Support VERIFY_RETURN_TYPE elision with unused operand

This handles the degenerate case where SCCP replaced the value in
the RETURN opcode with a constant, but the VERIFY_RETURN is still
there. We can still apply the same optimization, just don't need
to adjust the use list in this case.

The result is still sub-optimal in that a dead QM_ASSIGN is left
behind.

Author: nikic

Zend/Optimizer/dfa_pass.c

@@ -1236,7 +1236,6 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 				 && ssa->ops[op_1].op1_def == v
 				 && ssa->ops[op_1].op1_use >= 0
 				 && ssa->ops[op_1].op1_use_chain == -1
-				 && ssa->vars[v].use_chain >= 0
 				 && can_elide_return_type_check(op_array, ssa, &ssa->ops[op_1])) {
 
 // op_1: VERIFY_RETURN_TYPE #orig_var.? [T] -> #v.? [T] => NOP
@@ -1245,10 +1244,11 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 					if (zend_ssa_unlink_use_chain(ssa, op_1, orig_var)) {
 
 						int ret = ssa->vars[v].use_chain;
-
-						ssa->ops[ret].op1_use = orig_var;
-						ssa->ops[ret].op1_use_chain = ssa->vars[orig_var].use_chain;
-						ssa->vars[orig_var].use_chain = ret;
+						if (ret >= 0) {
+							ssa->ops[ret].op1_use = orig_var;
+							ssa->ops[ret].op1_use_chain = ssa->vars[orig_var].use_chain;
+							ssa->vars[orig_var].use_chain = ret;
+						}
 
 						ssa->vars[v].definition = -1;
 						ssa->vars[v].use_chain = -1;

ext/opcache/tests/opt/verify_return_type.phpt

@@ -37,6 +37,16 @@ class Test2 {
     }
 }
 
+class Test3 {
+    private function getBool() {
+        return true;
+    }
+
+    private function getBool2(): bool {
+        return $this->getBool();
+    }
+}
+
 ?>
 --EXPECTF--
 $_main:
@@ -91,3 +101,16 @@ Test2::getInt3:
 0003 V1 = DO_FCALL
 0004 VERIFY_RETURN_TYPE V1
 0005 RETURN V1
+
+Test3::getBool:
+     ; (lines=1, args=0, vars=0, tmps=0)
+     ; (after optimizer)
+     ; %s
+0000 RETURN bool(true)
+
+Test3::getBool2:
+     ; (lines=2, args=0, vars=0, tmps=1)
+     ; (after optimizer)
+     ; %s
+0000 V0 = QM_ASSIGN bool(true)
+0001 RETURN bool(true)