Assert and ??= can lead to use-of-uninitialized-value due to memoization

[iluuu1994]

Description

The following code:

<?php
assert(y)[y] ??= y;

Resulted in this output:

$_main:
     ; (lines=26, args=0, vars=0, tmps=10)
     ; (before optimizer)
     ; /home/dmitry/tmp/fuzz-60129.php:1-3
     ; return  [] RANGE[0..0]
0000 V2 = ASSERT_CHECK 0007
0001 INIT_FCALL 2 112 string("assert")
0002 T0 = FETCH_CONSTANT string("y")
0003 T1 = COPY_TMP T0
0004 SEND_VAL T0 1
0005 SEND_VAL string("assert(y)") 2
0006 V2 = DO_ICALL
0007 T3 = FETCH_CONSTANT string("y")
0008 T4 = COPY_TMP T3
0009 T5 = FETCH_DIM_IS V2 T3
0010 T6 = COALESCE T5 0022
0011 T7 = FETCH_CONSTANT string("y")
0012 V8 = ASSERT_CHECK 0017
0013 INIT_FCALL 2 112 string("assert")
0014 SEND_VAL T1 1                                                 ; <== T1 may be uninitialized here
0015 SEND_VAL string("assert(y)") 2
0016 V8 = DO_ICALL
0017 V8 = SEPARATE V8
0018 T9 = ASSIGN_DIM V8 T4
0019 OP_DATA T7
0020 T6 = QM_ASSIGN T9
0021 JMP 0024
0022 FREE T1
0023 FREE T4
0024 FREE T6
0025 RETURN int(1)

PHP Version

PHP-8.1

Operating System

No response