array_shift / array_pop on an element ($a['q']) mutate the inner array in place, so a copy of the outer array and a reused literal change too #601

Summary

array_shift / array_pop on an element ($a['q']) mutate the inner array in place, so a copy of the outer array and a reused literal change too.

Repro

<?php
function mk(int $n): array { return ['q' => range(1, $n)]; }
$a = mk(3);
$b = $a;
array_shift($a['q']);
array_pop($a['q']);
echo json_encode($a), ' ', json_encode($b), "\n";
for ($i = 0; $i < 3; $i++) { $el = ['q' => [1, 2, 3]]; echo array_shift($el['q']), ' '; }
echo "\n";

Expected (php)

{"q":[2]} {"q":[1,2,3]}
1 1 1 

Actual (manticore a9c79b1c, Darwin arm64)

{"q":[2]} {"q":[2]}
1 2 3 

Tracking

Known-bug repro: tests/aot/repro/wrong/array_mutator_on_element_corrupts_copy.php — bash tests/aot/xfail.sh -k array_mutator_on_element_corrupts_copy reports XFAIL while this is open and XPASS once it is fixed; then move the repro into tests/aot/cases/ and close this issue.