fix(aot): stabilize explode() indexed string reads

[PurHur]

Summary

• Fix intermittent free(): invalid pointer when AOT code uses explode(...)[n] (e.g. second line of test/fixtures/aot/cases/explode.phpt).
• Pin the packed hashtable across __hashtable__readStringAt, return an owned string via __string__separate, and copy before __value__writeString so hashtable entries are never stolen.

Root cause

Temporary explode() hashtables could be freed before indexed string reads finished. __value__writeString could also take ownership of pointers still stored in the table.

Test output (Docker php-compiler:22.04-dev, LLVM at /opt/llvm9)

./script/docker-ci-local.sh  # harness: tar-pipe when bind-mount empty

=== AotTest ===
OK (44 tests, 52 assertions)

=== explode.phpt stress (stdin compile, 20 runs) ===
failures: 0/20

(Baseline before fix: ~25–35% failure rate on the same stress loop.)

Test plan

• php vendor/bin/phpunit test/aot/AotTest.php in Docker
• 20× manual compile/run of explode.phpt FILE section
• ./script/docker-ci-local.sh full suite (recommended before merge)

Made with Cursor