Fix fiber switch corrupting user comparator globals in sort functions

ext/standard/array.c

@@ -35,6 +35,7 @@
 #include "zend_exceptions.h"
 #include "ext/random/php_random.h"
 #include "zend_frameless_function.h"
+#include "zend_fibers.h"
 
 /* {{{ defines */
 
@@ -807,8 +808,11 @@ static int php_array_user_compare(Bucket *a, Bucket *b) /* {{{ */
 	old_user_compare_fci_cache = BG(user_compare_fci_cache); \
 	ARRAYG(compare_deprecation_thrown) = 0; \
 	BG(user_compare_fci_cache) = empty_fcall_info_cache; \
+	/* The comparator is restored in LIFO order, which a fiber switch breaks. */ \
+	zend_fiber_switch_block(); \
 
 #define PHP_ARRAY_CMP_FUNC_RESTORE() \
+	zend_fiber_switch_unblock(); \
 	BG(user_compare_fci) = old_user_compare_fci; \
 	BG(user_compare_fci_cache) = old_user_compare_fci_cache; \
 
@@ -6379,6 +6383,7 @@ PHP_FUNCTION(array_multisort)
 	func[num_arrays - 1] = php_get_data_compare_func_unstable(sort_type, sort_order != PHP_SORT_ASC);
 	bucket_compare_func_t *old_multisort_func = ARRAYG(multisort_func);
 	ARRAYG(multisort_func) = func;
+	zend_fiber_switch_block();
 
 	/* Create the indirection array. This array is of size MxN, where
 	 * M is the number of entries in each input array and N is the number
@@ -6470,6 +6475,7 @@ PHP_FUNCTION(array_multisort)
 	efree(indirect);
 	efree(func);
 	efree(arrays);
+	zend_fiber_switch_unblock();
 	ARRAYG(multisort_func) = old_multisort_func;
 }
 /* }}} */

ext/standard/tests/array/array_sort_comparator_fiber_switch.phpt

@@ -0,0 +1,125 @@
+--TEST--
+Sort functions: suspending a fiber from the comparator throws a FiberError
+--FILE--
+<?php
+
+function run(string $label, callable $sort)
+{
+    $fiber = new Fiber($sort);
+    try {
+        $fiber->start();
+        echo "$label: no error\n";
+    } catch (FiberError $e) {
+        echo "$label: ", $e->getMessage(), "\n";
+    }
+}
+
+$suspend = function ($x, $y) {
+    Fiber::suspend();
+    return $x <=> $y;
+};
+
+run('usort', function () use ($suspend) {
+    $array = [3, 1, 2];
+    usort($array, $suspend);
+});
+
+run('uasort', function () use ($suspend) {
+    $array = [3, 1, 2];
+    uasort($array, $suspend);
+});
+
+run('uksort', function () use ($suspend) {
+    $array = ['b' => 1, 'a' => 2];
+    uksort($array, $suspend);
+});
+
+run('array_udiff', function () use ($suspend) {
+    array_udiff([1, 2], [1], $suspend);
+});
+
+run('array_uintersect', function () use ($suspend) {
+    array_uintersect([1, 2], [1], $suspend);
+});
+
+run('array_diff_ukey', function () use ($suspend) {
+    array_diff_ukey(['a' => 1], ['a' => 1], $suspend);
+});
+
+run('array_multisort', function () {
+    $array = [
+        new class {
+            function __toString(): string
+            {
+                Fiber::suspend();
+                return '3';
+            }
+        },
+        new class {
+            function __toString(): string
+            {
+                return '1';
+            }
+        },
+    ];
+    array_multisort($array, SORT_STRING);
+});
+
+$fiber = new Fiber(function () {
+    Fiber::suspend('before');
+    $array = [3, 1, 2];
+    usort($array, fn($x, $y) => $x <=> $y);
+    return $array;
+});
+var_dump($fiber->start());
+$fiber->resume();
+var_dump($fiber->getReturn());
+
+$array = [3, 1, 2];
+try {
+    usort($array, function ($x, $y) {
+        throw new Exception('boom');
+    });
+} catch (Exception $e) {
+    echo $e->getMessage(), "\n";
+}
+$fiber = new Fiber(function () {
+    Fiber::suspend('after exception');
+});
+var_dump($fiber->start());
+
+$array = [3, 1, 2];
+usort($array, function ($x, $y) {
+    $inner = [2, 1];
+    usort($inner, fn($a, $b) => $a <=> $b);
+    return $x <=> $y;
+});
+var_dump($array);
+?>
+--EXPECT--
+usort: Cannot switch fibers in current execution context
+uasort: Cannot switch fibers in current execution context
+uksort: Cannot switch fibers in current execution context
+array_udiff: Cannot switch fibers in current execution context
+array_uintersect: Cannot switch fibers in current execution context
+array_diff_ukey: Cannot switch fibers in current execution context
+array_multisort: Cannot switch fibers in current execution context
+string(6) "before"
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}
+boom
+string(15) "after exception"
+array(3) {
+  [0]=>
+  int(1)
+  [1]=>
+  int(2)
+  [2]=>
+  int(3)
+}