Forgot to mention: When I disable opcache, the problem goes away. Also by downgrading back to PHP 7.2 (with opcache enabled)

Does the problem go away if you set opcache.optimization_level=0?

Unfortunately it doesn't. It's exactly the same with opcache.optimization_level=0

In that case, does setting opcache.protect_memory=1 produce a different backtrace?

Oh, I'm sorry… The problem indeed goes away after I set "opcache.protect_memory=1". I hadn't reloaded php-fpm correctly before. 

The backtrace I get with opcache.protect_memory=1 follows:

#0  0x00007f7ddb598d7f in raise () from /usr/lib/libc.so.6
#1  0x00007f7ddb583672 in abort () from /usr/lib/libc.so.6
#2  0x00007f7ddb583548 in __assert_fail_base.cold.0 () from /usr/lib/libc.so.6
#3  0x00007f7ddb591396 in __assert_fail () from /usr/lib/libc.so.6
#4  0x000055a2619614f0 in rc_dtor_func (p=0x7f7ddad66d80) at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:64
#5  0x000055a261977277 in i_zval_ptr_dtor (zval_ptr=0x7f7dd20e0060,
    __zend_filename=0x55a2621cc210 "/home/krist/tmp/php-7.3.2/Zend/zend_hash.c", __zend_lineno=1491)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.h:44
#6  0x000055a26197c072 in zend_array_destroy (ht=0x7f7dd213b480)
    at /home/krist/tmp/php-7.3.2/Zend/zend_hash.c:1491
#7  0x000055a261961694 in zend_array_destroy_wrapper (arr=0x7f7dd213b480)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:90
#8  0x000055a26196151f in rc_dtor_func (p=0x7f7dd213b480) at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:65
#9  0x000055a261977277 in i_zval_ptr_dtor (zval_ptr=0x7f7ddad6c788,
    __zend_filename=0x55a2621cc210 "/home/krist/tmp/php-7.3.2/Zend/zend_hash.c", __zend_lineno=1487)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.h:44
#10 0x000055a26197c034 in zend_array_destroy (ht=0x7f7dd213b5a0)
    at /home/krist/tmp/php-7.3.2/Zend/zend_hash.c:1487
#11 0x000055a261961694 in zend_array_destroy_wrapper (arr=0x7f7dd213b5a0)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:90
#12 0x000055a26196151f in rc_dtor_func (p=0x7f7dd213b5a0) at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:65
#13 0x000055a261977277 in i_zval_ptr_dtor (zval_ptr=0x7f7dd213a620,
    __zend_filename=0x55a2621cc210 "/home/krist/tmp/php-7.3.2/Zend/zend_hash.c", __zend_lineno=1487)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.h:44
#14 0x000055a26197c034 in zend_array_destroy (ht=0x7f7dd213b540)
    at /home/krist/tmp/php-7.3.2/Zend/zend_hash.c:1487
#15 0x000055a261961694 in zend_array_destroy_wrapper (arr=0x7f7dd213b540)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:90
#16 0x000055a26196151f in rc_dtor_func (p=0x7f7dd213b540) at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:65
#17 0x000055a261977277 in i_zval_ptr_dtor (zval_ptr=0x7f7dd2131408,
    __zend_filename=0x55a2621cc210 "/home/krist/tmp/php-7.3.2/Zend/zend_hash.c", __zend_lineno=1487)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.h:44
#18 0x000055a26197c034 in zend_array_destroy (ht=0x7f7dd213b4e0)
    at /home/krist/tmp/php-7.3.2/Zend/zend_hash.c:1487
#19 0x000055a261961694 in zend_array_destroy_wrapper (arr=0x7f7dd213b4e0)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:90
#20 0x000055a26196151f in rc_dtor_func (p=0x7f7dd213b4e0) at /home/krist/tmp/php-7.3.2/Zend/zend_variables.c:65
#21 0x000055a2619b28e1 in i_zval_ptr_dtor (zval_ptr=0x7f7dd2136238,
    __zend_filename=0x55a2621d13c0 "/home/krist/tmp/php-7.3.2/Zend/zend_objects.c", __zend_lineno=55)
    at /home/krist/tmp/php-7.3.2/Zend/zend_variables.h:44
#22 0x000055a2619b2bbe in zend_object_std_dtor (object=0x7f7dd21361c0)
    at /home/krist/tmp/php-7.3.2/Zend/zend_objects.c:55
#23 0x000055a2619b9b0d in zend_objects_store_free_object_storage (objects=0x55a26237e568 <executor_globals+840>,
    fast_shutdown=0 '\000') at /home/krist/tmp/php-7.3.2/Zend/zend_objects_API.c:118
#24 0x000055a26194ba71 in shutdown_executor () at /home/krist/tmp/php-7.3.2/Zend/zend_execute_API.c:268
#25 0x000055a261963f7d in zend_deactivate () at /home/krist/tmp/php-7.3.2/Zend/zend.c:1104
#26 0x000055a2618ca496 in php_request_shutdown (dummy=0x0) at /home/krist/tmp/php-7.3.2/main/main.c:1926
#27 0x000055a261a52f3b in main (argc=3, argv=0x7ffdbd24e6e8)

I meant the problem goes away when I set "opcache.optimization_level=0" (checked twice , sorry again)

I believe the issue is not in the template, but the code generating the data: https://github.com/vanilla/vanilla/blob/818e6a6dc387dd47a0a9fa78c6899aebf6ba7ecb/plugins/editor/class.editor.plugin.php#L323

For now I have this test case causing memory leaks in opcache:

<?php
function test(int $x) {
    $a = ['a' => 0, 'b' => $x];
    $b = [];
    $b[0] = $a;
    $c = $b[0];
}

SCCP value dump:

    #5.X4 = null
    #6.X4 = partial ["a" => int(0)]
    #7.CV1($a) = partial ["a" => int(0)]
    #8.CV2($b) = []
    #9.CV2($b) = [0 => zval(type=253)]
    #10.X4 = partial ["a" => int(0)]
    #11.CV3($c) = partial ["a" => int(0)]

And importantly, we end up embedding #9.CV2($b) as a literal -- but of course nothing will be able to handle the partial array it contains, as this is an SCCP only concept.

Two possible ways to fix: Either we can check recursively for partial arrays when replacing constants, or we can mark arrays as partial if they contain partial arrays. Not totally sure, but I think the latter is required for correctness in other cases as well. In particular we assume that for non-partial arrays a constant lattice value can only lower to overdetermined, while in the case where it contains a partial array it could lower to another, different constant value.

Can you please confirm whether this fixes the issue you're seeing? I've fixed *something* here, but I'm not sure if this is also what was causing the problem, or just an unrelated problem.

Yes, it does indeed fix the issue! Thanks a lot!