From e649a0d65f66cb2858ccc8cb630b942b3f202f3f Mon Sep 17 00:00:00 2001
From: twosee <twose@qq.com>
Date: Sat, 11 Jul 2020 04:25:51 +0800
Subject: [PATCH] Fixed bug #79821

---
 ext/standard/tests/bug79821.phpt | 21 +++++++++++++++++++++
 ext/standard/var.c               |  3 +++
 2 files changed, 24 insertions(+)
 create mode 100644 ext/standard/tests/bug79821.phpt

diff --git a/ext/standard/tests/bug79821.phpt b/ext/standard/tests/bug79821.phpt
new file mode 100644
index 0000000000000..cf1d27e1280af
--- /dev/null
+++ b/ext/standard/tests/bug79821.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Bug #79821 (array grow during var_dump)
+--FILE--
+<?php
+
+$foo = $bar = [];
+for ($i = 0; $i < 3; $i++) {
+    $foo = [$foo, [&$bar]];
+}
+ob_start(function (string $buffer) use (&$bar) {
+    $bar[][] = null;
+    return '';
+}, 1);
+var_dump($foo[0]);
+ob_end_clean();
+
+echo "OK\n";
+
+?>
+--EXPECT--
+OK
diff --git a/ext/standard/var.c b/ext/standard/var.c
index 7a868434fd677..2283d48c8679d 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -127,6 +127,7 @@ PHPAPI void php_var_dump(zval *struc, int level) /* {{{ */
 					PUTS("*RECURSION*\n");
 					return;
 				}
+				GC_ADDREF(myht);
 				GC_PROTECT_RECURSION(myht);
 			}
 			count = zend_array_count(myht);
@@ -135,8 +136,10 @@ PHPAPI void php_var_dump(zval *struc, int level) /* {{{ */
 			ZEND_HASH_FOREACH_KEY_VAL_IND(myht, num, key, val) {
 				php_array_element_dump(val, num, key, level);
 			} ZEND_HASH_FOREACH_END();
+
 			if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
 				GC_UNPROTECT_RECURSION(myht);
+				GC_DELREF(myht);
 			}
 			if (level > 1) {
 				php_printf("%*c", level-1, ' ');