One array opcode is missing in sfall. There is no way in O(1) to distinguish if key exists in map array or if it's a 0. The only way is to call array_key on every index which is O(n). Also the array has to be created with a "lookup" flag, without it, you can't have 0 as value in the first place.