From 69b5ee61d029b5532cd47ccae6ab0546b6d53106 Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Fri, 2 May 2014 12:48:43 +0200
Subject: [PATCH] Fixed bug #67169: []= after_array_splice incorrect

This fixes a regression I introduced in beta 1.
---
 NEWS                     |  4 ++++
 Zend/tests/bug67169.phpt | 26 ++++++++++++++++++++++++++
 Zend/zend_hash.c         |  1 +
 3 files changed, 31 insertions(+)
 create mode 100644 Zend/tests/bug67169.phpt

diff --git a/NEWS b/NEWS
index 72e91e810f..d0ce2f1940 100644
--- a/NEWS
+++ b/NEWS
@@ -2,6 +2,10 @@ PHP                                                                        NEWS
 |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
 ?? ??? 2014, PHP 5.6.0 Beta 3
 
+- Core:
+  . Fixed bug #67169 (array_splice all elements, then []= gives wrong index).
+    (Nikita)
+
 01 May 2014, PHP 5.6.0 Beta 2
 
 - CLI server:
diff --git a/Zend/tests/bug67169.phpt b/Zend/tests/bug67169.phpt
new file mode 100644
index 0000000000..8aa6aaf24a
--- /dev/null
+++ b/Zend/tests/bug67169.phpt
@@ -0,0 +1,26 @@
+--TEST--
+Bug #67169: array_splice all elements, then []= gives wrong index
+--FILE--
+<?php
+
+$array = array('a', 'b');
+array_splice($array, 0, 2);
+$array[] = 'c';
+var_dump($array);
+
+$array = array('a', 'b');
+array_shift($array);
+array_shift($array);
+$array[] = 'c';
+var_dump($array);
+
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  string(1) "c"
+}
+array(1) {
+  [0]=>
+  string(1) "c"
+}
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 309631338a..a9fd3e9a43 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -487,6 +487,7 @@ ZEND_API void zend_hash_reindex(HashTable *ht, zend_bool only_integer_keys) {
 
 	IS_CONSISTENT(ht);
 	if (UNEXPECTED(ht->nNumOfElements == 0)) {
+		ht->nNextFreeElement = 0;
 		return;
 	}
 
-- 
2.40.0