/src/php-src/Zend/zend_objects_API.c

Source
/*
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
   | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
   | available through the world-wide-web at the following url:           |
   | http://www.zend.com/license/2_00.txt.                                |
   | If you did not receive a copy of the Zend license and are unable to  |
   | obtain it through the world-wide-web, please send a note to          |
   | license@zend.com so we can mail you a copy immediately.              |
   +----------------------------------------------------------------------+
   | Authors: Andi Gutmans <andi@php.net>                                 |
   |          Zeev Suraski <zeev@php.net>                                 |
   |          Dmitry Stogov <dmitry@php.net>                              |
   +----------------------------------------------------------------------+
*/

#include "zend.h"
#include "zend_globals.h"
#include "zend_variables.h"
#include "zend_API.h"
#include "zend_objects_API.h"
#include "zend_fibers.h"

ZEND_API void ZEND_FASTCALL zend_objects_store_init(zend_objects_store *objects, uint32_t init_size)
{
  objects->object_buckets = (zend_object **) emalloc(init_size * sizeof(zend_object*));
  objects->top = 1; /* Skip 0 so that handles are true */
  objects->size = init_size;
  objects->free_list_head = -1;
  memset(&objects->object_buckets[0], 0, sizeof(zend_object*));
}

ZEND_API void ZEND_FASTCALL zend_objects_store_destroy(zend_objects_store *objects)
{
  efree(objects->object_buckets);
  objects->object_buckets = NULL;
}

ZEND_API void ZEND_FASTCALL zend_objects_store_call_destructors(zend_objects_store *objects)
{
  EG(flags) |= EG_FLAGS_OBJECT_STORE_NO_REUSE;
  if (objects->top > 1) {
    uint32_t i;
    for (i = 1; i < objects->top; i++) {
      zend_object *obj = objects->object_buckets[i];
      if (IS_OBJ_VALID(obj)) {
        if (!(OBJ_FLAGS(obj) & IS_OBJ_DESTRUCTOR_CALLED)) {
          GC_ADD_FLAGS(obj, IS_OBJ_DESTRUCTOR_CALLED);

          if (obj->handlers->dtor_obj != zend_objects_destroy_object
              || obj->ce->destructor) {
            GC_ADDREF(obj);
            obj->handlers->dtor_obj(obj);
            GC_DELREF(obj);
          }
        }
      }
    }
  }
}

ZEND_API void ZEND_FASTCALL zend_objects_store_mark_destructed(zend_objects_store *objects)
{
  if (objects->object_buckets && objects->top > 1) {
    zend_object **obj_ptr = objects->object_buckets + 1;
    zend_object **end = objects->object_buckets + objects->top;

    do {
      zend_object *obj = *obj_ptr;

      if (IS_OBJ_VALID(obj)) {
        GC_ADD_FLAGS(obj, IS_OBJ_DESTRUCTOR_CALLED);
      }
      obj_ptr++;
    } while (obj_ptr != end);
  }
}

ZEND_API void ZEND_FASTCALL zend_objects_store_free_object_storage(zend_objects_store *objects, bool fast_shutdown)
{
  zend_object **obj_ptr, **end, *obj;

  if (objects->top <= 1) {
    return;
  }

  /* Free object contents, but don't free objects themselves, so they show up as leaks.
   * Also add a ref to all objects, so the object can't be freed by something else later. */
  end = objects->object_buckets + 1;
  obj_ptr = objects->object_buckets + objects->top;

  if (fast_shutdown) {
    do {
      obj_ptr--;
      obj = *obj_ptr;
      if (IS_OBJ_VALID(obj)) {
        if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
          GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
          if (obj->handlers->free_obj != zend_object_std_dtor
           || (OBJ_FLAGS(obj) & IS_OBJ_WEAKLY_REFERENCED)
          ) {
            GC_ADDREF(obj);
            obj->handlers->free_obj(obj);
          }
        }
      }
    } while (obj_ptr != end);
  } else {
    do {
      obj_ptr--;
      obj = *obj_ptr;
      if (IS_OBJ_VALID(obj)) {
        if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
          GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
          GC_ADDREF(obj);
          obj->handlers->free_obj(obj);
        }
      }
    } while (obj_ptr != end);
  }
}


/* Store objects API */
static ZEND_COLD zend_never_inline void ZEND_FASTCALL zend_objects_store_put_cold(zend_object *object)
{
  int handle;
  uint32_t new_size = 2 * EG(objects_store).size;

  EG(objects_store).object_buckets = (zend_object **) erealloc(EG(objects_store).object_buckets, new_size * sizeof(zend_object*));
  /* Assign size after realloc, in case it fails */
  EG(objects_store).size = new_size;
  handle = EG(objects_store).top++;
  object->handle = handle;
  EG(objects_store).object_buckets[handle] = object;
}

ZEND_API void ZEND_FASTCALL zend_objects_store_put(zend_object *object)
{
  int handle;

  /* When in shutdown sequence - do not reuse previously freed handles, to make sure
   * the dtors for newly created objects are called in zend_objects_store_call_destructors() loop
   */
  if (EG(objects_store).free_list_head != -1 && EXPECTED(!(EG(flags) & EG_FLAGS_OBJECT_STORE_NO_REUSE))) {
    handle = EG(objects_store).free_list_head;
    EG(objects_store).free_list_head = GET_OBJ_BUCKET_NUMBER(EG(objects_store).object_buckets[handle]);
  } else if (UNEXPECTED(EG(objects_store).top == EG(objects_store).size)) {
    zend_objects_store_put_cold(object);
    return;
  } else {
    handle = EG(objects_store).top++;
  }
  object->handle = handle;
  EG(objects_store).object_buckets[handle] = object;
}

ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object *object) /* {{{ */
{
  ZEND_ASSERT(GC_REFCOUNT(object) == 0);

  /* GC might have released this object already. */
  if (UNEXPECTED(GC_TYPE(object) == IS_NULL)) {
    return;
  }

  /*  Make sure we hold a reference count during the destructor call
    otherwise, when the destructor ends the storage might be freed
    when the refcount reaches 0 a second time
   */
  if (!(OBJ_FLAGS(object) & IS_OBJ_DESTRUCTOR_CALLED)) {
    GC_ADD_FLAGS(object, IS_OBJ_DESTRUCTOR_CALLED);

    if (object->handlers->dtor_obj != zend_objects_destroy_object
        || object->ce->destructor) {
      GC_SET_REFCOUNT(object, 1);
      object->handlers->dtor_obj(object);
      GC_DELREF(object);
    }
  }

  if (GC_REFCOUNT(object) == 0) {
    uint32_t handle = object->handle;
    void *ptr;

    ZEND_ASSERT(EG(objects_store).object_buckets != NULL);
    ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[handle]));
    EG(objects_store).object_buckets[handle] = SET_OBJ_INVALID(object);
    if (!(OBJ_FLAGS(object) & IS_OBJ_FREE_CALLED)) {
      GC_ADD_FLAGS(object, IS_OBJ_FREE_CALLED);
      GC_SET_REFCOUNT(object, 1);
      object->handlers->free_obj(object);
    }
    ptr = ((char*)object) - object->handlers->offset;
    GC_REMOVE_FROM_BUFFER(object);
    efree(ptr);
    ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(handle);
  }
}
/* }}} */

ZEND_API ZEND_COLD zend_property_info *zend_get_property_info_for_slot_slow(zend_object *obj, zval *slot)
{
  uintptr_t offset = OBJ_PROP_SLOT_TO_OFFSET(obj, slot);
  zend_property_info *prop_info;
  ZEND_HASH_MAP_FOREACH_PTR(&obj->ce->properties_info, prop_info) {
    if (prop_info->offset == offset) {
      return prop_info;
    }
  } ZEND_HASH_FOREACH_END();
  return NULL;
}

Coverage Report

Created: 2025-12-14 06:10

Line	Count	Source
1		/*
2		+----------------------------------------------------------------------+
3		\| Zend Engine \|
4		+----------------------------------------------------------------------+
5		\| Copyright (c) Zend Technologies Ltd. (http://www.zend.com) \|
6		+----------------------------------------------------------------------+
7		\| This source file is subject to version 2.00 of the Zend license, \|
8		\| that is bundled with this package in the file LICENSE, and is \|
9		\| available through the world-wide-web at the following url: \|
10		\| http://www.zend.com/license/2_00.txt. \|
11		\| If you did not receive a copy of the Zend license and are unable to \|
12		\| obtain it through the world-wide-web, please send a note to \|
13		\| license@zend.com so we can mail you a copy immediately. \|
14		+----------------------------------------------------------------------+
15		\| Authors: Andi Gutmans <andi@php.net> \|
16		\| Zeev Suraski <zeev@php.net> \|
17		\| Dmitry Stogov <dmitry@php.net> \|
18		+----------------------------------------------------------------------+
19		*/
20
21		#include "zend.h"
22		#include "zend_globals.h"
23		#include "zend_variables.h"
24		#include "zend_API.h"
25		#include "zend_objects_API.h"
26		#include "zend_fibers.h"
27
28		ZEND_API void ZEND_FASTCALL zend_objects_store_init(zend_objects_store *objects, uint32_t init_size)
29	306k	{
30	306k	objects->object_buckets = (zend_object *) emalloc(init_size sizeof(zend_object*));
31	306k	objects->top = 1; /* Skip 0 so that handles are true */
32	306k	objects->size = init_size;
33	306k	objects->free_list_head = -1;
34	306k	memset(&objects->object_buckets[0], 0, sizeof(zend_object*));
35	306k	}
36
37		ZEND_API void ZEND_FASTCALL zend_objects_store_destroy(zend_objects_store *objects)
38	306k	{
39	306k	efree(objects->object_buckets);
40	306k	objects->object_buckets = NULL;
41	306k	}
42
43		ZEND_API void ZEND_FASTCALL zend_objects_store_call_destructors(zend_objects_store *objects)
44	306k	{
45	306k	EG(flags) \|= EG_FLAGS_OBJECT_STORE_NO_REUSE;
46	306k	if (objects->top > 1) {
47	198k	uint32_t i;
48	3.65M	for (i = 1; i < objects->top; i++) {
49	3.45M	zend_object *obj = objects->object_buckets[i];
50	3.45M	if (IS_OBJ_VALID(obj)) {
51	35.9k	if (!(OBJ_FLAGS(obj) & IS_OBJ_DESTRUCTOR_CALLED)) {
52	30.3k	GC_ADD_FLAGS(obj, IS_OBJ_DESTRUCTOR_CALLED);
53
54	30.3k	if (obj->handlers->dtor_obj != zend_objects_destroy_object
55	28.4k	\|\| obj->ce->destructor) {
56	2.83k	GC_ADDREF(obj);
57	2.83k	obj->handlers->dtor_obj(obj);
58	2.83k	GC_DELREF(obj);
59	2.83k	}
60	30.3k	}
61	35.9k	}
62	3.45M	}
63	198k	}
64	306k	}
65
66		ZEND_API void ZEND_FASTCALL zend_objects_store_mark_destructed(zend_objects_store *objects)
67	9.02k	{
68	9.02k	if (objects->object_buckets && objects->top > 1) {
69	1.13k	zend_object **obj_ptr = objects->object_buckets + 1;
70	1.13k	zend_object **end = objects->object_buckets + objects->top;
71
72	97.8k	do {
73	97.8k	zend_object obj = obj_ptr;
74
75	97.8k	if (IS_OBJ_VALID(obj)) {
76	95.7k	GC_ADD_FLAGS(obj, IS_OBJ_DESTRUCTOR_CALLED);
77	95.7k	}
78	97.8k	obj_ptr++;
79	97.8k	} while (obj_ptr != end);
80	1.13k	}
81	9.02k	}
82
83		ZEND_API void ZEND_FASTCALL zend_objects_store_free_object_storage(zend_objects_store *objects, bool fast_shutdown)
84	306k	{
85	306k	zend_object obj_ptr, end, *obj;
86
87	306k	if (objects->top <= 1) {
88	108k	return;
89	108k	}
90
91		/* Free object contents, but don't free objects themselves, so they show up as leaks.
92		* Also add a ref to all objects, so the object can't be freed by something else later. */
93	198k	end = objects->object_buckets + 1;
94	198k	obj_ptr = objects->object_buckets + objects->top;
95
96	198k	if (fast_shutdown) {
97	0	do {
98	0	obj_ptr--;
99	0	obj = *obj_ptr;
100	0	if (IS_OBJ_VALID(obj)) {
101	0	if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
102	0	GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
103	0	if (obj->handlers->free_obj != zend_object_std_dtor
104	0	\|\| (OBJ_FLAGS(obj) & IS_OBJ_WEAKLY_REFERENCED)
105	0	) {
106	0	GC_ADDREF(obj);
107	0	obj->handlers->free_obj(obj);
108	0	}
109	0	}
110	0	}
111	0	} while (obj_ptr != end);
112	198k	} else {
113	3.55M	do {
114	3.55M	obj_ptr--;
115	3.55M	obj = *obj_ptr;
116	3.55M	if (IS_OBJ_VALID(obj)) {
117	112k	if (!(OBJ_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
118	112k	GC_ADD_FLAGS(obj, IS_OBJ_FREE_CALLED);
119	112k	GC_ADDREF(obj);
120	112k	obj->handlers->free_obj(obj);
121	112k	}
122	112k	}
123	3.55M	} while (obj_ptr != end);
124	198k	}
125	198k	}
126
127
128		/* Store objects API */
129		static ZEND_COLD zend_never_inline void ZEND_FASTCALL zend_objects_store_put_cold(zend_object *object)
130	514	{
131	514	int handle;
132	514	uint32_t new_size = 2 * EG(objects_store).size;
133
134	514	EG(objects_store).object_buckets = (zend_object *) erealloc(EG(objects_store).object_buckets, new_size sizeof(zend_object*));
135		/* Assign size after realloc, in case it fails */
136	514	EG(objects_store).size = new_size;
137	514	handle = EG(objects_store).top++;
138	514	object->handle = handle;
139	514	EG(objects_store).object_buckets[handle] = object;
140	514	}
141
142		ZEND_API void ZEND_FASTCALL zend_objects_store_put(zend_object *object)
143	4.53M	{
144	4.53M	int handle;
145
146		/* When in shutdown sequence - do not reuse previously freed handles, to make sure
147		* the dtors for newly created objects are called in zend_objects_store_call_destructors() loop
148		*/
149	4.53M	if (EG(objects_store).free_list_head != -1 && EXPECTED(!(EG(flags) & EG_FLAGS_OBJECT_STORE_NO_REUSE))) {
150	978k	handle = EG(objects_store).free_list_head;
151	978k	EG(objects_store).free_list_head = GET_OBJ_BUCKET_NUMBER(EG(objects_store).object_buckets[handle]);
152	3.55M	} else if (UNEXPECTED(EG(objects_store).top == EG(objects_store).size)) {
153	514	zend_objects_store_put_cold(object);
154	514	return;
155	3.55M	} else {
156	3.55M	handle = EG(objects_store).top++;
157	3.55M	}
158	4.53M	object->handle = handle;
159	4.53M	EG(objects_store).object_buckets[handle] = object;
160	4.53M	}
161
162		ZEND_API void ZEND_FASTCALL zend_objects_store_del(zend_object object) / {{{ */
163	4.43M	{
164	4.43M	ZEND_ASSERT(GC_REFCOUNT(object) == 0);
165
166		/* GC might have released this object already. */
167	4.43M	if (UNEXPECTED(GC_TYPE(object) == IS_NULL)) {
168	832	return;
169	832	}
170
171		/* Make sure we hold a reference count during the destructor call
172		otherwise, when the destructor ends the storage might be freed
173		when the refcount reaches 0 a second time
174		*/
175	4.43M	if (!(OBJ_FLAGS(object) & IS_OBJ_DESTRUCTOR_CALLED)) {
176	3.84M	GC_ADD_FLAGS(object, IS_OBJ_DESTRUCTOR_CALLED);
177
178	3.84M	if (object->handlers->dtor_obj != zend_objects_destroy_object
179	3.84M	\|\| object->ce->destructor) {
180	55.0k	GC_SET_REFCOUNT(object, 1);
181	55.0k	object->handlers->dtor_obj(object);
182	55.0k	GC_DELREF(object);
183	55.0k	}
184	3.84M	}
185
186	4.43M	if (GC_REFCOUNT(object) == 0) {
187	4.38M	uint32_t handle = object->handle;
188	4.38M	void *ptr;
189
190	4.38M	ZEND_ASSERT(EG(objects_store).object_buckets != NULL);
191	4.38M	ZEND_ASSERT(IS_OBJ_VALID(EG(objects_store).object_buckets[handle]));
192	4.38M	EG(objects_store).object_buckets[handle] = SET_OBJ_INVALID(object);
193	4.38M	if (!(OBJ_FLAGS(object) & IS_OBJ_FREE_CALLED)) {
194	4.38M	GC_ADD_FLAGS(object, IS_OBJ_FREE_CALLED);
195	4.38M	GC_SET_REFCOUNT(object, 1);
196	4.38M	object->handlers->free_obj(object);
197	4.38M	}
198	4.38M	ptr = ((char*)object) - object->handlers->offset;
199	4.38M	GC_REMOVE_FROM_BUFFER(object);
200	4.38M	efree(ptr);
201	4.38M	ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(handle);
202	4.38M	}
203	4.43M	}
204		/* }}} */
205
206		ZEND_API ZEND_COLD zend_property_info zend_get_property_info_for_slot_slow(zend_object obj, zval *slot)
207	160	{
208	160	uintptr_t offset = OBJ_PROP_SLOT_TO_OFFSET(obj, slot);
209	160	zend_property_info *prop_info;
210	640	ZEND_HASH_MAP_FOREACH_PTR(&obj->ce->properties_info, prop_info) {
211	640	if (prop_info->offset == offset) {
212	160	return prop_info;
213	160	}
214	640	} ZEND_HASH_FOREACH_END();
215	0	return NULL;
216	160	}