[opentelemetry-php-contrib] OpenTelemetry: pre hook threw exception

[MarcHagen]

Describe your environment

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

PHP 8.3.20 (fpm-fcgi) (built: Apr 11 2025 17:02:03)
Copyright (c) The PHP Group
Zend Engine v4.3.20, Copyright (c) Zend Technologies
    with Zend OPcache v8.3.20, Copyright (c), by Zend Technologies

open-telemetry/opentelemetry: v1.0.0
open-telemetry/opentelemetry-auto-curl: v0.0.5

Steps to reproduce
I'm not quite sure why this is a problem. It seems somehow the curl_init hook is not fired correctly sometimes resulting in the CurlHandle too not being set properly in the WeakMap.

What is the expected behavior?
No warnings, errors

What is the actual behavior?

PHP Warning:  curl_setopt(): OpenTelemetry: post hook threw exception, class=null function=curl_setopt message=Object CurlHandle#163 not contained in WeakMap in Unknown on line 0
PHP Warning:  curl_exec(): OpenTelemetry: pre hook threw exception, class=null function=curl_exec message=Object CurlHandle#163 not contained in WeakMap in Unknown on line 0

Additional context
Exceptions/warnings come from the not existing key check:
https://github.com/open-telemetry/opentelemetry-php-contrib/blob/e0c6ed6d2a001fb5a5433238b7aa80791672cf4a/src/Instrumentation/Curl/src/CurlInstrumentation.php#L71
https://github.com/open-telemetry/opentelemetry-php-contrib/blob/e0c6ed6d2a001fb5a5433238b7aa80791672cf4a/src/Instrumentation/Curl/src/CurlInstrumentation.php#L193

[brettmc]

I've pinged the main author of the curl instrumentation.

[intuibase]

@MarcHagen Could you share curl related code which is triggering this error?

[MarcHagen]

@intuibase to be fair I would like to but the amount of curl functions scattered in the codebase (yes i know not my call) I have no clue what part is failing. The exception is not clear where and it (of course) only happens on production.

Here a sample piece of code of our codebase. Maybe something to due with the HTTP/2.0 connection in curl?

private function curlGet(string $url, array $params = [], int $timeout = 19): string
{
	if (count($params) > 0) {
		$url .= '?' . http_build_query($params);
	}

	$response = $this->getFromCache($url);
	if ($response === null) {
		if (!isset($this->curlGetHandle)) {
			$this->curlGetHandle = curl_init();
			curl_setopt($this->curlGetHandle, CURLOPT_RETURNTRANSFER, true);
			curl_setopt($this->curlGetHandle, CURLOPT_FOLLOWLOCATION, true);
			if (API_USER && API_PASS) {
				curl_setopt($this->curlGetHandle, CURLOPT_USERPWD, CAPI_USER . ':' . API_PASS);
				curl_setopt($this->curlGetHandle, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
			}
		}

		curl_setopt($this->curlGetHandle, CURLOPT_URL, $url);
		curl_setopt($this->curlGetHandle, CURLOPT_TIMEOUT, $timeout);
		$response = $this->handleResponse($this->curlGetHandle);
		$this->saveToCache($url, $response);
	}

	return $response;
}

private function handleResponse(CurlHandle $ch): string
{
	$output = curl_exec($ch);
	if ($output === false) {
		$errno = curl_errno($ch);
		$errmsg = curl_error($ch);
		$msg = "[module] cURL request failed with error [$errno]: $errmsg";
		curl_close($ch);
		throw new Exception($msg, $errno);
	}

	curl_close($ch);

	return $output;
}

Currently my patch on the vendor code has worked fine:

diff --git a/src/CurlInstrumentation.php b/src/CurlInstrumentation.php
index 7e04d120..95d7517a 100644
--- a/src/CurlInstrumentation.php
+++ b/src/CurlInstrumentation.php
@@ -69,7 +69,7 @@ class CurlInstrumentation
             'curl_setopt',
             pre: null,
             post: static function ($_obj, array $params, mixed $retVal) use ($curlHandleToAttributes, &$curlSetOptInstrumentationSuppressed) {
-                if ($retVal != true || $curlSetOptInstrumentationSuppressed) {
+                if ($retVal != true || $curlSetOptInstrumentationSuppressed || !isset($curlHandleToAttributes[$params[0]])) {
                     return;
                 }

@@ -83,7 +83,7 @@ class CurlInstrumentation
             'curl_setopt_array',
             pre: null,
             post: static function ($_obj, array $params, mixed $retVal) use ($curlHandleToAttributes) {
-                if ($retVal != true) {
+                if ($retVal != true || !isset($curlHandleToAttributes[$params[0]])) {
                     foreach ($params[1] as $option => $value) {
                         if (!curl_setopt($params[0], $option, $value)) {
                             break;
@@ -140,7 +140,7 @@ class CurlInstrumentation
             null,
             'curl_exec',
             pre: static function ($obj, array $params, ?string $class, ?string $function, ?string $filename, ?int $lineno) use ($instrumentation, $curlHandleToAttributes, &$curlSetOptInstrumentationSuppressed) {
-                if (!($params[0] instanceof CurlHandle)) {
+                if (!($params[0] instanceof CurlHandle) || !isset($curlHandleToAttributes[$params[0]])) {
                     return;
                 }

@@ -191,7 +191,7 @@ class CurlInstrumentation

             },
             post: static function ($obj, array $params, mixed $retVal) use ($curlHandleToAttributes) {
-                if (!($params[0] instanceof CurlHandle)) {
+                if (!($params[0] instanceof CurlHandle) || !isset($curlHandleToAttributes[$params[0]])) {
                     return;
                 }

[intuibase]

Hey @MarcHagen

I came back from vacation and I'll take a look into issue, thanks for sharing code. I'll try to reproduce it and try to understand why curl handle is disappearing but still tracked.

[intuibase]

Hey @MarcHagen,

I tried to reproduce the issue locally and analyzed the methods you shared. I’d like to share two thoughts:

First, I agree the instrumentation should be made more bulletproof. I could add additional protection—either like you suggested, or by inserting the handle into the WeakMap if it doesn’t exist. However, doing so might result in missing some attributes.

Second, based on the code you shared, I think there might be a bug in your application.

In handleResponse, you're closing the CurlHandle with curl_close($ch); and throwing an exception - but the object property $this->curlGetHandle is not unset(). So if you call curlGet() again, the handle is not reinitialized because of the !isset($this->curlGetHandle) check.

I reproduced issue with this code:

<?php
class MyClient
{
    private CurlHandle $curlGetHandle;

    public function curlGet(string $url): string
    {
        if (!isset($this->curlGetHandle)) {
            echo "[INIT] Initializing new cURL handle\n";
            $this->curlGetHandle = curl_init();
            curl_setopt($this->curlGetHandle, CURLOPT_RETURNTRANSFER, true);
            curl_setopt($this->curlGetHandle, CURLOPT_FOLLOWLOCATION, true);
        }

        curl_setopt($this->curlGetHandle, CURLOPT_URL, $url);
        curl_setopt($this->curlGetHandle, CURLOPT_TIMEOUT, 2);

        return $this->handleResponse($this->curlGetHandle);
    }

    private function handleResponse(CurlHandle $ch): string
    {
        $output = curl_exec($ch);

        if ($output === false) {
            $errno = curl_errno($ch);
            $errmsg = curl_error($ch);
            echo "[ERROR] $errmsg\n";
            curl_close($ch); // closes the handle but does not unset property
            throw new Exception("cURL failed: $errmsg [$errno]", $errno);
        }

        return $output;
    }
}

$client = new MyClient();

try {
    $client->curlGet('http://localhost:9/fail');
} catch (Exception $e) {
    echo "Caught: " . $e->getMessage() . "\n";
}

echo "\n--- TRYING AGAIN ---\n\n";

try {
    $client->curlGet('http://example.com');
} catch (Exception $e) {
    echo "Caught again: " . $e->getMessage() . "\n";
}

and got same result (I was testing with Elastic distribution, so there a additional metadata):

[INIT] Initializing new cURL handle
[ERROR] Failed to connect to localhost port 9 after 0 ms: Couldn't connect to server
Caught: cURL failed: Failed to connect to localhost port 9 after 0 ms: Couldn't connect to server [7]

--- TRYING AGAIN ---

[EDOT] [2025-07-31 11:47:10.040342 UTC] [237253/237253] [ERROR   ] [INSTRUMENTATION] Instrumentation hook error: Error thrown with message 'Object CurlHandle#347 not contained in WeakMap' in /home/paplo/sources/elastic-otel-php/prod/php/vendor_84/open-telemetry/opentelemetry-auto-curl/src/CurlInstrumentation.php:77
[EDOT] [2025-07-31 11:47:10.040362 UTC] [237253/237253] [ERROR   ] [INSTRUMENTATION] Instrumentation hook error: Error thrown with message 'Object CurlHandle#347 not contained in WeakMap' in /home/paplo/sources/elastic-otel-php/prod/php/vendor_84/open-telemetry/opentelemetry-auto-curl/src/CurlInstrumentation.php:77
[EDOT] [2025-07-31 11:47:10.040375 UTC] [237253/237253] [ERROR   ] [INSTRUMENTATION] Instrumentation hook error: Error thrown with message 'Object CurlHandle#347 not contained in WeakMap' in /home/paplo/sources/elastic-otel-php/prod/php/vendor_84/open-telemetry/opentelemetry-auto-curl/src/CurlInstrumentation.php:148
[EDOT] [2025-07-31 11:47:10.357526 UTC] [237253/237253] [ERROR   ] [INSTRUMENTATION] Instrumentation hook error: Error thrown with message 'Object CurlHandle#347 not contained in WeakMap' in /home/paplo/sources/elastic-otel-php/prod/php/vendor_84/open-telemetry/opentelemetry-auto-curl/src/CurlInstrumentation.php:218

I think that commenting out

                    $curlHandleToAttributes->offsetUnset($params[0]);

in curl_close instrumentation should hide issue.
Could you please do that and confirm if it helped with hiding errors?

[MarcHagen]

Hey @intuibase
That would be a great bug catch, yes. I've posted just a small snippet of the relevant code.
But yes, you are correct, the isset causes issues with concurrent calls.
But only in a small hand of situations because most of the times the throw ends the code, but sometimes is caught and the code continues.

A person changed that part of the code to be HTTP2 but, aka reusing the connection, but with the close in handleResponse its not even reusing the connection... So much unintended behaviour.

For what changes are needed in the library, I still think we should add guarding against this or at least throw/send a useful error/warning message to debugging becomes easier.

EDIT:

But yes, you are correct, the isset causes issues with concurrent calls.

curl_close on PHP8.0+ does not do anything. Is should be unset($ch)

[intuibase]

Hey @MarcHagen

I've prepared a fix and it was merged into main branch of contrib respository.
Here is a PR open-telemetry/opentelemetry-php-contrib#423

Please try it with your app/system.

[MarcHagen]

Hiya, awesome PR. First thanks for the time put in.
On my end I've updated parts of the code and updated the library.
It does not seem to give any more warnings at time of writing.
Therefor i consider this issue closed as fixed.