From efbb614ad3feb00cf12336dd51710e5ff7307ad7 Mon Sep 17 00:00:00 2001
From: andrewnester <andrew.nester.dev@gmail.com>
Date: Wed, 15 Feb 2017 12:39:50 +0300
Subject: [PATCH] Fixed #74100 - Fixed array_fill behaviour with negative
 $start_index

---
 ext/standard/array.c                          |  2 +-
 .../tests/array/array_fill_variation1.phpt    |  2 +-
 .../array/array_fill_variation1_64bit.phpt    |  2 +-
 ext/standard/tests/array/bug74100.phpt        | 29 +++++++++++++++++++
 4 files changed, 32 insertions(+), 3 deletions(-)
 create mode 100644 ext/standard/tests/array/bug74100.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index eb5d7c35be4a9..c1dda84709693 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -1980,8 +1980,8 @@ PHP_FUNCTION(array_fill)
 			}
 			zend_hash_index_add_new(Z_ARRVAL_P(return_value), start_key, val);
 			while (--num) {
-				zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), val);
 				start_key++;
+				zend_hash_index_add_new(Z_ARRVAL_P(return_value), start_key, val);
 			}
 		}
 	} else if (EXPECTED(num == 0)) {
diff --git a/ext/standard/tests/array/array_fill_variation1.phpt b/ext/standard/tests/array/array_fill_variation1.phpt
index 684949fe95905..38c2703d0211d 100644
--- a/ext/standard/tests/array/array_fill_variation1.phpt
+++ b/ext/standard/tests/array/array_fill_variation1.phpt
@@ -120,7 +120,7 @@ array(2) {
 array(2) {
   [-10]=>
   int(100)
-  [0]=>
+  [-9]=>
   int(100)
 }
 -- Iteration 3 --
diff --git a/ext/standard/tests/array/array_fill_variation1_64bit.phpt b/ext/standard/tests/array/array_fill_variation1_64bit.phpt
index 6cbec86f60843..adac4a175f275 100644
--- a/ext/standard/tests/array/array_fill_variation1_64bit.phpt
+++ b/ext/standard/tests/array/array_fill_variation1_64bit.phpt
@@ -120,7 +120,7 @@ array(2) {
 array(2) {
   [-10]=>
   int(100)
-  [0]=>
+  [-9]=>
   int(100)
 }
 -- Iteration 3 --
diff --git a/ext/standard/tests/array/bug74100.phpt b/ext/standard/tests/array/bug74100.phpt
new file mode 100644
index 0000000000000..50a5a2b54bb0f
--- /dev/null
+++ b/ext/standard/tests/array/bug74100.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Bug #74100 (array_fill with negative $start_index works incorrectly)
+--FILE--
+<?php
+var_dump(array_fill_keys(range(-2,1), true));
+var_dump(array_fill(-2, 4, true));
+?>
+--EXPECT--
+array(4) {
+  [-2]=>
+  bool(true)
+  [-1]=>
+  bool(true)
+  [0]=>
+  bool(true)
+  [1]=>
+  bool(true)
+}
+array(4) {
+  [-2]=>
+  bool(true)
+  [-1]=>
+  bool(true)
+  [0]=>
+  bool(true)
+  [1]=>
+  bool(true)
+}
+