Fix type inference

dstogov · dstogov · commit 1f58365438ca · 2022-01-10T21:53:35.000+03:00
Fixes oss-fuzz #43367
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
@@ -2636,9 +2636,6 @@ static zend_always_inline int _zend_update_type_info(
 						tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING;
 					}
 				}
-				if (t1 & MAY_BE_OBJECT) {
-					tmp |= MAY_BE_REF;
-				}
 				tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 				UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
 			}
diff --git a/ext/opcache/tests/jit/assign_dim_008.phpt b/ext/opcache/tests/jit/assign_dim_008.phpt
@@ -0,0 +1,18 @@
+--TEST--
+JIT ASSIGN_DIM: 008
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+function(int $a) {
+  $arr = $a[] = (y);
+  $arr = y;
+  $c = $y = $arr[] = y($c);
+}
+?>
+DONE
+--EXPECT--
+DONE

Original file line number	Diff line number	Diff line change
`@@ -2636,9 +2636,6 @@ static zend_always_inline int _zend_update_type_info(`
`2636`	`2636`	`tmp \|= MAY_BE_NULL\|MAY_BE_FALSE\|MAY_BE_TRUE\|MAY_BE_LONG\|MAY_BE_DOUBLE\|MAY_BE_STRING;`
`2637`	`2637`	`}`
`2638`	`2638`	`}`
`2639`		`- if (t1 & MAY_BE_OBJECT) {`
`2640`		`- tmp \|= MAY_BE_REF;`
`2641`		`- }`
`2642`	`2639`	`tmp \|= MAY_BE_RC1 \| MAY_BE_RCN;`
`2643`	`2640`	`UPDATE_SSA_TYPE(tmp, ssa_op->result_def);`
`2644`	`2641`	`}`