Fixed incorrect assumption about reference counting

Author: dstogov

ext/opcache/Optimizer/zend_inference.c

@@ -3582,7 +3582,9 @@ static zend_always_inline int _zend_update_type_info(
 				tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
 				if (opline->result_type == IS_TMP_VAR) {
 					if (opline->opcode == ZEND_FETCH_R || opline->opcode == ZEND_FETCH_IS) {
-						tmp |= MAY_BE_RCN;
+						/* Variable reference counter may be decremented before use */
+						/* See: ext/opcache/tests/jit/fetch_r_001.phpt */
+						tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 					} else {
 						tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 					}

ext/opcache/tests/jit/fetch_r_001.phpt

@@ -0,0 +1,16 @@
+--TEST--
+FETCH_R: 001 result reference counter may be decremented befor use
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+$x = [&$v];
+$y = 'x';
+$$y == [&$x[0]];
+?>
+DONE
+--EXPECT--
+DONE