Perf: keep native-long +/−/* on TYPE_NATIVE_LONG hot path (#36189)

[PurHur]

Summary

• JitLongArithOverflow::binaryNativeLong() no longer boxes every native-long +/-/* into __value__ after AOT: integer overflow wraps instead of promoting to float — silent wrong arithmetic #31964
• Hot path returns TYPE_NATIVE_LONG (direct i64 SSA) — restores typed-recursion performance (fibo_r disassembly has 0 __value__* calls)
• Literal overflow still handled by tryFoldBinary; boxed operands still use writeBoxedBinary

Closes #36189

Root cause

#31964 (#89867d206f) routed all native-long arithmetic through writeBoxedBinary, forcing 7-way value dispatch on every n-2 / + in fibo_r.

Verification

./script/aot-smoke.sh                                    → 8/8
make dev-verify-fast                                     → OK (66s)
make north-star5-verify-fast                               → OK
./script/phpunit.sh --filter 'IntArithOverflowPromote31964AotTest|IntSubOverflowPromote32422AotTest' → 3/3

# fibo(30) in Docker:
php bin/compile.php -o /tmp/fibo30 "benchmarks/fibo(30).php"
time /tmp/fibo30                                         → 0.012s (was ~0.13s)
objdump -d --disassemble=fibo_r /tmp/fibo30 | grep __value__ | wc -l → 0 (was ~400 insn path)

test/repro/issue_int_sub_overflow.php AOT               → float promotion OK

Not covered

• script/differential-sweep.sh --aot --repeat 3 (not run this run — no lowering-shape change beyond native-long pair fast path)
• Runtime overflow on variable⊗variable native-long pairs without constant fold (rare; boxed paths unchanged)

Made with Cursor