Fixed type inference

Author: dstogov

ext/opcache/Optimizer/zend_inference.c

@@ -2331,12 +2331,14 @@ static int zend_update_type_info(const zend_op_array *op_array,
 				}
 			} else if (opline->extended_value == ZEND_ASSIGN_OBJ) {
 				if (opline->op1_type == IS_CV) {
-					if (orig & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
-						orig &= (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
-						orig |= MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
-					}
-					if (orig & MAY_BE_OBJECT) {
-						orig |= (MAY_BE_RC1|MAY_BE_RCN);
+					if (!(orig & MAY_BE_REF)) {
+						if (orig & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
+							orig &= (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
+							orig |= MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
+						}
+						if (orig & MAY_BE_OBJECT) {
+							orig |= (MAY_BE_RC1|MAY_BE_RCN);
+						}
 					}
 					UPDATE_SSA_TYPE(orig, ssa_ops[i].op1_def);
 					COPY_SSA_OBJ_TYPE(ssa_ops[i].op1_use, ssa_ops[i].op1_def);