nicolas-grekas · Nov 12, 2026 · Nov 12, 2026 · kocsismate · Nov 13, 2026
diff --git a/NEWS b/NEWS
@@ -57,6 +57,10 @@ PHP                                                                        NEWS
     after a dot segment in a path, replacement file drive paths, the output
     encoding used for percent-encoding, the URLSearchParams tail pointer and
     fragment serialization without a query. (alexandre-daubois)
+  . Merge patch lexbor/lexbor@f4cbbcd, fixing lexbor_array_obj_t allocating 8
+    times the memory it uses. (Nicolas Grekas)
+  . Reduced the initial size of the tokenizer pools and of the memory pool
+    caches, saving about 900KB per HTML parse. (Nicolas Grekas)
 
 - LibXML:
   . Clear the libxml last error in libxml_use_internal_errors(false).

diff --git a/UPGRADING b/UPGRADING
@@ -205,6 +205,10 @@ PHP 8.7 UPGRADE NOTES
     target does not keep is now released at that assignment instead of after
     the last one.
 
+- DOM:
+  . Parsing HTML with Dom\HTMLDocument or innerHTML uses much less memory for
+    small inputs.
+
 - Standard:
   . Improved performance of strcspn() and strpbrk() when searching longer strings
     with a single-byte character mask.

@@ -5,13 +5,14 @@ dom
 --SKIPIF--
 <?php
 if (PHP_INT_SIZE != 8) die("skip 64-bit only");
+if (getenv("USE_ZEND_ALLOC") === "0") die("skip Zend MM disabled");
 ?>
 --INI--
-memory_limit=32M
+memory_limit=26M
 --FILE--
 <?php
 $html = '<template><p>t</p><template><b>n</b></template></template><main>' . str_repeat('<i></i>', 100000) . '</main>';
 Dom\HTMLDocument::createFromString($html, LIBXML_NOERROR);
 ?>
 --EXPECTF--
-Fatal error: Allowed memory size of 33554432 bytes exhausted %S(tried to allocate %d bytes) in %s on line %d
+Fatal error: Allowed memory size of 27262976 bytes exhausted %S(tried to allocate %d bytes) in %s on line %d
@@ -1,4 +1,6 @@
 PHP_LEXBOR_CFLAGS="-Wno-unknown-warning-option -Wno-unterminated-string-initialization -I@ext_srcdir@/"
+dnl Initial sizes of the tokenizer pools and of the mraw cache, see patch 0026.
+PHP_LEXBOR_CFLAGS="$PHP_LEXBOR_CFLAGS -DLXB_HTML_TKZ_TOKEN_POOL_SIZE=16 -DLXB_HTML_TKZ_ATTR_POOL_SIZE=256 -DLEXBOR_MRAW_CACHE_SIZE=64"
 LEXBOR_DIR="lexbor"
 
 AC_DEFINE([HAVE_LEXBOR], [1], [Define to 1 if the PHP extension 'lexbor' is available.])

@@ -24,6 +24,8 @@ ADD_SOURCES("ext/lexbor/lexbor/tag", "tag.c","lexbor");
 ADD_SOURCES("ext/lexbor/lexbor/unicode", "idna.c unicode.c","lexbor");
 ADD_SOURCES("ext/lexbor/lexbor/url", "url.c","lexbor");
 ADD_FLAG("CFLAGS_LEXBOR", "/D LEXBOR_BUILDING /utf-8");
+// Initial sizes of the tokenizer pools and of the mraw cache, see patch 0026.
+ADD_FLAG("CFLAGS_LEXBOR", "/D LXB_HTML_TKZ_TOKEN_POOL_SIZE=16 /D LXB_HTML_TKZ_ATTR_POOL_SIZE=256 /D LEXBOR_MRAW_CACHE_SIZE=64");
 
 AC_DEFINE("HAVE_LEXBOR", 1, "Define to 1 if the PHP extension 'lexbor' is available.");
 

@@ -29,8 +29,7 @@ lexbor_array_obj_init(lexbor_array_obj_t *array,
     array->size = size;
     array->struct_size = struct_size;
 
-    array->list = lexbor_malloc(sizeof(uint8_t *)
-                                * (array->size * struct_size));
+    array->list = lexbor_malloc(array->size * struct_size);
     if (array->list == NULL) {
         return LXB_STATUS_ERROR_MEMORY_ALLOCATION;
     }
@@ -77,8 +76,7 @@ lexbor_array_obj_expand(lexbor_array_obj_t *array, size_t up_to)
 
     new_size = array->length + up_to;
 
-    list = lexbor_realloc(array->list, sizeof(uint8_t *)
-                          * (new_size * array->struct_size));
+    list = lexbor_realloc(array->list, new_size * array->struct_size);
     if (list == NULL) {
         return NULL;
     }
@@ -170,8 +168,7 @@ lexbor_array_obj_delete(lexbor_array_obj_t *array, size_t begin, size_t length)
 
     memmove(&array->list[ begin * array->struct_size ],
             &array->list[ end_len * array->struct_size ],
-            sizeof(uint8_t *)
-            * ((array->length - end_len) * array->struct_size));
+            (array->length - end_len) * array->struct_size);
 
     array->length -= length;
 }

@@ -11,6 +11,10 @@
     #include <sanitizer/asan_interface.h>
 #endif
 
+#ifndef LEXBOR_MRAW_CACHE_SIZE
+    #define LEXBOR_MRAW_CACHE_SIZE 64
+#endif
+
 
 #define lexbor_mraw_meta_set(data, size)                                       \
     do {                                                                       \
@@ -62,7 +66,7 @@ lexbor_mraw_init(lexbor_mraw_t *mraw, size_t chunk_size)
     /* Cache */
     mraw->cache = lexbor_bst_create();
 
-    status = lexbor_bst_init(mraw->cache, 512);
+    status = lexbor_bst_init(mraw->cache, LEXBOR_MRAW_CACHE_SIZE);
     if (status) {
         return status;
     }

@@ -20,6 +20,14 @@
 
 #define LXB_HTML_TKZ_TEMP_SIZE (4096 * 4)
 
+#ifndef LXB_HTML_TKZ_TOKEN_POOL_SIZE
+    #define LXB_HTML_TKZ_TOKEN_POOL_SIZE 16
+#endif
+
+#ifndef LXB_HTML_TKZ_ATTR_POOL_SIZE
+    #define LXB_HTML_TKZ_ATTR_POOL_SIZE 256
+#endif
+
 
 enum {
     LXB_HTML_TOKENIZER_OPT_TAGS_SELF       = 1 << 0,
@@ -63,14 +71,16 @@ lxb_html_tokenizer_init(lxb_html_tokenizer_t *tkz)
 
     tkz->dobj_token = lexbor_dobject_create();
     status = lexbor_dobject_init(tkz->dobj_token,
-                                 4096, sizeof(lxb_html_token_t));
+                                 LXB_HTML_TKZ_TOKEN_POOL_SIZE,
+                                 sizeof(lxb_html_token_t));
     if (status != LXB_STATUS_OK) {
         return status;
     }
 
     /* Init Token Attributes */
     tkz->dobj_token_attr = lexbor_dobject_create();
-    status = lexbor_dobject_init(tkz->dobj_token_attr, 4096,
+    status = lexbor_dobject_init(tkz->dobj_token_attr,
+                                 LXB_HTML_TKZ_ATTR_POOL_SIZE,
                                  sizeof(lxb_html_token_attr_t));
     if (status != LXB_STATUS_OK) {
         return status;

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Sat, 26 Aug 2023 15:08:59 +0200
-Subject: [PATCH 01/24] Expose line and column information for use in PHP
+Subject: [PATCH 01/26] Expose line and column information for use in PHP
 
 ---
  source/lexbor/dom/interfaces/node.h  |  2 ++

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Mon, 14 Aug 2023 20:18:51 +0200
-Subject: [PATCH 02/24] Track implied added nodes for options use in PHP
+Subject: [PATCH 02/26] Track implied added nodes for options use in PHP
 
 ---
  source/lexbor/html/tree.h                            | 3 +++

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Thu, 24 Aug 2023 22:57:48 +0200
-Subject: [PATCH 03/24] Patch utilities and data structure to be able to
+Subject: [PATCH 03/26] Patch utilities and data structure to be able to
  generate smaller lookup tables
 
 Changed the generation script to check if everything fits in 32-bits.

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Wed, 29 Nov 2023 21:26:47 +0100
-Subject: [PATCH 04/24] Remove unused upper case tag static data
+Subject: [PATCH 04/26] Remove unused upper case tag static data
 
 ---
  source/lexbor/tag/res.h | 2 ++

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Wed, 29 Nov 2023 21:29:31 +0100
-Subject: [PATCH 05/24] Shrink size of static binary search tree
+Subject: [PATCH 05/26] Shrink size of static binary search tree
 
 This also makes it more efficient on the data cache.
 ---

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Niels Dossche <7771979+nielsdos@users.noreply.github.com>
 Date: Sun, 7 Jan 2024 21:59:28 +0100
-Subject: [PATCH 06/24] Patch out unused CSS style code
+Subject: [PATCH 06/26] Patch out unused CSS style code
 
 ---
  source/lexbor/css/rule.h | 2 ++

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
 Date: Sun, 17 May 2026 22:17:14 +0200
-Subject: [PATCH 07/24] Add lxb_url_is_special() to the public API (#362)
+Subject: [PATCH 07/26] Add lxb_url_is_special() to the public API (#362)
 
 As https://wiki.php.net/rfc/uri_followup#uri_type_detection relies on this information.
 ---

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Fri, 26 Jun 2026 18:55:56 +0300
-Subject: [PATCH 08/24] URL: fixed setters for empty hosts.
+Subject: [PATCH 08/26] URL: fixed setters for empty hosts.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Fri, 5 Jun 2026 22:13:32 +0300
-Subject: [PATCH 09/24] URL: fixed uninitialized memory in the path buffer
+Subject: [PATCH 09/26] URL: fixed uninitialized memory in the path buffer
  growth.
 
 When a path was long enough to outgrow the on-stack buffer, the first

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
 Date: Thu, 9 Jul 2026 21:51:05 +0200
-Subject: [PATCH 10/24] Fix parsing for URL containing empty host and userinfo
+Subject: [PATCH 10/26] Fix parsing for URL containing empty host and userinfo
 
 The returned error code (LXB_URL_ERROR_TYPE_INVALID_CREDENTIALS) apparently contradicts the specification:
 

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
 Date: Fri, 10 Jul 2026 22:31:16 +0200
-Subject: [PATCH 11/24] Percent-encode the caret in the path
+Subject: [PATCH 11/26] Percent-encode the caret in the path
 
 The caret (^) is part of the path percent-encode set:
 

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Wed, 12 Aug 2026 23:29:20 +0300
-Subject: [PATCH 12/24] URL: added public IPv6 parser.
+Subject: [PATCH 12/26] URL: added public IPv6 parser.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Thu, 13 Aug 2026 23:29:16 +0300
-Subject: [PATCH 13/24] URL: added public percent-encoder API.
+Subject: [PATCH 13/26] URL: added public percent-encoder API.
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Fri, 5 Jun 2026 22:34:23 +0300
-Subject: [PATCH 14/24] CSS: fixed heap buffer overflow in :lexbor-contains()
+Subject: [PATCH 14/26] CSS: fixed heap buffer overflow in :lexbor-contains()
  parsing.
 
 The contains string buffer was allocated by the size of the string

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Wed, 10 Jun 2026 19:50:10 +0300
-Subject: [PATCH 15/24] Encoding: fixed buffer overflows in malformed decode
+Subject: [PATCH 15/26] Encoding: fixed buffer overflows in malformed decode
  replay.
 
 Fixed out-of-bounds writes in buffering decoders when replacement output

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Fri, 5 Jun 2026 21:46:26 +0300
-Subject: [PATCH 16/24] URL: fixed tail pointer in URLSearchParams for
+Subject: [PATCH 16/26] URL: fixed tail pointer in URLSearchParams for
  delimiter-free query.
 
 When a query had a single token without '=' or '&' (e.g. "?abc"), the

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@bastelstu.be>
 Date: Fri, 31 Jul 2026 20:56:18 +0200
-Subject: [PATCH 17/24] URL: Fix parsing of usernames containing `@`
+Subject: [PATCH 17/26] URL: Fix parsing of usernames containing `@`
 
 Fixes lexbor/lexbor#399.
 ---

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Mon, 7 Sep 2026 22:11:39 +0300
-Subject: [PATCH 18/24] Unicode: fixed uninitialized memory in IDNA buffer
+Subject: [PATCH 18/26] Unicode: fixed uninitialized memory in IDNA buffer
  growth.
 
 When an IDNA buffer outgrew the stack allocation, the move to the heap

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
 Date: Fri, 11 Sep 2026 21:58:45 +0200
-Subject: [PATCH 19/24] URL: encode opaque path spaces before query and
+Subject: [PATCH 19/26] URL: encode opaque path spaces before query and
  fragment. (#405)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@tideways-gmbh.com>
 Date: Fri, 11 Sep 2026 22:45:33 +0200
-Subject: [PATCH 20/24] URL: Fix `lxb_url_serialize_fragment()` without a query
+Subject: [PATCH 20/26] URL: Fix `lxb_url_serialize_fragment()` without a query
  (#410)
 
 The `lxb_url_serialize_fragment()` function checked if the query contained data

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
 Date: Tue, 22 Sep 2026 22:20:28 +0200
-Subject: [PATCH 21/24] URL: expose component reset functions. (#415)
+Subject: [PATCH 21/26] URL: expose component reset functions. (#415)
 
 * URL: expose component reset functions.
 

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?Tim=20D=C3=BCsterhus?= <tim@tideways-gmbh.com>
 Date: Sat, 26 Sep 2026 18:41:05 +0200
-Subject: [PATCH 22/24] URL: Fix parsing of query and fragment after a
+Subject: [PATCH 22/26] URL: Fix parsing of query and fragment after a
  dot-component in path (#411)
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: =?UTF-8?q?M=C3=A1t=C3=A9=20Kocsis?= <kocsismate@woohoolabs.com>
 Date: Mon, 21 Sep 2026 20:01:43 +0200
-Subject: [PATCH 23/24] URL: Keep replacement file drive paths hierarchical
+Subject: [PATCH 23/26] URL: Keep replacement file drive paths hierarchical
  (#423)
 
 WHATWG file state (https://url.spec.whatwg.org/#file-state) step 4.4.3.2 resets the path to an empty list. Do not mark it opaque, as that makes subsequent pathname updates silently do nothing.

@@ -1,7 +1,7 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Alexander Borisov <lex.borisov@gmail.com>
 Date: Thu, 24 Sep 2026 15:05:51 +0300
-Subject: [PATCH 24/24] URL: normalize output encoding for percent-encoding.
+Subject: [PATCH 24/26] URL: normalize output encoding for percent-encoding.
 
 ---
  source/lexbor/url/url.c | 34 +++++++++++++++++++++++++---------