Don't unconditionally add array value type for undef

We have an invariant that an array value type is set if and only
if an array key type is set, which is violated for the case of
undef values for always invalid keys.

Author: nikic

ext/opcache/Optimizer/zend_inference.c

@@ -2047,7 +2047,7 @@ static uint32_t assign_dim_result_type(
 		 * key type exists iff a value type exists even in dead code that may use empty types. */
 		if (value_type & (MAY_BE_ANY|MAY_BE_UNDEF)) {
 			if (value_type & MAY_BE_UNDEF) {
-				tmp |= MAY_BE_ARRAY_OF_NULL;
+				value_type |= MAY_BE_NULL;
 			}
 			if (dim_op_type == IS_UNUSED) {
 				tmp |= MAY_BE_ARRAY_KEY_LONG;

ext/opcache/tests/invalid_array_key_type.phpt

@@ -13,6 +13,9 @@ function test(\SplObjectStorage $definitions = null) {
     $definitions[$argument] = 1;
     $definitions[$argument] += 1;
 }
+function test2() {
+    $a[[]] = $undef;
+}
 
 ?>
 ===DONE===