Merge branch 'PHP-7.0' into PHP-7.1

* PHP-7.0:
  Fixed bug #72943 (assign_dim on string doesn't reset hval)

Conflicts:
	Zend/zend_execute.c

diff --cc NEWS
index cab86791130690aba129781f3819e416a3397f62,1fc159a17bc2cb0d574b392d060d85e6cb836f44..7661933b24bfe5d3335847d241b874d4be51775e
--- 1/NEWS
--- 2/NEWS
+++ b/NEWS
@@@ -1,9 -1,15 +1,10 @@@
  PHP                                                                        NEWS
  |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 -?? ??? 2016 PHP 7.0.11
 +?? ??? 2016, PHP 7.1.0RC1
  
  - Core:
 -  . Fixed bug #72911 (Memleak in zend_binary_assign_op_obj_helper). (Laruence)
 -  . Fixed bug #72813 (Segfault with __get returned by ref). (Laruence)
 -  . Fixed bug #72767 (PHP Segfaults when trying to expand an infinite operator).
 -    (Nikita)
 -  . Fixed bug #72854 (PHP Crashes on duplicate destructor call). (Nikita)
 -  . Fixed bug #72857 (stream_socket_recvfrom read access violation). (Anatol)
+   . Fixed bug #72943 (assign_dim on string doesn't reset hval). (Laruence)
 +  . Fixed bug #72598 (Reference is lost after array_slice()) (Nikita)
  
  - COM:
    . Fixed bug #72922 (COM called from PHP does not return out parameters).

diff --cc Zend/zend_execute.c
index d2411ad5c3be30c98c644011ee3815772eb3a921,2882f3dc33de5e69d7aaec4ec8b8c69def71fcde..f0f249e243435566242cb809bf034ee2d39db871
--- 1/Zend/zend_execute.c
--- 2/Zend/zend_execute.c
+++ b/Zend/zend_execute.c
@@@ -1324,18 -1324,28 +1324,19 @@@ static zend_never_inline void zend_assi
                memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
                Z_STRVAL_P(str)[offset+1] = 0;
        } else if (!Z_REFCOUNTED_P(str)) {
 +              old_str = Z_STR_P(str);
                Z_STR_P(str) = zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
                Z_TYPE_INFO_P(str) = IS_STRING_EX;
 -      }
 -
 -      if (Z_TYPE_P(value) != IS_STRING) {
 -              zend_string *tmp = zval_get_string(value);
 -
 -              Z_STRVAL_P(str)[offset] = ZSTR_VAL(tmp)[0];
 -              zend_string_release(tmp);
 +              zend_string_release(old_str);
        } else {
 -              Z_STRVAL_P(str)[offset] = Z_STRVAL_P(value)[0];
 +              SEPARATE_STRING(str);
+               zend_string_forget_hash_val(Z_STR_P(str));
        }
 -      /*
 -       * the value of an assignment to a string offset is undefined
 -      T(result->u.var).var = &T->str_offset.str;
 -      */
  
 -      zend_string_release(old_str);
 -      if (result) {
 -              zend_uchar c = (zend_uchar)Z_STRVAL_P(str)[offset];
 +      Z_STRVAL_P(str)[offset] = c;
  
 +      if (result) {
 +              /* Return the new character */
                if (CG(one_char_string)[c]) {
                        ZVAL_INTERNED_STR(result, CG(one_char_string)[c]);
                } else {