GeezerVison

ret = php_array_merge_recursive(Z_ARRVAL_P(dest_zval), Z_ARRVAL_P(src_zval));
if (thash) {
	GC_TRY_UNPROTECT_RECURSION(thash);
}
if (!ret) {
	return 0;
}

--TEST--
GH-23089 (Memory leak in array_merge_recursive on stack overflow with object)
--SKIPIF--
<?php
if (ini_get('zend.max_allowed_stack_size') === false) {
    die('skip No stack limit support');
}
if (getenv('SKIP_ASAN')) {
    die('skip ASAN needs different stack limit setting due to more stack space usage');
}
?>
--INI--
zend.max_allowed_stack_size=256K
--FILE--
<?php
$obj = new stdClass();
$deep = [];
for ($i = 0; $i < 30000; $i++) {
    $deep = ['k' => $deep];
}
$obj->val = $deep;
$a = ['obj' => $obj];
try {
    array_merge_recursive($a, $a);
} catch (Throwable $e) {
    echo $e::class, ": ", $e->getMessage(), "\n";
}
echo "done\n";
?>
--EXPECTF--
Error: Maximum call stack size of %d bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion?
done

[Sat Sep  5 17:36:00 2026]  Script:  '/home/sjoerd/php-src/ext/standard/tests/array/gh23089_leak.phpt'
/home/sjoerd/php-src/Zend/zend_hash.c(291) :  Freeing 0x0000fc2ec9203480 (56 bytes), script=/home/sjoerd/php-src/ext/standard/tests/array/gh23089_leak.phpt
Last leak repeated 30000 times