Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/Optimizer/dfa_pass.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Dmitry Stogov <dmitry@php.net>                              |
16
   +----------------------------------------------------------------------+
17
*/
18
19
#include "Optimizer/zend_optimizer.h"
20
#include "Optimizer/zend_optimizer_internal.h"
21
#include "zend_API.h"
22
#include "zend_constants.h"
23
#include "zend_execute.h"
24
#include "zend_vm.h"
25
#include "zend_bitset.h"
26
#include "zend_cfg.h"
27
#include "zend_ssa.h"
28
#include "zend_func_info.h"
29
#include "zend_call_graph.h"
30
#include "zend_inference.h"
31
#include "zend_dump.h"
32
33
#ifndef ZEND_DEBUG_DFA
34
# define ZEND_DEBUG_DFA ZEND_DEBUG
35
#endif
36
37
#if ZEND_DEBUG_DFA
38
# include "ssa_integrity.c"
39
#endif
40
41
zend_result zend_dfa_analyze_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa)
42
109k
{
43
109k
  uint32_t build_flags;
44
45
109k
  if (op_array->last_try_catch) {
46
    /* TODO: we can't analyze functions with try/catch/finally ??? */
47
32.2k
    return FAILURE;
48
32.2k
  }
49
50
    /* Build SSA */
51
76.8k
  memset(ssa, 0, sizeof(zend_ssa));
52
53
76.8k
  zend_build_cfg(&ctx->arena, op_array, ZEND_CFG_NO_ENTRY_PREDECESSORS, &ssa->cfg);
54
55
76.8k
  if ((ssa->cfg.flags & ZEND_FUNC_INDIRECT_VAR_ACCESS)) {
56
    /* TODO: we can't analyze functions with indirect variable access ??? */
57
2.73k
    return FAILURE;
58
2.73k
  }
59
60
74.1k
  zend_cfg_build_predecessors(&ctx->arena, &ssa->cfg);
61
62
74.1k
  if (ctx->debug_level & ZEND_DUMP_DFA_CFG) {
63
0
    zend_dump_op_array(op_array, ZEND_DUMP_CFG, "dfa cfg", &ssa->cfg);
64
0
  }
65
66
  /* Compute Dominators Tree */
67
74.1k
  zend_cfg_compute_dominators_tree(op_array, &ssa->cfg);
68
69
  /* Identify reducible and irreducible loops */
70
74.1k
  zend_cfg_identify_loops(op_array, &ssa->cfg);
71
72
74.1k
  if (ctx->debug_level & ZEND_DUMP_DFA_DOMINATORS) {
73
0
    zend_dump_dominators(op_array, &ssa->cfg);
74
0
  }
75
76
74.1k
  build_flags = 0;
77
74.1k
  if (ctx->debug_level & ZEND_DUMP_DFA_LIVENESS) {
78
0
    build_flags |= ZEND_SSA_DEBUG_LIVENESS;
79
0
  }
80
74.1k
  if (ctx->debug_level & ZEND_DUMP_DFA_PHI) {
81
0
    build_flags |= ZEND_SSA_DEBUG_PHI_PLACEMENT;
82
0
  }
83
74.1k
  if (zend_build_ssa(&ctx->arena, ctx->script, op_array, build_flags, ssa) == FAILURE) {
84
0
    return FAILURE;
85
0
  }
86
87
74.1k
  if (ctx->debug_level & ZEND_DUMP_DFA_SSA) {
88
0
    zend_dump_op_array(op_array, ZEND_DUMP_SSA, "dfa ssa", ssa);
89
0
  }
90
91
92
74.1k
  zend_ssa_compute_use_def_chains(&ctx->arena, op_array, ssa);
93
94
74.1k
  zend_ssa_find_false_dependencies(op_array, ssa);
95
96
74.1k
  zend_ssa_find_sccs(op_array, ssa);
97
98
74.1k
  if (zend_ssa_inference(&ctx->arena, op_array, ctx->script, ssa, ctx->optimization_level) == FAILURE) {
99
0
    return FAILURE;
100
0
  }
101
102
74.1k
  if (zend_ssa_escape_analysis(ctx->script, op_array, ssa) == FAILURE) {
103
0
    return FAILURE;
104
0
  }
105
106
74.1k
  if (ctx->debug_level & ZEND_DUMP_DFA_SSA_VARS) {
107
0
    zend_dump_ssa_variables(op_array, ssa, 0);
108
0
  }
109
110
74.1k
  return SUCCESS;
111
74.1k
}
112
113
static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_optimizer_ctx *ctx)
114
6.23k
{
115
6.23k
  zend_basic_block *blocks = ssa->cfg.blocks;
116
6.23k
  zend_basic_block *blocks_end = blocks + ssa->cfg.blocks_count;
117
6.23k
  zend_basic_block *b;
118
6.23k
  zend_func_info *func_info;
119
6.23k
  int j;
120
6.23k
  uint32_t i = 0;
121
6.23k
  uint32_t target = 0;
122
6.23k
  uint32_t *shiftlist;
123
6.23k
  ALLOCA_FLAG(use_heap);
124
125
6.23k
  shiftlist = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last, use_heap);
126
6.23k
  memset(shiftlist, 0, sizeof(uint32_t) * op_array->last);
127
  /* remove empty callee_info */
128
6.23k
  func_info = ZEND_FUNC_INFO(op_array);
129
6.23k
  if (func_info) {
130
6.23k
    zend_call_info **call_info = &func_info->callee_info;
131
13.5k
    while ((*call_info)) {
132
7.32k
      if ((*call_info)->caller_init_opline->opcode == ZEND_NOP) {
133
52
        *call_info = (*call_info)->next_callee;
134
7.27k
      } else {
135
7.27k
        call_info = &(*call_info)->next_callee;
136
7.27k
      }
137
7.32k
    }
138
6.23k
  }
139
140
62.1k
  for (b = blocks; b < blocks_end; b++) {
141
55.9k
    if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
142
53.3k
      if (b->len) {
143
53.0k
        uint32_t new_start, old_end;
144
59.8k
        while (i < b->start) {
145
6.83k
          shiftlist[i] = i - target;
146
6.83k
          i++;
147
6.83k
        }
148
149
53.0k
        if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
150
          /* Only keep the FREE for the loop var */
151
18
          ZEND_ASSERT(op_array->opcodes[b->start].opcode == ZEND_FREE
152
18
              || op_array->opcodes[b->start].opcode == ZEND_FE_FREE);
153
18
          b->len = 1;
154
18
        }
155
156
53.0k
        new_start = target;
157
53.0k
        old_end = b->start + b->len;
158
319k
        while (i < old_end) {
159
266k
          shiftlist[i] = i - target;
160
266k
          if (EXPECTED(op_array->opcodes[i].opcode != ZEND_NOP)) {
161
249k
            if (i != target) {
162
126k
              op_array->opcodes[target] = op_array->opcodes[i];
163
126k
              ssa->ops[target] = ssa->ops[i];
164
126k
              ssa->cfg.map[target] = b - blocks;
165
126k
            }
166
249k
            target++;
167
249k
          }
168
266k
          i++;
169
266k
        }
170
53.0k
        b->start = new_start;
171
53.0k
        if (target != old_end) {
172
29.2k
          zend_op *opline;
173
29.2k
          zend_op *new_opline;
174
175
29.2k
          b->len = target - b->start;
176
29.2k
          opline = op_array->opcodes + old_end - 1;
177
29.2k
          if (opline->opcode == ZEND_NOP) {
178
91
            continue;
179
91
          }
180
181
29.1k
          new_opline = op_array->opcodes + target - 1;
182
29.1k
          zend_optimizer_migrate_jump(op_array, new_opline, opline);
183
29.1k
        }
184
53.0k
      } else {
185
333
        b->start = target;
186
333
      }
187
53.3k
    } else {
188
2.56k
      b->start = target;
189
2.56k
      b->len = 0;
190
2.56k
    }
191
55.9k
  }
192
193
6.23k
  if (target != op_array->last) {
194
    /* reset rest opcodes */
195
30.9k
    for (i = target; i < op_array->last; i++) {
196
24.7k
      MAKE_NOP(op_array->opcodes + i);
197
24.7k
    }
198
199
    /* update SSA variables */
200
320k
    for (j = 0; j < ssa->vars_count; j++) {
201
314k
      if (ssa->vars[j].definition >= 0) {
202
203k
        ssa->vars[j].definition -= shiftlist[ssa->vars[j].definition];
203
203k
      }
204
314k
      if (ssa->vars[j].use_chain >= 0) {
205
218k
        ssa->vars[j].use_chain -= shiftlist[ssa->vars[j].use_chain];
206
218k
      }
207
314k
    }
208
280k
    for (i = 0; i < op_array->last; i++) {
209
274k
      if (ssa->ops[i].op1_use_chain >= 0) {
210
13.8k
        ssa->ops[i].op1_use_chain -= shiftlist[ssa->ops[i].op1_use_chain];
211
13.8k
      }
212
274k
      if (ssa->ops[i].op2_use_chain >= 0) {
213
32.8k
        ssa->ops[i].op2_use_chain -= shiftlist[ssa->ops[i].op2_use_chain];
214
32.8k
      }
215
274k
      if (ssa->ops[i].res_use_chain >= 0) {
216
0
        ssa->ops[i].res_use_chain -= shiftlist[ssa->ops[i].res_use_chain];
217
0
      }
218
274k
    }
219
220
    /* update branch targets */
221
62.1k
    for (b = blocks; b < blocks_end; b++) {
222
55.9k
      if ((b->flags & ZEND_BB_REACHABLE) && b->len != 0) {
223
53.0k
        zend_op *opline = op_array->opcodes + b->start + b->len - 1;
224
53.0k
        zend_optimizer_shift_jump(op_array, opline, shiftlist);
225
53.0k
      }
226
55.9k
    }
227
228
    /* update try/catch array */
229
6.23k
    for (j = 0; j < op_array->last_try_catch; j++) {
230
0
      op_array->try_catch_array[j].try_op -= shiftlist[op_array->try_catch_array[j].try_op];
231
0
      op_array->try_catch_array[j].catch_op -= shiftlist[op_array->try_catch_array[j].catch_op];
232
0
      if (op_array->try_catch_array[j].finally_op) {
233
0
        op_array->try_catch_array[j].finally_op -= shiftlist[op_array->try_catch_array[j].finally_op];
234
0
        op_array->try_catch_array[j].finally_end -= shiftlist[op_array->try_catch_array[j].finally_end];
235
0
      }
236
0
    }
237
238
    /* update call graph */
239
6.23k
    if (func_info) {
240
6.23k
      zend_call_info *call_info = func_info->callee_info;
241
13.5k
      while (call_info) {
242
7.27k
        call_info->caller_init_opline -=
243
7.27k
          shiftlist[call_info->caller_init_opline - op_array->opcodes];
244
7.27k
        if (call_info->caller_call_opline) {
245
7.27k
          call_info->caller_call_opline -=
246
7.27k
            shiftlist[call_info->caller_call_opline - op_array->opcodes];
247
7.27k
        }
248
7.27k
        call_info = call_info->next_callee;
249
7.27k
      }
250
6.23k
    }
251
252
6.23k
    op_array->last = target;
253
6.23k
  }
254
6.23k
  free_alloca(shiftlist, use_heap);
255
6.23k
}
256
257
356
static bool safe_instanceof(const zend_class_entry *ce1, const zend_class_entry *ce2) {
258
356
  if (ce1 == ce2) {
259
204
    return 1;
260
204
  }
261
152
  if (!(ce1->ce_flags & ZEND_ACC_LINKED)) {
262
    /* This case could be generalized, similarly to unlinked_instanceof */
263
20
    return 0;
264
20
  }
265
132
  return instanceof_function(ce1, ce2);
266
152
}
267
268
static inline bool can_elide_list_type(
269
  const zend_script *script, const zend_op_array *op_array,
270
  const zend_ssa_var_info *use_info, const zend_type type)
271
446
{
272
446
  const zend_type *single_type;
273
  /* For intersection: result==false is failure, default is success.
274
   * For union: result==true is success, default is failure. */
275
446
  bool is_intersection = ZEND_TYPE_IS_INTERSECTION(type);
276
896
  ZEND_TYPE_FOREACH(type, single_type) {
277
896
    if (ZEND_TYPE_HAS_LIST(*single_type)) {
278
52
      ZEND_ASSERT(!is_intersection);
279
52
      return can_elide_list_type(script, op_array, use_info, *single_type);
280
52
    }
281
398
    if (ZEND_TYPE_HAS_NAME(*single_type)) {
282
398
      zend_string *lcname = zend_string_tolower(ZEND_TYPE_NAME(*single_type));
283
398
      const zend_class_entry *ce = zend_optimizer_get_class_entry(script, op_array, lcname);
284
398
      zend_string_release(lcname);
285
398
      bool result = ce && safe_instanceof(use_info->ce, ce);
286
398
      if (result == !is_intersection) {
287
292
        return result;
288
292
      }
289
398
    }
290
398
  } ZEND_TYPE_FOREACH_END();
291
102
  return is_intersection;
292
446
}
293
294
static inline bool can_elide_return_type_check(
295
2.44k
    const zend_script *script, zend_op_array *op_array, zend_ssa *ssa, zend_ssa_op *ssa_op) {
296
2.44k
  zend_arg_info *arg_info = &op_array->arg_info[-1];
297
2.44k
  zend_ssa_var_info *use_info = &ssa->var_info[ssa_op->op1_use];
298
2.44k
  uint32_t use_type = use_info->type & (MAY_BE_ANY|MAY_BE_UNDEF);
299
2.44k
  if (use_type & MAY_BE_REF) {
300
0
    return 0;
301
0
  }
302
303
2.44k
  if (use_type & MAY_BE_UNDEF) {
304
84
    use_type &= ~MAY_BE_UNDEF;
305
84
    use_type |= MAY_BE_NULL;
306
84
  }
307
308
2.44k
  uint32_t disallowed_types = use_type & ~ZEND_TYPE_PURE_MASK(arg_info->type);
309
2.44k
  if (!disallowed_types) {
310
    /* Only contains allowed types. */
311
502
    return true;
312
502
  }
313
314
1.94k
  if (disallowed_types == MAY_BE_OBJECT && use_info->ce && ZEND_TYPE_IS_COMPLEX(arg_info->type)) {
315
394
    return can_elide_list_type(script, op_array, use_info, arg_info->type);
316
394
  }
317
318
1.54k
  return false;
319
1.94k
}
320
321
static bool opline_supports_assign_contraction(
322
4.87k
    zend_op_array *op_array, zend_ssa *ssa, zend_op *opline, int src_var, uint32_t cv_var) {
323
4.87k
  if (opline->opcode == ZEND_NEW) {
324
    /* see Zend/tests/generators/aborted_yield_during_new.phpt */
325
1.01k
    return 0;
326
1.01k
  }
327
328
  /* Frameless calls override the return value, but the return value may overlap with the arguments. */
329
3.86k
  switch (opline->opcode) {
330
0
    case ZEND_FRAMELESS_ICALL_3:
331
0
      if ((opline + 1)->op1_type == IS_CV && (opline + 1)->op1.var == cv_var) return 0;
332
0
      ZEND_FALLTHROUGH;
333
0
    case ZEND_FRAMELESS_ICALL_2:
334
0
      if (opline->op2_type == IS_CV && opline->op2.var == cv_var) return 0;
335
0
      ZEND_FALLTHROUGH;
336
0
    case ZEND_FRAMELESS_ICALL_1:
337
0
      if (opline->op1_type == IS_CV && opline->op1.var == cv_var) return 0;
338
0
      return 1;
339
3.86k
  }
340
341
3.86k
  if (opline->opcode == ZEND_DO_ICALL || opline->opcode == ZEND_DO_UCALL
342
3.86k
      || opline->opcode == ZEND_DO_FCALL || opline->opcode == ZEND_DO_FCALL_BY_NAME) {
343
    /* Function calls may dtor the return value after it has already been written -- allow
344
     * direct assignment only for types where a double-dtor does not matter. */
345
468
    uint32_t type = ssa->var_info[src_var].type;
346
468
    uint32_t simple = MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE;
347
468
    return !((type & MAY_BE_ANY) & ~simple);
348
468
  }
349
350
3.39k
  if (opline->opcode == ZEND_POST_INC || opline->opcode == ZEND_POST_DEC) {
351
    /* POST_INC/DEC write the result variable before performing the inc/dec. For $i = $i++
352
     * eliding the temporary variable would thus yield an incorrect result. */
353
21
    return opline->op1_type != IS_CV || opline->op1.var != cv_var;
354
21
  }
355
356
3.37k
  if (opline->opcode == ZEND_INIT_ARRAY) {
357
    /* INIT_ARRAY initializes the result array before reading key/value. */
358
45
    return (opline->op1_type != IS_CV || opline->op1.var != cv_var)
359
45
      && (opline->op2_type != IS_CV || opline->op2.var != cv_var);
360
45
  }
361
362
3.33k
  if (opline->opcode == ZEND_CAST
363
3.33k
      && (opline->extended_value == IS_ARRAY || opline->extended_value == IS_OBJECT)) {
364
    /* CAST to array/object may initialize the result to an empty array/object before
365
     * reading the expression. */
366
24
    return opline->op1_type != IS_CV || opline->op1.var != cv_var;
367
24
  }
368
369
3.30k
  if ((opline->opcode == ZEND_ASSIGN_OP
370
3.30k
    || opline->opcode == ZEND_ASSIGN_OBJ
371
3.30k
    || opline->opcode == ZEND_ASSIGN_DIM
372
3.30k
    || opline->opcode == ZEND_ASSIGN_OBJ_OP
373
3.30k
    || opline->opcode == ZEND_ASSIGN_DIM_OP)
374
3.30k
   && opline->op1_type == IS_CV
375
3.30k
   && opline->op1.var == cv_var
376
3.30k
   && zend_may_throw(opline, &ssa->ops[ssa->vars[src_var].definition], op_array, ssa)) {
377
16
    return 0;
378
16
  }
379
380
3.29k
  return 1;
381
3.30k
}
382
383
static bool variable_defined_or_used_in_range(zend_ssa *ssa, int var, int start, int end)
384
3.41k
{
385
3.45k
  while (start < end) {
386
33
    const zend_ssa_op *ssa_op = &ssa->ops[start];
387
33
    if ((ssa_op->op1_def >= 0 && ssa->vars[ssa_op->op1_def].var == var) ||
388
33
      (ssa_op->op2_def >= 0 && ssa->vars[ssa_op->op2_def].var == var) ||
389
33
      (ssa_op->result_def >= 0 && ssa->vars[ssa_op->result_def].var == var) ||
390
33
      (ssa_op->op1_use >= 0 && ssa->vars[ssa_op->op1_use].var == var) ||
391
33
      (ssa_op->op2_use >= 0 && ssa->vars[ssa_op->op2_use].var == var) ||
392
33
      (ssa_op->result_use >= 0 && ssa->vars[ssa_op->result_use].var == var)
393
33
    ) {
394
1
      return 1;
395
1
    }
396
32
    start++;
397
32
  }
398
3.41k
  return 0;
399
3.41k
}
400
401
int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
402
74.1k
{
403
74.1k
  zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
404
74.1k
  int removed_ops = 0;
405
406
74.1k
  if (func_info->callee_info) {
407
32.2k
    zend_call_info *call_info = func_info->callee_info;
408
409
78.7k
    do {
410
78.7k
      zend_op *op = call_info->caller_init_opline;
411
412
78.7k
      if ((op->opcode == ZEND_FRAMELESS_ICALL_2
413
78.7k
        || (op->opcode == ZEND_FRAMELESS_ICALL_3 && (op + 1)->op1_type == IS_CONST))
414
78.7k
       && call_info->callee_func
415
78.7k
       && zend_string_equals_literal_ci(call_info->callee_func->common.function_name, "in_array")) {
416
417
0
        bool strict = 0;
418
0
        bool has_opdata = op->opcode == ZEND_FRAMELESS_ICALL_3;
419
0
        ZEND_ASSERT(!call_info->is_prototype);
420
421
0
        if (has_opdata) {
422
0
          if (zend_is_true(CT_CONSTANT_EX(op_array, (op + 1)->op1.constant))) {
423
0
            strict = 1;
424
0
          }
425
0
        }
426
427
0
        if (op->op2_type == IS_CONST
428
0
         && Z_TYPE_P(CT_CONSTANT_EX(op_array, op->op2.constant)) == IS_ARRAY) {
429
0
          bool ok = 1;
430
431
0
          HashTable *src = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, op->op2.constant));
432
0
          HashTable *dst;
433
0
          zval *val, tmp;
434
0
          zend_ulong idx;
435
436
0
          ZVAL_TRUE(&tmp);
437
0
          dst = zend_new_array(zend_hash_num_elements(src));
438
0
          if (strict) {
439
0
            ZEND_HASH_FOREACH_VAL(src, val) {
440
0
              if (Z_TYPE_P(val) == IS_STRING) {
441
0
                zend_hash_add(dst, Z_STR_P(val), &tmp);
442
0
              } else if (Z_TYPE_P(val) == IS_LONG) {
443
0
                zend_hash_index_add(dst, Z_LVAL_P(val), &tmp);
444
0
              } else {
445
0
                zend_array_destroy(dst);
446
0
                ok = 0;
447
0
                break;
448
0
              }
449
0
            } ZEND_HASH_FOREACH_END();
450
0
          } else {
451
0
            ZEND_HASH_FOREACH_VAL(src, val) {
452
0
              if (Z_TYPE_P(val) != IS_STRING || ZEND_HANDLE_NUMERIC(Z_STR_P(val), idx)) {
453
0
                zend_array_destroy(dst);
454
0
                ok = 0;
455
0
                break;
456
0
              }
457
0
              zend_hash_add(dst, Z_STR_P(val), &tmp);
458
0
            } ZEND_HASH_FOREACH_END();
459
0
          }
460
461
0
          if (ok) {
462
0
            ZVAL_ARR(&tmp, dst);
463
464
            /* Update opcode */
465
0
            op->opcode = ZEND_IN_ARRAY;
466
0
            op->extended_value = strict;
467
0
            op->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
468
0
            if (has_opdata) {
469
0
              MAKE_NOP(op + 1);
470
0
              removed_ops++;
471
0
            }
472
0
          }
473
0
        }
474
0
      }
475
78.7k
      call_info = call_info->next_callee;
476
78.7k
    } while (call_info);
477
32.2k
  }
478
479
74.1k
  return removed_ops;
480
74.1k
}
481
482
static zend_always_inline void take_successor_0(zend_ssa *ssa, int block_num, zend_basic_block *block)
483
896
{
484
896
  if (block->successors_count == 2) {
485
194
    if (block->successors[1] != block->successors[0]) {
486
35
      zend_ssa_remove_predecessor(ssa, block_num, block->successors[1]);
487
35
    }
488
194
    block->successors_count = 1;
489
194
  }
490
896
}
491
492
static zend_always_inline void take_successor_1(zend_ssa *ssa, int block_num, zend_basic_block *block)
493
502
{
494
502
  if (block->successors_count == 2) {
495
138
    if (block->successors[1] != block->successors[0]) {
496
94
      zend_ssa_remove_predecessor(ssa, block_num, block->successors[0]);
497
94
      block->successors[0] = block->successors[1];
498
94
    }
499
138
    block->successors_count = 1;
500
138
  }
501
502
}
502
503
static zend_always_inline void take_successor_ex(zend_ssa *ssa, int block_num, zend_basic_block *block, int target_block)
504
20
{
505
20
  int i;
506
507
52
  for (i = 0; i < block->successors_count; i++) {
508
32
    if (block->successors[i] != target_block) {
509
12
      zend_ssa_remove_predecessor(ssa, block_num, block->successors[i]);
510
12
    }
511
32
  }
512
20
  block->successors[0] = target_block;
513
20
  block->successors_count = 1;
514
20
}
515
516
static void compress_block(zend_op_array *op_array, zend_basic_block *block)
517
282k
{
518
287k
  while (block->len > 0) {
519
285k
    zend_op *opline = &op_array->opcodes[block->start + block->len - 1];
520
521
285k
    if (opline->opcode == ZEND_NOP) {
522
4.32k
      block->len--;
523
281k
    } else {
524
281k
      break;
525
281k
    }
526
285k
  }
527
282k
}
528
529
883
static void replace_predecessor(zend_ssa *ssa, int block_id, int old_pred, int new_pred) {
530
883
  zend_basic_block *block = &ssa->cfg.blocks[block_id];
531
883
  int *predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
532
883
  zend_ssa_phi *phi;
533
534
883
  int i;
535
883
  int old_pred_idx = -1;
536
883
  int new_pred_idx = -1;
537
2.14k
  for (i = 0; i < block->predecessors_count; i++) {
538
1.26k
    if (predecessors[i] == old_pred) {
539
883
      old_pred_idx = i;
540
883
    }
541
1.26k
    if (predecessors[i] == new_pred) {
542
229
      new_pred_idx = i;
543
229
    }
544
1.26k
  }
545
546
883
  ZEND_ASSERT(old_pred_idx != -1);
547
883
  if (new_pred_idx == -1) {
548
    /* If the new predecessor doesn't exist yet, simply rewire the old one */
549
654
    predecessors[old_pred_idx] = new_pred;
550
654
  } else {
551
    /* Otherwise, rewiring the old predecessor would make the new predecessor appear
552
     * twice, which violates our CFG invariants. Remove the old predecessor instead. */
553
229
    memmove(
554
229
      predecessors + old_pred_idx,
555
229
      predecessors + old_pred_idx + 1,
556
229
      sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
557
229
    );
558
559
    /* Also remove the corresponding phi node entries */
560
269
    for (phi = ssa->blocks[block_id].phis; phi; phi = phi->next) {
561
40
      if (phi->pi >= 0) {
562
16
        if (phi->pi == old_pred || phi->pi == new_pred) {
563
16
          zend_ssa_rename_var_uses(
564
16
            ssa, phi->ssa_var, phi->sources[0], /* update_types */ 0);
565
16
          zend_ssa_remove_phi(ssa, phi);
566
16
        }
567
24
      } else {
568
24
        memmove(
569
24
          phi->sources + old_pred_idx,
570
24
          phi->sources + old_pred_idx + 1,
571
24
          sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
572
24
        );
573
24
      }
574
40
    }
575
576
229
    block->predecessors_count--;
577
229
  }
578
883
}
579
580
static void zend_ssa_replace_control_link(zend_op_array *op_array, zend_ssa *ssa, int from, int to, int new_to)
581
883
{
582
883
  zend_basic_block *src = &ssa->cfg.blocks[from];
583
883
  zend_basic_block *old = &ssa->cfg.blocks[to];
584
883
  zend_basic_block *dst = &ssa->cfg.blocks[new_to];
585
883
  int i;
586
883
  zend_op *opline;
587
588
2.18k
  for (i = 0; i < src->successors_count; i++) {
589
1.30k
    if (src->successors[i] == to) {
590
903
      src->successors[i] = new_to;
591
903
    }
592
1.30k
  }
593
594
883
  if (src->len > 0) {
595
703
    opline = op_array->opcodes + src->start + src->len - 1;
596
703
    switch (opline->opcode) {
597
0
      case ZEND_JMP:
598
0
      case ZEND_FAST_CALL:
599
0
        ZEND_ASSERT(ZEND_OP1_JMP_ADDR(opline) == op_array->opcodes + old->start);
600
0
        ZEND_SET_OP_JMP_ADDR(opline, opline->op1, op_array->opcodes + dst->start);
601
0
        break;
602
222
      case ZEND_JMPZ:
603
277
      case ZEND_JMPNZ:
604
279
      case ZEND_JMPZ_EX:
605
287
      case ZEND_JMPNZ_EX:
606
287
      case ZEND_FE_RESET_R:
607
287
      case ZEND_FE_RESET_RW:
608
358
      case ZEND_JMP_SET:
609
390
      case ZEND_COALESCE:
610
390
      case ZEND_ASSERT_CHECK:
611
390
      case ZEND_JMP_NULL:
612
390
      case ZEND_BIND_INIT_STATIC_OR_JMP:
613
390
      case ZEND_JMP_FRAMELESS:
614
390
        if (ZEND_OP2_JMP_ADDR(opline) == op_array->opcodes + old->start) {
615
148
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, op_array->opcodes + dst->start);
616
148
        }
617
390
        break;
618
0
      case ZEND_CATCH:
619
0
        if (!(opline->extended_value & ZEND_LAST_CATCH)) {
620
0
          if (ZEND_OP2_JMP_ADDR(opline) == op_array->opcodes + old->start) {
621
0
            ZEND_SET_OP_JMP_ADDR(opline, opline->op2, op_array->opcodes + dst->start);
622
0
          }
623
0
        }
624
0
        break;
625
4
      case ZEND_FE_FETCH_R:
626
4
      case ZEND_FE_FETCH_RW:
627
4
        if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) == old->start) {
628
0
          opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
629
0
        }
630
4
        break;
631
0
      case ZEND_SWITCH_LONG:
632
0
      case ZEND_SWITCH_STRING:
633
28
      case ZEND_MATCH:
634
28
        {
635
28
          HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
636
28
          zval *zv;
637
172
          ZEND_HASH_FOREACH_VAL(jumptable, zv) {
638
172
            if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv)) == old->start) {
639
30
              Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
640
30
            }
641
172
          } ZEND_HASH_FOREACH_END();
642
28
          if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) == old->start) {
643
10
            opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
644
10
          }
645
28
          break;
646
0
        }
647
703
    }
648
703
  }
649
650
883
  replace_predecessor(ssa, new_to, to, from);
651
883
}
652
653
static void zend_ssa_unlink_block(zend_op_array *op_array, zend_ssa *ssa, zend_basic_block *block, int block_num)
654
1.25k
{
655
1.25k
  if (block->predecessors_count == 1 && ssa->blocks[block_num].phis == NULL) {
656
883
    int *predecessors, i;
657
883
    zend_basic_block *fe_fetch_block = NULL;
658
659
883
    ZEND_ASSERT(block->successors_count == 1);
660
883
    predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
661
883
    if (block->predecessors_count == 1 && (block->flags & ZEND_BB_FOLLOW)) {
662
721
      zend_basic_block *pred_block = &ssa->cfg.blocks[predecessors[0]];
663
664
721
      if (pred_block->len > 0 && (pred_block->flags & ZEND_BB_REACHABLE)) {
665
547
        if ((op_array->opcodes[pred_block->start + pred_block->len - 1].opcode == ZEND_FE_FETCH_R
666
547
         || op_array->opcodes[pred_block->start + pred_block->len - 1].opcode == ZEND_FE_FETCH_RW)
667
547
          && op_array->opcodes[pred_block->start + pred_block->len - 1].op2_type == IS_CV) {
668
4
          fe_fetch_block = pred_block;
669
4
          }
670
547
      }
671
721
    }
672
1.76k
    for (i = 0; i < block->predecessors_count; i++) {
673
883
      zend_ssa_replace_control_link(op_array, ssa, predecessors[i], block_num, block->successors[0]);
674
883
    }
675
883
    zend_ssa_remove_block(op_array, ssa, block_num);
676
883
    if (fe_fetch_block && fe_fetch_block->successors[0] == fe_fetch_block->successors[1]) {
677
      /* The body of "foreach" loop was removed */
678
4
      int ssa_var = ssa->ops[fe_fetch_block->start + fe_fetch_block->len - 1].op2_def;
679
4
      if (ssa_var >= 0) {
680
4
        zend_ssa_remove_uses_of_var(ssa, ssa_var);
681
4
      }
682
4
    }
683
883
  }
684
1.25k
}
685
686
static int zend_dfa_optimize_jmps(zend_op_array *op_array, zend_ssa *ssa)
687
148k
{
688
148k
  int removed_ops = 0;
689
148k
  int block_num = 0;
690
691
433k
  for (block_num = 1; block_num < ssa->cfg.blocks_count; block_num++) {
692
285k
    zend_basic_block *block = &ssa->cfg.blocks[block_num];
693
694
285k
    if (!(block->flags & ZEND_BB_REACHABLE)) {
695
3.90k
      continue;
696
3.90k
    }
697
281k
    compress_block(op_array, block);
698
281k
    if (block->len == 0) {
699
614
      zend_ssa_unlink_block(op_array, ssa, block, block_num);
700
614
    }
701
281k
  }
702
703
148k
  block_num = 0;
704
148k
  while (block_num < ssa->cfg.blocks_count
705
148k
    && !(ssa->cfg.blocks[block_num].flags & ZEND_BB_REACHABLE)) {
706
0
    block_num++;
707
0
  }
708
578k
  while (block_num < ssa->cfg.blocks_count) {
709
429k
    int next_block_num = block_num + 1;
710
429k
    zend_basic_block *block = &ssa->cfg.blocks[block_num];
711
429k
    uint32_t op_num;
712
429k
    zend_op *opline;
713
429k
    zend_ssa_op *ssa_op;
714
429k
    bool can_follow = 1;
715
716
438k
    while (next_block_num < ssa->cfg.blocks_count
717
438k
      && !(ssa->cfg.blocks[next_block_num].flags & ZEND_BB_REACHABLE)) {
718
8.62k
      if (ssa->cfg.blocks[next_block_num].flags & ZEND_BB_UNREACHABLE_FREE) {
719
64
        can_follow = 0;
720
64
      }
721
8.62k
      next_block_num++;
722
8.62k
    }
723
724
429k
    if (block->len) {
725
428k
      op_num = block->start + block->len - 1;
726
428k
      opline = op_array->opcodes + op_num;
727
428k
      ssa_op = ssa->ops + op_num;
728
729
428k
      switch (opline->opcode) {
730
24.6k
        case ZEND_JMP:
731
25.3k
optimize_jmp:
732
25.3k
          if (block->successors[0] == next_block_num && can_follow) {
733
907
            MAKE_NOP(opline);
734
907
            removed_ops++;
735
907
            goto optimize_nop;
736
907
          }
737
24.4k
          break;
738
24.4k
        case ZEND_JMPZ:
739
10.9k
optimize_jmpz:
740
10.9k
          if (opline->op1_type == IS_CONST) {
741
169
            if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
742
96
              MAKE_NOP(opline);
743
96
              removed_ops++;
744
96
              take_successor_1(ssa, block_num, block);
745
96
              goto optimize_nop;
746
96
            } else {
747
73
              opline->opcode = ZEND_JMP;
748
73
              COPY_NODE(opline->op1, opline->op2);
749
73
              take_successor_0(ssa, block_num, block);
750
73
              goto optimize_jmp;
751
73
            }
752
10.7k
          } else {
753
10.7k
            if (block->successors[0] == next_block_num && can_follow) {
754
106
              take_successor_0(ssa, block_num, block);
755
106
              if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_UNDEF)) {
756
6
                opline->opcode = ZEND_CHECK_VAR;
757
6
                opline->op2.num = 0;
758
100
              } else if (opline->op1_type == IS_CV || !(OP1_INFO() & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
759
50
                zend_ssa_remove_instr(ssa, opline, ssa_op);
760
50
                removed_ops++;
761
50
                goto optimize_nop;
762
50
              } else {
763
50
                opline->opcode = ZEND_FREE;
764
50
                opline->op2.num = 0;
765
50
              }
766
106
            }
767
10.7k
          }
768
10.7k
          break;
769
14.2k
        case ZEND_JMPNZ:
770
15.2k
optimize_jmpnz:
771
15.2k
          if (opline->op1_type == IS_CONST) {
772
867
            if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
773
614
              opline->opcode = ZEND_JMP;
774
614
              COPY_NODE(opline->op1, opline->op2);
775
614
              take_successor_0(ssa, block_num, block);
776
614
              goto optimize_jmp;
777
614
            } else {
778
253
              MAKE_NOP(opline);
779
253
              removed_ops++;
780
253
              take_successor_1(ssa, block_num, block);
781
253
              goto optimize_nop;
782
253
            }
783
14.3k
          } else if (block->successors_count == 2) {
784
14.3k
            if (block->successors[0] == next_block_num && can_follow) {
785
53
              take_successor_0(ssa, block_num, block);
786
53
              if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_UNDEF)) {
787
0
                opline->opcode = ZEND_CHECK_VAR;
788
0
                opline->op2.num = 0;
789
53
              } else if (opline->op1_type == IS_CV || !(OP1_INFO() & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
790
53
                zend_ssa_remove_instr(ssa, opline, ssa_op);
791
53
                removed_ops++;
792
53
                goto optimize_nop;
793
53
              } else {
794
0
                opline->opcode = ZEND_FREE;
795
0
                opline->op2.num = 0;
796
0
              }
797
53
            }
798
14.3k
          }
799
14.3k
          break;
800
14.3k
        case ZEND_JMPZ_EX:
801
492
          if (ssa->vars[ssa_op->result_def].use_chain < 0
802
492
              && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
803
60
            opline->opcode = ZEND_JMPZ;
804
60
            opline->result_type = IS_UNUSED;
805
60
            zend_ssa_remove_result_def(ssa, ssa_op);
806
60
            goto optimize_jmpz;
807
432
          } else if (opline->op1_type == IS_CONST) {
808
2
            if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
809
0
              opline->opcode = ZEND_BOOL;
810
0
              take_successor_1(ssa, block_num, block);
811
0
            }
812
2
          }
813
432
          break;
814
558
        case ZEND_JMPNZ_EX:
815
558
          if (ssa->vars[ssa_op->result_def].use_chain < 0
816
558
              && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
817
48
            opline->opcode = ZEND_JMPNZ;
818
48
            opline->result_type = IS_UNUSED;
819
48
            zend_ssa_remove_result_def(ssa, ssa_op);
820
48
            goto optimize_jmpnz;
821
510
          } else if (opline->op1_type == IS_CONST) {
822
22
            if (!zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
823
0
              opline->opcode = ZEND_BOOL;
824
0
              take_successor_1(ssa, block_num, block);
825
0
            }
826
22
          }
827
510
          break;
828
1.84k
        case ZEND_JMP_SET:
829
1.84k
          if (ssa->vars[ssa_op->result_def].use_chain < 0
830
1.84k
              && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
831
935
            opline->opcode = ZEND_JMPNZ;
832
935
            opline->result_type = IS_UNUSED;
833
935
            zend_ssa_remove_result_def(ssa, ssa_op);
834
935
            goto optimize_jmpnz;
835
935
          } else if (opline->op1_type == IS_CONST) {
836
6
            if (!zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
837
6
              MAKE_NOP(opline);
838
6
              removed_ops++;
839
6
              take_successor_1(ssa, block_num, block);
840
6
              zend_ssa_remove_result_def(ssa, ssa_op);
841
6
              goto optimize_nop;
842
6
            }
843
6
          }
844
907
          break;
845
2.36k
        case ZEND_COALESCE:
846
2.36k
        {
847
2.36k
          zend_ssa_var *var = &ssa->vars[ssa_op->result_def];
848
2.36k
          if (opline->op1_type == IS_CONST
849
2.36k
              && var->use_chain < 0 && var->phi_use_chain == NULL) {
850
153
            if (Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op1.constant)) == IS_NULL) {
851
127
              zend_ssa_remove_result_def(ssa, ssa_op);
852
127
              MAKE_NOP(opline);
853
127
              removed_ops++;
854
127
              take_successor_1(ssa, block_num, block);
855
127
              goto optimize_nop;
856
127
            } else {
857
26
              opline->opcode = ZEND_JMP;
858
26
              opline->result_type = IS_UNUSED;
859
26
              zend_ssa_remove_result_def(ssa, ssa_op);
860
26
              COPY_NODE(opline->op1, opline->op2);
861
26
              take_successor_0(ssa, block_num, block);
862
26
              goto optimize_jmp;
863
26
            }
864
153
          }
865
2.20k
          break;
866
2.36k
        }
867
90.9k
        case ZEND_JMP_NULL:
868
90.9k
        {
869
90.9k
          zend_ssa_var *var = &ssa->vars[ssa_op->result_def];
870
90.9k
          if (opline->op1_type == IS_CONST
871
90.9k
              && var->use_chain < 0 && var->phi_use_chain == NULL) {
872
44
            if (Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op1.constant)) == IS_NULL) {
873
24
              opline->opcode = ZEND_JMP;
874
24
              opline->result_type = IS_UNUSED;
875
24
              zend_ssa_remove_result_def(ssa, ssa_op);
876
24
              COPY_NODE(opline->op1, opline->op2);
877
24
              take_successor_0(ssa, block_num, block);
878
24
              goto optimize_jmp;
879
24
            } else {
880
20
              zend_ssa_remove_result_def(ssa, ssa_op);
881
20
              MAKE_NOP(opline);
882
20
              removed_ops++;
883
20
              take_successor_1(ssa, block_num, block);
884
20
              goto optimize_nop;
885
20
            }
886
44
          }
887
90.9k
          break;
888
90.9k
        }
889
90.9k
        case ZEND_SWITCH_LONG:
890
96
        case ZEND_SWITCH_STRING:
891
442
        case ZEND_MATCH:
892
442
          if (opline->op1_type == IS_CONST) {
893
20
            zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
894
20
            uint8_t type = Z_TYPE_P(zv);
895
20
            bool correct_type =
896
20
              (opline->opcode == ZEND_SWITCH_LONG && type == IS_LONG)
897
20
              || (opline->opcode == ZEND_SWITCH_STRING && type == IS_STRING)
898
20
              || (opline->opcode == ZEND_MATCH && (type == IS_LONG || type == IS_STRING));
899
900
            /* Switch statements have a fallback chain for loose comparison. In those
901
             * cases the SWITCH_* instruction is a NOP. Match does strict comparison and
902
             * thus jumps to the default branch on mismatched types, so we need to
903
             * convert MATCH to a jmp. */
904
20
            if (!correct_type && opline->opcode != ZEND_MATCH) {
905
4
              removed_ops++;
906
4
              MAKE_NOP(opline);
907
4
              opline->extended_value = 0;
908
4
              take_successor_ex(ssa, block_num, block, block->successors[block->successors_count - 1]);
909
4
              goto optimize_nop;
910
4
            }
911
912
16
            uint32_t target;
913
16
            if (correct_type) {
914
12
              HashTable *jmptable = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant));
915
12
              zval *jmp_zv = type == IS_LONG
916
12
                ? zend_hash_index_find(jmptable, Z_LVAL_P(zv))
917
12
                : zend_hash_find(jmptable, Z_STR_P(zv));
918
919
12
              if (jmp_zv) {
920
10
                target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(jmp_zv));
921
10
              } else {
922
2
                target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value);
923
2
              }
924
12
            } else {
925
4
              ZEND_ASSERT(opline->opcode == ZEND_MATCH);
926
4
              target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value);
927
4
            }
928
16
            opline->opcode = ZEND_JMP;
929
16
            opline->extended_value = 0;
930
16
            SET_UNUSED(opline->op1);
931
16
            ZEND_SET_OP_JMP_ADDR(opline, opline->op1, op_array->opcodes + target);
932
16
            SET_UNUSED(opline->op2);
933
16
            take_successor_ex(ssa, block_num, block, ssa->cfg.map[target]);
934
16
            goto optimize_jmp;
935
16
          }
936
422
          break;
937
422
        case ZEND_NOP:
938
1.64k
optimize_nop:
939
1.64k
          compress_block(op_array, block);
940
1.64k
          if (block->len == 0) {
941
750
            if (block_num > 0) {
942
636
              zend_ssa_unlink_block(op_array, ssa, block, block_num);
943
              /* backtrack to previous basic block */
944
3.94k
              do {
945
3.94k
                block_num--;
946
3.94k
              } while (block_num >= 0
947
3.94k
                && !(ssa->cfg.blocks[block_num].flags & ZEND_BB_REACHABLE));
948
636
              if (block_num >= 0) {
949
636
                continue;
950
636
              }
951
636
            }
952
750
          }
953
1.01k
          break;
954
282k
        default:
955
282k
          break;
956
428k
      }
957
428k
    }
958
959
429k
    block_num = next_block_num;
960
429k
  }
961
962
148k
  return removed_ops;
963
148k
}
964
965
static bool zend_dfa_try_to_replace_result(zend_op_array *op_array, zend_ssa *ssa, int def, int cv_var)
966
12.1k
{
967
12.1k
  int result_var = ssa->ops[def].result_def;
968
12.1k
  uint32_t cv = EX_NUM_TO_VAR(ssa->vars[cv_var].var);
969
970
12.1k
  if (result_var >= 0
971
12.1k
   && !(ssa->var_info[cv_var].type & MAY_BE_REF)
972
12.1k
   && ssa->vars[cv_var].alias == NO_ALIAS
973
12.1k
   && ssa->vars[result_var].phi_use_chain == NULL
974
12.1k
   && ssa->vars[result_var].sym_use_chain == NULL) {
975
7.13k
    int use = ssa->vars[result_var].use_chain;
976
977
7.13k
    if (use >= 0
978
7.13k
     && zend_ssa_next_use(ssa->ops, result_var, use) < 0
979
7.13k
     && op_array->opcodes[use].opcode != ZEND_FREE
980
7.13k
     && op_array->opcodes[use].opcode != ZEND_SEND_VAL
981
7.13k
     && op_array->opcodes[use].opcode != ZEND_SEND_VAL_EX
982
7.13k
     && op_array->opcodes[use].opcode != ZEND_VERIFY_RETURN_TYPE
983
7.13k
     && op_array->opcodes[use].opcode != ZEND_YIELD) {
984
6.67k
      if (use > def) {
985
6.67k
        int i = use;
986
6.67k
        const zend_op *opline = &op_array->opcodes[use];
987
988
12.7k
        while (i > def) {
989
7.64k
          if ((opline->op1_type == IS_CV && opline->op1.var == cv)
990
7.64k
           || (opline->op2_type == IS_CV && opline->op2.var == cv)
991
7.64k
           || (opline->result_type == IS_CV && opline->result.var == cv)) {
992
1.55k
            return 0;
993
1.55k
          }
994
6.08k
          opline--;
995
6.08k
          i--;
996
6.08k
        }
997
998
        /* Update opcodes and reconstruct SSA */
999
5.11k
        ssa->vars[result_var].definition = -1;
1000
5.11k
        ssa->vars[result_var].use_chain = -1;
1001
5.11k
        ssa->ops[def].result_def = -1;
1002
1003
5.11k
        op_array->opcodes[def].result_type = IS_UNUSED;
1004
5.11k
        op_array->opcodes[def].result.var = 0;
1005
1006
5.11k
        if (ssa->ops[use].op1_use == result_var) {
1007
1.70k
          ssa->ops[use].op1_use = cv_var;
1008
1.70k
          ssa->ops[use].op1_use_chain = ssa->vars[cv_var].use_chain;
1009
1.70k
          ssa->vars[cv_var].use_chain = use;
1010
1011
1.70k
          op_array->opcodes[use].op1_type = IS_CV;
1012
1.70k
          op_array->opcodes[use].op1.var = cv;
1013
3.41k
        } else if (ssa->ops[use].op2_use == result_var) {
1014
3.41k
          ssa->ops[use].op2_use = cv_var;
1015
3.41k
          ssa->ops[use].op2_use_chain = ssa->vars[cv_var].use_chain;
1016
3.41k
          ssa->vars[cv_var].use_chain = use;
1017
1018
3.41k
          op_array->opcodes[use].op2_type = IS_CV;
1019
3.41k
          op_array->opcodes[use].op2.var = cv;
1020
3.41k
        } else if (ssa->ops[use].result_use == result_var) {
1021
0
          ssa->ops[use].result_use = cv_var;
1022
0
          ssa->ops[use].res_use_chain = ssa->vars[cv_var].use_chain;
1023
0
          ssa->vars[cv_var].use_chain = use;
1024
1025
0
          op_array->opcodes[use].result_type = IS_CV;
1026
0
          op_array->opcodes[use].result.var = cv;
1027
0
        }
1028
1029
5.11k
        return 1;
1030
6.67k
      }
1031
6.67k
    }
1032
7.13k
  }
1033
1034
5.48k
  return 0;
1035
12.1k
}
1036
1037
void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa, zend_call_info **call_map)
1038
74.1k
{
1039
74.1k
  if (ctx->debug_level & ZEND_DUMP_BEFORE_DFA_PASS) {
1040
0
    zend_dump_op_array(op_array, ZEND_DUMP_SSA, "before dfa pass", ssa);
1041
0
  }
1042
1043
74.1k
  if (ssa->var_info) {
1044
74.1k
    int op_1;
1045
74.1k
    int v;
1046
74.1k
    int remove_nops = 0;
1047
74.1k
    zend_op *opline;
1048
74.1k
    zend_ssa_op *ssa_op;
1049
74.1k
    zval tmp;
1050
1051
74.1k
#if ZEND_DEBUG_DFA
1052
74.1k
    ssa_verify_integrity(op_array, ssa, "before dfa");
1053
74.1k
#endif
1054
1055
74.1k
    if (ZEND_OPTIMIZER_PASS_8 & ctx->optimization_level) {
1056
74.1k
      if (sccp_optimize_op_array(ctx, op_array, ssa, call_map)) {
1057
1.38k
        remove_nops = 1;
1058
1.38k
      }
1059
1060
74.1k
      if (zend_dfa_optimize_jmps(op_array, ssa)) {
1061
417
        remove_nops = 1;
1062
417
      }
1063
1064
74.1k
#if ZEND_DEBUG_DFA
1065
74.1k
      ssa_verify_integrity(op_array, ssa, "after sccp");
1066
74.1k
#endif
1067
74.1k
      if (ZEND_FUNC_INFO(op_array)) {
1068
74.1k
        if (zend_dfa_optimize_calls(op_array, ssa)) {
1069
0
          remove_nops = 1;
1070
0
        }
1071
74.1k
      }
1072
74.1k
      if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_8) {
1073
0
        zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after sccp pass", ssa);
1074
0
      }
1075
74.1k
#if ZEND_DEBUG_DFA
1076
74.1k
      ssa_verify_integrity(op_array, ssa, "after calls");
1077
74.1k
#endif
1078
74.1k
    }
1079
1080
74.1k
    if (ZEND_OPTIMIZER_PASS_14 & ctx->optimization_level) {
1081
74.1k
      if (dce_optimize_op_array(op_array, ctx, ssa, 0)) {
1082
4.18k
        remove_nops = 1;
1083
4.18k
      }
1084
74.1k
      if (zend_dfa_optimize_jmps(op_array, ssa)) {
1085
147
        remove_nops = 1;
1086
147
      }
1087
74.1k
      if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_14) {
1088
0
        zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after dce pass", ssa);
1089
0
      }
1090
74.1k
#if ZEND_DEBUG_DFA
1091
74.1k
      ssa_verify_integrity(op_array, ssa, "after dce");
1092
74.1k
#endif
1093
74.1k
    }
1094
1095
1.09M
    for (v = op_array->last_var; v < ssa->vars_count; v++) {
1096
1097
1.02M
      op_1 = ssa->vars[v].definition;
1098
1099
1.02M
      if (op_1 < 0) {
1100
197k
        continue;
1101
197k
      }
1102
1103
825k
      opline = op_array->opcodes + op_1;
1104
825k
      ssa_op = &ssa->ops[op_1];
1105
1106
      /* Convert LONG constants to DOUBLE */
1107
825k
      if (ssa->var_info[v].use_as_double) {
1108
2
        if (opline->opcode == ZEND_ASSIGN
1109
2
         && opline->op2_type == IS_CONST
1110
2
         && ssa->ops[op_1].op1_def == v
1111
2
         && !RETURN_VALUE_USED(opline)
1112
2
        ) {
1113
1114
// op_1: ASSIGN ? -> #v [use_as_double], long(?) => ASSIGN ? -> #v, double(?)
1115
1116
2
          zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1117
2
          ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
1118
2
          ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1119
2
          opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
1120
1121
2
        } else if (opline->opcode == ZEND_QM_ASSIGN
1122
0
         && opline->op1_type == IS_CONST
1123
0
        ) {
1124
1125
// op_1: QM_ASSIGN #v [use_as_double], long(?) => QM_ASSIGN #v, double(?)
1126
1127
0
          zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1128
0
          ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
1129
0
          ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1130
0
          opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
1131
0
        }
1132
1133
825k
      } else {
1134
825k
        if (opline->opcode == ZEND_ADD
1135
825k
         || opline->opcode == ZEND_SUB
1136
825k
         || opline->opcode == ZEND_MUL
1137
825k
         || opline->opcode == ZEND_IS_EQUAL
1138
825k
         || opline->opcode == ZEND_IS_NOT_EQUAL
1139
825k
         || opline->opcode == ZEND_IS_SMALLER
1140
825k
         || opline->opcode == ZEND_IS_SMALLER_OR_EQUAL
1141
825k
        ) {
1142
1143
28.8k
          if (opline->op1_type == IS_CONST && opline->op2_type != IS_CONST) {
1144
2.49k
            zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1145
1146
2.49k
            if ((OP2_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
1147
2.49k
             && Z_TYPE_INFO_P(zv) == IS_LONG) {
1148
1149
// op_1: #v.? = ADD long(?), #?.? [double] => #v.? = ADD double(?), #?.? [double]
1150
1151
4
              ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1152
4
              opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
1153
4
              zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1154
4
            }
1155
2.49k
            if (opline->opcode == ZEND_ADD) {
1156
287
              zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1157
1158
287
              if (((OP2_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG
1159
287
                && Z_TYPE_INFO_P(zv) == IS_LONG
1160
287
                && Z_LVAL_P(zv) == 0)
1161
287
               || ((OP2_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_DOUBLE
1162
284
                && Z_TYPE_INFO_P(zv) == IS_DOUBLE
1163
284
                && Z_DVAL_P(zv) == 0.0)) {
1164
1165
// op_1: #v.? = ADD 0, #?.? [double,long] => #v.? = QM_ASSIGN #?.?
1166
1167
3
                opline->opcode = ZEND_QM_ASSIGN;
1168
3
                opline->op1_type = opline->op2_type;
1169
3
                opline->op1.var = opline->op2.var;
1170
3
                opline->op2_type = IS_UNUSED;
1171
3
                opline->op2.num = 0;
1172
3
                ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1173
3
                ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1174
3
                ssa->ops[op_1].op2_use = -1;
1175
3
                ssa->ops[op_1].op2_use_chain = -1;
1176
3
              }
1177
2.20k
            } else if (opline->opcode == ZEND_MUL
1178
2.20k
             && (OP2_INFO() & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1179
0
              zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1180
1181
0
              if ((Z_TYPE_INFO_P(zv) == IS_LONG
1182
0
                && Z_LVAL_P(zv) == 2)
1183
0
               || (Z_TYPE_INFO_P(zv) == IS_DOUBLE
1184
0
                && Z_DVAL_P(zv) == 2.0
1185
0
                && !(OP2_INFO() & MAY_BE_LONG))) {
1186
1187
// op_1: #v.? = MUL 2, #x.? [double,long] => #v.? = ADD #x.?, #x.?
1188
1189
0
                opline->opcode = ZEND_ADD;
1190
0
                opline->op1_type = opline->op2_type;
1191
0
                opline->op1.var = opline->op2.var;
1192
0
                ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1193
0
                ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1194
0
              }
1195
0
            }
1196
26.3k
          } else if (opline->op1_type != IS_CONST && opline->op2_type == IS_CONST) {
1197
9.32k
            zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1198
1199
9.32k
            if ((OP1_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
1200
9.32k
             && Z_TYPE_INFO_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG) {
1201
1202
// op_1: #v.? = ADD #?.? [double], long(?) => #v.? = ADD #?.? [double], double(?)
1203
1204
133
              ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1205
133
              opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
1206
133
              zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1207
133
            }
1208
9.32k
            if (opline->opcode == ZEND_ADD || opline->opcode == ZEND_SUB) {
1209
1.74k
              if (((OP1_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG
1210
1.74k
                && Z_TYPE_INFO_P(zv) == IS_LONG
1211
1.74k
                && Z_LVAL_P(zv) == 0)
1212
1.74k
               || ((OP1_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_DOUBLE
1213
1.73k
                && Z_TYPE_INFO_P(zv) == IS_DOUBLE
1214
1.73k
                && Z_DVAL_P(zv) == 0.0)) {
1215
1216
// op_1: #v.? = ADD #?.? [double,long], 0 => #v.? = QM_ASSIGN #?.?
1217
1218
10
                opline->opcode = ZEND_QM_ASSIGN;
1219
10
                opline->op2_type = IS_UNUSED;
1220
10
                opline->op2.num = 0;
1221
10
              }
1222
7.57k
            } else if (opline->opcode == ZEND_MUL
1223
7.57k
             && (OP1_INFO() & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1224
846
              zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1225
1226
846
              if ((Z_TYPE_INFO_P(zv) == IS_LONG
1227
846
                && Z_LVAL_P(zv) == 2)
1228
846
               || (Z_TYPE_INFO_P(zv) == IS_DOUBLE
1229
784
                && Z_DVAL_P(zv) == 2.0
1230
784
                && !(OP1_INFO() & MAY_BE_LONG))) {
1231
1232
// op_1: #v.? = MUL #x.? [double,long], 2 => #v.? = ADD #x.?, #x.?
1233
1234
66
                opline->opcode = ZEND_ADD;
1235
66
                opline->op2_type = opline->op1_type;
1236
66
                opline->op2.var = opline->op1.var;
1237
66
                ssa->ops[op_1].op2_use = ssa->ops[op_1].op1_use;
1238
66
                ssa->ops[op_1].op2_use_chain = ssa->ops[op_1].op1_use_chain;
1239
66
              }
1240
846
            }
1241
9.32k
          }
1242
796k
        } else if (opline->opcode == ZEND_CONCAT) {
1243
7.66k
          if (!(OP1_INFO() & MAY_BE_OBJECT)
1244
7.66k
           && !(OP2_INFO() & MAY_BE_OBJECT)) {
1245
2.91k
            opline->opcode = ZEND_FAST_CONCAT;
1246
2.91k
          }
1247
788k
        } else if (opline->opcode == ZEND_VERIFY_RETURN_TYPE
1248
788k
         && opline->op1_type != IS_CONST
1249
788k
         && ssa->ops[op_1].op1_def == v
1250
788k
         && ssa->ops[op_1].op1_use >= 0) {
1251
1.59k
          int orig_var = ssa->ops[op_1].op1_use;
1252
1.59k
          int ret = ssa->vars[v].use_chain;
1253
1254
1.59k
          if (ssa->ops[op_1].op1_use_chain == -1
1255
1.59k
           && can_elide_return_type_check(ctx->script, op_array, ssa, &ssa->ops[op_1])) {
1256
1257
// op_1: VERIFY_RETURN_TYPE #orig_var.? [T] -> #v.? [T] => NOP
1258
1259
726
            zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1260
1261
726
            if (ret >= 0) {
1262
726
              ssa->ops[ret].op1_use = orig_var;
1263
726
              ssa->ops[ret].op1_use_chain = ssa->vars[orig_var].use_chain;
1264
726
              ssa->vars[orig_var].use_chain = ret;
1265
726
            }
1266
1267
726
            ssa->vars[v].definition = -1;
1268
726
            ssa->vars[v].use_chain = -1;
1269
1270
726
            ssa->ops[op_1].op1_def = -1;
1271
726
            ssa->ops[op_1].op1_use = -1;
1272
1273
726
            MAKE_NOP(opline);
1274
726
            remove_nops = 1;
1275
868
          } else if (ret >= 0
1276
868
           && ssa->ops[ret].op1_use == v
1277
868
           && ssa->ops[ret].op1_use_chain == -1
1278
868
           && can_elide_return_type_check(ctx->script, op_array, ssa, &ssa->ops[op_1])) {
1279
1280
// op_1: VERIFY_RETURN_TYPE #orig_var.? [T] -> #v.? [T] => NOP
1281
1282
16
            zend_ssa_replace_use_chain(ssa, op_1, ret, orig_var);
1283
1284
16
            ssa->ops[ret].op1_use = orig_var;
1285
16
            ssa->ops[ret].op1_use_chain = ssa->ops[op_1].op1_use_chain;
1286
1287
16
            ssa->vars[v].definition = -1;
1288
16
            ssa->vars[v].use_chain = -1;
1289
1290
16
            ssa->ops[op_1].op1_def = -1;
1291
16
            ssa->ops[op_1].op1_use = -1;
1292
1293
16
            MAKE_NOP(opline);
1294
16
            remove_nops = 1;
1295
16
          }
1296
1.59k
        }
1297
825k
      }
1298
1299
825k
      if (opline->opcode == ZEND_QM_ASSIGN
1300
825k
       && ssa->ops[op_1].result_def == v
1301
825k
       && opline->op1_type & (IS_TMP_VAR|IS_VAR)
1302
825k
       && !(ssa->var_info[v].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1303
825k
      ) {
1304
1305
61
        int src_var = ssa->ops[op_1].op1_use;
1306
1307
61
        if (src_var >= 0
1308
61
         && !(ssa->var_info[src_var].type & MAY_BE_REF)
1309
61
         && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
1310
61
         && ssa->vars[src_var].definition >= 0
1311
61
         && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
1312
61
         && ssa->ops[ssa->vars[src_var].definition].result_use < 0
1313
61
         && ssa->vars[src_var].use_chain == op_1
1314
61
         && ssa->ops[op_1].op1_use_chain < 0
1315
61
         && !ssa->vars[src_var].phi_use_chain
1316
61
         && !ssa->vars[src_var].sym_use_chain
1317
61
         && opline_supports_assign_contraction(
1318
41
           op_array, ssa, &op_array->opcodes[ssa->vars[src_var].definition],
1319
41
           src_var, opline->result.var)
1320
61
         && !variable_defined_or_used_in_range(ssa, EX_VAR_TO_NUM(opline->result.var),
1321
41
            ssa->vars[src_var].definition+1, op_1)
1322
61
        ) {
1323
1324
41
          int orig_var = ssa->ops[op_1].result_use;
1325
41
          int op_2 = ssa->vars[src_var].definition;
1326
1327
// op_2: #src_var.T = OP ...                                        => #v.CV = OP ...
1328
// op_1: QM_ASSIGN #src_var.T #orig_var.CV [undef,scalar] -> #v.CV,    NOP
1329
1330
41
          if (orig_var >= 0) {
1331
0
            zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1332
0
          }
1333
1334
          /* Reconstruct SSA */
1335
41
          ssa->vars[v].definition = op_2;
1336
41
          ssa->ops[op_2].result_def = v;
1337
1338
41
          ssa->vars[src_var].definition = -1;
1339
41
          ssa->vars[src_var].use_chain = -1;
1340
1341
41
          ssa->ops[op_1].op1_use = -1;
1342
41
          ssa->ops[op_1].op1_def = -1;
1343
41
          ssa->ops[op_1].op1_use_chain = -1;
1344
41
          ssa->ops[op_1].result_use = -1;
1345
41
          ssa->ops[op_1].result_def = -1;
1346
41
          ssa->ops[op_1].res_use_chain = -1;
1347
1348
          /* Update opcodes */
1349
41
          op_array->opcodes[op_2].result_type = opline->result_type;
1350
41
          op_array->opcodes[op_2].result.var = opline->result.var;
1351
1352
41
          MAKE_NOP(opline);
1353
41
          remove_nops = 1;
1354
1355
41
          if (op_array->opcodes[op_2].opcode == ZEND_SUB
1356
41
           && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1357
41
           && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1358
41
           && op_array->opcodes[op_2].op2_type == IS_CONST
1359
41
           && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1360
41
           && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1361
41
           && ssa->ops[op_2].op1_use >= 0
1362
41
           && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1363
1364
0
            op_array->opcodes[op_2].opcode = ZEND_PRE_DEC;
1365
0
            SET_UNUSED(op_array->opcodes[op_2].op2);
1366
0
            SET_UNUSED(op_array->opcodes[op_2].result);
1367
1368
0
            ssa->ops[op_2].result_def = -1;
1369
0
            ssa->ops[op_2].op1_def = v;
1370
1371
41
          } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1372
41
           && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1373
41
           && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1374
41
           && op_array->opcodes[op_2].op2_type == IS_CONST
1375
41
           && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1376
41
           && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1377
41
           && ssa->ops[op_2].op1_use >= 0
1378
41
           && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1379
1380
0
            op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1381
0
            SET_UNUSED(op_array->opcodes[op_2].op2);
1382
0
            SET_UNUSED(op_array->opcodes[op_2].result);
1383
1384
0
            ssa->ops[op_2].result_def = -1;
1385
0
            ssa->ops[op_2].op1_def = v;
1386
1387
41
          } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1388
41
           && op_array->opcodes[op_2].op2_type == op_array->opcodes[op_2].result_type
1389
41
           && op_array->opcodes[op_2].op2.var == op_array->opcodes[op_2].result.var
1390
41
           && op_array->opcodes[op_2].op1_type == IS_CONST
1391
41
           && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == IS_LONG
1392
41
           && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == 1
1393
41
           && ssa->ops[op_2].op2_use >= 0
1394
41
           && !(ssa->var_info[ssa->ops[op_2].op2_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1395
1396
0
            op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1397
0
            op_array->opcodes[op_2].op1_type = op_array->opcodes[op_2].op2_type;
1398
0
            op_array->opcodes[op_2].op1.var = op_array->opcodes[op_2].op2.var;
1399
0
            SET_UNUSED(op_array->opcodes[op_2].op2);
1400
0
            SET_UNUSED(op_array->opcodes[op_2].result);
1401
1402
0
            ssa->ops[op_2].result_def = -1;
1403
0
            ssa->ops[op_2].op1_def = v;
1404
0
            ssa->ops[op_2].op1_use = ssa->ops[op_2].op2_use;
1405
0
            ssa->ops[op_2].op1_use_chain = ssa->ops[op_2].op2_use_chain;
1406
0
            ssa->ops[op_2].op2_use = -1;
1407
0
            ssa->ops[op_2].op2_use_chain = -1;
1408
0
          }
1409
41
        }
1410
61
      }
1411
1412
825k
      if (ssa->vars[v].var >= op_array->last_var) {
1413
        /* skip TMP and VAR */
1414
700k
        continue;
1415
700k
      }
1416
1417
125k
      if (ssa->ops[op_1].op1_def == v
1418
125k
       && RETURN_VALUE_USED(opline)) {
1419
20.8k
        if (opline->opcode == ZEND_ASSIGN
1420
20.8k
         || opline->opcode == ZEND_ASSIGN_OP
1421
20.8k
         || opline->opcode == ZEND_PRE_INC
1422
20.8k
         || opline->opcode == ZEND_PRE_DEC) {
1423
12.1k
          zend_dfa_try_to_replace_result(op_array, ssa, op_1, v);
1424
12.1k
        } else if (opline->opcode == ZEND_POST_INC) {
1425
724
          int result_var = ssa->ops[op_1].result_def;
1426
1427
724
          if (result_var >= 0
1428
724
           && (ssa->var_info[result_var].type & ((MAY_BE_ANY|MAY_BE_REF|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1429
422
            int use = ssa->vars[result_var].use_chain;
1430
1431
422
            if (use >= 0 && op_array->opcodes[use].opcode == ZEND_IS_SMALLER
1432
422
             && ssa->ops[use].op1_use == result_var
1433
422
             && zend_dfa_try_to_replace_result(op_array, ssa, op_1, v)) {
1434
0
              opline->opcode = ZEND_PRE_INC;
1435
0
              op_array->opcodes[use].opcode = ZEND_IS_SMALLER_OR_EQUAL;
1436
0
            }
1437
422
          }
1438
7.98k
        } else if (opline->opcode == ZEND_POST_DEC) {
1439
1.18k
          int result_var = ssa->ops[op_1].result_def;
1440
1441
1.18k
          if (result_var >= 0
1442
1.18k
           && (ssa->var_info[result_var].type & ((MAY_BE_ANY|MAY_BE_REF|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1443
311
            int use = ssa->vars[result_var].use_chain;
1444
1445
311
            if (use >= 0 && op_array->opcodes[use].opcode == ZEND_IS_SMALLER
1446
311
             && ssa->ops[use].op2_use == result_var
1447
311
             && zend_dfa_try_to_replace_result(op_array, ssa, op_1, v)) {
1448
1
              opline->opcode = ZEND_PRE_DEC;
1449
1
              op_array->opcodes[use].opcode = ZEND_IS_SMALLER_OR_EQUAL;
1450
1
            }
1451
311
          }
1452
1.18k
        }
1453
20.8k
      }
1454
1455
125k
      if (opline->opcode == ZEND_ASSIGN
1456
125k
       && ssa->ops[op_1].op1_def == v
1457
125k
       && !RETURN_VALUE_USED(opline)
1458
125k
      ) {
1459
47.0k
        int orig_var = ssa->ops[op_1].op1_use;
1460
1461
47.0k
        if (orig_var >= 0
1462
47.0k
         && !(ssa->var_info[orig_var].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1463
47.0k
        ) {
1464
9.53k
          int src_var = ssa->ops[op_1].op2_use;
1465
1466
9.53k
          if ((opline->op2_type & (IS_TMP_VAR|IS_VAR))
1467
9.53k
           && src_var >= 0
1468
9.53k
           && !(ssa->var_info[src_var].type & MAY_BE_REF)
1469
9.53k
           && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
1470
9.53k
           && ssa->vars[src_var].definition >= 0
1471
9.53k
           && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
1472
9.53k
           && ssa->ops[ssa->vars[src_var].definition].result_use < 0
1473
9.53k
           && ssa->vars[src_var].use_chain == op_1
1474
9.53k
           && ssa->ops[op_1].op2_use_chain < 0
1475
9.53k
           && !ssa->vars[src_var].phi_use_chain
1476
9.53k
           && !ssa->vars[src_var].sym_use_chain
1477
9.53k
           && opline_supports_assign_contraction(
1478
4.83k
             op_array, ssa, &op_array->opcodes[ssa->vars[src_var].definition],
1479
4.83k
             src_var, opline->op1.var)
1480
9.53k
           && !variable_defined_or_used_in_range(ssa, EX_VAR_TO_NUM(opline->op1.var),
1481
3.37k
              ssa->vars[src_var].definition+1, op_1)
1482
9.53k
          ) {
1483
1484
3.37k
            int op_2 = ssa->vars[src_var].definition;
1485
1486
// op_2: #src_var.T = OP ...                                     => #v.CV = OP ...
1487
// op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, #src_var.T    NOP
1488
1489
3.37k
            zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1490
            /* Reconstruct SSA */
1491
3.37k
            ssa->vars[v].definition = op_2;
1492
3.37k
            ssa->ops[op_2].result_def = v;
1493
1494
3.37k
            ssa->vars[src_var].definition = -1;
1495
3.37k
            ssa->vars[src_var].use_chain = -1;
1496
1497
3.37k
            ssa->ops[op_1].op1_use = -1;
1498
3.37k
            ssa->ops[op_1].op2_use = -1;
1499
3.37k
            ssa->ops[op_1].op1_def = -1;
1500
3.37k
            ssa->ops[op_1].op1_use_chain = -1;
1501
1502
            /* Update opcodes */
1503
3.37k
            op_array->opcodes[op_2].result_type = opline->op1_type;
1504
3.37k
            op_array->opcodes[op_2].result.var = opline->op1.var;
1505
1506
3.37k
            MAKE_NOP(opline);
1507
3.37k
            remove_nops = 1;
1508
1509
3.37k
            if (op_array->opcodes[op_2].opcode == ZEND_SUB
1510
3.37k
             && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1511
3.37k
             && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1512
3.37k
             && op_array->opcodes[op_2].op2_type == IS_CONST
1513
3.37k
             && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1514
3.37k
             && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1515
3.37k
             && ssa->ops[op_2].op1_use >= 0
1516
3.37k
             && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1517
1518
0
              op_array->opcodes[op_2].opcode = ZEND_PRE_DEC;
1519
0
              SET_UNUSED(op_array->opcodes[op_2].op2);
1520
0
              SET_UNUSED(op_array->opcodes[op_2].result);
1521
1522
0
              ssa->ops[op_2].result_def = -1;
1523
0
              ssa->ops[op_2].op1_def = v;
1524
1525
3.37k
            } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1526
3.37k
             && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1527
3.37k
             && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1528
3.37k
             && op_array->opcodes[op_2].op2_type == IS_CONST
1529
3.37k
             && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1530
3.37k
             && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1531
3.37k
             && ssa->ops[op_2].op1_use >= 0
1532
3.37k
             && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1533
1534
0
              op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1535
0
              SET_UNUSED(op_array->opcodes[op_2].op2);
1536
0
              SET_UNUSED(op_array->opcodes[op_2].result);
1537
1538
0
              ssa->ops[op_2].result_def = -1;
1539
0
              ssa->ops[op_2].op1_def = v;
1540
1541
3.37k
            } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1542
3.37k
             && op_array->opcodes[op_2].op2_type == op_array->opcodes[op_2].result_type
1543
3.37k
             && op_array->opcodes[op_2].op2.var == op_array->opcodes[op_2].result.var
1544
3.37k
             && op_array->opcodes[op_2].op1_type == IS_CONST
1545
3.37k
             && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == IS_LONG
1546
3.37k
             && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == 1
1547
3.37k
             && ssa->ops[op_2].op2_use >= 0
1548
3.37k
             && !(ssa->var_info[ssa->ops[op_2].op2_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1549
1550
0
              op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1551
0
              op_array->opcodes[op_2].op1_type = op_array->opcodes[op_2].op2_type;
1552
0
              op_array->opcodes[op_2].op1.var = op_array->opcodes[op_2].op2.var;
1553
0
              SET_UNUSED(op_array->opcodes[op_2].op2);
1554
0
              SET_UNUSED(op_array->opcodes[op_2].result);
1555
1556
0
              ssa->ops[op_2].result_def = -1;
1557
0
              ssa->ops[op_2].op1_def = v;
1558
0
              ssa->ops[op_2].op1_use = ssa->ops[op_2].op2_use;
1559
0
              ssa->ops[op_2].op1_use_chain = ssa->ops[op_2].op2_use_chain;
1560
0
              ssa->ops[op_2].op2_use = -1;
1561
0
              ssa->ops[op_2].op2_use_chain = -1;
1562
0
            }
1563
6.15k
          } else if (opline->op2_type == IS_CONST
1564
6.15k
           || ((opline->op2_type & (IS_TMP_VAR|IS_VAR|IS_CV))
1565
3.33k
               && ssa->ops[op_1].op2_use >= 0
1566
3.33k
               && ssa->ops[op_1].op2_def < 0)
1567
6.15k
          ) {
1568
1569
// op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, CONST|TMPVAR => QM_ASSIGN v.CV, CONST|TMPVAR
1570
1571
6.15k
            if (ssa->ops[op_1].op1_use != ssa->ops[op_1].op2_use) {
1572
5.90k
              zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1573
5.90k
            } else {
1574
253
              ssa->ops[op_1].op2_use_chain = ssa->ops[op_1].op1_use_chain;
1575
253
            }
1576
1577
            /* Reconstruct SSA */
1578
6.15k
            ssa->ops[op_1].result_def = v;
1579
6.15k
            ssa->ops[op_1].op1_def = -1;
1580
6.15k
            ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1581
6.15k
            ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1582
6.15k
            ssa->ops[op_1].op2_use = -1;
1583
6.15k
            ssa->ops[op_1].op2_use_chain = -1;
1584
1585
            /* Update opcode */
1586
6.15k
            opline->result_type = opline->op1_type;
1587
6.15k
            opline->result.var = opline->op1.var;
1588
6.15k
            opline->op1_type = opline->op2_type;
1589
6.15k
            opline->op1.var = opline->op2.var;
1590
6.15k
            opline->op2_type = IS_UNUSED;
1591
6.15k
            opline->op2.var = 0;
1592
6.15k
            opline->opcode = ZEND_QM_ASSIGN;
1593
6.15k
          }
1594
9.53k
        }
1595
1596
78.2k
      } else if (opline->opcode == ZEND_ASSIGN_OP
1597
78.2k
       && opline->extended_value == ZEND_ADD
1598
78.2k
       && ssa->ops[op_1].op1_def == v
1599
78.2k
       && opline->op2_type == IS_CONST
1600
78.2k
       && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
1601
78.2k
       && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
1602
78.2k
       && ssa->ops[op_1].op1_use >= 0
1603
78.2k
       && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1604
1605
// op_1: ASSIGN_ADD #?.CV [undef,null,int,foat] ->#v.CV, int(1) => PRE_INC #?.CV ->#v.CV
1606
1607
12
        opline->opcode = ZEND_PRE_INC;
1608
12
        opline->extended_value = 0;
1609
12
        SET_UNUSED(opline->op2);
1610
1611
78.2k
      } else if (opline->opcode == ZEND_ASSIGN_OP
1612
78.2k
       && opline->extended_value == ZEND_SUB
1613
78.2k
       && ssa->ops[op_1].op1_def == v
1614
78.2k
       && opline->op2_type == IS_CONST
1615
78.2k
       && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
1616
78.2k
       && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
1617
78.2k
       && ssa->ops[op_1].op1_use >= 0
1618
78.2k
       && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1619
1620
// op_1: ASSIGN_SUB #?.CV [undef,null,int,foat] -> #v.CV, int(1) => PRE_DEC #?.CV ->#v.CV
1621
1622
0
        opline->opcode = ZEND_PRE_DEC;
1623
0
        opline->extended_value = 0;
1624
0
        SET_UNUSED(opline->op2);
1625
1626
78.2k
      } else if (ssa->ops[op_1].op1_def == v
1627
78.2k
       && !RETURN_VALUE_USED(opline)
1628
78.2k
       && ssa->ops[op_1].op1_use >= 0
1629
78.2k
       && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1630
78.2k
       && opline->opcode == ZEND_ASSIGN_OP
1631
78.2k
       && opline->extended_value != ZEND_CONCAT) {
1632
1633
// op_1: ASSIGN_OP #orig_var.CV [undef,null,bool,int,double] -> #v.CV, ? => #v.CV = ADD #orig_var.CV, ?
1634
1635
        /* Reconstruct SSA */
1636
1.36k
        ssa->ops[op_1].result_def = ssa->ops[op_1].op1_def;
1637
1.36k
        ssa->ops[op_1].op1_def = -1;
1638
1639
        /* Update opcode */
1640
1.36k
        opline->opcode = opline->extended_value;
1641
1.36k
        opline->extended_value = 0;
1642
1.36k
        opline->result_type = opline->op1_type;
1643
1.36k
        opline->result.var = opline->op1.var;
1644
1645
1.36k
      }
1646
125k
    }
1647
1648
74.1k
#if ZEND_DEBUG_DFA
1649
74.1k
    ssa_verify_integrity(op_array, ssa, "after dfa");
1650
74.1k
#endif
1651
1652
74.1k
    if (remove_nops) {
1653
6.23k
      zend_ssa_remove_nops(op_array, ssa, ctx);
1654
6.23k
#if ZEND_DEBUG_DFA
1655
6.23k
      ssa_verify_integrity(op_array, ssa, "after nop");
1656
6.23k
#endif
1657
6.23k
    }
1658
74.1k
  }
1659
1660
74.1k
  if (ctx->debug_level & ZEND_DUMP_AFTER_DFA_PASS) {
1661
0
    zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after dfa pass", ssa);
1662
0
  }
1663
74.1k
}
1664
1665
void zend_optimize_dfa(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1666
0
{
1667
0
  void *checkpoint = zend_arena_checkpoint(ctx->arena);
1668
0
  zend_ssa ssa;
1669
1670
0
  if (zend_dfa_analyze_op_array(op_array, ctx, &ssa) == FAILURE) {
1671
0
    zend_arena_release(&ctx->arena, checkpoint);
1672
0
    return;
1673
0
  }
1674
1675
0
  zend_dfa_optimize_op_array(op_array, ctx, &ssa, NULL);
1676
1677
  /* Destroy SSA */
1678
0
  zend_arena_release(&ctx->arena, checkpoint);
1679
0
}