Fix phpGH-16499: [JIT] Undefined to null coercion issues for return

Author: dstogov

Zend/Optimizer/zend_inference.c

@@ -3895,6 +3895,9 @@ static zend_always_inline zend_result _zend_update_type_info(
 			} else {
 				zend_arg_info *ret_info = op_array->arg_info - 1;
 				tmp = zend_fetch_arg_info_type(script, ret_info, &ce);
+				if ((tmp & MAY_BE_NULL) && opline->op1_type == IS_CV) {
+					tmp |= MAY_BE_UNDEF;
+				}
 				tmp |= (t1 & MAY_BE_INDIRECT);
 
 				// TODO: We could model more precisely how illegal types are converted.

ext/opcache/jit/zend_jit_helpers.c

@@ -1828,6 +1828,12 @@ static bool ZEND_FASTCALL zend_jit_verify_arg_slow(zval *arg, zend_arg_info *arg
 
 static void ZEND_FASTCALL zend_jit_verify_return_slow(zval *arg, const zend_op_array *op_array, zend_arg_info *arg_info, void **cache_slot)
 {
+    if (Z_TYPE_P(arg) == IS_NULL) {
+		ZEND_ASSERT(ZEND_TYPE_IS_SET(arg_info->type));
+		if (EXPECTED(ZEND_TYPE_CONTAINS_CODE(arg_info->type, IS_NULL))) {
+			return;
+		}
+	}
 	if (UNEXPECTED(!zend_check_user_type_slow(
 			&arg_info->type, arg, /* ref */ NULL, cache_slot, /* is_return_type */ true))) {
 		zend_verify_return_error((zend_function*)op_array, arg);

ext/opcache/tests/jit/gh16499.phpt

@@ -0,0 +1,28 @@
+--TEST--
+GH-16499 (Undefined to null coercion issues for return)
+--EXTENSIONS--
+opcache
+--INI--
+opcache.jit_buffer_size=64M
+--FILE--
+<?php
+function test($cond): ?int {
+    if ($cond) {
+        $i = 'foo';
+    }
+    return $i;
+}
+
+var_dump(test(false));
+var_dump(test(false));
+?>
+--EXPECTF--
+Warning: Undefined variable $i in %sgh16499.php on line 6
+
+Warning: Undefined variable $i in %sgh16499.php on line 6
+NULL
+
+Warning: Undefined variable $i in %sgh16499.php on line 6
+
+Warning: Undefined variable $i in %sgh16499.php on line 6
+NULL