test(types): pin a narrowed union reaching a typed object parameter

[Guikingone]

Closes #703.

The issue's reproducer answers 2 on current main, not a heap address — the miscompilation is
gone. What was missing is anything that would catch it coming back, so this adds the pin.

class Box { public int $num_rows = 0; }
function get(): Box|bool { $b = new Box(); $b->num_rows = 2; return $b; }
function readnum(Box $b): int { return $b->num_rows; }
$r = get();
if (!($r instanceof Box)) { exit(1); }
echo readnum($r), "|", $r->num_rows;   // 2|2, matching PHP 8.5.10

The EIR still looks the way the issue describes

The analysis in #703 is still accurate about the IR: the argument is Heap(Mixed) php=Box|bool
and the parameter is Heap(Object), because a union slot is boxed storage and the slot's type is
flow-insensitive even where the checker has narrowed it. There is no Union→Object coercion in
call_arg_coercion.rs.

The unbox is the backend's, emitted at the call site:

ldur x0, [x29, #-72]
bl __rt_mixed_unbox
mov x0, x1
bl _fn_readnum

What is pinned

Four fixtures:

• the issue's own reproducer;
• the four union flavours that share that boxed representation — Box|bool, ?Box, a
  three-member Box|bool|int, and a two-class Box|Other, each of which used to hand the callee
  a different heap address;
• the five call shapes — plain function, instance method, static method, two arguments in one
  call, and an immediately-invoked closure;
• one that reads the emitted assembly and asserts the unbox precedes the call.

That last one earns its place. The failure was silent — no diagnostic, no crash, a different
wrong number on every run — and a value assertion alone would keep passing if num_rows ever
moved to offset zero, where the box address and the object address read the same. It matches each
target's spelling of the call (bl _fn_readnum, bl fn_readnum, call fn_readnum), and the
leading indent is deliberate: the directive .globl _fn_readnum contains bl _fn_readnum as a
substring.

All four match host PHP 8.5.10 byte for byte, with --ir-opt both on and off.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KSAAWPyNBq6dP2b5puN3wr

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge; the previous coverage and documentation concerns are fully addressed, with no new actionable issue established.

Summary

This PR adds regression coverage ensuring narrowed, boxed union values reach typed object parameters as object pointers rather than boxed storage.

• Covers four boxed union forms and five call shapes.
• Exercises both optimized and optimizer-disabled EIR paths.
• Adds a target-aware assembly assertion that checks for mixed-value unboxing before the typed call.
• Introduces a scoped thread-local optimizer override for parallel-safe test execution.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
    U[Union-typed local] --> N[instanceof narrowing]
    N --> M[Heap Mixed storage]
    M --> X[Call-site mixed unbox]
    X --> O[Typed Heap Object parameter]
    O --> P[Correct property value]

Loading

_{Reviews (6) · Last reviewed commit: "test(types): find the call on every targ..."}