Fixed bug #74840 (Opcache overwrites argument of GENERATOR_RETURN within finally)

Author: bwoebi

NEWS

@@ -10,6 +10,10 @@ PHP                                                                        NEWS
   . Fixed bug #74761 (Unary operator expected error on some systems). (petk)
   . Fixed bug #73900 (Use After Free in unserialize() SplFixedArray). (nikic)
 
+- Opcache:
+  . Fixed bug #74840 (Opcache overwrites argument of GENERATOR_RETURN within
+    finally). (Bob)
+
 - PDO:
   . Fixed bug #69356 (PDOStatement::debugDumpParams() truncates query). (Adam
     Baratz)

Zend/tests/bug74840.phpt

@@ -0,0 +1,21 @@
+--TEST--
+Bug #74840: Opcache overwrites argument of GENERATOR_RETURN within finally
+--FILE--
+<?php
+
+$g = (function($a) {
+	try {
+		return $a + 1;
+	} finally {
+		$b = $a + 2;
+		var_dump($b);
+	}
+	yield; // Generator
+})(1);
+$g->next();
+var_dump($g->getReturn());
+
+?>
+--EXPECT--
+int(3)
+int(2)

ext/opcache/Optimizer/optimize_temp_vars_5.c

@@ -109,6 +109,7 @@ void optimize_temporary_variables(zend_op_array *op_array, zend_optimizer_ctx *c
 					 */
 					if ((op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) &&
 					    (opline->opcode == ZEND_RETURN ||
+					     opline->opcode == ZEND_GENERATOR_RETURN ||
 					     opline->opcode == ZEND_RETURN_BY_REF ||
 					     opline->opcode == ZEND_FREE ||
 					     opline->opcode == ZEND_FE_FREE)) {