Fix generator memory leaks when interrupted during argument evaluation (#9756)

Restore extra_named_params when restoring frozen call stack

Ensure correct target opline for exceptions thrown during yield from

Also appends the exception during a yield from values dtor instead of prepending it

Fixing regression introduced

Ensure correct target opline for exceptions thrown during yield from

Also appends the exception during a yield from values dtor instead of prepending it

Fixing regression introduced in 13649451c201361b438ca0f762cfb33dfc3fca39.

show more ...

Fix GH-8289: Exceptions thrown within a yielded from iterator are not rethrown into the generator

This also fixes the fact that exception traces were not including the generator frame when t

Fix GH-8289: Exceptions thrown within a yielded from iterator are not rethrown into the generator

This also fixes the fact that exception traces were not including the generator frame when thrown in a yielded from iterator.

show more ...

Fix use after free

Fixes oss-fuzz #44885

Fix memory leak

Fixes oss-fuzz #44685

Short-circuit get_gc for currently running generator

Simplify and fix generator tree management

This makes a number of related changes to the generator tree
management, that should hopefully make it easier to understand,
more robust an

Simplify and fix generator tree management

This makes a number of related changes to the generator tree
management, that should hopefully make it easier to understand,
more robust and faster for the common linear-chain case. Fixes
https://bugs.php.net/bug.php?id=80240, which was the original
motivation here.

* Generators now only add a ref to their direct parent.
* Nodes only store their children, not their leafs, which avoids
any need for leaf updating. This means it's no longer possible
to fetch the child for a certain leaf, which is something we
only needed in one place (update_current). If multi-children
nodes are involved, this will require doing a walk in the other
direction (from leaf to root). It does not affect the common
case of single-child nodes.
* The root/leaf pointers are now seen as a pair. One leaf generator
can point to the current root. If a different leaf generator is
used, we'll move the root pointer over to that one. Again, this
is a cache to make the common linear chain case fast, trees may
need to scan up the parent link.

Closes GH-6344.

show more ...

Run tidy

This should fix most of the remaining issues with tabs and spaces
being mixed in tests.

Cleanup observer API and add JIT support

Fix use-after-free with yield from in yield_from_multi_tree_single_nodes.phpt

Prevent release of generator children during destruction

Fix crashes with unproper cleaning of repeated yield from

Closes GH-6130

Don't allow dynamic properties on generators

Noticed this because we leak those properties in GC. This was
never intended to be allowed.

Fix throwing of yield from related exceptions into generator

Use the general zend_generator_throw_exception() helper for this.
Otherwise we don't handle the off-by-one opline correctly (

Fix throwing of yield from related exceptions into generator

Use the general zend_generator_throw_exception() helper for this.
Otherwise we don't handle the off-by-one opline correctly (should
we maybe just stop doing that?)

This is a followup to ad750c3bb6e7b48384c6265eb9d3bcf5b4000652,
which fixed a different yield from exception handling problem that
happened to show up in the same test case from oss-fuzz #25321.
Now both issues should be fixed.

show more ...

Assert there are children in zend_generator_get_child()

Add zend_observer API

Closes GH-5857.

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>
Co-authored-by: Sammy Powers <sammyk@datadoghq.com>

Fix handling of exception if valid() during yield from

Fixes oss-fuzz #25296.

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functio

Improve type declarations for Zend APIs

Voidification of Zend API which always succeeded
Use bool argument types instead of int for boolean arguments
Use bool return type for functions which return true/false (1/0)
Use zend_result return type for functions which return SUCCESS/FAILURE as they don't follow normal boolean semantics

Closes GH-6002

show more ...

Fixed bug #79927

We need to unset the AT_FIRST_YIELD flag when yielding from an
array as well.

In the interest of being conservative, I'm applying this only to
PHP 8.

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument nam

Implement named parameters

From an engine perspective, named parameters mainly add three
concepts:

* The SEND_* opcodes now accept a CONST op2, which is the
argument name. For now, it is looked up by linear scan and
runtime cached.
* This may leave UNDEF arguments on the stack. To avoid having
to deal with them in other places, a CHECK_UNDEF_ARGS opcode
is used to either replace them with defaults, or error.
* For variadic functions, EX(extra_named_params) are collected
and need to be freed based on ZEND_CALL_HAS_EXTRA_NAMED_PARAMS.

RFC: https://wiki.php.net/rfc/named_params

Closes GH-5357.

show more ...

Remove proto comments from C files

Closes GH-5758

Add iterator get_gc function for generators

Closes GH-5787.

Add get_gc handle for object iterators

Optional handler with the same semantics as the object handler.

Remove generator iterator member

This is probably a leftover from the PHP 5 implementation, where
the iterator was embedded directly in the generator.

Remove bogus generator iterator dtor

Fixes a use-after-free encountered in Symfony's SecurityBundle.
I don't have a reproducer for this, and believe the issue can only
occur if we le

Remove bogus generator iterator dtor

Fixes a use-after-free encountered in Symfony's SecurityBundle.
I don't have a reproducer for this, and believe the issue can only
occur if we leak an iterator (the leak is a separate issue).

We should not free the generator iterator here, because we do not
own it. The code that fetched the iterator is responsible for
releasing it. In the rare case where we do hit this code-path,
we cause a use-after-free.

show more ...