Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:32577
Mailing-List: contact internals-help@lists.php.net; run by ezmlm
Received-SPF: pass (pb1.pair.com: domain gmail.com designates 64.233.182.188 as permitted sender)
DomainKey-Status: bad
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references;
        b=FS23bZm+3OgquPSpyTxvzvodsOZnCpRP9hORxN5tEacbdrOiOygLgdaPV3kACx3T08ODuuABbIDW0y8NE3pKJzRzYGpfABFIuMJKdCHxQyTyNxvtCQTKRz5BaVbbIFnV+9g2g65tJFSHl0nLCtdyvIApNYt95FCL35OEnQOUwUU=
Message-ID: <ee59b7580710021831oa0460eena55a58ce63c5d5d7@mail.gmail.com>
Date: Tue, 2 Oct 2007 18:31:14 -0700
To: "Wietse Venema" <wietse@porcupine.org>
Cc: internals@lists.php.net
In-Reply-To: <20071003003533.EAE341F3E99@spike.porcupine.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20071003003533.EAE341F3E99@spike.porcupine.org>
Subject: Re: [PHP-DEV] PHP taint support: first results
From: planetbeing@gmail.com ("David Wang")

On 10/2/07, Wietse Venema <wietse@porcupine.org> wrote:
> Low-level implementation
> ------------------------
>
> Taint support is implemented with some of the unused bits in the
> zval data structure. The zval is the PHP equivalent of a memory
> cell. Besides a type (string, number etc.) and value, each zval has
> a reference count and a flag that says whether the zval is a reference
> to yet another zval that contains the actual value.

One possible problem area is that I'm using some of those very same
bits for storing GC information. I'm not using very many, so there
should be plenty to go around, but I'm currently using 3 bits in
is_ref. 2 for the "color" (the GC state of the object) and 1 for
whether or not the object is internally buffered. Just a heads up.

Some details: I have the leftmost bit in is_ref be the indicator of
is_ref. This is so I can test is_ref by just testing (z->is_ref >=
0x80). The reason I'm doing it like this is because I find that this
comparison test is a lot faster than doing a bitwise test. I then use
the other top three bits for what I need, so the bottom 4 bits are
free.

We really should conserve space, though. The biggest problem with
increasing the size of the zval struct seems to be (incredibly) L1
cache misses, as verified with cachegrind. Even increasing the size of
the current zval struct by one byte has a measurable impact (my goal
was to keep Zend/bench.php from showing any hit at all).

David