Merge branch 'PHP-8.0' into PHP-8.1

* PHP-8.0:
  Fix type inference for INIT_ARRAY with invalid index

Author: dstogov

Zend/Optimizer/zend_inference.c

@@ -3049,7 +3049,9 @@ static zend_always_inline int _zend_update_type_info(
 					arr_type = RES_USE_INFO();
 				}
 				tmp = MAY_BE_RC1|MAY_BE_ARRAY|arr_type;
-				if (opline->op1_type != IS_UNUSED) {
+				if (opline->op1_type != IS_UNUSED
+				 && (opline->op2_type == IS_UNUSED
+				  || (t2 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE|MAY_BE_STRING)))) {
 					tmp |= assign_dim_array_result_type(arr_type, t2, t1, opline->op2_type);
 					if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) {
 						tmp |= MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;

ext/opcache/tests/opt/inference_002.phpt

@@ -0,0 +1,15 @@
+--TEST--
+Type inference 002: Type inference for INIT_ARRAY with invalid index
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+var_dump([[]=>&$x]);
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Illegal offset type in %sinference_002.php:2
+Stack trace:
+#0 {main}
+  thrown in %sinference_002.php on line 2