From 0da07cb06505af8dd665ecdbe18975417220c2ef Mon Sep 17 00:00:00 2001
From: Yurun <admin@yurunsoft.com>
Date: Wed, 15 Jul 2026 19:06:49 +0800
Subject: [PATCH 01/12] =?UTF-8?q?fix(compiler):=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E5=AF=B9=E6=9C=AA=E5=AE=9A=E4=B9=89=E5=8F=98=E9=87=8F=E4=BD=BF?=
 =?UTF-8?q?=E7=94=A8=20=3F=3F=3D=20=E6=97=B6=E7=9A=84=E7=BC=96=E8=AF=91?=
 =?UTF-8?q?=E9=94=99=E8=AF=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Parser/AssignOpTrait.php                       | 14 +++++++++++---
 .../coalesce/assign-coalesce-undefined-var.phpt    | 14 ++++++++++++++
 2 files changed, 25 insertions(+), 3 deletions(-)
 create mode 100644 tests/compiler/coalesce/assign-coalesce-undefined-var.phpt

diff --git a/src/Parser/AssignOpTrait.php b/src/Parser/AssignOpTrait.php
index cf826761..826cd011 100644
--- a/src/Parser/AssignOpTrait.php
+++ b/src/Parser/AssignOpTrait.php
@@ -862,6 +862,17 @@ trait AssignOpTrait
     protected function parseAssignOpCoalesce(Expr\AssignOp\Coalesce $expr): string
     {
         $this->checkLeftValue($expr->var);
+
+        // PHP 允许对未定义的简单变量使用 ??=（例如 `$a ??= 123`）：
+        // 此时 isset 为 false，直接执行赋值。需要提前声明该局部变量，
+        // 否则 isset 检查会因变量未定义而报错。此处必须声明为 Type::VAR
+        // （Variant），使其初值为 NULL，从而 isset 在运行时正确判定为
+        // false 并执行赋值；若使用原生类型，isset 恒为 true 会导致取到
+        // 未初始化的默认值（如 int(0)、空字符串）。
+        if ($this->isVarExpr($expr->var) and !$this->hasVar($this->parseIdentifier($expr->var))) {
+            $this->addLocalVar($this->parseIdentifier($expr->var), Type::VAR);
+        }
+
         $isset = $this->parseChainedExpr($expr->var, self::OP_ISSET);
 
         $var = $this->parseWritableIdentifier($expr->var);
@@ -878,9 +889,6 @@ trait AssignOpTrait
         if ($this->isVarExpr($expr->expr) and !$this->hasVar($right)) {
             $this->errorUndefinedVariable($expr->expr);
         }
-        if ($this->isVarExpr($expr->var) and !$this->hasVar($var)) {
-            $this->addLocalVar($var, $this->getNormalAssignType($this->detectTypeOfExpr($expr->expr)));
-        }
         return '(' . $isset . '?' . $var . ':(' . $var . ' = ' . $right . '))';
     }
 
diff --git a/tests/compiler/coalesce/assign-coalesce-undefined-var.phpt b/tests/compiler/coalesce/assign-coalesce-undefined-var.phpt
new file mode 100644
index 00000000..4aad8edb
--- /dev/null
+++ b/tests/compiler/coalesce/assign-coalesce-undefined-var.phpt
@@ -0,0 +1,14 @@
+--TEST--
+assign coalesce on undefined variable
+--FILE--
+<?php
+$a ??= 123;
+var_dump($a);
+
+$b ??= 'foo';
+$b ??= 'bar';
+var_dump($b);
+?>
+--EXPECT--
+int(123)
+string(3) "foo"

From 72cbdc500a1805dda5180ef0e7c714d47afcba6a Mon Sep 17 00:00:00 2001
From: Yurun <admin@yurunsoft.com>
Date: Wed, 15 Jul 2026 19:20:57 +0800
Subject: [PATCH 02/12] =?UTF-8?q?fix(compiler):=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E5=A3=B0=E6=98=8E=E5=85=88=E5=90=8E=E5=BD=B1=E5=93=8D=E8=B7=A8?=
 =?UTF-8?q?=E5=91=BD=E5=90=8D=E7=A9=BA=E9=97=B4=E6=8E=A5=E5=8F=A3=E7=B1=BB?=
 =?UTF-8?q?=E5=9E=8B=E6=A0=A1=E9=AA=8C?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Translator.php                            |  4 +-
 .../interface-impl-param-type-cross-ns.phpt   | 48 +++++++++++++++++++
 2 files changed, 50 insertions(+), 2 deletions(-)
 create mode 100644 tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt

diff --git a/src/Translator.php b/src/Translator.php
index 676618a3..ce370f1e 100644
--- a/src/Translator.php
+++ b/src/Translator.php
@@ -3249,8 +3249,8 @@ CODE;
             Type::STR => [['kind' => 'isString']],
             Type::ARRAY => [['kind' => 'isArray']],
             Type::RESOURCE => [['kind' => 'isResource']],
-            Type::OBJECT => $arg->class
-                ? [['kind' => 'instanceof', 'class' => $arg->class]]
+            Type::OBJECT => $arg->declaredClass
+                ? [['kind' => 'instanceof', 'class' => $arg->declaredClass]]
                 : [['kind' => 'isObject']],
             default => null,
         };
diff --git a/tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt b/tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt
new file mode 100644
index 00000000..acaec9e6
--- /dev/null
+++ b/tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt
@@ -0,0 +1,48 @@
+--TEST--
+Cross-namespace interface implementation with an interface-typed parameter must not be reported as incompatible
+--FILE--
+<?php
+namespace A {
+    use B\I1;
+    use B\I2;
+
+    abstract class Test implements I2
+    {
+        public function test(I1 $a): bool
+        {
+            return true;
+        }
+    }
+}
+
+namespace B {
+    interface I1
+    {
+    }
+
+    interface I2
+    {
+        public function test(I1 $a): bool;
+    }
+
+    class Impl1 implements I1
+    {
+    }
+}
+
+namespace {
+    class Concrete extends \A\Test
+    {
+    }
+
+    function main()
+    {
+        $obj = new Concrete();
+        var_dump($obj->test(new \B\Impl1()));
+        echo "done\n";
+    }
+}
+?>
+--EXPECT--
+bool(true)
+done

From f9516c43c98226a4d33cb0d3377feadbdab58dbe Mon Sep 17 00:00:00 2001
From: Yurun <admin@yurunsoft.com>
Date: Wed, 15 Jul 2026 19:47:04 +0800
Subject: [PATCH 03/12] =?UTF-8?q?fix(compiler):=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E6=8E=A5=E5=8F=A3=E4=B8=ADself=E8=BF=94=E5=9B=9E=E7=B1=BB?=
 =?UTF-8?q?=E5=9E=8B=E8=A7=A3=E6=9E=90=E9=94=99=E8=AF=AF?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/CompilerBase.php                          |  5 ++-
 .../class/interface-method-self-return.phpt   | 42 +++++++++++++++++++
 .../interface-self-return-namespaced.phpt     | 36 ++++++++++++++++
 3 files changed, 82 insertions(+), 1 deletion(-)
 create mode 100644 tests/compiler/class/interface-method-self-return.phpt
 create mode 100644 tests/compiler/namespace/interface-self-return-namespaced.phpt

diff --git a/src/CompilerBase.php b/src/CompilerBase.php
index 074a1517..fab95bf8 100644
--- a/src/CompilerBase.php
+++ b/src/CompilerBase.php
@@ -1017,7 +1017,10 @@ class CompilerBase implements PropertyAccessContext
 
     protected function getFullClassName(): string
     {
-        return ltrim($this->namespace . '\\' . $this->class, '\\');
+        // 在接口上下文中，$this->class 为空但 $this->interface 已设置，
+        // `self` 类型声明应解析为接口自身的完整名称。
+        $classLike = $this->class !== '' ? $this->class : $this->interface;
+        return ltrim($this->namespace . '\\' . $classLike, '\\');
     }
 
     protected function getFullMethodName(string $fullClassName, string $method): string
diff --git a/tests/compiler/class/interface-method-self-return.phpt b/tests/compiler/class/interface-method-self-return.phpt
new file mode 100644
index 00000000..90e44eab
--- /dev/null
+++ b/tests/compiler/class/interface-method-self-return.phpt
@@ -0,0 +1,42 @@
+--TEST--
+interface method with `self` return type implemented by class (fluent interface), and namespace block containing comments
+--FILE--
+<?php
+
+namespace {
+    interface TestInterface
+    {
+        public function get(): self;
+    }
+
+    class TestClass implements TestInterface
+    {
+        public int $value = 0;
+
+        public function get(): self
+        {
+            return $this;
+        }
+
+        public function setValue(int $value): self
+        {
+            $this->value = $value;
+            return $this;
+        }
+    }
+
+    function main()
+    {
+        $test = new TestClass;
+        // get() returns self, so the result still satisfies the interface
+        var_dump($test->get() instanceof TestInterface);
+        var_dump($test === $test->get());
+        // fluent chaining of self-returning methods
+        var_dump($test->get()->setValue(42)->value);
+    }
+}
+?>
+--EXPECT--
+bool(true)
+bool(true)
+int(42)
diff --git a/tests/compiler/namespace/interface-self-return-namespaced.phpt b/tests/compiler/namespace/interface-self-return-namespaced.phpt
new file mode 100644
index 00000000..cfda0bad
--- /dev/null
+++ b/tests/compiler/namespace/interface-self-return-namespaced.phpt
@@ -0,0 +1,36 @@
+--TEST--
+interface method `self` return type resolves to the interface's fully-qualified name inside a named namespace
+--FILE--
+<?php
+
+namespace App {
+    interface Chainable
+    {
+        public function chain(): self;
+    }
+
+    // comment inside a named namespace block (Stmt_Nop)
+    class Widget implements Chainable
+    {
+        public array $log = [];
+
+        public function chain(): self
+        {
+            $this->log[] = 'chain';
+            return $this;
+        }
+    }
+}
+
+namespace {
+    function main()
+    {
+        $w = new \App\Widget();
+        var_dump($w->chain()->chain() instanceof \App\Chainable);
+        var_dump(count($w->log));
+    }
+}
+?>
+--EXPECT--
+bool(true)
+int(2)

From 6daa3121834cf183c859f11755ab1866e7e1c52f Mon Sep 17 00:00:00 2001
From: Yurun <admin@yurunsoft.com>
Date: Wed, 15 Jul 2026 21:17:52 +0800
Subject: [PATCH 04/12] =?UTF-8?q?fix(compiler):=20=E6=8C=89=E5=80=BC?=
 =?UTF-8?q?=E6=B6=88=E8=B4=B9=E5=BC=95=E7=94=A8=E8=BF=94=E5=9B=9E=E8=B0=83?=
 =?UTF-8?q?=E7=94=A8=E6=97=B6=E6=AD=A3=E7=A1=AE=E5=88=86=E7=A6=BB=E5=BC=95?=
 =?UTF-8?q?=E7=94=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/CompilerBase.php                          | 22 +++++++++
 src/Generator/CallArgumentGenerator.php       |  7 +++
 src/Parser/ArrayExpressionTrait.php           |  4 +-
 .../dynamic-return-reference-argument.phpt    | 46 +++++++++++++++++++
 4 files changed, 77 insertions(+), 2 deletions(-)
 create mode 100644 tests/compiler/ref/dynamic-return-reference-argument.phpt

diff --git a/src/CompilerBase.php b/src/CompilerBase.php
index 074a1517..5888454c 100644
--- a/src/CompilerBase.php
+++ b/src/CompilerBase.php
@@ -1066,6 +1066,28 @@ class CompilerBase implements PropertyAccessContext
         return $this->wrapVoidExprAsNull($expr, $this->parseExpr($expr));
     }
 
+    /**
+     * 把一个"按引用返回"的调用在按值消费处解引用为值快照。
+     *
+     * 返回引用的调用会产生一个指向被调用方存储的活引用。当该调用被按值消费
+     * （例如作为按值函数参数、数组元素、按值返回等会触发 PHP 分离语义的上下文）
+     * 时，PHP 会在求值那一刻拷贝出值的快照，因此之后对别名存储的修改不应再可见。
+     * 我们通过把结果赋值给一个临时 php::Var 来分离引用（普通的 Var 赋值会断开
+     * 引用，而 php::Variant(php::Ref) 构造会保留引用），从而保留从左到右的求值顺序。
+     *
+     * 注意：二元/一元运算等操作数上下文应保持引用活动、在运算时读值，不应在此快照；
+     * 那些上下文由各自的解析器直接保留引用。
+     */
+    protected function materializeRefReturnAsValue(NodeAbstract $value, string $expr): string
+    {
+        if ($value instanceof Expr\CallLike && $this->resolveRefReturningCall($value) !== false) {
+            $tmpVar = $this->addTmpVar(Type::VAR);
+            $this->context->beforeStmtLines[] = $tmpVar . ' = ' . $expr . ';';
+            return $tmpVar;
+        }
+        return $expr;
+    }
+
     protected function getObjectPropVarName(string $object, string $prop): string
     {
         return self::OBJECT_PROP . $object . self::NAMESPACE_SEPARATOR . $prop;
diff --git a/src/Generator/CallArgumentGenerator.php b/src/Generator/CallArgumentGenerator.php
index 0347667e..79431f24 100644
--- a/src/Generator/CallArgumentGenerator.php
+++ b/src/Generator/CallArgumentGenerator.php
@@ -586,6 +586,13 @@ trait CallArgumentGenerator
 
     protected function materializeCallArgValue(NodeAbstract $value, string $expr): string
     {
+        // A call that returns by reference yields a live php::Ref aliasing the
+        // callee's storage. When such a call feeds a by-value argument, PHP takes
+        // a value snapshot at evaluation time (left to right), so later mutations
+        // to the aliased storage must not be observable. The dynamic ArgList keeps
+        // references verbatim (Ctor::CopyRef), so we dereference into a temporary
+        // value at the point of the call.
+        $expr = $this->materializeRefReturnAsValue($value, $expr);
         if (!$this->shouldMaterializeCallArg($value)) {
             return $expr;
         }
diff --git a/src/Parser/ArrayExpressionTrait.php b/src/Parser/ArrayExpressionTrait.php
index a920f62b..819cf8cf 100644
--- a/src/Parser/ArrayExpressionTrait.php
+++ b/src/Parser/ArrayExpressionTrait.php
@@ -60,7 +60,7 @@ trait ArrayExpressionTrait
         $this->indentLevel++;
         foreach ($items as $item) {
             $this->assertExprCanBeUsedAsValue($item->value, 'array value');
-            $value = $this->parseIdentifier($item->value);
+            $value = $this->materializeRefReturnAsValue($item->value, $this->parseIdentifier($item->value));
             if ($item->key) {
                 $this->assertExprCanBeUsedAsValue($item->key, 'array key');
                 $key = $this->parseArrayKey($item->key);
@@ -221,7 +221,7 @@ trait ArrayExpressionTrait
                 }
                 $value = $this->convertToRef($item->value);
             } else {
-                $value = $this->parseIdentifier($item->value);
+                $value = $this->materializeRefReturnAsValue($item->value, $this->parseIdentifier($item->value));
             }
             if ($item->unpack) {
                 $this->context->beforeStmtLines[] = $this->getIndent() . $tmpVar . '.merge(' . $value . ');';
diff --git a/tests/compiler/ref/dynamic-return-reference-argument.phpt b/tests/compiler/ref/dynamic-return-reference-argument.phpt
new file mode 100644
index 00000000..471881ef
--- /dev/null
+++ b/tests/compiler/ref/dynamic-return-reference-argument.phpt
@@ -0,0 +1,46 @@
+--TEST--
+Reference-returning calls are copied by value when used as call arguments or array elements
+--FILE--
+<?php
+
+function main()
+{
+    $v1 = &test1();
+    var_dump($v1);
+    $v2 = &test1();
+    var_dump($v2);
+    var_dump($v1, $v2);
+    $v1 = 0;
+    var_dump($v1, $v2);
+    var_dump(test1(), test2());
+    var_dump([test1(), test2()]);
+}
+
+function &test1()
+{
+    $callback = 'test2';
+    return $callback();
+}
+
+function &test2()
+{
+    static $value = 0;
+    ++$value;
+    return $value;
+}
+?>
+--EXPECT--
+int(1)
+int(2)
+int(2)
+int(2)
+int(0)
+int(0)
+int(1)
+int(2)
+array(2) {
+  [0]=>
+  int(3)
+  [1]=>
+  int(4)
+}

From 00023cc3decbb39eabf6c8fc6aece5dd35ef165c Mon Sep 17 00:00:00 2001
From: Yurun <admin@yurunsoft.com>
Date: Sun, 19 Jul 2026 08:55:16 +0800
Subject: [PATCH 05/12] =?UTF-8?q?fix(compiler):=20=E6=8B=92=E7=BB=9D?=
 =?UTF-8?q?=E6=89=80=E6=9C=89$$=E8=AF=AD=E6=B3=95=E8=80=8C=E9=9D=9E?=
 =?UTF-8?q?=E4=BB=85=E7=89=B9=E5=AE=9A=E8=A1=A8=E8=BE=BE=E5=BC=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 phpunit/code/variable-variable-arraydim.php | 8 ++++++++
 phpunit/src/VariableVariableTest.php        | 9 +++++++++
 src/CompilerBase.php                        | 2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 phpunit/code/variable-variable-arraydim.php
 create mode 100644 phpunit/src/VariableVariableTest.php

diff --git a/phpunit/code/variable-variable-arraydim.php b/phpunit/code/variable-variable-arraydim.php
new file mode 100644
index 00000000..9a5db13f
--- /dev/null
+++ b/phpunit/code/variable-variable-arraydim.php
@@ -0,0 +1,8 @@
+<?php
+
+function variable_variable_with_array_dim(): void
+{
+    $foo = ['bar' => 'hello'];
+    ${$foo['bar']} = 'world';
+    echo $hello;
+}
diff --git a/phpunit/src/VariableVariableTest.php b/phpunit/src/VariableVariableTest.php
new file mode 100644
index 00000000..f3ae8102
--- /dev/null
+++ b/phpunit/src/VariableVariableTest.php
@@ -0,0 +1,9 @@
+<?php
+
+class VariableVariableTest extends \BaseTest
+{
+    public function testVariableVariableWithArrayDimThrowsUnsupportedError(): void
+    {
+        $this->exec('The `$$` syntax is not supported', 'variable-variable-arraydim.php');
+    }
+}
diff --git a/src/CompilerBase.php b/src/CompilerBase.php
index 074a1517..6381503d 100644
--- a/src/CompilerBase.php
+++ b/src/CompilerBase.php
@@ -1273,7 +1273,7 @@ class CompilerBase implements PropertyAccessContext
 
     protected function parseVariable(Variable $expr): string
     {
-        if (is_object($expr->name) and $this->isVarExpr($expr->name)) {
+        if (is_object($expr->name)) {
             $this->fatalError($expr, 'The `$$` syntax is not supported');
         }
         if ($this->isSuperGlobal($expr->name)) {

From a1b09926a3831da3cc6463ec497e9c822be61676 Mon Sep 17 00:00:00 2001
From: Yurun <admin@yurunsoft.com>
Date: Sun, 19 Jul 2026 09:39:05 +0800
Subject: [PATCH 06/12] =?UTF-8?q?fix(compiler):=20=E4=BF=AE=E5=A4=8D?=
 =?UTF-8?q?=E7=B1=BB=E5=B8=B8=E9=87=8F=E7=BB=A7=E6=89=BF=E9=87=8D=E5=86=99?=
 =?UTF-8?q?=E5=8F=8A=E7=B1=BB=E5=9E=8B=E6=8E=A8=E6=96=AD?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- 正确处理 parent::、self:: 和 static:: 的常量引用与类型解析
- 支持 ::class 魔法常量的编译期求值与字符串类型推断
- 引用其他类常量时继承其实际类型，避免误判为 VAR
- 仅当父类常量有显式声明类型时才校验类型兼容性
- 运行时注册子类常量前先删除父类继承条目以避免重定义冲突
---
 src/Entity/ConstantDef.php                    |  2 +
 src/Parser/ClassConstantFetchTrait.php        | 11 +++
 src/Preprocessor.php                          | 71 ++++++++++++++++++-
 src/Resolver/ClassConstantValueTrait.php      | 10 +++
 src/Translator.php                            | 26 +++++--
 src/gen_stub.php                              | 41 +++++++----
 .../const/class-const-override-variants.phpt  | 51 +++++++++++++
 .../compiler/const/class-const-override.phpt  | 30 ++++++++
 8 files changed, 222 insertions(+), 20 deletions(-)
 create mode 100644 tests/compiler/const/class-const-override-variants.phpt
 create mode 100644 tests/compiler/const/class-const-override.phpt

diff --git a/src/Entity/ConstantDef.php b/src/Entity/ConstantDef.php
index 6c192322..ed587ee9 100644
--- a/src/Entity/ConstantDef.php
+++ b/src/Entity/ConstantDef.php
@@ -19,6 +19,8 @@ class ConstantDef
     public string $arrayExpr = '';
     public string $class = '';
     public ?NodeAbstract $valueExpr = null;
+    /** Explicit declared type (e.g. `const int FOO`); null for inferred/untyped constants. */
+    public ?string $declaredType = null;
 
     public function __construct(string $name, int $flags, string $type, string $value)
     {
diff --git a/src/Parser/ClassConstantFetchTrait.php b/src/Parser/ClassConstantFetchTrait.php
index 5d16ecb5..527a9c42 100644
--- a/src/Parser/ClassConstantFetchTrait.php
+++ b/src/Parser/ClassConstantFetchTrait.php
@@ -31,6 +31,17 @@ trait ClassConstantFetchTrait
                 $self = true;
                 $class = $this->class;
             }
+        } elseif ($class === 'parent') {
+            // `parent::` refers to the parent of the current class. Resolve it to
+            // the real parent class name and treat it like `self` for the purpose
+            // of constant/magic-class resolution.
+            $parentClass = $this->getParentClass($this->class);
+            if ($parentClass !== '' && $this->hasClass($parentClass)) {
+                $class = $this->getClass($parentClass)->name;
+            } else {
+                $class = $parentClass;
+            }
+            $self = true;
         }
 
         $const = $this->escapeString($this->parseIdentifier($expr->name));
diff --git a/src/Preprocessor.php b/src/Preprocessor.php
index 0273d2cd..f2253b45 100644
--- a/src/Preprocessor.php
+++ b/src/Preprocessor.php
@@ -757,24 +757,89 @@ class Preprocessor extends CompilerBase
                     'Scalar_String' => Type::STR,
                     default => Type::VAR,
                 };
+                // `::class` is a compile-time magic constant that always yields a string,
+                // so a constant declared as `X = self::class` (or `Foo::class`) must be
+                // typed as a string rather than a generic variant.
+                if ($type === Type::VAR
+                    && $const->value instanceof Node\Expr\ClassConstFetch
+                    && strtolower((string) $const->value->name) === 'class') {
+                    $type = Type::STR;
+                }
+                // A constant whose value references another class constant
+                // (e.g. `X = ParentClass::Y` or `X = self::Y`) must take the referenced
+                // constant's type. This keeps override compatibility checks and the C++
+                // declaration correct, mirroring PHP where overriding an untyped constant
+                // with a value of any (compatible) type is allowed.
+                if ($type === Type::VAR
+                    && $const->value instanceof Node\Expr\ClassConstFetch
+                    && $const->value->class instanceof Node\Name) {
+                    $refType = $this->resolveReferencedConstantType($const->value, $this->getFullClassName());
+                    if ($refType !== null) {
+                        $type = $refType;
+                    }
+                }
             }
             $constName = $this->parseIdentifier($const->name);
             if ($this->classDef->hasConstant($constName)) {
                 $this->fatalError($v, "Duplicate constant `{$constName}`");
             }
-            $constInfo = $this->parseClassLikeConstant($const, $flags, $type, $class);
+            $constInfo = $this->parseClassLikeConstant($const, $flags, $type, $class, $declaredType);
             $constInfo->class = $class;
             $this->classDef->constants[$constInfo->name] = $constInfo;
         }
     }
 
-    private function parseClassLikeConstant(Node\Const_ $const, int $flags, string $type, string $class = ''): ConstantDef
+    /**
+     * Resolve the compile-time type of a class constant whose value is a
+     * `ClassConstFetch` referencing another constant (e.g. `X = ParentClass::Y`
+     * or `X = self::Y`). Returns the referenced constant's type, or null when
+     * the reference cannot be resolved yet (for instance when the referenced
+     * class has not been prepared). `::class` always resolves to a string.
+     */
+    private function resolveReferencedConstantType(Node\Expr\ClassConstFetch $fetch, string $currentClass): ?string
+    {
+        $constName = $fetch->name->toString();
+        if (strcasecmp($constName, 'class') === 0) {
+            return Type::STR;
+        }
+        if (!($fetch->class instanceof Node\Name)) {
+            return null;
+        }
+        $className = $fetch->class->toString();
+        if (strcasecmp($className, 'self') === 0 || strcasecmp($className, 'static') === 0) {
+            $targetClass = $currentClass;
+        } elseif (strcasecmp($className, 'parent') === 0) {
+            $targetClass = $this->getParentClass($currentClass);
+        } else {
+            $targetClass = $this->getNamespacedClassName($className);
+        }
+        if ($targetClass === '' || !$this->hasClass($targetClass)) {
+            return null;
+        }
+        $def = $this->getClass($targetClass);
+        if (!$def->hasConstant($constName)) {
+            return null;
+        }
+        $refConst = $def->getConstant($constName);
+        // Follow the chain in case the referenced constant is itself an
+        // expression that resolves to another constant.
+        if ($refConst->type !== Type::VAR) {
+            return $refConst->type;
+        }
+        if ($refConst->valueExpr instanceof Node\Expr\ClassConstFetch) {
+            return $this->resolveReferencedConstantType($refConst->valueExpr, $targetClass);
+        }
+        return null;
+    }
+
+    private function parseClassLikeConstant(Node\Const_ $const, int $flags, string $type, string $class = '', ?string $declaredType = null): ConstantDef
     {
         $constName = $this->parseIdentifier($const->name);
         $constValue = $this->parseIdentifier($const->value);
 
         $constInfo = new ConstantDef($constName, $flags, $type, $constValue);
         $constInfo->valueExpr = $const->value;
+        $constInfo->declaredType = $declaredType;
 
         if ($this->context->beforeStmtLines) {
             $arrayExpr = '';
@@ -979,7 +1044,7 @@ class Preprocessor extends CompilerBase
                             default => Type::VAR,
                         };
                     }
-                    $constInfo = $this->parseClassLikeConstant($const, $this->parseModifiers($stmt->flags), $type, $class);
+                    $constInfo = $this->parseClassLikeConstant($const, $this->parseModifiers($stmt->flags), $type, $class, $stmt->type ? $type : null);
                     $this->interfaceDef->constants[$constName] = $constInfo;
                 }
                 continue;
diff --git a/src/Resolver/ClassConstantValueTrait.php b/src/Resolver/ClassConstantValueTrait.php
index 0853e993..a674fd7a 100644
--- a/src/Resolver/ClassConstantValueTrait.php
+++ b/src/Resolver/ClassConstantValueTrait.php
@@ -116,6 +116,16 @@ trait ClassConstantValueTrait
             if ($expr instanceof Node\Expr\ClassConstFetch && $expr->class instanceof Node\Name) {
                 $constName = $expr->name->toString();
                 $className = $expr->class->toString();
+                if (strcasecmp($constName, 'class') === 0) {
+                    // `::class` is a compile-time magic constant that resolves to the
+                    // fully qualified class name of the referenced class.
+                    if (strcasecmp($className, 'self') === 0 || strcasecmp($className, 'static') === 0) {
+                        $className = $class;
+                    } elseif (strcasecmp($className, 'parent') === 0) {
+                        $className = $this->getParentClass($class);
+                    }
+                    return ltrim($this->getNamespacedClassName($className, $this->getNamespaceOfClass($class)), '\\');
+                }
                 if (strcasecmp($className, 'self') === 0) {
                     $className = $class;
                 } elseif (strcasecmp($className, 'parent') === 0) {
diff --git a/src/Translator.php b/src/Translator.php
index 676618a3..7b61f827 100644
--- a/src/Translator.php
+++ b/src/Translator.php
@@ -3477,10 +3477,28 @@ CODE;
                     if ($parentConst->flags & Modifiers::PRIVATE) {
                         continue;
                     }
-                    if ($childConst->type !== $parentConst->type || $childConst->class !== $parentConst->class) {
-                        $this->fatalError($classStmt,
-                            "Declaration of `{$className}::{$name}` must be compatible " .
-                            "with `{$parentClass}::{$name}`");
+                    // PHP only enforces type compatibility when the parent constant
+                    // carries an explicit declared type. Overriding an untyped constant
+                    // with a value of any type is permitted, so the type check is skipped
+                    // in that case. Visibility is always enforced below.
+                    if ($parentConst->declaredType !== null) {
+                        // An untyped child constant whose value is an expression (e.g.
+                        // `X = ParentClass::Y`) is inferred as a variant. Resolve its real
+                        // type from the referenced constant so the compatibility check uses
+                        // the actual value type.
+                        $childType = $childConst->type;
+                        if ($childType === Type::VAR
+                            && $childConst->valueExpr instanceof Node\Expr\ClassConstFetch) {
+                            $resolved = $this->resolveReferencedConstantType($childConst->valueExpr, $this->getFullClassName());
+                            if ($resolved !== null) {
+                                $childType = $resolved;
+                            }
+                        }
+                        if ($childType !== $parentConst->type || $childConst->class !== $parentConst->class) {
+                            $this->fatalError($classStmt,
+                                "Declaration of `{$className}::{$name}` must be compatible " .
+                                "with `{$parentClass}::{$name}`");
+                        }
                     }
                     if ($this->getVisibilityRank($childConst->flags) < $this->getVisibilityRank($parentConst->flags)) {
                         $this->fatalError($classStmt,
diff --git a/src/gen_stub.php b/src/gen_stub.php
index f266157f..752c6b9b 100755
--- a/src/gen_stub.php
+++ b/src/gen_stub.php
@@ -2354,18 +2354,29 @@ class EvaluatedValue
                 }
 
                 if ($expr instanceof Expr\ClassConstFetch) {
+                    $constName = $expr->name->__toString();
+                    if (strcasecmp($constName, 'class') === 0) {
+                        // `::class` is a compile-time magic constant that resolves to the
+                        // fully qualified class name of the referenced class.
+                        $className = getClassConstFetchClassName($expr);
+                        if (strcasecmp($className, 'self') === 0 || strcasecmp($className, 'static') === 0) {
+                            return ClassInfo::$currentClass;
+                        }
+                        if (strcasecmp($className, 'parent') === 0) {
+                            return getTranslator()->getParentClass(ClassInfo::$currentClass);
+                        }
+                        return ltrim($className, '\\');
+                    }
                     $class = getClassConstFetchClassName($expr);
                     if ($class === 'self') {
-                        $constName = ClassInfo::$currentClass . "::" . $expr->name->__toString();
+                        $constName = ClassInfo::$currentClass . "::" . $constName;
                         if (isset($allConstInfos[$constName])) {
                             return formatConstValue($allConstInfos[$constName]->getValue($allConstInfos)->value);
                         } else {
-                            return formatConstValue(getTranslator()->getClassConstValue($expr, ClassInfo::$currentClass, $expr->name->toString()));
+                            return formatConstValue(getTranslator()->getClassConstValue($expr, ClassInfo::$currentClass, $constName));
                         }
-                    } elseif ($expr->name->__toString() === 'class') {
-                        return $class;
                     } else {
-                        return formatConstValue(getTranslator()->getClassConstValue($expr, $class, $expr->name->__toString(), ClassInfo::$currentClass));
+                        return formatConstValue(getTranslator()->getClassConstValue($expr, $class, $constName, ClassInfo::$currentClass));
                     }
                 } else {
                     $constName = $expr->name->__toString();
@@ -2490,16 +2501,14 @@ class EvaluatedValue
 
         // PHP single-quote to C double-quote string
         if ($this->type->isString()) {
-            if (
-                $this->expr instanceof PhpParser\Node\Expr\ClassConstFetch
-            ) {
-                if ($this->expr->class instanceof PhpParser\Node\Name\FullyQualified and
-                    $this->expr->name instanceof PhpParser\Node\Identifier and
+            if ($this->expr instanceof PhpParser\Node\Expr\ClassConstFetch) {
+                if ($this->expr->name instanceof PhpParser\Node\Identifier and
                     $this->expr->name->__toString() === 'class') {
-                    $expr = '"' . addcslashes($this->expr->class->name, '\\') . '"';
-                } else {
-                    return $this->value;
+                    // `::class` is a compile-time magic constant that resolves to the
+                    // fully qualified class name (already stored in $this->value).
+                    return '"' . addcslashes($this->value, '\\') . '"';
                 }
+                return $this->value;
             } elseif ($this->expr instanceof Expr\ConstFetch) {
                 return getTranslator()->getConstValue($this->expr->name->toString());
             } elseif (!($this->expr instanceof String_)) {
@@ -2899,6 +2908,12 @@ class ConstInfo extends VariableLike
         $code .= "\tzend_string *const_{$constName}_name = zend_string_init_interned(\"$constName\", sizeof(\"$constName\") - 1, true);\n";
         $nameCode = "const_{$constName}_name";
 
+        // A child class may override a constant inherited from its parent. The
+        // runtime copies the parent's constants into the child, so re-declaring
+        // the constant would fail with "Cannot redefine class constant".
+        // Drop any inherited entry first so the child's value replaces it.
+        $code .= "\tzend_hash_del(&class_entry->constants_table, $nameCode);\n";
+
         if ($this->exposedDocComment) {
             $commentCode = "const_{$constName}_comment";
             $escapedCommentInit = $this->exposedDocComment->getInitCode();
diff --git a/tests/compiler/const/class-const-override-variants.phpt b/tests/compiler/const/class-const-override-variants.phpt
new file mode 100644
index 00000000..32a085e4
--- /dev/null
+++ b/tests/compiler/const/class-const-override-variants.phpt
@@ -0,0 +1,51 @@
+--TEST--
+class const override variants (self::class, parent::class, references, multi-level)
+--FILE--
+<?php
+
+declare(strict_types=1);
+
+class Base
+{
+    public const NAME = 'Base';
+    public const GREETING = 'hello';
+    public const VALUE = 42;
+}
+
+class Other
+{
+    public const TAG = 'other';
+}
+
+class Mid extends Base
+{
+    public const NAME = Base::GREETING;       // 'hello'
+    public const SELF_NAME = self::class;     // 'Mid'
+    public const PARENT_NAME = parent::class; // 'Base'
+    public const CROSS = Other::TAG;          // 'other'
+}
+
+class Leaf extends Mid
+{
+    public const VALUE = Mid::NAME;           // 'hello' (overrides Base::VALUE int with a string)
+    public const LEAF_NAME = self::class;     // 'Leaf'
+    public const GREET = Base::GREETING;      // 'hello'
+}
+
+function main()
+{
+    var_dump(Mid::NAME, Mid::SELF_NAME, Mid::PARENT_NAME, Mid::CROSS);
+    var_dump(Leaf::VALUE, Leaf::LEAF_NAME, Leaf::GREET);
+    var_dump(Base::VALUE, Leaf::VALUE);
+}
+?>
+--EXPECT--
+string(5) "hello"
+string(3) "Mid"
+string(4) "Base"
+string(5) "other"
+string(5) "hello"
+string(4) "Leaf"
+string(5) "hello"
+int(42)
+string(5) "hello"
diff --git a/tests/compiler/const/class-const-override.phpt b/tests/compiler/const/class-const-override.phpt
new file mode 100644
index 00000000..5d9e4c97
--- /dev/null
+++ b/tests/compiler/const/class-const-override.phpt
@@ -0,0 +1,30 @@
+--TEST--
+class const override referencing another constant
+--FILE--
+<?php
+
+declare(strict_types=1);
+
+abstract class ParentClass
+{
+    public const A = 'A';
+    public const B = 'B';
+}
+
+class TestClass extends ParentClass
+{
+    public const A = ParentClass::B;
+    public const B = 'bbb';
+}
+
+function main()
+{
+    var_dump(ParentClass::A, ParentClass::B);
+    var_dump(TestClass::A, TestClass::B);
+}
+?>
+--EXPECT--
+string(1) "A"
+string(1) "B"
+string(1) "B"
+string(3) "bbb"

From 8b76f841adad95c52fb3dfb868a4812889098d87 Mon Sep 17 00:00:00 2001
From: tianfenghan <rango@swoole.com>
Date: Sun, 19 Jul 2026 10:49:57 +0800
Subject: [PATCH 07/12] test(compiler): strengthen undefined coalesce
 assignment coverage

---
 src/Parser/AssignOpTrait.php                      | 15 ++++++---------
 .../coalesce/assign-coalesce-undefined-var.phpt   | 14 ++++++++++++++
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/src/Parser/AssignOpTrait.php b/src/Parser/AssignOpTrait.php
index 826cd011..dabef684 100644
--- a/src/Parser/AssignOpTrait.php
+++ b/src/Parser/AssignOpTrait.php
@@ -863,19 +863,16 @@ trait AssignOpTrait
     {
         $this->checkLeftValue($expr->var);
 
-        // PHP 允许对未定义的简单变量使用 ??=（例如 `$a ??= 123`）：
-        // 此时 isset 为 false，直接执行赋值。需要提前声明该局部变量，
-        // 否则 isset 检查会因变量未定义而报错。此处必须声明为 Type::VAR
-        // （Variant），使其初值为 NULL，从而 isset 在运行时正确判定为
-        // false 并执行赋值；若使用原生类型，isset 恒为 true 会导致取到
-        // 未初始化的默认值（如 int(0)、空字符串）。
-        if ($this->isVarExpr($expr->var) and !$this->hasVar($this->parseIdentifier($expr->var))) {
-            $this->addLocalVar($this->parseIdentifier($expr->var), Type::VAR);
+        // An undefined variable must exist before generating its isset check.
+        // Keep it as Variant so NULL remains distinguishable from native defaults.
+        $var = $this->isVarExpr($expr->var) ? $this->parseIdentifier($expr->var) : null;
+        if ($var !== null && !$this->hasVar($var)) {
+            $this->addLocalVar($var, Type::VAR);
         }
 
         $isset = $this->parseChainedExpr($expr->var, self::OP_ISSET);
 
-        $var = $this->parseWritableIdentifier($expr->var);
+        $var ??= $this->parseWritableIdentifier($expr->var);
         $propertyWriteTarget = $this->preparePropertyWriteTarget($expr->var);
 
         if ($propertyWriteTarget !== null) {
diff --git a/tests/compiler/coalesce/assign-coalesce-undefined-var.phpt b/tests/compiler/coalesce/assign-coalesce-undefined-var.phpt
index 4aad8edb..27dd886b 100644
--- a/tests/compiler/coalesce/assign-coalesce-undefined-var.phpt
+++ b/tests/compiler/coalesce/assign-coalesce-undefined-var.phpt
@@ -8,7 +8,21 @@ var_dump($a);
 $b ??= 'foo';
 $b ??= 'bar';
 var_dump($b);
+
+$c ??= null;
+var_dump(isset($c));
+$c ??= 'after-null';
+var_dump($c);
+
+for ($i = 0; $i < 2; $i++) {
+    $d ??= printf("default\n");
+}
+var_dump($d);
 ?>
 --EXPECT--
 int(123)
 string(3) "foo"
+bool(false)
+string(10) "after-null"
+default
+int(8)

From e231aa2404f2b1eced506e825484c6fdb98abab4 Mon Sep 17 00:00:00 2001
From: tianfenghan <rango@swoole.com>
Date: Sun, 19 Jul 2026 10:58:13 +0800
Subject: [PATCH 08/12] test(compiler): cover cross-namespace parameter
 variance

---
 src/Translator.php                             |  5 +++--
 .../interface-impl-param-type-cross-ns.phpt    | 18 ++++++++++++++++--
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/src/Translator.php b/src/Translator.php
index ce370f1e..e7c3838a 100644
--- a/src/Translator.php
+++ b/src/Translator.php
@@ -3242,6 +3242,7 @@ CODE;
             return $arg->typeCheck;
         }
 
+        $declaredClass = $arg->declaredClass ?: $arg->class;
         return match ($arg->type) {
             Type::INT => [['kind' => 'isInt']],
             Type::FLOAT => [['kind' => 'isFloat']],
@@ -3249,8 +3250,8 @@ CODE;
             Type::STR => [['kind' => 'isString']],
             Type::ARRAY => [['kind' => 'isArray']],
             Type::RESOURCE => [['kind' => 'isResource']],
-            Type::OBJECT => $arg->declaredClass
-                ? [['kind' => 'instanceof', 'class' => $arg->declaredClass]]
+            Type::OBJECT => $declaredClass
+                ? [['kind' => 'instanceof', 'class' => $declaredClass]]
                 : [['kind' => 'isObject']],
             default => null,
         };
diff --git a/tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt b/tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt
index acaec9e6..535212a7 100644
--- a/tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt
+++ b/tests/compiler/namespace/interface-impl-param-type-cross-ns.phpt
@@ -1,8 +1,9 @@
 --TEST--
-Cross-namespace interface implementation with an interface-typed parameter must not be reported as incompatible
+Cross-namespace interface implementation parameter compatibility is declaration-order independent
 --FILE--
 <?php
 namespace A {
+    use B\I0;
     use B\I1;
     use B\I2;
 
@@ -12,17 +13,28 @@ namespace A {
         {
             return true;
         }
+
+        public function testParent(I0 $a): bool
+        {
+            return true;
+        }
     }
 }
 
 namespace B {
-    interface I1
+    interface I0
+    {
+    }
+
+    interface I1 extends I0
     {
     }
 
     interface I2
     {
         public function test(I1 $a): bool;
+
+        public function testParent(I1 $a): bool;
     }
 
     class Impl1 implements I1
@@ -39,10 +51,12 @@ namespace {
     {
         $obj = new Concrete();
         var_dump($obj->test(new \B\Impl1()));
+        var_dump($obj->testParent(new \B\Impl1()));
         echo "done\n";
     }
 }
 ?>
 --EXPECT--
 bool(true)
+bool(true)
 done

From 6162185bd76c283c2a669370d24949e19c7fd5cc Mon Sep 17 00:00:00 2001
From: tianfenghan <rango@swoole.com>
Date: Sun, 19 Jul 2026 11:04:28 +0800
Subject: [PATCH 09/12] fix(compiler): scope interface self type resolution

---
 src/CompilerBase.php                          | 11 ++++++----
 src/Generator/TypeCheckGenerator.php          |  2 +-
 src/Resolver/NameResolutionTrait.php          |  2 +-
 .../interface-self-return-namespaced.phpt     | 20 +++++++++++++++++++
 4 files changed, 29 insertions(+), 6 deletions(-)

diff --git a/src/CompilerBase.php b/src/CompilerBase.php
index fab95bf8..310a79b7 100644
--- a/src/CompilerBase.php
+++ b/src/CompilerBase.php
@@ -1017,10 +1017,13 @@ class CompilerBase implements PropertyAccessContext
 
     protected function getFullClassName(): string
     {
-        // 在接口上下文中，$this->class 为空但 $this->interface 已设置，
-        // `self` 类型声明应解析为接口自身的完整名称。
-        $classLike = $this->class !== '' ? $this->class : $this->interface;
-        return ltrim($this->namespace . '\\' . $classLike, '\\');
+        return ltrim($this->namespace . '\\' . $this->class, '\\');
+    }
+
+    protected function getFullClassLikeName(): string
+    {
+        $name = $this->class !== '' ? $this->class : $this->interface;
+        return ltrim($this->namespace . '\\' . $name, '\\');
     }
 
     protected function getFullMethodName(string $fullClassName, string $method): string
diff --git a/src/Generator/TypeCheckGenerator.php b/src/Generator/TypeCheckGenerator.php
index 16dc4ae3..292967a1 100644
--- a/src/Generator/TypeCheckGenerator.php
+++ b/src/Generator/TypeCheckGenerator.php
@@ -104,7 +104,7 @@ trait TypeCheckGenerator
         }
 
         if ($name === 'self') {
-            $class = $this->getFullClassName();
+            $class = $this->getFullClassLikeName();
         } elseif ($name === 'parent') {
             $class = $this->classDef->extends ?? '';
         } elseif ($name === 'static') {
diff --git a/src/Resolver/NameResolutionTrait.php b/src/Resolver/NameResolutionTrait.php
index 307117e5..827db4a3 100644
--- a/src/Resolver/NameResolutionTrait.php
+++ b/src/Resolver/NameResolutionTrait.php
@@ -166,7 +166,7 @@ trait NameResolutionTrait
                 return $this->getTypeFromZendType($typeNameLower);
             } else {
                 if ($typeName === 'self') {
-                    $class = $this->getFullClassName();
+                    $class = $this->getFullClassLikeName();
                 } elseif ($typeName === 'parent') {
                     if (!$this->classDef) {
                         $this->fatalError($type, 'Cannot use "parent" type declaration outside a class');
diff --git a/tests/compiler/namespace/interface-self-return-namespaced.phpt b/tests/compiler/namespace/interface-self-return-namespaced.phpt
index cfda0bad..4d05a98a 100644
--- a/tests/compiler/namespace/interface-self-return-namespaced.phpt
+++ b/tests/compiler/namespace/interface-self-return-namespaced.phpt
@@ -7,6 +7,10 @@ namespace App {
     interface Chainable
     {
         public function chain(): self;
+
+        public function maybe(bool $present): ?self;
+
+        public function combine(self $other): self;
     }
 
     // comment inside a named namespace block (Stmt_Nop)
@@ -19,6 +23,16 @@ namespace App {
             $this->log[] = 'chain';
             return $this;
         }
+
+        public function maybe(bool $present): ?self
+        {
+            return $present ? $this : null;
+        }
+
+        public function combine(Chainable $other): self
+        {
+            return $this;
+        }
     }
 }
 
@@ -28,9 +42,15 @@ namespace {
         $w = new \App\Widget();
         var_dump($w->chain()->chain() instanceof \App\Chainable);
         var_dump(count($w->log));
+        var_dump($w->maybe(true) instanceof \App\Chainable);
+        var_dump($w->maybe(false));
+        var_dump($w->combine(new \App\Widget()) === $w);
     }
 }
 ?>
 --EXPECT--
 bool(true)
 int(2)
+bool(true)
+NULL
+bool(true)

From 848c763c0dfa63ea33a4207074377fa56c23cec6 Mon Sep 17 00:00:00 2001
From: tianfenghan <rango@swoole.com>
Date: Sun, 19 Jul 2026 11:09:22 +0800
Subject: [PATCH 10/12] test(compiler): cover expression variable names

---
 phpunit/code/variable-variable-function-call.php | 12 ++++++++++++
 phpunit/src/VariableVariableTest.php             |  5 +++++
 src/CompilerBase.php                             |  2 +-
 3 files changed, 18 insertions(+), 1 deletion(-)
 create mode 100644 phpunit/code/variable-variable-function-call.php

diff --git a/phpunit/code/variable-variable-function-call.php b/phpunit/code/variable-variable-function-call.php
new file mode 100644
index 00000000..26fd0ef1
--- /dev/null
+++ b/phpunit/code/variable-variable-function-call.php
@@ -0,0 +1,12 @@
+<?php
+
+function variable_name(): string
+{
+    return 'hello';
+}
+
+function variable_variable_with_function_call(): void
+{
+    ${variable_name()} = 'world';
+    echo $hello;
+}
diff --git a/phpunit/src/VariableVariableTest.php b/phpunit/src/VariableVariableTest.php
index f3ae8102..8afce89b 100644
--- a/phpunit/src/VariableVariableTest.php
+++ b/phpunit/src/VariableVariableTest.php
@@ -6,4 +6,9 @@ class VariableVariableTest extends \BaseTest
     {
         $this->exec('The `$$` syntax is not supported', 'variable-variable-arraydim.php');
     }
+
+    public function testVariableVariableWithFunctionCallThrowsUnsupportedError(): void
+    {
+        $this->exec('The `$$` syntax is not supported', 'variable-variable-function-call.php');
+    }
 }
diff --git a/src/CompilerBase.php b/src/CompilerBase.php
index 6381503d..eff7eab5 100644
--- a/src/CompilerBase.php
+++ b/src/CompilerBase.php
@@ -1273,7 +1273,7 @@ class CompilerBase implements PropertyAccessContext
 
     protected function parseVariable(Variable $expr): string
     {
-        if (is_object($expr->name)) {
+        if (!is_string($expr->name)) {
             $this->fatalError($expr, 'The `$$` syntax is not supported');
         }
         if ($this->isSuperGlobal($expr->name)) {

From 1128fb06c822daa7e0a1d24ad8556e35a36bb949 Mon Sep 17 00:00:00 2001
From: tianfenghan <rango@swoole.com>
Date: Sun, 19 Jul 2026 11:15:56 +0800
Subject: [PATCH 11/12] fix(compiler): preserve ref snapshot evaluation order

---
 src/CompilerBase.php                          | 17 +++-------
 .../dynamic-return-reference-argument.phpt    | 34 +++++++++++++++++++
 2 files changed, 39 insertions(+), 12 deletions(-)

diff --git a/src/CompilerBase.php b/src/CompilerBase.php
index 5888454c..e92ffb80 100644
--- a/src/CompilerBase.php
+++ b/src/CompilerBase.php
@@ -1067,23 +1067,16 @@ class CompilerBase implements PropertyAccessContext
     }
 
     /**
-     * 把一个"按引用返回"的调用在按值消费处解引用为值快照。
-     *
-     * 返回引用的调用会产生一个指向被调用方存储的活引用。当该调用被按值消费
-     * （例如作为按值函数参数、数组元素、按值返回等会触发 PHP 分离语义的上下文）
-     * 时，PHP 会在求值那一刻拷贝出值的快照，因此之后对别名存储的修改不应再可见。
-     * 我们通过把结果赋值给一个临时 php::Var 来分离引用（普通的 Var 赋值会断开
-     * 引用，而 php::Variant(php::Ref) 构造会保留引用），从而保留从左到右的求值顺序。
-     *
-     * 注意：二元/一元运算等操作数上下文应保持引用活动、在运算时读值，不应在此快照；
-     * 那些上下文由各自的解析器直接保留引用。
+     * Snapshot a reference-returning call before a by-value container can retain
+     * its php::Ref. Assigning to an existing Var detaches the reference, unlike
+     * constructing a Variant directly from Ref. Keep the assignment inline so
+     * earlier arguments or array elements retain PHP's evaluation order.
      */
     protected function materializeRefReturnAsValue(NodeAbstract $value, string $expr): string
     {
         if ($value instanceof Expr\CallLike && $this->resolveRefReturningCall($value) !== false) {
             $tmpVar = $this->addTmpVar(Type::VAR);
-            $this->context->beforeStmtLines[] = $tmpVar . ' = ' . $expr . ';';
-            return $tmpVar;
+            return '(' . $tmpVar . ' = ' . $expr . ')';
         }
         return $expr;
     }
diff --git a/tests/compiler/ref/dynamic-return-reference-argument.phpt b/tests/compiler/ref/dynamic-return-reference-argument.phpt
index 471881ef..aede4d2a 100644
--- a/tests/compiler/ref/dynamic-return-reference-argument.phpt
+++ b/tests/compiler/ref/dynamic-return-reference-argument.phpt
@@ -14,6 +14,9 @@ function main()
     var_dump($v1, $v2);
     var_dump(test1(), test2());
     var_dump([test1(), test2()]);
+    var_dump(['first' => test1(), test2()]);
+    var_dump(value_order('arg-left'), ref_order('arg-ref'));
+    var_dump([value_order('array-left'), ref_order('array-ref')]);
 }
 
 function &test1()
@@ -28,6 +31,19 @@ function &test2()
     ++$value;
     return $value;
 }
+
+function value_order(string $label): string
+{
+    echo "$label\n";
+    return $label;
+}
+
+function &ref_order(string $label)
+{
+    static $value = 42;
+    echo "$label\n";
+    return $value;
+}
 ?>
 --EXPECT--
 int(1)
@@ -44,3 +60,21 @@ array(2) {
   [1]=>
   int(4)
 }
+array(2) {
+  ["first"]=>
+  int(5)
+  [0]=>
+  int(6)
+}
+arg-left
+arg-ref
+string(8) "arg-left"
+int(42)
+array-left
+array-ref
+array(2) {
+  [0]=>
+  string(10) "array-left"
+  [1]=>
+  int(42)
+}

From c75b4d565bac89551ce40375566552ad91fbc01f Mon Sep 17 00:00:00 2001
From: tianfenghan <rango@swoole.com>
Date: Sun, 19 Jul 2026 11:24:03 +0800
Subject: [PATCH 12/12] fix(compiler): enforce class constant override rules

---
 .../code/inheritance_error_const_final.php    | 13 ++++++
 .../inheritance_error_const_missing_type.php  | 13 ++++++
 phpunit/src/InheritanceErrorTest.php          | 10 +++++
 src/Parser/ClassConstantFetchTrait.php        | 14 +++---
 src/Translator.php                            |  9 ++++
 .../const/class-const-parent-cross-ns.phpt    | 43 +++++++++++++++++++
 6 files changed, 93 insertions(+), 9 deletions(-)
 create mode 100644 phpunit/code/inheritance_error_const_final.php
 create mode 100644 phpunit/code/inheritance_error_const_missing_type.php
 create mode 100644 tests/compiler/const/class-const-parent-cross-ns.phpt

diff --git a/phpunit/code/inheritance_error_const_final.php b/phpunit/code/inheritance_error_const_final.php
new file mode 100644
index 00000000..e2e57cc7
--- /dev/null
+++ b/phpunit/code/inheritance_error_const_final.php
@@ -0,0 +1,13 @@
+<?php
+
+class FinalConstantParent
+{
+    final public const VALUE = 1;
+}
+
+class FinalConstantChild extends FinalConstantParent
+{
+    public const VALUE = 2;
+}
+
+function main() {}
diff --git a/phpunit/code/inheritance_error_const_missing_type.php b/phpunit/code/inheritance_error_const_missing_type.php
new file mode 100644
index 00000000..7f0c5023
--- /dev/null
+++ b/phpunit/code/inheritance_error_const_missing_type.php
@@ -0,0 +1,13 @@
+<?php
+
+class TypedConstantParent
+{
+    public const int VALUE = 1;
+}
+
+class UntypedConstantChild extends TypedConstantParent
+{
+    public const VALUE = 1;
+}
+
+function main() {}
diff --git a/phpunit/src/InheritanceErrorTest.php b/phpunit/src/InheritanceErrorTest.php
index 6c537f0c..5d1852b0 100644
--- a/phpunit/src/InheritanceErrorTest.php
+++ b/phpunit/src/InheritanceErrorTest.php
@@ -168,6 +168,16 @@ class InheritanceErrorTest extends TestCase
         $this->exec('must be compatible', 'inheritance_error_const_type.php');
     }
 
+    public function testTypedConstantCannotBeOverriddenWithoutDeclaredType()
+    {
+        $this->exec('must be compatible', 'inheritance_error_const_missing_type.php');
+    }
+
+    public function testFinalConstantCannotBeOverridden()
+    {
+        $this->exec('Cannot override final constant', 'inheritance_error_const_final.php');
+    }
+
     public function testConstantVisibilityMismatch()
     {
         $this->exec('must be compatible', 'inheritance_error_const_visibility.php');
diff --git a/src/Parser/ClassConstantFetchTrait.php b/src/Parser/ClassConstantFetchTrait.php
index 527a9c42..d5b01a94 100644
--- a/src/Parser/ClassConstantFetchTrait.php
+++ b/src/Parser/ClassConstantFetchTrait.php
@@ -32,15 +32,12 @@ trait ClassConstantFetchTrait
                 $class = $this->class;
             }
         } elseif ($class === 'parent') {
-            // `parent::` refers to the parent of the current class. Resolve it to
-            // the real parent class name and treat it like `self` for the purpose
-            // of constant/magic-class resolution.
-            $parentClass = $this->getParentClass($this->class);
-            if ($parentClass !== '' && $this->hasClass($parentClass)) {
-                $class = $this->getClass($parentClass)->name;
-            } else {
-                $class = $parentClass;
+            if (!$this->classDef || !$this->classDef->extends) {
+                $this->fatalError($expr, 'Cannot use "parent" outside a class or class does not extend any class');
             }
+            // extends is already fully resolved. Keep the leading slash so the
+            // current namespace is not applied again below.
+            $class = '\\' . $this->classDef->extends;
             $self = true;
         }
 
@@ -109,4 +106,3 @@ trait ClassConstantFetchTrait
     }
 
 }
-
diff --git a/src/Translator.php b/src/Translator.php
index 7b61f827..70d063a9 100644
--- a/src/Translator.php
+++ b/src/Translator.php
@@ -3477,11 +3477,20 @@ CODE;
                     if ($parentConst->flags & Modifiers::PRIVATE) {
                         continue;
                     }
+                    if ($parentConst->flags & Modifiers::FINAL) {
+                        $this->fatalError($classStmt,
+                            "Cannot override final constant `{$parentClass}::{$name}`");
+                    }
                     // PHP only enforces type compatibility when the parent constant
                     // carries an explicit declared type. Overriding an untyped constant
                     // with a value of any type is permitted, so the type check is skipped
                     // in that case. Visibility is always enforced below.
                     if ($parentConst->declaredType !== null) {
+                        if ($childConst->declaredType === null) {
+                            $this->fatalError($classStmt,
+                                "Declaration of `{$className}::{$name}` must be compatible " .
+                                "with `{$parentClass}::{$name}`");
+                        }
                         // An untyped child constant whose value is an expression (e.g.
                         // `X = ParentClass::Y`) is inferred as a variant. Resolve its real
                         // type from the referenced constant so the compatibility check uses
diff --git a/tests/compiler/const/class-const-parent-cross-ns.phpt b/tests/compiler/const/class-const-parent-cross-ns.phpt
new file mode 100644
index 00000000..f550fb66
--- /dev/null
+++ b/tests/compiler/const/class-const-parent-cross-ns.phpt
@@ -0,0 +1,43 @@
+--TEST--
+parent class constants resolve across namespaces
+--FILE--
+<?php
+
+namespace Library {
+    class Base
+    {
+        public const TOKEN = 'base';
+    }
+}
+
+namespace Application {
+    class Sibling
+    {
+    }
+
+    class Child extends \Library\Base
+    {
+        public const PARENT_NAME = parent::class;
+        public const SIBLING_NAME = Sibling::class;
+
+        public static function dumpParent(): void
+        {
+            var_dump(parent::class, parent::TOKEN);
+        }
+    }
+}
+
+namespace {
+    function main(): void
+    {
+        var_dump(\Application\Child::PARENT_NAME);
+        var_dump(\Application\Child::SIBLING_NAME);
+        \Application\Child::dumpParent();
+    }
+}
+?>
+--EXPECT--
+string(12) "Library\Base"
+string(19) "Application\Sibling"
+string(12) "Library\Base"
+string(4) "base"