AOT: XPath item() live walk + tag-list attrs for setIdAttribute (#35447)

[PurHur]

Summary

• Closes AOT: DOMXPath query()->item()->setIdAttribute segfaults — compile-time attrs stolen from childNodes[$N] (ext/dom/xpath.c) #35447 — DOMXPath::query('//b')->item(0)->setIdAttribute('id', true) SIGSEGV'd on AOT while Zend registered id y.
• Root cause (two parts): (1) rememberCompileTimeChildIndex ignored XPath lastQueryTag and stamped childNodes[$N] attrs (id=x); (2) XPath item() always rematerialized a detached clone so NestedJIT setIdAttribute had no ownerDocument.
• Fix: map XPath tag like getElementsByTagName (Regression: AOT setIdAttribute via getElementsByTagName()->item() registers wrong id (re-#33957, ext/dom/element.c) #35433), and prefer pinned-root live walk for XPath item() with rematerialize fallback (Regression: AOT DOMXPath::query() segfaults after length — VM/JIT match Zend (ext/dom/xpath.c) #27275).

php-src: ext/dom/xpath.c (query), ext/dom/nodelist.c (item), ext/dom/element.c (setIdAttribute → xmlAddID).

Test plan

• ./script/aot-smoke.sh → 8 passed, 0 failed
• Zend vs AOT repro test/repro/aot_dom_xpath_item_setidattribute.php → identical (tag=b / attr=y / y=b / x=null)
• ./script/phpunit.sh --filter DomXPathItemSetIdAttribute35447AotTest → OK (2 tests, 16 assertions)
• Regression: AOT setIdAttribute via getElementsByTagName()->item() registers wrong id (re-#33957, ext/dom/element.c) #35433 fixture dom_setidattribute_getelementbyid_aot.php still green

Made with Cursor