Fix type inference of SEND_UNPACK with empty array

An empty array will not be turned into an array of references.
This violated the invariant than an array has values iff it has
keys.

2 files changed, 28 insertions, 2 deletions

diff --git a/ext/opcache/Optimizer/zend_inference.c b/ext/opcache/Optimizer/zend_inference.c
index 9e88e4566b..64d6ba1aa4 100644
--- a/ext/opcache/Optimizer/zend_inference.c
+++ b/ext/opcache/Optimizer/zend_inference.c
@@ -2856,8 +2856,10 @@ static int zend_update_type_info(const zend_op_array *op_array,
 				tmp = t1;
 				if (t1 & MAY_BE_ARRAY) {
 					tmp |= MAY_BE_RC1 | MAY_BE_RCN;
-					/* SEND_UNPACK may acquire references into the array */
-					tmp |= MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+					if (t1 & MAY_BE_ARRAY_OF_ANY) {
+						/* SEND_UNPACK may acquire references into the array */
+						tmp |= MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
+					}
 				}
 				if (t1 & MAY_BE_OBJECT) {
 					tmp |= MAY_BE_RC1 | MAY_BE_RCN;
diff --git a/ext/opcache/tests/send_unpack_empty_array.phpt b/ext/opcache/tests/send_unpack_empty_array.phpt
new file mode 100644
index 0000000000..4059ad40f1
--- /dev/null
+++ b/ext/opcache/tests/send_unpack_empty_array.phpt
@@ -0,0 +1,24 @@
+--TEST--
+Type inference of SEND_UNPACK with empty array
+--FILE--
+<?php
+function test() {
+    $array = [1, 2, 3];
+    $values = [];
+    var_dump(array_push($array, 4, ...$values));
+    var_dump($array);
+}
+test();
+?>
+--EXPECT--
+int(4)
+array(4) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+  [3]=>
+  int(4)
+}