Fix #79364: When copy empty array, next key is unspecified

We must not forget to keep the `nNextFreeElement` when duplicating
empty arrays.

diff --git a/NEWS b/NEWS
index f3750061e169e2b9c84bd09b633d1252e40fd3f2..b290b23f81bdb8d8efbb3056d59bda278999be75 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,9 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? ????, PHP 7.3.17
 
+- Core:
+  . Fixed bug #79364 (When copy empty array, next key is unspecified). (cmb)
+
 - Spl:
   . Fixed bug #75673 (SplStack::unserialize() behavior). (cmb)
 

diff --git a/Zend/tests/bug79364.phpt b/Zend/tests/bug79364.phpt
new file mode 100644 (file)
index 0000000..6d96b4d
--- /dev/null
+++ b/Zend/tests/bug79364.phpt
@@ -0,0 +1,22 @@
+--TEST--
+Bug #79364 (When copy empty array, next key is unspecified)
+--FILE--
+<?php
+$a = [1, 2];
+unset($a[1], $a[0]);
+$b = $a;
+
+$a[] = 3;
+$b[] = 4;
+
+var_dump($a, $b);
+?>
+--EXPECT--
+array(1) {
+  [2]=>
+  int(3)
+}
+array(1) {
+  [2]=>
+  int(4)
+}

diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 8c0bce5b411ff6d47fdbf04e17a423000edb0094..6fc4666da9ae2e499bcddf358e6c155813009e73 100644 (file)
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -1934,7 +1934,7 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
                target->nTableMask = HT_MIN_MASK;
                target->nNumUsed = 0;
                target->nNumOfElements = 0;
-               target->nNextFreeElement = 0;
+               target->nNextFreeElement = source->nNextFreeElement;
                target->nInternalPointer = 0;
                HT_SET_DATA_ADDR(target, &uninitialized_bucket);
        } else if (GC_FLAGS(source) & IS_ARRAY_IMMUTABLE) {