Improve ASSIGN_OBJ[_REF] RC inference

* ASSIGN_OBJ may only modify RC if it implements __set.
* ASSIGN_OBJ_REF does not call __set, and thus may not modify RC.

Author: iluuu1994

Zend/Optimizer/zend_inference.c

@@ -3022,16 +3022,29 @@ static zend_always_inline zend_result _zend_update_type_info(
 				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
 			}
 			break;
-		case ZEND_ASSIGN_OBJ:
+		case ZEND_ASSIGN_OBJ: {
+			const zend_property_info *prop_info = NULL;
 			if (opline->op1_type == IS_CV) {
-				tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN;
+				bool add_rc = false;
+				if (t1 & MAY_BE_OBJECT) {
+					prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op);
+					if (!prop_info) {
+						zend_class_entry *ce = ssa_var_info[ssa_op->op1_use].ce;
+						if (!ce || ce->__set || !(ce->ce_flags & ZEND_ACC_FINAL)) {
+							add_rc = true;
+						}
+					}
+				}
+				tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT|MAY_BE_RC1|MAY_BE_RCN))|(add_rc ? (MAY_BE_RC1|MAY_BE_RCN) : 0);
 				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
 				COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
 			}
 			if (ssa_op->result_def >= 0) {
 				// TODO: If there is no __set we might do better
-				tmp = zend_fetch_prop_type(script,
-					zend_fetch_prop_info(op_array, ssa, opline, ssa_op), &ce);
+				if (!prop_info) {
+					prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op);
+				}
+				tmp = zend_fetch_prop_type(script, prop_info, &ce);
 				UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
 				if (ce) {
 					UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
@@ -3047,6 +3060,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
 			}
 			break;
+		}
 		case ZEND_ASSIGN_STATIC_PROP:
 			if (ssa_op->result_def >= 0) {
 				tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;
@@ -3157,15 +3171,6 @@ static zend_always_inline zend_result _zend_update_type_info(
 			}
 			break;
 		case ZEND_ASSIGN_OBJ_REF:
-			if (opline->op1_type == IS_CV && ssa_op->op1_def >= 0) {
-				tmp = t1;
-				if (tmp & MAY_BE_OBJECT) {
-					tmp |= MAY_BE_RC1 | MAY_BE_RCN;
-				}
-				UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
-				COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
-			}
-
 			t2 = OP1_DATA_INFO();
 			if ((opline+1)->op1_type == IS_VAR && (opline->extended_value & ZEND_RETURNS_FUNCTION)) {
 				tmp = (MAY_BE_REF | MAY_BE_RCN | MAY_BE_RC1 | t2) & ~MAY_BE_UNDEF;

Zend/Optimizer/zend_ssa.c

@@ -607,12 +607,6 @@ static zend_always_inline int _zend_ssa_rename_op(const zend_op_array *op_array,
 			}
 			break;
 		case ZEND_ASSIGN_OBJ_REF:
-			if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op1_type == IS_CV) {
-				ssa_ops[k].op1_def = ssa_vars_count;
-				var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
-				ssa_vars_count++;
-				//NEW_SSA_VAR(opline->op1.var)
-			}
 			next = opline + 1;
 			if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
 				ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];