[Serializer] Deserialization order of priority changed #[SerializedPath] vs. property name

[jerowork]

Symfony version(s) affected

6.3.5

Description

With the update of Serializer to 6.3.5, some deserialization of array to objects does behave differently (changed order of priority of configuration via attribute #[SerializedPath] vs. property name, when there is a key on root level with the same name as the private property.

Related to #49700.

How to reproduce

Example to explain changed behavior:

{
  "data": {
    "item": {
      "id": "id-1"
    }
  },
  "id": "id-2"
}

final class SomeEvent
{
    #[SerializedPath('[data][item][id]')]
    public string $id;
}

Before 6.3.5, the value of the id was id-1, with the change of #49700, the value of the id becomes id-2.

#49700 changes array_merge with array + array. It seems that the problem stated above is related to the fact that array_merge does overwrite keys differently than array + array:

$a = ['key' => 'value-a'];
$b = ['key' => 'value-b'];

var_dump(array_merge($a, $b));
// Results in:
// array(1) {
//   ["key"]=>
//   string(7) "value-b"
// }

var_dump($a + $b);
// Results in:
// array(1) {
//   ["key"]=>
//   string(7) "value-a"
// }

Possible Solution

As array_merge does behave slightly differently that array + array, the solution could be to switch array order to:

- $normalizedData = $normalizedData + $nestedData;
+ $normalizedData = $nestedData + $normalizedData;

This would result in the same, while keeping the fix (#49700) for the numeric key value.

PR: #51825

Additional Context

No response