Fix ASSIGN_STATIC_PROP_REF type inference

We were not inferring anything for the ASSIGN_STATIC_PROP_REF
result type at all, leaving it as an empty type. In the test
case this results in a live range being incorrectly eliminated,
but this could break in all kinds of other ways as well..

Author: nikic

ext/opcache/Optimizer/zend_inference.c

@@ -2938,6 +2938,9 @@ static zend_always_inline int _zend_update_type_info(
 			}
 			break;
 		case ZEND_ASSIGN_STATIC_PROP_REF:
+			if (ssa_op->result_def >= 0) {
+				UPDATE_SSA_TYPE(MAY_BE_REF, ssa_op->result_def);
+			}
 			if ((opline+1)->op1_type == IS_CV) {
 				opline++;
 				ssa_op++;

ext/opcache/tests/assign_static_prop_ref_result.phpt

@@ -0,0 +1,14 @@
+--TEST--
+ASSIGN_STATIC_PROP_REF result should have live range
+--FILE--
+<?php
+class Test {
+    public static $prop;
+}
+Test::$prop =& $v + UNDEF;
+?>
+--EXPECTF--
+Fatal error: Uncaught Error: Undefined constant "UNDEF" in %s:%d
+Stack trace:
+#0 {main}
+  thrown in %s on line %d