深入理解PHP的引用（References in PHP） huangguisu
为了深入理解PHP的引用，找到一篇老外的东西: http://derickrethans.nl/talks/phparch-php-variables-article
很多内容还是直接看英文版比较好，翻译过来有时候词不达意。
基础知识
php在zend里面存储的变量，PHP中每个变量都有对应的 zval， Zval结构体定义在Zend/zend.h里面，其结构:
typedef struct _zval_struct zval;
struct _zval_struct {
/* Variable information */
zvalue_value value; /* The value 存储变量的值*/
zend_uint refcount__gc; /* 引用计数 */
zend_uchar type; /* 变量具体类型*/
zend_uchar is_ref__gc; /* 是否引用 1为引用，0不是*/
}; 后面也经常提到refcount 即refcount_gc (PHP5.3以后引入的垃圾收集机制)PHP’s handling of variables can be non-obvious, at times.Have you ever wondered what happens at the engine level when a variable is copied to another? How about when a function returns a variable “by reference?” If so, read on.
PHP是弱语言，其变量处理的过程是不可见的。你是否曾经很想知道在变量复制的时候，PHP引擎做了什么？你是否曾经很想知道一个函数是如何以引用的方式返回一个变量？如果是这样，请您接着向下看。
Every computer language needs some form of container to hold data-variables. In some languages, those variables have a specific type attached to hem. They can be a string, a number, an array, an object or something else. Examples of such statically-typed languages are C and pascal. Variables in PHP do not have this specific restraint. They can be a string in one line, but a number in the next line. Converting between types is also easy to do, and often, even auto-matic. These loosely-typed variables are one of the properties that make PHP such an easy and powerful language, although they can sometimes also cause interesting problems. Internally, in PHP, those variables are all stored in a similar container, called a zval container (also called“variable container”). This container keeps track of several things that are related to a specific value. The most important things that a variable container contains are the value of the “variable”, but also the type of the variable. Python is similar to PHP in this regard as it also labels each variable with a type. The variable container contains a few more fields that the PHP engine uses to keep track of whether a value is a reference or not. It also keeps reference count of its value. Variables are stored in a symbol table, which is quite analogous to an associative array. This array has keys that represent the name of the variable, and those keys point to variable containers that contain the value (andtype) of the variables. See Figure 1 for an example of this.
总结就是变量存储在一个于类似关联数组的符号表中。
.
1 . 引用计数 Reference Counting
PHP tries to be smart when it deals with copying variables like in $a = $b. Using the = operator is also called an “assign-by-value” operation. While assigning by value, the PHP engine will not actually create a copy of the variable container, but it will merely increase the refcount__gc field in the variable container. As you can imagine this saves a lot of memory in case you have a large string of text, or a large array.Figure 2 shows how this “looks”.
In Step 1 there is one variable, a, which contains the text"this is" s and it has (by default) a reference count of 1.
In step 2, we assign variable $a to variable$b and$c. Here, no copy of the variable container is made, only the refcount value gets updated with 1 for each variable that is assigned to the container. Because we assign two more variables here, the refcount gets updated to 2 and ends up being 3 after the two assignment statements.
in step 3,Now, you might wonder what would happen if the variable $cgets changed. Two things might happen, depending on the value of therefcount. If the value is 1, then the container simply gets updated with its new value (and possibly its type, too). In case therefcountvalue is larger than 1, a new variable container gets created containing the new value (and type). You can see this in step 3 of Figure 2。Therefcount value for the variable container that is linked to the variable $ais decreased by one so that the variable container that belongs to variable$a and $b now has a refcount of 2, and the newly created container has a refcount of 1.
in step 4 ,When unsett( ) is called on a variable the refcount value of the variable container that is linked to the variable that is unset will be decreased by one. This happens when we call unset( $b ) in step 4. If the refcount value drops below 1, the PHP Engine will free the variable container.
in step 5,The variable container is then destroyed, as you can see in step 5.
2. 函数传值 Passing Variables to Functions
Besides the global symbol table that every script has, every call to a user defined function creates a symbol table where a function locally stores its variables. Every time a function is called, such a symbol table is created, and every time a function
returns, this symbol table is destroyed. A function returns by either using the
return statement, or by implicitly returning because the end of the function has been reached.
In Figure 3, I illustrate exactly how variables are assed to functions.
In step 1, we assign a value to the ariable $a, again—“this is”. We pass this variable to the do_something g( ) function, where it is received in the ariable $s.
In step 2, you can see that it is practically he same operation as assigning a variable to another ne (like we did in the previous section with $b = $a),except that the variable is stored in a different
symbol table—the one that belongs to the called function—and that the reference count is increased twice, instead he normal once. The reason for this is that the function’s stack also contains a reference to the variable container.（原因是函数栈也包含了这个变量容器的引用）
in step 3 ，When we assign a new value to the variable $s in step 3, the refcount of the original variable container is decreased by one and a new variable container is created, containing the new variable.
In step 4, we return the variable with thereturn statement. The returned variable gets an entry in the global symbol table and the refcount
value is increased by 1. When the function ends, the function’s symbol table will be destroyed. During the destruction, the engine will go over all variables in the symbol table and decrease therefcount
of each variable container. When a refcount of a variable container reaches 0, the variable container is destroyed.
As you see, the variable container is again not copied when returning it from the function due to PHP’s reference counting mechanism.
If the variable $s would not have been modified in step 3 then variable$a and $b would still point to the
same variable container which would have a refcount value of 2. In this situation, a copy of the variable container that was created with the statement$a = = “ this is ” would not have been made
3. 介绍引用Introducing References
References are a method of having two names for the same variable. A more technical description would be: references are a method of having two keys in a symbol table pointing to the same zval container. References can be created with the reference assignment operator &=.
Figure 4 gives a schematic overview of how references work in combination with reference counting.
Instep 1, we create a variable$a that contains the string “this is”.
Instep 2,Then in step two we create two references ($b and $c)to the same variable container. The refcount increases normally for each assignment making the final refcount 3, after both assignments by reference ($b =& $a and $c =& $a ), but because the reference assignment operator is used, the other valueis_ref is now set to 1.
This value is important for two reasons.The second one I will divulge a little bit later in this article(后面将会说明第二原因), and the first reason that makes this value important is when we are reassigning a new value to one of the three variables that
all point to the same variable container. If the is_ref value is set to 0 when a new value is set for a specific variable, the PHP engine will create a new variable container as you could see in step 3 of Figure 2. But
if the is_ref value is set to 1, then the PHP engine will not create a new variable container and simply only update the value to which one of the variable
names point as you can see in step 2 of Figure 4.
In step 3, The exact same result would be reached when the statement $a = 42 was used instead of$b = 42. After the variable container is modified, all three variables$a, $band $c will contain the value 42 .
In step 4, we use theunset() language construct to remove a variable—in this case variable $c. Using
unset() on a variable means that therefcount value of the variable container that the variable
points to gets decreased by 1. This works exactly the same for referenced variables. There is one difference, though, that shows in step 5.
In step 5 When the reference count of a variable container reaches 1 and the is_ref value is set to 1, the is_ref value is reset to 0. The reason for this is that a variable container can only be marked as a referenced variable container when there is more than one variable pointing to the variable container.
4 .混合变量直接赋值和引用赋值 Mixing Assign-by-Value and Assign-by-Reference
混合方式系，并没有节约内存空间，反而增加了。这个由于引用赋值后需要重新分配一份内存给引用的变量。
Something interesting—and perhaps unexpected—happens if you mix an assign-by-value call and an assign-by-reference call. This shows in Figure 5.
In step 1,In the first step we create two variables$a and$b, where the latter is assigned-by-value to the former. This creates a situation where
there is one variable container withis_ref set to 0 and r re ef fc co ou un nt t set to 2. This should be familiar by now.
In step 2 we proceed by assigning variable$c by reference to variable$c. Here, the PHP engine will create a copy of the variable container. The variable$akeeps pointing
to the original variable container but the refcount is, of course, decreased to 1 as there is only one variable pointing the this variable container now. The variables $b and$c point
to the copied container which has now arefcount of 2 and theis_ref value is set to 1.
You can see that in this case, using a reference does not save you any memory, it actually uses more memory, as it had to duplicate the original variable container.
The container had to be copied, otherwise the PHP engine would have no way of knowing how to deal with the reassignment of one of the three variables as two of them were references to the same container$b and$c, while the
other was not supposed to be a reference. If there is only one container with r re ef fc co ou un nt t set to 3, andis_ref set to 1, then it is impossible to figure that out. That is the reason why the PHP engine needs to create a copy of
the container when you do an assignment-by-reference.
If we switch the order of assignments—first we assign $a by reference to $b and then we assign $a by value to $c—then something similar happens. Figure 6 shows how this is handled.
In step 1,
In the first step we assign the variable $a to the string
“this is” and then we proceed to assign $a by reference to variable$b. We now have one variable container whereis_ref is 1 and refcount is 2.
In step 2,
, we assign variable $a by value to variable $c, now a copy of the variable container is made in order for the PHP engine to be able to handle modifications to the variables, correctly, with the same reasons as stated in the
previous paragraph.But if you go back to step 2 of Figure 2, where we assign the variable$ato both$b and$c, you see that no copy is made here.
5. 函数引用传递Passing References to Functions
Variables can also be passed-by-reference to functions. This is useful when a function needs to modify the value of a specific variable when it is called. The script in
Figure 7 is a slightly modified version of the script that you have already seen in Figure 3.
The only difference is the ampersand (&) in front of the$s variable in the declaration of the functiondo_something(). This ampersand instructs the PHP engine that the variable to which the ampersand
is applied is going to be passed by reference and not by value. A different name for a passed-by-reference variable is an “out variable”. When a variable is passed by reference to a function the new variable in the function’s symbol table is pointed to the
old container and the refcount value is
increased by 2 (one for the symbol table, and one for the stack). Just as in a normal assignment-by-reference the is_ref value inside the variable container is also set to 1 as you can see in step 2. From here on, the same things happen
as with a normal reference like in step 3,where no copy of the variable container is made if we assign a new value to the variable$s.
The refcount $s ; statement is basically the same as the $c = $a statement in step 2 of Figure 6. The global varible$a and the local variable $s are both references to he same variable container and the logic dictates that is_ref is set to 1 for a specific container and this conainer is assigned to another variable by-value, the conainer does not need to be duplicated. This is exactly hat happens here, except that the newly created varible is created in the global symbol table by the assignment of the return value of the function with the statement $b = do_something( $s ).
6 . 函数引用返回 Returning by Reference
Another feature in PHP is the ability to “return by reference”. This is useful, for example, if you want to select a variable for modification with a function, such as
selecting an array element or a node in a tree structure. In Figure 8 we show how returning by references work by means of an example.
In step 1,In this example (step 1), we define a $tree variable (which is actually not a tree, but a simple array) that contains three elements. The three
elements have key values of 1, 2 and 3, and all of them point to a string describing the English word that matches with the key’s value (ie.one, two and three).
In step 2,This array gets passed to the fiind_node()function by reference, along with the key of the element that thefiind_node() function should look for and return. We need to pass by reference here, otherwise we can not return a reference to one of the elements, as we will be returning a reference to a copy of the $tree . When $tree is passed to the function it has arefcount of 3 andis_refis set to 1. Nothing new here.
In step 3,The first statement in the function, $item = & $node[$key], causes a new variable to be created in the symbol table of the function, which points to the array element where the key is “3” (because the variable$key is set to 3). In this step 3 you see that the creation of the$item by assigning it by reference to the array element causes therefcountvalue of the variable container that belongs to the array element to be increased by 1. Theis_refvalue of that variable container is now 1, too, of course.
In step 4,The interesting things happen in step 4 where we return $item (by reference) back to the calling scope and assign it (by reference) to $node. This causes therefcountof the variable container to which the 3rd array key points to be set to 3. At this point $tree, $item (from the function’s scope) and $node (global scope) all point to this variable container.
In step 5, When the symbol table of the function is destroyed (in step 5), therefcount value decreases from 1 to 2.$node is now a reference to the third element in the array. If the variable$item would not have been assigned by reference to the return value of the do_something() function, but instead would have been assigned by value, then$node would not have been a reference to $tree[3]. In this case, therefcount value of the variable container to which $tree[3] points is then 1 after the function ends, but for some strange reason theis_refvalue is not reset to 0 as you might expect. My tests did not find any problems with this, though, in this simple example. If the function do_something() would not have been a “return-by-reference function”, then again the $node variable would not be a reference to $tree[3]]. In this case, theis_ref value of the variable ( $tree )container would have been reset to 0.
In step 6,Finally, in step 6, we modify the value in the variable container to which both$node and $tree[3] point.
Please do note that it is harmful not to accept a reference from a function that returns a reference. In some cases, PHP will get confused and cause memory corruptions which are very hard to find and debug. It is also not a good idea to return a static value as reference, as the PHP engine has problems with that too. In PHP 4.3, both cases can lead to very hard to reproduce bugs and crashes of PHP and the web server. In PHP 5, this works all a little bit better. Here you can expect a warning and it will behave “properly”. Hopefully, a backported fix for this problem makes it into a new minor version of PHP 4—PHP 4.4.
7.The Global Keyword
PHP has a feature that allows the use of a global variable inside a function: you can make this connection with the g gl lo ob ba al l keyword. This keyword will create a ref-
erence between the local variable and the global one. Figure 9 shows this in an example.
In step 1 and 2, we create the variable$varand call the functionupdate_var() with the string literal“one”
as the sole parameter. At this point, we have two variable containers. The first one is pointed to from the global variable $var, and the second one is the $val the functionupdate_var() with the string
literal“one” as the sole parameter. At this point, we have two variable containers. The first one is pointed to from the global variable $var, and the second one is the
$val variable in the called function. The latter variable container has arefcount value of 2, as both the variable on the stack and the local variable$val point to it.
In step 3,The global $var statement, in the function, creates a new variable in the local scope, which is created as a reference to the variable with the same name in the global scope. As you can see in step 3, this increases the refcount of the variable container from 1 to 2 and this also sets the is_ref value to 1.
In step 4, we unset the variable $var . Against some people’s expectation, the global variable $vardoes not get unset—as theunset() was done on a reference to the global variable$varand not that variable itself.
In step 5, To reestablish the reference, we employ the global keyword, again in step 5. As you can see, we have re-created the same situation as in step 3. Instead of using global $var we could just as well have used $var ==&$GLOBAL[ [‘var’] as it would have created the exact same situation.
In step 6, we continue to reassign the $var variable to the function’s $val argument. This changes the value to which both the global variable$var and the local variable$var point; this is what you would expect from a referenced variable. When the function ends,
In step 7, the reference from the variable in the scope of the function disappears, and we end up with one variable container with arefcount of 1 and anis_ref value of 0.
8. （勿滥用引用）Abusing References
In this section, I will give a few examples that show you how references should not be used—in some cases these examples might even create memory corruptions
in PHP 4.3 and lower.
Example 1: “Returning static values by-reference”. In Figure 10, we have a very small script with a return-by-reference function called definition().
This function simply returns an array that contains some elements. Returning by reference makes no sense here, as the exact same things would happen internally if the variable container holding the array was returned by value, except that in the intermediate step (step 3) the is_ref value of the container would not be set to 1, of course. In case the$defvariable in the function’s scope would have been referenced by another variable, something that might happen in a class method where you do $def = $this->def then the return-by-reference properties of the function would have copied the array, because this creates a similar situation as in step 2 of Figure 5.
Example 2: “Accepting references from a function hat doesn’t return references”. This is potentially dan-gerous; PHP 4.3 (and lower) does not handle this properly. In Listing 1, you see an example of something that is not going to work properly.
<?php
function &split_list($emails)
{
$emails =& preg_split(“/[,;]/”, $emails);
return $emails;
}
$emails =
split_list(‘derick@php.net;derick@derickrethans.nl;dr@ez.no’);
This function was implemented with performance in mind, trying not to copy variable containers by using references. As you should know after reading this article, this is not going to buy you anything. There are a few reasons why it doesn’t work. The first reason is that the PHP internal function preg_split() does not return by reference—actually, no internal function in PHP can return anything by reference. So, assigning the return value by reference from a function that doesn’t return a reference is pointless. The second reason why there is no performance benefit, here, is the same one as in Example 1, in the previous paragraph: you’re returning a static valuenot a reference to a variable—it does not make sense to make thes split_list() function to return-by-reference.
9. 总结 Conclusion
After reading this article, I hope that you now fully understand how references, refcounting, and variables work in PHP. It should also have explained that assigning by reference does not always save you memory—it’s better to let the PHP engine handle
this optimization. Do not try to outsmart PHP yourself here and only use references when they are really needed. In PHP 4.3, there are still some problems with references, for which patches are in the works. These patches are backports from PHP 5-specific
code, and although they work fine, they will break binary compatibility—meaning that compiled extensions no longer work after those patches are put into PHP. In my opinion, those hard to produce memory corruption errors should be fixed in PHP 4 too, though,
so perhaps this creates the need for a PHP 4.4 release. If you’re having problems, you can try to use the patch located at http://files.derickrethans.nl/patches/ze1-return-refrence-20050429.diff.txt The
PHP Manual also has some information on references, although it does not explain the internals very well. The URL for the section in PHP’s Manual is
http://php.net/language.references