Fixed #74100 - Fixed array_fill behaviour with negative $start_index

Author: andrewnester

ext/standard/array.c

@@ -1980,8 +1980,8 @@ PHP_FUNCTION(array_fill)
 			}
 			zend_hash_index_add_new(Z_ARRVAL_P(return_value), start_key, val);
 			while (--num) {
-				zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), val);
 				start_key++;
+				zend_hash_index_add_new(Z_ARRVAL_P(return_value), start_key, val);
 			}
 		}
 	} else if (EXPECTED(num == 0)) {

ext/standard/tests/array/array_fill_variation1_64bit.phpt

@@ -120,7 +120,7 @@ array(2) {
 array(2) {
   [-10]=>
   int(100)
-  [0]=>
+  [-9]=>
   int(100)
 }
 -- Iteration 3 --

ext/standard/tests/array/bug74100.phpt

@@ -0,0 +1,29 @@
+--TEST--
+Bug #72369 (array_merge() produces references in PHP7)
+--FILE--
+<?php
+var_dump(array_fill_keys(range(-2,1), true));
+var_dump(array_fill(-2, 4, true));
+?>
+--EXPECT--
+array(4) {
+  [-2]=>
+  bool(true)
+  [-1]=>
+  bool(true)
+  [0]=>
+  bool(true)
+  [1]=>
+  bool(true)
+}
+array(4) {
+  [-2]=>
+  bool(true)
+  [-1]=>
+  bool(true)
+  [0]=>
+  bool(true)
+  [1]=>
+  bool(true)
+}
+