Compiler: fix substr() negative offset on FuncCall haystack (#17572)

[PurHur]

Summary

• Generalize substr(f(...), -N) inline producer wiring from sprintf-only to any nested FuncCall haystack (dechex, str_pad, etc.)
• Extract substrNestedHaystackFuncCallAtUnaryMinusPattern + shared EXEC_RETURN slot resolver
• Add compliance .phpt guard and unit test for dechex haystack

Closes #17572

Root cause

wireSubstrNestedSprintfCallArgSlot / rewireSubstrNestedSprintfArgSendSlots hard-coded sprintf as the nested callee. substr(dechex(255), -2) wired both ARG_SEND slots to the offset literal (-2) instead of the dechex EXEC_RETURN.

php-src reference

ext/standard/string.c — PHP_FUNCTION(substr) negative offset on dynamic string operand

Verification

./script/docker-exec.sh -- bash -lc 'php bin/vm.php test/repro/maintainer_gap_substr_sprintf_nested.php'
# exit 0

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter "testSubstrNestedDechexUsesFuncCallProducerSlot|substr_negative_offset_funccall|substr_nested_builtin_arg"'
# OK (5 tests, 9 assertions)

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && vendor/bin/phpunit --filter InlineCallArgProducerSlotTest::testSubstr'
# OK (5 tests, 20 assertions)

./script/ci-fast.sh
# exit 0

Made with Cursor