Don't use CE info from pi node for MAY_BE_REF var

Once again, the actual class type may be reassigned indirectly.

Author: nikic

Zend/tests/assign_obj_to_ref_inference.phpt

@@ -7,15 +7,27 @@ class Test {
     public int $x = 42;
 }
 
-function test() {
+function test1() {
     $r =& $o;
     $o = new Test;
     $r = new stdClass;
     $r->x = 3.141;
     var_dump(is_float($o->x));
 }
-test();
+
+function test2($o) {
+    $r =& $o;
+    if ($o instanceof Test) {
+        $r = new stdClass;
+        $r->x = 3.141;
+        var_dump(is_float($o->x));
+    }
+}
+
+test1();
+test2(new Test);
 
 ?>
 --EXPECT--
 bool(true)
+bool(true)

ext/opcache/Optimizer/zend_inference.c

@@ -3629,7 +3629,11 @@ int zend_infer_types_ex(const zend_op_array *op_array, const zend_script *script
 				}
 
 				UPDATE_SSA_TYPE(tmp, j);
-				UPDATE_SSA_OBJ_TYPE(ce, is_instanceof, j);
+				if (tmp & MAY_BE_REF) {
+					UPDATE_SSA_OBJ_TYPE(NULL, 0, j);
+				} else {
+					UPDATE_SSA_OBJ_TYPE(ce, is_instanceof, j);
+				}
 			} else {
 				int first = 1;
 				int is_instanceof = 0;