Nested write into an Array(Mixed) element ($a[$i][$j] = ...) is silently lost: the parent keeps the stale inner array

[mirchaemanuel]

Summary

A nested write into an Array(Mixed) element — $a[$i][$j] = ... — is silently lost: the program compiles and runs, but the parent array keeps the stale inner array (a correctness miscompile), and the mutated copy leaks.

This is the only nested-write shape that compiles at all: on a homogeneous typed nested array the same statement is a compile-time error (error[4:1]: Nested array assignment requires a Mixed or ArrayAccess target), so the Mixed path below is the supported target shape — and it miscompiles.

Environment

• elephc main e63d5d337 (v0.26.0-158), macOS arm64 (Apple Silicon); PHP 8.4.23 as behavioral reference.

Repro

<?php
// Heterogeneous elements force Array(Mixed), the supported nested-write target shape.
$a = [['x', 'y0'], ['x', 'y1'], ['x', 'y2'], 7];
$a[2][1] = 'patched';
echo $a[2][1] . "\n";
echo $a[1][1] . "\n";

elephc --heap-debug write_read.php && ./write_read

Observed

y2
y1
HEAP DEBUG: allocs=24 frees=10 live_blocks=14 live_bytes=744 peak_live_bytes=1144
HEAP DEBUG: leak summary: live_blocks=14 live_bytes=744

The write is silently lost (y2 instead of patched), plus 14 leaked blocks.

Expected (PHP 8.4.23, verbatim)

patched
y1

Notes

• Suspected mechanism: the nested-lvalue write path on a Mixed element mutates a materialized copy of the inner array (the boxed Mixed cell's payload is unboxed/copied rather than written back through the parent slot), so the parent keeps the stale inner array and the mutated copy leaks.
• With the fix(codegen): release the inner-container temporary of a chained subscript read #524 fix applied, the wrong output is byte-identical (y2 / y1); only the leak count changes (14 → 6, from the released chained-read intermediates in the two echo lines) — the miscompile itself is unaffected.
• Severity: silent data loss on a construct that compiles without warnings; arguably the most severe of the batch filed from this test run.
• Found while regression-testing fix(codegen): release the inner-container temporary of a chained subscript read #524.