fix(parser): stabilize compound array access paths

src/Parser/AssignOpTrait.php

@@ -823,24 +823,11 @@ trait AssignOpTrait
 
     protected function parseAssignOp(Expr\AssignOp $node, string $op): string
     {
-        // Every analysis and lowering phase must see the same array key. Some
-        // of those helpers parse dynamic GLOBALS keys while determining the
-        // target type, so stabilizing only the final read and write is too
-        // late for side-effecting offsets such as $i++.
         if ($node->var instanceof Expr\ArrayDimFetch
-            && $node->var->dim !== null
-            && $this->shouldMaterializeOrderedOperand($node->var->dim)
+            && !$this->canUpdateKnownArraySlotInPlace($node, $op)
         ) {
-            $originalAccess = $node->var;
-            $dim = $this->addTmpVar(Type::VAR);
-            $this->context->beforeStmtLines[] = $dim . ' = '
-                . $this->parseOrderedOperand($originalAccess->dim, false) . ';';
             $node = clone $node;
-            $node->var = new Expr\ArrayDimFetch(
-                $originalAccess->var,
-                new Variable($dim, $originalAccess->dim->getAttributes()),
-                $originalAccess->getAttributes(),
-            );
+            $node->var = $this->stabilizeAssignOpArrayAccess($node->var);
         }
 
         $this->assertImmutableMutationTarget($node->var);
@@ -1013,6 +1000,41 @@ trait AssignOpTrait
         return $var . ' ' . $op . ' (' . $expr . ')';
     }
 
+    /**
+     * Evaluate every dynamic dimension of a compound-assignment target once,
+     * from the innermost access to the outermost access, before evaluating the
+     * right-hand side. Both the read and write lowering then reuse the cloned
+     * access path and cannot observe keys changed by a later dimension or RHS.
+     */
+    private function stabilizeAssignOpArrayAccess(Expr\ArrayDimFetch $access): Expr\ArrayDimFetch
+    {
+        $dimensions = [];
+        $base = $access;
+        while ($base instanceof Expr\ArrayDimFetch) {
+            $dimensions[] = $base;
+            $base = $base->var;
+        }
+
+        $stableAccess = $base;
+        foreach (array_reverse($dimensions) as $dimension) {
+            $dim = $dimension->dim;
+            $literal = $dim instanceof Node\Scalar\LNumber
+                || $dim instanceof Node\Scalar\DNumber
+                || $dim instanceof Node\Scalar\String_;
+            if ($dim !== null && !$literal) {
+                $tmp = $this->parseOrderedOperand($dim, false, true);
+                $dim = new Variable($tmp, $dim->getAttributes());
+            }
+            $stableAccess = new Expr\ArrayDimFetch(
+                $stableAccess,
+                $dim,
+                $dimension->getAttributes(),
+            );
+        }
+
+        return $stableAccess;
+    }
+
     /**
      * Preserve PHP's concat-assignment operation for statically typed strings.
      * String::append() calls concat_function() with the target as both the

src/Parser/BinaryOpTrait.php

@@ -521,10 +521,10 @@ trait BinaryOpTrait
         return $this->parseOrderedOperand($expr, true);
     }
 
-    protected function parseOrderedOperand(NodeAbstract $expr, bool $numeric): string
+    protected function parseOrderedOperand(NodeAbstract $expr, bool $numeric, bool $forceMaterialize = false): string
     {
         $this->assertExprCanBeUsedAsValue($expr, 'operand');
-        if (!$this->shouldMaterializeOrderedOperand($expr)) {
+        if (!$forceMaterialize && !$this->shouldMaterializeOrderedOperand($expr)) {
             $value = $numeric ? $this->parseNumericIdentifier($expr) : $this->parseIdentifier($expr);
             return $this->normalizeNativeObjectValueExpr($expr, $value);
         }

tests/compiler/array/compound-offset-evaluated-once.phpt

@@ -4,6 +4,17 @@ Array compound assignment evaluates a side-effecting offset once
 <?php
 declare(strict_types=1);
 
+function nextCompoundOffset(int &$index): int
+{
+    return $index++;
+}
+
+function changeCompoundOffsetPart(string &$part): int
+{
+    $part = 'b';
+    return 5;
+}
+
 function main(): void
 {
     $statementIndex = 0;
@@ -23,6 +34,30 @@ function main(): void
     $GLOBALS['typephp_compound_once_' . $globalIndex++] += 4;
 
     var_dump($globalIndex, $GLOBALS['typephp_compound_once_0']);
+
+    $nestedIndex = 0;
+    $nestedValues = [[10, 20], [30, 40]];
+    $nestedResult = ($nestedValues[$nestedIndex++][$nestedIndex++] += 5);
+
+    var_dump($nestedIndex, $nestedValues[0][1], $nestedValues[1][0], $nestedResult);
+
+    $callIndex = 0;
+    $callValues = [[10, 20], [30, 40]];
+    $callResult = ($callValues[nextCompoundOffset($callIndex)][nextCompoundOffset($callIndex)] *= 2);
+
+    var_dump($callIndex, $callValues[0][1], $callValues[1][0], $callResult);
+
+    $rhsIndex = 0;
+    $rhsValues = [10, 20];
+    $rhsResult = ($rhsValues[$rhsIndex] += ++$rhsIndex);
+
+    var_dump($rhsIndex, $rhsValues[0], $rhsValues[1], $rhsResult);
+
+    $offsetPart = 'a';
+    $interpolatedValues = ['a0' => 10, 'b0' => 20];
+    $interpolatedResult = ($interpolatedValues["{$offsetPart}0"] += changeCompoundOffsetPart($offsetPart));
+
+    var_dump($offsetPart, $interpolatedValues['a0'], $interpolatedValues['b0'], $interpolatedResult);
 }
 ?>
 --EXPECT--
@@ -39,3 +74,19 @@ array(1) {
 int(40)
 int(1)
 int(7)
+int(2)
+int(25)
+int(30)
+int(25)
+int(2)
+int(40)
+int(30)
+int(40)
+int(1)
+int(11)
+int(20)
+int(11)
+string(1) "b"
+int(15)
+int(20)
+int(15)

tests/compiler/std-vector/compound-offset-evaluated-once.phpt

@@ -0,0 +1,21 @@
+--TEST--
+std vector compound assignment evaluates its offset before the RHS
+--FILE--
+<?php
+function main(): void
+{
+    $index = 0;
+    $vector = std::vector(Type::Int, 2);
+    $vector[0] = 10;
+    $vector[1] = 20;
+
+    $result = ($vector[$index] += ++$index);
+
+    var_dump($index, $vector[0], $vector[1], $result);
+}
+?>
+--EXPECT--
+int(1)
+int(11)
+int(20)
+int(11)