Fix for https://github.com/facebook/hhvm/issues/4086

fix-xml-leak.patch

diff --git i/hphp/runtime/ext/ext_domdocument.cpp w/hphp/runtime/ext/ext_domdocument.cpp
index ea03bcb286..114175b9d7 100644
--- i/hphp/runtime/ext/ext_domdocument.cpp
+++ w/hphp/runtime/ext/ext_domdocument.cpp
@@ -1046,14 +1046,32 @@ static xmlNsPtr dom_get_nsdecl(xmlNode *node, xmlChar *localName) {
   return ret;
 }

-static void appendOrphan(XmlNodeSet &orphans, xmlNodePtr node) {
+/*
+ * If node is not nullptr, insert it into the given orphan set, which it must
+ * not already be a member of.
+ */
+static void appendOrphan(XmlNodeSet& orphans, xmlNodePtr node) {
   if (node) {
     assert(orphans.find(node) == orphans.end());
     orphans.insert(node);
   }
 }

-static void removeOrphanIfNeeded(XmlNodeSet &orphans, xmlNodePtr node) {
+/*
+ * If node is not nullptr, insert it into the given orphan set, which it may
+ * already be a member of.
+ */
+static void appendOrphanIfNeeded(XmlNodeSet& orphans, xmlNodePtr node) {
+  if (node) {
+    orphans.insert(node);
+  }
+}
+
+/*
+ * If node is not nullptr and is present in the given orphan set, remove it
+ * from the set.
+ */
+static void removeOrphanIfNeeded(XmlNodeSet& orphans, xmlNodePtr node) {
   if (node) {
     orphans.erase(node);
   }
@@ -1138,9 +1156,9 @@ Variant php_dom_create_object(xmlNodePtr obj, p_DOMDocument doc, bool owner) {
     nodeobj->incRefCount();
     nodeobj->m_doc = doc;
     nodeobj->m_node = obj;
-    if (owner && doc.get()) {
-      appendOrphan(*doc->m_orphans, obj);
-    }
+  }
+  if (owner && doc.get()) {
+    appendOrphanIfNeeded(*doc->m_orphans, obj);
   }
   return it->second;
 }
diff --git i/hphp/runtime/ext/ext_domdocument.h w/hphp/runtime/ext/ext_domdocument.h
index c897593a33..7e3359afb1 100644
--- i/hphp/runtime/ext/ext_domdocument.h
+++ w/hphp/runtime/ext/ext_domdocument.h
@@ -371,7 +371,7 @@ public:
   bool m_stricterror;
   bool m_recover;
   Array m_classmap;
-  std::auto_ptr<XmlNodeSet> m_orphans;
+  std::unique_ptr<XmlNodeSet> m_orphans;
   bool m_owner;

 private: