PHP内核解密系列：zend_execute的执行过程

ZEND_API void execute(zend_op_array *op_array TSRMLS_DC)  
{  
    zend_execute_data *execute_data;  
    zend_bool nested = 0;  
    zend_bool original_in_execution = EG(in_execution);  
  
  
    if (EG(exception)) {  
        return;  
    }  
  
    EG(in_execution) = 1;  
  
zend_vm_enter:  
    /* Initialize execute_data */  
    execute_data = (zend_execute_data *)zend_vm_stack_alloc(  
        ZEND_MM_ALIGNED_SIZE(sizeof(zend_execute_data)) +  
        ZEND_MM_ALIGNED_SIZE(sizeof(zval**) * op_array->last_var * (EG(active_symbol_table) ? 1 : 2)) +  
        ZEND_MM_ALIGNED_SIZE(sizeof(temp_variable)) * op_array->T TSRMLS_CC);  
  
    EX(CVs) = (zval***)((char*)execute_data + ZEND_MM_ALIGNED_SIZE(sizeof(zend_execute_data)));  
    memset(EX(CVs), 0, sizeof(zval**) * op_array->last_var);  
    EX(Ts) = (temp_variable *)(((char*)EX(CVs)) + ZEND_MM_ALIGNED_SIZE(sizeof(zval**) * op_array->last_var * (EG(active_symbol_table) ? 1 : 2)));  
    EX(fbc) = NULL;  
    EX(called_scope) = NULL;  
    EX(object) = NULL;  
    EX(old_error_reporting) = NULL;  
    EX(op_array) = op_array;  
    EX(symbol_table) = EG(active_symbol_table);  
    EX(prev_execute_data) = EG(current_execute_data);  
    EG(current_execute_data) = execute_data;  
    EX(nested) = nested;  
    nested = 1;  
  
    if (op_array->start_op) {  
        ZEND_VM_SET_OPCODE(op_array->start_op);  
    } else {  
        ZEND_VM_SET_OPCODE(op_array->opcodes);  
    }  
  
    if (op_array->this_var != -1 && EG(This)) {  
        Z_ADDREF_P(EG(This)); /* For $this pointer */  
        if (!EG(active_symbol_table)) {  
            EX(CVs)[op_array->this_var] = (zval**)EX(CVs) + (op_array->last_var + op_array->this_var);  
            *EX(CVs)[op_array->this_var] = EG(This);  
        } else {  
            if (zend_hash_add(EG(active_symbol_table), "this", sizeof("this"), &EG(This), sizeof(zval *), (void**)&EX(CVs)[op_array->this_var])==FAILURE) {  
                Z_DELREF_P(EG(This));  
            }  
        }  
    }  
  
    EG(opline_ptr) = &EX(opline);  
  
    EX(function_state).function = (zend_function *) op_array;  
    EX(function_state).arguments = NULL;  
      
    while (1) {  
        int ret;  
#ifdef ZEND_WIN32  
        if (EG(timed_out)) {  
            zend_timeout(0);  
        }  
#endif  
  
        if ((ret = EX(opline)->handler(execute_data TSRMLS_CC)) > 0) {  
            switch (ret) {  
                case 1:  
                    EG(in_execution) = original_in_execution;  
                    return;  
                case 2:  
                    op_array = EG(active_op_array);  
                    goto zend_vm_enter;  
                case 3:  
                    execute_data = EG(current_execute_data);  
                default:  
                    break;  
            }  
        }  
  
    }  
    zend_error_noreturn(E_ERROR, "Arrived at end of main loop which shouldn't happen");  
}

struct _zend_op_array {  
    /* Common elements */  
    zend_uchar type;  
    char *function_name;          
    zend_class_entry *scope;  
    zend_uint fn_flags;  
    union _zend_function *prototype;  
    zend_uint num_args;  
    zend_uint required_num_args;  
    zend_arg_info *arg_info;  
    zend_bool pass_rest_by_reference;  
    unsigned char return_reference;  
    /* END of common elements */  
  
    zend_bool done_pass_two;  
  
    zend_uint *refcount;  
  
    zend_op *opcodes;  
    zend_uint last, size;  
  
    zend_compiled_variable *vars;  
    int last_var, size_var;  
  
    zend_uint T;  
  
    zend_brk_cont_element *brk_cont_array;  
    int last_brk_cont;  
    int current_brk_cont;  
  
    zend_try_catch_element *try_catch_array;  
    int last_try_catch;  
  
    /* static variables support */  
    HashTable *static_variables;  
  
    zend_op *start_op;  
    int backpatch_count;  
  
    zend_uint this_var;  
  
    char *filename;  
    zend_uint line_start;  
    zend_uint line_end;  
    char *doc_comment;  
    zend_uint doc_comment_len;  
    zend_uint early_binding; /* the linked list of delayed declarations */  
  
    void *reserved[ZEND_MAX_RESERVED_RESOURCES];  
};  
  
typedef struct _zend_op_array zend_op_array;

#define ZEND_INTERNAL_FUNCTION              1  
#define ZEND_USER_FUNCTION                  2  
#define ZEND_OVERLOADED_FUNCTION            3  
#define ZEND_EVAL_CODE                      4  
#define ZEND_OVERLOADED_FUNCTION_TEMPORARY  5

EX(opline)->handler(execute_data TSRMLS_CC))

#define ZEND_VM_NEXT_OPCODE() /  
    CHECK_SYMBOL_TABLES() /  
    EX(opline)++; /  
    ZEND_VM_CONTINUE()  
  
#define ZEND_VM_SET_OPCODE(new_op) /  
    CHECK_SYMBOL_TABLES() /  
    EX(opline) = new_op  
  
#define ZEND_VM_JMP(new_op) /  
    CHECK_SYMBOL_TABLES() /  
    if (EXPECTED(!EG(exception))) { /  
        EX(opline) = new_op; /  
    } /  
    ZEND_VM_CONTINUE()  
  
#define ZEND_VM_INC_OPCODE() /  
    EX(opline)++

#define ZEND_VM_CONTINUE()   return 0  
#define ZEND_VM_RETURN()     return 1  
#define ZEND_VM_ENTER()      return 2  
#define ZEND_VM_LEAVE()      return 3  
#define ZEND_VM_DISPATCH(opcode, opline) return zend_vm_get_opcode_handler(opcode, opline)(ZEND_OPCODE_HANDLER_ARGS_PASSTHRU);

/* Executor */  
#ifdef ZTS  
# define EG(v) TSRMG(executor_globals_id, zend_executor_globals *, v)  
#else  
# define EG(v) (executor_globals.v)  
extern ZEND_API zend_executor_globals executor_globals;  
#endif

struct _zend_execute_data {  
    struct _zend_op *opline;  
    zend_function_state function_state;  
    zend_function *fbc; /* Function Being Called */  
    zend_class_entry *called_scope;  
    zend_op_array *op_array;  
    zval *object;  
    union _temp_variable *Ts;  
    zval ***CVs;  
    HashTable *symbol_table;  
    struct _zend_execute_data *prev_execute_data;  
    zval *old_error_reporting;  
    zend_bool nested;  
    zval **original_return_value;  
    zend_class_entry *current_scope;  
    zend_class_entry *current_called_scope;  
    zval *current_this;  
    zval *current_object;  
    struct _zend_op *call_opline;  
};

<?php  
$a = 123;  
  
test();  
  
function test()  
{  
    return 1;  
}  
?>

EX(op_array) = op_array; // 设置op_array字段为当前执行的op_array,也就是全局代码的op_array1
EX(prev_execute_data) = EG(current_execute_data);//将全局执行数据中保存的当前op_array执行数据保存到op_array1的execute_data1的prev_execute_data字段，由于这是执行的第一个op_array,所以prev_execute_data实际上是空值,然后将执行期全局变量的current_execute_data设置成execute_data1,然后设置execute_data1的当前执行op，这样就可以开始执行当前的op了

EG(active_op_array) = &EX(function_state).function->op_array;

case 2:
     op_array = EG(active_op_array);
     goto zend_vm_enter;