Check array flags

Author: iluuu1994

Zend/zend_execute.c

@@ -5342,8 +5342,7 @@ static bool zend_verify_type_inference(uint32_t type_mask, zval *value)
 		value = Z_REFVAL_P(value);
 	}
 
-	uint32_t type = 1u << Z_TYPE_P(value);
-	if (!(type_mask & type)) {
+	if (!(type_mask & (1u << Z_TYPE_P(value)))) {
 		return false;
 	}
 
@@ -5352,6 +5351,19 @@ static bool zend_verify_type_inference(uint32_t type_mask, zval *value)
 		uint32_t num_checked = 0;
 		zend_string *str;
 		zval *val;
+		if (HT_IS_INITIALIZED(ht)) {
+			if (zend_hash_num_elements(ht) == 0
+			 && !(type_mask & MAY_BE_ARRAY_EMPTY)
+			 && (MAY_BE_PACKED(type_mask) || MAY_BE_PACKED(type_mask))) {
+				return false;
+			}
+			if (HT_IS_PACKED(ht) && !MAY_BE_PACKED(type_mask)) {
+				return false;
+			}
+			if (!HT_IS_PACKED(ht) && !MAY_BE_HASH(type_mask)) {
+				return false;
+			}
+		}
 		ZEND_HASH_FOREACH_STR_KEY_VAL(ht, str, val) {
 			if (str) {
 				if (!(type_mask & MAY_BE_ARRAY_KEY_STRING)) {