Improve ZEND_NEW RC inference

ZEND_NEW returns RC1 if the instanciated class has no constructor.

Author: iluuu1994

Zend/Optimizer/zend_inference.c

@@ -3369,8 +3369,22 @@ static zend_always_inline zend_result _zend_update_type_info(
 			ce = zend_optimizer_get_class_entry_from_op1(script, op_array, opline);
 			if (ce) {
 				UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def);
+				/* New objects without constructors cannot escape. */
+				if (!ce->constructor
+				 && !ce->create_object
+				 && ce->default_object_handlers->get_constructor == zend_std_get_constructor) {
+					tmp &= ~MAY_BE_RCN;
+				}
 			} else if ((t1 & MAY_BE_CLASS) && ssa_op->op1_use >= 0 && ssa_var_info[ssa_op->op1_use].ce) {
-				UPDATE_SSA_OBJ_TYPE(ssa_var_info[ssa_op->op1_use].ce, ssa_var_info[ssa_op->op1_use].is_instanceof, ssa_op->result_def);
+				ce = ssa_var_info[ssa_op->op1_use].ce;
+				UPDATE_SSA_OBJ_TYPE(ce, ssa_var_info[ssa_op->op1_use].is_instanceof, ssa_op->result_def);
+				/* New objects without constructors cannot escape. */
+				if (!ssa_var_info[ssa_op->result_def].is_instanceof
+				 && !ce->constructor
+				 && !ce->create_object
+				 && ce->default_object_handlers->get_constructor == zend_std_get_constructor) {
+					tmp &= ~MAY_BE_RCN;
+				}
 			} else {
 				UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
 			}