Merge branch 'master' of git.php.net:php-src

* 'master' of git.php.net:php-src:
  Remove wrong commit committed by accident
  Fixed bug #69167 (call_user_func does not support references anymore)
  Fixed #69166 (Assigning array_values() to array does not reset key counter)

4 files changed, 44 insertions, 4 deletions

diff --git a/Zend/tests/bug69167.phpt b/Zend/tests/bug69167.phpt
new file mode 100644
index 0000000000..79326ed583
--- /dev/null
+++ b/Zend/tests/bug69167.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Bug #69167 (call_user_func does not support references anymore)
+--FILE--
+<?php
+function l($m) {
+	    echo $m . "\n";
+}
+ 
+$cb = 'l';
+call_user_func($cb, 'hi');
+ 
+$cb2 = &$cb;
+call_user_func($cb2, 'hi2');
+?>
+--EXPECT--
+hi
+hi2
diff --git a/Zend/zend_API.c b/Zend/zend_API.c
index 693a8340f8..3a6dbe5058 100644
--- a/Zend/zend_API.c
+++ b/Zend/zend_API.c
@@ -3017,6 +3017,7 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zend_object *object, uint
 		return 0;
 	}
 
+again:
 	switch (Z_TYPE_P(callable)) {
 		case IS_STRING:
 			if (object) {
@@ -3160,7 +3161,6 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zend_object *object, uint
 				}
 			}
 			return 0;
-
 		case IS_OBJECT:
 			if (Z_OBJ_HANDLER_P(callable, get_closure) && Z_OBJ_HANDLER_P(callable, get_closure)(callable, &fcc->calling_scope, &fcc->function_handler, &fcc->object) == SUCCESS) {
 				fcc->called_scope = fcc->calling_scope;
@@ -3173,8 +3173,14 @@ ZEND_API zend_bool zend_is_callable_ex(zval *callable, zend_object *object, uint
 				}
 				return 1;
 			}
-			/* break missing intentionally */
-
+			if (callable_name) {
+				*callable_name = zval_get_string(callable);
+			}
+			if (error) zend_spprintf(error, 0, "no array or string given");
+			return 0;
+		case IS_REFERENCE:
+			callable = Z_REFVAL_P(callable);
+			goto again;
 		default:
 			if (callable_name) {
 				*callable_name = zval_get_string(callable);
diff --git a/Zend/zend_hash.h b/Zend/zend_hash.h
index e21d292f19..4583d34e99 100644
--- a/Zend/zend_hash.h
+++ b/Zend/zend_hash.h
@@ -795,7 +795,7 @@ static zend_always_inline void *zend_hash_get_current_data_ptr_ex(HashTable *ht,
 #define ZEND_HASH_FILL_END() \
 		__fill_ht->nNumUsed = __fill_idx; \
 		__fill_ht->nNumOfElements = __fill_idx; \
-		__fill_ht->nNextFreeElement = __fill_idx + 1; \
+		__fill_ht->nNextFreeElement = __fill_idx; \
 		__fill_ht->nInternalPointer = 0; \
 	} while (0)
 
diff --git a/ext/standard/tests/array/bug69166.phpt b/ext/standard/tests/array/bug69166.phpt
new file mode 100644
index 0000000000..d0b5fadd6d
--- /dev/null
+++ b/ext/standard/tests/array/bug69166.phpt
@@ -0,0 +1,17 @@
+--TEST--
+Fixed #69166 (Assigning array_values() to array does not reset key counter)
+--FILE--
+<?php
+
+$array = [0];
+$ar = array_values($array);
+$ar[] = 1;
+var_dump($ar);
+?>
+--EXPECT--
+array(2) {
+  [0]=>
+  int(0)
+  [1]=>
+  int(1)
+}