Chained subscript read where the first index misses segfaults (null-fallback sentinel dereferenced as an array pointer)

[mirchaemanuel]

Summary

In a chained subscript read, a miss on the first index (so the miss fallback becomes the receiver of the second read) segfaults: for a refcounted element type the null fallback materializes the scalar sentinel 0x7fff_ffff_ffff_fffe instead of a null container, and the consuming outer read then loads the array length header from that sentinel address and faults.

A miss on the second index alone behaves correctly (warns, yields empty string, exits 0, heap clean) — only a first-index miss whose fallback is consumed as a container crashes.

Environment

• elephc main e63d5d337 (v0.26.0-158), macOS arm64 (Apple Silicon); PHP 8.4.23 as behavioral reference.

Repro

<?php
$a = [];
for ($i = 0; $i < 3; $i++) { $a[] = ['kw', 'word' . $i]; }
// Miss on the first index: the second read consumes the miss fallback.
$x = (string) $a[7][1];
echo 'x=' . $x . "\n";
echo 'done' . "\n";

elephc miss_inner.php && ./miss_inner    # also reproduces with --heap-debug

Observed

Warning: Undefined array key 7

then SIGSEGV (exit 139). The two echo lines never run.

Expected (PHP 8.4.23)

Warning: Undefined array key 7 …
Warning: Trying to access array offset on null …
x=
done

exit 0.

Notes

• Suspected mechanism: emit_array_get_null_fallback (src/codegen/lower_inst/arrays.rs, the _ => arm) materializes the scalar sentinel for refcounted element types; the consuming array_get then executes emit_load_from_address(len, array_reg, 0) against the sentinel value as if it were an array pointer.
• The working variant for contrast: $a[1][7] (first read hits, second misses) warns and continues correctly.
• Reproduces identically on pristine main and on the fix(codegen): release the inner-container temporary of a chained subscript read #524 branch (that fix only releases valid intermediates; the miss fallback path is untouched).
• Found while regression-testing fix(codegen): release the inner-container temporary of a chained subscript read #524. Severity: crash on legitimate PHP (an out-of-range read that PHP handles with warnings).

[mirchaemanuel]

Fix PR: #533. While fixing it the crash class turned out much wider than this report: on main, isset($a[7][1]), $a[7][1] ?? …, string-keyed $m['nope']['x'], 3-level chains with a first/middle miss, and foreach over a missed element all segfault through the same unguarded sentinel (compounded by IsNull being hard-coded false for statically-container-typed slots, which let $a[7] ?? [] propagate the sentinel into foreach). The PR guards every container consumer against the null/sentinel pair via one shared dual-arch helper, keeps isset/?? silent across the whole subscript chain (PHP semantics), and adds 10 regression tests — all previously-crashing shapes now exit 0 with PHP-equivalent output.