Fix DFG construction for VERIFY_RETURN

`use` only contains uses prior to definition. This was not
honoured for VERIFY_RETURN with a temporary operand.

The test case only breaks on PHP 7.2.

ext/opcache/Optimizer/zend_dfg.c

@@ -144,11 +144,11 @@ op1_use:
 					}
 				} else if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
 					var_num = EX_VAR_TO_NUM(opline->op1.var);
-					if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
+					if (!DFG_ISSET(def, set_size, j, var_num)) {
 						DFG_SET(use, set_size, j, var_num);
+					}
+					if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
 						DFG_SET(def, set_size, j, var_num);
-					} else if (!DFG_ISSET(def, set_size, j, var_num)) {
-						DFG_SET(use, set_size, j, var_num);
 					}
 				}
 				if (opline->op2_type == IS_CV) {

ext/opcache/tests/verify_return_dfg.phpt

@@ -0,0 +1,16 @@
+--TEST--
+Incorrect liveness computation for verify-return
+--FILE--
+<?php
+function test($foo): string
+{
+    switch ($foo) {
+        default:  $bar = 'x'; break;
+        case 'z': $bar = 'y'; break;
+    }
+    return (string)$bar;
+}
+?>
+===DONE===
+--EXPECT--
+===DONE===