Problems involving opcache and pcre.jit after upgrading to php-7.3.10 and NC17

Hi,

I’ve been running Nextcloud on a CentOS 7 system (a native booting system, not a VM; using the lighttpd web server) for a short while (since nc13) and it has always behaved pretty well. As of last week, the system was sitting on nc15 with php-7.2 and I decided, for funs, to update to nc17, and php-7.3. Both upgrades went fine, individually, but after the upgrades I started seeing two misbehaviors, both involving the gallery. A reasonable (I think) amount of web searching didn’t really reveal anything helpful, so I assume the two misbehaviors are both caused by something I did wrong.

  • Misbehavior 1: when trying to view individual photos in the gallery, I started seeing “preg_match(): JIT compilation failed: no more memory at [pathname]/3rdparty/symfony/routing/Matcher/UrlMatcher.php” … the amount of available memory didn’t change, nor did the web server (lighttpd) or php configurations. Restarting lighttpd would get rid of the error temporarily, but after a handful of file accesses it would come back. To work around it, I set “pcre.jit=0” in my php.ini file. I don’t see any changes in behavior or performance in NC, and do not have a pressing need to re-enable it, but would like to understand what happened since disabling the JIT compiler doesn’t really fix anything, it just makes the problem go away. I have confirmed that PCRE JIT support is enabled. I see one other post with the same sort of error: Occ upgrade - "JIT compilation failed - No more memory" but no help from it.

  • Problem 2: After disabling the PCRE JIT, when trying to download files from the gallery, I started getting “CSRF security check failure” messages. This was specifically with trying to download the file; browsing images and viewing them individually still worked. After a bit of poking and web searching I disabled opcache (“opcache.enable=0” in php.ini) and the error went away, though now the NC configuration check points out that enabling opcache is a good idea.

There are a couple of unfortunate details. First - I upgraded php, verified that the web server ran at all, and then upgraded Nextcloud without really doing much checking in between, so it’s hard to tell if the php update is what triggered this, or the NC update. Second - I tackled the JIT issue first, which involved a lot of staring at the nextcloud.log file. After turning off pcre.jit and restarting lighttpd, the out of memory issue went away … but the nextcloud.log file stopped getting written to. It doesn’t look like it moved to another location, there were no other errors indicating write access problems, the system and NC seemed to be running fine otherwise, and the web interface to that log file also stopped being appended to. So I trundled on and got to the opcache workaround without using the log. This was 2 days ago. I still don’t know why it stopped, but right now I’m looking at the log file and it started being written to again earlier today; I also don’t know why it re-started but there is no log help for the CSRF error.

Any thoughts? Any other information that would be helpful?

Thanks!

Incidentally, NC started writing to its log file again and if I re-enable pcre.jit, I see this buried in the spew:

"url":"\/ocs\/v2.php\/apps\/notifications\/api\/v2\/notifications","message":"preg_match(): Allocation of JIT memory failed, PCRE JIT will be disabled. This is likely caused by security restrictions. Either grant PHP permission to allocate executable memory, or set pcre.jit=0 at [path]\/lib\/private\/DB\/ConnectionFactory.php#243"

… which is actually helpful. A bit more searching brought me to https://bugs.php.net/bug.php?id=77260 which looks relevant, and ultimately to https://bugs.php.net/bug.php?id=78630 and basically it ends there with everyone deciding that the problem is with pcre. :man_shrugging: Anyway with opcache enabled the thing is still completely useless (with the CSRF security check failure) so that hasn’t changed.