Fix some refcounter issues

[roman-khimov]

Thanks @ixje for spotting these.

[codecov]

Codecov Report

Merging #2498 (18d627e) into master (d2dcdec) will increase coverage by 0.06%.
The diff coverage is 100.00%.

❗ Current head 18d627e differs from pull request most recent head 0d93b35. Consider uploading reports for the commit 0d93b35 to get more accurate results

@@            Coverage Diff             @@
##           master    #2498      +/-   ##
==========================================
+ Coverage   85.09%   85.15%   +0.06%     
==========================================
  Files         293      294       +1     
  Lines       36923    36945      +22     
==========================================
+ Hits        31418    31460      +42     
+ Misses       4187     4165      -22     
- Partials     1318     1320       +2     

Impacted Files	Coverage Δ
pkg/vm/ref_counter.go	100.00% <100.00%> (ø)
pkg/vm/vm.go	94.54% <100.00%> (+0.02%)	⬆️
pkg/network/server.go	74.11% <0.00%> (-0.10%)	⬇️
cli/input/readpass_unix.go	0.00% <0.00%> (ø)
pkg/services/oracle/request.go	63.01% <0.00%> (+5.02%)	⬆️
cli/input/input.go	62.16% <0.00%> (+10.94%)	⬆️
pkg/services/oracle/oracle.go	88.37% <0.00%> (+15.50%)	⬆️

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 81fa751...0d93b35. Read the comment docs.

[ixje]

I think there might be an issue with circular references as well. I'll try to verify and otherwise provide an example.

[ixje]

Here's a test to reproduce the issue

func TestCircularRefs(t *testing.T) {
	h := "560110c34a4acf4a10c36058cf5810c34ecf10c34ecf58cf0b604a11d2"
	prog, err := hex.DecodeString(h)
	require.NoError(t, err)
	vm := load(prog)
	vm.Run()
	assert.Equal(t, 3, vm.refs)
}

This script comes from here https://github.com/neo-project/neo-vm/blob/master/tests/neo-vm.Tests/UtReferenceCounter.cs#L14-L41. The format of the comments in that file is {<evaluation stack contents>} | {<static field slot contents>}: <engine reference count>. fwiw; the right side of the evaluation stack is the top
So this

//{A[],A[]}|{null}:3

means 2 array items in the evaluation stack, 1 null stack item in the staticfields slot, total ref count of 3.

---

The last opcode is REMOVE which removes array B from this setup

{A[A,B[C[D[B]]]],A[A,B],1}|{null}:9

The problem is with B containing itself, therefore the rc of B will always remain > 0 and it won't decrease the count for the internal elements that are discarded.

---

I don't think this scenario is very realistic on chain, but you might want to solve it regardless of that. The implication I see is that the max stack items limit might be reached sooner than the C# VM.

[roman-khimov]

Moved that to #2500 and merging this one as is.