Transfer MAY_BE_INDIRECT for VERIFY_RETURN

If the input is indirect, the output will be indirect too.

Author: nikic

Zend/Optimizer/zend_inference.c

@@ -3545,6 +3545,7 @@ static zend_always_inline int _zend_update_type_info(
 			} else {
 				zend_arg_info *ret_info = op_array->arg_info - 1;
 				tmp = zend_fetch_arg_info_type(script, ret_info, &ce);
+				tmp |= (t1 & MAY_BE_INDIRECT);
 
 				// TODO: We could model more precisely how illegal types are converted.
 				uint32_t extra_types = t1 & ~tmp;