A script that handled a php://input stream exited rather unexpectedly when it called session_start(). I had ‘track_errors’ enabled, so there was a message in $php_errormsg saying that headers had already been sent. But there was no file name or line number.
Fortunately the error log contained useful information: “PHP Deprecated: Automatically populating $HTTP_RAW_POST_DATA is deprecated and will be removed in a future version. To avoid this warning set ‘always_populate_raw_post_data’ to ‘-1’ in php.ini and use the php://input stream instead. in Unknown on line 0”.
The message must have been echoed, leading to the ‘headers already sent’ message when session_start tried to set a cookie.
Setting always_populate_raw_post_data to -1 in php.ini indeed made the error go away.
Hope this helps someone.