Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/Optimizer/zend_ssa.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine, SSA - Static Single Assignment Form                     |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Dmitry Stogov <dmitry@php.net>                              |
16
   |          Nikita Popov <nikic@php.net>                                |
17
   +----------------------------------------------------------------------+
18
*/
19
20
#include "zend_compile.h"
21
#include "zend_dfg.h"
22
#include "zend_ssa.h"
23
#include "zend_dump.h"
24
#include "zend_inference.h"
25
#include "Optimizer/zend_optimizer_internal.h"
26
27
1.47k
static bool dominates(const zend_basic_block *blocks, int a, int b) {
28
1.85k
  while (blocks[b].level > blocks[a].level) {
29
380
    b = blocks[b].idom;
30
380
  }
31
1.47k
  return a == b;
32
1.47k
}
33
34
static bool will_rejoin(
35
    const zend_cfg *cfg, const zend_dfg *dfg, const zend_basic_block *block,
36
1.63k
    int other_successor, int exclude, int var) {
37
1.63k
  int i;
38
5.34k
  for (i = 0; i < block->predecessors_count; i++) {
39
4.26k
    int predecessor = cfg->predecessors[block->predecessor_offset + i];
40
4.26k
    if (predecessor == exclude) {
41
1.60k
      continue;
42
1.60k
    }
43
44
    /* The variable is changed in this predecessor,
45
     * so we will not rejoin with the original value. */
46
    // TODO: This should not be limited to the direct predecessor block.
47
2.65k
    if (DFG_ISSET(dfg->def, dfg->size, predecessor, var)) {
48
1.18k
      continue;
49
1.18k
    }
50
51
    /* The other successor dominates this predecessor,
52
     * so we will get the original value from it. */
53
1.47k
    if (dominates(cfg->blocks, other_successor, predecessor)) {
54
548
      return 1;
55
548
    }
56
1.47k
  }
57
1.08k
  return 0;
58
1.63k
}
59
60
static bool needs_pi(const zend_op_array *op_array, const zend_dfg *dfg, const zend_ssa *ssa, int from, int to, int var) /* {{{ */
61
58.9k
{
62
58.9k
  const zend_basic_block *from_block, *to_block;
63
58.9k
  int other_successor;
64
65
58.9k
  if (!DFG_ISSET(dfg->in, dfg->size, to, var)) {
66
    /* Variable is not live, certainly won't benefit from pi */
67
3.56k
    return 0;
68
3.56k
  }
69
70
  /* Make sure that both successors of the from block aren't the same. Pi nodes are associated
71
   * with predecessor blocks, so we can't distinguish which edge the pi belongs to. */
72
55.3k
  from_block = &ssa->cfg.blocks[from];
73
55.3k
  ZEND_ASSERT(from_block->successors_count == 2);
74
55.3k
  if (from_block->successors[0] == from_block->successors[1]) {
75
0
    return 0;
76
0
  }
77
78
55.3k
  to_block = &ssa->cfg.blocks[to];
79
55.3k
  if (to_block->predecessors_count == 1) {
80
    /* Always place pi if one predecessor (an if branch) */
81
53.7k
    return 1;
82
53.7k
  }
83
84
  /* Check whether we will rejoin with the original value coming from the other successor,
85
   * in which case the pi node will not have an effect. */
86
1.63k
  other_successor = from_block->successors[0] == to
87
1.63k
    ? from_block->successors[1] : from_block->successors[0];
88
1.63k
  return !will_rejoin(&ssa->cfg, dfg, to_block, other_successor, from, var);
89
55.3k
}
90
/* }}} */
91
92
static zend_ssa_phi *add_pi(
93
    zend_arena **arena, const zend_op_array *op_array, zend_dfg *dfg, zend_ssa *ssa,
94
    int from, int to, int var) /* {{{ */
95
58.9k
{
96
58.9k
  zend_ssa_phi *phi;
97
58.9k
  if (!needs_pi(op_array, dfg, ssa, from, to, var)) {
98
4.11k
    return NULL;
99
4.11k
  }
100
101
54.7k
  phi = zend_arena_calloc(arena, 1,
102
54.7k
    ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)) +
103
54.7k
    ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->cfg.blocks[to].predecessors_count) +
104
54.7k
    sizeof(void*) * ssa->cfg.blocks[to].predecessors_count);
105
54.7k
  phi->sources = (int*)(((char*)phi) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)));
106
54.7k
  memset(phi->sources, 0xff, sizeof(int) * ssa->cfg.blocks[to].predecessors_count);
107
54.7k
  phi->use_chains = (zend_ssa_phi**)(((char*)phi->sources) + ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->cfg.blocks[to].predecessors_count));
108
109
54.7k
  phi->pi = from;
110
54.7k
  phi->var = var;
111
54.7k
  phi->ssa_var = -1;
112
54.7k
  phi->next = ssa->blocks[to].phis;
113
54.7k
  ssa->blocks[to].phis = phi;
114
115
  /* Block "to" now defines "var" via the pi statement, so add it to the "def" set. Note that
116
   * this is not entirely accurate, because the pi is actually placed along the edge from->to.
117
   * If there is a back-edge to "to" this may result in non-minimal SSA form. */
118
54.7k
  DFG_SET(dfg->def, dfg->size, to, var);
119
120
  /* If there are multiple predecessors in the target block, we need to place a phi there.
121
   * However this can (generally) not be expressed in terms of dominance frontiers, so place it
122
   * explicitly. dfg->use here really is dfg->phi, we're reusing the set. */
123
54.7k
  if (ssa->cfg.blocks[to].predecessors_count > 1) {
124
1.08k
    DFG_SET(dfg->use, dfg->size, to, var);
125
1.08k
  }
126
127
54.7k
  return phi;
128
58.9k
}
129
/* }}} */
130
131
static void pi_range(
132
    zend_ssa_phi *phi, int min_var, int max_var, zend_long min, zend_long max,
133
    char underflow, char overflow, char negative) /* {{{ */
134
8.91k
{
135
8.91k
  zend_ssa_range_constraint *constraint = &phi->constraint.range;
136
8.91k
  constraint->min_var = min_var;
137
8.91k
  constraint->max_var = max_var;
138
8.91k
  constraint->min_ssa_var = -1;
139
8.91k
  constraint->max_ssa_var = -1;
140
8.91k
  constraint->range.min = min;
141
8.91k
  constraint->range.max = max;
142
8.91k
  constraint->range.underflow = underflow;
143
8.91k
  constraint->range.overflow = overflow;
144
8.91k
  constraint->negative = negative ? NEG_INIT : NEG_NONE;
145
8.91k
  phi->has_range_constraint = true;
146
8.91k
}
147
/* }}} */
148
149
1.00k
static inline void pi_range_equals(zend_ssa_phi *phi, int var, zend_long val) {
150
1.00k
  pi_range(phi, var, var, val, val, 0, 0, 0);
151
1.00k
}
152
1.40k
static inline void pi_range_not_equals(zend_ssa_phi *phi, int var, zend_long val) {
153
1.40k
  pi_range(phi, var, var, val, val, 0, 0, 1);
154
1.40k
}
155
2.17k
static inline void pi_range_min(zend_ssa_phi *phi, int var, zend_long val) {
156
2.17k
  pi_range(phi, var, -1, val, ZEND_LONG_MAX, 0, 1, 0);
157
2.17k
}
158
4.32k
static inline void pi_range_max(zend_ssa_phi *phi, int var, zend_long val) {
159
4.32k
  pi_range(phi, -1, var, ZEND_LONG_MIN, val, 1, 0, 0);
160
4.32k
}
161
162
45.8k
static void pi_type_mask(zend_ssa_phi *phi, uint32_t type_mask) {
163
45.8k
  phi->has_range_constraint = false;
164
45.8k
  phi->constraint.type.ce = NULL;
165
45.8k
  phi->constraint.type.type_mask = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN;
166
45.8k
  phi->constraint.type.type_mask |= type_mask;
167
45.8k
  if (type_mask & MAY_BE_NULL) {
168
198
    phi->constraint.type.type_mask |= MAY_BE_UNDEF;
169
198
  }
170
45.8k
}
171
45.6k
static inline void pi_not_type_mask(zend_ssa_phi *phi, uint32_t type_mask) {
172
45.6k
  uint32_t relevant = MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
173
45.6k
  pi_type_mask(phi, ~type_mask & relevant);
174
45.6k
}
175
469
static inline uint32_t mask_for_type_check(uint32_t type) {
176
469
  if (type & MAY_BE_ARRAY) {
177
239
    return type | (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
178
239
  } else {
179
230
    return type;
180
230
  }
181
469
}
182
183
/* We can interpret $a + 5 == 0 as $a = 0 - 5, i.e. shift the adjustment to the other operand.
184
 * This negated adjustment is what is written into the "adjustment" parameter. */
185
static int find_adjusted_tmp_var(const zend_op_array *op_array, uint32_t build_flags, zend_op *opline, uint32_t var_num, zend_long *adjustment) /* {{{ */
186
939
{
187
939
  zend_op *op = opline;
188
939
  zval *zv;
189
190
2.09k
  while (op != op_array->opcodes) {
191
2.09k
    op--;
192
2.09k
    if (op->result_type != IS_TMP_VAR || op->result.var != var_num) {
193
1.15k
      continue;
194
1.15k
    }
195
196
939
    if (op->opcode == ZEND_POST_DEC) {
197
0
      if (op->op1_type == IS_CV) {
198
0
        *adjustment = -1;
199
0
        return EX_VAR_TO_NUM(op->op1.var);
200
0
      }
201
939
    } else if (op->opcode == ZEND_POST_INC) {
202
28
      if (op->op1_type == IS_CV) {
203
28
        *adjustment = 1;
204
28
        return EX_VAR_TO_NUM(op->op1.var);
205
28
      }
206
911
    } else if (op->opcode == ZEND_ADD) {
207
41
      if (op->op1_type == IS_CV && op->op2_type == IS_CONST) {
208
37
        zv = CRT_CONSTANT_EX(op_array, op, op->op2);
209
37
        if (Z_TYPE_P(zv) == IS_LONG
210
37
         && Z_LVAL_P(zv) != ZEND_LONG_MIN) {
211
35
          *adjustment = -Z_LVAL_P(zv);
212
35
          return EX_VAR_TO_NUM(op->op1.var);
213
35
        }
214
37
      } else if (op->op2_type == IS_CV && op->op1_type == IS_CONST) {
215
0
        zv = CRT_CONSTANT_EX(op_array, op, op->op1);
216
0
        if (Z_TYPE_P(zv) == IS_LONG
217
0
         && Z_LVAL_P(zv) != ZEND_LONG_MIN) {
218
0
          *adjustment = -Z_LVAL_P(zv);
219
0
          return EX_VAR_TO_NUM(op->op2.var);
220
0
        }
221
0
      }
222
870
    } else if (op->opcode == ZEND_SUB) {
223
56
      if (op->op1_type == IS_CV && op->op2_type == IS_CONST) {
224
34
        zv = CRT_CONSTANT_EX(op_array, op, op->op2);
225
34
        if (Z_TYPE_P(zv) == IS_LONG) {
226
34
          *adjustment = Z_LVAL_P(zv);
227
34
          return EX_VAR_TO_NUM(op->op1.var);
228
34
        }
229
34
      }
230
56
    }
231
842
    break;
232
939
  }
233
842
  return -1;
234
939
}
235
/* }}} */
236
237
/* e-SSA construction: Pi placement (Pi is actually a Phi with single
238
 * source and constraint).
239
 * Order of Phis is important, Pis must be placed before Phis
240
 */
241
static void place_essa_pis(
242
    zend_arena **arena, const zend_script *script, const zend_op_array *op_array,
243
74.1k
    uint32_t build_flags, zend_ssa *ssa, zend_dfg *dfg) /* {{{ */ {
244
74.1k
  zend_basic_block *blocks = ssa->cfg.blocks;
245
74.1k
  int j, blocks_count = ssa->cfg.blocks_count;
246
290k
  for (j = 0; j < blocks_count; j++) {
247
216k
    zend_ssa_phi *pi;
248
216k
    zend_op *opline = op_array->opcodes + blocks[j].start + blocks[j].len - 1;
249
216k
    int bt; /* successor block number if a condition is true */
250
216k
    int bf; /* successor block number if a condition is false */
251
252
216k
    if ((blocks[j].flags & ZEND_BB_REACHABLE) == 0 || blocks[j].len == 0) {
253
171
      continue;
254
171
    }
255
    /* the last instruction of basic block is conditional branch,
256
     * based on comparison of CV(s)
257
     */
258
216k
    switch (opline->opcode) {
259
5.48k
      case ZEND_JMPZ:
260
5.48k
        bf = blocks[j].successors[0];
261
5.48k
        bt = blocks[j].successors[1];
262
5.48k
        break;
263
7.50k
      case ZEND_JMPNZ:
264
7.50k
        bt = blocks[j].successors[0];
265
7.50k
        bf = blocks[j].successors[1];
266
7.50k
        break;
267
1.25k
      case ZEND_COALESCE:
268
1.25k
        if (opline->op1_type == IS_CV) {
269
134
          int var = EX_VAR_TO_NUM(opline->op1.var);
270
134
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, blocks[j].successors[0], var))) {
271
82
            pi_not_type_mask(pi, MAY_BE_NULL);
272
82
          }
273
134
        }
274
1.25k
        continue;
275
45.5k
      case ZEND_JMP_NULL:
276
45.5k
        if (opline->op1_type == IS_CV) {
277
45.3k
          int var = EX_VAR_TO_NUM(opline->op1.var);
278
45.3k
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, blocks[j].successors[1], var))) {
279
45.3k
            pi_not_type_mask(pi, MAY_BE_NULL);
280
45.3k
          }
281
45.3k
        }
282
45.5k
        continue;
283
156k
      default:
284
156k
        continue;
285
216k
    }
286
287
    /* The following patterns all inspect the opline directly before the JMPZ opcode.
288
     * Make sure that it is part of the same block, otherwise it might not be a dominating
289
     * assignment. */
290
12.9k
    if (blocks[j].len == 1) {
291
371
      continue;
292
371
    }
293
294
12.6k
    if (opline->op1_type == IS_TMP_VAR &&
295
12.6k
        ((opline-1)->opcode == ZEND_IS_EQUAL ||
296
11.2k
         (opline-1)->opcode == ZEND_IS_NOT_EQUAL ||
297
11.2k
         (opline-1)->opcode == ZEND_IS_SMALLER ||
298
11.2k
         (opline-1)->opcode == ZEND_IS_SMALLER_OR_EQUAL) &&
299
12.6k
        opline->op1.var == (opline-1)->result.var) {
300
6.69k
      int  var1 = -1;
301
6.69k
      int  var2 = -1;
302
6.69k
      zend_long val1 = 0;
303
6.69k
      zend_long val2 = 0;
304
//      long val = 0;
305
306
6.69k
      if ((opline-1)->op1_type == IS_CV) {
307
5.79k
        var1 = EX_VAR_TO_NUM((opline-1)->op1.var);
308
5.79k
      } else if ((opline-1)->op1_type == IS_TMP_VAR) {
309
419
        var1 = find_adjusted_tmp_var(
310
419
          op_array, build_flags, opline, (opline-1)->op1.var, &val2);
311
419
      }
312
313
6.69k
      if ((opline-1)->op2_type == IS_CV) {
314
1.51k
        var2 = EX_VAR_TO_NUM((opline-1)->op2.var);
315
5.18k
      } else if ((opline-1)->op2_type == IS_TMP_VAR) {
316
520
        var2 = find_adjusted_tmp_var(
317
520
          op_array, build_flags, opline, (opline-1)->op2.var, &val1);
318
520
      }
319
320
6.69k
      if (var1 >= 0 && var2 >= 0) {
321
1.11k
        if (!zend_sub_will_overflow(val1, val2) && !zend_sub_will_overflow(val2, val1)) {
322
1.11k
          zend_long tmp = val1;
323
1.11k
          val1 -= val2;
324
1.11k
          val2 -= tmp;
325
1.11k
        } else {
326
0
          var1 = -1;
327
0
          var2 = -1;
328
0
        }
329
5.58k
      } else if (var1 >= 0 && var2 < 0) {
330
4.74k
        zend_long add_val2 = 0;
331
4.74k
        if ((opline-1)->op2_type == IS_CONST) {
332
4.49k
          zval *zv = CRT_CONSTANT_EX(op_array, (opline-1), (opline-1)->op2);
333
334
4.49k
          if (Z_TYPE_P(zv) == IS_LONG) {
335
3.74k
            add_val2 = Z_LVAL_P(zv);
336
3.74k
          } else {
337
748
            var1 = -1;
338
748
          }
339
4.49k
        } else {
340
250
          var1 = -1;
341
250
        }
342
4.74k
        if (!zend_add_will_overflow(val2, add_val2)) {
343
4.74k
          val2 += add_val2;
344
4.74k
        } else {
345
0
          var1 = -1;
346
0
        }
347
4.74k
      } else if (var1 < 0 && var2 >= 0) {
348
435
        zend_long add_val1 = 0;
349
435
        if ((opline-1)->op1_type == IS_CONST) {
350
407
          zval *zv = CRT_CONSTANT_EX(op_array, (opline-1), (opline-1)->op1);
351
407
          if (Z_TYPE_P(zv) == IS_LONG) {
352
384
            add_val1 = Z_LVAL_P(CRT_CONSTANT_EX(op_array, (opline-1), (opline-1)->op1));
353
384
          } else {
354
23
            var2 = -1;
355
23
          }
356
407
        } else {
357
28
          var2 = -1;
358
28
        }
359
435
        if (!zend_add_will_overflow(val1, add_val1)) {
360
435
          val1 += add_val1;
361
435
        } else {
362
0
          var2 = -1;
363
0
        }
364
435
      }
365
366
6.69k
      if (var1 >= 0) {
367
4.85k
        if ((opline-1)->opcode == ZEND_IS_EQUAL) {
368
865
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
369
559
            pi_range_equals(pi, var2, val2);
370
559
          }
371
865
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
372
802
            pi_range_not_equals(pi, var2, val2);
373
802
          }
374
3.98k
        } else if ((opline-1)->opcode == ZEND_IS_NOT_EQUAL) {
375
245
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
376
194
            pi_range_equals(pi, var2, val2);
377
194
          }
378
245
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
379
239
            pi_range_not_equals(pi, var2, val2);
380
239
          }
381
3.74k
        } else if ((opline-1)->opcode == ZEND_IS_SMALLER) {
382
2.68k
          if (val2 > ZEND_LONG_MIN) {
383
2.68k
            if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
384
2.49k
              pi_range_max(pi, var2, val2-1);
385
2.49k
            }
386
2.68k
          }
387
2.68k
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
388
572
            pi_range_min(pi, var2, val2);
389
572
          }
390
2.68k
        } else if ((opline-1)->opcode == ZEND_IS_SMALLER_OR_EQUAL) {
391
1.05k
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
392
983
            pi_range_max(pi, var2, val2);
393
983
          }
394
1.05k
          if (val2 < ZEND_LONG_MAX) {
395
1.05k
            if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
396
766
              pi_range_min(pi, var2, val2+1);
397
766
            }
398
1.05k
          }
399
1.05k
        }
400
4.85k
      }
401
6.69k
      if (var2 >= 0) {
402
1.49k
        if((opline-1)->opcode == ZEND_IS_EQUAL) {
403
94
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
404
56
            pi_range_equals(pi, var1, val1);
405
56
          }
406
94
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
407
94
            pi_range_not_equals(pi, var1, val1);
408
94
          }
409
1.40k
        } else if ((opline-1)->opcode == ZEND_IS_NOT_EQUAL) {
410
241
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
411
196
            pi_range_equals(pi, var1, val1);
412
196
          }
413
241
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
414
239
            pi_range_not_equals(pi, var1, val1);
415
239
          }
416
1.16k
        } else if ((opline-1)->opcode == ZEND_IS_SMALLER) {
417
657
          if (val1 < ZEND_LONG_MAX) {
418
657
            if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
419
468
              pi_range_min(pi, var1, val1+1);
420
468
            }
421
657
          }
422
657
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
423
498
            pi_range_max(pi, var1, val1);
424
498
          }
425
657
        } else if ((opline-1)->opcode == ZEND_IS_SMALLER_OR_EQUAL) {
426
504
          if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
427
372
            pi_range_min(pi, var1, val1);
428
372
          }
429
504
          if (val1 > ZEND_LONG_MIN) {
430
504
            if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
431
345
              pi_range_max(pi, var1, val1-1);
432
345
            }
433
504
          }
434
504
        }
435
1.49k
      }
436
6.69k
    } else if (opline->op1_type == IS_TMP_VAR &&
437
5.92k
               ((opline-1)->opcode == ZEND_POST_INC ||
438
4.50k
                (opline-1)->opcode == ZEND_POST_DEC) &&
439
5.92k
               opline->op1.var == (opline-1)->result.var &&
440
5.92k
               (opline-1)->op1_type == IS_CV) {
441
25
      int var = EX_VAR_TO_NUM((opline-1)->op1.var);
442
443
25
      if ((opline-1)->opcode == ZEND_POST_DEC) {
444
17
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
445
0
          pi_range_equals(pi, -1, -1);
446
0
        }
447
17
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
448
17
          pi_range_not_equals(pi, -1, -1);
449
17
        }
450
17
      } else if ((opline-1)->opcode == ZEND_POST_INC) {
451
8
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
452
0
          pi_range_equals(pi, -1, 1);
453
0
        }
454
8
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
455
8
          pi_range_not_equals(pi, -1, 1);
456
8
        }
457
8
      }
458
5.89k
    } else if (opline->op1_type == IS_TMP_VAR &&
459
5.89k
               ((opline-1)->opcode == ZEND_PRE_INC ||
460
4.48k
                (opline-1)->opcode == ZEND_PRE_DEC) &&
461
5.89k
               opline->op1.var == (opline-1)->result.var &&
462
5.89k
               (opline-1)->op1_type == IS_CV) {
463
3
      int var = EX_VAR_TO_NUM((opline-1)->op1.var);
464
465
3
      if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
466
3
        pi_range_equals(pi, -1, 0);
467
3
      }
468
      /* speculative */
469
3
      if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
470
3
        pi_range_not_equals(pi, -1, 0);
471
3
      }
472
5.89k
    } else if (opline->op1_type == IS_TMP_VAR && (opline-1)->opcode == ZEND_TYPE_CHECK &&
473
5.89k
           opline->op1.var == (opline-1)->result.var && (opline-1)->op1_type == IS_CV) {
474
338
      int var = EX_VAR_TO_NUM((opline-1)->op1.var);
475
338
      uint32_t type = (opline-1)->extended_value;
476
338
      if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
477
244
        pi_type_mask(pi, mask_for_type_check(type));
478
244
      }
479
338
      if (type != MAY_BE_RESOURCE) {
480
        /* is_resource() may return false for closed resources */
481
334
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
482
225
          pi_not_type_mask(pi, mask_for_type_check(type));
483
225
        }
484
334
      }
485
5.55k
    } else if (opline->op1_type == IS_TMP_VAR &&
486
5.55k
           ((opline-1)->opcode == ZEND_IS_IDENTICAL
487
4.14k
          || (opline-1)->opcode == ZEND_IS_NOT_IDENTICAL) &&
488
5.55k
           opline->op1.var == (opline-1)->result.var) {
489
897
      int var;
490
897
      zval *val;
491
897
      uint32_t type_mask;
492
897
      if ((opline-1)->op1_type == IS_CV && (opline-1)->op2_type == IS_CONST) {
493
463
        var = EX_VAR_TO_NUM((opline-1)->op1.var);
494
463
        val = CRT_CONSTANT_EX(op_array, (opline-1), (opline-1)->op2);
495
463
      } else if ((opline-1)->op1_type == IS_CONST && (opline-1)->op2_type == IS_CV) {
496
0
        var = EX_VAR_TO_NUM((opline-1)->op2.var);
497
0
        val = CRT_CONSTANT_EX(op_array, (opline-1), (opline-1)->op1);
498
434
      } else {
499
434
        continue;
500
434
      }
501
502
      /* We're interested in === null/true/false comparisons here, because they eliminate
503
       * a type in the false-branch. Other === VAL comparisons are unlikely to be useful. */
504
463
      if (Z_TYPE_P(val) != IS_NULL && Z_TYPE_P(val) != IS_TRUE && Z_TYPE_P(val) != IS_FALSE) {
505
463
        continue;
506
463
      }
507
508
0
      type_mask = _const_op_type(val);
509
0
      if ((opline-1)->opcode == ZEND_IS_IDENTICAL) {
510
0
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
511
0
          pi_type_mask(pi, type_mask);
512
0
        }
513
0
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
514
0
          pi_not_type_mask(pi, type_mask);
515
0
        }
516
0
      } else {
517
0
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
518
0
          pi_type_mask(pi, type_mask);
519
0
        }
520
0
        if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
521
0
          pi_not_type_mask(pi, type_mask);
522
0
        }
523
0
      }
524
4.65k
    } else if (opline->op1_type == IS_TMP_VAR && (opline-1)->opcode == ZEND_INSTANCEOF &&
525
4.65k
           opline->op1.var == (opline-1)->result.var && (opline-1)->op1_type == IS_CV &&
526
4.65k
           (opline-1)->op2_type == IS_CONST) {
527
41
      int var = EX_VAR_TO_NUM((opline-1)->op1.var);
528
41
      zend_string *lcname = Z_STR_P(CRT_CONSTANT_EX(op_array, (opline-1), (opline-1)->op2) + 1);
529
41
      zend_class_entry *ce = zend_optimizer_get_class_entry(script, op_array, lcname);
530
41
      if (!ce) {
531
2
        continue;
532
2
      }
533
534
39
      if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
535
25
        pi_type_mask(pi, MAY_BE_OBJECT);
536
25
        pi->constraint.type.ce = ce;
537
25
      }
538
39
    }
539
12.6k
  }
540
74.1k
}
541
/* }}} */
542
543
static zend_always_inline int _zend_ssa_rename_op(const zend_op_array *op_array, const zend_op *opline, uint32_t k, uint32_t build_flags, int ssa_vars_count, zend_ssa_op *ssa_ops, int *var) /* {{{ */
544
1.33M
{
545
1.33M
  const zend_op *next;
546
547
1.33M
  if (opline->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
548
799k
    ssa_ops[k].op1_use = var[EX_VAR_TO_NUM(opline->op1.var)];
549
    //USE_SSA_VAR(op_array->last_var + opline->op1.var)
550
799k
  }
551
1.33M
  if (opline->op2_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
552
274k
    ssa_ops[k].op2_use = var[EX_VAR_TO_NUM(opline->op2.var)];
553
    //USE_SSA_VAR(op_array->last_var + opline->op2.var)
554
274k
  }
555
1.33M
  if ((build_flags & ZEND_SSA_USE_CV_RESULTS)
556
1.33M
   && opline->result_type == IS_CV
557
1.33M
   && opline->opcode != ZEND_RECV) {
558
0
    ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
559
    //USE_SSA_VAR(op_array->last_var + opline->result.var)
560
0
  }
561
562
1.33M
  switch (opline->opcode) {
563
57.6k
    case ZEND_ASSIGN:
564
57.6k
      if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op2_type == IS_CV) {
565
0
        ssa_ops[k].op2_def = ssa_vars_count;
566
0
        var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
567
0
        ssa_vars_count++;
568
        //NEW_SSA_VAR(opline->op2.var)
569
0
      }
570
57.6k
      if (opline->op1_type == IS_CV) {
571
93.5k
add_op1_def:
572
93.5k
        ssa_ops[k].op1_def = ssa_vars_count;
573
93.5k
        var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
574
93.5k
        ssa_vars_count++;
575
        //NEW_SSA_VAR(opline->op1.var)
576
93.5k
      }
577
94.0k
      break;
578
94.0k
    case ZEND_ASSIGN_REF:
579
2.01k
      if (opline->op2_type == IS_CV) {
580
957
        ssa_ops[k].op2_def = ssa_vars_count;
581
957
        var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
582
957
        ssa_vars_count++;
583
        //NEW_SSA_VAR(opline->op2.var)
584
957
      }
585
2.01k
      if (opline->op1_type == IS_CV) {
586
1.53k
        goto add_op1_def;
587
1.53k
      }
588
476
      break;
589
6.76k
    case ZEND_ASSIGN_DIM:
590
14.3k
    case ZEND_ASSIGN_OBJ:
591
14.3k
      next = opline + 1;
592
14.3k
      if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
593
8.03k
        ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
594
        //USE_SSA_VAR(op_array->last_var + next->op1.var);
595
8.03k
        if (build_flags & ZEND_SSA_RC_INFERENCE && next->op1_type == IS_CV) {
596
0
          ssa_ops[k + 1].op1_def = ssa_vars_count;
597
0
          var[EX_VAR_TO_NUM(next->op1.var)] = ssa_vars_count;
598
0
          ssa_vars_count++;
599
          //NEW_SSA_VAR(next->op1.var)
600
0
        }
601
8.03k
      }
602
14.3k
      if (opline->op1_type == IS_CV) {
603
8.97k
        ssa_ops[k].op1_def = ssa_vars_count;
604
8.97k
        var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
605
8.97k
        ssa_vars_count++;
606
        //NEW_SSA_VAR(opline->op1.var)
607
8.97k
      }
608
14.3k
      break;
609
303
    case ZEND_ASSIGN_OBJ_REF:
610
303
      if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op1_type == IS_CV) {
611
0
        ssa_ops[k].op1_def = ssa_vars_count;
612
0
        var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
613
0
        ssa_vars_count++;
614
        //NEW_SSA_VAR(opline->op1.var)
615
0
      }
616
303
      next = opline + 1;
617
303
      if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
618
303
        ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
619
        //USE_SSA_VAR(op_array->last_var + next->op1.var);
620
303
        if (next->op1_type == IS_CV) {
621
215
          ssa_ops[k + 1].op1_def = ssa_vars_count;
622
215
          var[EX_VAR_TO_NUM(next->op1.var)] = ssa_vars_count;
623
215
          ssa_vars_count++;
624
          //NEW_SSA_VAR(next->op1.var)
625
215
        }
626
303
      }
627
303
      break;
628
1.01k
    case ZEND_ASSIGN_STATIC_PROP:
629
1.01k
      next = opline + 1;
630
1.01k
      if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
631
663
        ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
632
        //USE_SSA_VAR(op_array->last_var + next->op1.var);
633
663
        if ((build_flags & ZEND_SSA_RC_INFERENCE) && next->op1_type == IS_CV) {
634
0
          ssa_ops[k + 1].op1_def = ssa_vars_count;
635
0
          var[EX_VAR_TO_NUM(next->op1.var)] = ssa_vars_count;
636
0
          ssa_vars_count++;
637
          //NEW_SSA_VAR(next->op1.var)
638
0
        }
639
663
      }
640
1.01k
      break;
641
110
    case ZEND_ASSIGN_STATIC_PROP_REF:
642
110
      next = opline + 1;
643
110
      if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
644
110
        ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
645
        //USE_SSA_VAR(op_array->last_var + next->op1.var);
646
110
        if (next->op1_type == IS_CV) {
647
34
          ssa_ops[k + 1].op1_def = ssa_vars_count;
648
34
          var[EX_VAR_TO_NUM(next->op1.var)] = ssa_vars_count;
649
34
          ssa_vars_count++;
650
          //NEW_SSA_VAR(next->op1.var)
651
34
        }
652
110
      }
653
110
      break;
654
12
    case ZEND_ASSIGN_STATIC_PROP_OP:
655
12
      next = opline + 1;
656
12
      if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
657
12
        ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
658
        //USE_SSA_VAR(op_array->last_var + next->op1.var);
659
12
      }
660
12
      break;
661
1.19k
    case ZEND_ASSIGN_DIM_OP:
662
1.71k
    case ZEND_ASSIGN_OBJ_OP:
663
1.71k
      if (opline->op1_type == IS_CV) {
664
1.22k
        ssa_ops[k].op1_def = ssa_vars_count;
665
1.22k
        var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
666
1.22k
        ssa_vars_count++;
667
        //NEW_SSA_VAR(opline->op1.var)
668
1.22k
      }
669
1.71k
      next = opline + 1;
670
1.71k
      if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
671
814
        ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
672
        //USE_SSA_VAR(op_array->last_var + next->op1.var);
673
814
      }
674
1.71k
      break;
675
4.66k
    case ZEND_ASSIGN_OP:
676
8.77k
    case ZEND_PRE_INC:
677
9.27k
    case ZEND_PRE_DEC:
678
10.0k
    case ZEND_POST_INC:
679
11.2k
    case ZEND_POST_DEC:
680
11.9k
    case ZEND_BIND_GLOBAL:
681
17.8k
    case ZEND_BIND_STATIC:
682
17.9k
    case ZEND_BIND_INIT_STATIC_OR_JMP:
683
18.4k
    case ZEND_SEND_VAR_NO_REF:
684
21.4k
    case ZEND_SEND_VAR_NO_REF_EX:
685
27.6k
    case ZEND_SEND_VAR_EX:
686
28.7k
    case ZEND_SEND_FUNC_ARG:
687
30.9k
    case ZEND_SEND_REF:
688
31.6k
    case ZEND_SEND_UNPACK:
689
32.2k
    case ZEND_FE_RESET_RW:
690
33.1k
    case ZEND_MAKE_REF:
691
33.5k
    case ZEND_PRE_INC_OBJ:
692
33.7k
    case ZEND_PRE_DEC_OBJ:
693
33.9k
    case ZEND_POST_INC_OBJ:
694
34.0k
    case ZEND_POST_DEC_OBJ:
695
34.8k
    case ZEND_UNSET_DIM:
696
35.6k
    case ZEND_UNSET_OBJ:
697
37.7k
    case ZEND_FETCH_DIM_W:
698
38.4k
    case ZEND_FETCH_DIM_RW:
699
39.1k
    case ZEND_FETCH_DIM_FUNC_ARG:
700
39.2k
    case ZEND_FETCH_DIM_UNSET:
701
39.5k
    case ZEND_FETCH_LIST_W:
702
39.5k
      if (opline->op1_type == IS_CV) {
703
31.3k
        goto add_op1_def;
704
31.3k
      }
705
8.17k
      break;
706
32.4k
    case ZEND_SEND_VAR:
707
33.5k
    case ZEND_CAST:
708
39.8k
    case ZEND_QM_ASSIGN:
709
41.0k
    case ZEND_JMP_SET:
710
42.2k
    case ZEND_COALESCE:
711
44.8k
    case ZEND_FE_RESET_R:
712
44.8k
      if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op1_type == IS_CV) {
713
0
        goto add_op1_def;
714
0
      }
715
44.8k
      break;
716
44.8k
    case ZEND_ADD_ARRAY_UNPACK:
717
150
      ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
718
150
      break;
719
17.4k
    case ZEND_ADD_ARRAY_ELEMENT:
720
17.4k
      ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
721
17.4k
      ZEND_FALLTHROUGH;
722
21.1k
    case ZEND_INIT_ARRAY:
723
21.1k
      if (((build_flags & ZEND_SSA_RC_INFERENCE)
724
21.1k
            || (opline->extended_value & ZEND_ARRAY_ELEMENT_REF))
725
21.1k
          && opline->op1_type == IS_CV) {
726
203
        goto add_op1_def;
727
203
      }
728
20.9k
      break;
729
20.9k
    case ZEND_YIELD:
730
1.83k
      if (opline->op1_type == IS_CV
731
1.83k
          && ((op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE)
732
385
            || (build_flags & ZEND_SSA_RC_INFERENCE))) {
733
52
        goto add_op1_def;
734
52
      }
735
1.78k
      break;
736
1.78k
    case ZEND_UNSET_CV:
737
1.58k
      goto add_op1_def;
738
3.23k
    case ZEND_VERIFY_RETURN_TYPE:
739
3.23k
      if (opline->op1_type & (IS_TMP_VAR|IS_VAR|IS_CV)) {
740
1.60k
        goto add_op1_def;
741
1.60k
      }
742
1.63k
      break;
743
2.59k
    case ZEND_FE_FETCH_R:
744
3.23k
    case ZEND_FE_FETCH_RW:
745
3.23k
      if (opline->op2_type != IS_CV) {
746
190
        ssa_ops[k].op2_use = -1; /* not used */
747
190
      }
748
3.23k
      ssa_ops[k].op2_def = ssa_vars_count;
749
3.23k
      var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
750
3.23k
      ssa_vars_count++;
751
      //NEW_SSA_VAR(opline->op2.var)
752
3.23k
      break;
753
5.45k
    case ZEND_BIND_LEXICAL:
754
5.45k
      if ((opline->extended_value & ZEND_BIND_REF) || (build_flags & ZEND_SSA_RC_INFERENCE)) {
755
480
        ssa_ops[k].op2_def = ssa_vars_count;
756
480
        var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
757
480
        ssa_vars_count++;
758
        //NEW_SSA_VAR(opline->op2.var)
759
480
      }
760
5.45k
      break;
761
401
    case ZEND_COPY_TMP:
762
401
      if (build_flags & ZEND_SSA_RC_INFERENCE) {
763
0
        ssa_ops[k].op1_def = ssa_vars_count;
764
0
        var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
765
0
        ssa_vars_count++;
766
        //NEW_SSA_VAR(opline->op1.var)
767
0
      }
768
401
      break;
769
0
    case ZEND_FRAMELESS_ICALL_1:
770
0
    case ZEND_FRAMELESS_ICALL_2:
771
0
    case ZEND_FRAMELESS_ICALL_3: {
772
0
      if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op1_type == IS_CV) {
773
0
        ssa_ops[k].op1_def = ssa_vars_count;
774
0
        var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
775
0
        ssa_vars_count++;
776
        //NEW_SSA_VAR(opline->op1.var)
777
0
      }
778
0
      if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op2_type == IS_CV) {
779
0
        ssa_ops[k].op2_def = ssa_vars_count;
780
0
        var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
781
0
        ssa_vars_count++;
782
        //NEW_SSA_VAR(opline->op2.var)
783
0
      }
784
0
      if (opline->opcode == ZEND_FRAMELESS_ICALL_3) {
785
0
        next = opline + 1;
786
0
        if (next->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
787
0
          ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
788
          //USE_SSA_VAR(op_array->last_var + next->op1.var);
789
0
          if ((build_flags & ZEND_SSA_RC_INFERENCE) && next->op1_type == IS_CV) {
790
0
            ssa_ops[k + 1].op1_def = ssa_vars_count;
791
0
            var[EX_VAR_TO_NUM(next->op1.var)] = ssa_vars_count;
792
0
            ssa_vars_count++;
793
            //NEW_SSA_VAR(next->op1.var)
794
0
          }
795
0
        }
796
0
      }
797
0
    }
798
1.13M
    default:
799
1.13M
      break;
800
1.33M
  }
801
802
1.33M
  if (opline->result_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
803
737k
    ssa_ops[k].result_def = ssa_vars_count;
804
737k
    var[EX_VAR_TO_NUM(opline->result.var)] = ssa_vars_count;
805
737k
    ssa_vars_count++;
806
    //NEW_SSA_VAR(op_array->last_var + opline->result.var)
807
737k
  }
808
809
1.33M
  return ssa_vars_count;
810
1.33M
}
811
/* }}} */
812
813
ZEND_API int zend_ssa_rename_op(const zend_op_array *op_array, const zend_op *opline, uint32_t k, uint32_t build_flags, int ssa_vars_count, zend_ssa_op *ssa_ops, int *var) /* {{{ */
814
0
{
815
0
  return _zend_ssa_rename_op(op_array, opline, k, build_flags, ssa_vars_count, ssa_ops, var);
816
0
}
817
/* }}} */
818
819
static zend_result zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa, int *var, int n) /* {{{ */
820
216k
{
821
216k
  zend_basic_block *blocks = ssa->cfg.blocks;
822
216k
  zend_ssa_block *ssa_blocks = ssa->blocks;
823
216k
  zend_ssa_op *ssa_ops = ssa->ops;
824
216k
  int ssa_vars_count = ssa->vars_count;
825
216k
  int i, j;
826
216k
  zend_op *opline, *end;
827
216k
  int *tmp = NULL;
828
216k
  ALLOCA_FLAG(use_heap = 0);
829
830
  // FIXME: Can we optimize this copying out in some cases?
831
216k
  if (blocks[n].next_child >= 0) {
832
67.1k
    tmp = do_alloca(sizeof(int) * (op_array->last_var + op_array->T), use_heap);
833
67.1k
    memcpy(tmp, var, sizeof(int) * (op_array->last_var + op_array->T));
834
67.1k
    var = tmp;
835
67.1k
  }
836
837
216k
  if (ssa_blocks[n].phis) {
838
114k
    zend_ssa_phi *phi = ssa_blocks[n].phis;
839
176k
    do {
840
176k
      if (phi->ssa_var < 0) {
841
122k
        phi->ssa_var = ssa_vars_count;
842
122k
        var[phi->var] = ssa_vars_count;
843
122k
        ssa_vars_count++;
844
122k
      } else {
845
54.3k
        var[phi->var] = phi->ssa_var;
846
54.3k
      }
847
176k
      phi = phi->next;
848
176k
    } while (phi);
849
114k
  }
850
851
216k
  opline = op_array->opcodes + blocks[n].start;
852
216k
  end = opline + blocks[n].len;
853
1.56M
  for (; opline < end; opline++) {
854
1.34M
    uint32_t k = opline - op_array->opcodes;
855
1.34M
    if (opline->opcode != ZEND_OP_DATA) {
856
1.33M
      ssa_vars_count = _zend_ssa_rename_op(op_array, opline, k, build_flags, ssa_vars_count, ssa_ops, var);
857
1.33M
    }
858
1.34M
  }
859
860
216k
  zend_ssa_op *fe_fetch_ssa_op = blocks[n].len != 0
861
216k
      && ((end-1)->opcode == ZEND_FE_FETCH_R || (end-1)->opcode == ZEND_FE_FETCH_RW)
862
216k
      && (end-1)->op2_type == IS_CV
863
216k
    ? &ssa_ops[blocks[n].start + blocks[n].len - 1] : NULL;
864
427k
  for (i = 0; i < blocks[n].successors_count; i++) {
865
211k
    int succ = blocks[n].successors[i];
866
211k
    zend_ssa_phi *p;
867
515k
    for (p = ssa_blocks[succ].phis; p; p = p->next) {
868
304k
      if (p->pi == n) {
869
        /* e-SSA Pi */
870
54.7k
        if (p->has_range_constraint) {
871
8.91k
          if (p->constraint.range.min_var >= 0) {
872
2.32k
            p->constraint.range.min_ssa_var = var[p->constraint.range.min_var];
873
2.32k
          }
874
8.91k
          if (p->constraint.range.max_var >= 0) {
875
2.29k
            p->constraint.range.max_ssa_var = var[p->constraint.range.max_var];
876
2.29k
          }
877
8.91k
        }
878
111k
        for (j = 0; j < blocks[succ].predecessors_count; j++) {
879
56.5k
          p->sources[j] = var[p->var];
880
56.5k
        }
881
54.7k
        if (p->ssa_var < 0) {
882
54.3k
          p->ssa_var = ssa_vars_count;
883
54.3k
          ssa_vars_count++;
884
54.3k
        }
885
249k
      } else if (p->pi < 0) {
886
        /* Normal Phi */
887
378k
        for (j = 0; j < blocks[succ].predecessors_count; j++)
888
378k
          if (ssa->cfg.predecessors[blocks[succ].predecessor_offset + j] == n) {
889
247k
            break;
890
247k
          }
891
247k
        ZEND_ASSERT(j < blocks[succ].predecessors_count);
892
247k
        p->sources[j] = var[p->var];
893
247k
        if (fe_fetch_ssa_op && i == 0 && p->sources[j] == fe_fetch_ssa_op->op2_def) {
894
          /* On the exit edge of an FE_FETCH, use the pre-modification value instead. */
895
826
          p->sources[j] = fe_fetch_ssa_op->op2_use;
896
826
        }
897
247k
      }
898
304k
    }
899
267k
    for (p = ssa_blocks[succ].phis; p && (p->pi >= 0); p = p->next) {
900
56.5k
      if (p->pi == n) {
901
54.7k
        zend_ssa_phi *q = p->next;
902
58.8k
        while (q) {
903
4.07k
          if (q->pi < 0 && q->var == p->var) {
904
1.95k
            for (j = 0; j < blocks[succ].predecessors_count; j++) {
905
1.95k
              if (ssa->cfg.predecessors[blocks[succ].predecessor_offset + j] == n) {
906
1.08k
                break;
907
1.08k
              }
908
1.95k
            }
909
1.08k
            ZEND_ASSERT(j < blocks[succ].predecessors_count);
910
1.08k
            q->sources[j] = p->ssa_var;
911
1.08k
          }
912
4.07k
          q = q->next;
913
4.07k
        }
914
54.7k
      }
915
56.5k
    }
916
211k
  }
917
918
216k
  ssa->vars_count = ssa_vars_count;
919
920
216k
  j = blocks[n].children;
921
359k
  while (j >= 0) {
922
    // FIXME: Tail call optimization?
923
142k
    if (zend_ssa_rename(op_array, build_flags, ssa, var, j) == FAILURE)
924
0
      return FAILURE;
925
142k
    j = blocks[j].next_child;
926
142k
  }
927
928
216k
  if (tmp) {
929
67.1k
    free_alloca(tmp, use_heap);
930
67.1k
  }
931
932
216k
  return SUCCESS;
933
216k
}
934
/* }}} */
935
936
ZEND_API zend_result zend_build_ssa(zend_arena **arena, const zend_script *script, const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa) /* {{{ */
937
74.1k
{
938
74.1k
  zend_basic_block *blocks = ssa->cfg.blocks;
939
74.1k
  zend_ssa_block *ssa_blocks;
940
74.1k
  int blocks_count = ssa->cfg.blocks_count;
941
74.1k
  uint32_t set_size;
942
74.1k
  zend_bitset def, in, phi;
943
74.1k
  int *var = NULL;
944
74.1k
  int i, j, k, changed;
945
74.1k
  zend_dfg dfg;
946
74.1k
  ALLOCA_FLAG(dfg_use_heap)
947
74.1k
  ALLOCA_FLAG(var_use_heap)
948
949
74.1k
  if ((blocks_count * (op_array->last_var + op_array->T)) > 4 * 1024 * 1024) {
950
      /* Don't build SSA for very big functions */
951
0
    return FAILURE;
952
0
  }
953
954
74.1k
  ssa_blocks = zend_arena_calloc(arena, blocks_count, sizeof(zend_ssa_block));
955
74.1k
  ssa->blocks = ssa_blocks;
956
957
  /* Compute Variable Liveness */
958
74.1k
  dfg.vars = op_array->last_var + op_array->T;
959
74.1k
  dfg.size = set_size = zend_bitset_len(dfg.vars);
960
74.1k
  dfg.tmp = do_alloca((set_size * sizeof(zend_ulong)) * (blocks_count * 4 + 1), dfg_use_heap);
961
74.1k
  memset(dfg.tmp, 0, (set_size * sizeof(zend_ulong)) * (blocks_count * 4 + 1));
962
74.1k
  dfg.def = dfg.tmp + set_size;
963
74.1k
  dfg.use = dfg.def + set_size * blocks_count;
964
74.1k
  dfg.in  = dfg.use + set_size * blocks_count;
965
74.1k
  dfg.out = dfg.in  + set_size * blocks_count;
966
967
74.1k
  zend_build_dfg(op_array, &ssa->cfg, &dfg, build_flags);
968
969
74.1k
  if (build_flags & ZEND_SSA_DEBUG_LIVENESS) {
970
0
    zend_dump_dfg(op_array, &ssa->cfg, &dfg);
971
0
  }
972
973
74.1k
  def = dfg.def;
974
74.1k
  in  = dfg.in;
975
976
  /* Reuse the "use" set, as we no longer need it */
977
74.1k
  phi = dfg.use;
978
74.1k
  zend_bitset_clear(phi, set_size * blocks_count);
979
980
  /* Place e-SSA pis. This will add additional "def" points, so it must
981
   * happen before def propagation. */
982
74.1k
  place_essa_pis(arena, script, op_array, build_flags, ssa, &dfg);
983
984
  /* SSA construction, Step 1: Propagate "def" sets in merge points */
985
82.4k
  do {
986
82.4k
    changed = 0;
987
449k
    for (j = 0; j < blocks_count; j++) {
988
366k
      zend_bitset def_j = def + j * set_size, phi_j = phi + j * set_size;
989
366k
      if ((blocks[j].flags & ZEND_BB_REACHABLE) == 0) {
990
40
        continue;
991
40
      }
992
366k
      if (blocks[j].predecessors_count > 1) {
993
134k
        if (blocks[j].flags & ZEND_BB_IRREDUCIBLE_LOOP) {
994
          /* Prevent any values from flowing into irreducible loops by
995
             replacing all incoming values with explicit phis.  The
996
             register allocator depends on this property.  */
997
0
          zend_bitset_union(phi_j, in + (j * set_size), set_size);
998
134k
        } else {
999
405k
          for (k = 0; k < blocks[j].predecessors_count; k++) {
1000
271k
            i = ssa->cfg.predecessors[blocks[j].predecessor_offset + k];
1001
477k
            while (i != -1 && i != blocks[j].idom) {
1002
206k
              zend_bitset_union_with_intersection(
1003
206k
                phi_j, phi_j, def + (i * set_size), in + (j * set_size), set_size);
1004
206k
              i = blocks[i].idom;
1005
206k
            }
1006
271k
          }
1007
134k
        }
1008
134k
        if (!zend_bitset_subset(phi_j, def_j, set_size)) {
1009
60.2k
          zend_bitset_union(def_j, phi_j, set_size);
1010
60.2k
          changed = 1;
1011
60.2k
        }
1012
134k
      }
1013
366k
    }
1014
82.4k
  } while (changed);
1015
1016
  /* SSA construction, Step 2: Phi placement based on Dominance Frontiers */
1017
74.1k
  var = do_alloca(sizeof(int) * (op_array->last_var + op_array->T), var_use_heap);
1018
74.1k
  if (!var) {
1019
0
    free_alloca(dfg.tmp, dfg_use_heap);
1020
0
    return FAILURE;
1021
0
  }
1022
1023
290k
  for (j = 0; j < blocks_count; j++) {
1024
216k
    if ((blocks[j].flags & ZEND_BB_REACHABLE) == 0) {
1025
32
      continue;
1026
32
    }
1027
216k
    if (!zend_bitset_empty(phi + j * set_size, set_size)) {
1028
5.34M
      ZEND_BITSET_REVERSE_FOREACH(phi + j * set_size, set_size, i) {
1029
121k
        zend_ssa_phi *phi = zend_arena_calloc(arena, 1,
1030
121k
          ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)) +
1031
121k
          ZEND_MM_ALIGNED_SIZE(sizeof(int) * blocks[j].predecessors_count) +
1032
121k
          sizeof(void*) * blocks[j].predecessors_count);
1033
1034
121k
        phi->sources = (int*)(((char*)phi) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)));
1035
121k
        memset(phi->sources, 0xff, sizeof(int) * blocks[j].predecessors_count);
1036
121k
        phi->use_chains = (zend_ssa_phi**)(((char*)phi->sources) + ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->cfg.blocks[j].predecessors_count));
1037
1038
121k
        phi->pi = -1;
1039
121k
        phi->var = i;
1040
121k
        phi->ssa_var = -1;
1041
1042
        /* Place phis after pis */
1043
121k
        {
1044
121k
          zend_ssa_phi **pp = &ssa_blocks[j].phis;
1045
124k
          while (*pp) {
1046
62.2k
            if ((*pp)->pi < 0) {
1047
59.7k
              break;
1048
59.7k
            }
1049
2.41k
            pp = &(*pp)->next;
1050
2.41k
          }
1051
121k
          phi->next = *pp;
1052
121k
          *pp = phi;
1053
121k
        }
1054
121k
      } ZEND_BITSET_FOREACH_END();
1055
62.1k
    }
1056
216k
  }
1057
1058
74.1k
  if (build_flags & ZEND_SSA_DEBUG_PHI_PLACEMENT) {
1059
0
    zend_dump_phi_placement(op_array, ssa);
1060
0
  }
1061
1062
  /* SSA construction, Step 3: Renaming */
1063
74.1k
  ssa->ops = zend_arena_calloc(arena, op_array->last, sizeof(zend_ssa_op));
1064
74.1k
  memset(ssa->ops, 0xff, op_array->last * sizeof(zend_ssa_op));
1065
74.1k
  memset(var + op_array->last_var, 0xff, op_array->T * sizeof(int));
1066
  /* Create uninitialized SSA variables for each CV */
1067
178k
  for (j = 0; j < op_array->last_var; j++) {
1068
104k
    var[j] = j;
1069
104k
  }
1070
74.1k
  ssa->vars_count = op_array->last_var;
1071
74.1k
  if (zend_ssa_rename(op_array, build_flags, ssa, var, 0) == FAILURE) {
1072
0
    free_alloca(var, var_use_heap);
1073
0
    free_alloca(dfg.tmp, dfg_use_heap);
1074
0
    return FAILURE;
1075
0
  }
1076
1077
74.1k
  free_alloca(var, var_use_heap);
1078
74.1k
  free_alloca(dfg.tmp, dfg_use_heap);
1079
1080
74.1k
  return SUCCESS;
1081
74.1k
}
1082
/* }}} */
1083
1084
ZEND_API void zend_ssa_compute_use_def_chains(zend_arena **arena, const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
1085
74.1k
{
1086
74.1k
  zend_ssa_var *ssa_vars;
1087
74.1k
  int i;
1088
1089
74.1k
  if (!ssa->vars) {
1090
74.1k
    ssa->vars = zend_arena_calloc(arena, ssa->vars_count, sizeof(zend_ssa_var));
1091
74.1k
  }
1092
74.1k
  ssa_vars = ssa->vars;
1093
1094
178k
  for (i = 0; i < op_array->last_var; i++) {
1095
104k
    ssa_vars[i].var = i;
1096
104k
    ssa_vars[i].scc = -1;
1097
104k
    ssa_vars[i].definition = -1;
1098
104k
    ssa_vars[i].use_chain = -1;
1099
104k
  }
1100
1.09M
  for (i = op_array->last_var; i < ssa->vars_count; i++) {
1101
1.02M
    ssa_vars[i].var = -1;
1102
1.02M
    ssa_vars[i].scc = -1;
1103
1.02M
    ssa_vars[i].definition = -1;
1104
1.02M
    ssa_vars[i].use_chain = -1;
1105
1.02M
  }
1106
1107
1.42M
  for (i = op_array->last - 1; i >= 0; i--) {
1108
1.34M
    zend_ssa_op *op = ssa->ops + i;
1109
1110
1.34M
    if (op->op1_use >= 0) {
1111
809k
      op->op1_use_chain = ssa_vars[op->op1_use].use_chain;
1112
809k
      ssa_vars[op->op1_use].use_chain = i;
1113
809k
    }
1114
1.34M
    if (op->op2_use >= 0 && op->op2_use != op->op1_use) {
1115
272k
      op->op2_use_chain = ssa_vars[op->op2_use].use_chain;
1116
272k
      ssa_vars[op->op2_use].use_chain = i;
1117
272k
    }
1118
1.34M
    if (op->result_use >= 0 && op->result_use != op->op1_use && op->result_use != op->op2_use) {
1119
17.5k
      op->res_use_chain = ssa_vars[op->result_use].use_chain;
1120
17.5k
      ssa_vars[op->result_use].use_chain = i;
1121
17.5k
    }
1122
1.34M
    if (op->op1_def >= 0) {
1123
104k
      ssa_vars[op->op1_def].var = EX_VAR_TO_NUM(op_array->opcodes[i].op1.var);
1124
104k
      ssa_vars[op->op1_def].definition = i;
1125
104k
    }
1126
1.34M
    if (op->op2_def >= 0) {
1127
4.67k
      ssa_vars[op->op2_def].var = EX_VAR_TO_NUM(op_array->opcodes[i].op2.var);
1128
4.67k
      ssa_vars[op->op2_def].definition = i;
1129
4.67k
    }
1130
1.34M
    if (op->result_def >= 0) {
1131
737k
      ssa_vars[op->result_def].var = EX_VAR_TO_NUM(op_array->opcodes[i].result.var);
1132
737k
      ssa_vars[op->result_def].definition = i;
1133
737k
    }
1134
1.34M
  }
1135
1136
290k
  for (i = 0; i < ssa->cfg.blocks_count; i++) {
1137
216k
    zend_ssa_phi *phi = ssa->blocks[i].phis;
1138
393k
    while (phi) {
1139
176k
      phi->block = i;
1140
176k
      ssa_vars[phi->ssa_var].var = phi->var;
1141
176k
      ssa_vars[phi->ssa_var].definition_phi = phi;
1142
176k
      if (phi->pi >= 0) {
1143
54.7k
        zend_ssa_phi *p;
1144
1145
54.7k
        ZEND_ASSERT(phi->sources[0] >= 0);
1146
54.7k
        p = ssa_vars[phi->sources[0]].phi_use_chain;
1147
58.1k
        while (p && p != phi) {
1148
3.36k
          p = zend_ssa_next_use_phi(ssa, phi->sources[0], p);
1149
3.36k
        }
1150
54.7k
        if (!p) {
1151
54.7k
          phi->use_chains[0] = ssa_vars[phi->sources[0]].phi_use_chain;
1152
54.7k
          ssa_vars[phi->sources[0]].phi_use_chain = phi;
1153
54.7k
        }
1154
54.7k
        if (phi->has_range_constraint) {
1155
          /* min and max variables can't be used together */
1156
8.91k
          zend_ssa_range_constraint *constraint = &phi->constraint.range;
1157
8.91k
          if (constraint->min_ssa_var >= 0) {
1158
2.32k
            phi->sym_use_chain = ssa_vars[constraint->min_ssa_var].sym_use_chain;
1159
2.32k
            ssa_vars[constraint->min_ssa_var].sym_use_chain = phi;
1160
6.58k
          } else if (constraint->max_ssa_var >= 0) {
1161
1.12k
            phi->sym_use_chain = ssa_vars[constraint->max_ssa_var].sym_use_chain;
1162
1.12k
            ssa_vars[constraint->max_ssa_var].sym_use_chain = phi;
1163
1.12k
          }
1164
8.91k
        }
1165
121k
      } else {
1166
121k
        int j;
1167
1168
369k
        for (j = 0; j < ssa->cfg.blocks[i].predecessors_count; j++) {
1169
247k
          zend_ssa_phi *p;
1170
1171
247k
          ZEND_ASSERT(phi->sources[j] >= 0);
1172
247k
          p = ssa_vars[phi->sources[j]].phi_use_chain;
1173
296k
          while (p && p != phi) {
1174
48.7k
            p = zend_ssa_next_use_phi(ssa, phi->sources[j], p);
1175
48.7k
          }
1176
247k
          if (!p) {
1177
246k
            phi->use_chains[j] = ssa_vars[phi->sources[j]].phi_use_chain;
1178
246k
            ssa_vars[phi->sources[j]].phi_use_chain = phi;
1179
246k
          }
1180
247k
        }
1181
121k
      }
1182
176k
      phi = phi->next;
1183
176k
    }
1184
216k
  }
1185
1186
  /* Mark indirectly accessed variables */
1187
178k
  for (i = 0; i < op_array->last_var; i++) {
1188
104k
    if ((ssa->cfg.flags & ZEND_FUNC_INDIRECT_VAR_ACCESS)) {
1189
0
      ssa_vars[i].alias = SYMTABLE_ALIAS;
1190
104k
    } else if (zend_string_equals_literal(op_array->vars[i], "http_response_header")) {
1191
0
      ssa_vars[i].alias = HTTP_RESPONSE_HEADER_ALIAS;
1192
0
    }
1193
104k
  }
1194
1.09M
  for (i = op_array->last_var; i < ssa->vars_count; i++) {
1195
1.02M
    if (ssa_vars[i].var < op_array->last_var) {
1196
256k
      ssa_vars[i].alias = ssa_vars[ssa_vars[i].var].alias;
1197
256k
    }
1198
1.02M
  }
1199
74.1k
}
1200
/* }}} */
1201
1202
void zend_ssa_unlink_use_chain(zend_ssa *ssa, int op, int var) /* {{{ */
1203
35.8k
{
1204
35.8k
  if (ssa->vars[var].use_chain == op) {
1205
30.3k
    ssa->vars[var].use_chain = zend_ssa_next_use(ssa->ops, var, op);
1206
30.3k
    return;
1207
30.3k
  }
1208
5.47k
  int use = ssa->vars[var].use_chain;
1209
1210
7.97k
  while (use >= 0) {
1211
7.97k
    if (ssa->ops[use].result_use == var) {
1212
51
      if (ssa->ops[use].res_use_chain == op) {
1213
51
        ssa->ops[use].res_use_chain = zend_ssa_next_use(ssa->ops, var, op);
1214
51
        return;
1215
51
      } else {
1216
0
        use = ssa->ops[use].res_use_chain;
1217
0
      }
1218
7.92k
    } else if (ssa->ops[use].op1_use == var) {
1219
5.88k
      if (ssa->ops[use].op1_use_chain == op) {
1220
3.90k
        ssa->ops[use].op1_use_chain = zend_ssa_next_use(ssa->ops, var, op);
1221
3.90k
        return;
1222
3.90k
      } else {
1223
1.97k
        use = ssa->ops[use].op1_use_chain;
1224
1.97k
      }
1225
5.88k
    } else if (ssa->ops[use].op2_use == var) {
1226
2.04k
      if (ssa->ops[use].op2_use_chain == op) {
1227
1.51k
        ssa->ops[use].op2_use_chain = zend_ssa_next_use(ssa->ops, var, op);
1228
1.51k
        return;
1229
1.51k
      } else {
1230
529
        use = ssa->ops[use].op2_use_chain;
1231
529
      }
1232
2.04k
    } else {
1233
0
      break;
1234
0
    }
1235
7.97k
  }
1236
  /* something wrong */
1237
0
  ZEND_UNREACHABLE();
1238
0
}
1239
/* }}} */
1240
1241
void zend_ssa_replace_use_chain(zend_ssa *ssa, int op, int new_op, int var) /* {{{ */
1242
16
{
1243
16
  if (ssa->vars[var].use_chain == op) {
1244
10
    ssa->vars[var].use_chain = new_op;
1245
10
    return;
1246
10
  } else {
1247
6
    int use = ssa->vars[var].use_chain;
1248
1249
6
    while (use >= 0) {
1250
6
      if (ssa->ops[use].result_use == var) {
1251
0
        if (ssa->ops[use].res_use_chain == op) {
1252
0
          ssa->ops[use].res_use_chain = new_op;
1253
0
          return;
1254
0
        } else {
1255
0
          use = ssa->ops[use].res_use_chain;
1256
0
        }
1257
6
      } else if (ssa->ops[use].op1_use == var) {
1258
6
        if (ssa->ops[use].op1_use_chain == op) {
1259
6
          ssa->ops[use].op1_use_chain = new_op;
1260
6
          return;
1261
6
        } else {
1262
0
          use = ssa->ops[use].op1_use_chain;
1263
0
        }
1264
6
      } else if (ssa->ops[use].op2_use == var) {
1265
0
        if (ssa->ops[use].op2_use_chain == op) {
1266
0
          ssa->ops[use].op2_use_chain = new_op;
1267
0
          return;
1268
0
        } else {
1269
0
          use = ssa->ops[use].op2_use_chain;
1270
0
        }
1271
0
      } else {
1272
0
        break;
1273
0
      }
1274
6
    }
1275
6
  }
1276
  /* something wrong */
1277
0
  ZEND_UNREACHABLE();
1278
0
}
1279
/* }}} */
1280
1281
void zend_ssa_remove_instr(zend_ssa *ssa, zend_op *opline, zend_ssa_op *ssa_op) /* {{{ */
1282
18.5k
{
1283
18.5k
  if (ssa_op->result_use >= 0) {
1284
195
    zend_ssa_unlink_use_chain(ssa, ssa_op - ssa->ops, ssa_op->result_use);
1285
195
    ssa_op->result_use = -1;
1286
195
    ssa_op->res_use_chain = -1;
1287
195
  }
1288
18.5k
  if (ssa_op->op1_use >= 0) {
1289
13.7k
    if (ssa_op->op1_use != ssa_op->op2_use) {
1290
13.5k
      zend_ssa_unlink_use_chain(ssa, ssa_op - ssa->ops, ssa_op->op1_use);
1291
13.5k
    } else {
1292
193
      ssa_op->op2_use_chain = ssa_op->op1_use_chain;
1293
193
    }
1294
13.7k
    ssa_op->op1_use = -1;
1295
13.7k
    ssa_op->op1_use_chain = -1;
1296
13.7k
  }
1297
18.5k
  if (ssa_op->op2_use >= 0) {
1298
3.13k
    zend_ssa_unlink_use_chain(ssa, ssa_op - ssa->ops, ssa_op->op2_use);
1299
3.13k
    ssa_op->op2_use = -1;
1300
3.13k
    ssa_op->op2_use_chain = -1;
1301
3.13k
  }
1302
1303
  /* We let the caller make sure that all defs are gone */
1304
18.5k
  ZEND_ASSERT(ssa_op->result_def == -1);
1305
18.5k
  ZEND_ASSERT(ssa_op->op1_def == -1);
1306
18.5k
  ZEND_ASSERT(ssa_op->op2_def == -1);
1307
1308
18.5k
  MAKE_NOP(opline);
1309
18.5k
}
1310
/* }}} */
1311
1312
static inline zend_ssa_phi **zend_ssa_next_use_phi_ptr(zend_ssa *ssa, int var, zend_ssa_phi *p) /* {{{ */
1313
1.25k
{
1314
1.25k
  if (p->pi >= 0) {
1315
416
    return &p->use_chains[0];
1316
839
  } else {
1317
839
    int j;
1318
1.46k
    for (j = 0; j < ssa->cfg.blocks[p->block].predecessors_count; j++) {
1319
1.46k
      if (p->sources[j] == var) {
1320
839
        return &p->use_chains[j];
1321
839
      }
1322
1.46k
    }
1323
839
  }
1324
0
  ZEND_UNREACHABLE();
1325
0
  return NULL;
1326
0
}
1327
/* }}} */
1328
1329
/* May be called even if source is not used in the phi (useful when removing uses in a phi
1330
 * with multiple identical operands) */
1331
static inline void zend_ssa_remove_use_of_phi_source(zend_ssa *ssa, zend_ssa_phi *phi, int source, zend_ssa_phi *next_use_phi) /* {{{ */
1332
11.8k
{
1333
11.8k
  zend_ssa_phi **cur = &ssa->vars[source].phi_use_chain;
1334
13.1k
  while (*cur && *cur != phi) {
1335
1.25k
    cur = zend_ssa_next_use_phi_ptr(ssa, source, *cur);
1336
1.25k
  }
1337
11.8k
  if (*cur) {
1338
8.91k
    *cur = next_use_phi;
1339
8.91k
  }
1340
11.8k
}
1341
/* }}} */
1342
1343
static void zend_ssa_remove_uses_of_phi_sources(zend_ssa *ssa, zend_ssa_phi *phi) /* {{{ */
1344
6.27k
{
1345
6.27k
  int source;
1346
26.3k
  FOREACH_PHI_SOURCE(phi, source) {
1347
26.3k
    zend_ssa_remove_use_of_phi_source(ssa, phi, source, zend_ssa_next_use_phi(ssa, source, phi));
1348
26.3k
  } FOREACH_PHI_SOURCE_END();
1349
6.27k
}
1350
/* }}} */
1351
1352
static void zend_ssa_remove_phi_from_block(zend_ssa *ssa, zend_ssa_phi *phi) /* {{{ */
1353
6.27k
{
1354
6.27k
  zend_ssa_block *block = &ssa->blocks[phi->block];
1355
6.27k
  zend_ssa_phi **cur = &block->phis;
1356
10.3k
  while (*cur != phi) {
1357
4.05k
    ZEND_ASSERT(*cur != NULL);
1358
4.05k
    cur = &(*cur)->next;
1359
4.05k
  }
1360
6.27k
  *cur = (*cur)->next;
1361
6.27k
}
1362
/* }}} */
1363
1364
void zend_ssa_remove_defs_of_instr(zend_ssa *ssa, zend_ssa_op *ssa_op) /* {{{ */
1365
3.05k
{
1366
3.05k
  if (ssa_op->op1_def >= 0) {
1367
619
    zend_ssa_remove_uses_of_var(ssa, ssa_op->op1_def);
1368
619
    zend_ssa_remove_op1_def(ssa, ssa_op);
1369
619
  }
1370
3.05k
  if (ssa_op->op2_def >= 0) {
1371
14
    zend_ssa_remove_uses_of_var(ssa, ssa_op->op2_def);
1372
14
    zend_ssa_remove_op2_def(ssa, ssa_op);
1373
14
  }
1374
3.05k
  if (ssa_op->result_def >= 0) {
1375
1.41k
    zend_ssa_remove_uses_of_var(ssa, ssa_op->result_def);
1376
1.41k
    zend_ssa_remove_result_def(ssa, ssa_op);
1377
1.41k
  }
1378
3.05k
}
1379
/* }}} */
1380
1381
static inline void zend_ssa_remove_phi_source(zend_ssa *ssa, zend_ssa_phi *phi, int pred_offset, int predecessors_count) /* {{{ */
1382
1.84k
{
1383
1.84k
  int j, var_num = phi->sources[pred_offset];
1384
1.84k
  zend_ssa_phi *next_phi = phi->use_chains[pred_offset];
1385
1386
1.84k
  predecessors_count--;
1387
1.84k
  if (pred_offset < predecessors_count) {
1388
484
    memmove(phi->sources + pred_offset, phi->sources + pred_offset + 1, (predecessors_count - pred_offset) * sizeof(uint32_t));
1389
484
    memmove(phi->use_chains + pred_offset, phi->use_chains + pred_offset + 1, (predecessors_count - pred_offset) * sizeof(zend_ssa_phi*));
1390
484
  }
1391
1392
  /* Check if they same var is used in a different phi operand as well, in this case we don't
1393
   * need to adjust the use chain (but may have to move the next pointer). */
1394
3.50k
  for (j = 0; j < predecessors_count; j++) {
1395
1.68k
    if (phi->sources[j] == var_num) {
1396
28
      if (j < pred_offset) {
1397
12
        ZEND_ASSERT(next_phi == NULL);
1398
16
      } else if (j >= pred_offset) {
1399
16
        phi->use_chains[j] = next_phi;
1400
16
      }
1401
28
      return;
1402
28
    }
1403
1.68k
  }
1404
1405
  /* Variable only used in one operand, remove the phi from the use chain. */
1406
1.82k
  zend_ssa_remove_use_of_phi_source(ssa, phi, var_num, next_phi);
1407
1.82k
}
1408
/* }}} */
1409
1410
void zend_ssa_remove_phi(zend_ssa *ssa, zend_ssa_phi *phi) /* {{{ */
1411
6.27k
{
1412
6.27k
  ZEND_ASSERT(phi->ssa_var >= 0);
1413
6.27k
  ZEND_ASSERT(ssa->vars[phi->ssa_var].use_chain < 0
1414
6.27k
    && ssa->vars[phi->ssa_var].phi_use_chain == NULL);
1415
6.27k
  zend_ssa_remove_uses_of_phi_sources(ssa, phi);
1416
6.27k
  zend_ssa_remove_phi_from_block(ssa, phi);
1417
6.27k
  ssa->vars[phi->ssa_var].definition_phi = NULL;
1418
6.27k
  phi->ssa_var = -1;
1419
6.27k
}
1420
/* }}} */
1421
1422
void zend_ssa_remove_uses_of_var(zend_ssa *ssa, int var_num) /* {{{ */
1423
7.03k
{
1424
7.03k
  zend_ssa_var *var = &ssa->vars[var_num];
1425
7.03k
  zend_ssa_phi *phi;
1426
7.03k
  int use;
1427
9.75k
  FOREACH_PHI_USE(var, phi) {
1428
9.75k
    int i, end = NUM_PHI_SOURCES(phi);
1429
9.75k
    for (i = 0; i < end; i++) {
1430
5.25k
      if (phi->sources[i] == var_num) {
1431
2.73k
        phi->use_chains[i] = NULL;
1432
2.73k
      }
1433
5.25k
    }
1434
9.75k
  } FOREACH_PHI_USE_END();
1435
7.03k
  var->phi_use_chain = NULL;
1436
8.50k
  FOREACH_USE(var, use) {
1437
8.50k
    zend_ssa_op *ssa_op = &ssa->ops[use];
1438
8.50k
    if (ssa_op->op1_use == var_num) {
1439
1.23k
      ssa_op->op1_use = -1;
1440
1.23k
      ssa_op->op1_use_chain = -1;
1441
1.23k
    }
1442
8.50k
    if (ssa_op->op2_use == var_num) {
1443
246
      ssa_op->op2_use = -1;
1444
246
      ssa_op->op2_use_chain = -1;
1445
246
    }
1446
8.50k
    if (ssa_op->result_use == var_num) {
1447
0
      ssa_op->result_use = -1;
1448
0
      ssa_op->res_use_chain = -1;
1449
0
    }
1450
8.50k
  } FOREACH_USE_END();
1451
7.03k
  var->use_chain = -1;
1452
7.03k
}
1453
/* }}} */
1454
1455
void zend_ssa_remove_predecessor(zend_ssa *ssa, int from, int to) /* {{{ */
1456
2.50k
{
1457
2.50k
  zend_basic_block *next_block = &ssa->cfg.blocks[to];
1458
2.50k
  zend_ssa_block *next_ssa_block = &ssa->blocks[to];
1459
2.50k
  zend_ssa_phi *phi;
1460
2.50k
  int j;
1461
1462
  /* Find at which predecessor offset this block is referenced */
1463
2.50k
  int pred_offset = -1;
1464
2.50k
  int *predecessors = &ssa->cfg.predecessors[next_block->predecessor_offset];
1465
1466
4.36k
  for (j = 0; j < next_block->predecessors_count; j++) {
1467
3.48k
    if (predecessors[j] == from) {
1468
1.62k
      pred_offset = j;
1469
1.62k
      break;
1470
1.62k
    }
1471
3.48k
  }
1472
1473
  /* If there are duplicate successors, the predecessors may have been removed in
1474
   * a previous iteration already. */
1475
2.50k
  if (pred_offset == -1) {
1476
883
    return;
1477
883
  }
1478
1479
  /* For phis in successor blocks, remove the operands associated with this block */
1480
3.62k
  for (phi = next_ssa_block->phis; phi; phi = phi->next) {
1481
2.00k
    if (phi->pi >= 0) {
1482
156
      if (phi->pi == from) {
1483
139
        zend_ssa_rename_var_uses(ssa, phi->ssa_var, phi->sources[0], /* update_types */ 0);
1484
139
        zend_ssa_remove_phi(ssa, phi);
1485
139
      }
1486
1.84k
    } else {
1487
1.84k
      ZEND_ASSERT(phi->sources[pred_offset] >= 0);
1488
1.84k
      zend_ssa_remove_phi_source(ssa, phi, pred_offset, next_block->predecessors_count);
1489
1.84k
    }
1490
2.00k
  }
1491
1492
  /* Remove this predecessor */
1493
1.62k
  next_block->predecessors_count--;
1494
1.62k
  if (pred_offset < next_block->predecessors_count) {
1495
388
    predecessors = &ssa->cfg.predecessors[next_block->predecessor_offset + pred_offset];
1496
388
    memmove(predecessors, predecessors + 1, (next_block->predecessors_count - pred_offset) * sizeof(uint32_t));
1497
388
  }
1498
1.62k
}
1499
/* }}} */
1500
1501
void zend_ssa_remove_block(zend_op_array *op_array, zend_ssa *ssa, int i) /* {{{ */
1502
2.56k
{
1503
2.56k
  zend_basic_block *block = &ssa->cfg.blocks[i];
1504
2.56k
  zend_ssa_block *ssa_block = &ssa->blocks[i];
1505
2.56k
  zend_ssa_phi *phi;
1506
2.56k
  int j;
1507
1508
2.56k
  block->flags &= ~ZEND_BB_REACHABLE;
1509
1510
  /* Removes phis in this block */
1511
3.17k
  for (phi = ssa_block->phis; phi; phi = phi->next) {
1512
616
    zend_ssa_remove_uses_of_var(ssa, phi->ssa_var);
1513
616
    zend_ssa_remove_phi(ssa, phi);
1514
616
  }
1515
1516
  /* Remove instructions in this block */
1517
5.58k
  for (j = block->start; j < block->start + block->len; j++) {
1518
3.02k
    if (op_array->opcodes[j].opcode == ZEND_NOP) {
1519
0
      continue;
1520
0
    }
1521
1522
3.02k
    zend_ssa_remove_defs_of_instr(ssa, &ssa->ops[j]);
1523
3.02k
    zend_ssa_remove_instr(ssa, &op_array->opcodes[j], &ssa->ops[j]);
1524
3.02k
  }
1525
1526
2.56k
  zend_ssa_remove_block_from_cfg(ssa, i);
1527
2.56k
}
1528
/* }}} */
1529
1530
void zend_ssa_remove_block_from_cfg(zend_ssa *ssa, int i) /* {{{ */
1531
2.58k
{
1532
2.58k
  zend_basic_block *block = &ssa->cfg.blocks[i];
1533
2.58k
  int *predecessors;
1534
2.58k
  int j, s;
1535
1536
4.94k
  for (s = 0; s < block->successors_count; s++) {
1537
2.36k
    zend_ssa_remove_predecessor(ssa, i, block->successors[s]);
1538
2.36k
  }
1539
1540
  /* Remove successors of predecessors */
1541
2.58k
  predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
1542
4.71k
  for (j = 0; j < block->predecessors_count; j++) {
1543
2.12k
    if (predecessors[j] >= 0) {
1544
2.12k
      zend_basic_block *prev_block = &ssa->cfg.blocks[predecessors[j]];
1545
1546
5.96k
      for (s = 0; s < prev_block->successors_count; s++) {
1547
3.83k
        if (prev_block->successors[s] == i) {
1548
1.24k
          memmove(prev_block->successors + s,
1549
1.24k
              prev_block->successors + s + 1,
1550
1.24k
              sizeof(int) * (prev_block->successors_count - s - 1));
1551
1.24k
          prev_block->successors_count--;
1552
1.24k
          s--;
1553
1.24k
        }
1554
3.83k
      }
1555
2.12k
    }
1556
2.12k
  }
1557
1558
2.58k
  block->successors_count = 0;
1559
2.58k
  block->predecessors_count = 0;
1560
1561
  /* Remove from dominators tree */
1562
2.58k
  if (block->idom >= 0) {
1563
2.58k
    j = ssa->cfg.blocks[block->idom].children;
1564
2.58k
    if (j == i) {
1565
1.21k
      ssa->cfg.blocks[block->idom].children = block->next_child;
1566
1.36k
    } else if (j >= 0) {
1567
639
      while (ssa->cfg.blocks[j].next_child >= 0) {
1568
639
        if (ssa->cfg.blocks[j].next_child == i) {
1569
639
          ssa->cfg.blocks[j].next_child = block->next_child;
1570
639
          break;
1571
639
        }
1572
0
        j = ssa->cfg.blocks[j].next_child;
1573
0
      }
1574
639
    }
1575
2.58k
  }
1576
2.58k
  block->idom = -1;
1577
2.58k
  block->level = -1;
1578
2.58k
  block->children = -1;
1579
2.58k
  block->next_child = -1;
1580
2.58k
}
1581
/* }}} */
1582
1583
static void propagate_phi_type_widening(zend_ssa *ssa, int var) /* {{{ */
1584
1.06k
{
1585
1.06k
  zend_ssa_phi *phi;
1586
2.01k
  FOREACH_PHI_USE(&ssa->vars[var], phi) {
1587
2.01k
    if (ssa->var_info[var].type & ~ssa->var_info[phi->ssa_var].type) {
1588
505
      ssa->var_info[phi->ssa_var].type |= ssa->var_info[var].type;
1589
505
      propagate_phi_type_widening(ssa, phi->ssa_var);
1590
505
    }
1591
2.01k
  } FOREACH_PHI_USE_END();
1592
1.06k
}
1593
/* }}} */
1594
1595
void zend_ssa_rename_var_uses(zend_ssa *ssa, int old, int new, bool update_types) /* {{{ */
1596
5.65k
{
1597
5.65k
  zend_ssa_var *old_var = &ssa->vars[old];
1598
5.65k
  zend_ssa_var *new_var = &ssa->vars[new];
1599
5.65k
  int use;
1600
5.65k
  zend_ssa_phi *phi;
1601
1602
5.65k
  ZEND_ASSERT(old >= 0 && new >= 0);
1603
5.65k
  ZEND_ASSERT(old != new);
1604
1605
  /* Only a no_val is both variables are */
1606
5.65k
  new_var->no_val &= old_var->no_val;
1607
1608
  /* Update ssa_op use chains */
1609
7.86k
  FOREACH_USE(old_var, use) {
1610
7.86k
    zend_ssa_op *ssa_op = &ssa->ops[use];
1611
1612
    /* If the op already uses the new var, don't add the op to the use
1613
     * list again. Instead move the use_chain to the correct operand. */
1614
7.86k
    bool add_to_use_chain = 1;
1615
7.86k
    if (ssa_op->result_use == new) {
1616
0
      add_to_use_chain = 0;
1617
2.21k
    } else if (ssa_op->op1_use == new) {
1618
0
      if (ssa_op->result_use == old) {
1619
0
        ssa_op->res_use_chain = ssa_op->op1_use_chain;
1620
0
        ssa_op->op1_use_chain = -1;
1621
0
      }
1622
0
      add_to_use_chain = 0;
1623
2.21k
    } else if (ssa_op->op2_use == new) {
1624
0
      if (ssa_op->result_use == old) {
1625
0
        ssa_op->res_use_chain = ssa_op->op2_use_chain;
1626
0
        ssa_op->op2_use_chain = -1;
1627
0
      } else if (ssa_op->op1_use == old) {
1628
0
        ssa_op->op1_use_chain = ssa_op->op2_use_chain;
1629
0
        ssa_op->op2_use_chain = -1;
1630
0
      }
1631
0
      add_to_use_chain = 0;
1632
0
    }
1633
1634
    /* Perform the actual renaming */
1635
7.86k
    if (ssa_op->result_use == old) {
1636
51
      ssa_op->result_use = new;
1637
51
    }
1638
7.86k
    if (ssa_op->op1_use == old) {
1639
2.04k
      ssa_op->op1_use = new;
1640
2.04k
    }
1641
7.86k
    if (ssa_op->op2_use == old) {
1642
236
      ssa_op->op2_use = new;
1643
236
    }
1644
1645
    /* Add op to use chain of new var (if it isn't already). We use the
1646
     * first use chain of (result, op1, op2) that has the new variable. */
1647
7.86k
    if (add_to_use_chain) {
1648
2.21k
      if (ssa_op->result_use == new) {
1649
51
        ssa_op->res_use_chain = new_var->use_chain;
1650
51
        new_var->use_chain = use;
1651
2.16k
      } else if (ssa_op->op1_use == new) {
1652
2.04k
        ssa_op->op1_use_chain = new_var->use_chain;
1653
2.04k
        new_var->use_chain = use;
1654
2.04k
      } else {
1655
124
        ZEND_ASSERT(ssa_op->op2_use == new);
1656
124
        ssa_op->op2_use_chain = new_var->use_chain;
1657
124
        new_var->use_chain = use;
1658
124
      }
1659
2.21k
    }
1660
7.86k
  } FOREACH_USE_END();
1661
5.65k
  old_var->use_chain = -1;
1662
1663
  /* Update phi use chains */
1664
7.47k
  FOREACH_PHI_USE(old_var, phi) {
1665
7.47k
    int j;
1666
7.47k
    bool after_first_new_source = 0;
1667
1668
    /* If the phi already uses the new var, find its use chain, as we may
1669
     * need to move it to a different source operand. */
1670
7.47k
    zend_ssa_phi **existing_use_chain_ptr = NULL;
1671
7.47k
    for (j = 0; j < ssa->cfg.blocks[phi->block].predecessors_count; j++) {
1672
3.27k
      if (phi->sources[j] == new) {
1673
207
        existing_use_chain_ptr = &phi->use_chains[j];
1674
207
        break;
1675
207
      }
1676
3.27k
    }
1677
1678
7.47k
    for (j = 0; j < ssa->cfg.blocks[phi->block].predecessors_count; j++) {
1679
3.45k
      if (phi->sources[j] == new) {
1680
213
        after_first_new_source = 1;
1681
3.23k
      } else if (phi->sources[j] == old) {
1682
1.82k
        phi->sources[j] = new;
1683
1684
        /* Either move existing use chain to this source, or add the phi
1685
         * to the phi use chain of the new variables. Do this only once. */
1686
1.82k
        if (!after_first_new_source) {
1687
1.64k
          if (existing_use_chain_ptr) {
1688
38
            phi->use_chains[j] = *existing_use_chain_ptr;
1689
38
            *existing_use_chain_ptr = NULL;
1690
1.61k
          } else {
1691
1.61k
            phi->use_chains[j] = new_var->phi_use_chain;
1692
1.61k
            new_var->phi_use_chain = phi;
1693
1.61k
          }
1694
1.64k
          after_first_new_source = 1;
1695
1.64k
        } else {
1696
180
          phi->use_chains[j] = NULL;
1697
180
        }
1698
1.82k
      }
1699
3.45k
    }
1700
1701
    /* Make sure phi result types are not incorrectly narrow after renaming.
1702
     * This should not normally happen, but can occur if we DCE an assignment
1703
     * or unset and there is an improper phi-indirected use lateron. */
1704
    // TODO Alternatively we could rerun type-inference after DCE
1705
7.47k
    if (update_types && (ssa->var_info[new].type & ~ssa->var_info[phi->ssa_var].type)) {
1706
560
      ssa->var_info[phi->ssa_var].type |= ssa->var_info[new].type;
1707
560
      propagate_phi_type_widening(ssa, phi->ssa_var);
1708
560
    }
1709
7.47k
  } FOREACH_PHI_USE_END();
1710
5.65k
  old_var->phi_use_chain = NULL;
1711
5.65k
}
1712
/* }}} */