From 1903fc62988c476d26283aa1baeca86f9a0540af Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Sat, 15 Oct 2016 23:21:12 +0200
Subject: [PATCH] Fix SplFixedArray::offsetGet() invocation for NULL offset

---
 ext/spl/spl_fixedarray.c    | 2 +-
 ext/spl/tests/bug64106.phpt | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ext/spl/spl_fixedarray.c b/ext/spl/spl_fixedarray.c
index 741b1dbf14..88b3150404 100644
--- a/ext/spl/spl_fixedarray.c
+++ b/ext/spl/spl_fixedarray.c
@@ -349,7 +349,7 @@ static zval *spl_fixedarray_object_read_dimension(zval *object, zval *offset, in
 	if (intern->fptr_offset_get) {
 		zval tmp;
 		if (!offset) {
-			ZVAL_UNDEF(&tmp);
+			ZVAL_NULL(&tmp);
 			offset = &tmp;
 		} else {
 			SEPARATE_ARG_IF_REF(offset);
diff --git a/ext/spl/tests/bug64106.phpt b/ext/spl/tests/bug64106.phpt
index 855caef213..26203c4e2e 100644
--- a/ext/spl/tests/bug64106.phpt
+++ b/ext/spl/tests/bug64106.phpt
@@ -4,7 +4,7 @@ Bug #64106: Segfault on SplFixedArray[][x] = y when extended
 <?php
 
 class MyFixedArray extends SplFixedArray {
-    public function offsetGet($offset) {}
+    public function offsetGet($offset) { var_dump($offset); }
 }
 
 $array = new MyFixedArray(10);
@@ -12,4 +12,6 @@ $array[][1] = 10;
 
 ?>
 --EXPECTF--
+NULL
+
 Notice: Indirect modification of overloaded element of MyFixedArray has no effect in %s on line %d
-- 
2.50.1