Stdlib: preg_match past-end offset binds empty $matches (#25313)

[PurHur]

Summary

• When preg_match / preg_match_all $offset is past the subject, php-src still initializes $matches to [] while returning false + PREG_INTERNAL_ERROR.
• VM: VmPregPure fills []; binders write when the engine produced an array (null sentinel preserves compile-failure leave-untouched).
• JIT: PregJitHelper::matchExArgv stores empty HT on past-end; PregMatchRuntime fail path writes it when present.

Closes #25313

Test plan

• Zend/VM/JIT match on test/repro/maintainer_gap_preg_match_offset_past_end.php
• vendor/bin/phpunit --filter preg_match_offset_past_end — OK (2 tests)
• AOT segfault on this surface is pre-existing (not introduced here)

php-src reference

• ext/pcre/php_pcre.c — php_pcre_pce_execute() early return still initializes $matches

Made with Cursor