Fix phpdbg over-read when watching a packed array element

[iliaal]

phpdbg watched every array element as a Bucket, but packed arrays store bare zvals and de-indirected stack variables aren't buckets, so reading Bucket.h/.key over-read the neighbour and a sibling write tripped a phantom watchpoint. Those elements are now watched as WATCH_ON_ZVAL, comparing the type info first and reading the value union only for initialised slots, so uninitialised CV bytes are never compared.

This also surfaced a pre-existing 32-bit crash: phpdbg_btree_insert_or_update() published each new node before initialising its child pointers, so a write to a node on a watched page faulted into the watchpoint handler and walked the half-built node. It now builds the node fully before linking it in. Both showed up on WINDOWS_X86_NTS once GH-22480 un-xfailed watch_006; watch_005 and watch_006 are un-skipped / re-recorded to match.

[iluuu1994]

This doesn't work for me. The PR still fails with the same error. I'll try to create a PR by tomorrow.

[iliaal]

Yeah I see now, I thought the linux 32 would validate it fully, but it doesn't. I see the issue on Win32. Will try to take a stab @ it tonight if I get anywhere I'll tag you on this PR, otherwise all yours :(

[iluuu1994]

You should run with MSAN, it reproduces on Linux. I think there are multiple issues.

1. We're treating all stack variables as buckets, even though the ones that we de-indirect are not. So phpdbg_check_watch_diff() will access out-of-bounds on &((Bucket *) oldPtr)->h (that's the primary issue here).
2. The above indicates we might want to just use the normal zval watch point (i.e. WATCH_ON_ZVAL), but we'll still need to unregister the watch point when the stack frame releases.
3. The stack frame is not zeroed on initialization, and CVs are not fully initialized for IS_UNDEF (just the type), so the memcmp() in phpdbg_check_watch_diff() will read uninitialized data anyway.

[iliaal]

Thanks for the pointers. WATCH_ON_ZVAL was the right call, covers all three: re-resolve in the parent on relocation, drop the watch once the CV goes IS_UNDEF on frame teardown/reuse, and check type info before the value union so uninitialised CV bytes aren't read.

That fixed the over-read but Win32 still crashed, on a separate pre-existing bug. phpdbg_btree_insert_or_update links a freshly allocated node into the tree before initialising its child pointers; when the node lands on a watched page, the init write faults into the watchpoint handler, which then walks the half-built node. It only reproduced on 32-bit, where the compact heap puts the node on the same page as the watched zval. Building the node before publishing it fixes it.

watch_005/006 pass, full phpdbg suite clean on a local x86 Windows build and under ASAN.

[iliaal]

Dropped both blocks and rebuilt the x86 NTS phpdbg; the full phpdbg suite is unchanged from before the removal.

[iluuu1994]

Looks correct now. I'll add Bob for a review, since he wrote most of this code (albeit a very long time ago).

[iluuu1994]

Feel free to merge this so nightly CI is finally green, we can still adjust if Bob finds something later. Just make sure to fix the description to something more accurate. Thanks!