Fixed GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT

Author: dstogov

Zend/Optimizer/zend_inference.c

@@ -2530,7 +2530,8 @@ static zend_always_inline int _zend_update_type_info(
 	 * unreachable code. Propagate the empty result early, so that that the following
 	 * code may assume that operands have at least one type. */
 	if (!(t1 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
-		|| !(t2 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))) {
+		|| !(t2 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
+		|| (ssa_op->result_use >= 0 && !(RES_USE_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)))) {
 		tmp = 0;
 		if (ssa_op->result_def >= 0 && !(ssa_var_info[ssa_op->result_def].type & MAY_BE_REF)) {
 			UPDATE_SSA_TYPE(tmp, ssa_op->result_def);

ext/opcache/tests/opt/gh10008.phpt

@@ -0,0 +1,26 @@
+--TEST--
+GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function test()
+{
+    $bool_or_int = true;
+    while (a()) {
+        if ($bool_or_int !== true) {
+            // The following line triggers narrowing during type inference of ZEND_ADD_ARRAY_ELEMENT.
+            $string_key = "a";
+            $array = ["bool_or_int" => $bool_or_int, $string_key => 123];
+        }
+
+        $bool_or_int = 0;
+    }
+}
+?>
+DONE
+--EXPECT--
+DONE