- Fixed bug #22088 (array_shift() leaves next index to be +1 too much)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index b97adfab5b73b28c44af679c262207d9026ed36b..32edd74c1f9f79e850265115810500245af1fa75 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1860,11 +1860,12 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
                int k = 0;
                Bucket *p = Z_ARRVAL_PP(stack)->pListHead;
                while (p != NULL) {
-                       if (p->nKeyLength == 0)
+                       if (p->nKeyLength == 0) {
                                p->h = k++;
+                       }
                        p = p->pListNext;
                }
-               Z_ARRVAL_PP(stack)->nNextFreeElement = k+1;
+               Z_ARRVAL_PP(stack)->nNextFreeElement = k;
                zend_hash_rehash(Z_ARRVAL_PP(stack));
        } else if (!key_len) {
                Z_ARRVAL_PP(stack)->nNextFreeElement = Z_ARRVAL_PP(stack)->nNextFreeElement - 1;