Bug #65051 [Opn->Csd]: count() off by one inside unset()

Edit report at https://bugs.php.net/bug.php?id=65051&edit=1 ID: 65051 Updated by: nikic@php.net Reported by: nikic@php.net Summary: count() off by one inside unset() -Status: Open +Status: Closed Type: Bug Package: Scripting Engine problem PHP Version: 5.5.0RC3 Block user comment: N Private report: N New Comment: Automatic comment on behalf of nikic Revision: http://git.php.net/?p=php-src.git;a=commit;h=86434be9462c5b14dccc588afe6bc1b4a1433360 Log: Fix bug #65051: count() off by one inside unset() Previous Comments: ------------------------------------------------------------------------ [2013-06-17 19:05:38] nikic@php.net Description: ------------ If code is run inside an array offset unset the reported size of that array will be off by one: <?php class Foo { public $array; public function __destruct() { var_dump(count($this->array[0])); var_dump($this->array[0]); } } $array = [[new Foo]]; $array[0][0]->array =& $array; unset($array[0][0]); Outputs: int(1) array(1) { } The reason is that zend_hash_del_key_or_index decrements the element count *after* calling the bucket dtor. ------------------------------------------------------------------------ -- Edit this bug report at https://bugs.php.net/bug.php?id=65051&edit=1