AOT: fix hashtable string index reads and add array_fill PHPT

[PurHur]

Summary

• Adds test/fixtures/aot/cases/array_fill.phpt — end-to-end AOT compile/link/run for array_fill() with string values and integer keys.
• Fixes LLVM JIT/AOT codegen for packed-list index reads: elements stored as strings (e.g. from array_fill(0, 3, 'x')) were always loaded via __hashtable__readLongAt, so echo $a[0] printed 0 instead of the string.
• Introduces HashTableHelper::readIndexedToValueBox() and JitValueBox::copyFromPointer() so mixed-type hashtable slots are read by runtime type tag and assigned into boxed __value__ destinations.

Root cause

Variable::dimFetch() on TYPE_HASHTABLE used readLongAt when no static string type was expected. String slots written by array_fill still hold TYPE_STRING in the __value__ union.

Test output (Docker php-compiler:22.04-dev)

./script/docker-ci-local.sh
# … VM + serve phases …
PHPUnit: AOT (@group aot)
OK (91 tests, 225 assertions)

Manual spot-check:

php bin/compile.php -o /tmp/af - <<< '<?php $a=array_fill(0,3,"x"); echo $a[0],$a[1],$a[2],"\n";'
/tmp/af
# xxx

Test plan

• ./script/docker-ci-local.sh in php-compiler:22.04-dev
• vendor/bin/phpunit --group aot — 91 tests, 225 assertions

Made with Cursor