[GromNaN]

array_merge() returns the non-empty argument as is when the other argument is empty. The returned array is the argument itself, shared through copy-on-write, so it also kept the next free index of the argument, which array_merge() is expected to reset because integer keys are renumbered from 0. The general code path does exactly that, and the shortcut is an optimization, so it is not supposed to be observable.

array_values() had the same shortcut and got the same guard in cc96166 ("Don't optimize input arrays with suffix holes", 2017), for the same reason, in the same file, without an RFC. array_merge() just never got it.

Today the same call site returns a differently shaped array depending on whether a variable happens to be empty at runtime:

$a = [1, 2, 3];
unset($a[2]);

$b = [];
$r = array_merge($a, $b);
$r[] = 4;   // key 3

$b = ['k' => 'x'];
$r = array_merge($a, $b);
$r[] = 4;   // key 2

The shortcut now applies only when the argument already behaves like the result of the general path: a packed array without holes, or an array with string keys only, whose next free index is the one the general path would produce. Everything else goes through the general path, which builds a fresh array. Clean arrays are still returned as is, so the copy is still avoided. array_merge_recursive() shares the code path and gets the same fix.

A regression test is added. Output before and after the change:

 array(3) {
   [0]=>
   int(1)
   [1]=>
   int(2)
-  [3]=>
+  [2]=>
   int(4)
 }
 array(2) {
   ["a"]=>
   int(1)
-  [1]=>
+  [0]=>
   int(3)
 }

[ArtUkrainskiy]

The shortcut is fixed, but a temporary first argument still keeps the old next index. The general path takes a refcount-1 array in place (dest = src under zend_may_modify_arg_in_place()). Nothing resets nNextFreeElement there when the other arguments are empty or not packed:

function holey() { $a = [1, 2, 3]; unset($a[2]); return $a; }
$r = array_merge(holey(), []);
$r[] = 'X';
var_dump(array_keys($r)); // 0, 1, 3 with this PR, 0, 1, 2 expected

The same happens with array_merge(holey()), array_merge(holey(), ['k' => 1]) and array_merge_recursive(holey(), []). With $a = holey(); array_merge($a, []) it's now correct, so the result still depends on whether the argument is a variable or a temporary.

Resetting it right after dest = src; fixes all of these, and ext/standard/tests/array still passes. These cases could go in the test too:

dest->nNextFreeElement = dest->nNumUsed;

[GromNaN]

@ArtUkrainskiy Thanks for the precise review. Confirmed and fixed in 6be0d75: the in-place path now resets the next free index right after dest = src, so a temporary first argument behaves like a variable. The test now covers array_merge(holey(), []), array_merge(holey()), array_merge(holey(), ["k" => 1]) and array_merge_recursive(holey(), []).