php是先把源码解析成opcode,然后再把opcode传递给zend_vm进行执行的。
在php7中,我们能很方便用phpdbg来查看一个文件或者一个函数的opcode了。至于phpdbg的使用,现在网上介绍不多,不过好在有很详细的help文档。下面是一个最简单的opcode代码:
$ bin/phpdbg -f /home/xiaoju/software/php7/demo/echo.php
prompt> list 100
00001: <?php
00002:
00003: $a = 1;
00004: $b = $a;
00005: $b = $b + 1;
00006: echo $b;
00007:
prompt> print exec
[Context /home/xiaoju/software/php7/demo/echo.php (6 ops)]
L1-7 {main}() /home/xiaoju/software/php7/demo/echo.php - 0x7fe3fae63300 + 6 ops
L3
这个php文件就做了一个最简单的加法操作。生成了6个_zend_op。所展示的每一行代表一个_zend_op
_zendop.lineno op号 _zend_op.opcode _zend_op.op1 _zend_op.op2 _zend_op.result
L5 #2 ADD $b 1 ~2
这里_zend_op.opcode对应的操作在官网有文档和详细的例子可以查看:http://cn.php.net/manual/zh/internals2.opcodes.php
值得一说的是,phpdbg还有一个远端UI版本,能让我们在近端诊断服务端的php信息
但是我们的目标还是在于研究php源码,phpdbg只能分析到opcode这层,还是不够的,gdb可能是更好的选择。
gdb的使用和平时使用差不多
比如我现在有个脚本echo.php:
1 <?php
2
3 $a = 1;
4 $b = $a;
5 $b = $b + 1;
6 echo $b;
我的php安装路径在:
/home/xiaoju/software/php7/bin/php
php源码路径在:
/home/xiaoju/webroot/php-src/php-src-master/
运行gdb
$ gdb /home/xiaoju/software/php7/bin/php
加载gdbinit:
(gdb) source /home/xiaoju/webroot/php-src/php-src-master/.gdbinit
设置断点:
(gdb) b zend_execute_scripts
运行:
(gdb) run -f /home/xiaoju/software/php7/demo/echo.php
我想在1459这行设置个断点:
1452 for (i = 0; i < file_count; i++) {
1453 file_handle = va_arg(files, zend_file_handle *);
1454 if (!file_handle) {
1455 continue;
1456 }
1457
1458 op_array = zend_compile_file(file_handle, type);
1459 if (file_handle->opened_path) {
1460 zend_hash_add_empty_element(&EG(included_files), file_handle->opened_path);
1461 }
(gdb) b 1459
继续跑
(gdb) continue
(gdb) s
(gdb) s
打印出这个时候的op_array
(gdb) p *op_array
$4 = {type = 2 '\002', arg_flags = "\000\000", fn_flags = 134217728, function_name = 0x0, scope = 0x0,
prototype = 0x0, num_args = 0, required_num_args = 0, arg_info = 0x0, refcount = 0x7ffff6002000, last = 6,
opcodes = 0x7ffff6076240, last_var = 2, T = 4, vars = 0x7ffff6079030, last_live_range = 0, last_try_catch = 0,
live_range = 0x0, try_catch_array = 0x0, static_variables = 0x0, filename = 0x7ffff605c2d0, line_start = 1,
line_end = 7, doc_comment = 0x0, early_binding = 4294967295, last_literal = 3, literals = 0x7ffff60030c0,
cache_size = 0, run_time_cache = 0x0, reserved = {0x0, 0x0, 0x0, 0x0}}
我可以优化输出:
(gdb) set print pretty on
(gdb) p *op_array
$5 = {
type = 2 '\002',
arg_flags = "\000\000",
fn_flags = 134217728,
function_name = 0x0,
scope = 0x0,
prototype = 0x0,
num_args = 0,
required_num_args = 0,
arg_info = 0x0,
refcount = 0x7ffff6002000,
last = 6,
opcodes = 0x7ffff6076240,
last_var = 2,
T = 4,
vars = 0x7ffff6079030,
last_live_range = 0,
last_try_catch = 0,
live_range = 0x0,
try_catch_array = 0x0,
static_variables = 0x0,
filename = 0x7ffff605c2d0,
line_start = 1,
line_end = 7,
doc_comment = 0x0,
early_binding = 4294967295,
last_literal = 3,
literals = 0x7ffff60030c0,
cache_size = 0,
run_time_cache = 0x0,
reserved = {0x0, 0x0, 0x0, 0x0}
}
我想打出op_array.filename.val的具体值
(gdb) p (op_array.filename.len)
$12 = 40
(gdb) p *(op_array.filename.val)@40
$13 = "/home/xiaoju/software/php7/demo/echo.php"
好了,我们可以顺便研究下_zend_op_array这个结构:
|
请发表评论