From 545bef8ae6d31302b14614570e0eed91dbc8635e Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Wed, 2 Oct 2024 12:37:04 +0200
Subject: [PATCH 1/2] Fix array_merge_recursive(): convert_to_array() may need
 separation (#16061)

---
 ext/standard/array.c                  |  3 ++-
 ext/standard/tests/array/gh16053.phpt | 28 +++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/gh16053.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4d1dca5002c..6c1975b1217 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -3700,7 +3700,6 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				}
 
 				ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1);
-				SEPARATE_ZVAL(dest_entry);
 				dest_zval = dest_entry;
 
 				if (Z_TYPE_P(dest_zval) == IS_NULL) {
@@ -3709,6 +3708,8 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				} else {
 					convert_to_array(dest_zval);
 				}
+				SEPARATE_ZVAL(dest_zval);
+
 				ZVAL_UNDEF(&tmp);
 				if (Z_TYPE_P(src_zval) == IS_OBJECT) {
 					ZVAL_COPY(&tmp, src_zval);
diff --git a/ext/standard/tests/array/gh16053.phpt b/ext/standard/tests/array/gh16053.phpt
new file mode 100644
index 00000000000..7106fb989ab
--- /dev/null
+++ b/ext/standard/tests/array/gh16053.phpt
@@ -0,0 +1,28 @@
+--TEST--
+GH-16053: Assertion failure in Zend/zend_hash.c
+--FILE--
+<?php
+
+class test
+{
+}
+$x = new test;
+$arr1 = array("string" => $x);
+$arr2 = array("string" => "hello");
+var_dump($arr1);
+var_dump(array_merge_recursive($arr1, $arr2));
+
+?>
+--EXPECTF--
+array(1) {
+  ["string"]=>
+  object(test)#%d (0) {
+  }
+}
+array(1) {
+  ["string"]=>
+  array(1) {
+    [0]=>
+    string(5) "hello"
+  }
+}

From 2bcf3f9e23a8eab865186c0d9572df60f9be69c4 Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Wed, 2 Oct 2024 12:38:24 +0200
Subject: [PATCH 2/2] [ci skip] NEWS for GH-16061

---
 NEWS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/NEWS b/NEWS
index 7ef01952a6e..c7457b839e8 100644
--- a/NEWS
+++ b/NEWS
@@ -52,6 +52,7 @@ PHP                                                                        NEWS
     (David Carlier)
   . Fixed bug GH-15937 (overflow on stream timeout option value).
     (David Carlier)
+  . Fixed bug GH-16053 (Assertion failure in Zend/zend_hash.c). (Arnaud)
 
 - Streams:
   . Fixed bugs GH-15908 and GH-15026 (leak / assertion failure in streams.c).