Don't optimize input arrays with suffix holes

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 9ddbf1f3bf22abbc14d66b6e9047465e776bf921..2640d27884c2e812df40dbd67a889ab87d12768e 100644 (file)
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4018,6 +4018,7 @@ PHP_FUNCTION(array_values)
        zval     *input,                /* Input array */
                         *entry;                /* An entry in the input array */
        zend_array *arrval;
+       zend_long arrlen;
 
        ZEND_PARSE_PARAMETERS_START(1, 1)
                Z_PARAM_ARRAY(input)
@@ -4026,12 +4027,14 @@ PHP_FUNCTION(array_values)
        arrval = Z_ARRVAL_P(input);
 
        /* Return empty input as is */
-       if (!zend_hash_num_elements(arrval)) {
+       arrlen = zend_hash_num_elements(arrval);
+       if (!arrlen) {
                RETURN_ZVAL(input, 1, 0);
        }
 
        /* Return vector-like packed arrays as-is */
-       if (HT_IS_PACKED(arrval) && HT_IS_WITHOUT_HOLES(arrval)) {
+       if (HT_IS_PACKED(arrval) && HT_IS_WITHOUT_HOLES(arrval) &&
+               arrval->nNextFreeElement == arrlen) {
                RETURN_ZVAL(input, 1, 0);
        }
 

diff --git a/ext/standard/tests/array/bug75433.phpt b/ext/standard/tests/array/bug75433.phpt
new file mode 100644 (file)
index 0000000..650c6ca
--- /dev/null
+++ b/ext/standard/tests/array/bug75433.phpt
@@ -0,0 +1,17 @@
+--TEST--
+array_values() preserves next index from source array when shallow-copying
+--FILE--
+<?php
+
+$a = [1,2,3];
+unset($a[2]);
+$b = array_values($a);
+$b[] = 4;
+print_r($b);
+--EXPECT--
+Array
+(
+    [0] => 1
+    [1] => 2
+    [2] => 4
+)