php-fpm - segfault at start

Description

PHP version : 8.5.2

The following code: Not a specific code

I have a core dump error during the start of php-fpm. It's only during the start and once one of the child crash, it run smoothly. php cli, even when running some worker didn't have any issue

I try to add debug flag in the dump but it seems partial (I didn't find doc about it), I add --enable-debug and in the CFLAG -g O0. Did I miss something (see below) because it doesn't seems to add much more detail

php extension

Core: 8.5.2
date: 8.5.2
lexbor: 8.5.2
openssl: 8.5.2
pcre: 8.5.2
sqlite3: 8.5.2
zlib: 8.5.2
ctype: 8.5.2
curl: 8.5.2
uri: 8.5.2
json: 8.5.2
fileinfo: 8.5.2
filter: 8.5.2
hash: 8.5.2
iconv: 8.5.2
SPL: 8.5.2
mbstring: 8.5.2
Zend OPcache: 8.5.2
session: 8.5.2
standard: 8.5.2
PDO: 8.5.2
pdo_sqlite: 8.5.2
Phar: 8.5.2
posix: 8.5.2
random: 8.5.2
readline: 8.5.2
Reflection: 8.5.2
libxml: 8.5.2
SimpleXML: 8.5.2
tokenizer: 8.5.2
dom: 20031129
xml: 8.5.2
xmlreader: 8.5.2
xmlwriter: 8.5.2
mysqlnd: mysqlnd 8.5.2
apcu: 5.1.28
bcmath: 8.5.2
ds: 1.6.0
sockets: 8.5.2
exif: 8.5.2
gd: 8.5.2
intl: 8.5.2
opentelemetry: 1.2.1
pcntl: 8.5.2
pdo_dblib: 8.5.2
pdo_mysql: 8.5.2
pdo_pgsql: 8.5.2
protobuf: 4.33.4
redis: 6.3.0
soap: 8.5.2
ev: 1.2.2
sodium: 8.5.2
zip: 1.22.7

My config is basically the default one from the docker : php:8.5.2-fpm-alpine3.23 with
php ini

opcache.interned_strings_buffer = 48
opcache.max_accelerated_files = 80000
opcache.memory_consumption = 450
opcache.validate_timestamps = Off
opcache.validate_permission = Off
opcache.max_wasted_percentage = 10
; preload file created by symfony
opcache.preload = /srv/app/config/preload.php
opcache.file_cache = /srv/app/var/opcache
opcache.error_log = /proc/self/fd/2
opcache.jit_buffer_size = 4M
realpath_cache_size = 4096K
realpath_cache_ttl = 600
memory_limit = 1024M
session.gc_maxlifetime = 86400
max_execution_time = 300
max_input_time = 120

php-fpm

[global]
error_log = /proc/self/fd/2
log_limit = 8192
daemonize = no
process_control_timeout = 120
log_level = warn
emergency_restart_threshold = 5
emergency_restart_interval = 1m

[www]
access.log = /proc/self/fd/2
clear_env = no
catch_workers_output = yes
decorate_workers_output = no
listen = /var/run/php/php-fpm.sock
listen.mode = 0666
ping.path = /ping
pm = dynamic
pm.max_children = 8
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 4
pm.max_requests = 150
pm.status_path = /_status
pm.status_listen = 0.0.0.0:9001

The trace :

Type "apropos word" to search for commands related to "word"...
Reading symbols from /usr/local/sbin/php-fpm...
(No debugging symbols found in /usr/local/sbin/php-fpm)

warning: Can't open file /dev/zero (deleted) during file-backed mapping note processing
[New LWP 15]
Core was generated by `/usr/local/sbin/php-fpm'.
Program terminated with signal SIGABRT, Aborted.
#0  __restore_sigs (set=set@entry=0x7ffd6dec4360) at ./arch/x86_64/syscall_arch.h:40

warning: 40     ./arch/x86_64/syscall_arch.h: No such file or directory
(gdb) bt
#0  __restore_sigs (set=set@entry=0x7ffd6dec4360) at ./arch/x86_64/syscall_arch.h:40
#1  0x00007fc96de517a9 in raise (sig=sig@entry=6) at src/signal/raise.c:11
#2  0x00007fc96de34f7a in abort () at src/exit/abort.c:11
#3  0x00007fc96de35026 in __assert_fail (expr=<optimized out>, file=<optimized out>, line=<optimized out>, func=<optimized out>) at src/exit/assert.c:7
#4  0x000055fa2c5578ca in ?? ()
#5  0x000055fa2c5599c4 in ?? ()
#6  0x000055fa2c55b431 in ?? ()
#7  0x000055fa2c55714e in ?? ()
#8  0x000055fa2c55c90b in ?? ()
#9  0x000055fa2c55714e in ?? ()
#10 0x000055fa2c5613c1 in ?? ()
#11 0x000055fa2c5618e6 in ?? ()
#12 0x000055fa2c5820ae in ?? ()
#13 0x000055fa2c5839ac in ?? ()
#14 0x000055fa2cbe14e4 in compile_filename ()
#15 0x000055fa2cb06243 in ?? ()
#16 0x000055fa2cb1840e in ?? ()
#17 0x000055fa2cb8ec54 in execute_ex ()
#18 0x000055fa2caf2339 in zend_call_function ()
#19 0x000055fa2caf289e in zend_call_known_function ()
#20 0x000055fa2c7c381c in ?? ()
#21 0x000055fa2caf30a6 in zend_lookup_class_ex ()
#22 0x000055fa2caf31a0 in zend_lookup_class ()
#23 0x000055fa2c790c1a in ?? ()
#24 0x000055fa2c790d59 in ?? ()
#25 0x000055fa2cb0cc0a in ?? ()
#26 0x000055fa2cb8e2ac in execute_ex ()
#27 0x000055fa2cba0c43 in zend_generator_resume ()
#28 0x000055fa2cba0f20 in ?? ()
#29 0x000055fa2cba0f57 in ?? ()
#30 0x000055fa2cba1f8e in ?? ()
#31 0x000055fa2cb06408 in ?? ()
#32 0x000055fa2cb41e06 in ?? ()
#33 0x000055fa2cb9099c in execute_ex ()
#34 0x000055fa2cba0c43 in zend_generator_resume ()
#35 0x000055fa2cba1f67 in ?? ()
#36 0x000055fa2cb107df in ?? ()
#37 0x000055fa2cb42987 in ?? ()
#38 0x000055fa2cb909bc in execute_ex ()
#39 0x000055fa2cb92cd2 in zend_execute ()
#40 0x000055fa2cc4573f in zend_execute_script ()
#41 0x000055fa2c9cd2c0 in php_execute_script_ex ()
#42 0x000055fa2c9cd46f in php_execute_script ()
#43 0x000055fa2cc59987 in ?? ()
#44 0x00007fc96de34a30 in libc_start_main_stage2 (main=0x55fa2cc58bce, argc=1, argv=0x7ffd6dec73e8) at src/env/__libc_start_main.c:95
#45 0x000055fa2c205c90 in _start ()
(gdb) bt full
#0  __restore_sigs (set=set@entry=0x7ffd6dec4360) at ./arch/x86_64/syscall_arch.h:40
No locals.
#1  0x00007fc96de517a9 in raise (sig=sig@entry=6) at src/signal/raise.c:11
        set = {__bits = {0, 206158430224, 140726447653952, 140726447653760, 140503091737888, 94533005201104, 94532998156080, 94532998154280, 94532998192896, 418, 139702699,
            140503091737888, 140726447653872, 94532974135059, 2353, 1103609320}}
        ret = 0
#2  0x00007fc96de34f7a in abort () at src/exit/abort.c:11
No locals.
#3  0x00007fc96de35026 in __assert_fail (expr=<optimized out>, file=<optimized out>, line=<optimized out>, func=<optimized out>) at src/exit/assert.c:7
No locals.
#4  0x000055fa2c5578ca in ?? ()
No symbol table info available.
#5  0x000055fa2c5599c4 in ?? ()
No symbol table info available.
#6  0x000055fa2c55b431 in ?? ()
No symbol table info available.
#7  0x000055fa2c55714e in ?? ()
No symbol table info available.
#8  0x000055fa2c55c90b in ?? ()
No symbol table info available.
#9  0x000055fa2c55714e in ?? ()
No symbol table info available.
#10 0x000055fa2c5613c1 in ?? ()
No symbol table info available.
#11 0x000055fa2c5618e6 in ?? ()
No symbol table info available.
#12 0x000055fa2c5820ae in ?? ()
No symbol table info available.
#13 0x000055fa2c5839ac in ?? ()
No symbol table info available.
#14 0x000055fa2cbe14e4 in compile_filename ()
No symbol table info available.
#15 0x000055fa2cb06243 in ?? ()
No symbol table info available.
#16 0x000055fa2cb1840e in ?? ()
No symbol table info available.
#17 0x000055fa2cb8ec54 in execute_ex ()
No symbol table info available.
#18 0x000055fa2caf2339 in zend_call_function ()
No symbol table info available.
#19 0x000055fa2caf289e in zend_call_known_function ()
No symbol table info available.
#20 0x000055fa2c7c381c in ?? ()
No symbol table info available.
#21 0x000055fa2caf30a6 in zend_lookup_class_ex ()
No symbol table info available.
#22 0x000055fa2caf31a0 in zend_lookup_class ()
No symbol table info available.
--Type <RET> for more, q to quit, c to continue without paging--
#23 0x000055fa2c790c1a in ?? ()
No symbol table info available.
#24 0x000055fa2c790d59 in ?? ()
No symbol table info available.
#25 0x000055fa2cb0cc0a in ?? ()
No symbol table info available.
#26 0x000055fa2cb8e2ac in execute_ex ()
No symbol table info available.
#27 0x000055fa2cba0c43 in zend_generator_resume ()
No symbol table info available.
#28 0x000055fa2cba0f20 in ?? ()
No symbol table info available.
#29 0x000055fa2cba0f57 in ?? ()
No symbol table info available.
#30 0x000055fa2cba1f8e in ?? ()
No symbol table info available.
#31 0x000055fa2cb06408 in ?? ()
No symbol table info available.
#32 0x000055fa2cb41e06 in ?? ()
No symbol table info available.
#33 0x000055fa2cb9099c in execute_ex ()
No symbol table info available.
#34 0x000055fa2cba0c43 in zend_generator_resume ()
No symbol table info available.
#35 0x000055fa2cba1f67 in ?? ()
No symbol table info available.
#36 0x000055fa2cb107df in ?? ()sp
No symbol table info available.
#37 0x000055fa2cb42987 in ?? ()
No symbol table info available.
#38 0x000055fa2cb909bc in execute_ex ()
No symbol table info available.
#39 0x000055fa2cb92cd2 in zend_execute ()
No symbol table info available.
#40 0x000055fa2cc4573f in zend_execute_script ()
No symbol table info available.
#41 0x000055fa2c9cd2c0 in php_execute_script_ex ()
No symbol table info available.
#42 0x000055fa2c9cd46f in php_execute_script ()
No symbol table info available.
#43 0x000055fa2cc59987 in ?? ()
No symbol table info available.
#44 0x00007fc96de34a30 in libc_start_main_stage2 (main=0x55fa2cc58bce, argc=1, argv=0x7ffd6dec73e8) at src/env/__libc_start_main.c:95
        envp = 0x7ffd6dec73f8
#45 0x000055fa2c205c90 in _start ()
No symbol table info available.

Around the time of the crash, I see (since the debug php version run)

2026-01-27 14:39:06.788=== Total 4 memory leaks detected ===
2026-01-27 14:39:06.788Last leak repeated 1 time
2026-01-27 14:39:06.788/usr/src/php/Zend/zend_hash.c(422) :  Freeing 0x00007fc9443caa00 (640 bytes), script=-
2026-01-27 14:39:06.788[Tue Jan 27 13:39:07 2026]  Script:  '-'
2026-01-27 14:39:06.788/usr/src/php/Zend/zend_inheritance.c(1894) :  Freeing 0x00007fc9687bc8c0 (176 bytes), script=-
2026-01-27 14:39:06.788[Tue Jan 27 13:39:07 2026]  Script:  '-'
2026-01-27 14:39:06.788/usr/src/php/Zend/zend_hash.c(176) :  Freeing 0x00007fc944ef1700 (320 bytes), script=-
2026-01-27 14:39:06.788[Tue Jan 27 13:39:07 2026]  Script:  '-'

My php

PHP Version

PHP 8.5.2 (cli) (built: Jan 27 2026 11:48:15) (NTS DEBUG)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.5.2, Copyright (c) Zend Technologies
    with Zend OPcache v8.5.2, Copyright (c), by Zend Technologies

Operating System

alpine 3.23

@Grummfy

Hi @Grummfy. The trace is not particularly useful as many frames are missing. Could you try disabling all 3rd party extensions to verify this is a php-src issue?

@iluuu1994

@iluuu1994 unfortunately it will not work if I disable everything. I was not able to reproduce it outside our run environment, so disabling some extension will break some part, so the deploy will be cancelled ...

but if I need to add more debug flag, just tell me how and I will try

Well, the missing frames in the stack trace might come from an extension. Can you try to disable all the extensions that you can, and see how you can install symbols for the ones you can't? It will be very hard to help you without code or an accurate stack trace.

Unfortunately, I can't really disable extension, we enable only the one we use or required by the framework. If I have a documentation on how to enable more trace in the stacktrace I can do it, but there since it only occurs on our running env, I can't give you more. Sorry

If I have a documentation on how to enable more trace in the stacktrace I can do it, but there since it only occurs on our running env, I can't give you more.

Note that PHP Docker images are not maintained by the PHP project but by Docker. Anyway, adding the CFLAGS="-g" option should include symbols, but you'll also need to make sure the binary is not stripped afterwards. You can check debug symbols are there with file $(which php), which should say "not stripped" at the end.

I rebuild completely the php docker with the flag, so any change is not an issue. If it's usefull I can provide it.

Note the issue continue to appear in 8.5.3.

so yes, the php is stripped, how can I unstripped it?

Thanks.

Firstly I can confirm that disabling opcache file cache save the day. No more crash.

So I try to go further and answer to your question, but I'm not sure how to do what you ask me to do. I'm not familiar with low level tool like gdb (I have done c a long time ago, but never use the debugger except to do bt and provide bug to open source tools).

So, if it help, I ask chatgpt to help me. I hope it help, otherwise I will require some guidance to provide you the answer. So here it is

We (aka chatgpt) investigated this further with a core dump and gdb.

Disabling opcache.file_cache completely makes the crash disappear, which confirms this is related to the file cache.

The crash occurs during file cache serialization, not during execution:

zend_file_cache_serialize_zval()
zend_file_cache_serialize_op_array()
zend_file_cache_script_store()
persistent_compile_file()

From the core dump we identified the function being serialized:

File:
/srv/app/src/ApiPlatform/Core/Outputs/SAE/Ticket/TicketSimpleOutput.php

Function:
extractCategoryBasedCreatedAt

Line start:
97

Backtrace frame:

zend_file_cache_serialize_op_array (op_array=0x7f8d903ad5b0, ...)
    function_name = "extractCategoryBasedCreatedAt"
    filename = "/srv/app/src/ApiPlatform/Core/Outputs/SAE/Ticket/TicketSimpleOutput.php"

The zval being serialized in zend_file_cache_serialize_zval has type IS_STRING (type_info=7) but contains an invalid pointer value, which suggests an invalid state or memory corruption during serialization.

So it tell me to lod the dump, then going to frame 4 and 5 and print different values

gdb) frame 4
#4  0x0000559156b57b9b in zend_file_cache_serialize_zval (zv=0x7f8d903ad7b0, script=0x55d8cf00, info=0x7ffc44cdc6d0, buf=0x7f8d903ac000) at /usr/src/php/ext/opcache/zend_file_cache.c:418
warning: 418    /usr/src/php/ext/opcache/zend_file_cache.c: No such file or directory
(gdb) info args
zv = 0x7f8d903ad7b0
script = 0x55d8cf00
info = 0x7ffc44cdc6d0
buf = 0x7f8d903ac000
(gdb) set $script = script
(gdb) p (char*)$script->script.filename->val
$1 = 0x4428bfb0 "/srv/app/src/ApiPlatform/Core/Outputs/SAE/Ticket/TicketSimpleOutput.php"
(gdb) p $zv->value.ce
Attempt to extract a component of a value that is not a structure pointer.
(gdb) print (char*) op_array->function_name.val
No symbol "op_array" in current context.
(gdb) p *zv
$2 = {value = {lval = 1165319512, dval = 5.7574433730768625e-315, counted = 0x45755d58, str = 0x45755d58, arr = 0x45755d58, obj = 0x45755d58, res = 0x45755d58, ref = 0x45755d58, ast = 0x45755d58, zv = 0x45755d58, ptr = 0x45755d58, ce = 0x45755d58,
    func = 0x45755d58, ww = {w1 = 1165319512, w2 = 0}}, u1 = {type_info = 7, v = {type = 7 '\a', type_flags = 0 '\000', u = {extra = 0}}}, u2 = {next = 0, cache_slot = 0, opline_num = 0, lineno = 0, num_args = 0, fe_pos = 0, fe_iter_idx = 0,
    guard = 0, constant_flags = 0, extra = 0}}
(gdb) p zv->u1.type_info
$3 = 7
(gdb) set $func = $zv->value.func
p (char*)$func->op_array.function_name->val
A syntax error in expression, near `p (char*)$func->op_array.function_name->val'.
(gdb) set $ce = $zv->value.ce
p (char*)$ce->name->val
A syntax error in expression, near `p (char*)$ce->name->val'.
(gdb) set $str = (zend_string*)$zv->value.str
p $str
A syntax error in expression, near `p $str'.
(gdb) p (char*)$str->val
Attempt to extract a component of a value that is not a structure pointer.
(gdb) frame 5
#5  0x0000559156b59c95 in zend_file_cache_serialize_op_array (op_array=0x7f8d903ad5b0, script=0x55d8cf00, info=0x7ffc44cdc6d0, buf=0x7f8d903ac000) at /usr/src/php/ext/opcache/zend_file_cache.c:542
542     in /usr/src/php/ext/opcache/zend_file_cache.c
(gdb) info args
op_array = 0x7f8d903ad5b0
script = 0x55d8cf00
info = 0x7ffc44cdc6d0
buf = 0x7f8d903ac000
(gdb) set $opa = op_array
p (char*)$opa->function_name->val
p (char*)$opa->filename->val
A syntax error in expression, near `p (char*)$opa->function_name->val
p (char*)$opa->filename->val'.
(gdb) set $opa = op_array
(gdb) p (char*)$opa->function_name->val
$4 = 0x4428c018 "extractCategoryBasedCreatedAt"
(gdb) p (char*)$opa->filename->val
$5 = 0x55d8e090 "/srv/app/src/ApiPlatform/Core/Outputs/SAE/Ticket/TicketSimpleOutput.php"
(gdb) set $str = (zend_string*)$zv->value.str
Attempt to extract a component of a value that is not a structure pointer.
(gdb) p $str
$6 = void
(gdb) frame 5
#5  0x0000559156b59c95 in zend_file_cache_serialize_op_array (op_array=0x7f8d903ad5b0, script=0x55d8cf00, info=0x7ffc44cdc6d0,
    buf=0x7f8d903ac000) at /usr/src/php/ext/opcache/zend_file_cache.c:542
542     in /usr/src/php/ext/opcache/zend_file_cache.c
(gdb) set $opa = op_array
(gdb) p (char*)$opa->filename->val
$7 = 0x55d8e090 "/srv/app/src/ApiPlatform/Core/Outputs/SAE/Ticket/TicketSimpleOutput.php"
(gdb) p (char*)$opa->function_name->val
$8 = 0x4428c018 "extractCategoryBasedCreatedAt"
(gdb) p $opa->line_start
$9 = 97

I have added the problematic file in the gist

Tell me if I can do more.

Perfect, thank you! I was able to create a reproducer from your information.

ext/opcache/tests/gh21052.phpt

--TEST--
GH-21052
--CREDITS--
Grummfy
--EXTENSIONS--
opcache
--INI--
opcache.enable=1
opcache.enable_cli=1
opcache.file_cache="{TMP}"
opcache.preload={PWD}/gh21052_a.inc
--FILE--
<?php
require __DIR__ . '/gh21052_b.inc';
?>
--EXPECT--

ext/opcache/tests/gh21052_a.inc

<?php

namespace Ns;

class A {
    const C = ['foo', 'bar', 'baz'];
}

ext/opcache/tests/gh21052_b.inc

<?php

namespace Ns;

class B {
    public function test() {
        var_dump(A::C);
    }
}

@Grummfy

@Grummfy You can find the patch here: GH-21281. Thanks for your effort to identify the issue.

thanks, I will try to find time to test it.

Fix preloaded constant erroneously propagated to file-cached script

@iluuu1994

@iluuu1994 fix confirmed to work. Thanks for all.

Navigation Menu

Repository navigation

php-fpm - segfault at start #21052

Description

PHP Version

Operating System

12 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

php-fpm - segfault at start #21052

Description

Description

PHP Version

Operating System

Activity

iluuu1994 commented on Jan 28, 2026

Grummfy commented on Jan 29, 2026

iluuu1994 commented on Feb 2, 2026

Grummfy commented on Feb 11, 2026

iluuu1994 commented on Feb 16, 2026

Grummfy commented on Feb 17, 2026

12 remaining items

Grummfy commented on Feb 23, 2026

iluuu1994 commented on Feb 23, 2026

iluuu1994 commented on Feb 23, 2026

Grummfy commented on Feb 24, 2026

Grummfy commented on Feb 25, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions