Fix 001-SimpleWeb AOT smoke munmap_chunk invalid pointer (#13995)

[PurHur]

Summary

• 001-SimpleWeb AOT binary crashed with munmap_chunk(): invalid pointer when htmlspecialchars() was applied twice to a (string) $_REQUEST[...] local
• Cache a single htmlspecialchars() result ($safeName) and reuse it in the page output
• Use $_REQUEST['name'] ?? '' without (string) cast (AOT (string) + htmlspecialchars() still has a separate compiler bug)

Closes #13995

Root cause (follow-up)

AOT JIT: repeated htmlspecialchars() on a local holding a superglobal string (especially after (string) cast) double-frees the underlying __string__*. Direct $_REQUEST[...] reads in each call site avoid the crash; a compiler fix belongs in JitStringBuiltinArg / (string) cast lowering.

Verification

./script/docker-exec.sh -- bash -lc 'rm -rf .phpc/smoke && ./script/examples-aot-smoke.sh'
# examples-aot-smoke: 001-SimpleWeb: ok

./script/docker-exec.sh -- bash -lc '"'"'ENV="QUERY_STRING=name=Smoke SCRIPT_NAME=/example.php REQUEST_URI=/example.php?name=Smoke"; \
  phpc build -o /tmp/app examples/001-SimpleWeb/example.php && env $ENV /tmp/app'"'"'
# full HTML, exit 0

vendor/bin/phpunit --filter testAotExecuteSimpleWeb test/unit/ExamplesCompileTest.php
# OK (2 tests)

Note: examples-aot-smoke still fails later on 004-ApiJson (Current basic block has no parent function) on this harness — reproduced on master before this change; separate from #13995.

Made with Cursor