Merge branch 'PHP-7.4'

* PHP-7.4:
  Fixed bug #79930
  Fix iov_base pointer type for illumos
  Backport bless_tests.php changes from PHP 8

Author: nikic

ext/opcache/zend_file_cache.c

@@ -1025,7 +1025,7 @@ int zend_file_cache_script_store(zend_persistent_script *script, int in_shm)
 #endif
 
 #ifdef HAVE_SYS_UIO_H
-	vec[0].iov_base = &info;
+	vec[0].iov_base = (void *)&info;
 	vec[0].iov_len = sizeof(info);
 	vec[1].iov_base = buf;
 	vec[1].iov_len = script->size;

ext/standard/array.c

@@ -3658,7 +3658,7 @@ PHPAPI int php_array_merge_recursive(HashTable *dest, HashTable *src) /* {{{ */
 						return 0;
 					}
 				} else {
-					Z_TRY_ADDREF_P(src_entry);
+					Z_TRY_ADDREF_P(src_zval);
 					zend_hash_next_index_insert(Z_ARRVAL_P(dest_zval), src_zval);
 				}
 				zval_ptr_dtor(&tmp);

ext/standard/tests/array/bug79930.phpt

@@ -0,0 +1,33 @@
+--TEST--
+Bug #79930: array_merge_recursive() crashes when called with array with single reference
+--FILE--
+<?php
+
+$a = 'a';
+$array = [
+    'value' => $a . 'b',
+];
+
+// Create rc=1 reference.
+array_walk($array, function () {});
+
+$m = array_merge_recursive(['value' => 'a'], $array);
+
+var_dump($a, $array, $m);
+
+?>
+--EXPECT--
+string(1) "a"
+array(1) {
+  ["value"]=>
+  string(2) "ab"
+}
+array(1) {
+  ["value"]=>
+  array(2) {
+    [0]=>
+    string(1) "a"
+    [1]=>
+    string(2) "ab"
+  }
+}