View Issue Details

IDProjectCategoryView StatusLast Update
0002383XdebugUncategorizedpublic2026-01-14 11:04
ReporterSunMar Assigned To 
PrioritylowSeverityminorReproducibilityalways
Status resolvedResolutionunable to reproduce 
Platformx86_64OSDebianOS VersionTrixie
Product Version3.4.6 
Summary0002383: Segmentation fault (8.3) / zend_mm_heap corrupted (8.4)
Description

Currently using XDebug 3.4.7 but this was not a selectable production version.

When running our test suite when using PHP 8.3.20+ or PHP 8.4.6+ with XDebug enabled, in the middle of the PHPUnit test suite it crashes with either Segmentation fault (PHP 8.3) or zend_mm_heap corrupted (PHP 8.4). If I set the environment variable XDEBUG_MODE="off" the issue disappears.

The crash happens both in my local where XDebug is running with mode "develop,debug" and in our pipeline where it's running with "coverage".

Steps To Reproduce

Although I can consistently reproduce the issue when I run the whole (large) PHPUnit test suite, running the individual tests where it crashes works.
Because of that I am unfortunately not able to create a snippet that reproduces the issue consistently. In the logs I see some reference to GC, so maybe it needs to do a lot of operations before the bug is triggered.

I have reproduced it using a debug build with "--enable-debug --enable-address-sanitizer --enable-undefined-sanitizer" and environment variables ASAN_OPTIONS="halt_on_error=0" and USE_ZEND_ALLOC=0.

If there is more information I can provide let me know and I'll happily spend some time collecting more details.

Additional Information

See attached log files with the output of both PHP 8.3 and PHP 8.4 after running the suite with the PHP debug build.

TagsNo tags attached.
Operating System
PHP Version8.4.10-8.4.19

Activities

SunMar

2025-11-11 06:13

reporter   ~0007403

Just noticed I didn't specify the PHP versions. Testing was done on PHP 8.3.27 and PHP 8.4.14, but I went back through older versions and PHP 8.3.19 and PHP 8.4.5 were fine, crashing started happening from 8.3.20/8.4.6 onwards.
The crash is happening after loading an XML file with SimpleXMLElement and traversing/reading various child nodes from it and assigning them to an associative array.
Sorry for not being able to provide a reproducible bit of PHP code, have tried for several hours but no luck. Hopefully with the debug build there is a way to still provide enough information to find the issue.

derick

2025-11-12 10:29

administrator   ~0007406

I just had a look at the traces, and these both indicate that the undefined read happens when PHP's GC is cleaning things up. However, it doesn't tell me which thing, only that it was allocated in SimpleXMLElement_getNamespaces, and being freed through a foreach loop ending (in the PHP 8.4 case). But I can't see what, or how, which makes it impossible for me to find this. From this trace, I am not even sure if it's solely an Xdebug issue or whether SimpleXML is broken.

Could I attempt to debug it with your whole suite locally?

SunMar

2025-11-12 11:42

reporter   ~0007408

Thanks for the reply! Unfortunately I can't share the whole suite. The problem is that this is a integration/functional test on some legacy code with a bunch of inter-dependencies, so it doesn't work unless you have the whole application running.
But I did have some luck yesterday in reproducing it in a more isolated way with just running a single test class (which contains over 30 individual tests).
This gives some hope in that I may be able to pull out the relevant parts of the code and create something standalone that can reproduce this. Next week I will spend some time to try that.
A very weird thing happened though, I was able to consistently reproduce it by running PHPUnit for the single test case, unless I added --testdox, when I did that for some more output it stopped crashing. I have no clue how --testdox can affect whether the test crashes or not.

derick

2025-11-12 12:21

administrator   ~0007409

I would recommend running everything through valgrind, with the environment variable USE_ZEND_ALLOC=0 — turning off the Zend memory manager gives tools, such as valgrind (or the memory sanitizer) a better stab at detecting problems, as the Zend MM often hides the real point in time where an error is created. You say that you set it — but make sure to export as tools (such PHPUnit in test isolation mode) might start a new PHP without the existing environment variables. Adding --test-dox might just subtly change where the memory gets misused, and it vaguely hints to me that the USE_ZEND_ALLOC env var isn't passed on.

SunMar

2025-11-12 12:31

reporter   ~0007410

I am running everything in a Docker container and added ''ENV USE_ZEND_ALLOC=0'' in the ''Dockerfile'', but I will double check to make sure it's set when I start debugging again and will take a look if I can get valgrind working. Thanks for the pointers!

SunMar

2026-01-07 11:07

reporter   ~0007437

Hi, sorry that it took a bit, things got busy, but today I had some time to dive into this again.
However, I couldn't reproduce it anymore. Not sure why, also on 8.4.14 where it previously didn't work I failed to reproduce it.
Some other dependencies were updated in the mean time, so it's hard to say where the difference is between then and now.

This ticket can be closed, if it comes back I'll investigate more and re-open or create a new ticket.

derick

2026-01-14 11:04

administrator   ~0007441

Ok, thanks for letting us know.

And if this indeed returns, feel free to file a new ticket.