Crash when stack walking in destructor of yielded from values during Generator->throw()

[bwoebi]

Description

The following code (https://3v4l.org/QeJLV):

<?php

$gen = (function() {
    yield from [null, new class { function __destruct() { throw new Exception; } }];
})();

function foo($gen) {
    $gen->valid();
}
foo($gen);

function spray() {}
spray(...range(1, 20));

$gen->throw(new Error);

Resulted in segmentation fault.

But I expected this output instead:

Fatal error: Uncaught Exception in /in/QeJLV:4
Stack trace:
#0 /in/QeJLV(4): class@anonymous->__destruct()
#1 [internal function]: {closure}()
#2 /in/QeJLV(15): Generator->throw(Object(Error))
#3 {main}

Next Error in /in/QeJLV:15
Stack trace:
#0 {main}
  thrown in /in/QeJLV on line 15

PHP Version

PHP 8.0.19-8.3.7

Operating System

No response

[morrisonlevi]

Note that spraying is not always necessary: https://3v4l.org/aqFD6.

// Primes the generator, sets prev_execute_data to something non-null.
function prime(Generator $generator)
{
    $generator->valid();
}

$g = (function () {
    yield from [null, new class {
        function __destruct()
        {
            // Trigger a stack walk, hitting a bad frame.
            print new Exception;
        }
    }];
})();

prime($g);

$g->throw(new Error);