Fixed bug #71092 (Segmentation fault with return type hinting)

diff --git a/NEWS b/NEWS
index 6f2b4b270183859fb33c682e34ead8790aa1d5d7..54bdeb7578aa0400cc5ee290a31cc7eb15e949f9 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,7 @@ PHP                                                                        NEWS
 ?? Jan 2016 PHP 7.0.2
 
 - Core:
+  . Fixed bug #71092 (Segmentation fault with return type hinting). (Laruence)
   . Fixed bug memleak in header_register_callback. (Laruence)
   . Fixed bug #71067 (Local object in class method stays in memory for each
     call). (Laruence)

diff --git a/Zend/tests/return_types/029.phpt b/Zend/tests/return_types/029.phpt
new file mode 100644 (file)
index 0000000..011182d
--- /dev/null
+++ b/Zend/tests/return_types/029.phpt
@@ -0,0 +1,23 @@
+--TEST--
+return type with finally
+--INI--
+opcache.enable=0
+--FILE--
+<?php
+
+function foo() : array {
+       try {
+               throw new Exception("xxxx");
+       } finally {
+               return ;
+       }
+}
+
+foo();
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Return value of foo() must be of the type array, none returned in %s29.php:%d
+Stack trace:
+#0 %s(%d): foo()
+#1 {main}
+  thrown in %s029.php on line %d

diff --git a/Zend/tests/return_types/bug71092.phpt b/Zend/tests/return_types/bug71092.phpt
new file mode 100644 (file)
index 0000000..a1ebc79
--- /dev/null
+++ b/Zend/tests/return_types/bug71092.phpt
@@ -0,0 +1,23 @@
+--TEST--
+Bug #71092 (Segmentation fault with return type hinting)
+--INI--
+opcache.enable=0
+--FILE--
+<?php
+
+function boom(): array {
+       $data = [['id']];
+       switch ($data[0]) {
+       case ['id']:
+               return;
+       }
+}
+
+boom();
+?>
+--EXPECTF--
+Fatal error: Uncaught TypeError: Return value of boom() must be of the type array, none returned in %sbug71092.php:%d
+Stack trace:
+#0 %s(%d): boom()
+#1 {main}
+  thrown in %sbug71092.php on line %d

diff --git a/Zend/zend_compile.c b/Zend/zend_compile.c
index 34246bdc04d2676de8c7ba4da48eb8ae899c53ef..1609ba5127f4bde9222c37f16986fa4053da1a08 100644 (file)
--- a/Zend/zend_compile.c
+++ b/Zend/zend_compile.c
@@ -3583,8 +3583,6 @@ void zend_compile_return(zend_ast *ast) /* {{{ */
                zend_compile_expr(&expr_node, expr_ast);
        }
 
-       zend_handle_loops_and_finally();
-
        if (CG(context).in_finally) {
                opline = zend_emit_op(NULL, ZEND_DISCARD_EXCEPTION, NULL, NULL);
                opline->op1_type = IS_TMP_VAR;
@@ -3595,6 +3593,9 @@ void zend_compile_return(zend_ast *ast) /* {{{ */
        if (!(CG(active_op_array)->fn_flags & ZEND_ACC_GENERATOR) && CG(active_op_array)->fn_flags & ZEND_ACC_HAS_RETURN_TYPE) {
                zend_emit_return_type_check(expr_ast ? &expr_node : NULL, CG(active_op_array)->arg_info - 1);
        }
+
+       zend_handle_loops_and_finally();
+
        opline = zend_emit_op(NULL, by_ref ? ZEND_RETURN_BY_REF : ZEND_RETURN,
                &expr_node, NULL);