CLI build in server crashes with repeated headers and -DZEND_RC_DEBUG=1

See analysis on #23698, this is causing some nightly tests to fail

With index.php

<?php

echo "Testing\n";

I got

root@3b54b073fb19:/var/www/html/repeated-headers# /usr/src/php86/sapi/cli/php -d error_include_args=0 -t /var/www/html/repeated-headers/ -n -S localhost:0
[Sun Nov  1 17:32:00 2026] PHP 8.6.0-dev Development Server (http://localhost:33929) started
[Sun Nov  1 17:32:08 2026] [::1]:53820 Accepted
[Sun Nov  1 17:32:08 2026] [::1]:53820 [200]: GET /
[Sun Nov  1 17:32:08 2026] [::1]:53820 Closing
php: /usr/src/php86/Zend/zend_types.h:849: uint32_t zend_gc_delref(zend_refcounted_h *): Assertion `(zval_gc_flags((p)->u.type_info) & ((1<<7)|(1<<8))) != (1<<7)' failed.
Aborted (core dumped)

when another shell ran

root@3b54b073fb19:/var/www/html# curl -H "Cookie: Foo" -H "cOOKIE: Bar" http://localhost:33929
Testing

Tested against PHP 8.6.0-dev @ 8661547

GDB backtrace:

__pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
44            return INTERNAL_SYSCALL_ERROR_P (ret) ? INTERNAL_SYSCALL_ERRNO (ret) : 0;
(gdb) bt
#0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at ./nptl/pthread_kill.c:44
#1  0x00007ffff7493f4f in __pthread_kill_internal (signo=6, threadid=<optimized out>) at ./nptl/pthread_kill.c:78
#2  0x00007ffff7444fb2 in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
#3  0x00007ffff742f472 in __GI_abort () at ./stdlib/abort.c:79
#4  0x00007ffff742f395 in __assert_fail_base (fmt=0x7ffff75a4a90 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x5555564023f9 "(zval_gc_flags((p)->u.type_info) & ((1<<7)|(1<<8))) != (1<<7)", 
    file=file@entry=0x55555640237f "/usr/src/php86/Zend/zend_types.h", line=line@entry=849, 
    function=function@entry=0x5555564023a0 "uint32_t zend_gc_delref(zend_refcounted_h *)") at ./assert/assert.c:94
#5  0x00007ffff743dec2 in __GI___assert_fail (assertion=0x5555564023f9 "(zval_gc_flags((p)->u.type_info) & ((1<<7)|(1<<8))) != (1<<7)", 
    file=0x55555640237f "/usr/src/php86/Zend/zend_types.h", line=849, 
    function=0x5555564023a0 "uint32_t zend_gc_delref(zend_refcounted_h *)") at ./assert/assert.c:103
#6  0x000055555614cfa7 in zend_gc_delref (p=0x555557812670) at Zend/zend_types.h:849
#7  0x000055555614cdae in zend_string_release_ex (s=0x555557812670, persistent=true) at Zend/zend_string.h:492
#8  0x000055555614f7dd in cli_header_value_dtor (zv=0x5555577f05f0) at sapi/cli/php_cli_server.c:284
#9  0x00005555560a290d in zend_hash_destroy (ht=0x55555776d330) at Zend/zend_hash.c:2008
#10 0x000055555614e7ba in php_cli_server_request_dtor (req=0x55555776d2e0) at sapi/cli/php_cli_server.c:1421
#11 0x000055555614e639 in php_cli_server_client_dtor (client=0x55555776d270) at sapi/cli/php_cli_server.c:2028
#12 0x000055555614e319 in php_cli_server_client_dtor_wrapper (zv=0x7fffffffd328) at sapi/cli/php_cli_server.c:2479
#13 0x00005555560a1671 in _zend_hash_packed_del_val (ht=0x5555574f36f8 <server+592>, idx=5, zv=0x5555578121e8) at Zend/zend_hash.c:1695
#14 0x00005555560a258b in zend_hash_index_del (ht=0x5555574f36f8 <server+592>, h=5) at Zend/zend_hash.c:1940
#15 0x000055555614fc67 in php_cli_server_close_connection (server=0x5555574f34a8 <server>, client=0x55555776d270)
    at sapi/cli/php_cli_server.c:2054
#16 0x00005555561528c6 in php_cli_server_request_shutdown (server=0x5555574f34a8 <server>, client=0x55555776d270)
    at sapi/cli/php_cli_server.c:2299
#17 0x0000555556150454 in php_cli_server_dispatch (server=0x5555574f34a8 <server>, client=0x55555776d270)
    at sapi/cli/php_cli_server.c:2384
#18 0x000055555614ec80 in php_cli_server_recv_event_read_request (server=0x5555574f34a8 <server>, client=0x55555776d270)
    at sapi/cli/php_cli_server.c:2718
#19 0x000055555614f1be in php_cli_server_do_event_for_each_fd_callback (_params=0x7fffffffd540, fd=5, event=1)
    at sapi/cli/php_cli_server.c:2805
#20 0x000055555614eecb in php_cli_server_poller_iter_on_active (poller=0x5555574f34b0 <server+8>, opaque=0x7fffffffd540, 
    callback=0x55555614ef90 <php_cli_server_do_event_for_each_fd_callback>) at sapi/cli/php_cli_server.c:918
#21 0x000055555614ead4 in php_cli_server_do_event_for_each_fd (server=0x5555574f34a8 <server>, 
    rhandler=0x55555614eb00 <php_cli_server_recv_event_read_request>, whandler=0x55555614ece0 <php_cli_server_send_event>)
    at sapi/cli/php_cli_server.c:2825
#22 0x000055555614bf0f in php_cli_server_do_event_loop (server=0x5555574f34a8 <server>) at sapi/cli/php_cli_server.c:2837
#23 0x000055555614b9aa in do_cli_server (argc=8, argv=0x555557526de0) at sapi/cli/php_cli_server.c:2969
#24 0x0000555556143c5d in do_php_cli (argc=8, argv=0x555557526de0) at sapi/cli/php_cli.c:1358
#25 0x0000555556143752 in main (argc=8, argv=0x7fffffffe938) at sapi/cli/php_cli_main.c:18

The actual assertion failure comes from

php-src/Zend/zend_types.h

Lines 800 to 808 in fbe85c1

    
           # define ZEND_RC_MOD_CHECK(p) do { \ 
        
           		if (zend_rc_debug) { \ 
        
           			uint8_t type = zval_gc_type((p)->u.type_info); \ 
        
           			if (type != IS_OBJECT && type != IS_NULL) { \ 
        
           				ZEND_ASSERT(!(zval_gc_flags((p)->u.type_info) & GC_IMMUTABLE)); \ 
        
           				ZEND_ASSERT((zval_gc_flags((p)->u.type_info) & (GC_PERSISTENT|GC_PERSISTENT_LOCAL)) != GC_PERSISTENT); \ 
        
           			} \ 
        
           		} \ 
        
           	} while (0)

Navigation Menu

Repository navigation

CLI build in server crashes with repeated headers and `-DZEND_RC_DEBUG=1` #25131

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

	# define ZEND_RC_MOD_CHECK(p) do { \
	if (zend_rc_debug) { \
	uint8_t type = zval_gc_type((p)->u.type_info); \
	if (type != IS_OBJECT && type != IS_NULL) { \
	ZEND_ASSERT(!(zval_gc_flags((p)->u.type_info) & GC_IMMUTABLE)); \
	ZEND_ASSERT((zval_gc_flags((p)->u.type_info) & (GC_PERSISTENT\|GC_PERSISTENT_LOCAL)) != GC_PERSISTENT); \
	} \
	} \
	} while (0)

CLI build in server crashes with repeated headers and -DZEND_RC_DEBUG=1 #25131

Description

Activity

DanielEScherzer commented on Nov 1, 2026

DanielEScherzer commented on Nov 1, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

CLI build in server crashes with repeated headers and `-DZEND_RC_DEBUG=1` #25131