Bug #68775 [NEW]: yield in a function argument crashes or loops indefinitely

From: bwoebi Operating system: Irrelevant PHP version: master-Git-2015-01-09 (Git) Package: Reproducible crash Bug Type: Bug Bug description:yield in a function argument crashes or loops indefinitely Description: ------------ Variants of that code (dependent on where execute_data->prev_execute_data is first needed) may also crash. My longer analysis resumed: EG(vm_stack_top) is reset to generator->stack->top in the next resume after zend_vm_stack_push_call_frame was called in the ZEND_INIT_FCALL_BY_NAME, that stack frame is now equal to EG(vm_stack_top), which is then returned in the next stack frame allocation (the var_dump one in the example) and prev_execute_data is set there to the address of the stack frame itself. Adding generator->stack->top = EG(vm_stack_top); on line 330 of zend_generators.c fixed the bug for me, but not sure if that's safe... Test script: --------------- function a($x) { var_dump($x); } function gen() { a(yield); } $g = gen(); $g->send(1); Expected result: ---------------- int(1) Actual result: -------------- Infinite loop: execute_data->prev_execute_data == execute_data -- Edit bug report at https://bugs.php.net/bug.php?id=68775&edit=1 -- Try a snapshot (PHP 5.4): https://bugs.php.net/fix.php?id=68775&r=trysnapshot54 Try a snapshot (PHP 5.5): https://bugs.php.net/fix.php?id=68775&r=trysnapshot55 Try a snapshot (trunk): https://bugs.php.net/fix.php?id=68775&r=trysnapshottrunk Fixed in SVN: https://bugs.php.net/fix.php?id=68775&r=fixed Fixed in release: https://bugs.php.net/fix.php?id=68775&r=alreadyfixed Need backtrace: https://bugs.php.net/fix.php?id=68775&r=needtrace Need Reproduce Script: https://bugs.php.net/fix.php?id=68775&r=needscript Try newer version: https://bugs.php.net/fix.php?id=68775&r=oldversion Not developer issue: https://bugs.php.net/fix.php?id=68775&r=support Expected behavior: https://bugs.php.net/fix.php?id=68775&r=notwrong Not enough info: https://bugs.php.net/fix.php?id=68775&r=notenoughinfo Submitted twice: https://bugs.php.net/fix.php?id=68775&r=submittedtwice register_globals: https://bugs.php.net/fix.php?id=68775&r=globals PHP 4 support discontinued: https://bugs.php.net/fix.php?id=68775&r=php4 Daylight Savings: https://bugs.php.net/fix.php?id=68775&r=dst IIS Stability: https://bugs.php.net/fix.php?id=68775&r=isapi Install GNU Sed: https://bugs.php.net/fix.php?id=68775&r=gnused Floating point limitations: https://bugs.php.net/fix.php?id=68775&r=float No Zend Extensions: https://bugs.php.net/fix.php?id=68775&r=nozend MySQL Configuration Error: https://bugs.php.net/fix.php?id=68775&r=mysqlcfg