[PHP-BUG] Bug #71188 [NEW]: str_replace converts integers in original $search array to strings

From:             admin at supermartas dot cz
Operating system: Any
PHP version:      7.0.1
Package:          Strings related
Bug Type:         Bug
Bug description:str_replace converts integers in original $search array to strings

Description:
------------
If I try the test script on Windows 10 or (probably) on CentOS, I will
get this result:

array(3) {
  [0]=>
  int(0)
  [1]=>
  int(1)
  [2]=>
  int(2)
}
array(3) {
  [0]=>
  string(1) "0"
  [1]=>
  string(1) "1"
  [2]=>
  string(1) "2"
}

PHP converted all integers in $a array to strings but the original array
should stay untouched!
But it's even worse on Ubuntu 14.04.3 LTS (PHP Version
7.0.1-2+deb.sury.org~trusty+1) where it returns at first the same result
as on the other operating systems but after some page refreshes (press
F5 in your browser about 20 times) it returns:

array(3) {
  [0]=>
  string(1) "0"
  [1]=>
  string(875835694) "<br />
<b>Fatal error</b>:  Allowed memory size of 134217728 bytes exhausted
(tried to allocate 3688507696953442304 bytes)

or sometimes:

array(3) {
  [0]=>
  string(1862275224) "<br />
<b>Fatal error</b>:  Allowed memory size of 134217728 bytes exhausted
(tried to allocate 140065040769024 bytes)

In another script (where I found out there is something wrong with PHP)
it didn't throw that fatal error but it modified the $a array like this
(original $a array has 10 items):

array(10) {
  [0]=>
  string(5) "https"
  [1]=>
  string(5) "https"
  [2]=>
  string(0) ""
  [3]=>
  string(5) "15421"
  [4]=>
  string(5) "15421"
  [5]=>
  string(7) "CGI/1.1"
  [6]=>
  string(6) "HTTP/2"
  [7]=>
  string(6) "HTTP/2"
  [8]=>
  string(5) "close"
  [9]=>
  string(1) "0"
}

If I convert items of $a array to string by hand ($a = ["0", "1", "2"]),
everything is working correctly.

Test script:
---------------
<?php
	$a = [0, 1, 2];
	$b = ["Nula", "Jedna", "Dva"];

	var_dump($a);
	str_replace($a, $b, "1");
	var_dump($a);


Expected result:
----------------
array(3) {
  [0]=>
  int(0)
  [1]=>
  int(1)
  [2]=>
  int(2)
}
array(3) {
  [0]=>
  int(0)
  [1]=>
  int(1)
  [2]=>
  int(2)
}

Actual result:
--------------
array(3) {
  [0]=>
  int(0)
  [1]=>
  int(1)
  [2]=>
  int(2)
}
array(3) {
  [0]=>
  string(1) "0"
  [1]=>
  string(1) "1"
  [2]=>
  string(1) "2"
}

-- 
Edit bug report at https://bugs.php.net/bug.php?id=71188&edit=1
-- 
Try a snapshot (PHP 5.4):   https://bugs.php.net/fix.php?id=71188&r=trysnapshot54
Try a snapshot (PHP 5.5):   https://bugs.php.net/fix.php?id=71188&r=trysnapshot55
Try a snapshot (trunk):     https://bugs.php.net/fix.php?id=71188&r=trysnapshottrunk
Fixed in SVN:               https://bugs.php.net/fix.php?id=71188&r=fixed
Fixed in release:           https://bugs.php.net/fix.php?id=71188&r=alreadyfixed
Need backtrace:             https://bugs.php.net/fix.php?id=71188&r=needtrace
Need Reproduce Script:      https://bugs.php.net/fix.php?id=71188&r=needscript
Try newer version:          https://bugs.php.net/fix.php?id=71188&r=oldversion
Not developer issue:        https://bugs.php.net/fix.php?id=71188&r=support
Expected behavior:          https://bugs.php.net/fix.php?id=71188&r=notwrong
Not enough info:            https://bugs.php.net/fix.php?id=71188&r=notenoughinfo
Submitted twice:            https://bugs.php.net/fix.php?id=71188&r=submittedtwice
register_globals:           https://bugs.php.net/fix.php?id=71188&r=globals
PHP 4 support discontinued: https://bugs.php.net/fix.php?id=71188&r=php4
Daylight Savings:           https://bugs.php.net/fix.php?id=71188&r=dst
IIS Stability:              https://bugs.php.net/fix.php?id=71188&r=isapi
Install GNU Sed:            https://bugs.php.net/fix.php?id=71188&r=gnused
Floating point limitations: https://bugs.php.net/fix.php?id=71188&r=float
No Zend Extensions:         https://bugs.php.net/fix.php?id=71188&r=nozend
MySQL Configuration Error:  https://bugs.php.net/fix.php?id=71188&r=mysqlcfg