search

php / php-src

The PHP Interpreter
https://www.php.net
Other
38.07k stars 7.74k forks source link

Using `SessionHandler` doesn't always close session file #16027

Open cs278 opened 2 weeks ago

cs278 commented 2 weeks ago

Description

The following code:

<?php

session_set_save_handler(new \SessionHandler, true);

session_start([
    'save_path' => __DIR__,
]);

$_SESSION['test'] = function () {};

If you make a request to this you'll see a fatal error due to the serialization failing, if you try and make another request the file is still locked and the request hangs waiting for the lock to be released. Removing the session_set_save_handler() is sufficient to fix the problem. From what I can tell ps_close_user is called but it never appears to make the call to SessionHandler::close().

I've managed to replicate this behaviour on FPM (ZTS and NTS) and CLI server.

I've written a test: 88f32f48e2b6e7fd3554aef8d255f88d02a4e8db

PHP Version

8.3.11 and 8.3.13-dev

Operating System

Debian/Ubuntu

nielsdos commented 1 week ago

This happens because eventually call_user_function is used to call the close method, but call_user_function never makes the call if an exception is already pending because it would result in unstable execution otherwise. Ideally the lock would get released by another cleanup mechanism.