Coverage Report

Created: 2026-06-02 06:36

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/Optimizer/pass3.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright © The PHP Group and Contributors.                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to the Modified BSD License that is      |
8
   | bundled with this package in the file LICENSE, and is available      |
9
   | through the World Wide Web at <https://www.php.net/license/>.        |
10
   |                                                                      |
11
   | SPDX-License-Identifier: BSD-3-Clause                                |
12
   +----------------------------------------------------------------------+
13
   | Authors: Andi Gutmans <andi@php.net>                                 |
14
   |          Zeev Suraski <zeev@php.net>                                 |
15
   |          Stanislav Malyshev <stas@zend.com>                          |
16
   |          Dmitry Stogov <dmitry@php.net>                              |
17
   +----------------------------------------------------------------------+
18
*/
19
20
/* pass 3: (Jump optimization)
21
 * - optimize series of JMPs
22
 */
23
24
#include "Optimizer/zend_optimizer.h"
25
#include "Optimizer/zend_optimizer_internal.h"
26
#include "zend_API.h"
27
#include "zend_constants.h"
28
#include "zend_execute.h"
29
#include "zend_vm.h"
30
31
/* we use "jmp_hitlist" to avoid infinity loops during jmp optimization */
32
static zend_always_inline bool in_hitlist(zend_op *target, zend_op **jmp_hitlist, int jmp_hitlist_count)
33
0
{
34
0
  int i;
35
36
0
  for (i = 0; i < jmp_hitlist_count; i++) {
37
0
    if (jmp_hitlist[i] == target) {
38
0
      return true;
39
0
    }
40
0
  }
41
0
  return false;
42
0
}
43
44
#define CHECK_LOOP(target) \
45
0
  if (EXPECTED(!in_hitlist(target, jmp_hitlist, jmp_hitlist_count))) { \
46
0
    jmp_hitlist[jmp_hitlist_count++] = target;  \
47
0
  } else { \
48
0
    break; \
49
0
  }
50
51
void zend_optimizer_pass3(zend_op_array *op_array, zend_optimizer_ctx *ctx)
52
0
{
53
0
  zend_op *opline;
54
0
  zend_op *end;
55
0
  zend_op *target;
56
0
  zend_op **jmp_hitlist;
57
0
  int jmp_hitlist_count;
58
0
  ALLOCA_FLAG(use_heap);
59
60
0
  jmp_hitlist = (zend_op**)do_alloca(sizeof(zend_op*)*op_array->last, use_heap);
61
0
  opline = op_array->opcodes;
62
0
  end =  opline + op_array->last;
63
64
0
  while (opline < end) {
65
66
0
    switch (opline->opcode) {
67
0
      case ZEND_JMP:
68
0
        jmp_hitlist_count = 0;
69
70
0
        target = ZEND_OP1_JMP_ADDR(opline);
71
0
        while (1) {
72
0
          if (target->opcode == ZEND_JMP) {
73
            /* convert JMP L1 ... L1: JMP L2 to JMP L2 .. L1: JMP L2 */
74
0
            target = ZEND_OP1_JMP_ADDR(target);
75
0
            CHECK_LOOP(target);
76
0
          } else if (target->opcode == ZEND_NOP) {
77
0
            target = target + 1;
78
0
          } else {
79
0
            break;
80
0
          }
81
0
          ZEND_SET_OP_JMP_ADDR(opline, opline->op1, target);
82
0
        }
83
84
0
        if (target == opline + 1) {
85
          /* convert L: JMP L+1 to NOP */
86
0
          MAKE_NOP(opline);
87
0
        } else if ((target->opcode == ZEND_RETURN ||
88
0
                    target->opcode == ZEND_RETURN_BY_REF ||
89
0
                    target->opcode == ZEND_GENERATOR_RETURN) &&
90
0
                   !(op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK)) {
91
          /* JMP L, L: RETURN to immediate RETURN */
92
0
          *opline = *target;
93
0
          if (opline->op1_type == IS_CONST) {
94
0
            zval zv;
95
0
            ZVAL_COPY(&zv, &ZEND_OP1_LITERAL(opline));
96
0
            opline->op1.constant = zend_optimizer_add_literal(op_array, &zv);
97
0
          }
98
0
        } else if (opline > op_array->opcodes &&
99
0
                   ((opline-1)->opcode == ZEND_JMPZ ||
100
0
                    (opline-1)->opcode == ZEND_JMPNZ)) {
101
0
            if (ZEND_OP2_JMP_ADDR(opline-1) == target) {
102
            /* JMPZ(X,L1), JMP(L1) -> NOP, JMP(L1) */
103
0
            zend_optimizer_convert_to_free_op1(op_array, opline - 1);
104
0
            }
105
0
        }
106
0
        break;
107
108
0
      case ZEND_JMP_SET:
109
0
      case ZEND_COALESCE:
110
0
        jmp_hitlist_count = 0;
111
112
0
        target = ZEND_OP2_JMP_ADDR(opline);
113
0
        while (1) {
114
0
          if (target->opcode == ZEND_JMP) {
115
0
            target = ZEND_OP1_JMP_ADDR(target);
116
0
            CHECK_LOOP(target);
117
0
          } else if (target->opcode == ZEND_NOP) {
118
0
            target = target + 1;
119
0
          } else {
120
0
            break;
121
0
          }
122
0
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, target);
123
0
        }
124
0
        break;
125
126
0
      case ZEND_JMPZ:
127
0
      case ZEND_JMPNZ:
128
0
        jmp_hitlist_count = 0;
129
130
0
        target = ZEND_OP2_JMP_ADDR(opline);
131
0
        while (1) {
132
0
          if (target->opcode == ZEND_JMP) {
133
            /* plain JMP */
134
            /* JMPZ(X,L1), L1: JMP(L2) => JMPZ(X,L2), L1: JMP(L2) */
135
0
            target = ZEND_OP1_JMP_ADDR(target);
136
0
            CHECK_LOOP(target);
137
0
          } else if (target->opcode == opline->opcode &&
138
0
                     SAME_VAR(opline->op1, target->op1)) {
139
            /* same opcode and same var as this opcode */
140
            /* JMPZ(X,L1), L1: JMPZ(X,L2) => JMPZ(X,L2), L1: JMPZ(X,L2) */
141
0
            target = ZEND_OP2_JMP_ADDR(target);
142
0
            CHECK_LOOP(target);
143
0
          } else if (target->opcode == INV_COND(opline->opcode) &&
144
0
                     SAME_VAR(opline->op1, target->op1)) {
145
            /* convert JMPZ(X,L1), L1: JMPNZ(X,L2) to
146
               JMPZ(X,L1+1) */
147
0
            target = target + 1;
148
0
          } else if (target->opcode == ZEND_NOP) {
149
0
            target = target + 1;
150
0
          } else {
151
0
            break;
152
0
          }
153
0
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, target);
154
0
        }
155
156
        /* convert L: JMPZ L+1 to NOP */
157
0
        if (target == opline + 1) {
158
0
          zend_optimizer_convert_to_free_op1(op_array, opline);
159
0
        }
160
0
        break;
161
162
0
      case ZEND_JMPZ_EX:
163
0
      case ZEND_JMPNZ_EX:
164
0
        jmp_hitlist_count = 0;
165
166
0
        target = ZEND_OP2_JMP_ADDR(opline);
167
0
        while (1) {
168
0
          if (target->opcode == ZEND_JMP) {
169
            /* plain JMP */
170
            /* JMPZ_EX(X,L1), L1: JMP(L2) => JMPZ_EX(X,L2), L1: JMP(L2) */
171
0
            target = ZEND_OP1_JMP_ADDR(target);
172
0
            CHECK_LOOP(target);
173
0
          } else if (target->opcode == opline->opcode-3 &&
174
0
                     (SAME_VAR(target->op1, opline->result) ||
175
0
                      SAME_VAR(target->op1, opline->op1))) {
176
            /* convert T=JMPZ_EX(X,L1), L1: JMPZ(T,L2) to
177
               JMPZ_EX(X,L2) */
178
0
            target = ZEND_OP2_JMP_ADDR(target);
179
0
            CHECK_LOOP(target);
180
0
          } else if (target->opcode == opline->opcode &&
181
0
                     target->result.var == opline->result.var &&
182
0
                     (SAME_VAR(target->op1, opline->result) ||
183
0
                      SAME_VAR(target->op1, opline->op1))) {
184
            /* convert T=JMPZ_EX(X,L1), L1: T=JMPZ_EX(T,L2) to
185
               JMPZ_EX(X,L2) */
186
0
            target = ZEND_OP2_JMP_ADDR(target);
187
0
            CHECK_LOOP(target);
188
0
          } else if (target->opcode == INV_EX_COND(opline->opcode) &&
189
0
                     (SAME_VAR(target->op1, opline->result) ||
190
0
                      SAME_VAR(target->op1, opline->op1))) {
191
             /* convert T=JMPZ_EX(X,L1), L1: JMPNZ(T,L2) to
192
              JMPZ_EX(X,L1+1) */
193
0
            target = target + 1;
194
0
          } else if (target->opcode == INV_EX_COND_EX(opline->opcode) &&
195
0
                     target->result.var == opline->result.var &&
196
0
                     (SAME_VAR(target->op1, opline->result) ||
197
0
                      SAME_VAR(target->op1, opline->op1))) {
198
             /* convert T=JMPZ_EX(X,L1), L1: T=JMPNZ_EX(T,L2) to
199
              JMPZ_EX(X,L1+1) */
200
0
            target = target + 1;
201
0
          } else if (target->opcode == ZEND_BOOL &&
202
0
                     (SAME_VAR(target->op1, opline->result) ||
203
0
                      SAME_VAR(target->op1, opline->op1))) {
204
            /* convert Y = JMPZ_EX(X,L1), L1: Z = BOOL(Y) to
205
               Z = JMPZ_EX(X,L1+1) */
206
207
            /* NOTE: This optimization pattern is not safe, but works, */
208
            /*       because result of JMPZ_EX instruction             */
209
            /*       is not used on the following path and             */
210
            /*       should be used once on the branch path.           */
211
            /*                                                         */
212
            /*       The pattern works well only if jumps processed in */
213
            /*       direct order, otherwise it breaks JMPZ_EX         */
214
            /*       sequences too early.                              */
215
0
            opline->result.var = target->result.var;
216
0
            target = target + 1;
217
0
            CHECK_LOOP(target);
218
0
          } else if (target->opcode == ZEND_NOP) {
219
0
            target = target + 1;
220
0
          } else {
221
0
            break;
222
0
          }
223
0
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, target);
224
0
        }
225
226
        /* convert L: T = JMPZ_EX X,L+1 to T = BOOL(X) */
227
0
        if (target == opline + 1) {
228
0
          opline->opcode = ZEND_BOOL;
229
0
          opline->op2.num = 0;
230
0
        }
231
0
        break;
232
0
    }
233
0
    opline++;
234
0
  }
235
0
  free_alloca(jmp_hitlist, use_heap);
236
0
}