Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/zend_objects_API.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine                                                          |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 2.00 of the Zend license,     |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | http://www.zend.com/license/2_00.txt.                                |
11
   | If you did not receive a copy of the Zend license and are unable to  |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@zend.com so we can mail you a copy immediately.              |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Dmitry Stogov <dmitry@php.net>                              |
18
   +----------------------------------------------------------------------+
19
*/
20
21
#include "zend.h"
22
#include "zend_globals.h"
23
#include "zend_variables.h"
24
#include "zend_API.h"
25
#include "zend_objects_API.h"
26
#include "zend_fibers.h"
27
28
ZEND_API void ZEND_FASTCALL zend_objects_store_init(zend_objects_store *objects, uint32_t init_size)
29
300k
{
30
300k
  objects->object_buckets = (zend_object **) emalloc(init_size * sizeof(zend_object*));
31
300k
  objects->top = 1; /* Skip 0 so that handles are true */
32
300k
  objects->size = init_size;
33
300k
  objects->free_list_head = -1;
34
300k
  memset(&objects->object_buckets[0], 0, sizeof(zend_object*));
35
300k
}
36
37
ZEND_API void ZEND_FASTCALL zend_objects_store_destroy(zend_objects_store *objects)
38
300k
{
39
300k
  efree(objects->object_buckets);
40
300k
  objects->object_buckets = NULL;
41
300k
}
42
43
ZEND_API void ZEND_FASTCALL zend_objects_store_call_destructors(zend_objects_store *objects)
44
297k
{
45
297k
  EG(flags) |= EG_FLAGS_OBJECT_STORE_NO_REUSE;
46
297k
  if (objects->top > 1) {
47
228k
    uint32_t i;
48
3.77M
    for (i = 1; i < objects->top; i++) {
49
3.54M
      zend_object *obj = objects->object_buckets[i];
50
3.54M
      if (IS_OBJ_VALID(obj)) {
51
31.5k
        if (!(OBJ_FLAGS(obj) & IS_OBJ_DESTRUCTOR_CALLED)) {
52
25.9k
          GC_ADD_FLAGS(obj, IS_OBJ_DESTRUCTOR_CALLED);
53
54
25.9k
          if (obj->handlers->dtor_obj != zend_objects_destroy_object
55
25.9k
              || obj->ce->destructor) {
56
2.46k
            GC_ADDREF(obj);
57
2.46k
            obj->handlers->dtor_obj(obj);
58
2.46k
            GC_DELREF(obj);
59
2.46k
          }
60
25.9k
        }
61
31.5k
      }
62
3.54M
    }
63
228k
  }
64
297k
}
65
66
ZEND_API void ZEND_FASTCALL zend_objects_store_mark_destructed(zend_objects_store *objects)
67
10.5k
{
68
10.5k
  if (objects->object_buckets && objects->top > 1) {
69
3.16k
    zend_object **obj_ptr = objects->object_buckets + 1;
70
3.16k
    zend_object **end = objects->object_buckets + objects->top;
71
72
570k
    do {
73
570k
      zend_object *obj = *obj_ptr;
74
75
570k
      if (IS_OBJ_VALID(obj)) {
76
567k
        GC_ADD_FLAGS(obj, IS_OBJ_DESTRUCTOR_CALLED);
77
567k
      }
78
570k
      obj_ptr++;
79
570k
    } while (obj_ptr != end);
80
3.16k
  }
81
10.5k
}
82
83
ZEND_API void ZEND_FASTCALL zend_objects_store_free_object_storage(zend_objects_store *objects, bool fast_shutdown)
84
300k
{
85
300k
  zend_object **obj_ptr, **end, *obj;
86
87
300k
  if (objects->top <= 1) {
88
68.9k
    return;
89
68.9k
  }
90
91
  /* Free object contents, but don't free objects themselves, so they show up as leaks.
92
   * Also add a ref to all objects, so the object can't be freed by something else later. */
93
231k
  end = objects->object_buckets + 1;
94
231k
  obj_ptr = objects->object_buckets + objects->top;
95
96
231k
  if (fast_shutdown) {
97
0
    do {
98
0
      obj_ptr--;
99
0
      obj = *obj_ptr;
100
0
      if (IS_OBJ_VALID(obj)) {
101
0
        if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
102
0
          GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
103
0
          if (obj->handlers->free_obj != zend_object_std_dtor) {
104
0
            GC_ADDREF(obj);
105
0
            obj->handlers->free_obj(obj);
106
0
          }
107
0
        }
108
0
      }
109
0
    } while (obj_ptr != end);
110
231k
  } else {
111
4.10M
    do {
112
4.10M
      obj_ptr--;
113
4.10M
      obj = *obj_ptr;
114
4.10M
      if (IS_OBJ_VALID(obj)) {
115
581k
        if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
116
581k
          GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
117
581k
          GC_ADDREF(obj);
118
581k
          obj->handlers->free_obj(obj);
119
581k
        }
120
581k
      }
121
4.10M
    } while (obj_ptr != end);
122
231k
  }
123
231k
}
124
125
126
/* Store objects API */
127
static ZEND_COLD zend_never_inline void ZEND_FASTCALL zend_objects_store_put_cold(zend_object *object)
128
575
{
129
575
  int handle;
130
575
  uint32_t new_size = 2 * EG(objects_store).size;
131
132
575
  EG(objects_store).object_buckets = (zend_object **) erealloc(EG(objects_store).object_buckets, new_size * sizeof(zend_object*));
133
  /* Assign size after realloc, in case it fails */
134
575
  EG(objects_store).size = new_size;
135
575
  handle = EG(objects_store).top++;
136
575
  object->handle = handle;
137
575
  EG(objects_store).object_buckets[handle] = object;
138
575
}
139
140
ZEND_API void ZEND_FASTCALL zend_objects_store_put(zend_object *object)
141
5.40M
{
142
5.40M
  int handle;
143
144
  /* When in shutdown sequence - do not reuse previously freed handles, to make sure
145
   * the dtors for newly created objects are called in zend_objects_store_call_destructors() loop
146
   */
147
5.40M
  if (EG(objects_store).free_list_head != -1 && EXPECTED(!(EG(flags) & EG_FLAGS_OBJECT_STORE_NO_REUSE))) {
148
1.29M
    handle = EG(objects_store).free_list_head;
149
1.29M
    EG(objects_store).free_list_head = GET_OBJ_BUCKET_NUMBER(EG(objects_store).object_buckets[handle]);
150
4.10M
  } else if (UNEXPECTED(EG(objects_store).top == EG(objects_store).size)) {
151
575
    zend_objects_store_put_cold(object);
152
575
    return;
153
4.10M
  } else {
154
4.10M
    handle = EG(objects_store).top++;
155
4.10M
  }
156
5.40M
  object->handle = handle;
157
5.40M
  EG(objects_store).object_buckets[handle] = object;
158
5.40M
}
159
160
ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object *object) /* {{{ */
161
5.05M
{
162
5.05M
  ZEND_ASSERT(GC_REFCOUNT(object) == 0);
163
164
  /* GC might have released this object already. */
165
5.05M
  if (UNEXPECTED(GC_TYPE(object) == IS_NULL)) {
166
1.18k
    return;
167
1.18k
  }
168
169
  /*  Make sure we hold a reference count during the destructor call
170
    otherwise, when the destructor ends the storage might be freed
171
    when the refcount reaches 0 a second time
172
   */
173
5.05M
  if (!(OBJ_FLAGS(object) & IS_OBJ_DESTRUCTOR_CALLED)) {
174
4.13M
    GC_ADD_FLAGS(object, IS_OBJ_DESTRUCTOR_CALLED);
175
176
4.13M
    if (object->handlers->dtor_obj != zend_objects_destroy_object
177
4.13M
        || object->ce->destructor) {
178
289k
      GC_SET_REFCOUNT(object, 1);
179
289k
      object->handlers->dtor_obj(object);
180
289k
      GC_DELREF(object);
181
289k
    }
182
4.13M
  }
183
184
5.05M
  if (GC_REFCOUNT(object) == 0) {
185
4.77M
    uint32_t handle = object->handle;
186
4.77M
    void *ptr;
187
188
4.77M
    ZEND_ASSERT(EG(objects_store).object_buckets != NULL);
189
4.77M
    ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[handle]));
190
4.77M
    EG(objects_store).object_buckets[handle] = SET_OBJ_INVALID(object);
191
4.77M
    if (!(OBJ_FLAGS(object) & IS_OBJ_FREE_CALLED)) {
192
4.77M
      GC_ADD_FLAGS(object, IS_OBJ_FREE_CALLED);
193
4.77M
      GC_SET_REFCOUNT(object, 1);
194
4.77M
      object->handlers->free_obj(object);
195
4.77M
    }
196
4.77M
    ptr = ((char*)object) - object->handlers->offset;
197
4.77M
    GC_REMOVE_FROM_BUFFER(object);
198
4.77M
    efree(ptr);
199
4.77M
    ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(handle);
200
4.77M
  }
201
5.05M
}
202
/* }}} */
203
204
ZEND_API ZEND_COLD zend_property_info *zend_get_property_info_for_slot_slow(zend_object *obj, zval *slot)
205
116
{
206
116
  uintptr_t offset = OBJ_PROP_SLOT_TO_OFFSET(obj, slot);
207
116
  zend_property_info *prop_info;
208
464
  ZEND_HASH_MAP_FOREACH_PTR(&obj->ce->properties_info, prop_info) {
209
464
    if (prop_info->offset == offset) {
210
116
      return prop_info;
211
116
    }
212
464
  } ZEND_HASH_FOREACH_END();
213
0
  return NULL;
214
116
}