VERIFY_RETURN_TYPE on references can't be eliminated

diff --git a/ext/opcache/Optimizer/dfa_pass.c b/ext/opcache/Optimizer/dfa_pass.c
index 63faaf62c38c6cb7b4e96d704aeea31e0c90b116..b7a0f065f736056abfe2132644560fbdca366669 100644 (file)
--- a/ext/opcache/Optimizer/dfa_pass.c
+++ b/ext/opcache/Optimizer/dfa_pass.c
@@ -312,6 +312,10 @@ static inline zend_bool can_elide_return_type_check(
        zend_ssa_var_info *use_info = &ssa->var_info[ssa_op->op1_use];
        zend_ssa_var_info *def_info = &ssa->var_info[ssa_op->op1_def];
 
+       if (use_info->type & MAY_BE_REF) {
+               return 0;
+       }
+
        /* A type is possible that is not in the allowed types */
        if ((use_info->type & (MAY_BE_ANY|MAY_BE_UNDEF)) & ~(def_info->type & MAY_BE_ANY)) {
                return 0;