Skip to content

Internal pointer past the end resets to the first element on copy-on-write separation #23617

Description

@iliaal

Description

end() followed by next() leaves the internal pointer past the end, so key() returns NULL. A copy-on-write separation then moves it back to the first element instead of leaving it past the end. An in-range pointer survives the same separation unchanged, and the untouched copy keeps NULL, so the past-the-end case is the only one that moves.

The following code:

<?php
$a = ['a' => 1, 'b' => 2, 'c' => 3];
end($a);
next($a);
var_dump(key($a), current($a));

$b = $a;
$a['d'] = 4;
var_dump(key($a), current($a));

Resulted in this output:

NULL
bool(false)
string(1) "a"
int(1)

But I expected this output instead:

NULL
bool(false)
NULL
bool(false)

zend_array_dup() clamps the copied pointer with (source->nInternalPointer < source->nNumUsed) ? source->nInternalPointer : 0 at Zend/zend_hash.c:2511 for the mixed case and :2495 for the packed case. The immutable branch at :2479 copies it verbatim, so the three arms of that function disagree.

PHP Version

PHP 8.4.25, also PHP-8.4 and master at d26d5f2

Operating System

Linux

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions