Fix type inference

Fixes oss-fuzz #44407

Author: dstogov

ext/opcache/Optimizer/zend_inference.c

@@ -2625,6 +2625,9 @@ static zend_always_inline int _zend_update_type_info(
 				if (t1 & MAY_BE_STRING) {
 					tmp |= MAY_BE_STRING | MAY_BE_NULL;
 				}
+				if (t1 & MAY_BE_OBJECT) {
+					tmp |= (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF);
+				}
 				if (t1 & (MAY_BE_ARRAY|MAY_BE_FALSE|MAY_BE_NULL|MAY_BE_UNDEF)) {
 					tmp |= (OP1_DATA_INFO() & (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF));
 

ext/opcache/tests/jit/assign_dim_012.phpt

@@ -0,0 +1,18 @@
+--TEST--
+JIT ASSIGN_DIM: 012
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+--FILE--
+<?php
+function test($key) {
+    $ao = new ArrayObject();
+    $ao[$key] = 1 < $ao['321'] = 2;
+}
+test('0');
+?>
+DONE
+--EXPECTF--
+DONE