From 202085023b8e2b0c8616253a5ad3ae5915db7a83 Mon Sep 17 00:00:00 2001
From: Arnaud Le Blanc <arnaud.lb@gmail.com>
Date: Wed, 25 Sep 2024 19:09:24 +0200
Subject: [PATCH] Fix array_merge_recursive(): convert_to_array() may need
 separation

---
 ext/standard/array.c                  |  3 ++-
 ext/standard/tests/array/gh16053.phpt | 28 +++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 1 deletion(-)
 create mode 100644 ext/standard/tests/array/gh16053.phpt

diff --git a/ext/standard/array.c b/ext/standard/array.c
index 4d1dca5002c1d..6c1975b121749 100644
--- a/ext/standard/array.c
+++ b/ext/standard/array.c
@@ -3700,7 +3700,6 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				}
 
 				ZEND_ASSERT(!Z_ISREF_P(dest_entry) || Z_REFCOUNT_P(dest_entry) > 1);
-				SEPARATE_ZVAL(dest_entry);
 				dest_zval = dest_entry;
 
 				if (Z_TYPE_P(dest_zval) == IS_NULL) {
@@ -3709,6 +3708,8 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 				} else {
 					convert_to_array(dest_zval);
 				}
+				SEPARATE_ZVAL(dest_zval);
+
 				ZVAL_UNDEF(&tmp);
 				if (Z_TYPE_P(src_zval) == IS_OBJECT) {
 					ZVAL_COPY(&tmp, src_zval);
diff --git a/ext/standard/tests/array/gh16053.phpt b/ext/standard/tests/array/gh16053.phpt
new file mode 100644
index 0000000000000..7106fb989abae
--- /dev/null
+++ b/ext/standard/tests/array/gh16053.phpt
@@ -0,0 +1,28 @@
+--TEST--
+GH-16053: Assertion failure in Zend/zend_hash.c
+--FILE--
+<?php
+
+class test
+{
+}
+$x = new test;
+$arr1 = array("string" => $x);
+$arr2 = array("string" => "hello");
+var_dump($arr1);
+var_dump(array_merge_recursive($arr1, $arr2));
+
+?>
+--EXPECTF--
+array(1) {
+  ["string"]=>
+  object(test)#%d (0) {
+  }
+}
+array(1) {
+  ["string"]=>
+  array(1) {
+    [0]=>
+    string(5) "hello"
+  }
+}