/src/php-src/Zend/Optimizer/sccp.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | +----------------------------------------------------------------------+ |
3 | | | Zend Engine, SCCP - Sparse Conditional Constant Propagation | |
4 | | +----------------------------------------------------------------------+ |
5 | | | Copyright (c) The PHP Group | |
6 | | +----------------------------------------------------------------------+ |
7 | | | This source file is subject to version 3.01 of the PHP license, | |
8 | | | that is bundled with this package in the file LICENSE, and is | |
9 | | | available through the world-wide-web at the following url: | |
10 | | | https://www.php.net/license/3_01.txt | |
11 | | | If you did not receive a copy of the PHP license and are unable to | |
12 | | | obtain it through the world-wide-web, please send a note to | |
13 | | | license@php.net so we can mail you a copy immediately. | |
14 | | +----------------------------------------------------------------------+ |
15 | | | Authors: Nikita Popov <nikic@php.net> | |
16 | | | Dmitry Stogov <dmitry@php.net> | |
17 | | +----------------------------------------------------------------------+ |
18 | | */ |
19 | | |
20 | | #include "zend_API.h" |
21 | | #include "zend_exceptions.h" |
22 | | #include "zend_ini.h" |
23 | | #include "zend_type_info.h" |
24 | | #include "Optimizer/zend_optimizer_internal.h" |
25 | | #include "Optimizer/zend_call_graph.h" |
26 | | #include "Optimizer/zend_inference.h" |
27 | | #include "Optimizer/scdf.h" |
28 | | #include "Optimizer/zend_dump.h" |
29 | | |
30 | | /* This implements sparse conditional constant propagation (SCCP) based on the SCDF framework. The |
31 | | * used value lattice is defined as follows: |
32 | | * |
33 | | * BOT < {constant values} < TOP |
34 | | * |
35 | | * TOP indicates an underdefined value, i.e. that we do not yet know the value of variable. |
36 | | * BOT indicates an overdefined value, i.e. that we know the variable to be non-constant. |
37 | | * |
38 | | * All variables are optimistically initialized to TOP, apart from the implicit variables defined |
39 | | * at the start of the first block. Note that variables that MAY_BE_REF are *not* initialized to |
40 | | * BOT. We rely on the fact that any operation resulting in a reference will produce a BOT anyway. |
41 | | * This is better because such operations might never be reached due to the conditional nature of |
42 | | * the algorithm. |
43 | | * |
44 | | * The meet operation for phi functions is defined as follows: |
45 | | * BOT + any = BOT |
46 | | * TOP + any = any |
47 | | * C_i + C_i = C_i (i.e. two equal constants) |
48 | | * C_i + C_j = BOT (i.e. two different constants) |
49 | | * |
50 | | * When evaluating instructions TOP and BOT are handled as follows: |
51 | | * a) If any operand is BOT, the result is BOT. The main exception to this is op1 of ASSIGN, which |
52 | | * is ignored. However, if the op1 MAY_BE_REF we do have to propagate the BOT. |
53 | | * b) Otherwise, if the instruction can never be evaluated (either in general, or with the |
54 | | * specific modifiers) the result is BOT. |
55 | | * c) Otherwise, if any operand is TOP, the result is TOP. |
56 | | * d) Otherwise (at this point all operands are known and constant), if we can compute the result |
57 | | * for these specific constants (without throwing notices or similar) then that is the result. |
58 | | * e) Otherwise the result is BOT. |
59 | | * |
60 | | * It is sometimes possible to determine a result even if one argument is TOP / BOT, e.g. for things |
61 | | * like BOT*0. Right now we don't bother with this. |
62 | | * |
63 | | * Feasible successors for conditional branches are determined as follows: |
64 | | * a) If we don't support the branch type or branch on BOT, all successors are feasible. |
65 | | * b) Otherwise, if we branch on TOP none of the successors are feasible. |
66 | | * c) Otherwise (we branch on a constant), the feasible successors are marked based on the constant |
67 | | * (usually only one successor will be feasible). |
68 | | * |
69 | | * The original SCCP algorithm is extended with ability to propagate constant array |
70 | | * elements and object properties. The extension is based on a variation of Array |
71 | | * SSA form and its application to Spare Constant Propagation, described at |
72 | | * "Array SSA Form" by Vivek Sarkar, Kathleen Knobe and Stephen Fink in chapter |
73 | | * 16 of the SSA book. |
74 | | */ |
75 | | |
76 | | #define SCP_DEBUG 0 |
77 | | |
78 | | typedef struct _sccp_ctx { |
79 | | scdf_ctx scdf; |
80 | | zend_call_info **call_map; |
81 | | zval *values; |
82 | | zval top; |
83 | | zval bot; |
84 | | } sccp_ctx; |
85 | | |
86 | 4.98M | #define TOP ((uint8_t)-1) |
87 | 3.98M | #define BOT ((uint8_t)-2) |
88 | 1.09M | #define PARTIAL_ARRAY ((uint8_t)-3) |
89 | 1.02M | #define PARTIAL_OBJECT ((uint8_t)-4) |
90 | 5.94M | #define IS_TOP(zv) (Z_TYPE_P(zv) == TOP) |
91 | 6.28M | #define IS_BOT(zv) (Z_TYPE_P(zv) == BOT) |
92 | 2.11M | #define IS_PARTIAL_ARRAY(zv) (Z_TYPE_P(zv) == PARTIAL_ARRAY) |
93 | 1.03M | #define IS_PARTIAL_OBJECT(zv) (Z_TYPE_P(zv) == PARTIAL_OBJECT) |
94 | | |
95 | 9.49k | #define MAKE_PARTIAL_ARRAY(zv) (Z_TYPE_INFO_P(zv) = PARTIAL_ARRAY | (IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT)) |
96 | 550 | #define MAKE_PARTIAL_OBJECT(zv) (Z_TYPE_INFO_P(zv) = PARTIAL_OBJECT | (IS_TYPE_REFCOUNTED << Z_TYPE_FLAGS_SHIFT)) |
97 | | |
98 | 1.27M | #define MAKE_TOP(zv) (Z_TYPE_INFO_P(zv) = TOP) |
99 | 188k | #define MAKE_BOT(zv) (Z_TYPE_INFO_P(zv) = BOT) |
100 | | |
101 | 0 | static void scp_dump_value(zval *zv) { |
102 | 0 | if (IS_TOP(zv)) { |
103 | 0 | fprintf(stderr, " top"); |
104 | 0 | } else if (IS_BOT(zv)) { |
105 | 0 | fprintf(stderr, " bot"); |
106 | 0 | } else if (Z_TYPE_P(zv) == IS_ARRAY || IS_PARTIAL_ARRAY(zv)) { |
107 | 0 | fprintf(stderr, " %s[", IS_PARTIAL_ARRAY(zv) ? "partial " : ""); |
108 | 0 | zend_dump_ht(Z_ARRVAL_P(zv)); |
109 | 0 | fprintf(stderr, "]"); |
110 | 0 | } else if (IS_PARTIAL_OBJECT(zv)) { |
111 | 0 | fprintf(stderr, " {"); |
112 | 0 | zend_dump_ht(Z_ARRVAL_P(zv)); |
113 | 0 | fprintf(stderr, "}"); |
114 | 0 | } else { |
115 | 0 | zend_dump_const(zv); |
116 | 0 | } |
117 | 0 | } |
118 | | |
119 | | static void empty_partial_array(zval *zv) |
120 | 3.69k | { |
121 | 3.69k | MAKE_PARTIAL_ARRAY(zv); |
122 | 3.69k | Z_ARR_P(zv) = zend_new_array(8); |
123 | 3.69k | } |
124 | | |
125 | | static void dup_partial_array(zval *dst, const zval *src) |
126 | 464 | { |
127 | 464 | MAKE_PARTIAL_ARRAY(dst); |
128 | 464 | Z_ARR_P(dst) = zend_array_dup(Z_ARR_P(src)); |
129 | 464 | } |
130 | | |
131 | | static void empty_partial_object(zval *zv) |
132 | 378 | { |
133 | 378 | MAKE_PARTIAL_OBJECT(zv); |
134 | 378 | Z_ARR_P(zv) = zend_new_array(8); |
135 | 378 | } |
136 | | |
137 | | static void dup_partial_object(zval *dst, const zval *src) |
138 | 172 | { |
139 | 172 | MAKE_PARTIAL_OBJECT(dst); |
140 | 172 | Z_ARR_P(dst) = zend_array_dup(Z_ARR_P(src)); |
141 | 172 | } |
142 | | |
143 | 1.11M | static inline bool value_known(zval *zv) { |
144 | 1.11M | return !IS_TOP(zv) && !IS_BOT(zv); |
145 | 1.11M | } |
146 | | |
147 | | /* Sets new value for variable and ensures that it is lower or equal |
148 | | * the previous one in the constant propagation lattice. */ |
149 | 1.03M | static void set_value(scdf_ctx *scdf, sccp_ctx *ctx, int var, const zval *new) { |
150 | 1.03M | zval *value = &ctx->values[var]; |
151 | 1.03M | if (IS_BOT(value) || IS_TOP(new)) { |
152 | 2.42k | return; |
153 | 2.42k | } |
154 | | |
155 | | #if SCP_DEBUG |
156 | | fprintf(stderr, "Lowering #%d.", var); |
157 | | zend_dump_var(scdf->op_array, IS_CV, scdf->ssa->vars[var].var); |
158 | | fprintf(stderr, " from"); |
159 | | scp_dump_value(value); |
160 | | fprintf(stderr, " to"); |
161 | | scp_dump_value(new); |
162 | | fprintf(stderr, "\n"); |
163 | | #endif |
164 | | |
165 | 1.03M | if (IS_TOP(value) || IS_BOT(new)) { |
166 | 1.02M | zval_ptr_dtor_nogc(value); |
167 | 1.02M | ZVAL_COPY(value, new); |
168 | 1.02M | scdf_add_to_worklist(scdf, var); |
169 | 1.02M | return; |
170 | 1.02M | } |
171 | | |
172 | | /* Always replace PARTIAL_(ARRAY|OBJECT), as new maybe changed by join_partial_(arrays|object) */ |
173 | 1.25k | if (IS_PARTIAL_ARRAY(new) || IS_PARTIAL_OBJECT(new)) { |
174 | 136 | if (Z_TYPE_P(value) != Z_TYPE_P(new) |
175 | 136 | || zend_hash_num_elements(Z_ARR_P(new)) != zend_hash_num_elements(Z_ARR_P(value))) { |
176 | 83 | zval_ptr_dtor_nogc(value); |
177 | 83 | ZVAL_COPY(value, new); |
178 | 83 | scdf_add_to_worklist(scdf, var); |
179 | 83 | } |
180 | 136 | return; |
181 | 136 | } |
182 | | |
183 | 1.12k | #if ZEND_DEBUG |
184 | 1.12k | ZEND_ASSERT(zend_is_identical(value, new) || |
185 | 1.12k | (Z_TYPE_P(value) == IS_DOUBLE && Z_TYPE_P(new) == IS_DOUBLE && isnan(Z_DVAL_P(value)) && isnan(Z_DVAL_P(new)))); |
186 | 1.12k | #endif |
187 | 1.12k | } |
188 | | |
189 | 1.40M | static zval *get_op1_value(sccp_ctx *ctx, zend_op *opline, const zend_ssa_op *ssa_op) { |
190 | 1.40M | if (opline->op1_type == IS_CONST) { |
191 | 210k | return CT_CONSTANT_EX(ctx->scdf.op_array, opline->op1.constant); |
192 | 1.19M | } else if (ssa_op->op1_use != -1) { |
193 | 876k | return &ctx->values[ssa_op->op1_use]; |
194 | 876k | } else { |
195 | 322k | return NULL; |
196 | 322k | } |
197 | 1.40M | } |
198 | | |
199 | 1.33M | static zval *get_op2_value(sccp_ctx *ctx, const zend_op *opline, const zend_ssa_op *ssa_op) { |
200 | 1.33M | if (opline->op2_type == IS_CONST) { |
201 | 461k | return CT_CONSTANT_EX(ctx->scdf.op_array, opline->op2.constant); |
202 | 874k | } else if (ssa_op->op2_use != -1) { |
203 | 275k | return &ctx->values[ssa_op->op2_use]; |
204 | 598k | } else { |
205 | 598k | return NULL; |
206 | 598k | } |
207 | 1.33M | } |
208 | | |
209 | | static bool can_replace_op1( |
210 | 17.4k | const zend_op_array *op_array, const zend_op *opline, const zend_ssa_op *ssa_op) { |
211 | 17.4k | switch (opline->opcode) { |
212 | 119 | case ZEND_PRE_INC: |
213 | 132 | case ZEND_PRE_DEC: |
214 | 132 | case ZEND_PRE_INC_OBJ: |
215 | 132 | case ZEND_PRE_DEC_OBJ: |
216 | 132 | case ZEND_POST_INC: |
217 | 141 | case ZEND_POST_DEC: |
218 | 141 | case ZEND_POST_INC_OBJ: |
219 | 141 | case ZEND_POST_DEC_OBJ: |
220 | 1.23k | case ZEND_ASSIGN: |
221 | 1.32k | case ZEND_ASSIGN_REF: |
222 | 1.59k | case ZEND_ASSIGN_DIM: |
223 | 1.61k | case ZEND_ASSIGN_OBJ: |
224 | 1.61k | case ZEND_ASSIGN_OBJ_REF: |
225 | 1.66k | case ZEND_ASSIGN_OP: |
226 | 1.68k | case ZEND_ASSIGN_DIM_OP: |
227 | 1.69k | case ZEND_ASSIGN_OBJ_OP: |
228 | 1.69k | case ZEND_ASSIGN_STATIC_PROP_OP: |
229 | 1.77k | case ZEND_FETCH_DIM_W: |
230 | 1.77k | case ZEND_FETCH_DIM_RW: |
231 | 1.77k | case ZEND_FETCH_DIM_UNSET: |
232 | 1.79k | case ZEND_FETCH_DIM_FUNC_ARG: |
233 | 1.79k | case ZEND_FETCH_OBJ_W: |
234 | 1.79k | case ZEND_FETCH_OBJ_RW: |
235 | 1.79k | case ZEND_FETCH_OBJ_UNSET: |
236 | 1.79k | case ZEND_FETCH_OBJ_FUNC_ARG: |
237 | 1.79k | case ZEND_FETCH_LIST_W: |
238 | 1.80k | case ZEND_UNSET_DIM: |
239 | 1.80k | case ZEND_UNSET_OBJ: |
240 | 1.84k | case ZEND_SEND_REF: |
241 | 1.87k | case ZEND_SEND_VAR_EX: |
242 | 1.90k | case ZEND_SEND_FUNC_ARG: |
243 | 1.90k | case ZEND_SEND_UNPACK: |
244 | 1.90k | case ZEND_SEND_ARRAY: |
245 | 1.90k | case ZEND_SEND_USER: |
246 | 1.90k | case ZEND_FE_RESET_RW: |
247 | 1.90k | return 0; |
248 | | /* Do not accept CONST */ |
249 | 10.6k | case ZEND_ROPE_ADD: |
250 | 10.6k | case ZEND_ROPE_END: |
251 | 10.6k | case ZEND_BIND_STATIC: |
252 | 10.6k | case ZEND_BIND_INIT_STATIC_OR_JMP: |
253 | 10.6k | case ZEND_BIND_GLOBAL: |
254 | 10.6k | case ZEND_MAKE_REF: |
255 | 10.6k | case ZEND_UNSET_CV: |
256 | 10.6k | case ZEND_ISSET_ISEMPTY_CV: |
257 | 10.6k | return 0; |
258 | 28 | case ZEND_INIT_ARRAY: |
259 | 36 | case ZEND_ADD_ARRAY_ELEMENT: |
260 | 36 | return !(opline->extended_value & ZEND_ARRAY_ELEMENT_REF); |
261 | 46 | case ZEND_YIELD: |
262 | 46 | return !(op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE); |
263 | 45 | case ZEND_VERIFY_RETURN_TYPE: |
264 | | // TODO: This would require a non-local change ??? |
265 | 45 | return 0; |
266 | 451 | case ZEND_OP_DATA: |
267 | 451 | return (opline - 1)->opcode != ZEND_ASSIGN_OBJ_REF && |
268 | 451 | (opline - 1)->opcode != ZEND_ASSIGN_STATIC_PROP_REF; |
269 | 4.32k | default: |
270 | 4.32k | if (ssa_op->op1_def != -1) { |
271 | 0 | ZEND_UNREACHABLE(); |
272 | 0 | return 0; |
273 | 0 | } |
274 | 17.4k | } |
275 | | |
276 | 4.32k | return 1; |
277 | 17.4k | } |
278 | | |
279 | | static bool can_replace_op2( |
280 | 4.38k | const zend_op_array *op_array, zend_op *opline, zend_ssa_op *ssa_op) { |
281 | 4.38k | switch (opline->opcode) { |
282 | | /* Do not accept CONST */ |
283 | 0 | case ZEND_DECLARE_CLASS_DELAYED: |
284 | 47 | case ZEND_BIND_LEXICAL: |
285 | 47 | case ZEND_FE_FETCH_R: |
286 | 47 | case ZEND_FE_FETCH_RW: |
287 | 47 | return 0; |
288 | 4.38k | } |
289 | 4.33k | return 1; |
290 | 4.38k | } |
291 | | |
292 | | static bool try_replace_op1( |
293 | 38.8k | sccp_ctx *ctx, zend_op *opline, zend_ssa_op *ssa_op, int var, zval *value) { |
294 | 38.8k | if (ssa_op->op1_use == var && can_replace_op1(ctx->scdf.op_array, opline, ssa_op)) { |
295 | 4.80k | zval zv; |
296 | 4.80k | ZVAL_COPY(&zv, value); |
297 | 4.80k | if (zend_optimizer_update_op1_const(ctx->scdf.op_array, opline, &zv)) { |
298 | 4.72k | return 1; |
299 | 4.72k | } |
300 | 74 | zval_ptr_dtor_nogc(&zv); |
301 | 74 | } |
302 | 34.0k | return 0; |
303 | 38.8k | } |
304 | | |
305 | | static bool try_replace_op2( |
306 | 38.8k | sccp_ctx *ctx, zend_op *opline, zend_ssa_op *ssa_op, int var, zval *value) { |
307 | 38.8k | if (ssa_op->op2_use == var && can_replace_op2(ctx->scdf.op_array, opline, ssa_op)) { |
308 | 4.33k | zval zv; |
309 | 4.33k | ZVAL_COPY(&zv, value); |
310 | 4.33k | if (zend_optimizer_update_op2_const(ctx->scdf.op_array, opline, &zv)) { |
311 | 4.23k | return 1; |
312 | 4.23k | } |
313 | 98 | zval_ptr_dtor_nogc(&zv); |
314 | 98 | } |
315 | 34.5k | return 0; |
316 | 38.8k | } |
317 | | |
318 | 6.11k | static inline zend_result ct_eval_binary_op(zval *result, uint8_t binop, zval *op1, zval *op2) { |
319 | | /* TODO: We could implement support for evaluation of + on partial arrays. */ |
320 | 6.11k | if (IS_PARTIAL_ARRAY(op1) || IS_PARTIAL_ARRAY(op2)) { |
321 | 22 | return FAILURE; |
322 | 22 | } |
323 | | |
324 | 6.09k | return zend_optimizer_eval_binary_op(result, binop, op1, op2); |
325 | 6.11k | } |
326 | | |
327 | 2.96k | static inline zend_result ct_eval_bool_cast(zval *result, zval *op) { |
328 | 2.96k | if (IS_PARTIAL_ARRAY(op)) { |
329 | 4 | if (zend_hash_num_elements(Z_ARRVAL_P(op)) == 0) { |
330 | | /* An empty partial array may be non-empty at runtime, we don't know whether the |
331 | | * result will be true or false. */ |
332 | 0 | return FAILURE; |
333 | 0 | } |
334 | | |
335 | 4 | ZVAL_TRUE(result); |
336 | 4 | return SUCCESS; |
337 | 4 | } |
338 | | |
339 | 2.95k | ZVAL_BOOL(result, zend_is_true(op)); |
340 | 2.95k | return SUCCESS; |
341 | 2.96k | } |
342 | | |
343 | 38 | static inline zend_result zval_to_string_offset(zend_long *result, zval *op) { |
344 | 38 | switch (Z_TYPE_P(op)) { |
345 | 32 | case IS_LONG: |
346 | 32 | *result = Z_LVAL_P(op); |
347 | 32 | return SUCCESS; |
348 | 6 | case IS_STRING: |
349 | 6 | if (IS_LONG == is_numeric_string( |
350 | 6 | Z_STRVAL_P(op), Z_STRLEN_P(op), result, NULL, 0)) { |
351 | 0 | return SUCCESS; |
352 | 0 | } |
353 | 6 | return FAILURE; |
354 | 0 | default: |
355 | 0 | return FAILURE; |
356 | 38 | } |
357 | 38 | } |
358 | | |
359 | 746 | static inline zend_result fetch_array_elem(zval **result, zval *op1, zval *op2) { |
360 | 746 | switch (Z_TYPE_P(op2)) { |
361 | 12 | case IS_NULL: |
362 | 12 | *result = zend_hash_find(Z_ARR_P(op1), ZSTR_EMPTY_ALLOC()); |
363 | 12 | return SUCCESS; |
364 | 14 | case IS_FALSE: |
365 | 14 | *result = zend_hash_index_find(Z_ARR_P(op1), 0); |
366 | 14 | return SUCCESS; |
367 | 14 | case IS_TRUE: |
368 | 14 | *result = zend_hash_index_find(Z_ARR_P(op1), 1); |
369 | 14 | return SUCCESS; |
370 | 554 | case IS_LONG: |
371 | 554 | *result = zend_hash_index_find(Z_ARR_P(op1), Z_LVAL_P(op2)); |
372 | 554 | return SUCCESS; |
373 | 18 | case IS_DOUBLE: { |
374 | 18 | zend_long lval = zend_dval_to_lval(Z_DVAL_P(op2)); |
375 | 18 | if (!zend_is_long_compatible(Z_DVAL_P(op2), lval)) { |
376 | 4 | return FAILURE; |
377 | 4 | } |
378 | 14 | *result = zend_hash_index_find(Z_ARR_P(op1), lval); |
379 | 14 | return SUCCESS; |
380 | 18 | } |
381 | 134 | case IS_STRING: |
382 | 134 | *result = zend_symtable_find(Z_ARR_P(op1), Z_STR_P(op2)); |
383 | 134 | return SUCCESS; |
384 | 0 | default: |
385 | 0 | return FAILURE; |
386 | 746 | } |
387 | 746 | } |
388 | | |
389 | 787 | static inline zend_result ct_eval_fetch_dim(zval *result, zval *op1, zval *op2, int support_strings) { |
390 | 787 | if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) { |
391 | 709 | zval *value; |
392 | 709 | if (fetch_array_elem(&value, op1, op2) == SUCCESS && value && !IS_BOT(value)) { |
393 | 514 | ZVAL_COPY(result, value); |
394 | 514 | return SUCCESS; |
395 | 514 | } |
396 | 709 | } else if (support_strings && Z_TYPE_P(op1) == IS_STRING) { |
397 | 38 | zend_long index; |
398 | 38 | if (zval_to_string_offset(&index, op2) == FAILURE) { |
399 | 6 | return FAILURE; |
400 | 6 | } |
401 | 32 | if (index >= 0 && index < Z_STRLEN_P(op1)) { |
402 | 30 | ZVAL_STR(result, zend_string_init(&Z_STRVAL_P(op1)[index], 1, 0)); |
403 | 30 | return SUCCESS; |
404 | 30 | } |
405 | 32 | } |
406 | 237 | return FAILURE; |
407 | 787 | } |
408 | | |
409 | | /* op1 may be NULL here to indicate an unset value */ |
410 | 41 | static inline zend_result ct_eval_isset_isempty(zval *result, uint32_t extended_value, zval *op1) { |
411 | 41 | zval zv; |
412 | 41 | if (!(extended_value & ZEND_ISEMPTY)) { |
413 | 41 | ZVAL_BOOL(result, op1 && Z_TYPE_P(op1) != IS_NULL); |
414 | 41 | return SUCCESS; |
415 | 41 | } else if (!op1) { |
416 | 0 | ZVAL_TRUE(result); |
417 | 0 | return SUCCESS; |
418 | 0 | } else if (ct_eval_bool_cast(&zv, op1) == SUCCESS) { |
419 | 0 | ZVAL_BOOL(result, Z_TYPE(zv) == IS_FALSE); |
420 | 0 | return SUCCESS; |
421 | 0 | } else { |
422 | 0 | return FAILURE; |
423 | 0 | } |
424 | 41 | } |
425 | | |
426 | 37 | static inline zend_result ct_eval_isset_dim(zval *result, uint32_t extended_value, zval *op1, zval *op2) { |
427 | 37 | if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) { |
428 | 37 | zval *value; |
429 | 37 | if (fetch_array_elem(&value, op1, op2) == FAILURE) { |
430 | 0 | return FAILURE; |
431 | 0 | } |
432 | 37 | if (IS_PARTIAL_ARRAY(op1) && (!value || IS_BOT(value))) { |
433 | 0 | return FAILURE; |
434 | 0 | } |
435 | 37 | return ct_eval_isset_isempty(result, extended_value, value); |
436 | 37 | } else if (Z_TYPE_P(op1) == IS_STRING) { |
437 | | // TODO |
438 | 0 | return FAILURE; |
439 | 0 | } else { |
440 | 0 | ZVAL_BOOL(result, (extended_value & ZEND_ISEMPTY)); |
441 | 0 | return SUCCESS; |
442 | 0 | } |
443 | 37 | } |
444 | | |
445 | 614 | static inline zend_result ct_eval_del_array_elem(zval *result, const zval *key) { |
446 | 614 | ZEND_ASSERT(IS_PARTIAL_ARRAY(result)); |
447 | | |
448 | 614 | switch (Z_TYPE_P(key)) { |
449 | 0 | case IS_NULL: |
450 | 0 | zend_hash_del(Z_ARR_P(result), ZSTR_EMPTY_ALLOC()); |
451 | 0 | break; |
452 | 0 | case IS_FALSE: |
453 | 0 | zend_hash_index_del(Z_ARR_P(result), 0); |
454 | 0 | break; |
455 | 0 | case IS_TRUE: |
456 | 0 | zend_hash_index_del(Z_ARR_P(result), 1); |
457 | 0 | break; |
458 | 254 | case IS_LONG: |
459 | 254 | zend_hash_index_del(Z_ARR_P(result), Z_LVAL_P(key)); |
460 | 254 | break; |
461 | 2 | case IS_DOUBLE: { |
462 | 2 | zend_long lval = zend_dval_to_lval(Z_DVAL_P(key)); |
463 | 2 | if (!zend_is_long_compatible(Z_DVAL_P(key), lval)) { |
464 | 2 | return FAILURE; |
465 | 2 | } |
466 | 0 | zend_hash_index_del(Z_ARR_P(result), lval); |
467 | 0 | break; |
468 | 2 | } |
469 | 354 | case IS_STRING: |
470 | 354 | zend_symtable_del(Z_ARR_P(result), Z_STR_P(key)); |
471 | 354 | break; |
472 | 4 | default: |
473 | 4 | return FAILURE; |
474 | 614 | } |
475 | | |
476 | 608 | return SUCCESS; |
477 | 614 | } |
478 | | |
479 | 4.72k | static inline zend_result ct_eval_add_array_elem(zval *result, zval *value, const zval *key) { |
480 | 4.72k | if (!key) { |
481 | 3.85k | SEPARATE_ARRAY(result); |
482 | 3.85k | if ((value = zend_hash_next_index_insert(Z_ARR_P(result), value))) { |
483 | 3.85k | Z_TRY_ADDREF_P(value); |
484 | 3.85k | return SUCCESS; |
485 | 3.85k | } |
486 | 0 | return FAILURE; |
487 | 3.85k | } |
488 | | |
489 | 878 | switch (Z_TYPE_P(key)) { |
490 | 0 | case IS_NULL: |
491 | 0 | SEPARATE_ARRAY(result); |
492 | 0 | value = zend_hash_update(Z_ARR_P(result), ZSTR_EMPTY_ALLOC(), value); |
493 | 0 | break; |
494 | 7 | case IS_FALSE: |
495 | 7 | SEPARATE_ARRAY(result); |
496 | 7 | value = zend_hash_index_update(Z_ARR_P(result), 0, value); |
497 | 7 | break; |
498 | 0 | case IS_TRUE: |
499 | 0 | SEPARATE_ARRAY(result); |
500 | 0 | value = zend_hash_index_update(Z_ARR_P(result), 1, value); |
501 | 0 | break; |
502 | 320 | case IS_LONG: |
503 | 320 | SEPARATE_ARRAY(result); |
504 | 320 | value = zend_hash_index_update(Z_ARR_P(result), Z_LVAL_P(key), value); |
505 | 320 | break; |
506 | 18 | case IS_DOUBLE: { |
507 | 18 | zend_long lval = zend_dval_to_lval(Z_DVAL_P(key)); |
508 | 18 | if (!zend_is_long_compatible(Z_DVAL_P(key), lval)) { |
509 | 18 | return FAILURE; |
510 | 18 | } |
511 | 0 | SEPARATE_ARRAY(result); |
512 | 0 | value = zend_hash_index_update( |
513 | 0 | Z_ARR_P(result), lval, value); |
514 | 0 | break; |
515 | 18 | } |
516 | 533 | case IS_STRING: |
517 | 533 | SEPARATE_ARRAY(result); |
518 | 533 | value = zend_symtable_update(Z_ARR_P(result), Z_STR_P(key), value); |
519 | 533 | break; |
520 | 0 | default: |
521 | 0 | return FAILURE; |
522 | 878 | } |
523 | | |
524 | 860 | Z_TRY_ADDREF_P(value); |
525 | 860 | return SUCCESS; |
526 | 878 | } |
527 | | |
528 | 26 | static inline zend_result ct_eval_add_array_unpack(zval *result, zval *array) { |
529 | 26 | zend_string *key; |
530 | 26 | zval *value; |
531 | 26 | if (Z_TYPE_P(array) != IS_ARRAY) { |
532 | 12 | return FAILURE; |
533 | 12 | } |
534 | | |
535 | 14 | SEPARATE_ARRAY(result); |
536 | 78 | ZEND_HASH_FOREACH_STR_KEY_VAL(Z_ARRVAL_P(array), key, value) { |
537 | 78 | if (key) { |
538 | 0 | value = zend_hash_update(Z_ARR_P(result), key, value); |
539 | 32 | } else { |
540 | 32 | value = zend_hash_next_index_insert(Z_ARR_P(result), value); |
541 | 32 | } |
542 | 78 | if (!value) { |
543 | 0 | return FAILURE; |
544 | 0 | } |
545 | 32 | Z_TRY_ADDREF_P(value); |
546 | 32 | } ZEND_HASH_FOREACH_END(); |
547 | 14 | return SUCCESS; |
548 | 14 | } |
549 | | |
550 | 404 | static inline zend_result ct_eval_assign_dim(zval *result, zval *value, const zval *key) { |
551 | 404 | switch (Z_TYPE_P(result)) { |
552 | 92 | case IS_NULL: |
553 | 92 | case IS_FALSE: |
554 | 92 | array_init(result); |
555 | 92 | ZEND_FALLTHROUGH; |
556 | 236 | case IS_ARRAY: |
557 | 390 | case PARTIAL_ARRAY: |
558 | 390 | return ct_eval_add_array_elem(result, value, key); |
559 | 14 | case IS_STRING: |
560 | | // TODO Before enabling this case, make sure ARRAY_DIM result op is correct |
561 | | #if 0 |
562 | | zend_long index; |
563 | | zend_string *new_str, *value_str; |
564 | | if (!key || Z_TYPE_P(value) == IS_ARRAY |
565 | | || zval_to_string_offset(&index, key) == FAILURE || index < 0) { |
566 | | return FAILURE; |
567 | | } |
568 | | |
569 | | if (index >= Z_STRLEN_P(result)) { |
570 | | new_str = zend_string_alloc(index + 1, 0); |
571 | | memcpy(ZSTR_VAL(new_str), Z_STRVAL_P(result), Z_STRLEN_P(result)); |
572 | | memset(ZSTR_VAL(new_str) + Z_STRLEN_P(result), ' ', index - Z_STRLEN_P(result)); |
573 | | ZSTR_VAL(new_str)[index + 1] = 0; |
574 | | } else { |
575 | | new_str = zend_string_init(Z_STRVAL_P(result), Z_STRLEN_P(result), 0); |
576 | | } |
577 | | |
578 | | value_str = zval_get_string(value); |
579 | | ZVAL_STR(result, new_str); |
580 | | Z_STRVAL_P(result)[index] = ZSTR_VAL(value_str)[0]; |
581 | | zend_string_release_ex(value_str, 0); |
582 | | #endif |
583 | 14 | return FAILURE; |
584 | 0 | default: |
585 | 0 | return FAILURE; |
586 | 404 | } |
587 | 404 | } |
588 | | |
589 | 52 | static inline zend_result fetch_obj_prop(zval **result, zval *op1, zval *op2) { |
590 | 52 | switch (Z_TYPE_P(op2)) { |
591 | 34 | case IS_STRING: |
592 | 34 | *result = zend_symtable_find(Z_ARR_P(op1), Z_STR_P(op2)); |
593 | 34 | return SUCCESS; |
594 | 18 | default: |
595 | 18 | return FAILURE; |
596 | 52 | } |
597 | 52 | } |
598 | | |
599 | 88 | static inline zend_result ct_eval_fetch_obj(zval *result, zval *op1, zval *op2) { |
600 | 88 | if (IS_PARTIAL_OBJECT(op1)) { |
601 | 52 | zval *value; |
602 | 52 | if (fetch_obj_prop(&value, op1, op2) == SUCCESS && value && !IS_BOT(value)) { |
603 | 8 | ZVAL_COPY(result, value); |
604 | 8 | return SUCCESS; |
605 | 8 | } |
606 | 52 | } |
607 | 80 | return FAILURE; |
608 | 88 | } |
609 | | |
610 | 20 | static inline zend_result ct_eval_isset_obj(zval *result, uint32_t extended_value, zval *op1, zval *op2) { |
611 | 20 | if (IS_PARTIAL_OBJECT(op1)) { |
612 | 0 | zval *value; |
613 | 0 | if (fetch_obj_prop(&value, op1, op2) == FAILURE) { |
614 | 0 | return FAILURE; |
615 | 0 | } |
616 | 0 | if (!value || IS_BOT(value)) { |
617 | 0 | return FAILURE; |
618 | 0 | } |
619 | 0 | return ct_eval_isset_isempty(result, extended_value, value); |
620 | 20 | } else { |
621 | 20 | ZVAL_BOOL(result, (extended_value & ZEND_ISEMPTY)); |
622 | 20 | return SUCCESS; |
623 | 20 | } |
624 | 20 | } |
625 | | |
626 | 68 | static inline zend_result ct_eval_del_obj_prop(zval *result, const zval *key) { |
627 | 68 | ZEND_ASSERT(IS_PARTIAL_OBJECT(result)); |
628 | | |
629 | 68 | switch (Z_TYPE_P(key)) { |
630 | 68 | case IS_STRING: |
631 | 68 | zend_symtable_del(Z_ARR_P(result), Z_STR_P(key)); |
632 | 68 | break; |
633 | 0 | default: |
634 | 0 | return FAILURE; |
635 | 68 | } |
636 | | |
637 | 68 | return SUCCESS; |
638 | 68 | } |
639 | | |
640 | 104 | static inline zend_result ct_eval_add_obj_prop(zval *result, zval *value, const zval *key) { |
641 | 104 | switch (Z_TYPE_P(key)) { |
642 | 104 | case IS_STRING: |
643 | 104 | value = zend_symtable_update(Z_ARR_P(result), Z_STR_P(key), value); |
644 | 104 | break; |
645 | 0 | default: |
646 | 0 | return FAILURE; |
647 | 104 | } |
648 | | |
649 | 104 | Z_TRY_ADDREF_P(value); |
650 | 104 | return SUCCESS; |
651 | 104 | } |
652 | | |
653 | 104 | static inline zend_result ct_eval_assign_obj(zval *result, zval *value, const zval *key) { |
654 | 104 | switch (Z_TYPE_P(result)) { |
655 | 0 | case IS_NULL: |
656 | 0 | case IS_FALSE: |
657 | 0 | empty_partial_object(result); |
658 | 0 | ZEND_FALLTHROUGH; |
659 | 104 | case PARTIAL_OBJECT: |
660 | 104 | return ct_eval_add_obj_prop(result, value, key); |
661 | 0 | default: |
662 | 0 | return FAILURE; |
663 | 104 | } |
664 | 104 | } |
665 | | |
666 | 1.65k | static inline zend_result ct_eval_incdec(zval *result, uint8_t opcode, zval *op1) { |
667 | | /* As of PHP 8.3 with the warning/deprecation notices any type other than int/double/null will emit a diagnostic |
668 | | if (Z_TYPE_P(op1) == IS_ARRAY || IS_PARTIAL_ARRAY(op1)) { |
669 | | return FAILURE; |
670 | | } |
671 | | */ |
672 | 1.65k | if (Z_TYPE_P(op1) != IS_LONG && Z_TYPE_P(op1) != IS_DOUBLE && Z_TYPE_P(op1) != IS_NULL) { |
673 | 36 | return FAILURE; |
674 | 36 | } |
675 | | |
676 | 1.62k | ZVAL_COPY(result, op1); |
677 | 1.62k | if (opcode == ZEND_PRE_INC |
678 | 1.62k | || opcode == ZEND_POST_INC |
679 | 1.62k | || opcode == ZEND_PRE_INC_OBJ |
680 | 1.62k | || opcode == ZEND_POST_INC_OBJ) { |
681 | 1.59k | increment_function(result); |
682 | 1.59k | } else { |
683 | | /* Decrement on null emits a deprecation notice */ |
684 | 31 | if (Z_TYPE_P(op1) == IS_NULL) { |
685 | 0 | zval_ptr_dtor(result); |
686 | 0 | return FAILURE; |
687 | 0 | } |
688 | 31 | decrement_function(result); |
689 | 31 | } |
690 | 1.62k | return SUCCESS; |
691 | 1.62k | } |
692 | | |
693 | 6 | static inline void ct_eval_type_check(zval *result, uint32_t type_mask, zval *op1) { |
694 | 6 | uint32_t type = Z_TYPE_P(op1); |
695 | 6 | if (type == PARTIAL_ARRAY) { |
696 | 4 | type = IS_ARRAY; |
697 | 4 | } else if (type == PARTIAL_OBJECT) { |
698 | 0 | type = IS_OBJECT; |
699 | 0 | } |
700 | 6 | ZVAL_BOOL(result, (type_mask >> type) & 1); |
701 | 6 | } |
702 | | |
703 | 0 | static inline zend_result ct_eval_in_array(zval *result, uint32_t extended_value, zval *op1, zval *op2) { |
704 | 0 | HashTable *ht; |
705 | 0 | bool res; |
706 | |
|
707 | 0 | if (Z_TYPE_P(op2) != IS_ARRAY) { |
708 | 0 | return FAILURE; |
709 | 0 | } |
710 | 0 | ht = Z_ARRVAL_P(op2); |
711 | 0 | if (EXPECTED(Z_TYPE_P(op1) == IS_STRING)) { |
712 | 0 | res = zend_hash_exists(ht, Z_STR_P(op1)); |
713 | 0 | } else if (extended_value) { |
714 | 0 | if (EXPECTED(Z_TYPE_P(op1) == IS_LONG)) { |
715 | 0 | res = zend_hash_index_exists(ht, Z_LVAL_P(op1)); |
716 | 0 | } else { |
717 | 0 | res = 0; |
718 | 0 | } |
719 | 0 | } else if (Z_TYPE_P(op1) <= IS_FALSE) { |
720 | 0 | res = zend_hash_exists(ht, ZSTR_EMPTY_ALLOC()); |
721 | 0 | } else { |
722 | 0 | zend_string *key; |
723 | 0 | zval key_tmp; |
724 | |
|
725 | 0 | res = 0; |
726 | 0 | ZEND_HASH_MAP_FOREACH_STR_KEY(ht, key) { |
727 | 0 | ZVAL_STR(&key_tmp, key); |
728 | 0 | if (zend_compare(op1, &key_tmp) == 0) { |
729 | 0 | res = 1; |
730 | 0 | break; |
731 | 0 | } |
732 | 0 | } ZEND_HASH_FOREACH_END(); |
733 | 0 | } |
734 | 0 | ZVAL_BOOL(result, res); |
735 | 0 | return SUCCESS; |
736 | 0 | } |
737 | | |
738 | 0 | static inline zend_result ct_eval_array_key_exists(zval *result, zval *op1, zval *op2) { |
739 | 0 | zval *value; |
740 | |
|
741 | 0 | if (Z_TYPE_P(op2) != IS_ARRAY && !IS_PARTIAL_ARRAY(op2)) { |
742 | 0 | return FAILURE; |
743 | 0 | } |
744 | 0 | if (Z_TYPE_P(op1) != IS_STRING && Z_TYPE_P(op1) != IS_LONG && Z_TYPE_P(op1) != IS_NULL) { |
745 | 0 | return FAILURE; |
746 | 0 | } |
747 | 0 | if (fetch_array_elem(&value, op2, op1) == FAILURE) { |
748 | 0 | return FAILURE; |
749 | 0 | } |
750 | 0 | if (IS_PARTIAL_ARRAY(op2) && (!value || IS_BOT(value))) { |
751 | 0 | return FAILURE; |
752 | 0 | } |
753 | | |
754 | 0 | ZVAL_BOOL(result, value != NULL); |
755 | 0 | return SUCCESS; |
756 | 0 | } |
757 | | |
758 | 0 | static bool can_ct_eval_func_call(zend_function *func, zend_string *name, uint32_t num_args, zval **args) { |
759 | | /* Precondition: func->type == ZEND_INTERNAL_FUNCTION, this is a global function */ |
760 | | /* Functions setting ZEND_ACC_COMPILE_TIME_EVAL (@compile-time-eval) must always produce the same result for the same arguments, |
761 | | * and have no dependence on global state (such as locales). It is okay if they throw |
762 | | * or warn on invalid arguments, as we detect this and will discard the evaluation result. */ |
763 | 0 | if (func->common.fn_flags & ZEND_ACC_COMPILE_TIME_EVAL) { |
764 | | /* This has @compile-time-eval in stub info and uses a macro such as ZEND_SUPPORTS_COMPILE_TIME_EVAL_FE */ |
765 | 0 | return true; |
766 | 0 | } |
767 | 0 | #ifndef ZEND_WIN32 |
768 | | /* On Windows this function may be code page dependent. */ |
769 | 0 | if (zend_string_equals_literal(name, "dirname")) { |
770 | 0 | return true; |
771 | 0 | } |
772 | 0 | #endif |
773 | | |
774 | 0 | if (num_args == 2) { |
775 | 0 | if (zend_string_equals_literal(name, "str_repeat")) { |
776 | | /* Avoid creating overly large strings at compile-time. */ |
777 | 0 | bool overflow; |
778 | 0 | return Z_TYPE_P(args[0]) == IS_STRING |
779 | 0 | && Z_TYPE_P(args[1]) == IS_LONG |
780 | 0 | && zend_safe_address(Z_STRLEN_P(args[0]), Z_LVAL_P(args[1]), 0, &overflow) < 64 * 1024 |
781 | 0 | && !overflow; |
782 | 0 | } |
783 | 0 | return false; |
784 | 0 | } |
785 | | |
786 | 0 | return false; |
787 | 0 | } |
788 | | |
789 | | /* The functions chosen here are simple to implement and either likely to affect a branch, |
790 | | * or just happened to be commonly used with constant operands in WP (need to test other |
791 | | * applications as well, of course). */ |
792 | | static inline zend_result ct_eval_func_call_ex( |
793 | 0 | zend_op_array *op_array, zval *result, zend_function *func, uint32_t num_args, zval **args) { |
794 | 0 | uint32_t i; |
795 | 0 | zend_string *name = func->common.function_name; |
796 | 0 | if (num_args == 1 && Z_TYPE_P(args[0]) == IS_STRING && |
797 | 0 | zend_optimizer_eval_special_func_call(result, name, Z_STR_P(args[0])) == SUCCESS) { |
798 | 0 | return SUCCESS; |
799 | 0 | } |
800 | | |
801 | 0 | if (!can_ct_eval_func_call(func, name, num_args, args)) { |
802 | 0 | return FAILURE; |
803 | 0 | } |
804 | | |
805 | 0 | zend_execute_data *prev_execute_data = EG(current_execute_data); |
806 | 0 | zend_execute_data *execute_data, dummy_frame; |
807 | 0 | zend_op dummy_opline; |
808 | | |
809 | | /* Add a dummy frame to get the correct strict_types behavior. */ |
810 | 0 | memset(&dummy_frame, 0, sizeof(zend_execute_data)); |
811 | 0 | memset(&dummy_opline, 0, sizeof(zend_op)); |
812 | 0 | dummy_frame.func = (zend_function *) op_array; |
813 | 0 | dummy_frame.opline = &dummy_opline; |
814 | 0 | dummy_opline.opcode = ZEND_DO_FCALL; |
815 | |
|
816 | 0 | execute_data = safe_emalloc(num_args, sizeof(zval), ZEND_CALL_FRAME_SLOT * sizeof(zval)); |
817 | 0 | memset(execute_data, 0, sizeof(zend_execute_data)); |
818 | 0 | execute_data->prev_execute_data = &dummy_frame; |
819 | 0 | EG(current_execute_data) = execute_data; |
820 | | |
821 | | /* Enable suppression and counting of warnings. */ |
822 | 0 | ZEND_ASSERT(EG(capture_warnings_during_sccp) == 0); |
823 | 0 | EG(capture_warnings_during_sccp) = 1; |
824 | |
|
825 | 0 | EX(func) = func; |
826 | 0 | EX_NUM_ARGS() = num_args; |
827 | 0 | for (i = 0; i < num_args; i++) { |
828 | 0 | ZVAL_COPY(EX_VAR_NUM(i), args[i]); |
829 | 0 | } |
830 | 0 | ZVAL_NULL(result); |
831 | 0 | func->internal_function.handler(execute_data, result); |
832 | 0 | for (i = 0; i < num_args; i++) { |
833 | 0 | zval_ptr_dtor_nogc(EX_VAR_NUM(i)); |
834 | 0 | } |
835 | |
|
836 | 0 | zend_result retval = SUCCESS; |
837 | 0 | if (EG(exception)) { |
838 | 0 | zval_ptr_dtor(result); |
839 | 0 | zend_clear_exception(); |
840 | 0 | retval = FAILURE; |
841 | 0 | } |
842 | |
|
843 | 0 | if (EG(capture_warnings_during_sccp) > 1) { |
844 | 0 | zval_ptr_dtor(result); |
845 | 0 | retval = FAILURE; |
846 | 0 | } |
847 | 0 | EG(capture_warnings_during_sccp) = 0; |
848 | |
|
849 | 0 | efree(execute_data); |
850 | 0 | EG(current_execute_data) = prev_execute_data; |
851 | 0 | return retval; |
852 | 0 | } |
853 | | |
854 | | static inline zend_result ct_eval_func_call( |
855 | 0 | zend_op_array *op_array, zval *result, zend_string *name, uint32_t num_args, zval **args) { |
856 | 0 | zend_function *func = zend_hash_find_ptr(CG(function_table), name); |
857 | 0 | if (!func || func->type != ZEND_INTERNAL_FUNCTION) { |
858 | 0 | return FAILURE; |
859 | 0 | } |
860 | 0 | return ct_eval_func_call_ex(op_array, result, func, num_args, args); |
861 | 0 | } |
862 | | |
863 | 3.53M | #define SET_RESULT(op, zv) do { \ |
864 | 3.53M | if (ssa_op->op##_def >= 0) { \ |
865 | 850k | set_value(scdf, ctx, ssa_op->op##_def, zv); \ |
866 | 850k | } \ |
867 | 3.53M | } while (0) |
868 | 3.44M | #define SET_RESULT_BOT(op) SET_RESULT(op, &ctx->bot) |
869 | | #define SET_RESULT_TOP(op) SET_RESULT(op, &ctx->top) |
870 | | |
871 | 71.0k | #define SKIP_IF_TOP(op) if (IS_TOP(op)) return; |
872 | | |
873 | 1.33M | static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_op) { |
874 | 1.33M | sccp_ctx *ctx = (sccp_ctx *) scdf; |
875 | 1.33M | zval *op1, *op2, zv; /* zv is a temporary to hold result values */ |
876 | | |
877 | 1.33M | op1 = get_op1_value(ctx, opline, ssa_op); |
878 | 1.33M | op2 = get_op2_value(ctx, opline, ssa_op); |
879 | | |
880 | 1.33M | switch (opline->opcode) { |
881 | 58.2k | case ZEND_ASSIGN: |
882 | | /* The value of op1 is irrelevant here, because we are overwriting it |
883 | | * -- unless it can be a reference, in which case we propagate a BOT. |
884 | | * The result is also BOT in this case, because it might be a typed reference. */ |
885 | 58.2k | if (IS_BOT(op1) && (ctx->scdf.ssa->var_info[ssa_op->op1_use].type & MAY_BE_REF)) { |
886 | 37.8k | SET_RESULT_BOT(op1); |
887 | 37.8k | SET_RESULT_BOT(result); |
888 | 37.8k | } else { |
889 | 20.3k | SET_RESULT(op1, op2); |
890 | 20.3k | SET_RESULT(result, op2); |
891 | 20.3k | } |
892 | 58.2k | return; |
893 | 6.85k | case ZEND_ASSIGN_DIM: |
894 | 6.85k | { |
895 | 6.85k | zval *data = get_op1_value(ctx, opline+1, ssa_op+1); |
896 | | |
897 | | /* If $a in $a[$b]=$c is UNDEF, treat it like NULL. There is no warning. */ |
898 | 6.85k | if ((ctx->scdf.ssa->var_info[ssa_op->op1_use].type & MAY_BE_ANY) == 0) { |
899 | 551 | op1 = &EG(uninitialized_zval); |
900 | 551 | } |
901 | | |
902 | 6.85k | if (IS_BOT(op1)) { |
903 | 5.62k | SET_RESULT_BOT(result); |
904 | 5.62k | SET_RESULT_BOT(op1); |
905 | 5.62k | return; |
906 | 5.62k | } |
907 | | |
908 | 1.22k | SKIP_IF_TOP(op1); |
909 | 1.22k | SKIP_IF_TOP(data); |
910 | 1.22k | if (op2) { |
911 | 752 | SKIP_IF_TOP(op2); |
912 | 752 | } |
913 | | |
914 | 1.22k | if (op2 && IS_BOT(op2)) { |
915 | | /* Update of unknown index */ |
916 | 164 | SET_RESULT_BOT(result); |
917 | 164 | if (ssa_op->op1_def >= 0) { |
918 | 162 | empty_partial_array(&zv); |
919 | 162 | SET_RESULT(op1, &zv); |
920 | 162 | zval_ptr_dtor_nogc(&zv); |
921 | 162 | } else { |
922 | 2 | SET_RESULT_BOT(op1); |
923 | 2 | } |
924 | 164 | return; |
925 | 164 | } |
926 | | |
927 | 1.06k | if (IS_BOT(data)) { |
928 | | |
929 | 663 | SET_RESULT_BOT(result); |
930 | 663 | if ((IS_PARTIAL_ARRAY(op1) |
931 | 663 | || Z_TYPE_P(op1) == IS_NULL |
932 | 663 | || Z_TYPE_P(op1) == IS_FALSE |
933 | 663 | || Z_TYPE_P(op1) == IS_ARRAY) |
934 | 663 | && ssa_op->op1_def >= 0) { |
935 | | |
936 | 649 | if (Z_TYPE_P(op1) == IS_NULL || Z_TYPE_P(op1) == IS_FALSE) { |
937 | 343 | empty_partial_array(&zv); |
938 | 343 | } else { |
939 | 306 | dup_partial_array(&zv, op1); |
940 | 306 | } |
941 | | |
942 | 649 | if (!op2) { |
943 | | /* We can't add NEXT element into partial array (skip it) */ |
944 | 387 | SET_RESULT(op1, &zv); |
945 | 387 | } else if (ct_eval_del_array_elem(&zv, op2) == SUCCESS) { |
946 | 262 | SET_RESULT(op1, &zv); |
947 | 262 | } else { |
948 | 0 | SET_RESULT_BOT(op1); |
949 | 0 | } |
950 | | |
951 | 649 | zval_ptr_dtor_nogc(&zv); |
952 | 649 | } else { |
953 | 14 | SET_RESULT_BOT(op1); |
954 | 14 | } |
955 | | |
956 | 663 | } else { |
957 | | |
958 | 398 | if (IS_PARTIAL_ARRAY(op1)) { |
959 | 158 | dup_partial_array(&zv, op1); |
960 | 240 | } else { |
961 | 240 | ZVAL_COPY(&zv, op1); |
962 | 240 | } |
963 | | |
964 | 398 | if (!op2 && IS_PARTIAL_ARRAY(&zv)) { |
965 | | /* We can't add NEXT element into partial array (skip it) */ |
966 | 4 | SET_RESULT(result, data); |
967 | 4 | SET_RESULT(op1, &zv); |
968 | 394 | } else if (ct_eval_assign_dim(&zv, data, op2) == SUCCESS) { |
969 | | /* Mark array containing partial array as partial */ |
970 | 380 | if (IS_PARTIAL_ARRAY(data)) { |
971 | 44 | MAKE_PARTIAL_ARRAY(&zv); |
972 | 44 | } |
973 | 380 | SET_RESULT(result, data); |
974 | 380 | SET_RESULT(op1, &zv); |
975 | 380 | } else { |
976 | 14 | SET_RESULT_BOT(result); |
977 | 14 | SET_RESULT_BOT(op1); |
978 | 14 | } |
979 | | |
980 | 398 | zval_ptr_dtor_nogc(&zv); |
981 | 398 | } |
982 | 1.06k | return; |
983 | 1.22k | } |
984 | | |
985 | 7.62k | case ZEND_ASSIGN_OBJ: |
986 | 7.62k | if (ssa_op->op1_def >= 0 |
987 | 7.62k | && ctx->scdf.ssa->vars[ssa_op->op1_def].escape_state == ESCAPE_STATE_NO_ESCAPE) { |
988 | 297 | zval *data = get_op1_value(ctx, opline+1, ssa_op+1); |
989 | 297 | zend_ssa_var_info *var_info = &ctx->scdf.ssa->var_info[ssa_op->op1_use]; |
990 | | |
991 | | /* Don't try to propagate assignments to (potentially) typed properties. We would |
992 | | * need to deal with errors and type conversions first. */ |
993 | | // TODO: Distinguish dynamic and declared property assignments here? |
994 | 297 | if (!var_info->ce || (var_info->ce->ce_flags & ZEND_ACC_HAS_TYPE_HINTS) || |
995 | 297 | !(var_info->ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES)) { |
996 | 103 | SET_RESULT_BOT(result); |
997 | 103 | SET_RESULT_BOT(op1); |
998 | 103 | return; |
999 | 103 | } |
1000 | | |
1001 | 194 | if (IS_BOT(op1)) { |
1002 | 8 | SET_RESULT_BOT(result); |
1003 | 8 | SET_RESULT_BOT(op1); |
1004 | 8 | return; |
1005 | 8 | } |
1006 | | |
1007 | 186 | SKIP_IF_TOP(op1); |
1008 | 186 | SKIP_IF_TOP(data); |
1009 | 186 | SKIP_IF_TOP(op2); |
1010 | | |
1011 | 186 | if (IS_BOT(op2)) { |
1012 | | /* Update of unknown property */ |
1013 | 14 | SET_RESULT_BOT(result); |
1014 | 14 | empty_partial_object(&zv); |
1015 | 14 | SET_RESULT(op1, &zv); |
1016 | 14 | zval_ptr_dtor_nogc(&zv); |
1017 | 14 | return; |
1018 | 14 | } |
1019 | | |
1020 | 172 | if (IS_BOT(data)) { |
1021 | 68 | SET_RESULT_BOT(result); |
1022 | 68 | if (IS_PARTIAL_OBJECT(op1) |
1023 | 68 | || Z_TYPE_P(op1) == IS_NULL |
1024 | 68 | || Z_TYPE_P(op1) == IS_FALSE) { |
1025 | | |
1026 | 68 | if (Z_TYPE_P(op1) == IS_NULL || Z_TYPE_P(op1) == IS_FALSE) { |
1027 | 0 | empty_partial_object(&zv); |
1028 | 68 | } else { |
1029 | 68 | dup_partial_object(&zv, op1); |
1030 | 68 | } |
1031 | | |
1032 | 68 | if (ct_eval_del_obj_prop(&zv, op2) == SUCCESS) { |
1033 | 68 | SET_RESULT(op1, &zv); |
1034 | 68 | } else { |
1035 | 0 | SET_RESULT_BOT(op1); |
1036 | 0 | } |
1037 | 68 | zval_ptr_dtor_nogc(&zv); |
1038 | 68 | } else { |
1039 | 0 | SET_RESULT_BOT(op1); |
1040 | 0 | } |
1041 | | |
1042 | 104 | } else { |
1043 | | |
1044 | 104 | if (IS_PARTIAL_OBJECT(op1)) { |
1045 | 104 | dup_partial_object(&zv, op1); |
1046 | 104 | } else { |
1047 | 0 | ZVAL_COPY(&zv, op1); |
1048 | 0 | } |
1049 | | |
1050 | 104 | if (ct_eval_assign_obj(&zv, data, op2) == SUCCESS) { |
1051 | 104 | SET_RESULT(result, data); |
1052 | 104 | SET_RESULT(op1, &zv); |
1053 | 104 | } else { |
1054 | 0 | SET_RESULT_BOT(result); |
1055 | 0 | SET_RESULT_BOT(op1); |
1056 | 0 | } |
1057 | | |
1058 | 104 | zval_ptr_dtor_nogc(&zv); |
1059 | 104 | } |
1060 | 7.32k | } else { |
1061 | 7.32k | SET_RESULT_BOT(result); |
1062 | 7.32k | SET_RESULT_BOT(op1); |
1063 | 7.32k | } |
1064 | 7.49k | return; |
1065 | | |
1066 | 55.7k | case ZEND_SEND_VAL: |
1067 | 88.2k | case ZEND_SEND_VAR: |
1068 | 88.2k | { |
1069 | | /* If the value of a SEND for an ICALL changes, we need to reconsider the |
1070 | | * ICALL result value. Otherwise we can ignore the opcode. */ |
1071 | 88.2k | zend_call_info *call; |
1072 | 88.2k | if (!ctx->call_map) { |
1073 | 410 | return; |
1074 | 410 | } |
1075 | | |
1076 | 87.8k | call = ctx->call_map[opline - ctx->scdf.op_array->opcodes]; |
1077 | 87.8k | if (IS_TOP(op1) || !call || !call->caller_call_opline |
1078 | 87.8k | || call->caller_call_opline->opcode != ZEND_DO_ICALL) { |
1079 | 87.8k | return; |
1080 | 87.8k | } |
1081 | | |
1082 | 0 | opline = call->caller_call_opline; |
1083 | 0 | ssa_op = &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes]; |
1084 | 0 | break; |
1085 | 87.8k | } |
1086 | 3.73k | case ZEND_INIT_ARRAY: |
1087 | 21.1k | case ZEND_ADD_ARRAY_ELEMENT: |
1088 | 21.1k | { |
1089 | 21.1k | zval *result = NULL; |
1090 | | |
1091 | 21.1k | if (opline->opcode == ZEND_ADD_ARRAY_ELEMENT) { |
1092 | 17.4k | result = &ctx->values[ssa_op->result_use]; |
1093 | 17.4k | if (IS_BOT(result)) { |
1094 | 170 | SET_RESULT_BOT(result); |
1095 | 170 | SET_RESULT_BOT(op1); |
1096 | 170 | return; |
1097 | 170 | } |
1098 | 17.2k | SKIP_IF_TOP(result); |
1099 | 17.2k | } |
1100 | | |
1101 | 21.0k | if (op1) { |
1102 | 20.9k | SKIP_IF_TOP(op1); |
1103 | 20.9k | } |
1104 | | |
1105 | 21.0k | if (op2) { |
1106 | 1.54k | SKIP_IF_TOP(op2); |
1107 | 1.54k | } |
1108 | | |
1109 | | /* We want to avoid keeping around intermediate arrays for each SSA variable in the |
1110 | | * ADD_ARRAY_ELEMENT chain. We do this by only keeping the array on the last opcode |
1111 | | * and use a NULL value everywhere else. */ |
1112 | 21.0k | if (result && Z_TYPE_P(result) == IS_NULL) { |
1113 | 0 | SET_RESULT_BOT(result); |
1114 | 0 | return; |
1115 | 0 | } |
1116 | | |
1117 | 21.0k | if (op2 && IS_BOT(op2)) { |
1118 | | /* Update of unknown index */ |
1119 | 633 | SET_RESULT_BOT(op1); |
1120 | 633 | if (ssa_op->result_def >= 0) { |
1121 | 633 | empty_partial_array(&zv); |
1122 | 633 | SET_RESULT(result, &zv); |
1123 | 633 | zval_ptr_dtor_nogc(&zv); |
1124 | 633 | } else { |
1125 | 0 | SET_RESULT_BOT(result); |
1126 | 0 | } |
1127 | 633 | return; |
1128 | 633 | } |
1129 | | |
1130 | 20.3k | if ((op1 && IS_BOT(op1)) |
1131 | 20.3k | || (opline->extended_value & ZEND_ARRAY_ELEMENT_REF)) { |
1132 | | |
1133 | 7.43k | SET_RESULT_BOT(op1); |
1134 | 7.43k | if (ssa_op->result_def >= 0) { |
1135 | 7.43k | if (!result) { |
1136 | 2.39k | empty_partial_array(&zv); |
1137 | 5.03k | } else { |
1138 | 5.03k | MAKE_PARTIAL_ARRAY(result); |
1139 | 5.03k | ZVAL_COPY_VALUE(&zv, result); |
1140 | 5.03k | ZVAL_NULL(result); |
1141 | 5.03k | } |
1142 | 7.43k | if (!op2) { |
1143 | | /* We can't add NEXT element into partial array (skip it) */ |
1144 | 7.07k | SET_RESULT(result, &zv); |
1145 | 7.07k | } else if (ct_eval_del_array_elem(&zv, op2) == SUCCESS) { |
1146 | 346 | SET_RESULT(result, &zv); |
1147 | 346 | } else { |
1148 | 6 | SET_RESULT_BOT(result); |
1149 | 6 | } |
1150 | 7.43k | zval_ptr_dtor_nogc(&zv); |
1151 | 7.43k | } else { |
1152 | | /* If any operand is BOT, mark the result as BOT right away. |
1153 | | * Exceptions to this rule are handled above. */ |
1154 | 0 | SET_RESULT_BOT(result); |
1155 | 0 | } |
1156 | | |
1157 | 12.9k | } else { |
1158 | 12.9k | if (result) { |
1159 | 11.9k | ZVAL_COPY_VALUE(&zv, result); |
1160 | 11.9k | ZVAL_NULL(result); |
1161 | 11.9k | } else { |
1162 | 1.04k | array_init(&zv); |
1163 | 1.04k | } |
1164 | | |
1165 | 12.9k | if (op1) { |
1166 | 12.8k | if (!op2 && IS_PARTIAL_ARRAY(&zv)) { |
1167 | | /* We can't add NEXT element into partial array (skip it) */ |
1168 | 8.54k | SET_RESULT(result, &zv); |
1169 | 8.54k | } else if (ct_eval_add_array_elem(&zv, op1, op2) == SUCCESS) { |
1170 | 4.32k | if (IS_PARTIAL_ARRAY(op1)) { |
1171 | 253 | MAKE_PARTIAL_ARRAY(&zv); |
1172 | 253 | } |
1173 | 4.32k | SET_RESULT(result, &zv); |
1174 | 4.32k | } else { |
1175 | 18 | SET_RESULT_BOT(result); |
1176 | 18 | } |
1177 | 12.8k | } else { |
1178 | 78 | SET_RESULT(result, &zv); |
1179 | 78 | } |
1180 | | |
1181 | 12.9k | zval_ptr_dtor_nogc(&zv); |
1182 | 12.9k | } |
1183 | 20.3k | return; |
1184 | 21.0k | } |
1185 | 150 | case ZEND_ADD_ARRAY_UNPACK: { |
1186 | 150 | zval *result = &ctx->values[ssa_op->result_use]; |
1187 | 150 | if (IS_BOT(result) || IS_BOT(op1)) { |
1188 | 124 | SET_RESULT_BOT(result); |
1189 | 124 | return; |
1190 | 124 | } |
1191 | 26 | SKIP_IF_TOP(result); |
1192 | 26 | SKIP_IF_TOP(op1); |
1193 | | |
1194 | | /* See comment for ADD_ARRAY_ELEMENT. */ |
1195 | 26 | if (Z_TYPE_P(result) == IS_NULL) { |
1196 | 0 | SET_RESULT_BOT(result); |
1197 | 0 | return; |
1198 | 0 | } |
1199 | 26 | ZVAL_COPY_VALUE(&zv, result); |
1200 | 26 | ZVAL_NULL(result); |
1201 | | |
1202 | 26 | if (ct_eval_add_array_unpack(&zv, op1) == SUCCESS) { |
1203 | 14 | SET_RESULT(result, &zv); |
1204 | 14 | } else { |
1205 | 12 | SET_RESULT_BOT(result); |
1206 | 12 | } |
1207 | 26 | zval_ptr_dtor_nogc(&zv); |
1208 | 26 | return; |
1209 | 26 | } |
1210 | 25.0k | case ZEND_NEW: |
1211 | 25.0k | if (ssa_op->result_def >= 0 |
1212 | 25.0k | && ctx->scdf.ssa->vars[ssa_op->result_def].escape_state == ESCAPE_STATE_NO_ESCAPE) { |
1213 | 364 | empty_partial_object(&zv); |
1214 | 364 | SET_RESULT(result, &zv); |
1215 | 364 | zval_ptr_dtor_nogc(&zv); |
1216 | 24.6k | } else { |
1217 | 24.6k | SET_RESULT_BOT(result); |
1218 | 24.6k | } |
1219 | 25.0k | return; |
1220 | 110 | case ZEND_ASSIGN_STATIC_PROP_REF: |
1221 | 413 | case ZEND_ASSIGN_OBJ_REF: |
1222 | | /* Handled here because we also need to BOT the OP_DATA operand, while the generic |
1223 | | * code below will not do so. */ |
1224 | 413 | SET_RESULT_BOT(result); |
1225 | 413 | SET_RESULT_BOT(op1); |
1226 | 413 | SET_RESULT_BOT(op2); |
1227 | 413 | opline++; |
1228 | 413 | ssa_op++; |
1229 | 413 | SET_RESULT_BOT(op1); |
1230 | 413 | break; |
1231 | 1.33M | } |
1232 | | |
1233 | 1.12M | if ((op1 && IS_BOT(op1)) || (op2 && IS_BOT(op2))) { |
1234 | | /* If any operand is BOT, mark the result as BOT right away. |
1235 | | * Exceptions to this rule are handled above. */ |
1236 | 672k | SET_RESULT_BOT(result); |
1237 | 672k | SET_RESULT_BOT(op1); |
1238 | 672k | SET_RESULT_BOT(op2); |
1239 | 672k | return; |
1240 | 672k | } |
1241 | | |
1242 | 455k | switch (opline->opcode) { |
1243 | 157 | case ZEND_ADD: |
1244 | 356 | case ZEND_SUB: |
1245 | 548 | case ZEND_MUL: |
1246 | 588 | case ZEND_DIV: |
1247 | 1.78k | case ZEND_MOD: |
1248 | 1.78k | case ZEND_POW: |
1249 | 2.01k | case ZEND_SL: |
1250 | 2.14k | case ZEND_SR: |
1251 | 2.23k | case ZEND_CONCAT: |
1252 | 2.24k | case ZEND_FAST_CONCAT: |
1253 | 2.24k | case ZEND_IS_EQUAL: |
1254 | 2.31k | case ZEND_IS_NOT_EQUAL: |
1255 | 3.65k | case ZEND_IS_SMALLER: |
1256 | 4.34k | case ZEND_IS_SMALLER_OR_EQUAL: |
1257 | 4.35k | case ZEND_IS_IDENTICAL: |
1258 | 4.35k | case ZEND_IS_NOT_IDENTICAL: |
1259 | 4.45k | case ZEND_BW_OR: |
1260 | 4.62k | case ZEND_BW_AND: |
1261 | 5.74k | case ZEND_BW_XOR: |
1262 | 5.74k | case ZEND_BOOL_XOR: |
1263 | 5.75k | case ZEND_CASE: |
1264 | 5.81k | case ZEND_CASE_STRICT: |
1265 | 5.81k | SKIP_IF_TOP(op1); |
1266 | 5.81k | SKIP_IF_TOP(op2); |
1267 | | |
1268 | 5.81k | if (ct_eval_binary_op(&zv, opline->opcode, op1, op2) == SUCCESS) { |
1269 | 2.68k | SET_RESULT(result, &zv); |
1270 | 2.68k | zval_ptr_dtor_nogc(&zv); |
1271 | 2.68k | break; |
1272 | 2.68k | } |
1273 | 3.12k | SET_RESULT_BOT(result); |
1274 | 3.12k | break; |
1275 | 256 | case ZEND_ASSIGN_OP: |
1276 | 311 | case ZEND_ASSIGN_DIM_OP: |
1277 | 413 | case ZEND_ASSIGN_OBJ_OP: |
1278 | 425 | case ZEND_ASSIGN_STATIC_PROP_OP: |
1279 | 425 | if (op1) { |
1280 | 333 | SKIP_IF_TOP(op1); |
1281 | 333 | } |
1282 | 425 | if (op2) { |
1283 | 424 | SKIP_IF_TOP(op2); |
1284 | 424 | } |
1285 | 425 | if (opline->opcode == ZEND_ASSIGN_OP) { |
1286 | 256 | if (ct_eval_binary_op(&zv, opline->extended_value, op1, op2) == SUCCESS) { |
1287 | 252 | SET_RESULT(op1, &zv); |
1288 | 252 | SET_RESULT(result, &zv); |
1289 | 252 | zval_ptr_dtor_nogc(&zv); |
1290 | 252 | break; |
1291 | 252 | } |
1292 | 256 | } else if (opline->opcode == ZEND_ASSIGN_DIM_OP) { |
1293 | 55 | if ((IS_PARTIAL_ARRAY(op1) || Z_TYPE_P(op1) == IS_ARRAY) |
1294 | 55 | && ssa_op->op1_def >= 0 && op2) { |
1295 | 52 | zval tmp; |
1296 | 52 | zval *data = get_op1_value(ctx, opline+1, ssa_op+1); |
1297 | | |
1298 | 52 | SKIP_IF_TOP(data); |
1299 | | |
1300 | 52 | if (ct_eval_fetch_dim(&tmp, op1, op2, 0) == SUCCESS) { |
1301 | 12 | if (IS_BOT(data)) { |
1302 | 0 | dup_partial_array(&zv, op1); |
1303 | 0 | ct_eval_del_array_elem(&zv, op2); |
1304 | 0 | SET_RESULT_BOT(result); |
1305 | 0 | SET_RESULT(op1, &zv); |
1306 | 0 | zval_ptr_dtor_nogc(&tmp); |
1307 | 0 | zval_ptr_dtor_nogc(&zv); |
1308 | 0 | break; |
1309 | 0 | } |
1310 | | |
1311 | 12 | if (ct_eval_binary_op(&tmp, opline->extended_value, &tmp, data) == FAILURE) { |
1312 | 2 | SET_RESULT_BOT(result); |
1313 | 2 | SET_RESULT_BOT(op1); |
1314 | 2 | zval_ptr_dtor_nogc(&tmp); |
1315 | 2 | break; |
1316 | 2 | } |
1317 | | |
1318 | 10 | if (IS_PARTIAL_ARRAY(op1)) { |
1319 | 0 | dup_partial_array(&zv, op1); |
1320 | 10 | } else { |
1321 | 10 | ZVAL_COPY(&zv, op1); |
1322 | 10 | } |
1323 | | |
1324 | 10 | if (ct_eval_assign_dim(&zv, &tmp, op2) == SUCCESS) { |
1325 | 10 | SET_RESULT(result, &tmp); |
1326 | 10 | SET_RESULT(op1, &zv); |
1327 | 10 | zval_ptr_dtor_nogc(&tmp); |
1328 | 10 | zval_ptr_dtor_nogc(&zv); |
1329 | 10 | break; |
1330 | 10 | } |
1331 | | |
1332 | 0 | zval_ptr_dtor_nogc(&tmp); |
1333 | 0 | zval_ptr_dtor_nogc(&zv); |
1334 | 0 | } |
1335 | 52 | } |
1336 | 114 | } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) { |
1337 | 102 | if (op1 && IS_PARTIAL_OBJECT(op1) |
1338 | 102 | && ssa_op->op1_def >= 0 |
1339 | 102 | && ctx->scdf.ssa->vars[ssa_op->op1_def].escape_state == ESCAPE_STATE_NO_ESCAPE) { |
1340 | 10 | zval tmp; |
1341 | 10 | zval *data = get_op1_value(ctx, opline+1, ssa_op+1); |
1342 | | |
1343 | 10 | SKIP_IF_TOP(data); |
1344 | | |
1345 | 10 | if (ct_eval_fetch_obj(&tmp, op1, op2) == SUCCESS) { |
1346 | 0 | if (IS_BOT(data)) { |
1347 | 0 | dup_partial_object(&zv, op1); |
1348 | 0 | ct_eval_del_obj_prop(&zv, op2); |
1349 | 0 | SET_RESULT_BOT(result); |
1350 | 0 | SET_RESULT(op1, &zv); |
1351 | 0 | zval_ptr_dtor_nogc(&tmp); |
1352 | 0 | zval_ptr_dtor_nogc(&zv); |
1353 | 0 | break; |
1354 | 0 | } |
1355 | | |
1356 | 0 | if (ct_eval_binary_op(&tmp, opline->extended_value, &tmp, data) == FAILURE) { |
1357 | 0 | SET_RESULT_BOT(result); |
1358 | 0 | SET_RESULT_BOT(op1); |
1359 | 0 | zval_ptr_dtor_nogc(&tmp); |
1360 | 0 | break; |
1361 | 0 | } |
1362 | | |
1363 | 0 | dup_partial_object(&zv, op1); |
1364 | |
|
1365 | 0 | if (ct_eval_assign_obj(&zv, &tmp, op2) == SUCCESS) { |
1366 | 0 | SET_RESULT(result, &tmp); |
1367 | 0 | SET_RESULT(op1, &zv); |
1368 | 0 | zval_ptr_dtor_nogc(&tmp); |
1369 | 0 | zval_ptr_dtor_nogc(&zv); |
1370 | 0 | break; |
1371 | 0 | } |
1372 | | |
1373 | 0 | zval_ptr_dtor_nogc(&tmp); |
1374 | 0 | zval_ptr_dtor_nogc(&zv); |
1375 | 0 | } |
1376 | 10 | } |
1377 | 102 | } |
1378 | 161 | SET_RESULT_BOT(result); |
1379 | 161 | SET_RESULT_BOT(op1); |
1380 | 161 | break; |
1381 | 132 | case ZEND_PRE_INC_OBJ: |
1382 | 150 | case ZEND_PRE_DEC_OBJ: |
1383 | 162 | case ZEND_POST_INC_OBJ: |
1384 | 172 | case ZEND_POST_DEC_OBJ: |
1385 | 172 | if (op1) { |
1386 | 8 | SKIP_IF_TOP(op1); |
1387 | 8 | SKIP_IF_TOP(op2); |
1388 | 8 | if (IS_PARTIAL_OBJECT(op1) |
1389 | 8 | && ssa_op->op1_def >= 0 |
1390 | 8 | && ctx->scdf.ssa->vars[ssa_op->op1_def].escape_state == ESCAPE_STATE_NO_ESCAPE) { |
1391 | 8 | zval tmp1, tmp2; |
1392 | | |
1393 | 8 | if (ct_eval_fetch_obj(&tmp1, op1, op2) == SUCCESS) { |
1394 | 8 | if (ct_eval_incdec(&tmp2, opline->opcode, &tmp1) == SUCCESS) { |
1395 | 0 | dup_partial_object(&zv, op1); |
1396 | 0 | ct_eval_assign_obj(&zv, &tmp2, op2); |
1397 | 0 | if (opline->opcode == ZEND_PRE_INC_OBJ || opline->opcode == ZEND_PRE_DEC_OBJ) { |
1398 | 0 | SET_RESULT(result, &tmp2); |
1399 | 0 | } else { |
1400 | 0 | SET_RESULT(result, &tmp1); |
1401 | 0 | } |
1402 | 0 | zval_ptr_dtor_nogc(&tmp1); |
1403 | 0 | zval_ptr_dtor_nogc(&tmp2); |
1404 | 0 | SET_RESULT(op1, &zv); |
1405 | 0 | zval_ptr_dtor_nogc(&zv); |
1406 | 0 | break; |
1407 | 0 | } |
1408 | 8 | zval_ptr_dtor_nogc(&tmp1); |
1409 | 8 | } |
1410 | 8 | } |
1411 | 8 | } |
1412 | 172 | SET_RESULT_BOT(op1); |
1413 | 172 | SET_RESULT_BOT(result); |
1414 | 172 | break; |
1415 | 1.32k | case ZEND_PRE_INC: |
1416 | 1.33k | case ZEND_PRE_DEC: |
1417 | 1.33k | SKIP_IF_TOP(op1); |
1418 | 1.33k | if (ct_eval_incdec(&zv, opline->opcode, op1) == SUCCESS) { |
1419 | 1.31k | SET_RESULT(op1, &zv); |
1420 | 1.31k | SET_RESULT(result, &zv); |
1421 | 1.31k | zval_ptr_dtor_nogc(&zv); |
1422 | 1.31k | break; |
1423 | 1.31k | } |
1424 | 26 | SET_RESULT_BOT(op1); |
1425 | 26 | SET_RESULT_BOT(result); |
1426 | 26 | break; |
1427 | 295 | case ZEND_POST_INC: |
1428 | 312 | case ZEND_POST_DEC: |
1429 | 312 | SKIP_IF_TOP(op1); |
1430 | 312 | SET_RESULT(result, op1); |
1431 | 312 | if (ct_eval_incdec(&zv, opline->opcode, op1) == SUCCESS) { |
1432 | 310 | SET_RESULT(op1, &zv); |
1433 | 310 | zval_ptr_dtor_nogc(&zv); |
1434 | 310 | break; |
1435 | 310 | } |
1436 | 2 | SET_RESULT_BOT(op1); |
1437 | 2 | break; |
1438 | 146 | case ZEND_BW_NOT: |
1439 | 354 | case ZEND_BOOL_NOT: |
1440 | 354 | SKIP_IF_TOP(op1); |
1441 | 354 | if (IS_PARTIAL_ARRAY(op1)) { |
1442 | 10 | SET_RESULT_BOT(result); |
1443 | 10 | break; |
1444 | 10 | } |
1445 | 344 | if (zend_optimizer_eval_unary_op(&zv, opline->opcode, op1) == SUCCESS) { |
1446 | 250 | SET_RESULT(result, &zv); |
1447 | 250 | zval_ptr_dtor_nogc(&zv); |
1448 | 250 | break; |
1449 | 250 | } |
1450 | 94 | SET_RESULT_BOT(result); |
1451 | 94 | break; |
1452 | 294 | case ZEND_CAST: |
1453 | 294 | SKIP_IF_TOP(op1); |
1454 | 294 | if (IS_PARTIAL_ARRAY(op1)) { |
1455 | 20 | SET_RESULT_BOT(result); |
1456 | 20 | break; |
1457 | 20 | } |
1458 | 274 | if (zend_optimizer_eval_cast(&zv, opline->extended_value, op1) == SUCCESS) { |
1459 | 4 | SET_RESULT(result, &zv); |
1460 | 4 | zval_ptr_dtor_nogc(&zv); |
1461 | 4 | break; |
1462 | 4 | } |
1463 | 270 | SET_RESULT_BOT(result); |
1464 | 270 | break; |
1465 | 49 | case ZEND_BOOL: |
1466 | 57 | case ZEND_JMPZ_EX: |
1467 | 115 | case ZEND_JMPNZ_EX: |
1468 | 115 | SKIP_IF_TOP(op1); |
1469 | 115 | if (ct_eval_bool_cast(&zv, op1) == SUCCESS) { |
1470 | 115 | SET_RESULT(result, &zv); |
1471 | 115 | zval_ptr_dtor_nogc(&zv); |
1472 | 115 | break; |
1473 | 115 | } |
1474 | 0 | SET_RESULT_BOT(result); |
1475 | 0 | break; |
1476 | 2 | case ZEND_STRLEN: |
1477 | 2 | SKIP_IF_TOP(op1); |
1478 | 2 | if (zend_optimizer_eval_strlen(&zv, op1) == SUCCESS) { |
1479 | 0 | SET_RESULT(result, &zv); |
1480 | 0 | zval_ptr_dtor_nogc(&zv); |
1481 | 0 | break; |
1482 | 0 | } |
1483 | 2 | SET_RESULT_BOT(result); |
1484 | 2 | break; |
1485 | 72 | case ZEND_YIELD_FROM: |
1486 | | // tmp = yield from [] -> tmp = null |
1487 | 72 | SKIP_IF_TOP(op1); |
1488 | 72 | if (Z_TYPE_P(op1) == IS_ARRAY && zend_hash_num_elements(Z_ARR_P(op1)) == 0) { |
1489 | 14 | ZVAL_NULL(&zv); |
1490 | 14 | SET_RESULT(result, &zv); |
1491 | 14 | break; |
1492 | 14 | } |
1493 | 58 | SET_RESULT_BOT(result); |
1494 | 58 | break; |
1495 | 56 | case ZEND_COUNT: |
1496 | 56 | SKIP_IF_TOP(op1); |
1497 | 56 | if (Z_TYPE_P(op1) == IS_ARRAY) { |
1498 | 6 | ZVAL_LONG(&zv, zend_hash_num_elements(Z_ARRVAL_P(op1))); |
1499 | 6 | SET_RESULT(result, &zv); |
1500 | 6 | zval_ptr_dtor_nogc(&zv); |
1501 | 6 | break; |
1502 | 6 | } |
1503 | 50 | SET_RESULT_BOT(result); |
1504 | 50 | break; |
1505 | 0 | case ZEND_IN_ARRAY: |
1506 | 0 | SKIP_IF_TOP(op1); |
1507 | 0 | SKIP_IF_TOP(op2); |
1508 | 0 | if (ct_eval_in_array(&zv, opline->extended_value, op1, op2) == SUCCESS) { |
1509 | 0 | SET_RESULT(result, &zv); |
1510 | 0 | zval_ptr_dtor_nogc(&zv); |
1511 | 0 | break; |
1512 | 0 | } |
1513 | 0 | SET_RESULT_BOT(result); |
1514 | 0 | break; |
1515 | 0 | case ZEND_ARRAY_KEY_EXISTS: |
1516 | 0 | SKIP_IF_TOP(op1); |
1517 | 0 | SKIP_IF_TOP(op2); |
1518 | 0 | if (ct_eval_array_key_exists(&zv, op1, op2) == SUCCESS) { |
1519 | 0 | SET_RESULT(result, &zv); |
1520 | 0 | zval_ptr_dtor_nogc(&zv); |
1521 | 0 | break; |
1522 | 0 | } |
1523 | 0 | SET_RESULT_BOT(result); |
1524 | 0 | break; |
1525 | 349 | case ZEND_FETCH_DIM_R: |
1526 | 363 | case ZEND_FETCH_DIM_IS: |
1527 | 735 | case ZEND_FETCH_LIST_R: |
1528 | 735 | SKIP_IF_TOP(op1); |
1529 | 735 | SKIP_IF_TOP(op2); |
1530 | | |
1531 | 735 | if (ct_eval_fetch_dim(&zv, op1, op2, (opline->opcode != ZEND_FETCH_LIST_R)) == SUCCESS) { |
1532 | 532 | SET_RESULT(result, &zv); |
1533 | 532 | zval_ptr_dtor_nogc(&zv); |
1534 | 532 | break; |
1535 | 532 | } |
1536 | 203 | SET_RESULT_BOT(result); |
1537 | 203 | break; |
1538 | 37 | case ZEND_ISSET_ISEMPTY_DIM_OBJ: |
1539 | 37 | SKIP_IF_TOP(op1); |
1540 | 37 | SKIP_IF_TOP(op2); |
1541 | | |
1542 | 37 | if (ct_eval_isset_dim(&zv, opline->extended_value, op1, op2) == SUCCESS) { |
1543 | 37 | SET_RESULT(result, &zv); |
1544 | 37 | zval_ptr_dtor_nogc(&zv); |
1545 | 37 | break; |
1546 | 37 | } |
1547 | 0 | SET_RESULT_BOT(result); |
1548 | 0 | break; |
1549 | 2.09k | case ZEND_FETCH_OBJ_R: |
1550 | 2.27k | case ZEND_FETCH_OBJ_IS: |
1551 | 2.27k | if (op1) { |
1552 | 70 | SKIP_IF_TOP(op1); |
1553 | 70 | SKIP_IF_TOP(op2); |
1554 | | |
1555 | 70 | if (ct_eval_fetch_obj(&zv, op1, op2) == SUCCESS) { |
1556 | 0 | SET_RESULT(result, &zv); |
1557 | 0 | zval_ptr_dtor_nogc(&zv); |
1558 | 0 | break; |
1559 | 0 | } |
1560 | 70 | } |
1561 | 2.27k | SET_RESULT_BOT(result); |
1562 | 2.27k | break; |
1563 | 68 | case ZEND_ISSET_ISEMPTY_PROP_OBJ: |
1564 | 68 | if (op1) { |
1565 | 20 | SKIP_IF_TOP(op1); |
1566 | 20 | SKIP_IF_TOP(op2); |
1567 | | |
1568 | 20 | if (ct_eval_isset_obj(&zv, opline->extended_value, op1, op2) == SUCCESS) { |
1569 | 20 | SET_RESULT(result, &zv); |
1570 | 20 | zval_ptr_dtor_nogc(&zv); |
1571 | 20 | break; |
1572 | 20 | } |
1573 | 20 | } |
1574 | 48 | SET_RESULT_BOT(result); |
1575 | 48 | break; |
1576 | 4.05k | case ZEND_QM_ASSIGN: |
1577 | 4.43k | case ZEND_JMP_SET: |
1578 | 4.46k | case ZEND_COALESCE: |
1579 | 4.46k | case ZEND_COPY_TMP: |
1580 | 4.46k | SET_RESULT(result, op1); |
1581 | 4.46k | break; |
1582 | 44 | case ZEND_JMP_NULL: |
1583 | 44 | switch (opline->extended_value & ZEND_SHORT_CIRCUITING_CHAIN_MASK) { |
1584 | 44 | case ZEND_SHORT_CIRCUITING_CHAIN_EXPR: |
1585 | 44 | ZVAL_NULL(&zv); |
1586 | 44 | break; |
1587 | 0 | case ZEND_SHORT_CIRCUITING_CHAIN_ISSET: |
1588 | 0 | ZVAL_FALSE(&zv); |
1589 | 0 | break; |
1590 | 0 | case ZEND_SHORT_CIRCUITING_CHAIN_EMPTY: |
1591 | 0 | ZVAL_TRUE(&zv); |
1592 | 0 | break; |
1593 | 44 | EMPTY_SWITCH_DEFAULT_CASE() |
1594 | 44 | } |
1595 | 44 | SET_RESULT(result, &zv); |
1596 | 44 | break; |
1597 | 62 | case ZEND_FETCH_CLASS: |
1598 | 62 | SET_RESULT(result, op2); |
1599 | 62 | break; |
1600 | 4 | case ZEND_ISSET_ISEMPTY_CV: |
1601 | 4 | SKIP_IF_TOP(op1); |
1602 | 4 | if (ct_eval_isset_isempty(&zv, opline->extended_value, op1) == SUCCESS) { |
1603 | 4 | SET_RESULT(result, &zv); |
1604 | 4 | zval_ptr_dtor_nogc(&zv); |
1605 | 4 | break; |
1606 | 4 | } |
1607 | 0 | SET_RESULT_BOT(result); |
1608 | 0 | break; |
1609 | 6 | case ZEND_TYPE_CHECK: |
1610 | 6 | SKIP_IF_TOP(op1); |
1611 | 6 | ct_eval_type_check(&zv, opline->extended_value, op1); |
1612 | 6 | SET_RESULT(result, &zv); |
1613 | 6 | zval_ptr_dtor_nogc(&zv); |
1614 | 6 | break; |
1615 | 4 | case ZEND_INSTANCEOF: |
1616 | 4 | SKIP_IF_TOP(op1); |
1617 | 4 | ZVAL_FALSE(&zv); |
1618 | 4 | SET_RESULT(result, &zv); |
1619 | 4 | break; |
1620 | 10.6k | case ZEND_ROPE_INIT: |
1621 | 10.6k | SKIP_IF_TOP(op2); |
1622 | 10.6k | if (IS_PARTIAL_ARRAY(op2)) { |
1623 | 0 | SET_RESULT_BOT(result); |
1624 | 0 | break; |
1625 | 0 | } |
1626 | 10.6k | if (zend_optimizer_eval_cast(&zv, IS_STRING, op2) == SUCCESS) { |
1627 | 10.6k | SET_RESULT(result, &zv); |
1628 | 10.6k | zval_ptr_dtor_nogc(&zv); |
1629 | 10.6k | break; |
1630 | 10.6k | } |
1631 | 0 | SET_RESULT_BOT(result); |
1632 | 0 | break; |
1633 | 23 | case ZEND_ROPE_ADD: |
1634 | 40 | case ZEND_ROPE_END: |
1635 | | // TODO The way this is currently implemented will result in quadratic runtime |
1636 | | // This is not necessary, the way the algorithm works it's okay to reuse the same |
1637 | | // string for all SSA vars with some extra checks |
1638 | 40 | SKIP_IF_TOP(op1); |
1639 | 40 | SKIP_IF_TOP(op2); |
1640 | 40 | if (ct_eval_binary_op(&zv, ZEND_CONCAT, op1, op2) == SUCCESS) { |
1641 | 40 | SET_RESULT(result, &zv); |
1642 | 40 | zval_ptr_dtor_nogc(&zv); |
1643 | 40 | break; |
1644 | 40 | } |
1645 | 0 | SET_RESULT_BOT(result); |
1646 | 0 | break; |
1647 | 0 | case ZEND_DO_ICALL: |
1648 | 0 | { |
1649 | 0 | zend_call_info *call; |
1650 | 0 | zval *name, *args[3] = {NULL}; |
1651 | 0 | int i; |
1652 | |
|
1653 | 0 | if (!ctx->call_map) { |
1654 | 0 | SET_RESULT_BOT(result); |
1655 | 0 | break; |
1656 | 0 | } |
1657 | | |
1658 | 0 | call = ctx->call_map[opline - ctx->scdf.op_array->opcodes]; |
1659 | 0 | name = CT_CONSTANT_EX(ctx->scdf.op_array, call->caller_init_opline->op2.constant); |
1660 | | |
1661 | | /* We already know it can't be evaluated, don't bother checking again */ |
1662 | 0 | if (ssa_op->result_def < 0 || IS_BOT(&ctx->values[ssa_op->result_def])) { |
1663 | 0 | break; |
1664 | 0 | } |
1665 | | |
1666 | | /* We're only interested in functions with up to three arguments right now. |
1667 | | * Note that named arguments with the argument in declaration order will still work. */ |
1668 | 0 | if (call->num_args > 3 || call->send_unpack || call->is_prototype || call->named_args) { |
1669 | 0 | SET_RESULT_BOT(result); |
1670 | 0 | break; |
1671 | 0 | } |
1672 | | |
1673 | 0 | for (i = 0; i < call->num_args; i++) { |
1674 | 0 | zend_op *opline = call->arg_info[i].opline; |
1675 | 0 | if (opline->opcode != ZEND_SEND_VAL && opline->opcode != ZEND_SEND_VAR) { |
1676 | 0 | SET_RESULT_BOT(result); |
1677 | 0 | return; |
1678 | 0 | } |
1679 | | |
1680 | 0 | args[i] = get_op1_value(ctx, opline, |
1681 | 0 | &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes]); |
1682 | 0 | if (args[i]) { |
1683 | 0 | if (IS_BOT(args[i]) || IS_PARTIAL_ARRAY(args[i])) { |
1684 | 0 | SET_RESULT_BOT(result); |
1685 | 0 | return; |
1686 | 0 | } else if (IS_TOP(args[i])) { |
1687 | 0 | return; |
1688 | 0 | } |
1689 | 0 | } |
1690 | 0 | } |
1691 | | |
1692 | | /* We didn't get a BOT argument, so value stays the same */ |
1693 | 0 | if (!IS_TOP(&ctx->values[ssa_op->result_def])) { |
1694 | 0 | break; |
1695 | 0 | } |
1696 | | |
1697 | 0 | if (ct_eval_func_call(scdf->op_array, &zv, Z_STR_P(name), call->num_args, args) == SUCCESS) { |
1698 | 0 | SET_RESULT(result, &zv); |
1699 | 0 | zval_ptr_dtor_nogc(&zv); |
1700 | 0 | break; |
1701 | 0 | } |
1702 | | |
1703 | | #if 0 |
1704 | | /* sort out | uniq -c | sort -n */ |
1705 | | fprintf(stderr, "%s\n", Z_STRVAL_P(name)); |
1706 | | /*if (args[1]) { |
1707 | | php_printf("%s %Z %Z\n", Z_STRVAL_P(name), args[0], args[1]); |
1708 | | } else { |
1709 | | php_printf("%s %Z\n", Z_STRVAL_P(name), args[0]); |
1710 | | }*/ |
1711 | | #endif |
1712 | | |
1713 | 0 | SET_RESULT_BOT(result); |
1714 | 0 | break; |
1715 | 0 | } |
1716 | 0 | case ZEND_FRAMELESS_ICALL_0: |
1717 | 0 | case ZEND_FRAMELESS_ICALL_1: |
1718 | 0 | case ZEND_FRAMELESS_ICALL_2: |
1719 | 0 | case ZEND_FRAMELESS_ICALL_3: { |
1720 | | /* We already know it can't be evaluated, don't bother checking again */ |
1721 | 0 | if (ssa_op->result_def < 0 || IS_BOT(&ctx->values[ssa_op->result_def])) { |
1722 | 0 | break; |
1723 | 0 | } |
1724 | | |
1725 | 0 | zval *args[3] = {NULL}; |
1726 | 0 | zend_function *func = ZEND_FLF_FUNC(opline); |
1727 | 0 | uint32_t num_args = ZEND_FLF_NUM_ARGS(opline->opcode); |
1728 | |
|
1729 | 0 | switch (num_args) { |
1730 | 0 | case 3: { |
1731 | 0 | zend_op *op_data = opline + 1; |
1732 | 0 | args[2] = get_op1_value(ctx, op_data, &ctx->scdf.ssa->ops[op_data - ctx->scdf.op_array->opcodes]); |
1733 | 0 | ZEND_FALLTHROUGH; |
1734 | 0 | } |
1735 | 0 | case 2: |
1736 | 0 | args[1] = get_op2_value(ctx, opline, &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes]); |
1737 | 0 | ZEND_FALLTHROUGH; |
1738 | 0 | case 1: |
1739 | 0 | args[0] = get_op1_value(ctx, opline, &ctx->scdf.ssa->ops[opline - ctx->scdf.op_array->opcodes]); |
1740 | 0 | break; |
1741 | 0 | } |
1742 | 0 | for (uint32_t i = 0; i < num_args; i++) { |
1743 | 0 | if (!args[i]) { |
1744 | 0 | SET_RESULT_BOT(result); |
1745 | 0 | return; |
1746 | 0 | } else if (IS_BOT(args[i]) || IS_PARTIAL_ARRAY(args[i])) { |
1747 | 0 | SET_RESULT_BOT(result); |
1748 | 0 | return; |
1749 | 0 | } else if (IS_TOP(args[i])) { |
1750 | 0 | return; |
1751 | 0 | } |
1752 | 0 | } |
1753 | 0 | if (ct_eval_func_call_ex(scdf->op_array, &zv, func, num_args, args) == SUCCESS) { |
1754 | 0 | SET_RESULT(result, &zv); |
1755 | 0 | zval_ptr_dtor_nogc(&zv); |
1756 | 0 | break; |
1757 | 0 | } |
1758 | 0 | SET_RESULT_BOT(result); |
1759 | 0 | break; |
1760 | 0 | } |
1761 | 428k | default: |
1762 | 428k | { |
1763 | | /* If we have no explicit implementation return BOT */ |
1764 | 428k | SET_RESULT_BOT(result); |
1765 | 428k | SET_RESULT_BOT(op1); |
1766 | 428k | SET_RESULT_BOT(op2); |
1767 | 428k | break; |
1768 | 0 | } |
1769 | 455k | } |
1770 | 455k | } |
1771 | | |
1772 | 1.03M | static zval *value_from_type_and_range(sccp_ctx *ctx, int var_num, zval *tmp) { |
1773 | 1.03M | zend_ssa *ssa = ctx->scdf.ssa; |
1774 | 1.03M | zend_ssa_var_info *info = &ssa->var_info[var_num]; |
1775 | | |
1776 | 1.03M | if (info->type & MAY_BE_UNDEF) { |
1777 | 120k | return NULL; |
1778 | 120k | } |
1779 | | |
1780 | 917k | if (!(info->type & MAY_BE_ANY)) { |
1781 | | /* This code must be unreachable. We could replace operands with NULL, but this doesn't |
1782 | | * really make things better. It would be better to later remove this code entirely. */ |
1783 | 7.65k | return NULL; |
1784 | 7.65k | } |
1785 | | |
1786 | 909k | if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_NULL))) { |
1787 | 51.7k | if (ssa->vars[var_num].definition >= 0 |
1788 | 51.7k | && ctx->scdf.op_array->opcodes[ssa->vars[var_num].definition].opcode == ZEND_VERIFY_RETURN_TYPE) { |
1789 | 15 | return NULL; |
1790 | 15 | } |
1791 | 51.7k | ZVAL_NULL(tmp); |
1792 | 51.7k | return tmp; |
1793 | 51.7k | } |
1794 | 858k | if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_FALSE))) { |
1795 | 203 | if (ssa->vars[var_num].definition >= 0 |
1796 | 203 | && ctx->scdf.op_array->opcodes[ssa->vars[var_num].definition].opcode == ZEND_VERIFY_RETURN_TYPE) { |
1797 | 6 | return NULL; |
1798 | 6 | } |
1799 | 197 | ZVAL_FALSE(tmp); |
1800 | 197 | return tmp; |
1801 | 203 | } |
1802 | 857k | if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_TRUE))) { |
1803 | 717 | if (ssa->vars[var_num].definition >= 0 |
1804 | 717 | && ctx->scdf.op_array->opcodes[ssa->vars[var_num].definition].opcode == ZEND_VERIFY_RETURN_TYPE) { |
1805 | 8 | return NULL; |
1806 | 8 | } |
1807 | 709 | ZVAL_TRUE(tmp); |
1808 | 709 | return tmp; |
1809 | 717 | } |
1810 | | |
1811 | 857k | if (!(info->type & ((MAY_BE_ANY|MAY_BE_UNDEF)-MAY_BE_LONG)) |
1812 | 857k | && info->has_range |
1813 | 857k | && !info->range.overflow && !info->range.underflow |
1814 | 857k | && info->range.min == info->range.max) { |
1815 | 1.14k | ZVAL_LONG(tmp, info->range.min); |
1816 | 1.14k | return tmp; |
1817 | 1.14k | } |
1818 | | |
1819 | 856k | return NULL; |
1820 | 857k | } |
1821 | | |
1822 | | |
1823 | | /* Returns whether there is a successor */ |
1824 | | static void sccp_mark_feasible_successors( |
1825 | | scdf_ctx *scdf, |
1826 | | int block_num, zend_basic_block *block, |
1827 | 70.6k | zend_op *opline, zend_ssa_op *ssa_op) { |
1828 | 70.6k | sccp_ctx *ctx = (sccp_ctx *) scdf; |
1829 | 70.6k | zval *op1, zv; |
1830 | 70.6k | int s; |
1831 | | |
1832 | | /* We can't determine the branch target at compile-time for these */ |
1833 | 70.6k | switch (opline->opcode) { |
1834 | 786 | case ZEND_ASSERT_CHECK: |
1835 | 786 | case ZEND_CATCH: |
1836 | 3.37k | case ZEND_FE_FETCH_R: |
1837 | 4.02k | case ZEND_FE_FETCH_RW: |
1838 | 4.18k | case ZEND_BIND_INIT_STATIC_OR_JMP: |
1839 | 4.18k | scdf_mark_edge_feasible(scdf, block_num, block->successors[0]); |
1840 | 4.18k | scdf_mark_edge_feasible(scdf, block_num, block->successors[1]); |
1841 | 4.18k | return; |
1842 | 70.6k | } |
1843 | | |
1844 | 66.5k | op1 = get_op1_value(ctx, opline, ssa_op); |
1845 | 66.5k | if (IS_BOT(op1)) { |
1846 | 63.3k | ZEND_ASSERT(ssa_op->op1_use >= 0); |
1847 | 63.3k | op1 = value_from_type_and_range(ctx, ssa_op->op1_use, &zv); |
1848 | 63.3k | } |
1849 | | |
1850 | | /* Branch target can be either one */ |
1851 | 66.5k | if (!op1 || IS_BOT(op1)) { |
1852 | 190k | for (s = 0; s < block->successors_count; s++) { |
1853 | 126k | scdf_mark_edge_feasible(scdf, block_num, block->successors[s]); |
1854 | 126k | } |
1855 | 63.1k | return; |
1856 | 63.1k | } |
1857 | | |
1858 | | /* Branch target not yet known */ |
1859 | 3.35k | if (IS_TOP(op1)) { |
1860 | 0 | return; |
1861 | 0 | } |
1862 | | |
1863 | 3.35k | switch (opline->opcode) { |
1864 | 378 | case ZEND_JMPZ: |
1865 | 386 | case ZEND_JMPZ_EX: |
1866 | 386 | { |
1867 | 386 | if (ct_eval_bool_cast(&zv, op1) == FAILURE) { |
1868 | 0 | scdf_mark_edge_feasible(scdf, block_num, block->successors[0]); |
1869 | 0 | scdf_mark_edge_feasible(scdf, block_num, block->successors[1]); |
1870 | 0 | return; |
1871 | 0 | } |
1872 | 386 | s = Z_TYPE(zv) == IS_TRUE; |
1873 | 386 | break; |
1874 | 386 | } |
1875 | 2.02k | case ZEND_JMPNZ: |
1876 | 2.08k | case ZEND_JMPNZ_EX: |
1877 | 2.46k | case ZEND_JMP_SET: |
1878 | 2.46k | { |
1879 | 2.46k | if (ct_eval_bool_cast(&zv, op1) == FAILURE) { |
1880 | 0 | scdf_mark_edge_feasible(scdf, block_num, block->successors[0]); |
1881 | 0 | scdf_mark_edge_feasible(scdf, block_num, block->successors[1]); |
1882 | 0 | return; |
1883 | 0 | } |
1884 | 2.46k | s = Z_TYPE(zv) == IS_FALSE; |
1885 | 2.46k | break; |
1886 | 2.46k | } |
1887 | 169 | case ZEND_COALESCE: |
1888 | 169 | s = (Z_TYPE_P(op1) == IS_NULL); |
1889 | 169 | break; |
1890 | 44 | case ZEND_JMP_NULL: |
1891 | 44 | s = (Z_TYPE_P(op1) != IS_NULL); |
1892 | 44 | break; |
1893 | 258 | case ZEND_FE_RESET_R: |
1894 | 277 | case ZEND_FE_RESET_RW: |
1895 | | /* A non-empty partial array is definitely non-empty, but an |
1896 | | * empty partial array may be non-empty at runtime. */ |
1897 | 277 | if (Z_TYPE_P(op1) != IS_ARRAY || |
1898 | 277 | (IS_PARTIAL_ARRAY(op1) && zend_hash_num_elements(Z_ARR_P(op1)) == 0)) { |
1899 | 88 | scdf_mark_edge_feasible(scdf, block_num, block->successors[0]); |
1900 | 88 | scdf_mark_edge_feasible(scdf, block_num, block->successors[1]); |
1901 | 88 | return; |
1902 | 88 | } |
1903 | 189 | s = zend_hash_num_elements(Z_ARR_P(op1)) != 0; |
1904 | 189 | break; |
1905 | 0 | case ZEND_SWITCH_LONG: |
1906 | 4 | case ZEND_SWITCH_STRING: |
1907 | 20 | case ZEND_MATCH: |
1908 | 20 | { |
1909 | 20 | bool strict_comparison = opline->opcode == ZEND_MATCH; |
1910 | 20 | uint8_t type = Z_TYPE_P(op1); |
1911 | 20 | bool correct_type = |
1912 | 20 | (opline->opcode == ZEND_SWITCH_LONG && type == IS_LONG) |
1913 | 20 | || (opline->opcode == ZEND_SWITCH_STRING && type == IS_STRING) |
1914 | 20 | || (opline->opcode == ZEND_MATCH && (type == IS_LONG || type == IS_STRING)); |
1915 | | |
1916 | 20 | if (correct_type) { |
1917 | 12 | zend_op_array *op_array = scdf->op_array; |
1918 | 12 | zend_ssa *ssa = scdf->ssa; |
1919 | 12 | HashTable *jmptable = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)); |
1920 | 12 | zval *jmp_zv = type == IS_LONG |
1921 | 12 | ? zend_hash_index_find(jmptable, Z_LVAL_P(op1)) |
1922 | 12 | : zend_hash_find(jmptable, Z_STR_P(op1)); |
1923 | 12 | int target; |
1924 | | |
1925 | 12 | if (jmp_zv) { |
1926 | 10 | target = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(jmp_zv))]; |
1927 | 10 | } else { |
1928 | 2 | target = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]; |
1929 | 2 | } |
1930 | 12 | scdf_mark_edge_feasible(scdf, block_num, target); |
1931 | 12 | return; |
1932 | 12 | } else if (strict_comparison) { |
1933 | 4 | zend_op_array *op_array = scdf->op_array; |
1934 | 4 | zend_ssa *ssa = scdf->ssa; |
1935 | 4 | int target = ssa->cfg.map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]; |
1936 | 4 | scdf_mark_edge_feasible(scdf, block_num, target); |
1937 | 4 | return; |
1938 | 4 | } |
1939 | 4 | s = block->successors_count - 1; |
1940 | 4 | break; |
1941 | 20 | } |
1942 | 0 | default: |
1943 | 0 | for (s = 0; s < block->successors_count; s++) { |
1944 | 0 | scdf_mark_edge_feasible(scdf, block_num, block->successors[s]); |
1945 | 0 | } |
1946 | 0 | return; |
1947 | 3.35k | } |
1948 | 3.25k | scdf_mark_edge_feasible(scdf, block_num, block->successors[s]); |
1949 | 3.25k | } |
1950 | | |
1951 | | static void join_hash_tables(HashTable *ret, HashTable *ht1, HashTable *ht2) |
1952 | 162 | { |
1953 | 162 | zend_ulong index; |
1954 | 162 | zend_string *key; |
1955 | 162 | zval *val1, *val2; |
1956 | | |
1957 | 402 | ZEND_HASH_FOREACH_KEY_VAL(ht1, index, key, val1) { |
1958 | 402 | if (key) { |
1959 | 34 | val2 = zend_hash_find(ht2, key); |
1960 | 86 | } else { |
1961 | 86 | val2 = zend_hash_index_find(ht2, index); |
1962 | 86 | } |
1963 | 402 | if (val2 && zend_is_identical(val1, val2)) { |
1964 | 32 | if (key) { |
1965 | 16 | val1 = zend_hash_add_new(ret, key, val1); |
1966 | 16 | } else { |
1967 | 16 | val1 = zend_hash_index_add_new(ret, index, val1); |
1968 | 16 | } |
1969 | 32 | Z_TRY_ADDREF_P(val1); |
1970 | 32 | } |
1971 | 402 | } ZEND_HASH_FOREACH_END(); |
1972 | 162 | } |
1973 | | |
1974 | | static zend_result join_partial_arrays(zval *a, zval *b) |
1975 | 2.92k | { |
1976 | 2.92k | zval ret; |
1977 | | |
1978 | 2.92k | if ((Z_TYPE_P(a) != IS_ARRAY && !IS_PARTIAL_ARRAY(a)) |
1979 | 2.92k | || (Z_TYPE_P(b) != IS_ARRAY && !IS_PARTIAL_ARRAY(b))) { |
1980 | 2.76k | return FAILURE; |
1981 | 2.76k | } |
1982 | | |
1983 | 162 | empty_partial_array(&ret); |
1984 | 162 | join_hash_tables(Z_ARRVAL(ret), Z_ARRVAL_P(a), Z_ARRVAL_P(b)); |
1985 | 162 | zval_ptr_dtor_nogc(a); |
1986 | 162 | ZVAL_COPY_VALUE(a, &ret); |
1987 | | |
1988 | 162 | return SUCCESS; |
1989 | 2.92k | } |
1990 | | |
1991 | | static zend_result join_partial_objects(zval *a, zval *b) |
1992 | 0 | { |
1993 | 0 | zval ret; |
1994 | |
|
1995 | 0 | if (!IS_PARTIAL_OBJECT(a) || !IS_PARTIAL_OBJECT(b)) { |
1996 | 0 | return FAILURE; |
1997 | 0 | } |
1998 | | |
1999 | 0 | empty_partial_object(&ret); |
2000 | 0 | join_hash_tables(Z_ARRVAL(ret), Z_ARRVAL_P(a), Z_ARRVAL_P(b)); |
2001 | 0 | zval_ptr_dtor_nogc(a); |
2002 | 0 | ZVAL_COPY_VALUE(a, &ret); |
2003 | |
|
2004 | 0 | return SUCCESS; |
2005 | 0 | } |
2006 | | |
2007 | 283k | static void join_phi_values(zval *a, zval *b, bool escape) { |
2008 | 283k | if (IS_BOT(a) || IS_TOP(b)) { |
2009 | 97.5k | return; |
2010 | 97.5k | } |
2011 | 185k | if (IS_TOP(a)) { |
2012 | 180k | zval_ptr_dtor_nogc(a); |
2013 | 180k | ZVAL_COPY(a, b); |
2014 | 180k | return; |
2015 | 180k | } |
2016 | 4.84k | if (IS_BOT(b)) { |
2017 | 1.11k | zval_ptr_dtor_nogc(a); |
2018 | 1.11k | MAKE_BOT(a); |
2019 | 1.11k | return; |
2020 | 1.11k | } |
2021 | 3.72k | if (IS_PARTIAL_ARRAY(a) || IS_PARTIAL_ARRAY(b)) { |
2022 | 139 | if (join_partial_arrays(a, b) == FAILURE) { |
2023 | 0 | zval_ptr_dtor_nogc(a); |
2024 | 0 | MAKE_BOT(a); |
2025 | 0 | } |
2026 | 3.58k | } else if (IS_PARTIAL_OBJECT(a) || IS_PARTIAL_OBJECT(b)) { |
2027 | 0 | if (escape || join_partial_objects(a, b) == FAILURE) { |
2028 | 0 | zval_ptr_dtor_nogc(a); |
2029 | 0 | MAKE_BOT(a); |
2030 | 0 | } |
2031 | 3.58k | } else if (!zend_is_identical(a, b)) { |
2032 | 2.78k | if (join_partial_arrays(a, b) == FAILURE) { |
2033 | 2.76k | zval_ptr_dtor_nogc(a); |
2034 | 2.76k | MAKE_BOT(a); |
2035 | 2.76k | } |
2036 | 2.78k | } |
2037 | 3.72k | } |
2038 | | |
2039 | 205k | static void sccp_visit_phi(scdf_ctx *scdf, zend_ssa_phi *phi) { |
2040 | 205k | sccp_ctx *ctx = (sccp_ctx *) scdf; |
2041 | 205k | zend_ssa *ssa = scdf->ssa; |
2042 | 205k | ZEND_ASSERT(phi->ssa_var >= 0); |
2043 | 205k | if (!IS_BOT(&ctx->values[phi->ssa_var])) { |
2044 | 181k | zend_basic_block *block = &ssa->cfg.blocks[phi->block]; |
2045 | 181k | int *predecessors = &ssa->cfg.predecessors[block->predecessor_offset]; |
2046 | | |
2047 | 181k | int i; |
2048 | 181k | zval result; |
2049 | 181k | MAKE_TOP(&result); |
2050 | | #if SCP_DEBUG |
2051 | | fprintf(stderr, "Handling phi("); |
2052 | | #endif |
2053 | 181k | if (phi->pi >= 0) { |
2054 | 56.7k | ZEND_ASSERT(phi->sources[0] >= 0); |
2055 | 56.7k | if (scdf_is_edge_feasible(scdf, phi->pi, phi->block)) { |
2056 | 55.9k | join_phi_values(&result, &ctx->values[phi->sources[0]], ssa->vars[phi->ssa_var].escape_state != ESCAPE_STATE_NO_ESCAPE); |
2057 | 55.9k | } |
2058 | 124k | } else { |
2059 | 378k | for (i = 0; i < block->predecessors_count; i++) { |
2060 | 253k | ZEND_ASSERT(phi->sources[i] >= 0); |
2061 | 253k | if (scdf_is_edge_feasible(scdf, predecessors[i], phi->block)) { |
2062 | | #if SCP_DEBUG |
2063 | | scp_dump_value(&ctx->values[phi->sources[i]]); |
2064 | | fprintf(stderr, ","); |
2065 | | #endif |
2066 | 227k | join_phi_values(&result, &ctx->values[phi->sources[i]], ssa->vars[phi->ssa_var].escape_state != ESCAPE_STATE_NO_ESCAPE); |
2067 | 227k | } else { |
2068 | | #if SCP_DEBUG |
2069 | | fprintf(stderr, " --,"); |
2070 | | #endif |
2071 | 26.4k | } |
2072 | 253k | } |
2073 | 124k | } |
2074 | | #if SCP_DEBUG |
2075 | | fprintf(stderr, ")\n"); |
2076 | | #endif |
2077 | | |
2078 | 181k | set_value(scdf, ctx, phi->ssa_var, &result); |
2079 | 181k | zval_ptr_dtor_nogc(&result); |
2080 | 181k | } |
2081 | 205k | } |
2082 | | |
2083 | | /* Call instruction -> remove opcodes that are part of the call */ |
2084 | | static int remove_call(sccp_ctx *ctx, zend_op *opline, zend_ssa_op *ssa_op) |
2085 | 0 | { |
2086 | 0 | zend_ssa *ssa = ctx->scdf.ssa; |
2087 | 0 | zend_op_array *op_array = ctx->scdf.op_array; |
2088 | 0 | zend_call_info *call; |
2089 | 0 | int i; |
2090 | |
|
2091 | 0 | ZEND_ASSERT(ctx->call_map); |
2092 | 0 | call = ctx->call_map[opline - op_array->opcodes]; |
2093 | 0 | ZEND_ASSERT(call); |
2094 | 0 | ZEND_ASSERT(call->caller_call_opline == opline); |
2095 | 0 | zend_ssa_remove_instr(ssa, opline, ssa_op); |
2096 | 0 | zend_ssa_remove_instr(ssa, call->caller_init_opline, |
2097 | 0 | &ssa->ops[call->caller_init_opline - op_array->opcodes]); |
2098 | |
|
2099 | 0 | for (i = 0; i < call->num_args; i++) { |
2100 | 0 | zend_ssa_remove_instr(ssa, call->arg_info[i].opline, |
2101 | 0 | &ssa->ops[call->arg_info[i].opline - op_array->opcodes]); |
2102 | 0 | } |
2103 | | |
2104 | | // TODO: remove call_info completely??? |
2105 | 0 | call->callee_func = NULL; |
2106 | |
|
2107 | 0 | return call->num_args + 2; |
2108 | 0 | } |
2109 | | |
2110 | | /* This is a basic DCE pass we run after SCCP. It only works on those instructions those result |
2111 | | * value(s) were determined by SCCP. It removes dead computational instructions and converts |
2112 | | * CV-affecting instructions into CONST ASSIGNs. This basic DCE is performed for multiple reasons: |
2113 | | * a) During operand replacement we eliminate FREEs. The corresponding computational instructions |
2114 | | * must be removed to avoid leaks. This way SCCP can run independently of the full DCE pass. |
2115 | | * b) The main DCE pass relies on type analysis to determine whether instructions have side-effects |
2116 | | * and can't be DCEd. This means that it will not be able collect all instructions rendered dead |
2117 | | * by SCCP, because they may have potentially side-effecting types, but the actual values are |
2118 | | * not. As such doing DCE here will allow us to eliminate more dead code in combination. |
2119 | | * c) The ordinary DCE pass cannot collect dead calls. However SCCP can result in dead calls, which |
2120 | | * we need to collect. |
2121 | | * d) The ordinary DCE pass cannot collect construction of dead non-escaping arrays and objects. |
2122 | | */ |
2123 | | static int try_remove_definition(sccp_ctx *ctx, int var_num, zend_ssa_var *var, zval *value) |
2124 | 43.1k | { |
2125 | 43.1k | zend_ssa *ssa = ctx->scdf.ssa; |
2126 | 43.1k | zend_op_array *op_array = ctx->scdf.op_array; |
2127 | 43.1k | int removed_ops = 0; |
2128 | | |
2129 | 43.1k | if (var->definition >= 0) { |
2130 | 41.5k | zend_op *opline = &op_array->opcodes[var->definition]; |
2131 | 41.5k | zend_ssa_op *ssa_op = &ssa->ops[var->definition]; |
2132 | | |
2133 | 41.5k | if (ssa_op->result_def == var_num) { |
2134 | 34.8k | if (opline->opcode == ZEND_ASSIGN) { |
2135 | | /* We can't drop the ASSIGN, but we can remove the result. */ |
2136 | 650 | if (var->use_chain < 0 && var->phi_use_chain == NULL) { |
2137 | 616 | opline->result_type = IS_UNUSED; |
2138 | 616 | zend_ssa_remove_result_def(ssa, ssa_op); |
2139 | 616 | } |
2140 | 650 | return 0; |
2141 | 650 | } |
2142 | 34.1k | if (ssa_op->op1_def >= 0 || ssa_op->op2_def >= 0) { |
2143 | 353 | if (var->use_chain < 0 && var->phi_use_chain == NULL) { |
2144 | 265 | switch (opline->opcode) { |
2145 | 0 | case ZEND_ASSIGN: |
2146 | 0 | case ZEND_ASSIGN_REF: |
2147 | 200 | case ZEND_ASSIGN_DIM: |
2148 | 202 | case ZEND_ASSIGN_OBJ: |
2149 | 202 | case ZEND_ASSIGN_OBJ_REF: |
2150 | 202 | case ZEND_ASSIGN_STATIC_PROP: |
2151 | 202 | case ZEND_ASSIGN_STATIC_PROP_REF: |
2152 | 245 | case ZEND_ASSIGN_OP: |
2153 | 245 | case ZEND_ASSIGN_DIM_OP: |
2154 | 245 | case ZEND_ASSIGN_OBJ_OP: |
2155 | 245 | case ZEND_ASSIGN_STATIC_PROP_OP: |
2156 | 257 | case ZEND_PRE_INC: |
2157 | 257 | case ZEND_PRE_DEC: |
2158 | 257 | case ZEND_PRE_INC_OBJ: |
2159 | 257 | case ZEND_PRE_DEC_OBJ: |
2160 | 257 | case ZEND_DO_ICALL: |
2161 | 257 | case ZEND_DO_UCALL: |
2162 | 257 | case ZEND_DO_FCALL_BY_NAME: |
2163 | 257 | case ZEND_DO_FCALL: |
2164 | 257 | case ZEND_INCLUDE_OR_EVAL: |
2165 | 257 | case ZEND_YIELD: |
2166 | 257 | case ZEND_YIELD_FROM: |
2167 | 257 | case ZEND_ASSERT_CHECK: |
2168 | 257 | opline->result_type = IS_UNUSED; |
2169 | 257 | zend_ssa_remove_result_def(ssa, ssa_op); |
2170 | 257 | break; |
2171 | 8 | default: |
2172 | 8 | break; |
2173 | 265 | } |
2174 | 265 | } |
2175 | | /* we cannot remove instruction that defines other variables */ |
2176 | 353 | return 0; |
2177 | 33.8k | } else if (opline->opcode == ZEND_JMPZ_EX |
2178 | 33.8k | || opline->opcode == ZEND_JMPNZ_EX |
2179 | 33.8k | || opline->opcode == ZEND_JMP_SET |
2180 | 33.8k | || opline->opcode == ZEND_COALESCE |
2181 | 33.8k | || opline->opcode == ZEND_JMP_NULL |
2182 | 33.8k | || opline->opcode == ZEND_FE_RESET_R |
2183 | 33.8k | || opline->opcode == ZEND_FE_RESET_RW |
2184 | 33.8k | || opline->opcode == ZEND_FE_FETCH_R |
2185 | 33.8k | || opline->opcode == ZEND_FE_FETCH_RW |
2186 | 33.8k | || opline->opcode == ZEND_NEW) { |
2187 | | /* we cannot simple remove jump instructions */ |
2188 | 494 | return 0; |
2189 | 33.3k | } else if (var->use_chain >= 0 |
2190 | 33.3k | || var->phi_use_chain != NULL) { |
2191 | 31.0k | if (value |
2192 | 31.0k | && (opline->result_type & (IS_VAR|IS_TMP_VAR)) |
2193 | 31.0k | && opline->opcode != ZEND_QM_ASSIGN |
2194 | 31.0k | && opline->opcode != ZEND_FETCH_CLASS |
2195 | 31.0k | && opline->opcode != ZEND_ROPE_INIT |
2196 | 31.0k | && opline->opcode != ZEND_ROPE_ADD |
2197 | 31.0k | && opline->opcode != ZEND_INIT_ARRAY |
2198 | 31.0k | && opline->opcode != ZEND_ADD_ARRAY_ELEMENT |
2199 | 31.0k | && opline->opcode != ZEND_ADD_ARRAY_UNPACK) { |
2200 | | /* Replace with QM_ASSIGN */ |
2201 | 8 | uint8_t old_type = opline->result_type; |
2202 | 8 | uint32_t old_var = opline->result.var; |
2203 | | |
2204 | 8 | ssa_op->result_def = -1; |
2205 | 8 | if (opline->opcode == ZEND_DO_ICALL) { |
2206 | 0 | removed_ops = remove_call(ctx, opline, ssa_op) - 1; |
2207 | 8 | } else { |
2208 | 8 | bool has_op_data = opline->opcode == ZEND_FRAMELESS_ICALL_3; |
2209 | 8 | zend_ssa_remove_instr(ssa, opline, ssa_op); |
2210 | 8 | removed_ops++; |
2211 | 8 | if (has_op_data) { |
2212 | 0 | zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1); |
2213 | 0 | removed_ops++; |
2214 | 0 | } |
2215 | 8 | } |
2216 | 8 | ssa_op->result_def = var_num; |
2217 | 8 | opline->opcode = ZEND_QM_ASSIGN; |
2218 | 8 | opline->result_type = old_type; |
2219 | 8 | opline->result.var = old_var; |
2220 | 8 | Z_TRY_ADDREF_P(value); |
2221 | 8 | zend_optimizer_update_op1_const(ctx->scdf.op_array, opline, value); |
2222 | 8 | } |
2223 | 31.0k | return 0; |
2224 | 31.0k | } else if ((opline->op2_type & (IS_VAR|IS_TMP_VAR)) |
2225 | 2.24k | && (!value_known(&ctx->values[ssa_op->op2_use]) |
2226 | 97 | || IS_PARTIAL_ARRAY(&ctx->values[ssa_op->op2_use]) |
2227 | 97 | || IS_PARTIAL_OBJECT(&ctx->values[ssa_op->op2_use]))) { |
2228 | 0 | return 0; |
2229 | 2.24k | } else if ((opline->op1_type & (IS_VAR|IS_TMP_VAR)) |
2230 | 2.24k | && (!value_known(&ctx->values[ssa_op->op1_use]) |
2231 | 451 | || IS_PARTIAL_ARRAY(&ctx->values[ssa_op->op1_use]) |
2232 | 451 | || IS_PARTIAL_OBJECT(&ctx->values[ssa_op->op1_use]))) { |
2233 | 10 | if (opline->opcode == ZEND_TYPE_CHECK |
2234 | 10 | || opline->opcode == ZEND_BOOL) { |
2235 | 8 | zend_ssa_remove_result_def(ssa, ssa_op); |
2236 | | /* For TYPE_CHECK we may compute the result value without knowing the |
2237 | | * operand, based on type inference information. Make sure the operand is |
2238 | | * freed and leave further cleanup to DCE. */ |
2239 | 8 | opline->opcode = ZEND_FREE; |
2240 | 8 | opline->result_type = IS_UNUSED; |
2241 | 8 | removed_ops++; |
2242 | 8 | } else { |
2243 | 2 | return 0; |
2244 | 2 | } |
2245 | 2.23k | } else { |
2246 | 2.23k | zend_ssa_remove_result_def(ssa, ssa_op); |
2247 | 2.23k | if (opline->opcode == ZEND_DO_ICALL) { |
2248 | 0 | removed_ops = remove_call(ctx, opline, ssa_op); |
2249 | 2.23k | } else { |
2250 | 2.23k | bool has_op_data = opline->opcode == ZEND_FRAMELESS_ICALL_3; |
2251 | 2.23k | zend_ssa_remove_instr(ssa, opline, ssa_op); |
2252 | 2.23k | removed_ops++; |
2253 | 2.23k | if (has_op_data) { |
2254 | 0 | zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1); |
2255 | 0 | removed_ops++; |
2256 | 0 | } |
2257 | 2.23k | } |
2258 | 2.23k | } |
2259 | 34.1k | } else if (ssa_op->op1_def == var_num) { |
2260 | 6.75k | if (opline->opcode == ZEND_ASSIGN) { |
2261 | | /* Leave assigns to DCE (due to dtor effects) */ |
2262 | 6.10k | return 0; |
2263 | 6.10k | } |
2264 | | |
2265 | | /* Compound assign or incdec -> convert to direct ASSIGN */ |
2266 | | |
2267 | 648 | if (!value) { |
2268 | | /* In some cases zend_may_throw() may be avoided */ |
2269 | 256 | switch (opline->opcode) { |
2270 | 154 | case ZEND_ASSIGN_DIM: |
2271 | 256 | case ZEND_ASSIGN_OBJ: |
2272 | 256 | case ZEND_ASSIGN_OP: |
2273 | 256 | case ZEND_ASSIGN_DIM_OP: |
2274 | 256 | case ZEND_ASSIGN_OBJ_OP: |
2275 | 256 | case ZEND_ASSIGN_STATIC_PROP_OP: |
2276 | 256 | if ((ssa_op->op2_use >= 0 && !value_known(&ctx->values[ssa_op->op2_use])) |
2277 | 256 | || ((ssa_op+1)->op1_use >= 0 &&!value_known(&ctx->values[(ssa_op+1)->op1_use]))) { |
2278 | 184 | return 0; |
2279 | 184 | } |
2280 | 72 | break; |
2281 | 72 | case ZEND_PRE_INC_OBJ: |
2282 | 0 | case ZEND_PRE_DEC_OBJ: |
2283 | 0 | case ZEND_POST_INC_OBJ: |
2284 | 0 | case ZEND_POST_DEC_OBJ: |
2285 | 0 | if (ssa_op->op2_use >= 0 && !value_known(&ctx->values[ssa_op->op2_use])) { |
2286 | 0 | return 0; |
2287 | 0 | } |
2288 | 0 | break; |
2289 | 0 | case ZEND_INIT_ARRAY: |
2290 | 0 | case ZEND_ADD_ARRAY_ELEMENT: |
2291 | 0 | if (opline->op2_type == IS_UNUSED) { |
2292 | 0 | return 0; |
2293 | 0 | } |
2294 | | /* break missing intentionally */ |
2295 | 0 | default: |
2296 | 0 | if (zend_may_throw(opline, ssa_op, op_array, ssa)) { |
2297 | 0 | return 0; |
2298 | 0 | } |
2299 | 0 | break; |
2300 | 256 | } |
2301 | 256 | } |
2302 | | |
2303 | | /* Mark result unused, if possible */ |
2304 | 464 | if (ssa_op->result_def >= 0) { |
2305 | 12 | if (ssa->vars[ssa_op->result_def].use_chain < 0 |
2306 | 12 | && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) { |
2307 | 6 | zend_ssa_remove_result_def(ssa, ssa_op); |
2308 | 6 | opline->result_type = IS_UNUSED; |
2309 | 6 | } else if (opline->opcode != ZEND_PRE_INC && |
2310 | 6 | opline->opcode != ZEND_PRE_DEC) { |
2311 | | /* op1_def and result_def are different */ |
2312 | 6 | return removed_ops; |
2313 | 6 | } |
2314 | 12 | } |
2315 | | |
2316 | | /* Destroy previous op2 */ |
2317 | 458 | if (opline->op2_type == IS_CONST) { |
2318 | 224 | literal_dtor(&ZEND_OP2_LITERAL(opline)); |
2319 | 234 | } else if (ssa_op->op2_use >= 0) { |
2320 | 94 | if (ssa_op->op2_use != ssa_op->op1_use) { |
2321 | 73 | zend_ssa_unlink_use_chain(ssa, var->definition, ssa_op->op2_use); |
2322 | 73 | } |
2323 | 94 | ssa_op->op2_use = -1; |
2324 | 94 | ssa_op->op2_use_chain = -1; |
2325 | 94 | } |
2326 | | |
2327 | | /* Remove OP_DATA opcode */ |
2328 | 458 | switch (opline->opcode) { |
2329 | 210 | case ZEND_ASSIGN_DIM: |
2330 | 266 | case ZEND_ASSIGN_OBJ: |
2331 | 266 | removed_ops++; |
2332 | 266 | zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1); |
2333 | 266 | break; |
2334 | 10 | case ZEND_ASSIGN_DIM_OP: |
2335 | 10 | case ZEND_ASSIGN_OBJ_OP: |
2336 | 10 | case ZEND_ASSIGN_STATIC_PROP_OP: |
2337 | 10 | removed_ops++; |
2338 | 10 | zend_ssa_remove_instr(ssa, opline + 1, ssa_op + 1); |
2339 | 10 | break; |
2340 | 182 | default: |
2341 | 182 | break; |
2342 | 458 | } |
2343 | | |
2344 | 458 | if (value) { |
2345 | | /* Convert to ASSIGN */ |
2346 | 386 | opline->opcode = ZEND_ASSIGN; |
2347 | 386 | opline->op2_type = IS_CONST; |
2348 | 386 | opline->op2.constant = zend_optimizer_add_literal(op_array, value); |
2349 | 386 | Z_TRY_ADDREF_P(value); |
2350 | 386 | } else { |
2351 | | /* Remove dead array or object construction */ |
2352 | 72 | removed_ops++; |
2353 | 72 | if (var->use_chain >= 0 || var->phi_use_chain != NULL) { |
2354 | 46 | zend_ssa_rename_var_uses(ssa, ssa_op->op1_def, ssa_op->op1_use, 1); |
2355 | 46 | } |
2356 | 72 | zend_ssa_remove_op1_def(ssa, ssa_op); |
2357 | 72 | zend_ssa_remove_instr(ssa, opline, ssa_op); |
2358 | 72 | } |
2359 | 458 | } |
2360 | 41.5k | } else if (var->definition_phi |
2361 | 1.60k | && var->use_chain < 0 |
2362 | 1.60k | && var->phi_use_chain == NULL) { |
2363 | 593 | zend_ssa_remove_phi(ssa, var->definition_phi); |
2364 | 593 | } |
2365 | 4.30k | return removed_ops; |
2366 | 43.1k | } |
2367 | | |
2368 | | /* This will try to replace uses of SSA variables we have determined to be constant. Not all uses |
2369 | | * can be replaced, because some instructions don't accept constant operands or only accept them |
2370 | | * if they have a certain type. */ |
2371 | 74.1k | static int replace_constant_operands(sccp_ctx *ctx) { |
2372 | 74.1k | zend_ssa *ssa = ctx->scdf.ssa; |
2373 | 74.1k | zend_op_array *op_array = ctx->scdf.op_array; |
2374 | 74.1k | int i; |
2375 | 74.1k | zval tmp; |
2376 | 74.1k | int removed_ops = 0; |
2377 | | |
2378 | | /* We iterate the variables backwards, so we can eliminate sequences like INIT_ROPE |
2379 | | * and INIT_ARRAY. */ |
2380 | 1.09M | for (i = ssa->vars_count - 1; i >= op_array->last_var; i--) { |
2381 | 1.02M | zend_ssa_var *var = &ssa->vars[i]; |
2382 | 1.02M | zval *value; |
2383 | 1.02M | int use; |
2384 | | |
2385 | 1.02M | if (IS_PARTIAL_ARRAY(&ctx->values[i]) |
2386 | 1.02M | || IS_PARTIAL_OBJECT(&ctx->values[i])) { |
2387 | 6.10k | if (!Z_DELREF(ctx->values[i])) { |
2388 | 5.52k | zend_array_destroy(Z_ARR(ctx->values[i])); |
2389 | 5.52k | } |
2390 | 6.10k | MAKE_BOT(&ctx->values[i]); |
2391 | 6.10k | if ((var->use_chain < 0 && var->phi_use_chain == NULL) || var->no_val) { |
2392 | 404 | removed_ops += try_remove_definition(ctx, i, var, NULL); |
2393 | 404 | } |
2394 | 6.10k | continue; |
2395 | 1.01M | } else if (value_known(&ctx->values[i])) { |
2396 | 42.7k | value = &ctx->values[i]; |
2397 | 974k | } else { |
2398 | 974k | value = value_from_type_and_range(ctx, i, &tmp); |
2399 | 974k | if (!value) { |
2400 | 920k | continue; |
2401 | 920k | } |
2402 | 974k | } |
2403 | | |
2404 | 135k | FOREACH_USE(var, use) { |
2405 | 135k | zend_op *opline = &op_array->opcodes[use]; |
2406 | 135k | zend_ssa_op *ssa_op = &ssa->ops[use]; |
2407 | 135k | if (try_replace_op1(ctx, opline, ssa_op, i, value)) { |
2408 | 4.72k | if (opline->opcode == ZEND_NOP) { |
2409 | 801 | removed_ops++; |
2410 | 801 | } |
2411 | 4.72k | ZEND_ASSERT(ssa_op->op1_def == -1); |
2412 | 4.72k | if (ssa_op->op1_use != ssa_op->op2_use) { |
2413 | 4.72k | zend_ssa_unlink_use_chain(ssa, use, ssa_op->op1_use); |
2414 | 4.72k | } else { |
2415 | 0 | ssa_op->op2_use_chain = ssa_op->op1_use_chain; |
2416 | 0 | } |
2417 | 4.72k | ssa_op->op1_use = -1; |
2418 | 4.72k | ssa_op->op1_use_chain = -1; |
2419 | 4.72k | } |
2420 | 38.8k | if (try_replace_op2(ctx, opline, ssa_op, i, value)) { |
2421 | 4.23k | ZEND_ASSERT(ssa_op->op2_def == -1); |
2422 | 4.23k | if (ssa_op->op2_use != ssa_op->op1_use) { |
2423 | 4.17k | zend_ssa_unlink_use_chain(ssa, use, ssa_op->op2_use); |
2424 | 4.17k | } |
2425 | 4.23k | ssa_op->op2_use = -1; |
2426 | 4.23k | ssa_op->op2_use_chain = -1; |
2427 | 4.23k | } |
2428 | 38.8k | } FOREACH_USE_END(); |
2429 | | |
2430 | 96.3k | if (value_known(&ctx->values[i])) { |
2431 | 42.7k | removed_ops += try_remove_definition(ctx, i, var, value); |
2432 | 42.7k | } |
2433 | 96.3k | } |
2434 | | |
2435 | 74.1k | return removed_ops; |
2436 | 74.1k | } |
2437 | | |
2438 | | static void sccp_context_init(zend_optimizer_ctx *ctx, sccp_ctx *sccp, |
2439 | 74.1k | zend_ssa *ssa, zend_op_array *op_array, zend_call_info **call_map) { |
2440 | 74.1k | int i; |
2441 | 74.1k | sccp->call_map = call_map; |
2442 | 74.1k | sccp->values = zend_arena_alloc(&ctx->arena, sizeof(zval) * ssa->vars_count); |
2443 | | |
2444 | 74.1k | MAKE_TOP(&sccp->top); |
2445 | 74.1k | MAKE_BOT(&sccp->bot); |
2446 | | |
2447 | 74.1k | i = 0; |
2448 | 178k | for (; i < op_array->last_var; ++i) { |
2449 | | /* These are all undefined variables, which we have to mark BOT. |
2450 | | * Otherwise the undefined variable warning might not be preserved. */ |
2451 | 104k | MAKE_BOT(&sccp->values[i]); |
2452 | 104k | } |
2453 | 1.09M | for (; i < ssa->vars_count; ++i) { |
2454 | 1.02M | if (ssa->vars[i].alias) { |
2455 | 0 | MAKE_BOT(&sccp->values[i]); |
2456 | 1.02M | } else { |
2457 | 1.02M | MAKE_TOP(&sccp->values[i]); |
2458 | 1.02M | } |
2459 | 1.02M | } |
2460 | 74.1k | } |
2461 | | |
2462 | 74.1k | static void sccp_context_free(sccp_ctx *sccp) { |
2463 | 74.1k | int i; |
2464 | 1.09M | for (i = sccp->scdf.op_array->last_var; i < sccp->scdf.ssa->vars_count; ++i) { |
2465 | 1.02M | zval_ptr_dtor_nogc(&sccp->values[i]); |
2466 | 1.02M | } |
2467 | 74.1k | } |
2468 | | |
2469 | | int sccp_optimize_op_array(zend_optimizer_ctx *ctx, zend_op_array *op_array, zend_ssa *ssa, zend_call_info **call_map) |
2470 | 74.1k | { |
2471 | 74.1k | sccp_ctx sccp; |
2472 | 74.1k | int removed_ops = 0; |
2473 | 74.1k | void *checkpoint = zend_arena_checkpoint(ctx->arena); |
2474 | | |
2475 | 74.1k | sccp_context_init(ctx, &sccp, ssa, op_array, call_map); |
2476 | | |
2477 | 74.1k | sccp.scdf.handlers.visit_instr = sccp_visit_instr; |
2478 | 74.1k | sccp.scdf.handlers.visit_phi = sccp_visit_phi; |
2479 | 74.1k | sccp.scdf.handlers.mark_feasible_successors = sccp_mark_feasible_successors; |
2480 | | |
2481 | 74.1k | scdf_init(ctx, &sccp.scdf, op_array, ssa); |
2482 | 74.1k | scdf_solve(&sccp.scdf, "SCCP"); |
2483 | | |
2484 | 74.1k | if (ctx->debug_level & ZEND_DUMP_SCCP) { |
2485 | 0 | int i, first = 1; |
2486 | |
|
2487 | 0 | for (i = op_array->last_var; i < ssa->vars_count; i++) { |
2488 | 0 | zval *zv = &sccp.values[i]; |
2489 | |
|
2490 | 0 | if (IS_TOP(zv) || IS_BOT(zv)) { |
2491 | 0 | continue; |
2492 | 0 | } |
2493 | 0 | if (first) { |
2494 | 0 | first = 0; |
2495 | 0 | fprintf(stderr, "\nSCCP Values for \""); |
2496 | 0 | zend_dump_op_array_name(op_array); |
2497 | 0 | fprintf(stderr, "\":\n"); |
2498 | 0 | } |
2499 | 0 | fprintf(stderr, " #%d.", i); |
2500 | 0 | zend_dump_var(op_array, IS_CV, ssa->vars[i].var); |
2501 | 0 | fprintf(stderr, " ="); |
2502 | 0 | scp_dump_value(zv); |
2503 | 0 | fprintf(stderr, "\n"); |
2504 | 0 | } |
2505 | 0 | } |
2506 | | |
2507 | 74.1k | removed_ops += scdf_remove_unreachable_blocks(&sccp.scdf); |
2508 | 74.1k | removed_ops += replace_constant_operands(&sccp); |
2509 | | |
2510 | 74.1k | sccp_context_free(&sccp); |
2511 | 74.1k | zend_arena_release(&ctx->arena, checkpoint); |
2512 | | |
2513 | 74.1k | return removed_ops; |
2514 | 74.1k | } |