Type system unsoundness in HHVM 3.27.1: inout parameters, shape subtyping, bounded quantification

runme.hh

<?hh

require_once(__DIR__ . '/soundness.hh');

breakage();

runme2.hh

<?hh

require_once(__DIR__ . '/soundness2.hh');

breakage2();

soundness.hh

<?hh // strict

final class Dummy
{
    final public function bork(): void
    {
        print('Bork.' . "\n");
    }
}

type Narrow = shape(...);
type Broad = shape('dummy' => Dummy);
type Dad = shape('child' => Narrow);

function naive<Tx as Dad>(inout Tx $parent): void
{
    $parent['child'] = shape();
}

function breakage(): void
{
    $oops = shape('child' => shape('dummy' => new Dummy()));
    naive(inout $oops);
    $oops['child']['dummy']->bork();
}

soundness2.hh

<?hh // strict

final class Dummy2
{
    final public function bork(): void
    {
        print('Bork.' . "\n");
    }
}

type Narrow2 = shape(...);
type Broad2 = shape('dummy' => Dummy2);
type Dad2 = shape('child' => Narrow2);

final class Breakage<Tx>
{
    final public function __construct(public Tx $shape) { }
}

function naive2<Tx as Dad2>(Breakage<Tx> $parent): void
{
    $parent->shape['child'] = shape();
}

function breakage2(): void
{
    $oops = new Breakage(shape('child' => shape('dummy' => new Dummy2())));
    naive2($oops);
    $oops->shape['child']['dummy']->bork();
}