Fix FETCH_OBJ_IS type inference

Even if the property is typed, null is still a valid return
value in the BP_VAR_IS case. Other cases will throw instead.

Author: nikic

ext/opcache/Optimizer/zend_inference.c

@@ -3452,6 +3452,10 @@ static zend_always_inline int _zend_update_type_info(
 							tmp &= ~MAY_BE_RC1;
 						}
 					}
+					if (opline->opcode == ZEND_FETCH_OBJ_IS) {
+						/* IS check may return null for uninitialized typed property. */
+						tmp |= MAY_BE_NULL;
+					}
 				}
 				UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
 				if (ce) {

ext/opcache/tests/jit/fetch_obj_is_typed_prop.phpt

@@ -0,0 +1,24 @@
+--TEST--
+FETCH_OBJ_IS on typed object property
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+
+class Test {
+    public stdClass $data;
+}
+
+function test() {
+    $test = new Test;
+    var_dump(isset($test->data[0]));
+}
+
+test();
+
+?>
+--EXPECT--
+bool(false)