Detailed explanation of the zval structure and reference counting mechanism in PHP7

Recommended study: "PHP Video Tutorial"

Recently when I was checking the information on PHP7 garbage collection, some code examples on the Internet were found locally. Different results occurred when running in different environments, which made me very confused. If you think about it carefully, it is not difficult to find the problem: most of these articles are from the PHP5. #Mainly focus on explaining the reference counting mechanism in the new zval container. If there are any fallacies, please feel free to give me some advice.

The new zval structure in PHP7

Let’s not talk secretly, let’s look at the code first!

struct _zval_struct {
    union {
        zend_long         lval;             /* long value */
        double            dval;             /* double value */
        zend_refcounted  *counted;
        zend_string      *str;
        zend_array       *arr;
        zend_object      *obj;
        zend_resource    *res;
        zend_reference   *ref;
        zend_ast_ref     *ast;
        zval             *zv;
        void             *ptr;
        zend_class_entry *ce;
        zend_function    *func;
        struct {
            uint32_t w1;
            uint32_t w2;
        } ww;
    } value;
    union {
        struct {
            ZEND_ENDIAN_LOHI_4(
                zend_uchar    type,         /* active type */
                zend_uchar    type_flags,
                zend_uchar    const_flags,
                zend_uchar    reserved)     /* call info for EX(This) */
        } v;
        uint32_t type_info;
    } u1;
    union {
        uint32_t     var_flags;
        uint32_t     next;                 /* hash collision chain */
        uint32_t     cache_slot;           /* literal cache slot */
        uint32_t     lineno;               /* line number (for ast nodes) */
        uint32_t     num_args;             /* arguments number for EX(This) */
        uint32_t     fe_pos;               /* foreach position */
        uint32_t     fe_iter_idx;          /* foreach iterator index */
    } u2;
};
复制代码

For a detailed description of the structure, you can refer to Brother Niao’s article at the end of the article. It is very detailed. I will not show off to others. Here I will only put forward a few key points:

• Variables in PHP7 are divided into two parts:

  variable name and variable value, which respectively correspond to zval_struct and the ## declared in it. zend_long and double

  in #value

• ##zval_struct.value are all simple data Type can directly store specific values, while other complex data types store a pointer to other data structures

  In PHP7, the reference counter is stored in
value
• instead of

  zval_struct

NULL
• ,

  Boolean type all belong to There is no data type with value (the Boolean type is marked by two constants IS_FALSE and IS_TRUE), and naturally there is no reference count

Reference
• (REFERENCE) has become a data structure instead of just a mark bit. Its structure is as follows:

  struct _zend_reference {
      zend_refcounted_h gc;
      zval              val;
  }

zend_reference
• As a

  value type contained in zval_struct, it also has its own val value, which points to a zval_struct.value. They all have their own reference counter.

  The reference counter is used to record how many
zval

currently point to the same

zend_value. For the sixth point, please see the following code:

$a = 'foo';
$b = &$a;
$c = $a;

The data structure at this time is like this:

$a and $b each have a

zval_struct

container, and the

value in it all point to the same zend_reference structure, zend_reference has an embedded val structure, pointing to the same zend_string, The content of the string is stored in it. And $c also has a zval_struct

, and its value can directly point to the

zend_string mentioned above during initialization, so that it will not Generate a copy. Let’s talk about the various phenomena that will occur in this new zval

structure, and the reasons behind these phenomena.

Question

1. Why the initial value of the reference counter of some variables is 0

Phenomena

$var_int = 233;
$var_float = 233.3;
$var_str = '233';

xdebug_debug_zval('var_int');
xdebug_debug_zval('var_float');
xdebug_debug_zval('var_str');

/** 输出 **
var_int:
(refcount=0, is_ref=0)int 233

var_float:
(refcount=0, is_ref=0)float 233.3

var_str:
(refcount=0, is_ref=0)string '233' (length=3)
**********/

Cause

In PHP7, when assigning a value to a variable, it includes two parts of the operation:

1. Apply for a

zval_struct

structure

for the symbolic quantity (that is, the variable name) 2. Store the value of the variable in zval_struct.value

. For the value that

zval can save in the value field, it will not be used in the corresponding field. They perform reference counting, but assign values ​​ directly when copying. These types are: IS_LONG

IS_DOUBLE
• That is our
integer

and

floating point type in PHP. So why is the refcount of var_str also 0? This involves two types of strings in PHP:

1,
interned string

Internal strings (function names, class names, variable names, static strings):

 $str = '233';    // 静态字符串

2. Ordinary string:

 $str = '233' . time();

For

internal string

, the content of the string is the only constant, which is equivalent to the definition in C language The strings in the static variable area,

their life cycle exists during the entire request period. After the request is completed, they will be destroyed and released . Naturally, there is no need to use reference counting for memory management.

二. 为什么在对整形、浮点型和静态字符串型变量进行引用赋值时，计数器的值会直接变为2

现象

$var_int_1 = 233;
$var_int_2 = &var_int;
xdebug_debug_zval('var_int_1');

/** 输出 **
var_int:
(refcount=2, is_ref=1)int 233
**********/

原因

回忆一下我们开头讲的 zval_struct 中 value 的数据结构，当为一个变量赋整形、浮点型或静态字符串类型的值时，value 的数据类型为 zend_long 、 double 或 zend_string，这时值是可以直接储存在 value 中的。而按值拷贝时，会开辟一个新的 zval_struct 以同样的方式将值储存到相同数据类型的 value 中，所以 refcount 的值一直都会为 0。

但是当使用 & 操作符进行引用拷贝时，情况就不一样了：

• PHP 为 & 操作符操作的变量申请一个 zend_reference 结构

• 将 zend_reference.value 指向原来的 zval_struct.value

• zval_struct.value 的数据类型会被修改为 zend_refrence

• 将 zval_struct.value 指向刚刚申请并初始化后的 zend_reference

• 为新变量申请 zval_struct 结构，将他的 value 指向刚刚创建的 zend_reference

此时：$var\_int\_1 和 $var_int_2 都拥有一个 zval_struct 结构体，并且他们的 zval_struct.value 都指向了同一个 zend_reference 结构，所以该结构的引用计数器的值为 2。

题外话：zend_reference 又指向了一个整形或浮点型的 value，如果指向的 value 类型是 zend_string，那么该 value 引用计数器的值为 1。而 xdebug 出来的 refcount 显示的是 zend_reference 的计数器值（即 2）

三. 为什么初始数组的引用计数器的值为 2

现象

$var_empty_arr = [1, 2, '3'];
xdebug_debug_zval('var_empty_arr');

/** 输出 **
var_arr:
(refcount=2, is_ref=0)
array (size=3)
  0 => (refcount=0, is_ref=0)int 1
  1 => (refcount=0, is_ref=0)int 2
  2 => (refcount=1, is_ref=0)string '3' (length=1)
**********/

原因

这牵扯到 PHP7 中的另一个概念，叫做 immutable array（不可变数组）。

For arrays the not-refcounted variant is called an "immutable array". If you use opcache, then constant array literals in your code will be converted into immutable arrays. Once again, these live in shared memory and as such must not use refcounting. Immutable arrays have a dummy refcount of 2, as it allows us to optimize certain separation paths.

不可变数组是 opcache 扩展优化出的一种数组类型，简单的说，所有多次编译结果恒定不变的数组，都会被优化为不可变数组，下面是一个反例：

$array = [1, 2, time()];

PHP 在编译阶段无法得知 time() 函数的返回值，所以此处的 $array 是可变数组。

不可变数组和我们上面讲到的内部字符串一样，都是不使用引用计数的，但是不同点是，内部字符串的计数值恒为 0，而不可变数组会使用一个伪计数值 2。

总结

• 简单数据类型

  • 整形（不使用引用计数）
  • 浮点型（不使用引用计数）
  • 布尔型（不使用引用计数）
  • NULL（不使用引用计数）

• 复杂数据类型

  • 字符串

    • 普通字符串（使用引用计数，初始值为 1）
    • 内部字符串（不使用引用计数，引用计数值恒为 0）

  • 数组

    • 普通数组（使用引用计数，初始值为 1）
    • 不可变数组（不使用引用计数，使用伪计数值 2）
  • 对象（使用引用计数，初始值为 1）

更多编程相关知识，请访问：编程视频！！

The above is the detailed content of Detailed explanation of the zval structure and reference counting mechanism in PHP7. For more information, please follow other related articles on the PHP Chinese website!