Unpacking empty packed array into uninitialized array causes assertion failure

[gal1ium]

Description

The following code:

<?php
$a=array();
for ($i=3; $i < 9999; $o++) {
$a[$i][0].= define('A',[...$a]);
unset($a[3]);
var_dump([...$a]);
}

Resulted in this output:

php-fuzz-execute: Zend/zend_vm_execute.h:2823: const zend_op *ZEND_ADD_ARRAY_UNPACK_SPEC_HANDLER(zend_execute_data *, const zend_op *): Assertion `(((__fill_ht)->u.flags & (1<<2)) != 0)' failed.
Aborted (core dumped)

PHP Version

16b2fc4

Operating System

Linux

[nielsdos]

Reduced to:

<?php
$a = [0];
unset($a[0]);
var_dump([...$a]);