Fixed type inference

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 6e0d0cb5d914733539a117f05d12b20c50efa264..d333947c660215e8a0d64adf4c42bb8935e3692c 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -3075,7 +3075,13 @@ static int zend_update_type_info(const zend_op_array *op_array,
                                        }
                                        j = zend_ssa_next_use(ssa_ops, ssa_ops[i].result_def, j);
                                }
-                               UPDATE_SSA_TYPE(tmp, ssa_ops[i].op1_def);
+                               if ((tmp & MAY_BE_ARRAY)
+                                && (tmp & (MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING))) {
+                                       UPDATE_SSA_TYPE(tmp, ssa_ops[i].op1_def);
+                               } else {
+                                       /* invalid key type */
+                                       UPDATE_SSA_TYPE(t1, ssa_ops[i].op1_def);
+                               }
                                COPY_SSA_OBJ_TYPE(ssa_ops[i].op1_use, ssa_ops[i].op1_def);
                        }
                        /* FETCH_LIST on a string behaves like FETCH_R on null */