From 60871e51ada0644f258c991d67adba22d38f8a7b Mon Sep 17 00:00:00 2001
From: Nikita Popov <nikic@php.net>
Date: Sat, 24 Nov 2012 18:21:11 +0100
Subject: [PATCH] Fix bug #63596: finally in generators segfaults

EX(fast_ret) wasn't initialized in this case so the code ended up
dereferencing an invalid pointer after the jump.
---
 Zend/tests/generators/finally_ran_on_close.phpt | 17 +++++++++++------
 Zend/zend_generators.c                          |  1 +
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/Zend/tests/generators/finally_ran_on_close.phpt b/Zend/tests/generators/finally_ran_on_close.phpt
index 44a84fae5c7..04a0561c879 100644
--- a/Zend/tests/generators/finally_ran_on_close.phpt
+++ b/Zend/tests/generators/finally_ran_on_close.phpt
@@ -5,14 +5,18 @@ finally is run even if a generator is closed mid-execution
 
 function gen() {
     try {
-        echo "before yield\n";
-        yield;
-        echo "after yield\n";
+        try {
+            echo "before yield\n";
+            yield;
+            echo "after yield\n";
+        } finally {
+            echo "finally run\n";
+        }
+        echo "code after finally\n";
     } finally {
-        echo "finally run\n";
+        echo "second finally run\n";
     }
-
-    echo "code after finally\n";
+    echo "code after second finally\n";
 }
 
 $gen = gen();
@@ -23,3 +27,4 @@ unset($gen);
 --EXPECT--
 before yield
 finally run
+second finally run
diff --git a/Zend/zend_generators.c b/Zend/zend_generators.c
index 516ff0b6ebb..18953058753 100644
--- a/Zend/zend_generators.c
+++ b/Zend/zend_generators.c
@@ -60,6 +60,7 @@ void zend_generator_close(zend_generator *generator, zend_bool finished_executio
 				 * the resume. */
 				if (finally_op_num) {
 					execute_data->opline = &op_array->opcodes[finally_op_num];
+					execute_data->fast_ret = NULL;
 					generator->flags |= ZEND_GENERATOR_FORCED_CLOSE;
 					zend_generator_resume(generator TSRMLS_CC);
 					return;