vm: native foreach over non-by-ref non-local targets

Previously `foreach ($arr as [$a,$b])` / `as $obj->prop` / `as
Foo::$bar` / `as $k => [$a,$b]` etc. were AST-delegated via
OP_TRY_FINALLY, forcing the enclosing function out of slot-only mode
and re-running the whole loop through the AST tree walker.

Adds two opcodes:

  OP_FOREACH_STEP_PUSH (A=keyFlag, C=exhaust-jmp): like OP_FOREACH_STEP
  but pushes value (and key when A=1) onto the stack instead of storing
  into a local slot. Always Dup()s to match the AST runner's snapshot.

  OP_ASSIGN_WRITABLE (A=lhs-ast-idx): pops a value and writes it to the
  AST node at SubASTs[A] via the phpv.Writable interface — handles obj
  prop, array element, static prop, dynamic-name var, etc.

emitForeach now picks per-target shape:
- Both targets bare locals → OP_FOREACH_STEP (unchanged fast path).
- Destructure target → push value, OP_DESTRUCTURE_ASSIGN + refresh slots.
- Other Writable target → push value, OP_ASSIGN_WRITABLE + refresh slots.

By-ref (`as &$v`) still AST-delegates — the iterator needs to yield
refs, which OpForeachInit doesn't build yet. That's the next sub-step.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: MagicalTux

core/vm/opcode.go

@@ -394,6 +394,24 @@ const (
 	// crossing an enclosing finally.
 	OpFinallyEnd
 
+	// OP_FOREACH_STEP_PUSH is the stack-pushing variant of OP_FOREACH_STEP,
+	// used for foreach value/key targets that aren't a bare local (e.g.
+	// `foreach ($arr as [$a, $b])` or `as $obj->prop => $val`). If the
+	// iterator is exhausted it jumps by C as OP_FOREACH_STEP does;
+	// otherwise it pushes the current value onto the stack (always
+	// Dup()'d to match the AST runner's snapshot semantics). When A != 0
+	// the current key is pushed FIRST (below the value), so the emitter
+	// can pop+assign value then pop+assign key — matching the AST's
+	// "key write before value write" order.
+	OpForeachStepPush
+
+	// OP_ASSIGN_WRITABLE pops a value off the stack and writes it to
+	// the AST Writable node at SubASTs[A] via WriteValue. Used for
+	// foreach targets whose shape isn't a bare local (destructure,
+	// object prop, array element, …) so we can drive the loop natively
+	// while delegating only the per-iteration write.
+	OpAssignWritable
+
 	// Sentinel — keep last.
 	opLast
 )
@@ -521,4 +539,6 @@ var opNames = [...]string{
 	OpStaticVarBind:       "STATIC_VAR_BIND",
 	OpDestructureAssign:   "DESTRUCTURE_ASSIGN",
 	OpFinallyEnd:          "FINALLY_END",
+	OpForeachStepPush:     "FOREACH_STEP_PUSH",
+	OpAssignWritable:      "ASSIGN_WRITABLE",
 }

core/vm/vm.go

@@ -1019,6 +1019,40 @@ func (f *Frame) runUntilError(ctx phpv.Context) (retVal *phpv.ZVal, finished boo
 				return nil, false, err
 			}
 
+		case OpForeachStepPush:
+			it := f.iters[len(f.iters)-1]
+			if !it.Valid(ctx) {
+				f.pc = uint32(int32(f.pc) + ins.C())
+				break
+			}
+			cur, err := it.Current(ctx)
+			if err != nil {
+				return nil, false, err
+			}
+			// Match AST runner's "key written before value" order:
+			// push key first (deeper in stack), then value (on top).
+			// Consumers pop value first, assign value; then pop key,
+			// assign key — which yields key-write-then-value-write at
+			// the WriteValue level.
+			if ins.A() != 0 {
+				key, err := it.Key(ctx)
+				if err != nil {
+					return nil, false, err
+				}
+				f.push(key.Dup())
+			}
+			f.push(cur.Dup())
+
+		case OpAssignWritable:
+			val := f.pop()
+			lhs, ok := f.fn.SubASTs[ins.A()].(phpv.Writable)
+			if !ok {
+				return nil, false, fmt.Errorf("OP_ASSIGN_WRITABLE: SubASTs[%d] is not Writable (%T)", ins.A(), f.fn.SubASTs[ins.A()])
+			}
+			if err := lhs.WriteValue(ctx, val); err != nil {
+				return nil, false, err
+			}
+
 		case OpForeachUnwind:
 			it := f.iters[len(f.iters)-1]
 			if c, ok := it.(interface{ Cleanup() }); ok {

core/vm/vmcompiler/emit_stmt.go

@@ -549,28 +549,37 @@ func (e *emitter) emitSwitch(n compiler.SwitchNode) error {
 }
 
 func (e *emitter) emitForeach(n foreachNode) error {
-	// foreach-by-ref (`foreach($arr as &$v)`) and non-local targets
-	// (`foreach($arr as $obj->prop => $val)`, list destructure, etc.)
-	// are AST-delegated — the surrounding scope's body is flagged
-	// slot-unsafe by IsSlotSafe so the hashtable stays authoritative
-	// while the AST runs the loop.
-	if n.ForeachIsRef() || !isSimpleLocal(n.ForeachValue()) || (n.ForeachKey() != nil && !isSimpleLocal(n.ForeachKey())) {
+	// foreach-by-ref (`foreach($arr as &$v)`) still AST-delegates — the
+	// iterator needs to yield refs and the helper that snapshots arrays
+	// uses different CoW semantics. The slot-unsafe flag on the
+	// enclosing function (set by IsSlotSafe) keeps the hashtable
+	// authoritative for the AST loop. Non-simple-local targets WITHOUT
+	// by-ref take the native path below.
+	if n.ForeachIsRef() {
 		raw, ok := any(n).(phpv.Runnable)
 		if !ok {
-			return unsupportedf("foreach delegation: cannot retrieve raw Runnable")
+			return unsupportedf("foreach by-ref delegation: cannot retrieve raw Runnable")
 		}
 		idx := e.astIndex(raw)
 		e.emit(vm.OpTryFinally, idx, 0, 0)
 		e.emit(vm.OpRefreshSlots, 0, 0, 0)
 		return nil
 	}
-	valNode := n.ForeachValue().(variableNode)
-	valIdx := e.localIndex(valNode.VariableName())
 
-	keyIdx := uint16(0xFFFF)
-	if k := n.ForeachKey(); k != nil {
-		kn := k.(variableNode)
-		keyIdx = e.localIndex(kn.VariableName())
+	valIsLocal := isSimpleLocal(n.ForeachValue())
+	keyExpr := n.ForeachKey()
+	keyIsLocal := keyExpr == nil || isSimpleLocal(keyExpr)
+
+	// Compute the operand for OP_FOREACH_STEP / OP_FOREACH_STEP_PUSH.
+	// When both targets are bare locals, the in-place store path (OP_FOREACH_STEP)
+	// avoids the stack push/pop entirely.
+	valLocalIdx := uint16(0xFFFF)
+	keyLocalIdx := uint16(0xFFFF)
+	if valIsLocal {
+		valLocalIdx = e.localIndex(n.ForeachValue().(variableNode).VariableName())
+	}
+	if keyExpr != nil && keyIsLocal {
+		keyLocalIdx = e.localIndex(keyExpr.(variableNode).VariableName())
 	}
 
 	// Eval src and emit the init op. C is patched to point past the
@@ -586,7 +595,33 @@ func (e *emitter) emitForeach(n foreachNode) error {
 	loopHead := uint32(len(e.code))
 
 	// Step: jumps to unwind on iterator exhaustion.
-	stepPC := e.emit(vm.OpForeachStep, valIdx, keyIdx, 0)
+	useNative := valIsLocal && keyIsLocal
+	var stepPC uint32
+	if useNative {
+		stepPC = e.emit(vm.OpForeachStep, valLocalIdx, keyLocalIdx, 0)
+	} else {
+		// Push key (if present) and value onto stack.
+		keyFlag := uint16(0)
+		if keyExpr != nil {
+			keyFlag = 1
+		}
+		stepPC = e.emit(vm.OpForeachStepPush, keyFlag, 0, 0)
+		if keyExpr != nil {
+			e.pushStack(1) // key
+		}
+		e.pushStack(1) // value
+
+		// Pop value off the stack first, write to value target.
+		if err := e.emitForeachTargetWrite(n.ForeachValue()); err != nil {
+			return err
+		}
+		// Then pop key (if present) and write to key target.
+		if keyExpr != nil {
+			if err := e.emitForeachTargetWrite(keyExpr); err != nil {
+				return err
+			}
+		}
+	}
 
 	// Body
 	if err := e.emitStmt(n.ForeachCode()); err != nil {
@@ -618,6 +653,42 @@ func (e *emitter) emitForeach(n foreachNode) error {
 	return nil
 }
 
+// emitForeachTargetWrite pops a value off the stack and writes it to
+// the foreach target node `target`. Used when the value/key isn't a
+// bare local — the runtime push the value, this code consumes it.
+//
+//   - destructure (`[$a, $b]`) → OP_DESTRUCTURE_ASSIGN
+//   - any other Writable shape → OP_ASSIGN_WRITABLE delegating to the
+//     AST node's WriteValue (handles obj prop, array element, static
+//     prop, dynamic-name variable, etc.)
+//   - simple local → OP_STORE_LOCAL (only happens when this is called
+//     for the key side and the value side forced the push path)
+func (e *emitter) emitForeachTargetWrite(target phpv.Runnable) error {
+	if isSimpleLocal(target) {
+		idx := e.localIndex(target.(variableNode).VariableName())
+		e.emit(vm.OpStoreLocal, idx, 0, 0)
+		e.popStack(1)
+		return nil
+	}
+	if compiler.IsDestructureTarget(target) {
+		idx := e.astIndex(target)
+		// flags = 0 → stmt-context (drop the value, don't push it back).
+		e.emit(vm.OpDestructureAssign, idx, 0, 0)
+		e.popStack(1)
+		// Locals may have changed via destructure's WriteValue.
+		e.emit(vm.OpRefreshSlots, 0, 0, 0)
+		return nil
+	}
+	// Generic Writable (object prop, array access, static prop, …).
+	idx := e.astIndex(target)
+	e.emit(vm.OpAssignWritable, idx, 0, 0)
+	e.popStack(1)
+	// Conservatively refresh — the WriteValue may have set a local
+	// through OffsetSet that the slot cache doesn't see.
+	e.emit(vm.OpRefreshSlots, 0, 0, 0)
+	return nil
+}
+
 func (e *emitter) emitReturn(n returnNode) error {
 	v := n.ReturnValue()
 	if n.ReturnHasTypeHint() {