Merge branch 'PHP-7.4'

Author: nikic

ext/opcache/Optimizer/zend_inference.c

@@ -2102,7 +2102,6 @@ static uint32_t assign_dim_result_type(
 		tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 	}
 	if (tmp & MAY_BE_ARRAY) {
-		tmp |= (value_type & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
 		if (value_type & MAY_BE_UNDEF) {
 			tmp |= MAY_BE_ARRAY_OF_NULL;
 		}
@@ -2123,6 +2122,11 @@ static uint32_t assign_dim_result_type(
 				tmp |= MAY_BE_ARRAY_KEY_STRING;
 			}
 		}
+		/* Only add value type if we have a key type. It might be that the key type is illegal
+		 * for arrays. */
+		if (tmp & MAY_BE_ARRAY_KEY_ANY) {
+			tmp |= (value_type & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
+		}
 	}
 	return tmp;
 }

ext/opcache/tests/invalid_array_key_type.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Don't add array value type is key type is illegal
+--FILE--
+<?php
+
+function test(\SplObjectStorage $definitions = null) {
+    $argument = new stdClass;
+    $definitions[$argument] = 1;
+    $definitions[$argument] += 1;
+    $argument = [];
+    $definitions[$argument] = 1;
+    $definitions[$argument] += 1;
+}
+
+?>
+===DONE===
+--EXPECT--
+===DONE===