Merge branch 'PHP-8.1'

* PHP-8.1:
  Fixed incorrect narrowing to double

Author: dstogov

Zend/Optimizer/zend_inference.c

@@ -4010,7 +4010,7 @@ static bool can_convert_to_double(
 	for (phi = var->phi_use_chain; phi; phi = zend_ssa_next_use_phi(ssa, var_num, phi)) {
 		/* Check that narrowing can actually be useful */
 		type = ssa->var_info[phi->ssa_var].type;
-		if ((type & MAY_BE_ANY) & ~(MAY_BE_LONG|MAY_BE_DOUBLE)) {
+		if (type & ((MAY_BE_ANY|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_DOUBLE))) {
 			return 0;
 		}
 

ext/opcache/tests/jit/assign_047.phpt

@@ -0,0 +1,25 @@
+--TEST--
+JIT ASSIGN: incorrect narrowing to double
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.protect_memory=1
+--FILE--
+<?php
+function test(){
+	$x = (object)['x'=>0];
+	for($i=0;$i<10;$i++){
+		+$a;
+		$a=$x->x;
+		$a=7;
+	}
+}
+test()
+?>
+DONE
+--EXPECTF--
+Warning: Undefined variable $a in %sassign_047.php on line 5
+DONE
+