match with heterogeneous mixed arms (object/array/string) dies at runtime coercing the object arm to string

[mirchaemanuel]

Summary

A match whose arms return heterogeneous mixed values (object / array / string) compiles but dies at runtime — the match-arm type unification appears to coerce the object arm to string.

Verified on

main (7396e65b), macOS ARM64.

Minimal reproduction

<?php
function pick(int $n): mixed {
    return match($n % 3) { 0 => new stdClass(), 1 => [1, 2], default => "s" };
}
$c = 0;
for ($n = 0; $n < 6; $n++) {
    $v = pick($n);
    $c += is_object($v) ? 10 : (is_array($v) ? 7 : 3);
}
echo $c;

Actual

Runtime fatal (Object of class stdClass could not be converted to string), no output.

Expected (PHP)

40

Notes

Found while stress-testing mixed-value shapes for the #484 review. The arms individually work; it is the heterogeneous unification of the match result that mis-coerces.

[mirchaemanuel]

Fix up in #492.

Root cause was exactly the suspected unification: lower_match typed its hidden merge temp with the syntactic join (wider_type_syntactic), which is scalar-biased — any Str arm collapses the whole join to Str, and it can never produce Mixed. Every arm was then coerced into that one type on store: the object arm through a fatal string cast (this report), the array arm through a silent one. The pairwise matrix was consistent: Str absorbs everything, null is absorbed, otherwise the last-folded arm's concrete type wins (object+int even failed to compile). The checker had an independent bug on the same construct — ExprKind::Match inference returned the first arm's type and ignored the rest, which is why the inferred-return variant died with runtime_call from PHP type Str to PHP type Object.

The fix mirrors the ternary lowering, which already gets this right (branch_merge_result_type → merge to Mixed, box each branch as-is): match arms now fold through the same merge machinery, and the checker joins all arms. Full before/after matrix in the PR.

Characterizing this also surfaced a pre-existing crash the fix would otherwise have newly routed match values into: gettype() on a nullable-int merge temp ($v = ($argc == 1) ? 1 : null; echo gettype($v); — segfaults on current main via ternary). Fixed in the same PR, with the wider emitter-dispatch pattern filed as #493 and the inferred-return nullability erasure as #494.