Fix AOT function-scoped array append segfault (revert #36314 delref dtor CFG)

[PurHur]

Summary

• Reverts the #36314 / #36195 changes to lib/JIT/Builtin/Refcount.php::__ref__delref that segfault on the first $a[] = … inside a user function (g_fn_array_append.php, test/repro/issue_36252_fn_array_append.php).
• Restores the #36252 delref body: header-only free without __hashtable__dtor / misplaced emitPossibleGcRootOnDelref in the keep-alive CFG block.
• {main} append continued to work; function CV append was broken — differential g_fn_array_append 0/3, Zend 16000.

Root cause

Bisect on master: 4f814aad66 (#36252) passes fn append; HEAD with #36314 dtor wiring fails. Removing only __hashtable__dtor is insufficient — the #36195 GC-root emit placement corrupts the delref CFG for refcounted arrays in function frames.

Test plan

make dev-verify-fast                                    # OK (75s, aot-smoke 9/9)
make north-star5-verify-fast                            # OK
./script/docker-exec.sh -- bash -lc '
  source script/php-env.sh
  php bin/compile.php -o /tmp/fn.bin test/repro/issue_36252_fn_array_append.php
  /tmp/fn.bin 16000   # -> 16000
  php bin/compile.php -o /tmp/main.bin test/repro/issue_36252_main_array_append.php
  /tmp/main.bin 16000 # -> 16000
'

Follow-up: re-land #36215 dtor + #36195 GC-root with fn-append regression in differential corpus.

Closes #36215 (partial — dtor deferred)

Made with Cursor