i guess i've found the bug
it's a "exception safe" problem as c++
well, not php5 exception, i meant zend_bailout(longjmp)

when write handler issue a Fatal error, will trigger zend_bailout() and skip ALL other modules rshutdown, including the one right after session_flush_data();

session.c:
static void php_session_flush(TSRMLS_D)
{
    if(PS(session_status)==php_session_active) {
        php_session_save_current_state(TSRMLS_C); <-- NOT exception safe using for mod_user.c
    }
    PS(session_status)=php_session_none; <- WON'T executed when zend_bailout
}

suggested fix:
mod_user.c :: function PS_WRITE_FUNC(user)
chnage
======
    retval = ps_call_handler(PSF(write), 2, args TSRMLS_CC);
======
to
======
zend_try {
    retval = ps_call_handler(PSF(write), 2, args TSRMLS_CC);
} zend_end_try();
======

fine

Index: zend_API.c
===================================================================
RCS file: /repository/ZendEngine2/zend_API.c,v
retrieving revision 1.315
diff -u -r1.315 zend_API.c
--- zend_API.c  1 Sep 2005 10:04:55 -0000   1.315
+++ zend_API.c  19 Sep 2005 15:46:39 -0000
@@ -2335,7 +2335,9 @@
 #if 0
        zend_printf("%s:  Request shutdown\n", module->name);
 #endif
+       zend_try {
        module->request_shutdown_func(module->type, module->module_number TSRMLS_CC);
+       } zend_end_try();
    }
    return 0;
 }

Index: mod_user.c
===================================================================
RCS file: /repository/php-src/ext/session/mod_user.c,v
retrieving revision 1.29
diff -u -r1.29 mod_user.c
--- mod_user.c  3 Aug 2005 14:07:43 -0000   1.29
+++ mod_user.c  19 Sep 2005 15:48:49 -0000
@@ -145,7 +145,9 @@
    SESS_ZVAL_STRING(key, args[0]);
    SESS_ZVAL_STRINGN(val, vallen, args[1]);
 
+   zend_try {
    retval = ps_call_handler(PSF(write), 2, args TSRMLS_CC);
+   } zend_end_try();
 
    FINISH;
 }

indent/space change is not included for readablity.
any one patch will do

Why do you patch zend_API.c?? The part you added the zend_try..catch thing is already covered with such elsewhere.

And wouldn't it be better to add that stuff in the ps_call_handler() function, not just in one place it is used?

the patch i proposed long ago ([8 Nov 2004 5:24pm CET], the 2nd note in this bug) patches mod_user.c only

do u mean here?
    zend_try {
        zend_hash_apply(&module_registry, (apply_func_t) module_registry_cleanup TSRMLS_CC);
    } zend_end_try();
this try/catch here will only make sure zend_deactivate_modules is return correctly, any single bailout will break the loop of zend_hash_apply(), which is foreach item in module_registry, all remaining modules is not RSHUTDOWNed correctly

either one of the patches will do. u don't need apply both of them.
let module itself, or php engine to make sure not to bailout in the middle. it's up to u guys to decide :)

about ps_call_handler:
hrm.. no idea if any other module/session handler have to be "no bailout" and/or "might bailout". i can only bring the problem up.

Fixed in PHP_4_4, PHP_5_1 and HEAD branches with this patch:

diff -u -r1.417 session.c
--- session.c   3 Aug 2005 14:07:44 -0000       1.417
+++ session.c   20 Sep 2005 20:54:26 -0000
@@ -1807,8 +1807,11 @@
 
 PHP_RSHUTDOWN_FUNCTION(session)
 {
-       php_session_flush(TSRMLS_C);
-       php_rshutdown_session_globals(TSRMLS_C);
+       zend_try {
+               php_session_flush(TSRMLS_C);
+               php_rshutdown_session_globals(TSRMLS_C);
+       } zend_end_try();
+
        return SUCCESS;
 }
 /* }}} */

Let me know if this doesn't fix the issue. (hard for me to confirm since I can't even reproduce it :)

yeah, all modules is rshutdown correctly. but sorry.. the session error messages is still there, let's check the source

PHP_RSHUTDOWN_FUNCTION(session)
{   
    zend_try {
        php_session_flush(TSRMLS_C); <- bailout, function is partly executed, do we care? let's step inside
        php_rshutdown_session_globals(TSRMLS_C); <- not executed
    } zend_end_try();
...
}
static void php_session_flush(TSRMLS_D)
{
    if(PS(session_status)==php_session_active) {
        php_session_save_current_state(TSRMLS_C); <- bailout, function is partly executed, but we don't care
        PS(session_status)=php_session_none; <- not executed. oops! this is important for SESSION_CHECK_ACTIVE_STATE
    }
}


i realize that, my patch to zend_API.c make sure every modules's rshutdown handler is called, but can't make sure the rshutdown itself is completed.

Does THIS fix it:

  http://www.php.net/~jani/patches/bug21306.patch

???

Patch committed.

i can confirm it's fixed, thanks