According to `git bisect` the offending commit is
<https://github.com/php/php-src/commit/c200e8e1>.

Yasuo, can you please have a look at this issue.

@cmd Thank you for investigation.
I'll look into this, but it seems I need more info. It works for me... 
Perhaps, SAPI involved? 

[yohgaki@dev PHP-7.1]$ ./php-bin 
<?php
session_start();
$_SESSION['blah'] = 'foo';
var_dump($_SESSION);
session_write_close();

session_start();
var_dump($_SESSION);
?>


array(1) {
  ["blah"]=>
  string(3) "foo"
}

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at -:4) in - on line 7

Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at -:4) in - on line 7
array(1) {
  ["blah"]=>
  string(3) "foo"
}

Indeed, it appears to break only if there is already some output
before the first session_start(). Try:

    <?php
    echo "start\n";
    session_start();
    $_SESSION['blah'] = 'foo';
    var_dump($_SESSION);
    session_write_close();
    
    session_start();
    var_dump($_SESSION);

Not initializing $_SESSION by 2nd session_start() is not a bug actually, but it should fail to initialize $_SESSION always when session_start() cannot be started. This is the objective for the bug fix commit mentioned.

So real bug here is session module initializes $_SESSION even if it failed to start when there is no output before 1st session_start().

This report's bug won't be fixed. I re-opened bug #71038.

@yasuo: As noted on the linked PR, it would be good to add an UPGRADING note about this.

@nikic 
Done. Thanks.

In my case session_set_cookie_params() causes problem, if i set domain, secure or httponly session is not set and cookie not sent, but if i leave only lifetime and path works ok. Any ideas how to fix it?