From a20c9bd3fec9b1df83193ae0db18cb04064461e3 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Sat, 16 Dec 2017 23:59:10 +0800
Subject: [PATCH] Fixed bug #75687 (var 8 (TMP) has array key type but not
 value type)

---
 NEWS                                   |  4 ++++
 ext/opcache/Optimizer/zend_inference.c |  3 +++
 ext/opcache/tests/bug75687.phpt        | 21 +++++++++++++++++++++
 3 files changed, 28 insertions(+)
 create mode 100644 ext/opcache/tests/bug75687.phpt

diff --git a/NEWS b/NEWS
index e8d8ef71e4c53..7dec72ca52176 100644
--- a/NEWS
+++ b/NEWS
@@ -5,6 +5,10 @@ PHP                                                                        NEWS
 - Core:
   . Fixed bug #75679 (Path 260 character problem). (Anatol)
 
+- Opcache:
+  . Fixed bug #75687 (var 8 (TMP) has array key type but not value type).
+    (Laruence)
+
 - PGSQL:
   . Fixed bug #75671 (pg_version() crashes when called on a connection to
     cockroach). (magicaltux at gmail dot com)
diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index dd49cc1a03d7f..263df059f033e 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -3338,6 +3338,9 @@ int zend_infer_types_ex(const zend_op_array *op_array, const zend_script *script
 							/* Ignore the constraint (either ce instanceof constraint->ce or
 							 * they are unrelated, as far as we can statically determine) */
 						}
+					} else if ((tmp & MAY_BE_ANY) == 0) {
+						/* FIXME: usage in unreachable block */
+						tmp |= MAY_BE_UNDEF;
 					}
 				}
 
diff --git a/ext/opcache/tests/bug75687.phpt b/ext/opcache/tests/bug75687.phpt
new file mode 100644
index 0000000000000..67cf8288a9784
--- /dev/null
+++ b/ext/opcache/tests/bug75687.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #75687 (var 8 (TMP) has array key type but not value type)
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+
+function x($y)
+{
+	if (is_array($y)) {
+		$z = is_array($y) ? array() : array($y);
+	}
+}
+?>
+okey
+--EXPECT--
+okey