Please try using this snapshot:

  http://snaps.php.net/php-trunk-latest.tar.gz
 
For Windows:

  http://windows.php.net/snapshots/

it should been fixed in master. try master branch please.

Unfortunately there was a change, SHA3, to ext/hash that is preventing compilation on either the master or PHP-7.0 branches. Should I file another bug about the SHA3 compilation error or wait until the 12th for the final PHP 7.0 release?

Also the link to the snapshot is dead so I continued to use the git source.

According to backtrace, it seems empty save_path is causing the segfault.

#0  ps_files_path_create (buf=0x7ffc75268dc0 "", data=0x0, key=0x7fb976803068 "DKMeRn,GkcwqPerBP6zex4FaSg3", buflen=4096)
    at /usr/local/src/php/php-src/ext/session/mod_files.c:117

However, I don't get segfault on my Fedora22.

[yohgaki@dev PHP-7.0]$ ./php-bin 
<?php
ini_set('session.hash_function',1);
ini_set('session.hash_bits_per_character',6);
ob_start();
session_start();
var_dump(session_save_path(),session_id());
session_regenerate_id();
var_dump(session_save_path(),session_id());
var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character'));
?>

string(0) ""
string(27) "vwUp0sl8ZjlJL0kE-7WjVi6WXFb"
string(0) ""
string(27) "wq1vwpb9mH6,M,aLjurTV3TWQz1"
string(1) "1"
string(1) "6"

Empty save_path should use the default tmp directory, usually "/tmp" on Linux. If you use invalid save_path like "/", you should get something like

[yohgaki@dev PHP-7.0]$ ./php-bin 
<?php
ini_set('session.save_path','/');
ini_set('session.hash_function',1);
ini_set('session.hash_bits_per_character',6);
ob_start();
session_start();
var_dump(session_save_path(),session_id());
session_regenerate_id();
var_dump(session_save_path(),session_id());
var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character'));
?>


Warning: session_start(): open(//sess_jxSkw0LA19QJ59sPJz3PR8dyyN2, O_RDWR) failed: Permission denied (13) in - on line 6
string(1) "/"
string(27) "jxSkw0LA19QJ59sPJz3PR8dyyN2"

Warning: session_regenerate_id(): open(//sess_jxSkw0LA19QJ59sPJz3PR8dyyN2, O_RDWR) failed: Permission denied (13) in - on line 8

Warning: session_regenerate_id(): Session write failed. ID: files (path: /) in - on line 8
string(1) "/"
string(27) "jxSkw0LA19QJ59sPJz3PR8dyyN2"
string(1) "1"
string(1) "6"


What is your "session.save_path" setting? Do you see any difference if you set it to "/tmp" explicitly?

session.save_path => /usr/local/php5/sessions

When running your code:

sudo -u php php
<?php
ini_set('session.save_path','/');
ini_set('session.hash_function',1);
ini_set('session.hash_bits_per_character',6);
ob_start();
session_start();
var_dump(session_save_path(),session_id());
session_regenerate_id();
var_dump(session_save_path(),session_id());
var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character'));
?>
PHP Warning:  session_start(): open(//sess_ZXiPpBRkQ80MdKYrhWszKREGL83, O_RDWR) failed: Permission denied (13) in - on line 6
PHP Warning:  session_regenerate_id(): open(//sess_ZXiPpBRkQ80MdKYrhWszKREGL83, O_RDWR) failed: Permission denied (13) in - on line 8
PHP Warning:  session_regenerate_id(): Session write failed. ID: files (path: /) in - on line 8
string(1) "/"
string(27) "ZXiPpBRkQ80MdKYrhWszKREGL83"
string(1) "/"
string(27) "ZXiPpBRkQ80MdKYrhWszKREGL83"
string(1) "1"
string(1) "6"

When changing the directory to /tmp where user php can write to the CLI segfaults and there is no output.

Here is the output of strace:

"<?php\n", 1024)                = 6
session_regenerate_id();
var_dump(session_save_path(),session_id());
var_dump(ini_get('session.hash_function'),ini_get('session.hash_bits_per_character'));
read(0, "ini_set('session.save_path','/tm"..., 1024) = 37
?>read(0, "ini_set('session.hash_function',"..., 1024) = 36
read(0, "ini_set('session.hash_bits_per_c"..., 1024) = 46
read(0, "ob_start();\n", 1024)          = 12
read(0, "session_start();\n", 1024)     = 17
read(0, "var_dump(session_save_path(),ses"..., 1024) = 44
read(0, "session_regenerate_id();\n", 1024) = 25
read(0, "var_dump(session_save_path(),ses"..., 1024) = 44
read(0, "var_dump(ini_get('session.hash_f"..., 1024) = 87
read(0,
"?>\n", 1024)                   = 3
read(0, "", 1024)                       = 0
gettimeofday({1447295001, 211980}, NULL) = 0
gettimeofday({1447295001, 212072}, NULL) = 0
gettimeofday({1447295001, 212158}, NULL) = 0
open("/dev/urandom", O_RDONLY)          = 3
read(3, "_\21A\31\325\376p\251\241+\246\235*n\336\351\305\275\22\307\374'S\206\230\352\325>\334\31\7\350", 32) = 32
close(3)                                = 0
stat("/tmp/sess_ei0-lWyGDQzU2Ad0xzgOvv5S04e", 0x7ffc18c18240) = -1 ENOENT (No such file or directory)
open("/tmp/sess_ei0-lWyGDQzU2Ad0xzgOvv5S04e", O_RDWR|O_CREAT|O_NOFOLLOW, 0600) = 3
fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
getuid()                                = 501
flock(3, LOCK_EX)                       = 0
fcntl(3, F_SETFD, FD_CLOEXEC)           = 0
fstat(3, {st_mode=S_IFREG|0600, st_size=0, ...}) = 0
pwrite(3, "", 0, 0)                     = 0
close(3)                                = 0
gettimeofday({1447295001, 219125}, NULL) = 0
open("/dev/urandom", O_RDONLY)          = 3
read(3, "2\352\22\17q\201\33\17VaS\17\203Y\350\212}d\276}\0F\323\24\236\31\303\32/\331m\320", 32) = 32
close(3)                                = 0
--- SIGSEGV {si_signo=SIGSEGV, si_code=SEGV_MAPERR, si_addr=0x18} ---
+++ killed by SIGSEGV +++
Segmentation fault


Notice that the file /tmp/sess_ei0-lWyGDQzU2Ad0xzgOvv5S04e is created.

My latest build is from commit fdb14346dce221842310f237a7fa8029bda5d5cc on master. I can't update past that commit because of hash.c not wanting to compile because of missing SHA3 references.

Latest build of master fixes the issue.