AOT: DOMXPath //@* NodeList::item(N>0) host-fold materialization (#32003)

[PurHur]

Summary

• Fix AOT segfault when DOMNodeList::item(N) is called with N > 0 on host-folded XPath attribute-axis node-sets (//@*, //a/@*, //attribute::*, etc.).
• Root cause: compile-time folding only cached item(0) via DomUserScriptElementCacheLlvm; further indices fell through to DomNodeListItemRuntime and crashed.
• Materialize item(N) from the host Zend node-set at compile time (JitDomXPathQueryUserScript::hostXPathAxisNodeAt + JitDomNodeListItemUserScript::materializeNthXPathAxisMatch).
• Extend dom_xpath_attr_star.phpt to assert star1 / star2 node names.

php-src reference: ext/dom/xpath.c — attribute axis node-set in document order.

Verification

./script/aot-smoke.sh
# aot-smoke: 8 passed, 0 failed

./script/phpunit.sh --filter DomXpathAttrStarAotTest
# OK (1 test, 5 assertions)

./script/docker-exec.sh -- bash -lc 'php bin/compile.php -o /tmp/x.bin test/repro/aot_dom_xpath_attr_star_32003.php && /tmp/x.bin'
# star=3 / star0=id / a_star=2 / axis=3 / named=1

Not covered

• Held NodeLists iterated inside a helper when the translation unit contains many distinct XPath queries still share one compile-time axis expr slot (test/repro/maintainer_gap_dom_xpath_attr_star.php); per-list snapshot follow-up needed.
• ./script/release-readiness.sh not run (Pillar 1 probe owned separately).

Closes #32003

Made with Cursor