Prevent resumption of generator suspended in yield from

Normally we prevent generators from being resumed while they are already
running, but we failed to do so for generators delegating to non-Generators. As
a result such generator can be resumed, terminated, which causes unexpected
results (crashes) later.

In gh19306.phpt in particular, the generator delegate It::getIterator() suspends
while being called by generator g(). We then resume g(), which throws while
trying to resume It::getIterator(). This causes g() and It::getIterator()
to be released. We then UAF when resuming the Fiber in It::getIterator().

Fix this by ensuring that generators are marked as running while they fetch
the next value from the delegate.

Fixes phpGH-19306
Closes phpGH-19315

Author: arnaud-lb

NEWS

@@ -13,6 +13,8 @@ PHP                                                                        NEWS
     (Arnaud)
   . Fixed bug GH-19303 (Unpacking empty packed array into uninitialized array
     causes assertion failure). (nielsdos)
+  . Fixed bug GH-19306 (Generator can be resumed while fetching next value from
+    delegated Generator). (Arnaud)
 
 - FTP:
   . Fix theoretical issues with hrtime() not being available. (nielsdos)

Zend/tests/gh19306.phpt

@@ -0,0 +1,40 @@
+--TEST--
+GH-19306: Generator suspended in yield from may be resumed
+--FILE--
+<?php
+
+class It implements IteratorAggregate
+{
+    public function getIterator(): Generator
+    {
+        yield "";
+        Fiber::suspend();
+    }
+}
+function g()
+{
+    yield from new It();
+}
+$a = g();
+$fiber = new Fiber(function () use ($a) {
+    echo "Fiber start\n";
+    $a->next();
+    echo "Fiber return\n";
+});
+$fiber->start();
+echo "Fiber suspended\n";
+try {
+    $a->next();
+} catch (Throwable $t) {
+    echo $t->getMessage(), "\n";
+}
+echo "Destroying fiber\n";
+$fiber = null;
+echo "Shutdown\n";
+?>
+--EXPECT--
+Fiber start
+Fiber suspended
+Cannot resume an already running generator
+Destroying fiber
+Shutdown

Zend/zend_generators.c

@@ -787,6 +787,8 @@ ZEND_API void zend_generator_resume(zend_generator *orig_generator) /* {{{ */
 		orig_generator->execute_fake.prev_execute_data = original_execute_data;
 	}
 
+	generator->flags |= ZEND_GENERATOR_CURRENTLY_RUNNING;
+
 	/* Ensure this is run after executor_data swap to have a proper stack trace */
 	if (UNEXPECTED(!Z_ISUNDEF(generator->values))) {
 		if (EXPECTED(zend_generator_get_next_delegated_value(generator) == SUCCESS)) {
@@ -795,7 +797,7 @@ ZEND_API void zend_generator_resume(zend_generator *orig_generator) /* {{{ */
 			EG(jit_trace_num) = original_jit_trace_num;
 
 			orig_generator->flags &= ~(ZEND_GENERATOR_DO_INIT | ZEND_GENERATOR_IN_FIBER);
-			generator->flags &= ~ZEND_GENERATOR_IN_FIBER;
+			generator->flags &= ~(ZEND_GENERATOR_CURRENTLY_RUNNING | ZEND_GENERATOR_IN_FIBER);
 			return;
 		}
 		if (UNEXPECTED(EG(exception))) {
@@ -817,7 +819,6 @@ ZEND_API void zend_generator_resume(zend_generator *orig_generator) /* {{{ */
 	}
 
 	/* Resume execution */
-	generator->flags |= ZEND_GENERATOR_CURRENTLY_RUNNING;
 	if (!ZEND_OBSERVER_ENABLED) {
 		zend_execute_ex(generator->execute_data);
 	} else {