sccp-02.diff

diff --git a/ext/opcache/Optimizer/sccp.c b/ext/opcache/Optimizer/sccp.c
index 5511313fae..1fe0f52f34 100644
--- a/ext/opcache/Optimizer/sccp.c
+++ b/ext/opcache/Optimizer/sccp.c
@@ -1230,6 +1230,16 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 			 * ADD_ARRAY_ELEMENT chain. We do this by only keeping the array on the last opcode
 			 * and use a NULL value everywhere else. */
 			if (Z_TYPE(ctx->values[ssa_op->result_def]) == IS_NULL) {
+				do {
+					int use = ctx->scdf.ssa->vars[ssa_op->result_def].use_chain;
+
+					SET_RESULT_BOT(result);
+					ZEND_ASSERT(use >= 0);
+					opline = ctx->scdf.op_array->opcodes + use;
+					ZEND_ASSERT(opline->opcode == ZEND_ADD_ARRAY_ELEMENT);
+					ssa_op = ctx->scdf.ssa->ops + use;
+				} while (Z_TYPE(ctx->values[ssa_op->result_def]) == IS_NULL);
+				SET_RESULT_BOT(result);
 				return;
 			}