Fix AOT nullable ?string param returns via compile-time ?? rewrite (#8563)

[PurHur]

Summary

Fixes AOT segfault/abort when functions return explicit nullable parameters (?string $n → ?string) — the bootstrap-aot-link blocker tracked on #8561 / #8555.

PHP-in-PHP approach:

• Compile-time rewrite in lib/Compiler.php: return $param and return (null !== $param ? $param : null) lower to $param ?? null (proven AOT-safe coalesce path)
• cfgFunctionReturnCallbackType: nullable scalar returns use __value__* ABI (parity with cfgParamIsImplicitNullable)
• Cherry-pick JIT ?: merge arm-tail RETURN lowering from bootstrap-aot-link: VALUE-box concat + ordered float compare lowering #8555 (emitCfgReturnOperand)

Reference: Zend ext/standard coalesce semantics; php-src equivalent shapes for ?string param/return ABI.

Verification

php vendor/bin/phpunit test/unit/NullableNeNullTernaryRewriteTest.php test/unit/NullableStringReturnAbiTest.php
# OK (2 tests)

php bin/vm.php test/repro/aot_ternary_ne_null.php
php bin/jit.php test/repro/aot_ternary_ne_null.php
# hello

export PHP_COMPILER_BOOTSTRAP_AOT_LINK=1
php bin/compile.php -o /tmp/ne test/repro/aot_ternary_ne_null.php && /tmp/ne
# hello (exit 0; was segfault 139)

php bin/compile.php -o /tmp/v test/repro/aot_ternary_var_nullable.php && /tmp/v
# hello (exit 0)

php bin/compile.php -o /tmp/d test/repro/aot_nullable_param_direct_return.php && /tmp/d
# hello (exit 0)

make bootstrap-aot-link still has unrelated failures (hash/crypto/stdlib); this PR greens the nullable-param return repros that blocked ns_func.php-class patterns.

Closes #8563

Made with Cursor