vm: lower isset/empty($obj->prop) natively via OP_ISSET_OBJ_PROP / OP_EMPTY_OBJ_PROP

Currently isset($obj->prop) / empty($obj->prop) fall through to
OpClassConst (generic AST.Run delegation). Add native opcodes that
pop the receiver and read the prop name from the const pool, then
dispatch to EvalIssetObjProp / EvalEmptyObjProp.

EvalIssetObjProp / EvalEmptyObjProp mirror checkExistence /
checkEmpty's runObjectVar branches — non-object receiver returns
false/true (no warn), otherwise HasProp + (for empty) ObjectGet +
IsValueEmpty.

IsIssetSupportedArg extended to accept objectVarNode shapes with
static names (non-dollar-prefix, non-nullsafe) and a recursively
supported receiver. Nested forms ($outer->inner->prop) work via
emitIssetContainerRead which now recurses via OP_OBJECT_GET_SAFE
for intermediate object reads.

Bodies that use only the natively-supported isset/empty shapes
(simple-local, array-access on simple container, object prop on
supported receiver) stay slot-safe. Dollar-prefix dyn-name and
nullsafe forms still AST-delegate via OpClassConst.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: MagicalTux

core/compiler/compile-isset.go

@@ -388,6 +388,45 @@ func EvalEmptyDim(ctx phpv.Context, value, key *phpv.ZVal) (bool, error) {
 	return IsValueEmpty(ctx, val), nil
 }
 
+// EvalIssetObjProp performs the existence-and-not-null check on
+// `$obj->propName`. Mirrors checkExistence's runObjectVar branch for
+// the post-receiver-evaluation portion: non-object receivers return
+// false (no warn), object receivers dispatch to HasProp (which itself
+// handles __isset and visibility).
+func EvalIssetObjProp(ctx phpv.Context, receiver *phpv.ZVal, propName phpv.ZString) (bool, error) {
+	if receiver == nil || receiver.GetType() != phpv.ZtObject {
+		return false, nil
+	}
+	obj, ok := receiver.Value().(*phpobj.ZObject)
+	if !ok {
+		return false, nil
+	}
+	return obj.HasProp(ctx, propName)
+}
+
+// EvalEmptyObjProp performs the "empty" check on `$obj->propName`.
+// Mirrors checkEmpty's runObjectVar branch: non-object receivers and
+// missing properties return true (empty); otherwise reads and applies
+// IsValueEmpty.
+func EvalEmptyObjProp(ctx phpv.Context, receiver *phpv.ZVal, propName phpv.ZString) (bool, error) {
+	if receiver == nil || receiver.GetType() != phpv.ZtObject {
+		return true, nil
+	}
+	obj, ok := receiver.Value().(*phpobj.ZObject)
+	if !ok {
+		return true, nil
+	}
+	exists, err := obj.HasProp(ctx, propName)
+	if err != nil || !exists {
+		return true, nil
+	}
+	val, err := obj.ObjectGet(ctx, propName)
+	if err != nil {
+		return true, nil
+	}
+	return IsValueEmpty(ctx, val), nil
+}
+
 func IsValueEmpty(ctx phpv.Context, v *phpv.ZVal) bool {
 	if v == nil {
 		return true

core/compiler/vmaccess.go

@@ -916,10 +916,26 @@ func IssetEmptyAllSimple(r phpv.Runnable) bool {
 //   - simple variable ($x)
 //   - array-access with a non-nullsafe simple-shape container
 //     ($x[$k], $x[k], also nested $x[$k1][$k2])
+//   - object property with a static (non-dollar-prefix) name and no
+//     nullsafe marker ($obj->prop). Receiver itself can be any
+//     emittable expression.
 func IsIssetSupportedArg(r phpv.Runnable) bool {
 	if IsSimpleVariable(r) {
 		return true
 	}
+	if o, ok := r.(*runObjectVar); ok {
+		// Reject dollar-prefix dyn-name and nullsafe forms — those
+		// need separate opcodes or extra short-circuit logic.
+		if o.nullsafe || o.nullChain {
+			return false
+		}
+		if len(o.varName) > 0 && o.varName[0] == '$' {
+			return false
+		}
+		// Receiver chain must also be a supported isset shape so
+		// emitIssetContainerRead can recurse without falling back.
+		return IsIssetSupportedArg(o.ref)
+	}
 	a, ok := r.(*runArrayAccess)
 	if !ok || a.nullChain {
 		return false

core/vm/opcode.go

@@ -456,6 +456,14 @@ const (
 	// PHP's `??` only silences property-existence, not receiver-type.
 	OpObjectGetSafe
 
+	// OP_ISSET_OBJ_PROP / OP_EMPTY_OBJ_PROP — native `isset($obj->prop)` /
+	// `empty($obj->prop)` for static-name, non-nullsafe property access.
+	// Encoding: A = const-pool name index. Pops receiver, pushes bool.
+	// Dispatches to compiler.EvalIssetObjProp / EvalEmptyObjProp which
+	// mirror checkExistence / checkEmpty's runObjectVar branches.
+	OpIssetObjProp
+	OpEmptyObjProp
+
 	// Sentinel — keep last.
 	opLast
 )
@@ -590,4 +598,6 @@ var opNames = [...]string{
 	OpObjectCallByExprs:   "OBJECT_CALL_BY_EXPRS",
 	OpObjectDynCall:       "OBJECT_DYN_CALL",
 	OpObjectGetSafe:       "OBJECT_GET_SAFE",
+	OpIssetObjProp:        "ISSET_OBJ_PROP",
+	OpEmptyObjProp:        "EMPTY_OBJ_PROP",
 }

core/vm/vm.go

@@ -1035,6 +1035,30 @@ func (f *Frame) runUntilError(ctx phpv.Context) (retVal *phpv.ZVal, finished boo
 			}
 			f.push(res)
 
+		case OpIssetObjProp:
+			receiver := f.pop()
+			name, ok := f.fn.Consts[ins.A()].(phpv.ZString)
+			if !ok {
+				return nil, false, fmt.Errorf("vm: OP_ISSET_OBJ_PROP name const is %T not ZString", f.fn.Consts[ins.A()])
+			}
+			exists, err := compiler.EvalIssetObjProp(ctx, receiver, name)
+			if err != nil {
+				return nil, false, err
+			}
+			f.push(phpv.ZBool(exists).ZVal())
+
+		case OpEmptyObjProp:
+			receiver := f.pop()
+			name, ok := f.fn.Consts[ins.A()].(phpv.ZString)
+			if !ok {
+				return nil, false, fmt.Errorf("vm: OP_EMPTY_OBJ_PROP name const is %T not ZString", f.fn.Consts[ins.A()])
+			}
+			isEmpty, err := compiler.EvalEmptyObjProp(ctx, receiver, name)
+			if err != nil {
+				return nil, false, err
+			}
+			f.push(phpv.ZBool(isEmpty).ZVal())
+
 		case OpObjectCall:
 			argc := int(ins.B())
 			args := make([]*phpv.ZVal, argc)

core/vm/vmcompiler/emit_expr.go

@@ -1141,6 +1141,19 @@ func (e *emitter) emitIssetArg(a phpv.Runnable) error {
 		e.popStack(1) // 2 in, 1 out
 		return nil
 	}
+	if ov, ok := a.(objectVarNode); ok {
+		// `isset($obj->prop)` — emit receiver as a permissive read so
+		// undefined-variable warnings on the receiver are suppressed,
+		// then OP_ISSET_OBJ_PROP pops receiver + reads name from the
+		// const pool to dispatch to EvalIssetObjProp.
+		if err := e.withSubexpr(func() error { return e.emitIssetContainerRead(ov.ObjectVarReceiver()) }); err != nil {
+			return err
+		}
+		idx := e.constIndex(ov.ObjectVarName())
+		e.emit(vm.OpIssetObjProp, idx, 0, 0)
+		// pop receiver, push bool → net stack delta zero.
+		return nil
+	}
 	return unsupportedf("emitIssetArg: unsupported shape %T", a)
 }
 
@@ -1164,6 +1177,18 @@ func (e *emitter) emitEmptyArg(a phpv.Runnable) error {
 		e.popStack(1)
 		return nil
 	}
+	if ov, ok := a.(objectVarNode); ok {
+		// `empty($obj->prop)` — emit receiver permissively then
+		// OP_EMPTY_OBJ_PROP. The dispatch returns true for non-object
+		// receivers and missing properties (matches PHP semantics).
+		if err := e.withSubexpr(func() error { return e.emitIssetContainerRead(ov.ObjectVarReceiver()) }); err != nil {
+			return err
+		}
+		idx := e.constIndex(ov.ObjectVarName())
+		e.emit(vm.OpEmptyObjProp, idx, 0, 0)
+		// pop receiver, push bool → net stack delta zero.
+		return nil
+	}
 	return unsupportedf("emitEmptyArg: unsupported shape %T", a)
 }
 
@@ -1194,6 +1219,22 @@ func (e *emitter) emitIssetContainerRead(c phpv.Runnable) error {
 		e.popStack(1)
 		return nil
 	}
+	if ov, ok := c.(objectVarNode); ok {
+		// Nested `$outer->inner->...` — recurse for the receiver, then
+		// permissive object read so a missing intermediate property
+		// just produces null without warning.
+		name := ov.ObjectVarName()
+		if !ov.ObjectVarIsNullSafe() && len(name) > 0 && name[0] != '$' {
+			if err := e.emitIssetContainerRead(ov.ObjectVarReceiver()); err != nil {
+				return err
+			}
+			idx := e.constIndex(name)
+			e.emit(vm.OpObjectGetSafe, idx, 0, 0)
+			return nil
+		}
+		// Fall through to unsupported for nullsafe/dyn-name nested
+		// containers — those keep AST delegation.
+	}
 	return unsupportedf("emitIssetContainerRead: unsupported shape %T", c)
 }