Merge branch 'PHP-7.4'

Author: nikic

ext/opcache/Optimizer/zend_inference.c

@@ -3412,17 +3412,15 @@ static int zend_update_type_info(const zend_op_array *op_array,
 						case ZEND_FETCH_DIM_RW:
 						case ZEND_FETCH_DIM_FUNC_ARG:
 						case ZEND_FETCH_LIST_W:
-						case ZEND_ASSIGN_OP:
-						case ZEND_ASSIGN_DIM_OP:
-						case ZEND_ASSIGN_OBJ_OP:
-						case ZEND_ASSIGN_STATIC_PROP_OP:
 						case ZEND_ASSIGN_DIM:
+						case ZEND_ASSIGN_DIM_OP:
 							tmp |= MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
 							break;
 						case ZEND_FETCH_OBJ_W:
 						case ZEND_FETCH_OBJ_RW:
 						case ZEND_FETCH_OBJ_FUNC_ARG:
 						case ZEND_ASSIGN_OBJ:
+						case ZEND_ASSIGN_OBJ_OP:
 						case ZEND_ASSIGN_OBJ_REF:
 						case ZEND_PRE_INC_OBJ:
 						case ZEND_PRE_DEC_OBJ:

ext/opcache/tests/assign_obj_op_of_fetch_dim.phpt

@@ -0,0 +1,20 @@
+--TEST--
+Type inference for $ary[$idx]->prop +=
+--FILE--
+<?php
+
+function test() {
+    $ary = [];
+    $ary[0]->y += 2;
+    var_dump(is_object($ary[0]));
+}
+test();
+
+?>
+--EXPECTF--
+Notice: Undefined offset: 0 in %s on line %d
+
+Warning: Creating default object from empty value in %s on line %d
+
+Notice: Undefined property: stdClass::$y in %s on line %d
+bool(true)