From df16fd149b8f9ae76ee0265ddb024a0f1cf8c9c8 Mon Sep 17 00:00:00 2001
From: Dmitry Stogov <dmitry@zend.com>
Date: Thu, 17 Jun 2021 13:03:09 +0300
Subject: [PATCH] Fixed incorrect type inference for "(array)$null".

---
 ext/opcache/Optimizer/zend_inference.c |  6 +++++-
 ext/opcache/tests/jit/cast_001.phpt    | 25 +++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 ext/opcache/tests/jit/cast_001.phpt

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index ec89f72c0b7..aa22d9bf32e 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2478,6 +2478,10 @@ static zend_always_inline int _zend_update_type_info(
 					tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 				} else {
 					tmp |= MAY_BE_RC1;
+					if (opline->extended_value == IS_ARRAY
+					 && (t1 & (MAY_BE_UNDEF|MAY_BE_NULL))) {
+						tmp |= MAY_BE_RCN;
+					}
 				}
 			}
 			if (opline->extended_value == IS_ARRAY) {
@@ -2487,7 +2491,7 @@ static zend_always_inline int _zend_update_type_info(
 				if (t1 & MAY_BE_OBJECT) {
 					tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
 				} else {
-					tmp |= ((t1 & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT) | ((t1 & MAY_BE_ANY) ? MAY_BE_ARRAY_PACKED : 0);
+					tmp |= ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) << MAY_BE_ARRAY_SHIFT) | ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) ? MAY_BE_ARRAY_PACKED : 0);
 				}
 			}
 			UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
diff --git a/ext/opcache/tests/jit/cast_001.phpt b/ext/opcache/tests/jit/cast_001.phpt
new file mode 100644
index 00000000000..91fbd51764b
--- /dev/null
+++ b/ext/opcache/tests/jit/cast_001.phpt
@@ -0,0 +1,25 @@
+--TEST--
+JIT CAST: 001
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+opcache.jit=1205
+;opcache.jit_debug=1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+function foo (int $x = null) {
+    $a = (array)$x;
+    $a[] = 42;
+    var_dump($a);
+}
+foo(null);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(42)
+}