Skip to content

Free pending named positions on partial-argument compile errors#22805

Closed
iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/pfa-named-positions-leak
Closed

Free pending named positions on partial-argument compile errors#22805
iliaal wants to merge 1 commit into
php:masterfrom
iliaal:fix/pfa-named-positions-leak

Conversation

@iliaal

@iliaal iliaal commented Jul 19, 2026

Copy link
Copy Markdown
Contributor

A partial application that uses a named placeholder (foo(x: ?, ...)) lazily allocates a named-positions table in zend_compile_args_ex, consumed only after argument compilation succeeds. A following argument that is itself a compile error (a positional or unpack after the named placeholder, or a misplaced variadic placeholder) longjmps out of the function before the table is consumed and leaks it.

This frees the table before the four reachable errors. The leak is on a zend_bailout path, so ZEND_MM's leak reporter never sees it; it shows only under valgrind/ASAN. Verified with USE_ZEND_ALLOC=0 valgrind: 376 bytes to 0 on foo(x: ?, ?), and 0 on the unpack, named-after-variadic, and variadic-twice variants. The added test exercises the path for CI valgrind; the error output is identical before and after, so it is a path check, not an output red/green.

A named placeholder in a partial application lazily allocates a
named-positions table that is only consumed once argument compilation
succeeds. A later argument that is itself a compile error (a positional
or unpack after the named placeholder, or a misplaced variadic
placeholder) longjmps out of zend_compile_args_ex before the table is
consumed, leaking it. Free the table before those errors.
@ndossche

Copy link
Copy Markdown
Member

I don't think we ever clean up memory on a 'noreturn' compile error; since the heap is destroyed anyway.

@iliaal
iliaal requested a review from arnaud-lb July 19, 2026 15:06
@iliaal

iliaal commented Jul 19, 2026

Copy link
Copy Markdown
Contributor Author

Yeah, it might be not necessary. Fairly simple fix though, I'll let @Arnaud-L weigh in here, if we agrees this is not necessary I'll close

@arnaud-lb

Copy link
Copy Markdown
Member

I found no example of freeing before _noreturn, so for consistency I think that it would be better to not make this change

@iliaal

iliaal commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

Ok

@iliaal iliaal closed this Jul 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants