Runtime: containers still leak their payload — 200k short-lived small arrays peak at 219 MB RSS under AOT (Zend ~2 MB); the dtor path from #36215 was reverted ("revert broken delref dtor/GC CFG") and nothing replaced it (lib/JIT/Builtin/Refcount.php, lib/JIT/HashTableDtorLlvm.php) (re-#36215)

[PurHur]

Category

Foundation: · closed-but-not-done · child of #36379

Problem

#36215 closed via "Runtime: wire hashtable/object dtors into __ref__delref at rc=0"; a later commit "Fix AOT function-scoped array append segfault — revert broken delref dtor/GC CFG (#36215)" took the CFG part back out. Re-verified on master 1edb103c34 with the issue's probe (for 200k: $a = mk($i) where mk returns a 2-element array holding a 100-byte string and a nested array):

	peak RSS
AOT 1edb103c34	219,048 kB
Zend	~2 MB (steady)

200k × ~1 KB ≈ 200 MB: every container's payload is still retained. A phpc fcgi worker doing this per request grows without bound (the #36388 soak will show it). The issue's Done-when ("flat < 20 MB", valgrind clean) is not met; the revert commit does not say what was wrong with the dtor CFG or what the plan is.

PHP implementation target

• Reinstate the dtors behind the memory-model spec (Reliability: memory-safety CI — ASan/UBSan runtime build, valgrind on the smoke set, a PHPC_RUNTIME_ASSERT=1 mode that checks refcount/ownership invariants, and a written memory-model spec the assertions are derived from (lib/AOT/Linker.php, lib/JIT/Builtin/Refcount.php, docs/runtime-semantics.md) #36397): __hashtable__dtor/__object__dtor delref every element/property then free; the segfault the revert mentions (function-scoped append) must be reproduced as a differential case first and fixed, not avoided by disabling the dtor.
• The probe (and the --repeat 10 corpus) under ASan (DX: debuggable binaries — DWARF line info via LLVM DIBuilder, PHP-level stack traces with file:line on uncaught exceptions, phpc build --debug, --asan, and a phpc profile that maps perf samples back to PHP functions (lib/JIT/AotDebugSymbols.php, lib/JIT/Context.php, lib/AOT/Linker.php) #36394 --asan) before closing.

Done when

• Probe peak RSS < 20 MB; valgrind --leak-check=full on the 9 smoke cases: 0 definitely lost
• The function-scoped append case that triggered the revert is a committed differential case and passes; --aot --repeat 10 unchanged

[PurHur]

claim: implementer-worker-lane-b — starting this run

[PurHur]

claim: cursor-agent — fix landed: exact-type obj dtor guard + delref CFG + native return cleanup (#36409)