vm: lower \$obj->prop OP= rhs to OP_OBJECT_COMPOUND_ASSIGN

Compound assigns on object properties (e.g. $obj->n += 5, $obj->s .= ' x')
were delegated to the AST runner via emitAssignViaAST. They now lower to
a dedicated OP_OBJECT_COMPOUND_ASSIGN opcode.

Encoding:
  A = const-pool name index (ZString prop name)
  B = tokenizer ItemType (e.g. T_PLUS_EQUAL, T_CONCAT_EQUAL)
  C bit 0 = "keep value on stack" (expr vs stmt context)

Stack: pops rhs, pops receiver. Inside the handler:
  cur := objectGet(receiver, name) (NULL on undefined)
  cur := cur.Dup() (bug81705-style snapshot)
  res := compoundOp(op)(cur, rhs)
  objectSet(receiver, name, res)
  if C&1 { push(res) }

Only the static-name, non-nullsafe shape goes native; dynamic-name
\$obj->{\$x} += v and nullsafe \$obj?->prop += v still fall through to
emitAssignViaAST. Typed properties, hooks, and asymmetric visibility are
already handled by the downstream ZObject.ObjectSet, so the native path
inherits them unchanged. Verified locally:
  - int/string/nullable compound assigns
  - .= with array→string coercion
  - typed-prop weak-mode coercion (numeric string warning + float
    deprecation notice)
  - property hooks fire (set hook called with post-op value)
  - expr-context: \$x = (\$obj->n += 100) yields 100

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: MagicalTux

core/vm/opcode.go

@@ -476,6 +476,17 @@ const (
 	// dispatch to ObjectSet(name, nil).
 	OpUnsetObjProp
 
+	// `$obj->prop OP= rhs` compound assign for static-name, non-
+	// nullsafe property access. Encoding:
+	//   A = const-pool name index (ZString prop name)
+	//   B = tokenizer ItemType (compound op token, e.g.
+	//       T_PLUS_EQUAL, T_CONCAT_EQUAL)
+	//   C bit 0 = "keep value on stack" (expr-context vs stmt-ctx)
+	// Stack: pops rhs, pops receiver. Reads cur via objectGet,
+	// applies compoundOp(op)(cur, rhs), writes back via objectSet.
+	// Pushes the post-op value back when keep-flag is set.
+	OpObjectCompoundAssign
+
 	// Sentinel — keep last.
 	opLast
 )
@@ -613,4 +624,5 @@ var opNames = [...]string{
 	OpIssetObjProp:        "ISSET_OBJ_PROP",
 	OpEmptyObjProp:        "EMPTY_OBJ_PROP",
 	OpUnsetObjProp:        "UNSET_OBJ_PROP",
+	OpObjectCompoundAssign: "OBJECT_COMPOUND_ASSIGN",
 }

core/vm/vm.go

@@ -1073,6 +1073,40 @@ func (f *Frame) runUntilError(ctx phpv.Context) (retVal *phpv.ZVal, finished boo
 				return nil, false, err
 			}
 
+		case OpObjectCompoundAssign:
+			rhs := f.pop()
+			receiver := f.pop()
+			name, ok := f.fn.Consts[ins.A()].(phpv.ZString)
+			if !ok {
+				return nil, false, fmt.Errorf("vm: OP_OBJECT_COMPOUND_ASSIGN name const is %T not ZString", f.fn.Consts[ins.A()])
+			}
+			op := tokenizer.ItemType(ins.B())
+			fn := compoundOp(op)
+			if fn == nil {
+				return nil, false, fmt.Errorf("vm: OP_OBJECT_COMPOUND_ASSIGN unknown op %d", ins.B())
+			}
+			cur, err := objectGet(ctx, receiver, name)
+			if err != nil {
+				return nil, false, err
+			}
+			if cur == nil {
+				cur = phpv.ZNULL.ZVal()
+			}
+			// Snapshot cur — mirrors OpOpAssignLocal's defense
+			// against handlers that mutate the slot in-place during
+			// `.=` coercion (bug81705 family).
+			cur = cur.Dup()
+			res, err := fn(ctx, cur, rhs)
+			if err != nil {
+				return nil, false, err
+			}
+			if err := objectSet(ctx, receiver, name, res); err != nil {
+				return nil, false, err
+			}
+			if ins.C()&1 != 0 {
+				f.push(res)
+			}
+
 		case OpObjectCall:
 			argc := int(ins.B())
 			args := make([]*phpv.ZVal, argc)

core/vm/vmcompiler/emit_expr.go

@@ -949,10 +949,20 @@ func (e *emitter) emitAssignViaAST(n operatorNode) error {
 func (e *emitter) emitCompoundAssign(n operatorNode, op tokenizer.ItemType) error {
 	lhs, ok := n.OperatorA().(variableNode)
 	if !ok {
-		// Delegate property / static-prop / array-element compound
-		// writes to the AST.
-		switch n.OperatorA().(type) {
-		case objectVarNode, arrayAccessNode:
+		// `$obj->prop OP= rhs`: emit natively for static-name,
+		// non-nullsafe property access. OP_OBJECT_COMPOUND_ASSIGN
+		// dispatches via objectGet/objectSet (which reach into the
+		// AST's ZObject layer for typed props, hooks, etc.) and
+		// applies the resolved compoundOp inside the handler.
+		if ov, ok := n.OperatorA().(objectVarNode); ok {
+			name := ov.ObjectVarName()
+			if !ov.ObjectVarIsNullSafe() && !(len(name) > 0 && name[0] == '$') {
+				return e.emitObjectVarCompoundAssign(ov, n.OperatorB(), op, e.stmtCtx)
+			}
+			return e.emitAssignViaAST(n)
+		}
+		// Array compound assigns still need a dedicated path.
+		if _, ok := n.OperatorA().(arrayAccessNode); ok {
 			return e.emitAssignViaAST(n)
 		}
 		if compiler.IsStaticPropertyTarget(n.OperatorA()) {

core/vm/vmcompiler/emit_object.go

@@ -3,6 +3,7 @@ package vmcompiler
 import (
 	"github.com/KarpelesLab/goro/core/compiler"
 	"github.com/KarpelesLab/goro/core/phpv"
+	"github.com/KarpelesLab/goro/core/tokenizer"
 	"github.com/KarpelesLab/goro/core/vm"
 )
 
@@ -106,6 +107,49 @@ func (e *emitter) emitObjectVarAssign(lhs objectVarNode, rhs phpv.Runnable, stmt
 	return nil
 }
 
+// emitObjectVarCompoundAssign emits `$obj->prop OP= rhs` for static-name,
+// non-nullsafe property access. The receiver is evaluated once; the
+// resulting value handle is reused for both objectGet (read current) and
+// objectSet (write back). The PHP semantics-level dance — typed prop
+// coercion, hook dispatch, asymmetric visibility — happens inside
+// ZObject.ObjectSet, same as for plain `=`.
+func (e *emitter) emitObjectVarCompoundAssign(lhs objectVarNode, rhs phpv.Runnable, op tokenizer.ItemType, stmtCtx bool) error {
+	if lhs.ObjectVarIsNullSafe() {
+		return unsupportedf("nullsafe property compound assign")
+	}
+	name := lhs.ObjectVarName()
+	if len(name) > 0 && name[0] == '$' {
+		return unsupportedf("dynamic property name in compound assign")
+	}
+	recv := lhs.ObjectVarReceiver()
+	// Receiver write-context: an undefined simple-variable receiver
+	// must not warn. Mirror emitObjectVarAssign's silent load path.
+	if v, ok := recv.(variableNode); ok {
+		idx := e.localIndex(v.VariableName())
+		e.emit(vm.OpLoadLocal, idx, 0, 0)
+		e.pushStack(1)
+	} else {
+		if err := e.withSubexpr(func() error { return e.emitExpr(recv) }); err != nil {
+			return err
+		}
+	}
+	if err := e.withSubexpr(func() error { return e.emitExpr(rhs) }); err != nil {
+		return err
+	}
+	nameIdx := e.constIndex(name)
+	var c int32
+	if !stmtCtx {
+		c = 1 // keep post-op value on stack
+	}
+	e.emit(vm.OpObjectCompoundAssign, nameIdx, uint16(op), c)
+	if stmtCtx {
+		e.popStack(2) // pop receiver + rhs, nothing pushed
+	} else {
+		e.popStack(1) // pop receiver+rhs, push result → net -1
+	}
+	return nil
+}
+
 func (e *emitter) emitObjectVarRead(n objectVarNode) error {
 	name := n.ObjectVarName()
 	// `$obj->$x` (no curly braces) parses to runObjectVar with the