Crash when stack walking in destructor of yielded from values during Generator->throw()

Description

The following code (https://3v4l.org/QeJLV):

<?php

$gen = (function() {
    yield from [null, new class { function __destruct() { throw new Exception; } }];
})();

function foo($gen) {
    $gen->valid();
}
foo($gen);

function spray() {}
spray(...range(1, 20));

$gen->throw(new Error);

Resulted in segmentation fault.

But I expected this output instead:

Fatal error: Uncaught Exception in /in/QeJLV:4
Stack trace:
#0 /in/QeJLV(4): class@anonymous->__destruct()
#1 [internal function]: {closure}()
#2 /in/QeJLV(15): Generator->throw(Object(Error))
#3 {main}

Next Error in /in/QeJLV:15
Stack trace:
#0 {main}
  thrown in /in/QeJLV on line 15

PHP Version

PHP 8.0.19-8.3.7

Operating System

No response

Note that spraying is not always necessary: https://3v4l.org/aqFD6.

// Primes the generator, sets prev_execute_data to something non-null.
function prime(Generator $generator)
{
    $generator->valid();
}

$g = (function () {
    yield from [null, new class {
        function __destruct()
        {
            // Trigger a stack walk, hitting a bad frame.
            print new Exception;
        }
    }];
})();

prime($g);

$g->throw(new Error);

Fix GH-14387: Crash when stack walking in destructor of yielded from …

Navigation Menu

Repository navigation

Crash when stack walking in destructor of yielded from values during Generator->throw() #14387

Description

PHP Version

Operating System

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Crash when stack walking in destructor of yielded from values during Generator->throw() #14387

Description

Description

PHP Version

Operating System

Activity

morrisonlevi commented on May 31, 2024

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions