Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/Optimizer/pass3.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Stanislav Malyshev <stas@zend.com>                          |
18
   |          Dmitry Stogov <dmitry@php.net>                              |
19
   +----------------------------------------------------------------------+
20
*/
21
22
/* pass 3: (Jump optimization)
23
 * - optimize series of JMPs
24
 */
25
26
#include "Optimizer/zend_optimizer.h"
27
#include "Optimizer/zend_optimizer_internal.h"
28
#include "zend_API.h"
29
#include "zend_constants.h"
30
#include "zend_execute.h"
31
#include "zend_vm.h"
32
33
/* we use "jmp_hitlist" to avoid infinity loops during jmp optimization */
34
static zend_always_inline bool in_hitlist(zend_op *target, zend_op **jmp_hitlist, int jmp_hitlist_count)
35
27.1k
{
36
27.1k
  int i;
37
38
28.1k
  for (i = 0; i < jmp_hitlist_count; i++) {
39
1.16k
    if (jmp_hitlist[i] == target) {
40
87
      return 1;
41
87
    }
42
1.16k
  }
43
27.0k
  return 0;
44
27.1k
}
45
46
#define CHECK_LOOP(target) \
47
27.1k
  if (EXPECTED(!in_hitlist(target, jmp_hitlist, jmp_hitlist_count))) { \
48
27.0k
    jmp_hitlist[jmp_hitlist_count++] = target;  \
49
27.0k
  } else { \
50
87
    break; \
51
87
  }
52
53
void zend_optimizer_pass3(zend_op_array *op_array, zend_optimizer_ctx *ctx)
54
109k
{
55
109k
  zend_op *opline;
56
109k
  zend_op *end;
57
109k
  zend_op *target;
58
109k
  zend_op **jmp_hitlist;
59
109k
  int jmp_hitlist_count;
60
109k
  ALLOCA_FLAG(use_heap);
61
62
109k
  jmp_hitlist = (zend_op**)do_alloca(sizeof(zend_op*)*op_array->last, use_heap);
63
109k
  opline = op_array->opcodes;
64
109k
  end =  opline + op_array->last;
65
66
2.69M
  while (opline < end) {
67
68
2.58M
    switch (opline->opcode) {
69
76.7k
      case ZEND_JMP:
70
76.7k
        jmp_hitlist_count = 0;
71
72
76.7k
        target = ZEND_OP1_JMP_ADDR(opline);
73
91.0k
        while (1) {
74
91.0k
          if (target->opcode == ZEND_JMP) {
75
            /* convert JMP L1 ... L1: JMP L2 to JMP L2 .. L1: JMP L2 */
76
13.1k
            target = ZEND_OP1_JMP_ADDR(target);
77
13.1k
            CHECK_LOOP(target);
78
77.9k
          } else if (target->opcode == ZEND_NOP) {
79
1.21k
            target = target + 1;
80
76.7k
          } else {
81
76.7k
            break;
82
76.7k
          }
83
14.3k
          ZEND_SET_OP_JMP_ADDR(opline, opline->op1, target);
84
14.3k
        }
85
86
76.7k
        if (target == opline + 1) {
87
          /* convert L: JMP L+1 to NOP */
88
2.03k
          MAKE_NOP(opline);
89
74.7k
        } else if ((target->opcode == ZEND_RETURN ||
90
74.7k
                    target->opcode == ZEND_RETURN_BY_REF ||
91
74.7k
                    target->opcode == ZEND_GENERATOR_RETURN) &&
92
74.7k
                   !(op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK)) {
93
          /* JMP L, L: RETURN to immediate RETURN */
94
13.4k
          *opline = *target;
95
13.4k
          if (opline->op1_type == IS_CONST) {
96
13.1k
            zval zv;
97
13.1k
            ZVAL_COPY(&zv, &ZEND_OP1_LITERAL(opline));
98
13.1k
            opline->op1.constant = zend_optimizer_add_literal(op_array, &zv);
99
13.1k
          }
100
61.3k
        } else if (opline > op_array->opcodes &&
101
61.3k
                   ((opline-1)->opcode == ZEND_JMPZ ||
102
61.1k
                    (opline-1)->opcode == ZEND_JMPNZ)) {
103
760
            if (ZEND_OP2_JMP_ADDR(opline-1) == target) {
104
            /* JMPZ(X,L1), JMP(L1) -> NOP, JMP(L1) */
105
55
            zend_optimizer_convert_to_free_op1(op_array, opline - 1);
106
55
            }
107
760
        }
108
76.7k
        break;
109
110
1.27k
      case ZEND_JMP_SET:
111
2.78k
      case ZEND_COALESCE:
112
2.78k
        jmp_hitlist_count = 0;
113
114
2.78k
        target = ZEND_OP2_JMP_ADDR(opline);
115
2.78k
        while (1) {
116
2.78k
          if (target->opcode == ZEND_JMP) {
117
0
            target = ZEND_OP1_JMP_ADDR(target);
118
0
            CHECK_LOOP(target);
119
2.78k
          } else if (target->opcode == ZEND_NOP) {
120
0
            target = target + 1;
121
2.78k
          } else {
122
2.78k
            break;
123
2.78k
          }
124
0
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, target);
125
0
        }
126
2.78k
        break;
127
128
18.0k
      case ZEND_JMPZ:
129
26.6k
      case ZEND_JMPNZ:
130
26.6k
        jmp_hitlist_count = 0;
131
132
26.6k
        target = ZEND_OP2_JMP_ADDR(opline);
133
39.2k
        while (1) {
134
39.2k
          if (target->opcode == ZEND_JMP) {
135
            /* plain JMP */
136
            /* JMPZ(X,L1), L1: JMP(L2) => JMPZ(X,L2), L1: JMP(L2) */
137
12.4k
            target = ZEND_OP1_JMP_ADDR(target);
138
12.4k
            CHECK_LOOP(target);
139
26.8k
          } else if (target->opcode == opline->opcode &&
140
26.8k
                     SAME_VAR(opline->op1, target->op1)) {
141
            /* same opcode and same var as this opcode */
142
            /* JMPZ(X,L1), L1: JMPZ(X,L2) => JMPZ(X,L2), L1: JMPZ(X,L2) */
143
124
            target = ZEND_OP2_JMP_ADDR(target);
144
124
            CHECK_LOOP(target);
145
26.7k
          } else if (target->opcode == INV_COND(opline->opcode) &&
146
26.7k
                     SAME_VAR(opline->op1, target->op1)) {
147
            /* convert JMPZ(X,L1), L1: JMPNZ(X,L2) to
148
               JMPZ(X,L1+1) */
149
0
            target = target + 1;
150
26.7k
          } else if (target->opcode == ZEND_NOP) {
151
125
            target = target + 1;
152
26.5k
          } else {
153
26.5k
            break;
154
26.5k
          }
155
12.6k
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, target);
156
12.6k
        }
157
158
        /* convert L: JMPZ L+1 to NOP */
159
26.6k
        if (target == opline + 1) {
160
82
          zend_optimizer_convert_to_free_op1(op_array, opline);
161
82
        }
162
26.6k
        break;
163
164
1.16k
      case ZEND_JMPZ_EX:
165
2.03k
      case ZEND_JMPNZ_EX:
166
2.03k
        jmp_hitlist_count = 0;
167
168
2.03k
        target = ZEND_OP2_JMP_ADDR(opline);
169
3.70k
        while (1) {
170
3.70k
          if (target->opcode == ZEND_JMP) {
171
            /* plain JMP */
172
            /* JMPZ_EX(X,L1), L1: JMP(L2) => JMPZ_EX(X,L2), L1: JMP(L2) */
173
234
            target = ZEND_OP1_JMP_ADDR(target);
174
234
            CHECK_LOOP(target);
175
3.46k
          } else if (target->opcode == opline->opcode-3 &&
176
3.46k
                     (SAME_VAR(target->op1, opline->result) ||
177
481
                      SAME_VAR(target->op1, opline->op1))) {
178
            /* convert T=JMPZ_EX(X,L1), L1: JMPZ(T,L2) to
179
               JMPZ_EX(X,L2) */
180
473
            target = ZEND_OP2_JMP_ADDR(target);
181
473
            CHECK_LOOP(target);
182
2.99k
          } else if (target->opcode == opline->opcode &&
183
2.99k
                     target->result.var == opline->result.var &&
184
2.99k
                     (SAME_VAR(target->op1, opline->result) ||
185
576
                      SAME_VAR(target->op1, opline->op1))) {
186
            /* convert T=JMPZ_EX(X,L1), L1: T=JMPZ_EX(T,L2) to
187
               JMPZ_EX(X,L2) */
188
576
            target = ZEND_OP2_JMP_ADDR(target);
189
576
            CHECK_LOOP(target);
190
2.42k
          } else if (target->opcode == INV_EX_COND(opline->opcode) &&
191
2.42k
                     (SAME_VAR(target->op1, opline->result) ||
192
188
                      SAME_VAR(target->op1, opline->op1))) {
193
             /* convert T=JMPZ_EX(X,L1), L1: JMPNZ(T,L2) to
194
              JMPZ_EX(X,L1+1) */
195
188
            target = target + 1;
196
2.23k
          } else if (target->opcode == INV_EX_COND_EX(opline->opcode) &&
197
2.23k
                     target->result.var == opline->result.var &&
198
2.23k
                     (SAME_VAR(target->op1, opline->result) ||
199
80
                      SAME_VAR(target->op1, opline->op1))) {
200
             /* convert T=JMPZ_EX(X,L1), L1: T=JMPNZ_EX(T,L2) to
201
              JMPZ_EX(X,L1+1) */
202
80
            target = target + 1;
203
2.15k
          } else if (target->opcode == ZEND_BOOL &&
204
2.15k
                     (SAME_VAR(target->op1, opline->result) ||
205
166
                      SAME_VAR(target->op1, opline->op1))) {
206
            /* convert Y = JMPZ_EX(X,L1), L1: Z = BOOL(Y) to
207
               Z = JMPZ_EX(X,L1+1) */
208
209
            /* NOTE: This optimization pattern is not safe, but works, */
210
            /*       because result of JMPZ_EX instruction             */
211
            /*       is not used on the following path and             */
212
            /*       should be used once on the branch path.           */
213
            /*                                                         */
214
            /*       The pattern works well only if jumps processed in */
215
            /*       direct order, otherwise it breaks JMPZ_EX         */
216
            /*       sequences too early.                              */
217
120
            opline->result.var = target->result.var;
218
120
            target = target + 1;
219
120
            CHECK_LOOP(target);
220
2.03k
          } else if (target->opcode == ZEND_NOP) {
221
0
            target = target + 1;
222
2.03k
          } else {
223
2.03k
            break;
224
2.03k
          }
225
1.67k
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, target);
226
1.67k
        }
227
228
        /* convert L: T = JMPZ_EX X,L+1 to T = BOOL(X) */
229
2.03k
        if (target == opline + 1) {
230
0
          opline->opcode = ZEND_BOOL;
231
0
          opline->op2.num = 0;
232
0
        }
233
2.03k
        break;
234
2.58M
    }
235
2.58M
    opline++;
236
2.58M
  }
237
109k
  free_alloca(jmp_hitlist, use_heap);
238
109k
}