From 345ecd9822820a54134bd53a6e449e1f22612e19 Mon Sep 17 00:00:00 2001
From: Xinchen Hui <laruence@gmail.com>
Date: Thu, 17 Mar 2016 07:41:41 -0700
Subject: [PATCH] Fixed #71837 (Wrong arrays behaviour)

---
 NEWS                                   |  1 +
 ext/standard/array.c                   |  6 ++++++
 ext/standard/tests/array/bug71837.phpt | 27 ++++++++++++++++++++++++++
 3 files changed, 34 insertions(+)
 create mode 100644 ext/standard/tests/array/bug71837.phpt

diff --git a/NEWS b/NEWS
index 419fbc499a..5329582dad 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,7 @@ PHP                                                                        NEWS
     (Laruence)
 
 - Standard:
+  . Fixed bug #71837 (Wrong arrays behaviour). (Laruence)
   . Fixed bug #71840 (Unserialize accepts wrongly data). (Ryat, Laruence)
 
 31 Mar 2016 PHP 7.0.5
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4d2c45ec51..4ff373a0b0 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -3198,6 +3198,9 @@ static inline void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETE
 		src  = Z_ARRVAL_P(arg);
 		dest = Z_ARRVAL_P(return_value);
 		ZEND_HASH_FOREACH_KEY_VAL(src, idx, string_key, src_entry) {
+			if (UNEXPECTED(Z_ISREF_P(src_entry) && Z_REFCOUNT_P(src_entry) == 1)) {
+				src_entry = Z_REFVAL_P(src_entry);
+			}
 			if (string_key) {
 				if (Z_REFCOUNTED_P(src_entry)) {
 					Z_ADDREF_P(src_entry);
@@ -3235,6 +3238,9 @@ static inline void php_array_merge_or_replace_wrapper(INTERNAL_FUNCTION_PARAMETE
 		src  = Z_ARRVAL_P(arg);
 		dest = Z_ARRVAL_P(return_value);
 		ZEND_HASH_FOREACH_STR_KEY_VAL(src, string_key, src_entry) {
+			if (UNEXPECTED(Z_ISREF_P(src_entry) && Z_REFCOUNT_P(src_entry) == 1)) {
+				src_entry = Z_REFVAL_P(src_entry);
+			}
 			if (string_key) {
 				if (Z_REFCOUNTED_P(src_entry)) {
 					Z_ADDREF_P(src_entry);
diff --git a/ext/standard/tests/array/bug71837.phpt b/ext/standard/tests/array/bug71837.phpt
new file mode 100644
index 0000000000..686d144c3c
--- /dev/null
+++ b/ext/standard/tests/array/bug71837.phpt
@@ -0,0 +1,27 @@
+--TEST--
+Bug #71837 (Wrong arrays behaviour)
+--FILE--
+<?php
+
+$p = array(array());
+array_push($p[0], array(100));
+
+$c = array_merge($p, array());
+$c[0][0] = 200;
+
+print_r($p);
+
+?>
+--EXPECT--
+Array
+(
+    [0] => Array
+        (
+            [0] => Array
+                (
+                    [0] => 100
+                )
+
+        )
+
+)
-- 
2.40.0