`opcache.file_cache_only = On` cause SEGV in `php_request_shutdown`

[cchangwen]

Description

opcache.file_cache_only = On cause SEGV in php_request_shutdown

The report appear and disappear when opcache.file_cache_only turn on and off.

AddressSanitizer:DEADLYSIGNAL
=================================================================
==159==ERROR: AddressSanitizer: SEGV on unknown address 0x007fbfff8041 (pc 0x56494e706f73 bp 0x7ffd15137390 sp 0x7ffd151372e0 T0)
==159==The signal is caused by a READ memory access.
    #0 0x56494e706f73  (/usr/local/bin/php+0x3da7f73) (BuildId: e5d03ae744c419767c29ba2eda688831cb4e619c)
    #1 0x56494e70b2f6 in _efree (/usr/local/bin/php+0x3dac2f6) (BuildId: e5d03ae744c419767c29ba2eda688831cb4e619c)
    #2 0x56494e4c3a20  (/usr/local/bin/php+0x3b64a20) (BuildId: e5d03ae744c419767c29ba2eda688831cb4e619c)
    #3 0x56494e4c333a in php_request_shutdown (/usr/local/bin/php+0x3b6433a) (BuildId: e5d03ae744c419767c29ba2eda688831cb4e619c)
    #4 0x56494f69b24c  (/usr/local/bin/php+0x4d3c24c) (BuildId: e5d03ae744c419767c29ba2eda688831cb4e619c)
    #5 0x56494f69638a  (/usr/local/bin/php+0x4d3738a) (BuildId: e5d03ae744c419767c29ba2eda688831cb4e619c)
    #6 0x7f892a169a2f  (/lib/ld-musl-x86_64.so.1+0x41a2f) (BuildId: 25262d1f0190fa67ac8949c47edb1488aae52fcd)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (/usr/local/bin/php+0x3da7f73) (BuildId: e5d03ae744c419767c29ba2eda688831cb4e619c) 
==159==ABORTING
Aborted

PHP Version

PHP 8.3.29 (cli) (built: Jan 13 2026 18:36:06) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.3.29, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.29, Copyright (c), by Zend Technologies

Operating System

Alpine Linux 3.23

[devnexen]

Hi @cchangwen would you have a minimal reproducer ?

[cchangwen]

#!/usr/bin/env bash

cd "$(dirname "$0")" || exit

set -e

if [ -d src ]; then
  cd src;
  git pull;
  cd -;
else
  git clone git@github.com:docker-library/php.git src
fi

cp -ra src/8.3/alpine3.23/fpm ./

sed -i '/PHP_CFLAGS/ s/-O2/-O0/' fpm/Dockerfile
sed -ri 's/(CFLAGS="\$PHP_CFLAGS)/\1 -Wall -Wextra -fsanitize=address,undefined -ggdb3 -fno-omit-frame-pointer -fsanitize-address-use-after-scope/' fpm/Dockerfile
sed -ri 's/(CPPFLAGS="\$PHP_CPPFLAGS)/\1 -Wall -Wextra -fsanitize=address,undefined -ggdb3 -fno-omit-frame-pointer -fsanitize-address-use-after-scope/' fpm/Dockerfile
sed -ri 's/(LDFLAGS="\$PHP_LDFLAGS)/\1 -fsanitize=address,undefined/' fpm/Dockerfile
sed -ri 's/(--enable-fpm)/\1 --enable-debug --enable-address-sanitizer/' fpm/Dockerfile

# keep $PHPIZE_DEPS
sed -i '/\$PHPIZE_DEPS \\/ d' fpm/Dockerfile
sed -i '/--virtual .build-deps/ i\  apk add --no-cache $PHPIZE_DEPS; \\' fpm/Dockerfile


sed -i '/rm -vf \/usr\/include\/iconv.h;/ s/\\$//' fpm/Dockerfile
sed -i '/rm -vf \/usr\/include\/iconv.h;/ a\\n\
RUN apk add --no-cache clang compiler-rt llvm; \n\
ENV CC=clang CXX=clang++ \n\
ENV ASAN_OPTIONS="suppressions=/etc/asan.supp:color=always:symbolize=1:abort_on_error=1:detect_leaks=1:detect_stack_use_after_return=1" \n\
ENV UBSAN_OPTIONS="suppressions=/etc/ubsan.supp:print_stacktrace=1:abort_on_error=1" \n\
RUN set -eux; cd /etc; touch asan.supp; echo -e "alignment:/usr/src/php/Zend/\\nfunction:/usr/src/php/Zend/" > ubsan.supp; \\' fpm/Dockerfile

# If configue fails, output the detailed log.
sed -ri 's/(--with-fpm-group=www-data)/\1 || { cat config.log; exit 111; }/' fpm/Dockerfile



podman build -t php83debug fpm
podman run --rm -it php83debug sh

test ok

rm /usr/local/etc/php/conf.d/*.ini
echo zend_extension=opcache >> /usr/local/etc/php/php.ini
echo opcache.enable_cli = On >> /usr/local/etc/php/php.ini
echo opcache.file_cache = /tmp >> /usr/local/etc/php/php.ini
echo opcache.file_cache_only = On >> /usr/local/etc/php/php.ini

php -m

echo -e '<?php\n phpinfo();' > index.php
php index.php

[cchangwen]

Dockerfile2

FROM localhost/php83debug
RUN set -eux; apk add --no-cache --virtual .build-deps $PHPIZE_DEPS; \
    \
    docker-php-source extract; cd /usr/src/php/ext/opcache; \
    \
    export \
      CFLAGS="$PHP_CFLAGS -Wall -Wextra -fsanitize=address,undefined -ggdb3 -fno-omit-frame-pointer -fsanitize-address-use-after-scope" \
      CPPFLAGS="$PHP_CPPFLAGS -Wall -Wextra -fsanitize=address,undefined -ggdb3 -fno-omit-frame-pointer -fsanitize-address-use-after-scope" \
      LDFLAGS="$PHP_LDFLAGS -fsanitize=address,undefined"; \
    \
    phpize; ./configure --enable-opcache; \
    #php ./patch-opcache-source-code.php; \
    make; make install; \
    \
    docker-php-source delete;

reproduce in the container

podman build -f Dockerfile2 -t php83debug2 fpm
podman run --rm -it php83debug2 sh

rm /usr/local/etc/php/conf.d/*.ini
echo zend_extension=opcache >> /usr/local/etc/php/php.ini
echo opcache.enable_cli = On >> /usr/local/etc/php/php.ini
echo opcache.file_cache = /tmp >> /usr/local/etc/php/php.ini
echo opcache.file_cache_only = On >> /usr/local/etc/php/php.ini

php -m

echo -e '<?php\n phpinfo();' > index.php
php index.php

The real cause of the error is building opcache.so separately,
Even if without making any modifications to the source code.

Does opcache.so must be compile together with the main PHP program?

[devnexen]

Does opcache.so must be compile together with the main PHP program?

Any release pre-8.5 allowed this. I cannot reproduce but is still ocurring if you try a php 8.4 release ? as 8.3 is EOL now.