Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/Optimizer/optimize_func_calls.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Dmitry Stogov <dmitry@php.net>                              |
16
   |          Xinchen Hui <laruence@php.net>                              |
17
   +----------------------------------------------------------------------+
18
*/
19
20
/* pass 4
21
 * - optimize INIT_FCALL_BY_NAME to DO_FCALL
22
 */
23
24
#include "Optimizer/zend_optimizer.h"
25
#include "Optimizer/zend_optimizer_internal.h"
26
#include "zend_API.h"
27
#include "zend_constants.h"
28
#include "zend_execute.h"
29
#include "zend_vm.h"
30
31
typedef struct _optimizer_call_info {
32
  zend_function *func;
33
  zend_op       *opline;
34
  zend_op       *last_check_func_arg_opline;
35
  bool      is_prototype;
36
  bool      try_inline;
37
  uint32_t       func_arg_num;
38
} optimizer_call_info;
39
40
static void zend_delete_call_instructions(zend_op_array *op_array, zend_op *opline)
41
478
{
42
478
  int call = 0;
43
44
1.07k
  while (1) {
45
1.07k
    switch (opline->opcode) {
46
10
      case ZEND_INIT_FCALL_BY_NAME:
47
10
      case ZEND_INIT_NS_FCALL_BY_NAME:
48
56
      case ZEND_INIT_STATIC_METHOD_CALL:
49
56
      case ZEND_INIT_METHOD_CALL:
50
524
      case ZEND_INIT_FCALL:
51
524
      case ZEND_INIT_PARENT_PROPERTY_HOOK_CALL:
52
524
        if (call == 0) {
53
478
          MAKE_NOP(opline);
54
478
          return;
55
478
        }
56
46
        ZEND_FALLTHROUGH;
57
54
      case ZEND_NEW:
58
54
      case ZEND_INIT_DYNAMIC_CALL:
59
54
      case ZEND_INIT_USER_CALL:
60
54
        call--;
61
54
        break;
62
40
      case ZEND_DO_FCALL:
63
40
      case ZEND_DO_ICALL:
64
54
      case ZEND_DO_UCALL:
65
54
      case ZEND_DO_FCALL_BY_NAME:
66
54
        call++;
67
54
        break;
68
42
      case ZEND_SEND_VAL:
69
190
      case ZEND_SEND_VAR:
70
190
        if (call == 0) {
71
190
          zend_optimizer_convert_to_free_op1(op_array, opline);
72
190
        }
73
190
        break;
74
1.07k
    }
75
592
    opline--;
76
592
  }
77
478
}
78
79
static void zend_try_inline_call(zend_op_array *op_array, zend_op *fcall, zend_op *opline, zend_function *func)
80
112k
{
81
112k
  const uint32_t no_discard = RETURN_VALUE_USED(opline) ? 0 : ZEND_ACC_NODISCARD;
82
83
112k
  if (func->type == ZEND_USER_FUNCTION
84
112k
   && !(func->op_array.fn_flags & (ZEND_ACC_ABSTRACT|ZEND_ACC_HAS_TYPE_HINTS|ZEND_ACC_DEPRECATED|no_discard))
85
    /* TODO: function copied from trait may be inconsistent ??? */
86
112k
   && !(func->op_array.fn_flags & (ZEND_ACC_TRAIT_CLONE))
87
112k
   && fcall->extended_value >= func->op_array.required_num_args
88
112k
   && func->op_array.opcodes[func->op_array.num_args].opcode == ZEND_RETURN) {
89
90
1.03k
    zend_op *ret_opline = func->op_array.opcodes + func->op_array.num_args;
91
92
1.03k
    if (ret_opline->op1_type == IS_CONST) {
93
560
      uint32_t i, num_args = func->op_array.num_args;
94
560
      num_args += (func->op_array.fn_flags & ZEND_ACC_VARIADIC) != 0;
95
96
560
      if (fcall->opcode == ZEND_INIT_STATIC_METHOD_CALL
97
560
          && !(func->op_array.fn_flags & ZEND_ACC_STATIC)) {
98
        /* Don't inline static call to instance method. */
99
0
        return;
100
0
      }
101
102
710
      for (i = 0; i < num_args; i++) {
103
        /* Don't inline functions with by-reference arguments. This would require
104
         * correct handling of INDIRECT arguments. */
105
180
        if (ZEND_ARG_SEND_MODE(&func->op_array.arg_info[i])) {
106
30
          return;
107
30
        }
108
180
      }
109
110
530
      if (fcall->extended_value < func->op_array.num_args) {
111
        /* don't inline functions with named constants in default arguments */
112
54
        i = fcall->extended_value;
113
114
58
        do {
115
58
          if (Z_TYPE_P(CRT_CONSTANT_EX(&func->op_array, &func->op_array.opcodes[i], func->op_array.opcodes[i].op2)) == IS_CONSTANT_AST) {
116
52
            return;
117
52
          }
118
6
          i++;
119
6
        } while (i < func->op_array.num_args);
120
54
      }
121
122
478
      if (RETURN_VALUE_USED(opline)) {
123
356
        zval zv;
124
125
356
        ZVAL_COPY(&zv, CRT_CONSTANT_EX(&func->op_array, ret_opline, ret_opline->op1));
126
356
        opline->opcode = ZEND_QM_ASSIGN;
127
356
        opline->op1_type = IS_CONST;
128
356
        opline->op1.constant = zend_optimizer_add_literal(op_array, &zv);
129
356
        SET_UNUSED(opline->op2);
130
356
      } else {
131
122
        MAKE_NOP(opline);
132
122
      }
133
134
478
      zend_delete_call_instructions(op_array, opline-1);
135
478
    }
136
1.03k
  }
137
112k
}
138
139
/* arg_num is 1-based here, to match SEND encoding. */
140
static bool has_known_send_mode(const optimizer_call_info *info, uint32_t arg_num)
141
111k
{
142
111k
  if (!info->func) {
143
108k
    return false;
144
108k
  }
145
146
  /* For prototype functions we should not make assumptions about arguments that are not part of
147
   * the signature: And inheriting method can add an optional by-ref argument. */
148
2.84k
  return !info->is_prototype
149
2.84k
    || arg_num <= info->func->common.num_args
150
2.84k
    || (info->func->common.fn_flags & ZEND_ACC_VARIADIC);
151
111k
}
152
153
void zend_optimize_func_calls(zend_op_array *op_array, zend_optimizer_ctx *ctx)
154
109k
{
155
109k
  zend_op *opline = op_array->opcodes;
156
109k
  zend_op *end = opline + op_array->last;
157
109k
  int call = 0;
158
109k
  void *checkpoint;
159
109k
  optimizer_call_info *call_stack;
160
161
109k
  if (op_array->last < 2) {
162
2.87k
    return;
163
2.87k
  }
164
165
106k
  checkpoint = zend_arena_checkpoint(ctx->arena);
166
106k
  call_stack = zend_arena_calloc(&ctx->arena, op_array->last / 2, sizeof(optimizer_call_info));
167
2.68M
  while (opline < end) {
168
2.57M
    switch (opline->opcode) {
169
5.53k
      case ZEND_INIT_FCALL_BY_NAME:
170
8.42k
      case ZEND_INIT_NS_FCALL_BY_NAME:
171
14.1k
      case ZEND_INIT_STATIC_METHOD_CALL:
172
58.7k
      case ZEND_INIT_METHOD_CALL:
173
168k
      case ZEND_INIT_FCALL:
174
239k
      case ZEND_NEW:
175
239k
      case ZEND_INIT_PARENT_PROPERTY_HOOK_CALL:
176
        /* The argument passing optimizations are valid for prototypes as well,
177
         * as inheritance cannot change between ref <-> non-ref arguments. */
178
239k
        call_stack[call].func = zend_optimizer_get_called_func(
179
239k
          ctx->script, op_array, opline, &call_stack[call].is_prototype);
180
239k
        call_stack[call].try_inline =
181
239k
          !call_stack[call].is_prototype
182
239k
          && opline->opcode != ZEND_NEW
183
239k
          && opline->opcode != ZEND_INIT_PARENT_PROPERTY_HOOK_CALL;
184
239k
        ZEND_FALLTHROUGH;
185
244k
      case ZEND_INIT_DYNAMIC_CALL:
186
245k
      case ZEND_INIT_USER_CALL:
187
245k
        call_stack[call].opline = opline;
188
245k
        call_stack[call].func_arg_num = (uint32_t)-1;
189
245k
        call++;
190
245k
        break;
191
235k
      case ZEND_DO_FCALL:
192
235k
      case ZEND_DO_ICALL:
193
245k
      case ZEND_DO_UCALL:
194
245k
      case ZEND_DO_FCALL_BY_NAME:
195
245k
      case ZEND_CALLABLE_CONVERT:
196
245k
        call--;
197
245k
        if (call_stack[call].func && call_stack[call].opline) {
198
117k
          zend_op *fcall = call_stack[call].opline;
199
200
117k
          if (fcall->opcode == ZEND_INIT_FCALL) {
201
            /* nothing to do */
202
109k
          } else if (fcall->opcode == ZEND_INIT_FCALL_BY_NAME) {
203
995
            fcall->opcode = ZEND_INIT_FCALL;
204
995
            fcall->op1.num = zend_vm_calc_used_stack(fcall->extended_value, call_stack[call].func);
205
995
            literal_dtor(&ZEND_OP2_LITERAL(fcall));
206
995
            fcall->op2.constant = fcall->op2.constant + 1;
207
6.74k
          } else if (fcall->opcode == ZEND_INIT_NS_FCALL_BY_NAME) {
208
368
            fcall->opcode = ZEND_INIT_FCALL;
209
368
            fcall->op1.num = zend_vm_calc_used_stack(fcall->extended_value, call_stack[call].func);
210
368
            literal_dtor(&op_array->literals[fcall->op2.constant]);
211
368
            literal_dtor(&op_array->literals[fcall->op2.constant + 2]);
212
368
            fcall->op2.constant = fcall->op2.constant + 1;
213
6.37k
          } else if (fcall->opcode == ZEND_INIT_STATIC_METHOD_CALL
214
6.37k
              || fcall->opcode == ZEND_INIT_METHOD_CALL
215
6.37k
              || fcall->opcode == ZEND_INIT_PARENT_PROPERTY_HOOK_CALL
216
6.37k
              || fcall->opcode == ZEND_NEW) {
217
            /* We don't have specialized opcodes for this, do nothing */
218
6.37k
          } else {
219
0
            ZEND_UNREACHABLE();
220
0
          }
221
222
          /* If the INIT opcode changed the DO opcode can also change to
223
           * a more optimized one.
224
           *
225
           * At this point we also know whether or not the result of
226
           * the DO opcode is used, allowing to optimize calls to
227
           * ZEND_ACC_NODISCARD functions. */
228
117k
          if (opline->opcode != ZEND_CALLABLE_CONVERT) {
229
117k
            opline->opcode = zend_get_call_op(fcall, call_stack[call].func, !RESULT_UNUSED(opline));
230
117k
          }
231
232
117k
          if ((ZEND_OPTIMIZER_PASS_16 & ctx->optimization_level)
233
117k
              && call_stack[call].try_inline
234
117k
              && opline->opcode != ZEND_CALLABLE_CONVERT) {
235
112k
            zend_try_inline_call(op_array, fcall, opline, call_stack[call].func);
236
112k
          }
237
117k
        }
238
245k
        call_stack[call].func = NULL;
239
245k
        call_stack[call].opline = NULL;
240
245k
        call_stack[call].try_inline = 0;
241
245k
        call_stack[call].func_arg_num = (uint32_t)-1;
242
245k
        break;
243
58
      case ZEND_FETCH_FUNC_ARG:
244
334
      case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
245
900
      case ZEND_FETCH_OBJ_FUNC_ARG:
246
1.73k
      case ZEND_FETCH_DIM_FUNC_ARG:
247
1.73k
        if (call_stack[call - 1].func_arg_num != (uint32_t)-1
248
1.73k
            && has_known_send_mode(&call_stack[call - 1], call_stack[call - 1].func_arg_num)) {
249
133
          if (ARG_SHOULD_BE_SENT_BY_REF(call_stack[call - 1].func, call_stack[call - 1].func_arg_num)) {
250
            /* There's no TMP specialization for FETCH_OBJ_W/FETCH_DIM_W. Avoid
251
             * converting it and error at runtime in the FUNC_ARG variant. */
252
38
            if ((opline->opcode == ZEND_FETCH_OBJ_FUNC_ARG || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG)
253
38
             && (opline->op1_type == IS_TMP_VAR || call_stack[call - 1].last_check_func_arg_opline == NULL)) {
254
              /* Don't remove the associated CHECK_FUNC_ARG opcode. */
255
10
              call_stack[call - 1].last_check_func_arg_opline = NULL;
256
10
              break;
257
10
            }
258
28
            if (opline->opcode != ZEND_FETCH_STATIC_PROP_FUNC_ARG) {
259
28
              opline->opcode -= 9;
260
28
            } else {
261
0
              opline->opcode = ZEND_FETCH_STATIC_PROP_W;
262
0
            }
263
95
          } else {
264
95
            if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG
265
95
                && opline->op2_type == IS_UNUSED) {
266
              /* FETCH_DIM_FUNC_ARG supports UNUSED op2, while FETCH_DIM_R does not.
267
               * Performing the replacement would create an invalid opcode. */
268
8
              call_stack[call - 1].try_inline = 0;
269
8
              break;
270
8
            }
271
272
87
            if (opline->opcode != ZEND_FETCH_STATIC_PROP_FUNC_ARG) {
273
87
              opline->opcode -= 12;
274
87
            } else {
275
0
              opline->opcode = ZEND_FETCH_STATIC_PROP_R;
276
0
            }
277
87
          }
278
133
        }
279
1.71k
        break;
280
30.2k
      case ZEND_SEND_VAL_EX:
281
30.2k
        if (opline->op2_type == IS_CONST) {
282
895
          call_stack[call - 1].try_inline = 0;
283
895
          break;
284
895
        }
285
286
29.3k
        if (has_known_send_mode(&call_stack[call - 1], opline->op2.num)) {
287
1.44k
          if (!ARG_MUST_BE_SENT_BY_REF(call_stack[call - 1].func, opline->op2.num)) {
288
1.38k
            opline->opcode = ZEND_SEND_VAL;
289
1.38k
          }
290
1.44k
        }
291
29.3k
        break;
292
1.46k
      case ZEND_CHECK_FUNC_ARG:
293
1.46k
        if (opline->op2_type == IS_CONST) {
294
96
          call_stack[call - 1].try_inline = 0;
295
96
          call_stack[call - 1].func_arg_num = (uint32_t)-1;
296
96
          break;
297
96
        }
298
299
1.37k
        if (has_known_send_mode(&call_stack[call - 1], opline->op2.num)) {
300
129
          call_stack[call - 1].func_arg_num = opline->op2.num;
301
129
          call_stack[call - 1].last_check_func_arg_opline = opline;
302
129
        }
303
1.37k
        break;
304
1.46k
      case ZEND_SEND_FUNC_ARG:
305
        /* Don't transform SEND_FUNC_ARG if any FETCH opcodes weren't transformed. */
306
1.46k
        if (call_stack[call - 1].last_check_func_arg_opline == NULL) {
307
1.34k
          if (opline->op2_type == IS_CONST) {
308
96
            call_stack[call - 1].try_inline = 0;
309
96
          }
310
1.34k
          break;
311
1.34k
        }
312
119
        MAKE_NOP(call_stack[call - 1].last_check_func_arg_opline);
313
119
        call_stack[call - 1].last_check_func_arg_opline = NULL;
314
119
        ZEND_FALLTHROUGH;
315
77.2k
      case ZEND_SEND_VAR_EX:
316
77.2k
        if (opline->op2_type == IS_CONST) {
317
450
          call_stack[call - 1].try_inline = 0;
318
450
          break;
319
450
        }
320
321
76.7k
        if (has_known_send_mode(&call_stack[call - 1], opline->op2.num)) {
322
755
          call_stack[call - 1].func_arg_num = (uint32_t)-1;
323
755
          if (ARG_SHOULD_BE_SENT_BY_REF(call_stack[call - 1].func, opline->op2.num)) {
324
76
            opline->opcode = ZEND_SEND_REF;
325
679
          } else {
326
679
            opline->opcode = ZEND_SEND_VAR;
327
679
          }
328
755
        }
329
76.7k
        break;
330
4.28k
      case ZEND_SEND_VAR_NO_REF_EX:
331
4.28k
        if (opline->op2_type == IS_CONST) {
332
176
          call_stack[call - 1].try_inline = 0;
333
176
          break;
334
176
        }
335
336
4.10k
        if (has_known_send_mode(&call_stack[call - 1], opline->op2.num)) {
337
374
          if (ARG_MUST_BE_SENT_BY_REF(call_stack[call - 1].func, opline->op2.num)) {
338
136
            opline->opcode = ZEND_SEND_VAR_NO_REF;
339
238
          } else if (ARG_MAY_BE_SENT_BY_REF(call_stack[call - 1].func, opline->op2.num)) {
340
0
            opline->opcode = ZEND_SEND_VAL;
341
238
          } else {
342
238
            opline->opcode = ZEND_SEND_VAR;
343
238
          }
344
374
        }
345
4.10k
        break;
346
69.3k
      case ZEND_SEND_VAL:
347
119k
      case ZEND_SEND_VAR:
348
121k
      case ZEND_SEND_REF:
349
121k
        if (opline->op2_type == IS_CONST) {
350
716
          call_stack[call - 1].try_inline = 0;
351
716
          break;
352
716
        }
353
120k
        break;
354
120k
      case ZEND_SEND_UNPACK:
355
3.68k
      case ZEND_SEND_USER:
356
4.16k
      case ZEND_SEND_ARRAY:
357
4.16k
        call_stack[call - 1].try_inline = 0;
358
4.16k
        break;
359
1.84M
      default:
360
1.84M
        break;
361
2.57M
    }
362
2.57M
    opline++;
363
2.57M
  }
364
365
106k
  zend_arena_release(&ctx->arena, checkpoint);
366
106k
}