Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/Optimizer/sccp.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine, SCCP - Sparse Conditional Constant Propagation          |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Nikita Popov <nikic@php.net>                                |
16
   |          Dmitry Stogov <dmitry@php.net>                              |
17
   +----------------------------------------------------------------------+
18
*/
19
20
#include "zend_API.h"
21
#include "zend_exceptions.h"
22
#include "zend_ini.h"
23
#include "zend_type_info.h"
24
#include "Optimizer/zend_optimizer_internal.h"
25
#include "Optimizer/zend_call_graph.h"
26
#include "Optimizer/zend_inference.h"
27
#include "Optimizer/scdf.h"
28
#include "Optimizer/zend_dump.h"
29
30
/* This implements sparse conditional constant propagation (SCCP) based on the SCDF framework. The
31
 * used value lattice is defined as follows:
32
 *
33
 * BOT < {constant values} < TOP
34
 *
35
 * TOP indicates an underdefined value, i.e. that we do not yet know the value of variable.
36
 * BOT indicates an overdefined value, i.e. that we know the variable to be non-constant.
37
 *
38
 * All variables are optimistically initialized to TOP, apart from the implicit variables defined
39
 * at the start of the first block. Note that variables that MAY_BE_REF are *not* initialized to
40
 * BOT. We rely on the fact that any operation resulting in a reference will produce a BOT anyway.
41
 * This is better because such operations might never be reached due to the conditional nature of
42
 * the algorithm.
43
 *
44
 * The meet operation for phi functions is defined as follows:
45
 * BOT + any = BOT
46
 * TOP + any = any
47
 * C_i + C_i = C_i (i.e. two equal constants)
48
 * C_i + C_j = BOT (i.e. two different constants)
49
 *
50
 * When evaluating instructions TOP and BOT are handled as follows:
51
 * a) If any operand is BOT, the result is BOT. The main exception to this is op1 of ASSIGN, which
52
 *    is ignored. However, if the op1 MAY_BE_REF we do have to propagate the BOT.
53
 * b) Otherwise, if the instruction can never be evaluated (either in general, or with the
54
 *    specific modifiers) the result is BOT.
55
 * c) Otherwise, if any operand is TOP, the result is TOP.
56
 * d) Otherwise (at this point all operands are known and constant), if we can compute the result
57
 *    for these specific constants (without throwing notices or similar) then that is the result.
58
 * e) Otherwise the result is BOT.
59
 *
60
 * It is sometimes possible to determine a result even if one argument is TOP / BOT, e.g. for things
61
 * like BOT*0. Right now we don't bother with this.
62
 *
63
 * Feasible successors for conditional branches are determined as follows:
64
 * a) If we don't support the branch type or branch on BOT, all successors are feasible.
65
 * b) Otherwise, if we branch on TOP none of the successors are feasible.
66
 * c) Otherwise (we branch on a constant), the feasible successors are marked based on the constant
67
 *    (usually only one successor will be feasible).
68
 *
69
 * The original SCCP algorithm is extended with ability to propagate constant array
70
 * elements and object properties. The extension is based on a variation of Array
71
 * SSA form and its application to Spare Constant Propagation, described at
72
 * "Array SSA Form" by Vivek Sarkar, Kathleen Knobe and Stephen Fink in chapter
73
 * 16 of the SSA book.
74
 */
75
76
#define SCP_DEBUG 0
77
78
typedef struct _sccp_ctx {
79
  scdf_ctx scdf;
80
  zend_call_info **call_map;
81
  zval *values;
82
  zval top;
83
  zval bot;
84
} sccp_ctx;
85
86
4.98M
#define TOP ((uint8_t)-1)
87
3.98M
#define BOT ((uint8_t)-2)
88
1.09M
#define PARTIAL_ARRAY ((uint8_t)-3)
89
1.02M
#define PARTIAL_OBJECT ((uint8_t)-4)
90
5.94M
#define IS_TOP(zv) (Z_TYPE_P(zv) == TOP)
91
6.28M
#define IS_BOT(zv) (Z_TYPE_P(zv) == BOT)
92
2.11M
#define IS_PARTIAL_ARRAY(zv) (Z_TYPE_P(zv) == PARTIAL_ARRAY)
93
1.03M
#define IS_PARTIAL_OBJECT(zv) (Z_TYPE_P(zv) == PARTIAL_OBJECT)
94
95
9.49k
#define MAKE_PARTIAL_ARRAY(zv) (Z_TYPE_INFO_P(zv) = PARTIAL_ARRAY | (IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT))
96
550
#define MAKE_PARTIAL_OBJECT(zv) (Z_TYPE_INFO_P(zv) = PARTIAL_OBJECT | (IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT))
97
98
1.27M
#define MAKE_TOP(zv) (Z_TYPE_INFO_P(zv) = TOP)
99
188k
#define MAKE_BOT(zv) (Z_TYPE_INFO_P(zv) = BOT)
100
101
0
static void scp_dump_value(zval *zv) {
102
0
  if (IS_TOP(zv)) {
103
0
    fprintf(stderr, " top");
104
0
  } else if (IS_BOT(zv)) {
105
0
    fprintf(stderr, " bot");
106
0
  } else if (Z_TYPE_P(zv) == IS_ARRAY || IS_PARTIAL_ARRAY(zv)) {
107
0
    fprintf(stderr, " %s[", IS_PARTIAL_ARRAY(zv) ? "partial " : "");
108
0
    zend_dump_ht(Z_ARRVAL_P(zv));
109
0
    fprintf(stderr, "]");
110
0
  } else if (IS_PARTIAL_OBJECT(zv)) {
111
0
    fprintf(stderr, " {");
112
0
    zend_dump_ht(Z_ARRVAL_P(zv));
113
0
    fprintf(stderr, "}");
114
0
  } else {
115
0
    zend_dump_const(zv);
116
0
  }
117
0
}
118
119
static void empty_partial_array(zval *zv)
120
3.69k
{
121
3.69k
  MAKE_PARTIAL_ARRAY(zv);
122
3.69k
  Z_ARR_P(zv) = zend_new_array(8);
123
3.69k
}
124
125
static void dup_partial_array(zval *dst, const zval *src)
126
464
{
127
464
  MAKE_PARTIAL_ARRAY(dst);
128
464
  Z_ARR_P(dst) = zend_array_dup(Z_ARR_P(src));
129
464
}
130
131
static void empty_partial_object(zval *zv)
132
378
{
133
378
  MAKE_PARTIAL_OBJECT(zv);
134
378
  Z_ARR_P(zv) = zend_new_array(8);
135
378
}
136
137
static void dup_partial_object(zval *dst, const zval *src)
138
172
{
139
172
  MAKE_PARTIAL_OBJECT(dst);
140
172
  Z_ARR_P(dst) = zend_array_dup(Z_ARR_P(src));
141
172
}
142
143
1.11M
static inline bool value_known(zval *zv) {
144
1.11M
  return !IS_TOP(zv) && !IS_BOT(zv);
145
1.11M
}
146
147
/* Sets new value for variable and ensures that it is lower or equal
148
 * the previous one in the constant propagation lattice. */
149
1.03M
static void set_value(scdf_ctx *scdf, sccp_ctx *ctx, int var, const zval *new) {
150
1.03M
  zval *value = &ctx->values[var];
151
1.03M
  if (IS_BOT(value) || IS_TOP(new)) {
152
2.42k
    return;
153
2.42k
  }
154
155
#if SCP_DEBUG
156
  fprintf(stderr, "Lowering #%d.", var);
157
  zend_dump_var(scdf->op_array, IS_CV, scdf->ssa->vars[var].var);
158
  fprintf(stderr, " from");
159
  scp_dump_value(value);
160
  fprintf(stderr, " to");
161
  scp_dump_value(new);
162
  fprintf(stderr, "\n");
163
#endif
164
165
1.03M
  if (IS_TOP(value) || IS_BOT(new)) {
166
1.02M
    zval_ptr_dtor_nogc(value);
167
1.02M
    ZVAL_COPY(value, new);
168
1.02M
    scdf_add_to_worklist(scdf, var);
169
1.02M
    return;
170
1.02M
  }
171
172
  /* Always replace PARTIAL_(ARRAY|OBJECT), as new maybe changed by join_partial_(arrays|object) */
173
1.25k
  if (IS_PARTIAL_ARRAY(new) || IS_PARTIAL_OBJECT(new)) {
174
136
    if (Z_TYPE_P(value) != Z_TYPE_P(new)
175
136
      || zend_hash_num_elements(Z_ARR_P(new)) != zend_hash_num_elements(Z_ARR_P(value))) {
176
83
      zval_ptr_dtor_nogc(value);
177
83
      ZVAL_COPY(value, new);
178
83
      scdf_add_to_worklist(scdf, var);
179
83
    }
180
136
    return;
181
136
  }
182
183
1.12k
#if ZEND_DEBUG
184
1.12k
  ZEND_ASSERT(zend_is_identical(value, new) ||
185
1.12k
    (Z_TYPE_P(value) == IS_DOUBLE && Z_TYPE_P(new) == IS_DOUBLE && isnan(Z_DVAL_P(value)) && isnan(Z_DVAL_P(new))));
186
1.12k
#endif
187
1.12k
}
188
189
1.40M
static zval *get_op1_value(sccp_ctx *ctx, zend_op *opline, const zend_ssa_op *ssa_op) {
190
1.40M
  if (opline->op1_type == IS_CONST) {
191
210k
    return CT_CONSTANT_EX(ctx->scdf.op_array, opline->op1.constant);
192
1.19M
  } else if (ssa_op->op1_use != -1) {
193
876k
    return &ctx->values[ssa_op->op1_use];
194
876k
  } else {
195
322k
    return NULL;
196
322k
  }
197
1.40M
}
198
199
1.33M
static zval *get_op2_value(sccp_ctx *ctx, const zend_op *opline, const zend_ssa_op *ssa_op) {
200
1.33M
  if (opline->op2_type == IS_CONST) {
201
461k
    return CT_CONSTANT_EX(ctx->scdf.op_array, opline->op2.constant);
202
874k
  } else if (ssa_op->op2_use != -1) {
203
275k
    return &ctx->values[ssa_op->op2_use];
204
598k
  } else {
205
598k
    return NULL;
206
598k
  }
207
1.33M
}
208
209
static bool can_replace_op1(
210
17.4k
    const zend_op_array *op_array, const zend_op *opline, const zend_ssa_op *ssa_op) {
211
17.4k
  switch (opline->opcode) {
212
119
    case ZEND_PRE_INC:
213
132
    case ZEND_PRE_DEC:
214
132
    case ZEND_PRE_INC_OBJ:
215
132
    case ZEND_PRE_DEC_OBJ:
216
132
    case ZEND_POST_INC:
217
141
    case ZEND_POST_DEC:
218
141
    case ZEND_POST_INC_OBJ:
219
141
    case ZEND_POST_DEC_OBJ:
220
1.23k
    case ZEND_ASSIGN:
221
1.32k
    case ZEND_ASSIGN_REF:
222
1.59k
    case ZEND_ASSIGN_DIM:
223
1.61k
    case ZEND_ASSIGN_OBJ:
224
1.61k
    case ZEND_ASSIGN_OBJ_REF:
225
1.66k
    case ZEND_ASSIGN_OP:
226
1.68k
    case ZEND_ASSIGN_DIM_OP:
227
1.69k
    case ZEND_ASSIGN_OBJ_OP:
228
1.69k
    case ZEND_ASSIGN_STATIC_PROP_OP:
229
1.77k
    case ZEND_FETCH_DIM_W:
230
1.77k
    case ZEND_FETCH_DIM_RW:
231
1.77k
    case ZEND_FETCH_DIM_UNSET:
232
1.79k
    case ZEND_FETCH_DIM_FUNC_ARG:
233
1.79k
    case ZEND_FETCH_OBJ_W:
234
1.79k
    case ZEND_FETCH_OBJ_RW:
235
1.79k
    case ZEND_FETCH_OBJ_UNSET:
236
1.79k
    case ZEND_FETCH_OBJ_FUNC_ARG:
237
1.79k
    case ZEND_FETCH_LIST_W:
238
1.80k
    case ZEND_UNSET_DIM:
239
1.80k
    case ZEND_UNSET_OBJ:
240
1.84k
    case ZEND_SEND_REF:
241
1.87k
    case ZEND_SEND_VAR_EX:
242
1.90k
    case ZEND_SEND_FUNC_ARG:
243
1.90k
    case ZEND_SEND_UNPACK:
244
1.90k
    case ZEND_SEND_ARRAY:
245
1.90k
    case ZEND_SEND_USER:
246
1.90k
    case ZEND_FE_RESET_RW:
247
1.90k
      return 0;
248
    /* Do not accept CONST */
249
10.6k
    case ZEND_ROPE_ADD:
250
10.6k
    case ZEND_ROPE_END:
251
10.6k
    case ZEND_BIND_STATIC:
252
10.6k
    case ZEND_BIND_INIT_STATIC_OR_JMP:
253
10.6k
    case ZEND_BIND_GLOBAL:
254
10.6k
    case ZEND_MAKE_REF:
255
10.6k
    case ZEND_UNSET_CV:
256
10.6k
    case ZEND_ISSET_ISEMPTY_CV:
257
10.6k
      return 0;
258
28
    case ZEND_INIT_ARRAY:
259
36
    case ZEND_ADD_ARRAY_ELEMENT:
260
36
      return !(opline->extended_value & ZEND_ARRAY_ELEMENT_REF);
261
46
    case ZEND_YIELD:
262
46
      return !(op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE);
263
45
    case ZEND_VERIFY_RETURN_TYPE:
264
      // TODO: This would require a non-local change ???
265
45
      return 0;
266
451
    case ZEND_OP_DATA:
267
451
      return (opline - 1)->opcode != ZEND_ASSIGN_OBJ_REF &&
268
451
        (opline - 1)->opcode != ZEND_ASSIGN_STATIC_PROP_REF;
269
4.32k
    default:
270
4.32k
      if (ssa_op->op1_def != -1) {
271
0
        ZEND_UNREACHABLE();
272
0
        return 0;
273
0
      }
274
17.4k
  }
275
276
4.32k
  return 1;
277
17.4k
}
278
279
static bool can_replace_op2(
280
4.38k
    const zend_op_array *op_array, zend_op *opline, zend_ssa_op *ssa_op) {
281
4.38k
  switch (opline->opcode) {
282
    /* Do not accept CONST */
283
0
    case ZEND_DECLARE_CLASS_DELAYED:
284
47
    case ZEND_BIND_LEXICAL:
285
47
    case ZEND_FE_FETCH_R:
286
47
    case ZEND_FE_FETCH_RW:
287
47
      return 0;
288
4.38k
  }
289
4.33k
  return 1;
290
4.38k
}
291
292
static bool try_replace_op1(
293
38.8k
    sccp_ctx *ctx, zend_op *opline, zend_ssa_op *ssa_op, int var, zval *value) {
294
38.8k
  if (ssa_op->op1_use == var && can_replace_op1(ctx->scdf.op_array, opline, ssa_op)) {
295
4.80k
    zval zv;
296
4.80k
    ZVAL_COPY(&zv, value);
297
4.80k
    if (zend_optimizer_update_op1_const(ctx->scdf.op_array, opline, &zv)) {
298
4.72k
      return 1;
299
4.72k
    }
300
74
    zval_ptr_dtor_nogc(&zv);
301
74
  }
302
34.0k
  return 0;
303
38.8k
}
304
305
static bool try_replace_op2(
306
38.8k
    sccp_ctx *ctx, zend_op *opline, zend_ssa_op *ssa_op, int var, zval *value) {
307
38.8k
  if (ssa_op->op2_use == var && can_replace_op2(ctx->scdf.op_array, opline, ssa_op)) {
308
4.33k
    zval zv;
309
4.33k
    ZVAL_COPY(&zv, value);
310
4.33k
    if (zend_optimizer_update_op2_const(ctx->scdf.op_array, opline, &zv)) {
311
4.23k
      return 1;
312
4.23k
    }
313
98
    zval_ptr_dtor_nogc(&zv);
314
98
  }
315
34.5k
  return 0;
316
38.8k
}
317
318
6.11k
static inline zend_result ct_eval_binary_op(zval *result, uint8_t binop, zval *op1, zval *op2) {
319
  /* TODO: We could implement support for evaluation of + on partial arrays. */
320
6.11k
  if (IS_PARTIAL_ARRAY(op1) || IS_PARTIAL_ARRAY(op2)) {
321
22
    return FAILURE;
322
22
  }
323
324
6.09k
  return zend_optimizer_eval_binary_op(result, binop, op1, op2);
325
6.11k
}
326
327
2.96k
static inline zend_result ct_eval_bool_cast(zval *result, zval *op) {
328
2.96k
  if (IS_PARTIAL_ARRAY(op)) {
329
4
    if (zend_hash_num_elements(Z_ARRVAL_P(op)) == 0) {
330
      /* An empty partial array may be non-empty at runtime, we don't know whether the
331
       * result will be true or false. */
332
0
      return FAILURE;
333
0
    }
334
335
4
    ZVAL_TRUE(result);
336
4
    return SUCCESS;
337
4
  }
338
339
2.95k
  ZVAL_BOOL(result, zend_is_true(op));
340
2.95k
  return SUCCESS;
341
2.96k
}
342
343
38
static inline zend_result zval_to_string_offset(zend_long *result, zval *op) {
344
38
  switch (Z_TYPE_P(op)) {
345
32
    case IS_LONG:
346
32
      *result = Z_LVAL_P(op);
347
32
      return SUCCESS;
348
6
    case IS_STRING:
349
6
      if (IS_LONG == is_numeric_string(
350
6
          Z_STRVAL_P(op), Z_STRLEN_P(op), result, NULL, 0)) {
351
0
        return SUCCESS;
352
0
      }
353
6
      return FAILURE;
354
0
    default:
355
0
      return FAILURE;
356
38
  }
357
38
}
358
359
746
static inline zend_result fetch_array_elem(zval **result, zval *op1, zval *op2) {
360
746
  switch (Z_TYPE_P(op2)) {
361
12
    case IS_NULL:
362
12
      *result = zend_hash_find(Z_ARR_P(op1), ZSTR_EMPTY_ALLOC());
363
12
      return SUCCESS;
364
14
    case IS_FALSE:
365
14
      *result = zend_hash_index_find(Z_ARR_P(op1), 0);
366
14
      return SUCCESS;
367
14
    case IS_TRUE:
368
14
      *result = zend_hash_index_find(Z_ARR_P(op1), 1);
369
14
      return SUCCESS;
370
554
    case IS_LONG:
371
554
      *result = zend_hash_index_find(Z_ARR_P(op1), Z_LVAL_P(op2));
372
554
      return SUCCESS;
373
18
    case IS_DOUBLE: {
374
18
      zend_long lval = zend_dval_to_lval(Z_DVAL_P(op2));
375
18
      if (!zend_is_long_compatible(Z_DVAL_P(op2), lval)) {
376
4
        return FAILURE;
377
4
      }
378
14
      *result = zend_hash_index_find(Z_ARR_P(op1), lval);
379
14
      return SUCCESS;
380
18
    }
381
134
    case IS_STRING:
382
134
      *result = zend_symtable_find(Z_ARR_P(op1), Z_STR_P(op2));
383
134
      return SUCCESS;
384
0
    default:
385
0
      return FAILURE;
386
746
  }
387
746
}
388
389
787
static inline zend_result ct_eval_fetch_dim(zval *result, zval *op1, zval *op2, int support_strings) {
390
787
  if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) {
391
709
    zval *value;
392
709
    if (fetch_array_elem(&value, op1, op2) == SUCCESS && value && !IS_BOT(value)) {
393
514
      ZVAL_COPY(result, value);
394
514
      return SUCCESS;
395
514
    }
396
709
  } else if (support_strings && Z_TYPE_P(op1) == IS_STRING) {
397
38
    zend_long index;
398
38
    if (zval_to_string_offset(&index, op2) == FAILURE) {
399
6
      return FAILURE;
400
6
    }
401
32
    if (index >= 0 && index < Z_STRLEN_P(op1)) {
402
30
      ZVAL_STR(result, zend_string_init(&Z_STRVAL_P(op1)[index], 1, 0));
403
30
      return SUCCESS;
404
30
    }
405
32
  }
406
237
  return FAILURE;
407
787
}
408
409
/* op1 may be NULL here to indicate an unset value */
410
41
static inline zend_result ct_eval_isset_isempty(zval *result, uint32_t extended_value, zval *op1) {
411
41
  zval zv;
412
41
  if (!(extended_value & ZEND_ISEMPTY)) {
413
41
    ZVAL_BOOL(result, op1 && Z_TYPE_P(op1) != IS_NULL);
414
41
    return SUCCESS;
415
41
  } else if (!op1) {
416
0
    ZVAL_TRUE(result);
417
0
    return SUCCESS;
418
0
  } else if (ct_eval_bool_cast(&zv, op1) == SUCCESS) {
419
0
    ZVAL_BOOL(result, Z_TYPE(zv) == IS_FALSE);
420
0
    return SUCCESS;
421
0
  } else {
422
0
    return FAILURE;
423
0
  }
424
41
}
425
426
37
static inline zend_result ct_eval_isset_dim(zval *result, uint32_t extended_value, zval *op1, zval *op2) {
427
37
  if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) {
428
37
    zval *value;
429
37
    if (fetch_array_elem(&value, op1, op2) == FAILURE) {
430
0
      return FAILURE;
431
0
    }
432
37
    if (IS_PARTIAL_ARRAY(op1) && (!value || IS_BOT(value))) {
433
0
      return FAILURE;
434
0
    }
435
37
    return ct_eval_isset_isempty(result, extended_value, value);
436
37
  } else if (Z_TYPE_P(op1) == IS_STRING) {
437
    // TODO
438
0
    return FAILURE;
439
0
  } else {
440
0
    ZVAL_BOOL(result, (extended_value & ZEND_ISEMPTY));
441
0
    return SUCCESS;
442
0
  }
443
37
}
444
445
614
static inline zend_result ct_eval_del_array_elem(zval *result, const zval *key) {
446
614
  ZEND_ASSERT(IS_PARTIAL_ARRAY(result));
447
448
614
  switch (Z_TYPE_P(key)) {
449
0
    case IS_NULL:
450
0
      zend_hash_del(Z_ARR_P(result), ZSTR_EMPTY_ALLOC());
451
0
      break;
452
0
    case IS_FALSE:
453
0
      zend_hash_index_del(Z_ARR_P(result), 0);
454
0
      break;
455
0
    case IS_TRUE:
456
0
      zend_hash_index_del(Z_ARR_P(result), 1);
457
0
      break;
458
254
    case IS_LONG:
459
254
      zend_hash_index_del(Z_ARR_P(result), Z_LVAL_P(key));
460
254
      break;
461
2
    case IS_DOUBLE: {
462
2
      zend_long lval = zend_dval_to_lval(Z_DVAL_P(key));
463
2
      if (!zend_is_long_compatible(Z_DVAL_P(key), lval)) {
464
2
        return FAILURE;
465
2
      }
466
0
      zend_hash_index_del(Z_ARR_P(result), lval);
467
0
      break;
468
2
    }
469
354
    case IS_STRING:
470
354
      zend_symtable_del(Z_ARR_P(result), Z_STR_P(key));
471
354
      break;
472
4
    default:
473
4
      return FAILURE;
474
614
  }
475
476
608
  return SUCCESS;
477
614
}
478
479
4.72k
static inline zend_result ct_eval_add_array_elem(zval *result, zval *value, const zval *key) {
480
4.72k
  if (!key) {
481
3.85k
    SEPARATE_ARRAY(result);
482
3.85k
    if ((value = zend_hash_next_index_insert(Z_ARR_P(result), value))) {
483
3.85k
      Z_TRY_ADDREF_P(value);
484
3.85k
      return SUCCESS;
485
3.85k
    }
486
0
    return FAILURE;
487
3.85k
  }
488
489
878
  switch (Z_TYPE_P(key)) {
490
0
    case IS_NULL:
491
0
      SEPARATE_ARRAY(result);
492
0
      value = zend_hash_update(Z_ARR_P(result), ZSTR_EMPTY_ALLOC(), value);
493
0
      break;
494
7
    case IS_FALSE:
495
7
      SEPARATE_ARRAY(result);
496
7
      value = zend_hash_index_update(Z_ARR_P(result), 0, value);
497
7
      break;
498
0
    case IS_TRUE:
499
0
      SEPARATE_ARRAY(result);
500
0
      value = zend_hash_index_update(Z_ARR_P(result), 1, value);
501
0
      break;
502
320
    case IS_LONG:
503
320
      SEPARATE_ARRAY(result);
504
320
      value = zend_hash_index_update(Z_ARR_P(result), Z_LVAL_P(key), value);
505
320
      break;
506
18
    case IS_DOUBLE: {
507
18
      zend_long lval = zend_dval_to_lval(Z_DVAL_P(key));
508
18
      if (!zend_is_long_compatible(Z_DVAL_P(key), lval)) {
509
18
        return FAILURE;
510
18
      }
511
0
      SEPARATE_ARRAY(result);
512
0
      value = zend_hash_index_update(
513
0
        Z_ARR_P(result), lval, value);
514
0
      break;
515
18
    }
516
533
    case IS_STRING:
517
533
      SEPARATE_ARRAY(result);
518
533
      value = zend_symtable_update(Z_ARR_P(result), Z_STR_P(key), value);
519
533
      break;
520
0
    default:
521
0
      return FAILURE;
522
878
  }
523
524
860
  Z_TRY_ADDREF_P(value);
525
860
  return SUCCESS;
526
878
}
527
528
26
static inline zend_result ct_eval_add_array_unpack(zval *result, zval *array) {
529
26
  zend_string *key;
530
26
  zval *value;
531
26
  if (Z_TYPE_P(array) != IS_ARRAY) {
532
12
    return FAILURE;
533
12
  }
534
535
14
  SEPARATE_ARRAY(result);
536
78
  ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(array), key, value) {
537
78
    if (key) {
538
0
      value = zend_hash_update(Z_ARR_P(result), key, value);
539
32
    } else {
540
32
      value = zend_hash_next_index_insert(Z_ARR_P(result), value);
541
32
    }
542
78
    if (!value) {
543
0
      return FAILURE;
544
0
    }
545
32
    Z_TRY_ADDREF_P(value);
546
32
  } ZEND_HASH_FOREACH_END();
547
14
  return SUCCESS;
548
14
}
549
550
404
static inline zend_result ct_eval_assign_dim(zval *result, zval *value, const zval *key) {
551
404
  switch (Z_TYPE_P(result)) {
552
92
    case IS_NULL:
553
92
    case IS_FALSE:
554
92
      array_init(result);
555
92
      ZEND_FALLTHROUGH;
556
236
    case IS_ARRAY:
557
390
    case PARTIAL_ARRAY:
558
390
      return ct_eval_add_array_elem(result, value, key);
559
14
    case IS_STRING:
560
      // TODO Before enabling this case, make sure ARRAY_DIM result op is correct
561
#if 0
562
      zend_long index;
563
      zend_string *new_str, *value_str;
564
      if (!key || Z_TYPE_P(value) == IS_ARRAY
565
          || zval_to_string_offset(&index, key) == FAILURE || index < 0) {
566
        return FAILURE;
567
      }
568
569
      if (index >= Z_STRLEN_P(result)) {
570
        new_str = zend_string_alloc(index + 1, 0);
571
        memcpy(ZSTR_VAL(new_str), Z_STRVAL_P(result), Z_STRLEN_P(result));
572
        memset(ZSTR_VAL(new_str) + Z_STRLEN_P(result), ' ', index - Z_STRLEN_P(result));
573
        ZSTR_VAL(new_str)[index + 1] = 0;
574
      } else {
575
        new_str = zend_string_init(Z_STRVAL_P(result), Z_STRLEN_P(result), 0);
576
      }
577
578
      value_str = zval_get_string(value);
579
      ZVAL_STR(result, new_str);
580
      Z_STRVAL_P(result)[index] = ZSTR_VAL(value_str)[0];
581
      zend_string_release_ex(value_str, 0);
582
#endif
583
14
      return FAILURE;
584
0
    default:
585
0
      return FAILURE;
586
404
  }
587
404
}
588
589
52
static inline zend_result fetch_obj_prop(zval **result, zval *op1, zval *op2) {
590
52
  switch (Z_TYPE_P(op2)) {
591
34
    case IS_STRING:
592
34
      *result = zend_symtable_find(Z_ARR_P(op1), Z_STR_P(op2));
593
34
      return SUCCESS;
594
18
    default:
595
18
      return FAILURE;
596
52
  }
597
52
}
598
599
88
static inline zend_result ct_eval_fetch_obj(zval *result, zval *op1, zval *op2) {
600
88
  if (IS_PARTIAL_OBJECT(op1)) {
601
52
    zval *value;
602
52
    if (fetch_obj_prop(&value, op1, op2) == SUCCESS && value && !IS_BOT(value)) {
603
8
      ZVAL_COPY(result, value);
604
8
      return SUCCESS;
605
8
    }
606
52
  }
607
80
  return FAILURE;
608
88
}
609
610
20
static inline zend_result ct_eval_isset_obj(zval *result, uint32_t extended_value, zval *op1, zval *op2) {
611
20
  if (IS_PARTIAL_OBJECT(op1)) {
612
0
    zval *value;
613
0
    if (fetch_obj_prop(&value, op1, op2) == FAILURE) {
614
0
      return FAILURE;
615
0
    }
616
0
    if (!value || IS_BOT(value)) {
617
0
      return FAILURE;
618
0
    }
619
0
    return ct_eval_isset_isempty(result, extended_value, value);
620
20
  } else {
621
20
    ZVAL_BOOL(result, (extended_value & ZEND_ISEMPTY));
622
20
    return SUCCESS;
623
20
  }
624
20
}
625
626
68
static inline zend_result ct_eval_del_obj_prop(zval *result, const zval *key) {
627
68
  ZEND_ASSERT(IS_PARTIAL_OBJECT(result));
628
629
68
  switch (Z_TYPE_P(key)) {
630
68
    case IS_STRING:
631
68
      zend_symtable_del(Z_ARR_P(result), Z_STR_P(key));
632
68
      break;
633
0
    default:
634
0
      return FAILURE;
635
68
  }
636
637
68
  return SUCCESS;
638
68
}
639
640
104
static inline zend_result ct_eval_add_obj_prop(zval *result, zval *value, const zval *key) {
641
104
  switch (Z_TYPE_P(key)) {
642
104
    case IS_STRING:
643
104
      value = zend_symtable_update(Z_ARR_P(result), Z_STR_P(key), value);
644
104
      break;
645
0
    default:
646
0
      return FAILURE;
647
104
  }
648
649
104
  Z_TRY_ADDREF_P(value);
650
104
  return SUCCESS;
651
104
}
652
653
104
static inline zend_result ct_eval_assign_obj(zval *result, zval *value, const zval *key) {
654
104
  switch (Z_TYPE_P(result)) {
655
0
    case IS_NULL:
656
0
    case IS_FALSE:
657
0
      empty_partial_object(result);
658
0
      ZEND_FALLTHROUGH;
659
104
    case PARTIAL_OBJECT:
660
104
      return ct_eval_add_obj_prop(result, value, key);
661
0
    default:
662
0
      return FAILURE;
663
104
  }
664
104
}
665
666
1.65k
static inline zend_result ct_eval_incdec(zval *result, uint8_t opcode, zval *op1) {
667
  /* As of PHP 8.3 with the warning/deprecation notices any type other than int/double/null will emit a diagnostic
668
  if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) {
669
    return FAILURE;
670
  }
671
  */
672
1.65k
  if (Z_TYPE_P(op1) != IS_LONG && Z_TYPE_P(op1) != IS_DOUBLE && Z_TYPE_P(op1) != IS_NULL) {
673
36
    return FAILURE;
674
36
  }
675
676
1.62k
  ZVAL_COPY(result, op1);
677
1.62k
  if (opcode == ZEND_PRE_INC
678
1.62k
      || opcode == ZEND_POST_INC
679
1.62k
      || opcode == ZEND_PRE_INC_OBJ
680
1.62k
      || opcode == ZEND_POST_INC_OBJ) {
681
1.59k
    increment_function(result);
682
1.59k
  } else {
683
    /* Decrement on null emits a deprecation notice */
684
31
    if (Z_TYPE_P(op1) == IS_NULL) {
685
0
      zval_ptr_dtor(result);
686
0
      return FAILURE;
687
0
    }
688
31
    decrement_function(result);
689
31
  }
690
1.62k
  return SUCCESS;
691
1.62k
}
692
693
6
static inline void ct_eval_type_check(zval *result, uint32_t type_mask, zval *op1) {
694
6
  uint32_t type = Z_TYPE_P(op1);
695
6
  if (type == PARTIAL_ARRAY) {
696
4
    type = IS_ARRAY;
697
4
  } else if (type == PARTIAL_OBJECT) {
698
0
    type = IS_OBJECT;
699
0
  }
700
6
  ZVAL_BOOL(result, (type_mask >> type) & 1);
701
6
}
702
703
0
static inline zend_result ct_eval_in_array(zval *result, uint32_t extended_value, zval *op1, zval *op2) {
704
0
  HashTable *ht;
705
0
  bool res;
706
707
0
  if (Z_TYPE_P(op2) != IS_ARRAY) {
708
0
    return FAILURE;
709
0
  }
710
0
  ht = Z_ARRVAL_P(op2);
711
0
  if (EXPECTED(Z_TYPE_P(op1) == IS_STRING)) {
712
0
    res = zend_hash_exists(ht, Z_STR_P(op1));
713
0
  } else if (extended_value) {
714
0
    if (EXPECTED(Z_TYPE_P(op1) == IS_LONG)) {
715
0
      res = zend_hash_index_exists(ht, Z_LVAL_P(op1));
716
0
    } else {
717
0
      res = 0;
718
0
    }
719
0
  } else if (Z_TYPE_P(op1) <= IS_FALSE) {
720
0
    res = zend_hash_exists(ht, ZSTR_EMPTY_ALLOC());
721
0
  } else {
722
0
    zend_string *key;
723
0
    zval key_tmp;
724
725
0
    res = 0;
726
0
    ZEND_HASH_MAP_FOREACH_STR_KEY(ht, key) {
727
0
      ZVAL_STR(&key_tmp, key);
728
0
      if (zend_compare(op1, &key_tmp) == 0) {
729
0
        res = 1;
730
0
        break;
731
0
      }
732
0
    } ZEND_HASH_FOREACH_END();
733
0
  }
734
0
  ZVAL_BOOL(result, res);
735
0
  return SUCCESS;
736
0
}
737
738
0
static inline zend_result ct_eval_array_key_exists(zval *result, zval *op1, zval *op2) {
739
0
  zval *value;
740
741
0
  if (Z_TYPE_P(op2) != IS_ARRAY && !IS_PARTIAL_ARRAY(op2)) {
742
0
    return FAILURE;
743
0
  }
744
0
  if (Z_TYPE_P(op1) != IS_STRING && Z_TYPE_P(op1) != IS_LONG && Z_TYPE_P(op1) != IS_NULL) {
745
0
    return FAILURE;
746
0
  }
747
0
  if (fetch_array_elem(&value, op2, op1) == FAILURE) {
748
0
    return FAILURE;
749
0
  }
750
0
  if (IS_PARTIAL_ARRAY(op2) && (!value || IS_BOT(value))) {
751
0
    return FAILURE;
752
0
  }
753
754
0
  ZVAL_BOOL(result, value != NULL);
755
0
  return SUCCESS;
756
0
}
757
758
0
static bool can_ct_eval_func_call(zend_function *func, zend_string *name, uint32_t num_args, zval **args) {
759
  /* Precondition: func->type == ZEND_INTERNAL_FUNCTION, this is a global function */
760
  /* Functions setting ZEND_ACC_COMPILE_TIME_EVAL (@compile-time-eval) must always produce the same result for the same arguments,
761
   * and have no dependence on global state (such as locales). It is okay if they throw
762
   * or warn on invalid arguments, as we detect this and will discard the evaluation result. */
763
0
  if (func->common.fn_flags & ZEND_ACC_COMPILE_TIME_EVAL) {
764
    /* This has @compile-time-eval in stub info and uses a macro such as ZEND_SUPPORTS_COMPILE_TIME_EVAL_FE */
765
0
    return true;
766
0
  }
767
0
#ifndef ZEND_WIN32
768
  /* On Windows this function may be code page dependent. */
769
0
  if (zend_string_equals_literal(name, "dirname")) {
770
0
    return true;
771
0
  }
772
0
#endif
773
774
0
  if (num_args == 2) {
775
0
    if (zend_string_equals_literal(name, "str_repeat")) {
776
      /* Avoid creating overly large strings at compile-time. */
777
0
      bool overflow;
778
0
      return Z_TYPE_P(args[0]) == IS_STRING
779
0
        && Z_TYPE_P(args[1]) == IS_LONG
780
0
        && zend_safe_address(Z_STRLEN_P(args[0]), Z_LVAL_P(args[1]), 0, &overflow) < 64 * 1024
781
0
        && !overflow;
782
0
    }
783
0
    return false;
784
0
  }
785
786
0
  return false;
787
0
}
788
789
/* The functions chosen here are simple to implement and either likely to affect a branch,
790
 * or just happened to be commonly used with constant operands in WP (need to test other
791
 * applications as well, of course). */
792
static inline zend_result ct_eval_func_call_ex(
793
0
    zend_op_array *op_array, zval *result, zend_function *func, uint32_t num_args, zval **args) {
794
0
  uint32_t i;
795
0
  zend_string *name = func->common.function_name;
796
0
  if (num_args == 1 && Z_TYPE_P(args[0]) == IS_STRING &&
797
0
      zend_optimizer_eval_special_func_call(result, name, Z_STR_P(args[0])) == SUCCESS) {
798
0
    return SUCCESS;
799
0
  }
800
801
0
  if (!can_ct_eval_func_call(func, name, num_args, args)) {
802
0
    return FAILURE;
803
0
  }
804
805
0
  zend_execute_data *prev_execute_data = EG(current_execute_data);
806
0
  zend_execute_data *execute_data, dummy_frame;
807
0
  zend_op dummy_opline;
808
809
  /* Add a dummy frame to get the correct strict_types behavior. */
810
0
  memset(&dummy_frame, 0, sizeof(zend_execute_data));
811
0
  memset(&dummy_opline, 0, sizeof(zend_op));
812
0
  dummy_frame.func = (zend_function *) op_array;
813
0
  dummy_frame.opline = &dummy_opline;
814
0
  dummy_opline.opcode = ZEND_DO_FCALL;
815
816
0
  execute_data = safe_emalloc(num_args, sizeof(zval), ZEND_CALL_FRAME_SLOT * sizeof(zval));
817
0
  memset(execute_data, 0, sizeof(zend_execute_data));
818
0
  execute_data->prev_execute_data = &dummy_frame;
819
0
  EG(current_execute_data) = execute_data;
820
821
  /* Enable suppression and counting of warnings. */
822
0
  ZEND_ASSERT(EG(capture_warnings_during_sccp) == 0);
823
0
  EG(capture_warnings_during_sccp) = 1;
824
825
0
  EX(func) = func;
826
0
  EX_NUM_ARGS() = num_args;
827
0
  for (i = 0; i < num_args; i++) {
828
0
    ZVAL_COPY(EX_VAR_NUM(i), args[i]);
829
0
  }
830
0
  ZVAL_NULL(result);
831
0
  func->internal_function.handler(execute_data, result);
832
0
  for (i = 0; i < num_args; i++) {
833
0
    zval_ptr_dtor_nogc(EX_VAR_NUM(i));
834
0
  }
835
836
0
  zend_result retval = SUCCESS;
837
0
  if (EG(exception)) {
838
0
    zval_ptr_dtor(result);
839
0
    zend_clear_exception();
840
0
    retval = FAILURE;
841
0
  }
842
843
0
  if (EG(capture_warnings_during_sccp) > 1) {
844
0
    zval_ptr_dtor(result);
845
0
    retval = FAILURE;
846
0
  }
847
0
  EG(capture_warnings_during_sccp) = 0;
848
849
0
  efree(execute_data);
850
0
  EG(current_execute_data) = prev_execute_data;
851
0
  return retval;
852
0
}
853
854
static inline zend_result ct_eval_func_call(
855
0
    zend_op_array *op_array, zval *result, zend_string *name, uint32_t num_args, zval **args) {
856
0
  zend_function *func = zend_hash_find_ptr(CG(function_table), name);
857
0
  if (!func || func->type != ZEND_INTERNAL_FUNCTION) {
858
0
    return FAILURE;
859
0
  }
860
0
  return ct_eval_func_call_ex(op_array, result, func, num_args, args);
861
0
}
862
863
3.53M
#define SET_RESULT(op, zv) do { \
864
3.53M
  if (ssa_op->op##_def >= 0) { \
865
850k
    set_value(scdf, ctx, ssa_op->op##_def, zv); \
866
850k
  } \
867
3.53M
} while (0)
868
3.44M
#define SET_RESULT_BOT(op) SET_RESULT(op, &ctx->bot)
869
#define SET_RESULT_TOP(op) SET_RESULT(op, &ctx->top)
870
871
71.0k
#define SKIP_IF_TOP(op) if (IS_TOP(op)) return;
872
873
1.33M
static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_op) {
874
1.33M
  sccp_ctx *ctx = (sccp_ctx *) scdf;
875
1.33M
  zval *op1, *op2, zv; /* zv is a temporary to hold result values */
876
877
1.33M
  op1 = get_op1_value(ctx, opline, ssa_op);
878
1.33M
  op2 = get_op2_value(ctx, opline, ssa_op);
879
880
1.33M
  switch (opline->opcode) {
881
58.2k
    case ZEND_ASSIGN:
882
      /* The value of op1 is irrelevant here, because we are overwriting it
883
       * -- unless it can be a reference, in which case we propagate a BOT.
884
       * The result is also BOT in this case, because it might be a typed reference. */
885
58.2k
      if (IS_BOT(op1) && (ctx->scdf.ssa->var_info[ssa_op->op1_use].type & MAY_BE_REF)) {
886
37.8k
        SET_RESULT_BOT(op1);
887
37.8k
        SET_RESULT_BOT(result);
888
37.8k
      } else {
889
20.3k
        SET_RESULT(op1, op2);
890
20.3k
        SET_RESULT(result, op2);
891
20.3k
      }
892
58.2k
      return;
893
6.85k
    case ZEND_ASSIGN_DIM:
894
6.85k
    {
895
6.85k
      zval *data = get_op1_value(ctx, opline+1, ssa_op+1);
896
897
      /* If $a in $a[$b]=$c is UNDEF, treat it like NULL. There is no warning. */
898
6.85k
      if ((ctx->scdf.ssa->var_info[ssa_op->op1_use].type & MAY_BE_ANY) == 0) {
899
551
        op1 = &EG(uninitialized_zval);
900
551
      }
901
902
6.85k
      if (IS_BOT(op1)) {
903
5.62k
        SET_RESULT_BOT(result);
904
5.62k
        SET_RESULT_BOT(op1);
905
5.62k
        return;
906
5.62k
      }
907
908
1.22k
      SKIP_IF_TOP(op1);
909
1.22k
      SKIP_IF_TOP(data);
910
1.22k
      if (op2) {
911
752
        SKIP_IF_TOP(op2);
912
752
      }
913
914
1.22k
      if (op2 && IS_BOT(op2)) {
915
        /* Update of unknown index */
916
164
        SET_RESULT_BOT(result);
917
164
        if (ssa_op->op1_def >= 0) {
918
162
          empty_partial_array(&zv);
919
162
          SET_RESULT(op1, &zv);
920
162
          zval_ptr_dtor_nogc(&zv);
921
162
        } else {
922
2
          SET_RESULT_BOT(op1);
923
2
        }
924
164
        return;
925
164
      }
926
927
1.06k
      if (IS_BOT(data)) {
928
929
663
        SET_RESULT_BOT(result);
930
663
        if ((IS_PARTIAL_ARRAY(op1)
931
663
            || Z_TYPE_P(op1) == IS_NULL
932
663
            || Z_TYPE_P(op1) == IS_FALSE
933
663
            || Z_TYPE_P(op1) == IS_ARRAY)
934
663
          && ssa_op->op1_def >= 0) {
935
936
649
          if (Z_TYPE_P(op1) == IS_NULL || Z_TYPE_P(op1) == IS_FALSE) {
937
343
            empty_partial_array(&zv);
938
343
          } else {
939
306
            dup_partial_array(&zv, op1);
940
306
          }
941
942
649
          if (!op2) {
943
            /* We can't add NEXT element into partial array (skip it) */
944
387
            SET_RESULT(op1, &zv);
945
387
          } else if (ct_eval_del_array_elem(&zv, op2) == SUCCESS) {
946
262
            SET_RESULT(op1, &zv);
947
262
          } else {
948
0
            SET_RESULT_BOT(op1);
949
0
          }
950
951
649
          zval_ptr_dtor_nogc(&zv);
952
649
        } else {
953
14
          SET_RESULT_BOT(op1);
954
14
        }
955
956
663
      } else {
957
958
398
        if (IS_PARTIAL_ARRAY(op1)) {
959
158
          dup_partial_array(&zv, op1);
960
240
        } else {
961
240
          ZVAL_COPY(&zv, op1);
962
240
        }
963
964
398
        if (!op2 && IS_PARTIAL_ARRAY(&zv)) {
965
          /* We can't add NEXT element into partial array (skip it) */
966
4
          SET_RESULT(result, data);
967
4
          SET_RESULT(op1, &zv);
968
394
        } else if (ct_eval_assign_dim(&zv, data, op2) == SUCCESS) {
969
          /* Mark array containing partial array as partial */
970
380
          if (IS_PARTIAL_ARRAY(data)) {
971
44
            MAKE_PARTIAL_ARRAY(&zv);
972
44
          }
973
380
          SET_RESULT(result, data);
974
380
          SET_RESULT(op1, &zv);
975
380
        } else {
976
14
          SET_RESULT_BOT(result);
977
14
          SET_RESULT_BOT(op1);
978
14
        }
979
980
398
        zval_ptr_dtor_nogc(&zv);
981
398
      }
982
1.06k
      return;
983
1.22k
    }
984
985
7.62k
    case ZEND_ASSIGN_OBJ:
986
7.62k
      if (ssa_op->op1_def >= 0
987
7.62k
          && ctx->scdf.ssa->vars[ssa_op->op1_def].escape_state == ESCAPE_STATE_NO_ESCAPE) {
988
297
        zval *data = get_op1_value(ctx, opline+1, ssa_op+1);
989
297
        zend_ssa_var_info *var_info = &ctx->scdf.ssa->var_info[ssa_op->op1_use];
990
991
        /* Don't try to propagate assignments to (potentially) typed properties. We would
992
         * need to deal with errors and type conversions first. */
993
        // TODO: Distinguish dynamic and declared property assignments here?
994
297
        if (!var_info->ce || (var_info->ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS) ||
995
297
            !(var_info->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES)) {
996
103
          SET_RESULT_BOT(result);
997
103
          SET_RESULT_BOT(op1);
998
103
          return;
999
103
        }
1000
1001
194
        if (IS_BOT(op1)) {
1002
8
          SET_RESULT_BOT(result);
1003
8
          SET_RESULT_BOT(op1);
1004
8
          return;
1005
8
        }
1006
1007
186
        SKIP_IF_TOP(op1);
1008
186
        SKIP_IF_TOP(data);
1009
186
        SKIP_IF_TOP(op2);
1010
1011
186
        if (IS_BOT(op2)) {
1012
          /* Update of unknown property */
1013
14
          SET_RESULT_BOT(result);
1014
14
          empty_partial_object(&zv);
1015
14
          SET_RESULT(op1, &zv);
1016
14
          zval_ptr_dtor_nogc(&zv);
1017
14
          return;
1018
14
        }
1019
1020
172
        if (IS_BOT(data)) {
1021
68
          SET_RESULT_BOT(result);
1022
68
          if (IS_PARTIAL_OBJECT(op1)
1023
68
              || Z_TYPE_P(op1) == IS_NULL
1024
68
              || Z_TYPE_P(op1) == IS_FALSE) {
1025
1026
68
            if (Z_TYPE_P(op1) == IS_NULL || Z_TYPE_P(op1) == IS_FALSE) {
1027
0
              empty_partial_object(&zv);
1028
68
            } else {
1029
68
              dup_partial_object(&zv, op1);
1030
68
            }
1031
1032
68
            if (ct_eval_del_obj_prop(&zv, op2) == SUCCESS) {
1033
68
              SET_RESULT(op1, &zv);
1034
68
            } else {
1035
0
              SET_RESULT_BOT(op1);
1036
0
            }
1037
68
            zval_ptr_dtor_nogc(&zv);
1038
68
          } else {
1039
0
            SET_RESULT_BOT(op1);
1040
0
          }
1041
1042
104
        } else {
1043
1044
104
          if (IS_PARTIAL_OBJECT(op1)) {
1045
104
            dup_partial_object(&zv, op1);
1046
104
          } else {
1047
0
            ZVAL_COPY(&zv, op1);
1048
0
          }
1049
1050
104
          if (ct_eval_assign_obj(&zv, data, op2) == SUCCESS) {
1051
104
            SET_RESULT(result, data);
1052
104
            SET_RESULT(op1, &zv);
1053
104
          } else {
1054
0
            SET_RESULT_BOT(result);
1055
0
            SET_RESULT_BOT(op1);
1056
0
          }
1057
1058
104
          zval_ptr_dtor_nogc(&zv);
1059
104
        }
1060
7.32k
      } else {
1061
7.32k
        SET_RESULT_BOT(result);
1062
7.32k
        SET_RESULT_BOT(op1);
1063
7.32k
      }
1064
7.49k
      return;
1065
1066
55.7k
    case ZEND_SEND_VAL:
1067
88.2k
    case ZEND_SEND_VAR:
1068
88.2k
    {
1069
      /* If the value of a SEND for an ICALL changes, we need to reconsider the
1070
       * ICALL result value. Otherwise we can ignore the opcode. */
1071
88.2k
      zend_call_info *call;
1072
88.2k
      if (!ctx->call_map) {
1073
410
        return;
1074
410
      }
1075
1076
87.8k
      call = ctx->call_map[opline - ctx->scdf.op_array->opcodes];
1077
87.8k
      if (IS_TOP(op1) || !call || !call->caller_call_opline
1078
87.8k
          || call->caller_call_opline->opcode != ZEND_DO_ICALL) {
1079
87.8k
        return;
1080
87.8k
      }
1081
1082
0
      opline = call->caller_call_opline;
1083
0
      ssa_op = &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes];
1084
0
      break;
1085
87.8k
    }
1086
3.73k
    case ZEND_INIT_ARRAY:
1087
21.1k
    case ZEND_ADD_ARRAY_ELEMENT:
1088
21.1k
    {
1089
21.1k
      zval *result = NULL;
1090
1091
21.1k
      if (opline->opcode == ZEND_ADD_ARRAY_ELEMENT) {
1092
17.4k
        result = &ctx->values[ssa_op->result_use];
1093
17.4k
        if (IS_BOT(result)) {
1094
170
          SET_RESULT_BOT(result);
1095
170
          SET_RESULT_BOT(op1);
1096
170
          return;
1097
170
        }
1098
17.2k
        SKIP_IF_TOP(result);
1099
17.2k
      }
1100
1101
21.0k
      if (op1) {
1102
20.9k
        SKIP_IF_TOP(op1);
1103
20.9k
      }
1104
1105
21.0k
      if (op2) {
1106
1.54k
        SKIP_IF_TOP(op2);
1107
1.54k
      }
1108
1109
      /* We want to avoid keeping around intermediate arrays for each SSA variable in the
1110
       * ADD_ARRAY_ELEMENT chain. We do this by only keeping the array on the last opcode
1111
       * and use a NULL value everywhere else. */
1112
21.0k
      if (result && Z_TYPE_P(result) == IS_NULL) {
1113
0
        SET_RESULT_BOT(result);
1114
0
        return;
1115
0
      }
1116
1117
21.0k
      if (op2 && IS_BOT(op2)) {
1118
        /* Update of unknown index */
1119
633
        SET_RESULT_BOT(op1);
1120
633
        if (ssa_op->result_def >= 0) {
1121
633
          empty_partial_array(&zv);
1122
633
          SET_RESULT(result, &zv);
1123
633
          zval_ptr_dtor_nogc(&zv);
1124
633
        } else {
1125
0
          SET_RESULT_BOT(result);
1126
0
        }
1127
633
        return;
1128
633
      }
1129
1130
20.3k
      if ((op1 && IS_BOT(op1))
1131
20.3k
          || (opline->extended_value & ZEND_ARRAY_ELEMENT_REF)) {
1132
1133
7.43k
        SET_RESULT_BOT(op1);
1134
7.43k
        if (ssa_op->result_def >= 0) {
1135
7.43k
          if (!result) {
1136
2.39k
            empty_partial_array(&zv);
1137
5.03k
          } else {
1138
5.03k
            MAKE_PARTIAL_ARRAY(result);
1139
5.03k
            ZVAL_COPY_VALUE(&zv, result);
1140
5.03k
            ZVAL_NULL(result);
1141
5.03k
          }
1142
7.43k
          if (!op2) {
1143
            /* We can't add NEXT element into partial array (skip it) */
1144
7.07k
            SET_RESULT(result, &zv);
1145
7.07k
          } else if (ct_eval_del_array_elem(&zv, op2) == SUCCESS) {
1146
346
            SET_RESULT(result, &zv);
1147
346
          } else {
1148
6
            SET_RESULT_BOT(result);
1149
6
          }
1150
7.43k
          zval_ptr_dtor_nogc(&zv);
1151
7.43k
        } else {
1152
          /* If any operand is BOT, mark the result as BOT right away.
1153
           * Exceptions to this rule are handled above. */
1154
0
          SET_RESULT_BOT(result);
1155
0
        }
1156
1157
12.9k
      } else {
1158
12.9k
        if (result) {
1159
11.9k
          ZVAL_COPY_VALUE(&zv, result);
1160
11.9k
          ZVAL_NULL(result);
1161
11.9k
        } else {
1162
1.04k
          array_init(&zv);
1163
1.04k
        }
1164
1165
12.9k
        if (op1) {
1166
12.8k
          if (!op2 && IS_PARTIAL_ARRAY(&zv)) {
1167
            /* We can't add NEXT element into partial array (skip it) */
1168
8.54k
            SET_RESULT(result, &zv);
1169
8.54k
          } else if (ct_eval_add_array_elem(&zv, op1, op2) == SUCCESS) {
1170
4.32k
            if (IS_PARTIAL_ARRAY(op1)) {
1171
253
              MAKE_PARTIAL_ARRAY(&zv);
1172
253
            }
1173
4.32k
            SET_RESULT(result, &zv);
1174
4.32k
          } else {
1175
18
            SET_RESULT_BOT(result);
1176
18
          }
1177
12.8k
        } else {
1178
78
          SET_RESULT(result, &zv);
1179
78
        }
1180
1181
12.9k
        zval_ptr_dtor_nogc(&zv);
1182
12.9k
      }
1183
20.3k
      return;
1184
21.0k
    }
1185
150
    case ZEND_ADD_ARRAY_UNPACK: {
1186
150
      zval *result = &ctx->values[ssa_op->result_use];
1187
150
      if (IS_BOT(result) || IS_BOT(op1)) {
1188
124
        SET_RESULT_BOT(result);
1189
124
        return;
1190
124
      }
1191
26
      SKIP_IF_TOP(result);
1192
26
      SKIP_IF_TOP(op1);
1193
1194
      /* See comment for ADD_ARRAY_ELEMENT. */
1195
26
      if (Z_TYPE_P(result) == IS_NULL) {
1196
0
        SET_RESULT_BOT(result);
1197
0
        return;
1198
0
      }
1199
26
      ZVAL_COPY_VALUE(&zv, result);
1200
26
      ZVAL_NULL(result);
1201
1202
26
      if (ct_eval_add_array_unpack(&zv, op1) == SUCCESS) {
1203
14
        SET_RESULT(result, &zv);
1204
14
      } else {
1205
12
        SET_RESULT_BOT(result);
1206
12
      }
1207
26
      zval_ptr_dtor_nogc(&zv);
1208
26
      return;
1209
26
    }
1210
25.0k
    case ZEND_NEW:
1211
25.0k
      if (ssa_op->result_def >= 0
1212
25.0k
          && ctx->scdf.ssa->vars[ssa_op->result_def].escape_state == ESCAPE_STATE_NO_ESCAPE) {
1213
364
        empty_partial_object(&zv);
1214
364
        SET_RESULT(result, &zv);
1215
364
        zval_ptr_dtor_nogc(&zv);
1216
24.6k
      } else {
1217
24.6k
        SET_RESULT_BOT(result);
1218
24.6k
      }
1219
25.0k
      return;
1220
110
    case ZEND_ASSIGN_STATIC_PROP_REF:
1221
413
    case ZEND_ASSIGN_OBJ_REF:
1222
      /* Handled here because we also need to BOT the OP_DATA operand, while the generic
1223
       * code below will not do so. */
1224
413
      SET_RESULT_BOT(result);
1225
413
      SET_RESULT_BOT(op1);
1226
413
      SET_RESULT_BOT(op2);
1227
413
      opline++;
1228
413
      ssa_op++;
1229
413
      SET_RESULT_BOT(op1);
1230
413
      break;
1231
1.33M
  }
1232
1233
1.12M
  if ((op1 && IS_BOT(op1)) || (op2 && IS_BOT(op2))) {
1234
    /* If any operand is BOT, mark the result as BOT right away.
1235
     * Exceptions to this rule are handled above. */
1236
672k
    SET_RESULT_BOT(result);
1237
672k
    SET_RESULT_BOT(op1);
1238
672k
    SET_RESULT_BOT(op2);
1239
672k
    return;
1240
672k
  }
1241
1242
455k
  switch (opline->opcode) {
1243
157
    case ZEND_ADD:
1244
356
    case ZEND_SUB:
1245
548
    case ZEND_MUL:
1246
588
    case ZEND_DIV:
1247
1.78k
    case ZEND_MOD:
1248
1.78k
    case ZEND_POW:
1249
2.01k
    case ZEND_SL:
1250
2.14k
    case ZEND_SR:
1251
2.23k
    case ZEND_CONCAT:
1252
2.24k
    case ZEND_FAST_CONCAT:
1253
2.24k
    case ZEND_IS_EQUAL:
1254
2.31k
    case ZEND_IS_NOT_EQUAL:
1255
3.65k
    case ZEND_IS_SMALLER:
1256
4.34k
    case ZEND_IS_SMALLER_OR_EQUAL:
1257
4.35k
    case ZEND_IS_IDENTICAL:
1258
4.35k
    case ZEND_IS_NOT_IDENTICAL:
1259
4.45k
    case ZEND_BW_OR:
1260
4.62k
    case ZEND_BW_AND:
1261
5.74k
    case ZEND_BW_XOR:
1262
5.74k
    case ZEND_BOOL_XOR:
1263
5.75k
    case ZEND_CASE:
1264
5.81k
    case ZEND_CASE_STRICT:
1265
5.81k
      SKIP_IF_TOP(op1);
1266
5.81k
      SKIP_IF_TOP(op2);
1267
1268
5.81k
      if (ct_eval_binary_op(&zv, opline->opcode, op1, op2) == SUCCESS) {
1269
2.68k
        SET_RESULT(result, &zv);
1270
2.68k
        zval_ptr_dtor_nogc(&zv);
1271
2.68k
        break;
1272
2.68k
      }
1273
3.12k
      SET_RESULT_BOT(result);
1274
3.12k
      break;
1275
256
    case ZEND_ASSIGN_OP:
1276
311
    case ZEND_ASSIGN_DIM_OP:
1277
413
    case ZEND_ASSIGN_OBJ_OP:
1278
425
    case ZEND_ASSIGN_STATIC_PROP_OP:
1279
425
      if (op1) {
1280
333
        SKIP_IF_TOP(op1);
1281
333
      }
1282
425
      if (op2) {
1283
424
        SKIP_IF_TOP(op2);
1284
424
      }
1285
425
      if (opline->opcode == ZEND_ASSIGN_OP) {
1286
256
        if (ct_eval_binary_op(&zv, opline->extended_value, op1, op2) == SUCCESS) {
1287
252
          SET_RESULT(op1, &zv);
1288
252
          SET_RESULT(result, &zv);
1289
252
          zval_ptr_dtor_nogc(&zv);
1290
252
          break;
1291
252
        }
1292
256
      } else if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
1293
55
        if ((IS_PARTIAL_ARRAY(op1) || Z_TYPE_P(op1) == IS_ARRAY)
1294
55
            && ssa_op->op1_def >= 0 && op2) {
1295
52
          zval tmp;
1296
52
          zval *data = get_op1_value(ctx, opline+1, ssa_op+1);
1297
1298
52
          SKIP_IF_TOP(data);
1299
1300
52
          if (ct_eval_fetch_dim(&tmp, op1, op2, 0) == SUCCESS) {
1301
12
            if (IS_BOT(data)) {
1302
0
              dup_partial_array(&zv, op1);
1303
0
              ct_eval_del_array_elem(&zv, op2);
1304
0
              SET_RESULT_BOT(result);
1305
0
              SET_RESULT(op1, &zv);
1306
0
              zval_ptr_dtor_nogc(&tmp);
1307
0
              zval_ptr_dtor_nogc(&zv);
1308
0
              break;
1309
0
            }
1310
1311
12
            if (ct_eval_binary_op(&tmp, opline->extended_value, &tmp, data) == FAILURE) {
1312
2
              SET_RESULT_BOT(result);
1313
2
              SET_RESULT_BOT(op1);
1314
2
              zval_ptr_dtor_nogc(&tmp);
1315
2
              break;
1316
2
            }
1317
1318
10
            if (IS_PARTIAL_ARRAY(op1)) {
1319
0
              dup_partial_array(&zv, op1);
1320
10
            } else {
1321
10
              ZVAL_COPY(&zv, op1);
1322
10
            }
1323
1324
10
            if (ct_eval_assign_dim(&zv, &tmp, op2) == SUCCESS) {
1325
10
              SET_RESULT(result, &tmp);
1326
10
              SET_RESULT(op1, &zv);
1327
10
              zval_ptr_dtor_nogc(&tmp);
1328
10
              zval_ptr_dtor_nogc(&zv);
1329
10
              break;
1330
10
            }
1331
1332
0
            zval_ptr_dtor_nogc(&tmp);
1333
0
            zval_ptr_dtor_nogc(&zv);
1334
0
          }
1335
52
        }
1336
114
      } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
1337
102
        if (op1 && IS_PARTIAL_OBJECT(op1)
1338
102
            && ssa_op->op1_def >= 0
1339
102
            && ctx->scdf.ssa->vars[ssa_op->op1_def].escape_state == ESCAPE_STATE_NO_ESCAPE) {
1340
10
          zval tmp;
1341
10
          zval *data = get_op1_value(ctx, opline+1, ssa_op+1);
1342
1343
10
          SKIP_IF_TOP(data);
1344
1345
10
          if (ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) {
1346
0
            if (IS_BOT(data)) {
1347
0
              dup_partial_object(&zv, op1);
1348
0
              ct_eval_del_obj_prop(&zv, op2);
1349
0
              SET_RESULT_BOT(result);
1350
0
              SET_RESULT(op1, &zv);
1351
0
              zval_ptr_dtor_nogc(&tmp);
1352
0
              zval_ptr_dtor_nogc(&zv);
1353
0
              break;
1354
0
            }
1355
1356
0
            if (ct_eval_binary_op(&tmp, opline->extended_value, &tmp, data) == FAILURE) {
1357
0
              SET_RESULT_BOT(result);
1358
0
              SET_RESULT_BOT(op1);
1359
0
              zval_ptr_dtor_nogc(&tmp);
1360
0
              break;
1361
0
            }
1362
1363
0
            dup_partial_object(&zv, op1);
1364
1365
0
            if (ct_eval_assign_obj(&zv, &tmp, op2) == SUCCESS) {
1366
0
              SET_RESULT(result, &tmp);
1367
0
              SET_RESULT(op1, &zv);
1368
0
              zval_ptr_dtor_nogc(&tmp);
1369
0
              zval_ptr_dtor_nogc(&zv);
1370
0
              break;
1371
0
            }
1372
1373
0
            zval_ptr_dtor_nogc(&tmp);
1374
0
            zval_ptr_dtor_nogc(&zv);
1375
0
          }
1376
10
        }
1377
102
      }
1378
161
      SET_RESULT_BOT(result);
1379
161
      SET_RESULT_BOT(op1);
1380
161
      break;
1381
132
    case ZEND_PRE_INC_OBJ:
1382
150
    case ZEND_PRE_DEC_OBJ:
1383
162
    case ZEND_POST_INC_OBJ:
1384
172
    case ZEND_POST_DEC_OBJ:
1385
172
      if (op1) {
1386
8
        SKIP_IF_TOP(op1);
1387
8
        SKIP_IF_TOP(op2);
1388
8
        if (IS_PARTIAL_OBJECT(op1)
1389
8
            && ssa_op->op1_def >= 0
1390
8
            && ctx->scdf.ssa->vars[ssa_op->op1_def].escape_state == ESCAPE_STATE_NO_ESCAPE) {
1391
8
          zval tmp1, tmp2;
1392
1393
8
          if (ct_eval_fetch_obj(&tmp1, op1, op2) == SUCCESS) {
1394
8
            if (ct_eval_incdec(&tmp2, opline->opcode, &tmp1) == SUCCESS) {
1395
0
              dup_partial_object(&zv, op1);
1396
0
              ct_eval_assign_obj(&zv, &tmp2, op2);
1397
0
              if (opline->opcode == ZEND_PRE_INC_OBJ || opline->opcode == ZEND_PRE_DEC_OBJ) {
1398
0
                SET_RESULT(result, &tmp2);
1399
0
              } else {
1400
0
                SET_RESULT(result, &tmp1);
1401
0
              }
1402
0
              zval_ptr_dtor_nogc(&tmp1);
1403
0
              zval_ptr_dtor_nogc(&tmp2);
1404
0
              SET_RESULT(op1, &zv);
1405
0
              zval_ptr_dtor_nogc(&zv);
1406
0
              break;
1407
0
            }
1408
8
            zval_ptr_dtor_nogc(&tmp1);
1409
8
          }
1410
8
        }
1411
8
      }
1412
172
      SET_RESULT_BOT(op1);
1413
172
      SET_RESULT_BOT(result);
1414
172
      break;
1415
1.32k
    case ZEND_PRE_INC:
1416
1.33k
    case ZEND_PRE_DEC:
1417
1.33k
      SKIP_IF_TOP(op1);
1418
1.33k
      if (ct_eval_incdec(&zv, opline->opcode, op1) == SUCCESS) {
1419
1.31k
        SET_RESULT(op1, &zv);
1420
1.31k
        SET_RESULT(result, &zv);
1421
1.31k
        zval_ptr_dtor_nogc(&zv);
1422
1.31k
        break;
1423
1.31k
      }
1424
26
      SET_RESULT_BOT(op1);
1425
26
      SET_RESULT_BOT(result);
1426
26
      break;
1427
295
    case ZEND_POST_INC:
1428
312
    case ZEND_POST_DEC:
1429
312
      SKIP_IF_TOP(op1);
1430
312
      SET_RESULT(result, op1);
1431
312
      if (ct_eval_incdec(&zv, opline->opcode, op1) == SUCCESS) {
1432
310
        SET_RESULT(op1, &zv);
1433
310
        zval_ptr_dtor_nogc(&zv);
1434
310
        break;
1435
310
      }
1436
2
      SET_RESULT_BOT(op1);
1437
2
      break;
1438
146
    case ZEND_BW_NOT:
1439
354
    case ZEND_BOOL_NOT:
1440
354
      SKIP_IF_TOP(op1);
1441
354
      if (IS_PARTIAL_ARRAY(op1)) {
1442
10
        SET_RESULT_BOT(result);
1443
10
        break;
1444
10
      }
1445
344
      if (zend_optimizer_eval_unary_op(&zv, opline->opcode, op1) == SUCCESS) {
1446
250
        SET_RESULT(result, &zv);
1447
250
        zval_ptr_dtor_nogc(&zv);
1448
250
        break;
1449
250
      }
1450
94
      SET_RESULT_BOT(result);
1451
94
      break;
1452
294
    case ZEND_CAST:
1453
294
      SKIP_IF_TOP(op1);
1454
294
      if (IS_PARTIAL_ARRAY(op1)) {
1455
20
        SET_RESULT_BOT(result);
1456
20
        break;
1457
20
      }
1458
274
      if (zend_optimizer_eval_cast(&zv, opline->extended_value, op1) == SUCCESS) {
1459
4
        SET_RESULT(result, &zv);
1460
4
        zval_ptr_dtor_nogc(&zv);
1461
4
        break;
1462
4
      }
1463
270
      SET_RESULT_BOT(result);
1464
270
      break;
1465
49
    case ZEND_BOOL:
1466
57
    case ZEND_JMPZ_EX:
1467
115
    case ZEND_JMPNZ_EX:
1468
115
      SKIP_IF_TOP(op1);
1469
115
      if (ct_eval_bool_cast(&zv, op1) == SUCCESS) {
1470
115
        SET_RESULT(result, &zv);
1471
115
        zval_ptr_dtor_nogc(&zv);
1472
115
        break;
1473
115
      }
1474
0
      SET_RESULT_BOT(result);
1475
0
      break;
1476
2
    case ZEND_STRLEN:
1477
2
      SKIP_IF_TOP(op1);
1478
2
      if (zend_optimizer_eval_strlen(&zv, op1) == SUCCESS) {
1479
0
        SET_RESULT(result, &zv);
1480
0
        zval_ptr_dtor_nogc(&zv);
1481
0
        break;
1482
0
      }
1483
2
      SET_RESULT_BOT(result);
1484
2
      break;
1485
72
    case ZEND_YIELD_FROM:
1486
      // tmp = yield from [] -> tmp = null
1487
72
      SKIP_IF_TOP(op1);
1488
72
      if (Z_TYPE_P(op1) == IS_ARRAY && zend_hash_num_elements(Z_ARR_P(op1)) == 0) {
1489
14
        ZVAL_NULL(&zv);
1490
14
        SET_RESULT(result, &zv);
1491
14
        break;
1492
14
      }
1493
58
      SET_RESULT_BOT(result);
1494
58
      break;
1495
56
    case ZEND_COUNT:
1496
56
      SKIP_IF_TOP(op1);
1497
56
      if (Z_TYPE_P(op1) == IS_ARRAY) {
1498
6
        ZVAL_LONG(&zv, zend_hash_num_elements(Z_ARRVAL_P(op1)));
1499
6
        SET_RESULT(result, &zv);
1500
6
        zval_ptr_dtor_nogc(&zv);
1501
6
        break;
1502
6
      }
1503
50
      SET_RESULT_BOT(result);
1504
50
      break;
1505
0
    case ZEND_IN_ARRAY:
1506
0
      SKIP_IF_TOP(op1);
1507
0
      SKIP_IF_TOP(op2);
1508
0
      if (ct_eval_in_array(&zv, opline->extended_value, op1, op2) == SUCCESS) {
1509
0
        SET_RESULT(result, &zv);
1510
0
        zval_ptr_dtor_nogc(&zv);
1511
0
        break;
1512
0
      }
1513
0
      SET_RESULT_BOT(result);
1514
0
      break;
1515
0
    case ZEND_ARRAY_KEY_EXISTS:
1516
0
      SKIP_IF_TOP(op1);
1517
0
      SKIP_IF_TOP(op2);
1518
0
      if (ct_eval_array_key_exists(&zv, op1, op2) == SUCCESS) {
1519
0
        SET_RESULT(result, &zv);
1520
0
        zval_ptr_dtor_nogc(&zv);
1521
0
        break;
1522
0
      }
1523
0
      SET_RESULT_BOT(result);
1524
0
      break;
1525
349
    case ZEND_FETCH_DIM_R:
1526
363
    case ZEND_FETCH_DIM_IS:
1527
735
    case ZEND_FETCH_LIST_R:
1528
735
      SKIP_IF_TOP(op1);
1529
735
      SKIP_IF_TOP(op2);
1530
1531
735
      if (ct_eval_fetch_dim(&zv, op1, op2, (opline->opcode != ZEND_FETCH_LIST_R)) == SUCCESS) {
1532
532
        SET_RESULT(result, &zv);
1533
532
        zval_ptr_dtor_nogc(&zv);
1534
532
        break;
1535
532
      }
1536
203
      SET_RESULT_BOT(result);
1537
203
      break;
1538
37
    case ZEND_ISSET_ISEMPTY_DIM_OBJ:
1539
37
      SKIP_IF_TOP(op1);
1540
37
      SKIP_IF_TOP(op2);
1541
1542
37
      if (ct_eval_isset_dim(&zv, opline->extended_value, op1, op2) == SUCCESS) {
1543
37
        SET_RESULT(result, &zv);
1544
37
        zval_ptr_dtor_nogc(&zv);
1545
37
        break;
1546
37
      }
1547
0
      SET_RESULT_BOT(result);
1548
0
      break;
1549
2.09k
    case ZEND_FETCH_OBJ_R:
1550
2.27k
    case ZEND_FETCH_OBJ_IS:
1551
2.27k
      if (op1) {
1552
70
        SKIP_IF_TOP(op1);
1553
70
        SKIP_IF_TOP(op2);
1554
1555
70
        if (ct_eval_fetch_obj(&zv, op1, op2) == SUCCESS) {
1556
0
          SET_RESULT(result, &zv);
1557
0
          zval_ptr_dtor_nogc(&zv);
1558
0
          break;
1559
0
        }
1560
70
      }
1561
2.27k
      SET_RESULT_BOT(result);
1562
2.27k
      break;
1563
68
    case ZEND_ISSET_ISEMPTY_PROP_OBJ:
1564
68
      if (op1) {
1565
20
        SKIP_IF_TOP(op1);
1566
20
        SKIP_IF_TOP(op2);
1567
1568
20
        if (ct_eval_isset_obj(&zv, opline->extended_value, op1, op2) == SUCCESS) {
1569
20
          SET_RESULT(result, &zv);
1570
20
          zval_ptr_dtor_nogc(&zv);
1571
20
          break;
1572
20
        }
1573
20
      }
1574
48
      SET_RESULT_BOT(result);
1575
48
      break;
1576
4.05k
    case ZEND_QM_ASSIGN:
1577
4.43k
    case ZEND_JMP_SET:
1578
4.46k
    case ZEND_COALESCE:
1579
4.46k
    case ZEND_COPY_TMP:
1580
4.46k
      SET_RESULT(result, op1);
1581
4.46k
      break;
1582
44
    case ZEND_JMP_NULL:
1583
44
      switch (opline->extended_value & ZEND_SHORT_CIRCUITING_CHAIN_MASK) {
1584
44
        case ZEND_SHORT_CIRCUITING_CHAIN_EXPR:
1585
44
          ZVAL_NULL(&zv);
1586
44
          break;
1587
0
        case ZEND_SHORT_CIRCUITING_CHAIN_ISSET:
1588
0
          ZVAL_FALSE(&zv);
1589
0
          break;
1590
0
        case ZEND_SHORT_CIRCUITING_CHAIN_EMPTY:
1591
0
          ZVAL_TRUE(&zv);
1592
0
          break;
1593
44
        EMPTY_SWITCH_DEFAULT_CASE()
1594
44
      }
1595
44
      SET_RESULT(result, &zv);
1596
44
      break;
1597
62
    case ZEND_FETCH_CLASS:
1598
62
      SET_RESULT(result, op2);
1599
62
      break;
1600
4
    case ZEND_ISSET_ISEMPTY_CV:
1601
4
      SKIP_IF_TOP(op1);
1602
4
      if (ct_eval_isset_isempty(&zv, opline->extended_value, op1) == SUCCESS) {
1603
4
        SET_RESULT(result, &zv);
1604
4
        zval_ptr_dtor_nogc(&zv);
1605
4
        break;
1606
4
      }
1607
0
      SET_RESULT_BOT(result);
1608
0
      break;
1609
6
    case ZEND_TYPE_CHECK:
1610
6
      SKIP_IF_TOP(op1);
1611
6
      ct_eval_type_check(&zv, opline->extended_value, op1);
1612
6
      SET_RESULT(result, &zv);
1613
6
      zval_ptr_dtor_nogc(&zv);
1614
6
      break;
1615
4
    case ZEND_INSTANCEOF:
1616
4
      SKIP_IF_TOP(op1);
1617
4
      ZVAL_FALSE(&zv);
1618
4
      SET_RESULT(result, &zv);
1619
4
      break;
1620
10.6k
    case ZEND_ROPE_INIT:
1621
10.6k
      SKIP_IF_TOP(op2);
1622
10.6k
      if (IS_PARTIAL_ARRAY(op2)) {
1623
0
        SET_RESULT_BOT(result);
1624
0
        break;
1625
0
      }
1626
10.6k
      if (zend_optimizer_eval_cast(&zv, IS_STRING, op2) == SUCCESS) {
1627
10.6k
        SET_RESULT(result, &zv);
1628
10.6k
        zval_ptr_dtor_nogc(&zv);
1629
10.6k
        break;
1630
10.6k
      }
1631
0
      SET_RESULT_BOT(result);
1632
0
      break;
1633
23
    case ZEND_ROPE_ADD:
1634
40
    case ZEND_ROPE_END:
1635
      // TODO The way this is currently implemented will result in quadratic runtime
1636
      // This is not necessary, the way the algorithm works it's okay to reuse the same
1637
      // string for all SSA vars with some extra checks
1638
40
      SKIP_IF_TOP(op1);
1639
40
      SKIP_IF_TOP(op2);
1640
40
      if (ct_eval_binary_op(&zv, ZEND_CONCAT, op1, op2) == SUCCESS) {
1641
40
        SET_RESULT(result, &zv);
1642
40
        zval_ptr_dtor_nogc(&zv);
1643
40
        break;
1644
40
      }
1645
0
      SET_RESULT_BOT(result);
1646
0
      break;
1647
0
    case ZEND_DO_ICALL:
1648
0
    {
1649
0
      zend_call_info *call;
1650
0
      zval *name, *args[3] = {NULL};
1651
0
      int i;
1652
1653
0
      if (!ctx->call_map) {
1654
0
        SET_RESULT_BOT(result);
1655
0
        break;
1656
0
      }
1657
1658
0
      call = ctx->call_map[opline - ctx->scdf.op_array->opcodes];
1659
0
      name = CT_CONSTANT_EX(ctx->scdf.op_array, call->caller_init_opline->op2.constant);
1660
1661
      /* We already know it can't be evaluated, don't bother checking again */
1662
0
      if (ssa_op->result_def < 0 || IS_BOT(&ctx->values[ssa_op->result_def])) {
1663
0
        break;
1664
0
      }
1665
1666
      /* We're only interested in functions with up to three arguments right now.
1667
       * Note that named arguments with the argument in declaration order will still work. */
1668
0
      if (call->num_args > 3 || call->send_unpack || call->is_prototype || call->named_args) {
1669
0
        SET_RESULT_BOT(result);
1670
0
        break;
1671
0
      }
1672
1673
0
      for (i = 0; i < call->num_args; i++) {
1674
0
        zend_op *opline = call->arg_info[i].opline;
1675
0
        if (opline->opcode != ZEND_SEND_VAL && opline->opcode != ZEND_SEND_VAR) {
1676
0
          SET_RESULT_BOT(result);
1677
0
          return;
1678
0
        }
1679
1680
0
        args[i] = get_op1_value(ctx, opline,
1681
0
          &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes]);
1682
0
        if (args[i]) {
1683
0
          if (IS_BOT(args[i]) || IS_PARTIAL_ARRAY(args[i])) {
1684
0
            SET_RESULT_BOT(result);
1685
0
            return;
1686
0
          } else if (IS_TOP(args[i])) {
1687
0
            return;
1688
0
          }
1689
0
        }
1690
0
      }
1691
1692
      /* We didn't get a BOT argument, so value stays the same */
1693
0
      if (!IS_TOP(&ctx->values[ssa_op->result_def])) {
1694
0
        break;
1695
0
      }
1696
1697
0
      if (ct_eval_func_call(scdf->op_array, &zv, Z_STR_P(name), call->num_args, args) == SUCCESS) {
1698
0
        SET_RESULT(result, &zv);
1699
0
        zval_ptr_dtor_nogc(&zv);
1700
0
        break;
1701
0
      }
1702
1703
#if 0
1704
      /* sort out | uniq -c | sort -n */
1705
      fprintf(stderr, "%s\n", Z_STRVAL_P(name));
1706
      /*if (args[1]) {
1707
        php_printf("%s %Z %Z\n", Z_STRVAL_P(name), args[0], args[1]);
1708
      } else {
1709
        php_printf("%s %Z\n", Z_STRVAL_P(name), args[0]);
1710
      }*/
1711
#endif
1712
1713
0
      SET_RESULT_BOT(result);
1714
0
      break;
1715
0
    }
1716
0
    case ZEND_FRAMELESS_ICALL_0:
1717
0
    case ZEND_FRAMELESS_ICALL_1:
1718
0
    case ZEND_FRAMELESS_ICALL_2:
1719
0
    case ZEND_FRAMELESS_ICALL_3: {
1720
      /* We already know it can't be evaluated, don't bother checking again */
1721
0
      if (ssa_op->result_def < 0 || IS_BOT(&ctx->values[ssa_op->result_def])) {
1722
0
        break;
1723
0
      }
1724
1725
0
      zval *args[3] = {NULL};
1726
0
      zend_function *func = ZEND_FLF_FUNC(opline);
1727
0
      uint32_t num_args = ZEND_FLF_NUM_ARGS(opline->opcode);
1728
1729
0
      switch (num_args) {
1730
0
        case 3: {
1731
0
          zend_op *op_data = opline + 1;
1732
0
          args[2] = get_op1_value(ctx, op_data, &ctx->scdf.ssa->ops[op_data - ctx->scdf.op_array->opcodes]);
1733
0
          ZEND_FALLTHROUGH;
1734
0
        }
1735
0
        case 2:
1736
0
          args[1] = get_op2_value(ctx, opline, &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes]);
1737
0
          ZEND_FALLTHROUGH;
1738
0
        case 1:
1739
0
          args[0] = get_op1_value(ctx, opline, &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes]);
1740
0
          break;
1741
0
      }
1742
0
      for (uint32_t i = 0; i < num_args; i++) {
1743
0
        if (!args[i]) {
1744
0
          SET_RESULT_BOT(result);
1745
0
          return;
1746
0
        } else if (IS_BOT(args[i]) || IS_PARTIAL_ARRAY(args[i])) {
1747
0
          SET_RESULT_BOT(result);
1748
0
          return;
1749
0
        } else if (IS_TOP(args[i])) {
1750
0
          return;
1751
0
        }
1752
0
      }
1753
0
      if (ct_eval_func_call_ex(scdf->op_array, &zv, func, num_args, args) == SUCCESS) {
1754
0
        SET_RESULT(result, &zv);
1755
0
        zval_ptr_dtor_nogc(&zv);
1756
0
        break;
1757
0
      }
1758
0
      SET_RESULT_BOT(result);
1759
0
      break;
1760
0
    }
1761
428k
    default:
1762
428k
    {
1763
      /* If we have no explicit implementation return BOT */
1764
428k
      SET_RESULT_BOT(result);
1765
428k
      SET_RESULT_BOT(op1);
1766
428k
      SET_RESULT_BOT(op2);
1767
428k
      break;
1768
0
    }
1769
455k
  }
1770
455k
}
1771
1772
1.03M
static zval *value_from_type_and_range(sccp_ctx *ctx, int var_num, zval *tmp) {
1773
1.03M
  zend_ssa *ssa = ctx->scdf.ssa;
1774
1.03M
  zend_ssa_var_info *info = &ssa->var_info[var_num];
1775
1776
1.03M
  if (info->type & MAY_BE_UNDEF) {
1777
120k
    return NULL;
1778
120k
  }
1779
1780
917k
  if (!(info->type & MAY_BE_ANY)) {
1781
    /* This code must be unreachable. We could replace operands with NULL, but this doesn't
1782
     * really make things better. It would be better to later remove this code entirely. */
1783
7.65k
    return NULL;
1784
7.65k
  }
1785
1786
909k
  if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_NULL))) {
1787
51.7k
    if (ssa->vars[var_num].definition >= 0
1788
51.7k
     && ctx->scdf.op_array->opcodes[ssa->vars[var_num].definition].opcode == ZEND_VERIFY_RETURN_TYPE) {
1789
15
      return NULL;
1790
15
    }
1791
51.7k
    ZVAL_NULL(tmp);
1792
51.7k
    return tmp;
1793
51.7k
  }
1794
858k
  if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_FALSE))) {
1795
203
    if (ssa->vars[var_num].definition >= 0
1796
203
     && ctx->scdf.op_array->opcodes[ssa->vars[var_num].definition].opcode == ZEND_VERIFY_RETURN_TYPE) {
1797
6
      return NULL;
1798
6
    }
1799
197
    ZVAL_FALSE(tmp);
1800
197
    return tmp;
1801
203
  }
1802
857k
  if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_TRUE))) {
1803
717
    if (ssa->vars[var_num].definition >= 0
1804
717
     && ctx->scdf.op_array->opcodes[ssa->vars[var_num].definition].opcode == ZEND_VERIFY_RETURN_TYPE) {
1805
8
      return NULL;
1806
8
    }
1807
709
    ZVAL_TRUE(tmp);
1808
709
    return tmp;
1809
717
  }
1810
1811
857k
  if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_LONG))
1812
857k
      && info->has_range
1813
857k
      && !info->range.overflow && !info->range.underflow
1814
857k
      && info->range.min == info->range.max) {
1815
1.14k
    ZVAL_LONG(tmp, info->range.min);
1816
1.14k
    return tmp;
1817
1.14k
  }
1818
1819
856k
  return NULL;
1820
857k
}
1821
1822
1823
/* Returns whether there is a successor */
1824
static void sccp_mark_feasible_successors(
1825
    scdf_ctx *scdf,
1826
    int block_num, zend_basic_block *block,
1827
70.6k
    zend_op *opline, zend_ssa_op *ssa_op) {
1828
70.6k
  sccp_ctx *ctx = (sccp_ctx *) scdf;
1829
70.6k
  zval *op1, zv;
1830
70.6k
  int s;
1831
1832
  /* We can't determine the branch target at compile-time for these */
1833
70.6k
  switch (opline->opcode) {
1834
786
    case ZEND_ASSERT_CHECK:
1835
786
    case ZEND_CATCH:
1836
3.37k
    case ZEND_FE_FETCH_R:
1837
4.02k
    case ZEND_FE_FETCH_RW:
1838
4.18k
    case ZEND_BIND_INIT_STATIC_OR_JMP:
1839
4.18k
      scdf_mark_edge_feasible(scdf, block_num, block->successors[0]);
1840
4.18k
      scdf_mark_edge_feasible(scdf, block_num, block->successors[1]);
1841
4.18k
      return;
1842
70.6k
  }
1843
1844
66.5k
  op1 = get_op1_value(ctx, opline, ssa_op);
1845
66.5k
  if (IS_BOT(op1)) {
1846
63.3k
    ZEND_ASSERT(ssa_op->op1_use >= 0);
1847
63.3k
    op1 = value_from_type_and_range(ctx, ssa_op->op1_use, &zv);
1848
63.3k
  }
1849
1850
  /* Branch target can be either one */
1851
66.5k
  if (!op1 || IS_BOT(op1)) {
1852
190k
    for (s = 0; s < block->successors_count; s++) {
1853
126k
      scdf_mark_edge_feasible(scdf, block_num, block->successors[s]);
1854
126k
    }
1855
63.1k
    return;
1856
63.1k
  }
1857
1858
  /* Branch target not yet known */
1859
3.35k
  if (IS_TOP(op1)) {
1860
0
    return;
1861
0
  }
1862
1863
3.35k
  switch (opline->opcode) {
1864
378
    case ZEND_JMPZ:
1865
386
    case ZEND_JMPZ_EX:
1866
386
    {
1867
386
      if (ct_eval_bool_cast(&zv, op1) == FAILURE) {
1868
0
        scdf_mark_edge_feasible(scdf, block_num, block->successors[0]);
1869
0
        scdf_mark_edge_feasible(scdf, block_num, block->successors[1]);
1870
0
        return;
1871
0
      }
1872
386
      s = Z_TYPE(zv) == IS_TRUE;
1873
386
      break;
1874
386
    }
1875
2.02k
    case ZEND_JMPNZ:
1876
2.08k
    case ZEND_JMPNZ_EX:
1877
2.46k
    case ZEND_JMP_SET:
1878
2.46k
    {
1879
2.46k
      if (ct_eval_bool_cast(&zv, op1) == FAILURE) {
1880
0
        scdf_mark_edge_feasible(scdf, block_num, block->successors[0]);
1881
0
        scdf_mark_edge_feasible(scdf, block_num, block->successors[1]);
1882
0
        return;
1883
0
      }
1884
2.46k
      s = Z_TYPE(zv) == IS_FALSE;
1885
2.46k
      break;
1886
2.46k
    }
1887
169
    case ZEND_COALESCE:
1888
169
      s = (Z_TYPE_P(op1) == IS_NULL);
1889
169
      break;
1890
44
    case ZEND_JMP_NULL:
1891
44
      s = (Z_TYPE_P(op1) != IS_NULL);
1892
44
      break;
1893
258
    case ZEND_FE_RESET_R:
1894
277
    case ZEND_FE_RESET_RW:
1895
      /* A non-empty partial array is definitely non-empty, but an
1896
       * empty partial array may be non-empty at runtime. */
1897
277
      if (Z_TYPE_P(op1) != IS_ARRAY ||
1898
277
          (IS_PARTIAL_ARRAY(op1) && zend_hash_num_elements(Z_ARR_P(op1)) == 0)) {
1899
88
        scdf_mark_edge_feasible(scdf, block_num, block->successors[0]);
1900
88
        scdf_mark_edge_feasible(scdf, block_num, block->successors[1]);
1901
88
        return;
1902
88
      }
1903
189
      s = zend_hash_num_elements(Z_ARR_P(op1)) != 0;
1904
189
      break;
1905
0
    case ZEND_SWITCH_LONG:
1906
4
    case ZEND_SWITCH_STRING:
1907
20
    case ZEND_MATCH:
1908
20
    {
1909
20
      bool strict_comparison = opline->opcode == ZEND_MATCH;
1910
20
      uint8_t type = Z_TYPE_P(op1);
1911
20
      bool correct_type =
1912
20
        (opline->opcode == ZEND_SWITCH_LONG && type == IS_LONG)
1913
20
        || (opline->opcode == ZEND_SWITCH_STRING && type == IS_STRING)
1914
20
        || (opline->opcode == ZEND_MATCH && (type == IS_LONG || type == IS_STRING));
1915
1916
20
      if (correct_type) {
1917
12
        zend_op_array *op_array = scdf->op_array;
1918
12
        zend_ssa *ssa = scdf->ssa;
1919
12
        HashTable *jmptable = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant));
1920
12
        zval *jmp_zv = type == IS_LONG
1921
12
          ? zend_hash_index_find(jmptable, Z_LVAL_P(op1))
1922
12
          : zend_hash_find(jmptable, Z_STR_P(op1));
1923
12
        int target;
1924
1925
12
        if (jmp_zv) {
1926
10
          target = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(jmp_zv))];
1927
10
        } else {
1928
2
          target = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)];
1929
2
        }
1930
12
        scdf_mark_edge_feasible(scdf, block_num, target);
1931
12
        return;
1932
12
      } else if (strict_comparison) {
1933
4
        zend_op_array *op_array = scdf->op_array;
1934
4
        zend_ssa *ssa = scdf->ssa;
1935
4
        int target = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)];
1936
4
        scdf_mark_edge_feasible(scdf, block_num, target);
1937
4
        return;
1938
4
      }
1939
4
      s = block->successors_count - 1;
1940
4
      break;
1941
20
    }
1942
0
    default:
1943
0
      for (s = 0; s < block->successors_count; s++) {
1944
0
        scdf_mark_edge_feasible(scdf, block_num, block->successors[s]);
1945
0
      }
1946
0
      return;
1947
3.35k
  }
1948
3.25k
  scdf_mark_edge_feasible(scdf, block_num, block->successors[s]);
1949
3.25k
}
1950
1951
static void join_hash_tables(HashTable *ret, HashTable *ht1, HashTable *ht2)
1952
162
{
1953
162
  zend_ulong index;
1954
162
  zend_string *key;
1955
162
  zval *val1, *val2;
1956
1957
402
  ZEND_HASH_FOREACH_KEY_VAL(ht1, index, key, val1) {
1958
402
    if (key) {
1959
34
      val2 = zend_hash_find(ht2, key);
1960
86
    } else {
1961
86
      val2 = zend_hash_index_find(ht2, index);
1962
86
    }
1963
402
    if (val2 && zend_is_identical(val1, val2)) {
1964
32
      if (key) {
1965
16
        val1 = zend_hash_add_new(ret, key, val1);
1966
16
      } else {
1967
16
        val1 = zend_hash_index_add_new(ret, index, val1);
1968
16
      }
1969
32
      Z_TRY_ADDREF_P(val1);
1970
32
    }
1971
402
  } ZEND_HASH_FOREACH_END();
1972
162
}
1973
1974
static zend_result join_partial_arrays(zval *a, zval *b)
1975
2.92k
{
1976
2.92k
  zval ret;
1977
1978
2.92k
  if ((Z_TYPE_P(a) != IS_ARRAY && !IS_PARTIAL_ARRAY(a))
1979
2.92k
      || (Z_TYPE_P(b) != IS_ARRAY && !IS_PARTIAL_ARRAY(b))) {
1980
2.76k
    return FAILURE;
1981
2.76k
  }
1982
1983
162
  empty_partial_array(&ret);
1984
162
  join_hash_tables(Z_ARRVAL(ret), Z_ARRVAL_P(a), Z_ARRVAL_P(b));
1985
162
  zval_ptr_dtor_nogc(a);
1986
162
  ZVAL_COPY_VALUE(a, &ret);
1987
1988
162
  return SUCCESS;
1989
2.92k
}
1990
1991
static zend_result join_partial_objects(zval *a, zval *b)
1992
0
{
1993
0
  zval ret;
1994
1995
0
  if (!IS_PARTIAL_OBJECT(a) || !IS_PARTIAL_OBJECT(b)) {
1996
0
    return FAILURE;
1997
0
  }
1998
1999
0
  empty_partial_object(&ret);
2000
0
  join_hash_tables(Z_ARRVAL(ret), Z_ARRVAL_P(a), Z_ARRVAL_P(b));
2001
0
  zval_ptr_dtor_nogc(a);
2002
0
  ZVAL_COPY_VALUE(a, &ret);
2003
2004
0
  return SUCCESS;
2005
0
}
2006
2007
283k
static void join_phi_values(zval *a, zval *b, bool escape) {
2008
283k
  if (IS_BOT(a) || IS_TOP(b)) {
2009
97.5k
    return;
2010
97.5k
  }
2011
185k
  if (IS_TOP(a)) {
2012
180k
    zval_ptr_dtor_nogc(a);
2013
180k
    ZVAL_COPY(a, b);
2014
180k
    return;
2015
180k
  }
2016
4.84k
  if (IS_BOT(b)) {
2017
1.11k
    zval_ptr_dtor_nogc(a);
2018
1.11k
    MAKE_BOT(a);
2019
1.11k
    return;
2020
1.11k
  }
2021
3.72k
  if (IS_PARTIAL_ARRAY(a) || IS_PARTIAL_ARRAY(b)) {
2022
139
    if (join_partial_arrays(a, b) == FAILURE) {
2023
0
      zval_ptr_dtor_nogc(a);
2024
0
      MAKE_BOT(a);
2025
0
    }
2026
3.58k
  } else if (IS_PARTIAL_OBJECT(a) || IS_PARTIAL_OBJECT(b)) {
2027
0
    if (escape || join_partial_objects(a, b) == FAILURE) {
2028
0
      zval_ptr_dtor_nogc(a);
2029
0
      MAKE_BOT(a);
2030
0
    }
2031
3.58k
  } else if (!zend_is_identical(a, b)) {
2032
2.78k
    if (join_partial_arrays(a, b) == FAILURE) {
2033
2.76k
      zval_ptr_dtor_nogc(a);
2034
2.76k
      MAKE_BOT(a);
2035
2.76k
    }
2036
2.78k
  }
2037
3.72k
}
2038
2039
205k
static void sccp_visit_phi(scdf_ctx *scdf, zend_ssa_phi *phi) {
2040
205k
  sccp_ctx *ctx = (sccp_ctx *) scdf;
2041
205k
  zend_ssa *ssa = scdf->ssa;
2042
205k
  ZEND_ASSERT(phi->ssa_var >= 0);
2043
205k
  if (!IS_BOT(&ctx->values[phi->ssa_var])) {
2044
181k
    zend_basic_block *block = &ssa->cfg.blocks[phi->block];
2045
181k
    int *predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
2046
2047
181k
    int i;
2048
181k
    zval result;
2049
181k
    MAKE_TOP(&result);
2050
#if SCP_DEBUG
2051
    fprintf(stderr, "Handling phi(");
2052
#endif
2053
181k
    if (phi->pi >= 0) {
2054
56.7k
      ZEND_ASSERT(phi->sources[0] >= 0);
2055
56.7k
      if (scdf_is_edge_feasible(scdf, phi->pi, phi->block)) {
2056
55.9k
        join_phi_values(&result, &ctx->values[phi->sources[0]], ssa->vars[phi->ssa_var].escape_state != ESCAPE_STATE_NO_ESCAPE);
2057
55.9k
      }
2058
124k
    } else {
2059
378k
      for (i = 0; i < block->predecessors_count; i++) {
2060
253k
        ZEND_ASSERT(phi->sources[i] >= 0);
2061
253k
        if (scdf_is_edge_feasible(scdf, predecessors[i], phi->block)) {
2062
#if SCP_DEBUG
2063
          scp_dump_value(&ctx->values[phi->sources[i]]);
2064
          fprintf(stderr, ",");
2065
#endif
2066
227k
          join_phi_values(&result, &ctx->values[phi->sources[i]], ssa->vars[phi->ssa_var].escape_state != ESCAPE_STATE_NO_ESCAPE);
2067
227k
        } else {
2068
#if SCP_DEBUG
2069
          fprintf(stderr, " --,");
2070
#endif
2071
26.4k
        }
2072
253k
      }
2073
124k
    }
2074
#if SCP_DEBUG
2075
    fprintf(stderr, ")\n");
2076
#endif
2077
2078
181k
    set_value(scdf, ctx, phi->ssa_var, &result);
2079
181k
    zval_ptr_dtor_nogc(&result);
2080
181k
  }
2081
205k
}
2082
2083
/* Call instruction -> remove opcodes that are part of the call */
2084
static int remove_call(sccp_ctx *ctx, zend_op *opline, zend_ssa_op *ssa_op)
2085
0
{
2086
0
  zend_ssa *ssa = ctx->scdf.ssa;
2087
0
  zend_op_array *op_array = ctx->scdf.op_array;
2088
0
  zend_call_info *call;
2089
0
  int i;
2090
2091
0
  ZEND_ASSERT(ctx->call_map);
2092
0
  call = ctx->call_map[opline - op_array->opcodes];
2093
0
  ZEND_ASSERT(call);
2094
0
  ZEND_ASSERT(call->caller_call_opline == opline);
2095
0
  zend_ssa_remove_instr(ssa, opline, ssa_op);
2096
0
  zend_ssa_remove_instr(ssa, call->caller_init_opline,
2097
0
    &ssa->ops[call->caller_init_opline - op_array->opcodes]);
2098
2099
0
  for (i = 0; i < call->num_args; i++) {
2100
0
    zend_ssa_remove_instr(ssa, call->arg_info[i].opline,
2101
0
      &ssa->ops[call->arg_info[i].opline - op_array->opcodes]);
2102
0
  }
2103
2104
  // TODO: remove call_info completely???
2105
0
  call->callee_func = NULL;
2106
2107
0
  return call->num_args + 2;
2108
0
}
2109
2110
/* This is a basic DCE pass we run after SCCP. It only works on those instructions those result
2111
 * value(s) were determined by SCCP. It removes dead computational instructions and converts
2112
 * CV-affecting instructions into CONST ASSIGNs. This basic DCE is performed for multiple reasons:
2113
 * a) During operand replacement we eliminate FREEs. The corresponding computational instructions
2114
 *    must be removed to avoid leaks. This way SCCP can run independently of the full DCE pass.
2115
 * b) The main DCE pass relies on type analysis to determine whether instructions have side-effects
2116
 *    and can't be DCEd. This means that it will not be able collect all instructions rendered dead
2117
 *    by SCCP, because they may have potentially side-effecting types, but the actual values are
2118
 *    not. As such doing DCE here will allow us to eliminate more dead code in combination.
2119
 * c) The ordinary DCE pass cannot collect dead calls. However SCCP can result in dead calls, which
2120
 *    we need to collect.
2121
 * d) The ordinary DCE pass cannot collect construction of dead non-escaping arrays and objects.
2122
 */
2123
static int try_remove_definition(sccp_ctx *ctx, int var_num, zend_ssa_var *var, zval *value)
2124
43.1k
{
2125
43.1k
  zend_ssa *ssa = ctx->scdf.ssa;
2126
43.1k
  zend_op_array *op_array = ctx->scdf.op_array;
2127
43.1k
  int removed_ops = 0;
2128
2129
43.1k
  if (var->definition >= 0) {
2130
41.5k
    zend_op *opline = &op_array->opcodes[var->definition];
2131
41.5k
    zend_ssa_op *ssa_op = &ssa->ops[var->definition];
2132
2133
41.5k
    if (ssa_op->result_def == var_num) {
2134
34.8k
      if (opline->opcode == ZEND_ASSIGN) {
2135
        /* We can't drop the ASSIGN, but we can remove the result. */
2136
650
        if (var->use_chain < 0 && var->phi_use_chain == NULL) {
2137
616
          opline->result_type = IS_UNUSED;
2138
616
          zend_ssa_remove_result_def(ssa, ssa_op);
2139
616
        }
2140
650
        return 0;
2141
650
      }
2142
34.1k
      if (ssa_op->op1_def >= 0 || ssa_op->op2_def >= 0) {
2143
353
        if (var->use_chain < 0 && var->phi_use_chain == NULL) {
2144
265
          switch (opline->opcode) {
2145
0
            case ZEND_ASSIGN:
2146
0
            case ZEND_ASSIGN_REF:
2147
200
            case ZEND_ASSIGN_DIM:
2148
202
            case ZEND_ASSIGN_OBJ:
2149
202
            case ZEND_ASSIGN_OBJ_REF:
2150
202
            case ZEND_ASSIGN_STATIC_PROP:
2151
202
            case ZEND_ASSIGN_STATIC_PROP_REF:
2152
245
            case ZEND_ASSIGN_OP:
2153
245
            case ZEND_ASSIGN_DIM_OP:
2154
245
            case ZEND_ASSIGN_OBJ_OP:
2155
245
            case ZEND_ASSIGN_STATIC_PROP_OP:
2156
257
            case ZEND_PRE_INC:
2157
257
            case ZEND_PRE_DEC:
2158
257
            case ZEND_PRE_INC_OBJ:
2159
257
            case ZEND_PRE_DEC_OBJ:
2160
257
            case ZEND_DO_ICALL:
2161
257
            case ZEND_DO_UCALL:
2162
257
            case ZEND_DO_FCALL_BY_NAME:
2163
257
            case ZEND_DO_FCALL:
2164
257
            case ZEND_INCLUDE_OR_EVAL:
2165
257
            case ZEND_YIELD:
2166
257
            case ZEND_YIELD_FROM:
2167
257
            case ZEND_ASSERT_CHECK:
2168
257
              opline->result_type = IS_UNUSED;
2169
257
              zend_ssa_remove_result_def(ssa, ssa_op);
2170
257
              break;
2171
8
            default:
2172
8
              break;
2173
265
          }
2174
265
        }
2175
        /* we cannot remove instruction that defines other variables */
2176
353
        return 0;
2177
33.8k
      } else if (opline->opcode == ZEND_JMPZ_EX
2178
33.8k
          || opline->opcode == ZEND_JMPNZ_EX
2179
33.8k
          || opline->opcode == ZEND_JMP_SET
2180
33.8k
          || opline->opcode == ZEND_COALESCE
2181
33.8k
          || opline->opcode == ZEND_JMP_NULL
2182
33.8k
          || opline->opcode == ZEND_FE_RESET_R
2183
33.8k
          || opline->opcode == ZEND_FE_RESET_RW
2184
33.8k
          || opline->opcode == ZEND_FE_FETCH_R
2185
33.8k
          || opline->opcode == ZEND_FE_FETCH_RW
2186
33.8k
          || opline->opcode == ZEND_NEW) {
2187
        /* we cannot simple remove jump instructions */
2188
494
        return 0;
2189
33.3k
      } else if (var->use_chain >= 0
2190
33.3k
          || var->phi_use_chain != NULL) {
2191
31.0k
        if (value
2192
31.0k
            && (opline->result_type & (IS_VAR|IS_TMP_VAR))
2193
31.0k
            && opline->opcode != ZEND_QM_ASSIGN
2194
31.0k
            && opline->opcode != ZEND_FETCH_CLASS
2195
31.0k
            && opline->opcode != ZEND_ROPE_INIT
2196
31.0k
            && opline->opcode != ZEND_ROPE_ADD
2197
31.0k
            && opline->opcode != ZEND_INIT_ARRAY
2198
31.0k
            && opline->opcode != ZEND_ADD_ARRAY_ELEMENT
2199
31.0k
            && opline->opcode != ZEND_ADD_ARRAY_UNPACK) {
2200
          /* Replace with QM_ASSIGN */
2201
8
          uint8_t old_type = opline->result_type;
2202
8
          uint32_t old_var = opline->result.var;
2203
2204
8
          ssa_op->result_def = -1;
2205
8
          if (opline->opcode == ZEND_DO_ICALL) {
2206
0
            removed_ops = remove_call(ctx, opline, ssa_op) - 1;
2207
8
          } else {
2208
8
            bool has_op_data = opline->opcode == ZEND_FRAMELESS_ICALL_3;
2209
8
            zend_ssa_remove_instr(ssa, opline, ssa_op);
2210
8
            removed_ops++;
2211
8
            if (has_op_data) {
2212
0
              zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1);
2213
0
              removed_ops++;
2214
0
            }
2215
8
          }
2216
8
          ssa_op->result_def = var_num;
2217
8
          opline->opcode = ZEND_QM_ASSIGN;
2218
8
          opline->result_type = old_type;
2219
8
          opline->result.var = old_var;
2220
8
          Z_TRY_ADDREF_P(value);
2221
8
          zend_optimizer_update_op1_const(ctx->scdf.op_array, opline, value);
2222
8
        }
2223
31.0k
        return 0;
2224
31.0k
      } else if ((opline->op2_type & (IS_VAR|IS_TMP_VAR))
2225
2.24k
          && (!value_known(&ctx->values[ssa_op->op2_use])
2226
97
            || IS_PARTIAL_ARRAY(&ctx->values[ssa_op->op2_use])
2227
97
            || IS_PARTIAL_OBJECT(&ctx->values[ssa_op->op2_use]))) {
2228
0
        return 0;
2229
2.24k
      } else if ((opline->op1_type & (IS_VAR|IS_TMP_VAR))
2230
2.24k
          && (!value_known(&ctx->values[ssa_op->op1_use])
2231
451
            || IS_PARTIAL_ARRAY(&ctx->values[ssa_op->op1_use])
2232
451
            || IS_PARTIAL_OBJECT(&ctx->values[ssa_op->op1_use]))) {
2233
10
        if (opline->opcode == ZEND_TYPE_CHECK
2234
10
         || opline->opcode == ZEND_BOOL) {
2235
8
          zend_ssa_remove_result_def(ssa, ssa_op);
2236
          /* For TYPE_CHECK we may compute the result value without knowing the
2237
           * operand, based on type inference information. Make sure the operand is
2238
           * freed and leave further cleanup to DCE. */
2239
8
          opline->opcode = ZEND_FREE;
2240
8
          opline->result_type = IS_UNUSED;
2241
8
          removed_ops++;
2242
8
        } else {
2243
2
          return 0;
2244
2
        }
2245
2.23k
      } else {
2246
2.23k
        zend_ssa_remove_result_def(ssa, ssa_op);
2247
2.23k
        if (opline->opcode == ZEND_DO_ICALL) {
2248
0
          removed_ops = remove_call(ctx, opline, ssa_op);
2249
2.23k
        } else {
2250
2.23k
          bool has_op_data = opline->opcode == ZEND_FRAMELESS_ICALL_3;
2251
2.23k
          zend_ssa_remove_instr(ssa, opline, ssa_op);
2252
2.23k
          removed_ops++;
2253
2.23k
          if (has_op_data) {
2254
0
            zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1);
2255
0
            removed_ops++;
2256
0
          }
2257
2.23k
        }
2258
2.23k
      }
2259
34.1k
    } else if (ssa_op->op1_def == var_num) {
2260
6.75k
      if (opline->opcode == ZEND_ASSIGN) {
2261
        /* Leave assigns to DCE (due to dtor effects) */
2262
6.10k
        return 0;
2263
6.10k
      }
2264
2265
      /* Compound assign or incdec -> convert to direct ASSIGN */
2266
2267
648
      if (!value) {
2268
        /* In some cases zend_may_throw() may be avoided */
2269
256
        switch (opline->opcode) {
2270
154
          case ZEND_ASSIGN_DIM:
2271
256
          case ZEND_ASSIGN_OBJ:
2272
256
          case ZEND_ASSIGN_OP:
2273
256
          case ZEND_ASSIGN_DIM_OP:
2274
256
          case ZEND_ASSIGN_OBJ_OP:
2275
256
          case ZEND_ASSIGN_STATIC_PROP_OP:
2276
256
            if ((ssa_op->op2_use >= 0 && !value_known(&ctx->values[ssa_op->op2_use]))
2277
256
                || ((ssa_op+1)->op1_use >= 0 &&!value_known(&ctx->values[(ssa_op+1)->op1_use]))) {
2278
184
              return 0;
2279
184
            }
2280
72
            break;
2281
72
          case ZEND_PRE_INC_OBJ:
2282
0
          case ZEND_PRE_DEC_OBJ:
2283
0
          case ZEND_POST_INC_OBJ:
2284
0
          case ZEND_POST_DEC_OBJ:
2285
0
            if (ssa_op->op2_use >= 0 && !value_known(&ctx->values[ssa_op->op2_use])) {
2286
0
              return 0;
2287
0
            }
2288
0
            break;
2289
0
          case ZEND_INIT_ARRAY:
2290
0
          case ZEND_ADD_ARRAY_ELEMENT:
2291
0
            if (opline->op2_type == IS_UNUSED) {
2292
0
              return 0;
2293
0
            }
2294
            /* break missing intentionally */
2295
0
          default:
2296
0
            if (zend_may_throw(opline, ssa_op, op_array, ssa)) {
2297
0
              return 0;
2298
0
            }
2299
0
            break;
2300
256
        }
2301
256
      }
2302
2303
      /* Mark result unused, if possible */
2304
464
      if (ssa_op->result_def >= 0) {
2305
12
        if (ssa->vars[ssa_op->result_def].use_chain < 0
2306
12
            && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
2307
6
          zend_ssa_remove_result_def(ssa, ssa_op);
2308
6
          opline->result_type = IS_UNUSED;
2309
6
        } else if (opline->opcode != ZEND_PRE_INC &&
2310
6
            opline->opcode != ZEND_PRE_DEC) {
2311
          /* op1_def and result_def are different */
2312
6
          return removed_ops;
2313
6
        }
2314
12
      }
2315
2316
      /* Destroy previous op2 */
2317
458
      if (opline->op2_type == IS_CONST) {
2318
224
        literal_dtor(&ZEND_OP2_LITERAL(opline));
2319
234
      } else if (ssa_op->op2_use >= 0) {
2320
94
        if (ssa_op->op2_use != ssa_op->op1_use) {
2321
73
          zend_ssa_unlink_use_chain(ssa, var->definition, ssa_op->op2_use);
2322
73
        }
2323
94
        ssa_op->op2_use = -1;
2324
94
        ssa_op->op2_use_chain = -1;
2325
94
      }
2326
2327
      /* Remove OP_DATA opcode */
2328
458
      switch (opline->opcode) {
2329
210
        case ZEND_ASSIGN_DIM:
2330
266
        case ZEND_ASSIGN_OBJ:
2331
266
          removed_ops++;
2332
266
          zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1);
2333
266
          break;
2334
10
        case ZEND_ASSIGN_DIM_OP:
2335
10
        case ZEND_ASSIGN_OBJ_OP:
2336
10
        case ZEND_ASSIGN_STATIC_PROP_OP:
2337
10
          removed_ops++;
2338
10
          zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1);
2339
10
          break;
2340
182
        default:
2341
182
          break;
2342
458
      }
2343
2344
458
      if (value) {
2345
        /* Convert to ASSIGN */
2346
386
        opline->opcode = ZEND_ASSIGN;
2347
386
        opline->op2_type = IS_CONST;
2348
386
        opline->op2.constant = zend_optimizer_add_literal(op_array, value);
2349
386
        Z_TRY_ADDREF_P(value);
2350
386
      } else {
2351
        /* Remove dead array or object construction */
2352
72
        removed_ops++;
2353
72
        if (var->use_chain >= 0 || var->phi_use_chain != NULL) {
2354
46
          zend_ssa_rename_var_uses(ssa, ssa_op->op1_def, ssa_op->op1_use, 1);
2355
46
        }
2356
72
        zend_ssa_remove_op1_def(ssa, ssa_op);
2357
72
        zend_ssa_remove_instr(ssa, opline, ssa_op);
2358
72
      }
2359
458
    }
2360
41.5k
  } else if (var->definition_phi
2361
1.60k
      && var->use_chain < 0
2362
1.60k
      && var->phi_use_chain == NULL) {
2363
593
    zend_ssa_remove_phi(ssa, var->definition_phi);
2364
593
  }
2365
4.30k
  return removed_ops;
2366
43.1k
}
2367
2368
/* This will try to replace uses of SSA variables we have determined to be constant. Not all uses
2369
 * can be replaced, because some instructions don't accept constant operands or only accept them
2370
 * if they have a certain type. */
2371
74.1k
static int replace_constant_operands(sccp_ctx *ctx) {
2372
74.1k
  zend_ssa *ssa = ctx->scdf.ssa;
2373
74.1k
  zend_op_array *op_array = ctx->scdf.op_array;
2374
74.1k
  int i;
2375
74.1k
  zval tmp;
2376
74.1k
  int removed_ops = 0;
2377
2378
  /* We iterate the variables backwards, so we can eliminate sequences like INIT_ROPE
2379
   * and INIT_ARRAY. */
2380
1.09M
  for (i = ssa->vars_count - 1; i >= op_array->last_var; i--) {
2381
1.02M
    zend_ssa_var *var = &ssa->vars[i];
2382
1.02M
    zval *value;
2383
1.02M
    int use;
2384
2385
1.02M
    if (IS_PARTIAL_ARRAY(&ctx->values[i])
2386
1.02M
        || IS_PARTIAL_OBJECT(&ctx->values[i])) {
2387
6.10k
      if (!Z_DELREF(ctx->values[i])) {
2388
5.52k
        zend_array_destroy(Z_ARR(ctx->values[i]));
2389
5.52k
      }
2390
6.10k
      MAKE_BOT(&ctx->values[i]);
2391
6.10k
      if ((var->use_chain < 0 && var->phi_use_chain == NULL) || var->no_val) {
2392
404
        removed_ops += try_remove_definition(ctx, i, var, NULL);
2393
404
      }
2394
6.10k
      continue;
2395
1.01M
    } else if (value_known(&ctx->values[i])) {
2396
42.7k
      value = &ctx->values[i];
2397
974k
    } else {
2398
974k
      value = value_from_type_and_range(ctx, i, &tmp);
2399
974k
      if (!value) {
2400
920k
        continue;
2401
920k
      }
2402
974k
    }
2403
2404
135k
    FOREACH_USE(var, use) {
2405
135k
      zend_op *opline = &op_array->opcodes[use];
2406
135k
      zend_ssa_op *ssa_op = &ssa->ops[use];
2407
135k
      if (try_replace_op1(ctx, opline, ssa_op, i, value)) {
2408
4.72k
        if (opline->opcode == ZEND_NOP) {
2409
801
          removed_ops++;
2410
801
        }
2411
4.72k
        ZEND_ASSERT(ssa_op->op1_def == -1);
2412
4.72k
        if (ssa_op->op1_use != ssa_op->op2_use) {
2413
4.72k
          zend_ssa_unlink_use_chain(ssa, use, ssa_op->op1_use);
2414
4.72k
        } else {
2415
0
          ssa_op->op2_use_chain = ssa_op->op1_use_chain;
2416
0
        }
2417
4.72k
        ssa_op->op1_use = -1;
2418
4.72k
        ssa_op->op1_use_chain = -1;
2419
4.72k
      }
2420
38.8k
      if (try_replace_op2(ctx, opline, ssa_op, i, value)) {
2421
4.23k
        ZEND_ASSERT(ssa_op->op2_def == -1);
2422
4.23k
        if (ssa_op->op2_use != ssa_op->op1_use) {
2423
4.17k
          zend_ssa_unlink_use_chain(ssa, use, ssa_op->op2_use);
2424
4.17k
        }
2425
4.23k
        ssa_op->op2_use = -1;
2426
4.23k
        ssa_op->op2_use_chain = -1;
2427
4.23k
      }
2428
38.8k
    } FOREACH_USE_END();
2429
2430
96.3k
    if (value_known(&ctx->values[i])) {
2431
42.7k
      removed_ops += try_remove_definition(ctx, i, var, value);
2432
42.7k
    }
2433
96.3k
  }
2434
2435
74.1k
  return removed_ops;
2436
74.1k
}
2437
2438
static void sccp_context_init(zend_optimizer_ctx *ctx, sccp_ctx *sccp,
2439
74.1k
    zend_ssa *ssa, zend_op_array *op_array, zend_call_info **call_map) {
2440
74.1k
  int i;
2441
74.1k
  sccp->call_map = call_map;
2442
74.1k
  sccp->values = zend_arena_alloc(&ctx->arena, sizeof(zval) * ssa->vars_count);
2443
2444
74.1k
  MAKE_TOP(&sccp->top);
2445
74.1k
  MAKE_BOT(&sccp->bot);
2446
2447
74.1k
  i = 0;
2448
178k
  for (; i < op_array->last_var; ++i) {
2449
    /* These are all undefined variables, which we have to mark BOT.
2450
     * Otherwise the undefined variable warning might not be preserved. */
2451
104k
    MAKE_BOT(&sccp->values[i]);
2452
104k
  }
2453
1.09M
  for (; i < ssa->vars_count; ++i) {
2454
1.02M
    if (ssa->vars[i].alias) {
2455
0
      MAKE_BOT(&sccp->values[i]);
2456
1.02M
    } else {
2457
1.02M
      MAKE_TOP(&sccp->values[i]);
2458
1.02M
    }
2459
1.02M
  }
2460
74.1k
}
2461
2462
74.1k
static void sccp_context_free(sccp_ctx *sccp) {
2463
74.1k
  int i;
2464
1.09M
  for (i = sccp->scdf.op_array->last_var; i < sccp->scdf.ssa->vars_count; ++i) {
2465
1.02M
    zval_ptr_dtor_nogc(&sccp->values[i]);
2466
1.02M
  }
2467
74.1k
}
2468
2469
int sccp_optimize_op_array(zend_optimizer_ctx *ctx, zend_op_array *op_array, zend_ssa *ssa, zend_call_info **call_map)
2470
74.1k
{
2471
74.1k
  sccp_ctx sccp;
2472
74.1k
  int removed_ops = 0;
2473
74.1k
  void *checkpoint = zend_arena_checkpoint(ctx->arena);
2474
2475
74.1k
  sccp_context_init(ctx, &sccp, ssa, op_array, call_map);
2476
2477
74.1k
  sccp.scdf.handlers.visit_instr = sccp_visit_instr;
2478
74.1k
  sccp.scdf.handlers.visit_phi = sccp_visit_phi;
2479
74.1k
  sccp.scdf.handlers.mark_feasible_successors = sccp_mark_feasible_successors;
2480
2481
74.1k
  scdf_init(ctx, &sccp.scdf, op_array, ssa);
2482
74.1k
  scdf_solve(&sccp.scdf, "SCCP");
2483
2484
74.1k
  if (ctx->debug_level & ZEND_DUMP_SCCP) {
2485
0
    int i, first = 1;
2486
2487
0
    for (i = op_array->last_var; i < ssa->vars_count; i++) {
2488
0
      zval *zv = &sccp.values[i];
2489
2490
0
      if (IS_TOP(zv) || IS_BOT(zv)) {
2491
0
        continue;
2492
0
      }
2493
0
      if (first) {
2494
0
        first = 0;
2495
0
        fprintf(stderr, "\nSCCP Values for \"");
2496
0
        zend_dump_op_array_name(op_array);
2497
0
        fprintf(stderr, "\":\n");
2498
0
      }
2499
0
      fprintf(stderr, "    #%d.", i);
2500
0
      zend_dump_var(op_array, IS_CV, ssa->vars[i].var);
2501
0
      fprintf(stderr, " =");
2502
0
      scp_dump_value(zv);
2503
0
      fprintf(stderr, "\n");
2504
0
    }
2505
0
  }
2506
2507
74.1k
  removed_ops += scdf_remove_unreachable_blocks(&sccp.scdf);
2508
74.1k
  removed_ops += replace_constant_operands(&sccp);
2509
2510
74.1k
  sccp_context_free(&sccp);
2511
74.1k
  zend_arena_release(&ctx->arena, checkpoint);
2512
2513
74.1k
  return removed_ops;
2514
74.1k
}