PHP-FPM segfault in OPcache with PHP 8.4.10

[villermen]

Description

Our PHP-FPM crashes at seemingly random moments with an error in OPcache. I am unable to reproduce this locally but have made coredumps on production. They seem to result in 2 distinct backtraces that seem to point to the same error:

[New LWP 46774]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www             '.
Program terminated with signal SIGSEGV, Segmentation fault.

(gdb) bt

#0  0x00007f596e4f5b91 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#1  0x00007f596e4f72c9 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#2  0x00007f596e4f7db0 in zend_file_cache_script_store ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#3  0x00007f596e50a880 in persistent_compile_file ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#4  0x000055afdce6ea46 in compile_filename ()
#5  0x000055afdce01580 in ?? ()
#6  0x000055afdce0f689 in ?? ()
#7  0x000055afdce3bb0d in execute_ex ()
#8  0x000055afdce39f83 in zend_execute ()
#9  0x000055afdcea1a40 in zend_execute_script ()
#10 0x000055afdcd3f085 in php_execute_script_ex ()
#11 0x000055afdca09a5a in ?? ()
#12 0x00007f59715b624a in __libc_start_call_main (main=main@entry=0x55afdca08d10, 
    argc=argc@entry=2, argv=argv@entry=0x7ffe5eb3ef78)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#13 0x00007f59715b6305 in __libc_start_main_impl (main=0x55afdca08d10, argc=2, 
    argv=0x7ffe5eb3ef78, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7ffe5eb3ef68) at ../csu/libc-start.c:360
#14 0x000055afdca0ba31 in _start ()

Program terminated with signal SIGSEGV, Segmentation fault.

(gdb) bt

#0  0x00007f596e4f5b91 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#1  0x00007f596e4f72c9 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#2  0x00007f596e4f5cb5 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#3  0x00007f596e4f64d0 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#4  0x00007f596e4f5cb5 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#5  0x00007f596e4f7d82 in zend_file_cache_script_store ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#6  0x00007f596e50a880 in persistent_compile_file ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#7  0x000055afdce6ea46 in compile_filename ()
#8  0x000055afdce01580 in ?? ()
#9  0x000055afdce0f689 in ?? ()
#10 0x000055afdce3bb0d in execute_ex ()
#11 0x000055afdcdeb0cd in zend_call_function ()
#12 0x000055afdcdeb4dd in zend_call_known_function ()
#13 0x000055afdcc61f86 in ?? ()
#14 0x00007f596cc2564b in tideways_hooks_perform_autoload ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/tideways.so
#15 0x000055afdcdea31e in zend_lookup_class_ex ()
#16 0x000055afdcdeb8e0 in zend_fetch_class_by_name ()
#17 0x000055afdce0cde7 in ?? ()
#18 0x000055afdce3bcd4 in execute_ex ()
#19 0x000055afdce39f83 in zend_execute ()
#20 0x000055afdcea1a40 in zend_execute_script ()
#21 0x000055afdcd3f085 in php_execute_script_ex ()
#22 0x000055afdca09a5a in ?? ()
#23 0x00007f59715b624a in __libc_start_call_main (main=main@entry=0x55afdca08d10, 
    argc=argc@entry=2, argv=argv@entry=0x7ffe5eb3ef78)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#24 0x00007f59715b6305 in __libc_start_main_impl (main=0x55afdca08d10, argc=2, 
    argv=0x7ffe5eb3ef78, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7ffe5eb3ef68) at ../csu/libc-start.c:360
#25 0x000055afdca0ba31 in _start ()

I am out of my league in debugging this myself, and there's little I can change to the setup to narrow it down. Hopefully the backtraces help. If there's any additional context or hint of reproduction steps I can try please let me know.

PHP Version

PHP 8.4.10 (cli) (built: Jul  3 2025 22:57:54) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.10, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.10, Copyright (c), by Zend Technologies

Operating System

No response

[devnexen]

Hi @villermen would it be possible to disable tideways extension to see if this still coredump ?

[villermen]

@devnexen With Tideways disabled (extension not loaded in ini):

[New LWP 440]
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `php-fpm: pool www             '.
Program terminated with signal SIGSEGV, Segmentation fault.

(gdb) bt

#0  0x00007fdbd4297b91 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#1  0x00007fdbd42992c9 in ?? ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#2  0x00007fdbd4299db0 in zend_file_cache_script_store ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#3  0x00007fdbd42ac880 in persistent_compile_file ()
   from /usr/local/lib/php/extensions/no-debug-non-zts-20240924/opcache.so
#4  0x000055dd819efa46 in compile_filename ()
#5  0x000055dd81982580 in ?? ()
#6  0x000055dd81990bae in ?? ()
#7  0x000055dd819bcef3 in execute_ex ()
#8  0x000055dd819baf83 in zend_execute ()
#9  0x000055dd81a22a40 in zend_execute_script ()
#10 0x000055dd818c0085 in php_execute_script_ex ()
#11 0x000055dd8158aa5a in ?? ()
#12 0x00007fdbd72be24a in __libc_start_call_main (main=main@entry=0x55dd81589d10, 
    argc=argc@entry=2, argv=argv@entry=0x7ffe334e50e8)
    at ../sysdeps/nptl/libc_start_call_main.h:58
#13 0x00007fdbd72be305 in __libc_start_main_impl (main=0x55dd81589d10, argc=2, 
    argv=0x7ffe334e50e8, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7ffe334e50d8) at ../csu/libc-start.c:360
#14 0x000055dd8158ca31 in _start ()

[iluuu1994]

Looks like this crash happens in opcache file cache. Unsetting opcache.file_cache should fix the issue for you. You may try to run print_zstr script->script->filename in gdb (or print (char*)script->script->filename->val if you haven't loaded the .gdbinit file) to see which file is responsible. Maybe this will help creating a reproducer.

[iluuu1994]

Also, please also verify that you don't have any other 3rd party extensions enabled.

[villermen]

@iluuu1994 Thanks for the pointers so far!

The coredump I've created doesn't seem to include any symbols info args: No symbol table info available., so I wouldn't know how to inspect the arguments passed to the zend_file_cache_script_store(). Is there anything I can do to fix or work around that?