Fix inference for compound object op on dim

Author: nikic

ext/opcache/Optimizer/zend_inference.c

@@ -3185,6 +3185,9 @@ static int zend_update_type_info(const zend_op_array *op_array,
 						case ZEND_FETCH_DIM_W:
 						case ZEND_FETCH_DIM_RW:
 						case ZEND_FETCH_DIM_FUNC_ARG:
+						case ZEND_ASSIGN_DIM:
+							tmp |= MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
+							break;
 						case ZEND_ASSIGN_ADD:
 						case ZEND_ASSIGN_SUB:
 						case ZEND_ASSIGN_MUL:
@@ -3197,8 +3200,11 @@ static int zend_update_type_info(const zend_op_array *op_array,
 						case ZEND_ASSIGN_BW_AND:
 						case ZEND_ASSIGN_BW_XOR:
 						case ZEND_ASSIGN_POW:
-						case ZEND_ASSIGN_DIM:
-							tmp |= MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
+							if (op_array->opcodes[j].extended_value == ZEND_ASSIGN_DIM) {
+								tmp |= MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
+							} else if (op_array->opcodes[j].extended_value == ZEND_ASSIGN_OBJ) {
+								tmp |= MAY_BE_ARRAY_OF_OBJECT;
+							}
 							break;
 						case ZEND_FETCH_OBJ_W:
 						case ZEND_FETCH_OBJ_RW:

ext/opcache/tests/assign_obj_op_of_fetch_dim.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Type inference for $ary[$idx]->prop +=
+--FILE--
+<?php
+
+function test() {
+    $ary = [];
+    $ary[0]->y += 2;
+    var_dump(is_object($ary[0]));
+}
+test();
+
+?>
+--EXPECTF--
+Notice: Undefined offset: 0 in %s on line %d
+
+Warning: Creating default object from empty value in %s on line %d
+
+Notice: Undefined property: stdClass::$y in %s on line %d
+bool(true)