Fixed type-infer on ZEND_FETCH_DIM_FUNC_ARG

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 26ab08faeb98370f0c4e4984934766eb3cd1291e..6457c931778dec0b3959c7315b8a576bdfe4f27a 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2978,9 +2978,15 @@ static int zend_update_type_info(const zend_op_array *op_array,
                                                }
                                                tmp |= MAY_BE_ARRAY | MAY_BE_RC1;
                                        }
-                                       if (t1 & (MAY_BE_STRING|MAY_BE_ARRAY)) {
+                                       if (t1 & MAY_BE_STRING) {
                                                tmp |= MAY_BE_RC1;
                                        }
+                                       if (t1 & MAY_BE_ARRAY) {
+                                               tmp |= MAY_BE_RC1;
+                                               if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG) {
+                                                       tmp |= MAY_BE_RCN;
+                                               }
+                                       }
                                        if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
                                                tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN);
                                        }