Fibers causing segfaults on ppc64le

[Nadyita]

Description

The following code:

<?php

require_once __DIR__ . '/../vendor/autoload.php';

use Amp\Http\Client\HttpClientBuilder;
use Amp\Http\Client\Request;

$client = HttpClientBuilder::buildDefault();

$response = $client->request(new Request("https://httpbin.org/get"));

Resulted in this output:

PHP Fatal error:  Uncaught Error: Maximum call stack size of 1073692672 bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached. Infinite recursion? in /home/runner/vendor/amphp/amp/src/Internal/FutureState.php:52
Stack trace:
#0 /home/runner/vendor/amphp/dns/src/Rfc1035StubDnsResolver.php(256): Amp\Internal\FutureState->__destruct()
#1 /home/runner/vendor/amphp/dns/src/Rfc1035StubDnsResolver.php(561): Amp\Dns\Rfc1035StubDnsResolver->reloadConfig()
#2 /home/runner/vendor/amphp/dns/src/Rfc1035StubDnsResolver.php(103): Amp\Dns\Rfc1035StubDnsResolver->loadConfigIfNotLoaded()
#3 /home/runner/vendor/amphp/socket/src/DnsSocketConnector.php(165): Amp\Dns\Rfc1035StubDnsResolver->resolve()
#4 /home/runner/vendor/amphp/socket/src/DnsSocketConnector.php(42): Amp\Socket\DnsSocketConnector->resolve()
#5 /home/runner/vendor/amphp/socket/src/RetrySocketConnector.php(47): Amp\Socket\DnsSocketConnector->connect()
#6 /home/runner/vendor/amphp/http-client/src/Connection/DefaultConnectionFactory.php(100): Amp\Socket\RetrySocketConnector->connect()
#7 /home/runner/vendor/amphp/amp/src/functions.php(33): Amp\Http\Client\Connection\DefaultConnectionFactory->create()
#8 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/AbstractDriver.php(430): {closure:Amp\async():23}()
#9 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/AbstractDriver.php(567): Revolt\EventLoop\Internal\AbstractDriver->invokeMicrotasks()
#10 [internal function]: Revolt\EventLoop\Internal\AbstractDriver->{closure:Revolt\EventLoop\Internal\AbstractDriver::createCallbackFiber():565}()
#11 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/DriverSuspension.php(64): Fiber->resume()
#12 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/AbstractDriver.php(430): Revolt\EventLoop\Internal\DriverSuspension::{closure:Revolt\EventLoop\Internal\DriverSuspension::resume():61}()
#13 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/AbstractDriver.php(567): Revolt\EventLoop\Internal\AbstractDriver->invokeMicrotasks()
#14 [internal function]: Revolt\EventLoop\Internal\AbstractDriver->{closure:Revolt\EventLoop\Internal\AbstractDriver::createCallbackFiber():565}()
#15 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/AbstractDriver.php(503): Fiber->start()
#16 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/AbstractDriver.php(542): Revolt\EventLoop\Internal\AbstractDriver->invokeCallbacks()
#17 [internal function]: Revolt\EventLoop\Internal\AbstractDriver->{closure:Revolt\EventLoop\Internal\AbstractDriver::createLoopFiber():538}()
#18 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/AbstractDriver.php(96): Fiber->start()
#19 /home/runner/vendor/revolt/event-loop/src/EventLoop/Internal/DriverSuspension.php(117): Revolt\EventLoop\Internal\AbstractDriver->{closure:Revolt\EventLoop\Internal\AbstractDriver::__construct():90}()
#20 /home/runner/vendor/amphp/amp/src/Internal/FutureIterator.php(133): Revolt\EventLoop\Internal\DriverSuspension->suspend()
#21 /home/runner/vendor/amphp/amp/src/Future.php(59): Amp\Internal\FutureIterator->consume()
#22 /home/runner/vendor/amphp/amp/src/Future/functions.php(26): Amp\Future::iterate()
#23 /home/runner/vendor/amphp/http-client/src/Connection/ConnectionLimitingPool.php(250): Amp\Future\awaitFirst()
#24 /home/runner/vendor/amphp/http-client/src/Connection/ConnectionLimitingPool.php(106): Amp\Http\Client\Connection\ConnectionLimitingPool->getStreamFor()
#25 /home/runner/vendor/amphp/http-client/src/Connection/UnlimitedConnectionPool.php(42): Amp\Http\Client\Connection\ConnectionLimitingPool->getStream()
#26 /home/runner/vendor/amphp/http-client/src/PooledHttpClient.php(30): Amp\Http\Client\Connection\UnlimitedConnectionPool->getStream()
#27 /home/runner/vendor/amphp/http-client/src/functions.php(20): Amp\Http\Client\PooledHttpClient->{closure:Amp\Http\Client\PooledHttpClient::request():29}()
#28 /home/runner/vendor/amphp/http-client/src/PooledHttpClient.php(29): Amp\Http\Client\processRequest()
#29 /home/runner/vendor/amphp/http-client/src/Interceptor/RetryRequests.php(34): Amp\Http\Client\PooledHttpClient->request()
#30 /home/runner/vendor/amphp/http-client/src/InterceptedHttpClient.php(38): Amp\Http\Client\Interceptor\RetryRequests->request()
#31 /home/runner/vendor/amphp/http-client/src/functions.php(20): Amp\Http\Client\InterceptedHttpClient->{closure:Amp\Http\Client\InterceptedHttpClient::request():28}()
#32 /home/runner/vendor/amphp/http-client/src/InterceptedHttpClient.php(28): Amp\Http\Client\processRequest()
#33 /home/runner/vendor/amphp/http-client/src/Interceptor/FollowRedirects.php(131): Amp\Http\Client\InterceptedHttpClient->request()
#34 /home/runner/vendor/amphp/http-client/src/InterceptedHttpClient.php(38): Amp\Http\Client\Interceptor\FollowRedirects->request()
#35 /home/runner/vendor/amphp/http-client/src/functions.php(20): Amp\Http\Client\InterceptedHttpClient->{closure:Amp\Http\Client\InterceptedHttpClient::request():28}()
#36 /home/runner/vendor/amphp/http-client/src/InterceptedHttpClient.php(28): Amp\Http\Client\processRequest()
#37 /home/runner/vendor/amphp/http-client/src/Interceptor/ModifyRequest.php(48): Amp\Http\Client\InterceptedHttpClient->request()
#38 /home/runner/vendor/amphp/http-client/src/InterceptedHttpClient.php(38): Amp\Http\Client\Interceptor\ModifyRequest->request()
#39 /home/runner/vendor/amphp/http-client/src/functions.php(20): Amp\Http\Client\InterceptedHttpClient->{closure:Amp\Http\Client\InterceptedHttpClient::request():28}()
#40 /home/runner/vendor/amphp/http-client/src/InterceptedHttpClient.php(28): Amp\Http\Client\processRequest()
#41 /home/runner/vendor/amphp/http-client/src/HttpClient.php(33): Amp\Http\Client\InterceptedHttpClient->request()
#42 /home/runner/vendor/amphp/http-client/src/functions.php(30): Amp\Http\Client\HttpClient->{closure:Amp\Http\Client\HttpClient::request():33}()
#43 /home/runner/vendor/amphp/http-client/src/HttpClient.php(30): Amp\Http\Client\processRequest()
#44 /home/runner/src/test.php(10): Amp\Http\Client\HttpClient->request()
#45 {main}
  thrown in /home/runner/vendor/amphp/amp/src/Internal/FutureState.php on line 52
Segmentation fault

But I expected this output instead: No segfault

gdb backtrace of -dfiber.stack_size=1G src/test.php looks like this:

Program received signal SIGSEGV, Segmentation fault.
Downloading source file /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_exceptions.c
0x0000000100047998 in is_handle_exception_set () at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_exceptions.c:170
170			|| !ZEND_USER_CODE(execute_data->func->common.type)
(gdb) bt
#0  0x0000000100047998 in is_handle_exception_set () at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_exceptions.c:170
#1  zend_throw_exception_internal (exception=0x200001002000)
    at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_exceptions.c:225
#2  0x00000001003f7778 in zend_fiber_delegate_transfer_result (transfer=0x20010643f9b8, execute_data=<optimized out>,
    return_value=0x20010643faa8) at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_fibers.c:639
#3  zim_Fiber_suspend (execute_data=<optimized out>, return_value=0x20010643faa8)
    at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_fibers.c:951
#4  0x00000001003f24d4 in ZEND_DO_FCALL_SPEC_RETVAL_UNUSED_HANDLER ()
    at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_vm_execute.h:1907
#5  execute_ex (ex=<optimized out>) at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_vm_execute.h:58849
#6  0x000000010035f364 in zend_call_function (fci=fci@entry=0x200006223db8, fci_cache=<optimized out>,
    fci_cache@entry=0x200006223df8) at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_execute_API.c:1000
#7  0x00000001003f6320 in zend_fiber_execute (transfer=0x20010643ff88)
    at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_fibers.c:604
#8  0x00000001003f6aac in zend_fiber_trampoline (data=...) at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/zend_fibers.c:387
#9  0x0000000100264058 in make_fcontext () at /usr/src/debug/php-8.4.6-1.fc42.ppc64le/Zend/asm/make_ppc64_sysv_elf_gas.S:151

I tested this on Alpine Linux, and Fedora on PHP 8.2, 8.3, and 8.4, so it's nothing recent.

PHP Version

PHP 8.4.6 (cli) (built: Apr 8 2025 19:55:31) (NTS gcc ppc64le)
Copyright (c) The PHP Group
Built by Fedora Project
Zend Engine v4.4.6, Copyright (c) Zend Technologies

Operating System

Fedora 42 / Alpine Linux edge

[nielsdos]

Well, doesn't repro on x86, so I'll try emulating a ppc64le system I guess. I still have an emulator laying around.
I see upstream fiber context assembly code had some fixes: https://github.com/boostorg/context/commits/develop/src/asm/jump_ppc64_sysv_elf_gas.S
Maybe that's related. I'll check this today with emulation.

[nielsdos]

Tried for way too long, doesn't reproduce for me. Also running on Valgrind combined with emulation is too slow. And Alpine (of course) has no ASAN support for their compiler so I can't use that either.
Please try a custom build with --enable-address-sanitizer passed to the configure options, and then re-run the script with the environment variable USE_ZEND_ALLOC=0 and report the results.

[Nadyita]

I compiled 8.4.6 with and without --enable-address-sanitizer. Once enabled, PHP doesn't crash anymore. Is that expected?
I'll try patching in the changed jump_ppc64_sysv_elf_gas.S, and see if that also fixes the crash, but without needed the address sanitizer.

[nielsdos]

I compiled 8.4.6 with and without --enable-address-sanitizer. Once enabled, PHP doesn't crash anymore. Is that expected?

No. Is this with or without USE_ZEND_ALLOC=0?

I'll try patching in the changed jump_ppc64_sysv_elf_gas.S, and see if that also fixes the crash, but without needed the address sanitizer.

Sounds good, thanks!

[Nadyita]

Is this with or without USE_ZEND_ALLOC=0?

Without.

Sounds good, thanks!

Sadly, it doesn't fix the segfault. What else can I do?