JIT: cache __value__ type tags in emitBoxedNumericResult (#36217)

[PurHur]

Summary

• Load each operand's __value__::type byte once in emitBoxedNumericResult for promotion checks and float conversion
• Extract valueBoxToDoubleWithTypeByte, loadTypeByte, typeByteIsDouble, typeByteIsString helpers
• First slice of Perf: untyped loop counters and untyped user calls run boxed through __value__ with per-op type dispatch — add guarded speculation (unboxed i64 loop phis, unboxed call arguments) with the generic path as bail-out (lib/JIT.php, lib/JIT/JitValueNumeric.php, lib/JIT/Call/Native.php) (re-#23483) #36217 (tag caching) toward reducing per-op type dispatch in untyped arithmetic

Closes #36217 (partial — loop-counter and call-argument speculation remain follow-ups)

Test plan

./script/phpunit.sh --filter 'Issue34674|Issue34678|value_string_arith'
# OK (3 tests, 25 assertions)

make dev-verify-fast
# aot-smoke: 9 passed, 0 failed
# VM differential tier-0: 15/15 match Zend
# dev-verify-fast: OK (108s wall)

Not run: full script/differential-sweep.sh --aot --repeat 3 (no lowering semantics change expected; tag loads are CSE-equivalent)

Made with Cursor