Fix type inference

This fixes oss-fuzz #47422

Author: dstogov

ext/opcache/Optimizer/zend_inference.c

@@ -2639,8 +2639,8 @@ static zend_always_inline int _zend_update_type_info(
 						tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING;
 					}
 				}
-				if (!tmp) {
-					tmp = MAY_BE_NULL;
+				if (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE)) {
+					tmp |= MAY_BE_NULL;
 				}
 				tmp |= MAY_BE_RC1 | MAY_BE_RCN;
 				UPDATE_SSA_TYPE(tmp, ssa_op->result_def);

ext/opcache/tests/opt/inference_008.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Type inference 008: ASSIGN_DIM with invalid op1
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+function y() {
+    $j = 0;
+    for(;;) {
+        $cs = $a + $a;
+        $a = [] ?? $cs[] = $j;
+    }
+}
+?>
+DONE
+--EXPECT--
+DONE