Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/Optimizer/block_pass.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Stanislav Malyshev <stas@zend.com>                          |
18
   |          Dmitry Stogov <dmitry@php.net>                              |
19
   +----------------------------------------------------------------------+
20
*/
21
22
#include "Optimizer/zend_optimizer.h"
23
#include "Optimizer/zend_optimizer_internal.h"
24
#include "zend_API.h"
25
#include "zend_constants.h"
26
#include "zend_execute.h"
27
#include "zend_vm.h"
28
#include "zend_bitset.h"
29
#include "zend_cfg.h"
30
#include "zend_dump.h"
31
32
/* Checks if a constant (like "true") may be replaced by its value */
33
bool zend_optimizer_get_persistent_constant(zend_string *name, zval *result, int copy)
34
30.9k
{
35
30.9k
  zend_constant *c = zend_hash_find_ptr(EG(zend_constants), name);
36
30.9k
  if (c) {
37
46
    if ((ZEND_CONSTANT_FLAGS(c) & CONST_PERSISTENT)
38
46
     && !(ZEND_CONSTANT_FLAGS(c) & CONST_DEPRECATED)
39
46
     && (!(ZEND_CONSTANT_FLAGS(c) & CONST_NO_FILE_CACHE)
40
0
      || !(CG(compiler_options) & ZEND_COMPILE_WITH_FILE_CACHE))) {
41
0
      ZVAL_COPY_VALUE(result, &c->value);
42
0
      if (copy) {
43
0
        Z_TRY_ADDREF_P(result);
44
0
      }
45
0
      return 1;
46
46
    } else {
47
46
      return 0;
48
46
    }
49
46
  }
50
51
  /* Special constants null/true/false can always be substituted. */
52
30.8k
  c = zend_get_special_const(ZSTR_VAL(name), ZSTR_LEN(name));
53
30.8k
  if (c) {
54
0
    ZVAL_COPY_VALUE(result, &c->value);
55
0
    return 1;
56
0
  }
57
30.8k
  return 0;
58
30.8k
}
59
60
/* Data dependencies macros */
61
62
1.85M
#define VAR_SOURCE(op) Tsource[VAR_NUM(op.var)]
63
1.74M
#define SET_VAR_SOURCE(opline) Tsource[VAR_NUM(opline->result.var)] = opline
64
65
static void strip_leading_nops(zend_op_array *op_array, zend_basic_block *b)
66
9.03k
{
67
9.03k
  zend_op *opcodes = op_array->opcodes;
68
69
10.7k
  do {
70
10.7k
    b->start++;
71
10.7k
    b->len--;
72
10.7k
  } while (b->len > 0 && opcodes[b->start].opcode == ZEND_NOP);
73
9.03k
}
74
75
static void strip_nops(zend_op_array *op_array, zend_basic_block *b)
76
641k
{
77
641k
  uint32_t i, j;
78
79
641k
  if (b->len == 0) {
80
942
    return;
81
942
  }
82
83
640k
  if (op_array->opcodes[b->start].opcode == ZEND_NOP) {
84
2.82k
    strip_leading_nops(op_array, b);
85
2.82k
  }
86
87
640k
  if (b->len == 0) {
88
60
    return;
89
60
  }
90
91
  /* strip the inside NOPs */
92
640k
  i = j = b->start + 1;
93
3.69M
  while (i < b->start + b->len) {
94
3.05M
    if (op_array->opcodes[i].opcode != ZEND_NOP) {
95
3.02M
      if (i != j) {
96
51.1k
        op_array->opcodes[j] = op_array->opcodes[i];
97
51.1k
      }
98
3.02M
      j++;
99
3.02M
    }
100
3.05M
    i++;
101
3.05M
  }
102
640k
  b->len = j - b->start;
103
666k
  while (j < i) {
104
25.5k
    MAKE_NOP(op_array->opcodes + j);
105
25.5k
    j++;
106
25.5k
  }
107
640k
}
108
109
66
static int get_const_switch_target(zend_cfg *cfg, zend_op_array *op_array, zend_basic_block *block, zend_op *opline, zval *val) {
110
66
  HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
111
66
  zval *zv;
112
66
  if ((opline->opcode == ZEND_SWITCH_LONG && Z_TYPE_P(val) != IS_LONG)
113
66
      || (opline->opcode == ZEND_SWITCH_STRING && Z_TYPE_P(val) != IS_STRING)) {
114
    /* fallback to next block */
115
0
    return block->successors[block->successors_count - 1];
116
0
  }
117
66
  if (opline->opcode == ZEND_MATCH && Z_TYPE_P(val) != IS_LONG && Z_TYPE_P(val) != IS_STRING) {
118
    /* always jump to the default arm */
119
12
    return block->successors[block->successors_count - 1];
120
12
  }
121
54
  if (Z_TYPE_P(val) == IS_LONG) {
122
30
    zv = zend_hash_index_find(jumptable, Z_LVAL_P(val));
123
30
  } else {
124
24
    ZEND_ASSERT(Z_TYPE_P(val) == IS_STRING);
125
24
    zv = zend_hash_find(jumptable, Z_STR_P(val));
126
24
  }
127
54
  if (!zv) {
128
    /* default */
129
32
    return block->successors[block->successors_count - (opline->opcode == ZEND_MATCH ? 1 : 2)];
130
32
  }
131
22
  return cfg->map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv))];
132
54
}
133
134
static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array, zend_bitset used_ext, zend_cfg *cfg, zend_op **Tsource, uint32_t *opt_count)
135
641k
{
136
641k
  zend_op *opline, *src;
137
641k
  zend_op *end, *last_op = NULL;
138
139
641k
  if (block->len == 0) {
140
248
    return;
141
248
  }
142
143
641k
  if (op_array->opcodes[block->start].opcode == ZEND_NOP) {
144
    /* remove leading NOPs */
145
6.20k
    strip_leading_nops(op_array, block);
146
6.20k
  }
147
148
641k
  opline = op_array->opcodes + block->start;
149
641k
  end = opline + block->len;
150
4.33M
  while (opline < end) {
151
    /* Constant Propagation: strip X = QM_ASSIGN(const) */
152
3.69M
    if (opline->op1_type == IS_TMP_VAR &&
153
3.69M
        opline->opcode != ZEND_FREE) {
154
681k
      src = VAR_SOURCE(opline->op1);
155
681k
      if (src &&
156
681k
          src->opcode == ZEND_QM_ASSIGN &&
157
681k
          src->op1_type == IS_CONST
158
681k
      ) {
159
524
        znode_op op1 = opline->op1;
160
524
        if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
161
2
          COPY_NODE(opline->result, opline->op1);
162
2
          COPY_NODE(opline->op1, src->op1);
163
2
          VAR_SOURCE(op1) = NULL;
164
2
          MAKE_NOP(src);
165
2
          ++(*opt_count);
166
522
        } else {
167
522
          zval c;
168
522
          ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
169
522
          if (opline->opcode != ZEND_CASE
170
522
           && opline->opcode != ZEND_CASE_STRICT
171
522
           && opline->opcode != ZEND_FETCH_LIST_R
172
522
           && opline->opcode != ZEND_SWITCH_LONG
173
522
           && opline->opcode != ZEND_SWITCH_STRING
174
522
           && opline->opcode != ZEND_MATCH
175
522
           && opline->opcode != ZEND_MATCH_ERROR
176
522
           && zend_optimizer_update_op1_const(op_array, opline, &c)) {
177
494
            VAR_SOURCE(op1) = NULL;
178
494
            if (opline->opcode != ZEND_JMP_NULL
179
494
             && !zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
180
452
              literal_dtor(&ZEND_OP1_LITERAL(src));
181
452
              MAKE_NOP(src);
182
452
            }
183
494
            ++(*opt_count);
184
494
          } else {
185
28
            zval_ptr_dtor_nogc(&c);
186
28
          }
187
522
        }
188
524
      }
189
681k
    }
190
191
    /* Constant Propagation: strip X = QM_ASSIGN(const) */
192
3.69M
    if (opline->op2_type == IS_TMP_VAR) {
193
654k
      src = VAR_SOURCE(opline->op2);
194
654k
      if (src &&
195
654k
          src->opcode == ZEND_QM_ASSIGN &&
196
654k
          src->op1_type == IS_CONST) {
197
198
76
        znode_op op2 = opline->op2;
199
76
        zval c;
200
201
76
        ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
202
76
        if (zend_optimizer_update_op2_const(op_array, opline, &c)) {
203
64
          VAR_SOURCE(op2) = NULL;
204
64
          if (!zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
205
64
            literal_dtor(&ZEND_OP1_LITERAL(src));
206
64
            MAKE_NOP(src);
207
64
          }
208
64
          ++(*opt_count);
209
64
        } else {
210
12
          zval_ptr_dtor_nogc(&c);
211
12
        }
212
76
      }
213
654k
    }
214
215
3.69M
    switch (opline->opcode) {
216
192k
      case ZEND_ECHO:
217
192k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
218
36.8k
          src = VAR_SOURCE(opline->op1);
219
36.8k
          if (src &&
220
36.8k
              src->opcode == ZEND_CAST &&
221
36.8k
              src->extended_value == IS_STRING) {
222
            /* T = CAST(X, String), ECHO(T) => NOP, ECHO(X) */
223
93
            VAR_SOURCE(opline->op1) = NULL;
224
93
            COPY_NODE(opline->op1, src->op1);
225
93
            MAKE_NOP(src);
226
93
            ++(*opt_count);
227
93
          }
228
155k
        } else if (opline->op1_type == IS_CONST &&
229
155k
                   Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_DOUBLE) {
230
153k
          if (last_op == opline - 1) {
231
            /* compress consecutive ECHO's.
232
             * Float to string conversion may be affected by current
233
             * locale setting.
234
             */
235
4.86k
            size_t l, old_len;
236
237
4.86k
            if (Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_STRING) {
238
55
              convert_to_string(&ZEND_OP1_LITERAL(opline));
239
55
            }
240
4.86k
            if (Z_TYPE(ZEND_OP1_LITERAL(last_op)) != IS_STRING) {
241
33
              convert_to_string(&ZEND_OP1_LITERAL(last_op));
242
33
            }
243
4.86k
            old_len = Z_STRLEN(ZEND_OP1_LITERAL(last_op));
244
4.86k
            l = old_len + Z_STRLEN(ZEND_OP1_LITERAL(opline));
245
4.86k
            if (!Z_REFCOUNTED(ZEND_OP1_LITERAL(last_op))) {
246
1.55k
              zend_string *tmp = zend_string_alloc(l, 0);
247
1.55k
              memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP1_LITERAL(last_op)), old_len);
248
1.55k
              Z_STR(ZEND_OP1_LITERAL(last_op)) = tmp;
249
3.31k
            } else {
250
3.31k
              Z_STR(ZEND_OP1_LITERAL(last_op)) = zend_string_extend(Z_STR(ZEND_OP1_LITERAL(last_op)), l, 0);
251
3.31k
            }
252
4.86k
            Z_TYPE_INFO(ZEND_OP1_LITERAL(last_op)) = IS_STRING_EX;
253
4.86k
            memcpy(Z_STRVAL(ZEND_OP1_LITERAL(last_op)) + old_len, Z_STRVAL(ZEND_OP1_LITERAL(opline)), Z_STRLEN(ZEND_OP1_LITERAL(opline)));
254
4.86k
            Z_STRVAL(ZEND_OP1_LITERAL(last_op))[l] = '\0';
255
4.86k
            zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
256
4.86k
            ZVAL_STR(&ZEND_OP1_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP1_LITERAL(last_op))));
257
4.86k
            ZVAL_NULL(&ZEND_OP1_LITERAL(last_op));
258
4.86k
            MAKE_NOP(last_op);
259
4.86k
            ++(*opt_count);
260
4.86k
          }
261
153k
          last_op = opline;
262
153k
        }
263
192k
        break;
264
265
574
      case ZEND_MATCH_ERROR:
266
574
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
267
244
          src = VAR_SOURCE(opline->op1);
268
244
          VAR_SOURCE(opline->op1) = NULL;
269
244
        }
270
574
        break;
271
272
50.9k
      case ZEND_FREE:
273
        /* Note: Only remove the source if the source is local to this block.
274
         * If it's not local, then the other blocks successors must also eventually either FREE or consume the temporary,
275
         * hence removing the temporary is not safe in the general case, especially when other consumers are not FREE.
276
         * A FREE may not be removed without also removing the source's result, because otherwise that would cause a memory leak. */
277
50.9k
        if (opline->extended_value == ZEND_FREE_VOID_CAST) {
278
          /* Keep the ZEND_FREE opcode alive. */
279
50.8k
        } else if (opline->op1_type == IS_TMP_VAR) {
280
25.0k
          src = VAR_SOURCE(opline->op1);
281
25.0k
          if (src) {
282
21.7k
            switch (src->opcode) {
283
19
              case ZEND_BOOL:
284
229
              case ZEND_BOOL_NOT:
285
                /* T = BOOL(X), FREE(T) => T = BOOL(X) */
286
                /* The remaining BOOL is removed by a separate optimization */
287
                /* The source is a bool, no source removals take place, so this may be done non-locally. */
288
229
                VAR_SOURCE(opline->op1) = NULL;
289
229
                MAKE_NOP(opline);
290
229
                ++(*opt_count);
291
229
                break;
292
1.25k
              case ZEND_ASSIGN:
293
1.26k
              case ZEND_ASSIGN_DIM:
294
1.26k
              case ZEND_ASSIGN_OBJ:
295
1.26k
              case ZEND_ASSIGN_STATIC_PROP:
296
1.67k
              case ZEND_ASSIGN_OP:
297
1.67k
              case ZEND_ASSIGN_DIM_OP:
298
1.68k
              case ZEND_ASSIGN_OBJ_OP:
299
1.68k
              case ZEND_ASSIGN_STATIC_PROP_OP:
300
1.68k
              case ZEND_PRE_INC:
301
1.68k
              case ZEND_PRE_DEC:
302
1.68k
              case ZEND_PRE_INC_OBJ:
303
1.68k
              case ZEND_PRE_DEC_OBJ:
304
1.68k
              case ZEND_PRE_INC_STATIC_PROP:
305
1.68k
              case ZEND_PRE_DEC_STATIC_PROP:
306
1.68k
                if (src < op_array->opcodes + block->start) {
307
0
                  break;
308
0
                }
309
1.68k
                src->result_type = IS_UNUSED;
310
1.68k
                VAR_SOURCE(opline->op1) = NULL;
311
1.68k
                MAKE_NOP(opline);
312
1.68k
                ++(*opt_count);
313
1.68k
                break;
314
19.7k
              default:
315
19.7k
                break;
316
21.7k
            }
317
21.7k
          }
318
25.8k
        } else if (opline->op1_type == IS_VAR) {
319
25.8k
          src = VAR_SOURCE(opline->op1);
320
          /* V = OP, FREE(V) => OP. NOP */
321
25.8k
          if (src >= op_array->opcodes + block->start &&
322
25.8k
              src->opcode != ZEND_FETCH_R &&
323
25.8k
              src->opcode != ZEND_FETCH_STATIC_PROP_R &&
324
25.8k
              src->opcode != ZEND_FETCH_DIM_R &&
325
25.8k
              src->opcode != ZEND_FETCH_OBJ_R &&
326
25.8k
              src->opcode != ZEND_NEW &&
327
25.8k
              src->opcode != ZEND_FETCH_THIS) {
328
1.57k
            src->result_type = IS_UNUSED;
329
1.57k
            MAKE_NOP(opline);
330
1.57k
            ++(*opt_count);
331
1.57k
            if (src->opcode == ZEND_QM_ASSIGN) {
332
24
              if (src->op1_type & (IS_VAR|IS_TMP_VAR)) {
333
0
                src->opcode = ZEND_FREE;
334
24
              } else {
335
24
                MAKE_NOP(src);
336
24
              }
337
24
            }
338
1.57k
          }
339
25.8k
        }
340
50.9k
        break;
341
342
#if 0
343
    /* pre-evaluate functions:
344
       constant(x)
345
       function_exists(x)
346
       extension_loaded(x)
347
       BAD: interacts badly with Accelerator
348
    */
349
    if((opline->op1_type & IS_VAR) &&
350
       VAR_SOURCE(opline->op1) && VAR_SOURCE(opline->op1)->opcode == ZEND_DO_CF_FCALL &&
351
       VAR_SOURCE(opline->op1)->extended_value == 1) {
352
      zend_op *fcall = VAR_SOURCE(opline->op1);
353
      zend_op *sv = fcall-1;
354
      if(sv >= block->start_opline && sv->opcode == ZEND_SEND_VAL &&
355
         sv->op1_type == IS_CONST && Z_TYPE(OPLINE_OP1_LITERAL(sv)) == IS_STRING &&
356
         Z_LVAL(OPLINE_OP2_LITERAL(sv)) == 1
357
         ) {
358
        zval *arg = &OPLINE_OP1_LITERAL(sv);
359
        char *fname = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].function_name;
360
        size_t flen = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].name_len;
361
        if((flen == sizeof("function_exists")-1 && zend_binary_strcasecmp(fname, flen, "function_exists", sizeof("function_exists")-1) == 0) ||
362
              (flen == sizeof("is_callable")-1 && zend_binary_strcasecmp(fname, flen, "is_callable", sizeof("is_callable")-1) == 0)
363
              ) {
364
          zend_function *function;
365
          if((function = zend_hash_find_ptr(EG(function_table), Z_STR_P(arg))) != NULL) {
366
            literal_dtor(arg);
367
            MAKE_NOP(sv);
368
            MAKE_NOP(fcall);
369
            LITERAL_BOOL(opline->op1, 1);
370
            opline->op1_type = IS_CONST;
371
          }
372
        } else if(flen == sizeof("constant")-1 && zend_binary_strcasecmp(fname, flen, "constant", sizeof("constant")-1) == 0) {
373
          zval c;
374
          if (zend_optimizer_get_persistent_constant(Z_STR_P(arg), &c, 1 ELS_CC)) {
375
            literal_dtor(arg);
376
            MAKE_NOP(sv);
377
            MAKE_NOP(fcall);
378
            ZEND_OP1_LITERAL(opline) = zend_optimizer_add_literal(op_array, &c);
379
            /* no copy ctor - get already copied it */
380
            opline->op1_type = IS_CONST;
381
          }
382
        } else if(flen == sizeof("extension_loaded")-1 && zend_binary_strcasecmp(fname, flen, "extension_loaded", sizeof("extension_loaded")-1) == 0) {
383
          if(zend_hash_exists(&module_registry, Z_STR_P(arg))) {
384
            literal_dtor(arg);
385
            MAKE_NOP(sv);
386
            MAKE_NOP(fcall);
387
            LITERAL_BOOL(opline->op1, 1);
388
            opline->op1_type = IS_CONST;
389
          }
390
        }
391
      }
392
    }
393
#endif
394
395
50.9k
      case ZEND_FETCH_LIST_R:
396
1.85k
      case ZEND_FETCH_LIST_W:
397
1.85k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
398
          /* LIST variable will be deleted later by FREE */
399
1.58k
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
400
1.58k
        }
401
1.85k
        break;
402
403
8
      case ZEND_SWITCH_LONG:
404
73
      case ZEND_SWITCH_STRING:
405
393
      case ZEND_MATCH:
406
393
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
407
          /* SWITCH variable will be deleted later by FREE, so we can't optimize it */
408
121
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
409
121
          break;
410
121
        }
411
272
        if (opline->op1_type == IS_CONST) {
412
66
          int target = get_const_switch_target(cfg, op_array, block, opline, &ZEND_OP1_LITERAL(opline));
413
66
          literal_dtor(&ZEND_OP1_LITERAL(opline));
414
66
          literal_dtor(&ZEND_OP2_LITERAL(opline));
415
66
          opline->opcode = ZEND_JMP;
416
66
          opline->op1_type = IS_UNUSED;
417
66
          opline->op2_type = IS_UNUSED;
418
66
          block->successors_count = 1;
419
66
          block->successors[0] = target;
420
66
        }
421
272
        break;
422
423
194
      case ZEND_CASE:
424
494
      case ZEND_CASE_STRICT:
425
1.04k
      case ZEND_COPY_TMP:
426
1.04k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
427
          /* Variable will be deleted later by FREE, so we can't optimize it */
428
1.04k
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
429
1.04k
          break;
430
1.04k
        }
431
0
        ZEND_FALLTHROUGH;
432
433
26.5k
      case ZEND_IS_EQUAL:
434
29.0k
      case ZEND_IS_NOT_EQUAL:
435
29.0k
        if (opline->op1_type == IS_CONST &&
436
29.0k
            opline->op2_type == IS_CONST) {
437
0
          goto optimize_constant_binary_op;
438
0
        }
439
            /* IS_EQ(TRUE, X)      => BOOL(X)
440
             * IS_EQ(FALSE, X)     => BOOL_NOT(X)
441
             * IS_NOT_EQ(TRUE, X)  => BOOL_NOT(X)
442
             * IS_NOT_EQ(FALSE, X) => BOOL(X)
443
             * CASE(TRUE, X)       => BOOL(X)
444
             * CASE(FALSE, X)      => BOOL_NOT(X)
445
             */
446
29.0k
        if (opline->op1_type == IS_CONST &&
447
29.0k
          (Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_FALSE ||
448
0
           Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_TRUE)) {
449
          /* Optimization of comparison with "null" is not safe,
450
           * because ("0" == null) is not equal to !("0")
451
           */
452
0
          opline->opcode =
453
0
            ((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP1_LITERAL(opline))) == IS_TRUE)) ?
454
0
            ZEND_BOOL : ZEND_BOOL_NOT;
455
0
          COPY_NODE(opline->op1, opline->op2);
456
0
          SET_UNUSED(opline->op2);
457
0
          ++(*opt_count);
458
0
          goto optimize_bool;
459
29.0k
        } else if (opline->op2_type == IS_CONST &&
460
29.0k
                   (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_FALSE ||
461
25.5k
                    Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_TRUE)) {
462
          /* Optimization of comparison with "null" is not safe,
463
           * because ("0" == null) is not equal to !("0")
464
           */
465
0
          opline->opcode =
466
0
            ((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP2_LITERAL(opline))) == IS_TRUE)) ?
467
0
            ZEND_BOOL : ZEND_BOOL_NOT;
468
0
          SET_UNUSED(opline->op2);
469
0
          ++(*opt_count);
470
0
          goto optimize_bool;
471
0
        }
472
29.0k
        break;
473
29.0k
      case ZEND_IS_IDENTICAL:
474
1.88k
        if (opline->op1_type == IS_CONST &&
475
1.88k
          opline->op2_type == IS_CONST) {
476
0
          goto optimize_constant_binary_op;
477
0
        }
478
479
1.88k
        if (opline->op1_type == IS_CONST &&
480
1.88k
          (Z_TYPE(ZEND_OP1_LITERAL(opline)) <= IS_TRUE && Z_TYPE(ZEND_OP1_LITERAL(opline)) >= IS_NULL)) {
481
          /* IS_IDENTICAL(TRUE, T)  => TYPE_CHECK(T, TRUE)
482
           * IS_IDENTICAL(FALSE, T) => TYPE_CHECK(T, FALSE)
483
           * IS_IDENTICAL(NULL, T)  => TYPE_CHECK(T, NULL)
484
           */
485
0
          opline->opcode = ZEND_TYPE_CHECK;
486
0
          opline->extended_value = (1 << Z_TYPE(ZEND_OP1_LITERAL(opline)));
487
0
          COPY_NODE(opline->op1, opline->op2);
488
0
          SET_UNUSED(opline->op2);
489
0
          ++(*opt_count);
490
0
          goto optimize_type_check;
491
1.88k
        } else if (opline->op2_type == IS_CONST &&
492
1.88k
          (Z_TYPE(ZEND_OP2_LITERAL(opline)) <= IS_TRUE && Z_TYPE(ZEND_OP2_LITERAL(opline)) >= IS_NULL)) {
493
          /* IS_IDENTICAL(T, TRUE)  => TYPE_CHECK(T, TRUE)
494
           * IS_IDENTICAL(T, FALSE) => TYPE_CHECK(T, FALSE)
495
           * IS_IDENTICAL(T, NULL)  => TYPE_CHECK(T, NULL)
496
           */
497
128
          opline->opcode = ZEND_TYPE_CHECK;
498
128
          opline->extended_value = (1 << Z_TYPE(ZEND_OP2_LITERAL(opline)));
499
128
          SET_UNUSED(opline->op2);
500
128
          ++(*opt_count);
501
128
          goto optimize_type_check;
502
128
        }
503
1.75k
        break;
504
1.75k
      case ZEND_TYPE_CHECK:
505
1.38k
optimize_type_check:
506
1.38k
        if (opline->extended_value == (1 << IS_TRUE) || opline->extended_value == (1 << IS_FALSE)) {
507
184
          if (opline->op1_type == IS_TMP_VAR &&
508
184
            !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
509
156
            src = VAR_SOURCE(opline->op1);
510
511
156
            if (src) {
512
156
              switch (src->opcode) {
513
0
                case ZEND_BOOL:
514
0
                case ZEND_BOOL_NOT:
515
                  /* T = BOOL(X)     + TYPE_CHECK(T, TRUE)  -> BOOL(X), NOP
516
                   * T = BOOL(X)     + TYPE_CHECK(T, FALSE) -> BOOL_NOT(X), NOP
517
                   * T = BOOL_NOT(X) + TYPE_CHECK(T, TRUE)  -> BOOL_NOT(X), NOP
518
                   * T = BOOL_NOT(X) + TYPE_CHECK(T, FALSE) -> BOOL(X), NOP
519
                   */
520
0
                  src->opcode =
521
0
                    ((src->opcode == ZEND_BOOL) == (opline->extended_value == (1 << IS_TRUE))) ?
522
0
                    ZEND_BOOL : ZEND_BOOL_NOT;
523
0
                  COPY_NODE(src->result, opline->result);
524
0
                  SET_VAR_SOURCE(src);
525
0
                  MAKE_NOP(opline);
526
0
                  ++(*opt_count);
527
0
                  break;
528
156
              }
529
156
            }
530
156
          }
531
184
        }
532
1.38k
        break;
533
  
534
1.66k
      case ZEND_BOOL:
535
13.1k
      case ZEND_BOOL_NOT:
536
20.5k
      optimize_bool:
537
20.5k
        if (opline->op1_type == IS_CONST) {
538
170
          goto optimize_const_unary_op;
539
170
        }
540
20.3k
        if (opline->op1_type == IS_TMP_VAR &&
541
20.3k
            !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
542
17.7k
          src = VAR_SOURCE(opline->op1);
543
17.7k
          if (src) {
544
17.7k
            switch (src->opcode) {
545
3.90k
              case ZEND_BOOL_NOT:
546
                /* T = BOOL_NOT(X) + BOOL(T) -> NOP, BOOL_NOT(X) */
547
3.90k
                VAR_SOURCE(opline->op1) = NULL;
548
3.90k
                COPY_NODE(opline->op1, src->op1);
549
3.90k
                opline->opcode = (opline->opcode == ZEND_BOOL) ? ZEND_BOOL_NOT : ZEND_BOOL;
550
3.90k
                MAKE_NOP(src);
551
3.90k
                ++(*opt_count);
552
3.90k
                goto optimize_bool;
553
3.51k
              case ZEND_BOOL:
554
                /* T = BOOL(X) + BOOL(T) -> NOP, BOOL(X) */
555
3.51k
                VAR_SOURCE(opline->op1) = NULL;
556
3.51k
                COPY_NODE(opline->op1, src->op1);
557
3.51k
                MAKE_NOP(src);
558
3.51k
                ++(*opt_count);
559
3.51k
                goto optimize_bool;
560
192
              case ZEND_IS_EQUAL:
561
192
                if (opline->opcode == ZEND_BOOL_NOT) {
562
0
                  src->opcode = ZEND_IS_NOT_EQUAL;
563
0
                }
564
192
                COPY_NODE(src->result, opline->result);
565
192
                SET_VAR_SOURCE(src);
566
192
                MAKE_NOP(opline);
567
192
                ++(*opt_count);
568
192
                break;
569
0
              case ZEND_IS_NOT_EQUAL:
570
0
                if (opline->opcode == ZEND_BOOL_NOT) {
571
0
                  src->opcode = ZEND_IS_EQUAL;
572
0
                }
573
0
                COPY_NODE(src->result, opline->result);
574
0
                SET_VAR_SOURCE(src);
575
0
                MAKE_NOP(opline);
576
0
                ++(*opt_count);
577
0
                break;
578
100
              case ZEND_IS_IDENTICAL:
579
100
                if (opline->opcode == ZEND_BOOL_NOT) {
580
0
                  src->opcode = ZEND_IS_NOT_IDENTICAL;
581
0
                }
582
100
                COPY_NODE(src->result, opline->result);
583
100
                SET_VAR_SOURCE(src);
584
100
                MAKE_NOP(opline);
585
100
                ++(*opt_count);
586
100
                break;
587
45
              case ZEND_IS_NOT_IDENTICAL:
588
45
                if (opline->opcode == ZEND_BOOL_NOT) {
589
0
                  src->opcode = ZEND_IS_IDENTICAL;
590
0
                }
591
45
                COPY_NODE(src->result, opline->result);
592
45
                SET_VAR_SOURCE(src);
593
45
                MAKE_NOP(opline);
594
45
                ++(*opt_count);
595
45
                break;
596
16
              case ZEND_IS_SMALLER:
597
16
                if (opline->opcode == ZEND_BOOL_NOT) {
598
0
                  uint8_t tmp_type;
599
0
                  uint32_t tmp;
600
601
0
                  src->opcode = ZEND_IS_SMALLER_OR_EQUAL;
602
0
                  tmp_type = src->op1_type;
603
0
                  src->op1_type = src->op2_type;
604
0
                  src->op2_type = tmp_type;
605
0
                  tmp = src->op1.num;
606
0
                  src->op1.num = src->op2.num;
607
0
                  src->op2.num = tmp;
608
0
                }
609
16
                COPY_NODE(src->result, opline->result);
610
16
                SET_VAR_SOURCE(src);
611
16
                MAKE_NOP(opline);
612
16
                ++(*opt_count);
613
16
                break;
614
207
              case ZEND_IS_SMALLER_OR_EQUAL:
615
207
                if (opline->opcode == ZEND_BOOL_NOT) {
616
0
                  uint8_t tmp_type;
617
0
                  uint32_t tmp;
618
619
0
                  src->opcode = ZEND_IS_SMALLER;
620
0
                  tmp_type = src->op1_type;
621
0
                  src->op1_type = src->op2_type;
622
0
                  src->op2_type = tmp_type;
623
0
                  tmp = src->op1.num;
624
0
                  src->op1.num = src->op2.num;
625
0
                  src->op2.num = tmp;
626
0
                }
627
207
                COPY_NODE(src->result, opline->result);
628
207
                SET_VAR_SOURCE(src);
629
207
                MAKE_NOP(opline);
630
207
                ++(*opt_count);
631
207
                break;
632
6
              case ZEND_ISSET_ISEMPTY_CV:
633
22
              case ZEND_ISSET_ISEMPTY_VAR:
634
314
              case ZEND_ISSET_ISEMPTY_DIM_OBJ:
635
368
              case ZEND_ISSET_ISEMPTY_PROP_OBJ:
636
380
              case ZEND_ISSET_ISEMPTY_STATIC_PROP:
637
416
              case ZEND_INSTANCEOF:
638
531
              case ZEND_TYPE_CHECK:
639
542
              case ZEND_DEFINED:
640
542
              case ZEND_IN_ARRAY:
641
566
              case ZEND_ARRAY_KEY_EXISTS:
642
566
                if (opline->opcode == ZEND_BOOL_NOT) {
643
464
                  break;
644
464
                }
645
102
                COPY_NODE(src->result, opline->result);
646
102
                SET_VAR_SOURCE(src);
647
102
                MAKE_NOP(opline);
648
102
                ++(*opt_count);
649
102
                break;
650
17.7k
            }
651
17.7k
          }
652
17.7k
        }
653
12.9k
        break;
654
655
30.9k
      case ZEND_JMPZ:
656
42.6k
      case ZEND_JMPNZ:
657
43.5k
          while (1) {
658
43.5k
          if (opline->op1_type == IS_CONST) {
659
82
            ++(*opt_count);
660
82
            block->successors_count = 1;
661
82
            if (zend_is_true(&ZEND_OP1_LITERAL(opline)) ==
662
82
                (opline->opcode == ZEND_JMPZ)) {
663
664
42
              MAKE_NOP(opline);
665
42
              block->successors[0] = block->successors[1];
666
42
              block->len--;
667
42
              cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
668
42
              break;
669
42
            } else {
670
40
              zend_basic_block *next = cfg->blocks + block->successors[1];
671
672
40
              next->flags &= ~ZEND_BB_FOLLOW;
673
40
              if (!(next->flags & (ZEND_BB_TARGET|ZEND_BB_PROTECTED))) {
674
34
                next->flags &= ~ZEND_BB_REACHABLE;
675
34
              }
676
40
              opline->opcode = ZEND_JMP;
677
40
              COPY_NODE(opline->op1, opline->op2);
678
40
              break;
679
40
            }
680
43.4k
          } else if (opline->op1_type == IS_TMP_VAR &&
681
43.4k
                     !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
682
40.6k
            src = VAR_SOURCE(opline->op1);
683
40.6k
            if (src) {
684
40.6k
              if (src->opcode == ZEND_BOOL_NOT) {
685
745
                VAR_SOURCE(opline->op1) = NULL;
686
745
                COPY_NODE(opline->op1, src->op1);
687
                /* T = BOOL_NOT(X) + JMPZ(T) -> NOP, JMPNZ(X) */
688
745
                opline->opcode = INV_COND(opline->opcode);
689
745
                MAKE_NOP(src);
690
745
                ++(*opt_count);
691
745
                continue;
692
39.9k
              } else if (src->opcode == ZEND_BOOL ||
693
39.9k
                         src->opcode == ZEND_QM_ASSIGN) {
694
172
                VAR_SOURCE(opline->op1) = NULL;
695
172
                COPY_NODE(opline->op1, src->op1);
696
172
                MAKE_NOP(src);
697
172
                ++(*opt_count);
698
172
                continue;
699
172
              }
700
40.6k
            }
701
40.6k
          }
702
42.5k
          break;
703
43.5k
        }
704
42.6k
        break;
705
706
374
      case ZEND_JMPZ_EX:
707
738
      case ZEND_JMPNZ_EX:
708
794
        while (1) {
709
794
          if (opline->op1_type == IS_CONST) {
710
58
            bool is_jmpz_ex = opline->opcode == ZEND_JMPZ_EX;
711
58
            if (zend_is_true(&ZEND_OP1_LITERAL(opline)) == is_jmpz_ex) {
712
713
2
              ++(*opt_count);
714
2
              opline->opcode = ZEND_QM_ASSIGN;
715
2
              zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
716
2
              ZVAL_BOOL(&ZEND_OP1_LITERAL(opline), is_jmpz_ex);
717
2
              opline->op2.num = 0;
718
2
              block->successors_count = 1;
719
2
              block->successors[0] = block->successors[1];
720
2
              cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
721
2
              break;
722
2
            }
723
736
          } else if (opline->op1_type == IS_TMP_VAR &&
724
736
                     (!zend_bitset_in(used_ext, VAR_NUM(opline->op1.var)) ||
725
638
                      opline->result.var == opline->op1.var)) {
726
638
            src = VAR_SOURCE(opline->op1);
727
638
            if (src) {
728
638
              if (src->opcode == ZEND_BOOL ||
729
638
                  src->opcode == ZEND_QM_ASSIGN) {
730
56
                VAR_SOURCE(opline->op1) = NULL;
731
56
                COPY_NODE(opline->op1, src->op1);
732
56
                MAKE_NOP(src);
733
56
                ++(*opt_count);
734
56
                continue;
735
56
              }
736
638
            }
737
638
          }
738
736
          break;
739
794
        }
740
738
        break;
741
742
81.8k
      case ZEND_CONCAT:
743
120k
      case ZEND_FAST_CONCAT:
744
120k
        if (opline->op1_type == IS_CONST &&
745
120k
            opline->op2_type == IS_CONST) {
746
0
          goto optimize_constant_binary_op;
747
0
        }
748
749
120k
        if (opline->op2_type == IS_CONST &&
750
120k
            opline->op1_type == IS_TMP_VAR) {
751
752
31.1k
          src = VAR_SOURCE(opline->op1);
753
31.1k
            if (src &&
754
31.1k
              (src->opcode == ZEND_CONCAT ||
755
31.0k
               src->opcode == ZEND_FAST_CONCAT) &&
756
31.1k
              src->op2_type == IS_CONST) {
757
            /* compress consecutive CONCATs */
758
979
            size_t l, old_len;
759
760
979
            if (Z_TYPE(ZEND_OP2_LITERAL(opline)) != IS_STRING) {
761
0
              convert_to_string(&ZEND_OP2_LITERAL(opline));
762
0
            }
763
979
            if (Z_TYPE(ZEND_OP2_LITERAL(src)) != IS_STRING) {
764
0
              convert_to_string(&ZEND_OP2_LITERAL(src));
765
0
            }
766
767
979
            VAR_SOURCE(opline->op1) = NULL;
768
979
            COPY_NODE(opline->op1, src->op1);
769
979
            old_len = Z_STRLEN(ZEND_OP2_LITERAL(src));
770
979
            l = old_len + Z_STRLEN(ZEND_OP2_LITERAL(opline));
771
979
            if (!Z_REFCOUNTED(ZEND_OP2_LITERAL(src))) {
772
307
              zend_string *tmp = zend_string_alloc(l, 0);
773
307
              memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP2_LITERAL(src)), old_len);
774
307
              Z_STR(ZEND_OP2_LITERAL(src)) = tmp;
775
672
            } else {
776
672
              Z_STR(ZEND_OP2_LITERAL(src)) = zend_string_extend(Z_STR(ZEND_OP2_LITERAL(src)), l, 0);
777
672
            }
778
979
            Z_TYPE_INFO(ZEND_OP2_LITERAL(src)) = IS_STRING_EX;
779
979
            memcpy(Z_STRVAL(ZEND_OP2_LITERAL(src)) + old_len, Z_STRVAL(ZEND_OP2_LITERAL(opline)), Z_STRLEN(ZEND_OP2_LITERAL(opline)));
780
979
            Z_STRVAL(ZEND_OP2_LITERAL(src))[l] = '\0';
781
979
            zval_ptr_dtor_str(&ZEND_OP2_LITERAL(opline));
782
979
            ZVAL_STR(&ZEND_OP2_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP2_LITERAL(src))));
783
979
            ZVAL_NULL(&ZEND_OP2_LITERAL(src));
784
979
            MAKE_NOP(src);
785
979
            ++(*opt_count);
786
979
          }
787
31.1k
        }
788
789
120k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
790
41.5k
          src = VAR_SOURCE(opline->op1);
791
41.5k
          if (src &&
792
41.5k
              src->opcode == ZEND_CAST &&
793
41.5k
              src->extended_value == IS_STRING &&
794
41.5k
              src->op1_type != IS_CONST) {
795
            /* convert T1 = CAST(STRING, X), T2 = CONCAT(T1, Y) to T2 = CONCAT(X,Y) */
796
2
            VAR_SOURCE(opline->op1) = NULL;
797
2
            COPY_NODE(opline->op1, src->op1);
798
2
            MAKE_NOP(src);
799
2
            ++(*opt_count);
800
2
          }
801
41.5k
              }
802
120k
        if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
803
69.4k
          src = VAR_SOURCE(opline->op2);
804
69.4k
          if (src &&
805
69.4k
              src->opcode == ZEND_CAST &&
806
69.4k
              src->extended_value == IS_STRING &&
807
69.4k
              src->op1_type != IS_CONST) {
808
            /* convert T1 = CAST(STRING, X), T2 = CONCAT(Y, T1) to T2 = CONCAT(Y,X) */
809
9
            zend_op *src = VAR_SOURCE(opline->op2);
810
9
            VAR_SOURCE(opline->op2) = NULL;
811
9
            COPY_NODE(opline->op2, src->op1);
812
9
            MAKE_NOP(src);
813
9
            ++(*opt_count);
814
9
          }
815
69.4k
        }
816
120k
        if (opline->op1_type == IS_CONST &&
817
120k
            Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_STRING &&
818
120k
            Z_STRLEN(ZEND_OP1_LITERAL(opline)) == 0) {
819
          /* convert CONCAT('', X) => CAST(STRING, X) */
820
10
          literal_dtor(&ZEND_OP1_LITERAL(opline));
821
10
          opline->opcode = ZEND_CAST;
822
10
          opline->extended_value = IS_STRING;
823
10
          COPY_NODE(opline->op1, opline->op2);
824
10
          opline->op2_type = IS_UNUSED;
825
10
          opline->op2.var = 0;
826
10
          ++(*opt_count);
827
120k
        } else if (opline->op2_type == IS_CONST &&
828
120k
                 Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING &&
829
120k
                 Z_STRLEN(ZEND_OP2_LITERAL(opline)) == 0) {
830
          /* convert CONCAT(X, '') => CAST(STRING, X) */
831
18
          literal_dtor(&ZEND_OP2_LITERAL(opline));
832
18
          opline->opcode = ZEND_CAST;
833
18
          opline->extended_value = IS_STRING;
834
18
          opline->op2_type = IS_UNUSED;
835
18
          opline->op2.var = 0;
836
18
          ++(*opt_count);
837
119k
        } else if (opline->opcode == ZEND_CONCAT &&
838
119k
                   (opline->op1_type == IS_CONST ||
839
81.7k
                    (opline->op1_type == IS_TMP_VAR &&
840
66.2k
                     VAR_SOURCE(opline->op1) &&
841
66.2k
                     (VAR_SOURCE(opline->op1)->opcode == ZEND_FAST_CONCAT ||
842
23.1k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_ROPE_END ||
843
23.1k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CONSTANT ||
844
23.1k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CLASS_CONSTANT))) &&
845
119k
                   (opline->op2_type == IS_CONST ||
846
30.8k
                    (opline->op2_type == IS_TMP_VAR &&
847
17.4k
                     VAR_SOURCE(opline->op2) &&
848
17.4k
                     (VAR_SOURCE(opline->op2)->opcode == ZEND_FAST_CONCAT ||
849
15.1k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_ROPE_END ||
850
15.1k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CONSTANT ||
851
26.5k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CLASS_CONSTANT)))) {
852
26.5k
          opline->opcode = ZEND_FAST_CONCAT;
853
26.5k
          ++(*opt_count);
854
26.5k
        }
855
120k
        break;
856
857
11.1k
      case ZEND_ADD:
858
14.8k
      case ZEND_SUB:
859
23.0k
      case ZEND_MUL:
860
26.0k
      case ZEND_DIV:
861
30.2k
      case ZEND_MOD:
862
32.0k
      case ZEND_SL:
863
32.5k
      case ZEND_SR:
864
42.7k
      case ZEND_IS_SMALLER:
865
46.1k
      case ZEND_IS_SMALLER_OR_EQUAL:
866
46.7k
      case ZEND_IS_NOT_IDENTICAL:
867
47.7k
      case ZEND_BOOL_XOR:
868
48.6k
      case ZEND_BW_OR:
869
65.5k
      case ZEND_BW_AND:
870
76.8k
      case ZEND_BW_XOR:
871
76.8k
        if (opline->op1_type == IS_CONST &&
872
76.8k
            opline->op2_type == IS_CONST) {
873
          /* evaluate constant expressions */
874
5.34k
          zval result;
875
876
5.34k
optimize_constant_binary_op:
877
5.34k
          if (zend_optimizer_eval_binary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline), &ZEND_OP2_LITERAL(opline)) == SUCCESS) {
878
0
            literal_dtor(&ZEND_OP1_LITERAL(opline));
879
0
            literal_dtor(&ZEND_OP2_LITERAL(opline));
880
0
            opline->opcode = ZEND_QM_ASSIGN;
881
0
            SET_UNUSED(opline->op2);
882
0
            zend_optimizer_update_op1_const(op_array, opline, &result);
883
0
            ++(*opt_count);
884
0
          }
885
5.34k
        }
886
76.8k
        break;
887
888
76.8k
      case ZEND_BW_NOT:
889
4.77k
        if (opline->op1_type == IS_CONST) {
890
          /* evaluate constant unary ops */
891
104
          zval result;
892
893
274
optimize_const_unary_op:
894
274
          if (zend_optimizer_eval_unary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
895
170
            literal_dtor(&ZEND_OP1_LITERAL(opline));
896
170
            opline->opcode = ZEND_QM_ASSIGN;
897
170
            zend_optimizer_update_op1_const(op_array, opline, &result);
898
170
            ++(*opt_count);
899
170
          }
900
274
        }
901
4.94k
        break;
902
903
4.94k
      case ZEND_CAST:
904
2.55k
        if (opline->op1_type == IS_CONST) {
905
          /* cast of constant operand */
906
296
          zval result;
907
908
296
          if (zend_optimizer_eval_cast(&result, opline->extended_value, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
909
4
            literal_dtor(&ZEND_OP1_LITERAL(opline));
910
4
            opline->opcode = ZEND_QM_ASSIGN;
911
4
            opline->extended_value = 0;
912
4
            zend_optimizer_update_op1_const(op_array, opline, &result);
913
4
            ++(*opt_count);
914
4
          }
915
296
        }
916
2.55k
        break;
917
918
347
      case ZEND_STRLEN:
919
347
        if (opline->op1_type == IS_CONST) {
920
18
          zval result;
921
922
18
          if (zend_optimizer_eval_strlen(&result, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
923
0
            literal_dtor(&ZEND_OP1_LITERAL(opline));
924
0
            opline->opcode = ZEND_QM_ASSIGN;
925
0
            zend_optimizer_update_op1_const(op_array, opline, &result);
926
0
            ++(*opt_count);
927
0
          }
928
18
        }
929
347
        break;
930
931
162k
      case ZEND_RETURN:
932
162k
        if (opline->op1_type == IS_TMP_VAR) {
933
3.85k
          src = VAR_SOURCE(opline->op1);
934
3.85k
          if (src && src->opcode == ZEND_QM_ASSIGN) {
935
144
            zend_op *op = src + 1;
936
144
            bool optimize = 1;
937
938
144
            while (op < opline) {
939
24
              if ((op->op1_type == opline->op1_type
940
24
                && op->op1.var == opline->op1.var)
941
24
               || (op->op2_type == opline->op1_type
942
24
                && op->op2.var == opline->op1.var)) {
943
24
                optimize = 0;
944
24
                break;
945
24
              }
946
0
              op++;
947
0
            }
948
949
144
            if (optimize) {
950
              /* T = QM_ASSIGN(X), RETURN(T) to NOP, RETURN(X) */
951
120
              VAR_SOURCE(opline->op1) = NULL;
952
120
              COPY_NODE(opline->op1, src->op1);
953
120
              MAKE_NOP(src);
954
120
              ++(*opt_count);
955
120
            }
956
144
          }
957
3.85k
        }
958
162k
        break;
959
960
11.1k
      case ZEND_QM_ASSIGN:
961
11.1k
        if (opline->op1_type == opline->result_type &&
962
11.1k
            opline->op1.var == opline->result.var) {
963
          /* strip T = QM_ASSIGN(T) */
964
0
          MAKE_NOP(opline);
965
0
          ++(*opt_count);
966
11.1k
        } else if (opline->op1_type == IS_TMP_VAR &&
967
11.1k
                   opline->result_type == IS_TMP_VAR &&
968
11.1k
                   !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
969
          /* T1 = ..., T2 = QM_ASSIGN(T1) to T2 = ..., NOP */
970
1.58k
          src = VAR_SOURCE(opline->op1);
971
1.58k
          if (src &&
972
1.58k
            src->opcode != ZEND_COPY_TMP &&
973
1.58k
            src->opcode != ZEND_ADD_ARRAY_ELEMENT &&
974
1.58k
            src->opcode != ZEND_ADD_ARRAY_UNPACK &&
975
1.58k
            (src->opcode != ZEND_DECLARE_LAMBDA_FUNCTION ||
976
1.58k
             src == opline -1)) {
977
1.58k
            src->result.var = opline->result.var;
978
1.58k
            VAR_SOURCE(opline->op1) = NULL;
979
1.58k
            VAR_SOURCE(opline->result) = src;
980
1.58k
            MAKE_NOP(opline);
981
1.58k
            ++(*opt_count);
982
1.58k
          }
983
1.58k
        }
984
11.1k
        break;
985
3.69M
    }
986
987
    /* get variable source */
988
3.69M
    if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
989
1.74M
      SET_VAR_SOURCE(opline);
990
1.74M
    }
991
3.69M
    opline++;
992
3.69M
  }
993
641k
}
994
995
/* Rebuild plain (optimized) op_array from CFG */
996
static void assemble_code_blocks(zend_cfg *cfg, zend_op_array *op_array, zend_optimizer_ctx *ctx)
997
109k
{
998
109k
  zend_basic_block *blocks = cfg->blocks;
999
109k
  zend_basic_block *end = blocks + cfg->blocks_count;
1000
109k
  zend_basic_block *b;
1001
109k
  zend_op *new_opcodes;
1002
109k
  zend_op *opline;
1003
109k
  uint32_t len = 0;
1004
1005
575k
  for (b = blocks; b < end; b++) {
1006
466k
    if (b->len == 0) {
1007
40.2k
      continue;
1008
40.2k
    }
1009
426k
    if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1010
410k
      opline = op_array->opcodes + b->start + b->len - 1;
1011
410k
      if (opline->opcode == ZEND_JMP) {
1012
58.7k
        zend_basic_block *next = b + 1;
1013
1014
72.0k
        while (next < end && !(next->flags & ZEND_BB_REACHABLE)) {
1015
13.2k
          next++;
1016
13.2k
        }
1017
58.7k
        if (next < end && next == blocks + b->successors[0]) {
1018
          /* JMP to the next block - strip it */
1019
12
          MAKE_NOP(opline);
1020
12
          b->len--;
1021
12
        }
1022
352k
      } else if (b->len == 1 && opline->opcode == ZEND_NOP) {
1023
        /* skip empty block */
1024
0
        b->len--;
1025
0
      }
1026
410k
      len += b->len;
1027
410k
    } else {
1028
      /* this block will not be used, delete all constants there */
1029
15.5k
      zend_op *op = op_array->opcodes + b->start;
1030
15.5k
      zend_op *end = op + b->len;
1031
34.9k
      for (; op < end; op++) {
1032
19.3k
        if (op->op1_type == IS_CONST) {
1033
13.9k
          literal_dtor(&ZEND_OP1_LITERAL(op));
1034
13.9k
        }
1035
19.3k
        if (op->op2_type == IS_CONST) {
1036
241
          literal_dtor(&ZEND_OP2_LITERAL(op));
1037
241
        }
1038
19.3k
      }
1039
15.5k
    }
1040
426k
  }
1041
1042
109k
  new_opcodes = emalloc(len * sizeof(zend_op));
1043
109k
  opline = new_opcodes;
1044
1045
  /* Copy code of reachable blocks into a single buffer */
1046
575k
  for (b = blocks; b < end; b++) {
1047
466k
    if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1048
411k
      memcpy(opline, op_array->opcodes + b->start, b->len * sizeof(zend_op));
1049
411k
      b->start = opline - new_opcodes;
1050
411k
      opline += b->len;
1051
411k
    }
1052
466k
  }
1053
1054
  /* adjust jump targets */
1055
109k
  efree(op_array->opcodes);
1056
109k
  op_array->opcodes = new_opcodes;
1057
109k
  op_array->last = len;
1058
1059
575k
  for (b = blocks; b < end; b++) {
1060
466k
    if (!(b->flags & ZEND_BB_REACHABLE) || b->len == 0) {
1061
55.8k
      continue;
1062
55.8k
    }
1063
410k
    opline = op_array->opcodes + b->start + b->len - 1;
1064
410k
    switch (opline->opcode) {
1065
600
      case ZEND_FAST_CALL:
1066
59.3k
      case ZEND_JMP:
1067
59.3k
        ZEND_SET_OP_JMP_ADDR(opline, opline->op1, new_opcodes + blocks[b->successors[0]].start);
1068
59.3k
        break;
1069
17.6k
      case ZEND_JMPZ:
1070
27.3k
      case ZEND_JMPNZ:
1071
27.6k
      case ZEND_JMPZ_EX:
1072
27.9k
      case ZEND_JMPNZ_EX:
1073
42.7k
      case ZEND_FE_RESET_R:
1074
43.5k
      case ZEND_FE_RESET_RW:
1075
44.7k
      case ZEND_JMP_SET:
1076
46.2k
      case ZEND_COALESCE:
1077
47.5k
      case ZEND_ASSERT_CHECK:
1078
94.1k
      case ZEND_JMP_NULL:
1079
94.3k
      case ZEND_BIND_INIT_STATIC_OR_JMP:
1080
94.3k
      case ZEND_JMP_FRAMELESS:
1081
94.3k
        ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1082
94.3k
        break;
1083
7.13k
      case ZEND_CATCH:
1084
7.13k
        if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1085
5.51k
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1086
5.51k
        }
1087
7.13k
        break;
1088
14.8k
      case ZEND_FE_FETCH_R:
1089
15.6k
      case ZEND_FE_FETCH_RW:
1090
15.6k
        opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[0]].start);
1091
15.6k
        break;
1092
8
      case ZEND_SWITCH_LONG:
1093
56
      case ZEND_SWITCH_STRING:
1094
234
      case ZEND_MATCH:
1095
234
      {
1096
234
        HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
1097
234
        zval *zv;
1098
234
        uint32_t s = 0;
1099
234
        ZEND_ASSERT(b->successors_count == (opline->opcode == ZEND_MATCH ? 1 : 2) + zend_hash_num_elements(jumptable));
1100
1101
2.11k
        ZEND_HASH_FOREACH_VAL(jumptable, zv) {
1102
2.11k
          Z_LVAL_P(zv) = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1103
2.11k
        } ZEND_HASH_FOREACH_END();
1104
234
        opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1105
234
        break;
1106
234
      }
1107
410k
    }
1108
410k
  }
1109
1110
  /* adjust exception jump targets & remove unused try_catch_array entries */
1111
109k
  if (op_array->last_try_catch) {
1112
32.2k
    int i, j;
1113
32.2k
    uint32_t *map;
1114
32.2k
    ALLOCA_FLAG(use_heap);
1115
1116
32.2k
    map = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last_try_catch, use_heap);
1117
71.3k
    for (i = 0, j = 0; i< op_array->last_try_catch; i++) {
1118
39.1k
      if (blocks[cfg->map[op_array->try_catch_array[i].try_op]].flags & ZEND_BB_REACHABLE) {
1119
39.1k
        map[i] = j;
1120
39.1k
        op_array->try_catch_array[j].try_op = blocks[cfg->map[op_array->try_catch_array[i].try_op]].start;
1121
39.1k
        if (op_array->try_catch_array[i].catch_op) {
1122
38.5k
          op_array->try_catch_array[j].catch_op = blocks[cfg->map[op_array->try_catch_array[i].catch_op]].start;
1123
38.5k
        } else {
1124
551
          op_array->try_catch_array[j].catch_op =  0;
1125
551
        }
1126
39.1k
        if (op_array->try_catch_array[i].finally_op) {
1127
678
          op_array->try_catch_array[j].finally_op = blocks[cfg->map[op_array->try_catch_array[i].finally_op]].start;
1128
38.4k
        } else {
1129
38.4k
          op_array->try_catch_array[j].finally_op =  0;
1130
38.4k
        }
1131
39.1k
        if (!op_array->try_catch_array[i].finally_end) {
1132
38.4k
          op_array->try_catch_array[j].finally_end = 0;
1133
38.4k
        } else {
1134
678
          op_array->try_catch_array[j].finally_end = blocks[cfg->map[op_array->try_catch_array[i].finally_end]].start;
1135
678
        }
1136
39.1k
        j++;
1137
39.1k
      }
1138
39.1k
    }
1139
32.2k
    if (i != j) {
1140
7
      op_array->last_try_catch = j;
1141
7
      if (j == 0) {
1142
1
        efree(op_array->try_catch_array);
1143
1
        op_array->try_catch_array = NULL;
1144
1
      }
1145
1146
7
      if (op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) {
1147
0
        zend_op *opline = new_opcodes;
1148
0
        zend_op *end = opline + len;
1149
0
        while (opline < end) {
1150
0
          if (opline->opcode == ZEND_FAST_RET &&
1151
0
              opline->op2.num != (uint32_t)-1 &&
1152
0
              opline->op2.num < (uint32_t)j) {
1153
0
            opline->op2.num = map[opline->op2.num];
1154
0
          }
1155
0
          opline++;
1156
0
        }
1157
0
      }
1158
7
    }
1159
32.2k
    free_alloca(map, use_heap);
1160
32.2k
  }
1161
1162
  /* rebuild map (just for printing) */
1163
109k
  memset(cfg->map, -1, sizeof(int) * op_array->last);
1164
575k
  for (int n = 0; n < cfg->blocks_count; n++) {
1165
466k
    if (cfg->blocks[n].flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1166
411k
      cfg->map[cfg->blocks[n].start] = n;
1167
411k
    }
1168
466k
  }
1169
109k
}
1170
1171
static zend_always_inline zend_basic_block *get_target_block(const zend_cfg *cfg, zend_basic_block *block, int n, uint32_t *opt_count)
1172
200k
{
1173
200k
  int b;
1174
200k
  zend_basic_block *target_block = cfg->blocks + block->successors[n];
1175
1176
200k
  if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1177
38
    do {
1178
38
      b = target_block->successors[0];
1179
38
      target_block = cfg->blocks + b;
1180
38
    } while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1181
34
    block->successors[n] = b;
1182
34
    ++(*opt_count);
1183
34
  }
1184
200k
  return target_block;
1185
200k
}
1186
1187
static zend_always_inline zend_basic_block *get_follow_block(const zend_cfg *cfg, zend_basic_block *block, int n, uint32_t *opt_count)
1188
43.2k
{
1189
43.2k
  int b;
1190
43.2k
  zend_basic_block *target_block = cfg->blocks + block->successors[n];
1191
1192
43.2k
  if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1193
602
    do {
1194
602
      b = target_block->successors[0];
1195
602
      target_block = cfg->blocks + b;
1196
602
    } while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1197
598
    block->successors[n] = b;
1198
598
    ++(*opt_count);
1199
598
  }
1200
43.2k
  return target_block;
1201
43.2k
}
1202
1203
static zend_always_inline zend_basic_block *get_next_block(const zend_cfg *cfg, zend_basic_block *block)
1204
106k
{
1205
106k
  zend_basic_block *next_block = block + 1;
1206
106k
  zend_basic_block *end = cfg->blocks + cfg->blocks_count;
1207
1208
121k
  while (1) {
1209
121k
    if (next_block == end) {
1210
966
      return NULL;
1211
120k
    } else if (next_block->flags & ZEND_BB_REACHABLE) {
1212
105k
      break;
1213
105k
    }
1214
15.2k
    next_block++;
1215
15.2k
  }
1216
105k
  while (next_block->len == 0 && !(next_block->flags & ZEND_BB_PROTECTED)) {
1217
21
    next_block = cfg->blocks + next_block->successors[0];
1218
21
  }
1219
105k
  return next_block;
1220
106k
}
1221
1222
1223
/* we use "jmp_hitlist" to avoid infinity loops during jmp optimization */
1224
static zend_always_inline bool in_hitlist(int target, int *jmp_hitlist, int jmp_hitlist_count)
1225
506
{
1226
506
  int i;
1227
1228
506
  for (i = 0; i < jmp_hitlist_count; i++) {
1229
225
    if (jmp_hitlist[i] == target) {
1230
225
      return 1;
1231
225
    }
1232
225
  }
1233
281
  return 0;
1234
506
}
1235
1236
#define CHECK_LOOP(target) \
1237
506
  if (EXPECTED(!in_hitlist(target, jmp_hitlist, jmp_hitlist_count))) { \
1238
281
    jmp_hitlist[jmp_hitlist_count++] = target;  \
1239
281
  } else { \
1240
225
    break; \
1241
225
  }
1242
1243
static void zend_jmp_optimization(zend_basic_block *block, zend_op_array *op_array, const zend_cfg *cfg, int *jmp_hitlist, uint32_t *opt_count)
1244
641k
{
1245
  /* last_op is the last opcode of the current block */
1246
641k
  zend_basic_block *target_block, *follow_block, *next_block;
1247
641k
  zend_op *last_op, *target;
1248
641k
  int next, jmp_hitlist_count;
1249
1250
641k
  if (block->len == 0) {
1251
1.00k
    return;
1252
1.00k
  }
1253
1254
640k
  last_op = op_array->opcodes + block->start + block->len - 1;
1255
640k
  switch (last_op->opcode) {
1256
105k
    case ZEND_JMP:
1257
105k
      jmp_hitlist_count = 0;
1258
1259
105k
      target_block = get_target_block(cfg, block, 0, opt_count);
1260
105k
      while (target_block->len == 1) {
1261
54.0k
        target = op_array->opcodes + target_block->start;
1262
54.0k
        if (target->opcode == ZEND_JMP) {
1263
          /* JMP L, L: JMP L1 -> JMP L1 */
1264
78
          next = target_block->successors[0];
1265
54.0k
        } else {
1266
54.0k
          break;
1267
54.0k
        }
1268
78
        CHECK_LOOP(next);
1269
39
        block->successors[0] = next;
1270
39
        ++(*opt_count);
1271
39
        target_block = get_target_block(cfg, block, 0, opt_count);
1272
39
      }
1273
1274
105k
      next_block = get_next_block(cfg, block);
1275
105k
      if (target_block == next_block) {
1276
        /* JMP(next) -> NOP */
1277
780
        MAKE_NOP(last_op);
1278
780
        ++(*opt_count);
1279
780
        block->len--;
1280
104k
      } else if (target_block->len == 1) {
1281
53.8k
        target = op_array->opcodes + target_block->start;
1282
53.8k
        if ((target->opcode == ZEND_RETURN ||
1283
53.8k
                    target->opcode == ZEND_RETURN_BY_REF ||
1284
53.8k
                    target->opcode == ZEND_GENERATOR_RETURN) &&
1285
53.8k
                   !(op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK)) {
1286
          /* JMP L, L: RETURN to immediate RETURN */
1287
18
          *last_op = *target;
1288
18
          if (last_op->op1_type == IS_CONST) {
1289
18
            zval zv;
1290
18
            ZVAL_COPY(&zv, &ZEND_OP1_LITERAL(last_op));
1291
18
            last_op->op1.constant = zend_optimizer_add_literal(op_array, &zv);
1292
18
          }
1293
18
          block->successors_count = 0;
1294
18
          ++(*opt_count);
1295
18
        }
1296
53.8k
      }
1297
105k
      break;
1298
1299
1.81k
    case ZEND_JMP_SET:
1300
3.46k
    case ZEND_COALESCE:
1301
51.1k
    case ZEND_JMP_NULL:
1302
51.1k
      jmp_hitlist_count = 0;
1303
1304
51.1k
      target_block = get_target_block(cfg, block, 0, opt_count);
1305
51.1k
      while (target_block->len == 1) {
1306
1.17k
        target = op_array->opcodes + target_block->start;
1307
1308
1.17k
        if (target->opcode == ZEND_JMP) {
1309
          /* JMP_SET(X, L), L: JMP(L2) -> JMP_SET(X, L2) */
1310
32
          next = target_block->successors[0];
1311
32
          CHECK_LOOP(next);
1312
32
          block->successors[0] = next;
1313
32
          ++(*opt_count);
1314
1.14k
        } else {
1315
1.14k
          break;
1316
1.14k
        }
1317
32
        target_block = get_target_block(cfg, block, 0, opt_count);
1318
32
      }
1319
51.1k
      break;
1320
1321
30.2k
    case ZEND_JMPZ:
1322
42.5k
    case ZEND_JMPNZ:
1323
42.5k
      jmp_hitlist_count = 0;
1324
1325
42.5k
      target_block = get_target_block(cfg, block, 0, opt_count);
1326
42.7k
      while (target_block->len == 1) {
1327
29.5k
        target = op_array->opcodes + target_block->start;
1328
1329
29.5k
        if (target->opcode == ZEND_JMP) {
1330
          /* JMPZ(X, L), L: JMP(L2) -> JMPZ(X, L2) */
1331
0
          next = target_block->successors[0];
1332
29.5k
        } else if (target->opcode == last_op->opcode &&
1333
29.5k
                   SAME_VAR(target->op1, last_op->op1)) {
1334
          /* JMPZ(X, L), L: JMPZ(X, L2) -> JMPZ(X, L2) */
1335
372
          next = target_block->successors[0];
1336
29.1k
        } else if (target->opcode == INV_COND(last_op->opcode) &&
1337
29.1k
                   SAME_VAR(target->op1, last_op->op1)) {
1338
          /* JMPZ(X, L), L: JMPNZ(X, L2) -> JMPZ(X, L+1) */
1339
24
          next = target_block->successors[1];
1340
29.1k
        } else {
1341
29.1k
          break;
1342
29.1k
        }
1343
396
        CHECK_LOOP(next);
1344
210
        block->successors[0] = next;
1345
210
        ++(*opt_count);
1346
210
        target_block = get_target_block(cfg, block, 0, opt_count);
1347
210
      }
1348
1349
42.5k
      follow_block = get_follow_block(cfg, block, 1, opt_count);
1350
42.5k
      if (target_block == follow_block) {
1351
        /* L: JMP[N]Z(X, L+1) -> NOP or FREE(X) */
1352
454
        zend_optimizer_convert_to_free_op1(op_array, last_op);
1353
454
        if (last_op->opcode == ZEND_NOP) {
1354
0
          block->len--;
1355
0
        }
1356
454
        block->successors_count = 1;
1357
454
        ++(*opt_count);
1358
42.0k
      } else if (follow_block->len == 1) {
1359
9.43k
        target = op_array->opcodes + follow_block->start;
1360
9.43k
        if (target->opcode == ZEND_JMP) {
1361
822
            if (block->successors[0] == follow_block->successors[0]) {
1362
            /* JMPZ(X,L1), JMP(L1) -> NOP, JMP(L1) */
1363
32
            zend_optimizer_convert_to_free_op1(op_array, last_op);
1364
32
            if (last_op->opcode == ZEND_NOP) {
1365
0
              block->len--;
1366
0
            }
1367
32
            block->successors[0] = follow_block - cfg->blocks;
1368
32
            block->successors_count = 1;
1369
32
            ++(*opt_count);
1370
32
            break;
1371
790
          } else if (!(follow_block->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED))) {
1372
790
            next_block = get_next_block(cfg, follow_block);
1373
1374
790
            if (target_block == next_block) {
1375
              /* JMPZ(X,L1) JMP(L2) L1: -> JMPNZ(X,L2) NOP*/
1376
1377
417
              last_op->opcode = INV_COND(last_op->opcode);
1378
1379
417
              block->successors[0] = follow_block->successors[0];
1380
417
              block->successors[1] = next_block - cfg->blocks;
1381
1382
417
              follow_block->flags &= ~ZEND_BB_REACHABLE;
1383
417
              MAKE_NOP(target);
1384
417
              follow_block->len = 0;
1385
1386
417
              next_block->flags |= ZEND_BB_FOLLOW;
1387
1388
417
              break;
1389
417
            }
1390
790
          }
1391
822
        }
1392
9.43k
      }
1393
42.0k
      break;
1394
1395
42.0k
    case ZEND_JMPNZ_EX:
1396
736
    case ZEND_JMPZ_EX:
1397
736
      jmp_hitlist_count = 0;
1398
1399
736
      target_block = get_target_block(cfg, block, 0, opt_count);
1400
736
      while (target_block->len == 1) {
1401
68
        target = op_array->opcodes + target_block->start;
1402
1403
68
        if (target->opcode == ZEND_JMP) {
1404
          /* T = JMPZ_EX(X, L), L: JMP(L2) -> T = JMPZ(X, L2) */
1405
0
          next = target_block->successors[0];
1406
68
        } else if (target->opcode == last_op->opcode-3 &&
1407
68
                   (SAME_VAR(target->op1, last_op->result) ||
1408
0
                    SAME_VAR(target->op1, last_op->op1))) {
1409
          /* T = JMPZ_EX(X, L1), L1: JMPZ({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1410
0
          next = target_block->successors[0];
1411
68
        } else if (target->opcode == last_op->opcode &&
1412
68
                   target->result.var == last_op->result.var &&
1413
68
                   (SAME_VAR(target->op1, last_op->result) ||
1414
0
                    SAME_VAR(target->op1, last_op->op1))) {
1415
          /* T = JMPZ_EX(X, L1), L1: T = JMPZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1416
0
          next = target_block->successors[0];
1417
68
        } else if (target->opcode == INV_EX_COND(last_op->opcode) &&
1418
68
                   (SAME_VAR(target->op1, last_op->result) ||
1419
0
                    SAME_VAR(target->op1, last_op->op1))) {
1420
          /* T = JMPZ_EX(X, L1), L1: JMPNZ({X|T1}, L2) -> T = JMPZ_EX(X, L1+1) */
1421
0
          next = target_block->successors[1];
1422
68
        } else if (target->opcode == INV_EX_COND_EX(last_op->opcode) &&
1423
68
                   target->result.var == last_op->result.var &&
1424
68
                   (SAME_VAR(target->op1, last_op->result) ||
1425
0
                    SAME_VAR(target->op1, last_op->op1))) {
1426
          /* T = JMPZ_EX(X, L1), L1: T = JMPNZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L1+1) */
1427
0
          next = target_block->successors[1];
1428
68
        } else if (target->opcode == ZEND_BOOL &&
1429
68
                   (SAME_VAR(target->op1, last_op->result) ||
1430
0
                    SAME_VAR(target->op1, last_op->op1))) {
1431
          /* convert Y = JMPZ_EX(X,L1), L1: Z = BOOL(Y) to
1432
             Z = JMPZ_EX(X,L1+1) */
1433
1434
          /* NOTE: This optimization pattern is not safe, but works, */
1435
          /*       because result of JMPZ_EX instruction             */
1436
          /*       is not used on the following path and             */
1437
          /*       should be used once on the branch path.           */
1438
          /*                                                         */
1439
          /*       The pattern works well only if jumps processed in */
1440
          /*       direct order, otherwise it breaks JMPZ_EX         */
1441
          /*       sequences too early.                              */
1442
0
          last_op->result.var = target->result.var;
1443
0
          next = target_block->successors[0];
1444
68
        } else {
1445
68
          break;
1446
68
        }
1447
0
        CHECK_LOOP(next);
1448
0
        block->successors[0] = next;
1449
0
        ++(*opt_count);
1450
0
        target_block = get_target_block(cfg, block, 0, opt_count);
1451
0
      }
1452
1453
736
      follow_block = get_follow_block(cfg, block, 1, opt_count);
1454
736
      if (target_block == follow_block) {
1455
        /* L: T = JMP[N]Z_EX(X, L+1) -> T = BOOL(X) */
1456
0
        last_op->opcode = ZEND_BOOL;
1457
0
        last_op->op2.num = 0;
1458
0
        block->successors_count = 1;
1459
0
        ++(*opt_count);
1460
0
        break;
1461
0
      }
1462
736
      break;
1463
640k
  }
1464
640k
}
1465
1466
/* Global data dependencies */
1467
1468
/* Find a set of variables which are used outside of the block where they are
1469
 * defined. We won't apply some optimization patterns for such variables. */
1470
static void zend_t_usage(zend_cfg *cfg, zend_op_array *op_array, zend_bitset used_ext, zend_optimizer_ctx *ctx)
1471
141k
{
1472
141k
  int n;
1473
141k
  zend_basic_block *block, *next_block;
1474
141k
  uint32_t var_num;
1475
141k
  uint32_t bitset_len;
1476
141k
  zend_bitset usage;
1477
141k
  zend_bitset defined_here;
1478
141k
  void *checkpoint;
1479
141k
  zend_op *opline, *end;
1480
1481
1482
141k
  if (op_array->T == 0) {
1483
    /* shortcut - if no Ts, nothing to do */
1484
14.7k
    return;
1485
14.7k
  }
1486
1487
126k
  checkpoint = zend_arena_checkpoint(ctx->arena);
1488
126k
  bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1489
126k
  defined_here = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1490
1491
126k
  zend_bitset_clear(defined_here, bitset_len);
1492
682k
  for (n = 1; n < cfg->blocks_count; n++) {
1493
555k
    block = cfg->blocks + n;
1494
1495
555k
    if (!(block->flags & ZEND_BB_REACHABLE)) {
1496
55.0k
      continue;
1497
55.0k
    }
1498
1499
500k
    opline = op_array->opcodes + block->start;
1500
500k
    end = opline + block->len;
1501
500k
    if (!(block->flags & ZEND_BB_FOLLOW) ||
1502
500k
        (block->flags & ZEND_BB_TARGET)) {
1503
      /* Skip continuation of "extended" BB */
1504
260k
      zend_bitset_clear(defined_here, bitset_len);
1505
260k
    }
1506
1507
2.67M
    while (opline<end) {
1508
2.17M
      if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1509
591k
        var_num = VAR_NUM(opline->op1.var);
1510
591k
        if (!zend_bitset_in(defined_here, var_num)) {
1511
325k
          zend_bitset_incl(used_ext, var_num);
1512
325k
        }
1513
591k
      }
1514
2.17M
      if (opline->op2_type == IS_VAR) {
1515
71.6k
        var_num = VAR_NUM(opline->op2.var);
1516
71.6k
        if (opline->opcode == ZEND_FE_FETCH_R ||
1517
71.6k
            opline->opcode == ZEND_FE_FETCH_RW) {
1518
          /* these opcode use the op2 as result */
1519
246
          zend_bitset_incl(defined_here, var_num);
1520
71.4k
        } else if (!zend_bitset_in(defined_here, var_num)) {
1521
152
          zend_bitset_incl(used_ext, var_num);
1522
152
        }
1523
2.10M
      } else if (opline->op2_type == IS_TMP_VAR) {
1524
341k
        var_num = VAR_NUM(opline->op2.var);
1525
341k
        if (!zend_bitset_in(defined_here, var_num)) {
1526
47.4k
          zend_bitset_incl(used_ext, var_num);
1527
47.4k
        }
1528
341k
      }
1529
1530
2.17M
      if (opline->result_type == IS_VAR) {
1531
157k
        var_num = VAR_NUM(opline->result.var);
1532
157k
        zend_bitset_incl(defined_here, var_num);
1533
2.02M
      } else if (opline->result_type == IS_TMP_VAR) {
1534
846k
        var_num = VAR_NUM(opline->result.var);
1535
846k
        switch (opline->opcode) {
1536
5.06k
          case ZEND_ADD_ARRAY_ELEMENT:
1537
5.12k
          case ZEND_ADD_ARRAY_UNPACK:
1538
304k
          case ZEND_ROPE_ADD:
1539
            /* these opcodes use the result as argument */
1540
304k
            if (!zend_bitset_in(defined_here, var_num)) {
1541
260k
              zend_bitset_incl(used_ext, var_num);
1542
260k
            }
1543
304k
            break;
1544
541k
          default :
1545
541k
            zend_bitset_incl(defined_here, var_num);
1546
846k
        }
1547
846k
      }
1548
2.17M
      opline++;
1549
2.17M
    }
1550
500k
  }
1551
1552
126k
  if (ctx->debug_level & ZEND_DUMP_BLOCK_PASS_VARS) {
1553
0
    bool printed = 0;
1554
0
    uint32_t i;
1555
1556
0
    for (i = op_array->last_var; i< op_array->T; i++) {
1557
0
      if (zend_bitset_in(used_ext, i)) {
1558
0
        if (!printed) {
1559
0
          fprintf(stderr, "NON-LOCAL-VARS: %d", i);
1560
0
          printed = 1;
1561
0
        } else {
1562
0
          fprintf(stderr, ", %d", i);
1563
0
        }
1564
0
      }
1565
0
    }
1566
0
    if (printed) {
1567
0
      fprintf(stderr, "\n");
1568
0
    }
1569
0
  }
1570
1571
126k
  usage = defined_here;
1572
126k
  next_block = NULL;
1573
808k
  for (n = cfg->blocks_count; n > 0;) {
1574
682k
    block = cfg->blocks + (--n);
1575
1576
682k
    if (!(block->flags & ZEND_BB_REACHABLE) || block->len == 0) {
1577
55.2k
      continue;
1578
55.2k
    }
1579
1580
626k
    end = op_array->opcodes + block->start;
1581
626k
    opline = end + block->len - 1;
1582
626k
    if (!next_block ||
1583
626k
        !(next_block->flags & ZEND_BB_FOLLOW) ||
1584
626k
        (next_block->flags & ZEND_BB_TARGET)) {
1585
      /* Skip continuation of "extended" BB */
1586
387k
      zend_bitset_copy(usage, used_ext, bitset_len);
1587
387k
    } else if (block->successors_count > 1) {
1588
135k
      zend_bitset_union(usage, used_ext, bitset_len);
1589
135k
    }
1590
626k
    next_block = block;
1591
1592
4.29M
    while (opline >= end) {
1593
      /* usage checks */
1594
3.67M
      if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
1595
1.75M
        if (!zend_bitset_in(usage, VAR_NUM(opline->result.var))) {
1596
6.04k
          switch (opline->opcode) {
1597
0
            case ZEND_ASSIGN_OP:
1598
0
            case ZEND_ASSIGN_DIM_OP:
1599
0
            case ZEND_ASSIGN_OBJ_OP:
1600
0
            case ZEND_ASSIGN_STATIC_PROP_OP:
1601
0
            case ZEND_PRE_INC:
1602
0
            case ZEND_PRE_DEC:
1603
0
            case ZEND_ASSIGN:
1604
0
            case ZEND_ASSIGN_REF:
1605
0
            case ZEND_DO_FCALL:
1606
0
            case ZEND_DO_ICALL:
1607
0
            case ZEND_DO_UCALL:
1608
0
            case ZEND_DO_FCALL_BY_NAME:
1609
0
              opline->result_type = IS_UNUSED;
1610
0
              break;
1611
0
            case ZEND_POST_INC:
1612
0
            case ZEND_POST_DEC:
1613
0
            case ZEND_POST_INC_OBJ:
1614
0
            case ZEND_POST_DEC_OBJ:
1615
0
            case ZEND_POST_INC_STATIC_PROP:
1616
0
            case ZEND_POST_DEC_STATIC_PROP:
1617
0
              opline->opcode -= 2;
1618
0
              opline->result_type = IS_UNUSED;
1619
0
              break;
1620
26
            case ZEND_QM_ASSIGN:
1621
582
            case ZEND_BOOL:
1622
4.55k
            case ZEND_BOOL_NOT:
1623
4.55k
              zend_optimizer_convert_to_free_op1(op_array, opline);
1624
4.55k
              break;
1625
842
            case ZEND_JMPZ_EX:
1626
1.39k
            case ZEND_JMPNZ_EX:
1627
1.39k
              opline->opcode -= 3;
1628
1.39k
              SET_UNUSED(opline->result);
1629
1.39k
              break;
1630
0
            case ZEND_ADD_ARRAY_ELEMENT:
1631
0
            case ZEND_ADD_ARRAY_UNPACK:
1632
0
            case ZEND_ROPE_ADD:
1633
0
              zend_bitset_incl(usage, VAR_NUM(opline->result.var));
1634
0
              break;
1635
6.04k
          }
1636
1.75M
        } else {
1637
1.75M
          switch (opline->opcode) {
1638
67.2k
            case ZEND_ADD_ARRAY_ELEMENT:
1639
67.5k
            case ZEND_ADD_ARRAY_UNPACK:
1640
444k
            case ZEND_ROPE_ADD:
1641
444k
              break;
1642
1.30M
            default:
1643
1.30M
              zend_bitset_excl(usage, VAR_NUM(opline->result.var));
1644
1.30M
              break;
1645
1.75M
          }
1646
1.75M
        }
1647
1.75M
      }
1648
1649
3.67M
      if (opline->op2_type == IS_VAR) {
1650
107k
        switch (opline->opcode) {
1651
228
          case ZEND_FE_FETCH_R:
1652
246
          case ZEND_FE_FETCH_RW:
1653
246
            zend_bitset_excl(usage, VAR_NUM(opline->op2.var));
1654
246
            break;
1655
107k
          default:
1656
107k
            zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1657
107k
            break;
1658
107k
        }
1659
3.56M
      } else if (opline->op2_type == IS_TMP_VAR) {
1660
654k
        zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1661
654k
      }
1662
1663
3.67M
      if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1664
906k
        zend_bitset_incl(usage, VAR_NUM(opline->op1.var));
1665
906k
      }
1666
1667
3.67M
      opline--;
1668
3.67M
    }
1669
626k
  }
1670
1671
126k
  zend_arena_release(&ctx->arena, checkpoint);
1672
126k
}
1673
1674
static void zend_merge_blocks(zend_op_array *op_array, zend_cfg *cfg, uint32_t *opt_count)
1675
141k
{
1676
141k
  int i;
1677
141k
  zend_basic_block *b, *bb;
1678
141k
  zend_basic_block *prev = NULL;
1679
1680
841k
  for (i = 0; i < cfg->blocks_count; i++) {
1681
699k
    b = cfg->blocks + i;
1682
699k
    if (b->flags & ZEND_BB_REACHABLE) {
1683
640k
      if ((b->flags & ZEND_BB_FOLLOW) &&
1684
640k
          !(b->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED)) &&
1685
640k
          prev && prev->successors_count == 1 && prev->successors[0] == i)
1686
38.1k
      {
1687
38.1k
        zend_op *last_op = op_array->opcodes + prev->start + prev->len - 1;
1688
38.1k
        if (prev->len != 0 && last_op->opcode == ZEND_JMP) {
1689
0
          MAKE_NOP(last_op);
1690
0
        }
1691
1692
39.8k
        for (bb = prev + 1; bb != b; bb++) {
1693
1.77k
          zend_op *op = op_array->opcodes + bb->start;
1694
1.77k
          zend_op *end = op + bb->len;
1695
3.18k
          while (op < end) {
1696
1.40k
            if (op->op1_type == IS_CONST) {
1697
557
              literal_dtor(&ZEND_OP1_LITERAL(op));
1698
557
            }
1699
1.40k
            if (op->op2_type == IS_CONST) {
1700
130
              literal_dtor(&ZEND_OP2_LITERAL(op));
1701
130
            }
1702
1.40k
            MAKE_NOP(op);
1703
1.40k
            op++;
1704
1.40k
          }
1705
          /* make block empty */
1706
1.77k
          bb->len = 0;
1707
1.77k
        }
1708
1709
        /* re-link */
1710
38.1k
        prev->flags |= (b->flags & ZEND_BB_EXIT);
1711
38.1k
        prev->len = b->start + b->len - prev->start;
1712
38.1k
        prev->successors_count = b->successors_count;
1713
38.1k
        if (b->successors != b->successors_storage) {
1714
64
          prev->successors = b->successors;
1715
64
          b->successors = b->successors_storage;
1716
38.0k
        } else {
1717
38.0k
          memcpy(prev->successors, b->successors, b->successors_count * sizeof(int));
1718
38.0k
        }
1719
1720
        /* unlink & make block empty and unreachable */
1721
38.1k
        b->flags = 0;
1722
38.1k
        b->len = 0;
1723
38.1k
        b->successors_count = 0;
1724
38.1k
        ++(*opt_count);
1725
602k
      } else {
1726
602k
        prev = b;
1727
602k
      }
1728
640k
    }
1729
699k
  }
1730
141k
}
1731
1732
141k
#define PASSES 3
1733
1734
void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1735
109k
{
1736
109k
  zend_cfg cfg;
1737
109k
  zend_basic_block *blocks, *end, *b;
1738
109k
  int pass;
1739
109k
  uint32_t bitset_len;
1740
109k
  zend_bitset usage;
1741
109k
  void *checkpoint;
1742
109k
  zend_op **Tsource;
1743
109k
  uint32_t opt_count;
1744
109k
  int *jmp_hitlist;
1745
1746
    /* Build CFG */
1747
109k
  checkpoint = zend_arena_checkpoint(ctx->arena);
1748
109k
  zend_build_cfg(&ctx->arena, op_array, 0, &cfg);
1749
1750
109k
  if (cfg.blocks_count * (op_array->last_var + op_array->T) > 64 * 1024 * 1024) {
1751
0
    zend_arena_release(&ctx->arena, checkpoint);
1752
0
    return;
1753
0
  }
1754
1755
109k
  if (ctx->debug_level & ZEND_DUMP_BEFORE_BLOCK_PASS) {
1756
0
    zend_dump_op_array(op_array, ZEND_DUMP_CFG, "before block pass", &cfg);
1757
0
  }
1758
1759
109k
  bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1760
109k
  Tsource = zend_arena_calloc(&ctx->arena, op_array->last_var + op_array->T, sizeof(zend_op *));
1761
109k
  usage = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1762
109k
  jmp_hitlist = zend_arena_alloc(&ctx->arena, cfg.blocks_count * sizeof(int));
1763
1764
109k
  blocks = cfg.blocks;
1765
109k
  end = blocks + cfg.blocks_count;
1766
141k
  for (pass = 0; pass < PASSES; pass++) {
1767
141k
    opt_count = 0;
1768
1769
    /* Compute data dependencies */
1770
141k
    zend_bitset_clear(usage, bitset_len);
1771
141k
    zend_t_usage(&cfg, op_array, usage, ctx);
1772
1773
    /* optimize each basic block separately */
1774
841k
    for (b = blocks; b < end; b++) {
1775
699k
      if (!(b->flags & ZEND_BB_REACHABLE)) {
1776
58.0k
        continue;
1777
58.0k
      }
1778
      /* we track data dependencies only inside a single basic block */
1779
641k
      if (!(b->flags & ZEND_BB_FOLLOW) ||
1780
641k
          (b->flags & ZEND_BB_TARGET)) {
1781
        /* Skip continuation of "extended" BB */
1782
401k
        memset(Tsource, 0, (op_array->last_var + op_array->T) * sizeof(zend_op *));
1783
401k
      }
1784
641k
      zend_optimize_block(b, op_array, usage, &cfg, Tsource, &opt_count);
1785
641k
    }
1786
1787
    /* Eliminate NOPs */
1788
841k
    for (b = blocks; b < end; b++) {
1789
699k
      if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
1790
        /* In unreachable_free blocks only preserve loop var frees. */
1791
116
        for (uint32_t i = b->start; i < b->start + b->len; i++) {
1792
78
          zend_op *opline = &op_array->opcodes[i];
1793
78
          if (!zend_optimizer_is_loop_var_free(opline)) {
1794
40
            MAKE_NOP(opline);
1795
40
          }
1796
78
        }
1797
38
      }
1798
699k
      if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1799
641k
        strip_nops(op_array, b);
1800
641k
      }
1801
699k
    }
1802
1803
141k
    opt_count = 0;
1804
1805
    /* Jump optimization for each block */
1806
841k
    for (b = blocks; b < end; b++) {
1807
699k
      if (b->flags & ZEND_BB_REACHABLE) {
1808
641k
        zend_jmp_optimization(b, op_array, &cfg, jmp_hitlist, &opt_count);
1809
641k
      }
1810
699k
    }
1811
1812
    /* Eliminate unreachable basic blocks */
1813
141k
    zend_cfg_remark_reachable_blocks(op_array, &cfg);
1814
1815
    /* Merge Blocks */
1816
141k
    zend_merge_blocks(op_array, &cfg, &opt_count);
1817
1818
141k
    if (opt_count == 0) {
1819
108k
      break;
1820
108k
    }
1821
141k
  }
1822
1823
109k
  assemble_code_blocks(&cfg, op_array, ctx);
1824
1825
109k
  if (ctx->debug_level & ZEND_DUMP_AFTER_BLOCK_PASS) {
1826
0
    zend_dump_op_array(op_array, ZEND_DUMP_CFG | ZEND_DUMP_HIDE_UNREACHABLE, "after block pass", &cfg);
1827
0
  }
1828
1829
  /* Destroy CFG */
1830
109k
  zend_arena_release(&ctx->arena, checkpoint);
1831
109k
}