Start block at loop var free

This ensures that code directly before the loop var free is
separated out (and will generally be eliminated as unreachable).
This fixes some assumptions we have that unreachable loop var free
blocks start with the loop var free.

Fixes oss-fuzz #39395.

Author: nikic

Zend/tests/code_before_loop_var_free.phpt

@@ -0,0 +1,12 @@
+--TEST--
+Code before loop var free
+--FILE--
+<?php
+switch ($x > 0) {
+default:
+    return;
+    Y;
+}
+?>
+--EXPECTF--
+Warning: Undefined variable $x in %s on line %d

ext/opcache/Optimizer/zend_cfg.c

@@ -434,13 +434,12 @@ int zend_build_cfg(zend_arena **arena, const zend_op_array *op_array, uint32_t b
 				flags |= ZEND_FUNC_HAS_EXTENDED_FCALL;
 				break;
 			case ZEND_FREE:
-				if (opline->extended_value == ZEND_FREE_SWITCH) {
+			case ZEND_FE_FREE:
+				if (zend_optimizer_is_loop_var_free(opline)) {
+					BB_START(i);
 					flags |= ZEND_FUNC_FREE_LOOP_VAR;
 				}
 				break;
-			case ZEND_FE_FREE:
-				flags |= ZEND_FUNC_FREE_LOOP_VAR;
-				break;
 		}
 	}