Coverage Report

Created: 2026-07-25 06:39

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/zend_objects.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine                                                          |
4
   +----------------------------------------------------------------------+
5
   | Copyright © Zend Technologies Ltd., a subsidiary company of          |
6
   |     Perforce Software, Inc., and Contributors.                       |
7
   +----------------------------------------------------------------------+
8
   | This source file is subject to the Modified BSD License that is      |
9
   | bundled with this package in the file LICENSE, and is available      |
10
   | through the World Wide Web at <https://www.php.net/license/>.        |
11
   |                                                                      |
12
   | SPDX-License-Identifier: BSD-3-Clause                                |
13
   +----------------------------------------------------------------------+
14
   | Authors: Andi Gutmans <andi@php.net>                                 |
15
   |          Zeev Suraski <zeev@php.net>                                 |
16
   |          Dmitry Stogov <dmitry@php.net>                              |
17
   +----------------------------------------------------------------------+
18
*/
19
20
#include "zend.h"
21
#include "zend_globals.h"
22
#include "zend_variables.h"
23
#include "zend_API.h"
24
#include "zend_interfaces.h"
25
#include "zend_exceptions.h"
26
#include "zend_weakrefs.h"
27
#include "zend_lazy_objects.h"
28
29
static zend_always_inline void _zend_object_std_init(zend_object *object, zend_class_entry *ce)
30
3.29M
{
31
3.29M
  GC_SET_REFCOUNT(object, 1);
32
3.29M
  GC_TYPE_INFO(object) = GC_OBJECT;
33
3.29M
  object->ce = ce;
34
3.29M
  object->extra_flags = 0;
35
3.29M
  object->handlers = ce->default_object_handlers;
36
3.29M
  object->properties = NULL;
37
3.29M
  zend_objects_store_put(object);
38
3.29M
  if (UNEXPECTED(ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
39
228k
    zval *guard_value = object->properties_table + object->ce->default_properties_count;
40
228k
    ZVAL_UNDEF(guard_value);
41
228k
    Z_GUARD_P(guard_value) = 0;
42
228k
  }
43
3.29M
}
44
45
ZEND_API void ZEND_FASTCALL zend_object_std_init(zend_object *object, zend_class_entry *ce)
46
995k
{
47
995k
  _zend_object_std_init(object, ce);
48
995k
}
49
50
void zend_object_dtor_dynamic_properties(zend_object *object)
51
3.28M
{
52
3.28M
  if (object->properties) {
53
626k
    if (EXPECTED(!(GC_FLAGS(object->properties) & IS_ARRAY_IMMUTABLE))) {
54
626k
      if (EXPECTED(GC_DELREF(object->properties) == 0)
55
625k
          && EXPECTED(GC_TYPE(object->properties) != IS_NULL)) {
56
625k
        zend_array_destroy(object->properties);
57
625k
      }
58
626k
    }
59
626k
  }
60
3.28M
}
61
62
void zend_object_dtor_property(zend_object *object, zval *p)
63
6.45M
{
64
6.45M
  if (Z_REFCOUNTED_P(p)) {
65
2.69M
    if (UNEXPECTED(Z_ISREF_P(p)) &&
66
29.6k
        (ZEND_DEBUG || ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(p)))) {
67
29.6k
      zend_property_info *prop_info = zend_get_property_info_for_slot_self(object, p);
68
29.6k
      if (ZEND_TYPE_IS_SET(prop_info->type)) {
69
28.9k
        ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(p), prop_info);
70
28.9k
      }
71
29.6k
    }
72
2.69M
    i_zval_ptr_dtor(p);
73
2.69M
  }
74
6.45M
}
75
76
ZEND_API void zend_object_std_dtor(zend_object *object)
77
3.28M
{
78
3.28M
  zval *p, *end;
79
80
3.28M
  if (UNEXPECTED(GC_FLAGS(object) & IS_OBJ_WEAKLY_REFERENCED)) {
81
575
    zend_weakrefs_notify(object);
82
575
  }
83
84
3.28M
  if (UNEXPECTED(zend_object_is_lazy(object))) {
85
1.82k
    zend_lazy_object_del_info(object);
86
1.82k
  }
87
88
3.28M
  zend_object_dtor_dynamic_properties(object);
89
90
3.28M
  p = object->properties_table;
91
3.28M
  if (EXPECTED(object->ce->default_properties_count)) {
92
954k
    end = p + object->ce->default_properties_count;
93
6.45M
    do {
94
6.45M
      zend_object_dtor_property(object, p);
95
6.45M
      p++;
96
6.45M
    } while (p != end);
97
954k
  }
98
99
3.28M
  if (UNEXPECTED(object->ce->ce_flags & ZEND_ACC_USE_GUARDS)) {
100
228k
    if (EXPECTED(Z_TYPE_P(p) == IS_STRING)) {
101
1.33k
      zval_ptr_dtor_str(p);
102
227k
    } else if (Z_TYPE_P(p) == IS_ARRAY) {
103
366
      HashTable *guards;
104
105
366
      guards = Z_ARRVAL_P(p);
106
366
      ZEND_ASSERT(guards != NULL);
107
366
      zend_hash_destroy(guards);
108
366
      FREE_HASHTABLE(guards);
109
366
    }
110
228k
  }
111
3.28M
}
112
113
ZEND_API void zend_objects_destroy_object(zend_object *object)
114
56.3k
{
115
56.3k
  zend_function *destructor = object->ce->destructor;
116
117
56.3k
  if (destructor) {
118
56.3k
    if (UNEXPECTED(zend_object_is_lazy(object))) {
119
164
      return;
120
164
    }
121
122
56.1k
    zend_object *old_exception;
123
56.1k
    const zend_op *old_opline_before_exception = NULL;
124
125
56.1k
    if (destructor->common.fn_flags & (ZEND_ACC_PRIVATE|ZEND_ACC_PROTECTED)) {
126
0
      if (EG(current_execute_data)) {
127
0
        zend_class_entry *scope = zend_get_executed_scope();
128
        /* Ensure that if we're calling a protected or private function, we're allowed to do so. */
129
0
        ZEND_ASSERT(!(destructor->common.fn_flags & ZEND_ACC_PUBLIC));
130
0
        if (!zend_check_method_accessible(destructor, scope)) {
131
0
          zend_throw_error(NULL,
132
0
            "Call to %s %s::__destruct() from %s%s",
133
0
            zend_visibility_string(destructor->common.fn_flags), ZSTR_VAL(object->ce->name),
134
0
            scope ? "scope " : "global scope",
135
0
            scope ? ZSTR_VAL(scope->name) : ""
136
0
          );
137
0
          return;
138
0
        }
139
0
      } else {
140
0
        zend_error(E_WARNING,
141
0
          "Call to %s %s::__destruct() from global scope during shutdown ignored",
142
0
          zend_visibility_string(destructor->common.fn_flags), ZSTR_VAL(object->ce->name));
143
0
        return;
144
0
      }
145
0
    }
146
147
56.1k
    GC_ADDREF(object);
148
149
    /* Make sure that destructors are protected from previously thrown exceptions.
150
     * For example, if an exception was thrown in a function and when the function's
151
     * local variable destruction results in a destructor being called.
152
     */
153
56.1k
    old_exception = NULL;
154
56.1k
    if (EG(exception)) {
155
44.6k
      if (EG(exception) == object) {
156
0
        zend_error_noreturn(E_CORE_ERROR, "Attempt to destruct pending exception");
157
44.6k
      } else {
158
44.6k
        if (EG(current_execute_data)) {
159
14.8k
          if (EG(current_execute_data)->func
160
14.8k
           && ZEND_USER_CODE(EG(current_execute_data)->func->common.type)) {
161
14.7k
            zend_rethrow_exception(EG(current_execute_data));
162
14.7k
          }
163
14.8k
          EG(current_execute_data)->opline = EG(opline_before_exception);
164
14.8k
          old_opline_before_exception = EG(opline_before_exception);
165
14.8k
        }
166
44.6k
        old_exception = EG(exception);
167
44.6k
        EG(exception) = NULL;
168
44.6k
      }
169
44.6k
    }
170
171
56.1k
    zend_call_known_instance_method_with_0_params(destructor, object, NULL);
172
173
56.1k
    if (old_exception) {
174
353
      if (EG(current_execute_data)) {
175
348
        EG(current_execute_data)->opline = EG(exception_op);
176
348
        EG(opline_before_exception) = old_opline_before_exception;
177
348
      }
178
353
      if (EG(exception)) {
179
218
        zend_exception_set_previous(EG(exception), old_exception);
180
218
      } else {
181
135
        EG(exception) = old_exception;
182
135
      }
183
353
    }
184
56.1k
    OBJ_RELEASE(object);
185
56.1k
  }
186
56.3k
}
187
188
ZEND_API zend_object* ZEND_FASTCALL zend_objects_new(zend_class_entry *ce)
189
2.29M
{
190
2.29M
  zend_object *object = emalloc(sizeof(zend_object) + zend_object_properties_size(ce));
191
192
2.29M
  _zend_object_std_init(object, ce);
193
2.29M
  return object;
194
2.29M
}
195
196
ZEND_API void ZEND_FASTCALL zend_objects_clone_members(zend_object *new_object, const zend_object *old_object)
197
1.01k
{
198
1.01k
  bool has_clone_method = old_object->ce->clone != NULL;
199
200
1.01k
  if (old_object->ce->default_properties_count) {
201
449
    const zval *src = old_object->properties_table;
202
449
    zval *dst = new_object->properties_table;
203
449
    const zval *end = src + old_object->ce->default_properties_count;
204
205
855
    do {
206
855
      i_zval_ptr_dtor(dst);
207
855
      ZVAL_COPY_VALUE_PROP(dst, src);
208
855
      zval_add_ref(dst);
209
855
      if (has_clone_method) {
210
        /* Unconditionally add the IS_PROP_REINITABLE flag to avoid a potential cache miss of property_info */
211
211
        Z_PROP_FLAG_P(dst) |= IS_PROP_REINITABLE;
212
211
      }
213
214
855
      if (UNEXPECTED(Z_ISREF_P(dst)) &&
215
7
          (ZEND_DEBUG || ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(dst)))) {
216
7
        zend_property_info *prop_info = zend_get_property_info_for_slot_self(new_object, dst);
217
7
        if (ZEND_TYPE_IS_SET(prop_info->type)) {
218
5
          ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(dst), prop_info);
219
5
        }
220
7
      }
221
855
      src++;
222
855
      dst++;
223
855
    } while (src != end);
224
565
  } else if (old_object->properties && !has_clone_method) {
225
    /* fast copy */
226
188
    if (EXPECTED(old_object->handlers == &std_object_handlers)) {
227
188
      if (EXPECTED(!(GC_FLAGS(old_object->properties) & IS_ARRAY_IMMUTABLE))) {
228
188
        GC_ADDREF(old_object->properties);
229
188
      }
230
188
      new_object->properties = old_object->properties;
231
188
      return;
232
188
    }
233
188
  }
234
235
826
  if (old_object->properties &&
236
36
      EXPECTED(zend_hash_num_elements(old_object->properties))) {
237
36
    zval *prop, new_prop;
238
36
    zend_ulong num_key;
239
36
    zend_string *key;
240
241
36
    if (!new_object->properties) {
242
36
      new_object->properties = zend_new_array(zend_hash_num_elements(old_object->properties));
243
36
      zend_hash_real_init_mixed(new_object->properties);
244
36
    } else {
245
0
      zend_hash_extend(new_object->properties, new_object->properties->nNumUsed + zend_hash_num_elements(old_object->properties), 0);
246
0
    }
247
248
36
    HT_FLAGS(new_object->properties) |=
249
36
      HT_FLAGS(old_object->properties) & HASH_FLAG_HAS_EMPTY_IND;
250
251
166
    ZEND_HASH_MAP_FOREACH_KEY_VAL(old_object->properties, num_key, key, prop) {
252
166
      if (Z_TYPE_P(prop) == IS_INDIRECT) {
253
33
        ZVAL_INDIRECT(&new_prop, new_object->properties_table + (Z_INDIRECT_P(prop) - old_object->properties_table));
254
33
      } else {
255
14
        ZVAL_COPY_VALUE(&new_prop, prop);
256
14
        zval_add_ref(&new_prop);
257
14
      }
258
166
      if (has_clone_method) {
259
        /* Unconditionally add the IS_PROP_REINITABLE flag to avoid a potential cache miss of property_info */
260
42
        Z_PROP_FLAG_P(&new_prop) |= IS_PROP_REINITABLE;
261
42
      }
262
166
      if (EXPECTED(key)) {
263
47
        _zend_hash_append(new_object->properties, key, &new_prop);
264
47
      } else {
265
0
        zend_hash_index_add_new(new_object->properties, num_key, &new_prop);
266
0
      }
267
166
    } ZEND_HASH_FOREACH_END();
268
36
  }
269
270
826
  if (has_clone_method) {
271
235
    zend_call_known_instance_method_with_0_params(new_object->ce->clone, new_object, NULL);
272
273
235
    if (ZEND_CLASS_HAS_READONLY_PROPS(new_object->ce)) {
274
291
      for (uint32_t i = 0; i < new_object->ce->default_properties_count; i++) {
275
158
        zval* prop = OBJ_PROP_NUM(new_object, i);
276
        /* Unconditionally remove the IS_PROP_REINITABLE flag to avoid a potential cache miss of property_info */
277
158
        Z_PROP_FLAG_P(prop) &= ~IS_PROP_REINITABLE;
278
158
      }
279
133
    }
280
235
  }
281
826
}
282
283
ZEND_API zend_object *zend_objects_clone_obj_with(zend_object *old_object, const zend_class_entry *scope, const HashTable *properties)
284
231
{
285
231
  zend_object *new_object = old_object->handlers->clone_obj(old_object);
286
287
231
  if (EXPECTED(!EG(exception))) {
288
    /* Unlock readonly properties once more. */
289
231
    if (ZEND_CLASS_HAS_READONLY_PROPS(new_object->ce)) {
290
75
      for (uint32_t i = 0; i < new_object->ce->default_properties_count; i++) {
291
50
        zval* prop = OBJ_PROP_NUM(new_object, i);
292
50
        Z_PROP_FLAG_P(prop) |= IS_PROP_REINITABLE;
293
50
      }
294
25
    }
295
296
231
    const zend_class_entry *old_scope = EG(fake_scope);
297
298
231
    EG(fake_scope) = scope;
299
300
1.06k
    ZEND_HASH_FOREACH_KEY_VAL(properties, zend_ulong num_key, zend_string *key, zval *val) {
301
1.06k
      if (UNEXPECTED(Z_ISREF_P(val))) {
302
10
        if (Z_REFCOUNT_P(val) == 1) {
303
5
          val = Z_REFVAL_P(val);
304
5
        } else {
305
5
          zend_throw_error(NULL, "Cannot assign by reference when cloning with updated properties");
306
5
          break;
307
5
        }
308
10
      }
309
310
414
      if (UNEXPECTED(key == NULL)) {
311
33
        key = zend_long_to_str(num_key);
312
33
        new_object->handlers->write_property(new_object, key, val, NULL);
313
33
        zend_string_release_ex(key, false);
314
381
      } else {
315
381
        new_object->handlers->write_property(new_object, key, val, NULL);
316
381
      }
317
318
414
      if (UNEXPECTED(EG(exception))) {
319
61
        break;
320
61
      }
321
414
    } ZEND_HASH_FOREACH_END();
322
323
231
    EG(fake_scope) = old_scope;
324
325
    /* Lock readonly properties once more. */
326
231
    if (ZEND_CLASS_HAS_READONLY_PROPS(new_object->ce)) {
327
75
      for (uint32_t i = 0; i < new_object->ce->default_properties_count; i++) {
328
50
        zval* prop = OBJ_PROP_NUM(new_object, i);
329
50
        Z_PROP_FLAG_P(prop) &= ~IS_PROP_REINITABLE;
330
50
      }
331
25
    }
332
231
  }
333
334
231
  return new_object;
335
231
}
336
337
ZEND_API zend_object *zend_objects_clone_obj(zend_object *old_object)
338
1.07k
{
339
1.07k
  zend_object *new_object;
340
341
1.07k
  if (UNEXPECTED(zend_object_is_lazy(old_object))) {
342
80
    return zend_lazy_object_clone(old_object);
343
80
  }
344
345
  /* assume that create isn't overwritten, so when clone depends on the
346
   * overwritten one then it must itself be overwritten */
347
999
  new_object = zend_objects_new(old_object->ce);
348
349
  /* zend_objects_clone_members() expect the properties to be initialized. */
350
999
  if (new_object->ce->default_properties_count) {
351
449
    zval *p = new_object->properties_table;
352
449
    zval *end = p + new_object->ce->default_properties_count;
353
855
    do {
354
855
      ZVAL_UNDEF(p);
355
855
      p++;
356
855
    } while (p != end);
357
449
  }
358
359
999
  zend_objects_clone_members(new_object, old_object);
360
361
999
  return new_object;
362
1.07k
}