Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/Optimizer/zend_inference.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine, e-SSA based Type & Range Inference                      |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Dmitry Stogov <dmitry@php.net>                              |
16
   +----------------------------------------------------------------------+
17
*/
18
19
#include "zend_compile.h"
20
#include "zend_generators.h"
21
#include "zend_inference.h"
22
#include "zend_func_info.h"
23
#include "zend_call_graph.h"
24
#include "zend_closures.h"
25
#include "zend_worklist.h"
26
#include "zend_optimizer_internal.h"
27
28
/* The used range inference algorithm is described in:
29
 *     V. Campos, R. Rodrigues, I. de Assis Costa and F. Pereira.
30
 *     "Speed and Precision in Range Analysis", SBLP'12.
31
 *
32
 * There are a couple degrees of freedom, we use:
33
 *  * Propagation on SCCs.
34
 *  * e-SSA for live range splitting.
35
 *  * Only intra-procedural inference.
36
 *  * Widening with warmup passes, but without jump sets.
37
 */
38
39
/* Whether to handle symbolic range constraints */
40
#define SYM_RANGE
41
42
/* Whether to handle negative range constraints */
43
/* Negative range inference is buggy, so disabled for now */
44
#undef NEG_RANGE
45
46
/* Number of warmup passes to use prior to widening */
47
251k
#define RANGE_WARMUP_PASSES 16
48
49
/* Logging for range inference in general */
50
#if 0
51
#define LOG_SSA_RANGE(...) fprintf(stderr, __VA_ARGS__)
52
#else
53
#define LOG_SSA_RANGE(...)
54
#endif
55
56
/* Logging for negative range constraints */
57
#if 0
58
#define LOG_NEG_RANGE(...) fprintf(stderr, __VA_ARGS__)
59
#else
60
#define LOG_NEG_RANGE(...)
61
#endif
62
63
/* Pop elements in unspecified order from worklist until it is empty */
64
393k
#define WHILE_WORKLIST(worklist, len, i) do { \
65
393k
  bool _done = 0; \
66
1.07M
  while (!_done) { \
67
686k
    _done = 1; \
68
7.91M
    ZEND_BITSET_FOREACH(worklist, len, i) { \
69
1.35M
      zend_bitset_excl(worklist, i); \
70
1.35M
      _done = 0;
71
72
#define WHILE_WORKLIST_END() \
73
1.35M
    } ZEND_BITSET_FOREACH_END(); \
74
686k
  } \
75
393k
} while (0)
76
77
#define CHECK_SCC_VAR(var2) \
78
  do { \
79
    if (!ssa->vars[var2].no_val) { \
80
      if (ssa->vars[var2].scc < 0) { \
81
        zend_ssa_check_scc_var(op_array, ssa, var2, index, stack); \
82
      } \
83
      if (ssa->vars[var2].scc < ssa->vars[var].scc) { \
84
        ssa->vars[var].scc = ssa->vars[var2].scc; \
85
        is_root = 0; \
86
      } \
87
    } \
88
  } while (0)
89
90
#define CHECK_SCC_ENTRY(var2) \
91
1.24M
  do { \
92
1.24M
    if (ssa->vars[var2].scc != ssa->vars[var].scc) { \
93
1.08M
      ssa->vars[var2].scc_entry = 1; \
94
1.08M
    } \
95
1.24M
  } while (0)
96
97
#define ADD_SCC_VAR(_var) \
98
183k
  do { \
99
183k
    if (ssa->vars[_var].scc == scc && \
100
183k
        !(ssa->var_info[_var].type & MAY_BE_REF)) { \
101
76.3k
      zend_bitset_incl(worklist, _var); \
102
76.3k
    } \
103
183k
  } while (0)
104
105
#define ADD_SCC_VAR_1(_var) \
106
112k
  do { \
107
112k
    if (ssa->vars[_var].scc == scc && \
108
112k
        !(ssa->var_info[_var].type & MAY_BE_REF) && \
109
112k
        !zend_bitset_in(visited, _var)) { \
110
57.4k
      zend_bitset_incl(worklist, _var); \
111
57.4k
    } \
112
112k
  } while (0)
113
114
#define FOR_EACH_DEFINED_VAR(line, MACRO) \
115
1.25M
  do { \
116
1.25M
    if (ssa->ops[line].op1_def >= 0) { \
117
183k
      MACRO(ssa->ops[line].op1_def); \
118
183k
    } \
119
1.25M
    if (ssa->ops[line].op2_def >= 0) { \
120
10.3k
      MACRO(ssa->ops[line].op2_def); \
121
10.3k
    } \
122
1.25M
    if (ssa->ops[line].result_def >= 0) { \
123
942k
      MACRO(ssa->ops[line].result_def); \
124
942k
    } \
125
1.25M
    if (op_array->opcodes[line].opcode == ZEND_OP_DATA) { \
126
11.2k
      if (ssa->ops[line-1].op1_def >= 0) { \
127
6.78k
        MACRO(ssa->ops[line-1].op1_def); \
128
6.78k
      } \
129
11.2k
      if (ssa->ops[line-1].op2_def >= 0) { \
130
0
        MACRO(ssa->ops[line-1].op2_def); \
131
0
      } \
132
11.2k
      if (ssa->ops[line-1].result_def >= 0) { \
133
3.28k
        MACRO(ssa->ops[line-1].result_def); \
134
3.28k
      } \
135
1.24M
    } else if ((uint32_t)line+1 < op_array->last && \
136
1.24M
               op_array->opcodes[line+1].opcode == ZEND_OP_DATA) { \
137
19.6k
      if (ssa->ops[line+1].op1_def >= 0) { \
138
163
        MACRO(ssa->ops[line+1].op1_def); \
139
163
      } \
140
19.6k
      if (ssa->ops[line+1].op2_def >= 0) { \
141
0
        MACRO(ssa->ops[line+1].op2_def); \
142
0
      } \
143
19.6k
      if (ssa->ops[line+1].result_def >= 0) { \
144
0
        MACRO(ssa->ops[line+1].result_def); \
145
0
      } \
146
19.6k
    } \
147
1.25M
  } while (0)
148
149
150
#define FOR_EACH_VAR_USAGE(_var, MACRO) \
151
1.23M
  do { \
152
1.23M
    zend_ssa_phi *p = ssa->vars[_var].phi_use_chain; \
153
1.23M
    int use = ssa->vars[_var].use_chain; \
154
2.48M
    while (use >= 0) { \
155
1.25M
      FOR_EACH_DEFINED_VAR(use, MACRO); \
156
1.25M
      use = zend_ssa_next_use(ssa->ops, _var, use); \
157
1.25M
    } \
158
1.23M
    p = ssa->vars[_var].phi_use_chain; \
159
1.62M
    while (p) { \
160
389k
      MACRO(p->ssa_var); \
161
389k
      p = zend_ssa_next_use_phi(ssa, _var, p); \
162
389k
    } \
163
1.23M
  } while (0)
164
165
1.82k
static inline bool add_will_overflow(zend_long a, zend_long b) {
166
1.82k
  return (b > 0 && a > ZEND_LONG_MAX - b)
167
1.82k
    || (b < 0 && a < ZEND_LONG_MIN - b);
168
1.82k
}
169
#if 0
170
static inline bool sub_will_overflow(zend_long a, zend_long b) {
171
  return (b > 0 && a < ZEND_LONG_MIN + b)
172
    || (b < 0 && a > ZEND_LONG_MAX + b);
173
}
174
#endif
175
176
#if 0
177
/* Recursive Pearce's SCC algorithm implementation */
178
static void zend_ssa_check_scc_var(const zend_op_array *op_array, zend_ssa *ssa, int var, int *index, zend_worklist_stack *stack) /* {{{ */
179
{
180
  int is_root = 1;
181
#ifdef SYM_RANGE
182
  zend_ssa_phi *p;
183
#endif
184
185
  ssa->vars[var].scc = *index;
186
  (*index)++;
187
188
  FOR_EACH_VAR_USAGE(var, CHECK_SCC_VAR);
189
190
#ifdef SYM_RANGE
191
  /* Process symbolic control-flow constraints */
192
  p = ssa->vars[var].sym_use_chain;
193
  while (p) {
194
    CHECK_SCC_VAR(p->ssa_var);
195
    p = p->sym_use_chain;
196
  }
197
#endif
198
199
  if (is_root) {
200
    ssa->sccs--;
201
    while (stack->len > 0) {
202
      int var2 = zend_worklist_stack_peek(stack);
203
      if (ssa->vars[var2].scc < ssa->vars[var].scc) {
204
        break;
205
      }
206
      zend_worklist_stack_pop(stack);
207
      ssa->vars[var2].scc = ssa->sccs;
208
      (*index)--;
209
    }
210
    ssa->vars[var].scc = ssa->sccs;
211
    ssa->vars[var].scc_entry = 1;
212
    (*index)--;
213
  } else {
214
    zend_worklist_stack_push(stack, var);
215
  }
216
}
217
/* }}} */
218
219
ZEND_API void zend_ssa_find_sccs(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
220
{
221
  int index = 0;
222
  zend_worklist_stack stack;
223
  int j;
224
  ALLOCA_FLAG(stack_use_heap)
225
226
  ZEND_WORKLIST_STACK_ALLOCA(&stack, ssa->vars_count, stack_use_heap);
227
228
  /* Find SCCs using Pearce's algorithm. */
229
  ssa->sccs = ssa->vars_count;
230
  for (j = 0; j < ssa->vars_count; j++) {
231
    if (!ssa->vars[j].no_val && ssa->vars[j].scc < 0) {
232
      zend_ssa_check_scc_var(op_array, ssa, j, &index, &stack);
233
    }
234
  }
235
236
  if (ssa->sccs) {
237
    /* Shift SCC indexes. */
238
    for (j = 0; j < ssa->vars_count; j++) {
239
      if (ssa->vars[j].scc >= 0) {
240
        ssa->vars[j].scc -= ssa->sccs;
241
      }
242
    }
243
  }
244
  ssa->sccs = ssa->vars_count - ssa->sccs;
245
246
  for (j = 0; j < ssa->vars_count; j++) {
247
    if (ssa->vars[j].scc >= 0) {
248
      int var = j;
249
      FOR_EACH_VAR_USAGE(var, CHECK_SCC_ENTRY);
250
    }
251
  }
252
253
  ZEND_WORKLIST_STACK_FREE_ALLOCA(&stack, stack_use_heap);
254
}
255
/* }}} */
256
257
#else
258
/* Iterative Pearce's SCC algorithm implementation */
259
260
typedef struct _zend_scc_iterator {
261
  int               state;
262
  int               last;
263
  union {
264
    int           use;
265
    zend_ssa_phi *phi;
266
  };
267
} zend_scc_iterator;
268
269
static int zend_scc_next(const zend_op_array *op_array, zend_ssa *ssa, int var, zend_scc_iterator *iterator) /* {{{ */
270
2.28M
{
271
2.28M
  zend_ssa_phi *phi;
272
2.28M
  int use, var2;
273
274
2.28M
  switch (iterator->state) {
275
1.05M
    case 0:                       goto state_0;
276
117k
    case 1:  use = iterator->use; goto state_1;
277
7.32k
    case 2:  use = iterator->use; goto state_2;
278
800k
    case 3:  use = iterator->use; goto state_3;
279
4.75k
    case 4:  use = iterator->use; goto state_4;
280
0
    case 5:  use = iterator->use; goto state_5;
281
97
    case 6:  use = iterator->use; goto state_6;
282
0
    case 7:  use = iterator->use; goto state_7;
283
2.61k
    case 8:  use = iterator->use; goto state_8;
284
292k
    case 9:  phi = iterator->phi; goto state_9;
285
0
#ifdef SYM_RANGE
286
3.35k
    case 10: phi = iterator->phi; goto state_10;
287
0
#endif
288
0
    case 11:                      goto state_11;
289
2.28M
  }
290
291
1.05M
state_0:
292
1.05M
  use = ssa->vars[var].use_chain;
293
2.13M
  while (use >= 0) {
294
1.07M
    iterator->use = use;
295
1.07M
    var2 = ssa->ops[use].op1_def;
296
1.07M
    if (var2 >= 0 && !ssa->vars[var2].no_val) {
297
117k
      iterator->state = 1;
298
117k
      return var2;
299
117k
    }
300
1.07M
state_1:
301
1.07M
    var2 = ssa->ops[use].op2_def;
302
1.07M
    if (var2 >= 0 && !ssa->vars[var2].no_val) {
303
7.32k
      iterator->state = 2;
304
7.32k
      return var2;
305
7.32k
    }
306
1.07M
state_2:
307
1.07M
    var2 = ssa->ops[use].result_def;
308
1.07M
    if (var2 >= 0 && !ssa->vars[var2].no_val) {
309
800k
      iterator->state = 3;
310
800k
      return var2;
311
800k
    }
312
1.07M
state_3:
313
1.07M
    if (op_array->opcodes[use].opcode == ZEND_OP_DATA) {
314
9.93k
      var2 = ssa->ops[use-1].op1_def;
315
9.93k
      if (var2 >= 0 && !ssa->vars[var2].no_val) {
316
4.75k
        iterator->state = 4;
317
4.75k
        return var2;
318
4.75k
      }
319
9.93k
state_4:
320
9.93k
      var2 = ssa->ops[use-1].op2_def;
321
9.93k
      if (var2 >= 0 && !ssa->vars[var2].no_val) {
322
0
        iterator->state = 5;
323
0
        return var2;
324
0
      }
325
9.93k
state_5:
326
9.93k
      var2 = ssa->ops[use-1].result_def;
327
9.93k
      if (var2 >= 0 && !ssa->vars[var2].no_val) {
328
2.61k
        iterator->state = 8;
329
2.61k
        return var2;
330
2.61k
      }
331
1.06M
    } else if ((uint32_t)use+1 < op_array->last &&
332
1.06M
               op_array->opcodes[use+1].opcode == ZEND_OP_DATA) {
333
16.7k
      var2 = ssa->ops[use+1].op1_def;
334
16.7k
      if (var2 >= 0 && !ssa->vars[var2].no_val) {
335
97
        iterator->state = 6;
336
97
        return var2;
337
97
      }
338
16.7k
state_6:
339
16.7k
      var2 = ssa->ops[use+1].op2_def;
340
16.7k
      if (var2 >= 0 && !ssa->vars[var2].no_val) {
341
0
        iterator->state = 7;
342
0
        return var2;
343
0
      }
344
16.7k
state_7:
345
16.7k
      var2 = ssa->ops[use+1].result_def;
346
16.7k
      if (var2 >= 0 && !ssa->vars[var2].no_val) {
347
0
        iterator->state = 8;
348
0
        return var2;
349
0
      }
350
16.7k
    }
351
1.07M
state_8:
352
1.07M
    use = zend_ssa_next_use(ssa->ops, var, use);
353
1.07M
  }
354
355
1.05M
  phi = ssa->vars[var].phi_use_chain;
356
1.35M
  while (phi) {
357
294k
    var2 = phi->ssa_var;
358
294k
    if (!ssa->vars[var2].no_val) {
359
292k
      iterator->state = 9;
360
292k
      iterator->phi = phi;
361
292k
      return var2;
362
292k
    }
363
294k
state_9:
364
294k
    phi = zend_ssa_next_use_phi(ssa, var, phi);
365
294k
  }
366
367
1.05M
#ifdef SYM_RANGE
368
  /* Process symbolic control-flow constraints */
369
1.05M
  phi = ssa->vars[var].sym_use_chain;
370
1.06M
  while (phi) {
371
3.45k
    var2 = phi->ssa_var;
372
3.45k
    if (!ssa->vars[var2].no_val) {
373
3.35k
      iterator->state = 10;
374
3.35k
      iterator->phi = phi;
375
3.35k
      return var2;
376
3.35k
    }
377
3.45k
state_10:
378
3.45k
    phi = phi->sym_use_chain;
379
3.45k
  }
380
1.05M
#endif
381
382
1.05M
  iterator->state = 11;
383
1.05M
state_11:
384
1.05M
  return -1;
385
1.05M
}
386
/* }}} */
387
388
static void zend_ssa_check_scc_var(const zend_op_array *op_array, zend_ssa *ssa, int var, int *index, zend_worklist_stack *stack, zend_worklist_stack *vstack, zend_scc_iterator *iterators) /* {{{ */
389
220k
{
390
1.05M
restart:
391
1.05M
  zend_worklist_stack_push(vstack, var);
392
1.05M
  iterators[var].state = 0;
393
1.05M
  iterators[var].last = -1;
394
1.05M
  ssa->vars[var].scc_entry = 1;
395
1.05M
  ssa->vars[var].scc = *index;
396
1.05M
  (*index)++;
397
398
2.11M
  while (vstack->len > 0) {
399
1.89M
    var = zend_worklist_stack_peek(vstack);
400
2.28M
    while (1) {
401
2.28M
      int var2;
402
403
2.28M
      if (iterators[var].last >= 0) {
404
        /* finish edge */
405
1.22M
        var2 = iterators[var].last;
406
1.22M
        if (ssa->vars[var2].scc < ssa->vars[var].scc) {
407
114k
          ssa->vars[var].scc = ssa->vars[var2].scc;
408
114k
          ssa->vars[var].scc_entry = 0;
409
114k
        }
410
1.22M
      }
411
2.28M
      var2 = zend_scc_next(op_array, ssa, var, iterators + var);
412
2.28M
      iterators[var].last = var2;
413
2.28M
      if (var2 < 0) break;
414
      /* begin edge */
415
1.22M
      if (ssa->vars[var2].scc < 0) {
416
838k
        var = var2;
417
838k
        goto restart;
418
838k
      }
419
1.22M
    }
420
421
    /* finish visiting */
422
1.05M
    zend_worklist_stack_pop(vstack);
423
1.05M
    if (ssa->vars[var].scc_entry) {
424
946k
      ssa->sccs--;
425
1.05M
      while (stack->len > 0) {
426
135k
        int var2 = zend_worklist_stack_peek(stack);
427
135k
        if (ssa->vars[var2].scc < ssa->vars[var].scc) {
428
21.9k
          break;
429
21.9k
        }
430
113k
        zend_worklist_stack_pop(stack);
431
113k
        ssa->vars[var2].scc = ssa->sccs;
432
113k
        (*index)--;
433
113k
      }
434
946k
      ssa->vars[var].scc = ssa->sccs;
435
946k
      (*index)--;
436
946k
    } else {
437
113k
      zend_worklist_stack_push(stack, var);
438
113k
    }
439
1.05M
  }
440
1.05M
}
441
/* }}} */
442
443
ZEND_API void zend_ssa_find_sccs(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
444
74.1k
{
445
74.1k
  int index = 0;
446
74.1k
  zend_worklist_stack stack, vstack;
447
74.1k
  zend_scc_iterator *iterators;
448
74.1k
  int j;
449
74.1k
  ALLOCA_FLAG(stack_use_heap)
450
74.1k
  ALLOCA_FLAG(vstack_use_heap)
451
74.1k
  ALLOCA_FLAG(iterators_use_heap)
452
453
74.1k
  iterators = do_alloca(sizeof(zend_scc_iterator) * ssa->vars_count, iterators_use_heap);
454
74.1k
  ZEND_WORKLIST_STACK_ALLOCA(&vstack, ssa->vars_count, vstack_use_heap);
455
74.1k
  ZEND_WORKLIST_STACK_ALLOCA(&stack, ssa->vars_count, stack_use_heap);
456
457
  /* Find SCCs using Pearce's algorithm. */
458
74.1k
  ssa->sccs = ssa->vars_count;
459
1.20M
  for (j = 0; j < ssa->vars_count; j++) {
460
1.12M
    if (!ssa->vars[j].no_val && ssa->vars[j].scc < 0) {
461
220k
      zend_ssa_check_scc_var(op_array, ssa, j, &index, &stack, &vstack, iterators);
462
220k
    }
463
1.12M
  }
464
465
74.1k
  if (ssa->sccs) {
466
    /* Shift SCC indexes. */
467
838k
    for (j = 0; j < ssa->vars_count; j++) {
468
811k
      if (ssa->vars[j].scc >= 0) {
469
742k
        ssa->vars[j].scc -= ssa->sccs;
470
742k
      }
471
811k
    }
472
27.1k
  }
473
74.1k
  ssa->sccs = ssa->vars_count - ssa->sccs;
474
475
1.20M
  for (j = 0; j < ssa->vars_count; j++) {
476
1.12M
    if (ssa->vars[j].scc >= 0) {
477
1.05M
      int var = j;
478
1.24M
      FOR_EACH_VAR_USAGE(var, CHECK_SCC_ENTRY);
479
1.05M
    }
480
1.12M
  }
481
482
74.1k
  ZEND_WORKLIST_STACK_FREE_ALLOCA(&stack, stack_use_heap);
483
74.1k
  ZEND_WORKLIST_STACK_FREE_ALLOCA(&vstack, vstack_use_heap);
484
74.1k
  free_alloca(iterators, iterators_use_heap);
485
74.1k
}
486
/* }}} */
487
488
#endif
489
490
ZEND_API void zend_ssa_find_false_dependencies(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
491
74.1k
{
492
74.1k
  zend_ssa_var *ssa_vars = ssa->vars;
493
74.1k
  zend_ssa_op *ssa_ops = ssa->ops;
494
74.1k
  int ssa_vars_count = ssa->vars_count;
495
74.1k
  zend_bitset worklist;
496
74.1k
  int i, j, use;
497
74.1k
  zend_ssa_phi *p;
498
74.1k
  ALLOCA_FLAG(use_heap);
499
500
74.1k
  if (!op_array->function_name || !ssa->vars || !ssa->ops) {
501
35.7k
    return;
502
35.7k
  }
503
504
38.3k
  worklist = do_alloca(sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count), use_heap);
505
38.3k
  memset(worklist, 0, sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count));
506
507
471k
  for (i = 0; i < ssa_vars_count; i++) {
508
433k
    ssa_vars[i].no_val = 1; /* mark as unused */
509
433k
    use = ssa->vars[i].use_chain;
510
457k
    while (use >= 0) {
511
337k
      if (!zend_ssa_is_no_val_use(&op_array->opcodes[use], &ssa->ops[use], i)) {
512
312k
        ssa_vars[i].no_val = 0; /* used directly */
513
312k
        zend_bitset_incl(worklist, i);
514
312k
        break;
515
312k
      }
516
24.1k
      use = zend_ssa_next_use(ssa_ops, i, use);
517
24.1k
    }
518
433k
  }
519
520
1.30M
  WHILE_WORKLIST(worklist, zend_bitset_len(ssa_vars_count), i) {
521
1.30M
    if (ssa_vars[i].definition_phi) {
522
      /* mark all possible sources as used */
523
63.5k
      p = ssa_vars[i].definition_phi;
524
63.5k
      if (p->pi >= 0) {
525
20.8k
        if (ssa_vars[p->sources[0]].no_val) {
526
27
          ssa_vars[p->sources[0]].no_val = 0; /* used indirectly */
527
27
          zend_bitset_incl(worklist, p->sources[0]);
528
27
        }
529
42.6k
      } else {
530
129k
        for (j = 0; j < ssa->cfg.blocks[p->block].predecessors_count; j++) {
531
86.4k
          ZEND_ASSERT(p->sources[j] >= 0);
532
86.4k
          if (ssa->vars[p->sources[j]].no_val) {
533
51.9k
            ssa_vars[p->sources[j]].no_val = 0; /* used indirectly */
534
51.9k
            zend_bitset_incl(worklist, p->sources[j]);
535
51.9k
          }
536
86.4k
        }
537
42.6k
      }
538
63.5k
    }
539
1.30M
  } WHILE_WORKLIST_END();
540
541
38.3k
  free_alloca(worklist, use_heap);
542
38.3k
}
543
/* }}} */
544
545
/* From "Hacker's Delight" */
546
static zend_ulong minOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
547
36
{
548
36
  zend_ulong m, temp;
549
550
36
  m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
551
2.30k
  while (m != 0) {
552
2.28k
    if (~a & c & m) {
553
18
      temp = (a | m) & -m;
554
18
      if (temp <= b) {
555
10
        a = temp;
556
10
        break;
557
10
      }
558
2.26k
    } else if (a & ~c & m) {
559
498
      temp = (c | m) & -m;
560
498
      if (temp <= d) {
561
0
        c = temp;
562
0
        break;
563
0
      }
564
498
    }
565
2.27k
    m = m >> 1;
566
2.27k
  }
567
36
  return a | c;
568
36
}
569
570
static zend_ulong maxOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
571
92
{
572
92
  zend_ulong m, temp;
573
574
92
  m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
575
2.39k
  while (m != 0) {
576
2.38k
    if (b & d & m) {
577
74
      temp = (b - m) | (m - 1);
578
74
      if (temp >= a) {
579
74
        b = temp;
580
74
        break;
581
74
      }
582
0
      temp = (d - m) | (m - 1);
583
0
      if (temp >= c) {
584
0
        d = temp;
585
0
        break;
586
0
      }
587
0
    }
588
2.30k
    m = m >> 1;
589
2.30k
  }
590
92
  return b | d;
591
92
}
592
593
static zend_ulong minAND(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
594
743
{
595
743
  zend_ulong m, temp;
596
597
743
  m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
598
14.1k
  while (m != 0) {
599
14.1k
    if (~a & ~c & m) {
600
12.3k
      temp = (a | m) & -m;
601
12.3k
      if (temp <= b) {
602
491
        a = temp;
603
491
        break;
604
491
      }
605
11.8k
      temp = (c | m) & -m;
606
11.8k
      if (temp <= d) {
607
208
        c = temp;
608
208
        break;
609
208
      }
610
11.8k
    }
611
13.4k
    m = m >> 1;
612
13.4k
  }
613
743
  return a & c;
614
743
}
615
616
static zend_ulong maxAND(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
617
292
{
618
292
  zend_ulong m, temp;
619
620
292
  m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
621
11.5k
  while (m != 0) {
622
11.5k
    if (b & ~d & m) {
623
26
      temp = (b | ~m) | (m - 1);
624
26
      if (temp >= a) {
625
26
        b = temp;
626
26
        break;
627
26
      }
628
11.4k
    } else if (~b & d & m) {
629
258
      temp = (d | ~m) | (m - 1);
630
258
      if (temp >= c) {
631
258
        d = temp;
632
258
        break;
633
258
      }
634
258
    }
635
11.2k
    m = m >> 1;
636
11.2k
  }
637
292
  return b & d;
638
292
}
639
640
/* Based on "Hacker's Delight" */
641
642
/*
643
0: + + + + 0 0 0 0 => 0 0 + min/max
644
2: + + - + 0 0 1 0 => 1 0 ? min(a,b,c,-1)/max(a,b,0,d)
645
3: + + - - 0 0 1 1 => 1 1 - min/max
646
8: - + + + 1 0 0 0 => 1 0 ? min(a,-1,b,d)/max(0,b,c,d)
647
a: - + - + 1 0 1 0 => 1 0 ? MIN(a,c)/max(0,b,0,d)
648
b: - + - - 1 0 1 1 => 1 1 - c/-1
649
c: - - + + 1 1 0 0 => 1 1 - min/max
650
e: - - - + 1 1 1 0 => 1 1 - a/-1
651
f  - - - - 1 1 1 1 => 1 1 - min/max
652
*/
653
static void zend_ssa_range_or(zend_long a, zend_long b, zend_long c, zend_long d, zend_ssa_range *tmp)
654
93
{
655
93
  int x = ((a < 0) ? 8 : 0) |
656
93
          ((b < 0) ? 4 : 0) |
657
93
          ((c < 0) ? 2 : 0) |
658
93
          ((d < 0) ? 1 : 0);
659
93
  switch (x) {
660
16
    case 0x0:
661
16
    case 0x3:
662
16
    case 0xc:
663
16
    case 0xf:
664
16
      tmp->min = minOR(a, b, c, d);
665
16
      tmp->max = maxOR(a, b, c, d);
666
16
      break;
667
0
    case 0x2:
668
0
      tmp->min = minOR(a, b, c, -1);
669
0
      tmp->max = maxOR(a, b, 0, d);
670
0
      break;
671
20
    case 0x8:
672
20
      tmp->min = minOR(a, -1, c, d);
673
20
      tmp->max = maxOR(0, b, c, d);
674
20
      break;
675
56
    case 0xa:
676
56
      tmp->min = MIN(a, c);
677
56
      tmp->max = maxOR(0, b, 0, d);
678
56
      break;
679
1
    case 0xb:
680
1
      tmp->min = c;
681
1
      tmp->max = -1;
682
1
      break;
683
0
    case 0xe:
684
0
      tmp->min = a;
685
0
      tmp->max = -1;
686
0
      break;
687
93
  }
688
93
}
689
690
/*
691
0: + + + + 0 0 0 0 => 0 0 + min/max
692
2: + + - + 0 0 1 0 => 0 0 + 0/b
693
3: + + - - 0 0 1 1 => 0 0 + min/max
694
8: - + + + 1 0 0 0 => 0 0 + 0/d
695
a: - + - + 1 0 1 0 => 1 0 ? min(a,-1,c,-1)/NAX(b,d)
696
b: - + - - 1 0 1 1 => 1 0 ? min(a,-1,c,d)/max(0,b,c,d)
697
c: - - + + 1 1 0 0 => 1 1 - min/max
698
e: - - - + 1 1 1 0 => 1 0 ? min(a,b,c,-1)/max(a,b,0,d)
699
f  - - - - 1 1 1 1 => 1 1 - min/max
700
*/
701
static void zend_ssa_range_and(zend_long a, zend_long b, zend_long c, zend_long d, zend_ssa_range *tmp)
702
926
{
703
926
  int x = ((a < 0) ? 8 : 0) |
704
926
          ((b < 0) ? 4 : 0) |
705
926
          ((c < 0) ? 2 : 0) |
706
926
          ((d < 0) ? 1 : 0);
707
926
  switch (x) {
708
278
    case 0x0:
709
284
    case 0x3:
710
284
    case 0xc:
711
284
    case 0xf:
712
284
      tmp->min = minAND(a, b, c, d);
713
284
      tmp->max = maxAND(a, b, c, d);
714
284
      break;
715
152
    case 0x2:
716
152
      tmp->min = 0;
717
152
      tmp->max = b;
718
152
      break;
719
31
    case 0x8:
720
31
      tmp->min = 0;
721
31
      tmp->max = d;
722
31
      break;
723
451
    case 0xa:
724
451
      tmp->min = minAND(a, -1, c, -1);
725
451
      tmp->max = MAX(b, d);
726
451
      break;
727
8
    case 0xb:
728
8
      tmp->min = minAND(a, -1, c, d);
729
8
      tmp->max = maxAND(0, b, c, d);
730
8
      break;
731
0
    case 0xe:
732
0
      tmp->min = minAND(a, b, c, -1);
733
0
      tmp->max = maxAND(a, b, 0, d);
734
0
      break;
735
926
  }
736
926
}
737
738
static inline bool zend_abs_range(
739
388
    zend_long min, zend_long max, zend_long *abs_min, zend_long *abs_max) {
740
388
  if (min == ZEND_LONG_MIN) {
741
    /* Cannot take absolute value of LONG_MIN  */
742
8
    return 0;
743
8
  }
744
745
380
  if (min >= 0) {
746
368
    *abs_min = min;
747
368
    *abs_max = max;
748
368
  } else if (max <= 0) {
749
12
    *abs_min = -max;
750
12
    *abs_max = -min;
751
12
  } else {
752
    /* Range crossing zero */
753
0
    *abs_min = 0;
754
0
    *abs_max = MAX(max, -min);
755
0
  }
756
757
380
  return 1;
758
388
}
759
760
342
static inline zend_long safe_shift_left(zend_long n, zend_long s) {
761
342
  return (zend_long) ((zend_ulong) n << (zend_ulong) s);
762
342
}
763
764
184
static inline bool shift_left_overflows(zend_long n, zend_long s) {
765
  /* This considers shifts that shift in the sign bit to be overflowing as well */
766
184
  if (n >= 0) {
767
86
    return s >= SIZEOF_ZEND_LONG * 8 - 1 || safe_shift_left(n, s) < n;
768
98
  } else {
769
98
    return s >= SIZEOF_ZEND_LONG * 8 || safe_shift_left(n, s) > n;
770
98
  }
771
184
}
772
773
/* If b does not divide a exactly, return the two adjacent values between which the real result
774
 * lies. */
775
308
static void float_div(zend_long a, zend_long b, zend_long *r1, zend_long *r2) {
776
308
  *r1 = *r2 = a / b;
777
308
  if (a % b != 0) {
778
216
    if (*r2 < 0) {
779
90
      (*r2)--;
780
126
    } else {
781
126
      (*r2)++;
782
126
    }
783
216
  }
784
308
}
785
786
static bool zend_inference_calc_binary_op_range(
787
    const zend_op_array *op_array, const zend_ssa *ssa,
788
69.6k
    const zend_op *opline, const zend_ssa_op *ssa_op, uint8_t opcode, zend_ssa_range *tmp) {
789
69.6k
  zend_long op1_min, op2_min, op1_max, op2_max, t1, t2, t3, t4;
790
791
69.6k
  switch (opcode) {
792
32.4k
    case ZEND_ADD:
793
32.4k
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
794
22.8k
        op1_min = OP1_MIN_RANGE();
795
22.8k
        op2_min = OP2_MIN_RANGE();
796
22.8k
        op1_max = OP1_MAX_RANGE();
797
22.8k
        op2_max = OP2_MAX_RANGE();
798
22.8k
        if (OP1_RANGE_UNDERFLOW() ||
799
22.8k
          OP2_RANGE_UNDERFLOW() ||
800
22.8k
          zend_add_will_overflow(op1_min, op2_min)) {
801
22.0k
          tmp->underflow = 1;
802
22.0k
          tmp->min = ZEND_LONG_MIN;
803
22.0k
        } else {
804
831
          tmp->min = op1_min + op2_min;
805
831
        }
806
22.8k
        if (OP1_RANGE_OVERFLOW() ||
807
22.8k
          OP2_RANGE_OVERFLOW() ||
808
22.8k
          zend_add_will_overflow(op1_max, op2_max)) {
809
22.2k
          tmp->overflow = 1;
810
22.2k
          tmp->max = ZEND_LONG_MAX;
811
22.2k
        } else {
812
615
          tmp->max = op1_max + op2_max;
813
615
        }
814
22.8k
        return 1;
815
22.8k
      }
816
9.55k
      break;
817
9.55k
    case ZEND_SUB:
818
6.86k
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
819
5.60k
        op1_min = OP1_MIN_RANGE();
820
5.60k
        op2_min = OP2_MIN_RANGE();
821
5.60k
        op1_max = OP1_MAX_RANGE();
822
5.60k
        op2_max = OP2_MAX_RANGE();
823
5.60k
        if (OP1_RANGE_UNDERFLOW() ||
824
5.60k
          OP2_RANGE_OVERFLOW() ||
825
5.60k
          zend_sub_will_overflow(op1_min, op2_max)) {
826
4.22k
          tmp->underflow = 1;
827
4.22k
          tmp->min = ZEND_LONG_MIN;
828
4.22k
        } else {
829
1.37k
          tmp->min = op1_min - op2_max;
830
1.37k
        }
831
5.60k
        if (OP1_RANGE_OVERFLOW() ||
832
5.60k
          OP2_RANGE_UNDERFLOW() ||
833
5.60k
          zend_sub_will_overflow(op1_max, op2_min)) {
834
4.14k
          tmp->overflow = 1;
835
4.14k
          tmp->max = ZEND_LONG_MAX;
836
4.14k
        } else {
837
1.45k
          tmp->max = op1_max - op2_min;
838
1.45k
        }
839
5.60k
        return 1;
840
5.60k
      }
841
1.26k
      break;
842
9.01k
    case ZEND_MUL:
843
9.01k
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
844
6.86k
        double dummy;
845
6.86k
        zend_long t1_overflow, t2_overflow, t3_overflow, t4_overflow;
846
6.86k
        op1_min = OP1_MIN_RANGE();
847
6.86k
        op2_min = OP2_MIN_RANGE();
848
6.86k
        op1_max = OP1_MAX_RANGE();
849
6.86k
        op2_max = OP2_MAX_RANGE();
850
        /* Suppress uninit variable warnings, these will only be used if the overflow
851
         * flags are all false. */
852
6.86k
        t1 = t2 = t3 = t4 = 0;
853
6.86k
        ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_min, t1, dummy, t1_overflow);
854
6.86k
        ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_max, t2, dummy, t2_overflow);
855
6.86k
        ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_min, t3, dummy, t3_overflow);
856
6.86k
        ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_max, t4, dummy, t4_overflow);
857
6.86k
        (void) dummy;
858
859
        // FIXME: more careful overflow checks?
860
6.86k
        if (OP1_RANGE_UNDERFLOW() || OP2_RANGE_UNDERFLOW() ||
861
6.86k
          OP1_RANGE_OVERFLOW() || OP2_RANGE_OVERFLOW()  ||
862
6.86k
          t1_overflow || t2_overflow || t3_overflow || t4_overflow
863
6.86k
        ) {
864
6.71k
          tmp->underflow = 1;
865
6.71k
          tmp->overflow = 1;
866
6.71k
          tmp->min = ZEND_LONG_MIN;
867
6.71k
          tmp->max = ZEND_LONG_MAX;
868
6.71k
        } else {
869
148
          tmp->min = MIN(MIN(t1, t2), MIN(t3, t4));
870
148
          tmp->max = MAX(MAX(t1, t2), MAX(t3, t4));
871
148
        }
872
6.86k
        return 1;
873
6.86k
      }
874
2.15k
      break;
875
3.23k
    case ZEND_DIV:
876
3.23k
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
877
2.91k
        op1_min = OP1_MIN_RANGE();
878
2.91k
        op2_min = OP2_MIN_RANGE();
879
2.91k
        op1_max = OP1_MAX_RANGE();
880
2.91k
        op2_max = OP2_MAX_RANGE();
881
882
        /* If op2 crosses zero, then floating point values close to zero might be
883
         * possible, which will result in arbitrarily large results (overflow). Also
884
         * avoid dividing LONG_MIN by -1, which is UB. */
885
2.91k
        if (OP1_RANGE_UNDERFLOW() || OP2_RANGE_UNDERFLOW() ||
886
2.91k
          OP1_RANGE_OVERFLOW() || OP2_RANGE_OVERFLOW() ||
887
2.91k
          (op2_min <= 0 && op2_max >= 0) ||
888
2.91k
          (op1_min == ZEND_LONG_MIN && op2_max == -1)
889
2.91k
        ) {
890
2.83k
          tmp->underflow = 1;
891
2.83k
          tmp->overflow = 1;
892
2.83k
          tmp->min = ZEND_LONG_MIN;
893
2.83k
          tmp->max = ZEND_LONG_MAX;
894
2.83k
        } else {
895
77
          zend_long t1_, t2_, t3_, t4_;
896
77
          float_div(op1_min, op2_min, &t1, &t1_);
897
77
          float_div(op1_min, op2_max, &t2, &t2_);
898
77
          float_div(op1_max, op2_min, &t3, &t3_);
899
77
          float_div(op1_max, op2_max, &t4, &t4_);
900
901
77
          tmp->min = MIN(MIN(MIN(t1, t2), MIN(t3, t4)), MIN(MIN(t1_, t2_), MIN(t3_, t4_)));
902
77
          tmp->max = MAX(MAX(MAX(t1, t2), MAX(t3, t4)), MAX(MAX(t1_, t2_), MAX(t3_, t4_)));
903
77
        }
904
2.91k
        return 1;
905
2.91k
      }
906
321
      break;
907
3.57k
    case ZEND_MOD:
908
3.57k
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
909
2.09k
        if (OP1_RANGE_UNDERFLOW() ||
910
2.09k
          OP2_RANGE_UNDERFLOW() ||
911
2.09k
          OP1_RANGE_OVERFLOW()  ||
912
2.09k
          OP2_RANGE_OVERFLOW()) {
913
1.71k
          tmp->min = ZEND_LONG_MIN;
914
1.71k
          tmp->max = ZEND_LONG_MAX;
915
1.71k
        } else {
916
388
          zend_long op2_abs_min, op2_abs_max;
917
918
388
          op1_min = OP1_MIN_RANGE();
919
388
          op2_min = OP2_MIN_RANGE();
920
388
          op1_max = OP1_MAX_RANGE();
921
388
          op2_max = OP2_MAX_RANGE();
922
388
          if (!zend_abs_range(op2_min, op2_max, &op2_abs_min, &op2_abs_max)) {
923
8
            break;
924
8
          }
925
926
380
          if (op2_abs_max == 0) {
927
            /* Always modulus by zero, nothing we can do */
928
36
            break;
929
36
          }
930
344
          if (op2_abs_min == 0) {
931
            /* Ignore the modulus by zero case, which will throw */
932
0
            op2_abs_min++;
933
0
          }
934
935
344
          if (op1_min >= 0) {
936
35
            tmp->min = op1_max < op2_abs_min ? op1_min : 0;
937
35
            tmp->max = MIN(op1_max, op2_abs_max - 1);
938
309
          } else if (op1_max <= 0) {
939
0
            tmp->min = MAX(op1_min, -op2_abs_max + 1);
940
0
            tmp->max = op1_min > -op2_abs_min ? op1_max : 0;
941
309
          } else {
942
309
            tmp->min = MAX(op1_min, -op2_abs_max + 1);
943
309
            tmp->max = MIN(op1_max, op2_abs_max - 1);
944
309
          }
945
344
        }
946
2.05k
        return 1;
947
2.09k
      }
948
1.47k
      break;
949
1.56k
    case ZEND_SL:
950
1.56k
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
951
1.29k
        if (OP1_RANGE_UNDERFLOW() ||
952
1.29k
          OP2_RANGE_UNDERFLOW() ||
953
1.29k
          OP1_RANGE_OVERFLOW() ||
954
1.29k
          OP2_RANGE_OVERFLOW()) {
955
1.16k
          tmp->min = ZEND_LONG_MIN;
956
1.16k
          tmp->max = ZEND_LONG_MAX;
957
1.16k
        } else {
958
133
          op1_min = OP1_MIN_RANGE();
959
133
          op2_min = OP2_MIN_RANGE();
960
133
          op1_max = OP1_MAX_RANGE();
961
133
          op2_max = OP2_MAX_RANGE();
962
963
          /* Shifts by negative numbers will throw, ignore them */
964
133
          if (op2_min < 0) {
965
34
            op2_min = 0;
966
34
          }
967
133
          if (op2_max < 0) {
968
10
            op2_max = 0;
969
10
          }
970
971
133
          if (shift_left_overflows(op1_min, op2_max)
972
133
              || shift_left_overflows(op1_max, op2_max)) {
973
82
            tmp->min = ZEND_LONG_MIN;
974
82
            tmp->max = ZEND_LONG_MAX;
975
82
          } else {
976
51
            t1 = safe_shift_left(op1_min, op2_min);
977
51
            t2 = safe_shift_left(op1_min, op2_max);
978
51
            t3 = safe_shift_left(op1_max, op2_min);
979
51
            t4 = safe_shift_left(op1_max, op2_max);
980
51
            tmp->min = MIN(MIN(t1, t2), MIN(t3, t4));
981
51
            tmp->max = MAX(MAX(t1, t2), MAX(t3, t4));
982
51
          }
983
133
        }
984
1.29k
        return 1;
985
1.29k
      }
986
267
      break;
987
509
    case ZEND_SR:
988
509
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
989
328
        if (OP1_RANGE_UNDERFLOW() ||
990
328
          OP2_RANGE_UNDERFLOW() ||
991
328
          OP1_RANGE_OVERFLOW() ||
992
328
          OP2_RANGE_OVERFLOW()) {
993
220
          tmp->min = ZEND_LONG_MIN;
994
220
          tmp->max = ZEND_LONG_MAX;
995
220
        } else {
996
108
          op1_min = OP1_MIN_RANGE();
997
108
          op2_min = OP2_MIN_RANGE();
998
108
          op1_max = OP1_MAX_RANGE();
999
108
          op2_max = OP2_MAX_RANGE();
1000
1001
          /* Shifts by negative numbers will throw, ignore them */
1002
108
          if (op2_min < 0) {
1003
76
            op2_min = 0;
1004
76
          }
1005
108
          if (op2_max < 0) {
1006
14
            op2_max = 0;
1007
14
          }
1008
1009
          /* Shifts by more than the integer size will be 0 or -1 */
1010
108
          if (op2_min >= SIZEOF_ZEND_LONG * 8) {
1011
8
            op2_min = SIZEOF_ZEND_LONG * 8 - 1;
1012
8
          }
1013
108
          if (op2_max >= SIZEOF_ZEND_LONG * 8) {
1014
20
            op2_max = SIZEOF_ZEND_LONG * 8 - 1;
1015
20
          }
1016
1017
108
          t1 = op1_min >> op2_min;
1018
108
          t2 = op1_min >> op2_max;
1019
108
          t3 = op1_max >> op2_min;
1020
108
          t4 = op1_max >> op2_max;
1021
108
          tmp->min = MIN(MIN(t1, t2), MIN(t3, t4));
1022
108
          tmp->max = MAX(MAX(t1, t2), MAX(t3, t4));
1023
108
        }
1024
328
        return 1;
1025
328
      }
1026
181
      break;
1027
711
    case ZEND_BW_OR:
1028
711
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
1029
525
        if (OP1_RANGE_UNDERFLOW() ||
1030
525
          OP2_RANGE_UNDERFLOW() ||
1031
525
          OP1_RANGE_OVERFLOW() ||
1032
525
          OP2_RANGE_OVERFLOW()) {
1033
432
          tmp->min = ZEND_LONG_MIN;
1034
432
          tmp->max = ZEND_LONG_MAX;
1035
432
        } else {
1036
93
          op1_min = OP1_MIN_RANGE();
1037
93
          op2_min = OP2_MIN_RANGE();
1038
93
          op1_max = OP1_MAX_RANGE();
1039
93
          op2_max = OP2_MAX_RANGE();
1040
93
          zend_ssa_range_or(op1_min, op1_max, op2_min, op2_max, tmp);
1041
93
        }
1042
525
        return 1;
1043
525
      }
1044
186
      break;
1045
9.72k
    case ZEND_BW_AND:
1046
9.72k
      if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
1047
8.28k
        if (OP1_RANGE_UNDERFLOW() ||
1048
8.28k
          OP2_RANGE_UNDERFLOW() ||
1049
8.28k
          OP1_RANGE_OVERFLOW() ||
1050
8.28k
          OP2_RANGE_OVERFLOW()) {
1051
7.36k
          tmp->min = ZEND_LONG_MIN;
1052
7.36k
          tmp->max = ZEND_LONG_MAX;
1053
7.36k
        } else {
1054
926
          op1_min = OP1_MIN_RANGE();
1055
926
          op2_min = OP2_MIN_RANGE();
1056
926
          op1_max = OP1_MAX_RANGE();
1057
926
          op2_max = OP2_MAX_RANGE();
1058
926
          zend_ssa_range_and(op1_min, op1_max, op2_min, op2_max, tmp);
1059
926
        }
1060
8.28k
        return 1;
1061
8.28k
      }
1062
1.44k
      break;
1063
2.03k
    case ZEND_BW_XOR:
1064
      // TODO
1065
2.03k
      break;
1066
69.6k
    EMPTY_SWITCH_DEFAULT_CASE()
1067
69.6k
  }
1068
18.9k
  return 0;
1069
69.6k
}
1070
1071
static bool zend_inference_calc_range(const zend_op_array *op_array, const zend_ssa *ssa, int var, int widening, int narrowing, zend_ssa_range *tmp)
1072
1.57M
{
1073
1.57M
  uint32_t line;
1074
1.57M
  const zend_op *opline;
1075
1.57M
  const zend_ssa_op *ssa_op;
1076
1077
1.57M
  if (ssa->vars[var].definition_phi) {
1078
275k
    const zend_ssa_phi *p = ssa->vars[var].definition_phi;
1079
275k
    int i;
1080
1081
275k
    tmp->underflow = 0;
1082
275k
    tmp->min = ZEND_LONG_MAX;
1083
275k
    tmp->max = ZEND_LONG_MIN;
1084
275k
    tmp->overflow = 0;
1085
275k
    if (p->pi >= 0 && p->has_range_constraint) {
1086
25.2k
      const zend_ssa_range_constraint *constraint = &p->constraint.range;
1087
25.2k
      if (constraint->negative) {
1088
1.78k
        int src1 = p->sources[0];
1089
1090
1.78k
        if (ssa->var_info[src1].has_range) {
1091
1.47k
          *tmp = ssa->var_info[src1].range;
1092
1.47k
          if (constraint->range.min == constraint->range.max
1093
1.47k
           && !constraint->range.underflow
1094
1.47k
           && !constraint->range.overflow
1095
1.47k
           && p->constraint.range.min_ssa_var < 0
1096
1.47k
           && p->constraint.range.max_ssa_var < 0
1097
1.47k
           && ssa->vars[src1].definition >= 0) {
1098
            /* Check for constrained induction variable */
1099
136
            line = ssa->vars[src1].definition;
1100
136
            opline = op_array->opcodes + line;
1101
136
            switch (opline->opcode) {
1102
0
              case ZEND_PRE_DEC:
1103
56
              case ZEND_POST_DEC:
1104
56
                if (!tmp->underflow) {
1105
20
                  const zend_ssa_phi *p = ssa->vars[ssa->ops[line].op1_use].definition_phi;
1106
1107
20
                  if (p && p->pi < 0
1108
20
                   && ssa->cfg.blocks[p->block].predecessors_count == 2
1109
20
                   && p->sources[1] == var
1110
20
                   && ssa->var_info[p->sources[0]].has_range
1111
20
                   && ssa->var_info[p->sources[0]].range.min > constraint->range.max) {
1112
20
                    tmp->min = constraint->range.max + 1;
1113
20
                  }
1114
20
                }
1115
56
                break;
1116
0
              case ZEND_PRE_INC:
1117
10
              case ZEND_POST_INC:
1118
10
                if (!tmp->overflow) {
1119
0
                  const zend_ssa_phi *p = ssa->vars[ssa->ops[line].op1_use].definition_phi;
1120
1121
0
                  if (p && p->pi < 0
1122
0
                   && ssa->cfg.blocks[p->block].predecessors_count == 2
1123
0
                   && p->sources[1] == var
1124
0
                   && ssa->var_info[p->sources[0]].has_range
1125
0
                   && ssa->var_info[p->sources[0]].range.max < constraint->range.min) {
1126
0
                    tmp->max = constraint->range.min - 1;
1127
0
                  }
1128
0
                }
1129
10
                break;
1130
136
            }
1131
136
          }
1132
1.47k
        } else if (narrowing) {
1133
284
          tmp->underflow = 1;
1134
284
          tmp->min = ZEND_LONG_MIN;
1135
284
          tmp->max = ZEND_LONG_MAX;
1136
284
          tmp->overflow = 1;
1137
284
        }
1138
1139
#ifdef NEG_RANGE
1140
        if (constraint->min_ssa_var < 0 &&
1141
            constraint->max_ssa_var < 0 &&
1142
            ssa->var_info[p->ssa_var].has_range) {
1143
          LOG_NEG_RANGE("%s() #%d [%ld..%ld] -> [%ld..%ld]?\n",
1144
            ZSTR_VAL(op_array->function_name),
1145
            p->ssa_var,
1146
            ssa->var_info[p->ssa_var].range.min,
1147
            ssa->var_info[p->ssa_var].range.max,
1148
            tmp->min,
1149
            tmp->max);
1150
          if (constraint->negative == NEG_USE_LT &&
1151
              tmp->max >= constraint->range.min) {
1152
            tmp->overflow = 0;
1153
            tmp->max = constraint->range.min - 1;
1154
            LOG_NEG_RANGE("  => [%ld..%ld]\n", tmp->min, tmp->max);
1155
          } else if (constraint->negative == NEG_USE_GT &&
1156
                     tmp->min <= constraint->range.max) {
1157
            tmp->underflow = 0;
1158
            tmp->min = constraint->range.max + 1;
1159
            LOG_NEG_RANGE("  => [%ld..%ld]\n", tmp->min, tmp->max);
1160
          }
1161
        }
1162
#endif
1163
23.5k
      } else if (ssa->var_info[p->sources[0]].has_range) {
1164
        /* intersection */
1165
23.2k
        *tmp = ssa->var_info[p->sources[0]].range;
1166
23.2k
        if (constraint->min_ssa_var < 0) {
1167
20.5k
          tmp->underflow = constraint->range.underflow && tmp->underflow;
1168
20.5k
          tmp->min = MAX(constraint->range.min, tmp->min);
1169
20.5k
#ifdef SYM_RANGE
1170
20.5k
        } else if (narrowing && ssa->var_info[constraint->min_ssa_var].has_range) {
1171
881
          tmp->underflow = ssa->var_info[constraint->min_ssa_var].range.underflow && tmp->underflow;
1172
881
          if (!add_will_overflow(ssa->var_info[constraint->min_ssa_var].range.min, constraint->range.min)) {
1173
876
            tmp->min = MAX(ssa->var_info[constraint->min_ssa_var].range.min + constraint->range.min, tmp->min);
1174
876
          }
1175
881
#endif
1176
881
        }
1177
23.2k
        if (constraint->max_ssa_var < 0) {
1178
19.4k
          tmp->max = MIN(constraint->range.max, tmp->max);
1179
19.4k
          tmp->overflow = constraint->range.overflow && tmp->overflow;
1180
19.4k
#ifdef SYM_RANGE
1181
19.4k
        } else if (narrowing && ssa->var_info[constraint->max_ssa_var].has_range) {
1182
943
          if (!add_will_overflow(ssa->var_info[constraint->max_ssa_var].range.max, constraint->range.max)) {
1183
938
            tmp->max = MIN(ssa->var_info[constraint->max_ssa_var].range.max + constraint->range.max, tmp->max);
1184
938
          }
1185
943
          tmp->overflow = ssa->var_info[constraint->max_ssa_var].range.overflow && tmp->overflow;
1186
943
#endif
1187
943
        }
1188
23.2k
      } else if (narrowing) {
1189
269
        if (constraint->min_ssa_var < 0) {
1190
269
          tmp->underflow = constraint->range.underflow;
1191
269
          tmp->min = constraint->range.min;
1192
269
#ifdef SYM_RANGE
1193
269
        } else if (narrowing && ssa->var_info[constraint->min_ssa_var].has_range) {
1194
0
          if (add_will_overflow(ssa->var_info[constraint->min_ssa_var].range.min, constraint->range.min)) {
1195
0
            tmp->underflow = 1;
1196
0
            tmp->min = ZEND_LONG_MIN;
1197
0
          } else {
1198
0
            tmp->underflow = ssa->var_info[constraint->min_ssa_var].range.underflow;
1199
0
            tmp->min = ssa->var_info[constraint->min_ssa_var].range.min + constraint->range.min;
1200
0
          }
1201
0
#endif
1202
0
        } else {
1203
0
          tmp->underflow = 1;
1204
0
          tmp->min = ZEND_LONG_MIN;
1205
0
        }
1206
269
        if (constraint->max_ssa_var < 0) {
1207
269
          tmp->max = constraint->range.max;
1208
269
          tmp->overflow = constraint->range.overflow;
1209
269
#ifdef SYM_RANGE
1210
269
        } else if (narrowing && ssa->var_info[constraint->max_ssa_var].has_range) {
1211
0
          if (add_will_overflow(ssa->var_info[constraint->max_ssa_var].range.max, constraint->range.max)) {
1212
0
            tmp->overflow = 1;
1213
0
            tmp->max = ZEND_LONG_MAX;
1214
0
          } else {
1215
0
            tmp->max = ssa->var_info[constraint->max_ssa_var].range.max + constraint->range.max;
1216
0
            tmp->overflow = ssa->var_info[constraint->max_ssa_var].range.overflow;
1217
0
          }
1218
0
#endif
1219
0
        } else {
1220
0
          tmp->max = ZEND_LONG_MAX;
1221
0
          tmp->overflow = 1;
1222
0
        }
1223
269
      }
1224
250k
    } else {
1225
733k
      for (i = 0; i < ssa->cfg.blocks[p->block].predecessors_count; i++) {
1226
483k
        ZEND_ASSERT(p->sources[i] >= 0);
1227
483k
        if (ssa->var_info[p->sources[i]].has_range) {
1228
          /* union */
1229
419k
          tmp->underflow |= ssa->var_info[p->sources[i]].range.underflow;
1230
419k
          tmp->min = MIN(tmp->min, ssa->var_info[p->sources[i]].range.min);
1231
419k
          tmp->max = MAX(tmp->max, ssa->var_info[p->sources[i]].range.max);
1232
419k
          tmp->overflow |= ssa->var_info[p->sources[i]].range.overflow;
1233
419k
        } else if (narrowing) {
1234
23.1k
          tmp->underflow = 1;
1235
23.1k
          tmp->min = ZEND_LONG_MIN;
1236
23.1k
          tmp->max = ZEND_LONG_MAX;
1237
23.1k
          tmp->overflow = 1;
1238
23.1k
        }
1239
483k
      }
1240
250k
    }
1241
275k
    return (tmp->min <= tmp->max);
1242
1.30M
  } else if (ssa->vars[var].definition < 0) {
1243
8.72k
    return 0;
1244
8.72k
  }
1245
1.29M
  line = ssa->vars[var].definition;
1246
1.29M
  opline = op_array->opcodes + line;
1247
1.29M
  ssa_op = &ssa->ops[line];
1248
1249
1.29M
  return zend_inference_propagate_range(op_array, ssa, opline, ssa_op, var, tmp);
1250
1.57M
}
1251
1252
ZEND_API bool zend_inference_propagate_range(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline, const zend_ssa_op* ssa_op, int var, zend_ssa_range *tmp)
1253
1.29M
{
1254
1.29M
  tmp->underflow = 0;
1255
1.29M
  tmp->overflow = 0;
1256
1.29M
  switch (opline->opcode) {
1257
23.5k
    case ZEND_ADD:
1258
29.0k
    case ZEND_SUB:
1259
36.9k
    case ZEND_MUL:
1260
40.0k
    case ZEND_DIV:
1261
43.2k
    case ZEND_MOD:
1262
44.8k
    case ZEND_SL:
1263
45.3k
    case ZEND_SR:
1264
45.9k
    case ZEND_BW_OR:
1265
49.1k
    case ZEND_BW_AND:
1266
51.1k
    case ZEND_BW_XOR:
1267
51.1k
      if (ssa_op->result_def == var) {
1268
51.1k
        return zend_inference_calc_binary_op_range(
1269
51.1k
          op_array, ssa, opline, ssa_op, opline->opcode, tmp);
1270
51.1k
      }
1271
0
      break;
1272
1273
7.12k
    case ZEND_BW_NOT:
1274
7.12k
      if (ssa_op->result_def == var) {
1275
7.12k
        if (OP1_HAS_RANGE()) {
1276
5.17k
          if (OP1_RANGE_UNDERFLOW() ||
1277
5.17k
              OP1_RANGE_OVERFLOW()) {
1278
2.59k
            tmp->min = ZEND_LONG_MIN;
1279
2.59k
            tmp->max = ZEND_LONG_MAX;
1280
2.59k
          } else {
1281
2.57k
            zend_long op1_min = OP1_MIN_RANGE();
1282
2.57k
            zend_long op1_max = OP1_MAX_RANGE();
1283
2.57k
            tmp->min = ~op1_max;
1284
2.57k
            tmp->max = ~op1_min;
1285
2.57k
          }
1286
5.17k
          return 1;
1287
5.17k
        }
1288
7.12k
      }
1289
1.95k
      break;
1290
1.95k
    case ZEND_CAST:
1291
1.06k
      if (ssa_op->op1_def == var) {
1292
0
        if (ssa_op->op1_def >= 0) {
1293
0
          if (OP1_HAS_RANGE()) {
1294
0
            tmp->underflow = OP1_RANGE_UNDERFLOW();
1295
0
            tmp->min = OP1_MIN_RANGE();
1296
0
            tmp->max = OP1_MAX_RANGE();
1297
0
            tmp->overflow  = OP1_RANGE_OVERFLOW();
1298
0
            return 1;
1299
0
          }
1300
0
        }
1301
1.06k
      } else if (ssa_op->result_def == var) {
1302
1.06k
        if (opline->extended_value == IS_LONG) {
1303
204
          if (OP1_HAS_RANGE()) {
1304
106
            tmp->min = OP1_MIN_RANGE();
1305
106
            tmp->max = OP1_MAX_RANGE();
1306
106
            return 1;
1307
106
          } else {
1308
98
            tmp->min = ZEND_LONG_MIN;
1309
98
            tmp->max = ZEND_LONG_MAX;
1310
98
            return 1;
1311
98
          }
1312
204
        }
1313
1.06k
      }
1314
863
      break;
1315
6.44k
    case ZEND_QM_ASSIGN:
1316
7.73k
    case ZEND_JMP_SET:
1317
8.99k
    case ZEND_COALESCE:
1318
9.39k
    case ZEND_COPY_TMP:
1319
9.39k
      if (ssa_op->op1_def == var) {
1320
0
        if (ssa_op->op1_def >= 0) {
1321
0
          if (OP1_HAS_RANGE()) {
1322
0
            tmp->underflow = OP1_RANGE_UNDERFLOW();
1323
0
            tmp->min = OP1_MIN_RANGE();
1324
0
            tmp->max = OP1_MAX_RANGE();
1325
0
            tmp->overflow  = OP1_RANGE_OVERFLOW();
1326
0
            return 1;
1327
0
          }
1328
0
        }
1329
0
      }
1330
9.39k
      if (ssa_op->result_def == var) {
1331
9.39k
        if (OP1_HAS_RANGE()) {
1332
6.69k
          tmp->min = OP1_MIN_RANGE();
1333
6.69k
          tmp->max = OP1_MAX_RANGE();
1334
6.69k
          tmp->underflow = OP1_RANGE_UNDERFLOW();
1335
6.69k
          tmp->overflow  = OP1_RANGE_OVERFLOW();
1336
6.69k
          return 1;
1337
6.69k
        }
1338
9.39k
      }
1339
2.70k
      break;
1340
2.70k
    case ZEND_SEND_VAR:
1341
0
      if (ssa_op->op1_def == var) {
1342
0
        if (ssa_op->op1_def >= 0) {
1343
0
          if (OP1_HAS_RANGE()) {
1344
0
            tmp->underflow = OP1_RANGE_UNDERFLOW();
1345
0
            tmp->min = OP1_MIN_RANGE();
1346
0
            tmp->max = OP1_MAX_RANGE();
1347
0
            tmp->overflow  = OP1_RANGE_OVERFLOW();
1348
0
            return 1;
1349
0
          }
1350
0
        }
1351
0
      }
1352
0
      break;
1353
20.3k
    case ZEND_PRE_INC:
1354
20.3k
      if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1355
20.3k
        if (OP1_HAS_RANGE()) {
1356
19.9k
          tmp->min = OP1_MIN_RANGE();
1357
19.9k
          tmp->max = OP1_MAX_RANGE();
1358
19.9k
          tmp->underflow = OP1_RANGE_UNDERFLOW();
1359
19.9k
          tmp->overflow = OP1_RANGE_OVERFLOW();
1360
19.9k
          if (tmp->max < ZEND_LONG_MAX) {
1361
17.1k
            tmp->max++;
1362
17.1k
          } else {
1363
2.83k
            tmp->overflow = 1;
1364
2.83k
          }
1365
19.9k
          if (tmp->min < ZEND_LONG_MAX && !tmp->underflow) {
1366
16.8k
            tmp->min++;
1367
16.8k
          }
1368
19.9k
          return 1;
1369
19.9k
        }
1370
20.3k
      }
1371
370
      break;
1372
1.54k
    case ZEND_PRE_DEC:
1373
1.54k
      if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1374
1.54k
        if (OP1_HAS_RANGE()) {
1375
1.33k
          tmp->min = OP1_MIN_RANGE();
1376
1.33k
          tmp->max = OP1_MAX_RANGE();
1377
1.33k
          tmp->underflow = OP1_RANGE_UNDERFLOW();
1378
1.33k
          tmp->overflow = OP1_RANGE_OVERFLOW();
1379
1.33k
          if (tmp->min > ZEND_LONG_MIN) {
1380
94
            tmp->min--;
1381
1.24k
          } else {
1382
1.24k
            tmp->underflow = 1;
1383
1.24k
          }
1384
1.33k
          if (tmp->max > ZEND_LONG_MIN && !tmp->overflow) {
1385
260
            tmp->max--;
1386
260
          }
1387
1.33k
          return 1;
1388
1.33k
        }
1389
1.54k
      }
1390
213
      break;
1391
5.20k
    case ZEND_POST_INC:
1392
5.20k
      if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1393
5.20k
        if (OP1_HAS_RANGE()) {
1394
5.03k
          tmp->min = OP1_MIN_RANGE();
1395
5.03k
          tmp->max = OP1_MAX_RANGE();
1396
5.03k
          tmp->underflow = OP1_RANGE_UNDERFLOW();
1397
5.03k
          tmp->overflow = OP1_RANGE_OVERFLOW();
1398
5.03k
          if (ssa_op->result_def == var) {
1399
1.34k
            return 1;
1400
1.34k
          }
1401
3.68k
          if (tmp->max < ZEND_LONG_MAX) {
1402
2.75k
            tmp->max++;
1403
2.75k
          } else {
1404
936
            tmp->overflow = 1;
1405
936
          }
1406
3.68k
          if (tmp->min < ZEND_LONG_MAX && !tmp->underflow) {
1407
3.37k
            tmp->min++;
1408
3.37k
          }
1409
3.68k
          return 1;
1410
5.03k
        }
1411
5.20k
      }
1412
170
      break;
1413
6.18k
    case ZEND_POST_DEC:
1414
6.18k
      if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1415
6.18k
        if (OP1_HAS_RANGE()) {
1416
5.15k
          tmp->min = OP1_MIN_RANGE();
1417
5.15k
          tmp->max = OP1_MAX_RANGE();
1418
5.15k
          tmp->underflow = OP1_RANGE_UNDERFLOW();
1419
5.15k
          tmp->overflow = OP1_RANGE_OVERFLOW();
1420
5.15k
          if (ssa_op->result_def == var) {
1421
2.37k
            return 1;
1422
2.37k
          }
1423
2.77k
          if (tmp->min > ZEND_LONG_MIN) {
1424
56
            tmp->min--;
1425
2.72k
          } else {
1426
2.72k
            tmp->underflow = 1;
1427
2.72k
          }
1428
2.77k
          if (tmp->max > ZEND_LONG_MIN && !tmp->overflow) {
1429
374
            tmp->max--;
1430
374
          }
1431
2.77k
          return 1;
1432
5.15k
        }
1433
6.18k
      }
1434
1.03k
      break;
1435
1.81k
    case ZEND_UNSET_DIM:
1436
1.87k
    case ZEND_UNSET_OBJ:
1437
1.87k
      if (ssa_op->op1_def == var) {
1438
        /* If op1 is scalar, UNSET_DIM and UNSET_OBJ have no effect, so we can keep
1439
         * the previous ranges. */
1440
1.87k
        if (OP1_HAS_RANGE()) {
1441
1.49k
          tmp->min = OP1_MIN_RANGE();
1442
1.49k
          tmp->max = OP1_MAX_RANGE();
1443
1.49k
          tmp->underflow = OP1_RANGE_UNDERFLOW();
1444
1.49k
          tmp->overflow  = OP1_RANGE_OVERFLOW();
1445
1.49k
          return 1;
1446
1.49k
        }
1447
1.87k
      }
1448
372
      break;
1449
53.3k
    case ZEND_ASSIGN:
1450
53.3k
      if (ssa_op->op1_def == var || ssa_op->op2_def == var || ssa_op->result_def == var) {
1451
53.3k
        if (OP2_HAS_RANGE()) {
1452
44.8k
          tmp->min = OP2_MIN_RANGE();
1453
44.8k
          tmp->max = OP2_MAX_RANGE();
1454
44.8k
          tmp->underflow = OP2_RANGE_UNDERFLOW();
1455
44.8k
          tmp->overflow  = OP2_RANGE_OVERFLOW();
1456
44.8k
          return 1;
1457
44.8k
        }
1458
53.3k
      }
1459
8.46k
      break;
1460
35.2k
    case ZEND_ASSIGN_DIM:
1461
39.6k
    case ZEND_ASSIGN_OBJ:
1462
39.9k
    case ZEND_ASSIGN_STATIC_PROP:
1463
41.6k
    case ZEND_ASSIGN_DIM_OP:
1464
42.5k
    case ZEND_ASSIGN_OBJ_OP:
1465
42.5k
    case ZEND_ASSIGN_STATIC_PROP_OP:
1466
42.5k
      if ((ssa_op+1)->op1_def == var) {
1467
0
        opline++;
1468
0
        ssa_op++;
1469
0
        if (OP1_HAS_RANGE()) {
1470
0
          tmp->min = OP1_MIN_RANGE();
1471
0
          tmp->max = OP1_MAX_RANGE();
1472
0
          tmp->underflow = OP1_RANGE_UNDERFLOW();
1473
0
          tmp->overflow  = OP1_RANGE_OVERFLOW();
1474
0
        }
1475
0
        return 1;
1476
0
      }
1477
42.5k
      break;
1478
42.5k
    case ZEND_ASSIGN_OP:
1479
24.0k
      if (opline->extended_value != ZEND_CONCAT
1480
24.0k
       && opline->extended_value != ZEND_POW) {
1481
18.5k
        if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1482
18.5k
          return zend_inference_calc_binary_op_range(
1483
18.5k
            op_array, ssa, opline, ssa_op,
1484
18.5k
            opline->extended_value, tmp);
1485
18.5k
        }
1486
18.5k
      }
1487
5.58k
      break;
1488
5.58k
    case ZEND_OP_DATA:
1489
0
      if (ssa_op->op1_def == var) {
1490
0
        if ((opline-1)->opcode == ZEND_ASSIGN_DIM ||
1491
0
            (opline-1)->opcode == ZEND_ASSIGN_OBJ ||
1492
0
            (opline-1)->opcode == ZEND_ASSIGN_STATIC_PROP ||
1493
0
            (opline-1)->opcode == ZEND_ASSIGN_DIM_OP ||
1494
0
            (opline-1)->opcode == ZEND_ASSIGN_OBJ_OP ||
1495
0
            (opline-1)->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
1496
0
          if (OP1_HAS_RANGE()) {
1497
0
            tmp->min = OP1_MIN_RANGE();
1498
0
            tmp->max = OP1_MAX_RANGE();
1499
0
            tmp->underflow = OP1_RANGE_UNDERFLOW();
1500
0
            tmp->overflow  = OP1_RANGE_OVERFLOW();
1501
0
            return 1;
1502
0
          }
1503
0
        }
1504
0
        break;
1505
0
      }
1506
0
      break;
1507
11.7k
    case ZEND_RECV:
1508
13.0k
    case ZEND_RECV_INIT:
1509
13.0k
      if (ssa_op->result_def == var) {
1510
13.0k
        if (op_array->arg_info &&
1511
13.0k
            opline->op1.num <= op_array->num_args) {
1512
13.0k
          zend_type type = op_array->arg_info[opline->op1.num-1].type;
1513
13.0k
          uint32_t mask = ZEND_TYPE_PURE_MASK_WITHOUT_NULL(type);
1514
13.0k
          if (mask == MAY_BE_LONG) {
1515
1.10k
            tmp->underflow = 0;
1516
1.10k
            tmp->min = ZEND_LONG_MIN;
1517
1.10k
            tmp->max = ZEND_LONG_MAX;
1518
1.10k
            tmp->overflow = 0;
1519
1.10k
            return 1;
1520
1.10k
          }
1521
13.0k
        }
1522
13.0k
      }
1523
11.9k
      break;
1524
11.9k
    case ZEND_STRLEN:
1525
301
      if (ssa_op->result_def == var) {
1526
#if SIZEOF_ZEND_LONG == 4
1527
        /* The length of a string is a non-negative integer. However, on 32-bit
1528
         * platforms overflows into negative lengths may occur, so it's better
1529
         * to not assume any particular range. */
1530
        tmp->min = ZEND_LONG_MIN;
1531
#else
1532
301
        tmp->min = 0;
1533
301
#endif
1534
301
        tmp->max = ZEND_LONG_MAX;
1535
301
        return 1;
1536
301
      }
1537
0
      break;
1538
44
    case ZEND_FUNC_NUM_ARGS:
1539
44
      tmp->min = 0;
1540
44
      tmp->max = ZEND_LONG_MAX;
1541
44
      return 1;
1542
454
    case ZEND_COUNT:
1543
      /* count() on Countable objects may return negative numbers */
1544
454
      tmp->min = ZEND_LONG_MIN;
1545
454
      tmp->max = ZEND_LONG_MAX;
1546
454
      return 1;
1547
38.4k
    case ZEND_DO_FCALL:
1548
38.4k
    case ZEND_DO_ICALL:
1549
41.7k
    case ZEND_DO_UCALL:
1550
41.7k
    case ZEND_DO_FCALL_BY_NAME:
1551
41.7k
      if (ssa_op->result_def == var) {
1552
41.7k
        const zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
1553
41.7k
        const zend_call_info *call_info;
1554
41.7k
        if (!func_info || !func_info->call_map) {
1555
9.11k
          break;
1556
9.11k
        }
1557
1558
32.6k
        call_info = func_info->call_map[opline - op_array->opcodes];
1559
32.6k
        if (!call_info || call_info->is_prototype) {
1560
11.8k
          break;
1561
11.8k
        }
1562
20.8k
        if (call_info->callee_func->type == ZEND_USER_FUNCTION) {
1563
6.65k
          func_info = ZEND_FUNC_INFO(&call_info->callee_func->op_array);
1564
6.65k
          if (func_info && func_info->return_info.has_range) {
1565
276
            *tmp = func_info->return_info.range;
1566
276
            return 1;
1567
276
          }
1568
6.65k
        }
1569
//TODO: we can't use type inference for internal functions at this point ???
1570
#if 0
1571
          uint32_t type;
1572
1573
          type = zend_get_func_info(call_info, ssa);
1574
          if (!(type & (MAY_BE_ANY - (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG)))) {
1575
            tmp->underflow = 0;
1576
            tmp->min = 0;
1577
            tmp->max = 0;
1578
            tmp->overflow = 0;
1579
            if (type & MAY_BE_LONG) {
1580
              tmp->min = ZEND_LONG_MIN;
1581
              tmp->max = ZEND_LONG_MAX;
1582
            } else if (type & MAY_BE_TRUE) {
1583
              if (!(type & (MAY_BE_NULL|MAY_BE_FALSE))) {
1584
                tmp->min = 1;
1585
              }
1586
              tmp->max = 1;
1587
            }
1588
            return 1;
1589
          }
1590
#endif
1591
20.8k
      }
1592
20.5k
      break;
1593
    // FIXME: support for more opcodes
1594
1.01M
    default:
1595
1.01M
      break;
1596
1.29M
  }
1597
1.13M
  return 0;
1598
1.29M
}
1599
1600
static void zend_inference_init_range(const zend_op_array *op_array, zend_ssa *ssa, int var, bool underflow, zend_long min, zend_long max, bool overflow)
1601
839k
{
1602
839k
  if (underflow) {
1603
818k
    min = ZEND_LONG_MIN;
1604
818k
  }
1605
839k
  if (overflow) {
1606
818k
    max = ZEND_LONG_MAX;
1607
818k
  }
1608
839k
  ssa->var_info[var].has_range = 1;
1609
839k
  ssa->var_info[var].range.underflow = underflow;
1610
839k
  ssa->var_info[var].range.min = min;
1611
839k
  ssa->var_info[var].range.max = max;
1612
839k
  ssa->var_info[var].range.overflow = overflow;
1613
839k
  LOG_SSA_RANGE("  change range (init      SCC %2d) %2d [%s%ld..%ld%s]\n", ssa->vars[var].scc, var, (underflow?"-- ":""), min, max, (overflow?" ++":""));
1614
839k
}
1615
1616
static bool zend_inference_widening_meet(zend_ssa_var_info *var_info, zend_ssa_range *r)
1617
38.0k
{
1618
38.0k
  if (!var_info->has_range) {
1619
55
    var_info->has_range = 1;
1620
38.0k
  } else {
1621
38.0k
    if (r->underflow ||
1622
38.0k
        var_info->range.underflow ||
1623
38.0k
        r->min < var_info->range.min) {
1624
29.0k
      r->underflow = 1;
1625
29.0k
      r->min = ZEND_LONG_MIN;
1626
29.0k
    }
1627
38.0k
    if (r->overflow ||
1628
38.0k
        var_info->range.overflow ||
1629
38.0k
        r->max > var_info->range.max) {
1630
31.4k
      r->overflow = 1;
1631
31.4k
      r->max = ZEND_LONG_MAX;
1632
31.4k
    }
1633
38.0k
    if (var_info->range.min == r->min &&
1634
38.0k
        var_info->range.max == r->max &&
1635
38.0k
        var_info->range.underflow == r->underflow &&
1636
38.0k
        var_info->range.overflow == r->overflow) {
1637
34.7k
      return 0;
1638
34.7k
    }
1639
38.0k
  }
1640
3.31k
  var_info->range = *r;
1641
3.31k
  return 1;
1642
38.0k
}
1643
1644
static bool zend_ssa_range_widening(const zend_op_array *op_array, zend_ssa *ssa, int var, int scc)
1645
139k
{
1646
139k
  zend_ssa_range tmp;
1647
1648
139k
  if (zend_inference_calc_range(op_array, ssa, var, 1, 0, &tmp)) {
1649
38.0k
    if (zend_inference_widening_meet(&ssa->var_info[var], &tmp)) {
1650
3.31k
      LOG_SSA_RANGE("  change range (widening  SCC %2d) %2d [%s%ld..%ld%s]\n", scc, var, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":""));
1651
3.31k
      return 1;
1652
3.31k
    }
1653
38.0k
  }
1654
136k
  return 0;
1655
139k
}
1656
1657
static bool zend_inference_narrowing_meet(zend_ssa_var_info *var_info, zend_ssa_range *r)
1658
248k
{
1659
248k
  if (!var_info->has_range) {
1660
63.9k
    var_info->has_range = 1;
1661
184k
  } else {
1662
184k
    if (!r->underflow &&
1663
184k
        !var_info->range.underflow &&
1664
184k
        var_info->range.min < r->min) {
1665
62
      r->min = var_info->range.min;
1666
62
    }
1667
184k
    if (!r->overflow &&
1668
184k
        !var_info->range.overflow &&
1669
184k
        var_info->range.max > r->max) {
1670
26
      r->max = var_info->range.max;
1671
26
    }
1672
184k
    if (r->underflow) {
1673
103k
      r->min = ZEND_LONG_MIN;
1674
103k
    }
1675
184k
    if (r->overflow) {
1676
106k
      r->max = ZEND_LONG_MAX;
1677
106k
    }
1678
184k
    if (var_info->range.min == r->min &&
1679
184k
        var_info->range.max == r->max &&
1680
184k
        var_info->range.underflow == r->underflow &&
1681
184k
        var_info->range.overflow == r->overflow) {
1682
137k
      return 0;
1683
137k
    }
1684
184k
  }
1685
111k
  var_info->range = *r;
1686
111k
  return 1;
1687
248k
}
1688
1689
static bool zend_ssa_range_narrowing(const zend_op_array *op_array, zend_ssa *ssa, int var, int scc)
1690
137k
{
1691
137k
  zend_ssa_range tmp;
1692
1693
137k
  if (zend_inference_calc_range(op_array, ssa, var, 0, 1, &tmp)) {
1694
85.4k
    if (zend_inference_narrowing_meet(&ssa->var_info[var], &tmp)) {
1695
45.5k
      LOG_SSA_RANGE("  change range (narrowing SCC %2d) %2d [%s%ld..%ld%s]\n", scc, var, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":""));
1696
45.5k
      return 1;
1697
45.5k
    }
1698
85.4k
  }
1699
92.3k
  return 0;
1700
137k
}
1701
1702
#ifdef NEG_RANGE
1703
# define CHECK_INNER_CYCLE(var2) \
1704
  do { \
1705
    if (ssa->vars[var2].scc == ssa->vars[var].scc && \
1706
        !ssa->vars[var2].scc_entry && \
1707
        !zend_bitset_in(visited, var2) && \
1708
      zend_check_inner_cycles(op_array, ssa, worklist, visited, var2)) { \
1709
      return 1; \
1710
    } \
1711
  } while (0)
1712
1713
static bool zend_check_inner_cycles(const zend_op_array *op_array, zend_ssa *ssa, zend_bitset worklist, zend_bitset visited, int var)
1714
{
1715
  if (zend_bitset_in(worklist, var)) {
1716
    return 1;
1717
  }
1718
  zend_bitset_incl(worklist, var);
1719
  FOR_EACH_VAR_USAGE(var, CHECK_INNER_CYCLE);
1720
  zend_bitset_incl(visited, var);
1721
  return 0;
1722
}
1723
#endif
1724
1725
static void zend_infer_ranges_warmup(const zend_op_array *op_array, zend_ssa *ssa, const int *scc_var, const int *next_scc_var, int scc)
1726
14.7k
{
1727
14.7k
  int worklist_len = zend_bitset_len(ssa->vars_count);
1728
14.7k
  int j, n;
1729
14.7k
  zend_ssa_range tmp;
1730
14.7k
  ALLOCA_FLAG(use_heap)
1731
14.7k
  zend_bitset worklist = do_alloca(sizeof(zend_ulong) * worklist_len * 2, use_heap);
1732
14.7k
  zend_bitset visited = worklist + worklist_len;
1733
#ifdef NEG_RANGE
1734
  int has_inner_cycles = 0;
1735
1736
  memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
1737
  memset(visited, 0, sizeof(zend_ulong) * worklist_len);
1738
  j = scc_var[scc];
1739
  while (j >= 0) {
1740
    if (!zend_bitset_in(visited, j) &&
1741
        zend_check_inner_cycles(op_array, ssa, worklist, visited, j)) {
1742
      has_inner_cycles = 1;
1743
      break;
1744
    }
1745
    j = next_scc_var[j];
1746
  }
1747
#endif
1748
1749
14.7k
  memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
1750
1751
251k
  for (n = 0; n < RANGE_WARMUP_PASSES; n++) {
1752
236k
    j= scc_var[scc];
1753
2.28M
    while (j >= 0) {
1754
2.04M
      if (ssa->vars[j].scc_entry
1755
2.04M
       && !(ssa->var_info[j].type & MAY_BE_REF)) {
1756
467k
        zend_bitset_incl(worklist, j);
1757
467k
      }
1758
2.04M
      j = next_scc_var[j];
1759
2.04M
    }
1760
1761
236k
    memset(visited, 0, sizeof(zend_ulong) * worklist_len);
1762
1763
7.08M
    WHILE_WORKLIST(worklist, worklist_len, j) {
1764
7.08M
      if (zend_inference_calc_range(op_array, ssa, j, 0, 0, &tmp)) {
1765
#ifdef NEG_RANGE
1766
        if (!has_inner_cycles &&
1767
            ssa->var_info[j].has_range &&
1768
            ssa->vars[j].definition_phi &&
1769
            ssa->vars[j].definition_phi->pi >= 0 &&
1770
          ssa->vars[j].definition_phi->has_range_constraint &&
1771
            ssa->vars[j].definition_phi->constraint.range.negative &&
1772
            ssa->vars[j].definition_phi->constraint.range.min_ssa_var < 0 &&
1773
            ssa->vars[j].definition_phi->constraint.range.max_ssa_var < 0) {
1774
          zend_ssa_range_constraint *constraint =
1775
            &ssa->vars[j].definition_phi->constraint.range;
1776
          if (tmp.min == ssa->var_info[j].range.min &&
1777
              tmp.max == ssa->var_info[j].range.max) {
1778
            if (constraint->negative == NEG_INIT) {
1779
              LOG_NEG_RANGE("#%d INVARIANT\n", j);
1780
              constraint->negative = NEG_INVARIANT;
1781
            }
1782
          } else if (tmp.min == ssa->var_info[j].range.min &&
1783
                     tmp.max == ssa->var_info[j].range.max + 1 &&
1784
                     tmp.max < constraint->range.min) {
1785
            if (constraint->negative == NEG_INIT ||
1786
                constraint->negative == NEG_INVARIANT) {
1787
              LOG_NEG_RANGE("#%d LT\n", j);
1788
              constraint->negative = NEG_USE_LT;
1789
//???NEG
1790
            } else if (constraint->negative == NEG_USE_GT) {
1791
              LOG_NEG_RANGE("#%d UNKNOWN\n", j);
1792
              constraint->negative = NEG_UNKNOWN;
1793
            }
1794
          } else if (tmp.max == ssa->var_info[j].range.max &&
1795
                       tmp.min == ssa->var_info[j].range.min - 1 &&
1796
                     tmp.min > constraint->range.max) {
1797
            if (constraint->negative == NEG_INIT ||
1798
                constraint->negative == NEG_INVARIANT) {
1799
              LOG_NEG_RANGE("#%d GT\n", j);
1800
              constraint->negative = NEG_USE_GT;
1801
//???NEG
1802
            } else if (constraint->negative == NEG_USE_LT) {
1803
              LOG_NEG_RANGE("#%d UNKNOWN\n", j);
1804
              constraint->negative = NEG_UNKNOWN;
1805
            }
1806
          } else {
1807
            LOG_NEG_RANGE("#%d UNKNOWN\n", j);
1808
            constraint->negative = NEG_UNKNOWN;
1809
          }
1810
        }
1811
#endif
1812
163k
        if (zend_inference_narrowing_meet(&ssa->var_info[j], &tmp)) {
1813
66.1k
          LOG_SSA_RANGE("  change range (warmup %2d SCC %2d) %2d [%s%ld..%ld%s]\n", n, scc, j, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":""));
1814
66.1k
          zend_bitset_incl(visited, j);
1815
112k
          FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR_1);
1816
66.1k
        }
1817
163k
      }
1818
7.08M
    } WHILE_WORKLIST_END();
1819
236k
  }
1820
14.7k
  free_alloca(worklist, use_heap);
1821
14.7k
}
1822
1823
static void zend_infer_ranges(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
1824
74.1k
{
1825
74.1k
  int worklist_len = zend_bitset_len(ssa->vars_count);
1826
74.1k
  zend_bitset worklist;
1827
74.1k
  int *next_scc_var;
1828
74.1k
  int *scc_var;
1829
74.1k
  zend_ssa_phi *p;
1830
74.1k
  zend_ssa_range tmp;
1831
74.1k
  int scc, j;
1832
74.1k
  ALLOCA_FLAG(use_heap);
1833
1834
74.1k
  worklist = do_alloca(
1835
74.1k
    ZEND_MM_ALIGNED_SIZE(sizeof(zend_ulong) * worklist_len) +
1836
74.1k
    ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->vars_count) +
1837
74.1k
    sizeof(int) * ssa->sccs, use_heap);
1838
74.1k
  next_scc_var = (int*)((char*)worklist + ZEND_MM_ALIGNED_SIZE(sizeof(zend_ulong) * worklist_len));
1839
74.1k
  scc_var = (int*)((char*)next_scc_var + ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->vars_count));
1840
1841
74.1k
  LOG_SSA_RANGE("Range Inference\n");
1842
1843
  /* Create linked lists of SSA variables for each SCC */
1844
74.1k
  memset(scc_var, -1, sizeof(int) * ssa->sccs);
1845
1.20M
  for (j = 0; j < ssa->vars_count; j++) {
1846
1.12M
    if (ssa->vars[j].scc >= 0) {
1847
1.05M
      next_scc_var[j] = scc_var[ssa->vars[j].scc];
1848
1.05M
      scc_var[ssa->vars[j].scc] = j;
1849
1.05M
    }
1850
1.12M
  }
1851
1852
1.02M
  for (scc = 0; scc < ssa->sccs; scc++) {
1853
946k
    j = scc_var[scc];
1854
946k
    if (next_scc_var[j] < 0) {
1855
      /* SCC with a single element */
1856
931k
      if (ssa->var_info[j].type & MAY_BE_REF) {
1857
        /* pass */
1858
780k
      } else if (zend_inference_calc_range(op_array, ssa, j, 0, 1, &tmp)) {
1859
130k
        zend_inference_init_range(op_array, ssa, j, tmp.underflow, tmp.min, tmp.max, tmp.overflow);
1860
650k
      } else {
1861
650k
        zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1);
1862
650k
      }
1863
931k
    } else {
1864
      /* Find SCC entry points */
1865
14.7k
      memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
1866
128k
      do {
1867
128k
        if (ssa->vars[j].scc_entry
1868
128k
         && !(ssa->var_info[j].type & MAY_BE_REF)) {
1869
29.2k
          zend_bitset_incl(worklist, j);
1870
29.2k
        }
1871
128k
        j = next_scc_var[j];
1872
128k
      } while (j >= 0);
1873
1874
14.7k
#if RANGE_WARMUP_PASSES > 0
1875
14.7k
      zend_infer_ranges_warmup(op_array, ssa, scc_var, next_scc_var, scc);
1876
14.7k
      j = scc_var[scc];
1877
128k
      do {
1878
128k
        if (!(ssa->var_info[j].type & MAY_BE_REF)) {
1879
81.4k
          zend_bitset_incl(worklist, j);
1880
81.4k
        }
1881
128k
        j = next_scc_var[j];
1882
128k
      } while (j >= 0);
1883
14.7k
#endif
1884
1885
      /* widening */
1886
543k
      WHILE_WORKLIST(worklist, worklist_len, j) {
1887
543k
        if (zend_ssa_range_widening(op_array, ssa, j, scc)) {
1888
5.31k
          FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1889
2.94k
        }
1890
543k
      } WHILE_WORKLIST_END();
1891
1892
      /* initialize missing ranges */
1893
142k
      for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
1894
128k
        if (!ssa->var_info[j].has_range
1895
128k
         && !(ssa->var_info[j].type & MAY_BE_REF)) {
1896
58.6k
          zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1);
1897
70.4k
          FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1898
58.6k
        }
1899
128k
      }
1900
1901
      /* widening (second round) */
1902
324k
      WHILE_WORKLIST(worklist, worklist_len, j) {
1903
324k
        if (zend_ssa_range_widening(op_array, ssa, j, scc)) {
1904
727
          FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1905
365
        }
1906
324k
      } WHILE_WORKLIST_END();
1907
1908
      /* Add all SCC entry variables into worklist for narrowing */
1909
142k
      for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
1910
128k
        if (ssa->vars[j].definition_phi
1911
128k
         && ssa->vars[j].definition_phi->pi < 0
1912
128k
         && !(ssa->var_info[j].type & MAY_BE_REF)) {
1913
          /* narrowing Phi functions first */
1914
8.98k
          zend_ssa_range_narrowing(op_array, ssa, j, scc);
1915
8.98k
        }
1916
128k
        zend_bitset_incl(worklist, j);
1917
128k
      }
1918
1919
      /* narrowing */
1920
954k
      WHILE_WORKLIST(worklist, worklist_len, j) {
1921
954k
        if (zend_ssa_range_narrowing(op_array, ssa, j, scc)) {
1922
106k
          FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1923
45.5k
#ifdef SYM_RANGE
1924
          /* Process symbolic control-flow constraints */
1925
45.5k
          p = ssa->vars[j].sym_use_chain;
1926
46.1k
          while (p) {
1927
624
            ADD_SCC_VAR(p->ssa_var);
1928
624
            p = p->sym_use_chain;
1929
624
          }
1930
45.5k
#endif
1931
45.5k
        }
1932
954k
      } WHILE_WORKLIST_END();
1933
14.7k
    }
1934
946k
  }
1935
1936
74.1k
  free_alloca(worklist, use_heap);
1937
74.1k
}
1938
/* }}} */
1939
1940
0
static uint32_t get_ssa_alias_types(zend_ssa_alias_kind alias) {
1941
0
  if (alias == HTTP_RESPONSE_HEADER_ALIAS) {
1942
0
    return MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_RC1 | MAY_BE_RCN;
1943
0
  } else {
1944
0
    return MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
1945
0
  }
1946
0
}
1947
1948
#define UPDATE_SSA_TYPE(_type, _var)                  \
1949
1.11M
  do {                               \
1950
1.11M
    uint32_t __type = (_type) & ~MAY_BE_GUARD;           \
1951
1.11M
    int __var = (_var);                       \
1952
1.11M
    if (__type & MAY_BE_REF) {                   \
1953
196k
      __type |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; \
1954
196k
    }                                \
1955
1.11M
    if (__var >= 0) {                       \
1956
1.11M
      zend_ssa_var *__ssa_var = &ssa_vars[__var];         \
1957
1.11M
      if (__ssa_var->var < op_array->num_args) {         \
1958
31.9k
        if (__type & MAY_BE_RC1) {                              \
1959
28.1k
          /* TODO: may be captured by exception backtreace */ \
1960
28.1k
          __type |= MAY_BE_RCN;                               \
1961
28.1k
        }                                                       \
1962
31.9k
      }                                                           \
1963
1.11M
      if (__ssa_var->var < op_array->last_var) {         \
1964
309k
        if (__type & (MAY_BE_REF|MAY_BE_RCN)) {         \
1965
236k
          __type |= MAY_BE_RC1 | MAY_BE_RCN;         \
1966
236k
        }                            \
1967
309k
        if ((__type & MAY_BE_RC1) && (__type & MAY_BE_STRING)) {\
1968
222k
          /* TODO: support for array keys and ($str . "")*/   \
1969
222k
          __type |= MAY_BE_RCN;                               \
1970
222k
        }                                                       \
1971
309k
        if ((__type & MAY_BE_RC1) && (__type & MAY_BE_OBJECT)) {\
1972
228k
          /* TODO: object may be captured by magic handlers */\
1973
228k
          __type |= MAY_BE_RCN;                               \
1974
228k
        }                                                       \
1975
309k
        if (__ssa_var->alias) {                 \
1976
0
          __type |= get_ssa_alias_types(__ssa_var->alias);  \
1977
0
        }                            \
1978
309k
      }                              \
1979
1.11M
      if (ssa_var_info[__var].type != __type) {           \
1980
926k
        ZEND_ASSERT(ssa_opcodes != NULL ||           \
1981
926k
          __ssa_var->var >= op_array->last_var ||       \
1982
926k
          (ssa_var_info[__var].type & MAY_BE_REF)       \
1983
926k
            == (__type & MAY_BE_REF));            \
1984
926k
        if (ssa_var_info[__var].type & ~__type) {       \
1985
0
          emit_type_narrowing_warning(op_array, ssa, __var);  \
1986
0
          return FAILURE;                   \
1987
0
        }                            \
1988
926k
        ssa_var_info[__var].type = __type;            \
1989
926k
        if (update_worklist) {                   \
1990
926k
          add_usages(op_array, ssa, worklist, __var);     \
1991
926k
        }                            \
1992
926k
      }                              \
1993
1.11M
      /*zend_bitset_excl(worklist, var);*/            \
1994
1.11M
    }                                \
1995
1.11M
  } while (0)
1996
1997
#define UPDATE_SSA_OBJ_TYPE(_ce, _is_instanceof, var)           \
1998
387k
  do {                                                                \
1999
387k
    if (var >= 0) {                         \
2000
387k
      zend_class_entry *__ce = (_ce);               \
2001
387k
      bool __is_instanceof = (_is_instanceof);          \
2002
387k
      if (__ce && (__ce->ce_flags & ZEND_ACC_FINAL)) {     \
2003
9.22k
        __is_instanceof = false;                \
2004
9.22k
      }                              \
2005
387k
      if (ssa_var_info[var].ce != __ce ||             \
2006
387k
          ssa_var_info[var].is_instanceof != __is_instanceof) { \
2007
36.9k
        ssa_var_info[var].ce = __ce;              \
2008
36.9k
        ssa_var_info[var].is_instanceof = __is_instanceof;    \
2009
36.9k
        if (update_worklist) {                   \
2010
36.9k
          add_usages(op_array, ssa, worklist, var);     \
2011
36.9k
        }                            \
2012
36.9k
      }                              \
2013
387k
      /*zend_bitset_excl(worklist, var);*/            \
2014
387k
    }                               \
2015
387k
  } while (0)
2016
2017
134k
#define COPY_SSA_OBJ_TYPE(from_var, to_var) do { \
2018
134k
  if ((from_var) >= 0 && (ssa_var_info[(from_var)].type & MAY_BE_OBJECT) \
2019
134k
      && ssa_var_info[(from_var)].ce && !(ssa_var_info[(to_var)].type & MAY_BE_REF)) { \
2020
4.29k
    UPDATE_SSA_OBJ_TYPE(ssa_var_info[(from_var)].ce, \
2021
4.29k
      ssa_var_info[(from_var)].is_instanceof, (to_var)); \
2022
130k
  } else { \
2023
130k
    UPDATE_SSA_OBJ_TYPE(NULL, 0, (to_var)); \
2024
130k
  } \
2025
134k
} while (0)
2026
2027
static void add_usages(const zend_op_array *op_array, zend_ssa *ssa, zend_bitset worklist, int var)
2028
963k
{
2029
963k
  if (ssa->vars[var].phi_use_chain) {
2030
187k
    zend_ssa_phi *p = ssa->vars[var].phi_use_chain;
2031
235k
    do {
2032
235k
      zend_bitset_incl(worklist, p->ssa_var);
2033
235k
      p = zend_ssa_next_use_phi(ssa, var, p);
2034
235k
    } while (p);
2035
187k
  }
2036
963k
  if (ssa->vars[var].use_chain >= 0) {
2037
831k
    int use = ssa->vars[var].use_chain;
2038
831k
    zend_ssa_op *op;
2039
2040
947k
    do {
2041
947k
      op = ssa->ops + use;
2042
947k
      if (op->result_def >= 0) {
2043
707k
        zend_bitset_incl(worklist, op->result_def);
2044
707k
      }
2045
947k
      if (op->op1_def >= 0) {
2046
102k
        zend_bitset_incl(worklist, op->op1_def);
2047
102k
      }
2048
947k
      if (op->op2_def >= 0) {
2049
8.28k
        zend_bitset_incl(worklist, op->op2_def);
2050
8.28k
      }
2051
947k
      if (op_array->opcodes[use].opcode == ZEND_OP_DATA) {
2052
9.99k
        op--;
2053
9.99k
        if (op->result_def >= 0) {
2054
2.33k
          zend_bitset_incl(worklist, op->result_def);
2055
2.33k
        }
2056
9.99k
        if (op->op1_def >= 0) {
2057
5.40k
          zend_bitset_incl(worklist, op->op1_def);
2058
5.40k
        }
2059
9.99k
        if (op->op2_def >= 0) {
2060
0
          zend_bitset_incl(worklist, op->op2_def);
2061
0
        }
2062
937k
      } else if (use + 1 < op_array->last
2063
937k
       && op_array->opcodes[use + 1].opcode == ZEND_OP_DATA) {
2064
10.4k
        op++;
2065
10.4k
        if (op->result_def >= 0) {
2066
0
          zend_bitset_incl(worklist, op->result_def);
2067
0
        }
2068
10.4k
        if (op->op1_def >= 0) {
2069
101
          zend_bitset_incl(worklist, op->op1_def);
2070
101
        }
2071
10.4k
        if (op->op2_def >= 0) {
2072
0
          zend_bitset_incl(worklist, op->op2_def);
2073
0
        }
2074
10.4k
      }
2075
947k
      use = zend_ssa_next_use(ssa->ops, var, use);
2076
947k
    } while (use >= 0);
2077
831k
  }
2078
963k
}
2079
2080
static void emit_type_narrowing_warning(const zend_op_array *op_array, zend_ssa *ssa, int var)
2081
0
{
2082
0
  int def_op_num = ssa->vars[var].definition;
2083
0
  const zend_op *def_opline = def_op_num >= 0 ? &op_array->opcodes[def_op_num] : NULL;
2084
0
  const char *def_op_name = def_opline ? zend_get_opcode_name(def_opline->opcode) : "PHI";
2085
0
  uint32_t lineno = def_opline ? def_opline->lineno : 0;
2086
0
  zend_error_at(
2087
0
    E_WARNING, op_array->filename, lineno,
2088
0
    "Narrowing occurred during type inference of %s. Please file a bug report on https://github.com/php/php-src/issues", def_op_name);
2089
0
#if ZEND_DEBUG
2090
0
  ZEND_ASSERT(0 && "Narrowing during type inference");
2091
0
#endif
2092
0
}
2093
2094
ZEND_API uint32_t ZEND_FASTCALL zend_array_type_info(const zval *zv)
2095
14.0k
{
2096
14.0k
  HashTable *ht = Z_ARRVAL_P(zv);
2097
14.0k
  uint32_t tmp = MAY_BE_ARRAY;
2098
14.0k
  zend_string *str;
2099
14.0k
  zval *val;
2100
2101
14.0k
  if (Z_REFCOUNTED_P(zv)) {
2102
10.3k
    tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2103
10.3k
  } else {
2104
3.76k
    tmp |= MAY_BE_RCN;
2105
3.76k
  }
2106
2107
14.0k
  if (zend_hash_num_elements(ht) == 0) {
2108
3.79k
    tmp |=  MAY_BE_ARRAY_EMPTY;
2109
10.2k
  } else if (HT_IS_PACKED(ht)) {
2110
8.02k
    tmp |= MAY_BE_ARRAY_PACKED;
2111
154k
    ZEND_HASH_PACKED_FOREACH_VAL(ht, val) {
2112
154k
      tmp |= 1 << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
2113
154k
    } ZEND_HASH_FOREACH_END();
2114
8.02k
  } else {
2115
17.2k
    ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(ht, str, val) {
2116
17.2k
      if (str) {
2117
3.73k
        tmp |= MAY_BE_ARRAY_STRING_HASH;
2118
3.73k
      } else {
2119
2.63k
        tmp |= MAY_BE_ARRAY_NUMERIC_HASH;
2120
2.63k
      }
2121
17.2k
      tmp |= 1 << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
2122
17.2k
    } ZEND_HASH_FOREACH_END();
2123
2.26k
  }
2124
14.0k
  return tmp;
2125
14.0k
}
2126
2127
2128
ZEND_API uint32_t zend_array_element_type(uint32_t t1, uint8_t op_type, int write, int insert)
2129
17.8k
{
2130
17.8k
  uint32_t tmp = 0;
2131
2132
17.8k
  if (t1 & MAY_BE_OBJECT) {
2133
13.7k
      if (!write) {
2134
      /* can't be REF  because of ZVAL_COPY_DEREF() usage */
2135
7.14k
      tmp |= MAY_BE_ANY | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2136
7.14k
    } else {
2137
6.61k
      tmp |= MAY_BE_ANY | MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2138
6.61k
      }
2139
13.7k
    if (write) {
2140
6.61k
      tmp |= MAY_BE_INDIRECT;
2141
6.61k
    }
2142
13.7k
  }
2143
17.8k
  if (t1 & MAY_BE_ARRAY) {
2144
16.1k
    if (insert) {
2145
425
      tmp |= MAY_BE_NULL;
2146
15.7k
    } else {
2147
15.7k
      tmp |= MAY_BE_NULL | ((t1 & MAY_BE_ARRAY_OF_ANY) >> MAY_BE_ARRAY_SHIFT);
2148
15.7k
      if (tmp & MAY_BE_ARRAY) {
2149
14.7k
        tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2150
14.7k
      }
2151
15.7k
      if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2152
14.9k
        if (!write) {
2153
          /* can't be REF  because of ZVAL_COPY_DEREF() usage */
2154
8.15k
          tmp |= MAY_BE_RCN;
2155
8.15k
          if ((op_type & (IS_VAR|IS_TMP_VAR)) && (t1 & MAY_BE_RC1)) {
2156
2.78k
            tmp |= MAY_BE_RC1;
2157
2.78k
          }
2158
8.15k
        } else if (t1 & MAY_BE_ARRAY_OF_REF) {
2159
6.11k
          tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN;
2160
6.11k
        } else {
2161
656
          tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2162
656
        }
2163
14.9k
      }
2164
15.7k
    }
2165
16.1k
    if (write) {
2166
7.38k
      tmp |= MAY_BE_INDIRECT;
2167
7.38k
    }
2168
16.1k
  }
2169
17.8k
  if (t1 & MAY_BE_STRING) {
2170
12.7k
    tmp |= MAY_BE_STRING | MAY_BE_RC1;
2171
12.7k
    if (write) {
2172
6.54k
      tmp |= MAY_BE_NULL;
2173
6.54k
    }
2174
12.7k
  }
2175
17.8k
  if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2176
15.5k
    tmp |= MAY_BE_NULL;
2177
15.5k
    if (write) {
2178
7.45k
      tmp |= MAY_BE_INDIRECT;
2179
7.45k
    }
2180
15.5k
  }
2181
17.8k
  if (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE)) {
2182
13.6k
    if (!write) {
2183
7.08k
      tmp |= MAY_BE_NULL;
2184
7.08k
    }
2185
13.6k
  }
2186
17.8k
  return tmp;
2187
17.8k
}
2188
2189
static uint32_t assign_dim_array_result_type(
2190
29.4k
    uint32_t arr_type, uint32_t dim_type, uint32_t value_type, uint8_t dim_op_type) {
2191
29.4k
  uint32_t tmp = 0;
2192
  /* Only add key type if we have a value type. We want to maintain the invariant that a
2193
   * key type exists iff a value type exists even in dead code that may use empty types. */
2194
29.4k
  if (value_type & (MAY_BE_ANY|MAY_BE_UNDEF)) {
2195
29.4k
    if (value_type & MAY_BE_UNDEF) {
2196
645
      value_type |= MAY_BE_NULL;
2197
645
    }
2198
29.4k
    if (dim_op_type == IS_UNUSED) {
2199
21.1k
      if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2200
1.12k
        tmp |= MAY_BE_ARRAY_PACKED;
2201
1.12k
      }
2202
21.1k
      tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
2203
21.1k
    } else {
2204
8.35k
      if (dim_type & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) {
2205
3.85k
        if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2206
2.39k
          tmp |= MAY_BE_ARRAY_PACKED;
2207
2.39k
        }
2208
3.85k
        tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
2209
3.85k
      }
2210
8.35k
      if (dim_type & MAY_BE_STRING) {
2211
3.93k
        tmp |= MAY_BE_ARRAY_KEY_STRING;
2212
3.93k
        if (dim_op_type != IS_CONST) {
2213
          // FIXME: numeric string
2214
2.34k
          if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2215
1.67k
            tmp |= MAY_BE_ARRAY_PACKED;
2216
1.67k
          }
2217
2.34k
          tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
2218
2.34k
        }
2219
3.93k
      }
2220
8.35k
      if (dim_type & (MAY_BE_UNDEF|MAY_BE_NULL)) {
2221
3.02k
        tmp |= MAY_BE_ARRAY_KEY_STRING;
2222
3.02k
      }
2223
8.35k
    }
2224
29.4k
  }
2225
  /* Only add value type if we have a key type. It might be that the key type is illegal
2226
   * for arrays. */
2227
29.4k
  if (tmp & MAY_BE_ARRAY_KEY_ANY) {
2228
29.4k
    tmp |= (value_type & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
2229
29.4k
  }
2230
29.4k
  tmp &= ~MAY_BE_ARRAY_EMPTY;
2231
29.4k
  return tmp;
2232
29.4k
}
2233
2234
static uint32_t assign_dim_result_type(
2235
8.40k
    uint32_t arr_type, uint32_t dim_type, uint32_t value_type, uint8_t dim_op_type) {
2236
8.40k
  uint32_t tmp = arr_type & ~(MAY_BE_RC1|MAY_BE_RCN);
2237
2238
8.40k
  if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2239
5.40k
    tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
2240
5.40k
    tmp |= MAY_BE_ARRAY|MAY_BE_RC1;
2241
5.40k
  }
2242
8.40k
  if (tmp & (MAY_BE_ARRAY|MAY_BE_STRING)) {
2243
8.21k
    tmp |= MAY_BE_RC1;
2244
8.21k
  }
2245
8.40k
  if (tmp & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2246
4.15k
    tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2247
4.15k
  }
2248
8.40k
  if (tmp & MAY_BE_ARRAY) {
2249
8.17k
    tmp |= assign_dim_array_result_type(arr_type, dim_type, value_type, dim_op_type);
2250
8.17k
  }
2251
8.40k
  return tmp;
2252
8.40k
}
2253
2254
/* For binary ops that have compound assignment operators */
2255
static uint32_t binary_op_result_type(
2256
    zend_ssa *ssa, uint8_t opcode, uint32_t t1, uint32_t t2, int result_var,
2257
51.9k
    zend_long optimization_level) {
2258
51.9k
  uint32_t tmp = 0;
2259
51.9k
  uint32_t t1_type = (t1 & MAY_BE_ANY) | (t1 & MAY_BE_UNDEF ? MAY_BE_NULL : 0);
2260
51.9k
  uint32_t t2_type = (t2 & MAY_BE_ANY) | (t2 & MAY_BE_UNDEF ? MAY_BE_NULL : 0);
2261
2262
51.9k
  if (!(ZEND_OPTIMIZER_IGNORE_OVERLOADING & optimization_level)) {
2263
    /* Handle potentially overloaded operators.
2264
     * This could be made more precise by checking the class type, if known. */
2265
51.9k
    if ((t1_type & MAY_BE_OBJECT) || (t2_type & MAY_BE_OBJECT)) {
2266
      /* This is somewhat GMP specific. */
2267
28.6k
      tmp |= MAY_BE_OBJECT | MAY_BE_FALSE | MAY_BE_RC1;
2268
28.6k
    }
2269
51.9k
  }
2270
2271
51.9k
  switch (opcode) {
2272
13.4k
    case ZEND_ADD:
2273
13.4k
      if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) {
2274
482
        if (result_var < 0 ||
2275
482
          !ssa->var_info[result_var].has_range ||
2276
482
            ssa->var_info[result_var].range.underflow ||
2277
482
            ssa->var_info[result_var].range.overflow) {
2278
          /* may overflow */
2279
298
          tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2280
298
        } else {
2281
184
          tmp |= MAY_BE_LONG;
2282
184
        }
2283
12.9k
      } else if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) {
2284
386
        tmp |= MAY_BE_DOUBLE;
2285
12.5k
      } else if (t1_type == MAY_BE_ARRAY && t2_type == MAY_BE_ARRAY) {
2286
158
        tmp |= MAY_BE_ARRAY | MAY_BE_RC1;
2287
158
        tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2288
158
        tmp |= t2 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2289
12.4k
      } else {
2290
12.4k
        tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2291
12.4k
        if ((t1_type & MAY_BE_ARRAY) && (t2_type & MAY_BE_ARRAY)) {
2292
1.52k
          tmp |= MAY_BE_ARRAY | MAY_BE_RC1;
2293
1.52k
          tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2294
1.52k
          tmp |= t2 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2295
1.52k
        }
2296
12.4k
      }
2297
13.4k
      break;
2298
3.87k
    case ZEND_SUB:
2299
10.8k
    case ZEND_MUL:
2300
10.8k
      if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) {
2301
822
        if (result_var < 0 ||
2302
822
          !ssa->var_info[result_var].has_range ||
2303
822
            ssa->var_info[result_var].range.underflow ||
2304
822
            ssa->var_info[result_var].range.overflow) {
2305
          /* may overflow */
2306
492
          tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2307
492
        } else {
2308
330
          tmp |= MAY_BE_LONG;
2309
330
        }
2310
10.0k
      } else if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) {
2311
156
        tmp |= MAY_BE_DOUBLE;
2312
9.89k
      } else {
2313
9.89k
        tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2314
9.89k
      }
2315
10.8k
      break;
2316
2.87k
    case ZEND_DIV:
2317
2.94k
    case ZEND_POW:
2318
2.94k
      if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) {
2319
44
        tmp |= MAY_BE_DOUBLE;
2320
2.89k
      } else {
2321
2.89k
        tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2322
2.89k
      }
2323
      /* Division by zero results in Inf/-Inf/Nan (double), so it doesn't need any special
2324
       * handling */
2325
2.94k
      break;
2326
3.34k
    case ZEND_MOD:
2327
3.34k
      tmp |= MAY_BE_LONG;
2328
      /* Division by zero results in an exception, so it doesn't need any special handling */
2329
3.34k
      break;
2330
645
    case ZEND_BW_OR:
2331
5.64k
    case ZEND_BW_AND:
2332
7.62k
    case ZEND_BW_XOR:
2333
7.62k
      if ((t1_type & MAY_BE_STRING) && (t2_type & MAY_BE_STRING)) {
2334
777
        tmp |= MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN;
2335
777
      }
2336
7.62k
      if ((t1_type & ~MAY_BE_STRING) || (t2_type & ~MAY_BE_STRING)) {
2337
7.44k
        tmp |= MAY_BE_LONG;
2338
7.44k
      }
2339
7.62k
      break;
2340
1.70k
    case ZEND_SL:
2341
2.28k
    case ZEND_SR:
2342
2.28k
      tmp |= MAY_BE_LONG;
2343
2.28k
      break;
2344
11.4k
    case ZEND_CONCAT:
2345
11.4k
    case ZEND_FAST_CONCAT:
2346
      /* TODO: +MAY_BE_OBJECT ??? */
2347
11.4k
      tmp = MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN;
2348
11.4k
      break;
2349
51.9k
    EMPTY_SWITCH_DEFAULT_CASE()
2350
51.9k
  }
2351
51.9k
  return tmp;
2352
51.9k
}
2353
2354
29.6k
static uint32_t zend_convert_type_declaration_mask(uint32_t type_mask) {
2355
29.6k
  uint32_t result_mask = type_mask & MAY_BE_ANY;
2356
29.6k
  if (type_mask & MAY_BE_VOID) {
2357
2.01k
    result_mask |= MAY_BE_NULL;
2358
2.01k
  }
2359
29.6k
  if (type_mask & MAY_BE_CALLABLE) {
2360
218
    result_mask |= MAY_BE_STRING|MAY_BE_OBJECT|MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
2361
218
  }
2362
29.6k
  if (type_mask & MAY_BE_STATIC) {
2363
134
    result_mask |= MAY_BE_OBJECT;
2364
134
  }
2365
29.6k
  if (type_mask & MAY_BE_ARRAY) {
2366
6.73k
    result_mask |= MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
2367
6.73k
  }
2368
29.6k
  return result_mask;
2369
29.6k
}
2370
2371
static uint32_t zend_convert_type(const zend_script *script, zend_type type, zend_class_entry **pce)
2372
50.4k
{
2373
50.4k
  if (pce) {
2374
50.4k
    *pce = NULL;
2375
50.4k
  }
2376
2377
50.4k
  if (!ZEND_TYPE_IS_SET(type)) {
2378
20.8k
    return MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_RC1|MAY_BE_RCN;
2379
20.8k
  }
2380
2381
29.6k
  uint32_t tmp = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(type));
2382
29.6k
  if (ZEND_TYPE_IS_COMPLEX(type)) {
2383
4.61k
    tmp |= MAY_BE_OBJECT;
2384
4.61k
    if (pce) {
2385
      /* As we only have space to store one CE,
2386
       * we use a plain object type for class unions. */
2387
4.61k
      if (ZEND_TYPE_HAS_NAME(type)) {
2388
3.61k
        zend_string *lcname = zend_string_tolower(ZEND_TYPE_NAME(type));
2389
        // TODO: Pass through op_array.
2390
3.61k
        *pce = zend_optimizer_get_class_entry(script, NULL, lcname);
2391
3.61k
        zend_string_release_ex(lcname, 0);
2392
3.61k
      }
2393
4.61k
    }
2394
4.61k
  }
2395
29.6k
  if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2396
20.6k
    tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2397
20.6k
  }
2398
29.6k
  return tmp;
2399
50.4k
}
2400
2401
ZEND_API uint32_t zend_fetch_arg_info_type(const zend_script *script, const zend_arg_info *arg_info, zend_class_entry **pce)
2402
45.5k
{
2403
45.5k
  return zend_convert_type(script, arg_info->type, pce);
2404
45.5k
}
2405
2406
5.67k
static const zend_property_info *lookup_prop_info(const zend_class_entry *ce, zend_string *name, zend_class_entry *scope) {
2407
5.67k
  const zend_property_info *prop_info;
2408
2409
  /* If the class is linked, reuse the precise runtime logic. */
2410
5.67k
  if ((ce->ce_flags & ZEND_ACC_LINKED)
2411
5.67k
   && (!scope || (scope->ce_flags & ZEND_ACC_LINKED))) {
2412
4.93k
    zend_class_entry *prev_scope = EG(fake_scope);
2413
4.93k
    EG(fake_scope) = scope;
2414
4.93k
    prop_info = zend_get_property_info(ce, name, 1);
2415
4.93k
    EG(fake_scope) = prev_scope;
2416
4.93k
    if (prop_info && prop_info != ZEND_WRONG_PROPERTY_INFO) {
2417
4.27k
      return prop_info;
2418
4.27k
    }
2419
663
    return NULL;
2420
4.93k
  }
2421
2422
  /* Otherwise, handle only some safe cases */
2423
737
  prop_info = zend_hash_find_ptr(&ce->properties_info, name);
2424
737
  if (prop_info &&
2425
737
    ((prop_info->ce == scope) ||
2426
605
     (!scope && (prop_info->flags & ZEND_ACC_PUBLIC)))
2427
737
  ) {
2428
597
    return prop_info;
2429
597
  }
2430
140
  return NULL;
2431
737
}
2432
2433
static const zend_property_info *zend_fetch_prop_info(const zend_op_array *op_array, zend_ssa *ssa, const zend_op *opline, const zend_ssa_op *ssa_op)
2434
71.6k
{
2435
71.6k
  const zend_property_info *prop_info = NULL;
2436
71.6k
  if (opline->op2_type == IS_CONST) {
2437
70.7k
    const zend_class_entry *ce = NULL;
2438
2439
70.7k
    if (opline->op1_type == IS_UNUSED && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
2440
3.23k
      ce = op_array->scope;
2441
67.5k
    } else if (ssa_op->op1_use >= 0) {
2442
67.5k
      ce = ssa->var_info[ssa_op->op1_use].ce;
2443
67.5k
    }
2444
70.7k
    if (ce) {
2445
3.74k
      prop_info = lookup_prop_info(ce,
2446
3.74k
        Z_STR_P(CRT_CONSTANT(opline->op2)),
2447
3.74k
        op_array->scope);
2448
3.74k
      if (prop_info && (prop_info->flags & ZEND_ACC_STATIC)) {
2449
28
        prop_info = NULL;
2450
28
      }
2451
3.74k
    }
2452
70.7k
  }
2453
71.6k
  return prop_info;
2454
71.6k
}
2455
2456
static const zend_property_info *zend_fetch_static_prop_info(const zend_script *script, const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline)
2457
2.33k
{
2458
2.33k
  const zend_property_info *prop_info = NULL;
2459
2.33k
  if (opline->op1_type == IS_CONST) {
2460
2.19k
    zend_class_entry *ce = NULL;
2461
2.19k
    if (opline->op2_type == IS_UNUSED) {
2462
718
      int fetch_type = opline->op2.num & ZEND_FETCH_CLASS_MASK;
2463
718
      switch (fetch_type) {
2464
608
        case ZEND_FETCH_CLASS_SELF:
2465
694
        case ZEND_FETCH_CLASS_STATIC:
2466
          /* We enforce that static property types cannot change during inheritance, so
2467
           * handling static the same way as self here is legal. */
2468
694
          ce = op_array->scope;
2469
694
          break;
2470
24
        case ZEND_FETCH_CLASS_PARENT:
2471
24
          if (op_array->scope && (op_array->scope->ce_flags & ZEND_ACC_LINKED)) {
2472
18
            ce = op_array->scope->parent;
2473
18
          }
2474
24
          break;
2475
718
      }
2476
1.47k
    } else if (opline->op2_type == IS_CONST) {
2477
1.32k
      zval *zv = CRT_CONSTANT(opline->op2);
2478
1.32k
      ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(zv + 1));
2479
1.32k
    }
2480
2481
2.19k
    if (ce) {
2482
1.93k
      zval *zv = CRT_CONSTANT(opline->op1);
2483
1.93k
      prop_info = lookup_prop_info(ce, Z_STR_P(zv), op_array->scope);
2484
1.93k
      if (prop_info && !(prop_info->flags & ZEND_ACC_STATIC)) {
2485
12
        prop_info = NULL;
2486
12
      }
2487
1.93k
    }
2488
2.19k
  }
2489
2.33k
  return prop_info;
2490
2.33k
}
2491
2492
static uint32_t zend_fetch_prop_type(const zend_script *script, const zend_property_info *prop_info, zend_class_entry **pce)
2493
74.0k
{
2494
74.0k
  if (!prop_info) {
2495
69.1k
    if (pce) {
2496
68.7k
      *pce = NULL;
2497
68.7k
    }
2498
69.1k
    return MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;
2499
69.1k
  }
2500
2501
4.84k
  return zend_convert_type(script, prop_info->type, pce);
2502
74.0k
}
2503
2504
static bool result_may_be_separated(zend_ssa *ssa, zend_ssa_op *ssa_op)
2505
3.88k
{
2506
3.88k
  int tmp_var = ssa_op->result_def;
2507
2508
3.88k
  if (ssa->vars[tmp_var].use_chain >= 0
2509
3.88k
   && !ssa->vars[tmp_var].phi_use_chain) {
2510
3.88k
    zend_ssa_op *use_op = &ssa->ops[ssa->vars[tmp_var].use_chain];
2511
2512
    /* TODO: analyze instructions between ssa_op and use_op */
2513
3.88k
    if (use_op == ssa_op + 1) {
2514
3.69k
      if ((use_op->op1_use == tmp_var && use_op->op1_use_chain < 0)
2515
3.69k
       || (use_op->op2_use == tmp_var && use_op->op2_use_chain < 0)) {
2516
3.69k
        return 0;
2517
3.69k
      }
2518
3.69k
    }
2519
3.88k
  }
2520
191
  return 1;
2521
3.88k
}
2522
2523
static zend_always_inline zend_result _zend_update_type_info(
2524
      const zend_op_array *op_array,
2525
      zend_ssa            *ssa,
2526
      const zend_script   *script,
2527
      zend_bitset          worklist,
2528
      const zend_op       *opline,
2529
      zend_ssa_op         *ssa_op,
2530
      const zend_op      **ssa_opcodes,
2531
      zend_long            optimization_level,
2532
      bool            update_worklist)
2533
863k
{
2534
863k
  uint32_t t1, t2;
2535
863k
  uint32_t tmp, orig;
2536
863k
  zend_ssa_var *ssa_vars = ssa->vars;
2537
863k
  zend_ssa_var_info *ssa_var_info = ssa->var_info;
2538
863k
  zend_class_entry *ce;
2539
863k
  int j;
2540
2541
863k
  if (opline->opcode == ZEND_OP_DATA) {
2542
249
    opline--;
2543
249
    ssa_op--;
2544
249
  }
2545
2546
863k
  t1 = OP1_INFO();
2547
863k
  t2 = OP2_INFO();
2548
2549
  /* If one of the operands cannot have any type, this means the operand derives from
2550
   * unreachable code. Propagate the empty result early, so that that the following
2551
   * code may assume that operands have at least one type. */
2552
863k
  if (!(t1 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
2553
863k
   || !(t2 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
2554
863k
   || (ssa_op->result_use >= 0 && !(RES_USE_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)))
2555
863k
   || ((opline->opcode == ZEND_ASSIGN_DIM_OP
2556
860k
     || opline->opcode == ZEND_ASSIGN_OBJ_OP
2557
860k
     || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP
2558
860k
     || opline->opcode == ZEND_ASSIGN_DIM
2559
860k
     || opline->opcode == ZEND_ASSIGN_OBJ)
2560
860k
      && !(OP1_DATA_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)) /*&& 0*/)) {
2561
3.77k
    tmp = 0;
2562
3.77k
    if (ssa_op->result_def >= 0 && !(ssa_var_info[ssa_op->result_def].type & MAY_BE_REF)) {
2563
3.06k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2564
3.06k
    }
2565
3.77k
    if (ssa_op->op1_def >= 0 && !(ssa_var_info[ssa_op->op1_def].type & MAY_BE_REF)) {
2566
1.45k
      UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2567
1.45k
    }
2568
3.77k
    if (ssa_op->op2_def >= 0 && !(ssa_var_info[ssa_op->op2_def].type & MAY_BE_REF)) {
2569
0
      UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
2570
0
    }
2571
3.77k
    if (opline->opcode == ZEND_ASSIGN_DIM_OP
2572
3.77k
     || opline->opcode == ZEND_ASSIGN_OBJ_OP
2573
3.77k
     || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP
2574
3.77k
     || opline->opcode == ZEND_ASSIGN_DIM
2575
3.77k
     || opline->opcode == ZEND_ASSIGN_OBJ) {
2576
655
      if ((ssa_op+1)->op1_def >= 0 && !(ssa_var_info[(ssa_op+1)->op1_def].type & MAY_BE_REF)) {
2577
0
        UPDATE_SSA_TYPE(tmp, (ssa_op+1)->op1_def);
2578
0
      }
2579
655
    }
2580
3.77k
    return SUCCESS;
2581
3.77k
  }
2582
2583
859k
  switch (opline->opcode) {
2584
10.7k
    case ZEND_ADD:
2585
14.1k
    case ZEND_SUB:
2586
19.6k
    case ZEND_MUL:
2587
22.3k
    case ZEND_DIV:
2588
22.3k
    case ZEND_POW:
2589
25.5k
    case ZEND_MOD:
2590
26.0k
    case ZEND_BW_OR:
2591
29.2k
    case ZEND_BW_AND:
2592
31.2k
    case ZEND_BW_XOR:
2593
32.8k
    case ZEND_SL:
2594
33.3k
    case ZEND_SR:
2595
41.7k
    case ZEND_CONCAT:
2596
41.7k
      tmp = binary_op_result_type(ssa, opline->opcode, t1, t2, ssa_op->result_def, optimization_level);
2597
41.7k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2598
41.7k
      break;
2599
41.7k
    case ZEND_BW_NOT:
2600
3.42k
      tmp = 0;
2601
3.42k
      if (t1 & MAY_BE_STRING) {
2602
1.17k
        tmp |= MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN;
2603
1.17k
      }
2604
3.42k
      if (t1 & (MAY_BE_ANY-MAY_BE_STRING)) {
2605
3.02k
        tmp |= MAY_BE_LONG;
2606
3.02k
      }
2607
3.42k
      if (!(ZEND_OPTIMIZER_IGNORE_OVERLOADING & optimization_level)) {
2608
3.42k
        if (t1 & MAY_BE_OBJECT) {
2609
          /* Potentially overloaded operator. */
2610
561
          tmp |= MAY_BE_OBJECT | MAY_BE_RC1;
2611
561
        }
2612
3.42k
      }
2613
3.42k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2614
3.42k
      break;
2615
3.42k
    case ZEND_BEGIN_SILENCE:
2616
2.54k
      UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def);
2617
2.54k
      break;
2618
2.54k
    case ZEND_BOOL_NOT:
2619
2.35k
    case ZEND_BOOL_XOR:
2620
3.77k
    case ZEND_IS_IDENTICAL:
2621
4.44k
    case ZEND_IS_NOT_IDENTICAL:
2622
7.23k
    case ZEND_IS_EQUAL:
2623
9.18k
    case ZEND_IS_NOT_EQUAL:
2624
16.2k
    case ZEND_IS_SMALLER:
2625
18.8k
    case ZEND_IS_SMALLER_OR_EQUAL:
2626
19.1k
    case ZEND_INSTANCEOF:
2627
19.4k
    case ZEND_JMPZ_EX:
2628
19.7k
    case ZEND_JMPNZ_EX:
2629
19.7k
    case ZEND_CASE:
2630
19.9k
    case ZEND_CASE_STRICT:
2631
20.8k
    case ZEND_BOOL:
2632
20.9k
    case ZEND_ISSET_ISEMPTY_CV:
2633
20.9k
    case ZEND_ISSET_ISEMPTY_VAR:
2634
22.8k
    case ZEND_ISSET_ISEMPTY_DIM_OBJ:
2635
23.4k
    case ZEND_ISSET_ISEMPTY_PROP_OBJ:
2636
23.5k
    case ZEND_ISSET_ISEMPTY_STATIC_PROP:
2637
23.6k
    case ZEND_ASSERT_CHECK:
2638
23.6k
    case ZEND_IN_ARRAY:
2639
23.6k
    case ZEND_ARRAY_KEY_EXISTS:
2640
23.6k
      UPDATE_SSA_TYPE(MAY_BE_FALSE|MAY_BE_TRUE, ssa_op->result_def);
2641
23.6k
      break;
2642
23.6k
    case ZEND_CAST:
2643
1.07k
      if (ssa_op->op1_def >= 0) {
2644
0
        tmp = t1;
2645
0
        if ((t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) &&
2646
0
            (opline->extended_value == IS_ARRAY ||
2647
0
             opline->extended_value == IS_OBJECT)) {
2648
0
          tmp |= MAY_BE_RCN;
2649
0
        } else if ((t1 & MAY_BE_STRING) &&
2650
0
            opline->extended_value == IS_STRING) {
2651
0
          tmp |= MAY_BE_RCN;
2652
0
        }
2653
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2654
0
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2655
0
      }
2656
1.07k
      tmp = 1 << opline->extended_value;
2657
1.07k
      if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2658
833
        if ((tmp & MAY_BE_ANY) == (t1 & MAY_BE_ANY)) {
2659
12
          tmp |= (t1 & MAY_BE_RC1) | MAY_BE_RCN;
2660
821
        } else if ((opline->extended_value == IS_ARRAY ||
2661
821
              opline->extended_value == IS_OBJECT) &&
2662
821
               (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT))) {
2663
361
            tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2664
460
        } else if (opline->extended_value == IS_STRING &&
2665
460
               (t1 & (MAY_BE_STRING|MAY_BE_OBJECT))) {
2666
282
          tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2667
282
        } else {
2668
178
          tmp |= MAY_BE_RC1;
2669
178
          if (opline->extended_value == IS_ARRAY
2670
178
           && (t1 & (MAY_BE_UNDEF|MAY_BE_NULL))) {
2671
12
            tmp |= MAY_BE_RCN;
2672
12
          }
2673
178
        }
2674
833
      }
2675
1.07k
      if (opline->extended_value == IS_ARRAY) {
2676
167
        if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL)) {
2677
105
          tmp |= MAY_BE_ARRAY_EMPTY;
2678
105
        }
2679
167
        if (t1 & MAY_BE_ARRAY) {
2680
95
          tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF);
2681
95
        }
2682
167
        if (t1 & MAY_BE_OBJECT) {
2683
149
          tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2684
149
        } else if (t1 & (MAY_BE_ANY - MAY_BE_NULL)) {
2685
16
          tmp |= ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) << MAY_BE_ARRAY_SHIFT) | ((t1 & MAY_BE_NULL) ? MAY_BE_ARRAY_KEY_LONG : MAY_BE_ARRAY_PACKED);
2686
16
        }
2687
167
      }
2688
1.07k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2689
1.07k
      break;
2690
6.43k
    case ZEND_QM_ASSIGN:
2691
7.48k
    case ZEND_JMP_SET:
2692
8.74k
    case ZEND_COALESCE:
2693
9.14k
    case ZEND_COPY_TMP:
2694
9.14k
      if (ssa_op->op1_def >= 0) {
2695
0
        tmp = t1;
2696
0
        if (t1 & (MAY_BE_RC1|MAY_BE_REF)) {
2697
0
          tmp |= MAY_BE_RCN;
2698
0
        }
2699
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2700
0
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2701
0
      }
2702
9.14k
      tmp = t1 & ~MAY_BE_UNDEF;
2703
9.14k
      if (opline->opcode != ZEND_COPY_TMP || opline->op1_type != IS_VAR) {
2704
8.89k
        tmp &= ~MAY_BE_REF;
2705
8.89k
      }
2706
9.14k
      if (t1 & MAY_BE_UNDEF) {
2707
1.43k
        tmp |= MAY_BE_NULL;
2708
1.43k
      }
2709
9.14k
      if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2710
3.97k
        tmp |= (t1 & (MAY_BE_RC1|MAY_BE_RCN));
2711
3.97k
        if (opline->opcode == ZEND_COPY_TMP || opline->op1_type == IS_CV) {
2712
861
          tmp |= MAY_BE_RCN;
2713
861
        }
2714
3.97k
      }
2715
9.14k
      if (opline->opcode == ZEND_COALESCE || opline->opcode == ZEND_JMP_SET) {
2716
        /* COALESCE and JMP_SET result can't be null */
2717
2.31k
        tmp &= ~MAY_BE_NULL;
2718
2.31k
        if (opline->opcode == ZEND_JMP_SET) {
2719
          /* JMP_SET result can't be false either */
2720
1.05k
          tmp &= ~MAY_BE_FALSE;
2721
1.05k
        }
2722
2.31k
      }
2723
9.14k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2724
9.14k
      COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def);
2725
9.14k
      break;
2726
45.5k
    case ZEND_JMP_NULL:
2727
45.5k
    {
2728
45.5k
      uint32_t short_circuiting_type = opline->extended_value & ZEND_SHORT_CIRCUITING_CHAIN_MASK;
2729
45.5k
      if (short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_EXPR) {
2730
45.4k
        tmp = MAY_BE_NULL;
2731
45.4k
      } else if (short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_ISSET) {
2732
48
        tmp = MAY_BE_FALSE;
2733
50
      } else {
2734
50
        ZEND_ASSERT(short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_EMPTY);
2735
50
        tmp = MAY_BE_TRUE;
2736
50
      }
2737
45.5k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2738
45.5k
      break;
2739
45.5k
    }
2740
45.5k
    case ZEND_ASSIGN_OP:
2741
9.72k
    case ZEND_ASSIGN_DIM_OP:
2742
10.1k
    case ZEND_ASSIGN_OBJ_OP:
2743
10.2k
    case ZEND_ASSIGN_STATIC_PROP_OP:
2744
10.2k
    {
2745
10.2k
      const zend_property_info *prop_info = NULL;
2746
10.2k
      orig = 0;
2747
10.2k
      tmp = 0;
2748
10.2k
      if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
2749
474
        prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op);
2750
474
        orig = t1;
2751
474
        t1 = zend_fetch_prop_type(script, prop_info, NULL);
2752
474
        t2 = OP1_DATA_INFO();
2753
9.73k
      } else if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
2754
1.43k
        if (t1 & MAY_BE_ARRAY_OF_REF) {
2755
1.21k
              tmp |= MAY_BE_REF;
2756
1.21k
        }
2757
1.43k
        orig = t1;
2758
1.43k
        t1 = zend_array_element_type(t1, opline->op1_type, 1, 0);
2759
1.43k
        t2 = OP1_DATA_INFO();
2760
8.29k
      } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
2761
10
        prop_info = zend_fetch_static_prop_info(script, op_array, ssa, opline);
2762
10
        t1 = zend_fetch_prop_type(script, prop_info, NULL);
2763
10
        t2 = OP1_DATA_INFO();
2764
8.28k
      } else {
2765
8.28k
        if (t1 & MAY_BE_REF) {
2766
2.13k
              tmp |= MAY_BE_REF;
2767
2.13k
        }
2768
8.28k
      }
2769
2770
10.2k
      tmp |= binary_op_result_type(
2771
10.2k
        ssa, opline->extended_value, t1, t2,
2772
10.2k
        opline->opcode == ZEND_ASSIGN_OP ? ssa_op->op1_def : -1, optimization_level);
2773
10.2k
      if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY)) {
2774
3.98k
        tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2775
3.98k
      }
2776
10.2k
      if (tmp & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2777
3.45k
        tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2778
3.45k
      }
2779
2780
10.2k
      if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
2781
1.43k
        if (opline->op1_type == IS_CV) {
2782
1.24k
          orig = assign_dim_result_type(orig, OP2_INFO(), tmp, opline->op2_type);
2783
1.24k
          UPDATE_SSA_TYPE(orig, ssa_op->op1_def);
2784
1.24k
          COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2785
1.24k
        }
2786
8.77k
      } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
2787
474
        if (opline->op1_type == IS_CV) {
2788
452
          orig = (orig & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN;
2789
452
          UPDATE_SSA_TYPE(orig, ssa_op->op1_def);
2790
452
          COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2791
452
        }
2792
8.29k
      } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
2793
        /* Nothing to do */
2794
8.28k
      } else {
2795
8.28k
        if (opline->opcode == ZEND_ASSIGN_OP && ssa_op->result_def >= 0 && (tmp & MAY_BE_RC1)) {
2796
3.26k
          tmp |= MAY_BE_RCN;
2797
3.26k
        }
2798
8.28k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2799
8.28k
      }
2800
10.2k
      if (ssa_op->result_def >= 0) {
2801
6.16k
        ce = NULL;
2802
6.16k
        if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
2803
829
          if (opline->op2_type == IS_UNUSED) {
2804
            /* When appending to an array and the LONG_MAX key is already used
2805
             * null will be returned. */
2806
20
            tmp |= MAY_BE_NULL;
2807
20
          }
2808
829
          if (t2 & (MAY_BE_ARRAY | MAY_BE_OBJECT)) {
2809
            /* Arrays and objects cannot be used as keys. */
2810
24
            tmp |= MAY_BE_NULL;
2811
24
          }
2812
829
          if (t1 & (MAY_BE_ANY - (MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING | MAY_BE_ARRAY))) {
2813
            /* null and false are implicitly converted to array, anything else
2814
             * results in a null return value. */
2815
773
            tmp |= MAY_BE_NULL;
2816
773
          }
2817
829
          if (tmp & MAY_BE_REF) {
2818
            /* Typed reference may cause auto conversion */
2819
749
            tmp |= MAY_BE_ANY;
2820
749
          }
2821
5.33k
        } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
2822
          /* The return value must also satisfy the property type */
2823
182
          if (prop_info) {
2824
8
            t1 = zend_fetch_prop_type(script, prop_info, &ce);
2825
8
            if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
2826
8
             && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
2827
              /* DOUBLE may be auto-converted to LONG */
2828
0
              tmp |= MAY_BE_LONG;
2829
0
              tmp &= ~MAY_BE_DOUBLE;
2830
8
            } else if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING)) == MAY_BE_STRING
2831
8
             && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
2832
              /* LONG/DOUBLE may be auto-converted to STRING */
2833
0
              tmp |= MAY_BE_STRING;
2834
0
              tmp &= ~(MAY_BE_LONG|MAY_BE_DOUBLE);
2835
0
            }
2836
8
            tmp &= t1;
2837
174
          } else {
2838
174
            tmp |= MAY_BE_LONG | MAY_BE_STRING;
2839
174
          }
2840
5.15k
        } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
2841
          /* The return value must also satisfy the property type */
2842
10
          if (prop_info) {
2843
10
            t1 = zend_fetch_prop_type(script, prop_info, &ce);
2844
10
            if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
2845
10
             && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
2846
              /* DOUBLE may be auto-converted to LONG */
2847
0
              tmp |= MAY_BE_LONG;
2848
0
              tmp &= ~MAY_BE_DOUBLE;
2849
10
            } else if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING)) == MAY_BE_STRING
2850
10
             && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
2851
              /* LONG/DOUBLE may be auto-converted to STRING */
2852
8
              tmp |= MAY_BE_STRING;
2853
8
              tmp &= ~(MAY_BE_LONG|MAY_BE_DOUBLE);
2854
8
            }
2855
10
            tmp &= t1;
2856
10
          } else {
2857
0
            tmp |= MAY_BE_LONG | MAY_BE_STRING;
2858
0
          }
2859
5.14k
        } else {
2860
5.14k
          if (tmp & MAY_BE_REF) {
2861
            /* Typed reference may cause auto conversion */
2862
1.33k
            tmp |= MAY_BE_ANY;
2863
1.33k
          }
2864
5.14k
        }
2865
6.16k
        tmp &= ~MAY_BE_REF;
2866
6.16k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2867
6.16k
        if (ce) {
2868
0
          UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
2869
0
        }
2870
6.16k
      }
2871
10.2k
      break;
2872
10.2k
    }
2873
10.2k
    case ZEND_PRE_INC:
2874
6.73k
    case ZEND_PRE_DEC:
2875
6.73k
      tmp = 0;
2876
6.73k
      if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2877
2.42k
        tmp |= MAY_BE_RC1;
2878
2.42k
        if (ssa_op->result_def >= 0) {
2879
760
          tmp |= MAY_BE_RCN;
2880
760
        }
2881
2.42k
      }
2882
6.73k
      if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) {
2883
1.42k
        if (!ssa_var_info[ssa_op->op1_use].has_range ||
2884
1.42k
            (opline->opcode == ZEND_PRE_DEC &&
2885
1.42k
             (ssa_var_info[ssa_op->op1_use].range.underflow ||
2886
58
              ssa_var_info[ssa_op->op1_use].range.min == ZEND_LONG_MIN)) ||
2887
1.42k
             (opline->opcode == ZEND_PRE_INC &&
2888
1.38k
              (ssa_var_info[ssa_op->op1_use].range.overflow ||
2889
1.36k
               ssa_var_info[ssa_op->op1_use].range.max == ZEND_LONG_MAX))) {
2890
          /* may overflow */
2891
321
          tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2892
1.10k
        } else {
2893
1.10k
          tmp |= MAY_BE_LONG;
2894
1.10k
        }
2895
5.31k
      } else {
2896
5.31k
        if (t1 & (MAY_BE_UNDEF | MAY_BE_NULL)) {
2897
4.38k
          if (opline->opcode == ZEND_PRE_INC) {
2898
3.51k
            tmp |= MAY_BE_LONG;
2899
3.51k
          } else {
2900
866
            tmp |= MAY_BE_NULL;
2901
866
          }
2902
4.38k
        }
2903
5.31k
        if (t1 & MAY_BE_LONG) {
2904
4.18k
          tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2905
4.18k
        }
2906
5.31k
        if (t1 & MAY_BE_DOUBLE) {
2907
3.70k
          tmp |= MAY_BE_DOUBLE;
2908
3.70k
        }
2909
5.31k
        if (t1 & MAY_BE_STRING) {
2910
2.29k
          tmp |= MAY_BE_STRING | MAY_BE_LONG | MAY_BE_DOUBLE;
2911
2.29k
        }
2912
5.31k
        tmp |= t1 & (MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_OBJECT);
2913
5.31k
      }
2914
6.73k
      if (ssa_op->result_def >= 0) {
2915
1.65k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2916
1.65k
      }
2917
6.73k
      if (ssa_op->op1_def >= 0) {
2918
6.72k
        if (t1 & MAY_BE_REF) {
2919
1.97k
          tmp |= MAY_BE_REF;
2920
1.97k
        }
2921
6.72k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2922
6.72k
      }
2923
6.73k
      break;
2924
6.73k
    case ZEND_POST_INC:
2925
5.14k
    case ZEND_POST_DEC:
2926
5.14k
      if (ssa_op->result_def >= 0) {
2927
5.14k
        tmp = 0;
2928
5.14k
        if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2929
1.49k
          tmp |= MAY_BE_RC1|MAY_BE_RCN;
2930
1.49k
        }
2931
5.14k
        tmp |= t1 & ~(MAY_BE_UNDEF|MAY_BE_REF|MAY_BE_RCN);
2932
5.14k
        if (t1 & MAY_BE_UNDEF) {
2933
1.30k
          tmp |= MAY_BE_NULL;
2934
1.30k
        }
2935
5.14k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2936
5.14k
      }
2937
5.14k
      tmp = 0;
2938
5.14k
      if (t1 & MAY_BE_REF) {
2939
684
        tmp |= MAY_BE_REF;
2940
684
      }
2941
5.14k
      if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2942
1.49k
        tmp |= MAY_BE_RC1;
2943
1.49k
      }
2944
5.14k
      if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) {
2945
474
        if (!ssa_var_info[ssa_op->op1_use].has_range ||
2946
474
             (opline->opcode == ZEND_POST_DEC &&
2947
474
              (ssa_var_info[ssa_op->op1_use].range.underflow ||
2948
136
               ssa_var_info[ssa_op->op1_use].range.min == ZEND_LONG_MIN)) ||
2949
474
              (opline->opcode == ZEND_POST_INC &&
2950
348
               (ssa_var_info[ssa_op->op1_use].range.overflow ||
2951
338
                ssa_var_info[ssa_op->op1_use].range.max == ZEND_LONG_MAX))) {
2952
          /* may overflow */
2953
320
          tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2954
320
        } else {
2955
154
          tmp |= MAY_BE_LONG;
2956
154
        }
2957
4.67k
      } else {
2958
4.67k
        if (t1 & (MAY_BE_UNDEF | MAY_BE_NULL)) {
2959
2.63k
          if (opline->opcode == ZEND_POST_INC) {
2960
762
            tmp |= MAY_BE_LONG;
2961
1.87k
          } else {
2962
1.87k
            tmp |= MAY_BE_NULL;
2963
1.87k
          }
2964
2.63k
        }
2965
4.67k
        if (t1 & MAY_BE_LONG) {
2966
3.46k
          tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2967
3.46k
        }
2968
4.67k
        if (t1 & MAY_BE_DOUBLE) {
2969
3.19k
          tmp |= MAY_BE_DOUBLE;
2970
3.19k
        }
2971
4.67k
        if (t1 & MAY_BE_STRING) {
2972
996
          tmp |= MAY_BE_STRING | MAY_BE_LONG | MAY_BE_DOUBLE;
2973
996
        }
2974
4.67k
        tmp |= t1 & (MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_RESOURCE | MAY_BE_ARRAY | MAY_BE_OBJECT | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_KEY_ANY);
2975
4.67k
      }
2976
5.14k
      if (ssa_op->op1_def >= 0) {
2977
5.12k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2978
5.12k
      }
2979
5.14k
      break;
2980
7.46k
    case ZEND_ASSIGN_DIM:
2981
7.46k
      if (opline->op1_type == IS_CV) {
2982
7.16k
        tmp = assign_dim_result_type(t1, t2, OP1_DATA_INFO(), opline->op2_type);
2983
7.16k
        tmp |= ssa->var_info[ssa_op->op1_def].type & (MAY_BE_ARRAY_PACKED|MAY_BE_ARRAY_NUMERIC_HASH|MAY_BE_ARRAY_STRING_HASH);
2984
7.16k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2985
7.16k
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2986
7.16k
      }
2987
7.46k
      if (ssa_op->result_def >= 0) {
2988
4.01k
        tmp = 0;
2989
4.01k
        if (t1 & MAY_BE_STRING) {
2990
898
          tmp |= MAY_BE_STRING | MAY_BE_NULL;
2991
898
        }
2992
4.01k
        if (t1 & MAY_BE_OBJECT) {
2993
874
          tmp |= (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF);
2994
874
        }
2995
4.01k
        if (t1 & (MAY_BE_ARRAY|MAY_BE_FALSE|MAY_BE_NULL|MAY_BE_UNDEF)) {
2996
3.89k
          tmp |= (OP1_DATA_INFO() & (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF));
2997
2998
3.89k
          if (OP1_DATA_INFO() & MAY_BE_UNDEF) {
2999
291
            tmp |= MAY_BE_NULL;
3000
291
          }
3001
3.89k
          if (t1 & MAY_BE_ARRAY_OF_REF) {
3002
            /* A scalar type conversion may occur when assigning to a typed reference. */
3003
885
            tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING;
3004
885
          }
3005
3.89k
        }
3006
4.01k
        if (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE)) {
3007
906
          tmp |= MAY_BE_NULL;
3008
906
        }
3009
4.01k
        tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3010
4.01k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3011
4.01k
      }
3012
7.46k
      if ((ssa_op+1)->op1_def >= 0) {
3013
0
        opline++;
3014
0
        ssa_op++;
3015
0
        tmp = OP1_INFO();
3016
0
        if (tmp & (MAY_BE_ANY | MAY_BE_REF)) {
3017
0
          if (tmp & MAY_BE_RC1) {
3018
0
            tmp |= MAY_BE_RCN;
3019
0
          }
3020
0
        }
3021
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3022
0
      }
3023
7.46k
      break;
3024
7.46k
    case ZEND_ASSIGN_OBJ:
3025
4.54k
      if (opline->op1_type == IS_CV) {
3026
4.44k
        zend_class_entry *ce = ssa_var_info[ssa_op->op1_use].ce;
3027
4.44k
        bool add_rc = (t1 & (MAY_BE_OBJECT|MAY_BE_REF)) && (!ce
3028
4.19k
          || ce->__set
3029
          /* Non-default write_property may be set within create_object. */
3030
4.19k
          || ce->create_object
3031
4.19k
          || ce->default_object_handlers->write_property != zend_std_write_property
3032
4.19k
          || ssa_var_info[ssa_op->op1_use].is_instanceof);
3033
4.44k
        tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT|MAY_BE_RC1|MAY_BE_RCN))|(add_rc ? (MAY_BE_RC1|MAY_BE_RCN) : 0);
3034
4.44k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3035
4.44k
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3036
4.44k
      }
3037
4.54k
      if (ssa_op->result_def >= 0) {
3038
        // TODO: If there is no __set we might do better
3039
1.20k
        tmp = zend_fetch_prop_type(script,
3040
1.20k
          zend_fetch_prop_info(op_array, ssa, opline, ssa_op), &ce);
3041
1.20k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3042
1.20k
        if (ce) {
3043
0
          UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3044
0
        }
3045
1.20k
      }
3046
4.54k
      if ((ssa_op+1)->op1_def >= 0) {
3047
0
        opline++;
3048
0
        ssa_op++;
3049
0
        tmp = OP1_INFO();
3050
0
        if (tmp & MAY_BE_RC1) {
3051
0
          tmp |= MAY_BE_RCN;
3052
0
        }
3053
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3054
0
      }
3055
4.54k
      break;
3056
4.54k
    case ZEND_ASSIGN_STATIC_PROP:
3057
248
      if (ssa_op->result_def >= 0) {
3058
248
        tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;
3059
248
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3060
248
      }
3061
248
      if ((ssa_op+1)->op1_def >= 0) {
3062
0
        opline++;
3063
0
        ssa_op++;
3064
0
        tmp = OP1_INFO();
3065
0
        if (tmp & MAY_BE_RC1) {
3066
0
          tmp |= MAY_BE_RCN;
3067
0
        }
3068
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3069
0
      }
3070
248
      break;
3071
412
    case ZEND_PRE_INC_OBJ:
3072
773
    case ZEND_PRE_DEC_OBJ:
3073
1.04k
    case ZEND_POST_INC_OBJ:
3074
1.23k
    case ZEND_POST_DEC_OBJ:
3075
1.23k
      if (opline->op1_type == IS_CV) {
3076
1.15k
        tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN;
3077
1.15k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3078
1.15k
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3079
1.15k
      }
3080
1.23k
      if (ssa_op->result_def >= 0) {
3081
        // TODO: ???
3082
992
        tmp = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3083
992
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3084
992
      }
3085
1.23k
      break;
3086
73.0k
    case ZEND_ASSIGN:
3087
73.0k
      if (ssa_op->op2_def >= 0) {
3088
0
        tmp = t2;
3089
0
        if (tmp & MAY_BE_RC1) {
3090
0
          tmp |= MAY_BE_RCN;
3091
0
        }
3092
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3093
0
      }
3094
73.0k
      tmp = t2 & ~(MAY_BE_UNDEF|MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN);
3095
73.0k
      if (t2 & MAY_BE_UNDEF) {
3096
1.86k
        tmp |= MAY_BE_NULL;
3097
1.86k
      }
3098
73.0k
      if (t1 & MAY_BE_REF) {
3099
41.5k
        tmp |= MAY_BE_REF;
3100
41.5k
      }
3101
73.0k
      if (t2 & MAY_BE_REF) {
3102
4.06k
        tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3103
68.9k
      } else if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
3104
43.8k
        tmp |= t2 & (MAY_BE_RC1|MAY_BE_RCN);
3105
43.8k
      } else if (t2 & (MAY_BE_RC1|MAY_BE_RCN)) {
3106
8.73k
        tmp |= MAY_BE_RCN;
3107
8.73k
      }
3108
73.0k
      if (RETURN_VALUE_USED(opline) && (tmp & MAY_BE_RC1)) {
3109
10.7k
        tmp |= MAY_BE_RCN;
3110
10.7k
      }
3111
73.0k
      if (ssa_op->op1_def >= 0) {
3112
73.0k
        if (ssa_var_info[ssa_op->op1_def].use_as_double) {
3113
2
          tmp &= ~MAY_BE_LONG;
3114
2
          tmp |= MAY_BE_DOUBLE;
3115
2
        }
3116
73.0k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3117
73.0k
        COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op1_def);
3118
73.0k
      }
3119
73.0k
      if (ssa_op->result_def >= 0) {
3120
24.3k
        if (tmp & MAY_BE_REF) {
3121
          /* A scalar type conversion may occur when assigning to a typed reference. */
3122
8.17k
          tmp &= ~MAY_BE_REF;
3123
8.17k
          tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN;
3124
8.17k
        }
3125
24.3k
        if ((tmp & (MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_RCN) {
3126
          /* refcount may be indirectly decremented. Make an exception if the result is used in the next instruction */
3127
1.12k
          if (!ssa_opcodes) {
3128
1.12k
            if (ssa->vars[ssa_op->result_def].use_chain < 0
3129
1.12k
             || opline + 1 != op_array->opcodes + ssa->vars[ssa_op->result_def].use_chain) {
3130
152
              tmp |= MAY_BE_RC1;
3131
152
              }
3132
1.12k
          } else {
3133
0
            if (ssa->vars[ssa_op->result_def].use_chain < 0
3134
0
             || opline + 1 != ssa_opcodes[ssa->vars[ssa_op->result_def].use_chain]) {
3135
0
              tmp |= MAY_BE_RC1;
3136
0
              }
3137
0
          }
3138
1.12k
        }
3139
24.3k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3140
24.3k
        COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def);
3141
24.3k
      }
3142
73.0k
      break;
3143
73.0k
    case ZEND_ASSIGN_REF:
3144
// TODO: ???
3145
2.89k
      if (opline->op2_type == IS_CV) {
3146
1.96k
        tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3147
1.96k
        if (t2 & MAY_BE_UNDEF) {
3148
386
          tmp |= MAY_BE_NULL;
3149
386
        }
3150
1.96k
        UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3151
1.96k
      }
3152
2.89k
      if (opline->op2_type == IS_VAR && opline->extended_value == ZEND_RETURNS_FUNCTION) {
3153
192
        tmp = (MAY_BE_REF | MAY_BE_RCN | MAY_BE_RC1 | t2) & ~MAY_BE_UNDEF;
3154
2.70k
      } else {
3155
2.70k
        tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3156
2.70k
      }
3157
2.89k
      if (t2 & MAY_BE_UNDEF) {
3158
386
        tmp |= MAY_BE_NULL;
3159
386
      }
3160
2.89k
      UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3161
2.89k
      if (ssa_op->result_def >= 0) {
3162
1.05k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3163
1.05k
      }
3164
2.89k
      break;
3165
2.89k
    case ZEND_ASSIGN_OBJ_REF:
3166
245
      if (opline->op1_type == IS_CV && ssa_op->op1_def >= 0) {
3167
0
        tmp = t1;
3168
0
        if (tmp & MAY_BE_OBJECT) {
3169
0
          tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3170
0
        }
3171
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3172
0
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3173
0
      }
3174
3175
245
      t2 = OP1_DATA_INFO();
3176
245
      if ((opline+1)->op1_type == IS_VAR && (opline->extended_value & ZEND_RETURNS_FUNCTION)) {
3177
0
        tmp = (MAY_BE_REF | MAY_BE_RCN | MAY_BE_RC1 | t2) & ~MAY_BE_UNDEF;
3178
245
      } else {
3179
245
        tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3180
245
      }
3181
245
      if (t2 & MAY_BE_UNDEF) {
3182
34
        tmp |= MAY_BE_NULL;
3183
34
      }
3184
245
      if (ssa_op->result_def >= 0) {
3185
60
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3186
60
      }
3187
245
      if ((opline+1)->op1_type == IS_CV) {
3188
245
        opline++;
3189
245
        ssa_op++;
3190
245
        tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3191
245
        if (t2 & MAY_BE_UNDEF) {
3192
34
          tmp |= MAY_BE_NULL;
3193
34
        }
3194
245
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3195
245
      }
3196
245
      break;
3197
245
    case ZEND_ASSIGN_STATIC_PROP_REF:
3198
54
      if (ssa_op->result_def >= 0) {
3199
38
        UPDATE_SSA_TYPE(MAY_BE_REF, ssa_op->result_def);
3200
38
      }
3201
54
      if ((opline+1)->op1_type == IS_CV) {
3202
52
        opline++;
3203
52
        ssa_op++;
3204
52
        UPDATE_SSA_TYPE(MAY_BE_REF, ssa_op->op1_def);
3205
52
      }
3206
54
      break;
3207
649
    case ZEND_BIND_GLOBAL:
3208
649
      tmp = MAY_BE_REF | MAY_BE_ANY
3209
649
        | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3210
649
      UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3211
649
      break;
3212
5.90k
    case ZEND_BIND_STATIC:
3213
5.90k
      tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF
3214
5.90k
        | ((opline->extended_value & ZEND_BIND_REF) ? MAY_BE_REF : (MAY_BE_RC1 | MAY_BE_RCN));
3215
5.90k
      if (opline->extended_value & ZEND_BIND_IMPLICIT) {
3216
4.39k
        tmp |= MAY_BE_UNDEF;
3217
4.39k
      }
3218
5.90k
      UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3219
5.90k
      break;
3220
5.90k
    case ZEND_BIND_INIT_STATIC_OR_JMP:
3221
166
      tmp = MAY_BE_UNDEF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_REF;
3222
166
      UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3223
166
      break;
3224
166
    case ZEND_SEND_VAR:
3225
0
      if (ssa_op->op1_def >= 0) {
3226
0
        tmp = t1;
3227
0
        if (t1 & (MAY_BE_RC1|MAY_BE_REF)) {
3228
0
          tmp |= MAY_BE_RCN;
3229
0
        }
3230
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3231
0
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3232
0
      }
3233
0
      break;
3234
480
    case ZEND_BIND_LEXICAL:
3235
480
      if (ssa_op->op2_def >= 0) {
3236
480
        if (opline->extended_value & ZEND_BIND_REF) {
3237
480
          tmp = t2 | MAY_BE_REF;
3238
480
        } else {
3239
0
          tmp = t2 & ~(MAY_BE_RC1|MAY_BE_RCN);
3240
0
          if (t2 & (MAY_BE_RC1|MAY_BE_RCN)) {
3241
0
            tmp |= MAY_BE_RCN;
3242
0
          }
3243
0
        }
3244
480
        UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3245
480
        COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op2_def);
3246
480
      }
3247
480
      break;
3248
515
    case ZEND_YIELD:
3249
515
      if (ssa_op->op1_def >= 0) {
3250
54
        if (op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
3251
54
          tmp = t1 | MAY_BE_REF;
3252
54
        } else {
3253
0
          tmp = t1 & ~(MAY_BE_RC1|MAY_BE_RCN);
3254
0
          if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
3255
0
            tmp |= MAY_BE_RCN;
3256
0
          }
3257
0
        }
3258
54
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3259
54
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3260
54
      }
3261
515
      if (ssa_op->result_def >= 0) {
3262
465
        tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF
3263
465
          | MAY_BE_RC1 | MAY_BE_RCN;
3264
465
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3265
465
      }
3266
515
      break;
3267
6.13k
    case ZEND_SEND_VAR_EX:
3268
6.13k
    case ZEND_SEND_FUNC_ARG:
3269
6.13k
      if (ssa_op->op1_def >= 0) {
3270
6.13k
        tmp = (t1 & MAY_BE_UNDEF)|MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3271
6.13k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3272
6.13k
      }
3273
6.13k
      break;
3274
6.13k
    case ZEND_SEND_REF:
3275
1.97k
      if (ssa_op->op1_def >= 0) {
3276
1.97k
        tmp = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3277
1.97k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3278
1.97k
      }
3279
1.97k
      break;
3280
1.97k
    case ZEND_SEND_UNPACK:
3281
276
      if (ssa_op->op1_def >= 0) {
3282
276
        tmp = t1;
3283
276
        if (t1 & MAY_BE_ARRAY) {
3284
270
          tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3285
270
          if (t1 & MAY_BE_ARRAY_OF_ANY) {
3286
            /* SEND_UNPACK may acquire references into the array */
3287
270
            tmp |= MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3288
270
          }
3289
270
        }
3290
276
        if (t1 & MAY_BE_OBJECT) {
3291
210
          tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3292
210
        }
3293
276
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3294
276
      }
3295
276
      break;
3296
1.83k
    case ZEND_FAST_CONCAT:
3297
12.8k
    case ZEND_ROPE_INIT:
3298
335k
    case ZEND_ROPE_ADD:
3299
346k
    case ZEND_ROPE_END:
3300
346k
      UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def);
3301
346k
      break;
3302
346k
    case ZEND_RECV:
3303
23.0k
    case ZEND_RECV_INIT:
3304
23.3k
    case ZEND_RECV_VARIADIC:
3305
23.3k
    {
3306
      /* Typehinting */
3307
23.3k
      zend_arg_info *arg_info = &op_array->arg_info[opline->op1.num-1];
3308
3309
23.3k
      ce = NULL;
3310
23.3k
      tmp = zend_fetch_arg_info_type(script, arg_info, &ce);
3311
23.3k
      if (ZEND_ARG_SEND_MODE(arg_info)) {
3312
1.50k
        tmp |= MAY_BE_REF;
3313
1.50k
        ce = NULL;
3314
1.50k
      }
3315
3316
23.3k
      if (opline->opcode == ZEND_RECV_VARIADIC) {
3317
350
        uint32_t elem_type = tmp & MAY_BE_REF
3318
350
          ? MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF
3319
350
          : (tmp & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
3320
350
        tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|elem_type;
3321
350
        ce = NULL;
3322
350
      }
3323
3324
23.3k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3325
23.3k
      if (ce) {
3326
692
        UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3327
22.6k
      } else {
3328
22.6k
        UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3329
22.6k
      }
3330
23.3k
      break;
3331
23.3k
    }
3332
537
    case ZEND_DECLARE_ANON_CLASS:
3333
537
      UPDATE_SSA_TYPE(MAY_BE_CLASS, ssa_op->result_def);
3334
537
      if (script && (ce = zend_hash_find_ptr(&script->class_table, Z_STR_P(CRT_CONSTANT(opline->op1)))) != NULL) {
3335
537
        UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def);
3336
537
      }
3337
537
      break;
3338
1.17k
    case ZEND_FETCH_CLASS:
3339
1.17k
      UPDATE_SSA_TYPE(MAY_BE_CLASS, ssa_op->result_def);
3340
1.17k
      if (opline->op2_type == IS_UNUSED) {
3341
0
        switch (opline->op1.num & ZEND_FETCH_CLASS_MASK) {
3342
0
          case ZEND_FETCH_CLASS_SELF:
3343
0
            if (op_array->scope) {
3344
0
              UPDATE_SSA_OBJ_TYPE(op_array->scope, 0, ssa_op->result_def);
3345
0
            } else {
3346
0
              UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3347
0
            }
3348
0
            break;
3349
0
          case ZEND_FETCH_CLASS_PARENT:
3350
0
            if (op_array->scope && op_array->scope->parent && (op_array->scope->ce_flags & ZEND_ACC_LINKED)) {
3351
0
              UPDATE_SSA_OBJ_TYPE(op_array->scope->parent, 0, ssa_op->result_def);
3352
0
            } else {
3353
0
              UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3354
0
            }
3355
0
            break;
3356
0
          case ZEND_FETCH_CLASS_STATIC:
3357
0
            if (op_array->scope && (op_array->scope->ce_flags & ZEND_ACC_FINAL)) {
3358
0
              UPDATE_SSA_OBJ_TYPE(op_array->scope, 0, ssa_op->result_def);
3359
0
            } else {
3360
0
              UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3361
0
            }
3362
0
            break;
3363
0
          default:
3364
0
            UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3365
0
            break;
3366
0
        }
3367
1.17k
      } else if (opline->op2_type == IS_CONST) {
3368
34
        zval *zv = CRT_CONSTANT(opline->op2);
3369
34
        if (Z_TYPE_P(zv) == IS_STRING) {
3370
34
          ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(zv+1));
3371
34
          UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def);
3372
34
        } else {
3373
0
          UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3374
0
        }
3375
1.13k
      } else {
3376
1.13k
        COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def);
3377
1.13k
      }
3378
1.17k
      break;
3379
25.0k
    case ZEND_NEW:
3380
25.0k
      tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_OBJECT;
3381
25.0k
      ce = zend_optimizer_get_class_entry_from_op1(script, op_array, opline);
3382
25.0k
      if (ce) {
3383
21.6k
        UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def);
3384
21.6k
      } else if ((t1 & MAY_BE_CLASS) && ssa_op->op1_use >= 0 && ssa_var_info[ssa_op->op1_use].ce) {
3385
541
        UPDATE_SSA_OBJ_TYPE(ssa_var_info[ssa_op->op1_use].ce, ssa_var_info[ssa_op->op1_use].is_instanceof, ssa_op->result_def);
3386
541
        if (!ssa_var_info[ssa_op->result_def].is_instanceof) {
3387
537
          ce = ssa_var_info[ssa_op->op1_use].ce;
3388
537
        }
3389
2.87k
      } else {
3390
2.87k
        UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3391
2.87k
      }
3392
      /* New objects without constructors cannot escape. */
3393
25.0k
      if (ce
3394
25.0k
       && !ce->constructor
3395
25.0k
       && !ce->create_object
3396
25.0k
       && ce->default_object_handlers->get_constructor == zend_std_get_constructor) {
3397
10.6k
        tmp &= ~MAY_BE_RCN;
3398
10.6k
      }
3399
25.0k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3400
25.0k
      break;
3401
25.0k
    case ZEND_CLONE:
3402
375
      UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_OBJECT, ssa_op->result_def);
3403
375
      COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def);
3404
375
      break;
3405
3.90k
    case ZEND_INIT_ARRAY:
3406
21.3k
    case ZEND_ADD_ARRAY_ELEMENT:
3407
21.3k
      if (ssa_op->op1_def >= 0) {
3408
406
        if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) {
3409
406
          tmp = (MAY_BE_REF | t1) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3410
406
          if (t1 & MAY_BE_UNDEF) {
3411
162
            tmp |= MAY_BE_NULL;
3412
162
          }
3413
406
        } else if ((t1 & (MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_REF) {
3414
0
          tmp = (MAY_BE_REF | t1) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3415
0
          if (t1 & MAY_BE_UNDEF) {
3416
0
            tmp |= MAY_BE_NULL;
3417
0
          }
3418
0
        } else if (t1 & MAY_BE_REF) {
3419
0
          tmp = (MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | t1);
3420
0
        } else {
3421
0
          tmp = t1;
3422
0
          if (t1 & MAY_BE_RC1) {
3423
0
            tmp |= MAY_BE_RCN;
3424
0
          }
3425
0
        }
3426
406
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3427
406
      }
3428
21.3k
      if (ssa_op->result_def >= 0) {
3429
21.3k
        uint32_t arr_type;
3430
21.3k
        if (opline->opcode == ZEND_INIT_ARRAY) {
3431
3.90k
          arr_type = 0;
3432
17.4k
        } else {
3433
17.4k
          arr_type = RES_USE_INFO();
3434
17.4k
        }
3435
21.3k
        tmp = MAY_BE_RC1|MAY_BE_ARRAY|arr_type;
3436
21.3k
        if (opline->opcode == ZEND_INIT_ARRAY && opline->op1_type == IS_UNUSED) {
3437
78
          tmp |= MAY_BE_ARRAY_EMPTY;
3438
78
        }
3439
21.3k
        if (opline->op1_type != IS_UNUSED
3440
21.3k
         && (opline->op2_type == IS_UNUSED
3441
21.3k
          || (t2 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE|MAY_BE_STRING)))) {
3442
21.3k
          tmp |= assign_dim_array_result_type(arr_type, t2, t1, opline->op2_type);
3443
21.3k
          if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) {
3444
438
            tmp |= MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3445
438
          }
3446
21.3k
        }
3447
21.3k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3448
21.3k
      }
3449
21.3k
      break;
3450
21.3k
    case ZEND_ADD_ARRAY_UNPACK:
3451
150
      tmp = ssa_var_info[ssa_op->result_use].type;
3452
150
      ZEND_ASSERT(tmp & MAY_BE_ARRAY);
3453
150
      tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
3454
150
      if (t1 & MAY_BE_OBJECT) {
3455
106
        tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY;
3456
106
      }
3457
150
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3458
150
      break;
3459
1.59k
    case ZEND_UNSET_CV:
3460
1.59k
      tmp = MAY_BE_UNDEF;
3461
1.59k
      if (!op_array->function_name) {
3462
        /* In global scope, we know nothing */
3463
1.11k
        tmp |= MAY_BE_REF;
3464
1.11k
      }
3465
1.59k
      UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3466
1.59k
      break;
3467
1.59k
    case ZEND_UNSET_DIM:
3468
1.03k
    case ZEND_UNSET_OBJ:
3469
1.03k
      if (ssa_op->op1_def >= 0) {
3470
1.03k
        UPDATE_SSA_TYPE(t1, ssa_op->op1_def);
3471
1.03k
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3472
1.03k
      }
3473
1.03k
      break;
3474
2.59k
    case ZEND_FE_RESET_R:
3475
3.80k
    case ZEND_FE_RESET_RW:
3476
3.80k
      if (ssa_op->op1_def >= 0) {
3477
1.12k
        tmp = t1;
3478
1.12k
        if (opline->opcode == ZEND_FE_RESET_RW) {
3479
1.12k
          tmp |= MAY_BE_REF;
3480
1.12k
        } else if (t1 & MAY_BE_RC1) {
3481
0
          tmp |= MAY_BE_RCN;
3482
0
        }
3483
1.12k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3484
1.12k
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3485
1.12k
      }
3486
3.80k
      if (opline->opcode == ZEND_FE_RESET_RW) {
3487
//???
3488
1.20k
        tmp = MAY_BE_REF | (t1 & (MAY_BE_ARRAY | MAY_BE_OBJECT));
3489
2.59k
      } else {
3490
2.59k
        tmp = MAY_BE_RC1 | MAY_BE_RCN | (t1 & (MAY_BE_ARRAY | MAY_BE_OBJECT | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF));
3491
2.59k
      }
3492
      /* The result is set to UNDEF for invalid foreach inputs. */
3493
3.80k
      if ((t1 & (MAY_BE_ANY | MAY_BE_UNDEF)) & ~(MAY_BE_ARRAY | MAY_BE_OBJECT)) {
3494
3.04k
        tmp |= MAY_BE_UNDEF;
3495
3.04k
      }
3496
3.80k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3497
3.80k
      COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def);
3498
3.80k
      break;
3499
3.79k
    case ZEND_FE_FETCH_R:
3500
4.62k
    case ZEND_FE_FETCH_RW:
3501
4.62k
      tmp = 0;
3502
4.62k
      if (opline->op2_type == IS_CV) {
3503
4.40k
        tmp = t2 & MAY_BE_REF;
3504
4.40k
      }
3505
4.62k
      if (t1 & MAY_BE_OBJECT) {
3506
3.43k
        if (opline->opcode == ZEND_FE_FETCH_RW) {
3507
831
          tmp |= MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3508
2.60k
        } else {
3509
2.60k
          tmp |= MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3510
2.60k
          if (opline->op2_type != IS_CV) {
3511
150
            tmp |= MAY_BE_REF;
3512
150
          }
3513
2.60k
        }
3514
3.43k
      }
3515
4.62k
      if (t1 & MAY_BE_ARRAY) {
3516
4.10k
        if (opline->opcode == ZEND_FE_FETCH_RW) {
3517
831
          tmp |= MAY_BE_REF | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3518
3.27k
        } else {
3519
3.27k
          tmp |= ((t1 & MAY_BE_ARRAY_OF_ANY) >> MAY_BE_ARRAY_SHIFT);
3520
3.27k
          if (tmp & MAY_BE_ARRAY) {
3521
2.80k
            tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3522
2.80k
          }
3523
3.27k
          if (t1 & MAY_BE_ARRAY_OF_REF) {
3524
2.58k
            tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3525
2.58k
            if (opline->op2_type != IS_CV) {
3526
150
              tmp |= MAY_BE_REF;
3527
150
            }
3528
2.58k
          } else if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
3529
350
            tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3530
350
          }
3531
3.27k
        }
3532
4.10k
      }
3533
4.62k
      UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3534
4.62k
      if (ssa_op->result_def >= 0) {
3535
2.05k
        tmp = (ssa_op->result_use >= 0) ? RES_USE_INFO() : 0;
3536
2.05k
        if (t1 & MAY_BE_OBJECT) {
3537
1.74k
          tmp |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3538
1.74k
        }
3539
2.05k
        if (t1 & MAY_BE_ARRAY) {
3540
1.85k
          if (t1 & MAY_BE_ARRAY_KEY_LONG) {
3541
1.78k
            tmp |= MAY_BE_LONG;
3542
1.78k
          }
3543
1.85k
          if (t1 & MAY_BE_ARRAY_KEY_STRING) {
3544
1.80k
            tmp |= MAY_BE_STRING | MAY_BE_RCN;
3545
1.80k
          }
3546
1.85k
        }
3547
2.05k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3548
2.05k
      }
3549
4.62k
      break;
3550
7.22k
    case ZEND_FETCH_DIM_R:
3551
8.17k
    case ZEND_FETCH_DIM_IS:
3552
9.32k
    case ZEND_FETCH_DIM_RW:
3553
13.4k
    case ZEND_FETCH_DIM_W:
3554
13.5k
    case ZEND_FETCH_DIM_UNSET:
3555
14.7k
    case ZEND_FETCH_DIM_FUNC_ARG:
3556
16.1k
    case ZEND_FETCH_LIST_R:
3557
16.4k
    case ZEND_FETCH_LIST_W:
3558
16.4k
      if (ssa_op->op1_def >= 0) {
3559
5.66k
        uint32_t key_type = 0;
3560
5.66k
        tmp = t1 & ~(MAY_BE_RC1|MAY_BE_RCN);
3561
5.66k
        if (opline->opcode == ZEND_FETCH_DIM_W ||
3562
5.66k
            opline->opcode == ZEND_FETCH_DIM_RW ||
3563
5.66k
            opline->opcode == ZEND_FETCH_DIM_FUNC_ARG ||
3564
5.66k
            opline->opcode == ZEND_FETCH_LIST_W) {
3565
5.56k
          if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3566
4.92k
            if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) {
3567
4.10k
              tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
3568
4.10k
            }
3569
4.92k
            tmp |= MAY_BE_ARRAY | MAY_BE_RC1;
3570
4.92k
          }
3571
5.56k
          if (t1 & (MAY_BE_STRING|MAY_BE_ARRAY)) {
3572
4.77k
            tmp |= MAY_BE_RC1;
3573
4.77k
            if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG) {
3574
880
              tmp |= t1 & MAY_BE_RCN;
3575
880
            }
3576
4.77k
          }
3577
5.56k
          if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
3578
4.16k
            tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN);
3579
4.16k
          }
3580
5.56k
          if (opline->op2_type == IS_UNUSED) {
3581
470
            if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3582
374
              key_type |= MAY_BE_ARRAY_PACKED;
3583
374
            }
3584
470
            if (t1 & MAY_BE_ARRAY) {
3585
369
              key_type |= MAY_BE_HASH_ONLY(t1) ?
3586
361
                MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
3587
369
            }
3588
5.09k
          } else {
3589
5.09k
            if (t2 & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) {
3590
3.44k
              if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3591
3.07k
                key_type |= MAY_BE_ARRAY_PACKED;
3592
3.07k
              }
3593
3.44k
              if (t1 & MAY_BE_ARRAY) {
3594
2.81k
                key_type |= MAY_BE_HASH_ONLY(t1) ?
3595
2.80k
                  MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
3596
2.81k
                }
3597
3.44k
            }
3598
5.09k
            if (t2 & MAY_BE_STRING) {
3599
2.33k
              key_type |= MAY_BE_ARRAY_KEY_STRING;
3600
2.33k
              if (opline->op2_type != IS_CONST) {
3601
                // FIXME: numeric string
3602
1.51k
                if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3603
1.43k
                  key_type |= MAY_BE_ARRAY_PACKED;
3604
1.43k
                }
3605
1.51k
                if (t1 & MAY_BE_ARRAY) {
3606
1.45k
                  key_type |= MAY_BE_HASH_ONLY(t1) ?
3607
1.40k
                    MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
3608
1.45k
                  }
3609
1.51k
              }
3610
2.33k
            }
3611
5.09k
            if (t2 & (MAY_BE_UNDEF | MAY_BE_NULL)) {
3612
997
              key_type |= MAY_BE_ARRAY_KEY_STRING;
3613
997
            }
3614
5.09k
          }
3615
5.56k
        } else if (opline->opcode == ZEND_FETCH_DIM_UNSET) {
3616
96
          if (t1 & MAY_BE_ARRAY) {
3617
88
            tmp |= MAY_BE_RC1;
3618
88
          }
3619
96
          if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
3620
72
            tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN);
3621
72
          }
3622
96
        }
3623
5.66k
        if ((key_type & (MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING))
3624
5.66k
            && (opline->opcode == ZEND_FETCH_DIM_RW
3625
5.34k
            || opline->opcode == ZEND_FETCH_DIM_W
3626
5.34k
            || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG
3627
5.34k
            || opline->opcode == ZEND_FETCH_LIST_W)) {
3628
5.34k
          j = ssa_vars[ssa_op->result_def].use_chain;
3629
5.34k
          if (j < 0) {
3630
            /* no uses */
3631
0
            tmp |= key_type | MAY_BE_ARRAY | MAY_BE_ARRAY_OF_NULL;
3632
0
          }
3633
10.6k
          while (j >= 0) {
3634
5.34k
            uint8_t opcode;
3635
3636
5.34k
            if (!ssa_opcodes) {
3637
5.34k
              if (j != (opline - op_array->opcodes) + 1) {
3638
                /* Use must be in next opline */
3639
0
                tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3640
0
                break;
3641
0
              }
3642
5.34k
              opcode = op_array->opcodes[j].opcode;
3643
5.34k
            } else {
3644
0
              if (ssa_opcodes[j] != opline + 1) {
3645
                /* Use must be in next opline */
3646
0
                tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3647
0
                break;
3648
0
              }
3649
0
              opcode = ssa_opcodes[j]->opcode;
3650
0
            }
3651
5.34k
            switch (opcode) {
3652
288
              case ZEND_FETCH_DIM_W:
3653
630
              case ZEND_FETCH_DIM_RW:
3654
694
              case ZEND_FETCH_DIM_FUNC_ARG:
3655
694
              case ZEND_FETCH_LIST_W:
3656
2.32k
              case ZEND_ASSIGN_DIM:
3657
2.71k
              case ZEND_ASSIGN_DIM_OP:
3658
2.71k
                tmp |= key_type | MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
3659
2.71k
                break;
3660
0
              case ZEND_SEND_VAR_EX:
3661
842
              case ZEND_SEND_FUNC_ARG:
3662
842
              case ZEND_SEND_VAR_NO_REF:
3663
842
              case ZEND_SEND_VAR_NO_REF_EX:
3664
1.07k
              case ZEND_SEND_REF:
3665
1.91k
              case ZEND_ASSIGN_REF:
3666
1.92k
              case ZEND_YIELD:
3667
1.94k
              case ZEND_INIT_ARRAY:
3668
1.94k
              case ZEND_ADD_ARRAY_ELEMENT:
3669
1.96k
              case ZEND_RETURN_BY_REF:
3670
1.97k
              case ZEND_VERIFY_RETURN_TYPE:
3671
2.26k
              case ZEND_MAKE_REF:
3672
2.26k
              case ZEND_FE_RESET_RW:
3673
2.26k
                tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3674
2.26k
                break;
3675
96
              case ZEND_PRE_INC:
3676
112
              case ZEND_PRE_DEC:
3677
112
              case ZEND_POST_INC:
3678
116
              case ZEND_POST_DEC:
3679
116
                if (tmp & MAY_BE_ARRAY_OF_LONG) {
3680
                  /* may overflow */
3681
116
                  tmp |= key_type | MAY_BE_ARRAY_OF_DOUBLE;
3682
116
                } else if (!(tmp & (MAY_BE_ARRAY_OF_LONG|MAY_BE_ARRAY_OF_DOUBLE))) {
3683
0
                  tmp |= key_type | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_DOUBLE;
3684
0
                }
3685
116
                break;
3686
24
              case ZEND_FETCH_OBJ_W:
3687
24
              case ZEND_FETCH_OBJ_RW:
3688
32
              case ZEND_FETCH_OBJ_FUNC_ARG:
3689
202
              case ZEND_ASSIGN_OBJ:
3690
206
              case ZEND_ASSIGN_OBJ_OP:
3691
224
              case ZEND_ASSIGN_OBJ_REF:
3692
224
              case ZEND_PRE_INC_OBJ:
3693
224
              case ZEND_PRE_DEC_OBJ:
3694
224
              case ZEND_POST_INC_OBJ:
3695
224
              case ZEND_POST_DEC_OBJ:
3696
                /* These will result in an error exception, unless the element
3697
                 * is already an object. */
3698
224
                break;
3699
8
              case ZEND_SEND_VAR:
3700
16
              case ZEND_FETCH_DIM_R:
3701
                /* This can occur if a DIM_FETCH_FUNC_ARG with UNUSED op2 is left
3702
                 * behind, because it can't be converted to DIM_FETCH_R. */
3703
16
                break;
3704
0
              case ZEND_FREE:
3705
                /* This may happen if the using opcode is DCEd.  */
3706
0
                break;
3707
5.34k
              EMPTY_SWITCH_DEFAULT_CASE()
3708
5.34k
            }
3709
5.34k
            j = zend_ssa_next_use(ssa->ops, ssa_op->result_def, j);
3710
5.34k
            if (j >= 0) {
3711
0
              tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3712
0
              break;
3713
0
            }
3714
5.34k
          }
3715
5.34k
          if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) {
3716
4.41k
            tmp &= ~MAY_BE_ARRAY_EMPTY;
3717
4.41k
          }
3718
5.34k
        }
3719
5.66k
        if (!(tmp & MAY_BE_ARRAY)
3720
5.66k
         || (tmp & MAY_BE_ARRAY_KEY_ANY)
3721
5.66k
         || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG
3722
5.66k
         || opline->opcode == ZEND_FETCH_DIM_R
3723
5.66k
         || opline->opcode == ZEND_FETCH_DIM_IS
3724
5.66k
         || opline->opcode == ZEND_FETCH_DIM_UNSET
3725
5.66k
         || opline->opcode == ZEND_FETCH_LIST_R) {
3726
5.64k
          UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3727
5.64k
        } else {
3728
          /* invalid key type */
3729
22
          return SUCCESS;
3730
22
        }
3731
5.64k
        COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3732
5.64k
      }
3733
      /* FETCH_LIST on a string behaves like FETCH_R on null */
3734
16.4k
      tmp = zend_array_element_type(
3735
16.4k
        opline->opcode != ZEND_FETCH_LIST_R ? t1 : ((t1 & ~MAY_BE_STRING) | MAY_BE_NULL),
3736
16.4k
        opline->op1_type,
3737
16.4k
        opline->opcode != ZEND_FETCH_DIM_R && opline->opcode != ZEND_FETCH_DIM_IS
3738
16.4k
          && opline->opcode != ZEND_FETCH_LIST_R,
3739
16.4k
        opline->op2_type == IS_UNUSED);
3740
16.4k
      if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG && (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE))) {
3741
1.01k
        tmp |= MAY_BE_NULL;
3742
1.01k
      }
3743
16.4k
      if (opline->opcode == ZEND_FETCH_DIM_IS && (t1 & MAY_BE_STRING)) {
3744
734
        tmp |= MAY_BE_NULL;
3745
734
      }
3746
16.4k
      if ((tmp & (MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_RCN && opline->result_type == IS_TMP_VAR) {
3747
        /* refcount may be indirectly decremented. Make an exception if the result is used in the next instruction */
3748
870
        if (!ssa_opcodes) {
3749
870
          if (ssa->vars[ssa_op->result_def].use_chain < 0
3750
870
           || opline + 1 != op_array->opcodes + ssa->vars[ssa_op->result_def].use_chain) {
3751
92
            tmp |= MAY_BE_RC1;
3752
92
            }
3753
870
        } else {
3754
0
          if (ssa->vars[ssa_op->result_def].use_chain < 0
3755
0
           || opline + 1 != ssa_opcodes[ssa->vars[ssa_op->result_def].use_chain]) {
3756
0
            tmp |= MAY_BE_RC1;
3757
0
            }
3758
0
        }
3759
870
      }
3760
16.4k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3761
16.4k
      break;
3762
16.4k
    case ZEND_FETCH_THIS:
3763
1.90k
      if (!(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
3764
1.90k
        UPDATE_SSA_OBJ_TYPE(op_array->scope, 1, ssa_op->result_def);
3765
1.90k
      }
3766
1.90k
      UPDATE_SSA_TYPE(MAY_BE_RCN|MAY_BE_OBJECT, ssa_op->result_def);
3767
1.90k
      break;
3768
67.3k
    case ZEND_FETCH_OBJ_R:
3769
68.0k
    case ZEND_FETCH_OBJ_IS:
3770
68.0k
    case ZEND_FETCH_OBJ_RW:
3771
69.9k
    case ZEND_FETCH_OBJ_W:
3772
70.1k
    case ZEND_FETCH_OBJ_UNSET:
3773
70.5k
    case ZEND_FETCH_OBJ_FUNC_ARG:
3774
70.5k
      if (ssa_op->result_def >= 0) {
3775
70.5k
        uint32_t tmp = 0;
3776
70.5k
        ce = NULL;
3777
70.5k
        if (opline->op1_type != IS_UNUSED
3778
70.5k
            && (t1 & (MAY_BE_ANY | MAY_BE_UNDEF) & ~MAY_BE_OBJECT)) {
3779
66.4k
          tmp |= MAY_BE_NULL;
3780
66.4k
        }
3781
70.5k
        if (opline->op1_type == IS_UNUSED || (t1 & MAY_BE_OBJECT)) {
3782
69.9k
          const zend_property_info *prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op);
3783
69.9k
          tmp |= zend_fetch_prop_type(script, prop_info, &ce);
3784
69.9k
          if (opline->opcode != ZEND_FETCH_OBJ_R && opline->opcode != ZEND_FETCH_OBJ_IS) {
3785
2.50k
            tmp |= MAY_BE_REF | MAY_BE_INDIRECT;
3786
2.50k
            if ((opline->extended_value & ZEND_FETCH_OBJ_FLAGS) == ZEND_FETCH_DIM_WRITE) {
3787
806
              tmp |= MAY_BE_UNDEF;
3788
806
            }
3789
2.50k
            ce = NULL;
3790
67.4k
          } else if (!(opline->op1_type & (IS_VAR|IS_TMP_VAR)) || !(t1 & MAY_BE_RC1)) {
3791
62.4k
            const zend_class_entry *ce = NULL;
3792
3793
62.4k
            if (opline->op1_type == IS_UNUSED) {
3794
2.33k
              ce = op_array->scope;
3795
60.0k
            } else if (ssa_op->op1_use >= 0 && !ssa->var_info[ssa_op->op1_use].is_instanceof) {
3796
59.8k
              ce = ssa->var_info[ssa_op->op1_use].ce;
3797
59.8k
            }
3798
            /* Unset properties will resort back to __get/__set */
3799
62.4k
            if (ce
3800
62.4k
             && !ce->create_object
3801
62.4k
             && ce->default_object_handlers->read_property == zend_std_read_property
3802
62.4k
             && !ce->__get
3803
62.4k
             && !result_may_be_separated(ssa, ssa_op)) {
3804
1.98k
              tmp &= ~MAY_BE_RC1;
3805
1.98k
            }
3806
62.4k
            if (opline->opcode == ZEND_FETCH_OBJ_IS) {
3807
              /* IS check may return null for uninitialized typed property. */
3808
558
              tmp |= MAY_BE_NULL;
3809
558
            }
3810
62.4k
          }
3811
69.9k
        }
3812
70.5k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3813
70.5k
        if (ce) {
3814
52
          UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3815
52
        }
3816
70.5k
      }
3817
70.5k
      break;
3818
70.5k
    case ZEND_FETCH_STATIC_PROP_R:
3819
1.72k
    case ZEND_FETCH_STATIC_PROP_IS:
3820
1.72k
    case ZEND_FETCH_STATIC_PROP_RW:
3821
1.92k
    case ZEND_FETCH_STATIC_PROP_W:
3822
1.96k
    case ZEND_FETCH_STATIC_PROP_UNSET:
3823
2.21k
    case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
3824
2.21k
      tmp = zend_fetch_prop_type(script,
3825
2.21k
        zend_fetch_static_prop_info(script, op_array, ssa, opline), &ce);
3826
2.21k
      if (opline->opcode != ZEND_FETCH_STATIC_PROP_R
3827
2.21k
          && opline->opcode != ZEND_FETCH_STATIC_PROP_IS) {
3828
491
        tmp |= MAY_BE_REF | MAY_BE_INDIRECT;
3829
491
        if ((opline->extended_value & ZEND_FETCH_OBJ_FLAGS) == ZEND_FETCH_DIM_WRITE) {
3830
141
          tmp |= MAY_BE_UNDEF;
3831
141
        }
3832
491
        ce = NULL;
3833
1.72k
      } else {
3834
1.72k
        if (!result_may_be_separated(ssa, ssa_op)) {
3835
1.70k
          tmp &= ~MAY_BE_RC1;
3836
1.70k
        }
3837
1.72k
        if (opline->opcode == ZEND_FETCH_STATIC_PROP_IS) {
3838
174
          tmp |= MAY_BE_UNDEF;
3839
174
        }
3840
1.72k
      }
3841
2.21k
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3842
2.21k
      if (ce) {
3843
28
        UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3844
28
      }
3845
2.21k
      break;
3846
0
    case ZEND_FRAMELESS_ICALL_1:
3847
0
    case ZEND_FRAMELESS_ICALL_2:
3848
0
    case ZEND_FRAMELESS_ICALL_3:
3849
0
      if (ssa_op->op1_def >= 0) {
3850
0
        ZEND_ASSERT(ssa_op->op1_use >= 0);
3851
0
        tmp = ssa->var_info[ssa_op->op1_use].type;
3852
0
        if (tmp & MAY_BE_RC1) {
3853
0
          tmp |= MAY_BE_RCN;
3854
0
        }
3855
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3856
0
      }
3857
0
      if (ssa_op->op2_def >= 0) {
3858
0
        ZEND_ASSERT(ssa_op->op2_use >= 0);
3859
0
        tmp = ssa->var_info[ssa_op->op2_use].type;
3860
0
        if (tmp & MAY_BE_RC1) {
3861
0
          tmp |= MAY_BE_RCN;
3862
0
        }
3863
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3864
0
      }
3865
0
      if (opline->opcode == ZEND_FRAMELESS_ICALL_3) {
3866
0
        zend_ssa_op *next_ssa_op = ssa_op + 1;
3867
0
        if (next_ssa_op->op1_def >= 0) {
3868
0
          ZEND_ASSERT(next_ssa_op->op1_use >= 0);
3869
0
          tmp = ssa->var_info[next_ssa_op->op1_use].type;
3870
0
          if (tmp & MAY_BE_RC1) {
3871
0
            tmp |= MAY_BE_RCN;
3872
0
          }
3873
0
          UPDATE_SSA_TYPE(tmp, next_ssa_op->op1_def);
3874
0
        }
3875
0
      }
3876
0
      ZEND_FALLTHROUGH;
3877
0
    case ZEND_FRAMELESS_ICALL_0:
3878
38.4k
    case ZEND_DO_FCALL:
3879
38.4k
    case ZEND_DO_ICALL:
3880
41.7k
    case ZEND_DO_UCALL:
3881
41.7k
    case ZEND_DO_FCALL_BY_NAME:
3882
41.7k
      if (ssa_op->result_def >= 0) {
3883
41.7k
        zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
3884
41.7k
        zend_call_info *call_info;
3885
3886
41.7k
        if (!func_info || !func_info->call_map) {
3887
9.11k
          goto unknown_opcode;
3888
9.11k
        }
3889
32.6k
        call_info = func_info->call_map[opline - op_array->opcodes];
3890
32.6k
        if (!call_info) {
3891
11.7k
          goto unknown_opcode;
3892
11.7k
        }
3893
3894
20.8k
        zend_class_entry *ce;
3895
20.8k
        bool ce_is_instanceof;
3896
20.8k
        tmp = zend_get_func_info(call_info, ssa, &ce, &ce_is_instanceof);
3897
20.8k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3898
20.8k
        if (ce) {
3899
993
          UPDATE_SSA_OBJ_TYPE(ce, ce_is_instanceof, ssa_op->result_def);
3900
993
        }
3901
20.8k
      }
3902
20.8k
      break;
3903
20.8k
    case ZEND_CALLABLE_CONVERT:
3904
341
      UPDATE_SSA_TYPE(MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN, ssa_op->result_def);
3905
341
      UPDATE_SSA_OBJ_TYPE(zend_ce_closure, /* is_instanceof */ false, ssa_op->result_def);
3906
341
      break;
3907
25.2k
    case ZEND_FETCH_CONSTANT:
3908
25.2k
      UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def);
3909
25.2k
      break;
3910
25.2k
    case ZEND_FETCH_CLASS_CONSTANT: {
3911
2.85k
      bool is_prototype;
3912
2.85k
      const zend_class_constant *cc = zend_fetch_class_const_info(script, op_array, opline, &is_prototype);
3913
2.85k
      if (!cc || !ZEND_TYPE_IS_SET(cc->type)) {
3914
2.73k
        UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def);
3915
2.73k
        break;
3916
2.73k
      }
3917
120
      UPDATE_SSA_TYPE(zend_convert_type(script, cc->type, &ce), ssa_op->result_def);
3918
120
      if (ce) {
3919
0
        UPDATE_SSA_OBJ_TYPE(ce, /* is_instanceof */ true, ssa_op->result_def);
3920
0
      }
3921
120
      break;
3922
120
    }
3923
301
    case ZEND_STRLEN:
3924
713
    case ZEND_COUNT:
3925
757
    case ZEND_FUNC_NUM_ARGS:
3926
757
      UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def);
3927
757
      break;
3928
757
    case ZEND_FUNC_GET_ARGS:
3929
130
      UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ARRAY|MAY_BE_ARRAY_EMPTY|MAY_BE_ARRAY_PACKED|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def);
3930
130
      break;
3931
379
    case ZEND_GET_CLASS:
3932
441
    case ZEND_GET_CALLED_CLASS:
3933
441
      UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RCN, ssa_op->result_def);
3934
441
      break;
3935
441
    case ZEND_GET_TYPE:
3936
74
      UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def);
3937
74
      break;
3938
818
    case ZEND_TYPE_CHECK: {
3939
818
      uint32_t expected_type_mask = opline->extended_value;
3940
818
      if (t1 & MAY_BE_UNDEF) {
3941
44
        t1 |= MAY_BE_NULL;
3942
44
      }
3943
818
      tmp = 0;
3944
818
      if (t1 & expected_type_mask) {
3945
728
        tmp |= MAY_BE_TRUE;
3946
728
        if ((t1 & expected_type_mask) & MAY_BE_RESOURCE) {
3947
138
          tmp |= MAY_BE_FALSE;
3948
138
        }
3949
728
      }
3950
818
      if (t1 & (MAY_BE_ANY - expected_type_mask)) {
3951
796
        tmp |= MAY_BE_FALSE;
3952
796
      }
3953
818
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3954
818
      break;
3955
818
    }
3956
818
    case ZEND_DEFINED:
3957
81
      UPDATE_SSA_TYPE(MAY_BE_FALSE|MAY_BE_TRUE, ssa_op->result_def);
3958
81
      break;
3959
1.74k
    case ZEND_VERIFY_RETURN_TYPE:
3960
1.74k
      if (t1 & MAY_BE_REF) {
3961
156
        tmp = t1;
3962
156
        ce = NULL;
3963
1.59k
      } else {
3964
1.59k
        zend_arg_info *ret_info = op_array->arg_info - 1;
3965
1.59k
        tmp = zend_fetch_arg_info_type(script, ret_info, &ce);
3966
1.59k
        if ((tmp & MAY_BE_NULL) && opline->op1_type == IS_CV) {
3967
57
          tmp |= MAY_BE_UNDEF;
3968
57
        }
3969
1.59k
        tmp |= (t1 & MAY_BE_INDIRECT);
3970
3971
        // TODO: We could model more precisely how illegal types are converted.
3972
1.59k
        uint32_t extra_types = t1 & ~tmp;
3973
1.59k
        if (!extra_types) {
3974
1.04k
          tmp &= t1;
3975
1.04k
        }
3976
1.59k
      }
3977
1.74k
      if (opline->op1_type & (IS_TMP_VAR|IS_VAR|IS_CV)) {
3978
1.60k
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3979
1.60k
        if (ce) {
3980
228
          UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->op1_def);
3981
1.37k
        } else {
3982
1.37k
          UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->op1_def);
3983
1.37k
        }
3984
1.60k
      } else {
3985
148
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3986
148
        if (ce) {
3987
24
          UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3988
124
        } else {
3989
124
          UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3990
124
        }
3991
148
      }
3992
1.74k
      break;
3993
1.74k
    case ZEND_MAKE_REF:
3994
941
      tmp = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3995
941
      UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3996
941
      if (ssa_op->op1_def >= 0) {
3997
242
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3998
242
      }
3999
941
      break;
4000
941
    case ZEND_CATCH:
4001
      /* Forbidden opcodes */
4002
0
      ZEND_UNREACHABLE();
4003
0
      break;
4004
286
    case ZEND_FETCH_CLASS_NAME:
4005
286
      UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RCN, ssa_op->result_def);
4006
286
      break;
4007
286
    case ZEND_ISSET_ISEMPTY_THIS:
4008
80
      UPDATE_SSA_TYPE(MAY_BE_BOOL, ssa_op->result_def);
4009
80
      break;
4010
6.08k
    case ZEND_DECLARE_LAMBDA_FUNCTION:
4011
6.08k
      UPDATE_SSA_TYPE(MAY_BE_OBJECT|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def);
4012
6.08k
      UPDATE_SSA_OBJ_TYPE(zend_ce_closure, /* is_instanceof */ false, ssa_op->result_def);
4013
6.08k
      break;
4014
0
    case ZEND_PRE_DEC_STATIC_PROP:
4015
14
    case ZEND_PRE_INC_STATIC_PROP:
4016
28
    case ZEND_POST_DEC_STATIC_PROP:
4017
104
    case ZEND_POST_INC_STATIC_PROP: {
4018
104
      if (ssa_op->result_def >= 0) {
4019
104
        const zend_property_info *prop_info = zend_fetch_static_prop_info(script, op_array, ssa, opline);
4020
104
        zend_class_entry *prop_ce;
4021
104
        tmp = zend_fetch_prop_type(script, prop_info, &prop_ce);
4022
        /* Internal objects may result in essentially anything. */
4023
104
        if (tmp & MAY_BE_OBJECT) {
4024
96
          goto unknown_opcode;
4025
96
        }
4026
8
        tmp &= MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_BOOL|MAY_BE_NULL;
4027
8
        if (tmp & MAY_BE_STRING) {
4028
0
          tmp |= MAY_BE_RC1 | MAY_BE_RCN;
4029
0
        }
4030
8
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
4031
8
      }
4032
8
      break;
4033
104
    }
4034
26
    case ZEND_SPACESHIP:
4035
26
      UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def);
4036
26
      break;
4037
265
    case ZEND_FETCH_GLOBALS:
4038
265
      UPDATE_SSA_TYPE(MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def);
4039
265
      break;
4040
1.42k
    default:
4041
#ifdef ZEND_DEBUG_TYPE_INFERENCE
4042
      if (ssa_op->result_def >= 0) {
4043
        switch (opline->opcode) {
4044
          case ZEND_FETCH_R:
4045
          case ZEND_FETCH_W:
4046
          case ZEND_FETCH_RW:
4047
          case ZEND_FETCH_IS:
4048
          case ZEND_FETCH_UNSET:
4049
          case ZEND_YIELD_FROM:
4050
          /* Currently unimplemented due to some assumptions in JIT. See:
4051
           * https://github.com/php/php-src/pull/13304#issuecomment-1926668141 */
4052
          case ZEND_SEPARATE:
4053
            break;
4054
          default:
4055
            fprintf(stderr, "Missing result type inference for opcode %s, line %d\n", zend_get_opcode_name(opline->opcode), opline->lineno);
4056
            break;
4057
        }
4058
      }
4059
      if (ssa_op->op1_def >= 0) {
4060
        fprintf(stderr, "Missing op1 type inference for opcode %s, line %d\n", zend_get_opcode_name(opline->opcode), opline->lineno);
4061
      }
4062
      if (ssa_op->op2_def >= 0) {
4063
        fprintf(stderr, "Missing op2 type inference for opcode %s, line %d\n", zend_get_opcode_name(opline->opcode), opline->lineno);
4064
      }
4065
#endif
4066
1.42k
      if (ssa_op->op1_def >= 0) {
4067
0
        tmp = MAY_BE_ANY | MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
4068
0
        UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
4069
0
      }
4070
22.3k
unknown_opcode:
4071
22.3k
      if (ssa_op->result_def >= 0) {
4072
22.3k
        tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
4073
22.3k
        if (opline->result_type == IS_TMP_VAR) {
4074
639
          if (opline->opcode == ZEND_FETCH_R || opline->opcode == ZEND_FETCH_IS) {
4075
            /* Variable reference counter may be decremented before use */
4076
            /* See: ext/opcache/tests/jit/fetch_r_001.phpt */
4077
82
            tmp |= MAY_BE_RC1 | MAY_BE_RCN;
4078
557
          } else {
4079
557
            tmp |= MAY_BE_RC1 | MAY_BE_RCN;
4080
557
          }
4081
21.7k
        } else if (opline->result_type == IS_CV) {
4082
0
          tmp |= MAY_BE_RC1 | MAY_BE_RCN;
4083
21.7k
        } else {
4084
21.7k
          tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN;
4085
21.7k
          switch (opline->opcode) {
4086
556
            case ZEND_FETCH_W:
4087
572
            case ZEND_FETCH_RW:
4088
579
            case ZEND_FETCH_FUNC_ARG:
4089
583
            case ZEND_FETCH_UNSET:
4090
583
            case ZEND_FETCH_DIM_W:
4091
583
            case ZEND_FETCH_DIM_RW:
4092
583
            case ZEND_FETCH_DIM_FUNC_ARG:
4093
583
            case ZEND_FETCH_DIM_UNSET:
4094
583
            case ZEND_FETCH_OBJ_W:
4095
583
            case ZEND_FETCH_OBJ_RW:
4096
583
            case ZEND_FETCH_OBJ_FUNC_ARG:
4097
583
            case ZEND_FETCH_OBJ_UNSET:
4098
583
            case ZEND_FETCH_STATIC_PROP_W:
4099
583
            case ZEND_FETCH_STATIC_PROP_RW:
4100
583
            case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
4101
583
            case ZEND_FETCH_STATIC_PROP_UNSET:
4102
583
              tmp |= MAY_BE_INDIRECT;
4103
583
              break;
4104
21.7k
          }
4105
21.7k
        }
4106
22.3k
        UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
4107
22.3k
      }
4108
22.3k
      break;
4109
859k
  }
4110
4111
859k
  return SUCCESS;
4112
859k
}
4113
4114
ZEND_API zend_result zend_update_type_info(
4115
      const zend_op_array *op_array,
4116
      zend_ssa            *ssa,
4117
      const zend_script   *script,
4118
      zend_op             *opline,
4119
      zend_ssa_op         *ssa_op,
4120
      const zend_op      **ssa_opcodes,
4121
      zend_long            optimization_level)
4122
0
{
4123
0
  return _zend_update_type_info(op_array, ssa, script, NULL, opline, ssa_op, ssa_opcodes, optimization_level, 0);
4124
0
}
4125
4126
0
static uint32_t get_class_entry_rank(zend_class_entry *ce) {
4127
0
  uint32_t rank = 0;
4128
0
  if (ce->ce_flags & ZEND_ACC_LINKED) {
4129
0
    while (ce->parent) {
4130
0
      rank++;
4131
0
      ce = ce->parent;
4132
0
    }
4133
0
  }
4134
0
  return rank;
4135
0
}
4136
4137
/* Compute least common ancestor on class inheritance tree only */
4138
static zend_class_entry *join_class_entries(
4139
63.3k
    zend_class_entry *ce1, zend_class_entry *ce2, int *is_instanceof) {
4140
63.3k
  uint32_t rank1, rank2;
4141
63.3k
  if (ce1 == ce2) {
4142
63.2k
    return ce1;
4143
63.2k
  }
4144
52
  if (!ce1 || !ce2) {
4145
52
    return NULL;
4146
52
  }
4147
4148
0
  rank1 = get_class_entry_rank(ce1);
4149
0
  rank2 = get_class_entry_rank(ce2);
4150
4151
0
  while (rank1 != rank2) {
4152
0
    if (rank1 > rank2) {
4153
0
      ce1 = !(ce1->ce_flags & ZEND_ACC_LINKED) ? NULL : ce1->parent;
4154
0
      rank1--;
4155
0
    } else {
4156
0
      ce2 = !(ce2->ce_flags & ZEND_ACC_LINKED) ? NULL : ce2->parent;
4157
0
      rank2--;
4158
0
    }
4159
0
  }
4160
4161
0
  while (ce1 != ce2) {
4162
0
    ce1 = !(ce1->ce_flags & ZEND_ACC_LINKED) ? NULL : ce1->parent;
4163
0
    ce2 = !(ce2->ce_flags & ZEND_ACC_LINKED) ? NULL : ce2->parent;
4164
0
  }
4165
4166
0
  if (ce1) {
4167
0
    *is_instanceof = 1;
4168
0
  }
4169
0
  return ce1;
4170
52
}
4171
4172
0
static bool safe_instanceof(zend_class_entry *ce1, zend_class_entry *ce2) {
4173
0
  if (ce1 == ce2) {
4174
0
    return 1;
4175
0
  }
4176
0
  if (!(ce1->ce_flags & ZEND_ACC_LINKED)) {
4177
    /* This case could be generalized, similarly to unlinked_instanceof */
4178
0
    return 0;
4179
0
  }
4180
0
  return instanceof_function(ce1, ce2);
4181
0
}
4182
4183
static zend_result zend_infer_types_ex(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_bitset worklist, zend_long optimization_level)
4184
74.1k
{
4185
74.1k
  zend_basic_block *blocks = ssa->cfg.blocks;
4186
74.1k
  zend_ssa_var *ssa_vars = ssa->vars;
4187
74.1k
  zend_ssa_var_info *ssa_var_info = ssa->var_info;
4188
74.1k
  int ssa_vars_count = ssa->vars_count;
4189
74.1k
  int i, j;
4190
74.1k
  uint32_t tmp, worklist_len = zend_bitset_len(ssa_vars_count);
4191
74.1k
  bool update_worklist = 1;
4192
74.1k
  const zend_op **ssa_opcodes = NULL;
4193
4194
1.13M
  while (!zend_bitset_empty(worklist, worklist_len)) {
4195
1.05M
    j = zend_bitset_first(worklist, worklist_len);
4196
1.05M
    zend_bitset_excl(worklist, j);
4197
1.05M
    if (ssa_vars[j].definition_phi) {
4198
192k
      zend_ssa_phi *p = ssa_vars[j].definition_phi;
4199
192k
      if (p->pi >= 0) {
4200
56.4k
        zend_class_entry *ce = ssa_var_info[p->sources[0]].ce;
4201
56.4k
        int is_instanceof = ssa_var_info[p->sources[0]].is_instanceof;
4202
56.4k
        tmp = get_ssa_var_info(ssa, p->sources[0]);
4203
4204
56.4k
        if (!p->has_range_constraint) {
4205
45.8k
          zend_ssa_type_constraint *constraint = &p->constraint.type;
4206
45.8k
          tmp &= constraint->type_mask;
4207
45.8k
          if (!(tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
4208
1.83k
            tmp &= ~(MAY_BE_RC1|MAY_BE_RCN);
4209
1.83k
          }
4210
45.8k
          if ((tmp & MAY_BE_OBJECT) && constraint->ce && ce != constraint->ce) {
4211
25
            if (!ce) {
4212
25
              ce = constraint->ce;
4213
25
              is_instanceof = 1;
4214
25
            } else if (is_instanceof && safe_instanceof(constraint->ce, ce)) {
4215
0
              ce = constraint->ce;
4216
0
            } else {
4217
              /* Ignore the constraint (either ce instanceof constraint->ce or
4218
               * they are unrelated, as far as we can statically determine) */
4219
0
            }
4220
25
          }
4221
45.8k
        }
4222
4223
56.4k
        UPDATE_SSA_TYPE(tmp, j);
4224
56.4k
        if (tmp & MAY_BE_REF) {
4225
33.4k
          UPDATE_SSA_OBJ_TYPE(NULL, 0, j);
4226
33.4k
        } else {
4227
23.0k
          UPDATE_SSA_OBJ_TYPE(ce, is_instanceof, j);
4228
23.0k
        }
4229
136k
      } else {
4230
136k
        int first = 1;
4231
136k
        int is_instanceof = 0;
4232
136k
        zend_class_entry *ce = NULL;
4233
4234
136k
        tmp = 0;
4235
414k
        for (i = 0; i < blocks[p->block].predecessors_count; i++) {
4236
277k
          tmp |= get_ssa_var_info(ssa, p->sources[i]);
4237
277k
        }
4238
136k
        UPDATE_SSA_TYPE(tmp, j);
4239
414k
        for (i = 0; i < blocks[p->block].predecessors_count; i++) {
4240
277k
          zend_ssa_var_info *info;
4241
4242
277k
          ZEND_ASSERT(p->sources[i] >= 0);
4243
277k
          info = &ssa_var_info[p->sources[i]];
4244
277k
          if (info->type & MAY_BE_OBJECT) {
4245
171k
            if (first) {
4246
107k
              ce = info->ce;
4247
107k
              is_instanceof = info->is_instanceof;
4248
107k
              first = 0;
4249
107k
            } else {
4250
63.3k
              is_instanceof |= info->is_instanceof;
4251
63.3k
              ce = join_class_entries(ce, info->ce, &is_instanceof);
4252
63.3k
            }
4253
171k
          }
4254
277k
        }
4255
136k
        UPDATE_SSA_OBJ_TYPE(ce, ce ? is_instanceof : 0, j);
4256
136k
      }
4257
863k
    } else if (ssa_vars[j].definition >= 0) {
4258
863k
      i = ssa_vars[j].definition;
4259
863k
      if (_zend_update_type_info(op_array, ssa, script, worklist, op_array->opcodes + i, ssa->ops + i, NULL, optimization_level, 1) == FAILURE) {
4260
0
        return FAILURE;
4261
0
      }
4262
863k
    }
4263
1.05M
  }
4264
74.1k
  return SUCCESS;
4265
74.1k
}
4266
4267
2.72k
static bool is_narrowable_instr(zend_op *opline)  {
4268
2.72k
  return opline->opcode == ZEND_ADD || opline->opcode == ZEND_SUB
4269
2.72k
    || opline->opcode == ZEND_MUL || opline->opcode == ZEND_DIV;
4270
2.72k
}
4271
4272
0
static bool is_effective_op1_double_cast(zend_op *opline, zval *op2) {
4273
0
  return (opline->opcode == ZEND_ADD && Z_LVAL_P(op2) == 0)
4274
0
    || (opline->opcode == ZEND_SUB && Z_LVAL_P(op2) == 0)
4275
0
    || (opline->opcode == ZEND_MUL && Z_LVAL_P(op2) == 1)
4276
0
    || (opline->opcode == ZEND_DIV && Z_LVAL_P(op2) == 1);
4277
0
}
4278
10
static bool is_effective_op2_double_cast(zend_op *opline, zval *op1) {
4279
  /* In PHP it holds that (double)(0-$int) is bitwise identical to 0.0-(double)$int,
4280
   * so allowing SUB here is fine. */
4281
10
  return (opline->opcode == ZEND_ADD && Z_LVAL_P(op1) == 0)
4282
10
    || (opline->opcode == ZEND_SUB && Z_LVAL_P(op1) == 0)
4283
10
    || (opline->opcode == ZEND_MUL && Z_LVAL_P(op1) == 1);
4284
10
}
4285
4286
/* This function recursively checks whether it's possible to convert an integer variable
4287
 * initialization to a double initialization. The basic idea is that if the value is used
4288
 * only in add/sub/mul/div ("narrowable" instructions) with a double result value, then it
4289
 * will be cast to double at that point anyway, so we may as well do it earlier already.
4290
 *
4291
 * The tricky case are chains of operations, where it's not necessarily a given that converting
4292
 * an integer to double before the chain of operations is the same as converting it after the
4293
 * chain. What this function does is detect two cases where it is safe:
4294
 *  * If the operations only involve constants, then we can simply verify that performing the
4295
 *    calculation on integers and doubles yields the same value.
4296
 *  * Even if one operand is not known, we may be able to determine that the operations with the
4297
 *    integer replaced by a double only acts as an effective double cast on the unknown operand.
4298
 *    E.g. 0+$i and 0.0+$i only differ by that cast. If then the consuming instruction of this
4299
 *    result will perform a double cast anyway, the conversion is safe.
4300
 *
4301
 * The checks happens recursively, while keeping track of which variables are already visited to
4302
 * avoid infinite loops. An iterative, worklist driven approach would be possible, but the state
4303
 * management more cumbersome to implement, so we don't bother for now.
4304
 */
4305
static bool can_convert_to_double(
4306
    const zend_op_array *op_array, zend_ssa *ssa, int var_num,
4307
5.36k
    zval *value, zend_bitset visited) {
4308
5.36k
  zend_ssa_var *var = &ssa->vars[var_num];
4309
5.36k
  zend_ssa_phi *phi;
4310
5.36k
  int use;
4311
5.36k
  uint32_t type;
4312
4313
5.36k
  if (zend_bitset_in(visited, var_num)) {
4314
4
    return 1;
4315
4
  }
4316
5.36k
  zend_bitset_incl(visited, var_num);
4317
4318
5.58k
  for (use = var->use_chain; use >= 0; use = zend_ssa_next_use(ssa->ops, var_num, use)) {
4319
2.94k
    zend_op *opline = &op_array->opcodes[use];
4320
2.94k
    zend_ssa_op *ssa_op = &ssa->ops[use];
4321
4322
2.94k
    if (zend_ssa_is_no_val_use(opline, ssa_op, var_num)) {
4323
218
      continue;
4324
218
    }
4325
4326
2.72k
    if (!is_narrowable_instr(opline)) {
4327
2.57k
      return 0;
4328
2.57k
    }
4329
4330
    /* Instruction always returns double, the conversion is certainly fine */
4331
148
    type = ssa->var_info[ssa_op->result_def].type;
4332
148
    if ((type & MAY_BE_ANY) == MAY_BE_DOUBLE) {
4333
6
      continue;
4334
6
    }
4335
4336
    /* UNDEF signals that the previous result is an effective double cast, this is only allowed
4337
     * if this instruction would have done the cast anyway (previous check). */
4338
142
    if (Z_ISUNDEF_P(value)) {
4339
0
      return 0;
4340
0
    }
4341
4342
    /* Check that narrowing can actually be useful */
4343
142
    if ((type & MAY_BE_ANY) & ~(MAY_BE_LONG|MAY_BE_DOUBLE)) {
4344
100
      return 0;
4345
100
    }
4346
4347
42
    {
4348
      /* For calculation on original values */
4349
42
      zval orig_op1, orig_op2, orig_result;
4350
      /* For calculation with var_num cast to double */
4351
42
      zval dval_op1, dval_op2, dval_result;
4352
4353
42
      ZVAL_UNDEF(&orig_op1);
4354
42
      ZVAL_UNDEF(&dval_op1);
4355
42
      if (ssa_op->op1_use == var_num) {
4356
42
        ZVAL_COPY_VALUE(&orig_op1, value);
4357
42
        ZVAL_DOUBLE(&dval_op1, (double) Z_LVAL_P(value));
4358
42
      } else if (opline->op1_type == IS_CONST) {
4359
0
        zval *zv = CRT_CONSTANT(opline->op1);
4360
0
        if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_DOUBLE) {
4361
0
          ZVAL_COPY_VALUE(&orig_op1, zv);
4362
0
          ZVAL_COPY_VALUE(&dval_op1, zv);
4363
0
        }
4364
0
      }
4365
4366
42
      ZVAL_UNDEF(&orig_op2);
4367
42
      ZVAL_UNDEF(&dval_op2);
4368
42
      if (ssa_op->op2_use == var_num) {
4369
0
        ZVAL_COPY_VALUE(&orig_op2, value);
4370
0
        ZVAL_DOUBLE(&dval_op2, (double) Z_LVAL_P(value));
4371
42
      } else if (opline->op2_type == IS_CONST) {
4372
32
        zval *zv = CRT_CONSTANT(opline->op2);
4373
32
        if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_DOUBLE) {
4374
32
          ZVAL_COPY_VALUE(&orig_op2, zv);
4375
32
          ZVAL_COPY_VALUE(&dval_op2, zv);
4376
32
        }
4377
32
      }
4378
4379
42
      ZEND_ASSERT(!Z_ISUNDEF(orig_op1) || !Z_ISUNDEF(orig_op2));
4380
42
      if (Z_ISUNDEF(orig_op1)) {
4381
0
        if (opline->opcode == ZEND_MUL && Z_LVAL(orig_op2) == 0) {
4382
0
          ZVAL_LONG(&orig_result, 0);
4383
0
        } else if (is_effective_op1_double_cast(opline, &orig_op2)) {
4384
0
          ZVAL_UNDEF(&orig_result);
4385
0
        } else {
4386
0
          return 0;
4387
0
        }
4388
42
      } else if (Z_ISUNDEF(orig_op2)) {
4389
10
        if (opline->opcode == ZEND_MUL && Z_LVAL(orig_op1) == 0) {
4390
0
          ZVAL_LONG(&orig_result, 0);
4391
10
        } else if (is_effective_op2_double_cast(opline, &orig_op1)) {
4392
6
          ZVAL_UNDEF(&orig_result);
4393
6
        } else {
4394
4
          return 0;
4395
4
        }
4396
32
      } else {
4397
32
        uint8_t opcode = opline->opcode;
4398
4399
32
        if (opcode == ZEND_ASSIGN_OP) {
4400
0
          opcode = opline->extended_value;
4401
0
        }
4402
4403
        /* Avoid division by zero */
4404
32
        if (opcode == ZEND_DIV && zval_get_double(&orig_op2) == 0.0) {
4405
0
          return 0;
4406
0
        }
4407
4408
32
        get_binary_op(opcode)(&orig_result, &orig_op1, &orig_op2);
4409
32
        get_binary_op(opcode)(&dval_result, &dval_op1, &dval_op2);
4410
32
        ZEND_ASSERT(Z_TYPE(dval_result) == IS_DOUBLE);
4411
32
        if (zval_get_double(&orig_result) != Z_DVAL(dval_result)) {
4412
4
          return 0;
4413
4
        }
4414
32
      }
4415
4416
34
      if (!can_convert_to_double(op_array, ssa, ssa_op->result_def, &orig_result, visited)) {
4417
32
        return 0;
4418
32
      }
4419
34
    }
4420
34
  }
4421
4422
2.65k
  for (phi = var->phi_use_chain; phi; phi = zend_ssa_next_use_phi(ssa, var_num, phi)) {
4423
    /* Check that narrowing can actually be useful */
4424
2.64k
    type = ssa->var_info[phi->ssa_var].type;
4425
2.64k
    if ((type & MAY_BE_ANY) & ~(MAY_BE_LONG|MAY_BE_DOUBLE)) {
4426
328
      return 0;
4427
328
    }
4428
4429
2.31k
    if (!can_convert_to_double(op_array, ssa, phi->ssa_var, value, visited)) {
4430
2.30k
      return 0;
4431
2.30k
    }
4432
2.31k
  }
4433
4434
10
  return 1;
4435
2.64k
}
4436
4437
static zend_result zend_type_narrowing(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level)
4438
74.1k
{
4439
74.1k
  uint32_t bitset_len = zend_bitset_len(ssa->vars_count);
4440
74.1k
  zend_bitset visited, worklist;
4441
74.1k
  int i, v;
4442
74.1k
  zend_op *opline;
4443
74.1k
  bool narrowed = 0;
4444
74.1k
  ALLOCA_FLAG(use_heap)
4445
4446
74.1k
  visited = ZEND_BITSET_ALLOCA(2 * bitset_len, use_heap);
4447
74.1k
  worklist = visited + bitset_len;
4448
4449
74.1k
  zend_bitset_clear(worklist, bitset_len);
4450
4451
1.09M
  for (v = op_array->last_var; v < ssa->vars_count; v++) {
4452
1.02M
    if ((ssa->var_info[v].type & (MAY_BE_REF | MAY_BE_ANY | MAY_BE_UNDEF)) != MAY_BE_LONG) continue;
4453
30.9k
    if (ssa->vars[v].definition < 0) continue;
4454
25.2k
    if (ssa->vars[v].no_val) continue;
4455
23.4k
    opline = op_array->opcodes + ssa->vars[v].definition;
4456
    /* Go through assignments of literal integers and check if they can be converted to
4457
     * doubles instead, in the hope that we'll narrow long|double to double. */
4458
23.4k
    if (opline->opcode == ZEND_ASSIGN && opline->result_type == IS_UNUSED &&
4459
23.4k
        opline->op1_type == IS_CV && opline->op2_type == IS_CONST) {
4460
3.01k
      zval *value = CRT_CONSTANT(opline->op2);
4461
4462
3.01k
      zend_bitset_clear(visited, bitset_len);
4463
3.01k
      if (can_convert_to_double(op_array, ssa, v, value, visited)) {
4464
2
        narrowed = 1;
4465
2
        ssa->var_info[v].use_as_double = 1;
4466
        /* The "visited" vars are exactly those which may change their type due to
4467
         * narrowing. Reset their types and add them to the type inference worklist */
4468
20
        ZEND_BITSET_FOREACH(visited, bitset_len, i) {
4469
6
          ssa->var_info[i].type &= ~MAY_BE_ANY;
4470
6
        } ZEND_BITSET_FOREACH_END();
4471
2
        zend_bitset_union(worklist, visited, bitset_len);
4472
2
      }
4473
3.01k
    }
4474
23.4k
  }
4475
4476
74.1k
  if (!narrowed) {
4477
74.1k
    free_alloca(visited, use_heap);
4478
74.1k
    return SUCCESS;
4479
74.1k
  }
4480
4481
2
  if (zend_infer_types_ex(op_array, script, ssa, worklist, optimization_level) == FAILURE) {
4482
0
    free_alloca(visited, use_heap);
4483
0
    return FAILURE;
4484
0
  }
4485
4486
2
  free_alloca(visited, use_heap);
4487
2
  return SUCCESS;
4488
2
}
4489
4490
static bool is_recursive_tail_call(const zend_op_array *op_array,
4491
                                  zend_op             *opline)
4492
71.6k
{
4493
71.6k
  zend_func_info *info = ZEND_FUNC_INFO(op_array);
4494
4495
71.6k
  if (info->ssa.ops && info->ssa.vars && info->call_map &&
4496
71.6k
      info->ssa.ops[opline - op_array->opcodes].op1_use >= 0 &&
4497
71.6k
      info->ssa.vars[info->ssa.ops[opline - op_array->opcodes].op1_use].definition >= 0) {
4498
4499
1.95k
    zend_op *op = op_array->opcodes + info->ssa.vars[info->ssa.ops[opline - op_array->opcodes].op1_use].definition;
4500
4501
1.95k
    if (op->opcode == ZEND_DO_UCALL) {
4502
138
      zend_call_info *call_info = info->call_map[op - op_array->opcodes];
4503
138
      if (call_info && op_array == &call_info->callee_func->op_array) {
4504
9
        return 1;
4505
9
      }
4506
138
    }
4507
1.95k
  }
4508
71.6k
  return 0;
4509
71.6k
}
4510
4511
uint32_t zend_get_return_info_from_signature_only(
4512
    const zend_function *func, const zend_script *script,
4513
26.3k
    zend_class_entry **ce, bool *ce_is_instanceof, bool use_tentative_return_info) {
4514
26.3k
  uint32_t type;
4515
26.3k
  if (func->common.fn_flags & ZEND_ACC_HAS_RETURN_TYPE &&
4516
26.3k
    (use_tentative_return_info || !ZEND_ARG_TYPE_IS_TENTATIVE(func->common.arg_info - 1))
4517
26.3k
  ) {
4518
20.5k
    zend_arg_info *ret_info = func->common.arg_info - 1;
4519
20.5k
    type = zend_fetch_arg_info_type(script, ret_info, ce);
4520
20.5k
    *ce_is_instanceof = ce != NULL;
4521
20.5k
  } else {
4522
5.78k
    type = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF
4523
5.78k
      | MAY_BE_RC1 | MAY_BE_RCN;
4524
5.78k
    *ce = NULL;
4525
5.78k
    *ce_is_instanceof = false;
4526
5.78k
  }
4527
4528
  /* For generators RETURN_REFERENCE refers to the yielded values. */
4529
26.3k
  if ((func->common.fn_flags & ZEND_ACC_RETURN_REFERENCE)
4530
26.3k
      && !(func->common.fn_flags & ZEND_ACC_GENERATOR)) {
4531
1.02k
    type |= MAY_BE_REF;
4532
1.02k
    *ce = NULL;
4533
1.02k
    *ce_is_instanceof = 0;
4534
1.02k
  }
4535
26.3k
  return type;
4536
26.3k
}
4537
4538
ZEND_API void zend_init_func_return_info(
4539
  const zend_op_array *op_array, const zend_script *script, zend_ssa_var_info *ret)
4540
6.52k
{
4541
6.52k
  ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE));
4542
4543
6.52k
  zend_ssa_range tmp_range = {0, 0, 0, 0};
4544
6.52k
  bool is_instanceof = false;
4545
6.52k
  ret->type = zend_get_return_info_from_signature_only(
4546
6.52k
    (zend_function *) op_array, script, &ret->ce, &is_instanceof, /* use_tentative_return_info */ 1);
4547
6.52k
  ret->is_instanceof = is_instanceof;
4548
6.52k
  ret->range = tmp_range;
4549
6.52k
  ret->has_range = 0;
4550
6.52k
}
4551
4552
static void zend_func_return_info(const zend_op_array   *op_array,
4553
                                  const zend_script     *script,
4554
                                  int                    recursive,
4555
                                  int                    widening,
4556
                                  zend_ssa_var_info     *ret)
4557
74.1k
{
4558
74.1k
  zend_func_info *info = ZEND_FUNC_INFO(op_array);
4559
74.1k
  zend_ssa *ssa = &info->ssa;
4560
74.1k
  int blocks_count = info->ssa.cfg.blocks_count;
4561
74.1k
  zend_basic_block *blocks = info->ssa.cfg.blocks;
4562
74.1k
  int j;
4563
74.1k
  uint32_t t1;
4564
74.1k
  uint32_t tmp = 0;
4565
74.1k
  zend_class_entry *tmp_ce = NULL;
4566
74.1k
  int tmp_is_instanceof = -1;
4567
74.1k
  zend_class_entry *arg_ce;
4568
74.1k
  int arg_is_instanceof;
4569
74.1k
  zend_ssa_range tmp_range = {0, 0, 0, 0};
4570
74.1k
  int tmp_has_range = -1;
4571
4572
74.1k
  if (op_array->fn_flags & ZEND_ACC_GENERATOR) {
4573
1.62k
    ret->type = MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
4574
1.62k
    ret->ce = zend_ce_generator;
4575
1.62k
    ret->is_instanceof = 0;
4576
1.62k
    ret->range = tmp_range;
4577
1.62k
    ret->has_range = 0;
4578
1.62k
    return;
4579
1.62k
  }
4580
4581
72.5k
  if (!ret->type) {
4582
    /* We will intersect the type later. */
4583
66.2k
    ret->type = MAY_BE_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_KEY_ANY
4584
66.2k
      | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF;
4585
66.2k
  }
4586
4587
286k
  for (j = 0; j < blocks_count; j++) {
4588
214k
    if ((blocks[j].flags & ZEND_BB_REACHABLE) && blocks[j].len != 0) {
4589
214k
      zend_op *opline = op_array->opcodes + blocks[j].start + blocks[j].len - 1;
4590
4591
214k
      if (opline->opcode == ZEND_RETURN || opline->opcode == ZEND_RETURN_BY_REF) {
4592
71.6k
        zend_ssa_op *ssa_op = ssa->ops ? &ssa->ops[opline - op_array->opcodes] : NULL;
4593
71.6k
        if (!recursive && ssa_op && info->ssa.var_info &&
4594
71.6k
            ssa_op->op1_use >= 0 &&
4595
71.6k
            info->ssa.var_info[ssa_op->op1_use].recursive) {
4596
0
          continue;
4597
0
        }
4598
71.6k
        if (is_recursive_tail_call(op_array, opline)) {
4599
9
          continue;
4600
9
        }
4601
71.6k
        t1 = OP1_INFO();
4602
71.6k
        if (t1 & MAY_BE_UNDEF) {
4603
180
          t1 |= MAY_BE_NULL;
4604
180
        }
4605
71.6k
        if (opline->opcode == ZEND_RETURN) {
4606
70.8k
          if (t1 & MAY_BE_RC1) {
4607
5.39k
            t1 |= MAY_BE_RCN;
4608
5.39k
          }
4609
70.8k
          t1 &= ~(MAY_BE_UNDEF | MAY_BE_REF);
4610
70.8k
        } else {
4611
831
          t1 |= MAY_BE_REF;
4612
831
          t1 &= ~(MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN);
4613
831
        }
4614
71.6k
        tmp |= t1;
4615
4616
71.6k
        if (ssa_op && info->ssa.var_info &&
4617
71.6k
            ssa_op->op1_use >= 0 && !(t1 & MAY_BE_REF) &&
4618
71.6k
            info->ssa.var_info[ssa_op->op1_use].ce) {
4619
1.50k
          arg_ce = info->ssa.var_info[ssa_op->op1_use].ce;
4620
1.50k
          arg_is_instanceof = info->ssa.var_info[ssa_op->op1_use].is_instanceof;
4621
70.1k
        } else {
4622
70.1k
          arg_ce = NULL;
4623
70.1k
          arg_is_instanceof = 0;
4624
70.1k
        }
4625
4626
71.6k
        if (tmp_is_instanceof < 0) {
4627
70.1k
          tmp_ce = arg_ce;
4628
70.1k
          tmp_is_instanceof = arg_is_instanceof;
4629
70.1k
        } else if (arg_ce && arg_ce == tmp_ce) {
4630
16
          if (tmp_is_instanceof != arg_is_instanceof) {
4631
0
            tmp_is_instanceof = 1;
4632
0
          }
4633
1.47k
        } else {
4634
1.47k
          tmp_ce = NULL;
4635
1.47k
          tmp_is_instanceof = 0;
4636
1.47k
        }
4637
4638
71.6k
        if (opline->op1_type == IS_CONST) {
4639
63.2k
          zval *zv = CRT_CONSTANT(opline->op1);
4640
4641
63.2k
          if (Z_TYPE_P(zv) == IS_LONG) {
4642
35.7k
            if (tmp_has_range < 0) {
4643
35.4k
              tmp_has_range = 1;
4644
35.4k
              tmp_range.underflow = 0;
4645
35.4k
              tmp_range.min = Z_LVAL_P(zv);
4646
35.4k
              tmp_range.max = Z_LVAL_P(zv);
4647
35.4k
              tmp_range.overflow = 0;
4648
35.4k
            } else if (tmp_has_range) {
4649
122
              if (!tmp_range.underflow) {
4650
62
                tmp_range.min = MIN(tmp_range.min, Z_LVAL_P(zv));
4651
62
              }
4652
122
              if (!tmp_range.overflow) {
4653
62
                tmp_range.max = MAX(tmp_range.max, Z_LVAL_P(zv));
4654
62
              }
4655
122
            }
4656
35.7k
          } else {
4657
27.5k
            tmp_has_range = 0;
4658
27.5k
          }
4659
63.2k
        } else if (ssa_op && info->ssa.var_info && ssa_op->op1_use >= 0) {
4660
8.37k
          if (info->ssa.var_info[ssa_op->op1_use].has_range) {
4661
7.96k
            if (tmp_has_range < 0) {
4662
7.53k
              tmp_has_range = 1;
4663
7.53k
              tmp_range = info->ssa.var_info[ssa_op->op1_use].range;
4664
7.53k
            } else if (tmp_has_range) {
4665
              /* union */
4666
334
              if (info->ssa.var_info[ssa_op->op1_use].range.underflow) {
4667
332
                tmp_range.underflow = 1;
4668
332
                tmp_range.min = ZEND_LONG_MIN;
4669
332
              } else {
4670
2
                tmp_range.min = MIN(tmp_range.min, info->ssa.var_info[ssa_op->op1_use].range.min);
4671
2
              }
4672
334
              if (info->ssa.var_info[ssa_op->op1_use].range.overflow) {
4673
332
                tmp_range.overflow = 1;
4674
332
                tmp_range.max = ZEND_LONG_MAX;
4675
332
              } else {
4676
2
                tmp_range.max = MAX(tmp_range.max, info->ssa.var_info[ssa_op->op1_use].range.max);
4677
2
              }
4678
334
            }
4679
7.96k
          } else if (!widening) {
4680
416
            tmp_has_range = 1;
4681
416
            tmp_range.underflow = 1;
4682
416
            tmp_range.min = ZEND_LONG_MIN;
4683
416
            tmp_range.max = ZEND_LONG_MAX;
4684
416
            tmp_range.overflow = 1;
4685
416
          }
4686
8.37k
        } else {
4687
0
          tmp_has_range = 0;
4688
0
        }
4689
71.6k
      }
4690
214k
    }
4691
214k
  }
4692
4693
72.5k
  if (!(op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE)) {
4694
66.1k
    if (tmp_is_instanceof < 0) {
4695
2.18k
      tmp_is_instanceof = 0;
4696
2.18k
      tmp_ce = NULL;
4697
2.18k
    }
4698
66.1k
    if (tmp_has_range < 0) {
4699
2.18k
      tmp_has_range = 0;
4700
2.18k
    }
4701
66.1k
    ret->ce = tmp_ce;
4702
66.1k
    ret->is_instanceof = tmp_is_instanceof;
4703
66.1k
  }
4704
72.5k
  ret->type &= tmp;
4705
72.5k
  ret->range = tmp_range;
4706
72.5k
  ret->has_range = tmp_has_range;
4707
72.5k
}
4708
4709
static zend_result zend_infer_types(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level)
4710
74.1k
{
4711
74.1k
  int ssa_vars_count = ssa->vars_count;
4712
74.1k
  int j;
4713
74.1k
  zend_bitset worklist;
4714
74.1k
  ALLOCA_FLAG(use_heap);
4715
4716
74.1k
  worklist = do_alloca(sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count), use_heap);
4717
74.1k
  memset(worklist, 0, sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count));
4718
4719
  /* Type Inference */
4720
1.09M
  for (j = op_array->last_var; j < ssa_vars_count; j++) {
4721
1.02M
    zend_bitset_incl(worklist, j);
4722
1.02M
  }
4723
4724
74.1k
  if (zend_infer_types_ex(op_array, script, ssa, worklist, optimization_level) == FAILURE) {
4725
0
    free_alloca(worklist,  use_heap);
4726
0
    return FAILURE;
4727
0
  }
4728
4729
74.1k
  if (optimization_level & ZEND_OPTIMIZER_NARROW_TO_DOUBLE) {
4730
    /* Narrowing integer initialization to doubles */
4731
74.1k
    zend_type_narrowing(op_array, script, ssa, optimization_level);
4732
74.1k
  }
4733
4734
74.1k
  if (ZEND_FUNC_INFO(op_array)) {
4735
74.1k
    zend_func_return_info(op_array, script, 1, 0, &ZEND_FUNC_INFO(op_array)->return_info);
4736
74.1k
  }
4737
4738
74.1k
  free_alloca(worklist,  use_heap);
4739
74.1k
  return SUCCESS;
4740
74.1k
}
4741
4742
static void zend_mark_cv_references(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa)
4743
74.1k
{
4744
74.1k
  int var, def;
4745
74.1k
  const zend_op *opline;
4746
74.1k
  zend_arg_info *arg_info;
4747
74.1k
  uint32_t worklist_len = zend_bitset_len(ssa->vars_count);
4748
74.1k
  zend_bitset worklist;
4749
74.1k
  ALLOCA_FLAG(use_heap);
4750
4751
74.1k
  worklist = do_alloca(sizeof(zend_ulong) * worklist_len, use_heap);
4752
74.1k
  memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
4753
4754
  /* Collect SSA variables which definitions creates PHP reference */
4755
1.20M
  for (var = 0; var < ssa->vars_count; var++) {
4756
1.12M
    def = ssa->vars[var].definition;
4757
1.12M
    if (def >= 0 && ssa->vars[var].var < op_array->last_var) {
4758
130k
      opline = op_array->opcodes + def;
4759
130k
      if (ssa->ops[def].result_def == var) {
4760
23.3k
        switch (opline->opcode) {
4761
20.2k
          case ZEND_RECV:
4762
23.0k
          case ZEND_RECV_INIT:
4763
23.0k
            arg_info = &op_array->arg_info[opline->op1.num-1];
4764
23.0k
            if (!ZEND_ARG_SEND_MODE(arg_info)) {
4765
21.5k
              continue;
4766
21.5k
            }
4767
1.46k
            break;
4768
1.46k
          default:
4769
350
            continue;
4770
23.3k
        }
4771
107k
      } else if (ssa->ops[def].op1_def == var) {
4772
102k
        switch (opline->opcode) {
4773
1.53k
          case ZEND_ASSIGN_REF:
4774
1.67k
          case ZEND_MAKE_REF:
4775
2.23k
          case ZEND_FE_RESET_RW:
4776
2.88k
          case ZEND_BIND_GLOBAL:
4777
4.85k
          case ZEND_SEND_REF:
4778
10.9k
          case ZEND_SEND_VAR_EX:
4779
10.9k
          case ZEND_SEND_FUNC_ARG:
4780
11.1k
          case ZEND_BIND_INIT_STATIC_OR_JMP:
4781
11.1k
            break;
4782
163
          case ZEND_INIT_ARRAY:
4783
203
          case ZEND_ADD_ARRAY_ELEMENT:
4784
203
            if (!(opline->extended_value & ZEND_ARRAY_ELEMENT_REF)) {
4785
0
              continue;
4786
0
            }
4787
203
            break;
4788
5.90k
          case ZEND_BIND_STATIC:
4789
5.90k
            if (!(opline->extended_value & ZEND_BIND_REF)) {
4790
4.94k
              continue;
4791
4.94k
            }
4792
965
            break;
4793
965
          case ZEND_YIELD:
4794
52
            if (!(op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE)) {
4795
0
              continue;
4796
0
            }
4797
52
            break;
4798
249
          case ZEND_OP_DATA:
4799
249
            switch ((opline-1)->opcode) {
4800
215
              case ZEND_ASSIGN_OBJ_REF:
4801
249
              case ZEND_ASSIGN_STATIC_PROP_REF:
4802
249
                break;
4803
0
              default:
4804
0
                continue;
4805
249
            }
4806
249
            break;
4807
85.2k
          default:
4808
85.2k
            continue;
4809
102k
        }
4810
102k
      } else if (ssa->ops[def].op2_def == var) {
4811
4.48k
        switch (opline->opcode) {
4812
957
          case ZEND_ASSIGN_REF:
4813
1.59k
          case ZEND_FE_FETCH_RW:
4814
1.59k
            break;
4815
480
          case ZEND_BIND_LEXICAL:
4816
480
            if (!(opline->extended_value & ZEND_BIND_REF)) {
4817
0
              continue;
4818
0
            }
4819
480
            break;
4820
2.41k
          default:
4821
2.41k
            continue;
4822
4.48k
        }
4823
4.48k
      } else {
4824
0
        ZEND_UNREACHABLE();
4825
0
      }
4826
16.1k
      zend_bitset_incl(worklist, var);
4827
996k
    } else if (ssa->var_info[var].type & MAY_BE_REF) {
4828
55.7k
      zend_bitset_incl(worklist, var);
4829
941k
    } else if (ssa->vars[var].alias == SYMTABLE_ALIAS) {
4830
0
      zend_bitset_incl(worklist, var);
4831
0
    }
4832
1.12M
  }
4833
4834
  /* Set and propagate MAY_BE_REF */
4835
3.17M
  WHILE_WORKLIST(worklist, worklist_len, var) {
4836
4837
3.17M
    ssa->var_info[var].type |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
4838
4839
3.17M
    if (ssa->vars[var].phi_use_chain) {
4840
88.7k
      zend_ssa_phi *p = ssa->vars[var].phi_use_chain;
4841
121k
      do {
4842
121k
        if (!(ssa->var_info[p->ssa_var].type & MAY_BE_REF)) {
4843
109k
          zend_bitset_incl(worklist, p->ssa_var);
4844
109k
        }
4845
121k
        p = zend_ssa_next_use_phi(ssa, var, p);
4846
121k
      } while (p);
4847
88.7k
    }
4848
4849
3.17M
    if (ssa->vars[var].use_chain >= 0) {
4850
165k
      int use = ssa->vars[var].use_chain;
4851
429k
      FOREACH_USE(&ssa->vars[var], use) {
4852
429k
        zend_ssa_op *op = ssa->ops + use;
4853
429k
        if (op->op1_use == var && op->op1_def >= 0) {
4854
60.7k
          if (!(ssa->var_info[op->op1_def].type & MAY_BE_REF)) {
4855
            /* Unset breaks references (outside global scope). */
4856
56.7k
            if (op_array->opcodes[use].opcode == ZEND_UNSET_CV
4857
56.7k
                && op_array->function_name) {
4858
70
              continue;
4859
70
            }
4860
56.6k
            zend_bitset_incl(worklist, op->op1_def);
4861
56.6k
          }
4862
60.7k
        }
4863
263k
        if (op->op2_use == var && op->op2_def >= 0) {
4864
3.37k
          if (!(ssa->var_info[op->op2_def].type & MAY_BE_REF)) {
4865
1.94k
            zend_bitset_incl(worklist, op->op2_def);
4866
1.94k
          }
4867
3.37k
        }
4868
263k
        if (op->result_use == var && op->result_def >= 0) {
4869
0
          if (!(ssa->var_info[op->result_def].type & MAY_BE_REF)) {
4870
0
            zend_bitset_incl(worklist, op->result_def);
4871
0
          }
4872
0
        }
4873
263k
      } FOREACH_USE_END();
4874
165k
    }
4875
3.17M
  } WHILE_WORKLIST_END();
4876
4877
74.1k
  free_alloca(worklist,  use_heap);
4878
74.1k
}
4879
4880
ZEND_API zend_result zend_ssa_inference(zend_arena **arena, const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level) /* {{{ */
4881
74.1k
{
4882
74.1k
  zend_ssa_var_info *ssa_var_info;
4883
74.1k
  int i;
4884
4885
74.1k
  if (!ssa->var_info) {
4886
74.1k
    ssa->var_info = zend_arena_calloc(arena, ssa->vars_count, sizeof(zend_ssa_var_info));
4887
74.1k
  }
4888
74.1k
  ssa_var_info = ssa->var_info;
4889
4890
74.1k
  if (!op_array->function_name) {
4891
91.4k
    for (i = 0; i < op_array->last_var; i++) {
4892
55.7k
      ssa_var_info[i].type = MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY  | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
4893
55.7k
      ssa_var_info[i].has_range = 0;
4894
55.7k
    }
4895
38.3k
  } else {
4896
87.1k
    for (i = 0; i < op_array->last_var; i++) {
4897
48.7k
      ssa_var_info[i].type = MAY_BE_UNDEF;
4898
48.7k
      ssa_var_info[i].has_range = 0;
4899
48.7k
      if (ssa->vars[i].alias) {
4900
0
        ssa_var_info[i].type |= get_ssa_alias_types(ssa->vars[i].alias);
4901
0
      }
4902
48.7k
    }
4903
38.3k
  }
4904
1.09M
  for (i = op_array->last_var; i < ssa->vars_count; i++) {
4905
1.02M
    ssa_var_info[i].type = 0;
4906
1.02M
    ssa_var_info[i].has_range = 0;
4907
1.02M
  }
4908
4909
74.1k
  zend_mark_cv_references(op_array, script, ssa);
4910
4911
74.1k
  zend_infer_ranges(op_array, ssa);
4912
4913
74.1k
  if (zend_infer_types(op_array, script, ssa, optimization_level) == FAILURE) {
4914
0
    return FAILURE;
4915
0
  }
4916
4917
74.1k
  return SUCCESS;
4918
74.1k
}
4919
/* }}} */
4920
4921
ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op, const zend_op_array *op_array, const zend_ssa *ssa, uint32_t t1, uint32_t t2)
4922
47.8k
{
4923
47.8k
  if (opline->op1_type == IS_CV) {
4924
16.1k
    if (t1 & MAY_BE_UNDEF) {
4925
8.67k
      switch (opline->opcode) {
4926
0
        case ZEND_UNSET_VAR:
4927
0
        case ZEND_ISSET_ISEMPTY_VAR:
4928
0
          return 1;
4929
2
        case ZEND_ISSET_ISEMPTY_DIM_OBJ:
4930
2
        case ZEND_ISSET_ISEMPTY_PROP_OBJ:
4931
5.49k
        case ZEND_ASSIGN:
4932
5.66k
        case ZEND_ASSIGN_DIM:
4933
5.66k
        case ZEND_ASSIGN_REF:
4934
5.66k
        case ZEND_BIND_GLOBAL:
4935
5.71k
        case ZEND_BIND_STATIC:
4936
5.71k
        case ZEND_BIND_INIT_STATIC_OR_JMP:
4937
5.81k
        case ZEND_FETCH_DIM_IS:
4938
5.81k
        case ZEND_FETCH_OBJ_IS:
4939
5.81k
        case ZEND_SEND_REF:
4940
6.15k
        case ZEND_UNSET_CV:
4941
6.15k
        case ZEND_ISSET_ISEMPTY_CV:
4942
6.15k
        case ZEND_MAKE_REF:
4943
6.15k
        case ZEND_FETCH_DIM_W:
4944
6.15k
          break;
4945
2.51k
        default:
4946
          /* undefined variable warning */
4947
2.51k
          return 1;
4948
8.67k
      }
4949
8.67k
    }
4950
31.7k
  } else if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
4951
26.0k
    if ((t1 & MAY_BE_RC1)
4952
26.0k
     && (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) {
4953
16.8k
      switch (opline->opcode) {
4954
10
        case ZEND_CASE:
4955
10
        case ZEND_CASE_STRICT:
4956
10
        case ZEND_FE_FETCH_R:
4957
10
        case ZEND_FE_FETCH_RW:
4958
10
        case ZEND_FETCH_LIST_R:
4959
10
        case ZEND_QM_ASSIGN:
4960
10
        case ZEND_SEND_VAL:
4961
10
        case ZEND_SEND_VAL_EX:
4962
10
        case ZEND_SEND_VAR:
4963
10
        case ZEND_SEND_VAR_EX:
4964
10
        case ZEND_SEND_FUNC_ARG:
4965
10
        case ZEND_SEND_VAR_NO_REF:
4966
10
        case ZEND_SEND_VAR_NO_REF_EX:
4967
10
        case ZEND_SEND_REF:
4968
10
        case ZEND_SEPARATE:
4969
10
        case ZEND_END_SILENCE:
4970
10
        case ZEND_MAKE_REF:
4971
10
          break;
4972
16.8k
        default:
4973
          /* destructor may be called */
4974
16.8k
          return 1;
4975
16.8k
      }
4976
16.8k
    }
4977
26.0k
  }
4978
4979
28.4k
  if (opline->op2_type == IS_CV) {
4980
1.71k
    if (t2 & MAY_BE_UNDEF) {
4981
891
      switch (opline->opcode) {
4982
0
        case ZEND_ASSIGN_REF:
4983
0
        case ZEND_FE_FETCH_R:
4984
0
        case ZEND_FE_FETCH_RW:
4985
0
          break;
4986
891
        default:
4987
          /* undefined variable warning */
4988
891
          return 1;
4989
891
      }
4990
891
    }
4991
26.7k
  } else if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
4992
4.89k
    if ((t2 & MAY_BE_RC1)
4993
4.89k
     && (t2 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) {
4994
572
      switch (opline->opcode) {
4995
214
        case ZEND_ASSIGN:
4996
214
        case ZEND_FE_FETCH_R:
4997
214
        case ZEND_FE_FETCH_RW:
4998
214
          break;
4999
358
        default:
5000
          /* destructor may be called */
5001
358
          return 1;
5002
572
      }
5003
572
    }
5004
4.89k
  }
5005
5006
27.2k
  switch (opline->opcode) {
5007
2.59k
    case ZEND_NOP:
5008
4.13k
    case ZEND_QM_ASSIGN:
5009
4.13k
    case ZEND_JMP:
5010
4.18k
    case ZEND_CHECK_VAR:
5011
4.18k
    case ZEND_MAKE_REF:
5012
4.18k
    case ZEND_BEGIN_SILENCE:
5013
4.18k
    case ZEND_END_SILENCE:
5014
9.59k
    case ZEND_FREE:
5015
10.2k
    case ZEND_FE_FREE:
5016
10.2k
    case ZEND_SEPARATE:
5017
10.3k
    case ZEND_TYPE_CHECK:
5018
10.3k
    case ZEND_DEFINED:
5019
10.3k
    case ZEND_ISSET_ISEMPTY_THIS:
5020
10.3k
    case ZEND_COALESCE:
5021
10.3k
    case ZEND_SWITCH_LONG:
5022
10.3k
    case ZEND_SWITCH_STRING:
5023
10.3k
    case ZEND_MATCH:
5024
10.3k
    case ZEND_ISSET_ISEMPTY_VAR:
5025
10.3k
    case ZEND_ISSET_ISEMPTY_CV:
5026
10.3k
    case ZEND_FUNC_NUM_ARGS:
5027
10.3k
    case ZEND_FUNC_GET_ARGS:
5028
10.3k
    case ZEND_COPY_TMP:
5029
10.3k
    case ZEND_JMP_NULL:
5030
10.3k
    case ZEND_JMP_FRAMELESS:
5031
10.3k
      return 0;
5032
21
    case ZEND_IS_IDENTICAL:
5033
41
    case ZEND_IS_NOT_IDENTICAL:
5034
41
    case ZEND_CASE_STRICT:
5035
      /* Array to array comparison may lead to recursion. */
5036
41
      return (t1 & t2) & MAY_BE_ARRAY_OF_ARRAY;
5037
0
    case ZEND_SEND_VAR:
5038
0
    case ZEND_SEND_VAL:
5039
0
    case ZEND_SEND_REF:
5040
0
    case ZEND_SEND_VAR_EX:
5041
0
    case ZEND_SEND_FUNC_ARG:
5042
0
    case ZEND_CHECK_FUNC_ARG:
5043
      /* May throw for named params. */
5044
0
      return opline->op2_type == IS_CONST;
5045
0
    case ZEND_INIT_FCALL:
5046
      /* can't throw, because call is resolved at compile time */
5047
0
      return 0;
5048
0
    case ZEND_BIND_GLOBAL:
5049
0
      if ((opline+1)->opcode == ZEND_BIND_GLOBAL) {
5050
0
        return zend_may_throw(opline + 1, ssa_op ? ssa_op + 1 : NULL, op_array, ssa);
5051
0
      }
5052
0
      return 0;
5053
995
    case ZEND_ADD:
5054
995
      if ((t1 & MAY_BE_ANY) == MAY_BE_ARRAY
5055
995
       && (t2 & MAY_BE_ANY) == MAY_BE_ARRAY) {
5056
14
        return 0;
5057
14
      }
5058
981
      return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5059
981
        (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5060
30
    case ZEND_DIV:
5061
30
      if (!OP2_HAS_RANGE() ||
5062
30
        (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) {
5063
        /* Division by zero */
5064
20
        return 1;
5065
20
      }
5066
10
      ZEND_FALLTHROUGH;
5067
275
    case ZEND_SUB:
5068
889
    case ZEND_MUL:
5069
889
    case ZEND_POW:
5070
889
      return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5071
889
        (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5072
    /* Ops may throw if not an integer */
5073
398
    case ZEND_MOD:
5074
398
      if (!OP2_HAS_RANGE() ||
5075
398
        (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) {
5076
        /* Division by zero */
5077
176
        return 1;
5078
176
      }
5079
222
      ZEND_FALLTHROUGH;
5080
254
    case ZEND_SL:
5081
313
    case ZEND_SR:
5082
313
      return (t1 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5083
313
        (t2 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5084
313
        !OP2_HAS_RANGE() ||
5085
313
        OP2_MIN_RANGE() < 0;
5086
755
    case ZEND_CONCAT:
5087
792
    case ZEND_FAST_CONCAT:
5088
792
      return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) ||
5089
792
        (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
5090
76
    case ZEND_BW_OR:
5091
298
    case ZEND_BW_AND:
5092
341
    case ZEND_BW_XOR:
5093
341
      if ((t1 & MAY_BE_ANY) == MAY_BE_STRING
5094
341
       && (t2 & MAY_BE_ANY) == MAY_BE_STRING) {
5095
91
        return 0;
5096
91
      }
5097
250
      return (t1 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5098
250
        (t2 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5099
408
    case ZEND_BW_NOT:
5100
408
      return (t1 & (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5101
1.34k
    case ZEND_PRE_INC:
5102
1.60k
    case ZEND_POST_INC:
5103
1.60k
      return (t1 & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5104
    /* null emits a warning as it has no effect compared to ++ which converts the value to 1 */
5105
67
    case ZEND_PRE_DEC:
5106
147
    case ZEND_POST_DEC:
5107
147
      return (t1 & (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5108
95
    case ZEND_BOOL_NOT:
5109
95
    case ZEND_JMPZ:
5110
95
    case ZEND_JMPNZ:
5111
95
    case ZEND_JMPZ_EX:
5112
95
    case ZEND_JMPNZ_EX:
5113
295
    case ZEND_BOOL:
5114
295
    case ZEND_JMP_SET:
5115
295
      return (t1 & MAY_BE_OBJECT);
5116
24
    case ZEND_BOOL_XOR:
5117
24
      return (t1 & MAY_BE_OBJECT) || (t2 & MAY_BE_OBJECT);
5118
89
    case ZEND_IS_EQUAL:
5119
283
    case ZEND_IS_NOT_EQUAL:
5120
414
    case ZEND_IS_SMALLER:
5121
428
    case ZEND_IS_SMALLER_OR_EQUAL:
5122
438
    case ZEND_CASE:
5123
438
    case ZEND_SPACESHIP:
5124
438
      if ((t1 & MAY_BE_ANY) == MAY_BE_NULL
5125
438
       || (t2 & MAY_BE_ANY) == MAY_BE_NULL) {
5126
61
        return 0;
5127
61
      }
5128
377
      return (t1 & (MAY_BE_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_OBJECT)) || (t2 & (MAY_BE_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_OBJECT));
5129
9
    case ZEND_ASSIGN_OP:
5130
9
      if (opline->extended_value == ZEND_ADD) {
5131
9
        if ((t1 & MAY_BE_ANY) == MAY_BE_ARRAY
5132
9
         && (t2 & MAY_BE_ANY) == MAY_BE_ARRAY) {
5133
0
          return 0;
5134
0
        }
5135
9
        return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5136
9
          (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5137
9
      } else if (opline->extended_value == ZEND_DIV ||
5138
0
        opline->extended_value == ZEND_MOD) {
5139
0
        if (!OP2_HAS_RANGE() ||
5140
0
          (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) {
5141
          /* Division by zero */
5142
0
          return 1;
5143
0
        }
5144
0
        return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5145
0
          (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5146
0
      } else if (opline->extended_value == ZEND_SUB ||
5147
0
        opline->extended_value == ZEND_MUL ||
5148
0
        opline->extended_value == ZEND_POW) {
5149
0
        return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5150
0
          (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5151
0
      } else if (opline->extended_value == ZEND_SL ||
5152
0
        opline->extended_value == ZEND_SR) {
5153
0
        return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5154
0
          (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5155
0
          !OP2_HAS_RANGE() ||
5156
0
          OP2_MIN_RANGE() < 0;
5157
0
      } else if (opline->extended_value == ZEND_CONCAT) {
5158
0
        return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) ||
5159
0
          (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
5160
0
      } else if (opline->extended_value == ZEND_BW_OR ||
5161
0
        opline->extended_value == ZEND_BW_AND ||
5162
0
        opline->extended_value == ZEND_BW_XOR) {
5163
0
        if ((t1 & MAY_BE_ANY) == MAY_BE_STRING
5164
0
         && (t2 & MAY_BE_ANY) == MAY_BE_STRING) {
5165
0
          return 0;
5166
0
        }
5167
0
        return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5168
0
          (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5169
0
      }
5170
0
      return 1;
5171
9.03k
    case ZEND_ASSIGN:
5172
9.03k
      if (t1 & MAY_BE_REF) {
5173
0
        return 1;
5174
0
      }
5175
9.03k
      ZEND_FALLTHROUGH;
5176
9.03k
    case ZEND_UNSET_VAR:
5177
9.03k
      return (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY));
5178
46
    case ZEND_BIND_STATIC:
5179
46
    case ZEND_BIND_INIT_STATIC_OR_JMP:
5180
46
      if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY)) {
5181
        /* Destructor may throw. */
5182
2
        return 1;
5183
2
      }
5184
44
      return 0;
5185
171
    case ZEND_ASSIGN_DIM:
5186
171
      if ((opline+1)->op1_type == IS_CV) {
5187
82
        if (OP1_DATA_INFO() & MAY_BE_UNDEF) {
5188
78
          return 1;
5189
78
        }
5190
82
      }
5191
93
      if (t1 & (MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_REF)) {
5192
9
        return 1;
5193
9
      }
5194
84
      return (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_TRUE|MAY_BE_FALSE|MAY_BE_STRING|MAY_BE_LONG|MAY_BE_DOUBLE)) || opline->op2_type == IS_UNUSED ||
5195
84
        (t2 & (MAY_BE_UNDEF|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5196
88
    case ZEND_ASSIGN_OBJ:
5197
88
      if (t1 & (MAY_BE_ANY-MAY_BE_OBJECT)) {
5198
4
        return 1;
5199
4
      }
5200
84
      if ((opline+1)->op1_type == IS_CV) {
5201
24
        if (OP1_DATA_INFO() & MAY_BE_UNDEF) {
5202
18
          return 1;
5203
18
        }
5204
24
      }
5205
66
      if (ssa_op->op1_use) {
5206
66
        const zend_ssa_var_info *var_info = ssa->var_info + ssa_op->op1_use;
5207
66
        const zend_class_entry *ce = var_info->ce;
5208
5209
66
        if (var_info->is_instanceof
5210
66
         || !ce
5211
66
         || ce->create_object
5212
66
         || ce->default_object_handlers->write_property != zend_std_write_property
5213
66
         || ce->default_object_handlers->get_property_ptr_ptr != zend_std_get_property_ptr_ptr
5214
66
         || ce->__get
5215
66
         || ce->__set
5216
66
         || ce->parent) {
5217
24
          return 1;
5218
24
        }
5219
5220
42
        if (opline->op2_type != IS_CONST) {
5221
0
          return 1;
5222
0
        }
5223
5224
42
        zend_string *prop_name = Z_STR_P(CRT_CONSTANT(opline->op2));
5225
42
        if (ZSTR_LEN(prop_name) > 0 && ZSTR_VAL(prop_name)[0] == '\0') {
5226
0
          return 1;
5227
0
        }
5228
5229
42
        zend_property_info *prop_info =
5230
42
          zend_hash_find_ptr(&ce->properties_info, prop_name);
5231
42
        if (prop_info) {
5232
10
          if (ZEND_TYPE_IS_SET(prop_info->type)) {
5233
6
            return 1;
5234
6
          }
5235
4
          return !(prop_info->flags & ZEND_ACC_PUBLIC)
5236
4
            && prop_info->ce != op_array->scope;
5237
32
        } else {
5238
32
          return !(ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES);
5239
32
        }
5240
42
      }
5241
0
      return 1;
5242
0
    case ZEND_ROPE_INIT:
5243
0
    case ZEND_ROPE_ADD:
5244
0
    case ZEND_ROPE_END:
5245
0
      return t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT);
5246
163
    case ZEND_INIT_ARRAY:
5247
163
      return (opline->op2_type != IS_UNUSED) && (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5248
155
    case ZEND_ADD_ARRAY_ELEMENT:
5249
155
      return (opline->op2_type == IS_UNUSED) || (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5250
0
    case ZEND_STRLEN:
5251
0
      return (t1 & MAY_BE_ANY) != MAY_BE_STRING;
5252
41
    case ZEND_COUNT:
5253
41
      return (t1 & MAY_BE_ANY) != MAY_BE_ARRAY;
5254
0
    case ZEND_RECV_INIT:
5255
0
      if (Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_CONSTANT_AST) {
5256
0
        return 1;
5257
0
      }
5258
0
      if (op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) {
5259
0
        uint32_t arg_num = opline->op1.num;
5260
0
        const zend_arg_info *cur_arg_info;
5261
5262
0
        if (EXPECTED(arg_num <= op_array->num_args)) {
5263
0
          cur_arg_info = &op_array->arg_info[arg_num-1];
5264
0
        } else if (UNEXPECTED(op_array->fn_flags & ZEND_ACC_VARIADIC)) {
5265
0
          cur_arg_info = &op_array->arg_info[op_array->num_args];
5266
0
        } else {
5267
0
          return 0;
5268
0
        }
5269
0
        return ZEND_TYPE_IS_SET(cur_arg_info->type);
5270
0
      } else {
5271
0
        return 0;
5272
0
      }
5273
0
    case ZEND_FETCH_IS:
5274
0
      return (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
5275
110
    case ZEND_ISSET_ISEMPTY_DIM_OBJ:
5276
110
      return (t1 & MAY_BE_OBJECT) || (t2 & (MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT));
5277
93
    case ZEND_FETCH_DIM_IS:
5278
93
      return (t1 & MAY_BE_OBJECT) || (t2 & (MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5279
34
    case ZEND_CAST:
5280
34
      switch (opline->extended_value) {
5281
8
        case IS_LONG:
5282
8
        case IS_DOUBLE:
5283
8
          return (t1 & MAY_BE_OBJECT);
5284
26
        case IS_STRING:
5285
26
          return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
5286
0
        case IS_ARRAY:
5287
0
          return (t1 & MAY_BE_OBJECT);
5288
0
        case IS_OBJECT:
5289
0
          return 0;
5290
34
        EMPTY_SWITCH_DEFAULT_CASE()
5291
34
      }
5292
      /* GCC is getting confused here for the Wimplicit-fallthrough warning with
5293
       * EMPTY_SWITCH_DEFAULT_CASE() macro */
5294
0
      return 0;
5295
0
    case ZEND_ARRAY_KEY_EXISTS:
5296
0
      if ((t2 & MAY_BE_ANY) != MAY_BE_ARRAY) {
5297
0
        return 1;
5298
0
      }
5299
0
      if ((t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
5300
0
        return 1;
5301
0
      }
5302
0
      return 0;
5303
0
    case ZEND_FE_RESET_R:
5304
0
    case ZEND_FE_RESET_RW:
5305
0
      if ((t1 & (MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
5306
0
        return 1;
5307
0
      }
5308
0
      return 0;
5309
0
    case ZEND_FE_FETCH_R:
5310
0
      if ((t1 & (MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
5311
0
        return 1;
5312
0
      }
5313
0
      if (opline->op2_type == IS_CV
5314
0
       && (t2 & MAY_BE_RC1)
5315
0
       && (t2 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) {
5316
0
        return 1;
5317
0
      }
5318
0
      return 0;
5319
0
    case ZEND_FETCH_DIM_W:
5320
0
    case ZEND_FETCH_LIST_W:
5321
0
      if (t1 & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)) {
5322
0
        return 1;
5323
0
      }
5324
0
      if (t2 & (MAY_BE_RESOURCE|MAY_BE_ARRAY|MAY_BE_OBJECT)) {
5325
0
        return 1;
5326
0
      }
5327
0
      if (opline->op2_type == IS_UNUSED) {
5328
0
        return 1;
5329
0
      }
5330
0
      return 0;
5331
415
    default:
5332
415
      return 1;
5333
27.2k
  }
5334
27.2k
}
5335
5336
ZEND_API bool zend_may_throw(const zend_op *opline, const zend_ssa_op *ssa_op, const zend_op_array *op_array, const zend_ssa *ssa)
5337
47.8k
{
5338
47.8k
  return zend_may_throw_ex(opline, ssa_op, op_array, ssa, OP1_INFO(), OP2_INFO());
5339
47.8k
}