Check that MAY_BE_REF variables cannot have a ce

Author: nikic

Zend/Optimizer/ssa_integrity.c

@@ -176,6 +176,9 @@ void ssa_verify_integrity(zend_op_array *op_array, zend_ssa *ssa, const char *ex
 		if ((type & MAY_BE_ARRAY_OF_ANY) && !(type & MAY_BE_ARRAY_KEY_ANY)) {
 			FAIL("var " VARFMT " has array value type but not key type\n", VAR(i));
 		}
+		if ((type & MAY_BE_REF) && ssa->var_info[i].ce) {
+			FAIL("var " VARFMT " may be ref but has ce\n", VAR(i));
+		}
 	}
 
 	/* Instructions */

Zend/Optimizer/zend_inference.c

@@ -3411,6 +3411,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 					tmp |= zend_fetch_prop_type(script, prop_info, &ce);
 					if (opline->result_type == IS_VAR) {
 						tmp |= MAY_BE_REF | MAY_BE_INDIRECT;
+						ce = NULL;
 					} else if (!(opline->op1_type & (IS_VAR|IS_TMP_VAR)) || !(t1 & MAY_BE_RC1)) {
 						zend_class_entry *ce = NULL;