/src/php-src/Zend/Optimizer/zend_inference.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | +----------------------------------------------------------------------+ |
3 | | | Zend Engine, e-SSA based Type & Range Inference | |
4 | | +----------------------------------------------------------------------+ |
5 | | | Copyright (c) The PHP Group | |
6 | | +----------------------------------------------------------------------+ |
7 | | | This source file is subject to version 3.01 of the PHP license, | |
8 | | | that is bundled with this package in the file LICENSE, and is | |
9 | | | available through the world-wide-web at the following url: | |
10 | | | https://www.php.net/license/3_01.txt | |
11 | | | If you did not receive a copy of the PHP license and are unable to | |
12 | | | obtain it through the world-wide-web, please send a note to | |
13 | | | license@php.net so we can mail you a copy immediately. | |
14 | | +----------------------------------------------------------------------+ |
15 | | | Authors: Dmitry Stogov <dmitry@php.net> | |
16 | | +----------------------------------------------------------------------+ |
17 | | */ |
18 | | |
19 | | #include "zend_compile.h" |
20 | | #include "zend_generators.h" |
21 | | #include "zend_inference.h" |
22 | | #include "zend_func_info.h" |
23 | | #include "zend_call_graph.h" |
24 | | #include "zend_closures.h" |
25 | | #include "zend_worklist.h" |
26 | | #include "zend_optimizer_internal.h" |
27 | | |
28 | | /* The used range inference algorithm is described in: |
29 | | * V. Campos, R. Rodrigues, I. de Assis Costa and F. Pereira. |
30 | | * "Speed and Precision in Range Analysis", SBLP'12. |
31 | | * |
32 | | * There are a couple degrees of freedom, we use: |
33 | | * * Propagation on SCCs. |
34 | | * * e-SSA for live range splitting. |
35 | | * * Only intra-procedural inference. |
36 | | * * Widening with warmup passes, but without jump sets. |
37 | | */ |
38 | | |
39 | | /* Whether to handle symbolic range constraints */ |
40 | | #define SYM_RANGE |
41 | | |
42 | | /* Whether to handle negative range constraints */ |
43 | | /* Negative range inference is buggy, so disabled for now */ |
44 | | #undef NEG_RANGE |
45 | | |
46 | | /* Number of warmup passes to use prior to widening */ |
47 | 251k | #define RANGE_WARMUP_PASSES 16 |
48 | | |
49 | | /* Logging for range inference in general */ |
50 | | #if 0 |
51 | | #define LOG_SSA_RANGE(...) fprintf(stderr, __VA_ARGS__) |
52 | | #else |
53 | | #define LOG_SSA_RANGE(...) |
54 | | #endif |
55 | | |
56 | | /* Logging for negative range constraints */ |
57 | | #if 0 |
58 | | #define LOG_NEG_RANGE(...) fprintf(stderr, __VA_ARGS__) |
59 | | #else |
60 | | #define LOG_NEG_RANGE(...) |
61 | | #endif |
62 | | |
63 | | /* Pop elements in unspecified order from worklist until it is empty */ |
64 | 393k | #define WHILE_WORKLIST(worklist, len, i) do { \ |
65 | 393k | bool _done = 0; \ |
66 | 1.07M | while (!_done) { \ |
67 | 686k | _done = 1; \ |
68 | 7.91M | ZEND_BITSET_FOREACH(worklist, len, i) { \ |
69 | 1.35M | zend_bitset_excl(worklist, i); \ |
70 | 1.35M | _done = 0; |
71 | | |
72 | | #define WHILE_WORKLIST_END() \ |
73 | 1.35M | } ZEND_BITSET_FOREACH_END(); \ |
74 | 686k | } \ |
75 | 393k | } while (0) |
76 | | |
77 | | #define CHECK_SCC_VAR(var2) \ |
78 | | do { \ |
79 | | if (!ssa->vars[var2].no_val) { \ |
80 | | if (ssa->vars[var2].scc < 0) { \ |
81 | | zend_ssa_check_scc_var(op_array, ssa, var2, index, stack); \ |
82 | | } \ |
83 | | if (ssa->vars[var2].scc < ssa->vars[var].scc) { \ |
84 | | ssa->vars[var].scc = ssa->vars[var2].scc; \ |
85 | | is_root = 0; \ |
86 | | } \ |
87 | | } \ |
88 | | } while (0) |
89 | | |
90 | | #define CHECK_SCC_ENTRY(var2) \ |
91 | 1.24M | do { \ |
92 | 1.24M | if (ssa->vars[var2].scc != ssa->vars[var].scc) { \ |
93 | 1.08M | ssa->vars[var2].scc_entry = 1; \ |
94 | 1.08M | } \ |
95 | 1.24M | } while (0) |
96 | | |
97 | | #define ADD_SCC_VAR(_var) \ |
98 | 183k | do { \ |
99 | 183k | if (ssa->vars[_var].scc == scc && \ |
100 | 183k | !(ssa->var_info[_var].type & MAY_BE_REF)) { \ |
101 | 76.3k | zend_bitset_incl(worklist, _var); \ |
102 | 76.3k | } \ |
103 | 183k | } while (0) |
104 | | |
105 | | #define ADD_SCC_VAR_1(_var) \ |
106 | 112k | do { \ |
107 | 112k | if (ssa->vars[_var].scc == scc && \ |
108 | 112k | !(ssa->var_info[_var].type & MAY_BE_REF) && \ |
109 | 112k | !zend_bitset_in(visited, _var)) { \ |
110 | 57.4k | zend_bitset_incl(worklist, _var); \ |
111 | 57.4k | } \ |
112 | 112k | } while (0) |
113 | | |
114 | | #define FOR_EACH_DEFINED_VAR(line, MACRO) \ |
115 | 1.25M | do { \ |
116 | 1.25M | if (ssa->ops[line].op1_def >= 0) { \ |
117 | 183k | MACRO(ssa->ops[line].op1_def); \ |
118 | 183k | } \ |
119 | 1.25M | if (ssa->ops[line].op2_def >= 0) { \ |
120 | 10.3k | MACRO(ssa->ops[line].op2_def); \ |
121 | 10.3k | } \ |
122 | 1.25M | if (ssa->ops[line].result_def >= 0) { \ |
123 | 942k | MACRO(ssa->ops[line].result_def); \ |
124 | 942k | } \ |
125 | 1.25M | if (op_array->opcodes[line].opcode == ZEND_OP_DATA) { \ |
126 | 11.2k | if (ssa->ops[line-1].op1_def >= 0) { \ |
127 | 6.78k | MACRO(ssa->ops[line-1].op1_def); \ |
128 | 6.78k | } \ |
129 | 11.2k | if (ssa->ops[line-1].op2_def >= 0) { \ |
130 | 0 | MACRO(ssa->ops[line-1].op2_def); \ |
131 | 0 | } \ |
132 | 11.2k | if (ssa->ops[line-1].result_def >= 0) { \ |
133 | 3.28k | MACRO(ssa->ops[line-1].result_def); \ |
134 | 3.28k | } \ |
135 | 1.24M | } else if ((uint32_t)line+1 < op_array->last && \ |
136 | 1.24M | op_array->opcodes[line+1].opcode == ZEND_OP_DATA) { \ |
137 | 19.6k | if (ssa->ops[line+1].op1_def >= 0) { \ |
138 | 163 | MACRO(ssa->ops[line+1].op1_def); \ |
139 | 163 | } \ |
140 | 19.6k | if (ssa->ops[line+1].op2_def >= 0) { \ |
141 | 0 | MACRO(ssa->ops[line+1].op2_def); \ |
142 | 0 | } \ |
143 | 19.6k | if (ssa->ops[line+1].result_def >= 0) { \ |
144 | 0 | MACRO(ssa->ops[line+1].result_def); \ |
145 | 0 | } \ |
146 | 19.6k | } \ |
147 | 1.25M | } while (0) |
148 | | |
149 | | |
150 | | #define FOR_EACH_VAR_USAGE(_var, MACRO) \ |
151 | 1.23M | do { \ |
152 | 1.23M | zend_ssa_phi *p = ssa->vars[_var].phi_use_chain; \ |
153 | 1.23M | int use = ssa->vars[_var].use_chain; \ |
154 | 2.48M | while (use >= 0) { \ |
155 | 1.25M | FOR_EACH_DEFINED_VAR(use, MACRO); \ |
156 | 1.25M | use = zend_ssa_next_use(ssa->ops, _var, use); \ |
157 | 1.25M | } \ |
158 | 1.23M | p = ssa->vars[_var].phi_use_chain; \ |
159 | 1.62M | while (p) { \ |
160 | 389k | MACRO(p->ssa_var); \ |
161 | 389k | p = zend_ssa_next_use_phi(ssa, _var, p); \ |
162 | 389k | } \ |
163 | 1.23M | } while (0) |
164 | | |
165 | 1.82k | static inline bool add_will_overflow(zend_long a, zend_long b) { |
166 | 1.82k | return (b > 0 && a > ZEND_LONG_MAX - b) |
167 | 1.82k | || (b < 0 && a < ZEND_LONG_MIN - b); |
168 | 1.82k | } |
169 | | #if 0 |
170 | | static inline bool sub_will_overflow(zend_long a, zend_long b) { |
171 | | return (b > 0 && a < ZEND_LONG_MIN + b) |
172 | | || (b < 0 && a > ZEND_LONG_MAX + b); |
173 | | } |
174 | | #endif |
175 | | |
176 | | #if 0 |
177 | | /* Recursive Pearce's SCC algorithm implementation */ |
178 | | static void zend_ssa_check_scc_var(const zend_op_array *op_array, zend_ssa *ssa, int var, int *index, zend_worklist_stack *stack) /* {{{ */ |
179 | | { |
180 | | int is_root = 1; |
181 | | #ifdef SYM_RANGE |
182 | | zend_ssa_phi *p; |
183 | | #endif |
184 | | |
185 | | ssa->vars[var].scc = *index; |
186 | | (*index)++; |
187 | | |
188 | | FOR_EACH_VAR_USAGE(var, CHECK_SCC_VAR); |
189 | | |
190 | | #ifdef SYM_RANGE |
191 | | /* Process symbolic control-flow constraints */ |
192 | | p = ssa->vars[var].sym_use_chain; |
193 | | while (p) { |
194 | | CHECK_SCC_VAR(p->ssa_var); |
195 | | p = p->sym_use_chain; |
196 | | } |
197 | | #endif |
198 | | |
199 | | if (is_root) { |
200 | | ssa->sccs--; |
201 | | while (stack->len > 0) { |
202 | | int var2 = zend_worklist_stack_peek(stack); |
203 | | if (ssa->vars[var2].scc < ssa->vars[var].scc) { |
204 | | break; |
205 | | } |
206 | | zend_worklist_stack_pop(stack); |
207 | | ssa->vars[var2].scc = ssa->sccs; |
208 | | (*index)--; |
209 | | } |
210 | | ssa->vars[var].scc = ssa->sccs; |
211 | | ssa->vars[var].scc_entry = 1; |
212 | | (*index)--; |
213 | | } else { |
214 | | zend_worklist_stack_push(stack, var); |
215 | | } |
216 | | } |
217 | | /* }}} */ |
218 | | |
219 | | ZEND_API void zend_ssa_find_sccs(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */ |
220 | | { |
221 | | int index = 0; |
222 | | zend_worklist_stack stack; |
223 | | int j; |
224 | | ALLOCA_FLAG(stack_use_heap) |
225 | | |
226 | | ZEND_WORKLIST_STACK_ALLOCA(&stack, ssa->vars_count, stack_use_heap); |
227 | | |
228 | | /* Find SCCs using Pearce's algorithm. */ |
229 | | ssa->sccs = ssa->vars_count; |
230 | | for (j = 0; j < ssa->vars_count; j++) { |
231 | | if (!ssa->vars[j].no_val && ssa->vars[j].scc < 0) { |
232 | | zend_ssa_check_scc_var(op_array, ssa, j, &index, &stack); |
233 | | } |
234 | | } |
235 | | |
236 | | if (ssa->sccs) { |
237 | | /* Shift SCC indexes. */ |
238 | | for (j = 0; j < ssa->vars_count; j++) { |
239 | | if (ssa->vars[j].scc >= 0) { |
240 | | ssa->vars[j].scc -= ssa->sccs; |
241 | | } |
242 | | } |
243 | | } |
244 | | ssa->sccs = ssa->vars_count - ssa->sccs; |
245 | | |
246 | | for (j = 0; j < ssa->vars_count; j++) { |
247 | | if (ssa->vars[j].scc >= 0) { |
248 | | int var = j; |
249 | | FOR_EACH_VAR_USAGE(var, CHECK_SCC_ENTRY); |
250 | | } |
251 | | } |
252 | | |
253 | | ZEND_WORKLIST_STACK_FREE_ALLOCA(&stack, stack_use_heap); |
254 | | } |
255 | | /* }}} */ |
256 | | |
257 | | #else |
258 | | /* Iterative Pearce's SCC algorithm implementation */ |
259 | | |
260 | | typedef struct _zend_scc_iterator { |
261 | | int state; |
262 | | int last; |
263 | | union { |
264 | | int use; |
265 | | zend_ssa_phi *phi; |
266 | | }; |
267 | | } zend_scc_iterator; |
268 | | |
269 | | static int zend_scc_next(const zend_op_array *op_array, zend_ssa *ssa, int var, zend_scc_iterator *iterator) /* {{{ */ |
270 | 2.28M | { |
271 | 2.28M | zend_ssa_phi *phi; |
272 | 2.28M | int use, var2; |
273 | | |
274 | 2.28M | switch (iterator->state) { |
275 | 1.05M | case 0: goto state_0; |
276 | 117k | case 1: use = iterator->use; goto state_1; |
277 | 7.32k | case 2: use = iterator->use; goto state_2; |
278 | 800k | case 3: use = iterator->use; goto state_3; |
279 | 4.75k | case 4: use = iterator->use; goto state_4; |
280 | 0 | case 5: use = iterator->use; goto state_5; |
281 | 97 | case 6: use = iterator->use; goto state_6; |
282 | 0 | case 7: use = iterator->use; goto state_7; |
283 | 2.61k | case 8: use = iterator->use; goto state_8; |
284 | 292k | case 9: phi = iterator->phi; goto state_9; |
285 | 0 | #ifdef SYM_RANGE |
286 | 3.35k | case 10: phi = iterator->phi; goto state_10; |
287 | 0 | #endif |
288 | 0 | case 11: goto state_11; |
289 | 2.28M | } |
290 | | |
291 | 1.05M | state_0: |
292 | 1.05M | use = ssa->vars[var].use_chain; |
293 | 2.13M | while (use >= 0) { |
294 | 1.07M | iterator->use = use; |
295 | 1.07M | var2 = ssa->ops[use].op1_def; |
296 | 1.07M | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
297 | 117k | iterator->state = 1; |
298 | 117k | return var2; |
299 | 117k | } |
300 | 1.07M | state_1: |
301 | 1.07M | var2 = ssa->ops[use].op2_def; |
302 | 1.07M | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
303 | 7.32k | iterator->state = 2; |
304 | 7.32k | return var2; |
305 | 7.32k | } |
306 | 1.07M | state_2: |
307 | 1.07M | var2 = ssa->ops[use].result_def; |
308 | 1.07M | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
309 | 800k | iterator->state = 3; |
310 | 800k | return var2; |
311 | 800k | } |
312 | 1.07M | state_3: |
313 | 1.07M | if (op_array->opcodes[use].opcode == ZEND_OP_DATA) { |
314 | 9.93k | var2 = ssa->ops[use-1].op1_def; |
315 | 9.93k | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
316 | 4.75k | iterator->state = 4; |
317 | 4.75k | return var2; |
318 | 4.75k | } |
319 | 9.93k | state_4: |
320 | 9.93k | var2 = ssa->ops[use-1].op2_def; |
321 | 9.93k | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
322 | 0 | iterator->state = 5; |
323 | 0 | return var2; |
324 | 0 | } |
325 | 9.93k | state_5: |
326 | 9.93k | var2 = ssa->ops[use-1].result_def; |
327 | 9.93k | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
328 | 2.61k | iterator->state = 8; |
329 | 2.61k | return var2; |
330 | 2.61k | } |
331 | 1.06M | } else if ((uint32_t)use+1 < op_array->last && |
332 | 1.06M | op_array->opcodes[use+1].opcode == ZEND_OP_DATA) { |
333 | 16.7k | var2 = ssa->ops[use+1].op1_def; |
334 | 16.7k | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
335 | 97 | iterator->state = 6; |
336 | 97 | return var2; |
337 | 97 | } |
338 | 16.7k | state_6: |
339 | 16.7k | var2 = ssa->ops[use+1].op2_def; |
340 | 16.7k | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
341 | 0 | iterator->state = 7; |
342 | 0 | return var2; |
343 | 0 | } |
344 | 16.7k | state_7: |
345 | 16.7k | var2 = ssa->ops[use+1].result_def; |
346 | 16.7k | if (var2 >= 0 && !ssa->vars[var2].no_val) { |
347 | 0 | iterator->state = 8; |
348 | 0 | return var2; |
349 | 0 | } |
350 | 16.7k | } |
351 | 1.07M | state_8: |
352 | 1.07M | use = zend_ssa_next_use(ssa->ops, var, use); |
353 | 1.07M | } |
354 | | |
355 | 1.05M | phi = ssa->vars[var].phi_use_chain; |
356 | 1.35M | while (phi) { |
357 | 294k | var2 = phi->ssa_var; |
358 | 294k | if (!ssa->vars[var2].no_val) { |
359 | 292k | iterator->state = 9; |
360 | 292k | iterator->phi = phi; |
361 | 292k | return var2; |
362 | 292k | } |
363 | 294k | state_9: |
364 | 294k | phi = zend_ssa_next_use_phi(ssa, var, phi); |
365 | 294k | } |
366 | | |
367 | 1.05M | #ifdef SYM_RANGE |
368 | | /* Process symbolic control-flow constraints */ |
369 | 1.05M | phi = ssa->vars[var].sym_use_chain; |
370 | 1.06M | while (phi) { |
371 | 3.45k | var2 = phi->ssa_var; |
372 | 3.45k | if (!ssa->vars[var2].no_val) { |
373 | 3.35k | iterator->state = 10; |
374 | 3.35k | iterator->phi = phi; |
375 | 3.35k | return var2; |
376 | 3.35k | } |
377 | 3.45k | state_10: |
378 | 3.45k | phi = phi->sym_use_chain; |
379 | 3.45k | } |
380 | 1.05M | #endif |
381 | | |
382 | 1.05M | iterator->state = 11; |
383 | 1.05M | state_11: |
384 | 1.05M | return -1; |
385 | 1.05M | } |
386 | | /* }}} */ |
387 | | |
388 | | static void zend_ssa_check_scc_var(const zend_op_array *op_array, zend_ssa *ssa, int var, int *index, zend_worklist_stack *stack, zend_worklist_stack *vstack, zend_scc_iterator *iterators) /* {{{ */ |
389 | 220k | { |
390 | 1.05M | restart: |
391 | 1.05M | zend_worklist_stack_push(vstack, var); |
392 | 1.05M | iterators[var].state = 0; |
393 | 1.05M | iterators[var].last = -1; |
394 | 1.05M | ssa->vars[var].scc_entry = 1; |
395 | 1.05M | ssa->vars[var].scc = *index; |
396 | 1.05M | (*index)++; |
397 | | |
398 | 2.11M | while (vstack->len > 0) { |
399 | 1.89M | var = zend_worklist_stack_peek(vstack); |
400 | 2.28M | while (1) { |
401 | 2.28M | int var2; |
402 | | |
403 | 2.28M | if (iterators[var].last >= 0) { |
404 | | /* finish edge */ |
405 | 1.22M | var2 = iterators[var].last; |
406 | 1.22M | if (ssa->vars[var2].scc < ssa->vars[var].scc) { |
407 | 114k | ssa->vars[var].scc = ssa->vars[var2].scc; |
408 | 114k | ssa->vars[var].scc_entry = 0; |
409 | 114k | } |
410 | 1.22M | } |
411 | 2.28M | var2 = zend_scc_next(op_array, ssa, var, iterators + var); |
412 | 2.28M | iterators[var].last = var2; |
413 | 2.28M | if (var2 < 0) break; |
414 | | /* begin edge */ |
415 | 1.22M | if (ssa->vars[var2].scc < 0) { |
416 | 838k | var = var2; |
417 | 838k | goto restart; |
418 | 838k | } |
419 | 1.22M | } |
420 | | |
421 | | /* finish visiting */ |
422 | 1.05M | zend_worklist_stack_pop(vstack); |
423 | 1.05M | if (ssa->vars[var].scc_entry) { |
424 | 946k | ssa->sccs--; |
425 | 1.05M | while (stack->len > 0) { |
426 | 135k | int var2 = zend_worklist_stack_peek(stack); |
427 | 135k | if (ssa->vars[var2].scc < ssa->vars[var].scc) { |
428 | 21.9k | break; |
429 | 21.9k | } |
430 | 113k | zend_worklist_stack_pop(stack); |
431 | 113k | ssa->vars[var2].scc = ssa->sccs; |
432 | 113k | (*index)--; |
433 | 113k | } |
434 | 946k | ssa->vars[var].scc = ssa->sccs; |
435 | 946k | (*index)--; |
436 | 946k | } else { |
437 | 113k | zend_worklist_stack_push(stack, var); |
438 | 113k | } |
439 | 1.05M | } |
440 | 1.05M | } |
441 | | /* }}} */ |
442 | | |
443 | | ZEND_API void zend_ssa_find_sccs(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */ |
444 | 74.1k | { |
445 | 74.1k | int index = 0; |
446 | 74.1k | zend_worklist_stack stack, vstack; |
447 | 74.1k | zend_scc_iterator *iterators; |
448 | 74.1k | int j; |
449 | 74.1k | ALLOCA_FLAG(stack_use_heap) |
450 | 74.1k | ALLOCA_FLAG(vstack_use_heap) |
451 | 74.1k | ALLOCA_FLAG(iterators_use_heap) |
452 | | |
453 | 74.1k | iterators = do_alloca(sizeof(zend_scc_iterator) * ssa->vars_count, iterators_use_heap); |
454 | 74.1k | ZEND_WORKLIST_STACK_ALLOCA(&vstack, ssa->vars_count, vstack_use_heap); |
455 | 74.1k | ZEND_WORKLIST_STACK_ALLOCA(&stack, ssa->vars_count, stack_use_heap); |
456 | | |
457 | | /* Find SCCs using Pearce's algorithm. */ |
458 | 74.1k | ssa->sccs = ssa->vars_count; |
459 | 1.20M | for (j = 0; j < ssa->vars_count; j++) { |
460 | 1.12M | if (!ssa->vars[j].no_val && ssa->vars[j].scc < 0) { |
461 | 220k | zend_ssa_check_scc_var(op_array, ssa, j, &index, &stack, &vstack, iterators); |
462 | 220k | } |
463 | 1.12M | } |
464 | | |
465 | 74.1k | if (ssa->sccs) { |
466 | | /* Shift SCC indexes. */ |
467 | 838k | for (j = 0; j < ssa->vars_count; j++) { |
468 | 811k | if (ssa->vars[j].scc >= 0) { |
469 | 742k | ssa->vars[j].scc -= ssa->sccs; |
470 | 742k | } |
471 | 811k | } |
472 | 27.1k | } |
473 | 74.1k | ssa->sccs = ssa->vars_count - ssa->sccs; |
474 | | |
475 | 1.20M | for (j = 0; j < ssa->vars_count; j++) { |
476 | 1.12M | if (ssa->vars[j].scc >= 0) { |
477 | 1.05M | int var = j; |
478 | 1.24M | FOR_EACH_VAR_USAGE(var, CHECK_SCC_ENTRY); |
479 | 1.05M | } |
480 | 1.12M | } |
481 | | |
482 | 74.1k | ZEND_WORKLIST_STACK_FREE_ALLOCA(&stack, stack_use_heap); |
483 | 74.1k | ZEND_WORKLIST_STACK_FREE_ALLOCA(&vstack, vstack_use_heap); |
484 | 74.1k | free_alloca(iterators, iterators_use_heap); |
485 | 74.1k | } |
486 | | /* }}} */ |
487 | | |
488 | | #endif |
489 | | |
490 | | ZEND_API void zend_ssa_find_false_dependencies(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */ |
491 | 74.1k | { |
492 | 74.1k | zend_ssa_var *ssa_vars = ssa->vars; |
493 | 74.1k | zend_ssa_op *ssa_ops = ssa->ops; |
494 | 74.1k | int ssa_vars_count = ssa->vars_count; |
495 | 74.1k | zend_bitset worklist; |
496 | 74.1k | int i, j, use; |
497 | 74.1k | zend_ssa_phi *p; |
498 | 74.1k | ALLOCA_FLAG(use_heap); |
499 | | |
500 | 74.1k | if (!op_array->function_name || !ssa->vars || !ssa->ops) { |
501 | 35.7k | return; |
502 | 35.7k | } |
503 | | |
504 | 38.3k | worklist = do_alloca(sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count), use_heap); |
505 | 38.3k | memset(worklist, 0, sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count)); |
506 | | |
507 | 471k | for (i = 0; i < ssa_vars_count; i++) { |
508 | 433k | ssa_vars[i].no_val = 1; /* mark as unused */ |
509 | 433k | use = ssa->vars[i].use_chain; |
510 | 457k | while (use >= 0) { |
511 | 337k | if (!zend_ssa_is_no_val_use(&op_array->opcodes[use], &ssa->ops[use], i)) { |
512 | 312k | ssa_vars[i].no_val = 0; /* used directly */ |
513 | 312k | zend_bitset_incl(worklist, i); |
514 | 312k | break; |
515 | 312k | } |
516 | 24.1k | use = zend_ssa_next_use(ssa_ops, i, use); |
517 | 24.1k | } |
518 | 433k | } |
519 | | |
520 | 1.30M | WHILE_WORKLIST(worklist, zend_bitset_len(ssa_vars_count), i) { |
521 | 1.30M | if (ssa_vars[i].definition_phi) { |
522 | | /* mark all possible sources as used */ |
523 | 63.5k | p = ssa_vars[i].definition_phi; |
524 | 63.5k | if (p->pi >= 0) { |
525 | 20.8k | if (ssa_vars[p->sources[0]].no_val) { |
526 | 27 | ssa_vars[p->sources[0]].no_val = 0; /* used indirectly */ |
527 | 27 | zend_bitset_incl(worklist, p->sources[0]); |
528 | 27 | } |
529 | 42.6k | } else { |
530 | 129k | for (j = 0; j < ssa->cfg.blocks[p->block].predecessors_count; j++) { |
531 | 86.4k | ZEND_ASSERT(p->sources[j] >= 0); |
532 | 86.4k | if (ssa->vars[p->sources[j]].no_val) { |
533 | 51.9k | ssa_vars[p->sources[j]].no_val = 0; /* used indirectly */ |
534 | 51.9k | zend_bitset_incl(worklist, p->sources[j]); |
535 | 51.9k | } |
536 | 86.4k | } |
537 | 42.6k | } |
538 | 63.5k | } |
539 | 1.30M | } WHILE_WORKLIST_END(); |
540 | | |
541 | 38.3k | free_alloca(worklist, use_heap); |
542 | 38.3k | } |
543 | | /* }}} */ |
544 | | |
545 | | /* From "Hacker's Delight" */ |
546 | | static zend_ulong minOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d) |
547 | 36 | { |
548 | 36 | zend_ulong m, temp; |
549 | | |
550 | 36 | m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1); |
551 | 2.30k | while (m != 0) { |
552 | 2.28k | if (~a & c & m) { |
553 | 18 | temp = (a | m) & -m; |
554 | 18 | if (temp <= b) { |
555 | 10 | a = temp; |
556 | 10 | break; |
557 | 10 | } |
558 | 2.26k | } else if (a & ~c & m) { |
559 | 498 | temp = (c | m) & -m; |
560 | 498 | if (temp <= d) { |
561 | 0 | c = temp; |
562 | 0 | break; |
563 | 0 | } |
564 | 498 | } |
565 | 2.27k | m = m >> 1; |
566 | 2.27k | } |
567 | 36 | return a | c; |
568 | 36 | } |
569 | | |
570 | | static zend_ulong maxOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d) |
571 | 92 | { |
572 | 92 | zend_ulong m, temp; |
573 | | |
574 | 92 | m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1); |
575 | 2.39k | while (m != 0) { |
576 | 2.38k | if (b & d & m) { |
577 | 74 | temp = (b - m) | (m - 1); |
578 | 74 | if (temp >= a) { |
579 | 74 | b = temp; |
580 | 74 | break; |
581 | 74 | } |
582 | 0 | temp = (d - m) | (m - 1); |
583 | 0 | if (temp >= c) { |
584 | 0 | d = temp; |
585 | 0 | break; |
586 | 0 | } |
587 | 0 | } |
588 | 2.30k | m = m >> 1; |
589 | 2.30k | } |
590 | 92 | return b | d; |
591 | 92 | } |
592 | | |
593 | | static zend_ulong minAND(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d) |
594 | 743 | { |
595 | 743 | zend_ulong m, temp; |
596 | | |
597 | 743 | m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1); |
598 | 14.1k | while (m != 0) { |
599 | 14.1k | if (~a & ~c & m) { |
600 | 12.3k | temp = (a | m) & -m; |
601 | 12.3k | if (temp <= b) { |
602 | 491 | a = temp; |
603 | 491 | break; |
604 | 491 | } |
605 | 11.8k | temp = (c | m) & -m; |
606 | 11.8k | if (temp <= d) { |
607 | 208 | c = temp; |
608 | 208 | break; |
609 | 208 | } |
610 | 11.8k | } |
611 | 13.4k | m = m >> 1; |
612 | 13.4k | } |
613 | 743 | return a & c; |
614 | 743 | } |
615 | | |
616 | | static zend_ulong maxAND(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d) |
617 | 292 | { |
618 | 292 | zend_ulong m, temp; |
619 | | |
620 | 292 | m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1); |
621 | 11.5k | while (m != 0) { |
622 | 11.5k | if (b & ~d & m) { |
623 | 26 | temp = (b | ~m) | (m - 1); |
624 | 26 | if (temp >= a) { |
625 | 26 | b = temp; |
626 | 26 | break; |
627 | 26 | } |
628 | 11.4k | } else if (~b & d & m) { |
629 | 258 | temp = (d | ~m) | (m - 1); |
630 | 258 | if (temp >= c) { |
631 | 258 | d = temp; |
632 | 258 | break; |
633 | 258 | } |
634 | 258 | } |
635 | 11.2k | m = m >> 1; |
636 | 11.2k | } |
637 | 292 | return b & d; |
638 | 292 | } |
639 | | |
640 | | /* Based on "Hacker's Delight" */ |
641 | | |
642 | | /* |
643 | | 0: + + + + 0 0 0 0 => 0 0 + min/max |
644 | | 2: + + - + 0 0 1 0 => 1 0 ? min(a,b,c,-1)/max(a,b,0,d) |
645 | | 3: + + - - 0 0 1 1 => 1 1 - min/max |
646 | | 8: - + + + 1 0 0 0 => 1 0 ? min(a,-1,b,d)/max(0,b,c,d) |
647 | | a: - + - + 1 0 1 0 => 1 0 ? MIN(a,c)/max(0,b,0,d) |
648 | | b: - + - - 1 0 1 1 => 1 1 - c/-1 |
649 | | c: - - + + 1 1 0 0 => 1 1 - min/max |
650 | | e: - - - + 1 1 1 0 => 1 1 - a/-1 |
651 | | f - - - - 1 1 1 1 => 1 1 - min/max |
652 | | */ |
653 | | static void zend_ssa_range_or(zend_long a, zend_long b, zend_long c, zend_long d, zend_ssa_range *tmp) |
654 | 93 | { |
655 | 93 | int x = ((a < 0) ? 8 : 0) | |
656 | 93 | ((b < 0) ? 4 : 0) | |
657 | 93 | ((c < 0) ? 2 : 0) | |
658 | 93 | ((d < 0) ? 1 : 0); |
659 | 93 | switch (x) { |
660 | 16 | case 0x0: |
661 | 16 | case 0x3: |
662 | 16 | case 0xc: |
663 | 16 | case 0xf: |
664 | 16 | tmp->min = minOR(a, b, c, d); |
665 | 16 | tmp->max = maxOR(a, b, c, d); |
666 | 16 | break; |
667 | 0 | case 0x2: |
668 | 0 | tmp->min = minOR(a, b, c, -1); |
669 | 0 | tmp->max = maxOR(a, b, 0, d); |
670 | 0 | break; |
671 | 20 | case 0x8: |
672 | 20 | tmp->min = minOR(a, -1, c, d); |
673 | 20 | tmp->max = maxOR(0, b, c, d); |
674 | 20 | break; |
675 | 56 | case 0xa: |
676 | 56 | tmp->min = MIN(a, c); |
677 | 56 | tmp->max = maxOR(0, b, 0, d); |
678 | 56 | break; |
679 | 1 | case 0xb: |
680 | 1 | tmp->min = c; |
681 | 1 | tmp->max = -1; |
682 | 1 | break; |
683 | 0 | case 0xe: |
684 | 0 | tmp->min = a; |
685 | 0 | tmp->max = -1; |
686 | 0 | break; |
687 | 93 | } |
688 | 93 | } |
689 | | |
690 | | /* |
691 | | 0: + + + + 0 0 0 0 => 0 0 + min/max |
692 | | 2: + + - + 0 0 1 0 => 0 0 + 0/b |
693 | | 3: + + - - 0 0 1 1 => 0 0 + min/max |
694 | | 8: - + + + 1 0 0 0 => 0 0 + 0/d |
695 | | a: - + - + 1 0 1 0 => 1 0 ? min(a,-1,c,-1)/NAX(b,d) |
696 | | b: - + - - 1 0 1 1 => 1 0 ? min(a,-1,c,d)/max(0,b,c,d) |
697 | | c: - - + + 1 1 0 0 => 1 1 - min/max |
698 | | e: - - - + 1 1 1 0 => 1 0 ? min(a,b,c,-1)/max(a,b,0,d) |
699 | | f - - - - 1 1 1 1 => 1 1 - min/max |
700 | | */ |
701 | | static void zend_ssa_range_and(zend_long a, zend_long b, zend_long c, zend_long d, zend_ssa_range *tmp) |
702 | 926 | { |
703 | 926 | int x = ((a < 0) ? 8 : 0) | |
704 | 926 | ((b < 0) ? 4 : 0) | |
705 | 926 | ((c < 0) ? 2 : 0) | |
706 | 926 | ((d < 0) ? 1 : 0); |
707 | 926 | switch (x) { |
708 | 278 | case 0x0: |
709 | 284 | case 0x3: |
710 | 284 | case 0xc: |
711 | 284 | case 0xf: |
712 | 284 | tmp->min = minAND(a, b, c, d); |
713 | 284 | tmp->max = maxAND(a, b, c, d); |
714 | 284 | break; |
715 | 152 | case 0x2: |
716 | 152 | tmp->min = 0; |
717 | 152 | tmp->max = b; |
718 | 152 | break; |
719 | 31 | case 0x8: |
720 | 31 | tmp->min = 0; |
721 | 31 | tmp->max = d; |
722 | 31 | break; |
723 | 451 | case 0xa: |
724 | 451 | tmp->min = minAND(a, -1, c, -1); |
725 | 451 | tmp->max = MAX(b, d); |
726 | 451 | break; |
727 | 8 | case 0xb: |
728 | 8 | tmp->min = minAND(a, -1, c, d); |
729 | 8 | tmp->max = maxAND(0, b, c, d); |
730 | 8 | break; |
731 | 0 | case 0xe: |
732 | 0 | tmp->min = minAND(a, b, c, -1); |
733 | 0 | tmp->max = maxAND(a, b, 0, d); |
734 | 0 | break; |
735 | 926 | } |
736 | 926 | } |
737 | | |
738 | | static inline bool zend_abs_range( |
739 | 388 | zend_long min, zend_long max, zend_long *abs_min, zend_long *abs_max) { |
740 | 388 | if (min == ZEND_LONG_MIN) { |
741 | | /* Cannot take absolute value of LONG_MIN */ |
742 | 8 | return 0; |
743 | 8 | } |
744 | | |
745 | 380 | if (min >= 0) { |
746 | 368 | *abs_min = min; |
747 | 368 | *abs_max = max; |
748 | 368 | } else if (max <= 0) { |
749 | 12 | *abs_min = -max; |
750 | 12 | *abs_max = -min; |
751 | 12 | } else { |
752 | | /* Range crossing zero */ |
753 | 0 | *abs_min = 0; |
754 | 0 | *abs_max = MAX(max, -min); |
755 | 0 | } |
756 | | |
757 | 380 | return 1; |
758 | 388 | } |
759 | | |
760 | 342 | static inline zend_long safe_shift_left(zend_long n, zend_long s) { |
761 | 342 | return (zend_long) ((zend_ulong) n << (zend_ulong) s); |
762 | 342 | } |
763 | | |
764 | 184 | static inline bool shift_left_overflows(zend_long n, zend_long s) { |
765 | | /* This considers shifts that shift in the sign bit to be overflowing as well */ |
766 | 184 | if (n >= 0) { |
767 | 86 | return s >= SIZEOF_ZEND_LONG * 8 - 1 || safe_shift_left(n, s) < n; |
768 | 98 | } else { |
769 | 98 | return s >= SIZEOF_ZEND_LONG * 8 || safe_shift_left(n, s) > n; |
770 | 98 | } |
771 | 184 | } |
772 | | |
773 | | /* If b does not divide a exactly, return the two adjacent values between which the real result |
774 | | * lies. */ |
775 | 308 | static void float_div(zend_long a, zend_long b, zend_long *r1, zend_long *r2) { |
776 | 308 | *r1 = *r2 = a / b; |
777 | 308 | if (a % b != 0) { |
778 | 216 | if (*r2 < 0) { |
779 | 90 | (*r2)--; |
780 | 126 | } else { |
781 | 126 | (*r2)++; |
782 | 126 | } |
783 | 216 | } |
784 | 308 | } |
785 | | |
786 | | static bool zend_inference_calc_binary_op_range( |
787 | | const zend_op_array *op_array, const zend_ssa *ssa, |
788 | 69.6k | const zend_op *opline, const zend_ssa_op *ssa_op, uint8_t opcode, zend_ssa_range *tmp) { |
789 | 69.6k | zend_long op1_min, op2_min, op1_max, op2_max, t1, t2, t3, t4; |
790 | | |
791 | 69.6k | switch (opcode) { |
792 | 32.4k | case ZEND_ADD: |
793 | 32.4k | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
794 | 22.8k | op1_min = OP1_MIN_RANGE(); |
795 | 22.8k | op2_min = OP2_MIN_RANGE(); |
796 | 22.8k | op1_max = OP1_MAX_RANGE(); |
797 | 22.8k | op2_max = OP2_MAX_RANGE(); |
798 | 22.8k | if (OP1_RANGE_UNDERFLOW() || |
799 | 22.8k | OP2_RANGE_UNDERFLOW() || |
800 | 22.8k | zend_add_will_overflow(op1_min, op2_min)) { |
801 | 22.0k | tmp->underflow = 1; |
802 | 22.0k | tmp->min = ZEND_LONG_MIN; |
803 | 22.0k | } else { |
804 | 831 | tmp->min = op1_min + op2_min; |
805 | 831 | } |
806 | 22.8k | if (OP1_RANGE_OVERFLOW() || |
807 | 22.8k | OP2_RANGE_OVERFLOW() || |
808 | 22.8k | zend_add_will_overflow(op1_max, op2_max)) { |
809 | 22.2k | tmp->overflow = 1; |
810 | 22.2k | tmp->max = ZEND_LONG_MAX; |
811 | 22.2k | } else { |
812 | 615 | tmp->max = op1_max + op2_max; |
813 | 615 | } |
814 | 22.8k | return 1; |
815 | 22.8k | } |
816 | 9.55k | break; |
817 | 9.55k | case ZEND_SUB: |
818 | 6.86k | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
819 | 5.60k | op1_min = OP1_MIN_RANGE(); |
820 | 5.60k | op2_min = OP2_MIN_RANGE(); |
821 | 5.60k | op1_max = OP1_MAX_RANGE(); |
822 | 5.60k | op2_max = OP2_MAX_RANGE(); |
823 | 5.60k | if (OP1_RANGE_UNDERFLOW() || |
824 | 5.60k | OP2_RANGE_OVERFLOW() || |
825 | 5.60k | zend_sub_will_overflow(op1_min, op2_max)) { |
826 | 4.22k | tmp->underflow = 1; |
827 | 4.22k | tmp->min = ZEND_LONG_MIN; |
828 | 4.22k | } else { |
829 | 1.37k | tmp->min = op1_min - op2_max; |
830 | 1.37k | } |
831 | 5.60k | if (OP1_RANGE_OVERFLOW() || |
832 | 5.60k | OP2_RANGE_UNDERFLOW() || |
833 | 5.60k | zend_sub_will_overflow(op1_max, op2_min)) { |
834 | 4.14k | tmp->overflow = 1; |
835 | 4.14k | tmp->max = ZEND_LONG_MAX; |
836 | 4.14k | } else { |
837 | 1.45k | tmp->max = op1_max - op2_min; |
838 | 1.45k | } |
839 | 5.60k | return 1; |
840 | 5.60k | } |
841 | 1.26k | break; |
842 | 9.01k | case ZEND_MUL: |
843 | 9.01k | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
844 | 6.86k | double dummy; |
845 | 6.86k | zend_long t1_overflow, t2_overflow, t3_overflow, t4_overflow; |
846 | 6.86k | op1_min = OP1_MIN_RANGE(); |
847 | 6.86k | op2_min = OP2_MIN_RANGE(); |
848 | 6.86k | op1_max = OP1_MAX_RANGE(); |
849 | 6.86k | op2_max = OP2_MAX_RANGE(); |
850 | | /* Suppress uninit variable warnings, these will only be used if the overflow |
851 | | * flags are all false. */ |
852 | 6.86k | t1 = t2 = t3 = t4 = 0; |
853 | 6.86k | ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_min, t1, dummy, t1_overflow); |
854 | 6.86k | ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_max, t2, dummy, t2_overflow); |
855 | 6.86k | ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_min, t3, dummy, t3_overflow); |
856 | 6.86k | ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_max, t4, dummy, t4_overflow); |
857 | 6.86k | (void) dummy; |
858 | | |
859 | | // FIXME: more careful overflow checks? |
860 | 6.86k | if (OP1_RANGE_UNDERFLOW() || OP2_RANGE_UNDERFLOW() || |
861 | 6.86k | OP1_RANGE_OVERFLOW() || OP2_RANGE_OVERFLOW() || |
862 | 6.86k | t1_overflow || t2_overflow || t3_overflow || t4_overflow |
863 | 6.86k | ) { |
864 | 6.71k | tmp->underflow = 1; |
865 | 6.71k | tmp->overflow = 1; |
866 | 6.71k | tmp->min = ZEND_LONG_MIN; |
867 | 6.71k | tmp->max = ZEND_LONG_MAX; |
868 | 6.71k | } else { |
869 | 148 | tmp->min = MIN(MIN(t1, t2), MIN(t3, t4)); |
870 | 148 | tmp->max = MAX(MAX(t1, t2), MAX(t3, t4)); |
871 | 148 | } |
872 | 6.86k | return 1; |
873 | 6.86k | } |
874 | 2.15k | break; |
875 | 3.23k | case ZEND_DIV: |
876 | 3.23k | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
877 | 2.91k | op1_min = OP1_MIN_RANGE(); |
878 | 2.91k | op2_min = OP2_MIN_RANGE(); |
879 | 2.91k | op1_max = OP1_MAX_RANGE(); |
880 | 2.91k | op2_max = OP2_MAX_RANGE(); |
881 | | |
882 | | /* If op2 crosses zero, then floating point values close to zero might be |
883 | | * possible, which will result in arbitrarily large results (overflow). Also |
884 | | * avoid dividing LONG_MIN by -1, which is UB. */ |
885 | 2.91k | if (OP1_RANGE_UNDERFLOW() || OP2_RANGE_UNDERFLOW() || |
886 | 2.91k | OP1_RANGE_OVERFLOW() || OP2_RANGE_OVERFLOW() || |
887 | 2.91k | (op2_min <= 0 && op2_max >= 0) || |
888 | 2.91k | (op1_min == ZEND_LONG_MIN && op2_max == -1) |
889 | 2.91k | ) { |
890 | 2.83k | tmp->underflow = 1; |
891 | 2.83k | tmp->overflow = 1; |
892 | 2.83k | tmp->min = ZEND_LONG_MIN; |
893 | 2.83k | tmp->max = ZEND_LONG_MAX; |
894 | 2.83k | } else { |
895 | 77 | zend_long t1_, t2_, t3_, t4_; |
896 | 77 | float_div(op1_min, op2_min, &t1, &t1_); |
897 | 77 | float_div(op1_min, op2_max, &t2, &t2_); |
898 | 77 | float_div(op1_max, op2_min, &t3, &t3_); |
899 | 77 | float_div(op1_max, op2_max, &t4, &t4_); |
900 | | |
901 | 77 | tmp->min = MIN(MIN(MIN(t1, t2), MIN(t3, t4)), MIN(MIN(t1_, t2_), MIN(t3_, t4_))); |
902 | 77 | tmp->max = MAX(MAX(MAX(t1, t2), MAX(t3, t4)), MAX(MAX(t1_, t2_), MAX(t3_, t4_))); |
903 | 77 | } |
904 | 2.91k | return 1; |
905 | 2.91k | } |
906 | 321 | break; |
907 | 3.57k | case ZEND_MOD: |
908 | 3.57k | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
909 | 2.09k | if (OP1_RANGE_UNDERFLOW() || |
910 | 2.09k | OP2_RANGE_UNDERFLOW() || |
911 | 2.09k | OP1_RANGE_OVERFLOW() || |
912 | 2.09k | OP2_RANGE_OVERFLOW()) { |
913 | 1.71k | tmp->min = ZEND_LONG_MIN; |
914 | 1.71k | tmp->max = ZEND_LONG_MAX; |
915 | 1.71k | } else { |
916 | 388 | zend_long op2_abs_min, op2_abs_max; |
917 | | |
918 | 388 | op1_min = OP1_MIN_RANGE(); |
919 | 388 | op2_min = OP2_MIN_RANGE(); |
920 | 388 | op1_max = OP1_MAX_RANGE(); |
921 | 388 | op2_max = OP2_MAX_RANGE(); |
922 | 388 | if (!zend_abs_range(op2_min, op2_max, &op2_abs_min, &op2_abs_max)) { |
923 | 8 | break; |
924 | 8 | } |
925 | | |
926 | 380 | if (op2_abs_max == 0) { |
927 | | /* Always modulus by zero, nothing we can do */ |
928 | 36 | break; |
929 | 36 | } |
930 | 344 | if (op2_abs_min == 0) { |
931 | | /* Ignore the modulus by zero case, which will throw */ |
932 | 0 | op2_abs_min++; |
933 | 0 | } |
934 | | |
935 | 344 | if (op1_min >= 0) { |
936 | 35 | tmp->min = op1_max < op2_abs_min ? op1_min : 0; |
937 | 35 | tmp->max = MIN(op1_max, op2_abs_max - 1); |
938 | 309 | } else if (op1_max <= 0) { |
939 | 0 | tmp->min = MAX(op1_min, -op2_abs_max + 1); |
940 | 0 | tmp->max = op1_min > -op2_abs_min ? op1_max : 0; |
941 | 309 | } else { |
942 | 309 | tmp->min = MAX(op1_min, -op2_abs_max + 1); |
943 | 309 | tmp->max = MIN(op1_max, op2_abs_max - 1); |
944 | 309 | } |
945 | 344 | } |
946 | 2.05k | return 1; |
947 | 2.09k | } |
948 | 1.47k | break; |
949 | 1.56k | case ZEND_SL: |
950 | 1.56k | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
951 | 1.29k | if (OP1_RANGE_UNDERFLOW() || |
952 | 1.29k | OP2_RANGE_UNDERFLOW() || |
953 | 1.29k | OP1_RANGE_OVERFLOW() || |
954 | 1.29k | OP2_RANGE_OVERFLOW()) { |
955 | 1.16k | tmp->min = ZEND_LONG_MIN; |
956 | 1.16k | tmp->max = ZEND_LONG_MAX; |
957 | 1.16k | } else { |
958 | 133 | op1_min = OP1_MIN_RANGE(); |
959 | 133 | op2_min = OP2_MIN_RANGE(); |
960 | 133 | op1_max = OP1_MAX_RANGE(); |
961 | 133 | op2_max = OP2_MAX_RANGE(); |
962 | | |
963 | | /* Shifts by negative numbers will throw, ignore them */ |
964 | 133 | if (op2_min < 0) { |
965 | 34 | op2_min = 0; |
966 | 34 | } |
967 | 133 | if (op2_max < 0) { |
968 | 10 | op2_max = 0; |
969 | 10 | } |
970 | | |
971 | 133 | if (shift_left_overflows(op1_min, op2_max) |
972 | 133 | || shift_left_overflows(op1_max, op2_max)) { |
973 | 82 | tmp->min = ZEND_LONG_MIN; |
974 | 82 | tmp->max = ZEND_LONG_MAX; |
975 | 82 | } else { |
976 | 51 | t1 = safe_shift_left(op1_min, op2_min); |
977 | 51 | t2 = safe_shift_left(op1_min, op2_max); |
978 | 51 | t3 = safe_shift_left(op1_max, op2_min); |
979 | 51 | t4 = safe_shift_left(op1_max, op2_max); |
980 | 51 | tmp->min = MIN(MIN(t1, t2), MIN(t3, t4)); |
981 | 51 | tmp->max = MAX(MAX(t1, t2), MAX(t3, t4)); |
982 | 51 | } |
983 | 133 | } |
984 | 1.29k | return 1; |
985 | 1.29k | } |
986 | 267 | break; |
987 | 509 | case ZEND_SR: |
988 | 509 | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
989 | 328 | if (OP1_RANGE_UNDERFLOW() || |
990 | 328 | OP2_RANGE_UNDERFLOW() || |
991 | 328 | OP1_RANGE_OVERFLOW() || |
992 | 328 | OP2_RANGE_OVERFLOW()) { |
993 | 220 | tmp->min = ZEND_LONG_MIN; |
994 | 220 | tmp->max = ZEND_LONG_MAX; |
995 | 220 | } else { |
996 | 108 | op1_min = OP1_MIN_RANGE(); |
997 | 108 | op2_min = OP2_MIN_RANGE(); |
998 | 108 | op1_max = OP1_MAX_RANGE(); |
999 | 108 | op2_max = OP2_MAX_RANGE(); |
1000 | | |
1001 | | /* Shifts by negative numbers will throw, ignore them */ |
1002 | 108 | if (op2_min < 0) { |
1003 | 76 | op2_min = 0; |
1004 | 76 | } |
1005 | 108 | if (op2_max < 0) { |
1006 | 14 | op2_max = 0; |
1007 | 14 | } |
1008 | | |
1009 | | /* Shifts by more than the integer size will be 0 or -1 */ |
1010 | 108 | if (op2_min >= SIZEOF_ZEND_LONG * 8) { |
1011 | 8 | op2_min = SIZEOF_ZEND_LONG * 8 - 1; |
1012 | 8 | } |
1013 | 108 | if (op2_max >= SIZEOF_ZEND_LONG * 8) { |
1014 | 20 | op2_max = SIZEOF_ZEND_LONG * 8 - 1; |
1015 | 20 | } |
1016 | | |
1017 | 108 | t1 = op1_min >> op2_min; |
1018 | 108 | t2 = op1_min >> op2_max; |
1019 | 108 | t3 = op1_max >> op2_min; |
1020 | 108 | t4 = op1_max >> op2_max; |
1021 | 108 | tmp->min = MIN(MIN(t1, t2), MIN(t3, t4)); |
1022 | 108 | tmp->max = MAX(MAX(t1, t2), MAX(t3, t4)); |
1023 | 108 | } |
1024 | 328 | return 1; |
1025 | 328 | } |
1026 | 181 | break; |
1027 | 711 | case ZEND_BW_OR: |
1028 | 711 | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
1029 | 525 | if (OP1_RANGE_UNDERFLOW() || |
1030 | 525 | OP2_RANGE_UNDERFLOW() || |
1031 | 525 | OP1_RANGE_OVERFLOW() || |
1032 | 525 | OP2_RANGE_OVERFLOW()) { |
1033 | 432 | tmp->min = ZEND_LONG_MIN; |
1034 | 432 | tmp->max = ZEND_LONG_MAX; |
1035 | 432 | } else { |
1036 | 93 | op1_min = OP1_MIN_RANGE(); |
1037 | 93 | op2_min = OP2_MIN_RANGE(); |
1038 | 93 | op1_max = OP1_MAX_RANGE(); |
1039 | 93 | op2_max = OP2_MAX_RANGE(); |
1040 | 93 | zend_ssa_range_or(op1_min, op1_max, op2_min, op2_max, tmp); |
1041 | 93 | } |
1042 | 525 | return 1; |
1043 | 525 | } |
1044 | 186 | break; |
1045 | 9.72k | case ZEND_BW_AND: |
1046 | 9.72k | if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) { |
1047 | 8.28k | if (OP1_RANGE_UNDERFLOW() || |
1048 | 8.28k | OP2_RANGE_UNDERFLOW() || |
1049 | 8.28k | OP1_RANGE_OVERFLOW() || |
1050 | 8.28k | OP2_RANGE_OVERFLOW()) { |
1051 | 7.36k | tmp->min = ZEND_LONG_MIN; |
1052 | 7.36k | tmp->max = ZEND_LONG_MAX; |
1053 | 7.36k | } else { |
1054 | 926 | op1_min = OP1_MIN_RANGE(); |
1055 | 926 | op2_min = OP2_MIN_RANGE(); |
1056 | 926 | op1_max = OP1_MAX_RANGE(); |
1057 | 926 | op2_max = OP2_MAX_RANGE(); |
1058 | 926 | zend_ssa_range_and(op1_min, op1_max, op2_min, op2_max, tmp); |
1059 | 926 | } |
1060 | 8.28k | return 1; |
1061 | 8.28k | } |
1062 | 1.44k | break; |
1063 | 2.03k | case ZEND_BW_XOR: |
1064 | | // TODO |
1065 | 2.03k | break; |
1066 | 69.6k | EMPTY_SWITCH_DEFAULT_CASE() |
1067 | 69.6k | } |
1068 | 18.9k | return 0; |
1069 | 69.6k | } |
1070 | | |
1071 | | static bool zend_inference_calc_range(const zend_op_array *op_array, const zend_ssa *ssa, int var, int widening, int narrowing, zend_ssa_range *tmp) |
1072 | 1.57M | { |
1073 | 1.57M | uint32_t line; |
1074 | 1.57M | const zend_op *opline; |
1075 | 1.57M | const zend_ssa_op *ssa_op; |
1076 | | |
1077 | 1.57M | if (ssa->vars[var].definition_phi) { |
1078 | 275k | const zend_ssa_phi *p = ssa->vars[var].definition_phi; |
1079 | 275k | int i; |
1080 | | |
1081 | 275k | tmp->underflow = 0; |
1082 | 275k | tmp->min = ZEND_LONG_MAX; |
1083 | 275k | tmp->max = ZEND_LONG_MIN; |
1084 | 275k | tmp->overflow = 0; |
1085 | 275k | if (p->pi >= 0 && p->has_range_constraint) { |
1086 | 25.2k | const zend_ssa_range_constraint *constraint = &p->constraint.range; |
1087 | 25.2k | if (constraint->negative) { |
1088 | 1.78k | int src1 = p->sources[0]; |
1089 | | |
1090 | 1.78k | if (ssa->var_info[src1].has_range) { |
1091 | 1.47k | *tmp = ssa->var_info[src1].range; |
1092 | 1.47k | if (constraint->range.min == constraint->range.max |
1093 | 1.47k | && !constraint->range.underflow |
1094 | 1.47k | && !constraint->range.overflow |
1095 | 1.47k | && p->constraint.range.min_ssa_var < 0 |
1096 | 1.47k | && p->constraint.range.max_ssa_var < 0 |
1097 | 1.47k | && ssa->vars[src1].definition >= 0) { |
1098 | | /* Check for constrained induction variable */ |
1099 | 136 | line = ssa->vars[src1].definition; |
1100 | 136 | opline = op_array->opcodes + line; |
1101 | 136 | switch (opline->opcode) { |
1102 | 0 | case ZEND_PRE_DEC: |
1103 | 56 | case ZEND_POST_DEC: |
1104 | 56 | if (!tmp->underflow) { |
1105 | 20 | const zend_ssa_phi *p = ssa->vars[ssa->ops[line].op1_use].definition_phi; |
1106 | | |
1107 | 20 | if (p && p->pi < 0 |
1108 | 20 | && ssa->cfg.blocks[p->block].predecessors_count == 2 |
1109 | 20 | && p->sources[1] == var |
1110 | 20 | && ssa->var_info[p->sources[0]].has_range |
1111 | 20 | && ssa->var_info[p->sources[0]].range.min > constraint->range.max) { |
1112 | 20 | tmp->min = constraint->range.max + 1; |
1113 | 20 | } |
1114 | 20 | } |
1115 | 56 | break; |
1116 | 0 | case ZEND_PRE_INC: |
1117 | 10 | case ZEND_POST_INC: |
1118 | 10 | if (!tmp->overflow) { |
1119 | 0 | const zend_ssa_phi *p = ssa->vars[ssa->ops[line].op1_use].definition_phi; |
1120 | |
|
1121 | 0 | if (p && p->pi < 0 |
1122 | 0 | && ssa->cfg.blocks[p->block].predecessors_count == 2 |
1123 | 0 | && p->sources[1] == var |
1124 | 0 | && ssa->var_info[p->sources[0]].has_range |
1125 | 0 | && ssa->var_info[p->sources[0]].range.max < constraint->range.min) { |
1126 | 0 | tmp->max = constraint->range.min - 1; |
1127 | 0 | } |
1128 | 0 | } |
1129 | 10 | break; |
1130 | 136 | } |
1131 | 136 | } |
1132 | 1.47k | } else if (narrowing) { |
1133 | 284 | tmp->underflow = 1; |
1134 | 284 | tmp->min = ZEND_LONG_MIN; |
1135 | 284 | tmp->max = ZEND_LONG_MAX; |
1136 | 284 | tmp->overflow = 1; |
1137 | 284 | } |
1138 | | |
1139 | | #ifdef NEG_RANGE |
1140 | | if (constraint->min_ssa_var < 0 && |
1141 | | constraint->max_ssa_var < 0 && |
1142 | | ssa->var_info[p->ssa_var].has_range) { |
1143 | | LOG_NEG_RANGE("%s() #%d [%ld..%ld] -> [%ld..%ld]?\n", |
1144 | | ZSTR_VAL(op_array->function_name), |
1145 | | p->ssa_var, |
1146 | | ssa->var_info[p->ssa_var].range.min, |
1147 | | ssa->var_info[p->ssa_var].range.max, |
1148 | | tmp->min, |
1149 | | tmp->max); |
1150 | | if (constraint->negative == NEG_USE_LT && |
1151 | | tmp->max >= constraint->range.min) { |
1152 | | tmp->overflow = 0; |
1153 | | tmp->max = constraint->range.min - 1; |
1154 | | LOG_NEG_RANGE(" => [%ld..%ld]\n", tmp->min, tmp->max); |
1155 | | } else if (constraint->negative == NEG_USE_GT && |
1156 | | tmp->min <= constraint->range.max) { |
1157 | | tmp->underflow = 0; |
1158 | | tmp->min = constraint->range.max + 1; |
1159 | | LOG_NEG_RANGE(" => [%ld..%ld]\n", tmp->min, tmp->max); |
1160 | | } |
1161 | | } |
1162 | | #endif |
1163 | 23.5k | } else if (ssa->var_info[p->sources[0]].has_range) { |
1164 | | /* intersection */ |
1165 | 23.2k | *tmp = ssa->var_info[p->sources[0]].range; |
1166 | 23.2k | if (constraint->min_ssa_var < 0) { |
1167 | 20.5k | tmp->underflow = constraint->range.underflow && tmp->underflow; |
1168 | 20.5k | tmp->min = MAX(constraint->range.min, tmp->min); |
1169 | 20.5k | #ifdef SYM_RANGE |
1170 | 20.5k | } else if (narrowing && ssa->var_info[constraint->min_ssa_var].has_range) { |
1171 | 881 | tmp->underflow = ssa->var_info[constraint->min_ssa_var].range.underflow && tmp->underflow; |
1172 | 881 | if (!add_will_overflow(ssa->var_info[constraint->min_ssa_var].range.min, constraint->range.min)) { |
1173 | 876 | tmp->min = MAX(ssa->var_info[constraint->min_ssa_var].range.min + constraint->range.min, tmp->min); |
1174 | 876 | } |
1175 | 881 | #endif |
1176 | 881 | } |
1177 | 23.2k | if (constraint->max_ssa_var < 0) { |
1178 | 19.4k | tmp->max = MIN(constraint->range.max, tmp->max); |
1179 | 19.4k | tmp->overflow = constraint->range.overflow && tmp->overflow; |
1180 | 19.4k | #ifdef SYM_RANGE |
1181 | 19.4k | } else if (narrowing && ssa->var_info[constraint->max_ssa_var].has_range) { |
1182 | 943 | if (!add_will_overflow(ssa->var_info[constraint->max_ssa_var].range.max, constraint->range.max)) { |
1183 | 938 | tmp->max = MIN(ssa->var_info[constraint->max_ssa_var].range.max + constraint->range.max, tmp->max); |
1184 | 938 | } |
1185 | 943 | tmp->overflow = ssa->var_info[constraint->max_ssa_var].range.overflow && tmp->overflow; |
1186 | 943 | #endif |
1187 | 943 | } |
1188 | 23.2k | } else if (narrowing) { |
1189 | 269 | if (constraint->min_ssa_var < 0) { |
1190 | 269 | tmp->underflow = constraint->range.underflow; |
1191 | 269 | tmp->min = constraint->range.min; |
1192 | 269 | #ifdef SYM_RANGE |
1193 | 269 | } else if (narrowing && ssa->var_info[constraint->min_ssa_var].has_range) { |
1194 | 0 | if (add_will_overflow(ssa->var_info[constraint->min_ssa_var].range.min, constraint->range.min)) { |
1195 | 0 | tmp->underflow = 1; |
1196 | 0 | tmp->min = ZEND_LONG_MIN; |
1197 | 0 | } else { |
1198 | 0 | tmp->underflow = ssa->var_info[constraint->min_ssa_var].range.underflow; |
1199 | 0 | tmp->min = ssa->var_info[constraint->min_ssa_var].range.min + constraint->range.min; |
1200 | 0 | } |
1201 | 0 | #endif |
1202 | 0 | } else { |
1203 | 0 | tmp->underflow = 1; |
1204 | 0 | tmp->min = ZEND_LONG_MIN; |
1205 | 0 | } |
1206 | 269 | if (constraint->max_ssa_var < 0) { |
1207 | 269 | tmp->max = constraint->range.max; |
1208 | 269 | tmp->overflow = constraint->range.overflow; |
1209 | 269 | #ifdef SYM_RANGE |
1210 | 269 | } else if (narrowing && ssa->var_info[constraint->max_ssa_var].has_range) { |
1211 | 0 | if (add_will_overflow(ssa->var_info[constraint->max_ssa_var].range.max, constraint->range.max)) { |
1212 | 0 | tmp->overflow = 1; |
1213 | 0 | tmp->max = ZEND_LONG_MAX; |
1214 | 0 | } else { |
1215 | 0 | tmp->max = ssa->var_info[constraint->max_ssa_var].range.max + constraint->range.max; |
1216 | 0 | tmp->overflow = ssa->var_info[constraint->max_ssa_var].range.overflow; |
1217 | 0 | } |
1218 | 0 | #endif |
1219 | 0 | } else { |
1220 | 0 | tmp->max = ZEND_LONG_MAX; |
1221 | 0 | tmp->overflow = 1; |
1222 | 0 | } |
1223 | 269 | } |
1224 | 250k | } else { |
1225 | 733k | for (i = 0; i < ssa->cfg.blocks[p->block].predecessors_count; i++) { |
1226 | 483k | ZEND_ASSERT(p->sources[i] >= 0); |
1227 | 483k | if (ssa->var_info[p->sources[i]].has_range) { |
1228 | | /* union */ |
1229 | 419k | tmp->underflow |= ssa->var_info[p->sources[i]].range.underflow; |
1230 | 419k | tmp->min = MIN(tmp->min, ssa->var_info[p->sources[i]].range.min); |
1231 | 419k | tmp->max = MAX(tmp->max, ssa->var_info[p->sources[i]].range.max); |
1232 | 419k | tmp->overflow |= ssa->var_info[p->sources[i]].range.overflow; |
1233 | 419k | } else if (narrowing) { |
1234 | 23.1k | tmp->underflow = 1; |
1235 | 23.1k | tmp->min = ZEND_LONG_MIN; |
1236 | 23.1k | tmp->max = ZEND_LONG_MAX; |
1237 | 23.1k | tmp->overflow = 1; |
1238 | 23.1k | } |
1239 | 483k | } |
1240 | 250k | } |
1241 | 275k | return (tmp->min <= tmp->max); |
1242 | 1.30M | } else if (ssa->vars[var].definition < 0) { |
1243 | 8.72k | return 0; |
1244 | 8.72k | } |
1245 | 1.29M | line = ssa->vars[var].definition; |
1246 | 1.29M | opline = op_array->opcodes + line; |
1247 | 1.29M | ssa_op = &ssa->ops[line]; |
1248 | | |
1249 | 1.29M | return zend_inference_propagate_range(op_array, ssa, opline, ssa_op, var, tmp); |
1250 | 1.57M | } |
1251 | | |
1252 | | ZEND_API bool zend_inference_propagate_range(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline, const zend_ssa_op* ssa_op, int var, zend_ssa_range *tmp) |
1253 | 1.29M | { |
1254 | 1.29M | tmp->underflow = 0; |
1255 | 1.29M | tmp->overflow = 0; |
1256 | 1.29M | switch (opline->opcode) { |
1257 | 23.5k | case ZEND_ADD: |
1258 | 29.0k | case ZEND_SUB: |
1259 | 36.9k | case ZEND_MUL: |
1260 | 40.0k | case ZEND_DIV: |
1261 | 43.2k | case ZEND_MOD: |
1262 | 44.8k | case ZEND_SL: |
1263 | 45.3k | case ZEND_SR: |
1264 | 45.9k | case ZEND_BW_OR: |
1265 | 49.1k | case ZEND_BW_AND: |
1266 | 51.1k | case ZEND_BW_XOR: |
1267 | 51.1k | if (ssa_op->result_def == var) { |
1268 | 51.1k | return zend_inference_calc_binary_op_range( |
1269 | 51.1k | op_array, ssa, opline, ssa_op, opline->opcode, tmp); |
1270 | 51.1k | } |
1271 | 0 | break; |
1272 | | |
1273 | 7.12k | case ZEND_BW_NOT: |
1274 | 7.12k | if (ssa_op->result_def == var) { |
1275 | 7.12k | if (OP1_HAS_RANGE()) { |
1276 | 5.17k | if (OP1_RANGE_UNDERFLOW() || |
1277 | 5.17k | OP1_RANGE_OVERFLOW()) { |
1278 | 2.59k | tmp->min = ZEND_LONG_MIN; |
1279 | 2.59k | tmp->max = ZEND_LONG_MAX; |
1280 | 2.59k | } else { |
1281 | 2.57k | zend_long op1_min = OP1_MIN_RANGE(); |
1282 | 2.57k | zend_long op1_max = OP1_MAX_RANGE(); |
1283 | 2.57k | tmp->min = ~op1_max; |
1284 | 2.57k | tmp->max = ~op1_min; |
1285 | 2.57k | } |
1286 | 5.17k | return 1; |
1287 | 5.17k | } |
1288 | 7.12k | } |
1289 | 1.95k | break; |
1290 | 1.95k | case ZEND_CAST: |
1291 | 1.06k | if (ssa_op->op1_def == var) { |
1292 | 0 | if (ssa_op->op1_def >= 0) { |
1293 | 0 | if (OP1_HAS_RANGE()) { |
1294 | 0 | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1295 | 0 | tmp->min = OP1_MIN_RANGE(); |
1296 | 0 | tmp->max = OP1_MAX_RANGE(); |
1297 | 0 | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1298 | 0 | return 1; |
1299 | 0 | } |
1300 | 0 | } |
1301 | 1.06k | } else if (ssa_op->result_def == var) { |
1302 | 1.06k | if (opline->extended_value == IS_LONG) { |
1303 | 204 | if (OP1_HAS_RANGE()) { |
1304 | 106 | tmp->min = OP1_MIN_RANGE(); |
1305 | 106 | tmp->max = OP1_MAX_RANGE(); |
1306 | 106 | return 1; |
1307 | 106 | } else { |
1308 | 98 | tmp->min = ZEND_LONG_MIN; |
1309 | 98 | tmp->max = ZEND_LONG_MAX; |
1310 | 98 | return 1; |
1311 | 98 | } |
1312 | 204 | } |
1313 | 1.06k | } |
1314 | 863 | break; |
1315 | 6.44k | case ZEND_QM_ASSIGN: |
1316 | 7.73k | case ZEND_JMP_SET: |
1317 | 8.99k | case ZEND_COALESCE: |
1318 | 9.39k | case ZEND_COPY_TMP: |
1319 | 9.39k | if (ssa_op->op1_def == var) { |
1320 | 0 | if (ssa_op->op1_def >= 0) { |
1321 | 0 | if (OP1_HAS_RANGE()) { |
1322 | 0 | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1323 | 0 | tmp->min = OP1_MIN_RANGE(); |
1324 | 0 | tmp->max = OP1_MAX_RANGE(); |
1325 | 0 | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1326 | 0 | return 1; |
1327 | 0 | } |
1328 | 0 | } |
1329 | 0 | } |
1330 | 9.39k | if (ssa_op->result_def == var) { |
1331 | 9.39k | if (OP1_HAS_RANGE()) { |
1332 | 6.69k | tmp->min = OP1_MIN_RANGE(); |
1333 | 6.69k | tmp->max = OP1_MAX_RANGE(); |
1334 | 6.69k | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1335 | 6.69k | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1336 | 6.69k | return 1; |
1337 | 6.69k | } |
1338 | 9.39k | } |
1339 | 2.70k | break; |
1340 | 2.70k | case ZEND_SEND_VAR: |
1341 | 0 | if (ssa_op->op1_def == var) { |
1342 | 0 | if (ssa_op->op1_def >= 0) { |
1343 | 0 | if (OP1_HAS_RANGE()) { |
1344 | 0 | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1345 | 0 | tmp->min = OP1_MIN_RANGE(); |
1346 | 0 | tmp->max = OP1_MAX_RANGE(); |
1347 | 0 | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1348 | 0 | return 1; |
1349 | 0 | } |
1350 | 0 | } |
1351 | 0 | } |
1352 | 0 | break; |
1353 | 20.3k | case ZEND_PRE_INC: |
1354 | 20.3k | if (ssa_op->op1_def == var || ssa_op->result_def == var) { |
1355 | 20.3k | if (OP1_HAS_RANGE()) { |
1356 | 19.9k | tmp->min = OP1_MIN_RANGE(); |
1357 | 19.9k | tmp->max = OP1_MAX_RANGE(); |
1358 | 19.9k | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1359 | 19.9k | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1360 | 19.9k | if (tmp->max < ZEND_LONG_MAX) { |
1361 | 17.1k | tmp->max++; |
1362 | 17.1k | } else { |
1363 | 2.83k | tmp->overflow = 1; |
1364 | 2.83k | } |
1365 | 19.9k | if (tmp->min < ZEND_LONG_MAX && !tmp->underflow) { |
1366 | 16.8k | tmp->min++; |
1367 | 16.8k | } |
1368 | 19.9k | return 1; |
1369 | 19.9k | } |
1370 | 20.3k | } |
1371 | 370 | break; |
1372 | 1.54k | case ZEND_PRE_DEC: |
1373 | 1.54k | if (ssa_op->op1_def == var || ssa_op->result_def == var) { |
1374 | 1.54k | if (OP1_HAS_RANGE()) { |
1375 | 1.33k | tmp->min = OP1_MIN_RANGE(); |
1376 | 1.33k | tmp->max = OP1_MAX_RANGE(); |
1377 | 1.33k | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1378 | 1.33k | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1379 | 1.33k | if (tmp->min > ZEND_LONG_MIN) { |
1380 | 94 | tmp->min--; |
1381 | 1.24k | } else { |
1382 | 1.24k | tmp->underflow = 1; |
1383 | 1.24k | } |
1384 | 1.33k | if (tmp->max > ZEND_LONG_MIN && !tmp->overflow) { |
1385 | 260 | tmp->max--; |
1386 | 260 | } |
1387 | 1.33k | return 1; |
1388 | 1.33k | } |
1389 | 1.54k | } |
1390 | 213 | break; |
1391 | 5.20k | case ZEND_POST_INC: |
1392 | 5.20k | if (ssa_op->op1_def == var || ssa_op->result_def == var) { |
1393 | 5.20k | if (OP1_HAS_RANGE()) { |
1394 | 5.03k | tmp->min = OP1_MIN_RANGE(); |
1395 | 5.03k | tmp->max = OP1_MAX_RANGE(); |
1396 | 5.03k | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1397 | 5.03k | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1398 | 5.03k | if (ssa_op->result_def == var) { |
1399 | 1.34k | return 1; |
1400 | 1.34k | } |
1401 | 3.68k | if (tmp->max < ZEND_LONG_MAX) { |
1402 | 2.75k | tmp->max++; |
1403 | 2.75k | } else { |
1404 | 936 | tmp->overflow = 1; |
1405 | 936 | } |
1406 | 3.68k | if (tmp->min < ZEND_LONG_MAX && !tmp->underflow) { |
1407 | 3.37k | tmp->min++; |
1408 | 3.37k | } |
1409 | 3.68k | return 1; |
1410 | 5.03k | } |
1411 | 5.20k | } |
1412 | 170 | break; |
1413 | 6.18k | case ZEND_POST_DEC: |
1414 | 6.18k | if (ssa_op->op1_def == var || ssa_op->result_def == var) { |
1415 | 6.18k | if (OP1_HAS_RANGE()) { |
1416 | 5.15k | tmp->min = OP1_MIN_RANGE(); |
1417 | 5.15k | tmp->max = OP1_MAX_RANGE(); |
1418 | 5.15k | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1419 | 5.15k | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1420 | 5.15k | if (ssa_op->result_def == var) { |
1421 | 2.37k | return 1; |
1422 | 2.37k | } |
1423 | 2.77k | if (tmp->min > ZEND_LONG_MIN) { |
1424 | 56 | tmp->min--; |
1425 | 2.72k | } else { |
1426 | 2.72k | tmp->underflow = 1; |
1427 | 2.72k | } |
1428 | 2.77k | if (tmp->max > ZEND_LONG_MIN && !tmp->overflow) { |
1429 | 374 | tmp->max--; |
1430 | 374 | } |
1431 | 2.77k | return 1; |
1432 | 5.15k | } |
1433 | 6.18k | } |
1434 | 1.03k | break; |
1435 | 1.81k | case ZEND_UNSET_DIM: |
1436 | 1.87k | case ZEND_UNSET_OBJ: |
1437 | 1.87k | if (ssa_op->op1_def == var) { |
1438 | | /* If op1 is scalar, UNSET_DIM and UNSET_OBJ have no effect, so we can keep |
1439 | | * the previous ranges. */ |
1440 | 1.87k | if (OP1_HAS_RANGE()) { |
1441 | 1.49k | tmp->min = OP1_MIN_RANGE(); |
1442 | 1.49k | tmp->max = OP1_MAX_RANGE(); |
1443 | 1.49k | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1444 | 1.49k | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1445 | 1.49k | return 1; |
1446 | 1.49k | } |
1447 | 1.87k | } |
1448 | 372 | break; |
1449 | 53.3k | case ZEND_ASSIGN: |
1450 | 53.3k | if (ssa_op->op1_def == var || ssa_op->op2_def == var || ssa_op->result_def == var) { |
1451 | 53.3k | if (OP2_HAS_RANGE()) { |
1452 | 44.8k | tmp->min = OP2_MIN_RANGE(); |
1453 | 44.8k | tmp->max = OP2_MAX_RANGE(); |
1454 | 44.8k | tmp->underflow = OP2_RANGE_UNDERFLOW(); |
1455 | 44.8k | tmp->overflow = OP2_RANGE_OVERFLOW(); |
1456 | 44.8k | return 1; |
1457 | 44.8k | } |
1458 | 53.3k | } |
1459 | 8.46k | break; |
1460 | 35.2k | case ZEND_ASSIGN_DIM: |
1461 | 39.6k | case ZEND_ASSIGN_OBJ: |
1462 | 39.9k | case ZEND_ASSIGN_STATIC_PROP: |
1463 | 41.6k | case ZEND_ASSIGN_DIM_OP: |
1464 | 42.5k | case ZEND_ASSIGN_OBJ_OP: |
1465 | 42.5k | case ZEND_ASSIGN_STATIC_PROP_OP: |
1466 | 42.5k | if ((ssa_op+1)->op1_def == var) { |
1467 | 0 | opline++; |
1468 | 0 | ssa_op++; |
1469 | 0 | if (OP1_HAS_RANGE()) { |
1470 | 0 | tmp->min = OP1_MIN_RANGE(); |
1471 | 0 | tmp->max = OP1_MAX_RANGE(); |
1472 | 0 | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1473 | 0 | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1474 | 0 | } |
1475 | 0 | return 1; |
1476 | 0 | } |
1477 | 42.5k | break; |
1478 | 42.5k | case ZEND_ASSIGN_OP: |
1479 | 24.0k | if (opline->extended_value != ZEND_CONCAT |
1480 | 24.0k | && opline->extended_value != ZEND_POW) { |
1481 | 18.5k | if (ssa_op->op1_def == var || ssa_op->result_def == var) { |
1482 | 18.5k | return zend_inference_calc_binary_op_range( |
1483 | 18.5k | op_array, ssa, opline, ssa_op, |
1484 | 18.5k | opline->extended_value, tmp); |
1485 | 18.5k | } |
1486 | 18.5k | } |
1487 | 5.58k | break; |
1488 | 5.58k | case ZEND_OP_DATA: |
1489 | 0 | if (ssa_op->op1_def == var) { |
1490 | 0 | if ((opline-1)->opcode == ZEND_ASSIGN_DIM || |
1491 | 0 | (opline-1)->opcode == ZEND_ASSIGN_OBJ || |
1492 | 0 | (opline-1)->opcode == ZEND_ASSIGN_STATIC_PROP || |
1493 | 0 | (opline-1)->opcode == ZEND_ASSIGN_DIM_OP || |
1494 | 0 | (opline-1)->opcode == ZEND_ASSIGN_OBJ_OP || |
1495 | 0 | (opline-1)->opcode == ZEND_ASSIGN_STATIC_PROP_OP) { |
1496 | 0 | if (OP1_HAS_RANGE()) { |
1497 | 0 | tmp->min = OP1_MIN_RANGE(); |
1498 | 0 | tmp->max = OP1_MAX_RANGE(); |
1499 | 0 | tmp->underflow = OP1_RANGE_UNDERFLOW(); |
1500 | 0 | tmp->overflow = OP1_RANGE_OVERFLOW(); |
1501 | 0 | return 1; |
1502 | 0 | } |
1503 | 0 | } |
1504 | 0 | break; |
1505 | 0 | } |
1506 | 0 | break; |
1507 | 11.7k | case ZEND_RECV: |
1508 | 13.0k | case ZEND_RECV_INIT: |
1509 | 13.0k | if (ssa_op->result_def == var) { |
1510 | 13.0k | if (op_array->arg_info && |
1511 | 13.0k | opline->op1.num <= op_array->num_args) { |
1512 | 13.0k | zend_type type = op_array->arg_info[opline->op1.num-1].type; |
1513 | 13.0k | uint32_t mask = ZEND_TYPE_PURE_MASK_WITHOUT_NULL(type); |
1514 | 13.0k | if (mask == MAY_BE_LONG) { |
1515 | 1.10k | tmp->underflow = 0; |
1516 | 1.10k | tmp->min = ZEND_LONG_MIN; |
1517 | 1.10k | tmp->max = ZEND_LONG_MAX; |
1518 | 1.10k | tmp->overflow = 0; |
1519 | 1.10k | return 1; |
1520 | 1.10k | } |
1521 | 13.0k | } |
1522 | 13.0k | } |
1523 | 11.9k | break; |
1524 | 11.9k | case ZEND_STRLEN: |
1525 | 301 | if (ssa_op->result_def == var) { |
1526 | | #if SIZEOF_ZEND_LONG == 4 |
1527 | | /* The length of a string is a non-negative integer. However, on 32-bit |
1528 | | * platforms overflows into negative lengths may occur, so it's better |
1529 | | * to not assume any particular range. */ |
1530 | | tmp->min = ZEND_LONG_MIN; |
1531 | | #else |
1532 | 301 | tmp->min = 0; |
1533 | 301 | #endif |
1534 | 301 | tmp->max = ZEND_LONG_MAX; |
1535 | 301 | return 1; |
1536 | 301 | } |
1537 | 0 | break; |
1538 | 44 | case ZEND_FUNC_NUM_ARGS: |
1539 | 44 | tmp->min = 0; |
1540 | 44 | tmp->max = ZEND_LONG_MAX; |
1541 | 44 | return 1; |
1542 | 454 | case ZEND_COUNT: |
1543 | | /* count() on Countable objects may return negative numbers */ |
1544 | 454 | tmp->min = ZEND_LONG_MIN; |
1545 | 454 | tmp->max = ZEND_LONG_MAX; |
1546 | 454 | return 1; |
1547 | 38.4k | case ZEND_DO_FCALL: |
1548 | 38.4k | case ZEND_DO_ICALL: |
1549 | 41.7k | case ZEND_DO_UCALL: |
1550 | 41.7k | case ZEND_DO_FCALL_BY_NAME: |
1551 | 41.7k | if (ssa_op->result_def == var) { |
1552 | 41.7k | const zend_func_info *func_info = ZEND_FUNC_INFO(op_array); |
1553 | 41.7k | const zend_call_info *call_info; |
1554 | 41.7k | if (!func_info || !func_info->call_map) { |
1555 | 9.11k | break; |
1556 | 9.11k | } |
1557 | | |
1558 | 32.6k | call_info = func_info->call_map[opline - op_array->opcodes]; |
1559 | 32.6k | if (!call_info || call_info->is_prototype) { |
1560 | 11.8k | break; |
1561 | 11.8k | } |
1562 | 20.8k | if (call_info->callee_func->type == ZEND_USER_FUNCTION) { |
1563 | 6.65k | func_info = ZEND_FUNC_INFO(&call_info->callee_func->op_array); |
1564 | 6.65k | if (func_info && func_info->return_info.has_range) { |
1565 | 276 | *tmp = func_info->return_info.range; |
1566 | 276 | return 1; |
1567 | 276 | } |
1568 | 6.65k | } |
1569 | | //TODO: we can't use type inference for internal functions at this point ??? |
1570 | | #if 0 |
1571 | | uint32_t type; |
1572 | | |
1573 | | type = zend_get_func_info(call_info, ssa); |
1574 | | if (!(type & (MAY_BE_ANY - (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG)))) { |
1575 | | tmp->underflow = 0; |
1576 | | tmp->min = 0; |
1577 | | tmp->max = 0; |
1578 | | tmp->overflow = 0; |
1579 | | if (type & MAY_BE_LONG) { |
1580 | | tmp->min = ZEND_LONG_MIN; |
1581 | | tmp->max = ZEND_LONG_MAX; |
1582 | | } else if (type & MAY_BE_TRUE) { |
1583 | | if (!(type & (MAY_BE_NULL|MAY_BE_FALSE))) { |
1584 | | tmp->min = 1; |
1585 | | } |
1586 | | tmp->max = 1; |
1587 | | } |
1588 | | return 1; |
1589 | | } |
1590 | | #endif |
1591 | 20.8k | } |
1592 | 20.5k | break; |
1593 | | // FIXME: support for more opcodes |
1594 | 1.01M | default: |
1595 | 1.01M | break; |
1596 | 1.29M | } |
1597 | 1.13M | return 0; |
1598 | 1.29M | } |
1599 | | |
1600 | | static void zend_inference_init_range(const zend_op_array *op_array, zend_ssa *ssa, int var, bool underflow, zend_long min, zend_long max, bool overflow) |
1601 | 839k | { |
1602 | 839k | if (underflow) { |
1603 | 818k | min = ZEND_LONG_MIN; |
1604 | 818k | } |
1605 | 839k | if (overflow) { |
1606 | 818k | max = ZEND_LONG_MAX; |
1607 | 818k | } |
1608 | 839k | ssa->var_info[var].has_range = 1; |
1609 | 839k | ssa->var_info[var].range.underflow = underflow; |
1610 | 839k | ssa->var_info[var].range.min = min; |
1611 | 839k | ssa->var_info[var].range.max = max; |
1612 | 839k | ssa->var_info[var].range.overflow = overflow; |
1613 | 839k | LOG_SSA_RANGE(" change range (init SCC %2d) %2d [%s%ld..%ld%s]\n", ssa->vars[var].scc, var, (underflow?"-- ":""), min, max, (overflow?" ++":"")); |
1614 | 839k | } |
1615 | | |
1616 | | static bool zend_inference_widening_meet(zend_ssa_var_info *var_info, zend_ssa_range *r) |
1617 | 38.0k | { |
1618 | 38.0k | if (!var_info->has_range) { |
1619 | 55 | var_info->has_range = 1; |
1620 | 38.0k | } else { |
1621 | 38.0k | if (r->underflow || |
1622 | 38.0k | var_info->range.underflow || |
1623 | 38.0k | r->min < var_info->range.min) { |
1624 | 29.0k | r->underflow = 1; |
1625 | 29.0k | r->min = ZEND_LONG_MIN; |
1626 | 29.0k | } |
1627 | 38.0k | if (r->overflow || |
1628 | 38.0k | var_info->range.overflow || |
1629 | 38.0k | r->max > var_info->range.max) { |
1630 | 31.4k | r->overflow = 1; |
1631 | 31.4k | r->max = ZEND_LONG_MAX; |
1632 | 31.4k | } |
1633 | 38.0k | if (var_info->range.min == r->min && |
1634 | 38.0k | var_info->range.max == r->max && |
1635 | 38.0k | var_info->range.underflow == r->underflow && |
1636 | 38.0k | var_info->range.overflow == r->overflow) { |
1637 | 34.7k | return 0; |
1638 | 34.7k | } |
1639 | 38.0k | } |
1640 | 3.31k | var_info->range = *r; |
1641 | 3.31k | return 1; |
1642 | 38.0k | } |
1643 | | |
1644 | | static bool zend_ssa_range_widening(const zend_op_array *op_array, zend_ssa *ssa, int var, int scc) |
1645 | 139k | { |
1646 | 139k | zend_ssa_range tmp; |
1647 | | |
1648 | 139k | if (zend_inference_calc_range(op_array, ssa, var, 1, 0, &tmp)) { |
1649 | 38.0k | if (zend_inference_widening_meet(&ssa->var_info[var], &tmp)) { |
1650 | 3.31k | LOG_SSA_RANGE(" change range (widening SCC %2d) %2d [%s%ld..%ld%s]\n", scc, var, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":"")); |
1651 | 3.31k | return 1; |
1652 | 3.31k | } |
1653 | 38.0k | } |
1654 | 136k | return 0; |
1655 | 139k | } |
1656 | | |
1657 | | static bool zend_inference_narrowing_meet(zend_ssa_var_info *var_info, zend_ssa_range *r) |
1658 | 248k | { |
1659 | 248k | if (!var_info->has_range) { |
1660 | 63.9k | var_info->has_range = 1; |
1661 | 184k | } else { |
1662 | 184k | if (!r->underflow && |
1663 | 184k | !var_info->range.underflow && |
1664 | 184k | var_info->range.min < r->min) { |
1665 | 62 | r->min = var_info->range.min; |
1666 | 62 | } |
1667 | 184k | if (!r->overflow && |
1668 | 184k | !var_info->range.overflow && |
1669 | 184k | var_info->range.max > r->max) { |
1670 | 26 | r->max = var_info->range.max; |
1671 | 26 | } |
1672 | 184k | if (r->underflow) { |
1673 | 103k | r->min = ZEND_LONG_MIN; |
1674 | 103k | } |
1675 | 184k | if (r->overflow) { |
1676 | 106k | r->max = ZEND_LONG_MAX; |
1677 | 106k | } |
1678 | 184k | if (var_info->range.min == r->min && |
1679 | 184k | var_info->range.max == r->max && |
1680 | 184k | var_info->range.underflow == r->underflow && |
1681 | 184k | var_info->range.overflow == r->overflow) { |
1682 | 137k | return 0; |
1683 | 137k | } |
1684 | 184k | } |
1685 | 111k | var_info->range = *r; |
1686 | 111k | return 1; |
1687 | 248k | } |
1688 | | |
1689 | | static bool zend_ssa_range_narrowing(const zend_op_array *op_array, zend_ssa *ssa, int var, int scc) |
1690 | 137k | { |
1691 | 137k | zend_ssa_range tmp; |
1692 | | |
1693 | 137k | if (zend_inference_calc_range(op_array, ssa, var, 0, 1, &tmp)) { |
1694 | 85.4k | if (zend_inference_narrowing_meet(&ssa->var_info[var], &tmp)) { |
1695 | 45.5k | LOG_SSA_RANGE(" change range (narrowing SCC %2d) %2d [%s%ld..%ld%s]\n", scc, var, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":"")); |
1696 | 45.5k | return 1; |
1697 | 45.5k | } |
1698 | 85.4k | } |
1699 | 92.3k | return 0; |
1700 | 137k | } |
1701 | | |
1702 | | #ifdef NEG_RANGE |
1703 | | # define CHECK_INNER_CYCLE(var2) \ |
1704 | | do { \ |
1705 | | if (ssa->vars[var2].scc == ssa->vars[var].scc && \ |
1706 | | !ssa->vars[var2].scc_entry && \ |
1707 | | !zend_bitset_in(visited, var2) && \ |
1708 | | zend_check_inner_cycles(op_array, ssa, worklist, visited, var2)) { \ |
1709 | | return 1; \ |
1710 | | } \ |
1711 | | } while (0) |
1712 | | |
1713 | | static bool zend_check_inner_cycles(const zend_op_array *op_array, zend_ssa *ssa, zend_bitset worklist, zend_bitset visited, int var) |
1714 | | { |
1715 | | if (zend_bitset_in(worklist, var)) { |
1716 | | return 1; |
1717 | | } |
1718 | | zend_bitset_incl(worklist, var); |
1719 | | FOR_EACH_VAR_USAGE(var, CHECK_INNER_CYCLE); |
1720 | | zend_bitset_incl(visited, var); |
1721 | | return 0; |
1722 | | } |
1723 | | #endif |
1724 | | |
1725 | | static void zend_infer_ranges_warmup(const zend_op_array *op_array, zend_ssa *ssa, const int *scc_var, const int *next_scc_var, int scc) |
1726 | 14.7k | { |
1727 | 14.7k | int worklist_len = zend_bitset_len(ssa->vars_count); |
1728 | 14.7k | int j, n; |
1729 | 14.7k | zend_ssa_range tmp; |
1730 | 14.7k | ALLOCA_FLAG(use_heap) |
1731 | 14.7k | zend_bitset worklist = do_alloca(sizeof(zend_ulong) * worklist_len * 2, use_heap); |
1732 | 14.7k | zend_bitset visited = worklist + worklist_len; |
1733 | | #ifdef NEG_RANGE |
1734 | | int has_inner_cycles = 0; |
1735 | | |
1736 | | memset(worklist, 0, sizeof(zend_ulong) * worklist_len); |
1737 | | memset(visited, 0, sizeof(zend_ulong) * worklist_len); |
1738 | | j = scc_var[scc]; |
1739 | | while (j >= 0) { |
1740 | | if (!zend_bitset_in(visited, j) && |
1741 | | zend_check_inner_cycles(op_array, ssa, worklist, visited, j)) { |
1742 | | has_inner_cycles = 1; |
1743 | | break; |
1744 | | } |
1745 | | j = next_scc_var[j]; |
1746 | | } |
1747 | | #endif |
1748 | | |
1749 | 14.7k | memset(worklist, 0, sizeof(zend_ulong) * worklist_len); |
1750 | | |
1751 | 251k | for (n = 0; n < RANGE_WARMUP_PASSES; n++) { |
1752 | 236k | j= scc_var[scc]; |
1753 | 2.28M | while (j >= 0) { |
1754 | 2.04M | if (ssa->vars[j].scc_entry |
1755 | 2.04M | && !(ssa->var_info[j].type & MAY_BE_REF)) { |
1756 | 467k | zend_bitset_incl(worklist, j); |
1757 | 467k | } |
1758 | 2.04M | j = next_scc_var[j]; |
1759 | 2.04M | } |
1760 | | |
1761 | 236k | memset(visited, 0, sizeof(zend_ulong) * worklist_len); |
1762 | | |
1763 | 7.08M | WHILE_WORKLIST(worklist, worklist_len, j) { |
1764 | 7.08M | if (zend_inference_calc_range(op_array, ssa, j, 0, 0, &tmp)) { |
1765 | | #ifdef NEG_RANGE |
1766 | | if (!has_inner_cycles && |
1767 | | ssa->var_info[j].has_range && |
1768 | | ssa->vars[j].definition_phi && |
1769 | | ssa->vars[j].definition_phi->pi >= 0 && |
1770 | | ssa->vars[j].definition_phi->has_range_constraint && |
1771 | | ssa->vars[j].definition_phi->constraint.range.negative && |
1772 | | ssa->vars[j].definition_phi->constraint.range.min_ssa_var < 0 && |
1773 | | ssa->vars[j].definition_phi->constraint.range.max_ssa_var < 0) { |
1774 | | zend_ssa_range_constraint *constraint = |
1775 | | &ssa->vars[j].definition_phi->constraint.range; |
1776 | | if (tmp.min == ssa->var_info[j].range.min && |
1777 | | tmp.max == ssa->var_info[j].range.max) { |
1778 | | if (constraint->negative == NEG_INIT) { |
1779 | | LOG_NEG_RANGE("#%d INVARIANT\n", j); |
1780 | | constraint->negative = NEG_INVARIANT; |
1781 | | } |
1782 | | } else if (tmp.min == ssa->var_info[j].range.min && |
1783 | | tmp.max == ssa->var_info[j].range.max + 1 && |
1784 | | tmp.max < constraint->range.min) { |
1785 | | if (constraint->negative == NEG_INIT || |
1786 | | constraint->negative == NEG_INVARIANT) { |
1787 | | LOG_NEG_RANGE("#%d LT\n", j); |
1788 | | constraint->negative = NEG_USE_LT; |
1789 | | //???NEG |
1790 | | } else if (constraint->negative == NEG_USE_GT) { |
1791 | | LOG_NEG_RANGE("#%d UNKNOWN\n", j); |
1792 | | constraint->negative = NEG_UNKNOWN; |
1793 | | } |
1794 | | } else if (tmp.max == ssa->var_info[j].range.max && |
1795 | | tmp.min == ssa->var_info[j].range.min - 1 && |
1796 | | tmp.min > constraint->range.max) { |
1797 | | if (constraint->negative == NEG_INIT || |
1798 | | constraint->negative == NEG_INVARIANT) { |
1799 | | LOG_NEG_RANGE("#%d GT\n", j); |
1800 | | constraint->negative = NEG_USE_GT; |
1801 | | //???NEG |
1802 | | } else if (constraint->negative == NEG_USE_LT) { |
1803 | | LOG_NEG_RANGE("#%d UNKNOWN\n", j); |
1804 | | constraint->negative = NEG_UNKNOWN; |
1805 | | } |
1806 | | } else { |
1807 | | LOG_NEG_RANGE("#%d UNKNOWN\n", j); |
1808 | | constraint->negative = NEG_UNKNOWN; |
1809 | | } |
1810 | | } |
1811 | | #endif |
1812 | 163k | if (zend_inference_narrowing_meet(&ssa->var_info[j], &tmp)) { |
1813 | 66.1k | LOG_SSA_RANGE(" change range (warmup %2d SCC %2d) %2d [%s%ld..%ld%s]\n", n, scc, j, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":"")); |
1814 | 66.1k | zend_bitset_incl(visited, j); |
1815 | 112k | FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR_1); |
1816 | 66.1k | } |
1817 | 163k | } |
1818 | 7.08M | } WHILE_WORKLIST_END(); |
1819 | 236k | } |
1820 | 14.7k | free_alloca(worklist, use_heap); |
1821 | 14.7k | } |
1822 | | |
1823 | | static void zend_infer_ranges(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */ |
1824 | 74.1k | { |
1825 | 74.1k | int worklist_len = zend_bitset_len(ssa->vars_count); |
1826 | 74.1k | zend_bitset worklist; |
1827 | 74.1k | int *next_scc_var; |
1828 | 74.1k | int *scc_var; |
1829 | 74.1k | zend_ssa_phi *p; |
1830 | 74.1k | zend_ssa_range tmp; |
1831 | 74.1k | int scc, j; |
1832 | 74.1k | ALLOCA_FLAG(use_heap); |
1833 | | |
1834 | 74.1k | worklist = do_alloca( |
1835 | 74.1k | ZEND_MM_ALIGNED_SIZE(sizeof(zend_ulong) * worklist_len) + |
1836 | 74.1k | ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->vars_count) + |
1837 | 74.1k | sizeof(int) * ssa->sccs, use_heap); |
1838 | 74.1k | next_scc_var = (int*)((char*)worklist + ZEND_MM_ALIGNED_SIZE(sizeof(zend_ulong) * worklist_len)); |
1839 | 74.1k | scc_var = (int*)((char*)next_scc_var + ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->vars_count)); |
1840 | | |
1841 | 74.1k | LOG_SSA_RANGE("Range Inference\n"); |
1842 | | |
1843 | | /* Create linked lists of SSA variables for each SCC */ |
1844 | 74.1k | memset(scc_var, -1, sizeof(int) * ssa->sccs); |
1845 | 1.20M | for (j = 0; j < ssa->vars_count; j++) { |
1846 | 1.12M | if (ssa->vars[j].scc >= 0) { |
1847 | 1.05M | next_scc_var[j] = scc_var[ssa->vars[j].scc]; |
1848 | 1.05M | scc_var[ssa->vars[j].scc] = j; |
1849 | 1.05M | } |
1850 | 1.12M | } |
1851 | | |
1852 | 1.02M | for (scc = 0; scc < ssa->sccs; scc++) { |
1853 | 946k | j = scc_var[scc]; |
1854 | 946k | if (next_scc_var[j] < 0) { |
1855 | | /* SCC with a single element */ |
1856 | 931k | if (ssa->var_info[j].type & MAY_BE_REF) { |
1857 | | /* pass */ |
1858 | 780k | } else if (zend_inference_calc_range(op_array, ssa, j, 0, 1, &tmp)) { |
1859 | 130k | zend_inference_init_range(op_array, ssa, j, tmp.underflow, tmp.min, tmp.max, tmp.overflow); |
1860 | 650k | } else { |
1861 | 650k | zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1); |
1862 | 650k | } |
1863 | 931k | } else { |
1864 | | /* Find SCC entry points */ |
1865 | 14.7k | memset(worklist, 0, sizeof(zend_ulong) * worklist_len); |
1866 | 128k | do { |
1867 | 128k | if (ssa->vars[j].scc_entry |
1868 | 128k | && !(ssa->var_info[j].type & MAY_BE_REF)) { |
1869 | 29.2k | zend_bitset_incl(worklist, j); |
1870 | 29.2k | } |
1871 | 128k | j = next_scc_var[j]; |
1872 | 128k | } while (j >= 0); |
1873 | | |
1874 | 14.7k | #if RANGE_WARMUP_PASSES > 0 |
1875 | 14.7k | zend_infer_ranges_warmup(op_array, ssa, scc_var, next_scc_var, scc); |
1876 | 14.7k | j = scc_var[scc]; |
1877 | 128k | do { |
1878 | 128k | if (!(ssa->var_info[j].type & MAY_BE_REF)) { |
1879 | 81.4k | zend_bitset_incl(worklist, j); |
1880 | 81.4k | } |
1881 | 128k | j = next_scc_var[j]; |
1882 | 128k | } while (j >= 0); |
1883 | 14.7k | #endif |
1884 | | |
1885 | | /* widening */ |
1886 | 543k | WHILE_WORKLIST(worklist, worklist_len, j) { |
1887 | 543k | if (zend_ssa_range_widening(op_array, ssa, j, scc)) { |
1888 | 5.31k | FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR); |
1889 | 2.94k | } |
1890 | 543k | } WHILE_WORKLIST_END(); |
1891 | | |
1892 | | /* initialize missing ranges */ |
1893 | 142k | for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) { |
1894 | 128k | if (!ssa->var_info[j].has_range |
1895 | 128k | && !(ssa->var_info[j].type & MAY_BE_REF)) { |
1896 | 58.6k | zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1); |
1897 | 70.4k | FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR); |
1898 | 58.6k | } |
1899 | 128k | } |
1900 | | |
1901 | | /* widening (second round) */ |
1902 | 324k | WHILE_WORKLIST(worklist, worklist_len, j) { |
1903 | 324k | if (zend_ssa_range_widening(op_array, ssa, j, scc)) { |
1904 | 727 | FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR); |
1905 | 365 | } |
1906 | 324k | } WHILE_WORKLIST_END(); |
1907 | | |
1908 | | /* Add all SCC entry variables into worklist for narrowing */ |
1909 | 142k | for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) { |
1910 | 128k | if (ssa->vars[j].definition_phi |
1911 | 128k | && ssa->vars[j].definition_phi->pi < 0 |
1912 | 128k | && !(ssa->var_info[j].type & MAY_BE_REF)) { |
1913 | | /* narrowing Phi functions first */ |
1914 | 8.98k | zend_ssa_range_narrowing(op_array, ssa, j, scc); |
1915 | 8.98k | } |
1916 | 128k | zend_bitset_incl(worklist, j); |
1917 | 128k | } |
1918 | | |
1919 | | /* narrowing */ |
1920 | 954k | WHILE_WORKLIST(worklist, worklist_len, j) { |
1921 | 954k | if (zend_ssa_range_narrowing(op_array, ssa, j, scc)) { |
1922 | 106k | FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR); |
1923 | 45.5k | #ifdef SYM_RANGE |
1924 | | /* Process symbolic control-flow constraints */ |
1925 | 45.5k | p = ssa->vars[j].sym_use_chain; |
1926 | 46.1k | while (p) { |
1927 | 624 | ADD_SCC_VAR(p->ssa_var); |
1928 | 624 | p = p->sym_use_chain; |
1929 | 624 | } |
1930 | 45.5k | #endif |
1931 | 45.5k | } |
1932 | 954k | } WHILE_WORKLIST_END(); |
1933 | 14.7k | } |
1934 | 946k | } |
1935 | | |
1936 | 74.1k | free_alloca(worklist, use_heap); |
1937 | 74.1k | } |
1938 | | /* }}} */ |
1939 | | |
1940 | 0 | static uint32_t get_ssa_alias_types(zend_ssa_alias_kind alias) { |
1941 | 0 | if (alias == HTTP_RESPONSE_HEADER_ALIAS) { |
1942 | 0 | return MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_RC1 | MAY_BE_RCN; |
1943 | 0 | } else { |
1944 | 0 | return MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
1945 | 0 | } |
1946 | 0 | } |
1947 | | |
1948 | | #define UPDATE_SSA_TYPE(_type, _var) \ |
1949 | 1.11M | do { \ |
1950 | 1.11M | uint32_t __type = (_type) & ~MAY_BE_GUARD; \ |
1951 | 1.11M | int __var = (_var); \ |
1952 | 1.11M | if (__type & MAY_BE_REF) { \ |
1953 | 196k | __type |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; \ |
1954 | 196k | } \ |
1955 | 1.11M | if (__var >= 0) { \ |
1956 | 1.11M | zend_ssa_var *__ssa_var = &ssa_vars[__var]; \ |
1957 | 1.11M | if (__ssa_var->var < op_array->num_args) { \ |
1958 | 31.9k | if (__type & MAY_BE_RC1) { \ |
1959 | 28.1k | /* TODO: may be captured by exception backtreace */ \ |
1960 | 28.1k | __type |= MAY_BE_RCN; \ |
1961 | 28.1k | } \ |
1962 | 31.9k | } \ |
1963 | 1.11M | if (__ssa_var->var < op_array->last_var) { \ |
1964 | 309k | if (__type & (MAY_BE_REF|MAY_BE_RCN)) { \ |
1965 | 236k | __type |= MAY_BE_RC1 | MAY_BE_RCN; \ |
1966 | 236k | } \ |
1967 | 309k | if ((__type & MAY_BE_RC1) && (__type & MAY_BE_STRING)) {\ |
1968 | 222k | /* TODO: support for array keys and ($str . "")*/ \ |
1969 | 222k | __type |= MAY_BE_RCN; \ |
1970 | 222k | } \ |
1971 | 309k | if ((__type & MAY_BE_RC1) && (__type & MAY_BE_OBJECT)) {\ |
1972 | 228k | /* TODO: object may be captured by magic handlers */\ |
1973 | 228k | __type |= MAY_BE_RCN; \ |
1974 | 228k | } \ |
1975 | 309k | if (__ssa_var->alias) { \ |
1976 | 0 | __type |= get_ssa_alias_types(__ssa_var->alias); \ |
1977 | 0 | } \ |
1978 | 309k | } \ |
1979 | 1.11M | if (ssa_var_info[__var].type != __type) { \ |
1980 | 926k | ZEND_ASSERT(ssa_opcodes != NULL || \ |
1981 | 926k | __ssa_var->var >= op_array->last_var || \ |
1982 | 926k | (ssa_var_info[__var].type & MAY_BE_REF) \ |
1983 | 926k | == (__type & MAY_BE_REF)); \ |
1984 | 926k | if (ssa_var_info[__var].type & ~__type) { \ |
1985 | 0 | emit_type_narrowing_warning(op_array, ssa, __var); \ |
1986 | 0 | return FAILURE; \ |
1987 | 0 | } \ |
1988 | 926k | ssa_var_info[__var].type = __type; \ |
1989 | 926k | if (update_worklist) { \ |
1990 | 926k | add_usages(op_array, ssa, worklist, __var); \ |
1991 | 926k | } \ |
1992 | 926k | } \ |
1993 | 1.11M | /*zend_bitset_excl(worklist, var);*/ \ |
1994 | 1.11M | } \ |
1995 | 1.11M | } while (0) |
1996 | | |
1997 | | #define UPDATE_SSA_OBJ_TYPE(_ce, _is_instanceof, var) \ |
1998 | 387k | do { \ |
1999 | 387k | if (var >= 0) { \ |
2000 | 387k | zend_class_entry *__ce = (_ce); \ |
2001 | 387k | bool __is_instanceof = (_is_instanceof); \ |
2002 | 387k | if (__ce && (__ce->ce_flags & ZEND_ACC_FINAL)) { \ |
2003 | 9.22k | __is_instanceof = false; \ |
2004 | 9.22k | } \ |
2005 | 387k | if (ssa_var_info[var].ce != __ce || \ |
2006 | 387k | ssa_var_info[var].is_instanceof != __is_instanceof) { \ |
2007 | 36.9k | ssa_var_info[var].ce = __ce; \ |
2008 | 36.9k | ssa_var_info[var].is_instanceof = __is_instanceof; \ |
2009 | 36.9k | if (update_worklist) { \ |
2010 | 36.9k | add_usages(op_array, ssa, worklist, var); \ |
2011 | 36.9k | } \ |
2012 | 36.9k | } \ |
2013 | 387k | /*zend_bitset_excl(worklist, var);*/ \ |
2014 | 387k | } \ |
2015 | 387k | } while (0) |
2016 | | |
2017 | 134k | #define COPY_SSA_OBJ_TYPE(from_var, to_var) do { \ |
2018 | 134k | if ((from_var) >= 0 && (ssa_var_info[(from_var)].type & MAY_BE_OBJECT) \ |
2019 | 134k | && ssa_var_info[(from_var)].ce && !(ssa_var_info[(to_var)].type & MAY_BE_REF)) { \ |
2020 | 4.29k | UPDATE_SSA_OBJ_TYPE(ssa_var_info[(from_var)].ce, \ |
2021 | 4.29k | ssa_var_info[(from_var)].is_instanceof, (to_var)); \ |
2022 | 130k | } else { \ |
2023 | 130k | UPDATE_SSA_OBJ_TYPE(NULL, 0, (to_var)); \ |
2024 | 130k | } \ |
2025 | 134k | } while (0) |
2026 | | |
2027 | | static void add_usages(const zend_op_array *op_array, zend_ssa *ssa, zend_bitset worklist, int var) |
2028 | 963k | { |
2029 | 963k | if (ssa->vars[var].phi_use_chain) { |
2030 | 187k | zend_ssa_phi *p = ssa->vars[var].phi_use_chain; |
2031 | 235k | do { |
2032 | 235k | zend_bitset_incl(worklist, p->ssa_var); |
2033 | 235k | p = zend_ssa_next_use_phi(ssa, var, p); |
2034 | 235k | } while (p); |
2035 | 187k | } |
2036 | 963k | if (ssa->vars[var].use_chain >= 0) { |
2037 | 831k | int use = ssa->vars[var].use_chain; |
2038 | 831k | zend_ssa_op *op; |
2039 | | |
2040 | 947k | do { |
2041 | 947k | op = ssa->ops + use; |
2042 | 947k | if (op->result_def >= 0) { |
2043 | 707k | zend_bitset_incl(worklist, op->result_def); |
2044 | 707k | } |
2045 | 947k | if (op->op1_def >= 0) { |
2046 | 102k | zend_bitset_incl(worklist, op->op1_def); |
2047 | 102k | } |
2048 | 947k | if (op->op2_def >= 0) { |
2049 | 8.28k | zend_bitset_incl(worklist, op->op2_def); |
2050 | 8.28k | } |
2051 | 947k | if (op_array->opcodes[use].opcode == ZEND_OP_DATA) { |
2052 | 9.99k | op--; |
2053 | 9.99k | if (op->result_def >= 0) { |
2054 | 2.33k | zend_bitset_incl(worklist, op->result_def); |
2055 | 2.33k | } |
2056 | 9.99k | if (op->op1_def >= 0) { |
2057 | 5.40k | zend_bitset_incl(worklist, op->op1_def); |
2058 | 5.40k | } |
2059 | 9.99k | if (op->op2_def >= 0) { |
2060 | 0 | zend_bitset_incl(worklist, op->op2_def); |
2061 | 0 | } |
2062 | 937k | } else if (use + 1 < op_array->last |
2063 | 937k | && op_array->opcodes[use + 1].opcode == ZEND_OP_DATA) { |
2064 | 10.4k | op++; |
2065 | 10.4k | if (op->result_def >= 0) { |
2066 | 0 | zend_bitset_incl(worklist, op->result_def); |
2067 | 0 | } |
2068 | 10.4k | if (op->op1_def >= 0) { |
2069 | 101 | zend_bitset_incl(worklist, op->op1_def); |
2070 | 101 | } |
2071 | 10.4k | if (op->op2_def >= 0) { |
2072 | 0 | zend_bitset_incl(worklist, op->op2_def); |
2073 | 0 | } |
2074 | 10.4k | } |
2075 | 947k | use = zend_ssa_next_use(ssa->ops, var, use); |
2076 | 947k | } while (use >= 0); |
2077 | 831k | } |
2078 | 963k | } |
2079 | | |
2080 | | static void emit_type_narrowing_warning(const zend_op_array *op_array, zend_ssa *ssa, int var) |
2081 | 0 | { |
2082 | 0 | int def_op_num = ssa->vars[var].definition; |
2083 | 0 | const zend_op *def_opline = def_op_num >= 0 ? &op_array->opcodes[def_op_num] : NULL; |
2084 | 0 | const char *def_op_name = def_opline ? zend_get_opcode_name(def_opline->opcode) : "PHI"; |
2085 | 0 | uint32_t lineno = def_opline ? def_opline->lineno : 0; |
2086 | 0 | zend_error_at( |
2087 | 0 | E_WARNING, op_array->filename, lineno, |
2088 | 0 | "Narrowing occurred during type inference of %s. Please file a bug report on https://github.com/php/php-src/issues", def_op_name); |
2089 | 0 | #if ZEND_DEBUG |
2090 | 0 | ZEND_ASSERT(0 && "Narrowing during type inference"); |
2091 | 0 | #endif |
2092 | 0 | } |
2093 | | |
2094 | | ZEND_API uint32_t ZEND_FASTCALL zend_array_type_info(const zval *zv) |
2095 | 14.0k | { |
2096 | 14.0k | HashTable *ht = Z_ARRVAL_P(zv); |
2097 | 14.0k | uint32_t tmp = MAY_BE_ARRAY; |
2098 | 14.0k | zend_string *str; |
2099 | 14.0k | zval *val; |
2100 | | |
2101 | 14.0k | if (Z_REFCOUNTED_P(zv)) { |
2102 | 10.3k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2103 | 10.3k | } else { |
2104 | 3.76k | tmp |= MAY_BE_RCN; |
2105 | 3.76k | } |
2106 | | |
2107 | 14.0k | if (zend_hash_num_elements(ht) == 0) { |
2108 | 3.79k | tmp |= MAY_BE_ARRAY_EMPTY; |
2109 | 10.2k | } else if (HT_IS_PACKED(ht)) { |
2110 | 8.02k | tmp |= MAY_BE_ARRAY_PACKED; |
2111 | 154k | ZEND_HASH_PACKED_FOREACH_VAL(ht, val) { |
2112 | 154k | tmp |= 1 << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT); |
2113 | 154k | } ZEND_HASH_FOREACH_END(); |
2114 | 8.02k | } else { |
2115 | 17.2k | ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(ht, str, val) { |
2116 | 17.2k | if (str) { |
2117 | 3.73k | tmp |= MAY_BE_ARRAY_STRING_HASH; |
2118 | 3.73k | } else { |
2119 | 2.63k | tmp |= MAY_BE_ARRAY_NUMERIC_HASH; |
2120 | 2.63k | } |
2121 | 17.2k | tmp |= 1 << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT); |
2122 | 17.2k | } ZEND_HASH_FOREACH_END(); |
2123 | 2.26k | } |
2124 | 14.0k | return tmp; |
2125 | 14.0k | } |
2126 | | |
2127 | | |
2128 | | ZEND_API uint32_t zend_array_element_type(uint32_t t1, uint8_t op_type, int write, int insert) |
2129 | 17.8k | { |
2130 | 17.8k | uint32_t tmp = 0; |
2131 | | |
2132 | 17.8k | if (t1 & MAY_BE_OBJECT) { |
2133 | 13.7k | if (!write) { |
2134 | | /* can't be REF because of ZVAL_COPY_DEREF() usage */ |
2135 | 7.14k | tmp |= MAY_BE_ANY | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
2136 | 7.14k | } else { |
2137 | 6.61k | tmp |= MAY_BE_ANY | MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
2138 | 6.61k | } |
2139 | 13.7k | if (write) { |
2140 | 6.61k | tmp |= MAY_BE_INDIRECT; |
2141 | 6.61k | } |
2142 | 13.7k | } |
2143 | 17.8k | if (t1 & MAY_BE_ARRAY) { |
2144 | 16.1k | if (insert) { |
2145 | 425 | tmp |= MAY_BE_NULL; |
2146 | 15.7k | } else { |
2147 | 15.7k | tmp |= MAY_BE_NULL | ((t1 & MAY_BE_ARRAY_OF_ANY) >> MAY_BE_ARRAY_SHIFT); |
2148 | 15.7k | if (tmp & MAY_BE_ARRAY) { |
2149 | 14.7k | tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
2150 | 14.7k | } |
2151 | 15.7k | if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
2152 | 14.9k | if (!write) { |
2153 | | /* can't be REF because of ZVAL_COPY_DEREF() usage */ |
2154 | 8.15k | tmp |= MAY_BE_RCN; |
2155 | 8.15k | if ((op_type & (IS_VAR|IS_TMP_VAR)) && (t1 & MAY_BE_RC1)) { |
2156 | 2.78k | tmp |= MAY_BE_RC1; |
2157 | 2.78k | } |
2158 | 8.15k | } else if (t1 & MAY_BE_ARRAY_OF_REF) { |
2159 | 6.11k | tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN; |
2160 | 6.11k | } else { |
2161 | 656 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2162 | 656 | } |
2163 | 14.9k | } |
2164 | 15.7k | } |
2165 | 16.1k | if (write) { |
2166 | 7.38k | tmp |= MAY_BE_INDIRECT; |
2167 | 7.38k | } |
2168 | 16.1k | } |
2169 | 17.8k | if (t1 & MAY_BE_STRING) { |
2170 | 12.7k | tmp |= MAY_BE_STRING | MAY_BE_RC1; |
2171 | 12.7k | if (write) { |
2172 | 6.54k | tmp |= MAY_BE_NULL; |
2173 | 6.54k | } |
2174 | 12.7k | } |
2175 | 17.8k | if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
2176 | 15.5k | tmp |= MAY_BE_NULL; |
2177 | 15.5k | if (write) { |
2178 | 7.45k | tmp |= MAY_BE_INDIRECT; |
2179 | 7.45k | } |
2180 | 15.5k | } |
2181 | 17.8k | if (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE)) { |
2182 | 13.6k | if (!write) { |
2183 | 7.08k | tmp |= MAY_BE_NULL; |
2184 | 7.08k | } |
2185 | 13.6k | } |
2186 | 17.8k | return tmp; |
2187 | 17.8k | } |
2188 | | |
2189 | | static uint32_t assign_dim_array_result_type( |
2190 | 29.4k | uint32_t arr_type, uint32_t dim_type, uint32_t value_type, uint8_t dim_op_type) { |
2191 | 29.4k | uint32_t tmp = 0; |
2192 | | /* Only add key type if we have a value type. We want to maintain the invariant that a |
2193 | | * key type exists iff a value type exists even in dead code that may use empty types. */ |
2194 | 29.4k | if (value_type & (MAY_BE_ANY|MAY_BE_UNDEF)) { |
2195 | 29.4k | if (value_type & MAY_BE_UNDEF) { |
2196 | 645 | value_type |= MAY_BE_NULL; |
2197 | 645 | } |
2198 | 29.4k | if (dim_op_type == IS_UNUSED) { |
2199 | 21.1k | if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
2200 | 1.12k | tmp |= MAY_BE_ARRAY_PACKED; |
2201 | 1.12k | } |
2202 | 21.1k | tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG; |
2203 | 21.1k | } else { |
2204 | 8.35k | if (dim_type & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) { |
2205 | 3.85k | if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
2206 | 2.39k | tmp |= MAY_BE_ARRAY_PACKED; |
2207 | 2.39k | } |
2208 | 3.85k | tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG; |
2209 | 3.85k | } |
2210 | 8.35k | if (dim_type & MAY_BE_STRING) { |
2211 | 3.93k | tmp |= MAY_BE_ARRAY_KEY_STRING; |
2212 | 3.93k | if (dim_op_type != IS_CONST) { |
2213 | | // FIXME: numeric string |
2214 | 2.34k | if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
2215 | 1.67k | tmp |= MAY_BE_ARRAY_PACKED; |
2216 | 1.67k | } |
2217 | 2.34k | tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG; |
2218 | 2.34k | } |
2219 | 3.93k | } |
2220 | 8.35k | if (dim_type & (MAY_BE_UNDEF|MAY_BE_NULL)) { |
2221 | 3.02k | tmp |= MAY_BE_ARRAY_KEY_STRING; |
2222 | 3.02k | } |
2223 | 8.35k | } |
2224 | 29.4k | } |
2225 | | /* Only add value type if we have a key type. It might be that the key type is illegal |
2226 | | * for arrays. */ |
2227 | 29.4k | if (tmp & MAY_BE_ARRAY_KEY_ANY) { |
2228 | 29.4k | tmp |= (value_type & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT; |
2229 | 29.4k | } |
2230 | 29.4k | tmp &= ~MAY_BE_ARRAY_EMPTY; |
2231 | 29.4k | return tmp; |
2232 | 29.4k | } |
2233 | | |
2234 | | static uint32_t assign_dim_result_type( |
2235 | 8.40k | uint32_t arr_type, uint32_t dim_type, uint32_t value_type, uint8_t dim_op_type) { |
2236 | 8.40k | uint32_t tmp = arr_type & ~(MAY_BE_RC1|MAY_BE_RCN); |
2237 | | |
2238 | 8.40k | if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
2239 | 5.40k | tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE); |
2240 | 5.40k | tmp |= MAY_BE_ARRAY|MAY_BE_RC1; |
2241 | 5.40k | } |
2242 | 8.40k | if (tmp & (MAY_BE_ARRAY|MAY_BE_STRING)) { |
2243 | 8.21k | tmp |= MAY_BE_RC1; |
2244 | 8.21k | } |
2245 | 8.40k | if (tmp & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
2246 | 4.15k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2247 | 4.15k | } |
2248 | 8.40k | if (tmp & MAY_BE_ARRAY) { |
2249 | 8.17k | tmp |= assign_dim_array_result_type(arr_type, dim_type, value_type, dim_op_type); |
2250 | 8.17k | } |
2251 | 8.40k | return tmp; |
2252 | 8.40k | } |
2253 | | |
2254 | | /* For binary ops that have compound assignment operators */ |
2255 | | static uint32_t binary_op_result_type( |
2256 | | zend_ssa *ssa, uint8_t opcode, uint32_t t1, uint32_t t2, int result_var, |
2257 | 51.9k | zend_long optimization_level) { |
2258 | 51.9k | uint32_t tmp = 0; |
2259 | 51.9k | uint32_t t1_type = (t1 & MAY_BE_ANY) | (t1 & MAY_BE_UNDEF ? MAY_BE_NULL : 0); |
2260 | 51.9k | uint32_t t2_type = (t2 & MAY_BE_ANY) | (t2 & MAY_BE_UNDEF ? MAY_BE_NULL : 0); |
2261 | | |
2262 | 51.9k | if (!(ZEND_OPTIMIZER_IGNORE_OVERLOADING & optimization_level)) { |
2263 | | /* Handle potentially overloaded operators. |
2264 | | * This could be made more precise by checking the class type, if known. */ |
2265 | 51.9k | if ((t1_type & MAY_BE_OBJECT) || (t2_type & MAY_BE_OBJECT)) { |
2266 | | /* This is somewhat GMP specific. */ |
2267 | 28.6k | tmp |= MAY_BE_OBJECT | MAY_BE_FALSE | MAY_BE_RC1; |
2268 | 28.6k | } |
2269 | 51.9k | } |
2270 | | |
2271 | 51.9k | switch (opcode) { |
2272 | 13.4k | case ZEND_ADD: |
2273 | 13.4k | if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) { |
2274 | 482 | if (result_var < 0 || |
2275 | 482 | !ssa->var_info[result_var].has_range || |
2276 | 482 | ssa->var_info[result_var].range.underflow || |
2277 | 482 | ssa->var_info[result_var].range.overflow) { |
2278 | | /* may overflow */ |
2279 | 298 | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2280 | 298 | } else { |
2281 | 184 | tmp |= MAY_BE_LONG; |
2282 | 184 | } |
2283 | 12.9k | } else if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) { |
2284 | 386 | tmp |= MAY_BE_DOUBLE; |
2285 | 12.5k | } else if (t1_type == MAY_BE_ARRAY && t2_type == MAY_BE_ARRAY) { |
2286 | 158 | tmp |= MAY_BE_ARRAY | MAY_BE_RC1; |
2287 | 158 | tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF); |
2288 | 158 | tmp |= t2 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF); |
2289 | 12.4k | } else { |
2290 | 12.4k | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2291 | 12.4k | if ((t1_type & MAY_BE_ARRAY) && (t2_type & MAY_BE_ARRAY)) { |
2292 | 1.52k | tmp |= MAY_BE_ARRAY | MAY_BE_RC1; |
2293 | 1.52k | tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF); |
2294 | 1.52k | tmp |= t2 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF); |
2295 | 1.52k | } |
2296 | 12.4k | } |
2297 | 13.4k | break; |
2298 | 3.87k | case ZEND_SUB: |
2299 | 10.8k | case ZEND_MUL: |
2300 | 10.8k | if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) { |
2301 | 822 | if (result_var < 0 || |
2302 | 822 | !ssa->var_info[result_var].has_range || |
2303 | 822 | ssa->var_info[result_var].range.underflow || |
2304 | 822 | ssa->var_info[result_var].range.overflow) { |
2305 | | /* may overflow */ |
2306 | 492 | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2307 | 492 | } else { |
2308 | 330 | tmp |= MAY_BE_LONG; |
2309 | 330 | } |
2310 | 10.0k | } else if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) { |
2311 | 156 | tmp |= MAY_BE_DOUBLE; |
2312 | 9.89k | } else { |
2313 | 9.89k | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2314 | 9.89k | } |
2315 | 10.8k | break; |
2316 | 2.87k | case ZEND_DIV: |
2317 | 2.94k | case ZEND_POW: |
2318 | 2.94k | if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) { |
2319 | 44 | tmp |= MAY_BE_DOUBLE; |
2320 | 2.89k | } else { |
2321 | 2.89k | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2322 | 2.89k | } |
2323 | | /* Division by zero results in Inf/-Inf/Nan (double), so it doesn't need any special |
2324 | | * handling */ |
2325 | 2.94k | break; |
2326 | 3.34k | case ZEND_MOD: |
2327 | 3.34k | tmp |= MAY_BE_LONG; |
2328 | | /* Division by zero results in an exception, so it doesn't need any special handling */ |
2329 | 3.34k | break; |
2330 | 645 | case ZEND_BW_OR: |
2331 | 5.64k | case ZEND_BW_AND: |
2332 | 7.62k | case ZEND_BW_XOR: |
2333 | 7.62k | if ((t1_type & MAY_BE_STRING) && (t2_type & MAY_BE_STRING)) { |
2334 | 777 | tmp |= MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN; |
2335 | 777 | } |
2336 | 7.62k | if ((t1_type & ~MAY_BE_STRING) || (t2_type & ~MAY_BE_STRING)) { |
2337 | 7.44k | tmp |= MAY_BE_LONG; |
2338 | 7.44k | } |
2339 | 7.62k | break; |
2340 | 1.70k | case ZEND_SL: |
2341 | 2.28k | case ZEND_SR: |
2342 | 2.28k | tmp |= MAY_BE_LONG; |
2343 | 2.28k | break; |
2344 | 11.4k | case ZEND_CONCAT: |
2345 | 11.4k | case ZEND_FAST_CONCAT: |
2346 | | /* TODO: +MAY_BE_OBJECT ??? */ |
2347 | 11.4k | tmp = MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN; |
2348 | 11.4k | break; |
2349 | 51.9k | EMPTY_SWITCH_DEFAULT_CASE() |
2350 | 51.9k | } |
2351 | 51.9k | return tmp; |
2352 | 51.9k | } |
2353 | | |
2354 | 29.6k | static uint32_t zend_convert_type_declaration_mask(uint32_t type_mask) { |
2355 | 29.6k | uint32_t result_mask = type_mask & MAY_BE_ANY; |
2356 | 29.6k | if (type_mask & MAY_BE_VOID) { |
2357 | 2.01k | result_mask |= MAY_BE_NULL; |
2358 | 2.01k | } |
2359 | 29.6k | if (type_mask & MAY_BE_CALLABLE) { |
2360 | 218 | result_mask |= MAY_BE_STRING|MAY_BE_OBJECT|MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF; |
2361 | 218 | } |
2362 | 29.6k | if (type_mask & MAY_BE_STATIC) { |
2363 | 134 | result_mask |= MAY_BE_OBJECT; |
2364 | 134 | } |
2365 | 29.6k | if (type_mask & MAY_BE_ARRAY) { |
2366 | 6.73k | result_mask |= MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF; |
2367 | 6.73k | } |
2368 | 29.6k | return result_mask; |
2369 | 29.6k | } |
2370 | | |
2371 | | static uint32_t zend_convert_type(const zend_script *script, zend_type type, zend_class_entry **pce) |
2372 | 50.4k | { |
2373 | 50.4k | if (pce) { |
2374 | 50.4k | *pce = NULL; |
2375 | 50.4k | } |
2376 | | |
2377 | 50.4k | if (!ZEND_TYPE_IS_SET(type)) { |
2378 | 20.8k | return MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_RC1|MAY_BE_RCN; |
2379 | 20.8k | } |
2380 | | |
2381 | 29.6k | uint32_t tmp = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(type)); |
2382 | 29.6k | if (ZEND_TYPE_IS_COMPLEX(type)) { |
2383 | 4.61k | tmp |= MAY_BE_OBJECT; |
2384 | 4.61k | if (pce) { |
2385 | | /* As we only have space to store one CE, |
2386 | | * we use a plain object type for class unions. */ |
2387 | 4.61k | if (ZEND_TYPE_HAS_NAME(type)) { |
2388 | 3.61k | zend_string *lcname = zend_string_tolower(ZEND_TYPE_NAME(type)); |
2389 | | // TODO: Pass through op_array. |
2390 | 3.61k | *pce = zend_optimizer_get_class_entry(script, NULL, lcname); |
2391 | 3.61k | zend_string_release_ex(lcname, 0); |
2392 | 3.61k | } |
2393 | 4.61k | } |
2394 | 4.61k | } |
2395 | 29.6k | if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
2396 | 20.6k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2397 | 20.6k | } |
2398 | 29.6k | return tmp; |
2399 | 50.4k | } |
2400 | | |
2401 | | ZEND_API uint32_t zend_fetch_arg_info_type(const zend_script *script, const zend_arg_info *arg_info, zend_class_entry **pce) |
2402 | 45.5k | { |
2403 | 45.5k | return zend_convert_type(script, arg_info->type, pce); |
2404 | 45.5k | } |
2405 | | |
2406 | 5.67k | static const zend_property_info *lookup_prop_info(const zend_class_entry *ce, zend_string *name, zend_class_entry *scope) { |
2407 | 5.67k | const zend_property_info *prop_info; |
2408 | | |
2409 | | /* If the class is linked, reuse the precise runtime logic. */ |
2410 | 5.67k | if ((ce->ce_flags & ZEND_ACC_LINKED) |
2411 | 5.67k | && (!scope || (scope->ce_flags & ZEND_ACC_LINKED))) { |
2412 | 4.93k | zend_class_entry *prev_scope = EG(fake_scope); |
2413 | 4.93k | EG(fake_scope) = scope; |
2414 | 4.93k | prop_info = zend_get_property_info(ce, name, 1); |
2415 | 4.93k | EG(fake_scope) = prev_scope; |
2416 | 4.93k | if (prop_info && prop_info != ZEND_WRONG_PROPERTY_INFO) { |
2417 | 4.27k | return prop_info; |
2418 | 4.27k | } |
2419 | 663 | return NULL; |
2420 | 4.93k | } |
2421 | | |
2422 | | /* Otherwise, handle only some safe cases */ |
2423 | 737 | prop_info = zend_hash_find_ptr(&ce->properties_info, name); |
2424 | 737 | if (prop_info && |
2425 | 737 | ((prop_info->ce == scope) || |
2426 | 605 | (!scope && (prop_info->flags & ZEND_ACC_PUBLIC))) |
2427 | 737 | ) { |
2428 | 597 | return prop_info; |
2429 | 597 | } |
2430 | 140 | return NULL; |
2431 | 737 | } |
2432 | | |
2433 | | static const zend_property_info *zend_fetch_prop_info(const zend_op_array *op_array, zend_ssa *ssa, const zend_op *opline, const zend_ssa_op *ssa_op) |
2434 | 71.6k | { |
2435 | 71.6k | const zend_property_info *prop_info = NULL; |
2436 | 71.6k | if (opline->op2_type == IS_CONST) { |
2437 | 70.7k | const zend_class_entry *ce = NULL; |
2438 | | |
2439 | 70.7k | if (opline->op1_type == IS_UNUSED && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) { |
2440 | 3.23k | ce = op_array->scope; |
2441 | 67.5k | } else if (ssa_op->op1_use >= 0) { |
2442 | 67.5k | ce = ssa->var_info[ssa_op->op1_use].ce; |
2443 | 67.5k | } |
2444 | 70.7k | if (ce) { |
2445 | 3.74k | prop_info = lookup_prop_info(ce, |
2446 | 3.74k | Z_STR_P(CRT_CONSTANT(opline->op2)), |
2447 | 3.74k | op_array->scope); |
2448 | 3.74k | if (prop_info && (prop_info->flags & ZEND_ACC_STATIC)) { |
2449 | 28 | prop_info = NULL; |
2450 | 28 | } |
2451 | 3.74k | } |
2452 | 70.7k | } |
2453 | 71.6k | return prop_info; |
2454 | 71.6k | } |
2455 | | |
2456 | | static const zend_property_info *zend_fetch_static_prop_info(const zend_script *script, const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) |
2457 | 2.33k | { |
2458 | 2.33k | const zend_property_info *prop_info = NULL; |
2459 | 2.33k | if (opline->op1_type == IS_CONST) { |
2460 | 2.19k | zend_class_entry *ce = NULL; |
2461 | 2.19k | if (opline->op2_type == IS_UNUSED) { |
2462 | 718 | int fetch_type = opline->op2.num & ZEND_FETCH_CLASS_MASK; |
2463 | 718 | switch (fetch_type) { |
2464 | 608 | case ZEND_FETCH_CLASS_SELF: |
2465 | 694 | case ZEND_FETCH_CLASS_STATIC: |
2466 | | /* We enforce that static property types cannot change during inheritance, so |
2467 | | * handling static the same way as self here is legal. */ |
2468 | 694 | ce = op_array->scope; |
2469 | 694 | break; |
2470 | 24 | case ZEND_FETCH_CLASS_PARENT: |
2471 | 24 | if (op_array->scope && (op_array->scope->ce_flags & ZEND_ACC_LINKED)) { |
2472 | 18 | ce = op_array->scope->parent; |
2473 | 18 | } |
2474 | 24 | break; |
2475 | 718 | } |
2476 | 1.47k | } else if (opline->op2_type == IS_CONST) { |
2477 | 1.32k | zval *zv = CRT_CONSTANT(opline->op2); |
2478 | 1.32k | ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(zv + 1)); |
2479 | 1.32k | } |
2480 | | |
2481 | 2.19k | if (ce) { |
2482 | 1.93k | zval *zv = CRT_CONSTANT(opline->op1); |
2483 | 1.93k | prop_info = lookup_prop_info(ce, Z_STR_P(zv), op_array->scope); |
2484 | 1.93k | if (prop_info && !(prop_info->flags & ZEND_ACC_STATIC)) { |
2485 | 12 | prop_info = NULL; |
2486 | 12 | } |
2487 | 1.93k | } |
2488 | 2.19k | } |
2489 | 2.33k | return prop_info; |
2490 | 2.33k | } |
2491 | | |
2492 | | static uint32_t zend_fetch_prop_type(const zend_script *script, const zend_property_info *prop_info, zend_class_entry **pce) |
2493 | 74.0k | { |
2494 | 74.0k | if (!prop_info) { |
2495 | 69.1k | if (pce) { |
2496 | 68.7k | *pce = NULL; |
2497 | 68.7k | } |
2498 | 69.1k | return MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN; |
2499 | 69.1k | } |
2500 | | |
2501 | 4.84k | return zend_convert_type(script, prop_info->type, pce); |
2502 | 74.0k | } |
2503 | | |
2504 | | static bool result_may_be_separated(zend_ssa *ssa, zend_ssa_op *ssa_op) |
2505 | 3.88k | { |
2506 | 3.88k | int tmp_var = ssa_op->result_def; |
2507 | | |
2508 | 3.88k | if (ssa->vars[tmp_var].use_chain >= 0 |
2509 | 3.88k | && !ssa->vars[tmp_var].phi_use_chain) { |
2510 | 3.88k | zend_ssa_op *use_op = &ssa->ops[ssa->vars[tmp_var].use_chain]; |
2511 | | |
2512 | | /* TODO: analyze instructions between ssa_op and use_op */ |
2513 | 3.88k | if (use_op == ssa_op + 1) { |
2514 | 3.69k | if ((use_op->op1_use == tmp_var && use_op->op1_use_chain < 0) |
2515 | 3.69k | || (use_op->op2_use == tmp_var && use_op->op2_use_chain < 0)) { |
2516 | 3.69k | return 0; |
2517 | 3.69k | } |
2518 | 3.69k | } |
2519 | 3.88k | } |
2520 | 191 | return 1; |
2521 | 3.88k | } |
2522 | | |
2523 | | static zend_always_inline zend_result _zend_update_type_info( |
2524 | | const zend_op_array *op_array, |
2525 | | zend_ssa *ssa, |
2526 | | const zend_script *script, |
2527 | | zend_bitset worklist, |
2528 | | const zend_op *opline, |
2529 | | zend_ssa_op *ssa_op, |
2530 | | const zend_op **ssa_opcodes, |
2531 | | zend_long optimization_level, |
2532 | | bool update_worklist) |
2533 | 863k | { |
2534 | 863k | uint32_t t1, t2; |
2535 | 863k | uint32_t tmp, orig; |
2536 | 863k | zend_ssa_var *ssa_vars = ssa->vars; |
2537 | 863k | zend_ssa_var_info *ssa_var_info = ssa->var_info; |
2538 | 863k | zend_class_entry *ce; |
2539 | 863k | int j; |
2540 | | |
2541 | 863k | if (opline->opcode == ZEND_OP_DATA) { |
2542 | 249 | opline--; |
2543 | 249 | ssa_op--; |
2544 | 249 | } |
2545 | | |
2546 | 863k | t1 = OP1_INFO(); |
2547 | 863k | t2 = OP2_INFO(); |
2548 | | |
2549 | | /* If one of the operands cannot have any type, this means the operand derives from |
2550 | | * unreachable code. Propagate the empty result early, so that that the following |
2551 | | * code may assume that operands have at least one type. */ |
2552 | 863k | if (!(t1 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)) |
2553 | 863k | || !(t2 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)) |
2554 | 863k | || (ssa_op->result_use >= 0 && !(RES_USE_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))) |
2555 | 863k | || ((opline->opcode == ZEND_ASSIGN_DIM_OP |
2556 | 860k | || opline->opcode == ZEND_ASSIGN_OBJ_OP |
2557 | 860k | || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP |
2558 | 860k | || opline->opcode == ZEND_ASSIGN_DIM |
2559 | 860k | || opline->opcode == ZEND_ASSIGN_OBJ) |
2560 | 860k | && !(OP1_DATA_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)) /*&& 0*/)) { |
2561 | 3.77k | tmp = 0; |
2562 | 3.77k | if (ssa_op->result_def >= 0 && !(ssa_var_info[ssa_op->result_def].type & MAY_BE_REF)) { |
2563 | 3.06k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2564 | 3.06k | } |
2565 | 3.77k | if (ssa_op->op1_def >= 0 && !(ssa_var_info[ssa_op->op1_def].type & MAY_BE_REF)) { |
2566 | 1.45k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
2567 | 1.45k | } |
2568 | 3.77k | if (ssa_op->op2_def >= 0 && !(ssa_var_info[ssa_op->op2_def].type & MAY_BE_REF)) { |
2569 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op2_def); |
2570 | 0 | } |
2571 | 3.77k | if (opline->opcode == ZEND_ASSIGN_DIM_OP |
2572 | 3.77k | || opline->opcode == ZEND_ASSIGN_OBJ_OP |
2573 | 3.77k | || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP |
2574 | 3.77k | || opline->opcode == ZEND_ASSIGN_DIM |
2575 | 3.77k | || opline->opcode == ZEND_ASSIGN_OBJ) { |
2576 | 655 | if ((ssa_op+1)->op1_def >= 0 && !(ssa_var_info[(ssa_op+1)->op1_def].type & MAY_BE_REF)) { |
2577 | 0 | UPDATE_SSA_TYPE(tmp, (ssa_op+1)->op1_def); |
2578 | 0 | } |
2579 | 655 | } |
2580 | 3.77k | return SUCCESS; |
2581 | 3.77k | } |
2582 | | |
2583 | 859k | switch (opline->opcode) { |
2584 | 10.7k | case ZEND_ADD: |
2585 | 14.1k | case ZEND_SUB: |
2586 | 19.6k | case ZEND_MUL: |
2587 | 22.3k | case ZEND_DIV: |
2588 | 22.3k | case ZEND_POW: |
2589 | 25.5k | case ZEND_MOD: |
2590 | 26.0k | case ZEND_BW_OR: |
2591 | 29.2k | case ZEND_BW_AND: |
2592 | 31.2k | case ZEND_BW_XOR: |
2593 | 32.8k | case ZEND_SL: |
2594 | 33.3k | case ZEND_SR: |
2595 | 41.7k | case ZEND_CONCAT: |
2596 | 41.7k | tmp = binary_op_result_type(ssa, opline->opcode, t1, t2, ssa_op->result_def, optimization_level); |
2597 | 41.7k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2598 | 41.7k | break; |
2599 | 41.7k | case ZEND_BW_NOT: |
2600 | 3.42k | tmp = 0; |
2601 | 3.42k | if (t1 & MAY_BE_STRING) { |
2602 | 1.17k | tmp |= MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN; |
2603 | 1.17k | } |
2604 | 3.42k | if (t1 & (MAY_BE_ANY-MAY_BE_STRING)) { |
2605 | 3.02k | tmp |= MAY_BE_LONG; |
2606 | 3.02k | } |
2607 | 3.42k | if (!(ZEND_OPTIMIZER_IGNORE_OVERLOADING & optimization_level)) { |
2608 | 3.42k | if (t1 & MAY_BE_OBJECT) { |
2609 | | /* Potentially overloaded operator. */ |
2610 | 561 | tmp |= MAY_BE_OBJECT | MAY_BE_RC1; |
2611 | 561 | } |
2612 | 3.42k | } |
2613 | 3.42k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2614 | 3.42k | break; |
2615 | 3.42k | case ZEND_BEGIN_SILENCE: |
2616 | 2.54k | UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def); |
2617 | 2.54k | break; |
2618 | 2.54k | case ZEND_BOOL_NOT: |
2619 | 2.35k | case ZEND_BOOL_XOR: |
2620 | 3.77k | case ZEND_IS_IDENTICAL: |
2621 | 4.44k | case ZEND_IS_NOT_IDENTICAL: |
2622 | 7.23k | case ZEND_IS_EQUAL: |
2623 | 9.18k | case ZEND_IS_NOT_EQUAL: |
2624 | 16.2k | case ZEND_IS_SMALLER: |
2625 | 18.8k | case ZEND_IS_SMALLER_OR_EQUAL: |
2626 | 19.1k | case ZEND_INSTANCEOF: |
2627 | 19.4k | case ZEND_JMPZ_EX: |
2628 | 19.7k | case ZEND_JMPNZ_EX: |
2629 | 19.7k | case ZEND_CASE: |
2630 | 19.9k | case ZEND_CASE_STRICT: |
2631 | 20.8k | case ZEND_BOOL: |
2632 | 20.9k | case ZEND_ISSET_ISEMPTY_CV: |
2633 | 20.9k | case ZEND_ISSET_ISEMPTY_VAR: |
2634 | 22.8k | case ZEND_ISSET_ISEMPTY_DIM_OBJ: |
2635 | 23.4k | case ZEND_ISSET_ISEMPTY_PROP_OBJ: |
2636 | 23.5k | case ZEND_ISSET_ISEMPTY_STATIC_PROP: |
2637 | 23.6k | case ZEND_ASSERT_CHECK: |
2638 | 23.6k | case ZEND_IN_ARRAY: |
2639 | 23.6k | case ZEND_ARRAY_KEY_EXISTS: |
2640 | 23.6k | UPDATE_SSA_TYPE(MAY_BE_FALSE|MAY_BE_TRUE, ssa_op->result_def); |
2641 | 23.6k | break; |
2642 | 23.6k | case ZEND_CAST: |
2643 | 1.07k | if (ssa_op->op1_def >= 0) { |
2644 | 0 | tmp = t1; |
2645 | 0 | if ((t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) && |
2646 | 0 | (opline->extended_value == IS_ARRAY || |
2647 | 0 | opline->extended_value == IS_OBJECT)) { |
2648 | 0 | tmp |= MAY_BE_RCN; |
2649 | 0 | } else if ((t1 & MAY_BE_STRING) && |
2650 | 0 | opline->extended_value == IS_STRING) { |
2651 | 0 | tmp |= MAY_BE_RCN; |
2652 | 0 | } |
2653 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
2654 | 0 | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
2655 | 0 | } |
2656 | 1.07k | tmp = 1 << opline->extended_value; |
2657 | 1.07k | if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
2658 | 833 | if ((tmp & MAY_BE_ANY) == (t1 & MAY_BE_ANY)) { |
2659 | 12 | tmp |= (t1 & MAY_BE_RC1) | MAY_BE_RCN; |
2660 | 821 | } else if ((opline->extended_value == IS_ARRAY || |
2661 | 821 | opline->extended_value == IS_OBJECT) && |
2662 | 821 | (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT))) { |
2663 | 361 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2664 | 460 | } else if (opline->extended_value == IS_STRING && |
2665 | 460 | (t1 & (MAY_BE_STRING|MAY_BE_OBJECT))) { |
2666 | 282 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2667 | 282 | } else { |
2668 | 178 | tmp |= MAY_BE_RC1; |
2669 | 178 | if (opline->extended_value == IS_ARRAY |
2670 | 178 | && (t1 & (MAY_BE_UNDEF|MAY_BE_NULL))) { |
2671 | 12 | tmp |= MAY_BE_RCN; |
2672 | 12 | } |
2673 | 178 | } |
2674 | 833 | } |
2675 | 1.07k | if (opline->extended_value == IS_ARRAY) { |
2676 | 167 | if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL)) { |
2677 | 105 | tmp |= MAY_BE_ARRAY_EMPTY; |
2678 | 105 | } |
2679 | 167 | if (t1 & MAY_BE_ARRAY) { |
2680 | 95 | tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF); |
2681 | 95 | } |
2682 | 167 | if (t1 & MAY_BE_OBJECT) { |
2683 | 149 | tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
2684 | 149 | } else if (t1 & (MAY_BE_ANY - MAY_BE_NULL)) { |
2685 | 16 | tmp |= ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) << MAY_BE_ARRAY_SHIFT) | ((t1 & MAY_BE_NULL) ? MAY_BE_ARRAY_KEY_LONG : MAY_BE_ARRAY_PACKED); |
2686 | 16 | } |
2687 | 167 | } |
2688 | 1.07k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2689 | 1.07k | break; |
2690 | 6.43k | case ZEND_QM_ASSIGN: |
2691 | 7.48k | case ZEND_JMP_SET: |
2692 | 8.74k | case ZEND_COALESCE: |
2693 | 9.14k | case ZEND_COPY_TMP: |
2694 | 9.14k | if (ssa_op->op1_def >= 0) { |
2695 | 0 | tmp = t1; |
2696 | 0 | if (t1 & (MAY_BE_RC1|MAY_BE_REF)) { |
2697 | 0 | tmp |= MAY_BE_RCN; |
2698 | 0 | } |
2699 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
2700 | 0 | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
2701 | 0 | } |
2702 | 9.14k | tmp = t1 & ~MAY_BE_UNDEF; |
2703 | 9.14k | if (opline->opcode != ZEND_COPY_TMP || opline->op1_type != IS_VAR) { |
2704 | 8.89k | tmp &= ~MAY_BE_REF; |
2705 | 8.89k | } |
2706 | 9.14k | if (t1 & MAY_BE_UNDEF) { |
2707 | 1.43k | tmp |= MAY_BE_NULL; |
2708 | 1.43k | } |
2709 | 9.14k | if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) { |
2710 | 3.97k | tmp |= (t1 & (MAY_BE_RC1|MAY_BE_RCN)); |
2711 | 3.97k | if (opline->opcode == ZEND_COPY_TMP || opline->op1_type == IS_CV) { |
2712 | 861 | tmp |= MAY_BE_RCN; |
2713 | 861 | } |
2714 | 3.97k | } |
2715 | 9.14k | if (opline->opcode == ZEND_COALESCE || opline->opcode == ZEND_JMP_SET) { |
2716 | | /* COALESCE and JMP_SET result can't be null */ |
2717 | 2.31k | tmp &= ~MAY_BE_NULL; |
2718 | 2.31k | if (opline->opcode == ZEND_JMP_SET) { |
2719 | | /* JMP_SET result can't be false either */ |
2720 | 1.05k | tmp &= ~MAY_BE_FALSE; |
2721 | 1.05k | } |
2722 | 2.31k | } |
2723 | 9.14k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2724 | 9.14k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def); |
2725 | 9.14k | break; |
2726 | 45.5k | case ZEND_JMP_NULL: |
2727 | 45.5k | { |
2728 | 45.5k | uint32_t short_circuiting_type = opline->extended_value & ZEND_SHORT_CIRCUITING_CHAIN_MASK; |
2729 | 45.5k | if (short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_EXPR) { |
2730 | 45.4k | tmp = MAY_BE_NULL; |
2731 | 45.4k | } else if (short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_ISSET) { |
2732 | 48 | tmp = MAY_BE_FALSE; |
2733 | 50 | } else { |
2734 | 50 | ZEND_ASSERT(short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_EMPTY); |
2735 | 50 | tmp = MAY_BE_TRUE; |
2736 | 50 | } |
2737 | 45.5k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2738 | 45.5k | break; |
2739 | 45.5k | } |
2740 | 45.5k | case ZEND_ASSIGN_OP: |
2741 | 9.72k | case ZEND_ASSIGN_DIM_OP: |
2742 | 10.1k | case ZEND_ASSIGN_OBJ_OP: |
2743 | 10.2k | case ZEND_ASSIGN_STATIC_PROP_OP: |
2744 | 10.2k | { |
2745 | 10.2k | const zend_property_info *prop_info = NULL; |
2746 | 10.2k | orig = 0; |
2747 | 10.2k | tmp = 0; |
2748 | 10.2k | if (opline->opcode == ZEND_ASSIGN_OBJ_OP) { |
2749 | 474 | prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op); |
2750 | 474 | orig = t1; |
2751 | 474 | t1 = zend_fetch_prop_type(script, prop_info, NULL); |
2752 | 474 | t2 = OP1_DATA_INFO(); |
2753 | 9.73k | } else if (opline->opcode == ZEND_ASSIGN_DIM_OP) { |
2754 | 1.43k | if (t1 & MAY_BE_ARRAY_OF_REF) { |
2755 | 1.21k | tmp |= MAY_BE_REF; |
2756 | 1.21k | } |
2757 | 1.43k | orig = t1; |
2758 | 1.43k | t1 = zend_array_element_type(t1, opline->op1_type, 1, 0); |
2759 | 1.43k | t2 = OP1_DATA_INFO(); |
2760 | 8.29k | } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) { |
2761 | 10 | prop_info = zend_fetch_static_prop_info(script, op_array, ssa, opline); |
2762 | 10 | t1 = zend_fetch_prop_type(script, prop_info, NULL); |
2763 | 10 | t2 = OP1_DATA_INFO(); |
2764 | 8.28k | } else { |
2765 | 8.28k | if (t1 & MAY_BE_REF) { |
2766 | 2.13k | tmp |= MAY_BE_REF; |
2767 | 2.13k | } |
2768 | 8.28k | } |
2769 | | |
2770 | 10.2k | tmp |= binary_op_result_type( |
2771 | 10.2k | ssa, opline->extended_value, t1, t2, |
2772 | 10.2k | opline->opcode == ZEND_ASSIGN_OP ? ssa_op->op1_def : -1, optimization_level); |
2773 | 10.2k | if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY)) { |
2774 | 3.98k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2775 | 3.98k | } |
2776 | 10.2k | if (tmp & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
2777 | 3.45k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
2778 | 3.45k | } |
2779 | | |
2780 | 10.2k | if (opline->opcode == ZEND_ASSIGN_DIM_OP) { |
2781 | 1.43k | if (opline->op1_type == IS_CV) { |
2782 | 1.24k | orig = assign_dim_result_type(orig, OP2_INFO(), tmp, opline->op2_type); |
2783 | 1.24k | UPDATE_SSA_TYPE(orig, ssa_op->op1_def); |
2784 | 1.24k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
2785 | 1.24k | } |
2786 | 8.77k | } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) { |
2787 | 474 | if (opline->op1_type == IS_CV) { |
2788 | 452 | orig = (orig & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN; |
2789 | 452 | UPDATE_SSA_TYPE(orig, ssa_op->op1_def); |
2790 | 452 | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
2791 | 452 | } |
2792 | 8.29k | } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) { |
2793 | | /* Nothing to do */ |
2794 | 8.28k | } else { |
2795 | 8.28k | if (opline->opcode == ZEND_ASSIGN_OP && ssa_op->result_def >= 0 && (tmp & MAY_BE_RC1)) { |
2796 | 3.26k | tmp |= MAY_BE_RCN; |
2797 | 3.26k | } |
2798 | 8.28k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
2799 | 8.28k | } |
2800 | 10.2k | if (ssa_op->result_def >= 0) { |
2801 | 6.16k | ce = NULL; |
2802 | 6.16k | if (opline->opcode == ZEND_ASSIGN_DIM_OP) { |
2803 | 829 | if (opline->op2_type == IS_UNUSED) { |
2804 | | /* When appending to an array and the LONG_MAX key is already used |
2805 | | * null will be returned. */ |
2806 | 20 | tmp |= MAY_BE_NULL; |
2807 | 20 | } |
2808 | 829 | if (t2 & (MAY_BE_ARRAY | MAY_BE_OBJECT)) { |
2809 | | /* Arrays and objects cannot be used as keys. */ |
2810 | 24 | tmp |= MAY_BE_NULL; |
2811 | 24 | } |
2812 | 829 | if (t1 & (MAY_BE_ANY - (MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING | MAY_BE_ARRAY))) { |
2813 | | /* null and false are implicitly converted to array, anything else |
2814 | | * results in a null return value. */ |
2815 | 773 | tmp |= MAY_BE_NULL; |
2816 | 773 | } |
2817 | 829 | if (tmp & MAY_BE_REF) { |
2818 | | /* Typed reference may cause auto conversion */ |
2819 | 749 | tmp |= MAY_BE_ANY; |
2820 | 749 | } |
2821 | 5.33k | } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) { |
2822 | | /* The return value must also satisfy the property type */ |
2823 | 182 | if (prop_info) { |
2824 | 8 | t1 = zend_fetch_prop_type(script, prop_info, &ce); |
2825 | 8 | if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG |
2826 | 8 | && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) { |
2827 | | /* DOUBLE may be auto-converted to LONG */ |
2828 | 0 | tmp |= MAY_BE_LONG; |
2829 | 0 | tmp &= ~MAY_BE_DOUBLE; |
2830 | 8 | } else if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING)) == MAY_BE_STRING |
2831 | 8 | && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE))) { |
2832 | | /* LONG/DOUBLE may be auto-converted to STRING */ |
2833 | 0 | tmp |= MAY_BE_STRING; |
2834 | 0 | tmp &= ~(MAY_BE_LONG|MAY_BE_DOUBLE); |
2835 | 0 | } |
2836 | 8 | tmp &= t1; |
2837 | 174 | } else { |
2838 | 174 | tmp |= MAY_BE_LONG | MAY_BE_STRING; |
2839 | 174 | } |
2840 | 5.15k | } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) { |
2841 | | /* The return value must also satisfy the property type */ |
2842 | 10 | if (prop_info) { |
2843 | 10 | t1 = zend_fetch_prop_type(script, prop_info, &ce); |
2844 | 10 | if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG |
2845 | 10 | && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) { |
2846 | | /* DOUBLE may be auto-converted to LONG */ |
2847 | 0 | tmp |= MAY_BE_LONG; |
2848 | 0 | tmp &= ~MAY_BE_DOUBLE; |
2849 | 10 | } else if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING)) == MAY_BE_STRING |
2850 | 10 | && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE))) { |
2851 | | /* LONG/DOUBLE may be auto-converted to STRING */ |
2852 | 8 | tmp |= MAY_BE_STRING; |
2853 | 8 | tmp &= ~(MAY_BE_LONG|MAY_BE_DOUBLE); |
2854 | 8 | } |
2855 | 10 | tmp &= t1; |
2856 | 10 | } else { |
2857 | 0 | tmp |= MAY_BE_LONG | MAY_BE_STRING; |
2858 | 0 | } |
2859 | 5.14k | } else { |
2860 | 5.14k | if (tmp & MAY_BE_REF) { |
2861 | | /* Typed reference may cause auto conversion */ |
2862 | 1.33k | tmp |= MAY_BE_ANY; |
2863 | 1.33k | } |
2864 | 5.14k | } |
2865 | 6.16k | tmp &= ~MAY_BE_REF; |
2866 | 6.16k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2867 | 6.16k | if (ce) { |
2868 | 0 | UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def); |
2869 | 0 | } |
2870 | 6.16k | } |
2871 | 10.2k | break; |
2872 | 10.2k | } |
2873 | 10.2k | case ZEND_PRE_INC: |
2874 | 6.73k | case ZEND_PRE_DEC: |
2875 | 6.73k | tmp = 0; |
2876 | 6.73k | if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) { |
2877 | 2.42k | tmp |= MAY_BE_RC1; |
2878 | 2.42k | if (ssa_op->result_def >= 0) { |
2879 | 760 | tmp |= MAY_BE_RCN; |
2880 | 760 | } |
2881 | 2.42k | } |
2882 | 6.73k | if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) { |
2883 | 1.42k | if (!ssa_var_info[ssa_op->op1_use].has_range || |
2884 | 1.42k | (opline->opcode == ZEND_PRE_DEC && |
2885 | 1.42k | (ssa_var_info[ssa_op->op1_use].range.underflow || |
2886 | 58 | ssa_var_info[ssa_op->op1_use].range.min == ZEND_LONG_MIN)) || |
2887 | 1.42k | (opline->opcode == ZEND_PRE_INC && |
2888 | 1.38k | (ssa_var_info[ssa_op->op1_use].range.overflow || |
2889 | 1.36k | ssa_var_info[ssa_op->op1_use].range.max == ZEND_LONG_MAX))) { |
2890 | | /* may overflow */ |
2891 | 321 | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2892 | 1.10k | } else { |
2893 | 1.10k | tmp |= MAY_BE_LONG; |
2894 | 1.10k | } |
2895 | 5.31k | } else { |
2896 | 5.31k | if (t1 & (MAY_BE_UNDEF | MAY_BE_NULL)) { |
2897 | 4.38k | if (opline->opcode == ZEND_PRE_INC) { |
2898 | 3.51k | tmp |= MAY_BE_LONG; |
2899 | 3.51k | } else { |
2900 | 866 | tmp |= MAY_BE_NULL; |
2901 | 866 | } |
2902 | 4.38k | } |
2903 | 5.31k | if (t1 & MAY_BE_LONG) { |
2904 | 4.18k | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2905 | 4.18k | } |
2906 | 5.31k | if (t1 & MAY_BE_DOUBLE) { |
2907 | 3.70k | tmp |= MAY_BE_DOUBLE; |
2908 | 3.70k | } |
2909 | 5.31k | if (t1 & MAY_BE_STRING) { |
2910 | 2.29k | tmp |= MAY_BE_STRING | MAY_BE_LONG | MAY_BE_DOUBLE; |
2911 | 2.29k | } |
2912 | 5.31k | tmp |= t1 & (MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_OBJECT); |
2913 | 5.31k | } |
2914 | 6.73k | if (ssa_op->result_def >= 0) { |
2915 | 1.65k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2916 | 1.65k | } |
2917 | 6.73k | if (ssa_op->op1_def >= 0) { |
2918 | 6.72k | if (t1 & MAY_BE_REF) { |
2919 | 1.97k | tmp |= MAY_BE_REF; |
2920 | 1.97k | } |
2921 | 6.72k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
2922 | 6.72k | } |
2923 | 6.73k | break; |
2924 | 6.73k | case ZEND_POST_INC: |
2925 | 5.14k | case ZEND_POST_DEC: |
2926 | 5.14k | if (ssa_op->result_def >= 0) { |
2927 | 5.14k | tmp = 0; |
2928 | 5.14k | if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) { |
2929 | 1.49k | tmp |= MAY_BE_RC1|MAY_BE_RCN; |
2930 | 1.49k | } |
2931 | 5.14k | tmp |= t1 & ~(MAY_BE_UNDEF|MAY_BE_REF|MAY_BE_RCN); |
2932 | 5.14k | if (t1 & MAY_BE_UNDEF) { |
2933 | 1.30k | tmp |= MAY_BE_NULL; |
2934 | 1.30k | } |
2935 | 5.14k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
2936 | 5.14k | } |
2937 | 5.14k | tmp = 0; |
2938 | 5.14k | if (t1 & MAY_BE_REF) { |
2939 | 684 | tmp |= MAY_BE_REF; |
2940 | 684 | } |
2941 | 5.14k | if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) { |
2942 | 1.49k | tmp |= MAY_BE_RC1; |
2943 | 1.49k | } |
2944 | 5.14k | if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) { |
2945 | 474 | if (!ssa_var_info[ssa_op->op1_use].has_range || |
2946 | 474 | (opline->opcode == ZEND_POST_DEC && |
2947 | 474 | (ssa_var_info[ssa_op->op1_use].range.underflow || |
2948 | 136 | ssa_var_info[ssa_op->op1_use].range.min == ZEND_LONG_MIN)) || |
2949 | 474 | (opline->opcode == ZEND_POST_INC && |
2950 | 348 | (ssa_var_info[ssa_op->op1_use].range.overflow || |
2951 | 338 | ssa_var_info[ssa_op->op1_use].range.max == ZEND_LONG_MAX))) { |
2952 | | /* may overflow */ |
2953 | 320 | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2954 | 320 | } else { |
2955 | 154 | tmp |= MAY_BE_LONG; |
2956 | 154 | } |
2957 | 4.67k | } else { |
2958 | 4.67k | if (t1 & (MAY_BE_UNDEF | MAY_BE_NULL)) { |
2959 | 2.63k | if (opline->opcode == ZEND_POST_INC) { |
2960 | 762 | tmp |= MAY_BE_LONG; |
2961 | 1.87k | } else { |
2962 | 1.87k | tmp |= MAY_BE_NULL; |
2963 | 1.87k | } |
2964 | 2.63k | } |
2965 | 4.67k | if (t1 & MAY_BE_LONG) { |
2966 | 3.46k | tmp |= MAY_BE_LONG | MAY_BE_DOUBLE; |
2967 | 3.46k | } |
2968 | 4.67k | if (t1 & MAY_BE_DOUBLE) { |
2969 | 3.19k | tmp |= MAY_BE_DOUBLE; |
2970 | 3.19k | } |
2971 | 4.67k | if (t1 & MAY_BE_STRING) { |
2972 | 996 | tmp |= MAY_BE_STRING | MAY_BE_LONG | MAY_BE_DOUBLE; |
2973 | 996 | } |
2974 | 4.67k | tmp |= t1 & (MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_RESOURCE | MAY_BE_ARRAY | MAY_BE_OBJECT | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_KEY_ANY); |
2975 | 4.67k | } |
2976 | 5.14k | if (ssa_op->op1_def >= 0) { |
2977 | 5.12k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
2978 | 5.12k | } |
2979 | 5.14k | break; |
2980 | 7.46k | case ZEND_ASSIGN_DIM: |
2981 | 7.46k | if (opline->op1_type == IS_CV) { |
2982 | 7.16k | tmp = assign_dim_result_type(t1, t2, OP1_DATA_INFO(), opline->op2_type); |
2983 | 7.16k | tmp |= ssa->var_info[ssa_op->op1_def].type & (MAY_BE_ARRAY_PACKED|MAY_BE_ARRAY_NUMERIC_HASH|MAY_BE_ARRAY_STRING_HASH); |
2984 | 7.16k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
2985 | 7.16k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
2986 | 7.16k | } |
2987 | 7.46k | if (ssa_op->result_def >= 0) { |
2988 | 4.01k | tmp = 0; |
2989 | 4.01k | if (t1 & MAY_BE_STRING) { |
2990 | 898 | tmp |= MAY_BE_STRING | MAY_BE_NULL; |
2991 | 898 | } |
2992 | 4.01k | if (t1 & MAY_BE_OBJECT) { |
2993 | 874 | tmp |= (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF); |
2994 | 874 | } |
2995 | 4.01k | if (t1 & (MAY_BE_ARRAY|MAY_BE_FALSE|MAY_BE_NULL|MAY_BE_UNDEF)) { |
2996 | 3.89k | tmp |= (OP1_DATA_INFO() & (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF)); |
2997 | | |
2998 | 3.89k | if (OP1_DATA_INFO() & MAY_BE_UNDEF) { |
2999 | 291 | tmp |= MAY_BE_NULL; |
3000 | 291 | } |
3001 | 3.89k | if (t1 & MAY_BE_ARRAY_OF_REF) { |
3002 | | /* A scalar type conversion may occur when assigning to a typed reference. */ |
3003 | 885 | tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING; |
3004 | 885 | } |
3005 | 3.89k | } |
3006 | 4.01k | if (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE)) { |
3007 | 906 | tmp |= MAY_BE_NULL; |
3008 | 906 | } |
3009 | 4.01k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
3010 | 4.01k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3011 | 4.01k | } |
3012 | 7.46k | if ((ssa_op+1)->op1_def >= 0) { |
3013 | 0 | opline++; |
3014 | 0 | ssa_op++; |
3015 | 0 | tmp = OP1_INFO(); |
3016 | 0 | if (tmp & (MAY_BE_ANY | MAY_BE_REF)) { |
3017 | 0 | if (tmp & MAY_BE_RC1) { |
3018 | 0 | tmp |= MAY_BE_RCN; |
3019 | 0 | } |
3020 | 0 | } |
3021 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3022 | 0 | } |
3023 | 7.46k | break; |
3024 | 7.46k | case ZEND_ASSIGN_OBJ: |
3025 | 4.54k | if (opline->op1_type == IS_CV) { |
3026 | 4.44k | zend_class_entry *ce = ssa_var_info[ssa_op->op1_use].ce; |
3027 | 4.44k | bool add_rc = (t1 & (MAY_BE_OBJECT|MAY_BE_REF)) && (!ce |
3028 | 4.19k | || ce->__set |
3029 | | /* Non-default write_property may be set within create_object. */ |
3030 | 4.19k | || ce->create_object |
3031 | 4.19k | || ce->default_object_handlers->write_property != zend_std_write_property |
3032 | 4.19k | || ssa_var_info[ssa_op->op1_use].is_instanceof); |
3033 | 4.44k | tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT|MAY_BE_RC1|MAY_BE_RCN))|(add_rc ? (MAY_BE_RC1|MAY_BE_RCN) : 0); |
3034 | 4.44k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3035 | 4.44k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3036 | 4.44k | } |
3037 | 4.54k | if (ssa_op->result_def >= 0) { |
3038 | | // TODO: If there is no __set we might do better |
3039 | 1.20k | tmp = zend_fetch_prop_type(script, |
3040 | 1.20k | zend_fetch_prop_info(op_array, ssa, opline, ssa_op), &ce); |
3041 | 1.20k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3042 | 1.20k | if (ce) { |
3043 | 0 | UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def); |
3044 | 0 | } |
3045 | 1.20k | } |
3046 | 4.54k | if ((ssa_op+1)->op1_def >= 0) { |
3047 | 0 | opline++; |
3048 | 0 | ssa_op++; |
3049 | 0 | tmp = OP1_INFO(); |
3050 | 0 | if (tmp & MAY_BE_RC1) { |
3051 | 0 | tmp |= MAY_BE_RCN; |
3052 | 0 | } |
3053 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3054 | 0 | } |
3055 | 4.54k | break; |
3056 | 4.54k | case ZEND_ASSIGN_STATIC_PROP: |
3057 | 248 | if (ssa_op->result_def >= 0) { |
3058 | 248 | tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN; |
3059 | 248 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3060 | 248 | } |
3061 | 248 | if ((ssa_op+1)->op1_def >= 0) { |
3062 | 0 | opline++; |
3063 | 0 | ssa_op++; |
3064 | 0 | tmp = OP1_INFO(); |
3065 | 0 | if (tmp & MAY_BE_RC1) { |
3066 | 0 | tmp |= MAY_BE_RCN; |
3067 | 0 | } |
3068 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3069 | 0 | } |
3070 | 248 | break; |
3071 | 412 | case ZEND_PRE_INC_OBJ: |
3072 | 773 | case ZEND_PRE_DEC_OBJ: |
3073 | 1.04k | case ZEND_POST_INC_OBJ: |
3074 | 1.23k | case ZEND_POST_DEC_OBJ: |
3075 | 1.23k | if (opline->op1_type == IS_CV) { |
3076 | 1.15k | tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN; |
3077 | 1.15k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3078 | 1.15k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3079 | 1.15k | } |
3080 | 1.23k | if (ssa_op->result_def >= 0) { |
3081 | | // TODO: ??? |
3082 | 992 | tmp = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3083 | 992 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3084 | 992 | } |
3085 | 1.23k | break; |
3086 | 73.0k | case ZEND_ASSIGN: |
3087 | 73.0k | if (ssa_op->op2_def >= 0) { |
3088 | 0 | tmp = t2; |
3089 | 0 | if (tmp & MAY_BE_RC1) { |
3090 | 0 | tmp |= MAY_BE_RCN; |
3091 | 0 | } |
3092 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op2_def); |
3093 | 0 | } |
3094 | 73.0k | tmp = t2 & ~(MAY_BE_UNDEF|MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN); |
3095 | 73.0k | if (t2 & MAY_BE_UNDEF) { |
3096 | 1.86k | tmp |= MAY_BE_NULL; |
3097 | 1.86k | } |
3098 | 73.0k | if (t1 & MAY_BE_REF) { |
3099 | 41.5k | tmp |= MAY_BE_REF; |
3100 | 41.5k | } |
3101 | 73.0k | if (t2 & MAY_BE_REF) { |
3102 | 4.06k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
3103 | 68.9k | } else if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) { |
3104 | 43.8k | tmp |= t2 & (MAY_BE_RC1|MAY_BE_RCN); |
3105 | 43.8k | } else if (t2 & (MAY_BE_RC1|MAY_BE_RCN)) { |
3106 | 8.73k | tmp |= MAY_BE_RCN; |
3107 | 8.73k | } |
3108 | 73.0k | if (RETURN_VALUE_USED(opline) && (tmp & MAY_BE_RC1)) { |
3109 | 10.7k | tmp |= MAY_BE_RCN; |
3110 | 10.7k | } |
3111 | 73.0k | if (ssa_op->op1_def >= 0) { |
3112 | 73.0k | if (ssa_var_info[ssa_op->op1_def].use_as_double) { |
3113 | 2 | tmp &= ~MAY_BE_LONG; |
3114 | 2 | tmp |= MAY_BE_DOUBLE; |
3115 | 2 | } |
3116 | 73.0k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3117 | 73.0k | COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op1_def); |
3118 | 73.0k | } |
3119 | 73.0k | if (ssa_op->result_def >= 0) { |
3120 | 24.3k | if (tmp & MAY_BE_REF) { |
3121 | | /* A scalar type conversion may occur when assigning to a typed reference. */ |
3122 | 8.17k | tmp &= ~MAY_BE_REF; |
3123 | 8.17k | tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN; |
3124 | 8.17k | } |
3125 | 24.3k | if ((tmp & (MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_RCN) { |
3126 | | /* refcount may be indirectly decremented. Make an exception if the result is used in the next instruction */ |
3127 | 1.12k | if (!ssa_opcodes) { |
3128 | 1.12k | if (ssa->vars[ssa_op->result_def].use_chain < 0 |
3129 | 1.12k | || opline + 1 != op_array->opcodes + ssa->vars[ssa_op->result_def].use_chain) { |
3130 | 152 | tmp |= MAY_BE_RC1; |
3131 | 152 | } |
3132 | 1.12k | } else { |
3133 | 0 | if (ssa->vars[ssa_op->result_def].use_chain < 0 |
3134 | 0 | || opline + 1 != ssa_opcodes[ssa->vars[ssa_op->result_def].use_chain]) { |
3135 | 0 | tmp |= MAY_BE_RC1; |
3136 | 0 | } |
3137 | 0 | } |
3138 | 1.12k | } |
3139 | 24.3k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3140 | 24.3k | COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def); |
3141 | 24.3k | } |
3142 | 73.0k | break; |
3143 | 73.0k | case ZEND_ASSIGN_REF: |
3144 | | // TODO: ??? |
3145 | 2.89k | if (opline->op2_type == IS_CV) { |
3146 | 1.96k | tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN); |
3147 | 1.96k | if (t2 & MAY_BE_UNDEF) { |
3148 | 386 | tmp |= MAY_BE_NULL; |
3149 | 386 | } |
3150 | 1.96k | UPDATE_SSA_TYPE(tmp, ssa_op->op2_def); |
3151 | 1.96k | } |
3152 | 2.89k | if (opline->op2_type == IS_VAR && opline->extended_value == ZEND_RETURNS_FUNCTION) { |
3153 | 192 | tmp = (MAY_BE_REF | MAY_BE_RCN | MAY_BE_RC1 | t2) & ~MAY_BE_UNDEF; |
3154 | 2.70k | } else { |
3155 | 2.70k | tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN); |
3156 | 2.70k | } |
3157 | 2.89k | if (t2 & MAY_BE_UNDEF) { |
3158 | 386 | tmp |= MAY_BE_NULL; |
3159 | 386 | } |
3160 | 2.89k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3161 | 2.89k | if (ssa_op->result_def >= 0) { |
3162 | 1.05k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3163 | 1.05k | } |
3164 | 2.89k | break; |
3165 | 2.89k | case ZEND_ASSIGN_OBJ_REF: |
3166 | 245 | if (opline->op1_type == IS_CV && ssa_op->op1_def >= 0) { |
3167 | 0 | tmp = t1; |
3168 | 0 | if (tmp & MAY_BE_OBJECT) { |
3169 | 0 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
3170 | 0 | } |
3171 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3172 | 0 | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3173 | 0 | } |
3174 | | |
3175 | 245 | t2 = OP1_DATA_INFO(); |
3176 | 245 | if ((opline+1)->op1_type == IS_VAR && (opline->extended_value & ZEND_RETURNS_FUNCTION)) { |
3177 | 0 | tmp = (MAY_BE_REF | MAY_BE_RCN | MAY_BE_RC1 | t2) & ~MAY_BE_UNDEF; |
3178 | 245 | } else { |
3179 | 245 | tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN); |
3180 | 245 | } |
3181 | 245 | if (t2 & MAY_BE_UNDEF) { |
3182 | 34 | tmp |= MAY_BE_NULL; |
3183 | 34 | } |
3184 | 245 | if (ssa_op->result_def >= 0) { |
3185 | 60 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3186 | 60 | } |
3187 | 245 | if ((opline+1)->op1_type == IS_CV) { |
3188 | 245 | opline++; |
3189 | 245 | ssa_op++; |
3190 | 245 | tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN); |
3191 | 245 | if (t2 & MAY_BE_UNDEF) { |
3192 | 34 | tmp |= MAY_BE_NULL; |
3193 | 34 | } |
3194 | 245 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3195 | 245 | } |
3196 | 245 | break; |
3197 | 245 | case ZEND_ASSIGN_STATIC_PROP_REF: |
3198 | 54 | if (ssa_op->result_def >= 0) { |
3199 | 38 | UPDATE_SSA_TYPE(MAY_BE_REF, ssa_op->result_def); |
3200 | 38 | } |
3201 | 54 | if ((opline+1)->op1_type == IS_CV) { |
3202 | 52 | opline++; |
3203 | 52 | ssa_op++; |
3204 | 52 | UPDATE_SSA_TYPE(MAY_BE_REF, ssa_op->op1_def); |
3205 | 52 | } |
3206 | 54 | break; |
3207 | 649 | case ZEND_BIND_GLOBAL: |
3208 | 649 | tmp = MAY_BE_REF | MAY_BE_ANY |
3209 | 649 | | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3210 | 649 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3211 | 649 | break; |
3212 | 5.90k | case ZEND_BIND_STATIC: |
3213 | 5.90k | tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF |
3214 | 5.90k | | ((opline->extended_value & ZEND_BIND_REF) ? MAY_BE_REF : (MAY_BE_RC1 | MAY_BE_RCN)); |
3215 | 5.90k | if (opline->extended_value & ZEND_BIND_IMPLICIT) { |
3216 | 4.39k | tmp |= MAY_BE_UNDEF; |
3217 | 4.39k | } |
3218 | 5.90k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3219 | 5.90k | break; |
3220 | 5.90k | case ZEND_BIND_INIT_STATIC_OR_JMP: |
3221 | 166 | tmp = MAY_BE_UNDEF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_REF; |
3222 | 166 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3223 | 166 | break; |
3224 | 166 | case ZEND_SEND_VAR: |
3225 | 0 | if (ssa_op->op1_def >= 0) { |
3226 | 0 | tmp = t1; |
3227 | 0 | if (t1 & (MAY_BE_RC1|MAY_BE_REF)) { |
3228 | 0 | tmp |= MAY_BE_RCN; |
3229 | 0 | } |
3230 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3231 | 0 | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3232 | 0 | } |
3233 | 0 | break; |
3234 | 480 | case ZEND_BIND_LEXICAL: |
3235 | 480 | if (ssa_op->op2_def >= 0) { |
3236 | 480 | if (opline->extended_value & ZEND_BIND_REF) { |
3237 | 480 | tmp = t2 | MAY_BE_REF; |
3238 | 480 | } else { |
3239 | 0 | tmp = t2 & ~(MAY_BE_RC1|MAY_BE_RCN); |
3240 | 0 | if (t2 & (MAY_BE_RC1|MAY_BE_RCN)) { |
3241 | 0 | tmp |= MAY_BE_RCN; |
3242 | 0 | } |
3243 | 0 | } |
3244 | 480 | UPDATE_SSA_TYPE(tmp, ssa_op->op2_def); |
3245 | 480 | COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op2_def); |
3246 | 480 | } |
3247 | 480 | break; |
3248 | 515 | case ZEND_YIELD: |
3249 | 515 | if (ssa_op->op1_def >= 0) { |
3250 | 54 | if (op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE) { |
3251 | 54 | tmp = t1 | MAY_BE_REF; |
3252 | 54 | } else { |
3253 | 0 | tmp = t1 & ~(MAY_BE_RC1|MAY_BE_RCN); |
3254 | 0 | if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) { |
3255 | 0 | tmp |= MAY_BE_RCN; |
3256 | 0 | } |
3257 | 0 | } |
3258 | 54 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3259 | 54 | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3260 | 54 | } |
3261 | 515 | if (ssa_op->result_def >= 0) { |
3262 | 465 | tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF |
3263 | 465 | | MAY_BE_RC1 | MAY_BE_RCN; |
3264 | 465 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3265 | 465 | } |
3266 | 515 | break; |
3267 | 6.13k | case ZEND_SEND_VAR_EX: |
3268 | 6.13k | case ZEND_SEND_FUNC_ARG: |
3269 | 6.13k | if (ssa_op->op1_def >= 0) { |
3270 | 6.13k | tmp = (t1 & MAY_BE_UNDEF)|MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF; |
3271 | 6.13k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3272 | 6.13k | } |
3273 | 6.13k | break; |
3274 | 6.13k | case ZEND_SEND_REF: |
3275 | 1.97k | if (ssa_op->op1_def >= 0) { |
3276 | 1.97k | tmp = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF; |
3277 | 1.97k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3278 | 1.97k | } |
3279 | 1.97k | break; |
3280 | 1.97k | case ZEND_SEND_UNPACK: |
3281 | 276 | if (ssa_op->op1_def >= 0) { |
3282 | 276 | tmp = t1; |
3283 | 276 | if (t1 & MAY_BE_ARRAY) { |
3284 | 270 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
3285 | 270 | if (t1 & MAY_BE_ARRAY_OF_ANY) { |
3286 | | /* SEND_UNPACK may acquire references into the array */ |
3287 | 270 | tmp |= MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3288 | 270 | } |
3289 | 270 | } |
3290 | 276 | if (t1 & MAY_BE_OBJECT) { |
3291 | 210 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
3292 | 210 | } |
3293 | 276 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3294 | 276 | } |
3295 | 276 | break; |
3296 | 1.83k | case ZEND_FAST_CONCAT: |
3297 | 12.8k | case ZEND_ROPE_INIT: |
3298 | 335k | case ZEND_ROPE_ADD: |
3299 | 346k | case ZEND_ROPE_END: |
3300 | 346k | UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def); |
3301 | 346k | break; |
3302 | 346k | case ZEND_RECV: |
3303 | 23.0k | case ZEND_RECV_INIT: |
3304 | 23.3k | case ZEND_RECV_VARIADIC: |
3305 | 23.3k | { |
3306 | | /* Typehinting */ |
3307 | 23.3k | zend_arg_info *arg_info = &op_array->arg_info[opline->op1.num-1]; |
3308 | | |
3309 | 23.3k | ce = NULL; |
3310 | 23.3k | tmp = zend_fetch_arg_info_type(script, arg_info, &ce); |
3311 | 23.3k | if (ZEND_ARG_SEND_MODE(arg_info)) { |
3312 | 1.50k | tmp |= MAY_BE_REF; |
3313 | 1.50k | ce = NULL; |
3314 | 1.50k | } |
3315 | | |
3316 | 23.3k | if (opline->opcode == ZEND_RECV_VARIADIC) { |
3317 | 350 | uint32_t elem_type = tmp & MAY_BE_REF |
3318 | 350 | ? MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF |
3319 | 350 | : (tmp & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT; |
3320 | 350 | tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|elem_type; |
3321 | 350 | ce = NULL; |
3322 | 350 | } |
3323 | | |
3324 | 23.3k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3325 | 23.3k | if (ce) { |
3326 | 692 | UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def); |
3327 | 22.6k | } else { |
3328 | 22.6k | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3329 | 22.6k | } |
3330 | 23.3k | break; |
3331 | 23.3k | } |
3332 | 537 | case ZEND_DECLARE_ANON_CLASS: |
3333 | 537 | UPDATE_SSA_TYPE(MAY_BE_CLASS, ssa_op->result_def); |
3334 | 537 | if (script && (ce = zend_hash_find_ptr(&script->class_table, Z_STR_P(CRT_CONSTANT(opline->op1)))) != NULL) { |
3335 | 537 | UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def); |
3336 | 537 | } |
3337 | 537 | break; |
3338 | 1.17k | case ZEND_FETCH_CLASS: |
3339 | 1.17k | UPDATE_SSA_TYPE(MAY_BE_CLASS, ssa_op->result_def); |
3340 | 1.17k | if (opline->op2_type == IS_UNUSED) { |
3341 | 0 | switch (opline->op1.num & ZEND_FETCH_CLASS_MASK) { |
3342 | 0 | case ZEND_FETCH_CLASS_SELF: |
3343 | 0 | if (op_array->scope) { |
3344 | 0 | UPDATE_SSA_OBJ_TYPE(op_array->scope, 0, ssa_op->result_def); |
3345 | 0 | } else { |
3346 | 0 | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3347 | 0 | } |
3348 | 0 | break; |
3349 | 0 | case ZEND_FETCH_CLASS_PARENT: |
3350 | 0 | if (op_array->scope && op_array->scope->parent && (op_array->scope->ce_flags & ZEND_ACC_LINKED)) { |
3351 | 0 | UPDATE_SSA_OBJ_TYPE(op_array->scope->parent, 0, ssa_op->result_def); |
3352 | 0 | } else { |
3353 | 0 | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3354 | 0 | } |
3355 | 0 | break; |
3356 | 0 | case ZEND_FETCH_CLASS_STATIC: |
3357 | 0 | if (op_array->scope && (op_array->scope->ce_flags & ZEND_ACC_FINAL)) { |
3358 | 0 | UPDATE_SSA_OBJ_TYPE(op_array->scope, 0, ssa_op->result_def); |
3359 | 0 | } else { |
3360 | 0 | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3361 | 0 | } |
3362 | 0 | break; |
3363 | 0 | default: |
3364 | 0 | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3365 | 0 | break; |
3366 | 0 | } |
3367 | 1.17k | } else if (opline->op2_type == IS_CONST) { |
3368 | 34 | zval *zv = CRT_CONSTANT(opline->op2); |
3369 | 34 | if (Z_TYPE_P(zv) == IS_STRING) { |
3370 | 34 | ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(zv+1)); |
3371 | 34 | UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def); |
3372 | 34 | } else { |
3373 | 0 | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3374 | 0 | } |
3375 | 1.13k | } else { |
3376 | 1.13k | COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def); |
3377 | 1.13k | } |
3378 | 1.17k | break; |
3379 | 25.0k | case ZEND_NEW: |
3380 | 25.0k | tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_OBJECT; |
3381 | 25.0k | ce = zend_optimizer_get_class_entry_from_op1(script, op_array, opline); |
3382 | 25.0k | if (ce) { |
3383 | 21.6k | UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def); |
3384 | 21.6k | } else if ((t1 & MAY_BE_CLASS) && ssa_op->op1_use >= 0 && ssa_var_info[ssa_op->op1_use].ce) { |
3385 | 541 | UPDATE_SSA_OBJ_TYPE(ssa_var_info[ssa_op->op1_use].ce, ssa_var_info[ssa_op->op1_use].is_instanceof, ssa_op->result_def); |
3386 | 541 | if (!ssa_var_info[ssa_op->result_def].is_instanceof) { |
3387 | 537 | ce = ssa_var_info[ssa_op->op1_use].ce; |
3388 | 537 | } |
3389 | 2.87k | } else { |
3390 | 2.87k | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3391 | 2.87k | } |
3392 | | /* New objects without constructors cannot escape. */ |
3393 | 25.0k | if (ce |
3394 | 25.0k | && !ce->constructor |
3395 | 25.0k | && !ce->create_object |
3396 | 25.0k | && ce->default_object_handlers->get_constructor == zend_std_get_constructor) { |
3397 | 10.6k | tmp &= ~MAY_BE_RCN; |
3398 | 10.6k | } |
3399 | 25.0k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3400 | 25.0k | break; |
3401 | 25.0k | case ZEND_CLONE: |
3402 | 375 | UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_OBJECT, ssa_op->result_def); |
3403 | 375 | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def); |
3404 | 375 | break; |
3405 | 3.90k | case ZEND_INIT_ARRAY: |
3406 | 21.3k | case ZEND_ADD_ARRAY_ELEMENT: |
3407 | 21.3k | if (ssa_op->op1_def >= 0) { |
3408 | 406 | if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) { |
3409 | 406 | tmp = (MAY_BE_REF | t1) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN); |
3410 | 406 | if (t1 & MAY_BE_UNDEF) { |
3411 | 162 | tmp |= MAY_BE_NULL; |
3412 | 162 | } |
3413 | 406 | } else if ((t1 & (MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_REF) { |
3414 | 0 | tmp = (MAY_BE_REF | t1) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN); |
3415 | 0 | if (t1 & MAY_BE_UNDEF) { |
3416 | 0 | tmp |= MAY_BE_NULL; |
3417 | 0 | } |
3418 | 0 | } else if (t1 & MAY_BE_REF) { |
3419 | 0 | tmp = (MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | t1); |
3420 | 0 | } else { |
3421 | 0 | tmp = t1; |
3422 | 0 | if (t1 & MAY_BE_RC1) { |
3423 | 0 | tmp |= MAY_BE_RCN; |
3424 | 0 | } |
3425 | 0 | } |
3426 | 406 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3427 | 406 | } |
3428 | 21.3k | if (ssa_op->result_def >= 0) { |
3429 | 21.3k | uint32_t arr_type; |
3430 | 21.3k | if (opline->opcode == ZEND_INIT_ARRAY) { |
3431 | 3.90k | arr_type = 0; |
3432 | 17.4k | } else { |
3433 | 17.4k | arr_type = RES_USE_INFO(); |
3434 | 17.4k | } |
3435 | 21.3k | tmp = MAY_BE_RC1|MAY_BE_ARRAY|arr_type; |
3436 | 21.3k | if (opline->opcode == ZEND_INIT_ARRAY && opline->op1_type == IS_UNUSED) { |
3437 | 78 | tmp |= MAY_BE_ARRAY_EMPTY; |
3438 | 78 | } |
3439 | 21.3k | if (opline->op1_type != IS_UNUSED |
3440 | 21.3k | && (opline->op2_type == IS_UNUSED |
3441 | 21.3k | || (t2 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE|MAY_BE_STRING)))) { |
3442 | 21.3k | tmp |= assign_dim_array_result_type(arr_type, t2, t1, opline->op2_type); |
3443 | 21.3k | if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) { |
3444 | 438 | tmp |= MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF; |
3445 | 438 | } |
3446 | 21.3k | } |
3447 | 21.3k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3448 | 21.3k | } |
3449 | 21.3k | break; |
3450 | 21.3k | case ZEND_ADD_ARRAY_UNPACK: |
3451 | 150 | tmp = ssa_var_info[ssa_op->result_use].type; |
3452 | 150 | ZEND_ASSERT(tmp & MAY_BE_ARRAY); |
3453 | 150 | tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF); |
3454 | 150 | if (t1 & MAY_BE_OBJECT) { |
3455 | 106 | tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY; |
3456 | 106 | } |
3457 | 150 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3458 | 150 | break; |
3459 | 1.59k | case ZEND_UNSET_CV: |
3460 | 1.59k | tmp = MAY_BE_UNDEF; |
3461 | 1.59k | if (!op_array->function_name) { |
3462 | | /* In global scope, we know nothing */ |
3463 | 1.11k | tmp |= MAY_BE_REF; |
3464 | 1.11k | } |
3465 | 1.59k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3466 | 1.59k | break; |
3467 | 1.59k | case ZEND_UNSET_DIM: |
3468 | 1.03k | case ZEND_UNSET_OBJ: |
3469 | 1.03k | if (ssa_op->op1_def >= 0) { |
3470 | 1.03k | UPDATE_SSA_TYPE(t1, ssa_op->op1_def); |
3471 | 1.03k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3472 | 1.03k | } |
3473 | 1.03k | break; |
3474 | 2.59k | case ZEND_FE_RESET_R: |
3475 | 3.80k | case ZEND_FE_RESET_RW: |
3476 | 3.80k | if (ssa_op->op1_def >= 0) { |
3477 | 1.12k | tmp = t1; |
3478 | 1.12k | if (opline->opcode == ZEND_FE_RESET_RW) { |
3479 | 1.12k | tmp |= MAY_BE_REF; |
3480 | 1.12k | } else if (t1 & MAY_BE_RC1) { |
3481 | 0 | tmp |= MAY_BE_RCN; |
3482 | 0 | } |
3483 | 1.12k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3484 | 1.12k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3485 | 1.12k | } |
3486 | 3.80k | if (opline->opcode == ZEND_FE_RESET_RW) { |
3487 | | //??? |
3488 | 1.20k | tmp = MAY_BE_REF | (t1 & (MAY_BE_ARRAY | MAY_BE_OBJECT)); |
3489 | 2.59k | } else { |
3490 | 2.59k | tmp = MAY_BE_RC1 | MAY_BE_RCN | (t1 & (MAY_BE_ARRAY | MAY_BE_OBJECT | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF)); |
3491 | 2.59k | } |
3492 | | /* The result is set to UNDEF for invalid foreach inputs. */ |
3493 | 3.80k | if ((t1 & (MAY_BE_ANY | MAY_BE_UNDEF)) & ~(MAY_BE_ARRAY | MAY_BE_OBJECT)) { |
3494 | 3.04k | tmp |= MAY_BE_UNDEF; |
3495 | 3.04k | } |
3496 | 3.80k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3497 | 3.80k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def); |
3498 | 3.80k | break; |
3499 | 3.79k | case ZEND_FE_FETCH_R: |
3500 | 4.62k | case ZEND_FE_FETCH_RW: |
3501 | 4.62k | tmp = 0; |
3502 | 4.62k | if (opline->op2_type == IS_CV) { |
3503 | 4.40k | tmp = t2 & MAY_BE_REF; |
3504 | 4.40k | } |
3505 | 4.62k | if (t1 & MAY_BE_OBJECT) { |
3506 | 3.43k | if (opline->opcode == ZEND_FE_FETCH_RW) { |
3507 | 831 | tmp |= MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3508 | 2.60k | } else { |
3509 | 2.60k | tmp |= MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3510 | 2.60k | if (opline->op2_type != IS_CV) { |
3511 | 150 | tmp |= MAY_BE_REF; |
3512 | 150 | } |
3513 | 2.60k | } |
3514 | 3.43k | } |
3515 | 4.62k | if (t1 & MAY_BE_ARRAY) { |
3516 | 4.10k | if (opline->opcode == ZEND_FE_FETCH_RW) { |
3517 | 831 | tmp |= MAY_BE_REF | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3518 | 3.27k | } else { |
3519 | 3.27k | tmp |= ((t1 & MAY_BE_ARRAY_OF_ANY) >> MAY_BE_ARRAY_SHIFT); |
3520 | 3.27k | if (tmp & MAY_BE_ARRAY) { |
3521 | 2.80k | tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3522 | 2.80k | } |
3523 | 3.27k | if (t1 & MAY_BE_ARRAY_OF_REF) { |
3524 | 2.58k | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
3525 | 2.58k | if (opline->op2_type != IS_CV) { |
3526 | 150 | tmp |= MAY_BE_REF; |
3527 | 150 | } |
3528 | 2.58k | } else if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
3529 | 350 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
3530 | 350 | } |
3531 | 3.27k | } |
3532 | 4.10k | } |
3533 | 4.62k | UPDATE_SSA_TYPE(tmp, ssa_op->op2_def); |
3534 | 4.62k | if (ssa_op->result_def >= 0) { |
3535 | 2.05k | tmp = (ssa_op->result_use >= 0) ? RES_USE_INFO() : 0; |
3536 | 2.05k | if (t1 & MAY_BE_OBJECT) { |
3537 | 1.74k | tmp |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3538 | 1.74k | } |
3539 | 2.05k | if (t1 & MAY_BE_ARRAY) { |
3540 | 1.85k | if (t1 & MAY_BE_ARRAY_KEY_LONG) { |
3541 | 1.78k | tmp |= MAY_BE_LONG; |
3542 | 1.78k | } |
3543 | 1.85k | if (t1 & MAY_BE_ARRAY_KEY_STRING) { |
3544 | 1.80k | tmp |= MAY_BE_STRING | MAY_BE_RCN; |
3545 | 1.80k | } |
3546 | 1.85k | } |
3547 | 2.05k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3548 | 2.05k | } |
3549 | 4.62k | break; |
3550 | 7.22k | case ZEND_FETCH_DIM_R: |
3551 | 8.17k | case ZEND_FETCH_DIM_IS: |
3552 | 9.32k | case ZEND_FETCH_DIM_RW: |
3553 | 13.4k | case ZEND_FETCH_DIM_W: |
3554 | 13.5k | case ZEND_FETCH_DIM_UNSET: |
3555 | 14.7k | case ZEND_FETCH_DIM_FUNC_ARG: |
3556 | 16.1k | case ZEND_FETCH_LIST_R: |
3557 | 16.4k | case ZEND_FETCH_LIST_W: |
3558 | 16.4k | if (ssa_op->op1_def >= 0) { |
3559 | 5.66k | uint32_t key_type = 0; |
3560 | 5.66k | tmp = t1 & ~(MAY_BE_RC1|MAY_BE_RCN); |
3561 | 5.66k | if (opline->opcode == ZEND_FETCH_DIM_W || |
3562 | 5.66k | opline->opcode == ZEND_FETCH_DIM_RW || |
3563 | 5.66k | opline->opcode == ZEND_FETCH_DIM_FUNC_ARG || |
3564 | 5.66k | opline->opcode == ZEND_FETCH_LIST_W) { |
3565 | 5.56k | if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
3566 | 4.92k | if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) { |
3567 | 4.10k | tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE); |
3568 | 4.10k | } |
3569 | 4.92k | tmp |= MAY_BE_ARRAY | MAY_BE_RC1; |
3570 | 4.92k | } |
3571 | 5.56k | if (t1 & (MAY_BE_STRING|MAY_BE_ARRAY)) { |
3572 | 4.77k | tmp |= MAY_BE_RC1; |
3573 | 4.77k | if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG) { |
3574 | 880 | tmp |= t1 & MAY_BE_RCN; |
3575 | 880 | } |
3576 | 4.77k | } |
3577 | 5.56k | if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
3578 | 4.16k | tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN); |
3579 | 4.16k | } |
3580 | 5.56k | if (opline->op2_type == IS_UNUSED) { |
3581 | 470 | if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
3582 | 374 | key_type |= MAY_BE_ARRAY_PACKED; |
3583 | 374 | } |
3584 | 470 | if (t1 & MAY_BE_ARRAY) { |
3585 | 369 | key_type |= MAY_BE_HASH_ONLY(t1) ? |
3586 | 361 | MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG; |
3587 | 369 | } |
3588 | 5.09k | } else { |
3589 | 5.09k | if (t2 & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) { |
3590 | 3.44k | if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
3591 | 3.07k | key_type |= MAY_BE_ARRAY_PACKED; |
3592 | 3.07k | } |
3593 | 3.44k | if (t1 & MAY_BE_ARRAY) { |
3594 | 2.81k | key_type |= MAY_BE_HASH_ONLY(t1) ? |
3595 | 2.80k | MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG; |
3596 | 2.81k | } |
3597 | 3.44k | } |
3598 | 5.09k | if (t2 & MAY_BE_STRING) { |
3599 | 2.33k | key_type |= MAY_BE_ARRAY_KEY_STRING; |
3600 | 2.33k | if (opline->op2_type != IS_CONST) { |
3601 | | // FIXME: numeric string |
3602 | 1.51k | if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) { |
3603 | 1.43k | key_type |= MAY_BE_ARRAY_PACKED; |
3604 | 1.43k | } |
3605 | 1.51k | if (t1 & MAY_BE_ARRAY) { |
3606 | 1.45k | key_type |= MAY_BE_HASH_ONLY(t1) ? |
3607 | 1.40k | MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG; |
3608 | 1.45k | } |
3609 | 1.51k | } |
3610 | 2.33k | } |
3611 | 5.09k | if (t2 & (MAY_BE_UNDEF | MAY_BE_NULL)) { |
3612 | 997 | key_type |= MAY_BE_ARRAY_KEY_STRING; |
3613 | 997 | } |
3614 | 5.09k | } |
3615 | 5.56k | } else if (opline->opcode == ZEND_FETCH_DIM_UNSET) { |
3616 | 96 | if (t1 & MAY_BE_ARRAY) { |
3617 | 88 | tmp |= MAY_BE_RC1; |
3618 | 88 | } |
3619 | 96 | if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) { |
3620 | 72 | tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN); |
3621 | 72 | } |
3622 | 96 | } |
3623 | 5.66k | if ((key_type & (MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING)) |
3624 | 5.66k | && (opline->opcode == ZEND_FETCH_DIM_RW |
3625 | 5.34k | || opline->opcode == ZEND_FETCH_DIM_W |
3626 | 5.34k | || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG |
3627 | 5.34k | || opline->opcode == ZEND_FETCH_LIST_W)) { |
3628 | 5.34k | j = ssa_vars[ssa_op->result_def].use_chain; |
3629 | 5.34k | if (j < 0) { |
3630 | | /* no uses */ |
3631 | 0 | tmp |= key_type | MAY_BE_ARRAY | MAY_BE_ARRAY_OF_NULL; |
3632 | 0 | } |
3633 | 10.6k | while (j >= 0) { |
3634 | 5.34k | uint8_t opcode; |
3635 | | |
3636 | 5.34k | if (!ssa_opcodes) { |
3637 | 5.34k | if (j != (opline - op_array->opcodes) + 1) { |
3638 | | /* Use must be in next opline */ |
3639 | 0 | tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3640 | 0 | break; |
3641 | 0 | } |
3642 | 5.34k | opcode = op_array->opcodes[j].opcode; |
3643 | 5.34k | } else { |
3644 | 0 | if (ssa_opcodes[j] != opline + 1) { |
3645 | | /* Use must be in next opline */ |
3646 | 0 | tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3647 | 0 | break; |
3648 | 0 | } |
3649 | 0 | opcode = ssa_opcodes[j]->opcode; |
3650 | 0 | } |
3651 | 5.34k | switch (opcode) { |
3652 | 288 | case ZEND_FETCH_DIM_W: |
3653 | 630 | case ZEND_FETCH_DIM_RW: |
3654 | 694 | case ZEND_FETCH_DIM_FUNC_ARG: |
3655 | 694 | case ZEND_FETCH_LIST_W: |
3656 | 2.32k | case ZEND_ASSIGN_DIM: |
3657 | 2.71k | case ZEND_ASSIGN_DIM_OP: |
3658 | 2.71k | tmp |= key_type | MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY; |
3659 | 2.71k | break; |
3660 | 0 | case ZEND_SEND_VAR_EX: |
3661 | 842 | case ZEND_SEND_FUNC_ARG: |
3662 | 842 | case ZEND_SEND_VAR_NO_REF: |
3663 | 842 | case ZEND_SEND_VAR_NO_REF_EX: |
3664 | 1.07k | case ZEND_SEND_REF: |
3665 | 1.91k | case ZEND_ASSIGN_REF: |
3666 | 1.92k | case ZEND_YIELD: |
3667 | 1.94k | case ZEND_INIT_ARRAY: |
3668 | 1.94k | case ZEND_ADD_ARRAY_ELEMENT: |
3669 | 1.96k | case ZEND_RETURN_BY_REF: |
3670 | 1.97k | case ZEND_VERIFY_RETURN_TYPE: |
3671 | 2.26k | case ZEND_MAKE_REF: |
3672 | 2.26k | case ZEND_FE_RESET_RW: |
3673 | 2.26k | tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3674 | 2.26k | break; |
3675 | 96 | case ZEND_PRE_INC: |
3676 | 112 | case ZEND_PRE_DEC: |
3677 | 112 | case ZEND_POST_INC: |
3678 | 116 | case ZEND_POST_DEC: |
3679 | 116 | if (tmp & MAY_BE_ARRAY_OF_LONG) { |
3680 | | /* may overflow */ |
3681 | 116 | tmp |= key_type | MAY_BE_ARRAY_OF_DOUBLE; |
3682 | 116 | } else if (!(tmp & (MAY_BE_ARRAY_OF_LONG|MAY_BE_ARRAY_OF_DOUBLE))) { |
3683 | 0 | tmp |= key_type | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_DOUBLE; |
3684 | 0 | } |
3685 | 116 | break; |
3686 | 24 | case ZEND_FETCH_OBJ_W: |
3687 | 24 | case ZEND_FETCH_OBJ_RW: |
3688 | 32 | case ZEND_FETCH_OBJ_FUNC_ARG: |
3689 | 202 | case ZEND_ASSIGN_OBJ: |
3690 | 206 | case ZEND_ASSIGN_OBJ_OP: |
3691 | 224 | case ZEND_ASSIGN_OBJ_REF: |
3692 | 224 | case ZEND_PRE_INC_OBJ: |
3693 | 224 | case ZEND_PRE_DEC_OBJ: |
3694 | 224 | case ZEND_POST_INC_OBJ: |
3695 | 224 | case ZEND_POST_DEC_OBJ: |
3696 | | /* These will result in an error exception, unless the element |
3697 | | * is already an object. */ |
3698 | 224 | break; |
3699 | 8 | case ZEND_SEND_VAR: |
3700 | 16 | case ZEND_FETCH_DIM_R: |
3701 | | /* This can occur if a DIM_FETCH_FUNC_ARG with UNUSED op2 is left |
3702 | | * behind, because it can't be converted to DIM_FETCH_R. */ |
3703 | 16 | break; |
3704 | 0 | case ZEND_FREE: |
3705 | | /* This may happen if the using opcode is DCEd. */ |
3706 | 0 | break; |
3707 | 5.34k | EMPTY_SWITCH_DEFAULT_CASE() |
3708 | 5.34k | } |
3709 | 5.34k | j = zend_ssa_next_use(ssa->ops, ssa_op->result_def, j); |
3710 | 5.34k | if (j >= 0) { |
3711 | 0 | tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
3712 | 0 | break; |
3713 | 0 | } |
3714 | 5.34k | } |
3715 | 5.34k | if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) { |
3716 | 4.41k | tmp &= ~MAY_BE_ARRAY_EMPTY; |
3717 | 4.41k | } |
3718 | 5.34k | } |
3719 | 5.66k | if (!(tmp & MAY_BE_ARRAY) |
3720 | 5.66k | || (tmp & MAY_BE_ARRAY_KEY_ANY) |
3721 | 5.66k | || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG |
3722 | 5.66k | || opline->opcode == ZEND_FETCH_DIM_R |
3723 | 5.66k | || opline->opcode == ZEND_FETCH_DIM_IS |
3724 | 5.66k | || opline->opcode == ZEND_FETCH_DIM_UNSET |
3725 | 5.66k | || opline->opcode == ZEND_FETCH_LIST_R) { |
3726 | 5.64k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3727 | 5.64k | } else { |
3728 | | /* invalid key type */ |
3729 | 22 | return SUCCESS; |
3730 | 22 | } |
3731 | 5.64k | COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def); |
3732 | 5.64k | } |
3733 | | /* FETCH_LIST on a string behaves like FETCH_R on null */ |
3734 | 16.4k | tmp = zend_array_element_type( |
3735 | 16.4k | opline->opcode != ZEND_FETCH_LIST_R ? t1 : ((t1 & ~MAY_BE_STRING) | MAY_BE_NULL), |
3736 | 16.4k | opline->op1_type, |
3737 | 16.4k | opline->opcode != ZEND_FETCH_DIM_R && opline->opcode != ZEND_FETCH_DIM_IS |
3738 | 16.4k | && opline->opcode != ZEND_FETCH_LIST_R, |
3739 | 16.4k | opline->op2_type == IS_UNUSED); |
3740 | 16.4k | if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG && (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE))) { |
3741 | 1.01k | tmp |= MAY_BE_NULL; |
3742 | 1.01k | } |
3743 | 16.4k | if (opline->opcode == ZEND_FETCH_DIM_IS && (t1 & MAY_BE_STRING)) { |
3744 | 734 | tmp |= MAY_BE_NULL; |
3745 | 734 | } |
3746 | 16.4k | if ((tmp & (MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_RCN && opline->result_type == IS_TMP_VAR) { |
3747 | | /* refcount may be indirectly decremented. Make an exception if the result is used in the next instruction */ |
3748 | 870 | if (!ssa_opcodes) { |
3749 | 870 | if (ssa->vars[ssa_op->result_def].use_chain < 0 |
3750 | 870 | || opline + 1 != op_array->opcodes + ssa->vars[ssa_op->result_def].use_chain) { |
3751 | 92 | tmp |= MAY_BE_RC1; |
3752 | 92 | } |
3753 | 870 | } else { |
3754 | 0 | if (ssa->vars[ssa_op->result_def].use_chain < 0 |
3755 | 0 | || opline + 1 != ssa_opcodes[ssa->vars[ssa_op->result_def].use_chain]) { |
3756 | 0 | tmp |= MAY_BE_RC1; |
3757 | 0 | } |
3758 | 0 | } |
3759 | 870 | } |
3760 | 16.4k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3761 | 16.4k | break; |
3762 | 16.4k | case ZEND_FETCH_THIS: |
3763 | 1.90k | if (!(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) { |
3764 | 1.90k | UPDATE_SSA_OBJ_TYPE(op_array->scope, 1, ssa_op->result_def); |
3765 | 1.90k | } |
3766 | 1.90k | UPDATE_SSA_TYPE(MAY_BE_RCN|MAY_BE_OBJECT, ssa_op->result_def); |
3767 | 1.90k | break; |
3768 | 67.3k | case ZEND_FETCH_OBJ_R: |
3769 | 68.0k | case ZEND_FETCH_OBJ_IS: |
3770 | 68.0k | case ZEND_FETCH_OBJ_RW: |
3771 | 69.9k | case ZEND_FETCH_OBJ_W: |
3772 | 70.1k | case ZEND_FETCH_OBJ_UNSET: |
3773 | 70.5k | case ZEND_FETCH_OBJ_FUNC_ARG: |
3774 | 70.5k | if (ssa_op->result_def >= 0) { |
3775 | 70.5k | uint32_t tmp = 0; |
3776 | 70.5k | ce = NULL; |
3777 | 70.5k | if (opline->op1_type != IS_UNUSED |
3778 | 70.5k | && (t1 & (MAY_BE_ANY | MAY_BE_UNDEF) & ~MAY_BE_OBJECT)) { |
3779 | 66.4k | tmp |= MAY_BE_NULL; |
3780 | 66.4k | } |
3781 | 70.5k | if (opline->op1_type == IS_UNUSED || (t1 & MAY_BE_OBJECT)) { |
3782 | 69.9k | const zend_property_info *prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op); |
3783 | 69.9k | tmp |= zend_fetch_prop_type(script, prop_info, &ce); |
3784 | 69.9k | if (opline->opcode != ZEND_FETCH_OBJ_R && opline->opcode != ZEND_FETCH_OBJ_IS) { |
3785 | 2.50k | tmp |= MAY_BE_REF | MAY_BE_INDIRECT; |
3786 | 2.50k | if ((opline->extended_value & ZEND_FETCH_OBJ_FLAGS) == ZEND_FETCH_DIM_WRITE) { |
3787 | 806 | tmp |= MAY_BE_UNDEF; |
3788 | 806 | } |
3789 | 2.50k | ce = NULL; |
3790 | 67.4k | } else if (!(opline->op1_type & (IS_VAR|IS_TMP_VAR)) || !(t1 & MAY_BE_RC1)) { |
3791 | 62.4k | const zend_class_entry *ce = NULL; |
3792 | | |
3793 | 62.4k | if (opline->op1_type == IS_UNUSED) { |
3794 | 2.33k | ce = op_array->scope; |
3795 | 60.0k | } else if (ssa_op->op1_use >= 0 && !ssa->var_info[ssa_op->op1_use].is_instanceof) { |
3796 | 59.8k | ce = ssa->var_info[ssa_op->op1_use].ce; |
3797 | 59.8k | } |
3798 | | /* Unset properties will resort back to __get/__set */ |
3799 | 62.4k | if (ce |
3800 | 62.4k | && !ce->create_object |
3801 | 62.4k | && ce->default_object_handlers->read_property == zend_std_read_property |
3802 | 62.4k | && !ce->__get |
3803 | 62.4k | && !result_may_be_separated(ssa, ssa_op)) { |
3804 | 1.98k | tmp &= ~MAY_BE_RC1; |
3805 | 1.98k | } |
3806 | 62.4k | if (opline->opcode == ZEND_FETCH_OBJ_IS) { |
3807 | | /* IS check may return null for uninitialized typed property. */ |
3808 | 558 | tmp |= MAY_BE_NULL; |
3809 | 558 | } |
3810 | 62.4k | } |
3811 | 69.9k | } |
3812 | 70.5k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3813 | 70.5k | if (ce) { |
3814 | 52 | UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def); |
3815 | 52 | } |
3816 | 70.5k | } |
3817 | 70.5k | break; |
3818 | 70.5k | case ZEND_FETCH_STATIC_PROP_R: |
3819 | 1.72k | case ZEND_FETCH_STATIC_PROP_IS: |
3820 | 1.72k | case ZEND_FETCH_STATIC_PROP_RW: |
3821 | 1.92k | case ZEND_FETCH_STATIC_PROP_W: |
3822 | 1.96k | case ZEND_FETCH_STATIC_PROP_UNSET: |
3823 | 2.21k | case ZEND_FETCH_STATIC_PROP_FUNC_ARG: |
3824 | 2.21k | tmp = zend_fetch_prop_type(script, |
3825 | 2.21k | zend_fetch_static_prop_info(script, op_array, ssa, opline), &ce); |
3826 | 2.21k | if (opline->opcode != ZEND_FETCH_STATIC_PROP_R |
3827 | 2.21k | && opline->opcode != ZEND_FETCH_STATIC_PROP_IS) { |
3828 | 491 | tmp |= MAY_BE_REF | MAY_BE_INDIRECT; |
3829 | 491 | if ((opline->extended_value & ZEND_FETCH_OBJ_FLAGS) == ZEND_FETCH_DIM_WRITE) { |
3830 | 141 | tmp |= MAY_BE_UNDEF; |
3831 | 141 | } |
3832 | 491 | ce = NULL; |
3833 | 1.72k | } else { |
3834 | 1.72k | if (!result_may_be_separated(ssa, ssa_op)) { |
3835 | 1.70k | tmp &= ~MAY_BE_RC1; |
3836 | 1.70k | } |
3837 | 1.72k | if (opline->opcode == ZEND_FETCH_STATIC_PROP_IS) { |
3838 | 174 | tmp |= MAY_BE_UNDEF; |
3839 | 174 | } |
3840 | 1.72k | } |
3841 | 2.21k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3842 | 2.21k | if (ce) { |
3843 | 28 | UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def); |
3844 | 28 | } |
3845 | 2.21k | break; |
3846 | 0 | case ZEND_FRAMELESS_ICALL_1: |
3847 | 0 | case ZEND_FRAMELESS_ICALL_2: |
3848 | 0 | case ZEND_FRAMELESS_ICALL_3: |
3849 | 0 | if (ssa_op->op1_def >= 0) { |
3850 | 0 | ZEND_ASSERT(ssa_op->op1_use >= 0); |
3851 | 0 | tmp = ssa->var_info[ssa_op->op1_use].type; |
3852 | 0 | if (tmp & MAY_BE_RC1) { |
3853 | 0 | tmp |= MAY_BE_RCN; |
3854 | 0 | } |
3855 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3856 | 0 | } |
3857 | 0 | if (ssa_op->op2_def >= 0) { |
3858 | 0 | ZEND_ASSERT(ssa_op->op2_use >= 0); |
3859 | 0 | tmp = ssa->var_info[ssa_op->op2_use].type; |
3860 | 0 | if (tmp & MAY_BE_RC1) { |
3861 | 0 | tmp |= MAY_BE_RCN; |
3862 | 0 | } |
3863 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op2_def); |
3864 | 0 | } |
3865 | 0 | if (opline->opcode == ZEND_FRAMELESS_ICALL_3) { |
3866 | 0 | zend_ssa_op *next_ssa_op = ssa_op + 1; |
3867 | 0 | if (next_ssa_op->op1_def >= 0) { |
3868 | 0 | ZEND_ASSERT(next_ssa_op->op1_use >= 0); |
3869 | 0 | tmp = ssa->var_info[next_ssa_op->op1_use].type; |
3870 | 0 | if (tmp & MAY_BE_RC1) { |
3871 | 0 | tmp |= MAY_BE_RCN; |
3872 | 0 | } |
3873 | 0 | UPDATE_SSA_TYPE(tmp, next_ssa_op->op1_def); |
3874 | 0 | } |
3875 | 0 | } |
3876 | 0 | ZEND_FALLTHROUGH; |
3877 | 0 | case ZEND_FRAMELESS_ICALL_0: |
3878 | 38.4k | case ZEND_DO_FCALL: |
3879 | 38.4k | case ZEND_DO_ICALL: |
3880 | 41.7k | case ZEND_DO_UCALL: |
3881 | 41.7k | case ZEND_DO_FCALL_BY_NAME: |
3882 | 41.7k | if (ssa_op->result_def >= 0) { |
3883 | 41.7k | zend_func_info *func_info = ZEND_FUNC_INFO(op_array); |
3884 | 41.7k | zend_call_info *call_info; |
3885 | | |
3886 | 41.7k | if (!func_info || !func_info->call_map) { |
3887 | 9.11k | goto unknown_opcode; |
3888 | 9.11k | } |
3889 | 32.6k | call_info = func_info->call_map[opline - op_array->opcodes]; |
3890 | 32.6k | if (!call_info) { |
3891 | 11.7k | goto unknown_opcode; |
3892 | 11.7k | } |
3893 | | |
3894 | 20.8k | zend_class_entry *ce; |
3895 | 20.8k | bool ce_is_instanceof; |
3896 | 20.8k | tmp = zend_get_func_info(call_info, ssa, &ce, &ce_is_instanceof); |
3897 | 20.8k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3898 | 20.8k | if (ce) { |
3899 | 993 | UPDATE_SSA_OBJ_TYPE(ce, ce_is_instanceof, ssa_op->result_def); |
3900 | 993 | } |
3901 | 20.8k | } |
3902 | 20.8k | break; |
3903 | 20.8k | case ZEND_CALLABLE_CONVERT: |
3904 | 341 | UPDATE_SSA_TYPE(MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN, ssa_op->result_def); |
3905 | 341 | UPDATE_SSA_OBJ_TYPE(zend_ce_closure, /* is_instanceof */ false, ssa_op->result_def); |
3906 | 341 | break; |
3907 | 25.2k | case ZEND_FETCH_CONSTANT: |
3908 | 25.2k | UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def); |
3909 | 25.2k | break; |
3910 | 25.2k | case ZEND_FETCH_CLASS_CONSTANT: { |
3911 | 2.85k | bool is_prototype; |
3912 | 2.85k | const zend_class_constant *cc = zend_fetch_class_const_info(script, op_array, opline, &is_prototype); |
3913 | 2.85k | if (!cc || !ZEND_TYPE_IS_SET(cc->type)) { |
3914 | 2.73k | UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def); |
3915 | 2.73k | break; |
3916 | 2.73k | } |
3917 | 120 | UPDATE_SSA_TYPE(zend_convert_type(script, cc->type, &ce), ssa_op->result_def); |
3918 | 120 | if (ce) { |
3919 | 0 | UPDATE_SSA_OBJ_TYPE(ce, /* is_instanceof */ true, ssa_op->result_def); |
3920 | 0 | } |
3921 | 120 | break; |
3922 | 120 | } |
3923 | 301 | case ZEND_STRLEN: |
3924 | 713 | case ZEND_COUNT: |
3925 | 757 | case ZEND_FUNC_NUM_ARGS: |
3926 | 757 | UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def); |
3927 | 757 | break; |
3928 | 757 | case ZEND_FUNC_GET_ARGS: |
3929 | 130 | UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ARRAY|MAY_BE_ARRAY_EMPTY|MAY_BE_ARRAY_PACKED|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def); |
3930 | 130 | break; |
3931 | 379 | case ZEND_GET_CLASS: |
3932 | 441 | case ZEND_GET_CALLED_CLASS: |
3933 | 441 | UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RCN, ssa_op->result_def); |
3934 | 441 | break; |
3935 | 441 | case ZEND_GET_TYPE: |
3936 | 74 | UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def); |
3937 | 74 | break; |
3938 | 818 | case ZEND_TYPE_CHECK: { |
3939 | 818 | uint32_t expected_type_mask = opline->extended_value; |
3940 | 818 | if (t1 & MAY_BE_UNDEF) { |
3941 | 44 | t1 |= MAY_BE_NULL; |
3942 | 44 | } |
3943 | 818 | tmp = 0; |
3944 | 818 | if (t1 & expected_type_mask) { |
3945 | 728 | tmp |= MAY_BE_TRUE; |
3946 | 728 | if ((t1 & expected_type_mask) & MAY_BE_RESOURCE) { |
3947 | 138 | tmp |= MAY_BE_FALSE; |
3948 | 138 | } |
3949 | 728 | } |
3950 | 818 | if (t1 & (MAY_BE_ANY - expected_type_mask)) { |
3951 | 796 | tmp |= MAY_BE_FALSE; |
3952 | 796 | } |
3953 | 818 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3954 | 818 | break; |
3955 | 818 | } |
3956 | 818 | case ZEND_DEFINED: |
3957 | 81 | UPDATE_SSA_TYPE(MAY_BE_FALSE|MAY_BE_TRUE, ssa_op->result_def); |
3958 | 81 | break; |
3959 | 1.74k | case ZEND_VERIFY_RETURN_TYPE: |
3960 | 1.74k | if (t1 & MAY_BE_REF) { |
3961 | 156 | tmp = t1; |
3962 | 156 | ce = NULL; |
3963 | 1.59k | } else { |
3964 | 1.59k | zend_arg_info *ret_info = op_array->arg_info - 1; |
3965 | 1.59k | tmp = zend_fetch_arg_info_type(script, ret_info, &ce); |
3966 | 1.59k | if ((tmp & MAY_BE_NULL) && opline->op1_type == IS_CV) { |
3967 | 57 | tmp |= MAY_BE_UNDEF; |
3968 | 57 | } |
3969 | 1.59k | tmp |= (t1 & MAY_BE_INDIRECT); |
3970 | | |
3971 | | // TODO: We could model more precisely how illegal types are converted. |
3972 | 1.59k | uint32_t extra_types = t1 & ~tmp; |
3973 | 1.59k | if (!extra_types) { |
3974 | 1.04k | tmp &= t1; |
3975 | 1.04k | } |
3976 | 1.59k | } |
3977 | 1.74k | if (opline->op1_type & (IS_TMP_VAR|IS_VAR|IS_CV)) { |
3978 | 1.60k | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3979 | 1.60k | if (ce) { |
3980 | 228 | UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->op1_def); |
3981 | 1.37k | } else { |
3982 | 1.37k | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->op1_def); |
3983 | 1.37k | } |
3984 | 1.60k | } else { |
3985 | 148 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3986 | 148 | if (ce) { |
3987 | 24 | UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def); |
3988 | 124 | } else { |
3989 | 124 | UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def); |
3990 | 124 | } |
3991 | 148 | } |
3992 | 1.74k | break; |
3993 | 1.74k | case ZEND_MAKE_REF: |
3994 | 941 | tmp = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF; |
3995 | 941 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
3996 | 941 | if (ssa_op->op1_def >= 0) { |
3997 | 242 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
3998 | 242 | } |
3999 | 941 | break; |
4000 | 941 | case ZEND_CATCH: |
4001 | | /* Forbidden opcodes */ |
4002 | 0 | ZEND_UNREACHABLE(); |
4003 | 0 | break; |
4004 | 286 | case ZEND_FETCH_CLASS_NAME: |
4005 | 286 | UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RCN, ssa_op->result_def); |
4006 | 286 | break; |
4007 | 286 | case ZEND_ISSET_ISEMPTY_THIS: |
4008 | 80 | UPDATE_SSA_TYPE(MAY_BE_BOOL, ssa_op->result_def); |
4009 | 80 | break; |
4010 | 6.08k | case ZEND_DECLARE_LAMBDA_FUNCTION: |
4011 | 6.08k | UPDATE_SSA_TYPE(MAY_BE_OBJECT|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def); |
4012 | 6.08k | UPDATE_SSA_OBJ_TYPE(zend_ce_closure, /* is_instanceof */ false, ssa_op->result_def); |
4013 | 6.08k | break; |
4014 | 0 | case ZEND_PRE_DEC_STATIC_PROP: |
4015 | 14 | case ZEND_PRE_INC_STATIC_PROP: |
4016 | 28 | case ZEND_POST_DEC_STATIC_PROP: |
4017 | 104 | case ZEND_POST_INC_STATIC_PROP: { |
4018 | 104 | if (ssa_op->result_def >= 0) { |
4019 | 104 | const zend_property_info *prop_info = zend_fetch_static_prop_info(script, op_array, ssa, opline); |
4020 | 104 | zend_class_entry *prop_ce; |
4021 | 104 | tmp = zend_fetch_prop_type(script, prop_info, &prop_ce); |
4022 | | /* Internal objects may result in essentially anything. */ |
4023 | 104 | if (tmp & MAY_BE_OBJECT) { |
4024 | 96 | goto unknown_opcode; |
4025 | 96 | } |
4026 | 8 | tmp &= MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_BOOL|MAY_BE_NULL; |
4027 | 8 | if (tmp & MAY_BE_STRING) { |
4028 | 0 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
4029 | 0 | } |
4030 | 8 | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
4031 | 8 | } |
4032 | 8 | break; |
4033 | 104 | } |
4034 | 26 | case ZEND_SPACESHIP: |
4035 | 26 | UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def); |
4036 | 26 | break; |
4037 | 265 | case ZEND_FETCH_GLOBALS: |
4038 | 265 | UPDATE_SSA_TYPE(MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def); |
4039 | 265 | break; |
4040 | 1.42k | default: |
4041 | | #ifdef ZEND_DEBUG_TYPE_INFERENCE |
4042 | | if (ssa_op->result_def >= 0) { |
4043 | | switch (opline->opcode) { |
4044 | | case ZEND_FETCH_R: |
4045 | | case ZEND_FETCH_W: |
4046 | | case ZEND_FETCH_RW: |
4047 | | case ZEND_FETCH_IS: |
4048 | | case ZEND_FETCH_UNSET: |
4049 | | case ZEND_YIELD_FROM: |
4050 | | /* Currently unimplemented due to some assumptions in JIT. See: |
4051 | | * https://github.com/php/php-src/pull/13304#issuecomment-1926668141 */ |
4052 | | case ZEND_SEPARATE: |
4053 | | break; |
4054 | | default: |
4055 | | fprintf(stderr, "Missing result type inference for opcode %s, line %d\n", zend_get_opcode_name(opline->opcode), opline->lineno); |
4056 | | break; |
4057 | | } |
4058 | | } |
4059 | | if (ssa_op->op1_def >= 0) { |
4060 | | fprintf(stderr, "Missing op1 type inference for opcode %s, line %d\n", zend_get_opcode_name(opline->opcode), opline->lineno); |
4061 | | } |
4062 | | if (ssa_op->op2_def >= 0) { |
4063 | | fprintf(stderr, "Missing op2 type inference for opcode %s, line %d\n", zend_get_opcode_name(opline->opcode), opline->lineno); |
4064 | | } |
4065 | | #endif |
4066 | 1.42k | if (ssa_op->op1_def >= 0) { |
4067 | 0 | tmp = MAY_BE_ANY | MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
4068 | 0 | UPDATE_SSA_TYPE(tmp, ssa_op->op1_def); |
4069 | 0 | } |
4070 | 22.3k | unknown_opcode: |
4071 | 22.3k | if (ssa_op->result_def >= 0) { |
4072 | 22.3k | tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
4073 | 22.3k | if (opline->result_type == IS_TMP_VAR) { |
4074 | 639 | if (opline->opcode == ZEND_FETCH_R || opline->opcode == ZEND_FETCH_IS) { |
4075 | | /* Variable reference counter may be decremented before use */ |
4076 | | /* See: ext/opcache/tests/jit/fetch_r_001.phpt */ |
4077 | 82 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
4078 | 557 | } else { |
4079 | 557 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
4080 | 557 | } |
4081 | 21.7k | } else if (opline->result_type == IS_CV) { |
4082 | 0 | tmp |= MAY_BE_RC1 | MAY_BE_RCN; |
4083 | 21.7k | } else { |
4084 | 21.7k | tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN; |
4085 | 21.7k | switch (opline->opcode) { |
4086 | 556 | case ZEND_FETCH_W: |
4087 | 572 | case ZEND_FETCH_RW: |
4088 | 579 | case ZEND_FETCH_FUNC_ARG: |
4089 | 583 | case ZEND_FETCH_UNSET: |
4090 | 583 | case ZEND_FETCH_DIM_W: |
4091 | 583 | case ZEND_FETCH_DIM_RW: |
4092 | 583 | case ZEND_FETCH_DIM_FUNC_ARG: |
4093 | 583 | case ZEND_FETCH_DIM_UNSET: |
4094 | 583 | case ZEND_FETCH_OBJ_W: |
4095 | 583 | case ZEND_FETCH_OBJ_RW: |
4096 | 583 | case ZEND_FETCH_OBJ_FUNC_ARG: |
4097 | 583 | case ZEND_FETCH_OBJ_UNSET: |
4098 | 583 | case ZEND_FETCH_STATIC_PROP_W: |
4099 | 583 | case ZEND_FETCH_STATIC_PROP_RW: |
4100 | 583 | case ZEND_FETCH_STATIC_PROP_FUNC_ARG: |
4101 | 583 | case ZEND_FETCH_STATIC_PROP_UNSET: |
4102 | 583 | tmp |= MAY_BE_INDIRECT; |
4103 | 583 | break; |
4104 | 21.7k | } |
4105 | 21.7k | } |
4106 | 22.3k | UPDATE_SSA_TYPE(tmp, ssa_op->result_def); |
4107 | 22.3k | } |
4108 | 22.3k | break; |
4109 | 859k | } |
4110 | | |
4111 | 859k | return SUCCESS; |
4112 | 859k | } |
4113 | | |
4114 | | ZEND_API zend_result zend_update_type_info( |
4115 | | const zend_op_array *op_array, |
4116 | | zend_ssa *ssa, |
4117 | | const zend_script *script, |
4118 | | zend_op *opline, |
4119 | | zend_ssa_op *ssa_op, |
4120 | | const zend_op **ssa_opcodes, |
4121 | | zend_long optimization_level) |
4122 | 0 | { |
4123 | 0 | return _zend_update_type_info(op_array, ssa, script, NULL, opline, ssa_op, ssa_opcodes, optimization_level, 0); |
4124 | 0 | } |
4125 | | |
4126 | 0 | static uint32_t get_class_entry_rank(zend_class_entry *ce) { |
4127 | 0 | uint32_t rank = 0; |
4128 | 0 | if (ce->ce_flags & ZEND_ACC_LINKED) { |
4129 | 0 | while (ce->parent) { |
4130 | 0 | rank++; |
4131 | 0 | ce = ce->parent; |
4132 | 0 | } |
4133 | 0 | } |
4134 | 0 | return rank; |
4135 | 0 | } |
4136 | | |
4137 | | /* Compute least common ancestor on class inheritance tree only */ |
4138 | | static zend_class_entry *join_class_entries( |
4139 | 63.3k | zend_class_entry *ce1, zend_class_entry *ce2, int *is_instanceof) { |
4140 | 63.3k | uint32_t rank1, rank2; |
4141 | 63.3k | if (ce1 == ce2) { |
4142 | 63.2k | return ce1; |
4143 | 63.2k | } |
4144 | 52 | if (!ce1 || !ce2) { |
4145 | 52 | return NULL; |
4146 | 52 | } |
4147 | | |
4148 | 0 | rank1 = get_class_entry_rank(ce1); |
4149 | 0 | rank2 = get_class_entry_rank(ce2); |
4150 | |
|
4151 | 0 | while (rank1 != rank2) { |
4152 | 0 | if (rank1 > rank2) { |
4153 | 0 | ce1 = !(ce1->ce_flags & ZEND_ACC_LINKED) ? NULL : ce1->parent; |
4154 | 0 | rank1--; |
4155 | 0 | } else { |
4156 | 0 | ce2 = !(ce2->ce_flags & ZEND_ACC_LINKED) ? NULL : ce2->parent; |
4157 | 0 | rank2--; |
4158 | 0 | } |
4159 | 0 | } |
4160 | |
|
4161 | 0 | while (ce1 != ce2) { |
4162 | 0 | ce1 = !(ce1->ce_flags & ZEND_ACC_LINKED) ? NULL : ce1->parent; |
4163 | 0 | ce2 = !(ce2->ce_flags & ZEND_ACC_LINKED) ? NULL : ce2->parent; |
4164 | 0 | } |
4165 | |
|
4166 | 0 | if (ce1) { |
4167 | 0 | *is_instanceof = 1; |
4168 | 0 | } |
4169 | 0 | return ce1; |
4170 | 52 | } |
4171 | | |
4172 | 0 | static bool safe_instanceof(zend_class_entry *ce1, zend_class_entry *ce2) { |
4173 | 0 | if (ce1 == ce2) { |
4174 | 0 | return 1; |
4175 | 0 | } |
4176 | 0 | if (!(ce1->ce_flags & ZEND_ACC_LINKED)) { |
4177 | | /* This case could be generalized, similarly to unlinked_instanceof */ |
4178 | 0 | return 0; |
4179 | 0 | } |
4180 | 0 | return instanceof_function(ce1, ce2); |
4181 | 0 | } |
4182 | | |
4183 | | static zend_result zend_infer_types_ex(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_bitset worklist, zend_long optimization_level) |
4184 | 74.1k | { |
4185 | 74.1k | zend_basic_block *blocks = ssa->cfg.blocks; |
4186 | 74.1k | zend_ssa_var *ssa_vars = ssa->vars; |
4187 | 74.1k | zend_ssa_var_info *ssa_var_info = ssa->var_info; |
4188 | 74.1k | int ssa_vars_count = ssa->vars_count; |
4189 | 74.1k | int i, j; |
4190 | 74.1k | uint32_t tmp, worklist_len = zend_bitset_len(ssa_vars_count); |
4191 | 74.1k | bool update_worklist = 1; |
4192 | 74.1k | const zend_op **ssa_opcodes = NULL; |
4193 | | |
4194 | 1.13M | while (!zend_bitset_empty(worklist, worklist_len)) { |
4195 | 1.05M | j = zend_bitset_first(worklist, worklist_len); |
4196 | 1.05M | zend_bitset_excl(worklist, j); |
4197 | 1.05M | if (ssa_vars[j].definition_phi) { |
4198 | 192k | zend_ssa_phi *p = ssa_vars[j].definition_phi; |
4199 | 192k | if (p->pi >= 0) { |
4200 | 56.4k | zend_class_entry *ce = ssa_var_info[p->sources[0]].ce; |
4201 | 56.4k | int is_instanceof = ssa_var_info[p->sources[0]].is_instanceof; |
4202 | 56.4k | tmp = get_ssa_var_info(ssa, p->sources[0]); |
4203 | | |
4204 | 56.4k | if (!p->has_range_constraint) { |
4205 | 45.8k | zend_ssa_type_constraint *constraint = &p->constraint.type; |
4206 | 45.8k | tmp &= constraint->type_mask; |
4207 | 45.8k | if (!(tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) { |
4208 | 1.83k | tmp &= ~(MAY_BE_RC1|MAY_BE_RCN); |
4209 | 1.83k | } |
4210 | 45.8k | if ((tmp & MAY_BE_OBJECT) && constraint->ce && ce != constraint->ce) { |
4211 | 25 | if (!ce) { |
4212 | 25 | ce = constraint->ce; |
4213 | 25 | is_instanceof = 1; |
4214 | 25 | } else if (is_instanceof && safe_instanceof(constraint->ce, ce)) { |
4215 | 0 | ce = constraint->ce; |
4216 | 0 | } else { |
4217 | | /* Ignore the constraint (either ce instanceof constraint->ce or |
4218 | | * they are unrelated, as far as we can statically determine) */ |
4219 | 0 | } |
4220 | 25 | } |
4221 | 45.8k | } |
4222 | | |
4223 | 56.4k | UPDATE_SSA_TYPE(tmp, j); |
4224 | 56.4k | if (tmp & MAY_BE_REF) { |
4225 | 33.4k | UPDATE_SSA_OBJ_TYPE(NULL, 0, j); |
4226 | 33.4k | } else { |
4227 | 23.0k | UPDATE_SSA_OBJ_TYPE(ce, is_instanceof, j); |
4228 | 23.0k | } |
4229 | 136k | } else { |
4230 | 136k | int first = 1; |
4231 | 136k | int is_instanceof = 0; |
4232 | 136k | zend_class_entry *ce = NULL; |
4233 | | |
4234 | 136k | tmp = 0; |
4235 | 414k | for (i = 0; i < blocks[p->block].predecessors_count; i++) { |
4236 | 277k | tmp |= get_ssa_var_info(ssa, p->sources[i]); |
4237 | 277k | } |
4238 | 136k | UPDATE_SSA_TYPE(tmp, j); |
4239 | 414k | for (i = 0; i < blocks[p->block].predecessors_count; i++) { |
4240 | 277k | zend_ssa_var_info *info; |
4241 | | |
4242 | 277k | ZEND_ASSERT(p->sources[i] >= 0); |
4243 | 277k | info = &ssa_var_info[p->sources[i]]; |
4244 | 277k | if (info->type & MAY_BE_OBJECT) { |
4245 | 171k | if (first) { |
4246 | 107k | ce = info->ce; |
4247 | 107k | is_instanceof = info->is_instanceof; |
4248 | 107k | first = 0; |
4249 | 107k | } else { |
4250 | 63.3k | is_instanceof |= info->is_instanceof; |
4251 | 63.3k | ce = join_class_entries(ce, info->ce, &is_instanceof); |
4252 | 63.3k | } |
4253 | 171k | } |
4254 | 277k | } |
4255 | 136k | UPDATE_SSA_OBJ_TYPE(ce, ce ? is_instanceof : 0, j); |
4256 | 136k | } |
4257 | 863k | } else if (ssa_vars[j].definition >= 0) { |
4258 | 863k | i = ssa_vars[j].definition; |
4259 | 863k | if (_zend_update_type_info(op_array, ssa, script, worklist, op_array->opcodes + i, ssa->ops + i, NULL, optimization_level, 1) == FAILURE) { |
4260 | 0 | return FAILURE; |
4261 | 0 | } |
4262 | 863k | } |
4263 | 1.05M | } |
4264 | 74.1k | return SUCCESS; |
4265 | 74.1k | } |
4266 | | |
4267 | 2.72k | static bool is_narrowable_instr(zend_op *opline) { |
4268 | 2.72k | return opline->opcode == ZEND_ADD || opline->opcode == ZEND_SUB |
4269 | 2.72k | || opline->opcode == ZEND_MUL || opline->opcode == ZEND_DIV; |
4270 | 2.72k | } |
4271 | | |
4272 | 0 | static bool is_effective_op1_double_cast(zend_op *opline, zval *op2) { |
4273 | 0 | return (opline->opcode == ZEND_ADD && Z_LVAL_P(op2) == 0) |
4274 | 0 | || (opline->opcode == ZEND_SUB && Z_LVAL_P(op2) == 0) |
4275 | 0 | || (opline->opcode == ZEND_MUL && Z_LVAL_P(op2) == 1) |
4276 | 0 | || (opline->opcode == ZEND_DIV && Z_LVAL_P(op2) == 1); |
4277 | 0 | } |
4278 | 10 | static bool is_effective_op2_double_cast(zend_op *opline, zval *op1) { |
4279 | | /* In PHP it holds that (double)(0-$int) is bitwise identical to 0.0-(double)$int, |
4280 | | * so allowing SUB here is fine. */ |
4281 | 10 | return (opline->opcode == ZEND_ADD && Z_LVAL_P(op1) == 0) |
4282 | 10 | || (opline->opcode == ZEND_SUB && Z_LVAL_P(op1) == 0) |
4283 | 10 | || (opline->opcode == ZEND_MUL && Z_LVAL_P(op1) == 1); |
4284 | 10 | } |
4285 | | |
4286 | | /* This function recursively checks whether it's possible to convert an integer variable |
4287 | | * initialization to a double initialization. The basic idea is that if the value is used |
4288 | | * only in add/sub/mul/div ("narrowable" instructions) with a double result value, then it |
4289 | | * will be cast to double at that point anyway, so we may as well do it earlier already. |
4290 | | * |
4291 | | * The tricky case are chains of operations, where it's not necessarily a given that converting |
4292 | | * an integer to double before the chain of operations is the same as converting it after the |
4293 | | * chain. What this function does is detect two cases where it is safe: |
4294 | | * * If the operations only involve constants, then we can simply verify that performing the |
4295 | | * calculation on integers and doubles yields the same value. |
4296 | | * * Even if one operand is not known, we may be able to determine that the operations with the |
4297 | | * integer replaced by a double only acts as an effective double cast on the unknown operand. |
4298 | | * E.g. 0+$i and 0.0+$i only differ by that cast. If then the consuming instruction of this |
4299 | | * result will perform a double cast anyway, the conversion is safe. |
4300 | | * |
4301 | | * The checks happens recursively, while keeping track of which variables are already visited to |
4302 | | * avoid infinite loops. An iterative, worklist driven approach would be possible, but the state |
4303 | | * management more cumbersome to implement, so we don't bother for now. |
4304 | | */ |
4305 | | static bool can_convert_to_double( |
4306 | | const zend_op_array *op_array, zend_ssa *ssa, int var_num, |
4307 | 5.36k | zval *value, zend_bitset visited) { |
4308 | 5.36k | zend_ssa_var *var = &ssa->vars[var_num]; |
4309 | 5.36k | zend_ssa_phi *phi; |
4310 | 5.36k | int use; |
4311 | 5.36k | uint32_t type; |
4312 | | |
4313 | 5.36k | if (zend_bitset_in(visited, var_num)) { |
4314 | 4 | return 1; |
4315 | 4 | } |
4316 | 5.36k | zend_bitset_incl(visited, var_num); |
4317 | | |
4318 | 5.58k | for (use = var->use_chain; use >= 0; use = zend_ssa_next_use(ssa->ops, var_num, use)) { |
4319 | 2.94k | zend_op *opline = &op_array->opcodes[use]; |
4320 | 2.94k | zend_ssa_op *ssa_op = &ssa->ops[use]; |
4321 | | |
4322 | 2.94k | if (zend_ssa_is_no_val_use(opline, ssa_op, var_num)) { |
4323 | 218 | continue; |
4324 | 218 | } |
4325 | | |
4326 | 2.72k | if (!is_narrowable_instr(opline)) { |
4327 | 2.57k | return 0; |
4328 | 2.57k | } |
4329 | | |
4330 | | /* Instruction always returns double, the conversion is certainly fine */ |
4331 | 148 | type = ssa->var_info[ssa_op->result_def].type; |
4332 | 148 | if ((type & MAY_BE_ANY) == MAY_BE_DOUBLE) { |
4333 | 6 | continue; |
4334 | 6 | } |
4335 | | |
4336 | | /* UNDEF signals that the previous result is an effective double cast, this is only allowed |
4337 | | * if this instruction would have done the cast anyway (previous check). */ |
4338 | 142 | if (Z_ISUNDEF_P(value)) { |
4339 | 0 | return 0; |
4340 | 0 | } |
4341 | | |
4342 | | /* Check that narrowing can actually be useful */ |
4343 | 142 | if ((type & MAY_BE_ANY) & ~(MAY_BE_LONG|MAY_BE_DOUBLE)) { |
4344 | 100 | return 0; |
4345 | 100 | } |
4346 | | |
4347 | 42 | { |
4348 | | /* For calculation on original values */ |
4349 | 42 | zval orig_op1, orig_op2, orig_result; |
4350 | | /* For calculation with var_num cast to double */ |
4351 | 42 | zval dval_op1, dval_op2, dval_result; |
4352 | | |
4353 | 42 | ZVAL_UNDEF(&orig_op1); |
4354 | 42 | ZVAL_UNDEF(&dval_op1); |
4355 | 42 | if (ssa_op->op1_use == var_num) { |
4356 | 42 | ZVAL_COPY_VALUE(&orig_op1, value); |
4357 | 42 | ZVAL_DOUBLE(&dval_op1, (double) Z_LVAL_P(value)); |
4358 | 42 | } else if (opline->op1_type == IS_CONST) { |
4359 | 0 | zval *zv = CRT_CONSTANT(opline->op1); |
4360 | 0 | if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_DOUBLE) { |
4361 | 0 | ZVAL_COPY_VALUE(&orig_op1, zv); |
4362 | 0 | ZVAL_COPY_VALUE(&dval_op1, zv); |
4363 | 0 | } |
4364 | 0 | } |
4365 | | |
4366 | 42 | ZVAL_UNDEF(&orig_op2); |
4367 | 42 | ZVAL_UNDEF(&dval_op2); |
4368 | 42 | if (ssa_op->op2_use == var_num) { |
4369 | 0 | ZVAL_COPY_VALUE(&orig_op2, value); |
4370 | 0 | ZVAL_DOUBLE(&dval_op2, (double) Z_LVAL_P(value)); |
4371 | 42 | } else if (opline->op2_type == IS_CONST) { |
4372 | 32 | zval *zv = CRT_CONSTANT(opline->op2); |
4373 | 32 | if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_DOUBLE) { |
4374 | 32 | ZVAL_COPY_VALUE(&orig_op2, zv); |
4375 | 32 | ZVAL_COPY_VALUE(&dval_op2, zv); |
4376 | 32 | } |
4377 | 32 | } |
4378 | | |
4379 | 42 | ZEND_ASSERT(!Z_ISUNDEF(orig_op1) || !Z_ISUNDEF(orig_op2)); |
4380 | 42 | if (Z_ISUNDEF(orig_op1)) { |
4381 | 0 | if (opline->opcode == ZEND_MUL && Z_LVAL(orig_op2) == 0) { |
4382 | 0 | ZVAL_LONG(&orig_result, 0); |
4383 | 0 | } else if (is_effective_op1_double_cast(opline, &orig_op2)) { |
4384 | 0 | ZVAL_UNDEF(&orig_result); |
4385 | 0 | } else { |
4386 | 0 | return 0; |
4387 | 0 | } |
4388 | 42 | } else if (Z_ISUNDEF(orig_op2)) { |
4389 | 10 | if (opline->opcode == ZEND_MUL && Z_LVAL(orig_op1) == 0) { |
4390 | 0 | ZVAL_LONG(&orig_result, 0); |
4391 | 10 | } else if (is_effective_op2_double_cast(opline, &orig_op1)) { |
4392 | 6 | ZVAL_UNDEF(&orig_result); |
4393 | 6 | } else { |
4394 | 4 | return 0; |
4395 | 4 | } |
4396 | 32 | } else { |
4397 | 32 | uint8_t opcode = opline->opcode; |
4398 | | |
4399 | 32 | if (opcode == ZEND_ASSIGN_OP) { |
4400 | 0 | opcode = opline->extended_value; |
4401 | 0 | } |
4402 | | |
4403 | | /* Avoid division by zero */ |
4404 | 32 | if (opcode == ZEND_DIV && zval_get_double(&orig_op2) == 0.0) { |
4405 | 0 | return 0; |
4406 | 0 | } |
4407 | | |
4408 | 32 | get_binary_op(opcode)(&orig_result, &orig_op1, &orig_op2); |
4409 | 32 | get_binary_op(opcode)(&dval_result, &dval_op1, &dval_op2); |
4410 | 32 | ZEND_ASSERT(Z_TYPE(dval_result) == IS_DOUBLE); |
4411 | 32 | if (zval_get_double(&orig_result) != Z_DVAL(dval_result)) { |
4412 | 4 | return 0; |
4413 | 4 | } |
4414 | 32 | } |
4415 | | |
4416 | 34 | if (!can_convert_to_double(op_array, ssa, ssa_op->result_def, &orig_result, visited)) { |
4417 | 32 | return 0; |
4418 | 32 | } |
4419 | 34 | } |
4420 | 34 | } |
4421 | | |
4422 | 2.65k | for (phi = var->phi_use_chain; phi; phi = zend_ssa_next_use_phi(ssa, var_num, phi)) { |
4423 | | /* Check that narrowing can actually be useful */ |
4424 | 2.64k | type = ssa->var_info[phi->ssa_var].type; |
4425 | 2.64k | if ((type & MAY_BE_ANY) & ~(MAY_BE_LONG|MAY_BE_DOUBLE)) { |
4426 | 328 | return 0; |
4427 | 328 | } |
4428 | | |
4429 | 2.31k | if (!can_convert_to_double(op_array, ssa, phi->ssa_var, value, visited)) { |
4430 | 2.30k | return 0; |
4431 | 2.30k | } |
4432 | 2.31k | } |
4433 | | |
4434 | 10 | return 1; |
4435 | 2.64k | } |
4436 | | |
4437 | | static zend_result zend_type_narrowing(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level) |
4438 | 74.1k | { |
4439 | 74.1k | uint32_t bitset_len = zend_bitset_len(ssa->vars_count); |
4440 | 74.1k | zend_bitset visited, worklist; |
4441 | 74.1k | int i, v; |
4442 | 74.1k | zend_op *opline; |
4443 | 74.1k | bool narrowed = 0; |
4444 | 74.1k | ALLOCA_FLAG(use_heap) |
4445 | | |
4446 | 74.1k | visited = ZEND_BITSET_ALLOCA(2 * bitset_len, use_heap); |
4447 | 74.1k | worklist = visited + bitset_len; |
4448 | | |
4449 | 74.1k | zend_bitset_clear(worklist, bitset_len); |
4450 | | |
4451 | 1.09M | for (v = op_array->last_var; v < ssa->vars_count; v++) { |
4452 | 1.02M | if ((ssa->var_info[v].type & (MAY_BE_REF | MAY_BE_ANY | MAY_BE_UNDEF)) != MAY_BE_LONG) continue; |
4453 | 30.9k | if (ssa->vars[v].definition < 0) continue; |
4454 | 25.2k | if (ssa->vars[v].no_val) continue; |
4455 | 23.4k | opline = op_array->opcodes + ssa->vars[v].definition; |
4456 | | /* Go through assignments of literal integers and check if they can be converted to |
4457 | | * doubles instead, in the hope that we'll narrow long|double to double. */ |
4458 | 23.4k | if (opline->opcode == ZEND_ASSIGN && opline->result_type == IS_UNUSED && |
4459 | 23.4k | opline->op1_type == IS_CV && opline->op2_type == IS_CONST) { |
4460 | 3.01k | zval *value = CRT_CONSTANT(opline->op2); |
4461 | | |
4462 | 3.01k | zend_bitset_clear(visited, bitset_len); |
4463 | 3.01k | if (can_convert_to_double(op_array, ssa, v, value, visited)) { |
4464 | 2 | narrowed = 1; |
4465 | 2 | ssa->var_info[v].use_as_double = 1; |
4466 | | /* The "visited" vars are exactly those which may change their type due to |
4467 | | * narrowing. Reset their types and add them to the type inference worklist */ |
4468 | 20 | ZEND_BITSET_FOREACH(visited, bitset_len, i) { |
4469 | 6 | ssa->var_info[i].type &= ~MAY_BE_ANY; |
4470 | 6 | } ZEND_BITSET_FOREACH_END(); |
4471 | 2 | zend_bitset_union(worklist, visited, bitset_len); |
4472 | 2 | } |
4473 | 3.01k | } |
4474 | 23.4k | } |
4475 | | |
4476 | 74.1k | if (!narrowed) { |
4477 | 74.1k | free_alloca(visited, use_heap); |
4478 | 74.1k | return SUCCESS; |
4479 | 74.1k | } |
4480 | | |
4481 | 2 | if (zend_infer_types_ex(op_array, script, ssa, worklist, optimization_level) == FAILURE) { |
4482 | 0 | free_alloca(visited, use_heap); |
4483 | 0 | return FAILURE; |
4484 | 0 | } |
4485 | | |
4486 | 2 | free_alloca(visited, use_heap); |
4487 | 2 | return SUCCESS; |
4488 | 2 | } |
4489 | | |
4490 | | static bool is_recursive_tail_call(const zend_op_array *op_array, |
4491 | | zend_op *opline) |
4492 | 71.6k | { |
4493 | 71.6k | zend_func_info *info = ZEND_FUNC_INFO(op_array); |
4494 | | |
4495 | 71.6k | if (info->ssa.ops && info->ssa.vars && info->call_map && |
4496 | 71.6k | info->ssa.ops[opline - op_array->opcodes].op1_use >= 0 && |
4497 | 71.6k | info->ssa.vars[info->ssa.ops[opline - op_array->opcodes].op1_use].definition >= 0) { |
4498 | | |
4499 | 1.95k | zend_op *op = op_array->opcodes + info->ssa.vars[info->ssa.ops[opline - op_array->opcodes].op1_use].definition; |
4500 | | |
4501 | 1.95k | if (op->opcode == ZEND_DO_UCALL) { |
4502 | 138 | zend_call_info *call_info = info->call_map[op - op_array->opcodes]; |
4503 | 138 | if (call_info && op_array == &call_info->callee_func->op_array) { |
4504 | 9 | return 1; |
4505 | 9 | } |
4506 | 138 | } |
4507 | 1.95k | } |
4508 | 71.6k | return 0; |
4509 | 71.6k | } |
4510 | | |
4511 | | uint32_t zend_get_return_info_from_signature_only( |
4512 | | const zend_function *func, const zend_script *script, |
4513 | 26.3k | zend_class_entry **ce, bool *ce_is_instanceof, bool use_tentative_return_info) { |
4514 | 26.3k | uint32_t type; |
4515 | 26.3k | if (func->common.fn_flags & ZEND_ACC_HAS_RETURN_TYPE && |
4516 | 26.3k | (use_tentative_return_info || !ZEND_ARG_TYPE_IS_TENTATIVE(func->common.arg_info - 1)) |
4517 | 26.3k | ) { |
4518 | 20.5k | zend_arg_info *ret_info = func->common.arg_info - 1; |
4519 | 20.5k | type = zend_fetch_arg_info_type(script, ret_info, ce); |
4520 | 20.5k | *ce_is_instanceof = ce != NULL; |
4521 | 20.5k | } else { |
4522 | 5.78k | type = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF |
4523 | 5.78k | | MAY_BE_RC1 | MAY_BE_RCN; |
4524 | 5.78k | *ce = NULL; |
4525 | 5.78k | *ce_is_instanceof = false; |
4526 | 5.78k | } |
4527 | | |
4528 | | /* For generators RETURN_REFERENCE refers to the yielded values. */ |
4529 | 26.3k | if ((func->common.fn_flags & ZEND_ACC_RETURN_REFERENCE) |
4530 | 26.3k | && !(func->common.fn_flags & ZEND_ACC_GENERATOR)) { |
4531 | 1.02k | type |= MAY_BE_REF; |
4532 | 1.02k | *ce = NULL; |
4533 | 1.02k | *ce_is_instanceof = 0; |
4534 | 1.02k | } |
4535 | 26.3k | return type; |
4536 | 26.3k | } |
4537 | | |
4538 | | ZEND_API void zend_init_func_return_info( |
4539 | | const zend_op_array *op_array, const zend_script *script, zend_ssa_var_info *ret) |
4540 | 6.52k | { |
4541 | 6.52k | ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE)); |
4542 | | |
4543 | 6.52k | zend_ssa_range tmp_range = {0, 0, 0, 0}; |
4544 | 6.52k | bool is_instanceof = false; |
4545 | 6.52k | ret->type = zend_get_return_info_from_signature_only( |
4546 | 6.52k | (zend_function *) op_array, script, &ret->ce, &is_instanceof, /* use_tentative_return_info */ 1); |
4547 | 6.52k | ret->is_instanceof = is_instanceof; |
4548 | 6.52k | ret->range = tmp_range; |
4549 | 6.52k | ret->has_range = 0; |
4550 | 6.52k | } |
4551 | | |
4552 | | static void zend_func_return_info(const zend_op_array *op_array, |
4553 | | const zend_script *script, |
4554 | | int recursive, |
4555 | | int widening, |
4556 | | zend_ssa_var_info *ret) |
4557 | 74.1k | { |
4558 | 74.1k | zend_func_info *info = ZEND_FUNC_INFO(op_array); |
4559 | 74.1k | zend_ssa *ssa = &info->ssa; |
4560 | 74.1k | int blocks_count = info->ssa.cfg.blocks_count; |
4561 | 74.1k | zend_basic_block *blocks = info->ssa.cfg.blocks; |
4562 | 74.1k | int j; |
4563 | 74.1k | uint32_t t1; |
4564 | 74.1k | uint32_t tmp = 0; |
4565 | 74.1k | zend_class_entry *tmp_ce = NULL; |
4566 | 74.1k | int tmp_is_instanceof = -1; |
4567 | 74.1k | zend_class_entry *arg_ce; |
4568 | 74.1k | int arg_is_instanceof; |
4569 | 74.1k | zend_ssa_range tmp_range = {0, 0, 0, 0}; |
4570 | 74.1k | int tmp_has_range = -1; |
4571 | | |
4572 | 74.1k | if (op_array->fn_flags & ZEND_ACC_GENERATOR) { |
4573 | 1.62k | ret->type = MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN; |
4574 | 1.62k | ret->ce = zend_ce_generator; |
4575 | 1.62k | ret->is_instanceof = 0; |
4576 | 1.62k | ret->range = tmp_range; |
4577 | 1.62k | ret->has_range = 0; |
4578 | 1.62k | return; |
4579 | 1.62k | } |
4580 | | |
4581 | 72.5k | if (!ret->type) { |
4582 | | /* We will intersect the type later. */ |
4583 | 66.2k | ret->type = MAY_BE_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_KEY_ANY |
4584 | 66.2k | | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF; |
4585 | 66.2k | } |
4586 | | |
4587 | 286k | for (j = 0; j < blocks_count; j++) { |
4588 | 214k | if ((blocks[j].flags & ZEND_BB_REACHABLE) && blocks[j].len != 0) { |
4589 | 214k | zend_op *opline = op_array->opcodes + blocks[j].start + blocks[j].len - 1; |
4590 | | |
4591 | 214k | if (opline->opcode == ZEND_RETURN || opline->opcode == ZEND_RETURN_BY_REF) { |
4592 | 71.6k | zend_ssa_op *ssa_op = ssa->ops ? &ssa->ops[opline - op_array->opcodes] : NULL; |
4593 | 71.6k | if (!recursive && ssa_op && info->ssa.var_info && |
4594 | 71.6k | ssa_op->op1_use >= 0 && |
4595 | 71.6k | info->ssa.var_info[ssa_op->op1_use].recursive) { |
4596 | 0 | continue; |
4597 | 0 | } |
4598 | 71.6k | if (is_recursive_tail_call(op_array, opline)) { |
4599 | 9 | continue; |
4600 | 9 | } |
4601 | 71.6k | t1 = OP1_INFO(); |
4602 | 71.6k | if (t1 & MAY_BE_UNDEF) { |
4603 | 180 | t1 |= MAY_BE_NULL; |
4604 | 180 | } |
4605 | 71.6k | if (opline->opcode == ZEND_RETURN) { |
4606 | 70.8k | if (t1 & MAY_BE_RC1) { |
4607 | 5.39k | t1 |= MAY_BE_RCN; |
4608 | 5.39k | } |
4609 | 70.8k | t1 &= ~(MAY_BE_UNDEF | MAY_BE_REF); |
4610 | 70.8k | } else { |
4611 | 831 | t1 |= MAY_BE_REF; |
4612 | 831 | t1 &= ~(MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN); |
4613 | 831 | } |
4614 | 71.6k | tmp |= t1; |
4615 | | |
4616 | 71.6k | if (ssa_op && info->ssa.var_info && |
4617 | 71.6k | ssa_op->op1_use >= 0 && !(t1 & MAY_BE_REF) && |
4618 | 71.6k | info->ssa.var_info[ssa_op->op1_use].ce) { |
4619 | 1.50k | arg_ce = info->ssa.var_info[ssa_op->op1_use].ce; |
4620 | 1.50k | arg_is_instanceof = info->ssa.var_info[ssa_op->op1_use].is_instanceof; |
4621 | 70.1k | } else { |
4622 | 70.1k | arg_ce = NULL; |
4623 | 70.1k | arg_is_instanceof = 0; |
4624 | 70.1k | } |
4625 | | |
4626 | 71.6k | if (tmp_is_instanceof < 0) { |
4627 | 70.1k | tmp_ce = arg_ce; |
4628 | 70.1k | tmp_is_instanceof = arg_is_instanceof; |
4629 | 70.1k | } else if (arg_ce && arg_ce == tmp_ce) { |
4630 | 16 | if (tmp_is_instanceof != arg_is_instanceof) { |
4631 | 0 | tmp_is_instanceof = 1; |
4632 | 0 | } |
4633 | 1.47k | } else { |
4634 | 1.47k | tmp_ce = NULL; |
4635 | 1.47k | tmp_is_instanceof = 0; |
4636 | 1.47k | } |
4637 | | |
4638 | 71.6k | if (opline->op1_type == IS_CONST) { |
4639 | 63.2k | zval *zv = CRT_CONSTANT(opline->op1); |
4640 | | |
4641 | 63.2k | if (Z_TYPE_P(zv) == IS_LONG) { |
4642 | 35.7k | if (tmp_has_range < 0) { |
4643 | 35.4k | tmp_has_range = 1; |
4644 | 35.4k | tmp_range.underflow = 0; |
4645 | 35.4k | tmp_range.min = Z_LVAL_P(zv); |
4646 | 35.4k | tmp_range.max = Z_LVAL_P(zv); |
4647 | 35.4k | tmp_range.overflow = 0; |
4648 | 35.4k | } else if (tmp_has_range) { |
4649 | 122 | if (!tmp_range.underflow) { |
4650 | 62 | tmp_range.min = MIN(tmp_range.min, Z_LVAL_P(zv)); |
4651 | 62 | } |
4652 | 122 | if (!tmp_range.overflow) { |
4653 | 62 | tmp_range.max = MAX(tmp_range.max, Z_LVAL_P(zv)); |
4654 | 62 | } |
4655 | 122 | } |
4656 | 35.7k | } else { |
4657 | 27.5k | tmp_has_range = 0; |
4658 | 27.5k | } |
4659 | 63.2k | } else if (ssa_op && info->ssa.var_info && ssa_op->op1_use >= 0) { |
4660 | 8.37k | if (info->ssa.var_info[ssa_op->op1_use].has_range) { |
4661 | 7.96k | if (tmp_has_range < 0) { |
4662 | 7.53k | tmp_has_range = 1; |
4663 | 7.53k | tmp_range = info->ssa.var_info[ssa_op->op1_use].range; |
4664 | 7.53k | } else if (tmp_has_range) { |
4665 | | /* union */ |
4666 | 334 | if (info->ssa.var_info[ssa_op->op1_use].range.underflow) { |
4667 | 332 | tmp_range.underflow = 1; |
4668 | 332 | tmp_range.min = ZEND_LONG_MIN; |
4669 | 332 | } else { |
4670 | 2 | tmp_range.min = MIN(tmp_range.min, info->ssa.var_info[ssa_op->op1_use].range.min); |
4671 | 2 | } |
4672 | 334 | if (info->ssa.var_info[ssa_op->op1_use].range.overflow) { |
4673 | 332 | tmp_range.overflow = 1; |
4674 | 332 | tmp_range.max = ZEND_LONG_MAX; |
4675 | 332 | } else { |
4676 | 2 | tmp_range.max = MAX(tmp_range.max, info->ssa.var_info[ssa_op->op1_use].range.max); |
4677 | 2 | } |
4678 | 334 | } |
4679 | 7.96k | } else if (!widening) { |
4680 | 416 | tmp_has_range = 1; |
4681 | 416 | tmp_range.underflow = 1; |
4682 | 416 | tmp_range.min = ZEND_LONG_MIN; |
4683 | 416 | tmp_range.max = ZEND_LONG_MAX; |
4684 | 416 | tmp_range.overflow = 1; |
4685 | 416 | } |
4686 | 8.37k | } else { |
4687 | 0 | tmp_has_range = 0; |
4688 | 0 | } |
4689 | 71.6k | } |
4690 | 214k | } |
4691 | 214k | } |
4692 | | |
4693 | 72.5k | if (!(op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE)) { |
4694 | 66.1k | if (tmp_is_instanceof < 0) { |
4695 | 2.18k | tmp_is_instanceof = 0; |
4696 | 2.18k | tmp_ce = NULL; |
4697 | 2.18k | } |
4698 | 66.1k | if (tmp_has_range < 0) { |
4699 | 2.18k | tmp_has_range = 0; |
4700 | 2.18k | } |
4701 | 66.1k | ret->ce = tmp_ce; |
4702 | 66.1k | ret->is_instanceof = tmp_is_instanceof; |
4703 | 66.1k | } |
4704 | 72.5k | ret->type &= tmp; |
4705 | 72.5k | ret->range = tmp_range; |
4706 | 72.5k | ret->has_range = tmp_has_range; |
4707 | 72.5k | } |
4708 | | |
4709 | | static zend_result zend_infer_types(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level) |
4710 | 74.1k | { |
4711 | 74.1k | int ssa_vars_count = ssa->vars_count; |
4712 | 74.1k | int j; |
4713 | 74.1k | zend_bitset worklist; |
4714 | 74.1k | ALLOCA_FLAG(use_heap); |
4715 | | |
4716 | 74.1k | worklist = do_alloca(sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count), use_heap); |
4717 | 74.1k | memset(worklist, 0, sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count)); |
4718 | | |
4719 | | /* Type Inference */ |
4720 | 1.09M | for (j = op_array->last_var; j < ssa_vars_count; j++) { |
4721 | 1.02M | zend_bitset_incl(worklist, j); |
4722 | 1.02M | } |
4723 | | |
4724 | 74.1k | if (zend_infer_types_ex(op_array, script, ssa, worklist, optimization_level) == FAILURE) { |
4725 | 0 | free_alloca(worklist, use_heap); |
4726 | 0 | return FAILURE; |
4727 | 0 | } |
4728 | | |
4729 | 74.1k | if (optimization_level & ZEND_OPTIMIZER_NARROW_TO_DOUBLE) { |
4730 | | /* Narrowing integer initialization to doubles */ |
4731 | 74.1k | zend_type_narrowing(op_array, script, ssa, optimization_level); |
4732 | 74.1k | } |
4733 | | |
4734 | 74.1k | if (ZEND_FUNC_INFO(op_array)) { |
4735 | 74.1k | zend_func_return_info(op_array, script, 1, 0, &ZEND_FUNC_INFO(op_array)->return_info); |
4736 | 74.1k | } |
4737 | | |
4738 | 74.1k | free_alloca(worklist, use_heap); |
4739 | 74.1k | return SUCCESS; |
4740 | 74.1k | } |
4741 | | |
4742 | | static void zend_mark_cv_references(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa) |
4743 | 74.1k | { |
4744 | 74.1k | int var, def; |
4745 | 74.1k | const zend_op *opline; |
4746 | 74.1k | zend_arg_info *arg_info; |
4747 | 74.1k | uint32_t worklist_len = zend_bitset_len(ssa->vars_count); |
4748 | 74.1k | zend_bitset worklist; |
4749 | 74.1k | ALLOCA_FLAG(use_heap); |
4750 | | |
4751 | 74.1k | worklist = do_alloca(sizeof(zend_ulong) * worklist_len, use_heap); |
4752 | 74.1k | memset(worklist, 0, sizeof(zend_ulong) * worklist_len); |
4753 | | |
4754 | | /* Collect SSA variables which definitions creates PHP reference */ |
4755 | 1.20M | for (var = 0; var < ssa->vars_count; var++) { |
4756 | 1.12M | def = ssa->vars[var].definition; |
4757 | 1.12M | if (def >= 0 && ssa->vars[var].var < op_array->last_var) { |
4758 | 130k | opline = op_array->opcodes + def; |
4759 | 130k | if (ssa->ops[def].result_def == var) { |
4760 | 23.3k | switch (opline->opcode) { |
4761 | 20.2k | case ZEND_RECV: |
4762 | 23.0k | case ZEND_RECV_INIT: |
4763 | 23.0k | arg_info = &op_array->arg_info[opline->op1.num-1]; |
4764 | 23.0k | if (!ZEND_ARG_SEND_MODE(arg_info)) { |
4765 | 21.5k | continue; |
4766 | 21.5k | } |
4767 | 1.46k | break; |
4768 | 1.46k | default: |
4769 | 350 | continue; |
4770 | 23.3k | } |
4771 | 107k | } else if (ssa->ops[def].op1_def == var) { |
4772 | 102k | switch (opline->opcode) { |
4773 | 1.53k | case ZEND_ASSIGN_REF: |
4774 | 1.67k | case ZEND_MAKE_REF: |
4775 | 2.23k | case ZEND_FE_RESET_RW: |
4776 | 2.88k | case ZEND_BIND_GLOBAL: |
4777 | 4.85k | case ZEND_SEND_REF: |
4778 | 10.9k | case ZEND_SEND_VAR_EX: |
4779 | 10.9k | case ZEND_SEND_FUNC_ARG: |
4780 | 11.1k | case ZEND_BIND_INIT_STATIC_OR_JMP: |
4781 | 11.1k | break; |
4782 | 163 | case ZEND_INIT_ARRAY: |
4783 | 203 | case ZEND_ADD_ARRAY_ELEMENT: |
4784 | 203 | if (!(opline->extended_value & ZEND_ARRAY_ELEMENT_REF)) { |
4785 | 0 | continue; |
4786 | 0 | } |
4787 | 203 | break; |
4788 | 5.90k | case ZEND_BIND_STATIC: |
4789 | 5.90k | if (!(opline->extended_value & ZEND_BIND_REF)) { |
4790 | 4.94k | continue; |
4791 | 4.94k | } |
4792 | 965 | break; |
4793 | 965 | case ZEND_YIELD: |
4794 | 52 | if (!(op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE)) { |
4795 | 0 | continue; |
4796 | 0 | } |
4797 | 52 | break; |
4798 | 249 | case ZEND_OP_DATA: |
4799 | 249 | switch ((opline-1)->opcode) { |
4800 | 215 | case ZEND_ASSIGN_OBJ_REF: |
4801 | 249 | case ZEND_ASSIGN_STATIC_PROP_REF: |
4802 | 249 | break; |
4803 | 0 | default: |
4804 | 0 | continue; |
4805 | 249 | } |
4806 | 249 | break; |
4807 | 85.2k | default: |
4808 | 85.2k | continue; |
4809 | 102k | } |
4810 | 102k | } else if (ssa->ops[def].op2_def == var) { |
4811 | 4.48k | switch (opline->opcode) { |
4812 | 957 | case ZEND_ASSIGN_REF: |
4813 | 1.59k | case ZEND_FE_FETCH_RW: |
4814 | 1.59k | break; |
4815 | 480 | case ZEND_BIND_LEXICAL: |
4816 | 480 | if (!(opline->extended_value & ZEND_BIND_REF)) { |
4817 | 0 | continue; |
4818 | 0 | } |
4819 | 480 | break; |
4820 | 2.41k | default: |
4821 | 2.41k | continue; |
4822 | 4.48k | } |
4823 | 4.48k | } else { |
4824 | 0 | ZEND_UNREACHABLE(); |
4825 | 0 | } |
4826 | 16.1k | zend_bitset_incl(worklist, var); |
4827 | 996k | } else if (ssa->var_info[var].type & MAY_BE_REF) { |
4828 | 55.7k | zend_bitset_incl(worklist, var); |
4829 | 941k | } else if (ssa->vars[var].alias == SYMTABLE_ALIAS) { |
4830 | 0 | zend_bitset_incl(worklist, var); |
4831 | 0 | } |
4832 | 1.12M | } |
4833 | | |
4834 | | /* Set and propagate MAY_BE_REF */ |
4835 | 3.17M | WHILE_WORKLIST(worklist, worklist_len, var) { |
4836 | | |
4837 | 3.17M | ssa->var_info[var].type |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
4838 | | |
4839 | 3.17M | if (ssa->vars[var].phi_use_chain) { |
4840 | 88.7k | zend_ssa_phi *p = ssa->vars[var].phi_use_chain; |
4841 | 121k | do { |
4842 | 121k | if (!(ssa->var_info[p->ssa_var].type & MAY_BE_REF)) { |
4843 | 109k | zend_bitset_incl(worklist, p->ssa_var); |
4844 | 109k | } |
4845 | 121k | p = zend_ssa_next_use_phi(ssa, var, p); |
4846 | 121k | } while (p); |
4847 | 88.7k | } |
4848 | | |
4849 | 3.17M | if (ssa->vars[var].use_chain >= 0) { |
4850 | 165k | int use = ssa->vars[var].use_chain; |
4851 | 429k | FOREACH_USE(&ssa->vars[var], use) { |
4852 | 429k | zend_ssa_op *op = ssa->ops + use; |
4853 | 429k | if (op->op1_use == var && op->op1_def >= 0) { |
4854 | 60.7k | if (!(ssa->var_info[op->op1_def].type & MAY_BE_REF)) { |
4855 | | /* Unset breaks references (outside global scope). */ |
4856 | 56.7k | if (op_array->opcodes[use].opcode == ZEND_UNSET_CV |
4857 | 56.7k | && op_array->function_name) { |
4858 | 70 | continue; |
4859 | 70 | } |
4860 | 56.6k | zend_bitset_incl(worklist, op->op1_def); |
4861 | 56.6k | } |
4862 | 60.7k | } |
4863 | 263k | if (op->op2_use == var && op->op2_def >= 0) { |
4864 | 3.37k | if (!(ssa->var_info[op->op2_def].type & MAY_BE_REF)) { |
4865 | 1.94k | zend_bitset_incl(worklist, op->op2_def); |
4866 | 1.94k | } |
4867 | 3.37k | } |
4868 | 263k | if (op->result_use == var && op->result_def >= 0) { |
4869 | 0 | if (!(ssa->var_info[op->result_def].type & MAY_BE_REF)) { |
4870 | 0 | zend_bitset_incl(worklist, op->result_def); |
4871 | 0 | } |
4872 | 0 | } |
4873 | 263k | } FOREACH_USE_END(); |
4874 | 165k | } |
4875 | 3.17M | } WHILE_WORKLIST_END(); |
4876 | | |
4877 | 74.1k | free_alloca(worklist, use_heap); |
4878 | 74.1k | } |
4879 | | |
4880 | | ZEND_API zend_result zend_ssa_inference(zend_arena **arena, const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level) /* {{{ */ |
4881 | 74.1k | { |
4882 | 74.1k | zend_ssa_var_info *ssa_var_info; |
4883 | 74.1k | int i; |
4884 | | |
4885 | 74.1k | if (!ssa->var_info) { |
4886 | 74.1k | ssa->var_info = zend_arena_calloc(arena, ssa->vars_count, sizeof(zend_ssa_var_info)); |
4887 | 74.1k | } |
4888 | 74.1k | ssa_var_info = ssa->var_info; |
4889 | | |
4890 | 74.1k | if (!op_array->function_name) { |
4891 | 91.4k | for (i = 0; i < op_array->last_var; i++) { |
4892 | 55.7k | ssa_var_info[i].type = MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; |
4893 | 55.7k | ssa_var_info[i].has_range = 0; |
4894 | 55.7k | } |
4895 | 38.3k | } else { |
4896 | 87.1k | for (i = 0; i < op_array->last_var; i++) { |
4897 | 48.7k | ssa_var_info[i].type = MAY_BE_UNDEF; |
4898 | 48.7k | ssa_var_info[i].has_range = 0; |
4899 | 48.7k | if (ssa->vars[i].alias) { |
4900 | 0 | ssa_var_info[i].type |= get_ssa_alias_types(ssa->vars[i].alias); |
4901 | 0 | } |
4902 | 48.7k | } |
4903 | 38.3k | } |
4904 | 1.09M | for (i = op_array->last_var; i < ssa->vars_count; i++) { |
4905 | 1.02M | ssa_var_info[i].type = 0; |
4906 | 1.02M | ssa_var_info[i].has_range = 0; |
4907 | 1.02M | } |
4908 | | |
4909 | 74.1k | zend_mark_cv_references(op_array, script, ssa); |
4910 | | |
4911 | 74.1k | zend_infer_ranges(op_array, ssa); |
4912 | | |
4913 | 74.1k | if (zend_infer_types(op_array, script, ssa, optimization_level) == FAILURE) { |
4914 | 0 | return FAILURE; |
4915 | 0 | } |
4916 | | |
4917 | 74.1k | return SUCCESS; |
4918 | 74.1k | } |
4919 | | /* }}} */ |
4920 | | |
4921 | | ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op, const zend_op_array *op_array, const zend_ssa *ssa, uint32_t t1, uint32_t t2) |
4922 | 47.8k | { |
4923 | 47.8k | if (opline->op1_type == IS_CV) { |
4924 | 16.1k | if (t1 & MAY_BE_UNDEF) { |
4925 | 8.67k | switch (opline->opcode) { |
4926 | 0 | case ZEND_UNSET_VAR: |
4927 | 0 | case ZEND_ISSET_ISEMPTY_VAR: |
4928 | 0 | return 1; |
4929 | 2 | case ZEND_ISSET_ISEMPTY_DIM_OBJ: |
4930 | 2 | case ZEND_ISSET_ISEMPTY_PROP_OBJ: |
4931 | 5.49k | case ZEND_ASSIGN: |
4932 | 5.66k | case ZEND_ASSIGN_DIM: |
4933 | 5.66k | case ZEND_ASSIGN_REF: |
4934 | 5.66k | case ZEND_BIND_GLOBAL: |
4935 | 5.71k | case ZEND_BIND_STATIC: |
4936 | 5.71k | case ZEND_BIND_INIT_STATIC_OR_JMP: |
4937 | 5.81k | case ZEND_FETCH_DIM_IS: |
4938 | 5.81k | case ZEND_FETCH_OBJ_IS: |
4939 | 5.81k | case ZEND_SEND_REF: |
4940 | 6.15k | case ZEND_UNSET_CV: |
4941 | 6.15k | case ZEND_ISSET_ISEMPTY_CV: |
4942 | 6.15k | case ZEND_MAKE_REF: |
4943 | 6.15k | case ZEND_FETCH_DIM_W: |
4944 | 6.15k | break; |
4945 | 2.51k | default: |
4946 | | /* undefined variable warning */ |
4947 | 2.51k | return 1; |
4948 | 8.67k | } |
4949 | 8.67k | } |
4950 | 31.7k | } else if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) { |
4951 | 26.0k | if ((t1 & MAY_BE_RC1) |
4952 | 26.0k | && (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) { |
4953 | 16.8k | switch (opline->opcode) { |
4954 | 10 | case ZEND_CASE: |
4955 | 10 | case ZEND_CASE_STRICT: |
4956 | 10 | case ZEND_FE_FETCH_R: |
4957 | 10 | case ZEND_FE_FETCH_RW: |
4958 | 10 | case ZEND_FETCH_LIST_R: |
4959 | 10 | case ZEND_QM_ASSIGN: |
4960 | 10 | case ZEND_SEND_VAL: |
4961 | 10 | case ZEND_SEND_VAL_EX: |
4962 | 10 | case ZEND_SEND_VAR: |
4963 | 10 | case ZEND_SEND_VAR_EX: |
4964 | 10 | case ZEND_SEND_FUNC_ARG: |
4965 | 10 | case ZEND_SEND_VAR_NO_REF: |
4966 | 10 | case ZEND_SEND_VAR_NO_REF_EX: |
4967 | 10 | case ZEND_SEND_REF: |
4968 | 10 | case ZEND_SEPARATE: |
4969 | 10 | case ZEND_END_SILENCE: |
4970 | 10 | case ZEND_MAKE_REF: |
4971 | 10 | break; |
4972 | 16.8k | default: |
4973 | | /* destructor may be called */ |
4974 | 16.8k | return 1; |
4975 | 16.8k | } |
4976 | 16.8k | } |
4977 | 26.0k | } |
4978 | | |
4979 | 28.4k | if (opline->op2_type == IS_CV) { |
4980 | 1.71k | if (t2 & MAY_BE_UNDEF) { |
4981 | 891 | switch (opline->opcode) { |
4982 | 0 | case ZEND_ASSIGN_REF: |
4983 | 0 | case ZEND_FE_FETCH_R: |
4984 | 0 | case ZEND_FE_FETCH_RW: |
4985 | 0 | break; |
4986 | 891 | default: |
4987 | | /* undefined variable warning */ |
4988 | 891 | return 1; |
4989 | 891 | } |
4990 | 891 | } |
4991 | 26.7k | } else if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) { |
4992 | 4.89k | if ((t2 & MAY_BE_RC1) |
4993 | 4.89k | && (t2 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) { |
4994 | 572 | switch (opline->opcode) { |
4995 | 214 | case ZEND_ASSIGN: |
4996 | 214 | case ZEND_FE_FETCH_R: |
4997 | 214 | case ZEND_FE_FETCH_RW: |
4998 | 214 | break; |
4999 | 358 | default: |
5000 | | /* destructor may be called */ |
5001 | 358 | return 1; |
5002 | 572 | } |
5003 | 572 | } |
5004 | 4.89k | } |
5005 | | |
5006 | 27.2k | switch (opline->opcode) { |
5007 | 2.59k | case ZEND_NOP: |
5008 | 4.13k | case ZEND_QM_ASSIGN: |
5009 | 4.13k | case ZEND_JMP: |
5010 | 4.18k | case ZEND_CHECK_VAR: |
5011 | 4.18k | case ZEND_MAKE_REF: |
5012 | 4.18k | case ZEND_BEGIN_SILENCE: |
5013 | 4.18k | case ZEND_END_SILENCE: |
5014 | 9.59k | case ZEND_FREE: |
5015 | 10.2k | case ZEND_FE_FREE: |
5016 | 10.2k | case ZEND_SEPARATE: |
5017 | 10.3k | case ZEND_TYPE_CHECK: |
5018 | 10.3k | case ZEND_DEFINED: |
5019 | 10.3k | case ZEND_ISSET_ISEMPTY_THIS: |
5020 | 10.3k | case ZEND_COALESCE: |
5021 | 10.3k | case ZEND_SWITCH_LONG: |
5022 | 10.3k | case ZEND_SWITCH_STRING: |
5023 | 10.3k | case ZEND_MATCH: |
5024 | 10.3k | case ZEND_ISSET_ISEMPTY_VAR: |
5025 | 10.3k | case ZEND_ISSET_ISEMPTY_CV: |
5026 | 10.3k | case ZEND_FUNC_NUM_ARGS: |
5027 | 10.3k | case ZEND_FUNC_GET_ARGS: |
5028 | 10.3k | case ZEND_COPY_TMP: |
5029 | 10.3k | case ZEND_JMP_NULL: |
5030 | 10.3k | case ZEND_JMP_FRAMELESS: |
5031 | 10.3k | return 0; |
5032 | 21 | case ZEND_IS_IDENTICAL: |
5033 | 41 | case ZEND_IS_NOT_IDENTICAL: |
5034 | 41 | case ZEND_CASE_STRICT: |
5035 | | /* Array to array comparison may lead to recursion. */ |
5036 | 41 | return (t1 & t2) & MAY_BE_ARRAY_OF_ARRAY; |
5037 | 0 | case ZEND_SEND_VAR: |
5038 | 0 | case ZEND_SEND_VAL: |
5039 | 0 | case ZEND_SEND_REF: |
5040 | 0 | case ZEND_SEND_VAR_EX: |
5041 | 0 | case ZEND_SEND_FUNC_ARG: |
5042 | 0 | case ZEND_CHECK_FUNC_ARG: |
5043 | | /* May throw for named params. */ |
5044 | 0 | return opline->op2_type == IS_CONST; |
5045 | 0 | case ZEND_INIT_FCALL: |
5046 | | /* can't throw, because call is resolved at compile time */ |
5047 | 0 | return 0; |
5048 | 0 | case ZEND_BIND_GLOBAL: |
5049 | 0 | if ((opline+1)->opcode == ZEND_BIND_GLOBAL) { |
5050 | 0 | return zend_may_throw(opline + 1, ssa_op ? ssa_op + 1 : NULL, op_array, ssa); |
5051 | 0 | } |
5052 | 0 | return 0; |
5053 | 995 | case ZEND_ADD: |
5054 | 995 | if ((t1 & MAY_BE_ANY) == MAY_BE_ARRAY |
5055 | 995 | && (t2 & MAY_BE_ANY) == MAY_BE_ARRAY) { |
5056 | 14 | return 0; |
5057 | 14 | } |
5058 | 981 | return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5059 | 981 | (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5060 | 30 | case ZEND_DIV: |
5061 | 30 | if (!OP2_HAS_RANGE() || |
5062 | 30 | (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) { |
5063 | | /* Division by zero */ |
5064 | 20 | return 1; |
5065 | 20 | } |
5066 | 10 | ZEND_FALLTHROUGH; |
5067 | 275 | case ZEND_SUB: |
5068 | 889 | case ZEND_MUL: |
5069 | 889 | case ZEND_POW: |
5070 | 889 | return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5071 | 889 | (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5072 | | /* Ops may throw if not an integer */ |
5073 | 398 | case ZEND_MOD: |
5074 | 398 | if (!OP2_HAS_RANGE() || |
5075 | 398 | (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) { |
5076 | | /* Division by zero */ |
5077 | 176 | return 1; |
5078 | 176 | } |
5079 | 222 | ZEND_FALLTHROUGH; |
5080 | 254 | case ZEND_SL: |
5081 | 313 | case ZEND_SR: |
5082 | 313 | return (t1 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5083 | 313 | (t2 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5084 | 313 | !OP2_HAS_RANGE() || |
5085 | 313 | OP2_MIN_RANGE() < 0; |
5086 | 755 | case ZEND_CONCAT: |
5087 | 792 | case ZEND_FAST_CONCAT: |
5088 | 792 | return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) || |
5089 | 792 | (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT)); |
5090 | 76 | case ZEND_BW_OR: |
5091 | 298 | case ZEND_BW_AND: |
5092 | 341 | case ZEND_BW_XOR: |
5093 | 341 | if ((t1 & MAY_BE_ANY) == MAY_BE_STRING |
5094 | 341 | && (t2 & MAY_BE_ANY) == MAY_BE_STRING) { |
5095 | 91 | return 0; |
5096 | 91 | } |
5097 | 250 | return (t1 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5098 | 250 | (t2 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5099 | 408 | case ZEND_BW_NOT: |
5100 | 408 | return (t1 & (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5101 | 1.34k | case ZEND_PRE_INC: |
5102 | 1.60k | case ZEND_POST_INC: |
5103 | 1.60k | return (t1 & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5104 | | /* null emits a warning as it has no effect compared to ++ which converts the value to 1 */ |
5105 | 67 | case ZEND_PRE_DEC: |
5106 | 147 | case ZEND_POST_DEC: |
5107 | 147 | return (t1 & (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5108 | 95 | case ZEND_BOOL_NOT: |
5109 | 95 | case ZEND_JMPZ: |
5110 | 95 | case ZEND_JMPNZ: |
5111 | 95 | case ZEND_JMPZ_EX: |
5112 | 95 | case ZEND_JMPNZ_EX: |
5113 | 295 | case ZEND_BOOL: |
5114 | 295 | case ZEND_JMP_SET: |
5115 | 295 | return (t1 & MAY_BE_OBJECT); |
5116 | 24 | case ZEND_BOOL_XOR: |
5117 | 24 | return (t1 & MAY_BE_OBJECT) || (t2 & MAY_BE_OBJECT); |
5118 | 89 | case ZEND_IS_EQUAL: |
5119 | 283 | case ZEND_IS_NOT_EQUAL: |
5120 | 414 | case ZEND_IS_SMALLER: |
5121 | 428 | case ZEND_IS_SMALLER_OR_EQUAL: |
5122 | 438 | case ZEND_CASE: |
5123 | 438 | case ZEND_SPACESHIP: |
5124 | 438 | if ((t1 & MAY_BE_ANY) == MAY_BE_NULL |
5125 | 438 | || (t2 & MAY_BE_ANY) == MAY_BE_NULL) { |
5126 | 61 | return 0; |
5127 | 61 | } |
5128 | 377 | return (t1 & (MAY_BE_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_OBJECT)) || (t2 & (MAY_BE_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_OBJECT)); |
5129 | 9 | case ZEND_ASSIGN_OP: |
5130 | 9 | if (opline->extended_value == ZEND_ADD) { |
5131 | 9 | if ((t1 & MAY_BE_ANY) == MAY_BE_ARRAY |
5132 | 9 | && (t2 & MAY_BE_ANY) == MAY_BE_ARRAY) { |
5133 | 0 | return 0; |
5134 | 0 | } |
5135 | 9 | return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5136 | 9 | (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5137 | 9 | } else if (opline->extended_value == ZEND_DIV || |
5138 | 0 | opline->extended_value == ZEND_MOD) { |
5139 | 0 | if (!OP2_HAS_RANGE() || |
5140 | 0 | (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) { |
5141 | | /* Division by zero */ |
5142 | 0 | return 1; |
5143 | 0 | } |
5144 | 0 | return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5145 | 0 | (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5146 | 0 | } else if (opline->extended_value == ZEND_SUB || |
5147 | 0 | opline->extended_value == ZEND_MUL || |
5148 | 0 | opline->extended_value == ZEND_POW) { |
5149 | 0 | return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5150 | 0 | (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5151 | 0 | } else if (opline->extended_value == ZEND_SL || |
5152 | 0 | opline->extended_value == ZEND_SR) { |
5153 | 0 | return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5154 | 0 | (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5155 | 0 | !OP2_HAS_RANGE() || |
5156 | 0 | OP2_MIN_RANGE() < 0; |
5157 | 0 | } else if (opline->extended_value == ZEND_CONCAT) { |
5158 | 0 | return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) || |
5159 | 0 | (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT)); |
5160 | 0 | } else if (opline->extended_value == ZEND_BW_OR || |
5161 | 0 | opline->extended_value == ZEND_BW_AND || |
5162 | 0 | opline->extended_value == ZEND_BW_XOR) { |
5163 | 0 | if ((t1 & MAY_BE_ANY) == MAY_BE_STRING |
5164 | 0 | && (t2 & MAY_BE_ANY) == MAY_BE_STRING) { |
5165 | 0 | return 0; |
5166 | 0 | } |
5167 | 0 | return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) || |
5168 | 0 | (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5169 | 0 | } |
5170 | 0 | return 1; |
5171 | 9.03k | case ZEND_ASSIGN: |
5172 | 9.03k | if (t1 & MAY_BE_REF) { |
5173 | 0 | return 1; |
5174 | 0 | } |
5175 | 9.03k | ZEND_FALLTHROUGH; |
5176 | 9.03k | case ZEND_UNSET_VAR: |
5177 | 9.03k | return (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY)); |
5178 | 46 | case ZEND_BIND_STATIC: |
5179 | 46 | case ZEND_BIND_INIT_STATIC_OR_JMP: |
5180 | 46 | if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY)) { |
5181 | | /* Destructor may throw. */ |
5182 | 2 | return 1; |
5183 | 2 | } |
5184 | 44 | return 0; |
5185 | 171 | case ZEND_ASSIGN_DIM: |
5186 | 171 | if ((opline+1)->op1_type == IS_CV) { |
5187 | 82 | if (OP1_DATA_INFO() & MAY_BE_UNDEF) { |
5188 | 78 | return 1; |
5189 | 78 | } |
5190 | 82 | } |
5191 | 93 | if (t1 & (MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_REF)) { |
5192 | 9 | return 1; |
5193 | 9 | } |
5194 | 84 | return (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_TRUE|MAY_BE_FALSE|MAY_BE_STRING|MAY_BE_LONG|MAY_BE_DOUBLE)) || opline->op2_type == IS_UNUSED || |
5195 | 84 | (t2 & (MAY_BE_UNDEF|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5196 | 88 | case ZEND_ASSIGN_OBJ: |
5197 | 88 | if (t1 & (MAY_BE_ANY-MAY_BE_OBJECT)) { |
5198 | 4 | return 1; |
5199 | 4 | } |
5200 | 84 | if ((opline+1)->op1_type == IS_CV) { |
5201 | 24 | if (OP1_DATA_INFO() & MAY_BE_UNDEF) { |
5202 | 18 | return 1; |
5203 | 18 | } |
5204 | 24 | } |
5205 | 66 | if (ssa_op->op1_use) { |
5206 | 66 | const zend_ssa_var_info *var_info = ssa->var_info + ssa_op->op1_use; |
5207 | 66 | const zend_class_entry *ce = var_info->ce; |
5208 | | |
5209 | 66 | if (var_info->is_instanceof |
5210 | 66 | || !ce |
5211 | 66 | || ce->create_object |
5212 | 66 | || ce->default_object_handlers->write_property != zend_std_write_property |
5213 | 66 | || ce->default_object_handlers->get_property_ptr_ptr != zend_std_get_property_ptr_ptr |
5214 | 66 | || ce->__get |
5215 | 66 | || ce->__set |
5216 | 66 | || ce->parent) { |
5217 | 24 | return 1; |
5218 | 24 | } |
5219 | | |
5220 | 42 | if (opline->op2_type != IS_CONST) { |
5221 | 0 | return 1; |
5222 | 0 | } |
5223 | | |
5224 | 42 | zend_string *prop_name = Z_STR_P(CRT_CONSTANT(opline->op2)); |
5225 | 42 | if (ZSTR_LEN(prop_name) > 0 && ZSTR_VAL(prop_name)[0] == '\0') { |
5226 | 0 | return 1; |
5227 | 0 | } |
5228 | | |
5229 | 42 | zend_property_info *prop_info = |
5230 | 42 | zend_hash_find_ptr(&ce->properties_info, prop_name); |
5231 | 42 | if (prop_info) { |
5232 | 10 | if (ZEND_TYPE_IS_SET(prop_info->type)) { |
5233 | 6 | return 1; |
5234 | 6 | } |
5235 | 4 | return !(prop_info->flags & ZEND_ACC_PUBLIC) |
5236 | 4 | && prop_info->ce != op_array->scope; |
5237 | 32 | } else { |
5238 | 32 | return !(ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES); |
5239 | 32 | } |
5240 | 42 | } |
5241 | 0 | return 1; |
5242 | 0 | case ZEND_ROPE_INIT: |
5243 | 0 | case ZEND_ROPE_ADD: |
5244 | 0 | case ZEND_ROPE_END: |
5245 | 0 | return t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT); |
5246 | 163 | case ZEND_INIT_ARRAY: |
5247 | 163 | return (opline->op2_type != IS_UNUSED) && (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5248 | 155 | case ZEND_ADD_ARRAY_ELEMENT: |
5249 | 155 | return (opline->op2_type == IS_UNUSED) || (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5250 | 0 | case ZEND_STRLEN: |
5251 | 0 | return (t1 & MAY_BE_ANY) != MAY_BE_STRING; |
5252 | 41 | case ZEND_COUNT: |
5253 | 41 | return (t1 & MAY_BE_ANY) != MAY_BE_ARRAY; |
5254 | 0 | case ZEND_RECV_INIT: |
5255 | 0 | if (Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_CONSTANT_AST) { |
5256 | 0 | return 1; |
5257 | 0 | } |
5258 | 0 | if (op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) { |
5259 | 0 | uint32_t arg_num = opline->op1.num; |
5260 | 0 | const zend_arg_info *cur_arg_info; |
5261 | |
|
5262 | 0 | if (EXPECTED(arg_num <= op_array->num_args)) { |
5263 | 0 | cur_arg_info = &op_array->arg_info[arg_num-1]; |
5264 | 0 | } else if (UNEXPECTED(op_array->fn_flags & ZEND_ACC_VARIADIC)) { |
5265 | 0 | cur_arg_info = &op_array->arg_info[op_array->num_args]; |
5266 | 0 | } else { |
5267 | 0 | return 0; |
5268 | 0 | } |
5269 | 0 | return ZEND_TYPE_IS_SET(cur_arg_info->type); |
5270 | 0 | } else { |
5271 | 0 | return 0; |
5272 | 0 | } |
5273 | 0 | case ZEND_FETCH_IS: |
5274 | 0 | return (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT)); |
5275 | 110 | case ZEND_ISSET_ISEMPTY_DIM_OBJ: |
5276 | 110 | return (t1 & MAY_BE_OBJECT) || (t2 & (MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT)); |
5277 | 93 | case ZEND_FETCH_DIM_IS: |
5278 | 93 | return (t1 & MAY_BE_OBJECT) || (t2 & (MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)); |
5279 | 34 | case ZEND_CAST: |
5280 | 34 | switch (opline->extended_value) { |
5281 | 8 | case IS_LONG: |
5282 | 8 | case IS_DOUBLE: |
5283 | 8 | return (t1 & MAY_BE_OBJECT); |
5284 | 26 | case IS_STRING: |
5285 | 26 | return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)); |
5286 | 0 | case IS_ARRAY: |
5287 | 0 | return (t1 & MAY_BE_OBJECT); |
5288 | 0 | case IS_OBJECT: |
5289 | 0 | return 0; |
5290 | 34 | EMPTY_SWITCH_DEFAULT_CASE() |
5291 | 34 | } |
5292 | | /* GCC is getting confused here for the Wimplicit-fallthrough warning with |
5293 | | * EMPTY_SWITCH_DEFAULT_CASE() macro */ |
5294 | 0 | return 0; |
5295 | 0 | case ZEND_ARRAY_KEY_EXISTS: |
5296 | 0 | if ((t2 & MAY_BE_ANY) != MAY_BE_ARRAY) { |
5297 | 0 | return 1; |
5298 | 0 | } |
5299 | 0 | if ((t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) { |
5300 | 0 | return 1; |
5301 | 0 | } |
5302 | 0 | return 0; |
5303 | 0 | case ZEND_FE_RESET_R: |
5304 | 0 | case ZEND_FE_RESET_RW: |
5305 | 0 | if ((t1 & (MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) { |
5306 | 0 | return 1; |
5307 | 0 | } |
5308 | 0 | return 0; |
5309 | 0 | case ZEND_FE_FETCH_R: |
5310 | 0 | if ((t1 & (MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) { |
5311 | 0 | return 1; |
5312 | 0 | } |
5313 | 0 | if (opline->op2_type == IS_CV |
5314 | 0 | && (t2 & MAY_BE_RC1) |
5315 | 0 | && (t2 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) { |
5316 | 0 | return 1; |
5317 | 0 | } |
5318 | 0 | return 0; |
5319 | 0 | case ZEND_FETCH_DIM_W: |
5320 | 0 | case ZEND_FETCH_LIST_W: |
5321 | 0 | if (t1 & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)) { |
5322 | 0 | return 1; |
5323 | 0 | } |
5324 | 0 | if (t2 & (MAY_BE_RESOURCE|MAY_BE_ARRAY|MAY_BE_OBJECT)) { |
5325 | 0 | return 1; |
5326 | 0 | } |
5327 | 0 | if (opline->op2_type == IS_UNUSED) { |
5328 | 0 | return 1; |
5329 | 0 | } |
5330 | 0 | return 0; |
5331 | 415 | default: |
5332 | 415 | return 1; |
5333 | 27.2k | } |
5334 | 27.2k | } |
5335 | | |
5336 | | ZEND_API bool zend_may_throw(const zend_op *opline, const zend_ssa_op *ssa_op, const zend_op_array *op_array, const zend_ssa *ssa) |
5337 | 47.8k | { |
5338 | 47.8k | return zend_may_throw_ex(opline, ssa_op, op_array, ssa, OP1_INFO(), OP2_INFO()); |
5339 | 47.8k | } |