Merge branch 'PHP-8.6'

* PHP-8.6:
  Fix GH-24050: gc_collect_white() frees data reachable from a resurrected object

Author: devnexen

Zend/tests/gh24050.phpt

@@ -0,0 +1,49 @@
+--TEST--
+GH-24050 (GC frees an object still held by a resurrected closure when (object) and use share an array)
+--CREDITS--
+OllieCrook
+--FILE--
+<?php
+
+class Resurrector
+{
+    public $closure;
+    public $self;
+
+    public function __destruct()
+    {
+        $GLOBALS['resurrected'] = $this->closure;
+    }
+}
+
+class Holder
+{
+    public $castObject;
+    public $resurrector;
+    public $self;
+}
+
+$array = ['victim' => new stdClass(), 'key' => 'value'];
+
+$holder = new Holder();
+$resurrector = new Resurrector();
+$holder->castObject = (object) $array;
+$resurrector->closure = function () use ($array) {
+    return $array;
+};
+$holder->resurrector = $resurrector;
+$holder->self = $holder;
+$resurrector->self = $resurrector;
+
+unset($array);
+gc_collect_cycles();
+
+unset($holder, $resurrector);
+gc_collect_cycles();
+gc_collect_cycles();
+
+var_dump($resurrected()['victim']);
+?>
+--EXPECT--
+object(stdClass)#1 (0) {
+}

Zend/tests/gh24050_2.phpt

@@ -0,0 +1,49 @@
+--TEST--
+GH-24050 (GC frees an object still held by a resurrected closure when (array) and use share a properties table)
+--FILE--
+<?php
+
+class Resurrector
+{
+    public $closure;
+    public $self;
+
+    public function __destruct()
+    {
+        $GLOBALS['resurrected'] = $this->closure;
+    }
+}
+
+class Holder
+{
+    public $obj;
+    public $resurrector;
+    public $self;
+}
+
+$obj = new stdClass();
+$obj->victim = new stdClass();
+
+$holder = new Holder();
+$resurrector = new Resurrector();
+$holder->obj = $obj;
+$array = (array) $obj;
+$resurrector->closure = function () use ($array) {
+    return $array;
+};
+$holder->resurrector = $resurrector;
+$holder->self = $holder;
+$resurrector->self = $resurrector;
+
+unset($array, $obj);
+gc_collect_cycles();
+
+unset($holder, $resurrector);
+gc_collect_cycles();
+gc_collect_cycles();
+
+var_dump($resurrected()['victim']);
+?>
+--EXPECT--
+object(stdClass)#2 (0) {
+}

Zend/zend_gc.c

@@ -1574,6 +1574,9 @@ static int gc_collect_white(zend_refcounted *ref, uint32_t *flags, gc_stack *sta
 				GC_ADDREF(ht);
 				if (GC_REF_CHECK_COLOR(ht, GC_WHITE)) {
 					GC_REF_SET_BLACK(ht);
+					if (!GC_INFO(ht)) {
+						gc_add_garbage((zend_refcounted *)ht);
+					}
 					for (; n != 0; n--) {
 						if (Z_COLLECTABLE_P(zv)) {
 							ref = Z_COUNTED_P(zv);