View Issue Details

IDProjectCategoryView StatusLast Update
0001770XdebugUncategorizedpublic2020-04-30 09:52
ReporterylandsmanAssigned Toderick 
PriorityhighSeveritycrashReproducibilityalways
Status resolvedResolutionunable to reproduce 
Platformnginx 1.17.9 php-fpm 7.3.xOScentosOS Version7 & 8
Product Version2.9.4 
Target VersionFixed in Version 
Summary0001770: fpm child process crashes when there is a php error
DescriptionAs an example: -

<?php
ob_start();
$result = eval("?>".$string."<"."?p"."hp return 1;");
$new_string = ob_get_clean();


What I expect is a string undefined error
when xdebug is not enabled in my php,ini that is exactly what I get
when xdebug is enabled I get a 502 error and child 7584 exited on signal 6 (SIGABRT) in the php log

Steps To Reproducestart php-fpm with xdebug started,

run the above code

nginx will give a 502 error and the php log will show the above quoted error
TagsNo tags attached.
Operating System
PHP Version7.3.10-7.3.14

Activities

derick

2020-03-23 13:18

administrator   ~0005332

Would you mind trying Xdebug 2.9.4 that I've just released first?

If that doesn't work, then please provide more information so that I can try to reproduce this at home. Particularly your set-up, your Xdebug php.ini settings, which OS and how you've installed nginx, php-fpm, and Xdebug.

ylandsman

2020-03-23 13:29

reporter   ~0005333

Thank you for your speedy response

Unfortunately didn't work.

php.ini is included here. php and nginx were built by me from source

xdebug was installed through pecl

php.ini (72,358 bytes)

derick

2020-03-23 15:12

administrator   ~0005336

Nothing weird in the INI settings. I'd love to reproduce this, but I've not ever used nginx and php-fpm. Can you provider either a Dockerfile that demonstrates the problem, a Vagrant image, or the full and exact steps to reproduce this locally? Assume I know nothing of nginx and php-fpm :-)

ylandsman

2020-03-24 16:49

reporter   ~0005339

I don't have any experience with docker or vagrant, but it occurred to me to try running php-fpm in a non daemonized process, and I got the following backtrace. Maybe this will give you the clues you need.

*** Error in `php-fpm: pool brgb': free(): invalid next size (fast): 0x0000000003771b70 ***
======= Backtrace: =========
/lib64/libc.so.6(+0x81679)[0x7f978bbdd679]
php-fpm: pool brgb[0x9042e2]
php-fpm: pool brgb[0x904456]
php-fpm: pool brgb(php_log_err_with_severity+0x12f)[0x449a13]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(xdebug_log_stack+0x7c)[0x7f97820a1dec]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(xdebug_error_cb+0x4ec)[0x7f97820a32fc]
php-fpm: pool brgb(zend_error+0x251)[0x44bf9d]
php-fpm: pool brgb[0x44b532]
php-fpm: pool brgb[0x8443b7]
php-fpm: pool brgb(php_output_get_contents+0x32)[0x81df62]
php-fpm: pool brgb[0x822388]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x12c7d)[0x7f97820a0c7d]
php-fpm: pool brgb[0x454a4a]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4546a3]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4546a3]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4546a3]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4546a3]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x8e20c9]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4546a3]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb(zend_call_function+0x679)[0x85d129]
php-fpm: pool brgb[0x7231e7]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x12c7d)[0x7f97820a0c7d]
php-fpm: pool brgb[0x454714]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
php-fpm: pool brgb[0x4549d2]
php-fpm: pool brgb(execute_ex+0x1609)[0x8e7839]
/usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so(+0x1236f)[0x7f97820a036f]
======= Memory map: ========
00400000-01159000 r-xp 00000000 fd:01 79691904 /usr/local/php7/sbin/php-fpm
01358000-01415000 r--p 00d58000 fd:01 79691904 /usr/local/php7/sbin/php-fpm
01415000-01426000 rw-p 00e15000 fd:01 79691904 /usr/local/php7/sbin/php-fpm
01426000-0144c000 rw-p 00000000 00:00 0
03303000-0350f000 rw-p 00000000 00:00 0 [heap]
0350f000-037a3000 rw-p 00000000 00:00 0 [heap]
7f9770000000-7f9770021000 rw-p 00000000 00:00 0
7f9770021000-7f9774000000 ---p 00000000 00:00 0
7f9777e00000-7f9779a8e000 rw-p 00000000 00:00 0
7f977ac00000-7f977ba28000 rw-p 00000000 00:00 0
7f977cc00000-7f977da28000 rw-p 00000000 00:00 0
7f977dc00000-7f977ea5c000 rw-p 00000000 00:00 0
7f977fa00000-7f9781e00000 rw-p 00000000 00:00 0
7f9781e7b000-7f9781e87000 r-xp 00000000 fd:01 108952 /usr/lib64/libnss_files-2.17.so
7f9781e87000-7f9782086000 ---p 0000c000 fd:01 108952 /usr/lib64/libnss_files-2.17.so
7f9782086000-7f9782087000 r--p 0000b000 fd:01 108952 /usr/lib64/libnss_files-2.17.so
7f9782087000-7f9782088000 rw-p 0000c000 fd:01 108952 /usr/lib64/libnss_files-2.17.so
7f9782088000-7f978208e000 rw-p 00000000 00:00 0
7f978208e000-7f97820d1000 r-xp 00000000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so
7f97820d1000-7f97822d1000 ---p 00043000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so
7f97822d1000-7f97822d3000 r--p 00043000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so
7f97822d3000-7f97822d5000 rw-p 00045000 fd:01 8458170 /usr/local/php7/lib/php/extensions/no-debug-non-zts-20180731/xdebug.so
7f97822d5000-7f97822d6000 rw-p 00000000 00:00 0
7f97822d6000-7f9788800000 r--p 00000000 fd:01 108921 /usr/lib/locale/locale-archive
7f9788800000-7f9788a00000 rw-p 00000000 00:00 0
7f9788b34000-7f9788b94000 r-xp 00000000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0
7f9788b94000-7f9788d94000 ---p 00060000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0
7f9788d94000-7f9788d95000 r--p 00060000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0
7f9788d95000-7f9788d96000 rw-p 00061000 fd:01 109054 /usr/lib64/libpcre.so.1.2.0
7f9788d96000-7f9788d9a000 r-xp 00000000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0
7f9788d9a000-7f9788f9a000 ---p 00004000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0
7f9788f9a000-7f9788f9b000 r--p 00004000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0
7f9788f9b000-7f9788f9c000 rw-p 00005000 fd:01 109278 /usr/lib64/libcap-ng.so.0.0.0
7f9788f9c000-7f9788fb8000 r-xp 00000000 fd:01 118167 /usr/lib64/libsasl2.so.3.0.0
7f9788fb8000-7f97891b7000 ---p 0001c000 fd:01 118167 [24-Mar-2020 16:16:30.377939] DEBUG: pid 24627, fpm_got_signal(), line 82: received SIGCHLD

derick

2020-03-24 17:12

administrator   ~0005341

How do I "try running php-fpm in a non daemonized process" ? *Please* provide the exact steps to reproduce this. I can't guess what you have done :-)

ylandsman

2020-03-24 17:55

reporter   ~0005343

Add the -F switch to the command line, and it will stay within the current shell context. Then from the web server, go the the url for the script I showed earlier and you will get this backtrace.

As an aside, if it will help, I would be happy to recompile xdebug in a debug mode, and generate a backtrace from gdb. I would however require instructions on how to do this, as when I tried php didn't recognize the binary as being correct for the debug instance of php.

ylandsman

2020-03-24 18:36

reporter   ~0005345

Just discovered that if I turn off the php configuration directive log_errors the problem goes away. Of course this doesn't work for a production environment, but it gives you more information on what is going on.

derick

2020-03-26 15:45

administrator   ~0005354

I've spent another hour trying to reproduce this, but I'm not having any luck. I've used the attached Dockerfile, build it with "docker image build -t issue1770:1.0 ." and then run it with "docker run -i -t issue1770:1.0" and then requested a page with "lynx -source -dump http://172.17.0.2:80/1770.php". No errors.

So, unless you can give me the exact steps on a clean OS install, a Dockerfile, or a VM, or access to a place where you can demonstrate the problem, I can't do much.

derick

2020-03-26 15:46

administrator  

Dockerfile (3,942 bytes)
FROM centos:7.7.1908

# docker image build -t issue1770:1.0 .
# docker run -i -t issue1770:1.0
# 

RUN yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm http://rpms.remirepo.net/enterprise/remi-release-7.rpm yum-utils
RUN yum-config-manager --enable remi-php73
RUN yum install -y valgrind gdb strace vim php-devel nginx php-fpm php-pear make net-tools psmisc git screen
RUN debuginfo-install -y php-fpm
#RUN mkdir /root/src && cd /root/src && wget https://www.php.net/distributions/php-7.4.3.tar.bz2 && tar cvzf php-7.4.3.tar.bz2 && cd php-7.4.3 && ./configure --disable-all &&
RUN echo "cgi.fix_pathinfo=0" > /etc/php.ini
RUN cd /tmp && git clone https://github.com/derickr/xdebug.git && cd xdebug && phpize && ./configure --with-php-config=/usr/bin/php-config && make && make install && echo "zend_extension=xdebug.so" >> /etc/php.d/90-xdebug.ini

RUN echo PD9waHAKcGhwaW5mbygpOwoKb2Jfc3RhcnQoKTsKJHJlc3VsdCA9IGV2YWwoIj8+Ii4kc3RyaW5nLiI8Ii4iP3AiLiJocCByZXR1cm4gMTsiKTsKJG5ld19zdHJpbmcgPSBvYl9nZXRfY2xlYW4oKTsKdmFyX2R1bXAoJG5ld19zdHJpbmcpOwo= | base64 -d > /usr/share/nginx/html/1770.php
RUN echo IyBGb3IgbW9yZSBpbmZvcm1hdGlvbiBvbiBjb25maWd1cmF0aW9uLCBzZWU6CiMgICAqIE9mZmljaWFsIEVuZ2xpc2ggRG9jdW1lbnRhdGlvbjogaHR0cDovL25naW54Lm9yZy9lbi9kb2NzLwojICAgKiBPZmZpY2lhbCBSdXNzaWFuIERvY3VtZW50YXRpb246IGh0dHA6Ly9uZ2lueC5vcmcvcnUvZG9jcy8KCnVzZXIgbmdpbng7Cndvcmtlcl9wcm9jZXNzZXMgYXV0bzsKZXJyb3JfbG9nIC92YXIvbG9nL25naW54L2Vycm9yLmxvZzsKcGlkIC9ydW4vbmdpbngucGlkOwoKIyBMb2FkIGR5bmFtaWMgbW9kdWxlcy4gU2VlIC91c3Ivc2hhcmUvZG9jL25naW54L1JFQURNRS5keW5hbWljLgppbmNsdWRlIC91c3Ivc2hhcmUvbmdpbngvbW9kdWxlcy8qLmNvbmY7CgpldmVudHMgewogICAgd29ya2VyX2Nvbm5lY3Rpb25zIDg7Cn0KCmh0dHAgewogICAgbG9nX2Zvcm1hdCAgbWFpbiAgJyRyZW1vdGVfYWRkciAtICRyZW1vdGVfdXNlciBbJHRpbWVfbG9jYWxdICIkcmVxdWVzdCIgJwogICAgICAgICAgICAgICAgICAgICAgJyRzdGF0dXMgJGJvZHlfYnl0ZXNfc2VudCAiJGh0dHBfcmVmZXJlciIgJwogICAgICAgICAgICAgICAgICAgICAgJyIkaHR0cF91c2VyX2FnZW50IiAiJGh0dHBfeF9mb3J3YXJkZWRfZm9yIic7CgogICAgYWNjZXNzX2xvZyAgL3Zhci9sb2cvbmdpbngvYWNjZXNzLmxvZyAgbWFpbjsKCiAgICBzZW5kZmlsZSAgICAgICAgICAgIG9uOwogICAgdGNwX25vcHVzaCAgICAgICAgICBvbjsKICAgIHRjcF9ub2RlbGF5ICAgICAgICAgb247CiAgICBrZWVwYWxpdmVfdGltZW91dCAgIDY1OwogICAgdHlwZXNfaGFzaF9tYXhfc2l6ZSAyMDQ4OwoKICAgIGluY2x1ZGUgICAgICAgICAgICAgL2V0Yy9uZ2lueC9taW1lLnR5cGVzOwogICAgZGVmYXVsdF90eXBlICAgICAgICBhcHBsaWNhdGlvbi9vY3RldC1zdHJlYW07CgogICAgIyBMb2FkIG1vZHVsYXIgY29uZmlndXJhdGlvbiBmaWxlcyBmcm9tIHRoZSAvZXRjL25naW54L2NvbmYuZCBkaXJlY3RvcnkuCiAgICAjIFNlZSBodHRwOi8vbmdpbngub3JnL2VuL2RvY3Mvbmd4X2NvcmVfbW9kdWxlLmh0bWwjaW5jbHVkZQogICAgIyBmb3IgbW9yZSBpbmZvcm1hdGlvbi4KICAgIGluY2x1ZGUgL2V0Yy9uZ2lueC9jb25mLmQvKi5jb25mOwoKICAgIHNlcnZlciB7CiAgICAgICAgbGlzdGVuICAgICAgIDgwIGRlZmF1bHRfc2VydmVyOwogICAgICAgIGxpc3RlbiAgICAgICBbOjpdOjgwIGRlZmF1bHRfc2VydmVyOwogICAgICAgIHNlcnZlcl9uYW1lICBfOwogICAgICAgIHJvb3QgICAgICAgICAvdXNyL3NoYXJlL25naW54L2h0bWw7CgogICAgICAgICMgTG9hZCBjb25maWd1cmF0aW9uIGZpbGVzIGZvciB0aGUgZGVmYXVsdCBzZXJ2ZXIgYmxvY2suCiAgICAgICAgaW5jbHVkZSAvZXRjL25naW54L2RlZmF1bHQuZC8qLmNvbmY7CgogICAgICAgIGxvY2F0aW9uIC8gewogICAgICAgIH0KCiAgICAgICAgZXJyb3JfcGFnZSA0MDQgLzQwNC5odG1sOwogICAgICAgICAgICBsb2NhdGlvbiA9IC80MHguaHRtbCB7CiAgICAgICAgfQoKICAgICAgICBlcnJvcl9wYWdlIDUwMCA1MDIgNTAzIDUwNCAvNTB4Lmh0bWw7CiAgICAgICAgICAgIGxvY2F0aW9uID0gLzUweC5odG1sIHsKICAgICAgICB9CgogICAgICAgIGxvY2F0aW9uIH4gXC5waHAkIHsKICAgICAgICAgICAgcm9vdCAgICAgICAgICAgaHRtbDsKICAgICAgICAgICAgZmFzdGNnaV9wYXNzICAgMTI3LjAuMC4xOjkwMDA7CiAgICAgICAgICAgIGZhc3RjZ2lfaW5kZXggIGluZGV4LnBocDsKICAgICAgICAgICAgZmFzdGNnaV9wYXJhbSAgU0NSSVBUX0ZJTEVOQU1FICAkZG9jdW1lbnRfcm9vdCRmYXN0Y2dpX3NjcmlwdF9uYW1lOwogICAgICAgICAgICBpbmNsdWRlICAgICAgICBmYXN0Y2dpX3BhcmFtczsKICAgICAgICB9CiAgICB9Cn0K | base64 -d > /etc/nginx/nginx.conf

RUN echo IyEvYmluL2Jhc2gKCm1rZGlyIC1wIC9ydW4vcGhwLWZwbQpwaHAtZnBtIC1kIGxvZ19lcnJvcnM9MSAtUgpzbGVlcCAyCi91c3Ivc2Jpbi9uZ2lueApzbGVlcCAxCi9iaW4vYmFzaAo= | base64 -d > /run-httpd.sh
RUN chmod -v +x /run-httpd.sh

EXPOSE 80

CMD ["/run-httpd.sh"]
Dockerfile (3,942 bytes)

derick

2020-04-16 15:31

administrator   ~0005395

Hi,

I've asked for follow up information three weeks ago. If this does not get provided soon, I will close this ticket out.

cheers,
Derick

derick

2020-04-30 09:52

administrator   ~0005408

I can't reproduce this, and the requested feedback was no provided, so I am closing this bug report. Please feel free to add the requested information, and at that point we can continue investigating.

Issue History

Date Modified Username Field Change
2020-03-23 11:54 ylandsman New Issue
2020-03-23 13:18 derick Assigned To => derick
2020-03-23 13:18 derick Status new => feedback
2020-03-23 13:18 derick Note Added: 0005332
2020-03-23 13:29 ylandsman File Added: php.ini
2020-03-23 13:29 ylandsman Note Added: 0005333
2020-03-23 13:29 ylandsman Status feedback => assigned
2020-03-23 15:12 derick Status assigned => feedback
2020-03-23 15:12 derick Note Added: 0005336
2020-03-23 15:12 derick Product Version 2.9.3 => 2.9.4
2020-03-23 15:12 derick Description Updated View Revisions
2020-03-23 15:12 derick Priority urgent => high
2020-03-24 16:49 ylandsman Note Added: 0005339
2020-03-24 16:49 ylandsman Status feedback => assigned
2020-03-24 17:12 derick Status assigned => feedback
2020-03-24 17:12 derick Note Added: 0005341
2020-03-24 17:55 ylandsman Note Added: 0005343
2020-03-24 17:55 ylandsman Status feedback => assigned
2020-03-24 18:36 ylandsman Note Added: 0005345
2020-03-26 15:45 derick Status assigned => feedback
2020-03-26 15:45 derick Note Added: 0005354
2020-03-26 15:46 derick File Added: Dockerfile
2020-04-16 15:31 derick Note Added: 0005395
2020-04-30 09:52 derick Status feedback => resolved
2020-04-30 09:52 derick Resolution open => unable to reproduce
2020-04-30 09:52 derick Note Added: 0005408