[php-src] Issue #9752: Generator crashes when interrupted during a function call with extra named params

From: Date: Fri, 14 Oct 2022 17:22:14 +0000
Subject: [php-src] Issue #9752: Generator crashes when interrupted during a function call with extra named params
Groups: php.bugs 
Request: Send a blank email to php-bugs+get-242599@lists.php.net to get a copy of this message
Issue: https://github.com/php/php-src/issues/9752 Author: arnaud-lb ### Description The following code: ```php <?php function f(...$x) { } function g() { f(a: 1, b: yield); }; $gen = g(); foreach ($gen as $value) { break; } ``` Resulted in this output: ``` Program received signal SIGSEGV, Segmentation fault. ``` But I expected this output instead: ``` ``` Gdb: ``` (gdb) r Starting program: sapi/cli/php gen2.php Program received signal SIGSEGV, Segmentation fault. 0x000055555631b481 in zend_array_release (array=0x0) at Zend/zend_hash.h:346 346 if (!(GC_FLAGS(array) & IS_ARRAY_IMMUTABLE)) { (gdb) bt #0 0x000055555631b481 in zend_array_release (array=0x0) at Zend/zend_hash.h:346 #1 0x000055555631b425 in zend_free_extra_named_params (extra_named_params=0x0) at Zend/zend_execute.c:4959 #2 0x00005555563176b2 in cleanup_unfinished_calls (execute_data=0x7ffff58621e0, op_num=3) at Zend/zend_execute.c:4230 #3 0x0000555556316d2e in zend_cleanup_unfinished_execution (execute_data=0x7ffff58621e0, op_num=3, catch_op_num=0) at Zend/zend_execute.c:4319 #4 0x00005555565bbead in zend_generator_cleanup_unfinished_execution (generator=0x7ffff584e640, execute_data=0x7ffff58621e0, catch_op_num=0) at Zend/zend_generators.c:128 #5 0x00005555565bba70 in zend_generator_close (generator=0x7ffff584e640, finished_execution=false) at Zend/zend_generators.c:166 #6 0x00005555565c3a67 in zend_generator_dtor_storage (object=0x7ffff584e640) at Zend/zend_generators.c:244 #7 0x00005555566022a8 in zend_objects_store_del (object=0x7ffff584e640) at Zend/zend_objects_API.c:184 #8 0x0000555556270717 in rc_dtor_func (p=0x7ffff584e640) at Zend/zend_variables.c:57 #9 0x0000555556270805 in i_zval_ptr_dtor (zval_ptr=0x7fffffffaee0) at Zend/zend_variables.h:44 #10 0x0000555556270755 in zval_ptr_dtor (zval_ptr=0x7fffffffaee0) at Zend/zend_variables.c:84 #11 0x00005555562cecc1 in _zend_hash_del_el_ex (ht=0x555557ae3530 <executor_globals+304>, idx=7, p=0x7ffff584b2e0, prev=0x0) at Zend/zend_hash.c:1355 #12 0x00005555562cda1e in _zend_hash_del_el (ht=0x555557ae3530 <executor_globals+304>, idx=7, p=0x7ffff584b2e0) at Zend/zend_hash.c:1378 #13 0x00005555562d5613 in zend_hash_reverse_apply (ht=0x555557ae3530 <executor_globals+304>, apply_func=0x555556222510 <zval_call_destructor>) at Zend/zend_hash.c:1949 #14 0x00005555562222f0 in shutdown_destructors () at Zend/zend_execute_API.c:252 #15 0x000055555627702d in zend_call_destructors () at Zend/zend.c:1256 #16 0x0000555556099a73 in php_request_shutdown (dummy=0x0) at main/main.c:1809 #17 0x00005555567eb9a8 in do_cli (argc=2, argv=0x603000000640) at sapi/cli/php_cli.c:1135 #18 0x00005555567e80f0 in main (argc=2, argv=0x603000000640) at sapi/cli/php_cli.c:1367 (gdb) frame 2 #2 0x00005555563176b2 in cleanup_unfinished_calls (execute_data=0x7ffff58621e0, op_num=3) at Zend/zend_execute.c:4230 4230 zend_free_extra_named_params(call->extra_named_params); (gdb) p call->extra_named_params $1 = (zend_array *) 0x0 ``` ### PHP Version PHP 8.1 24c297086d01811c5fd14ba3a3b9151759ab9c16 ### Operating System _No response_

« previous php.bugs (#242599) next »