From 150504e6b1ea2b2eac3177c8cff2657a243da22c Mon Sep 17 00:00:00 2001
From: twosee <twose@qq.com>
Date: Sat, 11 Jul 2020 06:14:22 +0800
Subject: [PATCH] Fixed bug #79821

HashTable was reallocated (zend_hash_packed_grow) during php_var_dump, so we should call GC_ADDREF to make SEPARATE_ARRAY work.

Closes GH-5837.
---
 ext/standard/tests/bug79821.phpt | 21 +++++++++++++++++++++
 ext/standard/var.c               |  3 +++
 2 files changed, 24 insertions(+)
 create mode 100644 ext/standard/tests/bug79821.phpt

diff --git a/ext/standard/tests/bug79821.phpt b/ext/standard/tests/bug79821.phpt
new file mode 100644
index 00000000000..cf1d27e1280
--- /dev/null
+++ b/ext/standard/tests/bug79821.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #79821 (array grow during var_dump)
+--FILE--
+<?php
+
+$foo = $bar = [];
+for ($i = 0; $i < 3; $i++) {
+    $foo = [$foo, [&$bar]];
+}
+ob_start(function (string $buffer) use (&$bar) {
+    $bar[][] = null;
+    return '';
+}, 1);
+var_dump($foo[0]);
+ob_end_clean();
+
+echo "OK\n";
+
+?>
+--EXPECT--
+OK
diff --git a/ext/standard/var.c b/ext/standard/var.c
index a008aab4cbf..241880b903e 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -122,6 +122,7 @@ again:
 					PUTS("*RECURSION*\n");
 					return;
 				}
+				GC_ADDREF(myht);
 				GC_PROTECT_RECURSION(myht);
 			}
 			count = zend_array_count(myht);
@@ -506,8 +507,10 @@ again:
 			ZEND_HASH_FOREACH_KEY_VAL_IND(myht, index, key, val) {
 				php_array_element_export(val, index, key, level, buf);
 			} ZEND_HASH_FOREACH_END();
+
 			if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
 				GC_UNPROTECT_RECURSION(myht);
+				GC_DELREF(myht);
 			}
 			if (level > 1) {
 				buffer_append_spaces(buf, level - 1);