Fix SoapClient not restoring EG(vm_stack_top) after a caught bailout

NEWS

@@ -77,6 +77,8 @@ PHP                                                                        NEWS
 - SOAP:
   . Fixed use of uninitialized func in do_request() on OOM bailout.
     (David Carlier)
+  . Fixed SoapClient not restoring EG(vm_stack_top) after catching a bailout
+    from a call that grew the VM stack. (Valery Ivashchanka)
 
 - Session:
   . Fixed session data loss in the files save handler when writing the session

ext/soap/soap.c

@@ -115,7 +115,7 @@ static void soap_error_handler(int error_num, zend_string *error_filename, uint3
 				EG(vm_stack) = tmp; \
 				EG(vm_stack_end) = tmp->end; \
 			} \
-			EG(vm_stack)->top = _old_stack_top; \
+			EG(vm_stack_top) = _old_stack_top; \
 		} \
 	} zend_end_try();\
 	SOAP_GLOBAL(use_soap_error_handler) = _old_handler;\

ext/soap/tests/client_fatal_deep_vm_stack.phpt

@@ -0,0 +1,38 @@
+--TEST--
+SoapClient: fatal error caught after the VM stack grew restores EG(vm_stack_top)
+--EXTENSIONS--
+soap
+--FILE--
+<?php
+function recurse($depth) {
+    if ($depth > 0) {
+        return recurse($depth - 1);
+    }
+    eval("class Dup {} class Dup {}");
+}
+
+class TestClient extends SoapClient {
+    public function __doRequest($request, $location, $action, $version, $oneWay = false, $uriParserClass = null): ?string {
+        recurse(50000);
+        return "";
+    }
+}
+
+$client = new TestClient(null, ["location" => "test://", "uri" => "test://"]);
+try {
+    $client->test();
+} catch (SoapFault $e) {
+    echo $e->getMessage(), "\n";
+}
+
+function f($a, $b, $c) {
+    return [$a, $b, $c];
+}
+for ($i = 0; $i < 100000; $i++) {
+    f($i, [$i], "x$i");
+}
+echo "Done\n";
+?>
+--EXPECTF--
+Cannot redeclare class Dup (previously declared in %s)
+Done