Merge branch 'PHP-7.0'

2 files changed, 35 insertions, 2 deletions

diff --git a/Zend/tests/generators/bug71441.phpt b/Zend/tests/generators/bug71441.phpt
new file mode 100644
index 0000000000..3a103888b0
--- /dev/null
+++ b/Zend/tests/generators/bug71441.phpt
@@ -0,0 +1,29 @@
+--TEST--
+Bug #71441 (Typehinted Generator with return in try/finally crashes)
+--FILE--
+<?php
+
+$num = 2000; /* to be sure to be in wild memory */
+$add = str_repeat("1 +", $num);
+$gen = (eval(<<<PHP
+return function (): \Generator {
+	try {
+		\$a = 1;
+		\$foo = \$a + $add \$a;
+		return yield \$foo;
+	} finally {
+		print "Ok\n";
+	}
+};
+PHP
+))();
+var_dump($gen->current());
+$gen->send("Success");
+var_dump($gen->getReturn());
+
+?>
+--EXPECT--
+int(2002)
+Ok
+string(7) "Success"
+
diff --git a/Zend/zend_opcode.c b/Zend/zend_opcode.c
index 8b55037794..d58e59b1c1 100644
--- a/Zend/zend_opcode.c
+++ b/Zend/zend_opcode.c
@@ -696,9 +696,13 @@ ZEND_API int pass_two(zend_op_array *op_array)
 			case ZEND_VERIFY_RETURN_TYPE:
 				if (op_array->fn_flags & ZEND_ACC_GENERATOR) {
 					if (opline->op1_type != IS_UNUSED) {
-						(opline + 1)->op1 = opline->op1;
-						(opline + 1)->op1_type = opline->op1_type;
+						zend_op *ret = opline;
+						do ret++; while (ret->opcode != ZEND_RETURN);
+
+						ret->op1 = opline->op1;
+						ret->op1_type = opline->op1_type;
 					}
+
 					MAKE_NOP(opline);
 				}
 				break;