fix(codegen): guard container consumers against the null-container sentinel (chained-read miss segfault)

CHANGELOG.md

@@ -12,6 +12,7 @@ Releases are listed newest first.
 - Added PHP 8.3 typed class constants for classes, interfaces, traits, and enums. Declared types are enforced for initializers and inherited overrides, including covariant narrowing, and are exposed through `ReflectionClassConstant::hasType()` and `getType()`; untyped constants and enum cases retain PHP-compatible reflection defaults.
 - Fixed `--web --max-requests` crash-loop accounting (issue #516): workers that exit after a planned request-quota recycle now use a dedicated status that the master excludes from startup-death streaks, so sustained traffic with a low quota keeps respawning workers instead of shutting down the server; genuine setup failures, other exit codes, and signal deaths still feed the guard.
 - Fixed nullable chained array reads (issue #525): consuming a value from a `?array` receiver now releases the one-shot hidden owned Mixed temporary created by nullable access, on both null and non-null paths, without invalidating the extracted result or double-releasing repeated reads.
+- Fixed chained container reads after a missing outer array offset (issues #526 and #554): indexed, associative, mixed-key, truthiness, `empty()`, `(bool)`, `count()`, spread-length, object-property, and method-call consumers now recognize null-container receivers before dereferencing them, preventing segfaults across every supported target. Direct nested reads emit PHP's missing-key and null-offset diagnostics, associative misses warn consistently, and invalid `count()`, spread, and method operations raise catchable PHP errors without evaluating skipped method arguments; `isset()`, `empty()`, and null coalescing remain silent across the full subscript chain, string-valued misses retain their null marker so `??` selects its default without conflating real empty strings, and `foreach` skips a missing container instead of crashing.
 - Fixed owned boxed Mixed temporaries leaking after string conversion (issue #527): explicit `(string)` casts plus implicit concatenation and interpolation now release detached Mixed sources, including by-value `foreach` element reads and non-null unions represented as Mixed; borrowed, persistent, moved, and non-heap values remain release no-ops.
 - Fixed boxed Mixed values leaking when nested loops reinitialize a local whose storage widens after lowering (issue #534): EIR now records a deferred `ReleaseLocalSlot` before the overwrite, prunes it for final scalar or ref-bound slots, and lowers it using the final slot representation. Cleanup is flow-sensitive across conditional ref-cell promotion, aliases, by-reference `foreach` and pointer paths, and widened parameters, preventing both missed releases and double frees with the EIR optimizer enabled or disabled.
 - Fixed function- and method-local indexed arrays leaking previous COW hash generations after promotion to string-keyed associative storage (issue #538): lowering now releases the boxed Mixed slot owner before consuming mutations and finalizes provisional concrete-load releases against the slot's final storage type. This preserves real COW aliases while avoiding an artificial clone on every insertion, leaving heap-debug clean with the EIR optimizer enabled or disabled across every supported target.

docs/internals/builtins/misc/empty.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/types/signatures.rs`](https://github.com/illegalstudio/elephc/blob/main/src/types/signatures.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1216](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1216) (`lower_empty`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1232](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1232) (`lower_empty`)
 - **Function symbol**: `lower_empty()`
 
 

docs/internals/builtins/string/strlen.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/string/strlen.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/string/strlen.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1077](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1077) (`lower_strlen`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1093](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1093) (`lower_strlen`)
 - **Function symbol**: `lower_strlen()`
 
 

docs/internals/builtins/type/boolval.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/boolval.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/boolval.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1174](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1174) (`lower_boolval`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1190](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1190) (`lower_boolval`)
 - **Function symbol**: `lower_boolval()`
 
 

docs/internals/builtins/type/floatval.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/floatval.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/floatval.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1140](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1140) (`lower_floatval`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1156](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1156) (`lower_floatval`)
 - **Function symbol**: `lower_floatval()`
 
 

docs/internals/builtins/type/intval.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/intval.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/intval.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1107](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1107) (`lower_intval`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1123](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1123) (`lower_intval`)
 - **Function symbol**: `lower_intval()`
 
 

docs/internals/builtins/type/is_array.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_array.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_array.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1601](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1601) (`lower_is_array`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1617](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1617) (`lower_is_array`)
 - **Function symbol**: `lower_is_array()`
 
 

docs/internals/builtins/type/is_bool.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_bool.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_bool.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1334](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1334) (`lower_static_type_predicate`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1350](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1350) (`lower_static_type_predicate`)
 - **Function symbol**: `lower_static_type_predicate()`
 
 

docs/internals/builtins/type/is_float.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_float.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_float.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1334](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1334) (`lower_static_type_predicate`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1350](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1350) (`lower_static_type_predicate`)
 - **Function symbol**: `lower_static_type_predicate()`
 
 

docs/internals/builtins/type/is_int.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_int.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_int.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1334](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1334) (`lower_static_type_predicate`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1350](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1350) (`lower_static_type_predicate`)
 - **Function symbol**: `lower_static_type_predicate()`
 
 

docs/internals/builtins/type/is_iterable.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_iterable.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_iterable.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1392](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1392) (`lower_is_iterable`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1408](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1408) (`lower_is_iterable`)
 - **Function symbol**: `lower_is_iterable()`
 
 

docs/internals/builtins/type/is_null.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_null.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_null.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1591](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1591) (`lower_is_null_builtin`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1607](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1607) (`lower_is_null_builtin`)
 - **Function symbol**: `lower_is_null_builtin()`
 
 

docs/internals/builtins/type/is_object.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_object.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_object.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1616](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1616) (`lower_is_object`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1632](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1632) (`lower_is_object`)
 - **Function symbol**: `lower_is_object()`
 
 

docs/internals/builtins/type/is_scalar.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_scalar.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_scalar.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1632](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1632) (`lower_is_scalar`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1648](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1648) (`lower_is_scalar`)
 - **Function symbol**: `lower_is_scalar()`
 
 

docs/internals/builtins/type/is_string.md

@@ -10,7 +10,7 @@ sidebar:
 ## Where it lives
 
 - **Signature**: [`src/builtins/types/is_string.rs`](https://github.com/illegalstudio/elephc/blob/main/src/builtins/types/is_string.rs)
-- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1334](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1334) (`lower_static_type_predicate`)
+- **Lowering**: [`src/codegen/lower_inst/builtins.rs`:1350](https://github.com/illegalstudio/elephc/blob/main/src/codegen/lower_inst/builtins.rs#L1350) (`lower_static_type_predicate`)
 - **Function symbol**: `lower_static_type_predicate()`
 
 

scripts/docs/builtin_registry.json

@@ -4784,7 +4784,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_boolval",
-      "codegen_line": 1174,
+      "codegen_line": 1190,
       "notes": [
         "Lowers `boolval()` using the same concrete scalar PHP truthiness rules as `IsTruthy`."
       ],
@@ -7717,7 +7717,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_empty",
-      "codegen_line": 1216,
+      "codegen_line": 1232,
       "notes": [
         "Lowers `empty()` for concrete scalar and array-like operands."
       ],
@@ -9476,7 +9476,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_floatval",
-      "codegen_line": 1140,
+      "codegen_line": 1156,
       "notes": [
         "Lowers `floatval()` for concrete scalar operands."
       ],
@@ -14509,7 +14509,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_intval",
-      "codegen_line": 1107,
+      "codegen_line": 1123,
       "notes": [
         "Lowers `intval()` for concrete scalar operands."
       ],
@@ -14718,7 +14718,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_is_array",
-      "codegen_line": 1601,
+      "codegen_line": 1617,
       "notes": [
         "Lowers `is_array()`: true for statically-known arrays/hashes, or a boxed Mixed/Union value",
         "whose runtime tag is an indexed (4) or associative (5) array. An `iterable`-typed value is",
@@ -14779,7 +14779,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_static_type_predicate",
-      "codegen_line": 1334,
+      "codegen_line": 1350,
       "notes": [
         "Lowers a static `is_*` predicate for concrete non-Mixed values."
       ],
@@ -15161,7 +15161,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_static_type_predicate",
-      "codegen_line": 1334,
+      "codegen_line": 1350,
       "notes": [
         "Lowers a static `is_*` predicate for concrete non-Mixed values."
       ],
@@ -15279,7 +15279,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_static_type_predicate",
-      "codegen_line": 1334,
+      "codegen_line": 1350,
       "notes": [
         "Lowers a static `is_*` predicate for concrete non-Mixed values."
       ],
@@ -15338,7 +15338,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_is_iterable",
-      "codegen_line": 1392,
+      "codegen_line": 1408,
       "notes": [
         "Lowers `is_iterable()` for concrete values and boxed Mixed payloads."
       ],
@@ -15520,7 +15520,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_is_null_builtin",
-      "codegen_line": 1591,
+      "codegen_line": 1607,
       "notes": [
         "Lowers `is_null()` for concrete scalar values and boxed Mixed payloads."
       ],
@@ -15638,7 +15638,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_is_object",
-      "codegen_line": 1616,
+      "codegen_line": 1632,
       "notes": [
         "Lowers `is_object()`: true for statically-known objects, or a boxed Mixed/Union value whose",
         "runtime tag is an object (6)."
@@ -15820,7 +15820,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_is_scalar",
-      "codegen_line": 1632,
+      "codegen_line": 1648,
       "notes": [
         "Lowers `is_scalar()`: true for int/float/string/bool, a non-null tagged scalar, or a boxed",
         "Mixed/Union value whose runtime tag is int (0), string (1), float (2), or bool (3). Null,",
@@ -15881,7 +15881,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_static_type_predicate",
-      "codegen_line": 1334,
+      "codegen_line": 1350,
       "notes": [
         "Lowers a static `is_*` predicate for concrete non-Mixed values."
       ],
@@ -27868,7 +27868,7 @@
       "checker_line": null,
       "codegen_file": "src/codegen/lower_inst/builtins.rs",
       "codegen_function": "lower_strlen",
-      "codegen_line": 1077,
+      "codegen_line": 1093,
       "notes": [
         "Lowers `strlen()` by coercing string-like values and returning the byte length."
       ],