Repository navigation
opcache_reset memory coprruption in ZTS under high concurrency (FrankenPHP) #18517
Description
Description
opcache_reset will sometimes lead to memory corruptions in ZTS under high concurrency.
The bug was first raised in this issue in the FrankenPHP repo. The reproducer from that issue will cause a opcache_reset after a few thousand requests under load. I'm not sure why an opcache reset is forced, it could be caused by inline classes filling up the opcache.interned_strings_buffer.
The main issue seems to be though that if multiple threads are executing scripts simultaneously, it will sometimes lead to weird opcache issues and result in a zend_mm_heap corrupted when an opcache_reset is scheduled.
I also created a smaller reproducer that will force the issue with a dev version of PHP installed here:
https://github.com/AlliBalliBaba/zts-opcache-reset-reproducer
For reference: FrankenPHP uses the bookworm ZTS docker image and runs PHP with 1 process and multiple threads
PHP Version
PHP 8.4.5 (cli) (built: Mar 17 2025 23:15:56) (ZTS)
Copyright (c) The PHP Group
Built by https://github.com/docker-library/php
Zend Engine v4.4.5, Copyright (c) Zend Technologies
with Zend OPcache v8.4.5, Copyright (c), by Zend Technologies
Operating System
debian-bookworm (Docker)
Activity
ndossche commentedon May 7, 2025
Duplicate of #14471 (and likely also #8739)
AlliBalliBaba commentedon May 8, 2025
@nielsdos is it possible to disable the
interned_strings_buffer? I'm still looking into why it's filling up to the point of forcing a reset, but it only seems to happen in that specific reproducer and only under concurrency.AlliBalliBaba commentedon May 8, 2025
Nvm I realized it can be disabled by just setting
opcache.interned_strings_buffer=0Fix opcache_reset()/opcache_invalidate() races using epoch-based recl…
Fix phpGH-8739: opcache_reset()/invalidate() races via epoch-based re…
Fix phpGH-8739: opcache_reset()/invalidate() races via epoch-based re…