Question

Function in c:

PHPAPI char *php_pcre_replace(char *regex,   int regex_len,
                              char *subject, int subject_len,
                              zval *replace_val, int is_callable_replace,
                              int *result_len, int limit, int *replace_count TSRMLS_DC)
{
    pcre_cache_entry    *pce;               /* Compiled regular expression */

    /* Compile regex or get it from cache. */
    if ((pce = pcre_get_compiled_regex_cache(regex, regex_len TSRMLS_CC)) == NULL) {
        return NULL;
    }

    return php_pcre_replace_impl(pce, subject, subject_len, replace_val, 
        is_callable_replace, result_len, limit, replace_count TSRMLS_CC);
}

Its assembly:

php5ts!php_pcre_replace:
1015db70 8b442408        mov     eax,dword ptr [esp+8]
1015db74 8b4c2404        mov     ecx,dword ptr [esp+4]
1015db78 56              push    esi
1015db79 8b74242c        mov     esi,dword ptr [esp+2Ch]
1015db7d 56              push    esi
1015db7e 50              push    eax
1015db7f 51              push    ecx
1015db80 e8cbeaffff      call    php5ts!pcre_get_compiled_regex_cache (1015c650)
1015db85 83c40c          add     esp,0Ch
1015db88 85c0            test    eax,eax
1015db8a 7502            jne     php5ts!php_pcre_replace+0x1e (1015db8e)

php5ts!php_pcre_replace+0x1c:
1015db8c 5e              pop     esi
1015db8d c3              ret

php5ts!php_pcre_replace+0x1e:
1015db8e 8b542428        mov     edx,dword ptr [esp+28h]
1015db92 8b4c2424        mov     ecx,dword ptr [esp+24h]
1015db96 56              push    esi
1015db97 52              push    edx
1015db98 8b542428        mov     edx,dword ptr [esp+28h]
1015db9c 51              push    ecx
1015db9d 8b4c2428        mov     ecx,dword ptr [esp+28h]
1015dba1 52              push    edx
1015dba2 8b542428        mov     edx,dword ptr [esp+28h]
1015dba6 51              push    ecx
1015dba7 8b4c2428        mov     ecx,dword ptr [esp+28h]
1015dbab 52              push    edx
1015dbac 8b542428        mov     edx,dword ptr [esp+28h]
1015dbb0 51              push    ecx
1015dbb1 52              push    edx
1015dbb2 50              push    eax
1015dbb3 e808000000      call    php5ts!php_pcre_replace_impl (1015dbc0)
1015dbb8 83c424          add     esp,24h
1015dbbb 5e              pop     esi
1015dbbc c3              ret

As we can see that pcre_get_compiled_regex_cache takes 2 parameters,but why 3 parameters are pushed into the stack?

1015db7d 56              push    esi
1015db7e 50              push    eax
1015db7f 51              push    ecx
1015db80 e8cbeaffff      call    php5ts!pcre_get_compiled_regex_cache (1015c650)

Answer 1

I guess the TSRMLS_DC and TSRMLS_CC macros contain some hidden extra parameters. A quick google showed up these macros in PHP programming as global state data. It makes sense, the macro in the function declaration must have a parameter which is at [esp+02ch] on the stack – the tenth parameter – you have nine already, and is passed as the first value on the stack (values are pushed right to left), followed by regex_len and then regex.