Fixed bug #72116 (7.0.6 array_fill optimization breaks implementation)

diff --git a/NEWS b/NEWS
index 7499240dbb22f3c59f1e595775f64b790f2c5a43..9391ec6cbabc82fbf3351fd326d863d017cc6d68 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -51,6 +51,7 @@ PHP                                                                        NEWS
     (Laruence)
   . Fixed bug #72031 (array_column() against an array of objects discards all
     values matching null). (Nikita)
+  . Fixed bug #72116 (array_fill optimization breaks implementation). (Bob)
 
 28 Apr 2016 PHP 7.0.6
 

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 34dac68d1f9a65460964d6a3cac83887d37d368b..9e21295d85bb4d9c165e91ea45d5f46b09b8aae4 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -2029,6 +2029,7 @@ PHP_FUNCTION(array_fill)
                        Z_ARRVAL_P(return_value)->nNumUsed = start_key + num;
                        Z_ARRVAL_P(return_value)->nNumOfElements = num;
                        Z_ARRVAL_P(return_value)->nInternalPointer = start_key;
+                       Z_ARRVAL_P(return_value)->nNextFreeElement = start_key + num;
 
                        if (Z_REFCOUNTED_P(val)) {
                                GC_REFCOUNT(Z_COUNTED_P(val)) += num;

diff --git a/ext/standard/tests/array/bug72116.phpt b/ext/standard/tests/array/bug72116.phpt
new file mode 100644 (file)
index 0000000..7951f69
--- /dev/null
+++ b/ext/standard/tests/array/bug72116.phpt
@@ -0,0 +1,18 @@
+--TEST--
+Bug #72116 (insertion after array_fill fails)
+--FILE--
+<?php
+
+$x = array_fill(0, 1, '..');
+$x[] = 'a';
+var_dump($x);
+
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  string(2) ".."
+  [1]=>
+  string(1) "a"
+}
+