Internal pointer past the end resets to the first element on copy-on-write separation

[iliaal]

Description

end() followed by next() leaves the internal pointer past the end, so key() returns NULL. A copy-on-write separation then moves it back to the first element instead of leaving it past the end. An in-range pointer survives the same separation unchanged, and the untouched copy keeps NULL, so the past-the-end case is the only one that moves.

The following code:

<?php
$a = ['a' => 1, 'b' => 2, 'c' => 3];
end($a);
next($a);
var_dump(key($a), current($a));

$b = $a;
$a['d'] = 4;
var_dump(key($a), current($a));

Resulted in this output:

NULL
bool(false)
string(1) "a"
int(1)

But I expected this output instead:

NULL
bool(false)
NULL
bool(false)

zend_array_dup() clamps the copied pointer with (source->nInternalPointer < source->nNumUsed) ? source->nInternalPointer : 0 at Zend/zend_hash.c:2511 for the mixed case and :2495 for the packed case. The immutable branch at :2479 copies it verbatim, so the three arms of that function disagree.

PHP Version

PHP 8.4.25, also PHP-8.4 and master at d26d5f2

Operating System

Linux

[iliaal]

Correction to the expected output above: NULL is wrong.

end(); next(); leaves the cursor at nNumUsed, and an append writes to that slot, so key() returns the appended key even with refcount 1 and no copy-on-write anywhere:

$a = ['a' => 1, 'b' => 2, 'c' => 3];
end($a);
next($a);
var_dump(key($a));   // NULL
$a['d'] = 4;
var_dump(key($a));   // "d"

So the defect is narrower than I described. For the snippet in this issue the separated array should report "d", matching the unseparated case, not NULL. What is wrong is only that it reports "a" instead.

There is also no single correct value to copy. Filling the table changes the unseparated answer to NULL, because the append rehashes and compaction does not remap an exhausted cursor. Normalising that in both zend_hash_rehash() and zend_array_dup() is likely what this needs.