Caught exception objects are never freed (throwable leaks once per catch)

[mirchaemanuel]

Summary

A caught exception object is never freed: each throw whose exception is handled by a catch leaks the throwable heap block (~48 bytes), once per catch. In a loop that throws-and-catches, the heap grows without bound.

Verified on

main (macOS ARM64, default EIR backend), via --heap-debug leak summary.

Minimal reproduction

<?php
for ($n = 0; $n < 200; $n++) {
    try {
        throw new TypeError("x");
    } catch (\Throwable $e) {
        // handled; $e goes out of scope at the end of the catch
    }
}
echo "done\n";

Actual (--heap-debug)

HEAP DEBUG: leak summary: live_blocks=200 live_bytes=9600

live_blocks grows linearly with the number of caught exceptions (N=50 → 50, N=200 → 200): the throwable allocated by throw is never released after the catch handler completes.

Expected

The caught exception object should be released when it leaves the catch scope (like any other scope-local object), leaving the heap flat across iterations.

Notes

General exception-handling ownership gap, independent of the throw source (a user throw new ..., a builtin fatal-to-TypeError, etc. all leak the same block). Not a crash — a steady per-catch leak. Long-running programs that use exceptions for control flow will accumulate memory.

[Guikingone]

Looks a lot like #399 🤔

If it's the same, the fix is open in #428

[mirchaemanuel]

Good call to cross-check — but they're distinct, verified against #428's branch on macOS ARM64:

• Owning call-result/argument temporary leaks when the call throws #399 repro ($t->make()->boom() chained-call throw) on fix(core): release owning call-result/argument temporaries when a call throws #428 → fixed: prints the two __destructs (dtor / caught / dtor / end), the intermediate temporary is released during unwind. 👍
• This issue's repro on the same fix(core): release owning call-result/argument temporaries when a call throws #428 build → still leaks: for (200) { try { throw new TypeError("x"); } catch (\Throwable $e) {} } reports live_blocks=200 under --heap-debug (one per catch).

So #428 drains the throwing call's owning temporaries via the eh-cleanup stack, but the caught exception object bound to $e is never released when the catch scope exits — a separate path (catch-variable scope cleanup) from the throwing-call temporaries. They live in the same neighborhood but the fix for #399 doesn't cover this one.

Happy to keep it open as its own issue; can also rebase-check once #428 lands to be sure nothing there incidentally covers it.

[mirchaemanuel]

Fixed in #477. Follow-up to the earlier exchange with @Guikingone: this confirmed to be a separate defect from #399/#428 — that fix drains the throwing call's owning temporaries, while this leak is the caught object itself never leaving the catch variable's slot.

Mechanics

The thrown object reaches the handler at refcount 1, owned by the in-flight cell (_exc_value). Op::CatchBind moves that reference into the catch variable's slot with a raw store and zeroes the cell. The frame epilogue, however, only releases slots written by Op::StoreLocal — so the catch slot was invisible to every implicit cleanup point: no rebind release on the next iteration's catch, no function-epilogue release, no program-exit release. A variable-less catch (\Throwable) dropped the reference outright. Only explicit user stores (unset($e), $e = null) freed it.

The subtle part: the system was "balanced" because the catch leaked. Making the slot owned without touching throw would double-free on rethrow — throw $e republishes the pointer while the inner slot still holds it, so an outer catch produces two slots sharing one reference.

Fix shape

Three coordinated changes: catch-bound slots follow the ordinary owned-local lifecycle (release-before-rebind + epilogue cleanup + prologue zero-init, via teaching the frame's cleanup-set collector about CatchBind); a variable-less catch consumes the reference through a hidden owned temporary; and throw of a borrowed value (a load of an owned local — the rethrow case) retains it, while throwing an owning temporary (throw new E()) still transfers.

Verified across 23 adversarial shapes (rethrow chains reusing the same variable name, aliasing + rethrow of the alias, sequential try/catch reusing $e, multi-clause/multi-type catches, finally on both paths, nested try, throws of globals/properties/array elements, uncaught fatal) — no double free, no bad-refcount, byte-identical behavior to main on every escape shape. A nice side effect: generator-internal catches previously leaked their caught exceptions too, and now free them.

Found while verifying (pre-existing, filed separately)

• return $e from inside a catch fails to compile — catch-specific (an ordinary object local returns fine).
• $e = new X() inside a catch mistypes the previous-value release as Mixed and leaks (identical on main; fix(ir,codegen): release caught exceptions through the owned-local lifecycle (#448) #477 is neutral there).
• An exception message built from a runtime scratch string (new E(str_repeat("m", 20))) is not persisted, so later concat/itoa activity corrupts getMessage()'s last byte — no try/catch needed.