Fix type inference of compound assignment to typed properties

[ndossche]

The result of ASSIGN_OBJ_OP and ASSIGN_STATIC_PROP_OP is coerced to the property type, but only DOUBLE->LONG and LONG/DOUBLE->STRING coercions were modelled. Other coercions resulted in an empty or too narrow type. When the property is unknown, BOOL and DOUBLE were also missing.

Inferred result type of $o->p OP= $v in weak mode:

Property	Value	Old	New	Runtime
int	float	long	long	int
?int	float	long	long	int
int|float	float	double	double	float
int|false	float	long	long	int
string	int	string	string	string
string|bool	int	string	string	string
bool	int	(empty)	bool	bool
float	int	(empty)	double	float
float|bool	string	(empty)	double|bool	float, bool if non-numeric
int|string	float	long	long|string	int, string for INF/NAN
int|bool	float	long	long|bool	int, bool for INF/NAN
(unknown)	any	+long|string	+scalar	any scalar

In strict mode, only int -> float coercion remains, e.g. a float property with an int value infers double, and an unknown property only adds double to the value type.

[arnaud-lb]

Looks good to me otherwise

[arnaud-lb]

Pre-existing, but this is not true for unset properties with a __get:

class B {
    public bool $b = false;
    function __construct() { unset($this->b); }
    function __get($n) { return 100; }
}
function f(B $o) { $r = ($o->b += 1); return [is_bool($r), $r]; }
var_dump(f(new B));
// opcache off: [false, int(2)]   opcache on: [true, int(2)]

[ndossche]

... fantastic (not)