Don't replace tmp with cv in YIELD argument

For by-ref generators, these may have different behavior. Fixes oss-fuzz 6059739298004992.
php · Oct 12, 2021 · 9ebe849 · 9ebe849
1 parent 845a67f
commit 9ebe849
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 1 deletion.
diff --git a/Zend/tests/generators/yield_by_reference_optimization.phpt b/Zend/tests/generators/yield_by_reference_optimization.phpt
@@ -0,0 +1,21 @@
+--TEST--
+Make sure optimization does not interfere with yield by ref
+--FILE--
+<?php
+
+function &gen() {
+    yield $v = 0;
+    yield $v = 1;
+}
+
+foreach (gen() as $v) {
+    var_dump($v);
+}
+
+?>
+--EXPECTF--
+Notice: Only variable references should be yielded by reference in %s on line %d
+int(0)
+
+Notice: Only variable references should be yielded by reference in %s on line %d
+int(1)
diff --git a/ext/opcache/Optimizer/dfa_pass.c b/ext/opcache/Optimizer/dfa_pass.c
@@ -1010,7 +1010,8 @@ static int zend_dfa_try_to_replace_result(zend_op_array *op_array, zend_ssa *ssa
 		 && op_array->opcodes[use].opcode != ZEND_FREE
 		 && op_array->opcodes[use].opcode != ZEND_SEND_VAL
 		 && op_array->opcodes[use].opcode != ZEND_SEND_VAL_EX
-		 && op_array->opcodes[use].opcode != ZEND_VERIFY_RETURN_TYPE) {
+		 && op_array->opcodes[use].opcode != ZEND_VERIFY_RETURN_TYPE
+		 && op_array->opcodes[use].opcode != ZEND_YIELD) {
 			if (use > def) {
 				int i = use;
 				const zend_op *opline = &op_array->opcodes[use];