CRASH in instanceof_function_slow

[plexorama]

Description

found following kernel log entry

php-fpm[153638]: segfault at 2f ip 0000634627ccda4d sp 00007fffa385be28 error 4 in php-fpm[634627800000+4fd000] likely on CPU 1 (core 1, socket 0)
Code: 8b 87 b8 01 00 00 48 8d 14 d0 eb 0a 90 48 83 c0 08 48 39 d0 74 27 48 39 30 75 f2 b8 01 00 00 00 c3 0f 1f 40 00 48 85 ff 74 13 <48> 8b 7f 10 48 39 fe 75 f2 eb e6 0f 1f 84 00 00 00 00 00 31 c0 c3

traced the code to the following location:

  0x00000000006cda3e <instanceof_function_slow+46>:    b8 01 00 00 00          mov    $0x1,%eax
   0x00000000006cda43 <instanceof_function_slow+51>:    c3                      ret
   0x00000000006cda44 <instanceof_function_slow+52>:    0f 1f 40 00             nopl   0x0(%rax)
   0x00000000006cda48 <instanceof_function_slow+56>:    48 85 ff                test   %rdi,%rdi
   0x00000000006cda4b <instanceof_function_slow+59>:    74 13                   je     0x6cda60 <instanceof_function_slow+80>

>>   0x00000000006cda4d <instanceof_function_slow+61>:    48 8b 7f 10             mov    0x10(%rdi),%rdi

   0x00000000006cda51 <instanceof_function_slow+65>:    48 39 fe                cmp    %rdi,%rsi
   0x00000000006cda54 <instanceof_function_slow+68>:    75 f2                   jne    0x6cda48 <instanceof_function_slow+56>
   0x00000000006cda56 <instanceof_function_slow+70>:    eb e6                   jmp    0x6cda3e <instanceof_function_slow+46>
   0x00000000006cda58 <instanceof_function_slow+72>:    0f 1f 84 00 00 00 00 00 nopl   0x0(%rax,%rax,1)
   0x00000000006cda60 <instanceof_function_slow+80>:    31 c0                   xor    %eax,%eax
   0x00000000006cda62 <instanceof_function_slow+82>:    c3                      ret

I've re-built php8.4.14 with debugging symbols enabled and traced the location to this line:

(gdb) disassemble /s instanceof_function_slow
Dump of assembler code for function instanceof_function_slow:
/usr/src/php/Zend/zend_operators.c:

2492 if (ce->ce_flags & ZEND_ACC_INTERFACE) {
0x0000000000a2bed1 <+66>: mov -0x20(%rbp),%rax
0x0000000000a2bed5 <+70>: mov 0x1c(%rax),%eax
0x0000000000a2bed8 <+73>: and $0x1,%eax
0x0000000000a2bedb <+76>: test %eax,%eax
0x0000000000a2bedd <+78>: je 0xa2bf71 <instanceof_function_slow+226>

if looks like "ce" is invalid in this case.

following modules are loaded:

[PHP Modules]
bcmath
bz2
Core
ctype
curl
date
dom
fileinfo
filter
gd
hash
iconv
igbinary
json
ldap
libxml
mbstring
mongodb
mysqli
mysqlnd
openssl
pcre
PDO
pdo_mysql
pdo_sqlite
Phar
posix
random
readline
Reflection
session
SimpleXML
sodium
SPL
sqlite3
standard
swoole
tidy
tokenizer
xml
xmlreader
xmlwriter
xsl
Zend OPcache
zip
zlib

[Zend Modules]
Zend OPcache

This is running on a production system, so my debugging abilities are somewhat limited. Unfortunately I can't pin down the location of the script that was being executed due to limited information (for now). I've enabled core dumps and not waiting for the crash to occur again.

PHP Version

PHP 8.4.14 (cli) (built: Nov  4 2025 00:22:08) (NTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.14, Copyright (c) Zend Technologies
    with Zend OPcache v8.4.14, Copyright (c), by Zend Technologies

Operating System

Ubuntu 24.04.2 LTS / php8.4.14-fpm-bookworm docker image

[devnexen]

Hi @plexorama would it be possible to have a larger backtrace ? e.g. (gdb) bt full. Cheers.

[arnaud-lb]

If you are using opcache.file_cache, this may be related to #20329. A workaround is to increase the interned string buffer size.

[plexorama]

Hi @plexorama would it be possible to have a larger backtrace ? e.g. (gdb) bt full. Cheers.

will post it here as soon as the error resurfaces and I have a full core dump available

[plexorama]

If you are using opcache.file_cache, this may be related to #20329. A workaround is to increase the interned string buffer size.

thanks, opcache.file_cache is not set in this case.

[plexorama]

hi @devnexen, the error surfaced again today, here is the bt and the regs:

(gdb) bt
#0  0x0000634627ccda4d in instanceof_function_slow ()
#1  0x0000634627c03ac0 in ?? ()
#2  0x00006346098a1132 in ?? ()
#3  0x0000000000000001 in ?? ()
#4  0x0000634665c6c8c0 in ?? ()
#5  0x0000000000000000 in ?? ()
(gdb) info reg
rax            0x6346028490b0      109152341102768
rbx            0x6346047b3d00      109152374045952
rcx            0x6                 6
rdx            0x634665b9094f      109154005485903
rsi            0x6346028490b0      109152341102768
rdi            0x1f                31
rbp            0x2                 0x2
rsp            0x7fffa385c678      0x7fffa385c678
r8             0x110000            1114112
r9             0x2                 2
r10            0x0                 0
r11            0x634628cdf300      109152983446272
r12            0x1                 1
r13            0x729497a137a0      125982524651424
r14            0x729497a13720      125982524651296
r15            0x729497a13800      125982524651520
rip            0x634627ccda4d      0x634627ccda4d <instanceof_function_slow+61>
eflags         0x10202             [ IF RF ]
cs             0x33                51
ss             0x2b                43
ds             0x0                 0
es             0x0                 0
fs             0x0                 0
gs             0x0                 0

[plexorama]

@devnexen I was able to get some more information by loading additional debugging symbols:

(gdb) bt
#0  0x0000634627ccda4d in instanceof_function_slow ()
#1  0x0000634627c03ac0 in is_a_impl ()
#2  0x00006346098a1132 in ?? ()
#3  0x0000000000000001 in zval_get_type (pz=0x6346098a1132) at /usr/src/php-8.4.14/Zend/zend_types.h:649
#4  0x0000634665c6c8c0 in ?? ()
#5  0x0000000000000000 in ?? ()

interestingly, frame 2 points to pz argument of zval_get_type(); which has an invalid type 137

(gdb) printzv 0x6346098a1132
[0x6346098a1132] unknown type 137

(gdb) zbacktrace 
[0x729497a13800] is_subclass_of("EGroupware\Api\Etemplate\Widget\Nextmatch\Filterheader", "EGroupware\Api\Etemplate\Widget") [internal function]
[0x729497a13720] EGroupware\Api\Etemplate\Widget->registerWidget("EGroupware\Api\Etemplate\Widget\Nextmatch\Filterheader", array(1)[0x729497a13780]) 
/var/www/html/api/src/Etemplate/Widget.php:338 
[0x729497a136d0] EGroupware\Api\Etemplate\Widget->(main) /var/www/html/api/src/Etemplate/Widget/Nextmatch/Filterheader.php:25 
[0x729497a135f0] EGroupware\Api\Etemplate\Widget->scanForWidgets() /var/www/html/api/src/Etemplate/Widget.php:376 
[0x729497a135a0] (main) /var/www/html/api/src/Etemplate/Widget.php:1148 
[0x729497a134c0] {closure:/var/www/html/api/src/autoload.php:38}("EGroupware\Api\Etemplate\Widget") /var/www/html/api/src/autoload.php:49 
[0x729497a13470] (main) /var/www/html/api/src/Etemplate/Widget/Taglist.php:24 
[0x729497a13390] {closure:/var/www/html/api/src/autoload.php:38}("EGroupware\Api\Etemplate\Widget\Taglist") /var/www/html/api/src/autoload.php:49 
[0x729497a13330] ReflectionMethod->__construct("EGroupware\Api\Etemplate\Widget\Taglist::ajax_email") [internal function]
[0x729497a13200] EGroupware\Api\Json\Request->handleRequest("EGroupware\Api\Etemplate\Widget\Taglist::ajax_email", array(2)[0x729497a13260]) /var/www/html/api/src/Json/Request.php:174 
[0x729497a13100] EGroupware\Api\Json\Request->parseRequest("EGroupware\Api\Etemplate\Widget\Taglist::ajax_email", "{"request":{"parameters":["<REDACTED>",{"num_rows":10,"includeLists":true}]
}}") /var/www/html/api/src/Json/Request.php:106 
[0x729497a13020] (main) /var/www/html/json.php:130 

[devnexen]

Thanks that s the PHP stack, if you have still the core dump would it be possible to do a bt full please ?

[plexorama]

here it is

(gdb) bt full
#0  0x0000634627ccda4d in instanceof_function_slow ()
No symbol table info available.
#1  0x0000634627c03ac0 in is_a_impl ()
No symbol table info available.
#2  0x00006346098a1132 in ?? ()
No symbol table info available.
#3  0x0000000000000001 in zval_get_type (pz=0x6346098a1132) at /usr/src/php-8.4.14/Zend/zend_types.h:649
No locals.
#4  0x0000634665c6c8c0 in ?? ()
No symbol table info available.
#5  0x0000000000000000 in ?? ()
No symbol table info available.

[devnexen]

If this is not possible get a fuller picture we would need at least a (minimal) reproducer, looks like your PHP backtrace gives you an idea where the issue occurs.