Defer object destructors to the next VM safepoint

Run an object's __destruct at the next VM safepoint instead of inline at the
point its refcount reaches zero, so a destructor can no longer reenter the VM
in the middle of an opcode's operand cleanup. Logical death stays synchronous:
a WeakReference reads null and a WeakMap entry is gone at the drop, and only
the physical destructor call and the free are deferred. Safepoints are entry
into a user function, method, closure, magic method or hook, a statement-level
internal call, every try-region boundary (entry, normal exit,
return/break/continue/goto/throw out of a try, and the end of a finally body),
a loop back-edge, and script or fiber end.

Because a flushed destructor exception is thrown from an opline still inside
the try region that owns it, the existing exception table delivers it to the
same catch that would have caught an inline throw; region scoping is positional
and needs no per-region runtime state. Several destructor exceptions at one
safepoint compose into a single getPrevious chain, an exit or unwind exception
wins over a destructor exception, and every object is destroyed exactly once.
Behavior is identical across the interpreter, tracing JIT, and function JIT.
Generators and fibers carry their own deferred-destructor queue, so a
destructor deferred inside one runs there rather than in the consumer.

Author: iliaal

Zend/tests/bug38220.phpt

@@ -67,6 +67,7 @@ A Object
 )
 func1(): 1
 after call func1
+before call func1
 A::__destruct()
 before call close
 A Object
@@ -75,7 +76,6 @@ A Object
 )
 close(): 1
 after call close
-before call func1
 A Object
 (
     [i] => 2

Zend/tests/dtor_defer/catch_on_early_exit.phpt

@@ -0,0 +1,57 @@
+--TEST--
+Deferred destructor: a throwing destructor dropped in a try is caught by that try when the try is left via return/break/continue
+--FILE--
+<?php
+class D {
+    public function __construct(public string $id) {}
+    public function __destruct() { throw new Exception("dtor {$this->id}"); }
+}
+
+function via_return() {
+    try {
+        $d = new D("r");
+        unset($d);
+        return "returned";
+    } catch (Exception $e) {
+        echo "return-case caught: {$e->getMessage()}\n";
+        return "caught";
+    }
+}
+var_dump(via_return());
+
+function via_break() {
+    foreach ([1] as $v) {
+        try {
+            $d = new D("b");
+            unset($d);
+            break;
+        } catch (Exception $e) {
+            echo "break-case caught: {$e->getMessage()}\n";
+        }
+    }
+    return "done";
+}
+var_dump(via_break());
+
+function via_continue() {
+    foreach ([1, 2] as $v) {
+        try {
+            $d = new D("c$v");
+            unset($d);
+            continue;
+        } catch (Exception $e) {
+            echo "continue-case caught: {$e->getMessage()}\n";
+        }
+    }
+    return "done";
+}
+var_dump(via_continue());
+?>
+--EXPECT--
+return-case caught: dtor r
+string(6) "caught"
+break-case caught: dtor b
+string(4) "done"
+continue-case caught: dtor c1
+continue-case caught: dtor c2
+string(4) "done"

Zend/tests/dtor_defer/exit_wins_over_throwing_dtor.phpt

@@ -0,0 +1,36 @@
+--TEST--
+Deferred destructor: exit() in a destructor wins over a throwing destructor in the same flush, either order
+--FILE--
+<?php
+class Exiter {
+    function __destruct() {
+        echo "Exiter dtor\n";
+        exit(7);
+    }
+}
+class Thrower {
+    public $id;
+    function __construct(int $id) { $this->id = $id; }
+    function __destruct() {
+        echo "Thrower {$this->id} dtor\n";
+        throw new Exception("thrown {$this->id}");
+    }
+}
+
+register_shutdown_function(function () { echo "shutdown\n"; });
+
+// Thrower deferred before Exiter, then Exiter: exit must win over the pending throw.
+$t = new Thrower(1);
+$t = null;
+$e = new Exiter();
+$e = null;
+
+// A safepoint flushes the batch. exit(7) wins; no user code runs afterwards.
+(function () {})();
+
+echo "UNREACHABLE\n";
+?>
+--EXPECT--
+Thrower 1 dtor
+Exiter dtor
+shutdown

Zend/tests/dtor_defer/finally_body_dtor_composition.phpt

@@ -0,0 +1,32 @@
+--TEST--
+Deferred destructor: a destructor dropped in a finally body composes with a destructor exception pending from the protected block and is caught by the enclosing try
+--FILE--
+<?php
+class D {
+    public function __construct(public string $id) {}
+    public function __destruct() { throw new Exception("dtor {$this->id}"); }
+}
+function f() {
+    try {
+        try {
+            $a = new D("try");
+            unset($a);
+            return "unreached";
+        } finally {
+            $b = new D("finally");
+            unset($b);
+            echo "finally body ran\n";
+        }
+    } catch (Exception $e) {
+        echo $e::class, ": ", $e->getMessage(), "\n";
+        echo "previous: ", $e->getPrevious()?->getMessage() ?? "none", "\n";
+        return "caught";
+    }
+}
+var_dump(f());
+?>
+--EXPECT--
+finally body ran
+Exception: dtor finally
+previous: dtor try
+string(6) "caught"

Zend/tests/dtor_defer/finally_throwing_dtor_once.phpt

@@ -0,0 +1,30 @@
+--TEST--
+Deferred destructor: a throwing destructor deferred in a finally runs exactly once
+--FILE--
+<?php
+class D {
+    function __destruct() {
+        echo "dtor\n";
+        throw new Exception("boom");
+    }
+}
+function g() {
+    try {
+        return 1;
+    } finally {
+        $x = new D();
+        unset($x);
+    }
+}
+g();
+echo "after g\n";
+?>
+--EXPECTF--
+dtor
+
+Fatal error: Uncaught Exception: boom in %s:%d
+Stack trace:
+#0 %s(%d): D->__destruct()
+#1 %s(%d): g()
+#2 {main}
+  thrown in %s on line %d

Zend/tests/dtor_defer/gc_condemned_inline.phpt

@@ -0,0 +1,35 @@
+--TEST--
+Deferred destructor: a drop inside a GC destructor of a condemned sibling runs inline
+--FILE--
+<?php
+$log = 0;
+class Node {
+    public $next;
+    public $peer;
+    function __destruct() {
+        global $log;
+        $log++;
+        $this->peer = null;
+    }
+}
+
+for ($r = 0; $r < 2000; $r++) {
+    $a = new Node();
+    $b = new Node();
+    $c = new Node();
+    $a->next = $b;
+    $b->next = $c;
+    $c->next = $a;
+    $a->peer = $c;
+    $b->peer = $a;
+    $c->peer = $b;
+    unset($a, $b, $c);
+    if ($r % 500 === 0) {
+        gc_collect_cycles();
+    }
+}
+gc_collect_cycles();
+echo "log=$log\n";
+?>
+--EXPECT--
+log=6000

Zend/tests/dtor_defer/loop_backedge_flush.phpt

@@ -0,0 +1,28 @@
+--TEST--
+Deferred destructors flush at loop back-edges
+--INI--
+opcache.enable_cli=0
+--FILE--
+<?php
+$dtors = 0;
+
+class C {
+    public function __destruct() {
+        global $dtors;
+        $dtors++;
+    }
+}
+
+for ($i = 0; $i < 3; $i++) {
+    $object = new C;
+    unset($object);
+    echo $i, ":", $dtors, "\n";
+}
+
+echo "done:", $dtors, "\n";
+?>
+--EXPECT--
+0:0
+1:1
+2:2
+done:2

Zend/tests/dtor_defer/nested_region_scoping.phpt

@@ -0,0 +1,59 @@
+--TEST--
+Deferred destructor: nested try regions scope the deferred queue; each region's destructor surfaces at its own level and a finally-return discards only its own
+--FILE--
+<?php
+class D {
+    public function __construct(public string $id) {}
+    public function __destruct() { throw new Exception("dtor {$this->id}"); }
+}
+
+function inner_level() {
+    try {
+        try {
+            $d = new D("inner");
+            unset($d);
+            return "inner-try-return";
+        } catch (Exception $e) {
+            echo "inner caught: {$e->getMessage()}\n";
+            return "inner-catch";
+        }
+    } catch (Exception $e) {
+        echo "outer WRONGLY caught: {$e->getMessage()}\n";
+        return "outer-catch";
+    }
+}
+var_dump(inner_level());
+
+function outer_survives() {
+    try {
+        $d = new D("outer");
+        unset($d);
+        try {
+            return "inner-try-return";
+        } finally {
+            return "inner-finally-return";
+        }
+    } catch (Exception $e) {
+        echo "outer caught: {$e->getMessage()}\n";
+        return "outer-catch";
+    }
+}
+var_dump(outer_survives());
+
+function finally_discards() {
+    try {
+        $d = new D("discarded");
+        unset($d);
+        return "try-return";
+    } finally {
+        return "finally-return";
+    }
+}
+var_dump(finally_discards());
+?>
+--EXPECT--
+inner caught: dtor inner
+string(11) "inner-catch"
+outer caught: dtor outer
+string(11) "outer-catch"
+string(14) "finally-return"

Zend/tests/dtor_defer/throw_after_deferred_dtor.phpt

@@ -0,0 +1,43 @@
+--TEST--
+Deferred destructor: a throwing destructor pending at an explicit throw preempts it, whether dropped before the statement or during the throw operand's evaluation, so no spurious exception chain is created
+--FILE--
+<?php
+class D {
+    public function __destruct() { throw new Exception("dtor"); }
+}
+
+// The throw operand is a pre-existing object; the destructor is dropped before it.
+function rethrow_case() {
+    try {
+        try {
+            throw new Exception("original");
+        } catch (Exception $orig) {
+            $x = new D();
+            unset($x);
+            throw $orig;
+        }
+    } catch (Exception $e) {
+        echo "rethrow: ", $e->getMessage(), " prev=", $e->getPrevious()?->getMessage() ?? "none", "\n";
+    }
+}
+rethrow_case();
+
+// The throw operand is a call that drops the destructor during its evaluation.
+function make(Exception $e) {
+    $x = new D();
+    unset($x);
+    return $e;
+}
+function operand_call_case() {
+    $pre = new Exception("explicit");
+    try {
+        throw make($pre);
+    } catch (Exception $e) {
+        echo "operand-call: ", $e->getMessage(), " prev=", $e->getPrevious()?->getMessage() ?? "none", "\n";
+    }
+}
+operand_call_case();
+?>
+--EXPECT--
+rethrow: dtor prev=none
+operand-call: dtor prev=none

Zend/tests/dtor_defer/throw_preempt_uncatchable.phpt

@@ -0,0 +1,18 @@
+--TEST--
+Deferred destructor: an uncatchable throwing destructor pending at an explicit throw or internal call preempts it positionally instead of being held to shutdown
+--FILE--
+<?php
+class D {
+    public function __destruct() { throw new Exception("dtor"); }
+}
+$d = new D();
+$e = new Exception("main");
+unset($d);
+throw $e;
+?>
+--EXPECTF--
+Fatal error: Uncaught Exception: dtor in %s:%d
+Stack trace:
+#0 %s(%d): D->__destruct()
+#1 {main}
+  thrown in %s on line %d