Fix refcount inference for typed properties

We were not adding RC1/RCN if the MAY_BE_OBJECT came from a class
type and there was no other refcounted type in the union.

Author: nikic

ext/opcache/Optimizer/zend_inference.c

@@ -2316,10 +2316,6 @@ static uint32_t zend_fetch_prop_type(const zend_script *script, zend_property_in
 	}
 	if (prop_info && ZEND_TYPE_IS_SET(prop_info->type)) {
 		uint32_t type = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(prop_info->type));
-
-		if (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
-			type |= MAY_BE_RC1 | MAY_BE_RCN;
-		}
 		if (ZEND_TYPE_HAS_CLASS(prop_info->type)) {
 			type |= MAY_BE_OBJECT;
 			if (pce) {
@@ -2332,6 +2328,9 @@ static uint32_t zend_fetch_prop_type(const zend_script *script, zend_property_in
 				}
 			}
 		}
+		if (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
+			type |= MAY_BE_RC1 | MAY_BE_RCN;
+		}
 		return type;
 	}
 	return MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;