search
HomeBackend DevelopmentPHP Tutorial深入理解PHP传参原理_PHP教程

深入理解PHP传参原理_PHP教程

Jul 20, 2016 am 11:15 AM
phpDownprincipleparameterexistExpandgo deepunderstandofwritequestionfirst

首先说下今天想到的一个问题。在编写php扩展的时候,似乎参数(即传给zend_parse_parameters的变量)是不需要free的。举例:

<span PHP_FUNCTION(test)
{
    </span><span char</span>*<span   str;
    </span><span int</span><span     str_len;

    </span><span if</span> (zend_parse_parameters(ZEND_NUM_ARGS() TSRMLS_CC, <span "</span><span s</span><span "</span>, &str, &str_len) ==<span  FAILURE) {
        RETURN_FALSE;
    }

    php_printf(str);<br />    <br />    </span><span //</span><span  无需free(str)   </span>
}

运行正常:

test("Hello World"); <span //</span><span  打印Hello World</span>

这里不用担心test函数会发生内存泄露,php会自动帮我们回收这些用于保存参数的变量。

那php究竟是如何做到的呢?要解释这个问题,还是得看php是怎么传递参数的。

EG(argument_stack)简介

简单来讲,在php中的EG中保存了一个专门用于存放参数的栈,名为argument_stack。每当发生函数调用的时候,php会将传入的参数压进EG(argument_stack)。一旦函数调用结束,则EG(argument_stack)被清理,并且等待下一次的函数调用。

关于EG(argument_stack)的struct结构、用途,php5.2和5.3实现有一些区别。本文主要以5.2为例,5.3+的变化后面抽空再说。

上图是5.2中argument_stack的大概示意图,看起来简单明了。其中,栈顶和栈底固定为NULL。函数接收的参数按照从左到右的顺序,依次被压入栈。注意,最后会被额外压入一个long型的值,表示栈里的参数个数(上图中为10)。

那被压入argument_stack的参数究竟是什么呢?其实是一个个zval类型的指针。它们指向的zva有可能是CV变量,有可能是is_ref=1的变量,还有可能是一个常量数字,或者常量字符串。

EG(argument_stack)在php5.2中被具体实现为zend_ptr_stack类型:

typedef <span struct</span><span  _zend_ptr_stack {
    </span><span int</span><span  top;                       // 栈中当前元素的个数
    </span><span int</span><span  max;                       // 栈中最多存放元素的个数
    </span><span void</span> **<span elements;               // 栈底
    </span><span void</span> **<span top_element;            // 栈顶
} zend_ptr_stack;</span>

初始化argument_stack

初始化argument_stack的工作是发生在php处理具体的请求之前,更准确说是处于php解释器的启动过程之中。

在init_executor函数里我们发现如下2行:

zend_ptr_stack_init(&<span EG(argument_stack));
zend_ptr_stack_push(</span>&EG(argument_stack), (<span void</span> *) NULL);

这2行分别代表着,初始化EG(argument_stack),紧接着压入一个NULL。由于EG是个全局变量,因此在实际调用zend_ptr_stack_init之前,EG(argument_stack)中的所有数据全部为0。

zend_ptr_stack_init实现很简单。

ZEND_API <span void</span> zend_ptr_stack_init(zend_ptr_stack *<span stack)
{
    stack</span>->top_element = stack->elements = (<span void</span> **) emalloc(<span sizeof</span>(<span void</span> *)*<span PTR_STACK_BLOCK_SIZE);
    stack</span>->max =<span  PTR_STACK_BLOCK_SIZE;   // 栈的大小被初始化成64
    stack</span>->top = <span 0</span><span ;                      // 当前元素个数为0
}</span>

一旦argument_stack被初始化完,则立即会被压入NULL。这里无须深究,这个NULL其实没有任何的含义。

NULL入栈之后,整个argument_stack的实际内存分布如下:

参数入栈

在压入第一个NULL之后,一旦再有参数入栈,则argument_stack会发生如下动作:

stack->top++<span ;
</span>*(stack->top_element++) =<span  参数;</span>

我们用一段简单的php代码来说明问题:

<span function</span> foo( <span $str</span><span  ){
    </span><span print_r</span>(<span 123</span><span );
}
foo(</span>"hello world");

上述代码在调用foo的时候,传入了一个字符串常量。因此,实际上被压入栈的是一个指向存储“hello world”的zval。用vld来查看编译之后的opcode:

line     # *  op                           fetch          ext  return  operands
---------------------------------------------------------------------------------
   3     0  >   NOP
   6     1      SEND_VAL                                                  OP1[  IS_CONST (458754) 'hello world' ]
         2      DO_FCALL                                      1           OP1[  IS_CONST (458752) 'foo' ]
  15     3    > RETURN                                                    OP1[  IS_CONST (0) 1 ]

SEND_VAL指令实际上做的事情就是将“hello world”压入argument_stack。

<span int</span><span  ZEND_SEND_VAL_SPEC_CONST_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
{
        &hellip;&hellip;</span><span 
        zval </span>*<span valptr, </span>*<span value;

        value </span>= &opline-><span op1.u.constant;
        ALLOC_ZVAL(valptr);
        INIT_PZVAL_COPY(valptr, value);
        </span><span if</span> (!<span 0</span><span ) {
            zval_copy_ctor(valptr);
        }<br /><br />        <span // 入栈,<span valptr</span>指向存放hello world的zval</span>
        zend_ptr_stack_push(</span>&<span EG(argument_stack), valptr);  
<span         &hellip;&hellip;</span>
}</span>

入栈完成之后的argument_stack为:

参数个数

前文说到,实际上并非把所有参数入栈就完事了。php还会额外压入一个数字,表示参数的个数,这个工作并非发生在SEND_XXX指令的时候。实际上,在真正执行函数之前,php会将参数个数入栈。

继续沿用上面的例子,DO_FCALL 指令用于调用foo函数。在调用foo之前,php会自动填入argument_stack最后一块。

<span static</span> <span int</span><span  zend_do_fcall_common_helper_SPEC(ZEND_OPCODE_HANDLER_ARGS)
{
    &hellip;&hellip;
    </span><span //</span><span  在argument_stack中压入2个值
    </span><span //</span><span  一个是参数个数(即opline->extended_value)
    </span><span //</span><span  一个是标识栈顶的NULL</span>
    zend_ptr_stack_2_push(&EG(argument_stack), (<span void</span> *)(zend_uintptr_t)opline-><span extended_value, NULL);
    &hellip;&hellip;
    </span><span if</span> (EX(function_state).function->type ==<span  ZEND_INTERNAL_FUNCTION) {
        &hellip;&hellip;
    }
    </span><span else</span> <span if</span> (EX(function_state).function->type ==<span  ZEND_USER_FUNCTION) {
        &hellip;&hellip;
        </span><span //</span><span  调用foo函数</span>
<span         zend_execute(EG(active_op_array) TSRMLS_CC);
    }
    </span><span else</span> { <span /*</span><span  ZEND_OVERLOADED_FUNCTION </span><span */</span><span 
        &hellip;&hellip;
    }
    &hellip;&hellip;
    </span><span //</span><span  清理<span argument_stack</span></span>
<span     zend_ptr_stack_clear_multiple(TSRMLS_C);
    &hellip;&hellip;
    ZEND_VM_NEXT_OPCODE();
}</span>

压入参数个数和NULL之后,用于foo调用的整个argument_stack已然完成。

获取参数

继续跟进上面的例子。让我们深入到foo函数,看看foo的opcode是什么样子的。

line     # *  op                           fetch          ext  return  operands
---------------------------------------------------------------------------------
   3     0  >   RECV                                                      OP1[  IS_CONST (0) 1 ]
   4     1      SEND_VAL                                                  OP1[  IS_CONST (5) 123 ]
         2      DO_FCALL                                      1           OP1[  IS_CONST (459027) 'print_r' ]
   5     3    > RETURN                                                    OP1[  IS_CONST (0) null ]

第一条指令是RECV,从字面上理解便是用于获取栈中参数的。实际上,SEND_VAL和RECV有点对应的感觉。每次函数调用之前SEND_VAL,在函数内部进行RECV。为什么不说是完全对应,实际上RECV指令并非一定需要。只有当用户定义的函数被调用是,才会产生RECV。我们编写的扩展函数,php自带的内建函数,都不会有RECV。

需要额外指出的是,每次SEND_VAL和RECV 均只能处理一个参数。也就是说如果传参的过程中有多个参数,那么会产生若干SEND_VAL以及若干RECV。这里引出一个很有趣的话题,传入参数和获取参数的顺序是怎样的呢?

答案是,SEND_VAL会将参数从左至右的进行压栈,而RECV一样的从左至右获取参数。

<span static</span> <span int</span><span  ZEND_RECV_SPEC_HANDLER(ZEND_OPCODE_HANDLER_ARGS)
{
    &hellip;&hellip;</span><span //</span><span  param拿参数的顺序是沿着栈顶-->栈底</span>
    <span if</span> (zend_ptr_stack_get_arg(arg_num, (<span void</span> **) &param TSRMLS_CC)==<span FAILURE) {
        &hellip;&hellip;
    } </span><span else</span><span  {
        zend_free_op free_res;
        zval </span>**<span var_ptr;

        </span><span //</span><span  验证参数</span>
        zend_verify_arg_type((zend_function *) EG(active_op_array), arg_num, *<span param TSRMLS_CC);
        var_ptr </span>= get_zval_ptr_ptr(&opline->result, EX(Ts), &<span free_res, BP_VAR_W);
        
        </span><span //</span><span  获取参数</span>
        <span if</span> (PZVAL_IS_REF(*<span param)) {
            zend_assign_to_variable_reference(var_ptr, param TSRMLS_CC);
        } </span><span else</span><span  {
            zend_receive(var_ptr, </span>*<span param TSRMLS_CC);
        }
    }

    ZEND_VM_NEXT_OPCODE();
}</span>

zend_assign_to_variable_reference 和 zend_receive 都会完成“获取参数” 。“获取参数”不太好理解,实际它究竟是做哪些事情呢?

说到底很简单,“获取参数”就是将这个参数添加到当前函数执行期间的“符号表”中,具体对应为EG(current_execute_data)->symbol_table。本示例中,RECV完成之后,函数体内的symbol_table中有了一个符号‘str’,它的值为“hello world”。

但argument_stack并没有发生一丝变化,因为RECV仅仅是读取参数,而不会对栈产生类似pop操作。

清理argument_stack

foo内部的print_r也是一个函数调用,因此也会产生压栈-->清栈的操作。因此print_r执行之前的argument_stack为:

print_r执行之后argument_stack又回到了foo刚RECV完的状态。

具体调用print_r的过程并非本文阐述的重点。我们关心的是当调用foo结束之后,php是如何清理argument_stack的。

上面展示的do_fcall代码片段中可以看出,清理工作由

<span static</span> inline <span void</span><span  zend_ptr_stack_clear_multiple(TSRMLS_D)
{
    </span><span void</span> **p = EG(argument_stack).top_element-<span 2</span><span ;
    </span><span //</span><span  取栈顶保存的参数个数</span>
    <span int</span> delete_count = (<span int</span>)(zend_uintptr_t) *<span p; 
    EG(argument_stack).top </span>-= (delete_count+<span 2</span><span );
    
    </span><span //</span><span  从上至下,依次清理</span>
    <span while</span> (--delete_count>=<span 0</span><span ) {
        zval </span>*q = *(zval **)(--<span p);
        </span>*p =<span  NULL;
        zval_ptr_dtor(</span>&<span q);
    }
    EG(argument_stack).top_element </span>=<span  p;
}</span>

注意这里清理栈中zval指针,使用的是zval_ptr_dtor。zval_ptr_dtor会将refcount减1,一旦refcount减为0,则保存该变量的内存区域会被真正的回收掉。

在本文示例中,foo调用完毕之后,保存“hello world”的zval状态为:

value        "hello world"
refcount     1
type         6
is_ref       0

由于refcount只剩1,因此,zval_ptr_dtor会将“hello world”真正从内存中销毁。

消栈完毕之后的argument_stack内存状态为:

深入理解PHP传参原理_PHP教程

Statement
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
PHP and Python: Different Paradigms ExplainedPHP and Python: Different Paradigms ExplainedApr 18, 2025 am 12:26 AM

PHP is mainly procedural programming, but also supports object-oriented programming (OOP); Python supports a variety of paradigms, including OOP, functional and procedural programming. PHP is suitable for web development, and Python is suitable for a variety of applications such as data analysis and machine learning.

PHP and Python: A Deep Dive into Their HistoryPHP and Python: A Deep Dive into Their HistoryApr 18, 2025 am 12:25 AM

PHP originated in 1994 and was developed by RasmusLerdorf. It was originally used to track website visitors and gradually evolved into a server-side scripting language and was widely used in web development. Python was developed by Guidovan Rossum in the late 1980s and was first released in 1991. It emphasizes code readability and simplicity, and is suitable for scientific computing, data analysis and other fields.

Choosing Between PHP and Python: A GuideChoosing Between PHP and Python: A GuideApr 18, 2025 am 12:24 AM

PHP is suitable for web development and rapid prototyping, and Python is suitable for data science and machine learning. 1.PHP is used for dynamic web development, with simple syntax and suitable for rapid development. 2. Python has concise syntax, is suitable for multiple fields, and has a strong library ecosystem.

PHP and Frameworks: Modernizing the LanguagePHP and Frameworks: Modernizing the LanguageApr 18, 2025 am 12:14 AM

PHP remains important in the modernization process because it supports a large number of websites and applications and adapts to development needs through frameworks. 1.PHP7 improves performance and introduces new features. 2. Modern frameworks such as Laravel, Symfony and CodeIgniter simplify development and improve code quality. 3. Performance optimization and best practices further improve application efficiency.

PHP's Impact: Web Development and BeyondPHP's Impact: Web Development and BeyondApr 18, 2025 am 12:10 AM

PHPhassignificantlyimpactedwebdevelopmentandextendsbeyondit.1)ItpowersmajorplatformslikeWordPressandexcelsindatabaseinteractions.2)PHP'sadaptabilityallowsittoscaleforlargeapplicationsusingframeworkslikeLaravel.3)Beyondweb,PHPisusedincommand-linescrip

How does PHP type hinting work, including scalar types, return types, union types, and nullable types?How does PHP type hinting work, including scalar types, return types, union types, and nullable types?Apr 17, 2025 am 12:25 AM

PHP type prompts to improve code quality and readability. 1) Scalar type tips: Since PHP7.0, basic data types are allowed to be specified in function parameters, such as int, float, etc. 2) Return type prompt: Ensure the consistency of the function return value type. 3) Union type prompt: Since PHP8.0, multiple types are allowed to be specified in function parameters or return values. 4) Nullable type prompt: Allows to include null values ​​and handle functions that may return null values.

How does PHP handle object cloning (clone keyword) and the __clone magic method?How does PHP handle object cloning (clone keyword) and the __clone magic method?Apr 17, 2025 am 12:24 AM

In PHP, use the clone keyword to create a copy of the object and customize the cloning behavior through the \_\_clone magic method. 1. Use the clone keyword to make a shallow copy, cloning the object's properties but not the object's properties. 2. The \_\_clone method can deeply copy nested objects to avoid shallow copying problems. 3. Pay attention to avoid circular references and performance problems in cloning, and optimize cloning operations to improve efficiency.

PHP vs. Python: Use Cases and ApplicationsPHP vs. Python: Use Cases and ApplicationsApr 17, 2025 am 12:23 AM

PHP is suitable for web development and content management systems, and Python is suitable for data science, machine learning and automation scripts. 1.PHP performs well in building fast and scalable websites and applications and is commonly used in CMS such as WordPress. 2. Python has performed outstandingly in the fields of data science and machine learning, with rich libraries such as NumPy and TensorFlow.

See all articles

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
1 months agoBy尊渡假赌尊渡假赌尊渡假赌
R.E.P.O. Best Graphic Settings
1 months agoBy尊渡假赌尊渡假赌尊渡假赌
Will R.E.P.O. Have Crossplay?
1 months agoBy尊渡假赌尊渡假赌尊渡假赌

Hot Tools

MinGW - Minimalist GNU for Windows

MinGW - Minimalist GNU for Windows

This project is in the process of being migrated to osdn.net/projects/mingw, you can continue to follow us there. MinGW: A native Windows port of the GNU Compiler Collection (GCC), freely distributable import libraries and header files for building native Windows applications; includes extensions to the MSVC runtime to support C99 functionality. All MinGW software can run on 64-bit Windows platforms.

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

WebStorm Mac version

WebStorm Mac version

Useful JavaScript development tools

Dreamweaver Mac version

Dreamweaver Mac version

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)