Cap the OOM auto-dump so a stuck worker can't dump forever

A worker pinned at memory_limit OOMs on nearly every request; an unguarded
auto-dump would write a fresh 100MB+ file each time and fill the disk. Add a
per-worker, cross-request guard on the automatic dump:

- rdump.oom_dump_max (default 1, 0 = unlimited): max attempts per process.
- rdump.oom_dump_min_interval (default 0 = off): minimum seconds between
  attempts.

Both gates apply together, and an attempt counts whether it succeeds or not so
a broken path/full disk can't retry without bound. Explicit rdump_dump() calls
are never throttled.

https://claude.ai/code/session_017skw8BsHkF8wur7Pf4G9W5

Author: claude

README.md

@@ -99,6 +99,8 @@ php.ini:
 extension=rdump.so
 rdump.oom_dump=/var/log/php-oom-%p.rdump   ; empty = disabled
 ;rdump.oom_dump_full=1                     ; also embed read-only segments
+;rdump.oom_dump_max=1                      ; max auto-dumps per worker (0 = unlimited)
+;rdump.oom_dump_min_interval=0             ; min seconds between auto-dumps (0 = off)
 ```
 
 The path may contain `%p` (PID) and `%t` (Unix time), expanded when the dump
@@ -113,6 +115,25 @@ from the engine's error callback (`zend_error_cb`) — on the intact stack,
 before any unwind, and off the `memory_limit` heap (libc `malloc`) — so it
 captures even the OOMs a shutdown handler cannot.
 
+#### Don't let it run away
+
+A worker pinned at `memory_limit` tends to OOM on *every* request, so an
+unguarded auto-dump would write a fresh (often 100 MB+) file each time and bury
+the disk. By default the auto-dump therefore fires **at most once per worker
+process** (`rdump.oom_dump_max=1`); the counter is per worker and spans requests,
+so restarting the worker re-arms it. Raise the cap if you want more, and/or set a
+minimum spacing — both gates apply together:
+
+```ini
+rdump.oom_dump_max=5            ; up to 5 dumps over the worker's lifetime (0 = unlimited)
+rdump.oom_dump_min_interval=60  ; ...and at least 60s apart
+```
+
+A dump attempt counts toward the cap whether it succeeds or not, so a bad path or
+a full disk can't retry forever either. This guard applies only to the automatic
+OOM dump — explicit `rdump_dump()` calls are never throttled. (Combine the cap
+with a `%p` path so each worker still writes a distinct file.)
+
 You can also toggle it at runtime — handy for a per-request/per-pid filename,
 or when you cannot edit php.ini:
 

php_rdump.h

@@ -26,6 +26,14 @@ extern zend_module_entry rdump_module_entry;
 ZEND_BEGIN_MODULE_GLOBALS(rdump)
     char *oom_dump;          /* rdump.oom_dump (INI): path, or "" to disable */
     zend_bool oom_dump_full; /* rdump.oom_dump_full (INI) */
+    /* Runaway guard for the OOM auto-dump. A worker that keeps hitting
+     * memory_limit would otherwise dump on every request and bury the disk;
+     * these cap the dumps over the worker's whole lifetime, not per request.
+     * count/last_ts are process- (per-thread-) scoped and survive RSHUTDOWN. */
+    zend_long oom_dump_max;          /* rdump.oom_dump_max (INI): 0 = unlimited */
+    zend_long oom_dump_min_interval; /* rdump.oom_dump_min_interval (INI), seconds; 0 = off */
+    zend_long oom_dump_count;        /* OOM dumps attempted so far this process */
+    zend_long oom_dump_last_ts;      /* time() of the last OOM dump attempt, 0 = none */
     /* Runtime override set via rdump_set_oom_dump(). Owned by us (libc
      * strdup/free), reset each request. Takes precedence over the INI
      * default when oom_dump_runtime_set is true ("" => force-disabled). */

rdump.c

@@ -584,18 +584,38 @@ static void rdump_zend_error_cb(RDUMP_ERROR_CB_PARAMS)
             && msg != NULL
             && strncmp(msg, RDUMP_OOM_PREFIX, sizeof(RDUMP_OOM_PREFIX) - 1) == 0
         ) {
-            char expanded[4096];
-            const char *out_path = path;
-            if (strchr(path, '%') != NULL
-                && rdump_expand_path(path, expanded, sizeof(expanded)) == 0
-            ) {
-                out_path = expanded;
+            /* Runaway guard: a worker pinned at memory_limit OOMs on nearly
+             * every request, so cap the auto-dump over the worker's lifetime
+             * by count and/or by minimum spacing. Both gates apply together;
+             * the default max of 1 keeps it to a single dump per worker. */
+            zend_long max = RDUMP_G(oom_dump_max);
+            zend_long interval = RDUMP_G(oom_dump_min_interval);
+            zend_long now = (zend_long)time(NULL);
+            int capped = (max > 0 && RDUMP_G(oom_dump_count) >= max);
+            int too_soon = (interval > 0
+                && RDUMP_G(oom_dump_last_ts) != 0
+                && now - RDUMP_G(oom_dump_last_ts) < interval);
+
+            if (!capped && !too_soon) {
+                char expanded[4096];
+                const char *out_path = path;
+                if (strchr(path, '%') != NULL
+                    && rdump_expand_path(path, expanded, sizeof(expanded)) == 0
+                ) {
+                    out_path = expanded;
+                }
+                /* Count the attempt (success or failure) and stamp the time
+                 * before writing, so a broken path or full disk cannot retry
+                 * without bound either. */
+                RDUMP_G(oom_dump_count)++;
+                RDUMP_G(oom_dump_last_ts) = now;
+
+                char *err = NULL;
+                RDUMP_G(in_oom_dump) = 1;
+                /* Best-effort: this is the death path, so swallow any failure. */
+                (void)rdump_write_file(out_path, full, &err);
+                RDUMP_G(in_oom_dump) = 0;
             }
-            char *err = NULL;
-            RDUMP_G(in_oom_dump) = 1;
-            /* Best-effort: this is the death path, so swallow any failure. */
-            (void)rdump_write_file(out_path, full, &err);
-            RDUMP_G(in_oom_dump) = 0;
         }
     }
     rdump_original_error_cb(RDUMP_ERROR_CB_PASSTHRU);
@@ -666,6 +686,14 @@ PHP_INI_BEGIN()
         "rdump.oom_dump_full", "0", PHP_INI_SYSTEM, OnUpdateBool,
         oom_dump_full, zend_rdump_globals, rdump_globals
     )
+    STD_PHP_INI_ENTRY(
+        "rdump.oom_dump_max", "1", PHP_INI_SYSTEM, OnUpdateLong,
+        oom_dump_max, zend_rdump_globals, rdump_globals
+    )
+    STD_PHP_INI_ENTRY(
+        "rdump.oom_dump_min_interval", "0", PHP_INI_SYSTEM, OnUpdateLong,
+        oom_dump_min_interval, zend_rdump_globals, rdump_globals
+    )
 PHP_INI_END()
 
 static const zend_function_entry rdump_functions[] = {
@@ -681,6 +709,10 @@ static PHP_GINIT_FUNCTION(rdump)
 #endif
     rdump_globals->oom_dump = NULL;
     rdump_globals->oom_dump_full = 0;
+    rdump_globals->oom_dump_max = 1;
+    rdump_globals->oom_dump_min_interval = 0;
+    rdump_globals->oom_dump_count = 0;
+    rdump_globals->oom_dump_last_ts = 0;
     rdump_globals->oom_dump_runtime = NULL;
     rdump_globals->oom_dump_runtime_full = 0;
     rdump_globals->oom_dump_runtime_set = 0;