1 files changed, 124 insertions, 299 deletions

diff --git a/Zend/zend_objects_API.c b/Zend/zend_objects_API.c
index 4727df4241..f48d40e5fb 100644
--- a/Zend/zend_objects_API.c
+++ b/Zend/zend_objects_API.c
@@ -25,15 +25,13 @@
 #include "zend_API.h"
 #include "zend_objects_API.h"
 
-#define ZEND_DEBUG_OBJECTS 0
-
-ZEND_API void zend_objects_store_init(zend_objects_store *objects, zend_uint init_size)
+ZEND_API void zend_objects_store_init(zend_objects_store *objects, uint32_t init_size)
 {
-	objects->object_buckets = (zend_object_store_bucket *) emalloc(init_size * sizeof(zend_object_store_bucket));
+	objects->object_buckets = (zend_object **) emalloc(init_size * sizeof(zend_object*));
 	objects->top = 1; /* Skip 0 so that handles are true */
 	objects->size = init_size;
 	objects->free_list_head = -1;
-	memset(&objects->object_buckets[0], 0, sizeof(zend_object_store_bucket));
+	memset(&objects->object_buckets[0], 0, sizeof(zend_object*));
 }
 
 ZEND_API void zend_objects_store_destroy(zend_objects_store *objects)
@@ -42,250 +40,182 @@ ZEND_API void zend_objects_store_destroy(zend_objects_store *objects)
 	objects->object_buckets = NULL;
 }
 
-ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects TSRMLS_DC)
+ZEND_API void zend_objects_store_call_destructors(zend_objects_store *objects)
 {
-	zend_uint i = 1;
-
-	for (i = 1; i < objects->top ; i++) {
-		if (objects->object_buckets[i].valid) {
-			struct _store_object *obj = &objects->object_buckets[i].bucket.obj;
-
-			if (!objects->object_buckets[i].destructor_called) {
-				objects->object_buckets[i].destructor_called = 1;
-				if (obj->dtor && obj->object) {
-					obj->refcount++;
-					obj->dtor(obj->object, i TSRMLS_CC);
-					obj = &objects->object_buckets[i].bucket.obj;
-					obj->refcount--;
-
-					if (obj->refcount == 0) {
-						/* in case gc_collect_cycle is triggered before free_storage */
-						GC_REMOVE_ZOBJ_FROM_BUFFER(obj);
-					}
+	if (objects->top > 1) {
+		zend_object **obj_ptr = objects->object_buckets + 1;
+		zend_object **end = objects->object_buckets + objects->top;
+
+		do {
+			zend_object *obj = *obj_ptr;
+
+			if (IS_OBJ_VALID(obj)) {
+				if (!(GC_FLAGS(obj) & IS_OBJ_DESTRUCTOR_CALLED)) {
+					GC_FLAGS(obj) |= IS_OBJ_DESTRUCTOR_CALLED;
+					GC_REFCOUNT(obj)++;
+					obj->handlers->dtor_obj(obj);
+					GC_REFCOUNT(obj)--;
 				}
 			}
-		}
+			obj_ptr++;
+		} while (obj_ptr != end);
 	}
 }
 
-ZEND_API void zend_objects_store_mark_destructed(zend_objects_store *objects TSRMLS_DC)
+ZEND_API void zend_objects_store_mark_destructed(zend_objects_store *objects)
 {
-	zend_uint i;
+	if (objects->object_buckets && objects->top > 1) {
+		zend_object **obj_ptr = objects->object_buckets + 1;
+		zend_object **end = objects->object_buckets + objects->top;
 
-	if (!objects->object_buckets) {
-		return;
-	}
-	for (i = 1; i < objects->top ; i++) {
-		if (objects->object_buckets[i].valid) {
-			objects->object_buckets[i].destructor_called = 1;
-		}
+		do {
+			zend_object *obj = *obj_ptr;
+
+			if (IS_OBJ_VALID(obj)) {
+				GC_FLAGS(obj) |= IS_OBJ_DESTRUCTOR_CALLED;
+			}
+			obj_ptr++;
+		} while (obj_ptr != end);
 	}
 }
 
-ZEND_API void zend_objects_store_free_object_storage(zend_objects_store *objects TSRMLS_DC)
+ZEND_API void zend_objects_store_free_object_storage(zend_objects_store *objects)
 {
-	zend_uint i = 1;
-
-	for (i = 1; i < objects->top ; i++) {
-		if (objects->object_buckets[i].valid) {
-			struct _store_object *obj = &objects->object_buckets[i].bucket.obj;
+	zend_object **obj_ptr, **end, *obj;
 
-			GC_REMOVE_ZOBJ_FROM_BUFFER(obj);
+	if (objects->top <= 1) {
+		return;
+	}
 
-			objects->object_buckets[i].valid = 0;
-			if (obj->free_storage) {
-				obj->free_storage(obj->object TSRMLS_CC);
+	/* Free object contents, but don't free objects themselves */
+	end = objects->object_buckets + 1;
+	obj_ptr = objects->object_buckets + objects->top;
+
+	do {
+		obj_ptr--;
+		obj = *obj_ptr;
+		if (IS_OBJ_VALID(obj)) {
+			if (!(GC_FLAGS(obj) & IS_OBJ_FREE_CALLED)) {
+				GC_FLAGS(obj) |= IS_OBJ_FREE_CALLED;
+				if (obj->handlers->free_obj) {
+					GC_REFCOUNT(obj)++;
+					obj->handlers->free_obj(obj);
+					GC_REFCOUNT(obj)--;
+				}
 			}
+		}
+	} while (obj_ptr != end);
+
+	/* Free objects themselves if they now have a refcount of 0, which means that
+	 * they were previously part of a cycle. Everything else will report as a leak.
+	 * Cycles are allowed because not all internal objects currently support GC. */
+	end = objects->object_buckets + objects->top;
+	while (obj_ptr != end) {
+		obj = *obj_ptr;
+		if (IS_OBJ_VALID(obj) && GC_REFCOUNT(obj) == 0) {
 			/* Not adding to free list as we are shutting down anyway */
+			void *ptr = ((char*)obj) - obj->handlers->offset;
+			GC_REMOVE_FROM_BUFFER(obj);
+			efree(ptr);
 		}
+		obj_ptr++;
 	}
 }
 
 
 /* Store objects API */
 
-ZEND_API zend_object_handle zend_objects_store_put(void *object, zend_objects_store_dtor_t dtor, zend_objects_free_object_storage_t free_storage, zend_objects_store_clone_t clone TSRMLS_DC)
+ZEND_API void zend_objects_store_put(zend_object *object)
 {
-	zend_object_handle handle;
-	struct _store_object *obj;
+	int handle;
 
 	if (EG(objects_store).free_list_head != -1) {
 		handle = EG(objects_store).free_list_head;
-		EG(objects_store).free_list_head = EG(objects_store).object_buckets[handle].bucket.free_list.next;
+		EG(objects_store).free_list_head = GET_OBJ_BUCKET_NUMBER(EG(objects_store).object_buckets[handle]);
 	} else {
 		if (EG(objects_store).top == EG(objects_store).size) {
 			EG(objects_store).size <<= 1;
-			EG(objects_store).object_buckets = (zend_object_store_bucket *) erealloc(EG(objects_store).object_buckets, EG(objects_store).size * sizeof(zend_object_store_bucket));
+			EG(objects_store).object_buckets = (zend_object **) erealloc(EG(objects_store).object_buckets, EG(objects_store).size * sizeof(zend_object*));
 		}
 		handle = EG(objects_store).top++;
 	}
-	obj = &EG(objects_store).object_buckets[handle].bucket.obj;
-	EG(objects_store).object_buckets[handle].destructor_called = 0;
-	EG(objects_store).object_buckets[handle].valid = 1;
-	EG(objects_store).object_buckets[handle].apply_count = 0;
-
-	obj->refcount = 1;
-	GC_OBJ_INIT(obj);
-	obj->object = object;
-	obj->dtor = dtor?dtor:(zend_objects_store_dtor_t)zend_objects_destroy_object;
-	obj->free_storage = free_storage;
-	obj->clone = clone;
-	obj->handlers = NULL;
-
-#if ZEND_DEBUG_OBJECTS
-	fprintf(stderr, "Allocated object id #%d\n", handle);
-#endif
-	return handle;
+	object->handle = handle;
+	EG(objects_store).object_buckets[handle] = object;
 }
 
-ZEND_API zend_uint zend_objects_store_get_refcount(zval *object TSRMLS_DC)
-{
-	zend_object_handle handle = Z_OBJ_HANDLE_P(object);
-
-	return EG(objects_store).object_buckets[handle].bucket.obj.refcount;
-}
+#define ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(handle)															\
+            SET_OBJ_BUCKET_NUMBER(EG(objects_store).object_buckets[handle], EG(objects_store).free_list_head);	\
+			EG(objects_store).free_list_head = handle;
 
-ZEND_API void zend_objects_store_add_ref(zval *object TSRMLS_DC)
+ZEND_API void zend_objects_store_free(zend_object *object) /* {{{ */
 {
-	zend_object_handle handle = Z_OBJ_HANDLE_P(object);
+	uint32_t handle = object->handle;
+	void *ptr = ((char*)object) - object->handlers->offset;
 
-	EG(objects_store).object_buckets[handle].bucket.obj.refcount++;
-#if ZEND_DEBUG_OBJECTS
-	fprintf(stderr, "Increased refcount of object id #%d\n", handle);
-#endif
-}
-
-/*
- * Add a reference to an objects store entry given the object handle.
- */
-ZEND_API void zend_objects_store_add_ref_by_handle(zend_object_handle handle TSRMLS_DC)
-{
-	EG(objects_store).object_buckets[handle].bucket.obj.refcount++;
-}
-
-#define ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST()																	\
-			EG(objects_store).object_buckets[handle].bucket.free_list.next = EG(objects_store).free_list_head;	\
-			EG(objects_store).free_list_head = handle;															\
-			EG(objects_store).object_buckets[handle].valid = 0;
-
-ZEND_API void zend_objects_store_del_ref(zval *zobject TSRMLS_DC)
-{
-	zend_object_handle handle;
-
-	handle = Z_OBJ_HANDLE_P(zobject);
-
-	Z_ADDREF_P(zobject);
-	zend_objects_store_del_ref_by_handle_ex(handle, Z_OBJ_HT_P(zobject) TSRMLS_CC);
-	Z_DELREF_P(zobject);
-
-	GC_ZOBJ_CHECK_POSSIBLE_ROOT(zobject);
+	GC_REMOVE_FROM_BUFFER(object);
+	efree(ptr);
+	ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(handle);
 }
+/* }}} */
 
-/*
- * Delete a reference to an objects store entry given the object handle.
- */
-ZEND_API void zend_objects_store_del_ref_by_handle_ex(zend_object_handle handle, const zend_object_handlers *handlers TSRMLS_DC) /* {{{ */
+ZEND_API void zend_objects_store_del(zend_object *object) /* {{{ */
 {
-	struct _store_object *obj;
-	int failure = 0;
-
-	if (!EG(objects_store).object_buckets) {
-		return;
-	}
-
-	obj = &EG(objects_store).object_buckets[handle].bucket.obj;
-
 	/*	Make sure we hold a reference count during the destructor call
 		otherwise, when the destructor ends the storage might be freed
 		when the refcount reaches 0 a second time
 	 */
-	if (EG(objects_store).object_buckets[handle].valid) {
-		if (obj->refcount == 1) {
-			if (!EG(objects_store).object_buckets[handle].destructor_called) {
-				EG(objects_store).object_buckets[handle].destructor_called = 1;
-
-				if (obj->dtor) {
-					if (handlers && !obj->handlers) {
-						obj->handlers = handlers;
-					}
+	if (EG(objects_store).object_buckets &&
+	    IS_OBJ_VALID(EG(objects_store).object_buckets[object->handle])) {
+		if (GC_REFCOUNT(object) == 0) {
+			int failure = 0;
+
+			if (!(GC_FLAGS(object) & IS_OBJ_DESTRUCTOR_CALLED)) {
+				GC_FLAGS(object) |= IS_OBJ_DESTRUCTOR_CALLED;
+
+				if (object->handlers->dtor_obj) {
+					GC_REFCOUNT(object)++;
 					zend_try {
-						obj->dtor(obj->object, handle TSRMLS_CC);
+						object->handlers->dtor_obj(object);
 					} zend_catch {
 						failure = 1;
 					} zend_end_try();
+					GC_REFCOUNT(object)--;
 				}
 			}
-			
-			/* re-read the object from the object store as the store might have been reallocated in the dtor */
-			obj = &EG(objects_store).object_buckets[handle].bucket.obj;
 
-			if (obj->refcount == 1) {
-				GC_REMOVE_ZOBJ_FROM_BUFFER(obj);
-				if (obj->free_storage) {
-					zend_try {
-						obj->free_storage(obj->object TSRMLS_CC);
-					} zend_catch {
-						failure = 1;
-					} zend_end_try();
+			if (GC_REFCOUNT(object) == 0) {
+				uint32_t handle = object->handle;
+				void *ptr;
+
+				EG(objects_store).object_buckets[handle] = SET_OBJ_INVALID(object);
+				if (!(GC_FLAGS(object) & IS_OBJ_FREE_CALLED)) {
+					GC_FLAGS(object) |= IS_OBJ_FREE_CALLED;
+					if (object->handlers->free_obj) {
+						zend_try {
+							GC_REFCOUNT(object)++;
+							object->handlers->free_obj(object);
+							GC_REFCOUNT(object)--;
+						} zend_catch {
+							failure = 1;
+						} zend_end_try();
+					}
 				}
-				ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST();
+				ptr = ((char*)object) - object->handlers->offset;
+				GC_REMOVE_FROM_BUFFER(object);
+				efree(ptr);
+				ZEND_OBJECTS_STORE_ADD_TO_FREE_LIST(handle);
 			}
-		}
-	}
-
-	obj->refcount--;
 
-#if ZEND_DEBUG_OBJECTS
-	if (obj->refcount == 0) {
-		fprintf(stderr, "Deallocated object id #%d\n", handle);
-	} else {
-		fprintf(stderr, "Decreased refcount of object id #%d\n", handle);
-	}
-#endif
-	if (failure) {
-		zend_bailout();
+			if (failure) {
+				zend_bailout();
+			}
+		} else {
+			GC_REFCOUNT(object)--;
+		}
 	}
 }
 /* }}} */
 
-ZEND_API zend_object_value zend_objects_store_clone_obj(zval *zobject TSRMLS_DC)
-{
-	zend_object_value retval;
-	void *new_object;
-	struct _store_object *obj;
-	zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
-
-	obj = &EG(objects_store).object_buckets[handle].bucket.obj;
-
-	if (obj->clone == NULL) {
-		zend_error(E_CORE_ERROR, "Trying to clone uncloneable object of class %s", Z_OBJCE_P(zobject)->name);
-	}
-
-	obj->clone(obj->object, &new_object TSRMLS_CC);
-	obj = &EG(objects_store).object_buckets[handle].bucket.obj;
-
-	retval.handle = zend_objects_store_put(new_object, obj->dtor, obj->free_storage, obj->clone TSRMLS_CC);
-	retval.handlers = Z_OBJ_HT_P(zobject);
-	EG(objects_store).object_buckets[handle].bucket.obj.handlers = retval.handlers;
-
-	return retval;
-}
-
-ZEND_API void *zend_object_store_get_object(const zval *zobject TSRMLS_DC)
-{
-	zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
-
-	return EG(objects_store).object_buckets[handle].bucket.obj.object;
-}
-
-/*
- * Retrieve an entry from the objects store given the object handle.
- */
-ZEND_API void *zend_object_store_get_object_by_handle(zend_object_handle handle TSRMLS_DC)
-{
-	return EG(objects_store).object_buckets[handle].bucket.obj.object;
-}
-
 /* zend_object_store_set_object:
  * It is ONLY valid to call this function from within the constructor of an
  * overloaded object.  Its purpose is to set the object pointer for the object
@@ -293,94 +223,15 @@ ZEND_API void *zend_object_store_get_object_by_handle(zend_object_handle handle
  * from the constructor function.  You MUST NOT use this function for any other
  * weird games, or call it at any other time after the object is constructed.
  * */
-ZEND_API void zend_object_store_set_object(zval *zobject, void *object TSRMLS_DC)
+ZEND_API void zend_object_store_set_object(zval *zobject, zend_object *object)
 {
-	zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
-
-	EG(objects_store).object_buckets[handle].bucket.obj.object = object;
+	EG(objects_store).object_buckets[Z_OBJ_HANDLE_P(zobject)] = object;
 }
 
-
 /* Called when the ctor was terminated by an exception */
-ZEND_API void zend_object_store_ctor_failed(zval *zobject TSRMLS_DC)
+ZEND_API void zend_object_store_ctor_failed(zend_object *obj)
 {
-	zend_object_handle handle = Z_OBJ_HANDLE_P(zobject);
-	zend_object_store_bucket *obj_bucket = &EG(objects_store).object_buckets[handle];
-	
-	obj_bucket->bucket.obj.handlers = Z_OBJ_HT_P(zobject);;
-	obj_bucket->destructor_called = 1;
-}
-
-
-/* Proxy objects workings */
-typedef struct _zend_proxy_object {
-	zval *object;
-	zval *property;
-} zend_proxy_object;
-
-static zend_object_handlers zend_object_proxy_handlers;
-
-ZEND_API void zend_objects_proxy_destroy(zend_object *object, zend_object_handle handle TSRMLS_DC)
-{
-}
-
-ZEND_API void zend_objects_proxy_free_storage(zend_proxy_object *object TSRMLS_DC)
-{
-	zval_ptr_dtor(&object->object);
-	zval_ptr_dtor(&object->property);
-	efree(object);
-}
-
-ZEND_API void zend_objects_proxy_clone(zend_proxy_object *object, zend_proxy_object **object_clone TSRMLS_DC)
-{
-	*object_clone = emalloc(sizeof(zend_proxy_object));
-	(*object_clone)->object = object->object;
-	(*object_clone)->property = object->property;
-	zval_add_ref(&(*object_clone)->property);
-	zval_add_ref(&(*object_clone)->object);
-}
-
-ZEND_API zval *zend_object_create_proxy(zval *object, zval *member TSRMLS_DC)
-{
-	zend_proxy_object *pobj = emalloc(sizeof(zend_proxy_object));
-	zval *retval;
-
-	pobj->object = object;
-	zval_add_ref(&pobj->object);
-	ALLOC_ZVAL(pobj->property);
-	INIT_PZVAL_COPY(pobj->property, member);
-	zval_copy_ctor(pobj->property);
-
-	MAKE_STD_ZVAL(retval);
-	Z_TYPE_P(retval) = IS_OBJECT;
-	Z_OBJ_HANDLE_P(retval) = zend_objects_store_put(pobj, (zend_objects_store_dtor_t)zend_objects_proxy_destroy, (zend_objects_free_object_storage_t) zend_objects_proxy_free_storage, (zend_objects_store_clone_t) zend_objects_proxy_clone TSRMLS_CC);
-	Z_OBJ_HT_P(retval) = &zend_object_proxy_handlers;
-
-	return retval;
-}
-
-ZEND_API void zend_object_proxy_set(zval **property, zval *value TSRMLS_DC)
-{
-	zend_proxy_object *probj = zend_object_store_get_object(*property TSRMLS_CC);
-
-	if (Z_OBJ_HT_P(probj->object) && Z_OBJ_HT_P(probj->object)->write_property) {
-		Z_OBJ_HT_P(probj->object)->write_property(probj->object, probj->property, value, 0 TSRMLS_CC);
-	} else {
-		zend_error(E_WARNING, "Cannot write property of object - no write handler defined");
-	}
-}
-
-ZEND_API zval* zend_object_proxy_get(zval *property TSRMLS_DC)
-{
-	zend_proxy_object *probj = zend_object_store_get_object(property TSRMLS_CC);
-
-	if (Z_OBJ_HT_P(probj->object) && Z_OBJ_HT_P(probj->object)->read_property) {
-		return Z_OBJ_HT_P(probj->object)->read_property(probj->object, probj->property, BP_VAR_R, 0 TSRMLS_CC);
-	} else {
-		zend_error(E_WARNING, "Cannot read property of object - no read handler defined");
-	}
-
-	return NULL;
+	GC_FLAGS(obj) |= IS_OBJ_DESTRUCTOR_CALLED;
 }
 
 ZEND_API zend_object_handlers *zend_get_std_object_handlers(void)
@@ -388,32 +239,6 @@ ZEND_API zend_object_handlers *zend_get_std_object_handlers(void)
 	return &std_object_handlers;
 }
 
-static zend_object_handlers zend_object_proxy_handlers = {
-	ZEND_OBJECTS_STORE_HANDLERS,
-
-	NULL,						/* read_property */
-	NULL,						/* write_property */
-	NULL,						/* read dimension */
-	NULL,						/* write_dimension */
-	NULL,						/* get_property_ptr_ptr */
-	zend_object_proxy_get,		/* get */
-	zend_object_proxy_set,		/* set */
-	NULL,						/* has_property */
-	NULL,						/* unset_property */
-	NULL,						/* has_dimension */
-	NULL,						/* unset_dimension */
-	NULL,						/* get_properties */
-	NULL,						/* get_method */
-	NULL,						/* call_method */
-	NULL,						/* get_constructor */
-	NULL,						/* get_class_entry */
-	NULL,						/* get_class_name */
-	NULL,						/* compare_objects */
-	NULL,						/* cast_object */
-	NULL,						/* count_elements */
-};
-
-
 /*
  * Local variables:
  * tab-width: 4