MFH: - Fixed bug #22088 (array_shift() leaves next index to be +1 too much)

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 27e990f7c78da09ac8f1f77507f80999ad786e4a..d58f1991dbc68e474be24273e4aa1ba189a273cb 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1724,11 +1724,12 @@ static void _phpi_pop(INTERNAL_FUNCTION_PARAMETERS, int off_the_end)
                int k = 0;
                Bucket *p = Z_ARRVAL_PP(stack)->pListHead;
                while (p != NULL) {
-                       if (p->nKeyLength == 0)
+                       if (p->nKeyLength == 0) {
                                p->h = k++;
+                       }
                        p = p->pListNext;
                }
-               Z_ARRVAL_PP(stack)->nNextFreeElement = k+1;
+               Z_ARRVAL_PP(stack)->nNextFreeElement = k;
                zend_hash_rehash(Z_ARRVAL_PP(stack));
        } else if (!key_len) {
                Z_ARRVAL_PP(stack)->nNextFreeElement = Z_ARRVAL_PP(stack)->nNextFreeElement - 1;