Fix memory leak after GC inside a foreach loop (#12572)

Fixes oss-fuzz #54515

Fix GH-9266: GC root buffer keeps growing when dtors are present

Do not reset cleared count on GC rerun.

Closes GH-9265.

Avoid possible [-Wstrict-prototypes] build warnings

Refactor GC data traversal loops

Previusly, to redce stack usage GC traversed object properties and array
elements in both directions. At first, it seeked backward from the last
elem

Refactor GC data traversal loops

Previusly, to redce stack usage GC traversed object properties and array
elements in both directions. At first, it seeked backward from the last
element, to find the last refcounted zval. Then, it traversed elements
forward. As result, we had 2 non-spatial memory accesses for each
object/array and usuall 2 expensive CPU cache misses.

Now all the traversal algorithms are refactored to scan elements only in
forward direction. The number of checks and GC stack usage should be the
same. The order of element processing may be differenr, but this
should not be a problem.

show more ...

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[

Use more compact representation for packed arrays.

- for packed arrays we store just an array of zvals without keys.
- the elements of packed array are accessible throuf as ht->arPacked[i]
instead of ht->arData[i]
- in addition to general ZEND_HASH_FOREACH_* macros, we introduced similar
familied for packed (ZEND_HASH_PACKED_FORECH_*) and real hashes
(ZEND_HASH_MAP_FOREACH_*)
- introduced an additional family of macros to access elements of array
(packed or real hashes) ZEND_ARRAY_ELEMET_SIZE, ZEND_ARRAY_ELEMET_EX,
ZEND_ARRAY_ELEMET, ZEND_ARRAY_NEXT_ELEMENT, ZEND_ARRAY_PREV_ELEMENT
- zend_hash_minmax() prototype was changed to compare only values

Because of smaller data set, this patch may show performance improvement
on some apps and benchmarks that use packed arrays. (~1% on PHP-Parser)

TODO:
- sapi/phpdbg needs special support for packed arrays (WATCH_ON_BUCKET).
- zend_hash_sort_ex() may require converting packed arrays to hash.

show more ...

Fix some typos (#7320)

Clean up gc_scan() implementation

The HT handling no longer needs to be shared, so move it into the
right branch. Also use a couple of early gotos to reduce nesting.

Fix GC of object properties HT

We partially fixed this in bug #78379, but still don't handle
the case where the properties array is marked as grey first,
which causes a delref to not

Fix GC of object properties HT

We partially fixed this in bug #78379, but still don't handle
the case where the properties array is marked as grey first,
which causes a delref to not be performed later.

Fix this by treating the object properties HT the same way as
other refcounted values, including addrefs/delrefs. The object
dtor code already handles properties HT with NULL GC type, so
out of order destruction should not be a problem.

Fixes oss-fuzz #36023.

show more ...

Fix bug #80072: Root live tmpvars after GC

TMPVAR operands are destroyed using zval_ptr_dtor_nogc(), because
they usually cannot contain cycles. However, there are some rare
exceptio

Fix bug #80072: Root live tmpvars after GC

TMPVAR operands are destroyed using zval_ptr_dtor_nogc(), because
they usually cannot contain cycles. However, there are some rare
exceptions where this is possible, e.g. unserialize() return value.
In such cases we rely on the producing code to root the value. If
a GC run occurs between the rooting and consumption of the value,
we would end up leaking it. To avoid this, root all live TMPVAR
values after a GC run.

Closes GH-7210.

show more ...

Convert some recently introduced zend_bool to bool

As well as `scripts/dev/check_parameters.php` utility.

Cfr. 3e01f5afb1b52fe26a956190296de0192eedeec1

Add API to prevent Fiber switch in select contexts

Co-authored-by: Martin Schröder <m.schroeder2007@gmail.com>

Rerun GC if destructors encountered

Since PHP 7.4 objects that have a destructor require two GC runs
to be collected. Currently the collection is delayed to the next
automatic GC run

Rerun GC if destructors encountered

Since PHP 7.4 objects that have a destructor require two GC runs
to be collected. Currently the collection is delayed to the next
automatic GC run. However, in some cases this may result in a large
increase in memory usage, as in one of the cases of bug #79519.

See also bug #78933 and bug #81117 where the current behavior is
unexpected for users.

This patch will automatically rerun GC if destructors were encountered.
I think this should not have much cost, because it is very likely that
objects on which the destructor has been called really are garbage,
so the extra GC run should not be doing wasted work.

Closes GH-5581.

show more ...

Don't perform recursive get_gc call

On further consideration, we should be making use of the fact
that zend_object_iterator is also a zend_object here, and let
GC handle the get_gc c

Don't perform recursive get_gc call

On further consideration, we should be making use of the fact
that zend_object_iterator is also a zend_object here, and let
GC handle the get_gc call on it. Calling get_gc recursively like
this is generally not safe, because there is only one gc_buffer.

This also happens to be much simpler...

show more ...

Expose inner dual_it iterator to GC

Moving the zend_iterator_dtor from dual_it_dtor to dual_it_free_storage
exposed this GC leak in an existing test. Forward the result of the
iterat

Expose inner dual_it iterator to GC

Moving the zend_iterator_dtor from dual_it_dtor to dual_it_free_storage
exposed this GC leak in an existing test. Forward the result of the
iterator get_gc to the dual_it get_gc.

show more ...

Mark various functions with void arguments.

This fixes a bunch of [-Wstrict-prototypes] warning,
because in C func() and func(void) have different semantics.

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool

Replace zend_bool uses with bool

We're starting to see a mix between uses of zend_bool and bool.
Replace all usages with the standard bool type everywhere.

Of course, zend_bool is retained as an alias.

show more ...

PHP array cannot refer to EG(symbol_table) any more. Replace corresponding checks by ZEND_ASSERT().

Make GC default threshold handling consistent

While the initial threshold is set to 10001 roots, the threshold
adjustment logic may then set it to 10000. The exact value really
doesn

Make GC default threshold handling consistent

While the initial threshold is set to 10001 roots, the threshold
adjustment logic may then set it to 10000. The exact value really
doesn't matter, but we should make it consistent.

show more ...

Change GC_COLLECTABLE flag into GC_NOT_COLLECTABLE to simplify GC_MAY_LEAK() check

Use GC stack in nested data removal

We should be doing this anyway to prevent stack overflow, but on
master this is important for an additional reason: The temporary
GC buffer provid

Use GC stack in nested data removal

We should be doing this anyway to prevent stack overflow, but on
master this is important for an additional reason: The temporary
GC buffer provided for get_gc handlers may get reused if the scan
is performed recursively instead of indirected via the GC stack.

This fixes oss-fuzz #23350.

show more ...

Move label to correct position

Fix null pointer UB in GC

This is just plain stupid: In C, it is not permitted to add zero
to a null pointer. In C++, it is permitted.

Fix warning of strict-prototypes

Closes GH-5673.

Add helper APIs for get_gc implementations

get_gc() implementations that need to explore heterogeneous data
currently work by computing how many GC entries they need,
allocating a bu

Add helper APIs for get_gc implementations

get_gc() implementations that need to explore heterogeneous data
currently work by computing how many GC entries they need,
allocating a buffer for that and storing it on the object. This
is inefficient and wastes memory, because the buffer is retained
after the GC run.

This commit adds an API for a single global GC buffer, which can
be reused by get_gc implementations (as only one get_gc call is
ever active at the same time). The GC buffer will automatically
grow during the GC run and be discarded at the end.

show more ...

Handle reallocated root buffer during GC destroy phase (v2)

We no longer protect GC during the destroy phase, so we need to
deal with buffer reallocation.

Note that the implemen

Handle reallocated root buffer during GC destroy phase (v2)

We no longer protect GC during the destroy phase, so we need to
deal with buffer reallocation.

Note that the implementation of spl_SplObjectStorage_free_storage
will call the destructor of SplObjectStorage, and free the instance properties,
which I think is what caused the root buffer to be reallocated.
(`current` is a pointer for an index within the root buffer?)

This fixes bug #78811 for me.

Closes GH-4935

show more ...