Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
  Fixed GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT

Author: dstogov

Zend/Optimizer/zend_inference.c

@@ -2545,6 +2545,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 	 * code may assume that operands have at least one type. */
 	if (!(t1 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
 	 || !(t2 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
+	 || (ssa_op->result_use >= 0 && !(RES_USE_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)))
 	 || ((opline->opcode == ZEND_ASSIGN_DIM_OP
 	   || opline->opcode == ZEND_ASSIGN_OBJ_OP
 	   || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP

ext/opcache/tests/opt/gh10008.phpt

@@ -0,0 +1,26 @@
+--TEST--
+GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+--EXTENSIONS--
+opcache
+--FILE--
+<?php
+function test()
+{
+    $bool_or_int = true;
+    while (a()) {
+        if ($bool_or_int !== true) {
+            // The following line triggers narrowing during type inference of ZEND_ADD_ARRAY_ELEMENT.
+            $string_key = "a";
+            $array = ["bool_or_int" => $bool_or_int, $string_key => 123];
+        }
+
+        $bool_or_int = 0;
+    }
+}
+?>
+DONE
+--EXPECT--
+DONE