php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #80422 php_opcache.dll crashes when using Apache 2.4 with JIT
Submitted: 2020-11-26 11:10 UTC Modified: 2021-01-13 08:11 UTC
Votes:2
Avg. Score:5.0 ± 0.0
Reproduced:2 of 2 (100.0%)
Same Version:1 (50.0%)
Same OS:2 (100.0%)
From: martin at radiok2r dot de Assigned: dmitry (profile)
Status: Closed Package: JIT
PHP Version: 8.0.0 OS: Windows 10 64-bit
Private report: No CVE-ID: None
 [2020-11-26 11:10 UTC] martin at radiok2r dot de
Description:
------------
Hello,

I'm trying to run Apache with PHP 8 JIT-compiler on Windows 10 64-bit. I did:

Downloaded and installed Apache 2.4.46 Win64 from
https://www.apachelounge.com/download/

Downloaded and installed PHP VS16 x64 Thread Safe (2020-Nov-24 22:49:03) from:
https://windows.php.net/download/

I inserted:
LoadModule php_module "C:/[Path to PHP]/php8apache2_4.dll"
AddHandler application/x-httpd-php .php
into my httpd.conf

I started Apache, and browsing to local webpages works fine.


Okay, so I added to my php.ini:
opcache.jit_buffer_size=100M
which should activate the JIT-compiler.

I restarted Apache and called a local webpage and just got:

This site can’t be reached
The connection was reset.

Windows event-log shows me (I hope the translation is correct):
Name of the crashed application: httpd.exe, Version: 2.4.46.0, Timestamp: 0x5f76f6fc
Name of the crashed modul: php_opcache.dll, Version: 8.0.0.0, Timestamp: 0x5fbd7aa0
Exceptioncode: 0xc0000005
Erroroffset: 0x000000000012a298
ID of the faulty process: 0x4628
Path to the crashed appliction: C:\[Path to Apache]\bin\httpd.exe
Path to the crashed modul:: c:\[Path to PHP]\ext\php_opcache.dll

Removing:
opcache.jit_buffer_size=100M
from php.ini, and Apache works fine again.




Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2020-11-26 11:20 UTC] cmb@php.net
-Status: Open +Status: Feedback -Package: Apache2 related +Package: JIT
 [2020-11-26 11:20 UTC] cmb@php.net
Thank you for this bug report. To properly diagnose the problem, we
need a backtrace to see what is happening behind the scenes. To
find out how to generate a backtrace, please read
http://bugs.php.net/bugs-generating-backtrace.php for *NIX and
http://bugs.php.net/bugs-generating-backtrace-win32.php for Win32

Once you have generated a backtrace, please submit it to this bug
report and change the status back to "Open". Thank you for helping
us make PHP better.
 [2020-11-26 13:34 UTC] martin at radiok2r dot de
-Status: Feedback +Status: Open -PHP Version: 8.0.0RC5 +PHP Version: 8.0.0
 [2020-11-26 13:34 UTC] martin at radiok2r dot de
Thanks for your fast reply. This is the output from the DebugDiag Analysis Report after installing the symbols from the Debug Pack. Hope it helps.


In httpd.exe_201126_135319.dmp the assembly instruction at php_opcache!zend_jit_trace_exit_is_hot+68 in c:\PHP\ext\php_opcache.dll from The PHP Group has caused an access violation exception (0xC0000005) when trying to read from memory location 0x00000004 on thread 162

Faulting Thread

Entry point   libhttpd!ap_run_generate_log_id+3ab0 
Create time   26.11.2020 13:52:36 
Time spent in user mode   0 Days 0:0:0.0 
Time spent in kernel mode   0 Days 0:0:0.0 

php_opcache!zend_jit_trace_exit_is_hot+68 [C:\php-snap-build\php80\vs16\x64\php-8.0.0-ts\ext\opcache\jit\zend_jit_trace.c @ 6916 + 4]     
0000000`00000002     0000000`00000003     0000000`00000000     0000000`00000000   
C:\php-snap-build\php80\vs16\x64\php-8.0.0-ts\ext\opcache\jit\zend_jit_trace.c @ 6916 + 4 

php_opcache!zend_jit_trace_exit+d3e [C:\php-snap-build\php80\vs16\x64\php-8.0.0-ts\ext\opcache\jit\zend_jit_trace.c @ 7343 + 47]     
00001d1`00000003     00000a7`01ebd940     00001d1`2baec730     0001000`00c44b40   
C:\php-snap-build\php80\vs16\x64\php-8.0.0-ts\ext\opcache\jit\zend_jit_trace.c @ 7343 + 47 

0x00001000`0800062b     00000a7`01ebd940     00001d1`2baec730     0001000`00c44b40     0001000`00aa2520    
0x000001d1`00000003     00001d1`2baec730     0001000`00c44b40     0001000`00aa2520     00001d1`2cfc7540    
0x000000a7`01ebd940     0001000`00c44b40     0001000`00aa2520     00001d1`2cfc7540     0000000`00000308    
0x000001d1`2baec730     0001000`00aa2520     00001d1`2cfc7540     0000000`00000308     0007ffe`40701b31    
0x00001000`00c44b40     00001d1`2cfc7540     0000000`00000308     0007ffe`40701b31     00001d1`2d00b048    
0x00001000`00aa2520     0000000`00000308     0007ffe`40701b31     00001d1`2d00b048     0000000`0000003d    
0x000001d1`2cfc7540     0007ffe`40701b31     00001d1`2d00b048     0000000`0000003d     00001d1`2ce79000    
0x00000308     00001d1`2d00b048     0000000`0000003d     00001d1`2ce79000     00001d1`2baec730    

php8ts!zend_string_tolower_ex+281 [C:\php-snap-build\php80\vs16\x64\php-8.0.0-ts\Zend\zend_operators.c @ 2670]     
0000000`00000000     0000000`00000000     0000000`00000000     0000000`00000000   
C:\php-snap-build\php80\vs16\x64\php-8.0.0-ts\Zend\zend_operators.c @ 2670
 [2020-11-27 11:39 UTC] nikic@php.net
-Assigned To: +Assigned To: dmitry
 [2020-11-27 11:39 UTC] nikic@php.net
Assigning to dmitry in case he can guess at the cause here.
 [2020-12-14 13:10 UTC] dmitry@php.net
-Status: Assigned +Status: Feedback
 [2020-12-14 13:10 UTC] dmitry@php.net
Unfortunately, the backtrace is not enough to guess the reason of the crash.
We need some way to reproduce the failure.
 [2020-12-14 13:16 UTC] martin at radiok2r dot de
-Status: Feedback +Status: Assigned
 [2020-12-14 13:16 UTC] martin at radiok2r dot de
What could I do? I have a VisualStudio 2013 running on the machine, might this help? Any other parameters I could try in php.ini to make it work?
 [2020-12-14 13:34 UTC] martin at radiok2r dot de
I tried to debug the process httpd by VS -> Debug -> Attach to Process. 

There are 2 httpd-processes, and I get for the first:

php_opcache.dll!zend_jit_trace_exit_is_hot(unsigned int trace_num, unsigned int exit_num) Line 6916	C
php_opcache.dll!zend_jit_trace_exit(unsigned int exit_num,  Line 7343	C
[External Code]	
php8ts.dll!00007ffaa0225d88()	Unknown

And for the second:

ntdll.dll!KiRaiseUserExceptionDispatcher()	Unknown
KernelBase.dll!00007ffacf202cb5()	Unknown
libapr-1.dll!00000000569d88bd()	Unknown
libapr-1.dll!00000000569d8752()	Unknown
mod_socache_shmcb.so!00007ffaa1f5169c()	Unknown
mod_ssl.so!00007ffaa1f25382()	Unknown
mod_ssl.so!00007ffaa1f15b57()	Unknown
libapr-1.dll!00000000569ce24e()	Unknown
httpd.exe!00007ff7ea281c6c()	Unknown
httpd.exe!00007ff7ea282fa4()	Unknown
[External Code]	

Thanks for looking into this!
 [2020-12-14 13:39 UTC] dmitry@php.net
Check what page causes the crash.
Try to reproduce the same crash, passing the script and CGI environment variables command line PHP (or PHP-CGI).
If the application doesn't use external resources (DB, etc) and doesn't contain sensitive data, you may just pack and send it to me (with instruction, how to reproduce the crash).

Otherwise, you need to track down to the problem yourself... You may catch the crash in debugger and check the PHP source position printing (char*)executor_globals.current_execute_data->func->op_array.function_name.val and executor_globals.current_execute_data->opline->lineno. Then try to isolate the function(s) involved into crash. This is not a simple task...
 [2020-12-14 13:42 UTC] dmitry@php.net
Also try to reproduce the same problem with opcache.jit=1205. If you see the same crash, try to isolate the problem with opcache.jit=1205 (it should be easier).
 [2020-12-14 15:49 UTC] martin at radiok2r dot de
Thanks for your reply and all your hints! 

It all works with opcache.jit=1205 without problems.

Without opcache.jit=1205 (no setting for opcache.jit at all in the php.ini) this php-code crashes:

<?php
	print "Hello world\r\n";
	print $_SERVER["DOCUMENT_ROOT"]."\r\n";

	for ($i = 0; $i < 100; $i++)
	{	$b = file_exists($_SERVER["DOCUMENT_ROOT"]."/index.php");		
	}

	print "It worked";


When reducing the loop to run 50 times it works, but 100 times is too much and it crashes.

Hope this helps.
 [2021-01-13 02:30 UTC] louisowen at me dot com
same situation,hope this bug can be solved quickly.
 [2021-01-13 06:12 UTC] dmitry@php.net
I wasn't able to reproduce the crash on test case from @martin.
Is it crashes on very first request (after web server start)?

I need a well reproducible test case to analyse and fix this.
Better, if it possible to reproduce the crash with CLI PHP (without Apache).
However, the problem may be especially related to Apache SAPI (ZTS or Windows ASLR).
 [2021-01-13 08:11 UTC] martin at radiok2r dot de
I changed the code for testing a bit to make it independent from the webserver:
<?php
	print "Hello world\r\n";
	
	for ($i = 0; $i < 100; $i++)
	{	$b = file_exists("index.php");		
		print $i;
		var_dump($b);
	}

	print "It worked";

This code still crashes in Apache, but works fine with CLI.

I'm not sure what else I could do to make it reproducible for you, I already gave you the versions from Apache I'm using. What else could influence that it works for you and not for me and louisowen?
 [2021-01-14 05:16 UTC] dmitry@php.net
Automatic comment on behalf of dmitry@zend.com
Revision: http://git.php.net/?p=php-src.git;a=commit;h=3edf5c969a9f5f3290852ab9edf61a876fca63d0
Log: Fixed bug #80422 (php_opcache.dll crashes when using Apache 2.4 with JIT)
 [2021-01-14 05:16 UTC] dmitry@php.net
-Status: Assigned +Status: Closed
 
PHP Copyright © 2001-2021 The PHP Group
All rights reserved.
Last updated: Thu Feb 25 03:01:24 2021 UTC