Skip to content

test(tracing): ASAN failures in eval'd code#3624

Draft
morrisonlevi wants to merge 11 commits intomasterfrom
levi/repro-asan-parseerror
Draft

test(tracing): ASAN failures in eval'd code#3624
morrisonlevi wants to merge 11 commits intomasterfrom
levi/repro-asan-parseerror

Conversation

@morrisonlevi
Copy link
Collaborator

@morrisonlevi morrisonlevi commented Feb 4, 2026

PROF-13687

Description

Look at the ASAN failures for commit 2242f59. Example.

The rest of the commits were to try and reduce a previous failure down to valid PHP code. They failed for me locally but for some reason, they didn't in CI. For instance, commit f499613 failed locally for both amd64 and arm64 on PHP 8.3 ZTS ASAN. Here's the output for amd64:

AddressSanitizer:DEADLYSIGNAL
=================================================================
==29864==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000009 (pc 0x7ffff56f7196 bp 0x7ffffffc3550 sp 0x7ffffffc2a00 T0)
==29864==The signal is caused by a READ memory access.
==29864==Hint: address points to the zero page.
    #0 0x7ffff56f7196 in ddtrace_fetch_debug_backtrace /tmp/src/tmp/build_extension/ext/collect_backtrace.c:514:17
    #1 0x7ffff5744f61 in ddtrace_exception_new /tmp/src/tmp/build_extension/ext/handlers_exception.c:440:5
    #2 0x7ffff57428bb in ddtrace_default_exception_new /tmp/src/tmp/build_extension/ext/handlers_exception.c:479:12
    #3 0x555557fa978b in _object_and_properties_init /usr/local/src/php/Zend/zend_API.c:1793:3
    #4 0x555557fa9870 in object_init_ex /usr/local/src/php/Zend/zend_API.c:1807:9
    #5 0x555558157f0a in ZEND_NEW_SPEC_CONST_UNUSED_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:10569:6
    #6 0x555558055433 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:57068:7
    #7 0x555557f36a94 in zend_call_function /usr/local/src/php/Zend/zend_execute_API.c:959:3
    #8 0x7ffff56498da in zend_call_function_wrapper /tmp/src/tmp/build_extension/zend_abstract_interface/sandbox/call.c:29:12
    #9 0x7ffff564a95b in zai_sandbox_try_call /tmp/src/tmp/build_extension/zend_abstract_interface/sandbox/call.c:104:15
    #10 0x7ffff564a5d1 in zai_sandbox_call /tmp/src/tmp/build_extension/zend_abstract_interface/sandbox/call.c:118:35
    #11 0x7ffff5826689 in dd_uhook_call_hook /tmp/src/tmp/build_extension/ext/hook/uhook.c:246:20
    #12 0x7ffff581b046 in dd_uhook_end /tmp/src/tmp/build_extension/ext/hook/uhook.c:483:21
    #13 0x7ffff563956b in zai_hook_finish /tmp/src/tmp/build_extension/zend_abstract_interface/hook/hook.c:1116:13
    #14 0x7ffff561544f in zai_hook_safe_finish /tmp/src/tmp/build_extension/zend_abstract_interface/interceptor/php8/interceptor.c:56:9
    #15 0x7ffff561279f in zai_interceptor_observer_end_handler /tmp/src/tmp/build_extension/zend_abstract_interface/interceptor/php8/interceptor.c:176:9
    #16 0x5555583ce9ea in call_end_observers /usr/local/src/php/Zend/zend_observer.c:274:3
    #17 0x5555583ce698 in zend_observer_fcall_end /usr/local/src/php/Zend/zend_observer.c:283:2
    #18 0x555558149758 in ZEND_DO_FCALL_SPEC_OBSERVER_HANDLER /usr/local/src/php/Zend/zend_vm_execute.h:2103:3
    #19 0x555558055433 in execute_ex /usr/local/src/php/Zend/zend_vm_execute.h:57068:7
    #20 0x55555805623d in zend_execute /usr/local/src/php/Zend/zend_vm_execute.h:61665:2
    #21 0x555557f940a5 in zend_execute_scripts /usr/local/src/php/Zend/zend.c:1895:4
    #22 0x555557cfdc72 in php_execute_script /usr/local/src/php/main/main.c:2531:13
    #23 0x555558582d2d in do_cli /usr/local/src/php/sapi/cli/php_cli.c:966:5
    #24 0x555558580172 in main /usr/local/src/php/sapi/cli/php_cli.c:1341:18
    #25 0x7ffffb742249 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16
    #26 0x7ffffb742304 in __libc_start_main csu/../csu/libc-start.c:360:3
    #27 0x5555567451f0 in _start (/opt/php/debug-zts-asan/bin/php+0x11f11f0) (BuildId: 9e741f29aa37d93b)

AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV /tmp/src/tmp/build_extension/ext/collect_backtrace.c:514:17 in ddtrace_fetch_debug_backtrace
==29864==ABORTING
Aborted

Termsig=6

Reviewer checklist

  • Test coverage seems ok.
  • Appropriate labels assigned.

Adds a PHPT that forces an eval() parse error inside an end-hook on an internal fake closure. Under ASAN this triggers a crash in ddtrace backtrace collection.
Updates the internal fake closure ASAN reproducer to use two hooks and re-enter after removing one hook, while forcing eval() into the error path.
Reduces iterations and re-entry calls to the smallest values while preserving the ASAN crash.
Removes the extra hook installation/removal while preserving the ASAN crash.
Drops the secondary closure and re-entry call while preserving the ASAN crash in ddtrace backtrace collection.
Simplifies the reproducer to a single internal fake closure with one hook, while forcing eval() into the error path and still crashing under ASAN.
The crash occurs during eval() error handling, so hook removal is unnecessary; keep the hook installed.
Passes no begin hook and removes unused hook-id plumbing, while still reproducing the ASAN SEGV in ddtrace backtrace collection.
Removes the unnecessary callable indirection; the reduced test still deterministically triggers the ASAN SEGV in ddtrace backtrace collection.
Removes the non-essential DD_INSTRUMENTATION_TELEMETRY_ENABLED environment section; the test still deterministically crashes under ASAN.
Replace the eval parse-error payload with valid PHP that throws an exception, and catch the exception at the call site. The ASAN SEGV in ddtrace backtrace collection still reproduces deterministically.
@morrisonlevi morrisonlevi changed the title Levi/repro asan parseerror test(tracing): ASAN failures in eval'd code Feb 4, 2026
@datadog-official
Copy link

datadog-official bot commented Feb 4, 2026

⚠️ Tests

Fix all issues with Cursor

⚠️ Warnings

🧪 1024 Tests failed

    testSearchPhpBinaries from integration.DDTrace\Tests\Integration\PHPInstallerTest (Fix with Cursor)

    testSimplePushAndProcess from laravel-58-test.DDTrace\Tests\Integrations\Laravel\V5_8\QueueTest (Fix with Cursor)

testSimplePushAndProcess from laravel-8x-test.DDTrace\Tests\Integrations\Laravel\V8_x\QueueTest (Datadog) (Fix with Cursor)
DDTrace\Tests\Integrations\Laravel\V8_x\QueueTest::testSimplePushAndProcess
Test code or tested code printed unexpected output: spanLinksTraceId: 6983c32200000000c4456e0eb1ef0321
tid: 6983c32200000000
hexProcessTraceId: c4456e0eb1ef0321
hexProcessSpanId: 8f6f3f1b1bea2127
processTraceId: 14142831214220739361
processSpanId: 10335549055503573287
View all

ℹ️ Info

❄️ No new flaky tests detected

This comment will be updated automatically if new data arrives.
🔗 Commit SHA: f499613 | Docs | Datadog PR Page | Was this helpful? Give us feedback!

@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.12%. Comparing base (32aaf0a) to head (f499613).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #3624      +/-   ##
==========================================
- Coverage   62.21%   62.12%   -0.09%     
==========================================
  Files         141      141              
  Lines       13387    13387              
  Branches     1753     1753              
==========================================
- Hits         8329     8317      -12     
- Misses       4260     4270      +10     
- Partials      798      800       +2     

see 2 files with indirect coverage changes


Continue to review full report in Codecov by Sentry.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 32aaf0a...f499613. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants