this is simply because the dumping array is resized(reallocaed).

a simple reproduced script is:
$obj = range(0, 5);
ob_start ( function ( $name ) { $GLOBALS[] = &$obj; } , 1 ) ;
var_dump ( $GLOBALS) ;


I am not sure how to fix this with a reasonable cost

Just increasing the refcount while dumping should probably work? We do things like that in various recursive walks due to issues like this.

hmm, probably right, but we also need handle the GC_PROTECTED inheritance ,
and I am also thinking , seems only $GLOBALS array could trigger this problem, in that case, the solution might be easy...

@laruence I don't think this is $GLOBALS specific. For example:

$obj = range(0, 5);
ob_start(function($name) use (&$obj) { static $i = 0; if ($i++ == 5) $obj["foo"] = "bar"; }, 1);
var_dump([&$obj]);

hmm, nop:
$obj = new Stdclass();
$obj->arr = [1, 2, 3, 4, 5];
$obj->arr = &$obj->arr;
ob_start ( function ( $name ) use($obj){  $obj->arr[] = 1; } , 1) ;
var_dump($obj);

okey, made a patch against 7.4:
diff --git a/Zend/zend_hash.c b/Zend/zend_hash.c
index 7a251ec..5dd4983 100644
--- a/Zend/zend_hash.c
+++ b/Zend/zend_hash.c
@@ -2073,6 +2073,9 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
                target->nInternalPointer = source->nInternalPointer;
                memcpy(HT_GET_DATA_ADDR(target), HT_GET_DATA_ADDR(source), HT_USED_SIZE(source));
        } else if (HT_FLAGS(source) & HASH_FLAG_PACKED) {
+               if (UNEXPECTED(GC_IS_RECURSIVE(source))) {
+                       GC_PROTECT_RECURSION(target);
+               }
                HT_FLAGS(target) = HT_FLAGS(source) & HASH_FLAG_MASK;
                target->nTableMask = HT_MIN_MASK;
                target->nNumUsed = source->nNumUsed;
@@ -2092,6 +2095,9 @@ ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source)
                        zend_array_dup_packed_elements(source, target, 1);
                }
        } else {
+               if (UNEXPECTED(GC_IS_RECURSIVE(source))) {
+                       GC_PROTECT_RECURSION(target);
+               }
                HT_FLAGS(target) = HT_FLAGS(source) & HASH_FLAG_MASK;
                target->nTableMask = source->nTableMask;
                target->nNextFreeElement = source->nNextFreeElement;
diff --git a/ext/standard/var.c b/ext/standard/var.c
index 3f7db8f..c1fe15a 100644
--- a/ext/standard/var.c
+++ b/ext/standard/var.c
@@ -129,6 +129,7 @@ again:
                                        return;
                                }
                                GC_PROTECT_RECURSION(myht);
+                               GC_ADDREF(myht);
                        }
                        count = zend_array_count(myht);
                        php_printf("%sarray(%d) {\n", COMMON, count);
@@ -138,6 +139,9 @@ again:
                        } ZEND_HASH_FOREACH_END();
                        if (!(GC_FLAGS(myht) & GC_IMMUTABLE)) {
                                GC_UNPROTECT_RECURSION(myht);
+                               if (GC_DELREF(myht) == 0) {
+                                       zend_array_destroy(myht);
+                               }
                        }
                        if (level > 1) {
                                php_printf("%*c", level-1, ' ');

running test, not sure about the gc_protected inheritance part, @nikic do you see any problems?

@laruence I'm not sure I understand why recursion protection should be inherited. If we addref the array (with GC recursion flag set) in var_dump, and then someone modifies the array, it will be separated and they should get a copy without the recursion flag, while var_dump is going to keep working on the original array with the recursion flag, so it should all work out in the end. Or not?

all tests pass, 
anyway, to be honest I agree the gc_protected part seems weird , maybe you could have a better slotion.

sorry for my poor english, let me try to explain the gc_protected part agian:

if we don’t keep the gc_protected flag, it will lead to a infinite loop in case the array has a recursive ref to itself, some thing like:
 arr[1] = &arr;
 var_dump(arr);
 ++refcount(arr);
   var_dump(arr[1]);
   ob_start called , separate arr[1], arr[1] became a new array also have arr[1] is it’self
  then var_dump(arr) lead to a infinte loop.

 if I still din’t make myself clear,  you may try with the test script without the gc_protcted inheritance part.

Patched