Runtime: dropping an array or object to refcount 0 frees only the header — packed values, string-key nodes and property boxes are never freed or delref'd, so every container death leaks (lib/JIT/Builtin/Refcount.php)

[PurHur]

Category

Foundation: · memory model · child of #36188

Problem

Refcount.php:440-497 (drop-to-zero): four opaque calls — phpc_destruct_try_invoke, phpc_destruct_delref_allowed, phpc_weakref_clear_object_typed, phpc_gc_unregister — then free(ptr) of the header only. Nothing frees a __hashtable__'s values array, its __strkey_node__/__objkey_node__ chains, or an __object__'s property boxes, and the contained values are never delref'd, so nested strings/arrays/objects leak transitively. In {main} nothing is freed at all until shutdown by design (phpc_destruct_delref_allowed() returns 0, :458-480, #4013).

A phpc fcgi worker or any loop that builds and discards arrays grows without bound; the compliance/differential harnesses never see it because each case is one short process. The VM has a Refcount + COW model that does release (lib/VM/HashTable.php), so the semantics to mirror exist in-tree.

php-src reference

• Zend/zend_variables.c rc_dtor_func → zend_array_destroy / zend_objects_store_del: destroying a container delrefs every element, then frees buckets, then the header.

PHP implementation target

• Emit __hashtable__dtor(ht): delref each packed value, walk and free strKeys/objKeys (delref key strings and values), free values; __object__dtor(obj): delref each property box, free slots. Dispatch on typeinfo kind at Refcount.php:495 before free.
• Decide {main} policy explicitly: keep "no frees in main" only for globals that outlive the script; temporaries and locals in main must be released (or document why not and measure the cost on the examples).
• Test under valgrind --leak-check=full and ASan (PHP_COMPILER_ASAN=1 link flag) on one differential sweep; add --repeat 10 runs — ownership changes are where heap corruption hides (AOT: script-scope ++/-- goes wrong once several statements or variables are involved (loop after statements, second variable) #23842).

Repro

./script/docker-exec.sh -- bash -lc 'source script/php-env.sh && cat > build/leak.php <<'"'"'EOP'"'"'
<?php function mk($i){ return ["k$i" => str_repeat("x", 100), "n" => [$i, $i+1]]; } for ($i = 0; $i < 200000; $i++) { $a = mk($i); } echo "done\n";
EOP
php bin/compile.php -o build/leak build/leak.php && /usr/bin/time -v ./build/leak 2>&1 | grep -E "done|Maximum resident"'

Expected: flat RSS (a few MB); today RSS grows with $i.

Done when

• The probe's peak RSS is flat (< 20 MB) and identical output; valgrind reports no definitely-lost blocks on script/aot-smoke.sh cases
• script/differential-sweep.sh --aot --repeat 10 unchanged; examples-fastcgiweb-smoke soak of 10k requests shows flat RSS
• docs/runtime-semantics.md documents ownership rules for containers and {main}

[PurHur]

claim: implementer-worker-lane-c — starting this run (lane C tie-break #36215 % 3 == 2; lane overflow from closed #36142 children)

[PurHur]

claim: implementer-worker-lane-c — continued this run (branch `agent/issue-36215-refcount-dtor`)

Progress (not merge-ready):

• Landed __hashtable__dtor / __object__dtor + __ref__delref dispatch.
• Assign paths now drop call-temp boxes after COPY (copyFromPointer/copyIntoPointer, coerceToValuePtrForStore pre-store delref).
• mk() repro peak RSS: ~430MB → ~166MB @ 200k (was linear); Zend stays ~19MB flat.

Still red: IR shows copy %15 <- %16 then copy global <- %15 without valueDelref %15 after global sync; RSS still ~50MB @ 50k → ~166MB @ 200k.

Next step: emit valueDelref on the promoted local slot after script-global sync copy; verify __hashtable__dtor call sites in internal_8 loop body at rc=0.

PR: (creating)

[PurHur]

claim: implementer-worker-lane-a — continuing PR #36306 this run (lane A tie-break #36215 % 3 == 0; north-star children closed)

[PurHur]

claim: implementer-worker-lane-c — continuing PR #36306 this run (lane C overflow; north-star #36143–#36148 closed)

[PurHur]

claim: compile-trust-automation — continuing PR #36306 this run (lane overflow: #36143–#36148 closed; gates green on master)

[PurHur]

claim: implementer-worker-lane-b — continuing PR #36306 this run (lane overflow: north-star children closed; finishing refcount dtor leak)

[PurHur]

PR #36306 triage (compile-trust-automation run):

Bisect on agent/issue-36215-refcount-dtor:

• Dtors-only (__hashtable__dtor / __object__dtor in Refcount delref): aot-smoke 8/8 inline cases pass; miniwebapp intermittently segfaults (139) or prints only Content-Type with empty body — classic heap corruption (AOT: script-scope ++/-- goes wrong once several statements or variables are involved (loop after statements, second variable) #23842).
• Assign-source release (JitValueBox::releaseEphemeralAssignSource in lib/JIT.php): miniwebapp compiles but always empty body (no segfault).
• Reverting GC/registry churn bundled in the same commit (GcCollectCyclesRuntime, #36245 stale-reset removal) does not fix either failure mode.

Next step: fix HashTableDtorLlvm / ObjectDtorLlvm under script/differential-sweep.sh --aot --repeat 10 with miniwebapp in the repro set; do not merge assign-source release until miniwebapp + differential are stable. Gate with ./script/aot-smoke.sh (9/9 incl. miniwebapp).

Master @ f2d0079: all Pillar-1 probes green (aot-smoke 9/9, north-star5-verify-fast OK).

[PurHur]

Merged #36314 — clean dtor-only fix (supersedes #36306 assign-release approach which broke miniwebapp).

Verified: make dev-verify-fast OK — aot-smoke 9/9 incl. miniwebapp, VM tier-0 15/15.

Assign-source release (Zend zval_ptr_dtor on COPY temps) still needed for flat RSS on the 200k-iter repro; tracked as follow-up on this issue.