Thank you for this bug report. To properly diagnose the problem, we
need a short but complete example script to be able to reproduce
this bug ourselves. 

A proper reproducing script starts with <?php and ends with ?>,
is max. 10-20 lines long and does not require any external 
resources such as databases, etc. If the script requires a 
database to demonstrate the issue, please make sure it creates 
all necessary tables, stored procedures etc.

Please avoid embedding huge scripts into the report.

ATM I don't have the time to write the given testfile inclusive phpunit in 10-20 lines nor do I've the possibilities to drag this issue down to get this crash into 10-20 lines.
As you can see "zbacktrace" don't give a hint and a normal backtrace is attached.
The source of TYPO3 can be found on https://github.com/TYPO3/TYPO3.CMS in branch master. The testfile themself is located here: https://github.com/TYPO3/TYPO3.CMS/blob/master/typo3/sysext/extbase/Tests/Unit/Mvc/Web/RequestBuilderTest.php

okey, I have cloned the TYPO3 , how could I run the test?

I run it normaly with

phpunit -c typo3/sysext/core/Build/UnitTests.xml

At the moment I use PHPUnit 4.6.6

Example of output for running the tests.

https://travis-ci.org/TYPO3/TYPO3.CMS/jobs/65556246

Dragged this down a bit further.

The crash happens on following line:
https://github.com/TYPO3/TYPO3.CMS/blob/master/typo3/sysext/extbase/Classes/Mvc/Web/RequestBuilder.php#L110

$this->defaultControllerName = current(array_keys($configuration['controllerConfiguration']));

in the crashing test, this is an empty array. But trying this in a 10 lines test doesn't fail.

Snippet to crash PHP7.

Without the unset, $var isn't changed and returns same content as before.
If array is empty in the first assignment you get a notice that $var is an uninitialized var.

<?php
    $configuration = array(
        'controllerConfiguration' => array(
            'TheFirstController' => array(
            ),
        )
    );
    $var = current(array_keys($configuration['controllerConfiguration']));
    var_dump($var);

    unset($configuration['controllerConfiguration']['TheFirstController']);

    $configuration['controllerConfiguration'] = array();
    $var = current(array_keys($configuration['controllerConfiguration']));
    var_dump($var);

Output of other PHP versions:

http://3v4l.org/UO3aI

This issue still exists with beta2.
What is needed to get this fixed?

Thanks for the reproduce script. I can confirm the segfault on
Windows and Linux.

For some reason when current() is called the second time,
array->htInternalPointer == 0 for the empty array (instead of
0xffffffff), so zend_hash_get_current_data() returns an
uninitialized entry instead of NULL.

Laruence, could you please have a look at this issue.

It seems that's a general issue in ZEND_HASH_FILL_END[1], where
nInternalPointer is always set to zero, instead of 0xffffffff for
empty arrays (see the attached patch "ZEND_HASH_FILL_END").

[1] <https://github.com/php/php-src/blob/php-7.0.0beta2/Zend/zend_hash.h#L887>

@cmb, thanks the patch looks fine. I committed it here: https://github.com/php/php-src/commit/7d5fb7bbf3c27017fa3bed462474aaa8d4746e72

Verified, works now. Many Thanks.