Pinned Tweet
All right! 我,Big Head,技术能力平平、对很多事情一知半解,却总能莫名其妙地升职,发财,成功,朋友牛逼,好玩的事有趣的人络绎不绝。
Yeah. “Fucking billionaires!”
10/21 PHP 发了安全更新,修了两个 critical RCE(CVE-2026-109618 / 109619)。官方 advisory 对第二个的描述大意是:worker 里的全局状态还指向上一个 request 已释放的内存,正常 reset 被 fatal error 跳过了,下一个 request 在正常初始化之前就用上了它,形成 use-after-free。
这类问题不只 PHP 有。任何「长生命周期 worker + 对象复用」的系统都可能踩到,连接池、游戏服务器、各种为了躲 GC 做的对象池都算。
对象复用的坑,往往不在 happy path:
- reset 写在 release 里,某个异常分支跳过了 reset 却照样把对象还回池子
- 下一次 acquire 拿到它,大部分字段被覆盖了,偏偏一个可选字段没被覆盖,带着上一次请求的值往下走
- 测试全绿,因为测试数据里每个字段都填了
第一个 CVE 据 advisory 描述也是同一类:内存还没初始化完就被 OOM 打断,request shutdown 又去读这块半初始化的数据。
比较稳的做法:reset 放在 acquire 侧,默认池子里的对象是脏的;错误路径和正常路径走同一个 cleanup;再留一个 debug 模式,release 时把对象填满垃圾值,让漏 reset 的字段在测试里直接炸出来。
我认为就是一种防御性编程吧
交易系统最怕的,不是慢,而是你根本不知道它什么时候会突然变慢。
平时延迟稳稳地跑在几十微秒,结果一看 P99.9,直接飙到几毫秒,甚至更高。
最头疼的是,这种长尾延迟往往不是某一行代码慢,而是各种因素叠加出来的。
CPU cache miss、TLB miss、线程抢占、NUMA 远程访问,甚至偶发的 page fault。
单独看可能都不严重,但几个因素撞到一起,尾延迟就很难看了。
更烦的是,压测数据挺漂亮,一上生产,流量一突增,P99.9 就开始乱跳,想复现都难。
所以现在做性能优化,我更关心 latency distribution,而不只是 average latency。
低延迟系统真正难的,不是再快几微秒,而是搞清楚最慢的那 0.1% 到底发生了什么。
A matching engine can look fast if the latency clock starts after dequeue.
During a burst, orders may spend more time waiting than matching.
Measure from ingress, and keep queueing time visible.
The latency you leave out still gets paid by the user.
In a replicated matching engine, what does an order ACK promise?
Received, sequenced, and committed to a quorum are different milestones.
If the leader dies right after the ACK, can the order disappear?
That answer should shape your retry and deduplication design.
8/ Fowler 文中转述了 LMAX 团队反复强调的一点,到今天仍然值得记住:"coming up with meaningful performance tests is often harder than developing the production code"。
Disruptor 论文:lmax-exchange.github.io/disr…
Martin Fowler《The LMAX Architecture》:martinfowler.com/articles/lm…
Big Head: "Three more classes, and I get my boat license."
Richard: "How many classes does it take?"
Big Head: "Three."
The energy I bring to every new year's resolution. Progress: 0%. Confidence: 100%. 💪
(sent by Grok bot)
Big Head, S2E9: "Gavin promoted me just to spite you. And now he keeps promoting me for some inexplicable reason."
Career goal unlocked: be the inexplicable reason. 🥤
(sent by Grok bot)







