Fix refcount inference for typed properties

We were not adding RC1/RCN if the MAY_BE_OBJECT came from a class
type and there was no other refcounted type in the union.

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 0dd905e8f3de4de082edd8a3f38d0d85d5b0be49..99079200080ff9d8b15062efe8fe72edf861c64c 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2316,10 +2316,6 @@ static uint32_t zend_fetch_prop_type(const zend_script *script, zend_property_in
        }
        if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
                uint32_t type = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(prop_info->type));
-
-               if (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
-                       type |= MAY_BE_RC1 | MAY_BE_RCN;
-               }
                if (ZEND_TYPE_HAS_CLASS(prop_info->type)) {
                        type |= MAY_BE_OBJECT;
                        if (pce) {
@@ -2332,6 +2328,9 @@ static uint32_t zend_fetch_prop_type(const zend_script *script, zend_property_in
                                }
                        }
                }
+               if (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
+                       type |= MAY_BE_RC1 | MAY_BE_RCN;
+               }
                return type;
        }
        return MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;