2
2
Reference counting
3
3
####################
4
4
5
- In languages like C, when you need memory for storing data for an indefinite period of time or in a
6
- large amount, you call ``malloc `` and ``free `` to acquire and release blocks of memory of some size.
7
- This sounds simple on the surface but turns out to be quite tricky, mainly because the data may not
8
- be freed for as long as it is used anywhere in the program. Sometimes this makes it unclear who is
9
- responsible for freeing the memory, and when to do so. Failure to handle this correctly may result
10
- in a use-after-free, double-free, or memory leak.
11
-
12
- In PHP you usually do not need to think about memory management. The engine takes care of allocating
13
- and freeing memory for you by tracking which values are no longer needed. It does this by assigning
14
- a reference count to each allocated value, often abbreviated as refcount or RC. Whenever a reference
15
- to a value is passed somewhere else, its reference count is increased to indicate the value is now
16
- used by another party. When the party no longer needs the value, it is responsible for decreasing
17
- the reference count. Once the reference count reaches zero, we know the value is no longer needed
18
- anywhere, and that it may be freed.
5
+ In languages like C, when you need memory for storing data for an indefinite
6
+ period of time or in a large amount, you call ``malloc `` and ``free `` to acquire
7
+ and release blocks of memory of some size. This sounds simple on the surface but
8
+ turns out to be quite tricky, mainly because the data may not be freed for as
9
+ long as it is used anywhere in the program. Sometimes this makes it unclear who
10
+ is responsible for freeing the memory, and when to do so. Failure to handle this
11
+ correctly may result in a use-after-free, double-free, or memory leak.
12
+
13
+ In PHP you usually do not need to think about memory management. The engine
14
+ takes care of allocating and freeing memory for you by tracking which values are
15
+ no longer needed. It does this by assigning a reference count to each allocated
16
+ value, often abbreviated as refcount or RC. Whenever a reference to a value is
17
+ passed somewhere else, its reference count is increased to indicate the value is
18
+ now used by another party. When the party no longer needs the value, it is
19
+ responsible for decreasing the reference count. Once the reference count reaches
20
+ zero, we know the value is no longer needed anywhere, and that it may be freed.
19
21
20
22
.. code :: php
21
23
@@ -24,18 +26,20 @@ anywhere, and that it may be freed.
24
26
unset($a); // RC 1
25
27
unset($b); // RC 0, free
26
28
27
- Reference counting is needed for types that store auxiliary data, which are the following:
29
+ Reference counting is needed for types that store auxiliary data, which are the
30
+ following:
28
31
29
32
- Strings
30
33
- Arrays
31
34
- Objects
32
35
- References
33
36
- Resources
34
37
35
- These are either reference types (objects, references and resources) or they are large types that
36
- don't fit in a single ``zend_value `` directly (strings, arrays). Simpler types either don't store a
37
- value at all (``null ``, ``false ``, ``true ``) or their value is small enough to fit directly in
38
- ``zend_value `` (``int ``, ``float ``).
38
+ These are either reference types (objects, references and resources) or they are
39
+ large types that don't fit in a single ``zend_value `` directly (strings,
40
+ arrays). Simpler types either don't store a value at all (``null ``, ``false ``,
41
+ ``true ``) or their value is small enough to fit directly in ``zend_value ``
42
+ (``int ``, ``float ``).
39
43
40
44
All of the reference counted types share a common initial struct sequence.
41
45
@@ -58,19 +62,20 @@ All of the reference counted types share a common initial struct sequence.
58
62
// ...
59
63
};
60
64
61
- The ``zend_refcounted_h `` struct is simple. It contains the reference count, and a `` type_info ``
62
- field that repeats some of the type information that is also stored in the `` zval ``, for situations
63
- where we're not dealing with a ``zval `` directly. It also stores some additional fields, described
64
- under `GC flags `_.
65
+ The ``zend_refcounted_h `` struct is simple. It contains the reference count, and
66
+ a `` type_info `` field that repeats some of the type information that is also
67
+ stored in the `` zval ``, for situations where we're not dealing with a ``zval ``
68
+ directly. It also stores some additional fields, described under `GC flags `_.
65
69
66
70
********
67
71
Macros
68
72
********
69
73
70
- As with ``zval ``, ``zend_refcounted_h `` members should not be accessed directly. Instead, you should
71
- use the provided macros. There are macros that work with reference counted types directly, prefixed
72
- with ``GC_ ``, or macros that work on ``zval `` values, usually prefixed with ``Z_ ``. Unfortunately,
73
- naming is not always consistent.
74
+ As with ``zval ``, ``zend_refcounted_h `` members should not be accessed directly.
75
+ Instead, you should use the provided macros. There are macros that work with
76
+ reference counted types directly, prefixed with ``GC_ ``, or macros that work on
77
+ ``zval `` values, usually prefixed with ``Z_ ``. Unfortunately, naming is not
78
+ always consistent.
74
79
75
80
.. list-table :: ``zval`` macros
76
81
:header-rows: 1
@@ -93,12 +98,14 @@ naming is not always consistent.
93
98
94
99
- - ``zval_ptr_dtor ``
95
100
- Yes
96
- - Decreases the reference count and frees the value if the reference count reaches zero.
101
+ - Decreases the reference count and frees the value if the reference
102
+ count reaches zero.
97
103
98
104
.. [#non-rc ]
99
105
100
- Whether the macro works with non-reference counted types. If it does, the operation is usually a
101
- no-op. If it does not, using the macro on these values is undefined behavior.
106
+ Whether the macro works with non-reference counted types. If it does, the
107
+ operation is usually a no-op. If it does not, using the macro on these values is
108
+ undefined behavior.
102
109
103
110
.. list-table :: ``zend_refcounted_h`` macros
104
111
:header-rows: 1
@@ -121,27 +128,32 @@ naming is not always consistent.
121
128
122
129
- - ``GC_DTOR[_P] ``
123
130
- Yes
124
- - Decreases the reference count and frees the value if the reference count reaches zero.
131
+ - Decreases the reference count and frees the value if the reference
132
+ count reaches zero.
125
133
126
134
.. [#immutable ]
127
135
128
- Whether the macro works with immutable types, described under `Immutable reference counted types `_.
136
+ Whether the macro works with immutable types, described under `Immutable
137
+ reference counted types `_.
129
138
130
139
************
131
140
Separation
132
141
************
133
142
134
- PHP has value and reference types. Reference types are types that are shared through a reference, a
135
- "pointer" to the value, rather than the value itself. Modifying such a value in one place changes it
136
- for all of its observers. For example, writing to a property changes the property in every place the
137
- object is referenced. Value types, on the other hand, are copied when passed to another party.
138
- Modifying the original value does not affect the copy, and vice versa.
139
-
140
- In PHP, arrays and strings are value types. Since they are also reference counted types, this
141
- requires some special care when modifying values. In particular, we need to make sure that modifying
142
- the value is not observable from other places. Modifying a value with RC 1 is unproblematic, since
143
- we are the values sole owner. However, if the value has a reference count of >1, we need to create a
144
- fresh copy before modifying it. This process is called separation or CoW (copy on write).
143
+ PHP has value and reference types. Reference types are types that are shared
144
+ through a reference, a "pointer" to the value, rather than the value itself.
145
+ Modifying such a value in one place changes it for all of its observers. For
146
+ example, writing to a property changes the property in every place the object is
147
+ referenced. Value types, on the other hand, are copied when passed to another
148
+ party. Modifying the original value does not affect the copy, and vice versa.
149
+
150
+ In PHP, arrays and strings are value types. Since they are also reference
151
+ counted types, this requires some special care when modifying values. In
152
+ particular, we need to make sure that modifying the value is not observable from
153
+ other places. Modifying a value with RC 1 is unproblematic, since we are the
154
+ values sole owner. However, if the value has a reference count of >1, we need to
155
+ create a fresh copy before modifying it. This process is called separation or
156
+ CoW (copy on write).
145
157
146
158
.. code :: php
147
159
@@ -155,20 +167,24 @@ fresh copy before modifying it. This process is called separation or CoW (copy o
155
167
Immutable reference counted types
156
168
***********************************
157
169
158
- Sometimes, even a reference counted type is not reference counted. When PHP runs in a multi-process
159
- or multi-threaded environment with opcache enabled, it shares some common values between processes
160
- or threads to reduce memory consumption. As you may know, sharing memory between processes or
161
- threads can be tricky and requires special care when modifying values. In particular, modification
162
- usually requires exclusive access to the memory so that the other processes or threads wait until
163
- the value is done being updated. In this case, this synchronization is avoided by making the value
164
- immutable and never modifying the reference count. Such values will receive the ``GC_IMMUTABLE ``
165
- flag in their ``gc->u.type_info `` field.
166
-
167
- Some macros like ``GC_TRY_ADDREF `` will guard against immutable values. You should not use immutable
168
- values on some macros, like ``GC_ADDREF ``. This will result in undefined behavior, because the macro
169
- will not check whether the value is immutable before performing the reference count modifications.
170
- You may execute PHP with the ``-d opcache.protect_memory=1 `` flag to mark the shared memory as
171
- read-only and trigger a hardware exception if the code accidentally attempts to modify it.
170
+ Sometimes, even a reference counted type is not reference counted. When PHP runs
171
+ in a multi-process or multi-threaded environment with opcache enabled, it shares
172
+ some common values between processes or threads to reduce memory consumption. As
173
+ you may know, sharing memory between processes or threads can be tricky and
174
+ requires special care when modifying values. In particular, modification usually
175
+ requires exclusive access to the memory so that the other processes or threads
176
+ wait until the value is done being updated. In this case, this synchronization
177
+ is avoided by making the value immutable and never modifying the reference
178
+ count. Such values will receive the ``GC_IMMUTABLE `` flag in their
179
+ ``gc->u.type_info `` field.
180
+
181
+ Some macros like ``GC_TRY_ADDREF `` will guard against immutable values. You
182
+ should not use immutable values on some macros, like ``GC_ADDREF ``. This will
183
+ result in undefined behavior, because the macro will not check whether the value
184
+ is immutable before performing the reference count modifications. You may
185
+ execute PHP with the ``-d opcache.protect_memory=1 `` flag to mark the shared
186
+ memory as read-only and trigger a hardware exception if the code accidentally
187
+ attempts to modify it.
172
188
173
189
*****************
174
190
Cycle collector
@@ -185,14 +201,15 @@ Sometimes, reference counting is not enough. Consider the following example:
185
201
unset($a);
186
202
unset($b);
187
203
188
- When this code finishes, the reference count of both instances of ``stdClass `` will still be 1, as
189
- they reference each other. This is called a reference cycle.
204
+ When this code finishes, the reference count of both instances of ``stdClass ``
205
+ will still be 1, as they reference each other. This is called a reference cycle.
190
206
191
- PHP implements a cycle collector that detects such cycles and frees values that are only reachable
192
- through their own references. The cycle collector will record values that may be involved in a
193
- cycle, and run when this buffer becomes full. It is also possible to invoke it explicitly by calling
194
- the ``gc_collect_cycles() `` function. The cycle collectors design is described in the `Cycle
195
- collector <todo> `_ chapter.
207
+ PHP implements a cycle collector that detects such cycles and frees values that
208
+ are only reachable through their own references. The cycle collector will record
209
+ values that may be involved in a cycle, and run when this buffer becomes full.
210
+ It is also possible to invoke it explicitly by calling the
211
+ ``gc_collect_cycles() `` function. The cycle collectors design is described in
212
+ the `Cycle collector <todo >`_ chapter.
196
213
197
214
**********
198
215
GC flags
@@ -207,22 +224,23 @@ collector <todo>`_ chapter.
207
224
#define GC_PERSISTENT (1<<7) /* allocated using malloc */
208
225
#define GC_PERSISTENT_LOCAL (1<<8) /* persistent, but thread-local */
209
226
210
- The ``GC_NOT_COLLECTABLE `` flag indicates that the value may not be involved in a reference cycle.
211
- This allows for a fast way to detect values that don't need to be added to the cycle collector
212
- buffer. Only arrays and objects may actually be involved in reference cycles.
227
+ The ``GC_NOT_COLLECTABLE `` flag indicates that the value may not be involved in
228
+ a reference cycle. This allows for a fast way to detect values that don't need
229
+ to be added to the cycle collector buffer. Only arrays and objects may actually
230
+ be involved in reference cycles.
213
231
214
- The ``GC_PROTECTED `` flag is used to protect against recursion in various internal functions. For
215
- example, ``var_dump `` recursively prints the contents of values, and marks visited values with the
216
- ``GC_PROTECTED `` flag. If the value is recursive, it prevents the same value from being visited
217
- again.
232
+ The ``GC_PROTECTED `` flag is used to protect against recursion in various
233
+ internal functions. For example, ``var_dump `` recursively prints the contents of
234
+ values, and marks visited values with the ``GC_PROTECTED `` flag. If the value is
235
+ recursive, it prevents the same value from being visited again.
218
236
219
237
``GC_IMMUTABLE `` has been discussed in `Immutable reference counted types `_.
220
238
221
- The ``GC_PERSISTENT `` flag indicates that the value was allocated using `` malloc ``, instead of PHPs
222
- own allocator. Usually, such values are alive for the entire lifetime of the process, instead of
223
- being freed at the end of the request. See the ` Zend allocator < todo >`_ chapter for more
224
- information.
239
+ The ``GC_PERSISTENT `` flag indicates that the value was allocated using
240
+ `` malloc ``, instead of PHPs own allocator. Usually, such values are alive for
241
+ the entire lifetime of the process, instead of being freed at the end of the
242
+ request. See the ` Zend allocator < todo >`_ chapter for more information.
225
243
226
- The ``GC_PERSISTENT_LOCAL `` flag indicates that a ``GC_PERSISTENT `` value is only accessible in one
227
- thread, and is thus still safe to modify. This flag is only used in debug builds to satisfy an
228
- ``assert ``.
244
+ The ``GC_PERSISTENT_LOCAL `` flag indicates that a ``GC_PERSISTENT `` value is
245
+ only accessible in one thread, and is thus still safe to modify. This flag is
246
+ only used in debug builds to satisfy an ``assert ``.
0 commit comments