Fix range() return type inference for undef operand

This results in a long range.

Author: nikic

Zend/Optimizer/zend_func_info.c

@@ -75,7 +75,8 @@ static uint32_t zend_range_info(const zend_call_info *call_info, const zend_ssa
 				|| (t3 & (MAY_BE_DOUBLE|MAY_BE_STRING))) {
 			tmp |= MAY_BE_ARRAY_OF_DOUBLE;
 		}
-		if ((t1 & (MAY_BE_ANY-(MAY_BE_STRING|MAY_BE_DOUBLE))) && (t2 & (MAY_BE_ANY-(MAY_BE_STRING|MAY_BE_DOUBLE)))) {
+		if ((t1 & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_STRING|MAY_BE_DOUBLE)))
+				&& (t2 & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_STRING|MAY_BE_DOUBLE)))) {
 			if ((t3 & MAY_BE_ANY) != MAY_BE_DOUBLE) {
 				tmp |= MAY_BE_ARRAY_OF_LONG;
 			}

ext/opcache/tests/invalid_array_key_type.phpt

@@ -16,6 +16,9 @@ function test(\SplObjectStorage $definitions = null) {
 function test2() {
     $a[[]] = $undef;
 }
+function test3() {
+    foreach (range(0, $undef) as $v) { }
+}
 
 ?>
 ===DONE===