From 158316fa6c35846d40dde3df933683ecd43253d3 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Sat, 5 Sep 2026 04:38:28 +0500
Subject: [PATCH 1/2] Fix GH-23576: array_keys() on an empty array returns a
 non-zero next index

---
 NEWS                                  |  2 ++
 ext/standard/array.c                  |  2 +-
 ext/standard/tests/array/gh23576.phpt | 32 +++++++++++++++++++++++++++
 3 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/gh23576.phpt

diff --git a/NEWS b/NEWS
index 13b3286c7b67..adc1ddc300ff 100644
--- a/NEWS
+++ b/NEWS
@@ -96,6 +96,8 @@ PHP                                                                        NEWS
   . Fixed a memory leak in array_merge_recursive() when the recursive merge of
     an object converted to an array fails. (David Carlier)
   . Fixed read buffer compaction in php_stream_filter_flush(). (crystarm)
+  . Fixed bug GH-23576 (Next index for array returned from array_keys() is
+    wrong). (Lazizbek Ergashev)
 
 - SimpleXML:
   . Fixed writing to a dimension of the object returned by attributes() not
diff --git a/ext/standard/array.c b/ext/standard/array.c
index 556f9a7ee666..ebd114844ab9 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -4504,7 +4504,7 @@ PHP_FUNCTION(array_keys)
 
 	/* Base case: empty input */
 	if (!elem_count) {
-		RETURN_COPY(input);
+		RETURN_EMPTY_ARRAY();
 	}
 
 	/* Initialize return array */
diff --git a/ext/standard/tests/array/gh23576.phpt b/ext/standard/tests/array/gh23576.phpt
new file mode 100644
index 000000000000..9b666d5db7e0
--- /dev/null
+++ b/ext/standard/tests/array/gh23576.phpt
@@ -0,0 +1,32 @@
+--TEST--
+GH-23576 (Next index for array returned from array_keys() is wrong)
+--FILE--
+<?php
+$a = [123 => 123];
+unset($a[123]);
+
+$b = array_keys($a);
+$b[] = 42;
+var_dump($b);
+
+$c = array_keys($a, 123);
+$c[] = 42;
+var_dump($c);
+
+$d = array_keys($a, 123, true);
+$d[] = 42;
+var_dump($d);
+?>
+--EXPECT--
+array(1) {
+  [0]=>
+  int(42)
+}
+array(1) {
+  [0]=>
+  int(42)
+}
+array(1) {
+  [0]=>
+  int(42)
+}

From 457a21e84a0f78988b31ee1cb6289d2110a57e20 Mon Sep 17 00:00:00 2001
From: Lazizbek Ergashev <lazerg2@gmail.com>
Date: Sun, 6 Sep 2026 01:43:28 +0500
Subject: [PATCH 2/2] Add empty array cases to the GH-23576 test

---
 ext/standard/tests/array/gh23576.phpt | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/ext/standard/tests/array/gh23576.phpt b/ext/standard/tests/array/gh23576.phpt
index 9b666d5db7e0..c3ada5559a23 100644
--- a/ext/standard/tests/array/gh23576.phpt
+++ b/ext/standard/tests/array/gh23576.phpt
@@ -16,6 +16,20 @@ var_dump($c);
 $d = array_keys($a, 123, true);
 $d[] = 42;
 var_dump($d);
+
+$e = [];
+
+$f = array_keys($e);
+$f[] = 42;
+var_dump($f);
+
+$g = array_keys($e, 123);
+$g[] = 42;
+var_dump($g);
+
+$h = array_keys($e, 123, true);
+$h[] = 42;
+var_dump($h);
 ?>
 --EXPECT--
 array(1) {
@@ -30,3 +44,15 @@ array(1) {
   [0]=>
   int(42)
 }
+array(1) {
+  [0]=>
+  int(42)
+}
+array(1) {
+  [0]=>
+  int(42)
+}
+array(1) {
+  [0]=>
+  int(42)
+}