WeakMapValueRetainsKey

warning native off by default PHP ≥ 8.0

Group: Probable bugs

Store a value that does not retain the WeakMap key. This opt-in inspection applies the policy stated in Detection.

Example

Finding with the rule explicitly enabled:

<?php
$m = new WeakMap(); $o = new stdClass(); $m[$o] = $o;

Reported:

• line 2: Store a value that does not retain the WeakMap key.

Detection

• Enabled policy requires automatic weak-key eviction. Report assigning a WeakMap value that is the identical key object or a literal array directly containing that same object; bounded local aliases of the key count. Highlight the assignment.
• Emit one finding per violating operation. Flow facts require a reachable path with no intervening mutation, escaped alias, unknown call involving the tracked value or analysis-budget exhaustion. Uncertain facts cannot prove a violation.

Exceptions (no report)

• Do not speculate about object graphs or closure captures beyond proven direct retention. Different objects, scalars and WeakReference wrappers are excluded.
• Exclude shadowed builtin symbols, unresolved required types, incomplete syntax and unsupported PHP versions.

Fix

No automatic fix. Choosing a repair requires runtime information, error-handling policy or a semantic decision.

All edits use exact byte ranges, preserve comments and evaluation order, and require syntax supported by the target PHP version. A fix must never add an evaluation or silently change unrelated arguments.

PHP versions

Minimum PHP 8.0, the release that introduced WeakMap: with an older target version the rule reports nothing, even when the class name resolves.

Options

None. Enabling the rule declares the policy stated in Detection; the rule is disabled by default.

Configure

In custos.json:

{
  "rules": {
    "WeakMapValueRetainsKey": {
      "enabled": true
    }
  }
}

Suppress

Before the statement or declaration (or the first statement of the file):

// @custos-ignore WeakMapValueRetainsKey