Fix: array_map dim-fetch haystack over prior FuncCall (#36355)

[PurHur]

Summary

• Bug: $data = json_decode(...); array_map('intval', $data['scores']) mapped the outer assoc array (1,1 from array+bool) because leadingCallbackFirstHaystackFuncCallBeforeCfgCall bound haystack ARG_SEND to the prior FuncCall EXEC_RETURN instead of the intervening ArrayDimFetch.
• Fix: for dead-temp array_map haystack arg Php stdlib specs implementation #1, prefer resolvePrecedingArrayDimFetchCallArgSlot before the FuncCall producer path.
• php-src: ext/standard/array.c — PHP_FUNCTION(array_map) / Z_PARAM_ARRAY for $array.

Closes #36355

Verification

export PHP_COMPILER_OPCACHE_CLI=0
php bin/vm.php test/differential/cases/i36355_array_map_json_dim_haystack.php
# Zend/VM/AOT: 90,70,100,80 / 4
php bin/vm.php test/repro/i36221_json_array_map_sprintf.php
# 90,70,100,80 ×3
php bin/print.php … → TYPE_ARG_SEND($10) after TYPE_ARRAY_DIM_FETCH($10,…)
./script/aot-smoke.sh → 9 passed, 0 failed; size gate OK
./script/phpunit.sh --filter 'InlineCallArgProducerSlotTest::testArrayMap…'
# 11 pass; 2 null-haystack slot asserts fail on master too (unchanged)

Not covered: inline implode inside sprintf arg list (sibling #36353 shape); full differential-sweep.sh --aot --repeat 3.

Made with Cursor