From cc96166f743011c037d9915681b28c363c189e0a Mon Sep 17 00:00:00 2001
From: Sara Golemon <pollita@php.net>
Date: Fri, 27 Oct 2017 13:05:38 -0400
Subject: [PATCH] Don't optimize input arrays with suffix holes

---
 ext/standard/array.c                   |  7 +++++--
 ext/standard/tests/array/bug75433.phpt | 17 +++++++++++++++++
 2 files changed, 22 insertions(+), 2 deletions(-)
 create mode 100644 ext/standard/tests/array/bug75433.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 9ddbf1f3bf..2640d27884 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4018,6 +4018,7 @@ PHP_FUNCTION(array_values)
 	zval	 *input,		/* Input array */
 			 *entry;		/* An entry in the input array */
 	zend_array *arrval;
+	zend_long arrlen;
 
 	ZEND_PARSE_PARAMETERS_START(1, 1)
 		Z_PARAM_ARRAY(input)
@@ -4026,12 +4027,14 @@ PHP_FUNCTION(array_values)
 	arrval = Z_ARRVAL_P(input);
 
 	/* Return empty input as is */
-	if (!zend_hash_num_elements(arrval)) {
+	arrlen = zend_hash_num_elements(arrval);
+	if (!arrlen) {
 		RETURN_ZVAL(input, 1, 0);
 	}
 
 	/* Return vector-like packed arrays as-is */
-	if (HT_IS_PACKED(arrval) && HT_IS_WITHOUT_HOLES(arrval)) {
+	if (HT_IS_PACKED(arrval) && HT_IS_WITHOUT_HOLES(arrval) &&
+		arrval->nNextFreeElement == arrlen) {
 		RETURN_ZVAL(input, 1, 0);
 	}
 
diff --git a/ext/standard/tests/array/bug75433.phpt b/ext/standard/tests/array/bug75433.phpt
new file mode 100644
index 0000000000..650c6ca378
--- /dev/null
+++ b/ext/standard/tests/array/bug75433.phpt
@@ -0,0 +1,17 @@
+--TEST--
+array_values() preserves next index from source array when shallow-copying
+--FILE--
+<?php
+
+$a = [1,2,3];
+unset($a[2]);
+$b = array_values($a);
+$b[] = 4;
+print_r($b);
+--EXPECT--
+Array
+(
+    [0] => 1
+    [1] => 2
+    [2] => 4
+)
-- 
2.40.0