Fixed reference-counter inference

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index be9add10cf792024a52a336970e84760056f69ea..1bcce64a28a5a0536da32de5cbc65b537710c8e3 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -3392,18 +3392,20 @@ static zend_always_inline int _zend_update_type_info(
                                if (opline->result_type != IS_TMP_VAR) {
                                        tmp |= MAY_BE_REF | MAY_BE_INDIRECT;
                                } else if (!(opline->op1_type & (IS_VAR|IS_TMP_VAR)) || !(t1 & MAY_BE_RC1)) {
+                                       zend_class_entry *ce = NULL;
+
+                                       if (opline->op1_type == IS_UNUSED) {
+                                               ce = op_array->scope;
+                                       } else if (ssa_op->op1_use >= 0 && !ssa->var_info[ssa_op->op1_use].is_instanceof) {
+                                               ce = ssa->var_info[ssa_op->op1_use].ce;
+                                       }
                                        if (prop_info) {
                                                /* FETCH_OBJ_R/IS for plain property increments reference counter,
                                                   so it can't be 1 */
-                                               tmp &= ~MAY_BE_RC1;
-                                       } else {
-                                               zend_class_entry *ce = NULL;
-
-                                               if (opline->op1_type == IS_UNUSED) {
-                                                       ce = op_array->scope;
-                                               } else if (ssa_op->op1_use >= 0 && !ssa->var_info[ssa_op->op1_use].is_instanceof) {
-                                                       ce = ssa->var_info[ssa_op->op1_use].ce;
+                                               if (ce && !ce->create_object) {
+                                                       tmp &= ~MAY_BE_RC1;
                                                }
+                                       } else {
                                                if (ce && !ce->create_object && !ce->__get) {
                                                        tmp &= ~MAY_BE_RC1;
                                                }