Repository navigation
Segfault when spawning new thread in soap extension #19226
Description
Description
The following code:
<?phpWhen served with Apache with mod_event and PHP ZTS and requested with curl http://127.0.0.1:80/index.php
Resulted in this output:
curl: (52) Empty reply from server
But I expected this output instead:
Crash site is
php-src/ext/opcache/ZendAccelerator.c
Line 614 in 2645663
triggered by this change in PHP 8.5 in 9859d83
Line 456 in 2645663
This only crashes if the soap extension and the opcache extension are loaded. I assume that opcache is not propery init
(gdb) bt
#0 0x0000ffff94ae3264 in accel_init_interned_string_for_php (str=0xffff99a855c0 "en", size=2, permanent=true)
at /usr/src/php-8.5.0alpha2/ext/opcache/ZendAccelerator.c:614
#1 0x0000ffff97be23f8 in php_soap_init_globals (soap_globals=0xffff9a60b940) at /usr/src/php-8.5.0alpha2/ext/soap/soap.c:456
#2 0x0000ffff98155be4 in allocate_new_resource (thread_resources_ptr=0xffff9be028b8, thread_id=281472896336240)
at /usr/src/php-8.5.0alpha2/TSRM/TSRM.c:406
#3 0x0000ffff98155ed0 in ts_resource_ex (id=0, th_id=0x0) at /usr/src/php-8.5.0alpha2/TSRM/TSRM.c:451
#4 0x0000ffff98d0e124 in php_handler (r=0xffff7c8281a0) at /usr/src/php-8.5.0alpha2/sapi/apache2handler/sapi_apache2.c:594
#5 0x0000aaaac3b0ac94 in ap_run_handler (r=0xffff7c8281a0) at config.c:169
#6 0x0000aaaac3b0c764 in ap_invoke_handler (r=0xffff7c8281a0) at config.c:443
#7 0x0000aaaac3b69338 in ap_process_async_request (r=0xffff7c8281a0) at http_request.c:452
#8 0x0000aaaac3b5d92c in ap_process_http_async_connection (c=0xffff7c823450) at http_core.c:155
#9 0x0000aaaac3b5e060 in ap_process_http_connection (c=0xffff7c823450) at http_core.c:246
#10 0x0000aaaac3b37960 in ap_run_process_connection (c=0xffff7c823450) at connection.c:42
#11 0x0000ffff9fb85858 in process_socket (thd=0xffff9bcdd350, p=0xffff7c823128, sock=0xffff7c8231a0, cs=0xffff7c8233a0, my_child_num=2,
my_thread_num=0) at event.c:1098
#12 0x0000ffff9fb8fc68 in worker_thread (thd=0xffff9bcdd350, dummy=0xffff9b812670) at event.c:2252
#13 0x0000aaaac3a80d5c in thread_start (thread=0xffff9bcdd350, data=0xffff9bcdd340) at util.c:3198
#14 0x0000ffffa00b47ec in dummy_worker (opaque=0xffff9bcdd350) at threadproc/unix/thread.c:142
#15 0x0000ffff9ff88624 in start_thread (arg=0xffffa023c918 <asan_thread_start(void*)>) at pthread_create.c:477
#16 0x0000ffff9fecb66c in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone.S:78
PHP Version
PHP 8.5.0alpha2 (cli) (built: Jul 23 2025 19:30:13) (ZTS)
Copyright (c) The PHP Group
Zend Engine v4.5.0-dev, Copyright (c) Zend Technologies
with Zend OPcache v8.5.0alpha2, Copyright (c), by Zend Technologies
Operating System
Debian Bullseye
Activity
realFlowControl commentedon Jul 23, 2025
The code change came with #18701
I assume that when spawning a new thread opcache's
accel_globals_ctor()has not been run whenphp_soap_init_globals()get's called and because of thatZCG(counted)points to unitialized globals 😞Fix phpGH-19226: Segfault when spawning new thread in soap extension