Merge branch 'PHP-8.1'

* PHP-8.1:
  Fix inference for assignment of known object to reference

Author: nikic

Zend/Optimizer/zend_inference.c

@@ -2809,7 +2809,11 @@ static zend_always_inline zend_result _zend_update_type_info(
 					tmp |= MAY_BE_DOUBLE;
 				}
 				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
-				COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op1_def);
+				if (tmp & MAY_BE_REF) {
+					UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->op1_def);
+				} else {
+					COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op1_def);
+				}
 			}
 			if (ssa_op->result_def >= 0) {
 				if (tmp & MAY_BE_REF) {

Zend/tests/assign_obj_to_ref_inference.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Assigning an object of known type to a reference variable
+--FILE--
+<?php
+
+class Test {
+    public int $x = 42;
+}
+
+function test() {
+    $r =& $o;
+    $o = new Test;
+    $r = new stdClass;
+    $r->x = 3.141;
+    var_dump(is_float($o->x));
+}
+test();
+
+?>
+--EXPECT--
+bool(true)