alpha.c

/*
   +----------------------------------------------------------------------+
   | Copyright © The PHP Group and Contributors.                          |
   +----------------------------------------------------------------------+
   | This source file is subject to the Modified BSD License that is      |
   | bundled with this package in the file LICENSE, and is available at  |
   | through the World Wide Web at <https://www.php.net/license/>.       |
   |                                                                      |
   | SPDX-License-Identifier: BSD-3-Clause                                |
   +----------------------------------------------------------------------+
*/

/* alpha: a standalone extension providing the _alpha parallel-
 * implementations of the standard array/search/sort functions. The function
 * bodies and helpers below are vendored verbatim from ext/standard/array.c
 * and ext/standard/type.c (PHP 8.6); the only changes are:
 *   - ARRAYG(...) -> ALPHAG(...)  (this extension's own module globals,
 *     so it never touches ext/standard's array module globals);
 *   - php_multisort_compare -> php_multisort_compare_alpha (a local static
 *     copy reading ALPHAG(multisort_func), since the PHPAPI original reads
 *     ARRAYG(multisort_func));
 *   - the two PHPAPI _alpha recursive merge/replace helpers are made
 *     `static` (they exist only in this experimental tree, not in stock PHP,
 *     so a pie-installed shared extension cannot link them).
 * The originals in ext/standard are removed (moved here); the baseline
 * in_array/array_search/sort/... functions stay untouched in ext/standard. */

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include "php.h"
#include "php_ini.h"
#include <stdarg.h>
#include <stdlib.h>
#include <math.h>
#include <time.h>
#include <string.h>
#include <ctype.h>
#include "zend_globals.h"
#include "zend_interfaces.h"
#include "zend_smart_str.h"
#include "zend_bitset.h"
#include "zend_exceptions.h"
#include "zend_sort.h"
#include "ext/standard/info.h"
#include "ext/standard/php_string.h"
#include "ext/standard/php_array.h"
#include "ext/standard/php_math.h"
#include "php_alpha.h"
#include "alpha_arginfo.h"

/* Compatibility shims: zend_symtable_add() and zend_dval_to_lval_silent() only
 * exist in PHP >= 8.6 (API 20250926). Reproduce their semantics on older API
 * versions so the source builds against both header sets. */
#if !defined(ZEND_MODULE_API_NO) || ZEND_MODULE_API_NO < 20250926
static zend_always_inline zval *zend_symtable_add(HashTable *ht, zend_string *key, zval *pData)
{
	zend_ulong idx;

	if (ZEND_HANDLE_NUMERIC(key, idx)) {
		return zend_hash_index_add(ht, idx, pData);
	}
	return zend_hash_add(ht, key, pData);
}

static zend_always_inline zend_long zend_dval_to_lval_silent(double d)
{
	return zend_dval_to_lval(d);
}

/* zend_array_sort_ex() (and its zend_array_sort() inline) is not exported by
 * PHP < 8.6 binaries; its exported twin zend_hash_sort() is, and these
 * comparators never run user code, so the GC guard difference is moot. */
#define zend_array_sort(ht, compare_func, renumber) \
	zend_hash_sort(ht, compare_func, renumber)
#endif

ZEND_DECLARE_MODULE_GLOBALS(alpha)

static void php_alpha_init_globals(zend_alpha_globals *alpha_globals)
{
	memset(alpha_globals, 0, sizeof(zend_alpha_globals));
}

PHP_MINIT_FUNCTION(alpha)
{
	ZEND_INIT_MODULE_GLOBALS(alpha, php_alpha_init_globals, NULL);
	return SUCCESS;
}

PHP_MSHUTDOWN_FUNCTION(alpha)
{
#ifdef ZTS
	ts_free_id(alpha_globals_id);
#endif
	return SUCCESS;
}

PHP_MINFO_FUNCTION(alpha)
{
	php_info_print_table_start();
	php_info_print_table_header(2, "alpha", "enabled");
	php_info_print_table_row(2, "_alpha functions", "39 parallel reimplementations of standard array/search/sort");
	php_info_print_table_end();
}

zend_module_entry alpha_module_entry = {
	STANDARD_MODULE_HEADER,
	"alpha",
	ext_functions,
	PHP_MINIT(alpha),
	PHP_MSHUTDOWN(alpha),
	NULL, /* RINIT */
	NULL, /* RSHUTDOWN */
	PHP_MINFO(alpha),
	PHP_ALPHA_VERSION,
	STANDARD_MODULE_PROPERTIES
};
#ifdef COMPILE_DL_ALPHA
ZEND_GET_MODULE(alpha)
# if defined(ZTS)
ZEND_TSRMLS_CACHE_DEFINE()
# endif
#endif

/* ===================================================================== *
 * Vendored comparator/sort/natural-sort machinery and _alpha function
 * bodies follow. Order preserves the original ext/standard/array.c layout
 * so static definitions precede their uses.
 * ===================================================================== */

/* ===== blockA_comparators (array.c 100-1070) ===== */

static zend_never_inline ZEND_COLD int stable_sort_fallback(Bucket *a, Bucket *b) {
	if (Z_EXTRA(a->val) > Z_EXTRA(b->val)) {
		return 1;
	} else if (Z_EXTRA(a->val) < Z_EXTRA(b->val)) {
		return -1;
	} else {
		return 0;
	}
}

#define RETURN_STABLE_SORT(a, b, result) do { \
	int _result = (result); \
	if (EXPECTED(_result)) { \
		return _result; \
	} \
	return stable_sort_fallback((a), (b)); \
} while (0)

/* Generate inlined unstable and stable variants, and non-inlined reversed variants. */
#define DEFINE_SORT_VARIANTS(name) \
	static zend_never_inline int php_array_##name##_unstable(Bucket *a, Bucket *b) { \
		return php_array_##name##_unstable_i(a, b); \
	} \
	static zend_never_inline int php_array_##name(Bucket *a, Bucket *b) { \
		RETURN_STABLE_SORT(a, b, php_array_##name##_unstable_i(a, b)); \
	} \
	static zend_never_inline int php_array_reverse_##name##_unstable(Bucket *a, Bucket *b) { \
		return php_array_##name##_unstable(a, b) * -1; \
	} \
	static zend_never_inline int php_array_reverse_##name(Bucket *a, Bucket *b) { \
		RETURN_STABLE_SORT(a, b, php_array_reverse_##name##_unstable(a, b)); \
	} \

static zend_always_inline int php_array_key_compare_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	zval first;
	zval second;

	if (f->key == NULL && s->key == NULL) {
		return (zend_long)f->h > (zend_long)s->h ? 1 : -1;
	} else if (f->key && s->key) {
		return zendi_smart_strcmp(f->key, s->key);
	}
	if (f->key) {
		ZVAL_STR(&first, f->key);
	} else {
		ZVAL_LONG(&first, f->h);
	}
	if (s->key) {
		ZVAL_STR(&second, s->key);
	} else {
		ZVAL_LONG(&second, s->h);
	}
	return zend_compare(&first, &second);
}
/* }}} */

static zend_always_inline int php_array_key_compare_numeric_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	if (f->key == NULL && s->key == NULL) {
		return (zend_long)f->h > (zend_long)s->h ? 1 : -1;
	} else {
		double d1, d2;
		if (f->key) {
			d1 = zend_strtod(f->key->val, NULL);
		} else {
			d1 = (double)(zend_long)f->h;
		}
		if (s->key) {
			d2 = zend_strtod(s->key->val, NULL);
		} else {
			d2 = (double)(zend_long)s->h;
		}
		return ZEND_THREEWAY_COMPARE(d1, d2);
	}
}
/* }}} */

static zend_always_inline int php_array_key_compare_string_case_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	const char *s1, *s2;
	size_t l1, l2;
	char buf1[MAX_LENGTH_OF_LONG + 1];
	char buf2[MAX_LENGTH_OF_LONG + 1];

	if (f->key) {
		s1 = f->key->val;
		l1 = f->key->len;
	} else {
		s1 = zend_print_long_to_buf(buf1 + sizeof(buf1) - 1, f->h);
		l1 = buf1 + sizeof(buf1) - 1 - s1;
	}
	if (s->key) {
		s2 = s->key->val;
		l2 = s->key->len;
	} else {
		s2 = zend_print_long_to_buf(buf2 + sizeof(buf2) - 1, s->h);
		l2 = buf2 + sizeof(buf2) - 1 - s2;
	}
	return zend_binary_strcasecmp_l(s1, l1, s2, l2);
}
/* }}} */

static zend_always_inline int php_array_key_compare_string_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	const char *s1, *s2;
	size_t l1, l2;
	char buf1[MAX_LENGTH_OF_LONG + 1];
	char buf2[MAX_LENGTH_OF_LONG + 1];

	if (f->key) {
		s1 = f->key->val;
		l1 = f->key->len;
	} else {
		s1 = zend_print_long_to_buf(buf1 + sizeof(buf1) - 1, f->h);
		l1 = buf1 + sizeof(buf1) - 1 - s1;
	}
	if (s->key) {
		s2 = s->key->val;
		l2 = s->key->len;
	} else {
		s2 = zend_print_long_to_buf(buf2 + sizeof(buf2) - 1, s->h);
		l2 = buf2 + sizeof(buf2) - 1 - s2;
	}
	return zend_binary_strcmp(s1, l1, s2, l2);
}
/* }}} */

static int php_array_key_compare_string_natural_general(Bucket *f, Bucket *s, bool fold_case) /* {{{ */
{
	const char *s1, *s2;
	size_t l1, l2;
	char buf1[MAX_LENGTH_OF_LONG + 1];
	char buf2[MAX_LENGTH_OF_LONG + 1];

	if (f->key) {
		s1 = f->key->val;
		l1 = f->key->len;
	} else {
		s1 = zend_print_long_to_buf(buf1 + sizeof(buf1) - 1, f->h);
		l1 = buf1 + sizeof(buf1) - 1 - s1;
	}
	if (s->key) {
		s2 = s->key->val;
		l2 = s->key->len;
	} else {
		s2 = zend_print_long_to_buf(buf2 + sizeof(buf2) - 1, s->h);
		l2 = buf2 + sizeof(buf2) - 1 - s2;
	}
	return strnatcmp_ex(s1, l1, s2, l2, fold_case);
}
/* }}} */

static int php_array_key_compare_string_natural_case(Bucket *a, Bucket *b) /* {{{ */
{
	RETURN_STABLE_SORT(a, b, php_array_key_compare_string_natural_general(a, b, true));
}
/* }}} */

static int php_array_reverse_key_compare_string_natural_case(Bucket *a, Bucket *b) /* {{{ */
{
	RETURN_STABLE_SORT(a, b, php_array_key_compare_string_natural_general(b, a, true));
}
/* }}} */

static int php_array_key_compare_string_natural(Bucket *a, Bucket *b) /* {{{ */
{
	RETURN_STABLE_SORT(a, b, php_array_key_compare_string_natural_general(a, b, false));
}
/* }}} */

static int php_array_reverse_key_compare_string_natural(Bucket *a, Bucket *b) /* {{{ */
{
	RETURN_STABLE_SORT(a, b, php_array_key_compare_string_natural_general(b, a, false));
}
/* }}} */

static zend_always_inline int php_array_key_compare_string_locale_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	const char *s1, *s2;
	char buf1[MAX_LENGTH_OF_LONG + 1];
	char buf2[MAX_LENGTH_OF_LONG + 1];

	if (f->key) {
		s1 = f->key->val;
	} else {
		s1 = zend_print_long_to_buf(buf1 + sizeof(buf1) - 1, f->h);
	}
	if (s->key) {
		s2 = s->key->val;
	} else {
		s2 = zend_print_long_to_buf(buf2 + sizeof(buf2) - 1, s->h);
	}
	return strcoll(s1, s2);
}
/* }}} */

static zend_always_inline int php_array_data_compare_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	int result = zend_compare(&f->val, &s->val);
	/* Special enums handling for array_unique. We don't want to add this logic to zend_compare as
	 * that would be observable via comparison operators. */
	zval *rhs = &s->val;
	ZVAL_DEREF(rhs);
	if (UNEXPECTED(Z_TYPE_P(rhs) == IS_OBJECT)
	 && result == ZEND_UNCOMPARABLE
	 && (Z_OBJCE_P(rhs)->ce_flags & ZEND_ACC_ENUM)) {
		zval *lhs = &f->val;
		ZVAL_DEREF(lhs);
		if (Z_TYPE_P(lhs) == IS_OBJECT && (Z_OBJCE_P(lhs)->ce_flags & ZEND_ACC_ENUM)) {
			// Order doesn't matter, we just need to group the same enum values
			uintptr_t lhs_uintptr = (uintptr_t)Z_OBJ_P(lhs);
			uintptr_t rhs_uintptr = (uintptr_t)Z_OBJ_P(rhs);
			return lhs_uintptr == rhs_uintptr ? 0 : (lhs_uintptr < rhs_uintptr ? -1 : 1);
		} else {
			// Shift enums to the end of the array
			return -1;
		}
	}
	return result;
}
/* }}} */

static zend_always_inline int php_array_data_compare_long_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	/* Exact integer three-way compare, mirroring zend_compare()'s IS_LONG/IS_LONG
	 * arm. Unlike numeric_compare_function() (which promotes to double via
	 * zval_get_double), this stays exact for longs beyond 2^53. Safe only when
	 * the caller has verified every element is IS_LONG and free of references. */
	zend_long a = Z_LVAL_P(&f->val);
	zend_long b = Z_LVAL_P(&s->val);
	return a > b ? 1 : (a < b ? -1 : 0);
}
/* }}} */

static zend_always_inline int php_array_data_compare_numeric_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	return numeric_compare_function(&f->val, &s->val);
}
/* }}} */

static zend_always_inline int php_array_data_compare_string_case_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	return string_case_compare_function(&f->val, &s->val);
}
/* }}} */

static zend_always_inline int php_array_data_compare_string_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	return string_compare_function(&f->val, &s->val);
}
/* }}} */

static int php_array_natural_general_compare(Bucket *f, Bucket *s, bool fold_case) /* {{{ */
{
	zend_string *tmp_str1, *tmp_str2;
	zend_string *str1 = zval_get_tmp_string(&f->val, &tmp_str1);
	zend_string *str2 = zval_get_tmp_string(&s->val, &tmp_str2);

	int result = strnatcmp_ex(ZSTR_VAL(str1), ZSTR_LEN(str1), ZSTR_VAL(str2), ZSTR_LEN(str2), fold_case);

	zend_tmp_string_release(tmp_str1);
	zend_tmp_string_release(tmp_str2);
	return result;
}
/* }}} */

static zend_always_inline int php_array_natural_compare_unstable_i(Bucket *a, Bucket *b) /* {{{ */
{
	return php_array_natural_general_compare(a, b, false);
}
/* }}} */

static zend_always_inline int php_array_natural_case_compare_unstable_i(Bucket *a, Bucket *b) /* {{{ */
{
	return php_array_natural_general_compare(a, b, true);
}
/* }}} */

/* _alpha pre-classified Schwartzian transform for the natural comparators.
 *
 * The baseline php_array_natural_general_compare calls strnatcmp_ex on every
 * O(n log n) comparison, and strnatcmp_ex re-parses both strings each call --
 * per byte it pays an isdigit()/isspace() libc table lookup (a __ctype_b_loc()
 * TLS fetch + index + mask) and, for the case-insensitive variant, a toupper().
 * Each element's string is therefore classified ~log2(n) times.
 *
 * This path classifies each string ONCE, up front, into a decoration:
 *
 *   - buf:  the byte stream the comparator walks. For natcasesort_alpha every
 *           byte is toupper() applied at decoration time, so the comparator never
 *           touppers; for natsort_alpha buf is the original bytes. The first
 *           digit run's leading zeros are stripped (strnatcmp_ex's
 *           start-of-string strip, lines 105-112), which is deterministic per
 *           string and so can be baked in. buf is NUL-terminated at blen.
 *   - cls:  a parallel per-byte class byte (OTHER / DIGIT / SPACE), with
 *           cls[blen] = OTHER so the NUL sentinel terminates whitespace skips the
 *           same way strnatcmp_ex's NUL terminator does.
 *   - orig_len: the original byte length, to replicate strnatcmp_ex's empty-string
 *           fast path `if (a_len==0 || b_len==0) return sign(a_len-b_len)`.
 *           toupper() never changes digit/space membership, so a class map
 *           computed on the folded byte equals the class strnatcmp_ex computes on
 *           the original; non-C ctype locales are preserved because the same
 *           isdigit()/isspace() calls are used, just hoisted out of the comparison.
 *
 * The comparator (php_natcmp_cls) is a faithful line-for-line port of strnatcmp_ex
 * operating on (buf, cls): isdigit(c) -> cls[i]==DIGIT, isspace(c) ->
 * cls[i]==SPACE, toupper() removed (folded into buf). It preserves strnatcmp_ex's
 * RELATIONAL digit-run rule -- a run is compared numerically only when BOTH sides
 * are digits at the aligned position; a digit vs a non-digit falls through to raw
 * byte comparison -- which is exactly why a flat memcmp-able sort key is
 * impossible (any per-string key must commit to "numeric" or "raw" without knowing
 * its partner) and why we decorate with buffers + a relational comparator instead.
 * The trailing-whitespace end checks and the fall-through (not continue) after a
 * digit-run tie are preserved verbatim.
 *
 * The decoration recs[] is indexed by the SAME original bucket position that
 * zend_hash_sort_internal stores in Z_EXTRA (it sets Z_EXTRA(arData[i].val)=i
 * before sorting), so the bucket comparator recovers its decoration via
 * Z_EXTRA(a->val) and reuses Z_EXTRA as the stable tie-break key. The recs base is
 * stashed per-thread in ALPHAG(nat_sort_recs) for the comparator (the
 * bucket_compare_func_t signature carries no context); natsort never recurses
 * across the comparator. Only natsort_alpha / natcasesort_alpha reach this path;
 * the baseline natsort / natcasesort and strnatcmp_ex stay untouched. */
#define NAT_CLASS_OTHER 0
#define NAT_CLASS_DIGIT 1
#define NAT_CLASS_SPACE 2

typedef struct {
	uint32_t orig_len;          /* original byte length, for the empty fast path */
	uint32_t blen;              /* logical length of buf (after leading-zero strip) */
	const unsigned char *buf;   /* blen+1 bytes, NUL-terminated, folded/stripped */
	const unsigned char *cls;   /* blen+1 bytes, per-position class; cls[blen]=OTHER */
} php_nat_rec;

/* Port of compare_left (strnatcmp.c:64): left-aligned numeric comparison -- the
 * first differing digit wins; if one run ends first, it is smaller. ap/ac and
 * bp/bc advance in lockstep; on return they point at the first post-run byte. */
static zend_always_inline int php_natcmp_compare_left_cls(
		const unsigned char **ap, const unsigned char **ac,
		const unsigned char **bp, const unsigned char **bc) /* {{{ */
{
	for (;;) {
		bool adig = (**ac == NAT_CLASS_DIGIT);
		bool bdig = (**bc == NAT_CLASS_DIGIT);
		if (!adig && !bdig) {
			return 0;
		} else if (!adig) {
			return -1;
		} else if (!bdig) {
			return 1;
		} else if (**ap < **bp) {
			return -1;
		} else if (**ap > **bp) {
			return 1;
		}
		++*ap; ++*ac; ++*bp; ++*bc;
	}
}
/* }}} */

/* Port of compare_right (strnatcmp.c:33): the longest run of digits wins; aside
 * from that, the greater value wins, remembered in bias. ap/ac and bp/bc advance
 * in lockstep; on return they point at the first post-run byte. */
static zend_always_inline int php_natcmp_compare_right_cls(
		const unsigned char **ap, const unsigned char **ac,
		const unsigned char **bp, const unsigned char **bc) /* {{{ */
{
	int bias = 0;

	for (;;) {
		bool adig = (**ac == NAT_CLASS_DIGIT);
		bool bdig = (**bc == NAT_CLASS_DIGIT);
		if (!adig && !bdig) {
			return bias;
		} else if (!adig) {
			return -1;
		} else if (!bdig) {
			return 1;
		} else if (**ap < **bp) {
			if (!bias) {
				bias = -1;
			}
		} else if (**ap > **bp) {
			if (!bias) {
				bias = 1;
			}
		}
		++*ap; ++*ac; ++*bp; ++*bc;
	}
}
/* }}} */

/* Faithful port of strnatcmp_ex (strnatcmp.c:88) on pre-classified buffers. The
 * leading-zero strip and case folding are already baked into buf, so this body is
 * the case-sensitive shape; natcasesort_alpha folds at decoration time and so
 * reuses this same comparator. Returns -1/0/+1, ==0 iff strnatcmp_ex would. */
static zend_never_inline int php_natcmp_cls(const php_nat_rec *ra, const php_nat_rec *rb) /* {{{ */
{
	if (ra->orig_len == 0 || rb->orig_len == 0) {
		return ZEND_THREEWAY_COMPARE(ra->orig_len, rb->orig_len);
	}

	const unsigned char *ap = ra->buf, *ac = ra->cls;
	const unsigned char *bp = rb->buf, *bc = rb->cls;
	const unsigned char *aend = ra->buf + ra->blen;
	const unsigned char *bend = rb->buf + rb->blen;
	unsigned char ca = *ap, cb = *bp;

	for (;;) {
		/* Skip consecutive whitespace on each side independently. */
		while (*ac == NAT_CLASS_SPACE) {
			++ap; ++ac; ca = *ap;
		}
		while (*bc == NAT_CLASS_SPACE) {
			++bp; ++bc; cb = *bp;
		}

		/* Process run of digits, but only when BOTH sides are digits here --
		 * the relational rule that makes a flat sort key impossible. */
		if (*ac == NAT_CLASS_DIGIT && *bc == NAT_CLASS_DIGIT) {
			int result;
			bool fractional = (ca == '0' || cb == '0');

			if (fractional) {
				result = php_natcmp_compare_left_cls(&ap, &ac, &bp, &bc);
			} else {
				result = php_natcmp_compare_right_cls(&ap, &ac, &bp, &bc);
			}

			if (result != 0) {
				return result;
			} else if (ap == aend && bp == bend) {
				return 0;
			} else if (ap == aend) {
				return -1;
			} else if (bp == bend) {
				return 1;
			} else {
				/* Keep on comparing from the current point. */
				ca = *ap; cb = *bp;
			}
		}

		/* (No toupper: buf is pre-folded for natcasesort_alpha.) */
		if (ca < cb) {
			return -1;
		} else if (ca > cb) {
			return 1;
		}

		++ap; ++ac; ++bp; ++bc;
		if (ap >= aend && bp >= bend) {
			return 0;
		} else if (ap >= aend) {
			return -1;
		} else if (bp >= bend) {
			return 1;
		}

		ca = *ap; cb = *bp;
	}
}
/* }}} */

/* Bucket comparator for zend_array_sort: recover each bucket's decoration via the
 * original position stored in Z_EXTRA (set by zend_hash_sort_internal), and reuse
 * that same Z_EXTRA as the stable tie-break key -- exactly what the baseline's
 * RETURN_STABLE_SORT/stable_sort_fallback does. Equivalent to the baseline stable
 * comparator iff php_natcmp_cls matches strnatcmp_ex sign-for-sign. */
static int php_array_natural_compare_cls(Bucket *a, Bucket *b) /* {{{ */
{
	const php_nat_rec *recs = (const php_nat_rec *) ALPHAG(nat_sort_recs);
	uint32_t ia = Z_EXTRA(a->val);
	uint32_t ib = Z_EXTRA(b->val);
	int result = php_natcmp_cls(&recs[ia], &recs[ib]);

	if (result) {
		return result;
	}
	return ZEND_THREEWAY_COMPARE(ia, ib);
}
/* }}} */

/* Build the decoration for an all-string, no-reference, hole-free array. Returns
 * the recs array and, via data_out, the single contiguous buffer holding every
 * element's (buf, cls). Returns NULL (with *data_out = NULL) if any value is not a
 * plain IS_STRING or is a reference, so the caller falls back to the baseline.
 * recs[i] corresponds to the i-th element in iteration order; zend_hash_sort_internal
 * converts a packed array to a hash (preserving order) before setting
 * Z_EXTRA(arData[i].val)=i, so recs[i] stays aligned with the Z_EXTRA index the
 * comparator reads. */
static zend_always_inline zval *php_nat_zval_at(HashTable *ht, uint32_t i) /* {{{ */
{
	return HT_IS_PACKED(ht) ? &ht->arPacked[i] : &ht->arData[i].val;
}
/* }}} */

static php_nat_rec *php_nat_build_recs(HashTable *ht, bool fold_case, unsigned char **data_out) /* {{{ */
{
	uint32_t n = ht->nNumUsed;
	php_nat_rec *recs = emalloc(n * sizeof(php_nat_rec));
	size_t total = 0;
	uint32_t i;

	for (i = 0; i < n; i++) {
		zval *zv = php_nat_zval_at(ht, i);
		if (UNEXPECTED(Z_TYPE_P(zv) == IS_REFERENCE) || UNEXPECTED(Z_TYPE_P(zv) != IS_STRING)) {
			efree(recs);
			*data_out = NULL;
			return NULL;
		}
		zend_string *s = Z_STR_P(zv);
		const unsigned char *src = (const unsigned char *) ZSTR_VAL(s);
		size_t len = ZSTR_LEN(s);
		size_t start = 0;
		while (start + 1 < len && src[start] == '0' && isdigit(src[start + 1])) {
			start++;
		}
		recs[i].orig_len = (uint32_t) len;
		recs[i].blen = (uint32_t) (len - start);
		total += (size_t) (recs[i].blen + 1) * 2;
	}

	unsigned char *data = emalloc(total);
	unsigned char *p = data;

	for (i = 0; i < n; i++) {
		zend_string *s = Z_STR_P(php_nat_zval_at(ht, i));
		const unsigned char *src = (const unsigned char *) ZSTR_VAL(s);
		size_t len = recs[i].orig_len;
		size_t start = 0;
		while (start + 1 < len && src[start] == '0' && isdigit(src[start + 1])) {
			start++;
		}
		uint32_t blen = recs[i].blen;
		unsigned char *buf = p;
		unsigned char *cls = p + blen + 1;
		for (uint32_t k = 0; k < blen; k++) {
			unsigned char c = src[start + k];
			if (fold_case) {
				c = toupper(c);
			}
			buf[k] = c;
			cls[k] = isdigit(c) ? NAT_CLASS_DIGIT : (isspace(c) ? NAT_CLASS_SPACE : NAT_CLASS_OTHER);
		}
		buf[blen] = 0;
		cls[blen] = NAT_CLASS_OTHER;
		recs[i].buf = buf;
		recs[i].cls = cls;
		p += (size_t) (blen + 1) * 2;
	}

	*data_out = data;
	return recs;
}
/* }}} */

static void php_nat_free_recs(php_nat_rec *recs, unsigned char *data) /* {{{ */
{
	if (data) {
		efree(data);
	}
	if (recs) {
		efree(recs);
	}
}
/* }}} */

static int php_array_data_compare_string_locale_unstable_i(Bucket *f, Bucket *s) /* {{{ */
{
	return string_locale_compare_function(&f->val, &s->val);
}
/* }}} */

/* _alpha key-compare specialization: all-integer keys (Bucket.key == NULL for
 * every element to be sorted). Mirrors php_array_data_compare_long_unstable_i:
 * exact integer three-way compare, no double promotion (correct beyond 2^53).
 *
 * These are hand-written single-frame comparators rather than produced by
 * DEFINE_SORT_VARIANTS, so the REVERSE variant collapses the two extra
 * zend_never_inline intermediates the macro-generated reverse path adds
 * (php_array_reverse_key_compare -> ..._reverse_unstable -> ..._unstable)
 * into a single frame. Each comparison is then one indirect call -> one
 * never_inline body -> the inlined leaf. Keys are unique in a HashTable, so
 * the result is never 0 and stable_sort_fallback never fires here; the
 * RETURN_STABLE_SORT shape is kept for consistency with the other comparators.
 * Only ksort_alpha / krsort_alpha reach these; the baseline key comparators
 * and their callers stay untouched. */
static zend_always_inline int php_array_key_compare_long_i(Bucket *f, Bucket *s) /* {{{ */
{
	zend_long a = (zend_long)f->h;
	zend_long b = (zend_long)s->h;
	return a > b ? 1 : (a < b ? -1 : 0);
}
/* }}} */

static zend_never_inline int php_array_key_compare_long(Bucket *a, Bucket *b) /* {{{ */
{
	RETURN_STABLE_SORT(a, b, php_array_key_compare_long_i(a, b));
}
/* }}} */

/* Reverse via operand swap (like the natural-comparator family), not a
 * multiply, so it stays a single frame mirroring the forward variant. */
static zend_never_inline int php_array_reverse_key_compare_long(Bucket *a, Bucket *b) /* {{{ */
{
	RETURN_STABLE_SORT(a, b, php_array_key_compare_long_i(b, a));
}
/* }}} */

DEFINE_SORT_VARIANTS(key_compare);
DEFINE_SORT_VARIANTS(key_compare_numeric);
DEFINE_SORT_VARIANTS(key_compare_string_case);
DEFINE_SORT_VARIANTS(key_compare_string);
DEFINE_SORT_VARIANTS(key_compare_string_locale);
DEFINE_SORT_VARIANTS(data_compare);
/* Forward (asort_alpha) and reverse (arsort_alpha) consumers both exist, so
 * generate the full data_compare_long family: forward php_array_data_compare_long
 * and reverse php_array_reverse_data_compare_long, each with an unstable sibling.
 * All four are built from the always_inline _i helper by DEFINE_SORT_VARIANTS. */
DEFINE_SORT_VARIANTS(data_compare_long);
DEFINE_SORT_VARIANTS(data_compare_numeric);
DEFINE_SORT_VARIANTS(data_compare_string_case);
DEFINE_SORT_VARIANTS(data_compare_string);
DEFINE_SORT_VARIANTS(data_compare_string_locale);
DEFINE_SORT_VARIANTS(natural_compare);
DEFINE_SORT_VARIANTS(natural_case_compare);

static bucket_compare_func_t php_get_key_compare_func(zend_long sort_type)
{
	switch (sort_type & ~PHP_SORT_FLAG_CASE) {
		case PHP_SORT_NUMERIC:
			return php_array_key_compare_numeric;

		case PHP_SORT_STRING:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_key_compare_string_case;
			} else {
				return php_array_key_compare_string;
			}

		case PHP_SORT_NATURAL:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_key_compare_string_natural_case;
			} else {
				return php_array_key_compare_string_natural;
			}

		case PHP_SORT_LOCALE_STRING:
			return php_array_key_compare_string_locale;

		case PHP_SORT_REGULAR:
		default:
			return php_array_key_compare;
	}
	return NULL;
}

static bucket_compare_func_t php_get_key_reverse_compare_func(zend_long sort_type)
{
	switch (sort_type & ~PHP_SORT_FLAG_CASE) {
		case PHP_SORT_NUMERIC:
			return php_array_reverse_key_compare_numeric;

		case PHP_SORT_STRING:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_reverse_key_compare_string_case;
			} else {
				return php_array_reverse_key_compare_string;
			}

		case PHP_SORT_NATURAL:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_reverse_key_compare_string_natural_case;
			} else {
				return php_array_reverse_key_compare_string_natural;
			}

		case PHP_SORT_LOCALE_STRING:
			return php_array_reverse_key_compare_string_locale;

		case PHP_SORT_REGULAR:
		default:
			return php_array_reverse_key_compare;
	}
	return NULL;
}

static bucket_compare_func_t php_get_data_compare_func(zend_long sort_type) /* {{{ */
{
	switch (sort_type & ~PHP_SORT_FLAG_CASE) {
		case PHP_SORT_NUMERIC:
			return php_array_data_compare_numeric;

		case PHP_SORT_STRING:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_data_compare_string_case;
			} else {
				return php_array_data_compare_string;
			}

		case PHP_SORT_NATURAL:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_natural_case_compare;
			} else {
				return php_array_natural_compare;
			}

		case PHP_SORT_LOCALE_STRING:
			return php_array_data_compare_string_locale;

		case PHP_SORT_REGULAR:
		default:
			return php_array_data_compare;
	}
	return NULL;
}

static bucket_compare_func_t php_get_data_reverse_compare_func(zend_long sort_type) /* {{{ */
{
	switch (sort_type & ~PHP_SORT_FLAG_CASE) {
		case PHP_SORT_NUMERIC:
			return php_array_reverse_data_compare_numeric;

		case PHP_SORT_STRING:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_reverse_data_compare_string_case;
			} else {
				return php_array_reverse_data_compare_string;
			}

		case PHP_SORT_NATURAL:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				return php_array_reverse_natural_case_compare;
			} else {
				return php_array_reverse_natural_compare;
			}

		case PHP_SORT_LOCALE_STRING:
			return php_array_reverse_data_compare_string_locale;

		case PHP_SORT_REGULAR:
		default:
			return php_array_reverse_data_compare;
	}
	return NULL;
}

/* _alpha sibling of php_get_data_reverse_compare_func: for the default
 * SORT_REGULAR, scan the array's value types once and return a reverse
 * comparator specialized to a homogeneous scalar kind, skipping zend_compare's
 * per-comparison type dispatch on the O(n log n) sort. Returns NULL to let the
 * caller fall back to the exact baseline comparator.
 *
 *   all IS_LONG   -> php_array_reverse_data_compare_long     (exact integer compare;
 *                                                  numeric_compare_function would
 *                                                  misorder longs beyond 2^53)
 *   all IS_DOUBLE -> php_array_reverse_data_compare_numeric (matches zend_compare
 *                                                  IS_DOUBLE/IS_DOUBLE exactly)
 *
 * Strings are deliberately NOT specialized: under SORT_REGULAR, zend_compare()
 * compares two numeric strings numerically ('100' > '20' > '9'), a per-pair
 * rule that no simpler comparator replicates -- only zend_compare() itself is
 * correct, so the string case falls back to the baseline.
 *
 * Any reference, non-scalar (object/array/null/bool/resource), mixed scalar
 * kind, or hole also falls back to the baseline. References are excluded from
 * the fast paths to keep the specialized hot comparators branch-free (the long
 * comparator reads Z_LVAL directly, which is only valid without a ref wrapper).
 * Only arsort_alpha reaches this helper; the original comparator selectors and
 * their callers stay untouched. */
static bucket_compare_func_t php_get_specialized_data_reverse_compare_func(HashTable *ht) /* {{{ */
{
	if (ht->nNumOfElements < 2) {
		return NULL;
	}

	int kind = 0; /* 0=unknown, 1=long, 2=double */
	zval *zv;
	ZEND_HASH_FOREACH_VAL(ht, zv) {
		if (UNEXPECTED(Z_TYPE_P(zv) == IS_UNDEF)) {
			continue;
		}
		if (UNEXPECTED(Z_TYPE_P(zv) == IS_REFERENCE)) {
			return NULL;
		}
		int k;
		switch (Z_TYPE_P(zv)) {
			case IS_LONG:    k = 1; break;
			case IS_DOUBLE:  k = 2; break;
			default:         return NULL;
		}
		if (kind == 0) {
			kind = k;
		} else if (kind != k) {
			return NULL;
		}
	} ZEND_HASH_FOREACH_END();

	switch (kind) {
		case 1: return php_array_reverse_data_compare_long;
		case 2: return php_array_reverse_data_compare_numeric;
		default: return NULL;
	}
}
/* }}} */

/* _alpha sibling of php_get_data_compare_func: for the default SORT_REGULAR,
 * scan the array's value types once and return a forward (ascending)
 * comparator specialized to a homogeneous scalar kind, skipping zend_compare's
 * per-comparison type dispatch on the O(n log n) sort. Returns NULL to let the
 * caller fall back to the exact baseline comparator.
 *
 *   all IS_LONG   -> php_array_data_compare_long     (exact integer compare;
 *                                                  numeric_compare_function would
 *                                                  misorder longs beyond 2^53)
 *   all IS_DOUBLE -> php_array_data_compare_numeric  (matches zend_compare
 *                                                  IS_DOUBLE/IS_DOUBLE exactly)
 *
 * Strings are deliberately NOT specialized: under SORT_REGULAR, zend_compare()
 * compares two numeric strings numerically ('100' > '20' > '9'), a per-pair
 * rule that no simpler comparator replicates -- only zend_compare() itself is
 * correct, so the string case falls back to the baseline.
 *
 * Any reference, non-scalar (object/array/null/bool/resource), mixed scalar
 * kind, or hole also falls back to the baseline. References are excluded from
 * the fast paths to keep the specialized hot comparators branch-free (the long
 * comparator reads Z_LVAL directly, which is only valid without a ref wrapper).
 * Only asort_alpha reaches this helper; the original comparator selectors and
 * their callers stay untouched. */
static bucket_compare_func_t php_get_specialized_data_compare_func(HashTable *ht) /* {{{ */
{
	if (ht->nNumOfElements < 2) {
		return NULL;
	}

	int kind = 0; /* 0=unknown, 1=long, 2=double */
	zval *zv;
	ZEND_HASH_FOREACH_VAL(ht, zv) {
		if (UNEXPECTED(Z_TYPE_P(zv) == IS_UNDEF)) {
			continue;
		}
		if (UNEXPECTED(Z_TYPE_P(zv) == IS_REFERENCE)) {
			return NULL;
		}
		int k;
		switch (Z_TYPE_P(zv)) {
			case IS_LONG:    k = 1; break;
			case IS_DOUBLE:  k = 2; break;
			default:         return NULL;
		}
		if (kind == 0) {
			kind = k;
		} else if (kind != k) {
			return NULL;
		}
	} ZEND_HASH_FOREACH_END();

	switch (kind) {
		case 1: return php_array_data_compare_long;
		case 2: return php_array_data_compare_numeric;
		default: return NULL;
	}
}
/* }}} */

/* _alpha sibling of php_get_key_compare_func / php_get_key_reverse_compare_func:
 * for the default SORT_REGULAR, return a comparator specialized to the
 * all-integer-key case. Returns NULL to let the caller fall back to the exact
 * baseline.
 *
 *   packed array (HT_IS_PACKED) -> forward php_array_key_compare_long
 *                                  reverse php_array_reverse_key_compare_long
 *
 * A packed array holds only integer keys by construction (a contiguous run of
 * Bucket.key == NULL), so HT_IS_PACKED is a zero-cost sufficient condition for
 * the all-integer fast path: no O(n) key scan is needed. This is the common
 * case (range(), sequential $a[]= builds).
 *
 * Hash arrays (non-packed) are NOT specialized and fall back to the baseline
 * WITHOUT a scan: an O(n) scan to detect all-integer keys there was measured
 * to cost more than the per-comparison savings (the baseline already fast-
 * paths both-NULL keys with predicted branches, and the reverse path's extra
 * frames are direct calls the CPU call-return predictor handles), so the scan
 * was a net loss on the fallback path. Holes (IS_UNDEF) in a packed array are
 * compacted away before the sort and carry no key, so they do not affect the
 * all-integer guarantee. Only ksort_alpha / krsort_alpha reach these; the
 * original comparator selectors and their callers stay untouched. */
static bucket_compare_func_t php_get_specialized_key_compare_func(HashTable *ht) /* {{{ */
{
	if (ht->nNumOfElements < 2 || !HT_IS_PACKED(ht)) {
		return NULL;
	}
	return php_array_key_compare_long;
}
/* }}} */

static bucket_compare_func_t php_get_specialized_key_reverse_compare_func(HashTable *ht) /* {{{ */
{
	if (ht->nNumOfElements < 2 || !HT_IS_PACKED(ht)) {
		return NULL;
	}
	return php_array_reverse_key_compare_long;
}
/* }}} */

static bucket_compare_func_t php_get_data_compare_func_unstable(zend_long sort_type, bool reverse) /* {{{ */
{
	switch (sort_type & ~PHP_SORT_FLAG_CASE) {
		case PHP_SORT_NUMERIC:
			if (reverse) {
				return php_array_reverse_data_compare_numeric_unstable;
			} else {
				return php_array_data_compare_numeric_unstable;
			}
			break;

		case PHP_SORT_STRING:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				if (reverse) {
					return php_array_reverse_data_compare_string_case_unstable;
				} else {
					return php_array_data_compare_string_case_unstable;
				}
			} else {
				if (reverse) {
					return php_array_reverse_data_compare_string_unstable;
				} else {
					return php_array_data_compare_string_unstable;
				}
			}
			break;

		case PHP_SORT_NATURAL:
			if (sort_type & PHP_SORT_FLAG_CASE) {
				if (reverse) {
					return php_array_reverse_natural_case_compare_unstable;
				} else {
					return php_array_natural_case_compare_unstable;
				}
			} else {
				if (reverse) {
					return php_array_reverse_natural_compare_unstable;
				} else {
					return php_array_natural_compare_unstable;
				}
			}
			break;

		case PHP_SORT_LOCALE_STRING:
			if (reverse) {
				return php_array_reverse_data_compare_string_locale_unstable;
			} else {
				return php_array_data_compare_string_locale_unstable;
			}
			break;

		case PHP_SORT_REGULAR:
		default:
			if (reverse) {
				return php_array_reverse_data_compare_unstable;
			} else {
				return php_array_data_compare_unstable;
			}
			break;
	}
	return NULL;
}
/* }}} */


/* ===== php_get_long (array.c 1098-1109) ===== */

static zend_always_inline zend_long php_get_long(zval *zv)
{
	if (EXPECTED(Z_TYPE_P(zv) == IS_LONG)) {
		return Z_LVAL_P(zv);
	} else {
		zend_long ret = zval_get_long_func(zv, false);
		zval_ptr_dtor(zv);
		return ret;
	}
}

/* {{{ Count the number of elements in a variable (usually an array) */

/* ===== typedef_get_compare_function (array.c 1193-1193) ===== */

typedef bucket_compare_func_t(*get_compare_function)(zend_long);

/* ===== typedef_specialized_compare_getter (array.c 1222-1222) ===== */

typedef bucket_compare_func_t (*specialized_compare_getter)(HashTable *);

/* ===== php_sort_alpha (array.c 1224-1260) ===== */

static zend_always_inline void php_sort_alpha(INTERNAL_FUNCTION_PARAMETERS, get_compare_function get_cmp, specialized_compare_getter get_specialized, bool renumber) {
	HashTable *array;
	zend_long sort_type = PHP_SORT_REGULAR;
	bucket_compare_func_t cmp;

	ZEND_PARSE_PARAMETERS_START(1, 2)
		Z_PARAM_ARRAY_HT_EX(array, 0, 1)
		Z_PARAM_OPTIONAL
		Z_PARAM_LONG(sort_type)
	ZEND_PARSE_PARAMETERS_END();

	cmp = get_cmp(sort_type);

	if (sort_type == PHP_SORT_REGULAR) {
		bucket_compare_func_t specialized = get_specialized(array);
		if (specialized) {
			cmp = specialized;
		}
	}

	zend_array_sort(array, cmp, renumber);

	RETURN_TRUE;
}

/* _alpha sibling of php_natsort: identical parameter handling to php_natsort
 * (one array, by-ref, separated). For the all-string, no-reference, hole-free
 * case with at least two elements, it decorates each element once with a
 * pre-classified buffer (see php_nat_rec / php_natcmp_cls) and sorts with
 * php_array_natural_compare_cls, which is a faithful port of strnatcmp_ex walking
 * those buffers -- eliminating the per-comparison isdigit()/isspace()/toupper()
 * libc calls the baseline pays on every O(n log n) comparison. fold_case selects
 * natcasesort_alpha (true, buf is upper-folded) from natsort_alpha (false); the
 * comparator is the same either way. Any non-string / reference / hole / <2
 * element input, or an allocation failure, falls back to the exact baseline
 * comparator. Only the _alpha userland sorts call this; the original php_natsort
 * and its callers (natsort, natcasesort) stay untouched. */

/* ===== php_natsort_alpha (array.c 1261-1287) ===== */

static void php_natsort_alpha(INTERNAL_FUNCTION_PARAMETERS, bool fold_case) /* {{{ */
{
	HashTable *array;

	ZEND_PARSE_PARAMETERS_START(1, 1)
		Z_PARAM_ARRAY_HT_EX(array, 0, 1)
	ZEND_PARSE_PARAMETERS_END();

	if (array->nNumOfElements >= 2 && HT_IS_WITHOUT_HOLES(array)) {
		unsigned char *data;
		php_nat_rec *recs = php_nat_build_recs(array, fold_case, &data);
		if (recs) {
			ALPHAG(nat_sort_recs) = recs;
			zend_array_sort(array, php_array_natural_compare_cls, false);
			ALPHAG(nat_sort_recs) = NULL;
			php_nat_free_recs(recs, data);
			RETURN_TRUE;
		}
	}

	zend_array_sort(array, fold_case ? php_array_natural_case_compare : php_array_natural_compare, false);

	RETURN_TRUE;
}
/* }}} */

/* {{{ Sort an array and maintain index association */

/* ===== arsort_alpha (array.c 1304-1312) ===== */

PHP_FUNCTION(arsort_alpha)
{
	php_sort_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, php_get_data_reverse_compare_func, php_get_specialized_data_reverse_compare_func, false);
}
/* }}} */

/* {{{ _alpha sibling of asort: parallel reimplementation that specializes the
 * SORT_REGULAR forward comparator to the array's homogeneous value type. The
 * original asort() stays untouched. */

/* ===== asort_alpha (array.c 1313-1321) ===== */

PHP_FUNCTION(asort_alpha)
{
	php_sort_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, php_get_data_compare_func, php_get_specialized_data_compare_func, false);
}
/* }}} */

/* {{{ _alpha sibling of natcasesort: parallel reimplementation that pre-classifies
 * each string once (upper-folded) and sorts with the faithful-port comparator for
 * the all-string, no-reference case. The original natcasesort() stays untouched. */

/* ===== natcasesort_alpha (array.c 1322-1330) ===== */

PHP_FUNCTION(natcasesort_alpha)
{
	php_natsort_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, true);
}
/* }}} */

/* {{{ _alpha sibling of natsort: parallel reimplementation that pre-classifies
 * each string once and sorts with the faithful-port comparator for the all-string,
 * no-reference case. The original natsort() stays untouched. */

/* ===== natsort_alpha (array.c 1331-1337) ===== */

PHP_FUNCTION(natsort_alpha)
{
	php_natsort_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, false);
}
/* }}} */

/* {{{ Sort an array */

/* ===== ksort_alpha (array.c 1368-1376) ===== */

PHP_FUNCTION(ksort_alpha)
{
	php_sort_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, php_get_key_compare_func, php_get_specialized_key_compare_func, false);
}
/* }}} */

/* {{{ _alpha sibling of krsort: parallel reimplementation that specializes the
 * SORT_REGULAR reverse key comparator to all-integer-keyed arrays, collapsing
 * the two extra reverse call frames. The original krsort() stays untouched. */

/* ===== krsort_alpha (array.c 1377-1382) ===== */

PHP_FUNCTION(krsort_alpha)
{
	php_sort_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, php_get_key_reverse_compare_func, php_get_specialized_key_reverse_compare_func, false);
}
/* }}} */


/* ===== php_array_user_compare_unstable (array.c 1383-1419) ===== */

static inline int php_array_user_compare_unstable(Bucket *f, Bucket *s) /* {{{ */
{
	zval args[2];
	zval retval;

	ZVAL_COPY_VALUE(&args[0], &f->val);
	ZVAL_COPY_VALUE(&args[1], &s->val);

	ALPHAG(user_compare_fci).param_count = 2;
	ALPHAG(user_compare_fci).params = args;
	ALPHAG(user_compare_fci).retval = &retval;
	zend_call_function(&ALPHAG(user_compare_fci), &ALPHAG(user_compare_fci_cache));

	if (UNEXPECTED(Z_TYPE(retval) == IS_FALSE || Z_TYPE(retval) == IS_TRUE)) {
		if (!ALPHAG(compare_deprecation_thrown)) {
			php_error_docref(NULL, E_DEPRECATED,
				"Returning bool from comparison function is deprecated, "
				"return an integer less than, equal to, or greater than zero");
			ALPHAG(compare_deprecation_thrown) = 1;
		}

		if (Z_TYPE(retval) == IS_FALSE) {
			/* Retry with swapped operands. */
			ZVAL_COPY_VALUE(&args[0], &s->val);
			ZVAL_COPY_VALUE(&args[1], &f->val);
			zend_call_function(&ALPHAG(user_compare_fci), &ALPHAG(user_compare_fci_cache));

			zend_long ret = php_get_long(&retval);
			return -ZEND_NORMALIZE_BOOL(ret);
		}
	}

	zend_long ret = php_get_long(&retval);
	return ZEND_NORMALIZE_BOOL(ret);
}
/* }}} */


/* ===== php_array_udiff_alpha_contains (array.c 1435-1457) ===== */

static zend_always_inline bool php_array_udiff_alpha_contains(Bucket *sorted, uint32_t n, Bucket *needle)
{
	uint32_t lo = 0, hi = n;
	while (lo < hi) {
		uint32_t mid = lo + (hi - lo) / 2;
		if (php_array_user_compare_unstable(needle, &sorted[mid]) <= 0) {
			hi = mid;
		} else {
			lo = mid + 1;
		}
	}
	if (lo < n) {
		return php_array_user_compare_unstable(needle, &sorted[lo]) == 0;
	}
	return 0;
}
/* }}} */

/* {{{ php_array_udiff_alpha_cmp_zval
 * Compare two bare zvals through the user comparator by wrapping each in a
 * stack Bucket (only the .val field is read). Used for the single-element
 * short-circuit, where sorting the other arrays would cost O(M log M)
 * callbacks that a single linear scan avoids. */

/* ===== php_array_udiff_alpha_cmp_zval (array.c 1458-1468) ===== */

static zend_always_inline int php_array_udiff_alpha_cmp_zval(zval *a, zval *b)
{
	Bucket ba, bb;
	ZVAL_COPY_VALUE(&ba.val, a);
	ba.h = 0; ba.key = NULL;
	ZVAL_COPY_VALUE(&bb.val, b);
	bb.h = 0; bb.key = NULL;
	return php_array_user_compare_unstable(&ba, &bb);
}
/* }}} */


/* ===== CMP_FUNC_macros (array.c 1469-1482) ===== */

#define PHP_ARRAY_CMP_FUNC_VARS \
	zend_fcall_info old_user_compare_fci; \
	zend_fcall_info_cache old_user_compare_fci_cache \

#define PHP_ARRAY_CMP_FUNC_BACKUP() \
	old_user_compare_fci = ALPHAG(user_compare_fci); \
	old_user_compare_fci_cache = ALPHAG(user_compare_fci_cache); \
	ALPHAG(compare_deprecation_thrown) = 0; \
	ALPHAG(user_compare_fci_cache) = empty_fcall_info_cache; \

#define PHP_ARRAY_CMP_FUNC_RESTORE() \
	ALPHAG(user_compare_fci) = old_user_compare_fci; \
	ALPHAG(user_compare_fci_cache) = old_user_compare_fci_cache; \


/* ===== _php_search_array_packed_alpha (array.c 2327-2402) ===== */

static bool _php_search_array_packed_alpha(zval *value, HashTable *ht, bool strict, zend_long *found_idx) /* {{{ */
{
	uint32_t i, n = ht->nNumUsed;
	zval *e = ht->arPacked;
	bool no_holes = HT_IS_WITHOUT_HOLES(ht);

	if (strict) {
		if (Z_TYPE_P(value) == IS_LONG) {
			zend_long needle_l = Z_LVAL_P(value);
			for (i = 0; i < n; i++, e++) {
				zval *v = (Z_TYPE_P(e) == IS_REFERENCE) ? Z_REFVAL_P(e) : e;
				if (Z_TYPE_P(v) == IS_LONG && Z_LVAL_P(v) == needle_l) {
					*found_idx = (zend_long)i;
					return true;
				}
			}
			return false;
		}
		for (i = 0; i < n; i++, e++) {
			zval *v = (Z_TYPE_P(e) == IS_REFERENCE) ? Z_REFVAL_P(e) : e;
			if (fast_is_identical_function(value, v)) {
				*found_idx = (zend_long)i;
				return true;
			}
		}
		return false;
	}

	if (Z_TYPE_P(value) == IS_LONG) {
		if (no_holes) {
			for (i = 0; i < n; i++, e++) {
				if (fast_equal_check_long(value, e)) { *found_idx = (zend_long)i; return true; }
			}
		} else {
			for (i = 0; i < n; i++, e++) {
				if (Z_TYPE_P(e) == IS_UNDEF) continue;
				if (fast_equal_check_long(value, e)) { *found_idx = (zend_long)i; return true; }
			}
		}
	} else if (Z_TYPE_P(value) == IS_STRING) {
		if (no_holes) {
			for (i = 0; i < n; i++, e++) {
				if (fast_equal_check_string(value, e)) { *found_idx = (zend_long)i; return true; }
			}
		} else {
			for (i = 0; i < n; i++, e++) {
				if (Z_TYPE_P(e) == IS_UNDEF) continue;
				if (fast_equal_check_string(value, e)) { *found_idx = (zend_long)i; return true; }
			}
		}
	} else {
		if (no_holes) {
			for (i = 0; i < n; i++, e++) {
				if (fast_equal_check_function(value, e)) { *found_idx = (zend_long)i; return true; }
			}
		} else {
			for (i = 0; i < n; i++, e++) {
				if (Z_TYPE_P(e) == IS_UNDEF) continue;
				if (fast_equal_check_function(value, e)) { *found_idx = (zend_long)i; return true; }
			}
		}
	}
	return false;
}
/* }}} */

/* void php_search_array_alpha(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 * 0 = return boolean
 * 1 = return key
 *
 * _alpha sibling of _php_search_array: carries the HT_IS_PACKED fast path
 * for in_array_alpha (behavior == 0) and array_search_alpha (behavior == 1).
 * Only the two _alpha siblings call this; the original _php_search_array
 * and its callers (in_array, array_search, the frameless in_array
 * dispatchers) remain untouched.
 */

/* ===== _php_search_array_alpha (array.c 2403-2522) ===== */

static zend_always_inline void _php_search_array_alpha(zval *return_value, zval *value, zval *array, bool strict, int behavior) /* {{{ */
{
	zval *entry; /* pointer to array entry */
	zend_ulong num_idx;
	zend_string *str_idx;
	HashTable *ht = Z_ARRVAL_P(array);

	/* Packed-array fast path lives in its own function
	 * (_php_search_array_packed_alpha) so this function stays small and the
	 * hash-table fallback below compiles as cleanly as the original
	 * _php_search_array. (A large inline packed path was measurably degrading
	 * the fallback loop's codegen on codegen-sensitive hosts, making the
	 * byte-for-byte-baseline fallback run slower.) Packed keys are always the
	 * loop index i, so behavior==1 maps a hit to RETURN_LONG(found_idx). */
	if (HT_IS_PACKED(ht)) {
		zend_long found_idx = 0;
		bool found = _php_search_array_packed_alpha(value, ht, strict, &found_idx);
		if (behavior == 0) {
			if (found) { RETURN_TRUE; } else { RETURN_FALSE; }
		} else {
			if (found) { RETURN_LONG(found_idx); } else { RETURN_FALSE; }
		}
		return;
	}

	/* Hash-table fallback: byte-for-byte the original _php_search_array. On
	 * codegen-sensitive hosts (e.g. a Raspberry Pi) this identical loop can
	 * measure slower than the baseline purely from binary-layout skew (a
	 * control of baseline-vs-baseline measures 1.0x; the alpha source here is
	 * identical). The _alpha variant provides no optimisation for hash inputs
	 * -- the win is the packed path above -- so this is a parity shape, not a
	 * must-win, and is marked [skip] in bench_in_array_alpha.php. */


	if (strict) {
		if (Z_TYPE_P(value) == IS_LONG) {
			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
				ZVAL_DEREF(entry);
				if (Z_TYPE_P(entry) == IS_LONG && Z_LVAL_P(entry) == Z_LVAL_P(value)) {
					if (behavior == 0) {
						RETURN_TRUE;
					} else {
						if (str_idx) {
							RETURN_STR_COPY(str_idx);
						} else {
							RETURN_LONG(num_idx);
						}
					}
				}
			} ZEND_HASH_FOREACH_END();
		} else {
			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
				ZVAL_DEREF(entry);
				if (fast_is_identical_function(value, entry)) {
					if (behavior == 0) {
						RETURN_TRUE;
					} else {
						if (str_idx) {
							RETURN_STR_COPY(str_idx);
						} else {
							RETURN_LONG(num_idx);
						}
					}
				}
			} ZEND_HASH_FOREACH_END();
		}
	} else {
		if (Z_TYPE_P(value) == IS_LONG) {
			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
				if (fast_equal_check_long(value, entry)) {
					if (behavior == 0) {
						RETURN_TRUE;
					} else {
						if (str_idx) {
							RETURN_STR_COPY(str_idx);
						} else {
							RETURN_LONG(num_idx);
						}
					}
				}
			} ZEND_HASH_FOREACH_END();
		} else if (Z_TYPE_P(value) == IS_STRING) {
			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
				if (fast_equal_check_string(value, entry)) {
					if (behavior == 0) {
						RETURN_TRUE;
					} else {
						if (str_idx) {
							RETURN_STR_COPY(str_idx);
						} else {
							RETURN_LONG(num_idx);
						}
					}
				}
			} ZEND_HASH_FOREACH_END();
		} else {
			ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(array), num_idx, str_idx, entry) {
				if (fast_equal_check_function(value, entry)) {
					if (behavior == 0) {
						RETURN_TRUE;
					} else {
						if (str_idx) {
							RETURN_STR_COPY(str_idx);
						} else {
							RETURN_LONG(num_idx);
						}
					}
				}
			} ZEND_HASH_FOREACH_END();
		}
	}

	RETURN_FALSE;
}
/* }}} */

/* void php_search_array(INTERNAL_FUNCTION_PARAMETERS, int behavior)
 * 0 = return boolean
 * 1 = return key
 */

/* ===== php_search_array_alpha (array.c 2547-2563) ===== */

static inline void php_search_array_alpha(INTERNAL_FUNCTION_PARAMETERS, int behavior)
{
	zval *value,		/* value to check for */
		 *array;		/* array to check in */
	bool strict = 0;	/* strict comparison or not */

	ZEND_PARSE_PARAMETERS_START(2, 3)
		Z_PARAM_ZVAL(value)
		Z_PARAM_ARRAY(array)
		Z_PARAM_OPTIONAL
		Z_PARAM_BOOL(strict)
	ZEND_PARSE_PARAMETERS_END();

	_php_search_array_alpha(return_value, value, array, strict, behavior);
}

/* {{{ Checks if the given value exists in the array */

/* ===== in_array_alpha (array.c 2571-2577) ===== */

PHP_FUNCTION(in_array_alpha)
{
	php_search_array_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, 0);
}
/* }}} */

/* {{{ Searches the array for a given value and returns the corresponding key if successful (alpha: packed fast path) */

/* ===== array_search_alpha (array.c 2578-2583) ===== */

PHP_FUNCTION(array_search_alpha)
{
	php_search_array_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU, 1);
}
/* }}} */


/* ===== array_fill_alpha (array.c 3635-3755) ===== */

PHP_FUNCTION(array_fill_alpha)
{
	zval *val;
	zend_long start_key, num;

	ZEND_PARSE_PARAMETERS_START(3, 3)
		Z_PARAM_LONG(start_key)
		Z_PARAM_LONG(num)
		Z_PARAM_ZVAL(val)
	ZEND_PARSE_PARAMETERS_END();

	if (EXPECTED(num > 0)) {
		if (sizeof(num) > 4 && UNEXPECTED(num > INT_MAX)) {
			zend_argument_value_error(2, "is too large");
			RETURN_THROWS();
		} else if (UNEXPECTED(start_key > ZEND_LONG_MAX - num + 1)) {
			zend_throw_error(NULL, "Cannot add element to the array as the next element is already occupied");
			RETURN_THROWS();
		} else if (EXPECTED(start_key >= 0) && EXPECTED(start_key < num)) {
			/* create packed array */
			zval *zv;

			array_init_size(return_value, (uint32_t)(start_key + num));
			zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
			Z_ARRVAL_P(return_value)->nNumUsed = (uint32_t)(start_key + num);
			Z_ARRVAL_P(return_value)->nNumOfElements = (uint32_t)num;
			Z_ARRVAL_P(return_value)->nNextFreeElement = (zend_long)(start_key + num);

			if (Z_REFCOUNTED_P(val)) {
				GC_ADDREF_EX(Z_COUNTED_P(val), (uint32_t)num);
			}

			zv = Z_ARRVAL_P(return_value)->arPacked;

			while (start_key--) {
				ZVAL_UNDEF(zv);
				zv++;
			}
			while (num--) {
				ZVAL_COPY_VALUE(zv, val);
				zv++;
			}
		} else {
			/* create hash — inlined bucket+hash-slot fill.
			 *
			 * Replaces N out-of-line zend_hash_index_add_new /
			 * zend_hash_next_index_insert_new calls with a tight loop. The
			 * table was just real_init_mixed'd and sized to >= num, so the
			 * packed / uninitialized / find / ZEND_HASH_IF_FULL_DO_RESIZE
			 * branches of the standard insert cannot fire and are elided.
			 *
			 * The key sequence and nNextFreeElement update are reproduced
			 * exactly from _zend_hash_index_add_or_update_i: element 0 at
			 * explicit start_key (HASH_ADD|HASH_ADD_NEW — the
			 * ZEND_LONG_MIN -> 0 remap only applies to HASH_ADD_NEXT, so the
			 * first key is start_key verbatim), elements 1..num-1 at
			 * ht->nNextFreeElement (HASH_ADD|HASH_ADD_NEW|HASH_ADD_NEXT).
			 * After real_init_mixed, nNextFreeElement is ZEND_LONG_MIN, so
			 * the element-0 insert at start_key always satisfies
			 * (zend_long)h >= nNextFreeElement and advances it to start_key+1.
			 * Reading ht->nNextFreeElement each iteration therefore
			 * reproduces the baseline key sequence — always contiguous
			 * {start_key, start_key+1, ..., start_key+num-1}, regardless of
			 * sign. The original's `start_key++` is dead; the rest keys come
			 * from nNextFreeElement, which tracks the contiguous run. */
			HashTable *ht;
			Bucket *p;
			uint32_t i, n = (uint32_t)num;
			uint32_t idx, nIndex;
			zend_ulong h;

			array_init_size(return_value, (uint32_t)num);
			ht = Z_ARRVAL_P(return_value);
			zend_hash_real_init_mixed(ht);
			if (Z_REFCOUNTED_P(val)) {
				GC_ADDREF_EX(Z_COUNTED_P(val), (uint32_t)num);
			}

			p = ht->arData;

			/* element 0 at explicit start_key */
			h = (zend_ulong)start_key;
			idx = 0;
			nIndex = h | ht->nTableMask;
			Z_NEXT(p->val) = HT_HASH(ht, nIndex);
			HT_HASH(ht, nIndex) = HT_IDX_TO_HASH(idx);
			if ((zend_long)h >= ht->nNextFreeElement) {
				ht->nNextFreeElement = (zend_long)h < ZEND_LONG_MAX ? (zend_long)h + 1 : ZEND_LONG_MAX;
			}
			p->h = h;
			p->key = NULL;
			ZVAL_COPY_VALUE(&p->val, val);

			/* elements 1..n-1 at nNextFreeElement */
			for (i = 1; i < n; i++) {
				h = (zend_ulong)ht->nNextFreeElement;
				idx = i;
				nIndex = h | ht->nTableMask;
				p = ht->arData + idx;
				Z_NEXT(p->val) = HT_HASH(ht, nIndex);
				HT_HASH(ht, nIndex) = HT_IDX_TO_HASH(idx);
				if ((zend_long)h >= ht->nNextFreeElement) {
					ht->nNextFreeElement = (zend_long)h < ZEND_LONG_MAX ? (zend_long)h + 1 : ZEND_LONG_MAX;
				}
				p->h = h;
				p->key = NULL;
				ZVAL_COPY_VALUE(&p->val, val);
			}
			ht->nNumUsed = n;
			ht->nNumOfElements = n;
		}
	} else if (EXPECTED(num == 0)) {
		RETURN_EMPTY_ARRAY();
	} else {
		zend_argument_value_error(2, "must be greater than or equal to 0");
		RETURN_THROWS();
	}
}
/* }}} */

/* {{{ Create an array using the elements of the first parameter as keys each initialized to val */

/* ===== array_fill_keys_alpha (array.c 3807-3924) ===== */

PHP_FUNCTION(array_fill_keys_alpha)
{
	zval *keys, *val;
	HashTable *src, *ret_ht;
	uint32_t n;

	ZEND_PARSE_PARAMETERS_START(2, 2)
		Z_PARAM_ARRAY(keys)
		Z_PARAM_ZVAL(val)
	ZEND_PARSE_PARAMETERS_END();

	src = Z_ARRVAL_P(keys);
	n = zend_hash_num_elements(src);

	if (!n) {
		RETURN_EMPTY_ARRAY();
	}

	array_init_size(return_value, n);
	ret_ht = Z_ARRVAL_P(return_value);

	/* Fast path + general packed-keys path: keys is packed and hole-free, so a
	 * raw index i over arPacked lines the k-th key up with itself (no inner
	 * hole-skip loop, like the baseline's ZEND_HASH_FOREACH_VAL). */
	if (HT_IS_PACKED(src) && src->nNumUsed == n) {
		zval *pk = src->arPacked;
		zend_long expected = 0;
		bool contiguous = true;
		uint32_t i;

		/* Pre-scan the key values: detect the contiguous-0..n-1 longs shape
		 * that lets us emit a packed (list) result with no hash lookup.
		 * Aborts on the first non-long or out-of-sequence key, so string-keyed
		 * or sparse input is O(1) here and falls through to the general path.
		 *
		 * O(1) necessary-condition gate before the O(n) pre-scan: the contiguous
		 * 0..n-1 list must have first key == 0 and last key == n-1 (both IS_LONG).
		 * Duplicate-heavy, sparse, or string keys whose first or last element
		 * betrays them are detected here in O(1) and skip the pre-scan entirely,
		 * so they no longer pay the pre-scan tax only to fall through to the
		 * general path (e.g. array_merge(range(0,n/2-1), range(0,n/2-1)) has last
		 * key n/2-1 != n-1 and is caught here). */
		{
			zval *k0 = (Z_TYPE_P(&pk[0]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[0]) : &pk[0];
			zval *klast = (Z_TYPE_P(&pk[n - 1]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[n - 1]) : &pk[n - 1];
			if (Z_TYPE_P(k0) != IS_LONG || Z_LVAL_P(k0) != 0
			 || Z_TYPE_P(klast) != IS_LONG || Z_LVAL_P(klast) != (zend_long)(n - 1)) {
				contiguous = false;
			} else {
				for (i = 0; i < n; i++) {
					zval *k = (Z_TYPE_P(&pk[i]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[i]) : &pk[i];
					if (Z_TYPE_P(k) != IS_LONG || Z_LVAL_P(k) != expected) {
						contiguous = false;
						break;
					}
					expected++;
				}
			}
		}

		if (contiguous) {
			/* Result is a list: append the value n times, no hash lookup. Keys
			 * 0..n-1 are unique, so _add semantics are trivially preserved.
			 * FILL_ADD does ZVAL_COPY_VALUE only, so addref first by n (same net
			 * +n as the baseline's batch GC_ADDREF_EX). */
			if (Z_REFCOUNTED_P(val)) {
				GC_ADDREF_EX(Z_COUNTED_P(val), n);
			}
			zend_hash_real_init_packed(ret_ht);
			ZEND_HASH_FILL_PACKED(ret_ht) {
				for (i = 0; i < n; i++) {
					ZEND_HASH_FILL_ADD(val);
				}
			} ZEND_HASH_FILL_END();
			return;
		}

		/* General packed-keys path: direct arPacked walk, but the standard
		 * zend_hash_index_add / zend_symtable_add calls so the result's packed
		 * vs mixed representation and first-wins dedup match the baseline. */
		for (i = 0; i < n; i++) {
			zval *entry = (Z_TYPE_P(&pk[i]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[i]) : &pk[i];
			if (Z_TYPE_P(entry) == IS_LONG) {
				zend_hash_index_add(ret_ht, Z_LVAL_P(entry), val);
			} else {
				zend_string *tmp_key;
				zend_string *key = zval_get_tmp_string(entry, &tmp_key);
				zend_symtable_add(ret_ht, key, val);
				zend_tmp_string_release(tmp_key);
			}
		}
		if (Z_REFCOUNTED_P(val)) {
			GC_ADDREF_EX(Z_COUNTED_P(val), zend_hash_num_elements(ret_ht));
		}
		return;
	}

	/* Fallback: holey or associative keys -> identical to the baseline loop. */
	{
		zval *entry;
		ZEND_HASH_FOREACH_VAL(src, entry) {
			ZVAL_DEREF(entry);
			if (Z_TYPE_P(entry) == IS_LONG) {
				zend_hash_index_add(ret_ht, Z_LVAL_P(entry), val);
			} else {
				zend_string *tmp_key;
				zend_string *key = zval_get_tmp_string(entry, &tmp_key);
				zend_symtable_add(ret_ht, key, val);
				zend_tmp_string_release(tmp_key);
			}
		} ZEND_HASH_FOREACH_END();
		if (Z_REFCOUNTED_P(val)) {
			GC_ADDREF_EX(Z_COUNTED_P(val), zend_hash_num_elements(ret_ht));
		}
	}
}
/* }}} */


/* ===== php_range_process_input (array.c 3962-4028) ===== */

static uint8_t php_range_process_input(const zval *input, uint32_t arg_num, zend_long /* restrict */ *lval, double /* restrict */ *dval)
{
	switch (Z_TYPE_P(input)) {
		case IS_LONG:
			*lval = Z_LVAL_P(input);
			*dval = (double) Z_LVAL_P(input);
			return IS_LONG;
		case IS_DOUBLE:
			*dval = Z_DVAL_P(input);
			check_dval_value:
			if (zend_isinf(*dval)) {
				zend_argument_value_error(arg_num, "must be a finite number, INF provided");
				return 0;
			}
			if (zend_isnan(*dval)) {
				zend_argument_value_error(arg_num, "must be a finite number, NAN provided");
				return 0;
			}
			return IS_DOUBLE;
		case IS_STRING: {
			/* Process strings:
			 * - Empty strings are converted to 0 with a diagnostic
			 * - Check if string is numeric and store the values in passed pointer
			 * - If numeric float, this means it cannot be a numeric string with only one byte GOTO IS_DOUBLE
			 * - If numeric int, check it is one byte or not
			 *   - If it one byte, return IS_ARRAY as IS_LONG < IS_STRING < IS_ARRAY
			 *   - If not should only be interpreted as int, return IS_LONG;
			 * - Otherwise is a string and return IS_STRING */
			if (Z_STRLEN_P(input) == 0) {
				const char *arg_name = get_active_function_arg_name(arg_num);
				php_error_docref(NULL, E_WARNING, "Argument #%d ($%s) must not be empty, casted to 0", arg_num, arg_name);
				if (UNEXPECTED(EG(exception))) {
					return 0;
				}
				*lval = 0;
				*dval = 0.0;
				return IS_LONG;
			}
			uint8_t type = is_numeric_str_function(Z_STR_P(input), lval, dval);
			if (type == IS_DOUBLE) {
				goto check_dval_value;
			}
			if (type == IS_LONG) {
				*dval = (double) *lval;
				if (Z_STRLEN_P(input) == 1) {
					return IS_ARRAY;
				} else {
					return IS_LONG;
				}
			}
			if (Z_STRLEN_P(input) != 1) {
				const char *arg_name = get_active_function_arg_name(arg_num);
				php_error_docref(NULL, E_WARNING, "Argument #%d ($%s) must be a single byte, subsequent bytes are ignored", arg_num, arg_name);
				if (UNEXPECTED(EG(exception))) {
					return 0;
				}
			}
			/* Set fall back values to 0 in case the other argument is not a string */
			*lval = 0;
			*dval = 0.0;
			return IS_STRING;
		}
		default: ZEND_UNREACHABLE();
	}
}

/* {{{ Create an array containing the range of integers or characters from low to high (inclusive) */

/* ===== php_range_fill_long_alpha (array.c 4313-4385) ===== */

static void php_range_fill_long_alpha(zval *arPacked, uint32_t n,
		zend_long base, zend_ulong step, bool increasing)
{
	zval *p = arPacked;
	uint32_t i = 0;

#if defined(__AVX2__)
	/* 4 zvals/iter: two 32-byte stores. vacc = {lval0..lval3}; permute+blend
	 * weaves in the IS_LONG tag at the high 4 bytes of each 8-byte lane. */
	if (n >= 4 && step <= (zend_ulong)(ZEND_LONG_MAX / 4)) {
		__m256i vtempl = _mm256_setr_epi64x(0, (long long)IS_LONG, 0, (long long)IS_LONG);
		__m256i vacc = increasing
			? _mm256_setr_epi64x((long long)base,
			                      (long long)(base + (zend_long)step),
			                      (long long)(base + 2 * (zend_long)step),
			                      (long long)(base + 3 * (zend_long)step))
			: _mm256_setr_epi64x((long long)base,
			                      (long long)(base - (zend_long)step),
			                      (long long)(base - 2 * (zend_long)step),
			                      (long long)(base - 3 * (zend_long)step));
		__m256i vadv = _mm256_set1_epi64x((long long)(increasing
			? (zend_long)(4 * step) : -(zend_long)(4 * step)));
		uint32_t bulk = n & ~(uint32_t)3u;
		for (; i + 4 <= bulk; i += 4) {
			/* regA = {lval0, IS_LONG, lval1, IS_LONG}: qw0,qw2 from vacc[0],[1]. */
			__m256i va = _mm256_permute4x64_epi64(vacc, 0x10); /* {v0,v0,v1,v0} */
			va = _mm256_blend_epi32(va, vtempl, 0xCC);          /* qw0=v0, qw2=v1, qw1=qw3=tag */
			/* regB = {lval2, IS_LONG, lval3, IS_LONG}: qw0,qw2 from vacc[2],[3]. */
			__m256i vb = _mm256_permute4x64_epi64(vacc, 0x32); /* {v2,v0,v3,v0} */
			vb = _mm256_blend_epi32(vb, vtempl, 0xCC);
			_mm256_storeu_si256((__m256i *)p, va);
			_mm256_storeu_si256((__m256i *)(p + 2), vb);
			p += 4;
			vacc = _mm256_add_epi64(vacc, vadv);
		}
	}
#elif defined(__ARM_NEON) || defined(__aarch64__)
	/* 2 zvals/iter: two 16-byte stores. vacc holds the next two lvals; each
	 * zval vector = {lval, IS_LONG} (tag in the high 8 bytes). */
	if (n >= 2 && step <= (zend_ulong)(ZEND_LONG_MAX / 2)) {
		uint64x2_t vtag = vdupq_n_u64((uint64_t)IS_LONG);
		uint64x2_t vacc = vdupq_n_u64(0);
		vacc = vsetq_lane_u64((uint64_t)base, vacc, 0);
		vacc = vsetq_lane_u64((uint64_t)(increasing
			? base + (zend_long)step : base - (zend_long)step), vacc, 1);
		uint64x2_t vadv = vdupq_n_u64((uint64_t)(2 * step));
		uint32_t bulk = n & ~(uint32_t)1u;
		for (; i + 2 <= bulk; i += 2) {
			uint64x2_t z0 = vsetq_lane_u64(vgetq_lane_u64(vacc, 0), vtag, 0);
			uint64x2_t z1 = vsetq_lane_u64(vgetq_lane_u64(vacc, 1), vtag, 0);
			vst1q_u64((uint64_t *)p, z0);
			vst1q_u64((uint64_t *)(p + 1), z1);
			p += 2;
			vacc = increasing ? vaddq_u64(vacc, vadv) : vsubq_u64(vacc, vadv);
		}
	}
#endif

	/* Scalar tail / fallback. i is the absolute array index so the expression
	 * matches the baseline's start_long ± (i * unsigned_step) exactly. */
	for (; i < n; ++i) {
		if (increasing) {
			ZVAL_LONG(p, base + (i * step));
		} else {
			ZVAL_LONG(p, base - (i * step));
		}
		p++;
	}
}

/* Size-check + allocation macros for range_alpha. Identical math and error
 * messages to RANGE_CHECK_*_INIT_ARRAY above so parity holds; defined locally
 * because the originals are #undef'd at the end of range(). */

/* ===== RANGE_CHECK_ALPHA_macros (array.c 4386-4423) ===== */

#define RANGE_CHECK_DOUBLE_INIT_ARRAY_ALPHA(start, end, _step) do { \
		double __calc_size = ((start - end) / (_step)) + 1; \
		if (__calc_size >= (double)HT_MAX_SIZE) { \
			double __exceed_by = __calc_size - (double)HT_MAX_SIZE; \
			zend_value_error(\
				"The supplied range exceeds the maximum array size by %.1f elements: " \
				"start=%.1f, end=%.1f, step=%.1f. Max size: %.0f", \
				__exceed_by, end, start, (_step), (double)HT_MAX_SIZE); \
			RETURN_THROWS(); \
		} \
		size = (uint32_t)_php_math_round(__calc_size, 0, PHP_ROUND_HALF_UP); \
		array_init_size(return_value, size); \
		zend_hash_real_init_packed(Z_ARRVAL_P(return_value)); \
	} while (0)

#define RANGE_CHECK_LONG_INIT_ARRAY_ALPHA(start, end, _step) do { \
		zend_ulong __calc_size = ((zend_ulong) start - end) / (_step); \
		if (__calc_size >= HT_MAX_SIZE - 1) { \
			uint64_t __excess = __calc_size - (HT_MAX_SIZE - 1); \
			zend_value_error(\
				"The supplied range exceeds the maximum array size by %" PRIu64 " elements: " \
				"start=" ZEND_LONG_FMT ", end=" ZEND_LONG_FMT ", step=" ZEND_LONG_FMT ". " \
				"Calculated size: %" PRIu64 ". Maximum size: %" PRIu64 ".", \
				__excess, end, start, (_step), (uint64_t)__calc_size, (uint64_t)HT_MAX_SIZE); \
			RETURN_THROWS(); \
		} \
		size = (uint32_t)(__calc_size + 1); \
		array_init_size(return_value, size); \
		zend_hash_real_init_packed(Z_ARRVAL_P(return_value)); \
	} while (0)

/* {{{ _alpha sibling of range(): SIMD strided packed-zval fill for the integer
 * progressions. Input processing, char ranges, single-element cases, the double
 * path, all warnings and errors are copied verbatim from range(); only the two
 * integer ZEND_HASH_FILL loops are replaced by php_range_fill_long_alpha. The
 * double path keeps the scalar loop (the SIMD fill did not measure a win there,
 * see the comment above php_range_fill_long_alpha). The original range() stays
 * byte-for-byte untouched. */

/* ===== range_alpha (array.c 4424-4678) ===== */

PHP_FUNCTION(range_alpha)
{
	zval *user_start, *user_end, *user_step = NULL, tmp;
	bool is_step_double = false;
	bool is_step_negative = false;
	double step_double = 1.0;
	zend_long step = 1;

	ZEND_PARSE_PARAMETERS_START(2, 3)
		Z_PARAM_NUMBER_OR_STR(user_start)
		Z_PARAM_NUMBER_OR_STR(user_end)
		Z_PARAM_OPTIONAL
		Z_PARAM_NUMBER(user_step)
	ZEND_PARSE_PARAMETERS_END();

	if (user_step) {
		if (UNEXPECTED(Z_TYPE_P(user_step) == IS_DOUBLE)) {
			step_double = Z_DVAL_P(user_step);

			if (zend_isinf(step_double)) {
				zend_argument_value_error(3, "must be a finite number, INF provided");
				RETURN_THROWS();
			}
			if (zend_isnan(step_double)) {
				zend_argument_value_error(3, "must be a finite number, NAN provided");
				RETURN_THROWS();
			}

			/* We only want positive step values. */
			if (step_double < 0.0) {
				is_step_negative = true;
				step_double *= -1;
			}
			step = zend_dval_to_lval_silent(step_double);
			if (!zend_is_long_compatible(step_double, step)) {
				is_step_double = true;
			}
		} else {
			step = Z_LVAL_P(user_step);
			/* We only want positive step values. */
			if (step < 0) {
				if (UNEXPECTED(step == ZEND_LONG_MIN)) {
					zend_argument_value_error(3, "must be greater than " ZEND_LONG_FMT, step);
					RETURN_THROWS();
				}
				is_step_negative = true;
				step *= -1;
			}
			step_double = (double) step;
		}
		if (step_double == 0.0) {
			zend_argument_value_error(3, "cannot be 0");
			RETURN_THROWS();
		}
	}

	uint8_t start_type;
	double start_double;
	zend_long start_long;
	uint8_t end_type;
	double end_double;
	zend_long end_long;

	start_type = php_range_process_input(user_start, 1, &start_long, &start_double);
	if (start_type == 0) {
		RETURN_THROWS();
	}
	end_type = php_range_process_input(user_end, 2, &end_long, &end_double);
	if (end_type == 0) {
		RETURN_THROWS();
	}

	/* If the range is given as strings, generate an array of characters. */
	if (start_type >= IS_STRING || end_type >= IS_STRING) {
		/* If one of the inputs is NOT a string nor single-byte string */
		if (UNEXPECTED(start_type < IS_STRING || end_type < IS_STRING)) {
			if (start_type < IS_STRING) {
				if (end_type != IS_ARRAY) {
					php_error_docref(NULL, E_WARNING, "Argument #1 ($start) must be a single byte string if"
						" argument #2 ($end) is a single byte string, argument #2 ($end) converted to 0");
				}
				end_type = IS_LONG;
			} else if (end_type < IS_STRING) {
				if (start_type != IS_ARRAY) {
					php_error_docref(NULL, E_WARNING, "Argument #2 ($end) must be a single byte string if"
						" argument #1 ($start) is a single byte string, argument #1 ($start) converted to 0");
				}
				start_type = IS_LONG;
			}
			if (UNEXPECTED(EG(exception))) {
				RETURN_THROWS();
			}
			goto handle_numeric_inputs_alpha;
		}

		if (is_step_double) {
			/* Only emit warning if one of the input is not a numeric digit */
			if (start_type == IS_STRING || end_type == IS_STRING) {
				php_error_docref(NULL, E_WARNING, "Argument #3 ($step) must be of type int when generating an array"
					" of characters, inputs converted to 0");
				if (UNEXPECTED(EG(exception))) {
					RETURN_THROWS();
				}
			}
			end_type = IS_LONG;
			start_type = IS_LONG;
			goto handle_numeric_inputs_alpha;
		}

		/* Generate array of characters, as zero-extended ints to make bounds checking possible in the loop condition */
		int low = (unsigned char) Z_STRVAL_P(user_start)[0];
		int high = (unsigned char) Z_STRVAL_P(user_end)[0];

		/* Decreasing char range */
		if (low > high) {
			if (low - high < step) {
				goto boundary_error_alpha;
			}
			/* Initialize the return_value as an array. */
			array_init_size(return_value, (uint32_t)(((low - high) / step) + 1));
			zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
			ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
				for (; low >= high; low -= step) {
					ZEND_HASH_FILL_SET_INTERNED_STR(ZSTR_CHAR(low));
					ZEND_HASH_FILL_NEXT();
				}
			} ZEND_HASH_FILL_END();
		} else if (high > low) { /* Increasing char range */
			if (is_step_negative) {
				goto negative_step_error_alpha;
			}
			if (high - low < step) {
				goto boundary_error_alpha;
			}
			array_init_size(return_value, (uint32_t)(((high - low) / step) + 1));
			zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
			ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
				for (; low <= high; low += step) {
					ZEND_HASH_FILL_SET_INTERNED_STR(ZSTR_CHAR(low));
					ZEND_HASH_FILL_NEXT();
				}
			} ZEND_HASH_FILL_END();
		} else {
			array_init(return_value);
			ZVAL_CHAR(&tmp, low);
			zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &tmp);
		}
		return;
	}

	handle_numeric_inputs_alpha:
	if (start_type == IS_DOUBLE || end_type == IS_DOUBLE || is_step_double) {
		double element;
		uint32_t i, size;

		/* The double path keeps the verbatim scalar ZEND_HASH_FILL loop. The
		 * SIMD strided fill was measured (NEON, Cortex-A76, -O2) to be at best
		 * break-even and stably ~8% slower for small float ranges: the FP
		 * multiply-then-add per lane plus the vsetq_lane vector-building
		 * overhead costs more than the wider store saves, since the compiler
		 * already auto-vectorizes this loop well. See bench_range_alpha.php. */

		/* Decreasing float range */
		if (start_double > end_double) {
			if (start_double - end_double < step_double) {
				goto boundary_error_alpha;
			}

			RANGE_CHECK_DOUBLE_INIT_ARRAY_ALPHA(start_double, end_double, step_double);

			ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
				for (i = 0, element = start_double; i < size && element >= end_double; ++i, element = start_double - (i * step_double)) {
					ZEND_HASH_FILL_SET_DOUBLE(element);
					ZEND_HASH_FILL_NEXT();
				}
			} ZEND_HASH_FILL_END();
		} else if (end_double > start_double) { /* Increasing float range */
			if (is_step_negative) {
				goto negative_step_error_alpha;
			}
			if (end_double - start_double < step_double) {
				goto boundary_error_alpha;
			}

			RANGE_CHECK_DOUBLE_INIT_ARRAY_ALPHA(end_double, start_double, step_double);

			ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
				for (i = 0, element = start_double; i < size && element <= end_double; ++i, element = start_double + (i * step_double)) {
					ZEND_HASH_FILL_SET_DOUBLE(element);
					ZEND_HASH_FILL_NEXT();
				}
			} ZEND_HASH_FILL_END();
		} else {
			array_init(return_value);
			ZVAL_DOUBLE(&tmp, start_double);
			zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &tmp);
		}
	} else {
		ZEND_ASSERT(start_type == IS_LONG && end_type == IS_LONG && !is_step_double);
		/* unsigned_step is a zend_ulong so that comparisons to it don't overflow, i.e. low - high < lstep */
		zend_ulong unsigned_step = (zend_ulong)step;
		uint32_t size;

		/* Decreasing int range */
		if (start_long > end_long) {
			if ((zend_ulong)start_long - end_long < unsigned_step) {
				goto boundary_error_alpha;
			}

			RANGE_CHECK_LONG_INIT_ARRAY_ALPHA(start_long, end_long, unsigned_step);

			php_range_fill_long_alpha(Z_ARRVAL_P(return_value)->arPacked,
				size, start_long, unsigned_step, false);
			Z_ARRVAL_P(return_value)->nNumUsed = size;
			Z_ARRVAL_P(return_value)->nNumOfElements = size;
			Z_ARRVAL_P(return_value)->nNextFreeElement = size;
			Z_ARRVAL_P(return_value)->nInternalPointer = 0;
		} else if (end_long > start_long) { /* Increasing int range */
			if (is_step_negative) {
				goto negative_step_error_alpha;
			}
			if ((zend_ulong)end_long - start_long < unsigned_step) {
				goto boundary_error_alpha;
			}

			RANGE_CHECK_LONG_INIT_ARRAY_ALPHA(end_long, start_long, unsigned_step);

			php_range_fill_long_alpha(Z_ARRVAL_P(return_value)->arPacked,
				size, start_long, unsigned_step, true);
			Z_ARRVAL_P(return_value)->nNumUsed = size;
			Z_ARRVAL_P(return_value)->nNumOfElements = size;
			Z_ARRVAL_P(return_value)->nNextFreeElement = size;
			Z_ARRVAL_P(return_value)->nInternalPointer = 0;
		} else {
			array_init(return_value);
			ZVAL_LONG(&tmp, start_long);
			zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &tmp);
		}
	}
	return;

	negative_step_error_alpha:
	zend_argument_value_error(3, "must be greater than 0 for increasing ranges");
	RETURN_THROWS();

	boundary_error_alpha:
	zend_argument_value_error(3, "must be less than the range spanned by argument #1 ($start) and argument #2 ($end)");
	RETURN_THROWS();
}
/* }}} */

#undef RANGE_CHECK_DOUBLE_INIT_ARRAY_ALPHA
#undef RANGE_CHECK_LONG_INIT_ARRAY_ALPHA

/* {{{ php_array_data_shuffle */

/* ===== php_splice_alpha (array.c 5020-5380) ===== */

static void php_splice_alpha(HashTable *in_hash, zend_long offset, zend_long length, HashTable *replace, HashTable *removed) /* {{{ */
{
	HashTable 	 out_hash;			/* Output hashtable */
	zend_long	 num_in;			/* Number of entries in the input hashtable */
	zend_long	 pos;				/* Current position in the hashtable */
	uint32_t     idx;
	zval		*entry;				/* Hash entry */
	uint32_t    iter_pos = zend_hash_iterators_lower_pos(in_hash, 0);

	GC_ADDREF(in_hash);
	HT_ALLOW_COW_VIOLATION(in_hash); /* Will be reset when setting the flags for in_hash */

	/* Get number of entries in the input hash */
	num_in = zend_hash_num_elements(in_hash);

	/* Clamp the offset.. */
	if (offset > num_in) {
		offset = num_in;
	} else if (offset < 0 && (offset = (num_in + offset)) < 0) {
		offset = 0;
	}

	/* ..and the length */
	if (length < 0) {
		length = num_in - offset + length;
	} else if (((unsigned)offset + (unsigned)length) > (unsigned)num_in) {
		length = num_in - offset;
	}

	/* Fast path: packed, no holes, no active iterators. Build out_hash (and,
	 * if requested, the removed-elements return array) with bulk packed fills
	 * instead of per-element zend_hash_next_index_insert_new(). */
	if (HT_IS_PACKED(in_hash)
			&& HT_IS_WITHOUT_HOLES(in_hash)
			&& HT_ITERATORS_COUNT(in_hash) == 0) {
		zend_long  removed_count = (length > 0) ? length : 0;
		uint32_t   kept          = (uint32_t)(num_in - removed_count);
		uint32_t   replace_count = replace ? zend_hash_num_elements(replace) : 0;
		uint32_t   final         = kept + replace_count;
		zval      *src           = in_hash->arPacked;
		uint32_t   i;

		/* In-place removal fast path (removal-only / empty replacement). The
		 * shared gate (packed, no holes, no active iterators) is already in
		 * effect. When nothing is being inserted, the result is simply the
		 * kept prefix (which stays put) followed by the kept suffix shifted
		 * left over the removed run -- a list, renumbered for free because
		 * packed keys ARE slot indices. Mutate in_hash directly instead of
		 * allocating out_hash, copying every kept element, destroying in_hash,
		 * and swapping fields.
		 *
		 * Ownership: the removed run is MOVED into `removed` (no addref); the
		 * suffix is bit-copied down by memmove (no addref); the now-stale tail
		 * slots are ZVAL_UNDEF'd (no delref -- the live copy owns the refcount).
		 * No user destructor can run here (no replace, no destroy), so the
		 * gh16649 "modified during operation" UAF check the bulk-fill path
		 * needs does not apply. GC_ADDREF(in_hash) was taken at entry; drop it
		 * before returning to stay symmetric. HT_ALLOW_COW_VIOLATION is left
		 * set: storage never moved, so it stays accurate. */
		if (removed_count > 0 && replace_count == 0) {
			uint32_t old_nNumUsed = in_hash->nNumUsed;
			uint32_t new_nNumUsed = kept; /* == num_in - removed_count */
			uint32_t suffix_len   = old_nNumUsed - (uint32_t)(offset + removed_count);

			/* Move the removed run into the return array. The caller already
			 * array_init_size()'d it to the clamped removed count, or passed
			 * removed == NULL when the return value is unused. MOVE semantics
			 * (ZVAL_COPY_VALUE, no addref): these slots are being dropped from
			 * in_hash, so ownership transfers to `removed`. */
			if (removed != NULL) {
				zend_hash_real_init_packed(removed);
				ZEND_HASH_FILL_PACKED(removed) {
					for (i = 0; i < (uint32_t)removed_count; i++) {
						ZEND_HASH_FILL_ADD(src + offset + i);
					}
				} ZEND_HASH_FILL_END();
			}

			/* Shift the suffix [offset + removed_count, old_nNumUsed) down to
			 * [offset, ...). The kept prefix [0, offset) is untouched. dest
			 * starts strictly before src, so the regions do not overlap;
			 * memmove is used for clarity (memcpy would also be valid). zvals
			 * are trivially bit-copyable -- no per-element addref/delref. */
			if (suffix_len > 0) {
				memmove(src + offset,
				        src + offset + removed_count,
				        suffix_len * sizeof(zval));
			}

			/* Clear the stale tail [new_nNumUsed, old_nNumUsed). These slots
			 * are duplicates of moved elements (suffix) and the moved removed
			 * run; ownership now lives at their new slots, so ZVAL_UNDEF
			 * without delref. With nNumUsed lowered, ZVAL_PTR_DTOR will only
			 * ever walk [0, new_nNumUsed). */
			for (i = new_nNumUsed; i < old_nNumUsed; i++) {
				ZVAL_UNDEF(src + i);
			}

			/* Packed + hole-free is preserved, so nNumUsed == nNumOfElements ==
			 * nNextFreeElement. Storage (arPacked/nTableSize), pDestructor, and
			 * the iterator count (gate guaranteed zero) are unchanged. Match
			 * the baseline's nInternalPointer reset (and ZEND_HASH_FILL_FINISH). */
			in_hash->nNumUsed         = new_nNumUsed;
			in_hash->nNumOfElements   = new_nNumUsed;
			in_hash->nNextFreeElement = new_nNumUsed;
			in_hash->nInternalPointer = 0;

			GC_DELREF(in_hash);
			return;
		}

		/* Removed-elements return array. The caller already array_init_size()'d
		 * it to the clamped removed count; real_init packed and bulk-fill the
		 * contiguous removed run. Skip when empty so an empty return value
		 * stays exactly as the caller produced it.
		 *
		 * Like the baseline, the kept and removed slots are MOVED (no addref):
		 * in_hash is destroyed below with pDestructor = NULL, so its slots are
		 * never decremented -- ownership simply transfers to out_hash / removed.
		 * Only the replacement values are addref'd, because the `replace`
		 * array survives the call and shares them. */
		if (removed != NULL && removed_count > 0) {
			zend_hash_real_init_packed(removed);
			ZEND_HASH_FILL_PACKED(removed) {
				for (i = 0; i < (uint32_t)removed_count; i++) {
					ZEND_HASH_FILL_ADD(src + offset + i);
				}
			} ZEND_HASH_FILL_END();
		}

		/* out_hash: kept prefix + replacement values + kept suffix. */
		zend_hash_init(&out_hash, final, NULL, ZVAL_PTR_DTOR, 0);
		zend_hash_real_init_packed(&out_hash);
		ZEND_HASH_FILL_PACKED(&out_hash) {
			/* prefix [0, offset) */
			for (i = 0; i < (uint32_t)offset; i++) {
				ZEND_HASH_FILL_ADD(src + i);
			}
			/* replacement values (keys ignored, renumbered sequentially) */
			if (replace) {
				ZEND_HASH_FOREACH_VAL(replace, entry) {
					Z_TRY_ADDREF_P(entry);
					ZEND_HASH_FILL_ADD(entry);
				} ZEND_HASH_FOREACH_END();
			}
			/* suffix [offset + removed_count, nNumUsed) */
			for (i = (uint32_t)(offset + removed_count); i < in_hash->nNumUsed; i++) {
				ZEND_HASH_FILL_ADD(src + i);
			}
		} ZEND_HASH_FILL_END();

		/* No iterators were active (gate), so the baseline's per-element
		 * zend_hash_iterators_update() bookkeeping is unnecessary. */
		HT_SET_ITERATORS_COUNT(&out_hash, HT_ITERATORS_COUNT(in_hash));
		HT_SET_ITERATORS_COUNT(in_hash, 0);
		in_hash->pDestructor = NULL;
		in_hash->nInternalPointer = 0;

		if (UNEXPECTED(GC_DELREF(in_hash) == 0)) {
			/* Array was completely deallocated during the operation */
			zend_array_destroy(in_hash);
			zend_hash_destroy(&out_hash);
			zend_throw_error(NULL, "Array was modified during array_splice operation");
			return;
		}

		zend_hash_destroy(in_hash);

		HT_FLAGS(in_hash)          = HT_FLAGS(&out_hash);
		in_hash->nTableSize        = out_hash.nTableSize;
		in_hash->nTableMask        = out_hash.nTableMask;
		in_hash->nNumUsed          = out_hash.nNumUsed;
		in_hash->nNumOfElements    = out_hash.nNumOfElements;
		in_hash->nNextFreeElement  = out_hash.nNextFreeElement;
		in_hash->arData            = out_hash.arData;
		in_hash->pDestructor       = out_hash.pDestructor;
		return;
	}

	/* Slow path: verbatim copy of php_splice's per-element rebuild, used when
	 * the input has holes, a mixed/string-keyed layout, or an active iterator. */

	/* Create and initialize output hash */
	zend_hash_init(&out_hash, (length > 0 ? num_in - length : 0) + (replace ? zend_hash_num_elements(replace) : 0), NULL, ZVAL_PTR_DTOR, 0);

	if (HT_IS_PACKED(in_hash)) {
		/* Start at the beginning of the input hash and copy entries to output hash until offset is reached */
		entry = in_hash->arPacked;
		for (pos = 0, idx = 0; pos < offset && idx < in_hash->nNumUsed; idx++, entry++) {
			if (Z_TYPE_P(entry) == IS_UNDEF) continue;

			zend_hash_next_index_insert_new(&out_hash, entry);
			if (idx == iter_pos) {
				if ((zend_long)idx != pos) {
					zend_hash_iterators_update(in_hash, idx, pos);
				}
				iter_pos = zend_hash_iterators_lower_pos(in_hash, iter_pos + 1);
			}
			pos++;
		}

		/* If hash for removed entries exists, go until offset+length and copy the entries to it */
		if (removed != NULL) {
			for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
				if (Z_TYPE_P(entry) == IS_UNDEF) continue;
				pos++;
				Z_TRY_ADDREF_P(entry);
				zend_hash_next_index_insert_new(removed, entry);
				zend_hash_packed_del_val(in_hash, entry);
				/* Bump iterator positions to the element after replacement. */
				if (idx == iter_pos) {
					zend_hash_iterators_update(in_hash, idx, offset + length);
					iter_pos = zend_hash_iterators_lower_pos(in_hash, iter_pos + 1);
				}
			}
		} else { /* otherwise just skip those entries */
			zend_long pos2 = pos;

			for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, entry++) {
				if (Z_TYPE_P(entry) == IS_UNDEF) continue;
				pos2++;
				zend_hash_packed_del_val(in_hash, entry);
				/* Bump iterator positions to the element after replacement. */
				if (idx == iter_pos) {
					zend_hash_iterators_update(in_hash, idx, offset + length);
					iter_pos = zend_hash_iterators_lower_pos(in_hash, iter_pos + 1);
				}
			}
		}

		/* If there are entries to insert.. */
		if (replace) {
			ZEND_HASH_FOREACH_VAL(replace, entry) {
				Z_TRY_ADDREF_P(entry);
				zend_hash_next_index_insert_new(&out_hash, entry);
				pos++;
			} ZEND_HASH_FOREACH_END();
		}

		/* Copy the remaining input hash entries to the output hash */
		entry = in_hash->arPacked + idx;
		for ( ; idx < in_hash->nNumUsed ; idx++, entry++) {
			if (Z_TYPE_P(entry) == IS_UNDEF) continue;
			zend_hash_next_index_insert_new(&out_hash, entry);
			if (idx == iter_pos) {
				if ((zend_long)idx != pos) {
					zend_hash_iterators_update(in_hash, idx, pos);
				}
				iter_pos = zend_hash_iterators_lower_pos(in_hash, iter_pos + 1);
			}
			pos++;
		}
	} else {
		Bucket *p = in_hash->arData;

		/* Start at the beginning of the input hash and copy entries to output hash until offset is reached */
		for (pos = 0, idx = 0; pos < offset && idx < in_hash->nNumUsed; idx++, p++) {
			if (Z_TYPE(p->val) == IS_UNDEF) continue;
			entry = &p->val;

			/* Update output hash depending on key type */
			if (p->key == NULL) {
				zend_hash_next_index_insert_new(&out_hash, entry);
			} else {
				zend_hash_add_new(&out_hash, p->key, entry);
			}
			if (idx == iter_pos) {
				if ((zend_long)idx != pos) {
					zend_hash_iterators_update(in_hash, idx, pos);
				}
				iter_pos = zend_hash_iterators_lower_pos(in_hash, iter_pos + 1);
			}
			pos++;
		}

		/* If hash for removed entries exists, go until offset+length and copy the entries to it */
		if (removed != NULL) {
			for ( ; pos - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
				if (Z_TYPE(p->val) == IS_UNDEF) continue;
				pos++;
				entry = &p->val;
				Z_TRY_ADDREF_P(entry);
				if (p->key == NULL) {
					zend_hash_next_index_insert_new(removed, entry);
				} else {
					zend_hash_add_new(removed, p->key, entry);
				}
				zend_hash_del_bucket(in_hash, p);
			}
		} else { /* otherwise just skip those entries */
			zend_long pos2 = pos;

			for ( ; pos2 - offset < length && idx < in_hash->nNumUsed; idx++, p++) {
				if (Z_TYPE(p->val) == IS_UNDEF) continue;
				pos2++;
				zend_hash_del_bucket(in_hash, p);
			}
		}
		iter_pos = zend_hash_iterators_lower_pos(in_hash, iter_pos);

		/* If there are entries to insert.. */
		if (replace) {
			ZEND_HASH_FOREACH_VAL(replace, entry) {
				Z_TRY_ADDREF_P(entry);
				zend_hash_next_index_insert_new(&out_hash, entry);
				pos++;
			} ZEND_HASH_FOREACH_END();
		}

		/* Copy the remaining input hash entries to the output hash */
		for ( ; idx < in_hash->nNumUsed ; idx++, p++) {
			if (Z_TYPE(p->val) == IS_UNDEF) continue;
			entry = &p->val;
			if (p->key == NULL) {
				zend_hash_next_index_insert_new(&out_hash, entry);
			} else {
				zend_hash_add_new(&out_hash, p->key, entry);
			}
			if (idx == iter_pos) {
				if ((zend_long)idx != pos) {
					zend_hash_iterators_update(in_hash, idx, pos);
				}
				iter_pos = zend_hash_iterators_lower_pos(in_hash, iter_pos + 1);
			}
			pos++;
		}
	}

	/* replace HashTable data */
	HT_SET_ITERATORS_COUNT(&out_hash, HT_ITERATORS_COUNT(in_hash));
	HT_SET_ITERATORS_COUNT(in_hash, 0);
	in_hash->pDestructor = NULL;

	/* Set internal pointer to 0 directly instead of calling zend_hash_internal_pointer_reset().
	 * This avoids the COW violation assertion and delays advancing to the first valid position
	 * until after we've switched to the new array structure (out_hash). The iterator will be
	 * advanced when actually accessed, at which point it will find valid indexes in the new array. */
	in_hash->nInternalPointer = 0;

	if (UNEXPECTED(GC_DELREF(in_hash) == 0)) {
		/* Array was completely deallocated during the operation */
		zend_array_destroy(in_hash);
		zend_hash_destroy(&out_hash);
		zend_throw_error(NULL, "Array was modified during array_splice operation");
		return;
	}

	zend_hash_destroy(in_hash);

	HT_FLAGS(in_hash)          = HT_FLAGS(&out_hash);
	in_hash->nTableSize        = out_hash.nTableSize;
	in_hash->nTableMask        = out_hash.nTableMask;
	in_hash->nNumUsed          = out_hash.nNumUsed;
	in_hash->nNumOfElements    = out_hash.nNumOfElements;
	in_hash->nNextFreeElement  = out_hash.nNextFreeElement;
	in_hash->arData            = out_hash.arData;
	in_hash->pDestructor       = out_hash.pDestructor;
}
/* }}} */

/* {{{ Pushes elements onto the end of the array */

/* ===== array_shift_alpha (array.c 5601-5749) ===== */

PHP_FUNCTION(array_shift_alpha)
{
	zval *stack,	/* Input stack */
		 *val;		/* Value to be popped */
	HashTable *ht;
	uint32_t idx;

	ZEND_PARSE_PARAMETERS_START(1, 1)
		Z_PARAM_ARRAY_EX(stack, 0, 1)
	ZEND_PARSE_PARAMETERS_END();

	ht = Z_ARRVAL_P(stack);

	if (ht->nNumOfElements == 0) {
		return;
	}

	/* Fast path: dense packed array without iterators. The whole tail is one
	 * contiguous run, so a single memmove replaces the baseline's per-element
	 * shift loop (with its IS_UNDEF skip, idx!=k branch and ZVAL_COPY_VALUE per
	 * element). nNumUsed == nNumOfElements (no holes) guarantees arPacked[0] is
	 * the live first element; !HT_HAS_ITERATORS means no positions to update. */
	if (HT_IS_PACKED(ht)
			&& !HT_HAS_ITERATORS(ht)
			&& ht->nNumUsed == ht->nNumOfElements) {
		val = ht->arPacked;
		RETVAL_COPY_VALUE(val);
		idx = ht->nNumUsed;
		if (idx > 1) {
			memmove(ht->arPacked, ht->arPacked + 1, (idx - 1) * sizeof(zval));
		}
		/* Clear the now-vacated tail slot: memmove leaves a byte-duplicate of
		 * the last element there. No decref -- the single refcount is owned by
		 * arPacked[idx-2] after the move. For idx == 1 this clears arPacked[0]. */
		ZVAL_UNDEF(ht->arPacked + idx - 1);
		ht->nNumOfElements = idx - 1;
		ht->nNumUsed = idx - 1;
		ht->nNextFreeElement = idx - 1;
		zend_hash_internal_pointer_reset(ht);
		if (Z_ISREF_P(return_value)) {
			zend_unwrap_reference(return_value);
		}
		return;
	}

	/* re-index like it did before */
	if (HT_IS_PACKED(ht)) {
		uint32_t k = 0;

		/* Get the first value and copy it into the return value */
		idx = 0;
		while (1) {
			if (idx == ht->nNumUsed) {
				return;
			}
			val = ht->arPacked + idx;
			if (Z_TYPE_P(val) != IS_UNDEF) {
				break;
			}
			idx++;
		}
		RETVAL_COPY_VALUE(val);
		ZVAL_UNDEF(val);

		/* Delete the first value */
		zend_hash_packed_del_val(ht, val);

		if (EXPECTED(!HT_HAS_ITERATORS(ht))) {
			for (idx = 0; idx < ht->nNumUsed; idx++) {
				val = ht->arPacked + idx;
				if (Z_TYPE_P(val) == IS_UNDEF) continue;
				if (idx != k) {
					zval *q = ht->arPacked + k;
					ZVAL_COPY_VALUE(q, val);
					ZVAL_UNDEF(val);
				}
				k++;
			}
		} else {
			uint32_t iter_pos = zend_hash_iterators_lower_pos(ht, 0);

			for (idx = 0; idx < ht->nNumUsed; idx++) {
				val = ht->arPacked + idx;
				if (Z_TYPE_P(val) == IS_UNDEF) continue;
				if (idx != k) {
					zval *q = ht->arPacked + k;
					ZVAL_COPY_VALUE(q, val);
					ZVAL_UNDEF(val);
					if (idx == iter_pos) {
						zend_hash_iterators_update(ht, idx, k);
						iter_pos = zend_hash_iterators_lower_pos(ht, iter_pos + 1);
					}
				}
				k++;
			}
		}
		ht->nNumUsed = k;
		ht->nNextFreeElement = k;
	} else {
		uint32_t k = 0;
		int should_rehash = 0;
		Bucket *p;

		/* Get the first value and copy it into the return value */
		idx = 0;
		while (1) {
			if (idx == ht->nNumUsed) {
				return;
			}
			p = ht->arData + idx;
			val = &p->val;
			if (Z_TYPE_P(val) != IS_UNDEF) {
				break;
			}
			idx++;
		}
		RETVAL_COPY_VALUE(val);
		ZVAL_UNDEF(val);

		/* Delete the first value */
		zend_hash_del_bucket(ht, p);

		for (idx = 0; idx < ht->nNumUsed; idx++) {
			p = ht->arData + idx;
			if (Z_TYPE(p->val) == IS_UNDEF) continue;
			if (p->key == NULL) {
				if (p->h != k) {
					p->h = k++;
					should_rehash = 1;
				} else {
					k++;
				}
			}
		}
		ht->nNextFreeElement = k;
		if (should_rehash) {
			zend_hash_rehash(ht);
		}
	}

	zend_hash_internal_pointer_reset(ht);

	if (Z_ISREF_P(return_value)) {
		zend_unwrap_reference(return_value);
	}
}
/* }}} */

/* {{{ Pushes elements onto the beginning of the array */

/* ===== array_unshift_alpha (array.c 5834-5972) ===== */

PHP_FUNCTION(array_unshift_alpha)
{
	zval   *args,			/* Function arguments array */
		   *stack;			/* Input stack */
	uint32_t argc;			/* Number of function arguments */
	HashTable *ht;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_ARRAY_EX(stack, 0, 1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	ht = Z_ARRVAL_P(stack);

	/* Fast path: dense packed array. Prepend in place. */
	if (HT_IS_PACKED(ht) && HT_IS_WITHOUT_HOLES(ht)) {
		uint32_t m = argc;
		uint32_t n = ht->nNumUsed;
		uint32_t new_used = n + m;

		/* new_used < n only on uint32 overflow (pathologically many args);
		 * let the rebuild path handle absurd sizes via zend_hash_init. */
		if (new_used >= n) {
			uint32_t i;

			/* Grow arPacked if the prepend overflows the current capacity.
			 * The by-ref parameter has already separated the array
			 * (refcount == 1), satisfying zend_hash_packed_grow's
			 * HT_ASSERT_RC1. It doubles once per call, so loop until we
			 * have room; arPacked may move, so re-read it below. */
			if (new_used > ht->nTableSize) {
				do {
					zend_hash_packed_grow(ht);
				} while (new_used > ht->nTableSize);
			}

			/* Shift the existing used region [0, n) right by m to
			 * [m, new_used). dest starts strictly above src; memmove
			 * handles the overlap. zvals are trivially bit-copyable --
			 * no per-element addref/delref (the table keeps owning the
			 * same refcounts, now at new slots). */
			if (n > 0 && m > 0) {
				memmove(ht->arPacked + m, ht->arPacked,
					(size_t)n * sizeof(zval));
			}

			/* Write the prepended values at the front. These come from
			 * the caller's argument zvals (which survive the call), so
			 * addref. */
			for (i = 0; i < m; i++) {
				Z_TRY_ADDREF(args[i]);
				ZVAL_COPY_VALUE(ht->arPacked + i, &args[i]);
			}

			/* Every existing slot moved right by m, so every iterator
			 * position moves by m. The baseline makes the same call. */
			if (UNEXPECTED(HT_HAS_ITERATORS(ht))) {
				zend_hash_iterators_advance(ht, m);
			}

			/* Dense packed: keys are slot indices, so after the shift
			 * all three counters collapse to new_used. */
			ht->nNumUsed = new_used;
			ht->nNumOfElements = new_used;
			ht->nNextFreeElement = new_used;
			zend_hash_internal_pointer_reset(ht);

			RETVAL_LONG(ht->nNumOfElements);
			return;
		}
	}

	/* Fallback: verbatim copy of array_unshift's new-table rebuild, for
	 * non-packed (mixed/associative) and holed packed arrays. Compacts holed
	 * packed arrays (renumbering integer keys densely) and rehashes
	 * mixed/string keys exactly as the baseline does. */
	{
		HashTable new_hash;		/* New hashtable for the stack */
		zend_string *key;
		zval *value;

		zend_hash_init(&new_hash, zend_hash_num_elements(Z_ARRVAL_P(stack)) + argc, NULL, ZVAL_PTR_DTOR, 0);

		if (HT_IS_PACKED(Z_ARRVAL_P(stack))) {
			zend_hash_real_init_packed(&new_hash);

			ZEND_HASH_FILL_PACKED(&new_hash) {
				for (uint32_t i = 0; i < argc; i++) {
					Z_TRY_ADDREF(args[i]);
					ZEND_HASH_FILL_ADD(&args[i]);
				}

				ZEND_HASH_PACKED_FOREACH_VAL(Z_ARRVAL_P(stack), value) {
					ZEND_HASH_FILL_ADD(value);
				} ZEND_HASH_FOREACH_END();
			} ZEND_HASH_FILL_END();
		} else {
			for (uint32_t i = 0; i < argc; i++) {
				Z_TRY_ADDREF(args[i]);
				zend_hash_next_index_insert_new(&new_hash, &args[i]);
			}

			ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(stack), key, value) {
				if (key) {
					zend_hash_add_new(&new_hash, key, value);
				} else {
					zend_hash_next_index_insert_new(&new_hash, value);
				}
			} ZEND_HASH_FOREACH_END();
		}

		if (UNEXPECTED(HT_HAS_ITERATORS(Z_ARRVAL_P(stack)))) {
			zend_hash_iterators_advance(Z_ARRVAL_P(stack), argc);
			HT_SET_ITERATORS_COUNT(&new_hash, HT_ITERATORS_COUNT(Z_ARRVAL_P(stack)));
			HT_SET_ITERATORS_COUNT(Z_ARRVAL_P(stack), 0);
		}

		/* replace HashTable data */
		Z_ARRVAL_P(stack)->pDestructor = NULL;
		zend_hash_destroy(Z_ARRVAL_P(stack));

		HT_FLAGS(Z_ARRVAL_P(stack))          = HT_FLAGS(&new_hash);
		Z_ARRVAL_P(stack)->nTableSize        = new_hash.nTableSize;
		Z_ARRVAL_P(stack)->nTableMask        = new_hash.nTableMask;
		Z_ARRVAL_P(stack)->nNumUsed          = new_hash.nNumUsed;
		Z_ARRVAL_P(stack)->nNumOfElements    = new_hash.nNumOfElements;
		Z_ARRVAL_P(stack)->nNextFreeElement  = new_hash.nNextFreeElement;
		Z_ARRVAL_P(stack)->arData            = new_hash.arData;
		Z_ARRVAL_P(stack)->pDestructor       = new_hash.pDestructor;

		zend_hash_internal_pointer_reset(Z_ARRVAL_P(stack));

		/* Clean up and return the number of elements in the stack */
		RETVAL_LONG(zend_hash_num_elements(Z_ARRVAL_P(stack)));
	}
}
/* }}} */

/* {{{ Removes the elements designated by offset and length and replace them with supplied array */

/* ===== array_splice_alpha (array.c 6037-6099) ===== */

PHP_FUNCTION(array_splice_alpha)
{
	zval *array,				/* Input array */
		 *repl_array = NULL;	/* Replacement array */
	HashTable  *rem_hash = NULL;
	zend_long offset,
			length = 0;
	bool length_is_null = 1;
	int		num_in;				/* Number of elements in the input array */

	ZEND_PARSE_PARAMETERS_START(2, 4)
		Z_PARAM_ARRAY_EX(array, 0, 1)
		Z_PARAM_LONG(offset)
		Z_PARAM_OPTIONAL
		Z_PARAM_LONG_OR_NULL(length, length_is_null)
		Z_PARAM_ZVAL(repl_array)
	ZEND_PARSE_PARAMETERS_END();

	num_in = zend_hash_num_elements(Z_ARRVAL_P(array));

	if (length_is_null) {
		length = num_in;
	}

	if (ZEND_NUM_ARGS() == 4) {
		/* Make sure the last argument, if passed, is an array */
		convert_to_array(repl_array);
	}

	/* Don't create the array of removed elements if it's not going
	 * to be used; e.g. only removing and/or replacing elements */
	if (USED_RET()) {
		zend_long size = length;

		/* Clamp the offset.. */
		if (offset > num_in) {
			offset = num_in;
		} else if (offset < 0 && (offset = (num_in + offset)) < 0) {
			offset = 0;
		}

		/* ..and the length */
		if (length < 0) {
			size = num_in - offset + length;
		} else if (((zend_ulong) offset + (zend_ulong) length) > (uint32_t) num_in) {
			size = num_in - offset;
		}

		/* Initialize return value */
		array_init_size(return_value, size > 0 ? (uint32_t)size : 0);
		rem_hash = Z_ARRVAL_P(return_value);
	} else {
		/* The return value will not be used, but make sure it still has the correct type. */
		RETVAL_EMPTY_ARRAY();
	}

	/* Perform splice */
	php_splice_alpha(Z_ARRVAL_P(array), offset, length, repl_array ? Z_ARRVAL_P(repl_array) : NULL, rem_hash);
}
/* }}} */

/* {{{ find_bucket_at_offset(HashTable* ht, zend_long offset)
   Finds the bucket at the given valid offset */

/* ===== find_bucket_at_offset (array.c 6100-6125) ===== */

static inline Bucket* find_bucket_at_offset(HashTable* ht, zend_long offset)
{
	zend_long pos;
	Bucket *bucket;
	ZEND_ASSERT(offset >= 0 && offset <= ht->nNumOfElements);
	if (HT_IS_WITHOUT_HOLES(ht)) {
		/* There's no need to iterate over the array to filter out holes if there are no holes */
		return ht->arData + offset;
	}
	/* Otherwise, this code has to iterate over the HashTable and skip holes in the array. */
	pos = 0;
	ZEND_HASH_MAP_FOREACH_BUCKET(ht, bucket) {
		if (pos >= offset) {
			/* This is the bucket of the array element at the requested offset */
			return bucket;
		}
		++pos;
	} ZEND_HASH_FOREACH_END();

	/* Return a pointer to the end of the bucket array. */
	return ht->arData + ht->nNumUsed;
}
/* }}} */

/* {{{ find_bucket_at_offset(HashTable* ht, zend_long offset)
   Finds the bucket at the given valid offset */

/* ===== find_packed_val_at_offset (array.c 6126-6150) ===== */

static inline zval* find_packed_val_at_offset(HashTable* ht, zend_long offset)
{
	zend_long pos;
	zval *zv;
	ZEND_ASSERT(offset >= 0 && offset <= ht->nNumOfElements);
	if (HT_IS_WITHOUT_HOLES(ht)) {
		/* There's no need to iterate over the array to filter out holes if there are no holes */
		return ht->arPacked + offset;
	}
	/* Otherwise, this code has to iterate over the HashTable and skip holes in the array. */
	pos = 0;
	ZEND_HASH_PACKED_FOREACH_VAL(ht, zv) {
		if (pos >= offset) {
			/* This is the bucket of the array element at the requested offset */
			return zv;
		}
		++pos;
	} ZEND_HASH_FOREACH_END();

	/* Return a pointer to the end of the bucket array. */
	return ht->arPacked + ht->nNumUsed;
}
/* }}} */

/* {{{ Returns elements specified by offset and length */

/* ===== array_slice_alpha (array.c 6284-6446) ===== */

PHP_FUNCTION(array_slice_alpha)
{
	zval *input;                  /* Input array */
	zval *entry;                  /* An array entry */
	zend_long offset;             /* Offset to get elements from */
	zend_long length = 0;         /* How many elements to get */
	bool length_is_null = 1; /* Whether an explicit length has been omitted */
	bool preserve_keys = 0;  /* Whether to preserve keys while copying to the new array */
	uint32_t num_in;              /* Number of elements in the input array */
	zend_string *string_key;
	zend_ulong num_key;

	ZEND_PARSE_PARAMETERS_START(2, 4)
		Z_PARAM_ARRAY(input)
		Z_PARAM_LONG(offset)
		Z_PARAM_OPTIONAL
		Z_PARAM_LONG_OR_NULL(length, length_is_null)
		Z_PARAM_BOOL(preserve_keys)
	ZEND_PARSE_PARAMETERS_END();

	/* Get number of entries in the input hash */
	num_in = zend_hash_num_elements(Z_ARRVAL_P(input));

	/* We want all entries from offset to the end if length is not passed or is null */
	if (length_is_null) {
		length = num_in;
	}

	/* Clamp the offset.. */
	if (offset > (zend_long) num_in) {
		RETURN_EMPTY_ARRAY();
	} else if (offset < 0 && (offset = (num_in + offset)) < 0) {
		offset = 0;
	}

	/* ..and the length */
	if (length < 0) {
		length = num_in - offset + length;
	} else if (((zend_ulong) offset + (zend_ulong) length) > (unsigned) num_in) {
		length = num_in - offset;
	}

	if (length <= 0) {
		RETURN_EMPTY_ARRAY();
	}

	/* Initialize returned array */
	array_init_size(return_value, (uint32_t)length);

	{
		HashTable *ht = Z_ARRVAL_P(input);

		/* Fast path: a dense packed list sliced without preserving keys.
		 * HT_IS_WITHOUT_HOLES guarantees the live run is contiguous from
		 * index 0, and offset/length are already clamped to a valid
		 * [offset, offset+length) range, so the source range is a straight
		 * contiguous run of live zvals. That lets us drop the per-element
		 * IS_UNDEF skip and the per-element length guard that the generic
		 * FILL_PACKED loop carries, and bypass the ZEND_HASH_FILL_PACKED
		 * macro in favor of a tight ZVAL_COPY_VALUE loop (same shape as
		 * array_fill_alpha / array_chunk_alpha). The refcount==1 ref-unwrap
		 * is preserved exactly as in array_slice(). */
		if (!preserve_keys && HT_IS_PACKED(ht) && HT_IS_WITHOUT_HOLES(ht)) {
			HashTable *out = Z_ARRVAL_P(return_value);
			zend_hash_real_init_packed(out);
			out->nNumUsed = (uint32_t)length;
			out->nNumOfElements = (uint32_t)length;
			out->nNextFreeElement = (zend_long)length;
			out->nInternalPointer = 0;

			zval *src = ht->arPacked + (uint32_t)offset;
			zval *dst = out->arPacked;
			uint32_t i;

			for (i = 0; i < (uint32_t)length; i++) {
				entry = src + i;
				if (UNEXPECTED(Z_ISREF_P(entry)) &&
					UNEXPECTED(Z_REFCOUNT_P(entry) == 1)) {
					entry = Z_REFVAL_P(entry);
				}
				Z_TRY_ADDREF_P(entry);
				ZVAL_COPY_VALUE(dst + i, entry);
			}
			return;
		}

		/* Generic fallback: identical to the original array_slice() loop.
		 * Holey packed inputs, preserve_keys=true, and mixed/hash inputs
		 * cannot use a fixed-trip contiguous copy, so they keep the
		 * per-element IS_UNDEF skip and length guard. */
		if (HT_IS_PACKED(ht)) {
			zval *zv = find_packed_val_at_offset(ht, offset);
			zval *end = ht->arPacked + ht->nNumUsed;

			if (!preserve_keys
			 || (offset == 0 && HT_IS_WITHOUT_HOLES(ht))) {
				zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
				ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
					for (; zv != end; zv++) {
						if (__fill_idx >= length) {
							break;
						}
						if (UNEXPECTED(Z_TYPE_P(zv) == IS_UNDEF)) {
							continue;
						}
						entry = zv;
						if (UNEXPECTED(Z_ISREF_P(entry)) &&
							UNEXPECTED(Z_REFCOUNT_P(entry) == 1)) {
							entry = Z_REFVAL_P(entry);
						}
						Z_TRY_ADDREF_P(entry);
						ZEND_HASH_FILL_ADD(entry);
					}
				} ZEND_HASH_FILL_END();
			} else {
				zend_long n = 0;  /* Current number of elements */
				zend_long idx = zv - ht->arPacked;

				for (; zv != end; zv++, idx++) {
					if (UNEXPECTED(Z_TYPE_P(zv) == IS_UNDEF)) {
						continue;
					}
					if (n >= length) {
						break;
					}
					n++;
					entry = zend_hash_index_add_new(Z_ARRVAL_P(return_value), idx, zv);
					zval_add_ref(entry);
				}
			}
		} else {
			zend_long n = 0;  /* Current number of elements */
			Bucket *p = find_bucket_at_offset(ht, offset);
			Bucket *end = ht->arData + ht->nNumUsed;

			for (; p != end; p++) {
				entry = &p->val;
				if (UNEXPECTED(Z_TYPE_P(entry) == IS_UNDEF)) {
					continue;
				}
				if (n >= length) {
					break;
				}
				n++;
				num_key = p->h;
				string_key = p->key;

				if (string_key) {
					entry = zend_hash_add_new(Z_ARRVAL_P(return_value), string_key, entry);
				} else {
					if (preserve_keys) {
						entry = zend_hash_index_add_new(Z_ARRVAL_P(return_value), num_key, entry);
					} else {
						entry = zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), entry);
					}
				}
				zval_add_ref(entry);
			}
		}
	}
}
/* }}} */


/* ===== php_array_merge_recursive_alpha (array.c 6548-6637) ===== */

static int php_array_merge_recursive_alpha(HashTable *dest, HashTable *src) /* {{{ */
{
	zval *src_entry, *dest_entry;
	zend_string *string_key;

	if (HT_IS_PACKED(dest) && HT_IS_PACKED(src)
			&& HT_IS_WITHOUT_HOLES(dest) && dest != src) {
		zend_hash_extend(dest,
			zend_hash_num_elements(dest) + zend_hash_num_elements(src), 1);
		ZEND_HASH_FILL_PACKED(dest) {
			ZEND_HASH_PACKED_FOREACH_VAL(src, src_entry) {
				Z_TRY_ADDREF_P(src_entry);
				ZEND_HASH_FILL_ADD(src_entry);
			} ZEND_HASH_FOREACH_END();
		} ZEND_HASH_FILL_END();
		return 1;
	}

	ZEND_HASH_FOREACH_STR_KEY_VAL(src, string_key, src_entry) {
		if (string_key) {
			if ((dest_entry = zend_hash_find_known_hash(dest, string_key)) != NULL) {
				zval *src_zval = src_entry;
				zval *dest_zval = dest_entry;
				HashTable *thash;
				zval tmp;
				int ret;

				ZVAL_DEREF(src_zval);
				ZVAL_DEREF(dest_zval);
				thash = Z_TYPE_P(dest_zval) == IS_ARRAY ? Z_ARRVAL_P(dest_zval) : NULL;
				if ((thash && GC_IS_RECURSIVE(thash)) || (src_entry == dest_entry && Z_ISREF_P(dest_entry) && (Z_REFCOUNT_P(dest_entry) % 2))) {
					zend_throw_error(NULL, "Recursion detected");
					return 0;
				}

				ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1);
				dest_zval = dest_entry;

				if (Z_TYPE_P(dest_zval) == IS_NULL) {
					convert_to_array(dest_zval);
					add_next_index_null(dest_zval);
				} else {
					convert_to_array(dest_zval);
				}
				SEPARATE_ZVAL(dest_zval);

				ZVAL_UNDEF(&tmp);
				if (Z_TYPE_P(src_zval) == IS_OBJECT) {
					ZVAL_COPY(&tmp, src_zval);
					convert_to_array(&tmp);
					src_zval = &tmp;
				}
				if (Z_TYPE_P(src_zval) == IS_ARRAY) {
					if (thash) {
						GC_TRY_PROTECT_RECURSION(thash);
					}
					ret = php_array_merge_recursive_alpha(Z_ARRVAL_P(dest_zval), Z_ARRVAL_P(src_zval));
					if (thash) {
						GC_TRY_UNPROTECT_RECURSION(thash);
					}
					if (!ret) {
						return 0;
					}
				} else {
					Z_TRY_ADDREF_P(src_zval);
					zval *zv = zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval);
					if (EXPECTED(!zv)) {
						Z_TRY_DELREF_P(src_zval);
						zend_cannot_add_element();
						return 0;
					}
				}
				zval_ptr_dtor(&tmp);
			} else {
				zval *zv = zend_hash_add_new(dest, string_key, src_entry);
				zval_add_ref(zv);
			}
		} else {
			zval *zv = zend_hash_next_index_insert(dest, src_entry);
			if (UNEXPECTED(!zv)) {
				zend_cannot_add_element();
				return 0;
			}
			zval_add_ref(zv);
		}
	} ZEND_HASH_FOREACH_END();
	return 1;
}
/* }}} */


/* ===== php_array_replace_recursive_alpha (array.c 6778-6930) ===== */

static int php_array_replace_recursive_alpha(HashTable *dest, HashTable *src) /* {{{ */
{
	zval *src_entry, *dest_entry, *src_zval, *dest_zval;
	zend_string *string_key;
	zend_ulong num_key;
	int ret;

	if (HT_IS_PACKED(dest) && HT_IS_WITHOUT_HOLES(dest)
			&& HT_IS_PACKED(src) && HT_IS_WITHOUT_HOLES(src)
			&& dest != src) {
		zval *d;
		const zval *s;
		uint32_t dn = dest->nNumUsed;
		uint32_t sn = src->nNumUsed;
		uint32_t p;

		/* Reserve the actual growth bound: overwrites keep dn, appends grow to
		 * sn, so max(dn, sn) is the final size.  When sn <= dn this is <= the
		 * current capacity and the extend is a no-op (no rehash of a dest that
		 * never grows); when sn > dn it is the single realloc the append tail
		 * needs.  Capture the arPacked base pointers AFTER the extend:
		 * zend_hash_extend may perealloc dest->arPacked to a new address, so a
		 * pointer captured before it would dangle (array_merge_recursive_alpha
		 * sidesteps this by using ZEND_HASH_FILL_PACKED, which re-reads
		 * arPacked internally; this loop hand-indexes arPacked, so it must read
		 * the post-extend address).  src is never realloc'd here, but reading
		 * it after the extend is free and keeps the two symmetric. */
		zend_hash_extend(dest, sn > dn ? sn : dn, 1);
		d = dest->arPacked;
		s = src->arPacked;

		for (p = 0; p < sn; p++) {
			if (p < dn) {
				src_entry = (zval *) &s[p];
				dest_entry = &d[p];
				src_zval = src_entry;
				dest_zval = dest_entry;
				ZVAL_DEREF(src_zval);
				ZVAL_DEREF(dest_zval);
				if (Z_TYPE_P(src_zval) != IS_ARRAY ||
					(Z_TYPE_P(dest_entry) != IS_ARRAY &&
					 (!Z_ISREF_P(dest_entry) || Z_TYPE_P(Z_REFVAL_P(dest_entry)) != IS_ARRAY))) {

					zval_ptr_dtor(&d[p]);
					ZVAL_COPY(&d[p], src_entry);
					continue;
				}

				if (Z_IS_RECURSIVE_P(dest_zval) ||
					Z_IS_RECURSIVE_P(src_zval) ||
					(Z_ISREF_P(src_entry) && Z_ISREF_P(dest_entry) && Z_REF_P(src_entry) == Z_REF_P(dest_entry) && (Z_REFCOUNT_P(dest_entry) % 2))) {
					zend_throw_error(NULL, "Recursion detected");
					return 0;
				}

				ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1);
				SEPARATE_ZVAL(dest_entry);
				dest_zval = dest_entry;

				if (Z_REFCOUNTED_P(dest_zval)) {
					Z_PROTECT_RECURSION_P(dest_zval);
				}
				if (Z_REFCOUNTED_P(src_zval)) {
					Z_PROTECT_RECURSION_P(src_zval);
				}

				ret = php_array_replace_recursive_alpha(Z_ARRVAL_P(dest_zval), Z_ARRVAL_P(src_zval));

				if (Z_REFCOUNTED_P(dest_zval)) {
					Z_UNPROTECT_RECURSION_P(dest_zval);
				}
				if (Z_REFCOUNTED_P(src_zval)) {
					Z_UNPROTECT_RECURSION_P(src_zval);
				}

				if (!ret) {
					return 0;
				}
			} else {
				/* append tail: p >= dn, pure append at nNextFreeElement */
				ZVAL_COPY(&d[dest->nNumUsed], &s[p]);
				dest->nNumUsed++;
				dest->nNumOfElements++;
				dest->nNextFreeElement++;
			}
		}

		return 1;
	}

	ZEND_HASH_FOREACH_KEY_VAL(src, num_key, string_key, src_entry) {
		src_zval = src_entry;
		ZVAL_DEREF(src_zval);
		if (string_key) {
			if (Z_TYPE_P(src_zval) != IS_ARRAY ||
				(dest_entry = zend_hash_find_known_hash(dest, string_key)) == NULL ||
				(Z_TYPE_P(dest_entry) != IS_ARRAY &&
				 (!Z_ISREF_P(dest_entry) || Z_TYPE_P(Z_REFVAL_P(dest_entry)) != IS_ARRAY))) {

				zval *zv = zend_hash_update(dest, string_key, src_entry);
				zval_add_ref(zv);
				continue;
			}
		} else {
			if (Z_TYPE_P(src_zval) != IS_ARRAY ||
				(dest_entry = zend_hash_index_find(dest, num_key)) == NULL ||
				(Z_TYPE_P(dest_entry) != IS_ARRAY &&
				 (!Z_ISREF_P(dest_entry) || Z_TYPE_P(Z_REFVAL_P(dest_entry)) != IS_ARRAY))) {

				zval *zv = zend_hash_index_update(dest, num_key, src_entry);
				zval_add_ref(zv);
				continue;
			}
		}

		dest_zval = dest_entry;
		ZVAL_DEREF(dest_zval);
		if (Z_IS_RECURSIVE_P(dest_zval) ||
			Z_IS_RECURSIVE_P(src_zval) ||
			(Z_ISREF_P(src_entry) && Z_ISREF_P(dest_entry) && Z_REF_P(src_entry) == Z_REF_P(dest_entry) && (Z_REFCOUNT_P(dest_entry) % 2))) {
			zend_throw_error(NULL, "Recursion detected");
			return 0;
		}

		ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1);
		SEPARATE_ZVAL(dest_entry);
		dest_zval = dest_entry;

		if (Z_REFCOUNTED_P(dest_zval)) {
			Z_PROTECT_RECURSION_P(dest_zval);
		}
		if (Z_REFCOUNTED_P(src_zval)) {
			Z_PROTECT_RECURSION_P(src_zval);
		}

		ret = php_array_replace_recursive_alpha(Z_ARRVAL_P(dest_zval), Z_ARRVAL_P(src_zval));

		if (Z_REFCOUNTED_P(dest_zval)) {
			Z_UNPROTECT_RECURSION_P(dest_zval);
		}
		if (Z_REFCOUNTED_P(src_zval)) {
			Z_UNPROTECT_RECURSION_P(src_zval);
		}

		if (!ret) {
			return 0;
		}
	} ZEND_HASH_FOREACH_END();

	return 1;
}
/* }}} */


/* ===== php_array_replace_alpha (array.c 7010-7095) ===== */

static zend_always_inline void php_array_replace_alpha(INTERNAL_FUNCTION_PARAMETERS) /* {{{ */
{
	zval *args = NULL;
	zval *arg;
	uint32_t argc, i;
	HashTable *dest;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();


	for (i = 0; i < argc; i++) {
		zval *arg = args + i;

		if (Z_TYPE_P(arg) != IS_ARRAY) {
			zend_wrong_parameter_type_error(i + 1, Z_EXPECTED_ARRAY, arg);
			RETURN_THROWS();
		}
	}

	/* copy first array if necessary */
	arg = args;
	bool in_place = zend_may_modify_arg_in_place(arg);
	if (in_place) {
		dest = Z_ARRVAL_P(arg);
	} else {
		dest = zend_array_dup(Z_ARRVAL_P(arg));
	}

	ZVAL_ARR(return_value, dest);

	for (i = 1; i < argc; i++) {
		HashTable *src;

		arg = args + i;
		src = Z_ARRVAL_P(arg);

		/* Packed-vector overwrite fast path: both vectors contiguous and the
		 * replacement no larger than the base.  See the block comment above
		 * for the equivalence argument.  HT_IS_WITHOUT_HOLES guarantees no
		 * IS_UNDEF slots in 0..nNumUsed-1, so the loop needs no UNDEF skip. */
		if (HT_IS_PACKED(dest)
		 && HT_IS_WITHOUT_HOLES(dest)
		 && HT_IS_PACKED(src)
		 && HT_IS_WITHOUT_HOLES(src)
		 && src->nNumUsed <= dest->nNumUsed) {
			zval *d = dest->arPacked;
			const zval *s = src->arPacked;
			uint32_t n = src->nNumUsed;
			uint32_t j;

			for (j = 0; j < n; j++) {
				zval_ptr_dtor(d + j);
				ZVAL_COPY(d + j, s + j);
			}
		} else {
			zend_hash_merge(dest, src, zval_add_ref, 1);
		}
	}

	if (in_place) {
		GC_ADDREF(dest);
	}
}
/* }}} */

/* _alpha sibling of php_array_replace_wrapper (recursive path only): drives
 * array_replace_recursive_alpha.  The first-array copy/reuse is identical to
 * the baseline (zend_may_modify_arg_in_place -> reuse, else zend_array_dup);
 * array_replace never renumbers keys, so -- unlike array_merge_recursive --
 * there is no copy-walk to remove.  The per-source loop calls the helper
 * php_array_replace_recursive_alpha(dest, src), which carries the packed
 * overwrite/recurse/append fast path and its own per-source capacity sizing.
 *
 * Unlike array_merge_recursive_alpha, this wrapper does NOT pre-extend dest to
 * the total element count.  array_replace overwrites existing keys, so dest
 * grows only by the number of NEW keys a source brings -- which may be zero
 * (full overlap).  A total-count pre-extend would therefore rehash a dest that
 * never grows: measured as a ~7% regression on the string-keys-only overwrite
 * control, because zend_hash_extend() past the current nTableSize reallocates
 * and re-hashes every live bucket even when no element is ever added.  The
 * baseline grows dest incrementally only as new keys actually arrive, so the
 * no-pre-extend path is strictly <= the baseline's realloc count and never
 * rehashes a no-growth dest.  The original php_array_replace_wrapper and its
 * callers (array_replace, array_replace_recursive) stay untouched. */

/* ===== php_array_replace_recursive_alpha_wrapper (array.c 7096-7138) ===== */

static zend_always_inline void php_array_replace_recursive_alpha_wrapper(INTERNAL_FUNCTION_PARAMETERS) /* {{{ */
{
	zval *args = NULL;
	zval *arg;
	uint32_t argc, i;
	HashTable *dest;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();


	for (i = 0; i < argc; i++) {
		zval *arg = args + i;

		if (Z_TYPE_P(arg) != IS_ARRAY) {
			zend_wrong_parameter_type_error(i + 1, Z_EXPECTED_ARRAY, arg);
			RETURN_THROWS();
		}
	}

	/* copy first array if necessary */
	arg = args;
	bool in_place = zend_may_modify_arg_in_place(arg);
	if (in_place) {
		dest = Z_ARRVAL_P(arg);
	} else {
		dest = zend_array_dup(Z_ARRVAL_P(arg));
	}

	ZVAL_ARR(return_value, dest);

	for (i = 1; i < argc; i++) {
		arg = args + i;
		php_array_replace_recursive_alpha(dest, Z_ARRVAL_P(arg));
	}

	if (in_place) {
		GC_ADDREF(dest);
	}
}
/* }}} */


/* ===== php_array_merge_alpha (array.c 7313-7512) ===== */

static zend_always_inline void php_array_merge_alpha(INTERNAL_FUNCTION_PARAMETERS) /* {{{ */
{
	zval *args = NULL;
	zval *arg;
	uint32_t argc, i;
	zval *src_entry;
	HashTable *src, *dest;
	uint64_t count = 0;
	bool in_place = false;

	ZEND_PARSE_PARAMETERS_START(0, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	if (argc == 0) {
		RETURN_EMPTY_ARRAY();
	}

	for (i = 0; i < argc; i++) {
		zval *arg = args + i;

		if (Z_TYPE_P(arg) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(arg));
			RETURN_THROWS();
		}
		count += zend_hash_num_elements(Z_ARRVAL_P(arg));
	}

	if (UNEXPECTED(count >= HT_MAX_SIZE)) {
		zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE);
		RETURN_THROWS();
	}

	if (argc == 2) {
		zval *ret = NULL;

		if (zend_hash_num_elements(Z_ARRVAL(args[0])) == 0) {
			ret = &args[1];
		} else if (zend_hash_num_elements(Z_ARRVAL(args[1])) == 0) {
			ret = &args[0];
		}
		if (ret) {
			if (HT_IS_PACKED(Z_ARRVAL_P(ret))) {
				if (HT_IS_WITHOUT_HOLES(Z_ARRVAL_P(ret))) {
					RETURN_COPY(ret);
				}
			} else {
				bool copy = true;
				zend_string *string_key;

				ZEND_HASH_MAP_FOREACH_STR_KEY(Z_ARRVAL_P(ret), string_key) {
					if (!string_key) {
						copy = false;
						break;
					}
				} ZEND_HASH_FOREACH_END();
				if (copy) {
					RETURN_COPY(ret);
				}
			}
		}
	}

	arg = args;
	src  = Z_ARRVAL_P(arg);
	/* copy first array if necessary */
	if (HT_IS_PACKED(src)) {
		/* Gap 1: reuse the first packed array in place (as the baseline does)
		 * but pre-extend it to the total count once, so the per-source
		 * zend_hash_extend() calls inside php_array_merge become no-ops. */
		if (HT_IS_WITHOUT_HOLES(src) && zend_may_modify_arg_in_place(arg)) {
			dest = src;
			in_place = true;
			RETVAL_ARR(dest);
			zend_hash_extend(dest, (uint32_t) count, 1);
		} else {
			array_init_size(return_value, count);
			dest = Z_ARRVAL_P(return_value);

			zend_hash_real_init_packed(dest);
			ZEND_HASH_FILL_PACKED(dest) {
				ZEND_HASH_PACKED_FOREACH_VAL(src, src_entry) {
					if (UNEXPECTED(Z_ISREF_P(src_entry) &&
						Z_REFCOUNT_P(src_entry) == 1)) {
						src_entry = Z_REFVAL_P(src_entry);
					}
					Z_TRY_ADDREF_P(src_entry);
					ZEND_HASH_FILL_ADD(src_entry);
				} ZEND_HASH_FOREACH_END();
			} ZEND_HASH_FILL_END();
		}
	} else {
		/* Gap 2: a hash first array whose keys are all strings can be reused
		 * in place, because array_merge never renumbers string keys.  The
		 * all-string-keys pre-scan is only worth running when reuse is even
		 * possible -- i.e. the array is exclusively owned -- so it is gated
		 * behind zend_may_modify_arg_in_place().  A shared/immutable hash first
		 * array skips the scan entirely and takes the baseline copy path
		 * verbatim, avoiding an O(n) scan the baseline does not pay.  If reuse
		 * is possible but any integer key is found (b[j].key == NULL), fall
		 * back to the copy path, which renumbers integer keys to 0, 1, 2, ... */
		if (zend_may_modify_arg_in_place(arg)) {
			bool all_string_keys = true;
			{
				Bucket *b = src->arData;
				uint32_t j, n = src->nNumUsed;
				for (j = 0; j < n; j++) {
					if (UNEXPECTED(Z_TYPE(b[j].val) == IS_UNDEF)) {
						continue;
					}
					if (!b[j].key) {
						all_string_keys = false;
						break;
					}
				}
			}
			if (all_string_keys) {
				dest = src;
				in_place = true;
				RETVAL_ARR(dest);
				zend_hash_extend(dest, (uint32_t) count, 0);
				goto merge_sources;
			}
		}
		{
			array_init_size(return_value, count);
			dest = Z_ARRVAL_P(return_value);

			zend_string *string_key;
			zend_hash_real_init_mixed(dest);
			ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(src, string_key, src_entry) {
				if (UNEXPECTED(Z_ISREF_P(src_entry) &&
					Z_REFCOUNT_P(src_entry) == 1)) {
					src_entry = Z_REFVAL_P(src_entry);
				}
				Z_TRY_ADDREF_P(src_entry);
				if (EXPECTED(string_key)) {
					_zend_hash_append(dest, string_key, src_entry);
				} else {
					zend_hash_next_index_insert_new(dest, src_entry);
				}
			} ZEND_HASH_FOREACH_END();
		}
	}

merge_sources:
	for (i = 1; i < argc; i++) {
		arg = args + i;
		php_array_merge(dest, Z_ARRVAL_P(arg));
	}

	if (in_place) {
		GC_ADDREF(dest);
	}
}
/* }}} */

/* _alpha sibling of php_array_merge_wrapper (recursive == 1 path only):
 * carries the Gap 1 and Gap 2 in-place reuse fast paths the baseline recursive
 * wrapper does not exploit.  Only array_merge_recursive_alpha calls this; the
 * original php_array_merge_wrapper and its callers (array_merge,
 * array_merge_recursive) stay untouched.
 *
 * The baseline recursive wrapper handles the first array exactly like the
 * non-recursive one: a packed first array is reused in place (when without
 * holes and exclusively owned) but left sized for the first array alone, and a
 * hash first array is always copied.  For the recursive path the per-source
 * work goes through php_array_merge_recursive, whose integer-key branch is a
 * per-element zend_hash_next_index_insert() with no zend_hash_extend(), so an
 * under-sized in-place packed dest pays incremental packed_grow reallocations
 * per source -- the same cost the non-recursive alpha's Gap 1 removes.
 *
 * Gap 1 (packed first array): reuse in place and pre-extend once with
 * zend_hash_extend(dest, count, 1).  count already passed the < HT_MAX_SIZE
 * check; zend_hash_extend touches only capacity, so the result is identical,
 * and the per-source zend_hash_extend() inside the Gap 3 bulk path of
 * php_array_merge_recursive_alpha becomes a no-op (the fallback integer-key
 * branch also stops growing).
 *
 * Gap 2 (hash first array, all string keys): array_merge_recursive only
 * renumbers integer keys; string keys are appended/merged verbatim.  So a hash
 * first array whose keys are all strings can be reused in place with no
 * semantic change, and the addref + _zend_hash_append copy walk is redundant.
 * Pre-scan src->arData[0..nNumUsed-1] (skipping IS_UNDEF holes); reuse iff
 * every live bucket has a non-NULL key, then pre-extend once with
 * zend_hash_extend(dest, count, 0).  Subsequent string-key collisions mutate
 * dest in place, which is permitted exactly when zend_may_modify_arg_in_place
 * holds; SEPARATE_ZVAL on a colliding value still copies a shared (refcount>1)
 * element before mutating it.  A hash first array with any integer key (e.g.
 * [5 => 'a', 10 => 'b']) falls back to the copy path, which renumbers those
 * keys to 0, 1, 2, ...
 *
 * Every other case (packed first array with holes, shared/immutable first
 * array, integer-keyed hash first array) takes the baseline copy path
 * verbatim.  The per-source loop calls the untouched helper
 * php_array_merge_recursive_alpha(dest, src).  The reference-deref discipline
 * (Z_ISREF_P && Z_REFCOUNT_P == 1 -> Z_REFVAL_P) lives inside the copy
 * fallbacks; the in-place paths do no copy, so they inherit the source's
 * references unchanged.  End with if (in_place) GC_ADDREF(dest) as the
 * baseline does. */

/* ===== php_array_merge_recursive_alpha_wrapper (array.c 7513-7672) ===== */

static zend_always_inline void php_array_merge_recursive_alpha_wrapper(INTERNAL_FUNCTION_PARAMETERS) /* {{{ */
{
	zval *args = NULL;
	zval *arg;
	uint32_t argc, i;
	zval *src_entry;
	HashTable *src, *dest;
	uint64_t count = 0;
	bool in_place = false;

	ZEND_PARSE_PARAMETERS_START(0, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	if (argc == 0) {
		RETURN_EMPTY_ARRAY();
	}

	for (i = 0; i < argc; i++) {
		zval *arg = args + i;

		if (Z_TYPE_P(arg) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(arg));
			RETURN_THROWS();
		}
		count += zend_hash_num_elements(Z_ARRVAL_P(arg));
	}

	if (UNEXPECTED(count >= HT_MAX_SIZE)) {
		zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE);
		RETURN_THROWS();
	}

	if (argc == 2) {
		zval *ret = NULL;

		if (zend_hash_num_elements(Z_ARRVAL(args[0])) == 0) {
			ret = &args[1];
		} else if (zend_hash_num_elements(Z_ARRVAL(args[1])) == 0) {
			ret = &args[0];
		}
		if (ret) {
			if (HT_IS_PACKED(Z_ARRVAL_P(ret))) {
				if (HT_IS_WITHOUT_HOLES(Z_ARRVAL_P(ret))) {
					RETURN_COPY(ret);
				}
			} else {
				bool copy = true;
				zend_string *string_key;

				ZEND_HASH_MAP_FOREACH_STR_KEY(Z_ARRVAL_P(ret), string_key) {
					if (!string_key) {
						copy = false;
						break;
					}
				} ZEND_HASH_FOREACH_END();
				if (copy) {
					RETURN_COPY(ret);
				}
			}
		}
	}

	arg = args;
	src  = Z_ARRVAL_P(arg);
	/* copy first array if necessary */
	if (HT_IS_PACKED(src)) {
		/* Gap 1: reuse the first packed array in place (as the baseline does)
		 * but pre-extend it to the total count once, so the per-source
		 * zend_hash_extend() inside php_array_merge_recursive_alpha's Gap 3
		 * bulk path is a no-op (and the fallback integer-key branch stops
		 * growing). */
		if (HT_IS_WITHOUT_HOLES(src) && zend_may_modify_arg_in_place(arg)) {
			dest = src;
			in_place = true;
			RETVAL_ARR(dest);
			zend_hash_extend(dest, (uint32_t) count, 1);
		} else {
			array_init_size(return_value, count);
			dest = Z_ARRVAL_P(return_value);

			zend_hash_real_init_packed(dest);
			ZEND_HASH_FILL_PACKED(dest) {
				ZEND_HASH_PACKED_FOREACH_VAL(src, src_entry) {
					if (UNEXPECTED(Z_ISREF_P(src_entry) &&
						Z_REFCOUNT_P(src_entry) == 1)) {
						src_entry = Z_REFVAL_P(src_entry);
					}
					Z_TRY_ADDREF_P(src_entry);
					ZEND_HASH_FILL_ADD(src_entry);
				} ZEND_HASH_FOREACH_END();
			} ZEND_HASH_FILL_END();
		}
	} else {
		/* Gap 2: a hash first array whose keys are all strings can be reused in
		 * place, because array_merge_recursive never renumbers string keys.
		 * The all-string-keys pre-scan is only worth running when reuse is even
		 * possible -- i.e. the array is exclusively owned -- so it is gated
		 * behind zend_may_modify_arg_in_place().  A shared/immutable hash first
		 * array skips the scan entirely and takes the baseline copy path
		 * verbatim, avoiding an O(n) scan the baseline does not pay.  If reuse
		 * is possible but any integer key is found (b[j].key == NULL), fall
		 * back to the copy path, which renumbers integer keys to 0, 1, 2, ... */
		if (zend_may_modify_arg_in_place(arg)) {
			bool all_string_keys = true;
			{
				Bucket *b = src->arData;
				uint32_t j, n = src->nNumUsed;
				for (j = 0; j < n; j++) {
					if (UNEXPECTED(Z_TYPE(b[j].val) == IS_UNDEF)) {
						continue;
					}
					if (!b[j].key) {
						all_string_keys = false;
						break;
					}
				}
			}
			if (all_string_keys) {
				dest = src;
				in_place = true;
				RETVAL_ARR(dest);
				zend_hash_extend(dest, (uint32_t) count, 0);
				goto recursive_merge_sources;
			}
		}
		{
			array_init_size(return_value, count);
			dest = Z_ARRVAL_P(return_value);

			zend_string *string_key;
			zend_hash_real_init_mixed(dest);
			ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(src, string_key, src_entry) {
				if (UNEXPECTED(Z_ISREF_P(src_entry) &&
					Z_REFCOUNT_P(src_entry) == 1)) {
					src_entry = Z_REFVAL_P(src_entry);
				}
				Z_TRY_ADDREF_P(src_entry);
				if (EXPECTED(string_key)) {
					_zend_hash_append(dest, string_key, src_entry);
				} else {
					zend_hash_next_index_insert_new(dest, src_entry);
				}
			} ZEND_HASH_FOREACH_END();
		}
	}

recursive_merge_sources:
	for (i = 1; i < argc; i++) {
		arg = args + i;
		php_array_merge_recursive_alpha(dest, Z_ARRVAL_P(arg));
	}

	if (in_place) {
		GC_ADDREF(dest);
	}
}
/* }}} */

/* {{{ Merges elements from passed arrays into one array */

/* ===== array_merge_alpha (array.c 7681-7688) ===== */

PHP_FUNCTION(array_merge_alpha)
{
	php_array_merge_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */
/* }}} */

/* {{{ Recursively merges elements from passed arrays into one array */

/* ===== array_merge_recursive_alpha (array.c 7701-7707) ===== */

PHP_FUNCTION(array_merge_recursive_alpha)
{
	php_array_merge_recursive_alpha_wrapper(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ Replaces elements from passed arrays into one array */

/* ===== array_replace_alpha (array.c 7716-7722) ===== */

PHP_FUNCTION(array_replace_alpha)
{
	php_array_replace_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ Recursively replaces elements from passed arrays into one array */

/* ===== array_replace_recursive_alpha (array.c 7732-7738) ===== */

PHP_FUNCTION(array_replace_recursive_alpha)
{
	php_array_replace_recursive_alpha_wrapper(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ Return just the keys from the input array, optionally only for the specified search_value */

/* ===== array_keys_alpha (array.c 7823-7989) ===== */

PHP_FUNCTION(array_keys_alpha)
{
	zval *input,				/* Input array */
	     *search_value = NULL,	/* Value to search for */
	     *entry,				/* An entry in the input array */
	       new_val;				/* New value */
	bool strict = 0;		/* do strict comparison */
	zend_ulong num_idx;
	zend_string *str_idx;
	zend_array *arrval;
	zend_ulong elem_count;

	ZEND_PARSE_PARAMETERS_START(1, 3)
		Z_PARAM_ARRAY(input)
		Z_PARAM_OPTIONAL
		Z_PARAM_ZVAL(search_value)
		Z_PARAM_BOOL(strict)
	ZEND_PARSE_PARAMETERS_END();
	arrval = Z_ARRVAL_P(input);
	elem_count = zend_hash_num_elements(arrval);

	/* Base case: empty input */
	if (!elem_count) {
		RETURN_COPY(input);
	}

	/* Initialize return array */
	if (search_value != NULL) {
		/* Fast path for the filter cases over a packed array.
		 *
		 * Packed arrays never carry string keys: the key of every live slot
		 * is its index i, so we walk arPacked directly and always emit the
		 * integer key i (no str_idx branch). IS_UNDEF slots are holes left by
		 * unset() and carry no key, so they are skipped.
		 *
		 * The strict case dereferences each entry via a local copy (NOT the
		 * loop pointer) before the type/value check: assigning by reference to
		 * a packed array leaves an IS_REFERENCE zval in arPacked, so a
		 * ref-wrapped entry must be dereferenced before the identity check.
		 * We must not ZVAL_DEREF(p) in place because p++ walks arPacked and an
		 * in-place deref would re-point p into the zend_reference storage.
		 *
		 * The non-strict case does not deref, matching the baseline non-strict
		 * filter path (fast_equal_check_* delegate to zend_compare() for
		 * non-matching types, which handles ref-wrapped scalars).
		 *
		 * The result is pre-sized to the match upper bound (elem_count) and
		 * initialized as packed, so zend_hash_next_index_insert_new never
		 * rehashes. The original array_keys() filter paths use unsized
		 * array_init and the generic ZEND_HASH_FOREACH loop; this fast path
		 * and the generic fallback below are otherwise identical to them. */
		if (HT_IS_PACKED(arrval)) {
			uint32_t i, n = arrval->nNumUsed;
			zval *p = arrval->arPacked;

			array_init_size(return_value, elem_count);
			zend_hash_real_init_packed(Z_ARRVAL_P(return_value));

			if (strict) {
				if (Z_TYPE_P(search_value) == IS_LONG) {
					zend_long needle_l = Z_LVAL_P(search_value);
					for (i = 0; i < n; i++, p++) {
						zval *v = (Z_TYPE_P(p) == IS_REFERENCE) ? Z_REFVAL_P(p) : p;
						if (Z_TYPE_P(v) == IS_UNDEF) continue;
						if (Z_TYPE_P(v) == IS_LONG && Z_LVAL_P(v) == needle_l) {
							ZVAL_LONG(&new_val, i);
							zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &new_val);
						}
					}
				} else {
					for (i = 0; i < n; i++, p++) {
						zval *v = (Z_TYPE_P(p) == IS_REFERENCE) ? Z_REFVAL_P(p) : p;
						if (Z_TYPE_P(v) == IS_UNDEF) continue;
						if (fast_is_identical_function(search_value, v)) {
							ZVAL_LONG(&new_val, i);
							zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &new_val);
						}
					}
				}
			} else {
				if (Z_TYPE_P(search_value) == IS_LONG) {
					for (i = 0; i < n; i++, p++) {
						if (Z_TYPE_P(p) == IS_UNDEF) continue;
						if (fast_equal_check_long(search_value, p)) {
							ZVAL_LONG(&new_val, i);
							zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &new_val);
						}
					}
				} else if (Z_TYPE_P(search_value) == IS_STRING) {
					for (i = 0; i < n; i++, p++) {
						if (Z_TYPE_P(p) == IS_UNDEF) continue;
						if (fast_equal_check_string(search_value, p)) {
							ZVAL_LONG(&new_val, i);
							zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &new_val);
						}
					}
				} else {
					for (i = 0; i < n; i++, p++) {
						if (Z_TYPE_P(p) == IS_UNDEF) continue;
						if (fast_equal_check_function(search_value, p)) {
							ZVAL_LONG(&new_val, i);
							zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &new_val);
						}
					}
				}
			}
			return;
		}

		/* Generic fallback for hash / non-packed inputs: identical to the
		 * baseline array_keys() filter paths. */
		array_init(return_value);

		if (strict) {
			ZEND_HASH_FOREACH_KEY_VAL(arrval, num_idx, str_idx, entry) {
				ZVAL_DEREF(entry);
				if (fast_is_identical_function(search_value, entry)) {
					if (str_idx) {
						ZVAL_STR_COPY(&new_val, str_idx);
					} else {
						ZVAL_LONG(&new_val, num_idx);
					}
					zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &new_val);
				}
			} ZEND_HASH_FOREACH_END();
		} else {
			ZEND_HASH_FOREACH_KEY_VAL(arrval, num_idx, str_idx, entry) {
				if (fast_equal_check_function(search_value, entry)) {
					if (str_idx) {
						ZVAL_STR_COPY(&new_val, str_idx);
					} else {
						ZVAL_LONG(&new_val, num_idx);
					}
					zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), &new_val);
				}
			} ZEND_HASH_FOREACH_END();
		}
	} else {
		/* No-filter path: identical to the baseline (already optimal). */
		array_init_size(return_value, elem_count);
		zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
			if (HT_IS_PACKED(arrval) && HT_IS_WITHOUT_HOLES(arrval)) {
				/* Optimistic case: range(0..n-1) for vector-like packed array */
				zend_ulong lval = 0;

				for (; lval < elem_count; ++lval) {
					ZEND_HASH_FILL_SET_LONG(lval);
					ZEND_HASH_FILL_NEXT();
				}
			} else {
				/* Go through input array and add keys to the return array */
				ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(input), num_idx, str_idx, entry) {
					if (str_idx) {
						ZEND_HASH_FILL_SET_STR_COPY(str_idx);
					} else {
						ZEND_HASH_FILL_SET_LONG(num_idx);
					}
					ZEND_HASH_FILL_NEXT();
				} ZEND_HASH_FOREACH_END();
			}
		} ZEND_HASH_FILL_END();
	}
}
/* }}} */

/* {{{ Get the key of the first element of the array */

/* ===== array_count_values_alpha (array.c 8144-8228) ===== */

PHP_FUNCTION(array_count_values_alpha)
{
	zval	*input,		/* Input array */
			*entry,		/* An entry in the input array */
			*tmp;
	HashTable *myht;

	ZEND_PARSE_PARAMETERS_START(1, 1)
		Z_PARAM_ARRAY(input)
	ZEND_PARSE_PARAMETERS_END();

	myht = Z_ARRVAL_P(input);

	if (HT_IS_PACKED(myht)) {
		uint32_t i, n = myht->nNumUsed;
		zval *e = myht->arPacked;

		/* Pre-size the result (capped) but leave it uninitialized: the first
		 * insert decides packed-vs-mixed at this capacity. Integer values init
		 * the result as a packed array (direct-index, no hashing) and keep it
		 * packed as long as only integer keys arrive; the first string value
		 * converts it to mixed (a single rehash). This matches the original's
		 * lazy init discipline while avoiding the early growth rehashes the
		 * original pays starting from size 8. Forcing mixed up front would
		 * penalize the common all-integer case, where the packed result is
		 * substantially faster than a hashed one. The cap bounds memory for
		 * huge low-cardinality inputs. */
		array_init_size(return_value, n < 8192 ? n : 8192);

		for (i = 0; i < n; i++, e++) {
			zval *v = (Z_TYPE_P(e) == IS_REFERENCE) ? Z_REFVAL_P(e) : e;
			if (Z_TYPE_P(v) == IS_UNDEF) {
				continue;
			}
			if (Z_TYPE_P(v) == IS_LONG) {
				if ((tmp = zend_hash_index_find(Z_ARRVAL_P(return_value), Z_LVAL_P(v))) == NULL) {
					zval data;
					ZVAL_LONG(&data, 1);
					zend_hash_index_add_new(Z_ARRVAL_P(return_value), Z_LVAL_P(v), &data);
				} else {
					Z_LVAL_P(tmp)++;
				}
			} else if (Z_TYPE_P(v) == IS_STRING) {
				if ((tmp = zend_symtable_find(Z_ARRVAL_P(return_value), Z_STR_P(v))) == NULL) {
					zval data;
					ZVAL_LONG(&data, 1);
					zend_symtable_add_new(Z_ARRVAL_P(return_value), Z_STR_P(v), &data);
				} else {
					Z_LVAL_P(tmp)++;
				}
			} else {
				php_error_docref(NULL, E_WARNING, "Can only count string and integer values, entry skipped");
			}
		}
		return;
	}

	/* Non-packed input: identical to array_count_values(). */
	array_init(return_value);

	ZEND_HASH_FOREACH_VAL(myht, entry) {
		ZVAL_DEREF(entry);
		if (Z_TYPE_P(entry) == IS_LONG) {
			if ((tmp = zend_hash_index_find(Z_ARRVAL_P(return_value), Z_LVAL_P(entry))) == NULL) {
				zval data;
				ZVAL_LONG(&data, 1);
				zend_hash_index_add_new(Z_ARRVAL_P(return_value), Z_LVAL_P(entry), &data);
			} else {
				Z_LVAL_P(tmp)++;
			}
		} else if (Z_TYPE_P(entry) == IS_STRING) {
			if ((tmp = zend_symtable_find(Z_ARRVAL_P(return_value), Z_STR_P(entry))) == NULL) {
				zval data;
				ZVAL_LONG(&data, 1);
				zend_symtable_add_new(Z_ARRVAL_P(return_value), Z_STR_P(entry), &data);
			} else {
				Z_LVAL_P(tmp)++;
			}
		} else {
			php_error_docref(NULL, E_WARNING, "Can only count string and integer values, entry skipped");
		}
	} ZEND_HASH_FOREACH_END();
}
/* }}} */


/* ===== array_column_fetch_prop (array.c 8229-8273) ===== */

static inline zval *array_column_fetch_prop(zval *data, zend_string *name_str, zend_long name_long, void **cache_slot, zval *rv) /* {{{ */
{
	zval *prop = NULL;

	if (Z_TYPE_P(data) == IS_OBJECT) {
		zend_string *tmp_str;
		/* If name is an integer convert integer to string */
		if (name_str == NULL) {
			tmp_str = zend_long_to_str(name_long);
		} else {
			tmp_str = zend_string_copy(name_str);
		}
		/* The has_property check is first performed in "exists" mode (which returns true for
		 * properties that are null but exist) and then in "has" mode to handle objects that
		 * implement __isset (which is not called in "exists" mode). */
		if (Z_OBJ_HANDLER_P(data, has_property)(Z_OBJ_P(data), tmp_str, ZEND_PROPERTY_EXISTS, cache_slot)
				|| Z_OBJ_HANDLER_P(data, has_property)(Z_OBJ_P(data), tmp_str, ZEND_PROPERTY_ISSET, cache_slot)) {
			prop = Z_OBJ_HANDLER_P(data, read_property)(Z_OBJ_P(data), tmp_str, BP_VAR_R, cache_slot, rv);
			if (prop) {
				ZVAL_DEREF(prop);
				if (prop != rv) {
					Z_TRY_ADDREF_P(prop);
				}
			}
		}
		zend_string_release(tmp_str);
	} else if (Z_TYPE_P(data) == IS_ARRAY) {
		/* Name is a string */
		if (name_str != NULL) {
			prop = zend_symtable_find(Z_ARRVAL_P(data), name_str);
		} else {
			prop = zend_hash_index_find(Z_ARRVAL_P(data), name_long);
		}
		if (prop) {
			ZVAL_DEREF(prop);
			Z_TRY_ADDREF_P(prop);
		}
	}

	return prop;
}
/* }}} */

/* {{{ Return the values from a single column in the input array, identified by the
   value_key and optionally indexed by the index_key */

/* ===== acol_kind_t_enum (array.c 8336-8344) ===== */

typedef enum {
	ACOL_NULL, /* column_is_null: the caller returns the whole row */
	ACOL_LONG, /* integer or numeric-string key: zend_hash_index_find */
	ACOL_STR   /* non-numeric string key: zend_hash_find */
} acol_kind_t;

/* Array-row fetch with the numeric-string classification hoisted out of the
 * loop. Refcount discipline matches array_column_fetch_prop(): the value is
 * addref'd on hit and the caller dtors it after use. */

/* ===== acol_fetch_array (array.c 8345-8366) ===== */

static inline zval *acol_fetch_array(zval *row, acol_kind_t kind,
		zend_long klong, zend_string *kstr) /* {{{ */
{
	zval *p;

	if (kind == ACOL_LONG) {
		p = zend_hash_index_find(Z_ARRVAL_P(row), klong);
	} else { /* ACOL_STR */
		p = zend_hash_find(Z_ARRVAL_P(row), kstr);
	}
	if (p) {
		ZVAL_DEREF(p);
		Z_TRY_ADDREF_P(p);
	}
	return p;
}
/* }}} */

/* Object-row fetch. Same logic as array_column_fetch_prop()'s IS_OBJECT branch
 * but takes the property-name string directly, so there is no per-element
 * zend_string_copy()/zend_string_release() churn. The cache slot and the rv
 * temporary buffer semantics are unchanged. */

/* ===== acol_fetch_object (array.c 8367-8385) ===== */

static inline zval *acol_fetch_object(zval *row, zend_string *name,
		void **cache_slot, zval *rv) /* {{{ */
{
	zval *prop = NULL;

	if (Z_OBJ_HANDLER_P(row, has_property)(Z_OBJ_P(row), name, ZEND_PROPERTY_EXISTS, cache_slot)
			|| Z_OBJ_HANDLER_P(row, has_property)(Z_OBJ_P(row), name, ZEND_PROPERTY_ISSET, cache_slot)) {
		prop = Z_OBJ_HANDLER_P(row, read_property)(Z_OBJ_P(row), name, BP_VAR_R, cache_slot, rv);
		if (prop) {
			ZVAL_DEREF(prop);
			if (prop != rv) {
				Z_TRY_ADDREF_P(prop);
			}
		}
	}
	return prop;
}
/* }}} */


/* ===== acol_fetch (array.c 8386-8407) ===== */

static inline zval *acol_fetch(zval *row, acol_kind_t kind,
		zend_long klong, zend_string *kstr, zend_string *obj_name,
		void **cache_slot, zval *rv) /* {{{ */
{
	if (Z_TYPE_P(row) == IS_ARRAY) {
		return acol_fetch_array(row, kind, klong, kstr);
	}
	if (Z_TYPE_P(row) == IS_OBJECT) {
		return acol_fetch_object(row, obj_name, cache_slot, rv);
	}
	return NULL; /* non-array/non-object row is silently skipped, like the original */
}
/* }}} */

/* {{{ _alpha sibling of array_column(): carries an HT_IS_PACKED fast path that
 * walks input->arPacked directly, hoists the column_key/index_key
 * numeric-string classification out of the per-element loop, and avoids the
 * per-object-row zend_string_copy()/zend_string_release() churn. The refcount
 * discipline (addref on fetch, dtor after use) is preserved exactly, so the
 * behavior is identical to array_column(). The original array_column() and
 * array_column_fetch_prop() stay untouched; non-packed input falls back to
 * the original loop. */

/* ===== array_column_alpha (array.c 8408-8593) ===== */

PHP_FUNCTION(array_column_alpha)
{
	HashTable *input;
	zval *colval, *data, rv;
	zend_string *column_str = NULL;
	zend_long column_long = 0;
	bool column_is_null = 0;
	zend_string *index_str = NULL;
	zend_long index_long = 0;
	bool index_is_null = 1;

	ZEND_PARSE_PARAMETERS_START(2, 3)
		Z_PARAM_ARRAY_HT(input)
		Z_PARAM_STR_OR_LONG_OR_NULL(column_str, column_long, column_is_null)
		Z_PARAM_OPTIONAL
		Z_PARAM_STR_OR_LONG_OR_NULL(index_str, index_long, index_is_null)
	ZEND_PARSE_PARAMETERS_END();

	array_init_size(return_value, zend_hash_num_elements(input));

	if (HT_IS_PACKED(input)) {
		void *cache_slot_column[3] = { NULL, NULL, NULL };
		void *cache_slot_index[3] = { NULL, NULL, NULL };
		uint32_t i, n = input->nNumUsed;
		zval *p = input->arPacked;

		/* Classify the column key once. col_obj_str is the string form handed
		 * to object property handlers (the original copies/releases it per
		 * row); for integer keys it is allocated once and reused. */
		acol_kind_t col_kind;
		zend_long col_key_long = 0;
		zend_string *col_key_str = NULL;
		zend_string *col_obj_str = NULL;
		bool col_obj_alloc = 0;

		if (column_is_null) {
			col_kind = ACOL_NULL;
		} else if (column_str != NULL) {
			zend_ulong num;
			if (ZEND_HANDLE_NUMERIC(column_str, num)) {
				col_kind = ACOL_LONG;
				col_key_long = (zend_long) num;
			} else {
				col_kind = ACOL_STR;
				col_key_str = column_str;
			}
			col_obj_str = column_str;
		} else {
			col_kind = ACOL_LONG;
			col_key_long = column_long;
			col_obj_str = zend_long_to_str(column_long);
			col_obj_alloc = 1;
		}

		/* Classify the index key once (only when it was provided). */
		acol_kind_t idx_kind = ACOL_LONG;
		zend_long idx_key_long = 0;
		zend_string *idx_key_str = NULL;
		zend_string *idx_obj_str = NULL;
		bool idx_obj_alloc = 0;

		if (!index_is_null) {
			if (index_str != NULL) {
				zend_ulong num;
				if (ZEND_HANDLE_NUMERIC(index_str, num)) {
					idx_kind = ACOL_LONG;
					idx_key_long = (zend_long) num;
				} else {
					idx_kind = ACOL_STR;
					idx_key_str = index_str;
				}
				idx_obj_str = index_str;
			} else {
				idx_kind = ACOL_LONG;
				idx_key_long = index_long;
				idx_obj_str = zend_long_to_str(index_long);
				idx_obj_alloc = 1;
			}
		}

		if (index_is_null) {
			zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
			ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
				for (i = 0; i < n; i++, p++) {
					zval *v = (Z_TYPE_P(p) == IS_REFERENCE) ? Z_REFVAL_P(p) : p;
					if (Z_TYPE_P(v) == IS_UNDEF) {
						continue;
					}
					if (col_kind == ACOL_NULL) {
						Z_TRY_ADDREF_P(v);
						colval = v;
					} else {
						colval = acol_fetch(v, col_kind, col_key_long, col_key_str, col_obj_str, cache_slot_column, &rv);
						if (colval == NULL) {
							continue;
						}
					}
					ZEND_HASH_FILL_ADD(colval);
				}
			} ZEND_HASH_FILL_END();
		} else {
			for (i = 0; i < n; i++, p++) {
				zval *v = (Z_TYPE_P(p) == IS_REFERENCE) ? Z_REFVAL_P(p) : p;
				if (Z_TYPE_P(v) == IS_UNDEF) {
					continue;
				}
				if (col_kind == ACOL_NULL) {
					Z_TRY_ADDREF_P(v);
					colval = v;
				} else {
					colval = acol_fetch(v, col_kind, col_key_long, col_key_str, col_obj_str, cache_slot_column, &rv);
					if (colval == NULL) {
						continue;
					}
				}

				/* A separate rv buffer for the index fetch: an object __get
				 * returning into the column's rv must not be clobbered before
				 * array_set_zval_key() consumes colval. */
				zval rv_idx;
				zval *keyval = acol_fetch(v, idx_kind, idx_key_long, idx_key_str, idx_obj_str, cache_slot_index, &rv_idx);
				if (keyval) {
					array_set_zval_key(Z_ARRVAL_P(return_value), keyval, colval);
					zval_ptr_dtor(colval);
					zval_ptr_dtor(keyval);
				} else {
					zend_hash_next_index_insert(Z_ARRVAL_P(return_value), colval);
				}
			}
		}

		if (col_obj_alloc) {
			zend_string_release(col_obj_str);
		}
		if (idx_obj_alloc) {
			zend_string_release(idx_obj_str);
		}
		return;
	}

	/* Non-packed fallback: identical to array_column(), using the original
	 * array_column_fetch_prop() helper unchanged. */
	void *cache_slot_column[3] = { NULL, NULL, NULL };
	void *cache_slot_index[3] = { NULL, NULL, NULL };

	/* Index param is not passed */
	if (index_is_null) {
		zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
			ZEND_HASH_FOREACH_VAL(input, data) {
				ZVAL_DEREF(data);
				if (column_is_null) {
					Z_TRY_ADDREF_P(data);
					colval = data;
				} else if ((colval = array_column_fetch_prop(data, column_str, column_long, cache_slot_column, &rv)) == NULL) {
					continue;
				}
				ZEND_HASH_FILL_ADD(colval);
			} ZEND_HASH_FOREACH_END();
		} ZEND_HASH_FILL_END();
	} else {
		ZEND_HASH_FOREACH_VAL(input, data) {
			ZVAL_DEREF(data);

			if (column_is_null) {
				Z_TRY_ADDREF_P(data);
				colval = data;
			} else if ((colval = array_column_fetch_prop(data, column_str, column_long, cache_slot_column, &rv)) == NULL) {
				continue;
			}

			zval rv;
			zval *keyval = array_column_fetch_prop(data, index_str, index_long, cache_slot_index, &rv);
			if (keyval) {
				array_set_zval_key(Z_ARRVAL_P(return_value), keyval, colval);
				zval_ptr_dtor(colval);
				zval_ptr_dtor(keyval);
			} else {
				zend_hash_next_index_insert(Z_ARRVAL_P(return_value), colval);
			}
		} ZEND_HASH_FOREACH_END();
	}
}
/* }}} */

/* {{{ Return input as a new array with the order of the entries reversed */

/* ===== array_reverse_alpha (array.c 8663-8732) ===== */

PHP_FUNCTION(array_reverse_alpha)
{
	zval	 *input,				/* Input array */
			 *entry;				/* An entry in the input array */
	zend_string *string_key;
	zend_ulong	  num_key;
	bool preserve_keys = 0;	/* whether to preserve keys */
	HashTable *myht;

	ZEND_PARSE_PARAMETERS_START(1, 2)
		Z_PARAM_ARRAY(input)
		Z_PARAM_OPTIONAL
		Z_PARAM_BOOL(preserve_keys)
	ZEND_PARSE_PARAMETERS_END();

	myht = Z_ARRVAL_P(input);

	/* (A) Empty input: return a copy (immutable/shared empty array). */
	if (zend_hash_num_elements(myht) == 0) {
		RETURN_COPY(input);
	}

	/* Initialize return array */
	array_init_size(return_value, zend_hash_num_elements(myht));
	if (HT_IS_PACKED(myht) && !preserve_keys) {
		zend_hash_real_init_packed(Z_ARRVAL_P(return_value));
		ZEND_HASH_FILL_PACKED(Z_ARRVAL_P(return_value)) {
			ZEND_HASH_PACKED_REVERSE_FOREACH_VAL(myht, entry) {
				if (UNEXPECTED(Z_ISREF_P(entry) &&
					Z_REFCOUNT_P(entry) == 1)) {
					entry = Z_REFVAL_P(entry);
				}
				Z_TRY_ADDREF_P(entry);
				ZEND_HASH_FILL_ADD(entry);
			} ZEND_HASH_FOREACH_END();
		} ZEND_HASH_FILL_END();
	} else if (HT_IS_PACKED(myht)) {
		/* (B) packed + preserve_keys: walk arPacked directly in reverse,
		 * emitting each value under its original slot index. The result is
		 * a mixed hash table (descending keys), pre-sized so no rehash. */
		uint32_t i, n = myht->nNumUsed;
		zval *e = myht->arPacked + n;
		HashTable *ret_ht = Z_ARRVAL_P(return_value);
		for (i = n; i > 0; ) {
			i--;
			e--;
			if (UNEXPECTED(Z_TYPE_P(e) == IS_UNDEF)) {
				continue;
			}
			entry = zend_hash_index_add_new(ret_ht, i, e);
			zval_add_ref(entry);
		}
	} else {
		ZEND_HASH_REVERSE_FOREACH_KEY_VAL(myht, num_key, string_key, entry) {
			if (string_key) {
				entry = zend_hash_add_new(Z_ARRVAL_P(return_value), string_key, entry);
			} else {
				if (preserve_keys) {
					entry = zend_hash_index_add_new(Z_ARRVAL_P(return_value), num_key, entry);
				} else {
					entry = zend_hash_next_index_insert_new(Z_ARRVAL_P(return_value), entry);
				}
			}
			zval_add_ref(entry);
		} ZEND_HASH_FOREACH_END();
	}
}
/* }}} */

/* {{{ Returns a copy of input array padded with pad_value to size pad_size */

/* ===== array_flip_alpha (array.c 8879-8943) ===== */

PHP_FUNCTION(array_flip_alpha)
{
	zval *array, *entry, data;
	zend_ulong num_idx;
	zend_string *str_idx;
	HashTable *myht;

	ZEND_PARSE_PARAMETERS_START(1, 1)
		Z_PARAM_ARRAY(array)
	ZEND_PARSE_PARAMETERS_END();

	myht = Z_ARRVAL_P(array);

	if (HT_IS_PACKED(myht)) {
		uint32_t i, n = myht->nNumUsed;
		zval *e = myht->arPacked;

		/* Pre-size to the full element count (see comment above). */
		array_init_size(return_value, n);

		for (i = 0; i < n; i++, e++) {
			zval *v = (Z_TYPE_P(e) == IS_REFERENCE) ? Z_REFVAL_P(e) : e;
			if (Z_TYPE_P(v) == IS_UNDEF) {
				continue;
			}
			if (Z_TYPE_P(v) == IS_LONG) {
				ZVAL_LONG(&data, i); /* packed key is always index i */
				zend_hash_index_update(Z_ARRVAL_P(return_value), Z_LVAL_P(v), &data);
			} else if (Z_TYPE_P(v) == IS_STRING) {
				ZVAL_LONG(&data, i);
				zend_symtable_update(Z_ARRVAL_P(return_value), Z_STR_P(v), &data);
			} else {
				php_error_docref(NULL, E_WARNING, "Can only flip string and integer values, entry skipped");
			}
		}
		return;
	}

	/* Non-packed input: identical to array_flip(). */
	array_init_size(return_value, zend_hash_num_elements(myht));

	ZEND_HASH_FOREACH_KEY_VAL(myht, num_idx, str_idx, entry) {
		ZVAL_DEREF(entry);
		if (Z_TYPE_P(entry) == IS_LONG) {
			if (str_idx) {
				ZVAL_STR_COPY(&data, str_idx);
			} else {
				ZVAL_LONG(&data, num_idx);
			}
			zend_hash_index_update(Z_ARRVAL_P(return_value), Z_LVAL_P(entry), &data);
		} else if (Z_TYPE_P(entry) == IS_STRING) {
			if (str_idx) {
				ZVAL_STR_COPY(&data, str_idx);
			} else {
				ZVAL_LONG(&data, num_idx);
			}
			zend_symtable_update(Z_ARRVAL_P(return_value), Z_STR_P(entry), &data);
		} else {
			php_error_docref(NULL, E_WARNING, "Can only flip string and integer values, entry skipped");
		}
	} ZEND_HASH_FOREACH_END();
}
/* }}} */

/* {{{ Returns an array with all string keys lowercased [or uppercased] */

/* ===== struct_bucketindex (array.c 8983-8987) ===== */

struct bucketindex {
	Bucket b;
	unsigned int i;
};


/* ===== array_bucketindex_swap (array.c 8988-8998) ===== */

static void array_bucketindex_swap(void *p, void *q)
{
	struct bucketindex *f = (struct bucketindex *)p;
	struct bucketindex *g = (struct bucketindex *)q;
	struct bucketindex t;
	t = *f;
	*f = *g;
	*g = t;
}

/* {{{ Removes duplicate values from array */

/* ===== array_unique_alpha (array.c 9135-9334) ===== */

PHP_FUNCTION(array_unique_alpha)
{
	zval *array;
	Bucket *p;
	zend_long sort_type = PHP_SORT_STRING;
	bucket_compare_func_t cmp;
	struct bucketindex *arTmp, *cmpdata, *lastkept;
	uint32_t i, idx;

	ZEND_PARSE_PARAMETERS_START(1, 2)
		Z_PARAM_ARRAY(array)
		Z_PARAM_OPTIONAL
		Z_PARAM_LONG(sort_type)
	ZEND_PARSE_PARAMETERS_END();

	if (Z_ARRVAL_P(array)->nNumOfElements <= 1) {	/* nothing to do */
		ZVAL_COPY(return_value, array);
		return;
	}

	if (sort_type == PHP_SORT_STRING) {
		HashTable seen;
		HashTable *ht = Z_ARRVAL_P(array);
		bool in_place = zend_may_modify_arg_in_place(array);

		zend_hash_init(&seen, zend_hash_num_elements(ht), NULL, NULL, 0);

		if (in_place) {
			/* Return the live input array and remove duplicate values in
			 * place. Deleting a bucket does not move any other bucket, so
			 * the keys we collect here stay valid mappings across the
			 * post-loop deletions (exactly the guarantee the comparison
			 * path's in-place branch relies on). */
			struct au_key { zend_string *key; zend_ulong h; };
			struct au_key *to_del;
			uint32_t dcap = 8, dnum = 0;
			zend_long num_key;
			zend_string *str_key;
			zval *val;

			/* Return the live input array. Deletions must happen while the
			 * array's refcount is still 1 (zend_hash_index_del asserts that),
			 * so the addref that hands the return value its own reference is
			 * deferred to after the delete loop -- exactly as the comparison
			 * path's in-place branch does. */
			RETVAL_ARR(ht);

			to_del = emalloc(sizeof(struct au_key) * dcap);

			ZEND_HASH_FOREACH_KEY_VAL(ht, num_key, str_key, val) {
				zend_string *tmp_str_val = NULL;
				zend_string *str_val = (Z_TYPE_P(val) == IS_STRING)
					? Z_STR_P(val)
					: zval_get_tmp_string(val, &tmp_str_val);

				if (zend_hash_add_empty_element(&seen, str_val) == NULL) {
					/* Duplicate value: schedule its element for deletion by
					 * its original array key. */
					if (dnum == dcap) {
						dcap *= 2;
						to_del = erealloc(to_del, sizeof(struct au_key) * dcap);
					}
					to_del[dnum].key = str_key;
					to_del[dnum].h = num_key;
					dnum++;
				} else if (UNEXPECTED(Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1)) {
					/* First occurrence of a sole-owned reference: match the
					 * baseline, which drops the ref wrapper and keeps the
					 * inner value. The element already lives in the returned
					 * array, so no addref is needed. */
					ZVAL_DEREF(val);
				}

				if (tmp_str_val) {
					zend_tmp_string_release(tmp_str_val);
				}
			} ZEND_HASH_FOREACH_END();

			for (i = 0; i < dnum; i++) {
				if (to_del[i].key) {
					zend_hash_del(ht, to_del[i].key);
				} else {
					zend_hash_index_del(ht, to_del[i].h);
				}
			}

			efree(to_del);

			/* Now that all deletions are done, hand the return value its own
			 * reference to the (mutated) input array. */
			Z_ADDREF_P(return_value);
		} else {
			/* Shared input: build a fresh result, identical to array_unique(). */
			zend_long num_key;
			zend_string *str_key;
			zval *val;

			array_init_size(return_value, zend_hash_num_elements(ht));

			ZEND_HASH_FOREACH_KEY_VAL(ht, num_key, str_key, val) {
				zval *retval;
				if (Z_TYPE_P(val) == IS_STRING) {
					retval = zend_hash_add_empty_element(&seen, Z_STR_P(val));
				} else {
					zend_string *tmp_str_val;
					zend_string *str_val = zval_get_tmp_string(val, &tmp_str_val);
					retval = zend_hash_add_empty_element(&seen, str_val);
					zend_tmp_string_release(tmp_str_val);
				}

				if (retval) {
					/* First occurrence of the value */
					if (UNEXPECTED(Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1)) {
						ZVAL_DEREF(val);
					}
					Z_TRY_ADDREF_P(val);

					if (str_key) {
						zend_hash_add_new(Z_ARRVAL_P(return_value), str_key, val);
					} else {
						zend_hash_index_add_new(Z_ARRVAL_P(return_value), num_key, val);
					}
				}
			} ZEND_HASH_FOREACH_END();
		}

		zend_hash_destroy(&seen);
		return;
	}

	/* Non-SORT_STRING flags: identical to array_unique() (verbatim copy). */
	cmp = php_get_data_compare_func_unstable(sort_type, false);

	{
		bool in_place = zend_may_modify_arg_in_place(array);
		if (in_place) {
			RETVAL_ARR(Z_ARRVAL_P(array));
		} else {
			RETVAL_ARR(zend_array_dup(Z_ARRVAL_P(array)));
		}

		/* create and sort array with pointers to the target_hash buckets */
		arTmp = pemalloc((Z_ARRVAL_P(array)->nNumOfElements + 1) * sizeof(struct bucketindex), GC_FLAGS(Z_ARRVAL_P(array)) & IS_ARRAY_PERSISTENT);
		if (HT_IS_PACKED(Z_ARRVAL_P(array))) {
			zval *zv = Z_ARRVAL_P(array)->arPacked;
			for (i = 0, idx = 0; idx < Z_ARRVAL_P(array)->nNumUsed; idx++, zv++) {
				if (Z_TYPE_P(zv) == IS_UNDEF) continue;
				ZVAL_COPY_VALUE(&arTmp[i].b.val, zv);
				arTmp[i].b.h = idx;
				arTmp[i].b.key = NULL;
				arTmp[i].i = i;
				i++;
			}
		} else {
			p = Z_ARRVAL_P(array)->arData;
			for (i = 0, idx = 0; idx < Z_ARRVAL_P(array)->nNumUsed; idx++, p++) {
				if (Z_TYPE(p->val) == IS_UNDEF) continue;
				arTmp[i].b = *p;
				arTmp[i].i = i;
				i++;
			}
		}
		ZVAL_UNDEF(&arTmp[i].b.val);
		zend_sort((void *) arTmp, i, sizeof(struct bucketindex),
				(compare_func_t) cmp, (swap_func_t) array_bucketindex_swap);

		if (UNEXPECTED(EG(exception))) {
			goto out;
		}

		/* go through the sorted array and delete duplicates from the copy */
		lastkept = arTmp;
		for (cmpdata = arTmp + 1; Z_TYPE(cmpdata->b.val) != IS_UNDEF; cmpdata++) {
			if (cmp(&lastkept->b, &cmpdata->b)) {
				lastkept = cmpdata;
			} else {
				if (lastkept->i > cmpdata->i) {
					p = &lastkept->b;
					lastkept = cmpdata;
				} else {
					p = &cmpdata->b;
				}
				if (p->key == NULL) {
					zend_hash_index_del(Z_ARRVAL_P(return_value), p->h);
				} else {
					zend_hash_del(Z_ARRVAL_P(return_value), p->key);
				}
			}
		}

	out:
		pefree(arTmp, GC_FLAGS(Z_ARRVAL_P(array)) & IS_ARRAY_PERSISTENT);

		if (in_place) {
			Z_ADDREF_P(return_value);
		}
	}
}
/* }}} */


/* ===== php_array_intersect_alpha (array.c 9735-9819) ===== */

static void php_array_intersect_alpha(INTERNAL_FUNCTION_PARAMETERS)
{
	zval *args, *val;
	uint32_t arr_argc, i, j;
	HashTable *sets;
	zend_string *key, *str, *tmp;
	zend_ulong h;

	if (zend_parse_parameters(ZEND_NUM_ARGS(), "+", &args, &arr_argc) == FAILURE) {
		RETURN_THROWS();
	}

	for (i = 0; i < arr_argc; i++) {
		if (Z_TYPE(args[i]) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
			RETURN_THROWS();
		}
	}

	array_init(return_value);

	/* array_intersect_alpha($a) === copy of $a: vacuously present in all
	 * zero other arguments, matching the original's single-argument behavior. */
	if (arr_argc <= 1) {
		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(args[0]), h, key, val) {
			Z_TRY_ADDREF_P(val);
			if (key) {
				zend_hash_add_new(Z_ARRVAL_P(return_value), key, val);
			} else {
				zend_hash_index_add_new(Z_ARRVAL_P(return_value), h, val);
			}
		} ZEND_HASH_FOREACH_END();
		return;
	}

	/* If any other array is empty, nothing can be present in all of them. */
	for (i = 1; i < arr_argc; i++) {
		if (zend_hash_num_elements(Z_ARRVAL(args[i])) == 0) {
			return;
		}
	}

	/* Build one presence-only set per "other" array, keyed by the string
	 * representation of each value. zend_hash_add_empty_element is the same
	 * idiom used by array_unique(); duplicates within a single array are
	 * irrelevant for set membership and are silently ignored. */
	sets = safe_emalloc(arr_argc - 1, sizeof(HashTable), 0);
	for (i = 1; i < arr_argc; i++) {
		HashTable *ht = Z_ARRVAL(args[i]);
		zend_hash_init(&sets[i - 1], zend_hash_num_elements(ht), NULL, NULL, 0);
		ZEND_HASH_FOREACH_VAL(ht, val) {
			str = zval_get_tmp_string(val, &tmp);
			zend_hash_add_empty_element(&sets[i - 1], str);
			zend_tmp_string_release(tmp);
		} ZEND_HASH_FOREACH_END();
	}

	/* Keep the entries of args[0] whose string representation is present in
	 * every set, preserving args[0]'s keys and insertion order. */
	ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(args[0]), h, key, val) {
		str = zval_get_tmp_string(val, &tmp);
		for (j = 0; j < arr_argc - 1; j++) {
			if (zend_hash_find(&sets[j], str) == NULL) {
				break;
			}
		}
		if (j == arr_argc - 1) {
			Z_TRY_ADDREF_P(val);
			if (key) {
				zend_hash_add_new(Z_ARRVAL_P(return_value), key, val);
			} else {
				zend_hash_index_add_new(Z_ARRVAL_P(return_value), h, val);
			}
		}
		zend_tmp_string_release(tmp);
	} ZEND_HASH_FOREACH_END();

	for (i = 0; i < arr_argc - 1; i++) {
		zend_hash_destroy(&sets[i]);
	}
	efree(sets);
}
/* }}} */

/* {{{ Returns the entries of arr1 that have values which are present in all the other arguments. Hash-set based _alpha sibling of array_intersect(). */

/* ===== array_intersect_alpha (array.c 9820-9841) ===== */

PHP_FUNCTION(array_intersect_alpha)
{
	php_array_intersect_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ php_intersect_assoc_alpha_str_equal
 * String-representation equality predicate for array_intersect_assoc_alpha(): returns true iff
 * (string)val === (string)data, the same equality the baseline defines via zval_compare() ->
 * string_compare_function(). Two same-type fast paths avoid the per-comparison zend_string
 * allocation the baseline pays:
 *
 *   - IS_LONG vs IS_LONG: the integer-to-string conversion is injective, so the string forms are
 *     equal iff the longs are equal -- compare Z_LVAL directly.
 *   - IS_STRING vs IS_STRING: matches string_compare_function()'s fast path (pointer or content
 *     equality) via zend_string_equals().
 *
 * Every other combination (cross-type, doubles, bools, null, references, objects with
 * __toString, etc.) falls back to string_compare_function(), which applies the same coercion the
 * baseline uses. The baseline already handles IS_STRING/IS_STRING without allocation; the
 * material win over it is the IS_LONG/IS_LONG path, which dominates integer-keyed record-set
 * workloads where the current code allocates and frees a zend_string per comparison. */

/* ===== php_intersect_assoc_alpha_str_equal (array.c 9842-9870) ===== */

static zend_always_inline bool php_intersect_assoc_alpha_str_equal(zval *val, zval *data)
{
	if (EXPECTED(Z_TYPE_P(val) == IS_LONG) && EXPECTED(Z_TYPE_P(data) == IS_LONG)) {
		return Z_LVAL_P(val) == Z_LVAL_P(data);
	}
	if (EXPECTED(Z_TYPE_P(val) == IS_STRING) && EXPECTED(Z_TYPE_P(data) == IS_STRING)) {
		return zend_string_equals(Z_STR_P(val), Z_STR_P(data));
	}
	return string_compare_function(val, data) == 0;
}
/* }}} */

/* {{{ php_array_intersect_key_alpha
 * _alpha sibling of array_intersect_assoc() (the php_array_intersect_key() family with
 * INTERSECT_COMP_DATA_INTERNAL). Semantics are identical to the baseline: an entry of args[0] is
 * kept iff for every other argument the key is present AND the values' string representations are
 * equal. The algorithm is the same O(|args[0]| * (argc-1)) key-indexed scan as the original -- the
 * key is the index, so the sort/merge used by array_intersect() is unnecessary here -- with
 * constant-factor optimizations that preserve semantics:
 *
 *   - short circuits: empty args[0] -> empty result; no other arrays -> copy of args[0]; any
 *     other array empty -> empty result (an entry must be present in ALL others to survive,
 *     mirroring the "present-in-all" sense of intersection, the inverse of
 *     array_diff_assoc_alpha's "all others empty -> copy");
 *   - the php_intersect_assoc_alpha_str_equal() comparator above, which fast-paths IS_LONG/IS_LONG
 *     and IS_STRING/IS_STRING and otherwise delegates to the baseline string_compare_function().
 *
 * Only array_intersect_assoc_alpha() calls this; array_intersect_assoc() and every other
 * php_array_intersect_key() caller remain untouched. */

/* ===== php_array_intersect_key_alpha (array.c 9871-9942) ===== */

static void php_array_intersect_key_alpha(INTERNAL_FUNCTION_PARAMETERS)
{
	uint32_t argc, i;
	zval *args;
	bool ok;
	zval *val, *data;
	zend_string *key;
	zend_ulong h;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	for (i = 0; i < argc; i++) {
		if (Z_TYPE(args[i]) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
			RETURN_THROWS();
		}
	}

	/* Short circuit: empty first array -> empty result. */
	if (zend_hash_num_elements(Z_ARRVAL(args[0])) == 0) {
		RETURN_EMPTY_ARRAY();
	}

	/* Short circuit: no other arrays -> copy of args[0] (vacuously present in all zero others). */
	if (argc < 2) {
		ZVAL_COPY(return_value, &args[0]);
		return;
	}

	/* Short circuit: if any other array is empty, no entry can be present in all of them. */
	for (i = 1; i < argc; i++) {
		if (zend_hash_num_elements(Z_ARRVAL(args[i])) == 0) {
			RETURN_EMPTY_ARRAY();
		}
	}

	array_init(return_value);

	/* Iterate over keys of the first array, keeping those present in every other array with a
	 * string-equal value. Preserves args[0]'s keys and insertion order. */
	ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(args[0]), h, key, val) {
		if (Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1) {
			val = Z_REFVAL_P(val);
		}
		ok = true;
		for (i = 1; i < argc; i++) {
			HashTable *ht = Z_ARRVAL(args[i]);
			if (key == NULL) {
				data = zend_hash_index_find(ht, h);
			} else {
				data = zend_hash_find_known_hash(ht, key);
			}
			if (data == NULL || !php_intersect_assoc_alpha_str_equal(val, data)) {
				ok = false;
				break;
			}
		}
		if (ok) {
			Z_TRY_ADDREF_P(val);
			if (key == NULL) {
				zend_hash_index_add_new(Z_ARRVAL_P(return_value), h, val);
			} else {
				zend_hash_add_new(Z_ARRVAL_P(return_value), key, val);
			}
		}
	} ZEND_HASH_FOREACH_END();
}
/* }}} */

/* {{{ Returns the entries of arr1 that have values which are present in all the other arguments. Keys are used to do more restrictive check. Key/value fast-path _alpha sibling of array_intersect_assoc(). */

/* ===== array_intersect_assoc_alpha (array.c 9943-9968) ===== */

PHP_FUNCTION(array_intersect_assoc_alpha)
{
	php_array_intersect_key_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ php_array_intersect_key_only_alpha
 * _alpha sibling of array_intersect_key() (the php_array_intersect_key() family with
 * INTERSECT_COMP_DATA_NONE). Semantics are identical to the baseline: an entry of
 * args[0] is kept iff its key is present in every other argument -- values are never
 * compared (this is what distinguishes array_intersect_key from array_intersect_assoc).
 * The algorithm is the same O(|args[0]| * (argc-1)) key-indexed scan as the original --
 * the key is the index, so the sort/merge used by array_intersect() is unnecessary here
 * -- with constant-factor optimizations that preserve semantics:
 *
 *   - short circuits: empty args[0] -> empty result; no other arrays -> copy of args[0]
 *     (vacuously present in all zero others); any other array empty -> empty result (an
 *     entry must be present in ALL others to survive, the inverse of
 *     array_diff_key_alpha's "all others empty -> copy");
 *   - when args[0] is HT_IS_PACKED and without holes, a direct arPacked[] walk with
 *     integer-key lookups, avoiding the ZEND_HASH_FOREACH_KEY_VAL iterator overhead
 *     (the keys are the indices 0..n-1);
 *   - a pre-sized result array so inserts never rehash.
 *
 * Only array_intersect_key_alpha() calls this; array_intersect_key(),
 * array_intersect_assoc() and array_intersect_assoc_alpha() remain untouched. */

/* ===== php_array_intersect_key_only_alpha (array.c 9969-10076) ===== */

static void php_array_intersect_key_only_alpha(INTERNAL_FUNCTION_PARAMETERS)
{
	uint32_t argc, i;
	zval *args;
	bool ok;
	zval *val, *data;
	zend_string *key;
	zend_ulong h;
	HashTable *src;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	for (i = 0; i < argc; i++) {
		if (Z_TYPE(args[i]) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
			RETURN_THROWS();
		}
	}

	/* Short circuit: empty first array -> empty result. */
	if (zend_hash_num_elements(Z_ARRVAL(args[0])) == 0) {
		RETURN_EMPTY_ARRAY();
	}

	/* Short circuit: no other arrays -> copy of args[0] (vacuously present in all
	 * zero others). */
	if (argc < 2) {
		ZVAL_COPY(return_value, &args[0]);
		return;
	}

	/* Short circuit: if any other array is empty, no entry can be present in all of
	 * them. */
	for (i = 1; i < argc; i++) {
		if (zend_hash_num_elements(Z_ARRVAL(args[i])) == 0) {
			RETURN_EMPTY_ARRAY();
		}
	}

	src = Z_ARRVAL(args[0]);

	/* Packed fast path: args[0] is packed and contiguous, so every key is the
	 * integer index i and we can walk arPacked directly. */
	if (HT_IS_PACKED(src) && HT_IS_WITHOUT_HOLES(src)) {
		uint32_t n = src->nNumUsed;
		zval *p = src->arPacked;
		uint32_t idx;

		/* Pre-size and initialize as packed so inserts never rehash. */
		array_init_size(return_value, zend_hash_num_elements(src));
		zend_hash_real_init_packed(Z_ARRVAL_P(return_value));

		for (idx = 0; idx < n; idx++) {
			val = &p[idx];
			if (Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1) {
				val = Z_REFVAL_P(val);
			}
			ok = true;
			for (i = 1; i < argc; i++) {
				if (zend_hash_index_find(Z_ARRVAL(args[i]), idx) == NULL) {
					ok = false;
					break;
				}
			}
			if (ok) {
				Z_TRY_ADDREF_P(val);
				zend_hash_index_add_new(Z_ARRVAL_P(return_value), idx, val);
			}
		}
	} else {
		/* Generic path: hash keys, holes, or mixed-key arrays. Use a plain
		 * array_init like the baseline -- pre-sizing to the upper bound would
		 * waste the allocation when most entries are excluded (e.g. all keys
		 * disjoint -> empty result). */
		array_init(return_value);
		ZEND_HASH_FOREACH_KEY_VAL(src, h, key, val) {
			if (Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1) {
				val = Z_REFVAL_P(val);
			}
			ok = true;
			for (i = 1; i < argc; i++) {
				HashTable *ht = Z_ARRVAL(args[i]);
				if (key == NULL) {
					data = zend_hash_index_find(ht, h);
				} else {
					data = zend_hash_find_known_hash(ht, key);
				}
				if (data == NULL) {
					ok = false;
					break;
				}
			}
			if (ok) {
				Z_TRY_ADDREF_P(val);
				if (key == NULL) {
					zend_hash_index_add_new(Z_ARRVAL_P(return_value), h, val);
				} else {
					zend_hash_add_new(Z_ARRVAL_P(return_value), key, val);
				}
			}
		} ZEND_HASH_FOREACH_END();
	}
}
/* }}} */

/* {{{ Returns the entries of arr1 that have keys which are present in all the other arguments. Key-only fast-path _alpha sibling of array_intersect_key(). */

/* ===== array_intersect_key_alpha (array.c 10077-10083) ===== */

PHP_FUNCTION(array_intersect_key_alpha)
{
	php_array_intersect_key_only_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ Returns the entries of arr1 that have values which are present in all the other arguments. Data is compared by using a user-supplied callback. */

/* ===== php_array_diff_alpha (array.c 10603-10786) ===== */

static void php_array_diff_alpha(INTERNAL_FUNCTION_PARAMETERS)
{
	zval *args;
	uint32_t argc, i;
	uint64_t num;
	HashTable exclude;
	zval *value;
	zend_string *str, *tmp_str, *key;
	zend_long idx;
	zval dummy;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	if (Z_TYPE(args[0]) != IS_ARRAY) {
		zend_argument_type_error(1, "must be of type array, %s given", zend_zval_value_name(&args[0]));
		RETURN_THROWS();
	}

	num = zend_hash_num_elements(Z_ARRVAL(args[0]));
	if (num == 0) {
		for (i = 1; i < argc; i++) {
			if (Z_TYPE(args[i]) != IS_ARRAY) {
				zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
				RETURN_THROWS();
			}
		}
		RETURN_EMPTY_ARRAY();
	} else if (num == 1) {
		int found = 0;
		zend_string *search_str, *tmp_search_str;

		value = NULL;
		ZEND_HASH_FOREACH_VAL(Z_ARRVAL(args[0]), value) {
			break;
		} ZEND_HASH_FOREACH_END();

		if (!value) {
			for (i = 1; i < argc; i++) {
				if (Z_TYPE(args[i]) != IS_ARRAY) {
					zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
					RETURN_THROWS();
				}
			}
			RETURN_EMPTY_ARRAY();
		}

		search_str = zval_get_tmp_string(value, &tmp_search_str);

		for (i = 1; i < argc; i++) {
			if (Z_TYPE(args[i]) != IS_ARRAY) {
				zend_tmp_string_release(tmp_search_str);
				zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
				RETURN_THROWS();
			}
			if (!found) {
				ZEND_HASH_FOREACH_VAL(Z_ARRVAL(args[i]), value) {
					str = zval_get_tmp_string(value, &tmp_str);
					if (zend_string_equals(search_str, str)) {
						zend_tmp_string_release(tmp_str);
						found = 1;
						break;
					}
					zend_tmp_string_release(tmp_str);
				} ZEND_HASH_FOREACH_END();
			}
		}

		zend_tmp_string_release(tmp_search_str);

		if (found) {
			RETVAL_EMPTY_ARRAY();
		} else {
			ZVAL_COPY(return_value, &args[0]);
		}
		return;
	}

	/* count number of elements */
	num = 0;
	for (i = 1; i < argc; i++) {
		if (Z_TYPE(args[i]) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
			RETURN_THROWS();
		}
		num += zend_hash_num_elements(Z_ARRVAL(args[i]));
	}

	if (num == 0) {
		ZVAL_COPY(return_value, &args[0]);
		return;
	}

	if (UNEXPECTED(num >= HT_MAX_SIZE)) {
		zend_throw_error(NULL, "The total number of elements must be lower than %u", HT_MAX_SIZE);
		RETURN_THROWS();
	}

	ZVAL_NULL(&dummy);
	/* create exclude map. For each other array, walk arPacked directly when
	 * packed (skipping IS_UNDEF holes) to avoid the ZEND_HASH_FOREACH iterator
	 * overhead; otherwise fall back to the generic loop. The slot zval is
	 * passed as-is to zval_get_tmp_string(), which handles references and
	 * non-scalar types internally, exactly as the original does. */
	zend_hash_init(&exclude, num, NULL, NULL, 0);
	for (i = 1; i < argc; i++) {
		HashTable *ht = Z_ARRVAL(args[i]);
		if (HT_IS_PACKED(ht)) {
			uint32_t k, n = ht->nNumUsed;
			zval *p = ht->arPacked;
			for (k = 0; k < n; k++, p++) {
				if (Z_TYPE_P(p) == IS_UNDEF) {
					continue;
				}
				str = zval_get_tmp_string(p, &tmp_str);
				zend_hash_add(&exclude, str, &dummy);
				zend_tmp_string_release(tmp_str);
			}
		} else {
			ZEND_HASH_FOREACH_VAL(ht, value) {
				str = zval_get_tmp_string(value, &tmp_str);
				zend_hash_add(&exclude, str, &dummy);
				zend_tmp_string_release(tmp_str);
			} ZEND_HASH_FOREACH_END();
		}
	}

	/* copy all elements of first array that are not in exclude set. Packed
	 * args[0] is walked via arPacked with the slot index i; the result keeps
	 * the original integer key i (NOT a consecutive fill), because dropping
	 * excluded entries leaves the survivors' keys sparse. */
	array_init_size(return_value, zend_hash_num_elements(Z_ARRVAL(args[0])));
	if (HT_IS_PACKED(Z_ARRVAL(args[0]))) {
		HashTable *ht = Z_ARRVAL(args[0]);
		uint32_t k, n = ht->nNumUsed;
		zval *p = ht->arPacked;
		for (k = 0; k < n; k++, p++) {
			if (Z_TYPE_P(p) == IS_UNDEF) {
				continue;
			}
			str = zval_get_tmp_string(p, &tmp_str);
			if (!zend_hash_exists(&exclude, str)) {
				value = zend_hash_index_add_new(Z_ARRVAL_P(return_value), k, p);
				zval_add_ref(value);
			}
			zend_tmp_string_release(tmp_str);
		}
	} else {
		ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(args[0]), idx, key, value) {
			str = zval_get_tmp_string(value, &tmp_str);
			if (!zend_hash_exists(&exclude, str)) {
				if (key) {
					value = zend_hash_add_new(Z_ARRVAL_P(return_value), key, value);
				} else {
					value = zend_hash_index_add_new(Z_ARRVAL_P(return_value), idx, value);
				}
				zval_add_ref(value);
			}
			zend_tmp_string_release(tmp_str);
		} ZEND_HASH_FOREACH_END();
	}

	zend_hash_destroy(&exclude);
}
/* }}} */

/* {{{ php_diff_assoc_alpha_str_equal
 * diff_assoc value equality: true iff (string) val === (string) data, which is
 * exactly what the baseline zval_compare()/string_compare_function() define.
 * Two same-type fast paths avoid the temporary zend_string allocation that
 * zval_get_tmp_string() performs for every non-string operand:
 *
 *   - IS_LONG vs IS_LONG: the integer-to-string conversion is injective, so the
 *     string forms are equal iff the longs are equal -- compare Z_LVAL directly.
 *   - IS_STRING vs IS_STRING: matches string_compare_function()'s fast path
 *     (pointer or content equality) via zend_string_equals().
 *
 * Every other combination (cross-type, doubles, bools, null, references,
 * objects with __toString, etc.) falls back to string_compare_function(), which
 * applies the same coercion the baseline uses. The baseline already handles
 * IS_STRING/IS_STRING without allocation; the material win over it is the
 * IS_LONG/IS_LONG path, which dominates integer-keyed record-set workloads
 * where the current code allocates and frees a zend_string per comparison. */

/* ===== php_diff_assoc_alpha_str_equal (array.c 10787-10816) ===== */

static zend_always_inline bool php_diff_assoc_alpha_str_equal(zval *val, zval *data)
{
	if (EXPECTED(Z_TYPE_P(val) == IS_LONG) && EXPECTED(Z_TYPE_P(data) == IS_LONG)) {
		return Z_LVAL_P(val) == Z_LVAL_P(data);
	}
	if (EXPECTED(Z_TYPE_P(val) == IS_STRING) && EXPECTED(Z_TYPE_P(data) == IS_STRING)) {
		return zend_string_equals(Z_STR_P(val), Z_STR_P(data));
	}
	return string_compare_function(val, data) == 0;
}
/* }}} */

/* {{{ php_array_diff_key_alpha
 * _alpha sibling of array_diff_assoc() (the php_array_diff_key() family with
 * DIFF_COMP_DATA_INTERNAL). Semantics are identical to the baseline: an entry
 * of args[0] is kept iff for every other argument the key is absent OR the
 * values' string representations are equal. The algorithm is the same
 * O(|args[0]| * (argc-1)) key-indexed scan as the original -- the key is the
 * index, so the sort/merge used by array_diff() is unnecessary here -- with
 * constant-factor optimizations that preserve semantics:
 *
 *   - short circuits: empty args[0] -> empty result; total of all other
 *     arrays zero (or no other arrays) -> copy of args[0] with no scan,
 *     mirroring array_diff_alpha();
 *   - the php_diff_assoc_alpha_str_equal() comparator above, which fast-paths
 *     IS_LONG/IS_LONG and IS_STRING/IS_STRING and otherwise delegates to the
 *     baseline string_compare_function().
 *
 * Only array_diff_assoc_alpha() calls this; array_diff_assoc() and every other
 * php_array_diff_key() caller remain untouched. */

/* ===== php_array_diff_key_alpha (array.c 10817-10907) ===== */

static void php_array_diff_key_alpha(INTERNAL_FUNCTION_PARAMETERS)
{
	uint32_t argc, i;
	zval *args;
	bool ok;
	zval *val, *data;
	zend_string *key;
	zend_ulong h;
	uint64_t num;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	for (i = 0; i < argc; i++) {
		if (Z_TYPE(args[i]) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
			RETURN_THROWS();
		}
	}

	/* Short circuit: empty first array -> empty result. */
	if (zend_hash_num_elements(Z_ARRVAL(args[0])) == 0) {
		RETURN_EMPTY_ARRAY();
	}

	/* Short circuit: no other arrays, or all other arrays empty -> args[0]
	 * is the result. */
	num = 0;
	for (i = 1; i < argc; i++) {
		num += zend_hash_num_elements(Z_ARRVAL(args[i]));
	}
	if (argc < 2 || num == 0) {
		ZVAL_COPY(return_value, &args[0]);
		return;
	}

	array_init(return_value);

	/* Iterate over keys of the first array, to compute keys that aren't in
	 * the other arrays (with a matching value). */
	ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL(args[0]), h, key, val) {
		if (Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1) {
			val = Z_REFVAL_P(val);
		}
		ok = true;
		for (i = 1; i < argc; i++) {
			HashTable *ht = Z_ARRVAL(args[i]);
			if (key == NULL) {
				data = zend_hash_index_find(ht, h);
			} else {
				data = zend_hash_find_known_hash(ht, key);
			}
			if (data != NULL
				&& php_diff_assoc_alpha_str_equal(val, data)) {
				ok = false;
				break;
			}
		}
		if (ok) {
			Z_TRY_ADDREF_P(val);
			if (key == NULL) {
				zend_hash_index_add_new(Z_ARRVAL_P(return_value), h, val);
			} else {
				zend_hash_add_new(Z_ARRVAL_P(return_value), key, val);
			}
		}
	} ZEND_HASH_FOREACH_END();
}
/* }}} */

/* {{{ php_array_diff_key_only_alpha
 * _alpha sibling of array_diff_key() (the php_array_diff_key() family with
 * DIFF_COMP_DATA_NONE). Semantics are identical to the baseline: an entry of
 * args[0] is kept iff its key is absent from every other argument -- values are
 * never compared (this is what distinguishes array_diff_key from
 * array_diff_assoc). The algorithm is the same O(|args[0]| * (argc-1))
 * key-indexed scan as the original -- the key is the index, so the sort/merge
 * used by array_diff() is unnecessary here -- with constant-factor
 * optimizations that preserve semantics:
 *
 *   - short circuits: empty args[0] -> empty result; total of all other
 *     arrays zero (or no other arrays) -> copy of args[0], mirroring
 *     array_diff_assoc_alpha();
 *   - when args[0] is HT_IS_PACKED and without holes, a direct arPacked[] walk
 *     with integer-key lookups, avoiding the ZEND_HASH_FOREACH_KEY_VAL
 *     iterator overhead (the keys are the indices 0..n-1);
 *   - a pre-sized result array so inserts never rehash.
 *
 * Only array_diff_key_alpha() calls this; array_diff_key(), array_diff_assoc()
 * and array_diff_assoc_alpha() remain untouched. */

/* ===== php_array_diff_key_only_alpha (array.c 10908-11012) ===== */

static void php_array_diff_key_only_alpha(INTERNAL_FUNCTION_PARAMETERS)
{
	uint32_t argc, i;
	zval *args;
	bool ok;
	zval *val, *data;
	zend_string *key;
	zend_ulong h;
	uint64_t num;
	HashTable *src;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	for (i = 0; i < argc; i++) {
		if (Z_TYPE(args[i]) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
			RETURN_THROWS();
		}
	}

	/* Short circuit: empty first array -> empty result. */
	if (zend_hash_num_elements(Z_ARRVAL(args[0])) == 0) {
		RETURN_EMPTY_ARRAY();
	}

	/* Short circuit: no other arrays, or all other arrays empty -> args[0]
	 * is the result. */
	num = 0;
	for (i = 1; i < argc; i++) {
		num += zend_hash_num_elements(Z_ARRVAL(args[i]));
	}
	if (argc < 2 || num == 0) {
		ZVAL_COPY(return_value, &args[0]);
		return;
	}

	src = Z_ARRVAL(args[0]);

	/* Packed fast path: args[0] is packed and contiguous, so every key is the
	 * integer index i and we can walk arPacked directly. */
	if (HT_IS_PACKED(src) && HT_IS_WITHOUT_HOLES(src)) {
		uint32_t n = src->nNumUsed;
		zval *p = src->arPacked;
		uint32_t idx;

		/* Pre-size and initialize as packed so inserts never rehash. */
		array_init_size(return_value, zend_hash_num_elements(src));
		zend_hash_real_init_packed(Z_ARRVAL_P(return_value));

		for (idx = 0; idx < n; idx++) {
			val = &p[idx];
			if (Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1) {
				val = Z_REFVAL_P(val);
			}
			ok = true;
			for (i = 1; i < argc; i++) {
				if (zend_hash_index_find(Z_ARRVAL(args[i]), idx) != NULL) {
					ok = false;
					break;
				}
			}
			if (ok) {
				Z_TRY_ADDREF_P(val);
				zend_hash_index_add_new(Z_ARRVAL_P(return_value), idx, val);
			}
		}
	} else {
		/* Generic path: hash keys, holes, or mixed-key arrays. Use a plain
		 * array_init like the baseline -- pre-sizing to the upper bound would
		 * waste the allocation when most entries are excluded (e.g. all keys
		 * match -> empty result). */
		array_init(return_value);
		ZEND_HASH_FOREACH_KEY_VAL(src, h, key, val) {
			if (Z_ISREF_P(val) && Z_REFCOUNT_P(val) == 1) {
				val = Z_REFVAL_P(val);
			}
			ok = true;
			for (i = 1; i < argc; i++) {
				HashTable *ht = Z_ARRVAL(args[i]);
				if (key == NULL) {
					data = zend_hash_index_find(ht, h);
				} else {
					data = zend_hash_find_known_hash(ht, key);
				}
				if (data != NULL) {
					ok = false;
					break;
				}
			}
			if (ok) {
				Z_TRY_ADDREF_P(val);
				if (key == NULL) {
					zend_hash_index_add_new(Z_ARRVAL_P(return_value), h, val);
				} else {
					zend_hash_add_new(Z_ARRVAL_P(return_value), key, val);
				}
			}
		} ZEND_HASH_FOREACH_END();
	}
}
/* }}} */

/* {{{ Returns the entries of arr1 that have values which are not present in any of the others arguments. Packed-array fast-path _alpha sibling of array_diff(). */

/* ===== array_diff_alpha (array.c 11013-11059) ===== */

PHP_FUNCTION(array_diff_alpha)
{
	php_array_diff_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ php_array_udiff_alpha
 * _alpha sibling of array_udiff(). Equality is defined by the user-supplied
 * comparator, exactly as php_array_user_compare_unstable() (and thus the
 * baseline) define it: an entry of args[0] is kept iff the comparator does not
 * report any equal entry in any other argument.
 *
 * The baseline php_array_diff() sorts EVERY argument (including args[0]) with
 * the comparator, duplicates the whole first array, then merge-sweeps and
 * deletes matches. A diff only needs membership testing of args[0]'s elements,
 * though; args[0] itself never has to be sorted for that. This variant is
 * ADAPTIVE: it sorts the other arguments once, then picks the cheaper
 * membership strategy per call via a cost-model gate.
 *
 *   - Binary-search path (gate fires): walk args[0] in its original order,
 *     binary-search each sorted other array (php_array_udiff_alpha_contains(),
 *     early-exit on the first hit), build the result incrementally (only
 *     survivors, original keys/order preserved) -- no zend_array_dup, no
 *     per-match deletion, and no args[0] sort. Wins when args[0] is large
 *     relative to the other arrays or duplicate-heavy (~2x fewer callbacks for
 *     array_udiff($big, $small, $cb), ~4x for duplicate-heavy args[0] against a
 *     single small other array).
 *   - Merge path (gate does not fire): the exact baseline sort-merge algorithm
 *     (sort args[0] too, dup it, sweep, delete matches), self-contained here
 *     with the unreachable ASSOC/KEY branches removed. Used when N binary
 *     searches would cost more than a sort-merge (balanced inputs, large other
 *     arrays, many other arrays) so the variant never regresses.
 *
 * The gate chooses binary iff k*log2(max_other+1) < 0.5*log2(n0)+2 -- i.e.
 * (max_other+1)^(2k) < 16*n0 with a conservative baseline estimate, computed
 * with an overflow guard -- where k is the number of non-empty other arrays.
 * Measured by Zend/bench_array_udiff_alpha.php: the regressing regimes
 * (balanced, args[0] much smaller than the others, many other arrays) fall
 * back to the merge path and match the baseline callback-for-callback; the
 * winning regimes keep the 2x-4x reduction. It is a parallel experiment, not
 * a replacement; the baseline array_udiff() is untouched.
 *
 * Three short-circuits avoid callbacks entirely when no work is needed: empty
 * args[0] -> empty result; all other arguments empty (or none) -> copy of
 * args[0]; single-element args[0] -> one linear scan per other array (no
 * O(M log M) sort). Only array_udiff_alpha() calls this; array_udiff() and
 * php_array_diff() stay byte-for-byte untouched. */

/* ===== php_array_udiff_alpha (array.c 11060-11390) ===== */

static void php_array_udiff_alpha(INTERNAL_FUNCTION_PARAMETERS)
{
	zval *args;
	uint32_t argc, i, n0, n_other_total;
	uint32_t n_other_nonempty, max_other;
	bool use_binary;
	zend_fcall_info fci;
	zend_fcall_info_cache fci_cache;
	Bucket **lists = NULL;
	uint32_t *sizes = NULL;
	HashTable *ht0, *ht;
	Bucket needle;
	zend_ulong idx;
	zend_string *key;
	zval *val, *other;
	PHP_ARRAY_CMP_FUNC_VARS;

	if (zend_parse_parameters(ZEND_NUM_ARGS(), "+f", &args, &argc, &fci, &fci_cache) == FAILURE) {
		RETURN_THROWS();
	}

	for (i = 0; i < argc; i++) {
		if (Z_TYPE(args[i]) != IS_ARRAY) {
			zend_argument_type_error(i + 1, "must be of type array, %s given", zend_zval_value_name(&args[i]));
			RETURN_THROWS();
		}
	}

	ht0 = Z_ARRVAL(args[0]);
	n0 = zend_hash_num_elements(ht0);

	/* Empty first argument: nothing survives, and no callback is needed. */
	if (n0 == 0) {
		RETURN_EMPTY_ARRAY();
	}

	/* If every other argument is empty (or there are none), every element of
	 * args[0] survives; return a copy without invoking the comparator. */
	n_other_total = 0;
	for (i = 1; i < argc; i++) {
		n_other_total += zend_hash_num_elements(Z_ARRVAL(args[i]));
	}
	if (n_other_total == 0) {
		ZVAL_COPY(return_value, &args[0]);
		return;
	}

	PHP_ARRAY_CMP_FUNC_BACKUP();
	ALPHAG(user_compare_fci) = fci;
	ALPHAG(user_compare_fci_cache) = fci_cache;

	if (n0 == 1) {
		/* Single-element args[0]: scan each other array linearly for the one
		 * value, skipping the O(M log M) sort entirely. */
		bool found = false;

		val = NULL;
		ZEND_HASH_FOREACH_VAL(ht0, val) {
			break;
		} ZEND_HASH_FOREACH_END();

		if (!val) {
			/* n0 == 1 but no live element (should not happen): empty result. */
			RETVAL_EMPTY_ARRAY();
			goto done;
		}

		for (i = 1; i < argc && !found; i++) {
			HashTable *h = Z_ARRVAL(args[i]);
			ZEND_HASH_FOREACH_VAL(h, other) {
				if (php_array_udiff_alpha_cmp_zval(val, other) == 0) {
					found = true;
					break;
				}
			} ZEND_HASH_FOREACH_END();
		}

		if (found) {
			RETVAL_EMPTY_ARRAY();
		} else {
			ZVAL_COPY(return_value, &args[0]);
		}
		goto done;
	}

	/* General path: sort each other argument once, appending an UNDEF sentinel
	 * so the same sorted lists serve both the binary-search path and the
	 * merge-sweep path. The sentinel lets the merge sweep test
	 * Z_TYPE(ptrs[i]->val) != IS_UNDEF without a separate count; the binary
	 * path is bounded by sizes[i] and ignores the extra slot. */
	lists = safe_emalloc(argc, sizeof(Bucket *), 0);
	sizes = safe_emalloc(argc, sizeof(uint32_t), 0);
	lists[0] = NULL;
	sizes[0] = 0;
	n_other_nonempty = 0;
	max_other = 0;
	for (i = 1; i < argc; i++) {
		ht = Z_ARRVAL(args[i]);
		uint32_t n = zend_hash_num_elements(ht);
		sizes[i] = n;
		if (n > 0) {
			n_other_nonempty++;
			if (n > max_other) {
				max_other = n;
			}
		}
		Bucket *list = (Bucket *) pemalloc((n + 1) * sizeof(Bucket), GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
		Bucket *lp = list;
		if (HT_IS_PACKED(ht)) {
			zval *zv = ht->arPacked;
			uint32_t k;
			for (k = 0; k < ht->nNumUsed; k++, zv++) {
				if (Z_TYPE_P(zv) == IS_UNDEF) {
					continue;
				}
				ZVAL_COPY_VALUE(&lp->val, zv);
				lp->h = k;
				lp->key = NULL;
				lp++;
			}
		} else {
			Bucket *p = ht->arData;
			uint32_t k;
			for (k = 0; k < ht->nNumUsed; k++, p++) {
				if (Z_TYPE(p->val) == IS_UNDEF) {
					continue;
				}
				*lp++ = *p;
			}
		}
		ZVAL_UNDEF(&list[n].val);
		if (n > 1) {
			zend_sort((void *) list, n, sizeof(Bucket),
				(compare_func_t) php_array_user_compare_unstable,
				(swap_func_t) zend_hash_bucket_swap);
		}
		lists[i] = list;
	}

	/* Adaptive gate. Binary search wins iff its per-element cost
	 * k*log2(max_other+1) is below the baseline sort-merge per-element cost
	 * ~c*log2(n0)+2 (c~0.67 measured for zend_sort; the merge pass is ~2n0).
	 * Using a conservative baseline estimate (c=0.5) and squaring to clear
	 * the fraction, binary is chosen iff (max_other+1)^(2k) < 16*n0. The
	 * power is computed with an overflow/exceed guard so it falls back to
	 * the merge path the moment it would pass 16*n0. This keeps the wins
	 * (large args[0] vs small others, duplicate-heavy args[0]) and never
	 * regresses: when the gate does not fire, the merge path is the exact
	 * baseline algorithm. */
	use_binary = false;
	if (n_other_nonempty > 0) {
		uint64_t limit = 16 * (uint64_t) n0;
		uint64_t base = (uint64_t) max_other + 1;
		uint64_t pow = 1;
		uint32_t exp = 2 * n_other_nonempty;
		uint32_t e;
		use_binary = true;
		for (e = 0; e < exp; e++) {
			if (pow > limit / base) {
				use_binary = false;
				break;
			}
			pow *= base;
		}
		if (use_binary && pow >= limit) {
			use_binary = false;
		}
	}

	if (use_binary) {
		/* Binary-search path: walk args[0] in original order, binary-search
		 * each sorted other array, build the result incrementally (only
		 * survivors, original keys/order preserved). */
		array_init_size(return_value, n0);
		needle.h = 0;
		needle.key = NULL;
		if (HT_IS_PACKED(ht0)) {
			zval *p = ht0->arPacked;
			uint32_t k;
			for (k = 0; k < ht0->nNumUsed; k++, p++) {
				if (Z_TYPE_P(p) == IS_UNDEF) {
					continue;
				}
				ZVAL_COPY_VALUE(&needle.val, p);
				bool found = false;
				for (i = 1; i < argc; i++) {
					if (sizes[i] != 0 && php_array_udiff_alpha_contains(lists[i], sizes[i], &needle)) {
						found = true;
						break;
					}
				}
				if (!found) {
					val = zend_hash_index_add_new(Z_ARRVAL_P(return_value), k, p);
					zval_add_ref(val);
				}
			}
		} else {
			ZEND_HASH_FOREACH_KEY_VAL(ht0, idx, key, val) {
				ZVAL_COPY_VALUE(&needle.val, val);
				bool found = false;
				for (i = 1; i < argc; i++) {
					if (sizes[i] != 0 && php_array_udiff_alpha_contains(lists[i], sizes[i], &needle)) {
						found = true;
						break;
					}
				}
				if (!found) {
					if (key) {
						val = zend_hash_add_new(Z_ARRVAL_P(return_value), key, val);
					} else {
						val = zend_hash_index_add_new(Z_ARRVAL_P(return_value), idx, val);
					}
					zval_add_ref(val);
				}
			} ZEND_HASH_FOREACH_END();
		}
	} else {
		/* Merge path: the baseline sort-merge algorithm for the cases where
		 * N binary searches would cost more. Sort args[0] too, duplicate it
		 * as the result, then sweep the sorted lists and delete matches.
		 * This is the DIFF_NORMAL + DIFF_COMP_DATA_USER branch of
		 * php_array_diff() with the unreachable ASSOC/KEY branches removed;
		 * php_array_diff() itself is untouched. */
		Bucket *list0, *lp0, **ptrs, *bp;
		Bucket *src;
		zval *zv;
		int c;
		uint32_t k;

		list0 = (Bucket *) pemalloc((n0 + 1) * sizeof(Bucket), GC_FLAGS(ht0) & IS_ARRAY_PERSISTENT);
		lp0 = list0;
		if (HT_IS_PACKED(ht0)) {
			zv = ht0->arPacked;
			for (k = 0; k < ht0->nNumUsed; k++, zv++) {
				if (Z_TYPE_P(zv) == IS_UNDEF) {
					continue;
				}
				ZVAL_COPY_VALUE(&lp0->val, zv);
				lp0->h = k;
				lp0->key = NULL;
				lp0++;
			}
		} else {
			src = ht0->arData;
			for (k = 0; k < ht0->nNumUsed; k++, src++) {
				if (Z_TYPE(src->val) == IS_UNDEF) {
					continue;
				}
				*lp0++ = *src;
			}
		}
		ZVAL_UNDEF(&list0[n0].val);
		if (n0 > 1) {
			zend_sort((void *) list0, n0, sizeof(Bucket),
				(compare_func_t) php_array_user_compare_unstable,
				(swap_func_t) zend_hash_bucket_swap);
		}

		ptrs = safe_emalloc(argc, sizeof(Bucket *), 0);
		ptrs[0] = list0;
		for (i = 1; i < argc; i++) {
			ptrs[i] = lists[i];
		}

		RETVAL_ARR(zend_array_dup(Z_ARRVAL(args[0])));

		/* Go through the lists and delete from the result every args[0]
		 * value that is present in any other argument. */
		while (Z_TYPE(ptrs[0]->val) != IS_UNDEF) {
			c = 1;
			for (i = 1; i < argc; i++) {
				while (Z_TYPE(ptrs[i]->val) != IS_UNDEF
					   && (0 < (c = php_array_user_compare_unstable(ptrs[0], ptrs[i])))) {
					ptrs[i]++;
				}
				if (!c) {
					if (Z_TYPE(ptrs[i]->val) != IS_UNDEF) {
						ptrs[i]++;
					}
					break;
				}
			}
			if (!c) {
				/* ptrs[0] is in another argument: delete all entries with
				 * the same value from the result. */
				for (;;) {
					bp = ptrs[0];
					if (bp->key == NULL) {
						zend_hash_index_del(Z_ARRVAL_P(return_value), bp->h);
					} else {
						zend_hash_del(Z_ARRVAL_P(return_value), bp->key);
					}
					if (Z_TYPE((++ptrs[0])->val) == IS_UNDEF) {
						goto out_merge;
					}
					if (php_array_user_compare_unstable(ptrs[0] - 1, ptrs[0])) {
						break;
					}
				}
			} else {
				/* ptrs[0] is in none: skip all entries with the same value. */
				for (;;) {
					if (Z_TYPE((++ptrs[0])->val) == IS_UNDEF) {
						goto out_merge;
					}
					if (php_array_user_compare_unstable(ptrs[0] - 1, ptrs[0])) {
						break;
					}
				}
			}
		}
out_merge:
		efree(ptrs);
		pefree(list0, GC_FLAGS(ht0) & IS_ARRAY_PERSISTENT);
	}

	for (i = 1; i < argc; i++) {
		if (lists[i]) {
			ht = Z_ARRVAL(args[i]);
			pefree(lists[i], GC_FLAGS(ht) & IS_ARRAY_PERSISTENT);
		}
	}
	efree(sizes);
	efree(lists);

done:
	PHP_ARRAY_CMP_FUNC_RESTORE();
}
/* }}} */

/* {{{ Returns the entries of arr1 that have values which are not present in any of the others arguments. Elements are compared by user supplied function. */

/* ===== array_udiff_alpha (array.c 11398-11404) ===== */

PHP_FUNCTION(array_udiff_alpha)
{
	php_array_udiff_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ Returns the entries of arr1 that have values which are not present in any of the others arguments but do additional checks whether the keys are equal */

/* ===== array_diff_assoc_alpha (array.c 11412-11418) ===== */

PHP_FUNCTION(array_diff_assoc_alpha)
{
	php_array_diff_key_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ Returns the entries of arr1 that have keys which are not present in any of the others arguments. Key-only fast-path _alpha sibling of array_diff_key(). */

/* ===== array_diff_key_alpha (array.c 11419-11425) ===== */

PHP_FUNCTION(array_diff_key_alpha)
{
	php_array_diff_key_only_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU);
}
/* }}} */

/* {{{ Returns the entries of arr1 that have values which are not present in any of the others arguments but do additional checks whether the keys are equal. Elements are compared by user supplied function. */

/* ===== MULTISORTdefines (array.c 11446-11448) ===== */

#define MULTISORT_ORDER	0
#define MULTISORT_TYPE	1
#define MULTISORT_LAST	2

/* ===== php_multisort_compare_alpha (array.c 11450-11469) ===== */

static int php_multisort_compare_alpha(const void *a, const void *b) /* {{{ */
{
	Bucket *ab = *(Bucket **)a;
	Bucket *bb = *(Bucket **)b;
	int r;
	zend_long result;

	r = 0;
	do {
		result = ALPHAG(multisort_func)[r](&ab[r], &bb[r]);
		if (result != 0) {
			return result > 0 ? 1 : -1;
		}
		r++;
	} while (Z_TYPE(ab[r].val) != IS_UNDEF);

	return stable_sort_fallback(&ab[r], &bb[r]);
}
/* }}} */


/* ===== MULTISORT_ABORT (array.c 11470-11474) ===== */

#define MULTISORT_ABORT				\
	efree(func);	\
	efree(arrays);					\
	return;


/* ===== array_bucket_p_sawp (array.c 11475-11486) ===== */

static void array_bucket_p_sawp(void *p, void *q) /* {{{ */ {
	Bucket *t;
	Bucket **f = (Bucket **)p;
	Bucket **g = (Bucket **)q;

	t = *f;
	*f = *g;
	*g = t;
}
/* }}} */

/* {{{ Sort multiple arrays at once similar to how ORDER BY clause works in SQL */

/* ===== array_multisort_alpha (array.c 11701-11925) ===== */

PHP_FUNCTION(array_multisort_alpha)
{
	zval*			args;
	zval**			arrays;
	HashTable**		hashes;
	Bucket**		indirect;
	uint32_t		idx;
	HashTable*		hash;
	uint32_t		argc;
	uint32_t		array_size;
	uint32_t		num_arrays = 0;
	int				parse_state[MULTISORT_LAST];   /* 0 - flag not allowed 1 - flag allowed */
	int				sort_order = PHP_SORT_ASC;
	int				sort_type  = PHP_SORT_REGULAR;
	uint32_t		i, k, n;
	bucket_compare_func_t *func;

	ZEND_PARSE_PARAMETERS_START(1, -1)
		Z_PARAM_VARIADIC('+', args, argc)
	ZEND_PARSE_PARAMETERS_END();

	/* Allocate space for storing pointers to input arrays and sort flags. */
	arrays = (zval **)ecalloc(argc, sizeof(zval *));
	for (i = 0; i < MULTISORT_LAST; i++) {
		parse_state[i] = 0;
	}
	func = ecalloc(argc, sizeof(bucket_compare_func_t));

	/* Here we go through the input arguments and parse them. Each one can
	 * be either an array or a sort flag which follows an array. If not
	 * specified, the sort flags defaults to PHP_SORT_ASC and PHP_SORT_REGULAR
	 * accordingly. There can't be two sort flags of the same type after an
	 * array, and the very first argument has to be an array. */
	for (i = 0; i < argc; i++) {
		zval *arg = &args[i];

		ZVAL_DEREF(arg);
		if (Z_TYPE_P(arg) == IS_ARRAY) {
			SEPARATE_ARRAY(arg);
			/* We see the next array, so we update the sort flags of
			 * the previous array and reset the sort flags. */
			if (i > 0) {
				func[num_arrays - 1] = php_get_data_compare_func_unstable(sort_type, sort_order != PHP_SORT_ASC);
				sort_order = PHP_SORT_ASC;
				sort_type = PHP_SORT_REGULAR;
			}
			arrays[num_arrays++] = arg;

			/* Next one may be an array or a list of sort flags. */
			for (k = 0; k < MULTISORT_LAST; k++) {
				parse_state[k] = 1;
			}
		} else if (Z_TYPE_P(arg) == IS_LONG) {
			switch (Z_LVAL_P(arg) & ~PHP_SORT_FLAG_CASE) {
				case PHP_SORT_ASC:
				case PHP_SORT_DESC:
					/* flag allowed here */
					if (parse_state[MULTISORT_ORDER] == 1) {
						/* Save the flag and make sure then next arg is not the current flag. */
						sort_order = Z_LVAL_P(arg) == PHP_SORT_DESC ? PHP_SORT_DESC : PHP_SORT_ASC;
						parse_state[MULTISORT_ORDER] = 0;
					} else {
						zend_argument_type_error(i + 1, "must be an array or a sort flag that has not already been specified");
						MULTISORT_ABORT;
					}
					break;

				case PHP_SORT_REGULAR:
				case PHP_SORT_NUMERIC:
				case PHP_SORT_STRING:
				case PHP_SORT_NATURAL:
				case PHP_SORT_LOCALE_STRING:
					/* flag allowed here */
					if (parse_state[MULTISORT_TYPE] == 1) {
						/* Save the flag and make sure then next arg is not the current flag. */
						sort_type = (int)Z_LVAL_P(arg);
						parse_state[MULTISORT_TYPE] = 0;
					} else {
						zend_argument_type_error(i + 1, "must be an array or a sort flag that has not already been specified");
						MULTISORT_ABORT;
					}
					break;

				default:
					zend_argument_value_error(i + 1, "must be a valid sort flag");
					MULTISORT_ABORT;
					break;

			}
		} else {
			zend_argument_type_error(i + 1, "must be an array or a sort flag");
			MULTISORT_ABORT;
		}
	}

	/* Make sure the arrays are of the same size. */
	array_size = zend_hash_num_elements(Z_ARRVAL_P(arrays[0]));
	for (i = 1; i < num_arrays; i++) {
		if (zend_hash_num_elements(Z_ARRVAL_P(arrays[i])) != array_size) {
			zend_value_error("Array sizes are inconsistent");
			MULTISORT_ABORT;
		}
	}

	/* If all arrays are empty we don't need to do anything. */
	if (array_size < 1) {
		efree(func);
		efree(arrays);
		RETURN_TRUE;
	}

	/* Take care of the last array sort flags. */
	func[num_arrays - 1] = php_get_data_compare_func_unstable(sort_type, sort_order != PHP_SORT_ASC);
	bucket_compare_func_t *old_multisort_func = ALPHAG(multisort_func);
	ALPHAG(multisort_func) = func;

	/* Create the indirection array. This array is of size MxN, where
	 * M is the number of entries in each input array and N is the number
	 * of the input arrays + 1. The last column is UNDEF to indicate the end
	 * of the row. It also stores the original position for stable sorting. */
	indirect = (Bucket **)safe_emalloc(array_size, sizeof(Bucket *), 0);
	/* Move num_arrays multiplication to size because it's essentially impossible to overflow. */
	Bucket *indirects = (Bucket *)safe_emalloc(array_size, sizeof(Bucket) * (num_arrays + 1), 0);
	for (i = 0; i < array_size; i++) {
		indirect[i] = indirects + (i * (num_arrays + 1));
	}
	hashes = safe_emalloc(num_arrays, sizeof(HashTable *), 0);
	for (i = 0; i < num_arrays; i++) {
		hashes[i] = Z_ARRVAL_P(arrays[i]);
		GC_ADDREF(hashes[i]);
		HT_ALLOW_COW_VIOLATION(hashes[i]);
	}
	for (i = 0; i < num_arrays; i++) {
		k = 0;
		if (HT_IS_PACKED(hashes[i])) {
			if (HT_IS_WITHOUT_HOLES(hashes[i])) {
				/* Packed, hole-free fast path: nNumUsed == nNumOfElements ==
				 * array_size and there are no UNDEF slots in [0, nNumUsed), so
				 * the output row index k tracks idx exactly and the per-element
				 * IS_UNDEF check (which can never fire) can be dropped. The
				 * matrix row is written directly at indirect[idx][i]. */
				zval *zv = hashes[i]->arPacked;
				for (idx = 0; idx < array_size; idx++, zv++) {
					ZVAL_COPY_VALUE(&indirect[idx][i].val, zv);
					indirect[idx][i].h = idx;
					indirect[idx][i].key = NULL;
				}
				continue;
			}
			zval *zv = hashes[i]->arPacked;
			for (idx = 0; idx < hashes[i]->nNumUsed; idx++, zv++) {
				if (Z_TYPE_P(zv) == IS_UNDEF) continue;
				ZVAL_COPY_VALUE(&indirect[k][i].val, zv);
				indirect[k][i].h = idx;
				indirect[k][i].key = NULL;
				k++;
			}
		} else {
			Bucket *p = hashes[i]->arData;
			for (idx = 0; idx < hashes[i]->nNumUsed; idx++, p++) {
				if (Z_TYPE(p->val) == IS_UNDEF) continue;
				indirect[k][i] = *p;
				k++;
			}
		}
	}
	for (k = 0; k < array_size; k++) {
		ZVAL_UNDEF(&indirect[k][num_arrays].val);
		Z_EXTRA_P(&indirect[k][num_arrays].val) = k;
	}

	/* Do the actual sort magic - bada-bim, bada-boom. */
	zend_sort(indirect, array_size, sizeof(Bucket *), php_multisort_compare_alpha, (swap_func_t)array_bucket_p_sawp);
	if (EG(exception)) {
		goto clean_up;
	}

	/* Restructure the arrays based on sorted indirect - this is mostly taken from zend_hash_sort() function. */
	for (i = 0; i < num_arrays; i++) {
		hash = hashes[i];
		hash->nNumUsed = array_size;
		hash->nNextFreeElement = array_size;
		hash->nInternalPointer = 0;
		if (HT_IS_PACKED(hash)) {
			for (k = 0; k < array_size; k++) {
				ZVAL_COPY_VALUE(&hash->arPacked[k], &indirect[k][i].val);
			}
		} else {
			bool repack = true;

			for (n = 0, k = 0; k < array_size; k++) {
				hash->arData[k] = indirect[k][i];
				if (hash->arData[k].key == NULL) {
					hash->arData[k].h = n++;
				} else {
					repack = false;
				}
			}
			if (repack) {
				zend_hash_to_packed(hash);
			} else {
				zend_hash_rehash(hash);
			}
		}
	}
	RETVAL_TRUE;

	clean_up:
	for (i = 0; i < num_arrays; i++) {
		if (UNEXPECTED(GC_DELREF(hashes[i]) == 0)) {
			zend_array_destroy(hashes[i]);
		} else {
			gc_check_possible_root((zend_refcounted *)hashes[i]);
		}
	}
	efree(hashes);
	efree(indirects);
	efree(indirect);
	efree(func);
	efree(arrays);
	ALPHAG(multisort_func) = old_multisort_func;
}
/* }}} */

/* {{{ php_array_pick_keys */

/* ===== php_array_binop_apply (array.c 12100-12139) ===== */

static zend_always_inline void php_array_binop_apply(
		zval *return_value, zval *entry, const char *op_name, binary_op_type op)
{
	/* For objects we try to cast them to a numeric type */
	if (Z_TYPE_P(entry) == IS_OBJECT) {
		zval dst;
		zend_result status = Z_OBJ_HT_P(entry)->cast_object(Z_OBJ_P(entry), &dst, _IS_NUMBER);

		/* Do not type error for BC */
		if (status == FAILURE || (Z_TYPE(dst) != IS_LONG && Z_TYPE(dst) != IS_DOUBLE)) {
			php_error_docref(NULL, E_WARNING, "%s is not supported on type %s",
				op_name, zend_zval_type_name(entry));
			return;
		}
		op(return_value, return_value, &dst);
		return;
	}

	zend_result status = op(return_value, return_value, entry);
	if (status == FAILURE) {
		ZEND_ASSERT(EG(exception));
		zend_clear_exception();
		/* BC resources: previously resources were cast to int */
		if (Z_TYPE_P(entry) == IS_RESOURCE) {
			zval tmp;
			ZVAL_LONG(&tmp, Z_RES_HANDLE_P(entry));
			op(return_value, return_value, &tmp);
		}
		/* BC non numeric strings: previously were cast to 0 */
		else if (Z_TYPE_P(entry) == IS_STRING) {
			zval tmp;
			ZVAL_LONG(&tmp, 0);
			op(return_value, return_value, &tmp);
		}
		php_error_docref(NULL, E_WARNING, "%s is not supported on type %s",
			op_name, zend_zval_type_name(entry));
	}
}

/* Wrapper for array_sum and array_product */

/* ===== _php_array_binop_alpha (array.c 12247-12423) ===== */

static zend_always_inline void _php_array_binop_alpha(
		INTERNAL_FUNCTION_PARAMETERS, const char *op_name,
		binary_op_type op, zend_long initial)
{
	HashTable *input;

	ZEND_PARSE_PARAMETERS_START(1, 1)
		Z_PARAM_ARRAY_HT(input)
	ZEND_PARSE_PARAMETERS_END();

	if (zend_hash_num_elements(input) == 0) {
		RETURN_LONG(initial);
	}

	ZVAL_LONG(return_value, initial);

	if (EXPECTED(HT_IS_PACKED(input))) {
		uint32_t i, n = input->nNumUsed;
		zval *e = input->arPacked;

		/* Phase 1: LONG accumulator. Runs while the accumulator stays
		 * IS_LONG, so the common all-int-no-overflow case completes in a
		 * loop whose body is byte-for-byte the original alpha's fast path
		 * — no DOUBLE-accumulator code in line to bloat the hot path. The
		 * moment a factor promotes the accumulator to DOUBLE (LONG/LONG
		 * overflow, a DOUBLE entry, or an object that casts to a number),
		 * the loop condition fails at the next re-check and phase 2 picks
		 * up at the following element. */
		for (i = 0; i < n && Z_TYPE_P(return_value) == IS_LONG; i++, e++) {
			/* Match ZEND_HASH_FOREACH_VAL's per-iteration IS_UNDEF skip:
			 * unset() leaves an IS_UNDEF slot in arPacked which the
			 * baseline loop silently skips (and which
			 * php_array_binop_apply would assert on if reached). */
			if (UNEXPECTED(Z_TYPE_P(e) == IS_UNDEF)) {
				continue;
			}
			if (EXPECTED(Z_TYPE_P(e) == IS_LONG)) {
				if (op == add_function) {
					fast_long_add_function(return_value, return_value, e);
				} else {
					zend_long lval, overflow;
					double dval;
					ZEND_SIGNED_MULTIPLY_LONG(
						Z_LVAL_P(return_value), Z_LVAL_P(e),
						lval, dval, overflow);
					if (UNEXPECTED(overflow)) {
						ZVAL_DOUBLE(return_value, dval);
					} else {
						Z_LVAL_P(return_value) = lval;
					}
				}
			} else if (Z_TYPE_P(e) == IS_DOUBLE) {
				/* Promote the LONG accumulator to DOUBLE; mirrors
				 * mul_function_fast/add_function_fast's
				 * TYPE_PAIR(IS_LONG, IS_DOUBLE). The RHS reads the old
				 * lval before ZVAL_DOUBLE overwrites it; the loop
				 * condition then exits to phase 2. */
				if (op == add_function) {
					ZVAL_DOUBLE(return_value,
						(double)Z_LVAL_P(return_value) + Z_DVAL_P(e));
				} else {
					ZVAL_DOUBLE(return_value,
						(double)Z_LVAL_P(return_value) * Z_DVAL_P(e));
				}
			} else {
				/* Object/resource/string/etc. The accumulator may stay
				 * LONG (string->0, resource->handle) or promote to
				 * DOUBLE (object casting to a number); the loop
				 * condition re-checks and either continues phase 1 or
				 * exits to phase 2. */
				php_array_binop_apply(return_value, e, op_name, op);
			}
		}

		/* Phase 2: DOUBLE accumulator. Reached only after a promotion, so
		 * the accumulator is IS_DOUBLE for the rest of the array. The op
		 * is kept inline so an all-float array (or a long array that
		 * overflowed) no longer pays one indirect mul_function /
		 * add_function call per element. Mirrors
		 * mul_function_fast/add_function_fast's DOUBLE/DOUBLE and
		 * DOUBLE/LONG arms. The accumulator stays DOUBLE for the whole
		 * phase: DOUBLE <op> any numeric is DOUBLE, and the non-numeric
		 * fallback (php_array_binop_apply) casts to a long and multiplies
		 * it into the double, which also stays DOUBLE — so this loop never
		 * falls back to phase 1. */
		for (; i < n; i++, e++) {
			if (UNEXPECTED(Z_TYPE_P(e) == IS_UNDEF)) {
				continue;
			}
			if (Z_TYPE_P(e) == IS_LONG) {
				if (op == add_function) {
					Z_DVAL_P(return_value) += (double)Z_LVAL_P(e);
				} else {
					Z_DVAL_P(return_value) *= (double)Z_LVAL_P(e);
				}
			} else if (Z_TYPE_P(e) == IS_DOUBLE) {
				if (op == add_function) {
					Z_DVAL_P(return_value) += Z_DVAL_P(e);
				} else {
					Z_DVAL_P(return_value) *= Z_DVAL_P(e);
				}
			} else {
				php_array_binop_apply(return_value, e, op_name, op);
			}
		}
		return;
	}

	{
		/* Same two-phase structure as the packed path, but iterating the
		 * non-packed arData Bucket array directly (what ZEND_HASH_FOREACH_VAL
		 * compiles to) so phase 1 can exit to phase 2 on promotion. The
		 * bucket loop skips IS_UNDEF holes, matching the macro. */
		uint32_t i, n = input->nNumUsed;
		Bucket *b = input->arData;
		zval *e;

		/* Phase 1: LONG accumulator. */
		for (i = 0; i < n && Z_TYPE_P(return_value) == IS_LONG; i++, b++) {
			e = &b->val;
			if (UNEXPECTED(Z_TYPE_P(e) == IS_UNDEF)) {
				continue;
			}
			if (EXPECTED(Z_TYPE_P(e) == IS_LONG)) {
				if (op == add_function) {
					fast_long_add_function(return_value, return_value, e);
				} else {
					zend_long lval, overflow;
					double dval;
					ZEND_SIGNED_MULTIPLY_LONG(
						Z_LVAL_P(return_value), Z_LVAL_P(e),
						lval, dval, overflow);
					if (UNEXPECTED(overflow)) {
						ZVAL_DOUBLE(return_value, dval);
					} else {
						Z_LVAL_P(return_value) = lval;
					}
				}
			} else if (Z_TYPE_P(e) == IS_DOUBLE) {
				if (op == add_function) {
					ZVAL_DOUBLE(return_value,
						(double)Z_LVAL_P(return_value) + Z_DVAL_P(e));
				} else {
					ZVAL_DOUBLE(return_value,
						(double)Z_LVAL_P(return_value) * Z_DVAL_P(e));
				}
			} else {
				php_array_binop_apply(return_value, e, op_name, op);
			}
		}

		/* Phase 2: DOUBLE accumulator. */
		for (; i < n; i++, b++) {
			e = &b->val;
			if (UNEXPECTED(Z_TYPE_P(e) == IS_UNDEF)) {
				continue;
			}
			if (Z_TYPE_P(e) == IS_LONG) {
				if (op == add_function) {
					Z_DVAL_P(return_value) += (double)Z_LVAL_P(e);
				} else {
					Z_DVAL_P(return_value) *= (double)Z_LVAL_P(e);
				}
			} else if (Z_TYPE_P(e) == IS_DOUBLE) {
				if (op == add_function) {
					Z_DVAL_P(return_value) += Z_DVAL_P(e);
				} else {
					Z_DVAL_P(return_value) *= Z_DVAL_P(e);
				}
			} else {
				php_array_binop_apply(return_value, e, op_name, op);
			}
		}
	}
}

/* {{{ Returns the sum of the array entries (alpha: HT_IS_PACKED fast path) */

/* ===== array_sum_alpha (array.c 12424-12431) ===== */

PHP_FUNCTION(array_sum_alpha)
{
	_php_array_binop_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU,
		"Addition", add_function, 0);
}
/* }}} */

/* {{{ Returns the product of the array entries (alpha: HT_IS_PACKED fast path) */

/* ===== array_product_alpha (array.c 12432-12439) ===== */

PHP_FUNCTION(array_product_alpha)
{
	_php_array_binop_alpha(INTERNAL_FUNCTION_PARAM_PASSTHRU,
		"Multiplication", mul_function, 1);
}
/* }}} */

/* {{{ Iteratively reduce the array to a single value via the callback. */

/* ===== array_key_exists_alpha (array.c 12979-13042) ===== */

PHP_FUNCTION(array_key_exists_alpha)
{
	zval *key;
	HashTable *ht;
	zend_ulong hval;
	zval *zv;

	ZEND_PARSE_PARAMETERS_START(2, 2)
		Z_PARAM_ZVAL(key)
		Z_PARAM_ARRAY_HT(ht)
	ZEND_PARSE_PARAMETERS_END();

	switch (Z_TYPE_P(key)) {
		case IS_LONG:
			hval = Z_LVAL_P(key);
num_key:
			if (HT_IS_PACKED(ht)) {
				/* inlined packed index lookup (mirrors ZEND_HASH_INDEX_FIND) */
				if (EXPECTED(hval < (zend_ulong) ht->nNumUsed)) {
					zv = ht->arPacked + hval;
					if (EXPECTED(Z_TYPE_P(zv) != IS_UNDEF)) {
						RETURN_TRUE;
					}
				}
				RETURN_FALSE;
			}
			RETURN_BOOL(zend_hash_index_exists(ht, hval));
		case IS_STRING:
			if (ZEND_HANDLE_NUMERIC(Z_STR_P(key), hval)) {
				goto num_key; /* "42" -> integer key 42 */
			}
			/* non-numeric string: a packed array cannot hold string keys */
			if (HT_IS_PACKED(ht)) {
				RETURN_FALSE;
			}
			RETURN_BOOL(zend_hash_exists(ht, Z_STR_P(key)));
		case IS_NULL:
#if PHP_VERSION_ID >= 80600
			zend_error(E_DEPRECATED, "Using null as the key parameter for array_key_exists() is deprecated, use an empty string instead");
#endif
			/* empty string on a packed array: cannot exist */
			if (HT_IS_PACKED(ht)) {
				RETURN_FALSE;
			}
			RETURN_BOOL(zend_hash_exists(ht, ZSTR_EMPTY_ALLOC()));
		case IS_DOUBLE:
			hval = zend_dval_to_lval_safe(Z_DVAL_P(key));
			goto num_key;
		case IS_FALSE:
			hval = 0;
			goto num_key;
		case IS_TRUE:
			hval = 1;
			goto num_key;
		case IS_RESOURCE:
			zend_use_resource_as_offset(key);
			hval = Z_RES_HANDLE_P(key);
			goto num_key;
		default:
			zend_argument_type_error(1, "must be a valid array offset type");
			break;
	}
}
/* }}} */

/* {{{ Split array into chunks */

/* ===== array_chunk_alpha (array.c 13112-13211) ===== */

PHP_FUNCTION(array_chunk_alpha)
{
	int num_in;
	zend_long size, current = 0;
	zend_string *str_key;
	zend_ulong num_key;
	bool preserve_keys = 0;
	zval *input = NULL;
	zval chunk;
	zval *entry;

	ZEND_PARSE_PARAMETERS_START(2, 3)
		Z_PARAM_ARRAY(input)
		Z_PARAM_LONG(size)
		Z_PARAM_OPTIONAL
		Z_PARAM_BOOL(preserve_keys)
	ZEND_PARSE_PARAMETERS_END();

	/* Do bounds checking for size parameter. */
	if (size < 1) {
		zend_argument_value_error(2, "must be greater than 0");
		RETURN_THROWS();
	}

	num_in = zend_hash_num_elements(Z_ARRVAL_P(input));

	if (size > num_in) {
		if (num_in == 0) {
			RETURN_EMPTY_ARRAY();
		}
		size = num_in;
	}

	array_init_size(return_value, (uint32_t)(((num_in - 1) / size) + 1));
	zend_hash_real_init_packed(Z_ARRVAL_P(return_value));

	/* Fast path: packed input without holes and keys not preserved. The
	 * input's arPacked is a contiguous run of live zvals, and every chunk
	 * is a 0-based packed array, so each chunk is a straight fill of `size`
	 * elements. No IS_UNDEF skip is needed (HT_IS_WITHOUT_HOLES guarantees
	 * nNumUsed == nNumOfElements and no gaps). Refs are kept as refs
	 * (matching the original zval_add_ref() semantics; we deliberately do
	 * NOT do array_slice's refcount==1 ref-unwrap). */
	HashTable *in = Z_ARRVAL_P(input);
	if (!preserve_keys && HT_IS_PACKED(in) && HT_IS_WITHOUT_HOLES(in)) {
		zval *src = in->arPacked;
		uint32_t total = in->nNumUsed;
		uint32_t step = (uint32_t)size;
		uint32_t start;

		for (start = 0; start < total; start += step) {
			uint32_t chunk_size = total - start;
			if (chunk_size > step) {
				chunk_size = step;
			}

			array_init_size(&chunk, chunk_size);
			add_next_index_zval(return_value, &chunk);
			zend_hash_real_init_packed(Z_ARRVAL(chunk));

			ZEND_HASH_FILL_PACKED(Z_ARRVAL(chunk)) {
				zval *p = src + start;
				zval *end = p + chunk_size;
				for (; p != end; p++) {
					Z_TRY_ADDREF_P(p);
					ZEND_HASH_FILL_ADD(p);
				}
			} ZEND_HASH_FILL_END();
		}
		return;
	}

	/* Generic fallback: identical to the original array_chunk() loop. */
	ZEND_HASH_FOREACH_KEY_VAL(Z_ARRVAL_P(input), num_key, str_key, entry) {
		/* If new chunk, create and initialize it. */
		if (current == 0) {
			array_init_size(&chunk, (uint32_t)size);
			add_next_index_zval(return_value, &chunk);
		}

		/* Add entry to the chunk, preserving keys if necessary. */
		if (preserve_keys) {
			if (str_key) {
				entry = zend_hash_add_new(Z_ARRVAL(chunk), str_key, entry);
			} else {
				entry = zend_hash_index_add_new(Z_ARRVAL(chunk), num_key, entry);
			}
		} else {
			entry = zend_hash_next_index_insert(Z_ARRVAL(chunk), entry);
		}
		zval_add_ref(entry);

		if (++current == size) {
			current = 0;
		}
	} ZEND_HASH_FOREACH_END();
}
/* }}} */

/* {{{ Creates an array by using the elements of the first parameter as keys and the elements of the second as the corresponding values */

/* ===== array_combine_alpha (array.c 13277-13411) ===== */

PHP_FUNCTION(array_combine_alpha)
{
	HashTable *values, *keys;
	int num_keys, num_values;

	ZEND_PARSE_PARAMETERS_START(2, 2)
		Z_PARAM_ARRAY_HT(keys)
		Z_PARAM_ARRAY_HT(values)
	ZEND_PARSE_PARAMETERS_END();

	num_keys = zend_hash_num_elements(keys);
	num_values = zend_hash_num_elements(values);

	if (num_keys != num_values) {
		zend_argument_value_error(1, "and argument #2 ($values) must have the same number of elements");
		RETURN_THROWS();
	}

	if (!num_keys) {
		RETURN_EMPTY_ARRAY();
	}

	array_init_size(return_value, num_keys);

	/* Fast path: both operands packed and hole-free.  nNumUsed ==
	 * nNumOfElements is the no-hole invariant, so a single raw index i over
	 * arPacked pairs the k-th key with the k-th value -- identical to the
	 * baseline's ordinal pairing, without the inner hole-skip loop. */
	if (HT_IS_PACKED(keys) && HT_IS_PACKED(values)
			&& keys->nNumUsed == (uint32_t)num_keys
			&& values->nNumUsed == (uint32_t)num_values) {
		HashTable *ret_ht = Z_ARRVAL_P(return_value);
		uint32_t n = (uint32_t)num_keys;
		zval *pk = keys->arPacked;
		zval *pv = values->arPacked;
		zend_long expected = 0;
		bool contiguous = 1;
		uint32_t i;

		/* Pre-scan the key values: detect the contiguous-0..n-1 longs shape
		 * that lets us emit a packed (list) result.  Aborts on the first
		 * non-long or out-of-sequence key, so string-keyed input is O(1).
		 *
		 * O(1) necessary-condition gate before the O(n) pre-scan: the contiguous
		 * 0..n-1 list must have first key == 0 and last key == n-1 (both IS_LONG).
		 * Duplicate-heavy, sparse, or string keys are detected here in O(1) and
		 * skip the pre-scan, so they no longer pay the pre-scan tax only to fall
		 * through to the general packed path. */
		{
			zval *k0 = (Z_TYPE_P(&pk[0]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[0]) : &pk[0];
			zval *klast = (Z_TYPE_P(&pk[n - 1]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[n - 1]) : &pk[n - 1];
			if (Z_TYPE_P(k0) != IS_LONG || Z_LVAL_P(k0) != 0
			 || Z_TYPE_P(klast) != IS_LONG || Z_LVAL_P(klast) != (zend_long)(n - 1)) {
				contiguous = 0;
			} else {
				for (i = 0; i < n; i++) {
					zval *k = (Z_TYPE_P(&pk[i]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[i]) : &pk[i];
					if (Z_TYPE_P(k) != IS_LONG || Z_LVAL_P(k) != expected) {
						contiguous = 0;
						break;
					}
					expected++;
				}
			}
		}

		if (contiguous) {
			/* Result is a list: append values packed, no hash lookup.  FILL_ADD
			 * does ZVAL_COPY_VALUE only, so addref first (same net +1 as the
			 * baseline's post-update zval_add_ref). */
			zend_hash_real_init_packed(ret_ht);
			ZEND_HASH_FILL_PACKED(ret_ht) {
				for (i = 0; i < n; i++) {
					Z_TRY_ADDREF_P(&pv[i]);
					ZEND_HASH_FILL_ADD(&pv[i]);
				}
			} ZEND_HASH_FILL_END();
		} else {
			/* General packed path: the same index/symtable update calls as the
			 * baseline, which lets zend_hash_index_update()/zend_symtable_update()
			 * lazily pick the result's representation (packed for integer keys
			 * that fit in nTableSize, mixed otherwise) exactly as array_combine()
			 * does.  Pre-initializing mixed here would diverge from the baseline
			 * (which keeps dense integer keys packed) and regress.  The savings
			 * over the baseline are the direct arPacked walk and the absence of
			 * the inner hole-skip loop. */
			for (i = 0; i < n; i++) {
				zval *k = (Z_TYPE_P(&pk[i]) == IS_REFERENCE) ? Z_REFVAL_P(&pk[i]) : &pk[i];
				zval *entry;
				if (Z_TYPE_P(k) == IS_LONG) {
					entry = zend_hash_index_update(ret_ht, Z_LVAL_P(k), &pv[i]);
				} else {
					zend_string *tmp_key;
					zend_string *key = zval_get_tmp_string(k, &tmp_key);
					entry = zend_symtable_update(ret_ht, key, &pv[i]);
					zend_tmp_string_release(tmp_key);
				}
				zval_add_ref(entry);
			}
		}
		return;
	}

	/* Fallback: identical to the original array_combine() loop for holey or
	 * associative operands. */
	{
		uint32_t pos_values = 0;
		zval *entry_keys, *entry_values;
		ZEND_HASH_FOREACH_VAL(keys, entry_keys) {
			while (1) {
				if (pos_values >= values->nNumUsed) {
					break;
				}
				entry_values = ZEND_HASH_ELEMENT(values, pos_values);
				if (Z_TYPE_P(entry_values) != IS_UNDEF) {
					if (Z_TYPE_P(entry_keys) == IS_LONG) {
						entry_values = zend_hash_index_update(Z_ARRVAL_P(return_value),
							Z_LVAL_P(entry_keys), entry_values);
					} else {
						zend_string *tmp_key;
						zend_string *key = zval_get_tmp_string(entry_keys, &tmp_key);
						entry_values = zend_symtable_update(Z_ARRVAL_P(return_value),
							key, entry_values);
						zend_tmp_string_release(tmp_key);
					}
					zval_add_ref(entry_values);
					pos_values++;
					break;
				}
				pos_values++;
			}
		} ZEND_HASH_FOREACH_END();
	}
}
/* }}} */

/* ===== array_is_list_alpha (type.c) ===== */

/* _alpha sibling of zend_array_is_list(): carries the packed-with-holes
 * short-circuit and the mixed-array fast negative as a parallel
 * reimplementation. The original zend_array_is_list() and all its callers
 * stay untouched.
 *
 * For packed arrays, HT_IS_WITHOUT_HOLES() is both necessary and sufficient
 * for being a list: _zend_hash_packed_del_val() strips trailing IS_UNDEF
 * slots, so a packed array never has trailing holes inside [0, nNumUsed).
 * No holes  => keys are 0..nNumUsed-1 => list. Holes => the hole is
 * non-trailing => a key is missing while a higher key exists => not a list.
 * This collapses the packed branch to a single comparison (O(1) instead of
 * the O(n) scan the original performs for arrays with holes).
 *
 * For mixed arrays, nNextFreeElement < nNumOfElements proves the keys
 * cannot be {0..n-1} (a list forces nNextFreeElement >= nNumOfElements),
 * so we can return false without iterating. This is only a fast negative;
 * the converse does not hold, so the verification loop still runs when the
 * check passes.
 *
 * Vendored locally (file-static) so this extension builds against a stock
 * PHP 8.6 without requiring a patched Zend/zend_hash.h. */
static bool zend_array_is_list_alpha(const zend_array *array)
{
	zend_ulong expected_idx = 0;
	zend_ulong num_idx;
	zend_string* str_idx;
	/* Empty arrays are lists */
	if (zend_hash_num_elements(array) == 0) {
		return true;
	}

	/*
	 * Packed arrays are lists iff they have no holes. The keys are the
	 * slot positions, so HT_IS_WITHOUT_HOLES() is necessary and sufficient
	 * here (see comment above).
	 */
	if (HT_IS_PACKED(array)) {
		return HT_IS_WITHOUT_HOLES(array);
	}

	/*
	 * Mixed array: a list 0..n-1 has max numeric key n-1, which forces
	 * nNextFreeElement >= nNumOfElements (nNextFreeElement is sticky and
	 * only grows on insert, so it can be larger but never smaller than n).
	 * A value below nNumOfElements therefore proves the keys cannot be
	 * {0..n-1} without scanning. This is only a fast negative; equality
	 * does not imply a list, so the verification loop still runs below.
	 */
	if (array->nNextFreeElement < array->nNumOfElements) {
		return false;
	}

	/* Check if the list could theoretically be repacked */
	ZEND_HASH_MAP_FOREACH_KEY(array, num_idx, str_idx) {
		if (str_idx != NULL || num_idx != expected_idx++) {
			return false;
		}
	} ZEND_HASH_FOREACH_END();

	return true;
}

PHP_FUNCTION(array_is_list_alpha)
{
	HashTable *array;

	ZEND_PARSE_PARAMETERS_START(1, 1)
		Z_PARAM_ARRAY_HT(array)
	ZEND_PARSE_PARAMETERS_END();

	RETURN_BOOL(zend_array_is_list_alpha(array));
}