Bug #71133 [Opn]: segfault on exception from generator

Edit report at https://bugs.php.net/bug.php?id=71133&edit=1

 ID:                 71133
 User updated by:    Bernhard dot Liebl at rz dot uni-regensburg dot de
 Reported by:        Bernhard dot Liebl at rz dot uni-regensburg dot de
 Summary:            segfault on exception from generator
 Status:             Open
 Type:               Bug
 Package:            PHP Language Specification
 Operating System:   Linux
 PHP Version:        5.6.16
 Block user comment: N
 Private report:     N

 New Comment:

Test on my local installation:

$ php -n coredump.php
starting 5.5.9-1ubuntu4.14
Segmentation fault (core dumped)

Also happens with php -n on clean docker images php:5.5-cli (5.5.30) and php:5.6-cli (5.6.16).


Previous Comments:
------------------------------------------------------------------------
[2015-12-16 08:21:39] [email protected]

could you try to test agian by "php -n" , which will disable all other third-part extensions.

------------------------------------------------------------------------
[2015-12-16 07:49:30] Bernhard dot Liebl at rz dot uni-regensburg dot de

Description:
------------
Throwing an exception from a generator under certain conditions produces a segfault. Happens with php 5.5.9 and php 5.6.16. Seems to be fixed with php 7.

Test script:
---------------
<?php

$a = function() {
    try {
        yield 1;
    } finally {
        throw new Exception();
    }
};

$b = function() {
    yield 1;
};

echo "starting " . phpversion() . "\n";
try {
    foreach ($a() as $x) {
        foreach ($b() as $y) {
            return true;
        }
    }
} catch (Exception $e) {
    echo "caught exception.\n";
}
echo "exit.\n";

Expected result:
----------------
starting 7.0.0
caught exception.
exit.

Actual result:
--------------
OUTPUT:
starting 5.6.16

COREDUMPS THEN
BACKTRACE:

Program received signal SIGSEGV, Segmentation fault.
0x000000000070d359 in gc_zval_possible_root ()
(gdb) bt
#0  0x000000000070d359 in gc_zval_possible_root ()
#1  0x000000000079b287 in ?? ()
#2  0x0000000000717e28 in execute_ex ()
#3  0x00000000006ddf89 in dtrace_execute_ex ()
#4  0x00000000006efa10 in zend_execute_scripts ()
#5  0x000000000068f845 in php_execute_script ()
#6  0x00000000007a00ce in ?? ()
#7  0x0000000000461d90 in main ()



------------------------------------------------------------------------



--
Edit this bug report at https://bugs.php.net/bug.php?id=71133&edit=1