Fix SplFixedArray::offsetGet() invocation for NULL offset

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 741b1dbf14e4bf454d8b3ecee5fa19fc54fee4aa..88b31504046f69cc6a6a99a76154ce557cc9eee1 100644 (file)
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -349,7 +349,7 @@ static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, in
        if (intern->fptr_offset_get) {
                zval tmp;
                if (!offset) {
-                       ZVAL_UNDEF(&tmp);
+                       ZVAL_NULL(&tmp);
                        offset = &tmp;
                } else {
                        SEPARATE_ARG_IF_REF(offset);

diff --git a/ext/spl/tests/bug64106.phpt b/ext/spl/tests/bug64106.phpt
index 855caef2136ec5aa0bd7abaca5fdda688acb9def..26203c4e2e9a28816a862b3f76bc6850f865aea3 100644 (file)
--- a/ext/spl/tests/bug64106.phpt
+++ b/ext/spl/tests/bug64106.phpt
@@ -4,7 +4,7 @@ Bug #64106: Segfault on SplFixedArray[][x] = y when extended
 <?php
 
 class MyFixedArray extends SplFixedArray {
-    public function offsetGet($offset) {}
+    public function offsetGet($offset) { var_dump($offset); }
 }
 
 $array = new MyFixedArray(10);
@@ -12,4 +12,6 @@ $array[][1] = 10;
 
 ?>
 --EXPECTF--
+NULL
+
 Notice: Indirect modification of overloaded element of MyFixedArray has no effect in %s on line %d