Language: ArrayAccess $obj[$k] += n uses live offsetGet value (#31947)

[PurHur]

Summary

• Closes Language: ArrayAccess $obj[$k] += n TypeError mixed + int — Zend writes through by-ref offsetGet (zend_vm_def.h) #31947 — $obj[$k] += n / *= on a user ArrayAccess with by-ref offsetGet TypeErrored mixed + int because TYPE_ARRAYACCESS_OFFSET was used as the numeric operand.
• VM now unwraps the live offsetGet payload (Zend ZEND_ASSIGN_DIM_OP / zend_std_read_dimension BP_VAR_RW) and writes the result back through offsetSet, matching postfix ++.
• PHP implementation: lib/VM/Variable.php (numericOp / bitwiseOp / incDecOp), lib/VM/ArrayAccessDimension.php (read()). php-src: Zend/zend_vm_def.h, Zend/zend_interfaces.c, Zend/zend_object_handlers.c. No new runtime/*.c.

Test plan

• Issue repro (VM) — inc=2 / plus=3 / mul=3
• Issue repro (JIT) — same
• ./script/phpunit.sh --filter ArrayAccessAssignOp31947VMTest
• ./script/phpunit.sh --filter ArrayAccessAssignOp31947JITTest
• AOT of the repro — not finished in this run (~10 min, no emit); documented skip. JIT matches Zend.

Verification

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_arrayaccess_assign_op.php'

inc=2
plus=3
mul=3
EXIT:0

./script/docker-exec.sh -- bash -lc 'php bin/jit.php test/repro/maintainer_gap_arrayaccess_assign_op.php'

inc=2
plus=3
mul=3
EXIT:0

./script/phpunit.sh --filter ArrayAccessAssignOp31947VMTest

OK (1 test, 1 assertion)

./script/phpunit.sh --filter ArrayAccessAssignOp31947JITTest

OK (1 test, 1 assertion)

Not covered: full VMTest / JITTest suites, script/differential-sweep.sh, AOT native emit, ci-local.sh.

Made with Cursor