View Issue Details

Jump to Notes
IDProjectCategoryView StatusDate SubmittedLast Update
0002292XdebugUncategorizedpublic2024-10-04 20:332025-06-27 00:16
ReporterGaryAllan Assigned To 
PrioritynormalSeveritycrashReproducibilityalways
Status resolvedResolutionunable to reproduce 
Product Version3.3.2 
Summary0002292: Apache2 mod_php exit signal Segmentation fault (11) with Xdebug enabled
Description

Hello, I'm a developer on the phpIPAM project and have encountered a bug using xdebug to test and develop the code.

I am experiencing Segmentation faults with the Xdebug module enabled.

I'm aware you would prefer a minimal php script to reproduce but the process to reproduce is complex. The code spawns a number of threads to ping the subnet, sends the data to the main process via IPC and then iterates over the results using NET/DNS2 to resolve DNS names of discovered hosts.

Is there a way of obtaining additional debugging info from this Apache2 environment?

Steps To Reproduce

Install phpIPAM on Debian 12 AMD64, Apache 2 mod_php.

Install php8.3 project dependencies from deb [signed-by=/usr/share/keyrings/deb.sury.org-php.gpg] https://packages.sury.org/php/ bookworm mai

Enable Xdebug

Use the web application to scan a subnet.

Scan will fail to complete. FireFox developer tools will report that the XHR request for subnet-scan-execute.php fails with error NS_ERROR_NET_RESET and /var/log/apache2/error.log will contain the line "child pid 101462 exit signal Segmentation fault (11)"

Disabling the xdebug module results in the scan succeeding with no "exit signal Segmentation fault (11)"" errors logged.

The crash is 100% reproducible.

I've stepped through the code in VSCode using Xdebug. It segfaults with 100% repeatability as NET/DNS2 throws a Net_DNS2_Exception error. This is not caught by a wrapping try catch block.

The code behaves as expected with Xdebug 3.3.2 disabled on this system (php 8.3.12)

The code behaves as expected on another VM running PHP 7.2.24 and Xdebug 3.1.6 enabled.

The code crashes under php8.3.12 with Xdebug 3.3.2 enabled.

Additional Information

php83:/var/log/apache2# php -v
PHP 8.3.12 (cli) (built: Sep 27 2024 04:03:53) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.12, Copyright (c) Zend Technologies
with Zend OPcache v8.3.12, Copyright (c), by Zend Technologies
with Xdebug v3.3.2, Copyright (c) 2002-2024, by Derick Rethans

root@php83:/var/log/apache2# cat error.log | grep Seg
[Fri Oct 04 20:48:49.293844 2024] [core:notice] [pid 101457:tid 101457] AH00052: child pid 101462 exit signal Segmentation fault (11)
[Fri Oct 04 20:49:05.322734 2024] [core:notice] [pid 101457:tid 101457] AH00052: child pid 101461 exit signal Segmentation fault (11)

oot@php83:/var/log/apache2# dpkg -l | grep php
ii libapache2-mod-php8.3 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 server-side, HTML-embedded scripting language (Apache 2 module)
ii php-common 2:95+0~20240927.54+debian12~1.gbpe0084c all Common files for PHP packages
ii php-composer-ca-bundle 1.3.5-1 all utility library to find a path to the system CA bundle
ii php-composer-class-map-generator 1.0.0-2+deb12u1 all Utilities to scan PHP code and generate class maps
ii php-composer-metadata-minifier 1.0.0-2 all Small utility library that handles metadata minification and expansion
ii php-composer-pcre 3.1.0-1+deb12u1 all PCRE wrapping library that offers type-safe preg_* replacements
ii php-composer-semver 3.3.2-1 all utilities, version constraint parsing and validation
ii php-composer-spdx-licenses 1.5.7-1 all SPDX licenses list and validation library
ii php-composer-xdebug-handler 3.0.3-2+deb12u1 all Restarts a process without Xdebug
ii php-curl 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all CURL module for PHP [default]
ii php-gd 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all GD module for PHP [default]
ii php-gmp 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all GMP module for PHP [default]
ii php-intl 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all Internationalisation module for PHP [default]
ii php-json-schema 5.2.12-2 all implementation of JSON schema
ii php-ldap 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all LDAP module for PHP [default]
ii php-mbstring 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all MBSTRING module for PHP [default]
ii php-mysql 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all MySQL module for PHP [default]
ii php-pear 1:1.10.13+submodules+notgz+2022032202-2+0~20230612.39+debian12~1.gbpfd4c1d all PEAR Base System
ii php-psr-container 1.1.2-1 all Common Container Interface (PHP FIG PSR-11)
ii php-psr-log 1.1.4-2 all common interface for logging libraries
ii php-react-promise 2.9.0-3 all lightweight implementation of CommonJS Promises/A for PHP
ii php-seld-signal-handler 2.0.1-2 all simple cross-platform1 signal handler
ii php-snmp 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all SNMP module for PHP [default]
ii php-symfony-console 5.4.23+dfsg-1+deb12u2 all run tasks from the command line
ii php-symfony-deprecation-contracts 2.5.2-1+deb12u1 all A generic function and convention to trigger deprecation notices
ii php-symfony-filesystem 5.4.23+dfsg-1+deb12u2 all basic filesystem utilities
ii php-symfony-finder 5.4.23+dfsg-1+deb12u2 all find files and directories
ii php-symfony-process 5.4.23+dfsg-1+deb12u2 all execute commands in sub-processes
ii php-symfony-service-contracts 2.5.2-1+deb12u1 all Generic abstractions related to writing services
ii php-symfony-string 5.4.23+dfsg-1+deb12u2 all object-oriented API to work with strings
ii php-xdebug 3.3.2-1+0~20240420.60+debian12~1.gbp3869a8 amd64 Xdebug Module for PHP
ii php-xhprof 2.3.10-1+0~20240714.25+debian12~1.gbp5f4d7a amd64 Hierarchical Profiler for PHP 5.x
ii php-xml 2:8.3+95+0~20240927.54+debian12~1.gbpe0084c all DOM, SimpleXML, WDDX, XML, and XSL module for PHP [default]
ii php8.3 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c all server-side, HTML-embedded scripting language (metapackage)
ii php8.3-cli 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 command-line interpreter for the PHP scripting language
ii php8.3-common 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 documentation, examples and common module for PHP
ii php8.3-curl 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 CURL module for PHP
ii php8.3-gd 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 GD module for PHP
ii php8.3-gmp 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 GMP module for PHP
ii php8.3-intl 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 Internationalisation module for PHP
ii php8.3-ldap 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 LDAP module for PHP
ii php8.3-mbstring 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 MBSTRING module for PHP
ii php8.3-mysql 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 MySQL module for PHP
ii php8.3-opcache 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 Zend OpCache module for PHP
ii php8.3-readline 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 readline module for PHP
ii php8.3-snmp 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 SNMP module for PHP
ii php8.3-xdebug 3.3.2-1+0~20240420.60+debian12~1.gbp3869a8 amd64 Xdebug Module for PHP
ii php8.3-xhprof 2.3.10-1+0~20240714.25+debian12~1.gbp5f4d7a amd64 Hierarchical Profiler for PHP 5.x
ii php8.3-xml 8.3.12-1+0~20240927.43+debian12~1.gbpad3b8c amd64 DOM, SimpleXML, XML, and XSL module for PHP

root@php83:/var/log/apache2# cat /etc/php/8.3/apache2/conf.d/20-xdebug.ini
zend_extension=xdebug.so

xdebug.mode=develop,debug

xdebug.start_with_request=yes
xdebug.client_host=<Build PC>
xdebug.client_port=9000
xdebug.max_nesting_level=250

The code works as expected on another VM running php7.2.24 and Xdebug 3.1.6

root@php72 ~]# php -v
PHP 7.2.24 (cli) (built: Oct 22 2019 08:28:36) ( NTS )
Copyright (c) 1997-2018 The PHP Group
Zend Engine v3.2.0, Copyright (c) 1998-2018 Zend Technologies
with Zend OPcache v7.2.24, Copyright (c) 1999-2018, by Zend Technologies
with Xdebug v3.1.6, Copyright (c) 2002-2022, by Derick Rethans

Tags3.3.2, php8.3
Operating SystemDebian 12, AMD64
PHP Version8.3.10-8.3.19

Activities

GaryAllan

2024-10-04 22:28

reporter   ~0007055

I've attached gdb output

(gdb) c
Continuing.
[Detaching after vfork from child process 127171]

Program received signal SIGSEGV, Segmentation fault.
0x00007c86fcc8f680 in _emalloc () from target:/usr/lib/apache2/modules/libphp8.3.so

(gdb) bt 15
#0 0x00007c86fcc8f680 in _emalloc () from target:/usr/lib/apache2/modules/libphp8.3.so
#1 0x00007c86fcccb3a2 in zend_hash_str_update () from target:/usr/lib/apache2/modules/libphp8.3.so
0000002 0x00007c86fccbec13 in add_assoc_null_ex () from target:/usr/lib/apache2/modules/libphp8.3.so
0000003 0x00007c86fd4ec5bc in zval_from_stack_add_frame_variables (opa=0x7c86fc693500, symbols=<optimized out>, edata=0x7c86fc618840, frame=0x7c86fc695050) at ./build-8.3/src/develop/stack.c:436
0000004 zval_from_stack_add_frame (output=0x7c86fd50f410 <xdebug_globals+1008>, fse=0x57ec1f8b0940, edata=0x7c86fc618840, add_local_vars=<optimized out>, params_as_values=<optimized out>) at ./build-8.3/src/develop/stack.c:467
0000005 0x00007c86fd4eca2f in zval_from_stack (output=output@entry=0x7c86fd50f410 <xdebug_globals+1008>, add_local_vars=add_local_vars@entry=true, params_as_values=params_as_values@entry=true) at ./build-8.3/src/develop/stack.c:495
0000006 0x00007c86fd4eedf3 in xdebug_develop_throw_exception_hook (exception=exception@entry=0x7c86fc6db300, file=file@entry=0x7c86fc6db358, line=line@entry=0x7c86fc6db368, code=code@entry=0x7c86fc6db348,
code_str=code_str@entry=0x57ec1fc68fb0 "3", message=message@entry=0x7c86fc6db328) at ./build-8.3/src/develop/stack.c:1252
0000007 0x00007c86fd4c6087 in xdebug_throw_exception_hook (exception=0x7c86fc6db300) at ./build-8.3/src/base/base.c:1543
0000008 xdebug_throw_exception_hook (exception=0x7c86fc6db300) at ./build-8.3/src/base/base.c:1495
0000009 0x00007c86fcad924d in zend_throw_exception_internal () from target:/usr/lib/apache2/modules/libphp8.3.so
0000010 0x00007c86fcad06f3 in ?? () from target:/usr/lib/apache2/modules/libphp8.3.so
0000011 0x00007c86fcd27423 in execute_ex () from target:/usr/lib/apache2/modules/libphp8.3.so
0000012 0x00007c86fcad7175 in ?? () from target:/usr/lib/apache2/modules/libphp8.3.so
0000013 0x00007c86fcad8043 in ?? () from target:/usr/lib/apache2/modules/libphp8.3.so
0000014 0x00007c86fcad7175 in ?? () from target:/usr/lib/apache2/modules/libphp8.3.so

GaryAllan

2024-10-05 11:36

reporter   ~0007056

Additional information attached.

I've discovered that the first request after restarting Apache does not crash but all subsequent identical requests do. This lead me to look at OPcache.

OPcache module enabled, xdebug module disabled = no crash
OPcache module disabled, xdebug module enabled = no crash
OPcache module enabled, xdebug module enabled = no crash on 1st run, crash on 2nd+ run
OPcache module enabled, xdebug module enabled, USE_ZEND_ALLOC=0 = no crash

I'm no longer sure if this a Xdebug, OPcache or PHP Zend Alloc issue.

Valgrind trace collected with:

USE_ZEND_ALLOC=1 ZEND_DONT_UNLOAD_MODULES=1 APACHE_RUN_USER=www-data APACHE_RUN_GROUP=www-data APACHE_PID_FILE=/var/run/apache2/apache2.pid APACHE_RUN_DIR=/var/run/apache2 APACHE_LOCK_DIR=/var/lock/apache2 APACHE_LOG_DIR=/var/log/apache2 valgrind --leak-check=full --show-reachable=yes --tool=memcheck --error-limit=no --log-file=val.log /usr/sbin/apache2 -DFOREGROUND

derick

2024-10-13 16:47

administrator   ~0007075

I think the culprit in the valgrind output is:

==197826== Use of uninitialised value of size 8
==197826==    at 0x6184B6C: call_end_observers (zend_observer.c:274)
==197826==    by 0x6184B6C: zend_observer_fcall_end (zend_observer.c:283)
==197826==    by 0x64A9C0F: ???
==197826==    by 0x614EFFF: execute_ex (zend_vm_execute.h:57578)
==197826==    by 0x64A9BDF: ???
==197826==    by 0x55CBA69: xdebug_execute_user_code_begin (base.c:793)
==197826==    by 0x55CC107: xdebug_execute_begin (base.c:1042)
==197826==    by 0x55CC107: xdebug_execute_begin (base.c:1034)

Which I am going to guess is caused by https://github.com/php/php-src/commit/e715dd0afb1babc122efd4142c95623a12e14cfd, which should be fixed in the PHP releases going to be released on Thursday (the 17th of October).

GaryAllan

2024-11-07 18:55

reporter   ~0007079

Issue is still present on php8.3.13 when Opcache and Xdebug modules are both enabled.

root@php83:~# php -v
PHP 8.3.13 (cli) (built: Nov 4 2024 23:34:58) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.13, Copyright (c) Zend Technologies
with Zend OPcache v8.3.13, Copyright (c), by Zend Technologies
with Xdebug v3.3.2, Copyright (c) 2002-2024, by Derick Rethans

root@php83:~# cat /var/log/apache2/error.log
[Thu Nov 07 18:50:53.206379 2024] [core:notice] [pid 33472:tid 33472] AH00052: child pid 33478 exit signal Segmentation fault (11)
[Thu Nov 07 18:51:00.216094 2024] [core:notice] [pid 33472:tid 33472] AH00052: child pid 33473 exit signal Segmentation fault (11)

derick

2024-11-27 15:50

administrator   ~0007086

There are quite a lot of steps in the "Steps to Reproduce" section. Could you perhaps provide a Docker file that has all these steps, and hence shows this crash?

GaryAllan

2024-11-27 21:52

reporter   ~0007105

I can still trigger this with 8.3.14

Now i know it needs opcache and xdebug to be enabled I'll work on a cut down test case.

If not I'll add instructions on how to recreate with https://hub.docker.com/r/phpipam/phpipam-www

root@php83:~# php -v
PHP 8.3.14 (cli) (built: Nov 25 2024 18:23:27) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.3.14, Copyright (c) Zend Technologies
with Zend OPcache v8.3.14, Copyright (c), by Zend Technologies
with Xdebug v3.3.2, Copyright (c) 2002-2024, by Derick Rethans

root@php83:~# cat /var/log/apache2/error.log
[Wed Nov 27 21:45:39.406217 2024] [core:notice] [pid 24904:tid 24904] AH00052: child pid 24912 exit signal Segmentation fault (11)
[Wed Nov 27 21:45:43.413304 2024] [core:notice] [pid 24904:tid 24904] AH00052: child pid 24914 exit signal Segmentation fault (11)

derick

2024-11-28 13:21

administrator   ~0007109

Thanks for checking in. I'll leave this as "Feedback Requested" for now.

derick

2025-04-08 12:52

administrator   ~0007237

Did you find time to look at this?

derick

2025-04-24 16:31

administrator   ~0007254

Could you please provide the requested feedback?

derick

2025-06-27 00:16

administrator   ~0007324

I can't find enough information to reproduce this, and no requested information has been submitted. I'm therefore closing this out.

If you can reproduce this with the latest (3.3.4) version, and can provide enough information for me to reproduce this, please open a new ticket.