[kairosci]

Fixes #23586 by allocating GC traversal storage outside the request memory limit and freeing it on normal return or bailout. Adds regression coverage for memory exhaustion, wide graphs, and destructor bailouts.

[arnaud-lb]

I believe that this is fixed by 8.4.27. Could you confirm?

[kairosci]

I don't think so, I can still reproduce the issue in 8.4 and 8.5.

[arnaud-lb]

Could you share the exact command you use to execute the reproducer (preferably with php -n ...), and the output of php --version ?

[kairosci]

I ran the reproducer with:

./sapi/cli/php -n run-tests.php -n Zend/tests/gh23586.phpt

The test passed, but it exhausted memory in zend_hash.c:161; I did not reproduce the GC assertion.

./sapi/cli/php --version

PHP 8.4.28-dev (cli) (built: Oct 26 2026 13:38:21) (NTS DEBUG)
Copyright (c) The PHP Group
Zend Engine v4.4.28-dev, Copyright (c) Zend Technologies

Could you point me to the change in 8.4.27 that fixes this?

[kairosci]

I also verified the original reproducer with and without this change on PHP 8.4. Without the fix, it fails while allocating GC traversal storage; with the fix, it gets past that point. This confirms the fix addresses the issue

I also checked the PHP-8.4 branch and the 8.4.27 tag: both still use emalloc() for GC traversal storage, so this fix is not included there yet. The change in this PR replaces it with pemalloc().

[arnaud-lb]

Could you point me to the change in 8.4.27 that fixes this?

The graceful OOM handling introduced in 3584a98 is supposed to fix this. The OOM you are observing is not an issue if this doesn't interrupt the GC anymore.