[php-src] Issue #9752: Generator crashes when interrupted during a function call with extra named params
| From: | arnaud-lb | Date: | Fri, 14 Oct 2022 17:22:14 +0000 |
| Subject: | [php-src] Issue #9752: Generator crashes when interrupted during a function call with extra named params | ||
| Groups: | php.bugs | ||
| Request: | Send a blank email to php-bugs+get-242599@lists.php.net to get a copy of this message | ||
Issue: https://github.com/php/php-src/issues/9752
Author: arnaud-lb
### Description
The following code:
```php
<?php
function f(...$x) {
}
function g() {
f(a: 1, b: yield);
};
$gen = g();
foreach ($gen as $value) {
break;
}
```
Resulted in this output:
```
Program received signal SIGSEGV, Segmentation fault.
```
But I expected this output instead:
```
```
Gdb:
```
(gdb) r
Starting program: sapi/cli/php gen2.php
Program received signal SIGSEGV, Segmentation fault.
0x000055555631b481 in zend_array_release (array=0x0) at Zend/zend_hash.h:346
346 if (!(GC_FLAGS(array) & IS_ARRAY_IMMUTABLE)) {
(gdb) bt
#0 0x000055555631b481 in zend_array_release (array=0x0) at Zend/zend_hash.h:346
#1 0x000055555631b425 in zend_free_extra_named_params (extra_named_params=0x0) at
Zend/zend_execute.c:4959
#2 0x00005555563176b2 in cleanup_unfinished_calls (execute_data=0x7ffff58621e0, op_num=3) at
Zend/zend_execute.c:4230
#3 0x0000555556316d2e in zend_cleanup_unfinished_execution (execute_data=0x7ffff58621e0, op_num=3,
catch_op_num=0) at Zend/zend_execute.c:4319
#4 0x00005555565bbead in zend_generator_cleanup_unfinished_execution (generator=0x7ffff584e640,
execute_data=0x7ffff58621e0, catch_op_num=0) at Zend/zend_generators.c:128
#5 0x00005555565bba70 in zend_generator_close (generator=0x7ffff584e640, finished_execution=false)
at Zend/zend_generators.c:166
#6 0x00005555565c3a67 in zend_generator_dtor_storage (object=0x7ffff584e640) at
Zend/zend_generators.c:244
#7 0x00005555566022a8 in zend_objects_store_del (object=0x7ffff584e640) at
Zend/zend_objects_API.c:184
#8 0x0000555556270717 in rc_dtor_func (p=0x7ffff584e640) at Zend/zend_variables.c:57
#9 0x0000555556270805 in i_zval_ptr_dtor (zval_ptr=0x7fffffffaee0) at Zend/zend_variables.h:44
#10 0x0000555556270755 in zval_ptr_dtor (zval_ptr=0x7fffffffaee0) at Zend/zend_variables.c:84
#11 0x00005555562cecc1 in _zend_hash_del_el_ex (ht=0x555557ae3530 <executor_globals+304>,
idx=7, p=0x7ffff584b2e0, prev=0x0) at Zend/zend_hash.c:1355
#12 0x00005555562cda1e in _zend_hash_del_el (ht=0x555557ae3530 <executor_globals+304>, idx=7,
p=0x7ffff584b2e0) at Zend/zend_hash.c:1378
#13 0x00005555562d5613 in zend_hash_reverse_apply (ht=0x555557ae3530 <executor_globals+304>,
apply_func=0x555556222510 <zval_call_destructor>) at Zend/zend_hash.c:1949
#14 0x00005555562222f0 in shutdown_destructors () at Zend/zend_execute_API.c:252
#15 0x000055555627702d in zend_call_destructors () at Zend/zend.c:1256
#16 0x0000555556099a73 in php_request_shutdown (dummy=0x0) at main/main.c:1809
#17 0x00005555567eb9a8 in do_cli (argc=2, argv=0x603000000640) at sapi/cli/php_cli.c:1135
#18 0x00005555567e80f0 in main (argc=2, argv=0x603000000640) at sapi/cli/php_cli.c:1367
(gdb) frame 2
#2 0x00005555563176b2 in cleanup_unfinished_calls (execute_data=0x7ffff58621e0, op_num=3) at
Zend/zend_execute.c:4230
4230 zend_free_extra_named_params(call->extra_named_params);
(gdb) p call->extra_named_params
$1 = (zend_array *) 0x0
```
### PHP Version
PHP 8.1 24c297086d01811c5fd14ba3a3b9151759ab9c16
### Operating System
_No response_