View Issue Details

IDProjectCategoryView StatusLast Update
0002229XdebugStep Debuggingpublic2024-03-28 16:59
Reportercvirag Assigned To 
PrioritynormalSeverityminorReproducibilityhave not tried
Status resolvedResolutionduplicate 
PlatformDocker ARM64OSDebianOS Version12
Product Version3.3.1 
Summary0002229: Sigsegv when breakpoint is set
Description

Hello,

I have a recently built Docker php:8.1-fpm package with xdebug enabled.

$ php-fpm --version
PHP 8.1.26 (fpm-fcgi) (built: Dec 16 2023 05:13:17)
Copyright (c) The PHP Group
Zend Engine v4.1.26, Copyright (c) Zend Technologies
    with Zend OPcache v8.1.26, Copyright (c), by Zend Technologies
    with Xdebug v3.3.1, Copyright (c) 2002-2023, by Derick Rethans

Running PHP with XDEBUG_MODE=develop,debug

On client side, Visual Studio Code Extension "PHP Debug" version 1.34.0 is used.

If I enable a breakpoint, PHP-FPM crashes. Without breakpoints, requests to PHP-FPM are served properly.

Backtrace of the core dumps:
# gdb /usr/local/sbin/php-fpm /tmp/core-php-fpm.59 
GNU gdb (Debian 13.1-3) 13.1
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "aarch64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/local/sbin/php-fpm...
(No debugging symbols found in /usr/local/sbin/php-fpm)

warning: Can't open file /dev/zero (deleted) during file-backed mapping note processing
[New LWP 59]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm:'.
Program terminated with signal SIGSEGV, Segmentation fault.
#0  0x0000ffffab84e104 in zend_string_equal_content (s2=0x7d31392d39, s1=0xffffab66b1c0)
    at /usr/local/include/php/Zend/zend_string.h:357
357             return ZSTR_LEN(s1) == ZSTR_LEN(s2) && zend_string_equal_val(s1, s2);
(gdb) bt
#0  0x0000ffffab84e104 in zend_string_equal_content (s2=0x7d31392d39, s1=0xffffab66b1c0)
    at /usr/local/include/php/Zend/zend_string.h:357
#1  zend_string_equals (s2=0x7d31392d39, s1=0xffffab66b1c0) at /usr/local/include/php/Zend/zend_string.h:362
#2  mark_fse_as_having_line_breakpoints (fse=0xaaaae9c54930) at /tmp/pear/temp/xdebug/src/debugger/debugger.c:573
#3  handle_breakpoints (return_value=0xffffab61c5c0, breakpoint_type=8, fse=0xaaaae9c54930)
    at /tmp/pear/temp/xdebug/src/debugger/debugger.c:591
#4  xdebug_debugger_handle_breakpoints (fse=fse@entry=0xaaaae9c54930, breakpoint_type=breakpoint_type@entry=8, 
    return_value=return_value@entry=0xffffab61c5c0) at /tmp/pear/temp/xdebug/src/debugger/debugger.c:623
#5  0x0000ffffab8379e4 in xdebug_execute_internal_end (current_execute_data=<optimized out>, return_value=0xffffab61c5c0)
    at /tmp/pear/temp/xdebug/src/base/base.c:998
#6  xdebug_execute_internal (current_execute_data=<optimized out>, return_value=0xffffab61c5c0)
    at /tmp/pear/temp/xdebug/src/base/base.c:1022
#7  0x0000aaaadbefc1b8 in ?? ()
#8  0x0000aaaadc269838 in execute_ex ()
#9  0x0000aaaadbefc124 in ?? ()
#10 0x0000aaaadc269838 in execute_ex ()
#11 0x0000aaaadbefc124 in ?? ()
#12 0x0000aaaadc269838 in execute_ex ()
#13 0x0000aaaadbefc124 in ?? ()
#14 0x0000aaaadc269838 in execute_ex ()
TagsNo tags attached.
Operating System
PHP Version8.1.10-8.1.19

Relationships

has duplicate 0002236 resolvedderick SIGSEGV in zend_string_equal_content 
has duplicate 0002241 resolvedderick Segmentation fault - Symfony 6.2.1 - Sulu cms 

Activities

derick

2023-12-21 10:16

administrator   ~0006736

Would you be able to provide an Xdebug log as well? It's explained at https://xdebug.org/reporting-bugs#step-debugger ?

hennevanoch

2023-12-22 15:04

reporter   ~0006740

We are experiencing the same issue as described. xdebug 3.2.2 is working fine, starting 3.3.0 we are having the issues.

I attached the xdebug log.

If there is anything else I can help with.

dpierzchal

2023-12-27 13:20

reporter   ~0006742

I have the same issue. Same docker: php:8.1-fpm
When I switch to xdebug-3.1.0 is works fine, but xdebug-3.3.1 doesn't work with this docker.

It seems that php:8.3-fpm + xdebug-3.3.1 works fine. ( I haven't verify it deeply, but at least such configuration doesn't cause described error. )

derick

2024-01-08 18:25

administrator   ~0006754

@cvirag, is that the whole output of bt? I believe it is missing many stackframes.

If anybody else can also make a bt, that would be great.

As so far, I haven't been able to reproduce this?

cvirag

2024-01-08 21:00

reporter   ~0006755

Hi Derick, could this bt be useful to you?

derick

2024-01-09 12:03

administrator   ~0006756

@cvirag, yes, a little. Can you, when you're at the (gdb) prompt also enter the following:

frame 2
p *extra_brk_info
p *extra_brk_info.filename
p (char*)extra_brk_info.filename.val
p *executed_filename
p (char*)executed_filename.val

If you have an xdebug.log file to go with this (see https://xdebug.org/reporting-bugs#step-debugger), that would be of great help too.

cheers,
Derick

cvirag

2024-01-09 12:53

reporter   ~0006758

Hi @derick, please find the xdebug log as well as the output of the additional gdb commands attached (I also included bt in xdebug_gdb_details.log).

derick

2024-01-15 15:23

administrator   ~0006775

The result of p *executed_filename is suspicious:

(gdb) p *executed_filename
Cannot access memory at address 0x7d31392d39

cvirag

2024-01-15 15:25

reporter   ~0006777

yes, it is. The interesting thing is that it works sometimes. I can't find a pattern when it crashes and when it does not though.

deanrock

2024-01-26 07:34

reporter   ~0006814

Hi @derick, I don't have reproduction steps to share, since it fails in various places in our codebase.

However, I narrowed it down to https://github.com/xdebug/xdebug/tree/91bfb654b0a6cfed63d327728db8ec2f3f82c97a

It works without issues on previous commit (a725dadae5c80187f5f3f0a0af7e316b874ef08d), and it also works on 3.3.1 if I revert this commit.

derick

2024-01-30 12:01

administrator   ~0006823

@deadrock, I am sure that reverting this speed-up will resolve the problem, but that's not a solution. For some reason zend_get_executed_filename_ex() returns bogus data, which is the real problem. So far, I haven't been able to reproduce this yet.

Can any of you reproduce this in a docker environment that you can share? @xedaxip791 perhaps, as your set-up is all public.

deanrock

2024-01-30 12:40

reporter   ~0006824

@derick I spent a bit more time debugging this, and came to the same conclusion, but at least revert allows us to continue using debugger as before.

At some point, (for function_name __invoke) executor_globals.current_execute_data->func->op_array.filename becomes 0x6465746300000040, which is not problem since executor_globals.current_execute_data->func->type equals 1, so zend_get_executed_filename_ex() returns filename of prev_execute_data.
However, when efree() is called in https://github.com/php/php-src/blob/af2110e664635329cbd7038727d4c7f222bb8a0e/Zend/zend_closures.c#L60, executor_globals.current_execute_data->func->type becomes 0, which means that zend_get_executed_filename_ex() returns filename of the current_execute_data, which points to the bogus address 0x6465746300000040.

(Not completely sure what the significance of the 0x6465746300000040 address it, but it's always the same.)


I have tried making a minimal reproduction case, but haven't succeeded yet.

I've tested this on php-8.1.27. If I try to build php with --enable-debug flag, the issue doesn't appear.

derick

2024-01-30 12:53

administrator   ~0006825

@deanrock — I tried with both debug and non-debug builds (of PHP 8.2.28-dev), but I can't even reproduce this in a big environment. If you can provide something even in a bug environment for me to try, then perhaps we can pinpoint this better. However, I might nearly consider this as a bug in PHP, as the zend_get_executed_filename_ex() function misbehaves?

deanrock

2024-01-30 13:05

reporter   ~0006826

@derick This (at least from what I observed) happens in xdebug_execute_internal, which is not used in PHP 8.2+ https://github.com/xdebug/xdebug/blob/3918dbabbc72211c0b8c7c5a873beef3faa27249/src/base/base.c#L1006.

I haven't managed to reproduce bogus filename pointer in xdebug_execute_begin / xdebug_execute_ex.

I've only been able to reproduce this in our company's PHP codebase, which I cannot share.

derick

2024-01-30 16:09

administrator   ~0006827

Right, it seems a PHP 8.1 (and 8.0) only issue. From PHP 8.2 and later Xdebug uses observers. But right now, @xedaxip791 could reproduce it in 0002241

cvirag

2024-02-07 12:43

reporter   ~0006835

Hi Derick, I don't know if it gives any value to the investigation, but although I still can't reproduce the problem, I saw the following.
My application has 2 layers, UI + API backend (running in the same docker container, served by the same nginx webserver container). If I call a UI page, which has no interaction to the API layer, enabling a breakpoint works fine. However if I put a breakpoint on the API module, it crashes most of the time. I can break on the UI layer without problem, but it will crash the PHP-FPM workers which are supposed to serve the API call(s).
Of course, if I remove/disable all the breakpoints, the request can go through without crash.

derick

2024-03-28 16:59

administrator   ~0006872

Marking this as "duplicate" of 0002252, as that has a reproduce case that I can reproduce with.