Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Server crashes (134) in worker mode under certain conditions #803

Closed
AlliBalliBaba opened this issue May 19, 2024 · 14 comments · Fixed by #857
Closed

Server crashes (134) in worker mode under certain conditions #803

AlliBalliBaba opened this issue May 19, 2024 · 14 comments · Fixed by #857
Labels
bug Something isn't working

Comments

@AlliBalliBaba
Copy link

AlliBalliBaba commented May 19, 2024

What happened?

I am seeing weird server crashes in the dunglas/frankenphp:1.1-php8.3-bookworm and dunglas/frankenphp:1.1-php8.3-alpine images if the pcntl extension is also installed.

The Frankenphp worker server will crash when uploading a multipart/form-data image and then redirecting afterwards. The issue seems to stem from some memory misallocation. The bug seems to happen consistently when the worker only handles 1 request. For reproducing this minimal example, you have to create a frankenphp-worker.php with the following content:

$handle = function()
{
    $file = $_FILES["file"] ?? null;
    $content =( $file['tmp_name'] ?? null) ? file_get_contents($file['tmp_name']) : null;
    if($file){
        header('Location: /?success');
    }
    echo "<form method='POST' enctype='multipart/form-data'><input type='file' name='file'><button>go</button></form>";
};

frankenphp_handle_request($handle);

To get the server crash, I had to do the following:

  1. Start the server docker image (dunglas/frankenphp:1.1-php8.3-bookworm)
  2. Install pcnt if it's not installed already (install-php-extensions pcntl)
  3. Visit the page served by frankenphp-worker.php in a browser and see the upload form
  4. Upload any file or image with the form

It is also weird that this is not 100% consistent.

I recorded this bug in Ubuntu (WSL) (amd) in both the dunglas/frankenphp:1.1-php8.3-bookworm and dunglas/frankenphp:1.1-php8.3-alpine docker images. But -only- if the pcntl extension is also installed so maybe there's an incompatiblity there? It feels very random

Also when the bug occurs (inconsistently) I see either free(): invalid pointer in the output before the POST request is handled or double free or corruption (out) after the request is handled.

Build Type

Docker (Debian Bookworm)

Worker Mode

Yes

Operating System

GNU/Linux

CPU Architecture

x86_64

PHP configuration

PHP Version 8.3.7
System	Linux 6199cc9a8b22 5.15.146.1-microsoft-standard-WSL2 #1 SMP Thu Jan 11 04:09:03 UTC 2024 x86_64
Build Date	May 10 2024 21:41:14
Build System	Linux - Docker
Build Provider	https://github.com/docker-library/php
Configure Command	'./configure' '--build=x86_64-linux-gnu' '--with-config-file-path=/usr/local/etc/php' '--with-config-file-scan-dir=/usr/local/etc/php/conf.d' '--enable-option-checking=fatal' '--with-mhash' '--with-pic' '--enable-mbstring' '--enable-mysqlnd' '--with-password-argon2' '--with-sodium=shared' '--with-pdo-sqlite=/usr' '--with-sqlite3=/usr' '--with-curl' '--with-iconv' '--with-openssl' '--with-readline' '--with-zlib' '--enable-phpdbg' '--enable-phpdbg-readline' '--with-pear' '--with-libdir=lib/x86_64-linux-gnu' '--enable-embed' '--enable-zts' '--disable-zend-signals' 'build_alias=x86_64-linux-gnu'
Server API	FrankenPHP
Virtual Directory Support	enabled
Configuration File (php.ini) Path	/usr/local/etc/php
Loaded Configuration File	(none)
Scan this dir for additional .ini files	/usr/local/etc/php/conf.d
Additional .ini files parsed	/usr/local/etc/php/conf.d/99-octane.ini, /usr/local/etc/php/conf.d/docker-php-ext-gd.ini, /usr/local/etc/php/conf.d/docker-php-ext-opcache.ini, /usr/local/etc/php/conf.d/docker-php-ext-pcntl.ini, /usr/local/etc/php/conf.d/docker-php-ext-pdo_mysql.ini, /usr/local/etc/php/conf.d/docker-php-ext-redis.ini, /usr/local/etc/php/conf.d/docker-php-ext-sodium.ini
PHP API	20230831
PHP Extension	20230831
Zend Extension	420230831
Zend Extension Build	API420230831,TS
PHP Extension Build	API20230831,TS
Debug Build	no
Thread Safety	enabled
Thread API	POSIX Threads
Zend Signal Handling	disabled
Zend Memory Manager	enabled
Zend Multibyte Support	provided by mbstring
Zend Max Execution Timers	enabled
IPv6 Support	enabled
DTrace Support	disabled
Registered PHP Streams	https, ftps, compress.zlib, php, file, glob, data, http, ftp, phar
Registered Stream Socket Transports	tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
Registered Stream Filters	zlib.*, convert.iconv.*, string.rot13, string.toupper, string.tolower, convert.*, consumed, dechunk
Zend logoThis program makes use of the Zend Scripting Language Engine:
Zend Engine v4.3.7, Copyright (c) Zend Technologies with Zend OPcache v8.3.7, Copyright (c), by Zend Technologies
Configuration
Core
PHP Version	8.3.7
Directive	Local Value	Master Value
allow_url_fopen	On	On
allow_url_include	Off	Off
arg_separator.input	&	&
arg_separator.output	&	&
auto_append_file	no value	no value
auto_globals_jit	On	On
auto_prepend_file	no value	no value
browscap	no value	no value
default_charset	UTF-8	UTF-8
default_mimetype	text/html	text/html
disable_classes	no value	no value
disable_functions	no value	no value
display_errors	Off	On
display_startup_errors	On	On
doc_root	no value	no value
docref_ext	no value	no value
docref_root	no value	no value
enable_dl	On	On
enable_post_data_reading	On	On
error_append_string	no value	no value
error_log	no value	no value
error_log_mode	0644	0644
error_prepend_string	no value	no value
error_reporting	-1	no value
expose_php	Off	Off
extension_dir	/usr/local/lib/php/extensions/no-debug-zts-20230831	/usr/local/lib/php/extensions/no-debug-zts-20230831
fiber.stack_size	no value	no value
file_uploads	On	On
hard_timeout	2	2
highlight.comment	#FF8000	#FF8000
highlight.default	#0000BB	#0000BB
highlight.html	#000000	#000000
highlight.keyword	#007700	#007700
highlight.string	#DD0000	#DD0000
html_errors	On	On
ignore_repeated_errors	Off	Off
ignore_repeated_source	Off	Off
ignore_user_abort	On	Off
implicit_flush	Off	Off
include_path	.:/usr/local/lib/php	.:/usr/local/lib/php
input_encoding	no value	no value
internal_encoding	no value	no value
log_errors	Off	Off
mail.add_x_header	Off	Off
mail.force_extra_parameters	no value	no value
mail.log	no value	no value
mail.mixed_lf_and_crlf	Off	Off
max_execution_time	60	30
max_file_uploads	20	20
max_input_nesting_level	64	64
max_input_time	-1	-1
max_input_vars	1000	1000
max_multipart_body_parts	-1	-1
memory_limit	128M	128M
open_basedir	no value	no value
output_buffering	0	0
output_encoding	no value	no value
output_handler	no value	no value
post_max_size	100M	100M
precision	14	14
realpath_cache_size	16M	16M
realpath_cache_ttl	360	360
register_argc_argv	On	On
report_memleaks	On	On
report_zend_debug	Off	Off
request_order	no value	no value
sendmail_from	no value	no value
sendmail_path	/usr/sbin/sendmail -t -i	/usr/sbin/sendmail -t -i
serialize_precision	-1	-1
short_open_tag	On	On
SMTP	localhost	localhost
smtp_port	25	25
sys_temp_dir	no value	no value
syslog.facility	LOG_USER	LOG_USER
syslog.filter	no-ctrl	no-ctrl
syslog.ident	php	php
unserialize_callback_func	no value	no value
upload_max_filesize	100M	100M
upload_tmp_dir	no value	no value
user_dir	no value	no value
user_ini.cache_ttl	300	300
user_ini.filename	.user.ini	.user.ini
variables_order	EGPCS	EGPCS
xmlrpc_error_number	0	0
xmlrpc_errors	Off	Off
zend.assertions	1	1
zend.detect_unicode	On	On
zend.enable_gc	On	On
zend.exception_ignore_args	Off	Off
zend.exception_string_param_max_len	15	15
zend.max_allowed_stack_size	0	0
zend.multibyte	Off	Off
zend.reserved_stack_size	0	0
zend.script_encoding	no value	no value
ctype
ctype functions	enabled
curl
cURL support	enabled
cURL Information	7.88.1
Age	10
Features
AsynchDNS	Yes
CharConv	No
Debug	No
GSS-Negotiate	No
IDN	Yes
IPv6	Yes
krb4	No
Largefile	Yes
libz	Yes
NTLM	Yes
NTLMWB	Yes
SPNEGO	Yes
SSL	Yes
SSPI	No
TLS-SRP	Yes
HTTP2	Yes
GSSAPI	Yes
KERBEROS5	Yes
UNIX_SOCKETS	Yes
PSL	Yes
HTTPS_PROXY	Yes
MULTI_SSL	No
BROTLI	Yes
ALTSVC	Yes
HTTP3	No
UNICODE	No
ZSTD	Yes
HSTS	Yes
GSASL	No
Protocols	dict, file, ftp, ftps, gopher, gophers, http, https, imap, imaps, ldap, ldaps, mqtt, pop3, pop3s, rtmp, rtmpe, rtmps, rtmpt, rtmpte, rtmpts, rtsp, scp, sftp, smb, smbs, smtp, smtps, telnet, tftp
Host	x86_64-pc-linux-gnu
SSL Version	OpenSSL/3.0.11
ZLib Version	1.2.13
libSSH Version	libssh2/1.10.0
Directive	Local Value	Master Value
curl.cainfo	no value	no value
date
date/time support	enabled
timelib version	2022.10
"Olson" Timezone Database Version	2024.1
Timezone Database	internal
Default timezone	Europe/Vienna
Directive	Local Value	Master Value
date.default_latitude	31.7667	31.7667
date.default_longitude	35.2333	35.2333
date.sunrise_zenith	90.833333	90.833333
date.sunset_zenith	90.833333	90.833333
date.timezone	UTC	UTC
dom
DOM/XML	enabled
DOM/XML API Version	20031129
libxml Version	2.9.14
HTML Support	enabled
XPath Support	enabled
XPointer Support	enabled
Schema Support	enabled
RelaxNG Support	enabled
fileinfo
fileinfo support	enabled
libmagic	543
filter
Input Validation and Filtering	enabled
Directive	Local Value	Master Value
filter.default	unsafe_raw	unsafe_raw
filter.default_flags	no value	no value
frankenphp
Version	v1.1.5
gd
GD Support	enabled
GD Version	bundled (2.1.0 compatible)
FreeType Support	enabled
FreeType Linkage	with freetype
FreeType Version	2.12.1
GIF Read Support	enabled
GIF Create Support	enabled
JPEG Support	enabled
libJPEG Version	6b
PNG Support	enabled
libPNG Version	1.6.39
WBMP Support	enabled
XPM Support	enabled
libXpm Version	30411
XBM Support	enabled
WebP Support	enabled
BMP Support	enabled
AVIF Support	enabled
TGA Read Support	enabled
Directive	Local Value	Master Value
gd.jpeg_ignore_warning	On	On
hash
hash support	enabled
Hashing Engines	md2 md4 md5 sha1 sha224 sha256 sha384 sha512/224 sha512/256 sha512 sha3-224 sha3-256 sha3-384 sha3-512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost gost-crypto adler32 crc32 crc32b crc32c fnv132 fnv1a32 fnv164 fnv1a64 joaat murmur3a murmur3c murmur3f xxh32 xxh64 xxh3 xxh128 haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5
MHASH support	Enabled
MHASH API Version	Emulated Support
iconv
iconv support	enabled
iconv implementation	glibc
iconv library version	2.36
Directive	Local Value	Master Value
iconv.input_encoding	no value	no value
iconv.internal_encoding	no value	no value
iconv.output_encoding	no value	no value
json
json support	enabled
libxml
libXML support	active
libXML Compiled Version	2.9.14
libXML Loaded Version	20914
libXML streams	enabled
mbstring
Multibyte Support	enabled
Multibyte string engine	libmbfl
HTTP input encoding translation	disabled
libmbfl version	1.3.2
mbstring extension makes use of "streamable kanji code filter and converter", which is distributed under the GNU Lesser General Public License version 2.1.
Multibyte (japanese) regex support	enabled
Multibyte regex (oniguruma) version	6.9.8
Directive	Local Value	Master Value
mbstring.detect_order	no value	no value
mbstring.encoding_translation	Off	Off
mbstring.http_input	no value	no value
mbstring.http_output	no value	no value
mbstring.http_output_conv_mimetypes	^(text/|application/xhtml\+xml)	^(text/|application/xhtml\+xml)
mbstring.internal_encoding	no value	no value
mbstring.language	neutral	neutral
mbstring.regex_retry_limit	1000000	1000000
mbstring.regex_stack_limit	100000	100000
mbstring.strict_detection	Off	Off
mbstring.substitute_character	no value	no value
mysqlnd
mysqlnd	enabled
Version	mysqlnd 8.3.7
Compression	supported
core SSL	supported
extended SSL	supported
Command buffer size	4096
Read buffer size	32768
Read timeout	86400
Collecting statistics	Yes
Collecting memory statistics	No
Tracing	n/a
Loaded plugins	mysqlnd,debug_trace,auth_plugin_mysql_native_password,auth_plugin_mysql_clear_password,auth_plugin_caching_sha2_password,auth_plugin_sha256_password
API Extensions	pdo_mysql
openssl
OpenSSL support	enabled
OpenSSL Library Version	OpenSSL 3.0.11 19 Sep 2023
OpenSSL Header Version	OpenSSL 3.0.11 19 Sep 2023
Openssl default config	/usr/lib/ssl/openssl.cnf
Directive	Local Value	Master Value
openssl.cafile	no value	no value
openssl.capath	no value	no value
pcntl
pcntl support	enabled
pcre
PCRE (Perl Compatible Regular Expressions) Support	enabled
PCRE Library Version	10.42 2022-12-12
PCRE Unicode Version	14.0.0
PCRE JIT Support	enabled
PCRE JIT Target	x86 64bit (little endian + unaligned)
Directive	Local Value	Master Value
pcre.backtrack_limit	1000000	1000000
pcre.jit	On	On
pcre.recursion_limit	100000	100000
PDO
PDO support	enabled
PDO drivers	sqlite, mysql
pdo_mysql
PDO Driver for MySQL	enabled
Client API version	mysqlnd 8.3.7
Directive	Local Value	Master Value
pdo_mysql.default_socket	no value	no value
pdo_sqlite
PDO Driver for SQLite 3.x	enabled
SQLite Library	3.40.1
Phar
Phar: PHP Archive support	enabled
Phar API version	1.1.1
Phar-based phar archives	enabled
Tar-based phar archives	enabled
ZIP-based phar archives	enabled
gzip compression	enabled
bzip2 compression	disabled (install ext/bz2)
Native OpenSSL support	enabled
Phar based on pear/PHP_Archive, original concept by Davey Shafik.
Phar fully realized by Gregory Beaver and Marcus Boerger.
Portions of tar implementation Copyright (c) 2003-2009 Tim Kientzle.
Directive	Local Value	Master Value
phar.cache_list	no value	no value
phar.readonly	On	On
phar.require_hash	On	On
posix
POSIX support	enabled
random
Version	8.3.7
readline
Readline Support	enabled
Readline library	8.2
Directive	Local Value	Master Value
cli.pager	no value	no value
cli.prompt	\b \>	\b \>
redis
Redis Support	enabled
Redis Version	6.0.2
Redis Sentinel Version	1.0
Available serializers	php, json
Available compression	lzf, zstd, lz4
Directive	Local Value	Master Value
redis.arrays.algorithm	no value	no value
redis.arrays.auth	no value	no value
redis.arrays.autorehash	0	0
redis.arrays.connecttimeout	0	0
redis.arrays.consistent	0	0
redis.arrays.distributor	no value	no value
redis.arrays.functions	no value	no value
redis.arrays.hosts	no value	no value
redis.arrays.index	0	0
redis.arrays.lazyconnect	0	0
redis.arrays.names	no value	no value
redis.arrays.pconnect	0	0
redis.arrays.previous	no value	no value
redis.arrays.readtimeout	0	0
redis.arrays.retryinterval	0	0
redis.clusters.auth	no value	no value
redis.clusters.cache_slots	0	0
redis.clusters.persistent	0	0
redis.clusters.read_timeout	0	0
redis.clusters.seeds	no value	no value
redis.clusters.timeout	0	0
redis.pconnect.connection_limit	0	0
redis.pconnect.echo_check_liveness	1	1
redis.pconnect.pool_detect_dirty	0	0
redis.pconnect.pool_pattern	no value	no value
redis.pconnect.pool_poll_timeout	0	0
redis.pconnect.pooling_enabled	1	1
redis.session.early_refresh	0	0
redis.session.lock_expire	0	0
redis.session.lock_retries	100	100
redis.session.lock_wait_time	20000	20000
redis.session.locking_enabled	0	0
Reflection
Reflection	enabled
session
Session Support	enabled
Registered save handlers	files user redis rediscluster
Registered serializer handlers	php_serialize php php_binary
Directive	Local Value	Master Value
session.auto_start	Off	Off
session.cache_expire	180	180
session.cache_limiter	nocache	nocache
session.cookie_domain	no value	no value
session.cookie_httponly	Off	Off
session.cookie_lifetime	0	0
session.cookie_path	/	/
session.cookie_samesite	no value	no value
session.cookie_secure	Off	Off
session.gc_divisor	100	100
session.gc_maxlifetime	1440	1440
session.gc_probability	1	1
session.lazy_write	On	On
session.name	PHPSESSID	PHPSESSID
session.referer_check	no value	no value
session.save_handler	files	files
session.save_path	no value	no value
session.serialize_handler	php	php
session.sid_bits_per_character	4	4
session.sid_length	32	32
session.upload_progress.cleanup	On	On
session.upload_progress.enabled	On	On
session.upload_progress.freq	1%	1%
session.upload_progress.min_freq	1	1
session.upload_progress.name	PHP_SESSION_UPLOAD_PROGRESS	PHP_SESSION_UPLOAD_PROGRESS
session.upload_progress.prefix	upload_progress_	upload_progress_
session.use_cookies	On	On
session.use_only_cookies	On	On
session.use_strict_mode	Off	Off
session.use_trans_sid	Off	Off
SimpleXML
SimpleXML support	enabled
Schema support	enabled
sodium
sodium support	enabled
libsodium headers version	1.0.18
libsodium library version	1.0.18
SPL
SPL support	enabled
Interfaces	OuterIterator, RecursiveIterator, SeekableIterator, SplObserver, SplSubject
Classes	AppendIterator, ArrayIterator, ArrayObject, BadFunctionCallException, BadMethodCallException, CachingIterator, CallbackFilterIterator, DirectoryIterator, DomainException, EmptyIterator, FilesystemIterator, FilterIterator, GlobIterator, InfiniteIterator, InvalidArgumentException, IteratorIterator, LengthException, LimitIterator, LogicException, MultipleIterator, NoRewindIterator, OutOfBoundsException, OutOfRangeException, OverflowException, ParentIterator, RangeException, RecursiveArrayIterator, RecursiveCachingIterator, RecursiveCallbackFilterIterator, RecursiveDirectoryIterator, RecursiveFilterIterator, RecursiveIteratorIterator, RecursiveRegexIterator, RecursiveTreeIterator, RegexIterator, RuntimeException, SplDoublyLinkedList, SplFileInfo, SplFileObject, SplFixedArray, SplHeap, SplMinHeap, SplMaxHeap, SplObjectStorage, SplPriorityQueue, SplQueue, SplStack, SplTempFileObject, UnderflowException, UnexpectedValueException
sqlite3
SQLite3 support	enabled
SQLite Library	3.40.1
Directive	Local Value	Master Value
sqlite3.defensive	On	On
sqlite3.extension_dir	no value	no value
standard
Dynamic Library Support	enabled
Path to sendmail	/usr/sbin/sendmail -t -i
Directive	Local Value	Master Value
assert.active	On	On
assert.bail	Off	Off
assert.callback	no value	no value
assert.exception	On	On
assert.warning	On	On
auto_detect_line_endings	Off	Off
default_socket_timeout	60	60
from	no value	no value
session.trans_sid_hosts	no value	no value
session.trans_sid_tags	a=href,area=href,frame=src,form=	a=href,area=href,frame=src,form=
unserialize_max_depth	4096	4096
url_rewriter.hosts	no value	no value
url_rewriter.tags	form=	form=
user_agent	no value	no value
tokenizer
Tokenizer Support	enabled
xml
XML Support	active
XML Namespace Support	active
libxml2 Version	2.9.14
xmlreader
XMLReader	enabled
xmlwriter
XMLWriter	enabled
Zend OPcache
Opcode Caching	Up and Running
Optimization	Enabled
SHM Cache	Enabled
File Cache	Disabled
JIT	On
Startup	OK
Shared memory model	mmap
Cache hits	5245
Cache misses	1665
Used memory	35794008
Free memory	232641448
Wasted memory	0
Interned Strings Used memory	5718664
Interned Strings Free memory	2669944
Cached scripts	871
Cached keys	1668
Max keys	32531
OOM restarts	0
Hash keys restarts	0
Manual restarts	0
Start time	2024-05-19T23:53:50+0200
Last restart time	none
Last force restart time	none
Directive	Local Value	Master Value
opcache.blacklist_filename	no value	no value
opcache.dups_fix	Off	Off
opcache.enable	On	On
opcache.enable_cli	On	On
opcache.enable_file_override	Off	Off
opcache.error_log	no value	no value
opcache.file_cache	no value	no value
opcache.file_cache_consistency_checks	On	On
opcache.file_cache_only	Off	Off
opcache.file_update_protection	2	2
opcache.force_restart_timeout	180	180
opcache.huge_code_pages	Off	Off
opcache.interned_strings_buffer	8	8
opcache.jit	tracing	tracing
opcache.jit_bisect_limit	0	0
opcache.jit_blacklist_root_trace	16	16
opcache.jit_blacklist_side_trace	8	8
opcache.jit_buffer_size	128M	128M
opcache.jit_debug	0	0
opcache.jit_hot_func	127	127
opcache.jit_hot_loop	64	64
opcache.jit_hot_return	8	8
opcache.jit_hot_side_exit	8	8
opcache.jit_max_exit_counters	8192	8192
opcache.jit_max_loop_unrolls	8	8
opcache.jit_max_polymorphic_calls	2	2
opcache.jit_max_recursive_calls	2	2
opcache.jit_max_recursive_returns	2	2
opcache.jit_max_root_traces	1024	1024
opcache.jit_max_side_traces	128	128
opcache.jit_max_trace_length	1024	1024
opcache.jit_prof_threshold	0.005	0.005
opcache.lockfile_path	/tmp	/tmp
opcache.log_verbosity_level	1	1
opcache.max_accelerated_files	32531	32531
opcache.max_file_size	0	0
opcache.max_wasted_percentage	5	5
opcache.memory_consumption	256M	256M
opcache.opt_debug_level	0	0
opcache.optimization_level	0x7FFEBFFF	0x7FFEBFFF
opcache.preferred_memory_model	no value	no value
opcache.preload	no value	no value
opcache.preload_user	no value	no value
opcache.protect_memory	Off	Off
opcache.record_warnings	Off	Off
opcache.restrict_api	no value	no value
opcache.revalidate_freq	2	2
opcache.revalidate_path	Off	Off
opcache.save_comments	On	On
opcache.use_cwd	Off	Off
opcache.validate_permission	Off	Off
opcache.validate_root	Off	Off
opcache.validate_timestamps	Off	Off
zlib
ZLib Support	enabled
Stream Wrapper	compress.zlib://
Stream Filter	zlib.inflate, zlib.deflate
Compiled Version	1.2.13
Linked Version	1.2.13
Directive	Local Value	Master Value
zlib.output_compression	On	On
zlib.output_compression_level	9	9
zlib.output_handler	no value	no value
Additional Modules
Module Name

Relevant log output

backend  | {"level":"info","ts":1716157049.991952,"msg":"restarting","worker":"/app/public/frankenphp-worker.php"}
backend  | free(): invalid pointer
backend  | {"level":"info","ts":1716157053.8772733,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"192.168.48
.1","remote_port":"34614","client_ip":"192.168.48.1","proto":"HTTP/1.1","method":"POST","host":"backend.cms.localhost:8033","uri":"/?success","headers":
{"Sec-Fetch-Site":["same-origin"],"Accept-Encoding":["gzip, deflate, br, zstd"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537
.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"],"Sec-Fetch-Mode":["navigate"],"Referer":["http://localhost:8033/?success"],"Accept-
Language":["en,de-AT;q=0.9,de;q=0.8"],"Connection":["keep-alive"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Origin":["http://localhost:8033"],"C
ookie":[],"Cache-Control":["max-age=0"],"Sec-Ch-Ua-Mobile":["?0"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp
,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"],"Content-Type":["multipart/form-data; boundary=----WebKitFormBoundaryBfhPuMOgZLPpnABw"],"
Sec-Fetch-User":["?1"],"Sec-Fetch-Dest":["document"],"Content-Length":["62477"],"Sec-Ch-Ua":["\"Google Chrome\";v=\"125\", \"Chromium\";v=\"125\", \"Not
.A/Brand\";v=\"24\""],"Upgrade-Insecure-Requests":["1"]}},"bytes_read":62477,"user_id":"","duration":0.043359339,"size":107,"status":302,"resp_headers":{"Location":["/?success"],"Content-Type":["text/html; charset=UTF-8"],"Server":["Caddy"],"X-Powered-By":["PHP/8.3.7"]}}
backend exited with code 134
@AlliBalliBaba AlliBalliBaba added the bug Something isn't working label May 19, 2024
@withinboredom
Copy link
Collaborator

Interesting! Thank you for providing a minimal reproducer, that helps a ton.

I happen to be working on a php-src RFC for someone right now so I popped over to the pcntl extension to just take a quick gander. From the looks of it, it probably isn't compatible with FrankenPHP.

  1. It was written with the assumption that PHP is the process owner ... Caddy is the process owner in FrankenPHP. That means making changes to the current process will make changes to the Caddy process. This is probably not what you want.
  2. The bug here appears to be stemming from the fact that at the end of a request, pcntl appears to try and reset a global signal table that spans all threads. This will probably result in a race condition when different threads try to change the same memory without coordination giving a potential "invalid pointer" at the beginning of a request or a "double free" at the end of a request.

I'd have to actually debug it to figure out what is going on, but in theory this bug would happen on any ZTS build with this extension and multiple threads.

@AlliBalliBaba
Copy link
Author

AlliBalliBaba commented May 22, 2024

Thanks for looking into it @withinboredom
This is unfortunate since some worker implementations like the one in laravel explicitly require you to have pcntl installed. I guess the workaround right now would be to just handle a lot of requests before gracefully restarting the worker. The chance for a server crash would then probably be very small.

@dunglas
Copy link
Owner

dunglas commented May 22, 2024

Actually Laravel Octane only needs pcntl for the CLI SAPI... to start FrankenPHP. FrankenPHP itself doesn't need nor use pcntl.

It should be possible to install pcntl for CLI but not for FrankenPHP, and this should work for Octane.

@lermontex
Copy link

lermontex commented May 22, 2024

Symfony Messenger may also require pcntl. In any case, without this extension I can’t run a project that uses message processing in batches (not sure if this is related)

https://symfony.com/doc/current/messenger.html#process-messages-by-batches

I'm using RabbitMQ, the following packages are installed:
symfony/messenger
symfony/doctrine-messenger
symfony/amqp-messenger

I also had strange crashes with a large number of messages. It's very sad if this is related

messenger-1   |
messenger-1   | In DispatchPcntlSignalListener.php line 24:
messenger-1   |
messenger-1   |   [Symfony\Component\ErrorHandler\Error\UndefinedFunctionError]
messenger-1   |   Attempted to call function "pcntl_signal_dispatch" from namespace "Symfony\
messenger-1   |   Component\Messenger\EventListener".
messenger-1   |
messenger-1   |
messenger-1   | Exception trace:
messenger-1   |   at /srv/app/vendor/symfony/messenger/EventListener/DispatchPcntlSignalListener.php:24
messenger-1   |  Symfony\Component\Messenger\EventListener\DispatchPcntlSignalListener->onWorkerRunning() at /srv/app/vendor/symfony/event-dispatcher/Debug/WrappedListener.php:116
messenger-1   |  Symfony\Component\EventDispatcher\Debug\WrappedListener->__invoke() at /srv/app/vendor/symfony/event-dispatcher/EventDispatcher.php:206
messenger-1   |  Symfony\Component\EventDispatcher\EventDispatcher->callListeners() at /srv/app/vendor/symfony/event-dispatcher/EventDispatcher.php:56
messenger-1   |  Symfony\Component\EventDispatcher\EventDispatcher->dispatch() at /srv/app/vendor/symfony/event-dispatcher/Debug/TraceableEventDispatcher.php:127
messenger-1   |  Symfony\Component\EventDispatcher\Debug\TraceableEventDispatcher->dispatch() at /srv/app/vendor/symfony/messenger/Worker.php:132
messenger-1   |  Symfony\Component\Messenger\Worker->run() at /srv/app/vendor/symfony/messenger/Command/ConsumeMessagesCommand.php:235
messenger-1   |  Symfony\Component\Messenger\Command\ConsumeMessagesCommand->execute() at /srv/app/vendor/symfony/console/Command/Command.php:279
messenger-1   |  Symfony\Component\Console\Command\Command->run() at /srv/app/vendor/symfony/console/Application.php:1049
messenger-1   |  Symfony\Component\Console\Application->doRunCommand() at /srv/app/vendor/symfony/framework-bundle/Console/Application.php:125
messenger-1   |  Symfony\Bundle\FrameworkBundle\Console\Application->doRunCommand() at /srv/app/vendor/symfony/console/Application.php:318
messenger-1   |  Symfony\Component\Console\Application->doRun() at /srv/app/vendor/symfony/framework-bundle/Console/Application.php:79
messenger-1   |  Symfony\Bundle\FrameworkBundle\Console\Application->doRun() at /srv/app/vendor/symfony/console/Application.php:169
messenger-1   |  Symfony\Component\Console\Application->run() at /srv/app/vendor/symfony/runtime/Runner/Symfony/ConsoleApplicationRunner.php:49
messenger-1   |  Symfony\Component\Runtime\Runner\Symfony\ConsoleApplicationRunner->run() at /srv/app/vendor/autoload_runtime.php:29
messenger-1   |  require_once() at /srv/app/bin/console:15
messenger-1   |
messenger-1   | messenger:consume [-l|--limit LIMIT] [-f|--failure-limit FAILURE-LIMIT] [-m|--memory-limit MEMORY-LIMIT] [-t|--time-limit TIME-LIMIT] [--sleep SLEEP] [-b|--bus BUS] [--queues QUEUES] [--no-reset] [--] [<receivers>...]

@dunglas
Copy link
Owner

dunglas commented May 22, 2024

@lermontex it's the same situation for Symfony Messenger. pcntl is only needed to run the consumer command (CLI), FrankenPHP (with the notable exception of the php-cli subcommand) runs the web server.

You could run the commands with the standard PHP CLI SAPI, (the php binary) with pcntl installed, and the web server (the FrankenPHP SAPI) without pcntl.

That being said, this is just a workaround. The real solution is to fix the thread safety issue in pcntl.

@dunglas
Copy link
Owner

dunglas commented May 22, 2024

Could you please report this bug to PHP directly, as this doesn't look specific to FrankenPHP (and there is nothing we can do about that in this code base).

@lermontex
Copy link

lermontex commented May 22, 2024

@dunglas, The fact is that, as far as I understand, using dunglas/symfony-docker I will have to add an additional image for Messenger

I'm currently using one image to run the webserver and handler. A similar solution is described here
dunglas/symfony-docker#539

I think it should be mentioned that this may cause errors since the pcntl extension will be installed in any mode:
https://github.com/dunglas/symfony-docker/blob/bfdd75e73ffcdce57f0f9f883029b57629549195/Dockerfile#L28

RUN set -eux; \
	install-php-extensions \
		@composer \
		apcu \
		intl \
		opcache \
		zip \
		pcntl \
	;
root@api:/srv/app# php -m
[PHP Modules]
amqp
apcu
Core
ctype
curl
date
dom
fileinfo
filter
hash
iconv
intl
json
libxml
mbstring
mysqlnd
openssl
pcntl
pcre
PDO
pdo_pgsql
pdo_sqlite
Phar
posix
random
readline
Reflection
session
SimpleXML
sodium
SPL
sqlite3
standard
tokenizer
xml
xmlreader
xmlwriter
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache

Anyway, it seems we need to add information about incompatibility (if this is indeed the case) to the documentation

@dunglas
Copy link
Owner

dunglas commented May 22, 2024

@lermontex we can document it in the "known issues" page! PR welcome.

Thanks to the reproducer, this bug shouldn't be too hard to fix.

I have a very busy week (and the next will be busy too), but I'll try to take a look after that if someone didn't had time to work on this.

@lermontex
Copy link

@dunglas, Unfortunately, I will not be able to provide more specific information, since I was never able to find out why the errors occurred in my case. I just mentioned that incompatibility with pcntl can also affect the operation of Symfony Messenger. Hope this can prevent unexpected errors and improve comppatiblity in the future

Anyway, thanks for your work!

@withinboredom
Copy link
Collaborator

You could run the commands with the standard PHP CLI SAPI, (the php binary) with pcntl installed, and the web server (the FrankenPHP SAPI) without pcntl.

You can do this by using different php.ini files instead of different containers. Basically have a web.php.ini and a worker.php.ini. In theory, you should already be doing this because workers generally need more memory than web requests, different error reporting, potentially different extensions enabled, different opcache/jit config, etc.

@AlliBalliBaba
Copy link
Author

I've noticed that triggering gc_collect_cycles() at the end of the worker script also seems to mitigate crashes, at least with a Laravel project I'm working on. I created an according PR for Laravel Octane. It would be nice if this also fixes crashes other people have been having.

The main problem with these types of crashes is how hard they are to reproduce

@dunglas
Copy link
Owner

dunglas commented Jun 7, 2024

Thanks for the reproducer. I can reproduce the bug on Mac using the latest version. I'm on it.

@dunglas
Copy link
Owner

dunglas commented Jun 7, 2024

#857 fixes the problem on my side. I don't think that it's related to pcntl.

Could you try this patch to see if it fixes the issue for you too @AlliBalliBaba?

@AlliBalliBaba
Copy link
Author

I suspect it will fix the issue. I'll try installing from source if I have time or with a new release once it's out

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants