fix(ir_lower): defer the release-before-store for storage that can still widen

[Guikingone]

Closes #479.

What was wrong

<?php
for ($n = 0; $n < 50; $n++) {
    try { throw new TypeError("x"); } catch (\Throwable $e) {
        $e = new TypeError("y");
    }
}
echo "done";

HEAP DEBUG: allocs=300 frees=153 live_blocks=147 live_bytes=7840

The diagnosis in the issue is inverted, and that is where the fix lives

The issue reads the EIR's load_local slot[0] typed php=mixed as "the release misreads an object pointer as a box". It is the other way round — and the distinction moves the fix to a different layer entirely.

catch (\Throwable $e) binds the slot as Object("Throwable"). The later TypeError store widens it: two object types have no arm in widened_local_storage_type, so the pair falls through to _ => Mixed. The backend then uses that final storage type for the whole frame — every store boxes, every load unboxes.

The release emitted before the first store was lowered while the slot still looked concrete:

v11: Heap(Object) php=Throwable = load_local slot[1]   ; lowered before the widening
release v11
store_local v10 slot[1]

Against boxed storage, an Object-typed load is an unbox with retain: it hands back the inner pointer with a fresh reference. The release cancels exactly that reference — and the box is never freed. Two blocks per iteration: the box, and the object it pinned.

Fix

That stale-type shape is what release_local_slot already exists for. #534 hit it for a slot that looked untracked (an inner for counter widened Int→Mixed by its checked-add update), and the deferred op fixed it by letting the backend release at the final widened type. A storage type that already needs lifetime tracking goes stale the same way — it was simply excluded by an early return.

So inside a loop the deferred op is now used for every storage type that can still widen:

• Mixed / Union keep the eager path — they are terminal, nothing widens a box further, so their eager load is already correctly typed.
• Str keeps it too, deliberately. Its eager release runs through the ownership analysis, which knows a .rodata literal pointer must not be freed; the slot-typed cleanup does not model that. Moving strings onto the deferred path would trade a leak for a free of read-only memory. (Str→Mixed therefore still has the same latent shape — worth its own issue, not this one.)

It is not catch-specific

The issue says the release path "falls back to Mixed for catch-bound locals specifically". It does not. Any supertype-typed local reassigned to a subtype leaks identically:

<?php
interface Shape { public function area(): int; }
class Sq implements Shape { public function area(): int { return 4; } }
function make(): Shape { return new Sq(); }

for ($n = 0; $n < 50; $n++) {
    $s = make();
    $s = new Sq();
}

HEAP DEBUG: allocs=200 frees=102 live_blocks=98 live_bytes=3136

That shape has its own regression test, because a catch-only fix would have left it leaking.

The fix I did not ship

The tempting one-liner is to give widened_local_storage_type the missing (Object, Object) arm, so two classes share one pointer slot instead of widening to Mixed — matching the Array/Array arm right above it. It fixes both repros.

It also breaks twelve DatePeriod tests. The synthetic DatePeriod bodies assign a DateTime in one branch and a DateTimeImmutable in the other:

if ($this->startIsImmutable) { $d = new DateTimeImmutable(); return $d->setTimestamp($this->startTs); }
$d = new DateTime();

which the checker rejects in userland — cannot reassign $d from DateTimeImmutable to DateTime — and which only works because the slot boxes. (It fails as Call to a member function format() on null, and the load side needs a matching arm in local_load_types_share_storage before it even compiles.) Widening stays; the release learns to wait for it.

After

HEAP DEBUG: allocs=300 frees=300 live_blocks=0 live_bytes=0
HEAP DEBUG: leak summary: clean

Tests

tests/codegen/runtime_gc/object_supertype_rebind.rs: the issue's repro, the interface-typed local, and the issue's three controls ($e = null, unset($e), same-class reassignment).

Both repros were verified to fail with the fix reverted, and the controls to pass either way. The controls use distinct variable names on purpose — sharing one name makes the third loop widen the first loop's slot, which turns the control into a fourth repro. It did, while I was writing it.

cargo test --test codegen_tests for codegen::runtime_gc (301), codegen::oop (615) and codegen::oop::datetime (135) pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01KSAAWPyNBq6dP2b5puN3wr

[greptile-apps]

Greptile Summary

This PR corrects ownership cleanup for loop-local storage whose representation can widen after an earlier store is lowered.

• Defers release-before-store until the backend knows the slot's final widened storage type.
• Preserves eager cleanup for terminal boxed types, strings, reference-bound locals, and stores outside loops.
• Adds heap-debug regressions for catch-bound and interface-typed object reassignment, plus unaffected control cases.
• Documents the widening and ownership behavior in the memory model.

Confidence Score: 5/5

The PR appears safe to merge; the previous documentation and misleading-comment findings are resolved, and no new actionable issue remains.

The current implementation defers cleanup only where loop lowering can observe a stale pre-widening storage type, retains eager ownership-aware cleanup where required, and includes focused heap-debug coverage for the reported leak and its controls.

Important Files Changed

Filename	Overview
src/ir_lower/context.rs	Defers loop-local cleanup when the current storage representation may still widen, while retaining the existing specialized cleanup paths.
tests/codegen/runtime_gc/object_supertype_rebind.rs	Adds focused heap-debug regressions and controls for object-supertype slots that widen to boxed Mixed storage.
tests/codegen/runtime_gc.rs	Registers the new runtime-GC regression module.
docs/internals/memory-model.md	Documents deferred cleanup for both initially untracked and already-tracked storage that later widens.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Lower store inside loop] --> B{Local is reference-bound?}
    B -->|Yes| C[Use reference-cell ownership path]
    B -->|No| D{Storage can still widen?}
    D -->|Yes| E[Emit deferred release_local_slot]
    D -->|No| F{Current storage needs tracking?}
    F -->|Yes| G[Emit eager typed release]
    F -->|No| H[No release needed]
    E --> I[Backend resolves final slot representation]
    I --> J[Release boxed or concrete value correctly]

Loading

_{Reviews (4): Last reviewed commit: "docs(internals): record the deferred rel..." | Re-trigger Greptile}

[nahime0]

lgtm