phanalist

E0045: Input-Dependent Live-Heap Growth

E0045 reports loops that retain memory in proportion to an input-sized collection. It distinguishes cumulative allocation from live heap: allocating temporary values is not the same as keeping them reachable until the request or worker finishes.

What it checks

• Appending input-sized values to an array that remains reachable
• Building a new local array with dynamic indexes, then returning or otherwise retaining it
• Retaining input-sized arrays, objects, or strings in another array or property
• Repeated copying growth such as array_unshift(), where the cumulative allocation is quadratic even when the final array is linear
• Accumulating values across loop iterations without a corresponding release
• Escaping values whose size is controlled by request input
• Calls to local functions or methods whose resource summary allocates or retains input-sized data

The finding reports the symbolic retained growth, cumulative allocation, and peak live heap. Retained size covers memory added by the loop; pre-existing input arrays are included in the peak estimate but not in the reported retained growth. For example, a retained array may be described as count($items) * bytes($items); this is a symbolic estimate, not a measurement of PHP’s internal zval or hashtable layout.

Model limits

E0045 does not run a garbage collector or know when PHP will free a value. It uses conservative reachability rules and the following simplifications:

• Stream reads in loop conditions (fgets(), fgetcsv(), fgetss(), fgetc(), fread(), fscanf(), and stream_get_line()) are treated as unbounded input. Streaming without retention is safe; retaining stream values is reported as input-dependent live-heap growth
• A generator that is consumed incrementally is treated as bounded; its peak is not assumed to grow with the full input
• Copy-on-write is modeled approximately; aliases and reference assignments are not tracked with full PHP reference semantics
• Writing an existing element of a non-empty parameter array is treated as an in-place overwrite rather than new retention; local arrays with a known constant size still track indexed growth
• Element byte sizes come from known scalar sizes; unknown element sizes remain symbolic. retained_element_bytes sets the minimum known element size that is treated as large retention
• Memory held by extensions, opcache, persistent connections, and the PHP runtime itself is outside the model
• Destructors, unset() in dynamic scopes, and object lifetimes that cross function boundaries are not modeled precisely
• Recursive retention and cyclic object graphs are not analyzed
• Parallel workers, fibers, and requests that share persistent state are not modeled

The rule is deliberately conservative around unknown callees: an unknown call with a tracked argument may invalidate that value’s growth information instead of claiming that memory is released. A callee summary only contributes retained growth when the retained value is derived from one of the callee’s parameters. Helpers that throw fresh exceptions or return unrelated temporary objects do not make their callers retain input-sized data.

When retained growth is unknown, the rule requires direct local accumulation or cumulative allocation at or above heap_alloc_threshold. Validation and predicate loops that only call helpers and discard their results are therefore not reported as live-heap growth. A discarded helper return value does not contribute retained growth, but in-place mutators such as array_push() still count as local accumulation.

Configuration

rules:
  E0045:
    runtime_threshold: quadratic
    heap_alloc_threshold: quadratic
    retained_element_bytes: 32
    report_input_cardinality: true
    include_cli_input: false
    max_findings_per_function: 20

heap_alloc_threshold controls when cumulative allocation is reported. retained_element_bytes is the estimated per-element size used when the element type is unknown. Lowering it makes retention findings more sensitive.

This site is open source. Improve this page.