Fix inference for compound object op on dim

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 64d6ba1aa4454d31cd4dde2abefee944a9c099e4..17e7d8e1a90fb492a318664735ba4ab75e364454 100644 (file)
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -3185,6 +3185,9 @@ static int zend_update_type_info(const zend_op_array *op_array,
                                                case ZEND_FETCH_DIM_W:
                                                case ZEND_FETCH_DIM_RW:
                                                case ZEND_FETCH_DIM_FUNC_ARG:
+                                               case ZEND_ASSIGN_DIM:
+                                                       tmp |= MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
+                                                       break;
                                                case ZEND_ASSIGN_ADD:
                                                case ZEND_ASSIGN_SUB:
                                                case ZEND_ASSIGN_MUL:
@@ -3197,8 +3200,11 @@ static int zend_update_type_info(const zend_op_array *op_array,
                                                case ZEND_ASSIGN_BW_AND:
                                                case ZEND_ASSIGN_BW_XOR:
                                                case ZEND_ASSIGN_POW:
-                                               case ZEND_ASSIGN_DIM:
-                                                       tmp |= MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
+                                                       if (op_array->opcodes[j].extended_value == ZEND_ASSIGN_DIM) {
+                                                               tmp |= MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
+                                                       } else if (op_array->opcodes[j].extended_value == ZEND_ASSIGN_OBJ) {
+                                                               tmp |= MAY_BE_ARRAY_OF_OBJECT;
+                                                       }
                                                        break;
                                                case ZEND_FETCH_OBJ_W:
                                                case ZEND_FETCH_OBJ_RW:

diff --git a/ext/opcache/tests/assign_obj_op_of_fetch_dim.phpt b/ext/opcache/tests/assign_obj_op_of_fetch_dim.phpt
new file mode 100644 (file)
index 0000000..c89d0be
--- /dev/null
+++ b/ext/opcache/tests/assign_obj_op_of_fetch_dim.phpt
@@ -0,0 +1,20 @@
+--TEST--
+Type inference for $ary[$idx]->prop +=
+--FILE--
+<?php
+
+function test() {
+    $ary = [];
+    $ary[0]->y += 2;
+    var_dump(is_object($ary[0]));
+}
+test();
+
+?>
+--EXPECTF--
+Notice: Undefined offset: 0 in %s on line %d
+
+Warning: Creating default object from empty value in %s on line %d
+
+Notice: Undefined property: stdClass::$y in %s on line %d
+bool(true)