Fix type inference

Fixes oss-fuzz #50272

Author: dstogov

Zend/Optimizer/zend_inference.c

@@ -1951,6 +1951,9 @@ static uint32_t assign_dim_array_result_type(
 				tmp |= MAY_BE_ARRAY_KEY_STRING;
 				if (dim_op_type != IS_CONST) {
 					// FIXME: numeric string
+					if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
+						tmp |= MAY_BE_ARRAY_PACKED;
+					}
 					tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
 				}
 			}

ext/opcache/tests/opt/inference_015.phpt

@@ -0,0 +1,19 @@
+--TEST--
+Type inference 015: ASSIGN_DIM_OP
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.optimization_level=-1
+--FILE--
+<?php
+function test() {
+    for(;;) {
+        $x[y.y] &= y;
+        $x = false;
+        $x[""] = y;
+    }
+}
+?>
+DONE
+--EXPECT--
+DONE