fix(codegen): guard container consumers against the null-container sentinel (chained-read miss segfault)

[mirchaemanuel]

Fixes #526 — and the crash class turned out wider than the report: on main, all of these segfault (exit 139), not just the chained read: isset($a[7][1]), $a[7][1] ?? …, $m['nope']['x'], $a[9][0][0], $a[0][9][0], foreach ($a[7] ?? [] as $v), foreach ($a[7] as $v).

Root cause

emit_array_get_null_fallback (src/codegen/lower_inst/arrays.rs) materializes the in-band NULL_SENTINEL (0x7fff_ffff_ffff_fffe) for missed reads of refcounted element types, and every downstream container consumer dereferenced it unguarded: lower_array_get_{aarch64,x86_64} loaded the length header straight from it; the same held for __rt_hash_get, __rt_array_get_mixed_key, __rt_hash_iter_next (null-guarded 0 but not the sentinel), the isset array probe, and the foreach length snapshot. Compounding it, IsNull on statically-container-typed slots was hard-coded false, so $a[7] ?? [] evaluated the miss as non-null and propagated the sentinel into foreach.

Design

Consumer-side guards, keeping the sentinel as the established null-container representation — it is already what ??/isset compare against for scalars, what Throwable::getPrevious() uses for null objects, and what incref/decref already skip via heap-range checks, so it is GC-safe by construction. (Changing the fallback to a different representation was considered and rejected: the sentinel-as-null convention is load-bearing across comparisons, so a representation change would ripple much wider.)

• New shared emitter helper emit_branch_if_null_container (src/codegen_support/sentinels.rs): branch on reg == 0 || reg == NULL_SENTINEL, symmetric ARM64/x86_64 arms.
• Guarded: lower_array_get_* (jumps to the fallback past the warning, so the Silent variants stay silent automatically), the isset array probes, IsNull for Array/AssocArray/Iterable/Object, the foreach indexed-length snapshot; plus 3-instruction sentinel extensions of the existing null guards in __rt_hash_get, __rt_array_get_mixed_key, __rt_hash_iter_next (both arches each).
• One ir_lower change so isset/?? silence propagates through the whole subscript chain (isset($a[7][1]) must not warn at any level — PHP semantics).

Before → after (base v0.26.1 93f576168, macOS arm64; all post-fix runs exit 0 and are PHP-compared)

Case	before	after
$a[7][1] (issue repro)	warn + SIGSEGV	warn, x=, done, heap clean
$a[1][7] (contrast)	OK	byte-identical to baseline
isset($a[7][1])	SIGSEGV	false, no warning
$a[7][1] ?? 'dflt'	SIGSEGV	silent, no crash (yields '' — pre-existing gap, see notes)
$m['nope']['x'] string-keyed	SIGSEGV	NULL, mirrors the working direction
3-level miss at each level	2 of 3 SIGSEGV	NULL ×3, one warning per real miss
foreach ($a[7] ?? [] as $v) / foreach ($a[7] as $v)	SIGSEGV	iterates empty / warns and skips
Mixed-element miss	OK	unchanged

--heap-debug: the repro and every previously-crashing variant end clean; the leaks remaining on some second-index-miss paths are byte-identical on unmodified main (pre-existing; they belong to the leak family being fixed in #524/#531/#532 — verified composed: on a local merge of those PRs the same programs end clean).

Cross-arch verification

Both arch arms edited symmetrically in every touched emitter (diff-reviewed). Beyond that, I captured the actual x86_64 assembly on this host (user asm via a runtime-cache pre-seed, runtime asm via an as shim — the toolchain otherwise insists on assembling with the host as) and verified the emitted guards verbatim (test/jz + movabs sentinel + cmp/je) in array_get, the isset probe, is_null_container, the iterator length snapshot, __rt_hash_get, __rt_array_get_mixed_key, __rt_hash_iter_next. Executing x86_64 locally is not possible on this host — relying on CI for the run matrix.

Tests

10 new regression tests in tests/codegen/regressions/arrays.rs (crash repro asserting stdout+warning+exit, second-index guard, heap-clean assertion, isset/?? silence, string-key chain, 3-level chain, foreach direct + coalesce, Mixed-element guard); the exact fixtures exit 139 on main. Focused suites, 0 failures: arrays 347 (incl. the 10 new), array_basics 81, isset 21, nested 119, coalesce 54, foreach 105, is_null 18, previous 3, runtime_gc 122. Zero build warnings; scripts/check_asm_comments.py clean on all touched codegen files.

Notes for the maintainer

• Pre-existing gap, deliberately not addressed here: $a[7][1] ?? 'dflt' yields '' instead of 'dflt' because IsNull on a statically-Str slot is constant-false — identical behavior for the already-working $a[1][7] ?? 'dflt' on main. Fixing it means giving Str a null representation, which needs an audit of every empty-string producer; follow-up issue candidate.
• PHP's second diagnostic (Trying to access array offset on null / foreach() argument … null given) is not emitted — no such warning infrastructure exists, and the already-working miss path omits it too.
• By-ref foreach over a missed element and chained writes to missed elements are out of scope (read path only).
• Touches src/ir_lower/expr/mod.rs in different hunks than fix(ir_lower): release the nullable-access hidden temp after its consuming chained read #531/fix(ir_lower): release owned Mixed sources after string coercion (foreach element leak) #532 (and fix(codegen): release the inner-container temporary of a chained subscript read #524) — expected to auto-merge.

[nahime0]

Opened #554 to track the pre-existing statically-Str null-coalescing gap documented in this PR.

It covers both $a[7][1] ?? 'dflt' after this PR's sentinel guard and the already non-crashing $a[1][7] ?? 'dflt' behavior on main, with explicit controls ensuring that a legitimate empty string still does not select the default. The issue also captures the required audit of string null representation, storage classes, ABI paths, and ownership.

Keeping this separate lets #533 remain focused on preventing null-container sentinel dereferences while #554 owns the PHP-semantic follow-up.

[nahime0]

I opened separate follow-ups for the two write/by-reference cases called out as out of scope here:

• By-reference foreach over a missing array element dereferences the null-container sentinel #556 — by-reference foreach over a missing element dereferences the null-container sentinel and crashes.
• Chained writes through a missing array element fail to autovivify the parent #555 — chained writes through a missing intermediate element fail to autovivify the parent, lose the write, and leak.

This keeps #533 focused on read/by-value consumer safety. #556 also distinguishes the new crash from the separate by-ref loop issue in #345, while #555 links the existing-parent work in #529/#553.