Coverage Report

Created: 2025-06-13 06:43

/src/php-src/Zend/zend_opcode.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine                                                          |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 2.00 of the Zend license,     |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | http://www.zend.com/license/2_00.txt.                                |
11
   | If you did not receive a copy of the Zend license and are unable to  |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@zend.com so we can mail you a copy immediately.              |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Dmitry Stogov <dmitry@php.net>                              |
18
   +----------------------------------------------------------------------+
19
*/
20
21
#include <stdio.h>
22
23
#include "zend.h"
24
#include "zend_alloc.h"
25
#include "zend_compile.h"
26
#include "zend_extensions.h"
27
#include "zend_API.h"
28
#include "zend_sort.h"
29
#include "zend_constants.h"
30
#include "zend_observer.h"
31
32
#include "zend_vm.h"
33
34
static void zend_extension_op_array_ctor_handler(zend_extension *extension, zend_op_array *op_array)
35
0
{
36
0
  if (extension->op_array_ctor) {
37
0
    extension->op_array_ctor(op_array);
38
0
  }
39
0
}
40
41
static void zend_extension_op_array_dtor_handler(zend_extension *extension, zend_op_array *op_array)
42
0
{
43
0
  if (extension->op_array_dtor) {
44
0
    extension->op_array_dtor(op_array);
45
0
  }
46
0
}
47
48
void init_op_array(zend_op_array *op_array, uint8_t type, int initial_ops_size)
49
198k
{
50
198k
  op_array->type = type;
51
198k
  op_array->arg_flags[0] = 0;
52
198k
  op_array->arg_flags[1] = 0;
53
198k
  op_array->arg_flags[2] = 0;
54
55
198k
  op_array->refcount = (uint32_t *) emalloc(sizeof(uint32_t));
56
198k
  *op_array->refcount = 1;
57
198k
  op_array->last = 0;
58
198k
  op_array->opcodes = emalloc(initial_ops_size * sizeof(zend_op));
59
60
198k
  op_array->last_var = 0;
61
198k
  op_array->vars = NULL;
62
63
198k
  op_array->T = 0;
64
65
198k
  op_array->function_name = NULL;
66
198k
  op_array->filename = zend_string_copy(zend_get_compiled_filename());
67
198k
  op_array->doc_comment = NULL;
68
198k
  op_array->attributes = NULL;
69
70
198k
  op_array->arg_info = NULL;
71
198k
  op_array->num_args = 0;
72
198k
  op_array->required_num_args = 0;
73
74
198k
  op_array->scope = NULL;
75
198k
  op_array->prototype = NULL;
76
198k
  op_array->prop_info = NULL;
77
78
198k
  op_array->live_range = NULL;
79
198k
  op_array->try_catch_array = NULL;
80
198k
  op_array->last_live_range = 0;
81
82
198k
  op_array->static_variables = NULL;
83
198k
  ZEND_MAP_PTR_INIT(op_array->static_variables_ptr, NULL);
84
198k
  op_array->last_try_catch = 0;
85
86
198k
  op_array->fn_flags = 0;
87
88
198k
  op_array->last_literal = 0;
89
198k
  op_array->literals = NULL;
90
91
198k
  op_array->num_dynamic_func_defs = 0;
92
198k
  op_array->dynamic_func_defs = NULL;
93
94
198k
  ZEND_MAP_PTR_INIT(op_array->run_time_cache, NULL);
95
198k
  op_array->cache_size = zend_op_array_extension_handles * sizeof(void*);
96
97
198k
  memset(op_array->reserved, 0, ZEND_MAX_RESERVED_RESOURCES * sizeof(void*));
98
99
198k
  if (zend_extension_flags & ZEND_EXTENSIONS_HAVE_OP_ARRAY_CTOR) {
100
0
    zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_op_array_ctor_handler, op_array);
101
0
  }
102
198k
}
103
104
ZEND_API void destroy_zend_function(zend_function *function)
105
0
{
106
0
  zval tmp;
107
108
0
  ZVAL_PTR(&tmp, function);
109
0
  zend_function_dtor(&tmp);
110
0
}
111
112
79.7k
ZEND_API void zend_type_release(zend_type type, bool persistent) {
113
79.7k
  if (ZEND_TYPE_HAS_LIST(type)) {
114
8.66k
    zend_type *list_type;
115
31.9k
    ZEND_TYPE_LIST_FOREACH_MUTABLE(ZEND_TYPE_LIST(type), list_type) {
116
31.9k
      zend_type_release(*list_type, persistent);
117
31.9k
    } ZEND_TYPE_LIST_FOREACH_END();
118
8.66k
    if (!ZEND_TYPE_USES_ARENA(type)) {
119
0
      pefree(ZEND_TYPE_LIST(type), persistent);
120
0
    }
121
71.0k
  } else if (ZEND_TYPE_HAS_NAME(type)) {
122
35.3k
    zend_string_release(ZEND_TYPE_NAME(type));
123
35.3k
  }
124
79.7k
}
125
126
528
void zend_free_internal_arg_info(zend_internal_function *function) {
127
528
  if ((function->fn_flags & (ZEND_ACC_HAS_RETURN_TYPE|ZEND_ACC_HAS_TYPE_HINTS)) &&
128
528
    function->arg_info) {
129
130
528
    uint32_t i;
131
528
    uint32_t num_args = function->num_args + 1;
132
528
    zend_internal_arg_info *arg_info = function->arg_info - 1;
133
134
528
    if (function->fn_flags & ZEND_ACC_VARIADIC) {
135
0
      num_args++;
136
0
    }
137
2.54k
    for (i = 0 ; i < num_args; i++) {
138
2.01k
      zend_type_release(arg_info[i].type, /* persistent */ 1);
139
2.01k
    }
140
528
    free(arg_info);
141
528
  }
142
528
}
143
144
ZEND_API void zend_function_dtor(zval *zv)
145
34.0k
{
146
34.0k
  zend_function *function = Z_PTR_P(zv);
147
148
34.0k
  if (function->type == ZEND_USER_FUNCTION) {
149
14.9k
    ZEND_ASSERT(function->common.function_name);
150
14.9k
    destroy_op_array(&function->op_array);
151
    /* op_arrays are allocated on arena, so we don't have to free them */
152
19.1k
  } else {
153
19.1k
    ZEND_ASSERT(function->type == ZEND_INTERNAL_FUNCTION);
154
19.1k
    ZEND_ASSERT(function->common.function_name);
155
19.1k
    zend_string_release_ex(function->common.function_name, 1);
156
157
    /* For methods this will be called explicitly. */
158
19.1k
    if (!function->common.scope) {
159
496
      zend_free_internal_arg_info(&function->internal_function);
160
161
496
      if (function->common.attributes) {
162
16
        zend_hash_release(function->common.attributes);
163
16
        function->common.attributes = NULL;
164
16
      }
165
496
    }
166
167
19.1k
    if (function->common.doc_comment) {
168
0
      zend_string_release_ex(function->common.doc_comment, 1);
169
0
      function->common.doc_comment = NULL;
170
0
    }
171
172
19.1k
    if (!(function->common.fn_flags & ZEND_ACC_ARENA_ALLOCATED)) {
173
608
      pefree(function, 1);
174
608
    }
175
19.1k
  }
176
34.0k
}
177
178
ZEND_API void zend_cleanup_internal_class_data(zend_class_entry *ce)
179
2.55k
{
180
2.55k
  if (ZEND_MAP_PTR(ce->static_members_table) && CE_STATIC_MEMBERS(ce)) {
181
1.18k
    zval *static_members = CE_STATIC_MEMBERS(ce);
182
1.18k
    zval *p = static_members;
183
1.18k
    zval *end = p + ce->default_static_members_count;
184
1.18k
    ZEND_MAP_PTR_SET(ce->static_members_table, NULL);
185
3.84k
    while (p != end) {
186
2.65k
      if (UNEXPECTED(Z_ISREF_P(p))) {
187
267
        zend_property_info *prop_info;
188
687
        ZEND_REF_FOREACH_TYPE_SOURCES(Z_REF_P(p), prop_info) {
189
687
          if (prop_info->ce == ce && p - static_members == prop_info->offset) {
190
198
            ZEND_REF_DEL_TYPE_SOURCE(Z_REF_P(p), prop_info);
191
198
            break; /* stop iteration here, the array might be realloc()'ed */
192
198
          }
193
687
        } ZEND_REF_FOREACH_TYPE_SOURCES_END();
194
267
      }
195
2.65k
      i_zval_ptr_dtor(p);
196
2.65k
      p++;
197
2.65k
    }
198
1.18k
    efree(static_members);
199
1.18k
  }
200
2.55k
}
201
202
static void _destroy_zend_class_traits_info(zend_class_entry *ce)
203
1.29k
{
204
1.29k
  uint32_t i;
205
206
4.05k
  for (i = 0; i < ce->num_traits; i++) {
207
2.75k
    zend_string_release_ex(ce->trait_names[i].name, 0);
208
2.75k
    zend_string_release_ex(ce->trait_names[i].lc_name, 0);
209
2.75k
  }
210
1.29k
  efree(ce->trait_names);
211
212
1.29k
  if (ce->trait_aliases) {
213
463
    i = 0;
214
2.84k
    while (ce->trait_aliases[i]) {
215
2.38k
      if (ce->trait_aliases[i]->trait_method.method_name) {
216
2.38k
        zend_string_release_ex(ce->trait_aliases[i]->trait_method.method_name, 0);
217
2.38k
      }
218
2.38k
      if (ce->trait_aliases[i]->trait_method.class_name) {
219
785
        zend_string_release_ex(ce->trait_aliases[i]->trait_method.class_name, 0);
220
785
      }
221
222
2.38k
      if (ce->trait_aliases[i]->alias) {
223
2.22k
        zend_string_release_ex(ce->trait_aliases[i]->alias, 0);
224
2.22k
      }
225
226
2.38k
      efree(ce->trait_aliases[i]);
227
2.38k
      i++;
228
2.38k
    }
229
230
463
    efree(ce->trait_aliases);
231
463
  }
232
233
1.29k
  if (ce->trait_precedences) {
234
181
    uint32_t j;
235
236
181
    i = 0;
237
829
    while (ce->trait_precedences[i]) {
238
648
      zend_string_release_ex(ce->trait_precedences[i]->trait_method.method_name, 0);
239
648
      zend_string_release_ex(ce->trait_precedences[i]->trait_method.class_name, 0);
240
241
1.60k
      for (j = 0; j < ce->trait_precedences[i]->num_excludes; j++) {
242
953
        zend_string_release_ex(ce->trait_precedences[i]->exclude_class_names[j], 0);
243
953
      }
244
648
      efree(ce->trait_precedences[i]);
245
648
      i++;
246
648
    }
247
181
    efree(ce->trait_precedences);
248
181
  }
249
1.29k
}
250
251
ZEND_API void zend_cleanup_mutable_class_data(zend_class_entry *ce)
252
717
{
253
717
  zend_class_mutable_data *mutable_data = ZEND_MAP_PTR_GET_IMM(ce->mutable_data);
254
255
717
  if (mutable_data) {
256
717
    HashTable *constants_table;
257
717
    zval *p;
258
259
717
    constants_table = mutable_data->constants_table;
260
717
    if (constants_table && constants_table != &ce->constants_table) {
261
435
      zend_class_constant *c;
262
263
2.88k
      ZEND_HASH_MAP_FOREACH_PTR(constants_table, c) {
264
2.88k
        if (c->ce == ce || (Z_CONSTANT_FLAGS(c->value) & CONST_OWNED)) {
265
900
          zval_ptr_dtor_nogc(&c->value);
266
900
        }
267
2.88k
      } ZEND_HASH_FOREACH_END();
268
435
      zend_hash_destroy(constants_table);
269
435
      mutable_data->constants_table = NULL;
270
435
    }
271
272
717
    p = mutable_data->default_properties_table;
273
717
    if (p && p != ce->default_properties_table) {
274
197
      zval *end = p + ce->default_properties_count;
275
276
482
      while (p < end) {
277
285
        zval_ptr_dtor_nogc(p);
278
285
        p++;
279
285
      }
280
197
      mutable_data->default_properties_table = NULL;
281
197
    }
282
283
717
    if (mutable_data->backed_enum_table) {
284
0
      zend_hash_release(mutable_data->backed_enum_table);
285
0
      mutable_data->backed_enum_table = NULL;
286
0
    }
287
288
717
    ZEND_MAP_PTR_SET_IMM(ce->mutable_data, NULL);
289
717
  }
290
717
}
291
292
ZEND_API void destroy_zend_class(zval *zv)
293
62.3k
{
294
62.3k
  zend_property_info *prop_info;
295
62.3k
  zend_class_entry *ce = Z_PTR_P(zv);
296
62.3k
  zend_function *fn;
297
298
62.3k
  if (ce->ce_flags & ZEND_ACC_IMMUTABLE) {
299
27.2k
    return;
300
27.2k
  }
301
302
  /* We don't increase the refcount for class aliases,
303
   * skip the destruction of aliases entirely. */
304
35.0k
  if (UNEXPECTED(Z_TYPE_INFO_P(zv) == IS_ALIAS_PTR)) {
305
17
    return;
306
17
  }
307
308
35.0k
  if (ce->ce_flags & ZEND_ACC_FILE_CACHED) {
309
0
    zend_class_constant *c;
310
0
    zval *p, *end;
311
312
0
    ZEND_HASH_MAP_FOREACH_PTR(&ce->constants_table, c) {
313
0
      if (c->ce == ce) {
314
0
        zval_ptr_dtor_nogc(&c->value);
315
0
      }
316
0
    } ZEND_HASH_FOREACH_END();
317
318
0
    if (ce->default_properties_table) {
319
0
      p = ce->default_properties_table;
320
0
      end = p + ce->default_properties_count;
321
322
0
      while (p < end) {
323
0
        zval_ptr_dtor_nogc(p);
324
0
        p++;
325
0
      }
326
0
    }
327
0
    return;
328
0
  }
329
330
35.0k
  ZEND_ASSERT(ce->refcount > 0);
331
332
35.0k
  if (--ce->refcount > 0) {
333
0
    return;
334
0
  }
335
336
35.0k
  switch (ce->type) {
337
35.0k
    case ZEND_USER_CLASS:
338
35.0k
      if (!(ce->ce_flags & ZEND_ACC_CACHED)) {
339
32.7k
        if (ce->parent_name && !(ce->ce_flags & ZEND_ACC_RESOLVED_PARENT)) {
340
6.25k
          zend_string_release_ex(ce->parent_name, 0);
341
6.25k
        }
342
343
32.7k
        zend_string_release_ex(ce->name, 0);
344
32.7k
        zend_string_release_ex(ce->info.user.filename, 0);
345
346
32.7k
        if (ce->doc_comment) {
347
142
          zend_string_release_ex(ce->doc_comment, 0);
348
142
        }
349
350
32.7k
        if (ce->attributes) {
351
1.54k
          zend_hash_release(ce->attributes);
352
1.54k
        }
353
354
32.7k
        if (ce->num_interfaces > 0 && !(ce->ce_flags & ZEND_ACC_RESOLVED_INTERFACES)) {
355
5.61k
          uint32_t i;
356
357
12.4k
          for (i = 0; i < ce->num_interfaces; i++) {
358
6.82k
            zend_string_release_ex(ce->interface_names[i].name, 0);
359
6.82k
            zend_string_release_ex(ce->interface_names[i].lc_name, 0);
360
6.82k
          }
361
5.61k
          efree(ce->interface_names);
362
5.61k
        }
363
364
32.7k
        if (ce->num_traits > 0) {
365
1.29k
          _destroy_zend_class_traits_info(ce);
366
1.29k
        }
367
32.7k
      }
368
369
35.0k
      if (ce->default_properties_table) {
370
10.9k
        zval *p = ce->default_properties_table;
371
10.9k
        zval *end = p + ce->default_properties_count;
372
373
26.3k
        while (p != end) {
374
15.3k
          i_zval_ptr_dtor(p);
375
15.3k
          p++;
376
15.3k
        }
377
10.9k
        efree(ce->default_properties_table);
378
10.9k
      }
379
35.0k
      if (ce->default_static_members_table) {
380
838
        zval *p = ce->default_static_members_table;
381
838
        zval *end = p + ce->default_static_members_count;
382
383
2.94k
        while (p != end) {
384
2.10k
          ZEND_ASSERT(!Z_ISREF_P(p));
385
2.10k
          i_zval_ptr_dtor(p);
386
2.10k
          p++;
387
2.10k
        }
388
838
        efree(ce->default_static_members_table);
389
838
      }
390
107k
      ZEND_HASH_MAP_FOREACH_PTR(&ce->properties_info, prop_info) {
391
107k
        if (prop_info->ce == ce) {
392
17.0k
          zend_string_release_ex(prop_info->name, 0);
393
17.0k
          if (prop_info->doc_comment) {
394
217
            zend_string_release_ex(prop_info->doc_comment, 0);
395
217
          }
396
17.0k
          if (prop_info->attributes) {
397
158
            zend_hash_release(prop_info->attributes);
398
158
          }
399
17.0k
          zend_type_release(prop_info->type, /* persistent */ 0);
400
17.0k
          if (prop_info->hooks) {
401
8.29k
            for (uint32_t i = 0; i < ZEND_PROPERTY_HOOK_COUNT; i++) {
402
5.53k
              if (prop_info->hooks[i]) {
403
3.30k
                destroy_op_array(&prop_info->hooks[i]->op_array);
404
3.30k
              }
405
5.53k
            }
406
2.76k
          }
407
17.0k
        }
408
107k
      } ZEND_HASH_FOREACH_END();
409
35.0k
      zend_hash_destroy(&ce->properties_info);
410
35.0k
      zend_hash_destroy(&ce->function_table);
411
35.0k
      if (zend_hash_num_elements(&ce->constants_table)) {
412
4.23k
        zend_class_constant *c;
413
414
34.7k
        ZEND_HASH_MAP_FOREACH_PTR(&ce->constants_table, c) {
415
34.7k
          if (c->ce == ce || (Z_CONSTANT_FLAGS(c->value) & CONST_OWNED)) {
416
5.27k
            zval_ptr_dtor_nogc(&c->value);
417
5.27k
            if (c->doc_comment) {
418
221
              zend_string_release_ex(c->doc_comment, 0);
419
221
            }
420
5.27k
            if (c->attributes) {
421
252
              zend_hash_release(c->attributes);
422
252
            }
423
5.27k
          }
424
34.7k
        } ZEND_HASH_FOREACH_END();
425
4.23k
      }
426
35.0k
      zend_hash_destroy(&ce->constants_table);
427
35.0k
      if (ce->num_interfaces > 0 && (ce->ce_flags & ZEND_ACC_RESOLVED_INTERFACES)) {
428
2.11k
        efree(ce->interfaces);
429
2.11k
      }
430
35.0k
      if (ce->backed_enum_table) {
431
0
        zend_hash_release(ce->backed_enum_table);
432
0
      }
433
35.0k
      break;
434
0
    case ZEND_INTERNAL_CLASS:
435
0
      if (ce->doc_comment) {
436
0
        zend_string_release_ex(ce->doc_comment, 1);
437
0
      }
438
439
0
      if (ce->backed_enum_table) {
440
0
        zend_hash_release(ce->backed_enum_table);
441
0
      }
442
0
      if (ce->default_properties_table) {
443
0
        zval *p = ce->default_properties_table;
444
0
        zval *end = p + ce->default_properties_count;
445
446
0
        while (p != end) {
447
0
          zval_internal_ptr_dtor(p);
448
0
          p++;
449
0
        }
450
0
        free(ce->default_properties_table);
451
0
      }
452
0
      if (ce->default_static_members_table) {
453
0
        zval *p = ce->default_static_members_table;
454
0
        zval *end = p + ce->default_static_members_count;
455
456
0
        while (p != end) {
457
0
          zval_internal_ptr_dtor(p);
458
0
          p++;
459
0
        }
460
0
        free(ce->default_static_members_table);
461
0
      }
462
463
0
      ZEND_HASH_MAP_FOREACH_PTR(&ce->properties_info, prop_info) {
464
0
        if (prop_info->ce == ce) {
465
0
          zend_string_release(prop_info->name);
466
0
          zend_type_release(prop_info->type, /* persistent */ 1);
467
0
          if (prop_info->attributes) {
468
0
            zend_hash_release(prop_info->attributes);
469
0
          }
470
0
          free(prop_info);
471
0
        }
472
0
      } ZEND_HASH_FOREACH_END();
473
0
      zend_hash_destroy(&ce->properties_info);
474
0
      zend_string_release_ex(ce->name, 1);
475
476
      /* TODO: eliminate this loop for classes without functions with arg_info / attributes */
477
0
      ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, fn) {
478
0
        if (fn->common.scope == ce) {
479
0
          if (fn->common.fn_flags & (ZEND_ACC_HAS_RETURN_TYPE|ZEND_ACC_HAS_TYPE_HINTS)) {
480
0
            zend_free_internal_arg_info(&fn->internal_function);
481
0
          }
482
483
0
          if (fn->common.attributes) {
484
0
            zend_hash_release(fn->common.attributes);
485
0
            fn->common.attributes = NULL;
486
0
          }
487
0
        }
488
0
      } ZEND_HASH_FOREACH_END();
489
490
0
      zend_hash_destroy(&ce->function_table);
491
0
      if (zend_hash_num_elements(&ce->constants_table)) {
492
0
        zend_class_constant *c;
493
494
0
        ZEND_HASH_MAP_FOREACH_PTR(&ce->constants_table, c) {
495
0
          if (c->ce == ce) {
496
0
            if (Z_TYPE(c->value) == IS_CONSTANT_AST) {
497
              /* We marked this as IMMUTABLE, but do need to free it when the
498
               * class is destroyed. */
499
0
              ZEND_ASSERT(Z_ASTVAL(c->value)->kind == ZEND_AST_CONST_ENUM_INIT);
500
0
              free(Z_AST(c->value));
501
0
            } else {
502
0
              zval_internal_ptr_dtor(&c->value);
503
0
            }
504
0
            if (c->doc_comment) {
505
0
              zend_string_release_ex(c->doc_comment, 1);
506
0
            }
507
0
            if (c->attributes) {
508
0
              zend_hash_release(c->attributes);
509
0
            }
510
0
          }
511
0
          free(c);
512
0
        } ZEND_HASH_FOREACH_END();
513
0
        zend_hash_destroy(&ce->constants_table);
514
0
      }
515
0
      if (ce->iterator_funcs_ptr) {
516
0
        free(ce->iterator_funcs_ptr);
517
0
      }
518
0
      if (ce->arrayaccess_funcs_ptr) {
519
0
        free(ce->arrayaccess_funcs_ptr);
520
0
      }
521
0
      if (ce->num_interfaces > 0) {
522
0
        free(ce->interfaces);
523
0
      }
524
0
      if (ce->properties_info_table) {
525
0
        free(ce->properties_info_table);
526
0
      }
527
0
      if (ce->attributes) {
528
0
        zend_hash_release(ce->attributes);
529
0
      }
530
0
      free(ce);
531
0
      break;
532
35.0k
  }
533
35.0k
}
534
535
void zend_class_add_ref(zval *zv)
536
0
{
537
0
  zend_class_entry *ce = Z_PTR_P(zv);
538
539
0
  if (Z_TYPE_P(zv) != IS_ALIAS_PTR && !(ce->ce_flags & ZEND_ACC_IMMUTABLE)) {
540
0
    ce->refcount++;
541
0
  }
542
0
}
543
544
ZEND_API void zend_destroy_static_vars(zend_op_array *op_array)
545
133k
{
546
133k
  if (ZEND_MAP_PTR(op_array->static_variables_ptr)) {
547
3.12k
    HashTable *ht = ZEND_MAP_PTR_GET(op_array->static_variables_ptr);
548
3.12k
    if (ht) {
549
3.11k
      zend_array_destroy(ht);
550
3.11k
      ZEND_MAP_PTR_SET(op_array->static_variables_ptr, NULL);
551
3.11k
    }
552
3.12k
  }
553
133k
}
554
555
ZEND_API void destroy_op_array(zend_op_array *op_array)
556
201k
{
557
201k
  uint32_t i;
558
559
201k
  if ((op_array->fn_flags & ZEND_ACC_HEAP_RT_CACHE)
560
201k
   && ZEND_MAP_PTR(op_array->run_time_cache)) {
561
71.1k
    efree(ZEND_MAP_PTR(op_array->run_time_cache));
562
71.1k
  }
563
564
201k
  if (op_array->function_name) {
565
80.6k
    zend_string_release_ex(op_array->function_name, 0);
566
80.6k
  }
567
568
201k
  if (!op_array->refcount || --(*op_array->refcount) > 0) {
569
124k
    return;
570
124k
  }
571
572
76.6k
  efree_size(op_array->refcount, sizeof(*(op_array->refcount)));
573
574
76.6k
  if (op_array->vars) {
575
36.3k
    i = op_array->last_var;
576
196k
    while (i > 0) {
577
160k
      i--;
578
160k
      zend_string_release_ex(op_array->vars[i], 0);
579
160k
    }
580
36.3k
    efree(op_array->vars);
581
36.3k
  }
582
583
  /* ZEND_ACC_PTR_OPS and ZEND_ACC_OVERRIDE use the same value */
584
76.6k
  if ((op_array->fn_flags & ZEND_ACC_PTR_OPS) && !op_array->function_name) {
585
15
    zend_op *op = op_array->opcodes;
586
15
    zend_op *end = op + op_array->last;
587
906
    while (op < end) {
588
891
      if (op->opcode == ZEND_DECLARE_ATTRIBUTED_CONST) {
589
247
        HashTable *attributes = Z_PTR_P(RT_CONSTANT(op+1, (op+1)->op1));
590
247
        zend_hash_release(attributes);
591
247
      }
592
891
      op++;
593
891
    }
594
15
  }
595
76.6k
  if (op_array->literals) {
596
76.5k
    zval *literal = op_array->literals;
597
76.5k
    zval *end = literal + op_array->last_literal;
598
1.38M
    while (literal < end) {
599
1.30M
      zval_ptr_dtor_nogc(literal);
600
1.30M
      literal++;
601
1.30M
    }
602
76.5k
    if (ZEND_USE_ABS_CONST_ADDR
603
76.5k
     || !(op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO)) {
604
0
      efree(op_array->literals);
605
0
    }
606
76.5k
  }
607
76.6k
  efree(op_array->opcodes);
608
609
76.6k
  zend_string_release_ex(op_array->filename, 0);
610
76.6k
  if (op_array->doc_comment) {
611
272
    zend_string_release_ex(op_array->doc_comment, 0);
612
272
  }
613
76.6k
  if (op_array->attributes) {
614
3.99k
    zend_hash_release(op_array->attributes);
615
3.99k
  }
616
76.6k
  if (op_array->live_range) {
617
26.7k
    efree(op_array->live_range);
618
26.7k
  }
619
76.6k
  if (op_array->try_catch_array) {
620
2.18k
    efree(op_array->try_catch_array);
621
2.18k
  }
622
76.6k
  if (zend_extension_flags & ZEND_EXTENSIONS_HAVE_OP_ARRAY_DTOR) {
623
0
    if (op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO) {
624
0
      zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_op_array_dtor_handler, op_array);
625
0
    }
626
0
  }
627
76.6k
  if (op_array->arg_info) {
628
25.3k
    uint32_t num_args = op_array->num_args;
629
25.3k
    zend_arg_info *arg_info = op_array->arg_info;
630
631
25.3k
    if (op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE) {
632
10.0k
      arg_info--;
633
10.0k
      num_args++;
634
10.0k
    }
635
25.3k
    if (op_array->fn_flags & ZEND_ACC_VARIADIC) {
636
226
      num_args++;
637
226
    }
638
62.3k
    for (i = 0 ; i < num_args; i++) {
639
36.9k
      if (arg_info[i].name) {
640
26.8k
        zend_string_release_ex(arg_info[i].name, 0);
641
26.8k
      }
642
36.9k
      zend_type_release(arg_info[i].type, /* persistent */ 0);
643
36.9k
    }
644
25.3k
    efree(arg_info);
645
25.3k
  }
646
76.6k
  if (op_array->static_variables) {
647
12.3k
    zend_array_destroy(op_array->static_variables);
648
12.3k
  }
649
76.6k
  if (op_array->num_dynamic_func_defs) {
650
53.2k
    for (i = 0; i < op_array->num_dynamic_func_defs; i++) {
651
31.6k
      destroy_op_array(op_array->dynamic_func_defs[i]);
652
31.6k
    }
653
21.5k
    efree(op_array->dynamic_func_defs);
654
21.5k
  }
655
76.6k
}
656
657
static void zend_update_extended_stmts(zend_op_array *op_array)
658
0
{
659
0
  zend_op *opline = op_array->opcodes, *end=opline+op_array->last;
660
661
0
  while (opline<end) {
662
0
    if (opline->opcode == ZEND_EXT_STMT) {
663
0
      if (opline+1<end) {
664
0
        if ((opline+1)->opcode == ZEND_EXT_STMT) {
665
0
          opline->opcode = ZEND_NOP;
666
0
          opline++;
667
0
          continue;
668
0
        }
669
0
        if (opline+1<end) {
670
0
          opline->lineno = (opline+1)->lineno;
671
0
        }
672
0
      } else {
673
0
        opline->opcode = ZEND_NOP;
674
0
      }
675
0
    }
676
0
    opline++;
677
0
  }
678
0
}
679
680
static void zend_extension_op_array_handler(zend_extension *extension, zend_op_array *op_array)
681
0
{
682
0
  if (extension->op_array_handler) {
683
0
    extension->op_array_handler(op_array);
684
0
  }
685
0
}
686
687
static void zend_check_finally_breakout(zend_op_array *op_array, uint32_t op_num, uint32_t dst_num)
688
906
{
689
906
  int i;
690
691
3.83k
  for (i = 0; i < op_array->last_try_catch; i++) {
692
2.97k
    if ((op_num < op_array->try_catch_array[i].finally_op ||
693
2.97k
          op_num >= op_array->try_catch_array[i].finally_end)
694
2.97k
        && (dst_num >= op_array->try_catch_array[i].finally_op &&
695
2.72k
           dst_num <= op_array->try_catch_array[i].finally_end)) {
696
17
      CG(in_compilation) = 1;
697
17
      CG(active_op_array) = op_array;
698
17
      CG(zend_lineno) = op_array->opcodes[op_num].lineno;
699
17
      zend_error_noreturn(E_COMPILE_ERROR, "jump into a finally block is disallowed");
700
2.95k
    } else if ((op_num >= op_array->try_catch_array[i].finally_op
701
2.95k
          && op_num <= op_array->try_catch_array[i].finally_end)
702
2.95k
        && (dst_num > op_array->try_catch_array[i].finally_end
703
252
          || dst_num < op_array->try_catch_array[i].finally_op)) {
704
25
      CG(in_compilation) = 1;
705
25
      CG(active_op_array) = op_array;
706
25
      CG(zend_lineno) = op_array->opcodes[op_num].lineno;
707
25
      zend_error_noreturn(E_COMPILE_ERROR, "jump out of a finally block is disallowed");
708
25
    }
709
2.97k
  }
710
906
}
711
712
2.13k
static uint32_t zend_get_brk_cont_target(const zend_op_array *op_array, const zend_op *opline) {
713
2.13k
  int nest_levels = opline->op2.num;
714
2.13k
  int array_offset = opline->op1.num;
715
2.13k
  zend_brk_cont_element *jmp_to;
716
3.03k
  do {
717
3.03k
    jmp_to = &CG(context).brk_cont_array[array_offset];
718
3.03k
    if (nest_levels > 1) {
719
899
      array_offset = jmp_to->parent;
720
899
    }
721
3.03k
  } while (--nest_levels > 0);
722
723
2.13k
  return opline->opcode == ZEND_BRK ? jmp_to->brk : jmp_to->cont;
724
2.13k
}
725
726
static void emit_live_range_raw(
727
1.50M
    zend_op_array *op_array, uint32_t var_num, uint32_t kind, uint32_t start, uint32_t end) {
728
1.50M
  zend_live_range *range;
729
730
1.50M
  op_array->last_live_range++;
731
1.50M
  op_array->live_range = erealloc(op_array->live_range,
732
1.50M
    sizeof(zend_live_range) * op_array->last_live_range);
733
734
1.50M
  ZEND_ASSERT(start < end);
735
1.50M
  range = &op_array->live_range[op_array->last_live_range - 1];
736
1.50M
  range->var = EX_NUM_TO_VAR(op_array->last_var + var_num);
737
1.50M
  range->var |= kind;
738
1.50M
  range->start = start;
739
1.50M
  range->end = end;
740
1.50M
}
741
742
static void emit_live_range(
743
    zend_op_array *op_array, uint32_t var_num, uint32_t start, uint32_t end,
744
1.47M
    zend_needs_live_range_cb needs_live_range) {
745
1.47M
  zend_op *def_opline = &op_array->opcodes[start], *orig_def_opline = def_opline;
746
1.47M
  zend_op *use_opline = &op_array->opcodes[end];
747
1.47M
  uint32_t kind;
748
749
1.47M
  switch (def_opline->opcode) {
750
    /* These should never be the first def. */
751
0
    case ZEND_ADD_ARRAY_ELEMENT:
752
0
    case ZEND_ADD_ARRAY_UNPACK:
753
0
    case ZEND_ROPE_ADD:
754
0
      ZEND_UNREACHABLE();
755
0
      return;
756
    /* Result is boolean, it doesn't have to be destroyed. */
757
0
    case ZEND_JMPZ_EX:
758
8
    case ZEND_JMPNZ_EX:
759
493
    case ZEND_BOOL:
760
2.92k
    case ZEND_BOOL_NOT:
761
    /* Classes don't have to be destroyed. */
762
3.63k
    case ZEND_FETCH_CLASS:
763
3.63k
    case ZEND_DECLARE_ANON_CLASS:
764
    /* FAST_CALLs don't have to be destroyed. */
765
6.21k
    case ZEND_FAST_CALL:
766
6.21k
      return;
767
910k
    case ZEND_BEGIN_SILENCE:
768
910k
      kind = ZEND_LIVE_SILENCE;
769
910k
      start++;
770
910k
      break;
771
59.2k
    case ZEND_ROPE_INIT:
772
59.2k
      kind = ZEND_LIVE_ROPE;
773
      /* ROPE live ranges include the generating opcode. */
774
59.2k
      def_opline--;
775
59.2k
      break;
776
32.0k
    case ZEND_FE_RESET_R:
777
34.1k
    case ZEND_FE_RESET_RW:
778
34.1k
      kind = ZEND_LIVE_LOOP;
779
34.1k
      start++;
780
34.1k
      break;
781
    /* Objects created via ZEND_NEW are only fully initialized
782
     * after the DO_FCALL (constructor call).
783
     * We are creating two live-ranges: ZEND_LINE_NEW for uninitialized
784
     * part, and ZEND_LIVE_TMPVAR for initialized.
785
     */
786
154k
    case ZEND_NEW:
787
154k
    {
788
154k
      int level = 0;
789
154k
      uint32_t orig_start = start;
790
791
383k
      while (def_opline + 1 < use_opline) {
792
383k
        def_opline++;
793
383k
        start++;
794
383k
        switch (def_opline->opcode) {
795
1.68k
          case ZEND_INIT_FCALL:
796
3.86k
          case ZEND_INIT_FCALL_BY_NAME:
797
4.12k
          case ZEND_INIT_NS_FCALL_BY_NAME:
798
4.59k
          case ZEND_INIT_DYNAMIC_CALL:
799
4.65k
          case ZEND_INIT_USER_CALL:
800
5.24k
          case ZEND_INIT_METHOD_CALL:
801
5.39k
          case ZEND_INIT_STATIC_METHOD_CALL:
802
5.39k
          case ZEND_INIT_PARENT_PROPERTY_HOOK_CALL:
803
12.8k
          case ZEND_NEW:
804
12.8k
            level++;
805
12.8k
            break;
806
163k
          case ZEND_DO_FCALL:
807
164k
          case ZEND_DO_FCALL_BY_NAME:
808
165k
          case ZEND_DO_ICALL:
809
166k
          case ZEND_DO_UCALL:
810
166k
            if (level == 0) {
811
154k
              goto done;
812
154k
            }
813
11.7k
            level--;
814
11.7k
            break;
815
383k
        }
816
383k
      }
817
154k
done:
818
154k
      emit_live_range_raw(op_array, var_num, ZEND_LIVE_NEW, orig_start + 1, start + 1);
819
154k
      if (start + 1 == end) {
820
        /* Trivial live-range, no need to store it. */
821
152k
        return;
822
152k
      }
823
154k
    }
824
2.39k
    ZEND_FALLTHROUGH;
825
262k
    default:
826
262k
      start++;
827
262k
      kind = ZEND_LIVE_TMPVAR;
828
829
      /* Check hook to determine whether a live range is necessary,
830
       * e.g. based on type info. */
831
262k
      if (needs_live_range && !needs_live_range(op_array, orig_def_opline)) {
832
2.08k
        return;
833
2.08k
      }
834
260k
      break;
835
260k
    case ZEND_COPY_TMP:
836
45.3k
    {
837
      /* COPY_TMP has a split live-range: One from the definition until the use in
838
       * "null" branch, and another from the start of the "non-null" branch to the
839
       * FREE opcode. */
840
45.3k
      uint32_t rt_var_num = EX_NUM_TO_VAR(op_array->last_var + var_num);
841
45.3k
      if (needs_live_range && !needs_live_range(op_array, orig_def_opline)) {
842
20
        return;
843
20
      }
844
845
45.3k
      kind = ZEND_LIVE_TMPVAR;
846
45.3k
      if (use_opline->opcode != ZEND_FREE) {
847
        /* This can happen if one branch of the coalesce has been optimized away.
848
         * In this case we should emit a normal live-range instead. */
849
32
        start++;
850
32
        break;
851
32
      }
852
853
45.3k
      zend_op *block_start_op = use_opline;
854
9.85M
      while ((block_start_op-1)->opcode == ZEND_FREE) {
855
9.80M
        block_start_op--;
856
9.80M
      }
857
858
45.3k
      start = block_start_op - op_array->opcodes;
859
45.3k
      if (start != end) {
860
39.6k
        emit_live_range_raw(op_array, var_num, kind, start, end);
861
39.6k
      }
862
863
19.8M
      do {
864
19.8M
        use_opline--;
865
866
        /* The use might have been optimized away, in which case we will hit the def
867
         * instead. */
868
19.8M
        if (use_opline->opcode == ZEND_COPY_TMP && use_opline->result.var == rt_var_num) {
869
8
          start = def_opline + 1 - op_array->opcodes;
870
8
          emit_live_range_raw(op_array, var_num, kind, start, end);
871
8
          return;
872
8
        }
873
19.8M
      } while (!(
874
19.8M
        ((use_opline->op1_type & (IS_TMP_VAR|IS_VAR)) && use_opline->op1.var == rt_var_num) ||
875
19.8M
        ((use_opline->op2_type & (IS_TMP_VAR|IS_VAR)) && use_opline->op2.var == rt_var_num)
876
19.8M
      ));
877
878
45.3k
      start = def_opline + 1 - op_array->opcodes;
879
45.3k
      end = use_opline - op_array->opcodes;
880
45.3k
      emit_live_range_raw(op_array, var_num, kind, start, end);
881
45.3k
      return;
882
45.3k
    }
883
1.47M
  }
884
885
1.26M
  emit_live_range_raw(op_array, var_num, kind, start, end);
886
1.26M
}
887
888
4.48M
static bool is_fake_def(zend_op *opline) {
889
  /* These opcodes only modify the result, not create it. */
890
4.48M
  return opline->opcode == ZEND_ROPE_ADD
891
4.48M
    || opline->opcode == ZEND_ADD_ARRAY_ELEMENT
892
4.48M
    || opline->opcode == ZEND_ADD_ARRAY_UNPACK;
893
4.48M
}
894
895
2.31M
static bool keeps_op1_alive(zend_op *opline) {
896
  /* These opcodes don't consume their OP1 operand,
897
   * it is later freed by something else. */
898
2.31M
  if (opline->opcode == ZEND_CASE
899
2.31M
   || opline->opcode == ZEND_CASE_STRICT
900
2.31M
   || opline->opcode == ZEND_SWITCH_LONG
901
2.31M
   || opline->opcode == ZEND_SWITCH_STRING
902
2.31M
   || opline->opcode == ZEND_MATCH
903
2.31M
   || opline->opcode == ZEND_MATCH_ERROR
904
2.31M
   || opline->opcode == ZEND_FETCH_LIST_R
905
2.31M
   || opline->opcode == ZEND_FETCH_LIST_W
906
2.31M
   || opline->opcode == ZEND_COPY_TMP) {
907
167
    return 1;
908
167
  }
909
2.31M
  ZEND_ASSERT(opline->opcode != ZEND_FE_FETCH_R
910
2.31M
    && opline->opcode != ZEND_FE_FETCH_RW
911
2.31M
    && opline->opcode != ZEND_VERIFY_RETURN_TYPE
912
2.31M
    && opline->opcode != ZEND_BIND_LEXICAL
913
2.31M
    && opline->opcode != ZEND_ROPE_ADD);
914
2.31M
  return 0;
915
2.31M
}
916
917
/* Live ranges must be sorted by increasing start opline */
918
11.9M
static int cmp_live_range(const zend_live_range *a, const zend_live_range *b) {
919
11.9M
  return a->start - b->start;
920
11.9M
}
921
3.44M
static void swap_live_range(zend_live_range *a, zend_live_range *b) {
922
3.44M
  uint32_t tmp;
923
3.44M
  tmp = a->var;
924
3.44M
  a->var = b->var;
925
3.44M
  b->var = tmp;
926
3.44M
  tmp = a->start;
927
3.44M
  a->start = b->start;
928
3.44M
  b->start = tmp;
929
3.44M
  tmp = a->end;
930
3.44M
  a->end = b->end;
931
3.44M
  b->end = tmp;
932
3.44M
}
933
934
static void zend_calc_live_ranges(
935
251k
    zend_op_array *op_array, zend_needs_live_range_cb needs_live_range) {
936
251k
  uint32_t opnum = op_array->last;
937
251k
  zend_op *opline = &op_array->opcodes[opnum];
938
251k
  ALLOCA_FLAG(use_heap)
939
251k
  uint32_t var_offset = op_array->last_var;
940
251k
  uint32_t *last_use = do_alloca(sizeof(uint32_t) * op_array->T, use_heap);
941
251k
  memset(last_use, -1, sizeof(uint32_t) * op_array->T);
942
943
251k
  ZEND_ASSERT(!op_array->live_range);
944
8.97M
  while (opnum > 0) {
945
8.71M
    opnum--;
946
8.71M
    opline--;
947
948
    /* SEPARATE always redeclares its op1. For the purposes of live-ranges,
949
     * its declaration is irrelevant. Don't terminate the current live-range
950
     * to avoid breaking special handling of COPY_TMP. */
951
8.71M
    if (opline->opcode == ZEND_SEPARATE) {
952
2.86k
      ZEND_ASSERT(opline->op1.var == opline->result.var);
953
2.86k
      continue;
954
2.86k
    }
955
956
8.71M
    if ((opline->result_type & (IS_TMP_VAR|IS_VAR)) && !is_fake_def(opline)) {
957
3.56M
      uint32_t var_num = EX_VAR_TO_NUM(opline->result.var) - var_offset;
958
      /* Defs without uses can occur for two reasons: Either because the result is
959
       * genuinely unused (e.g. omitted FREE opcode for an unused boolean result), or
960
       * because there are multiple defining opcodes (e.g. JMPZ_EX and QM_ASSIGN), in
961
       * which case the last one starts the live range. As such, we can simply ignore
962
       * missing uses here. */
963
3.56M
      if (EXPECTED(last_use[var_num] != (uint32_t) -1)) {
964
        /* Skip trivial live-range */
965
3.38M
        if (opnum + 1 != last_use[var_num]) {
966
1.46M
          uint32_t num;
967
968
1.46M
#if 1
969
          /* OP_DATA uses only op1 operand */
970
1.46M
          ZEND_ASSERT(opline->opcode != ZEND_OP_DATA);
971
1.46M
          num = opnum;
972
#else
973
          /* OP_DATA is really part of the previous opcode. */
974
          num = opnum - (opline->opcode == ZEND_OP_DATA);
975
#endif
976
1.46M
          emit_live_range(op_array, var_num, num, last_use[var_num], needs_live_range);
977
1.46M
        }
978
3.38M
        last_use[var_num] = (uint32_t) -1;
979
3.38M
      }
980
3.56M
    }
981
982
8.71M
    if ((opline->op1_type & (IS_TMP_VAR|IS_VAR))) {
983
3.31M
      uint32_t var_num = EX_VAR_TO_NUM(opline->op1.var) - var_offset;
984
3.31M
      if (EXPECTED(last_use[var_num] == (uint32_t) -1)) {
985
2.31M
        if (EXPECTED(!keeps_op1_alive(opline))) {
986
          /* OP_DATA is really part of the previous opcode. */
987
2.31M
          last_use[var_num] = opnum - (opline->opcode == ZEND_OP_DATA);
988
2.31M
        }
989
2.31M
      }
990
3.31M
    }
991
8.71M
    if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
992
1.11M
      uint32_t var_num = EX_VAR_TO_NUM(opline->op2.var) - var_offset;
993
1.11M
      if (UNEXPECTED(opline->opcode == ZEND_FE_FETCH_R
994
1.11M
          || opline->opcode == ZEND_FE_FETCH_RW)) {
995
        /* OP2 of FE_FETCH is actually a def, not a use. */
996
1.00k
        if (last_use[var_num] != (uint32_t) -1) {
997
1.00k
          if (opnum + 1 != last_use[var_num]) {
998
636
            emit_live_range(
999
636
              op_array, var_num, opnum, last_use[var_num], needs_live_range);
1000
636
          }
1001
1.00k
          last_use[var_num] = (uint32_t) -1;
1002
1.00k
        }
1003
1.11M
      } else if (EXPECTED(last_use[var_num] == (uint32_t) -1)) {
1004
1.07M
#if 1
1005
        /* OP_DATA uses only op1 operand */
1006
1.07M
        ZEND_ASSERT(opline->opcode != ZEND_OP_DATA);
1007
1.07M
        last_use[var_num] = opnum;
1008
#else
1009
        /* OP_DATA is really part of the previous opcode. */
1010
        last_use[var_num] = opnum - (opline->opcode == ZEND_OP_DATA);
1011
#endif
1012
1.07M
      }
1013
1.11M
    }
1014
8.71M
  }
1015
1016
251k
  if (op_array->last_live_range > 1) {
1017
77.7k
    zend_live_range *r1 = op_array->live_range;
1018
77.7k
    zend_live_range *r2 = r1 + op_array->last_live_range - 1;
1019
1020
    /* In most cases we need just revert the array */
1021
780k
    while (r1 < r2) {
1022
702k
      swap_live_range(r1, r2);
1023
702k
      r1++;
1024
702k
      r2--;
1025
702k
    }
1026
1027
77.7k
    r1 = op_array->live_range;
1028
77.7k
    r2 = r1 + op_array->last_live_range - 1;
1029
451k
    while (r1 < r2) {
1030
375k
      if (r1->start > (r1+1)->start) {
1031
2.69k
        zend_sort(r1, r2 - r1 + 1, sizeof(zend_live_range),
1032
2.69k
          (compare_func_t) cmp_live_range, (swap_func_t) swap_live_range);
1033
2.69k
        break;
1034
2.69k
      }
1035
373k
      r1++;
1036
373k
    }
1037
77.7k
  }
1038
1039
251k
  free_alloca(last_use, use_heap);
1040
251k
}
1041
1042
ZEND_API void zend_recalc_live_ranges(
1043
62.0k
    zend_op_array *op_array, zend_needs_live_range_cb needs_live_range) {
1044
  /* We assume that we never create live-ranges where there were none before. */
1045
62.0k
  ZEND_ASSERT(op_array->live_range);
1046
62.0k
  efree(op_array->live_range);
1047
62.0k
  op_array->live_range = NULL;
1048
62.0k
  op_array->last_live_range = 0;
1049
62.0k
  zend_calc_live_ranges(op_array, needs_live_range);
1050
62.0k
}
1051
1052
ZEND_API void pass_two(zend_op_array *op_array)
1053
189k
{
1054
189k
  zend_op *opline, *end;
1055
1056
189k
  if (!ZEND_USER_CODE(op_array->type)) {
1057
0
    return;
1058
0
  }
1059
189k
  if (CG(compiler_options) & ZEND_COMPILE_EXTENDED_STMT) {
1060
0
    zend_update_extended_stmts(op_array);
1061
0
  }
1062
189k
  if (CG(compiler_options) & ZEND_COMPILE_HANDLE_OP_ARRAY) {
1063
186k
    if (zend_extension_flags & ZEND_EXTENSIONS_HAVE_OP_ARRAY_HANDLER) {
1064
0
      zend_llist_apply_with_argument(&zend_extensions, (llist_apply_with_arg_func_t) zend_extension_op_array_handler, op_array);
1065
0
    }
1066
186k
  }
1067
1068
189k
  if (CG(context).vars_size != op_array->last_var) {
1069
110k
    op_array->vars = (zend_string**) erealloc(op_array->vars, sizeof(zend_string*)*op_array->last_var);
1070
110k
    CG(context).vars_size = op_array->last_var;
1071
110k
  }
1072
1073
#if ZEND_USE_ABS_CONST_ADDR
1074
  if (CG(context).opcodes_size != op_array->last) {
1075
    op_array->opcodes = (zend_op *) erealloc(op_array->opcodes, sizeof(zend_op)*op_array->last);
1076
    CG(context).opcodes_size = op_array->last;
1077
  }
1078
  if (CG(context).literals_size != op_array->last_literal) {
1079
    op_array->literals = (zval*)erealloc(op_array->literals, sizeof(zval) * op_array->last_literal);
1080
    CG(context).literals_size = op_array->last_literal;
1081
  }
1082
#else
1083
189k
  op_array->opcodes = (zend_op *) erealloc(op_array->opcodes,
1084
189k
    ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16) +
1085
189k
    sizeof(zval) * op_array->last_literal);
1086
189k
  if (op_array->literals) {
1087
189k
    memcpy(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16),
1088
189k
      op_array->literals, sizeof(zval) * op_array->last_literal);
1089
189k
    efree(op_array->literals);
1090
189k
    op_array->literals = (zval*)(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16));
1091
189k
  }
1092
189k
  CG(context).opcodes_size = op_array->last;
1093
189k
  CG(context).literals_size = op_array->last_literal;
1094
189k
#endif
1095
1096
189k
    op_array->T += ZEND_OBSERVER_ENABLED; // reserve last temporary for observers if enabled
1097
1098
  /* Needs to be set directly after the opcode/literal reallocation, to ensure destruction
1099
   * happens correctly if any of the following fixups generate a fatal error. */
1100
189k
  op_array->fn_flags |= ZEND_ACC_DONE_PASS_TWO;
1101
1102
189k
  opline = op_array->opcodes;
1103
189k
  end = opline + op_array->last;
1104
6.81M
  while (opline < end) {
1105
6.62M
    switch (opline->opcode) {
1106
5.63k
      case ZEND_RECV_INIT:
1107
5.63k
        {
1108
5.63k
          zval *val = CT_CONSTANT(opline->op2);
1109
5.63k
          if (Z_TYPE_P(val) == IS_CONSTANT_AST) {
1110
2.54k
            uint32_t slot = ZEND_MM_ALIGNED_SIZE_EX(op_array->cache_size, 8);
1111
2.54k
            Z_CACHE_SLOT_P(val) = slot;
1112
2.54k
            op_array->cache_size += sizeof(zval);
1113
2.54k
          }
1114
5.63k
        }
1115
5.63k
        break;
1116
5.42k
      case ZEND_FAST_CALL:
1117
5.42k
        opline->op1.opline_num = op_array->try_catch_array[opline->op1.num].finally_op;
1118
5.42k
        ZEND_PASS_TWO_UPDATE_JMP_TARGET(op_array, opline, opline->op1);
1119
5.42k
        break;
1120
1.09k
      case ZEND_BRK:
1121
2.13k
      case ZEND_CONT:
1122
2.13k
        {
1123
2.13k
          uint32_t jmp_target = zend_get_brk_cont_target(op_array, opline);
1124
1125
2.13k
          if (op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) {
1126
290
            zend_check_finally_breakout(op_array, opline - op_array->opcodes, jmp_target);
1127
290
          }
1128
2.13k
          opline->opcode = ZEND_JMP;
1129
2.13k
          opline->op1.opline_num = jmp_target;
1130
2.13k
          opline->op2.num = 0;
1131
2.13k
          ZEND_PASS_TWO_UPDATE_JMP_TARGET(op_array, opline, opline->op1);
1132
2.13k
        }
1133
2.13k
        break;
1134
1.12k
      case ZEND_GOTO:
1135
1.12k
        zend_resolve_goto_label(op_array, opline);
1136
1.12k
        if (op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) {
1137
616
          zend_check_finally_breakout(op_array, opline - op_array->opcodes, opline->op1.opline_num);
1138
616
        }
1139
1.12k
        ZEND_FALLTHROUGH;
1140
117k
      case ZEND_JMP:
1141
117k
        ZEND_PASS_TWO_UPDATE_JMP_TARGET(op_array, opline, opline->op1);
1142
117k
        break;
1143
25.3k
      case ZEND_JMPZ:
1144
52.2k
      case ZEND_JMPNZ:
1145
55.6k
      case ZEND_JMPZ_EX:
1146
57.9k
      case ZEND_JMPNZ_EX:
1147
60.2k
      case ZEND_JMP_SET:
1148
81.6k
      case ZEND_COALESCE:
1149
98.8k
      case ZEND_FE_RESET_R:
1150
100k
      case ZEND_FE_RESET_RW:
1151
155k
      case ZEND_JMP_NULL:
1152
155k
      case ZEND_BIND_INIT_STATIC_OR_JMP:
1153
158k
      case ZEND_JMP_FRAMELESS:
1154
158k
        ZEND_PASS_TWO_UPDATE_JMP_TARGET(op_array, opline, opline->op2);
1155
158k
        break;
1156
21.7k
      case ZEND_ASSERT_CHECK:
1157
21.7k
      {
1158
        /* If result of assert is unused, result of check is unused as well */
1159
21.7k
        zend_op *call = &op_array->opcodes[opline->op2.opline_num - 1];
1160
21.7k
        if (call->opcode == ZEND_EXT_FCALL_END) {
1161
0
          call--;
1162
0
        }
1163
21.7k
        if (call->result_type == IS_UNUSED) {
1164
5.20k
          opline->result_type = IS_UNUSED;
1165
5.20k
        }
1166
21.7k
        ZEND_PASS_TWO_UPDATE_JMP_TARGET(op_array, opline, opline->op2);
1167
21.7k
        break;
1168
155k
      }
1169
17.2k
      case ZEND_FE_FETCH_R:
1170
18.5k
      case ZEND_FE_FETCH_RW:
1171
        /* absolute index to relative offset */
1172
18.5k
        opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, opline->extended_value);
1173
18.5k
        break;
1174
52.5k
      case ZEND_CATCH:
1175
52.5k
        if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1176
10.0k
          ZEND_PASS_TWO_UPDATE_JMP_TARGET(op_array, opline, opline->op2);
1177
10.0k
        }
1178
52.5k
        break;
1179
217k
      case ZEND_RETURN:
1180
226k
      case ZEND_RETURN_BY_REF:
1181
226k
        if (op_array->fn_flags & ZEND_ACC_GENERATOR) {
1182
5.79k
          opline->opcode = ZEND_GENERATOR_RETURN;
1183
5.79k
        }
1184
226k
        break;
1185
32
      case ZEND_SWITCH_LONG:
1186
709
      case ZEND_SWITCH_STRING:
1187
1.48k
      case ZEND_MATCH:
1188
1.48k
      {
1189
        /* absolute indexes to relative offsets */
1190
1.48k
        HashTable *jumptable = Z_ARRVAL_P(CT_CONSTANT(opline->op2));
1191
1.48k
        zval *zv;
1192
9.42k
        ZEND_HASH_FOREACH_VAL(jumptable, zv) {
1193
9.42k
          Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, Z_LVAL_P(zv));
1194
9.42k
        } ZEND_HASH_FOREACH_END();
1195
1196
1.48k
        opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, opline->extended_value);
1197
1.48k
        break;
1198
709
      }
1199
6.62M
    }
1200
6.62M
    if (opline->op1_type == IS_CONST) {
1201
805k
      ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op1);
1202
5.81M
    } else if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1203
2.67M
      opline->op1.var = EX_NUM_TO_VAR(op_array->last_var + opline->op1.var);
1204
2.67M
    }
1205
6.62M
    if (opline->op2_type == IS_CONST) {
1206
1.23M
      ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op2);
1207
5.38M
    } else if (opline->op2_type & (IS_VAR|IS_TMP_VAR)) {
1208
693k
      opline->op2.var = EX_NUM_TO_VAR(op_array->last_var + opline->op2.var);
1209
693k
    }
1210
6.62M
    if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
1211
3.35M
      opline->result.var = EX_NUM_TO_VAR(op_array->last_var + opline->result.var);
1212
3.35M
    }
1213
6.62M
    ZEND_VM_SET_OPCODE_HANDLER(opline);
1214
6.62M
    opline++;
1215
6.62M
  }
1216
1217
189k
  zend_calc_live_ranges(op_array, NULL);
1218
1219
189k
  return;
1220
189k
}
1221
1222
ZEND_API unary_op_type get_unary_op(int opcode)
1223
35.6k
{
1224
35.6k
  switch (opcode) {
1225
5.30k
    case ZEND_BW_NOT:
1226
5.30k
      return (unary_op_type) bitwise_not_function;
1227
30.2k
    case ZEND_BOOL_NOT:
1228
30.2k
      return (unary_op_type) boolean_not_function;
1229
170
    default:
1230
170
      return (unary_op_type) NULL;
1231
35.6k
  }
1232
35.6k
}
1233
1234
ZEND_API binary_op_type get_binary_op(int opcode)
1235
164k
{
1236
164k
  switch (opcode) {
1237
14.4k
    case ZEND_ADD:
1238
14.4k
      return (binary_op_type) add_function;
1239
10.6k
    case ZEND_SUB:
1240
10.6k
      return (binary_op_type) sub_function;
1241
44.5k
    case ZEND_MUL:
1242
44.5k
      return (binary_op_type) mul_function;
1243
5.92k
    case ZEND_POW:
1244
5.92k
      return (binary_op_type) pow_function;
1245
7.78k
    case ZEND_DIV:
1246
7.78k
      return (binary_op_type) div_function;
1247
3.91k
    case ZEND_MOD:
1248
3.91k
      return (binary_op_type) mod_function;
1249
1.69k
    case ZEND_SL:
1250
1.69k
      return (binary_op_type) shift_left_function;
1251
1.79k
    case ZEND_SR:
1252
1.79k
      return (binary_op_type) shift_right_function;
1253
69
    case ZEND_FAST_CONCAT:
1254
10.6k
    case ZEND_CONCAT:
1255
10.6k
      return (binary_op_type) concat_function;
1256
2.49k
    case ZEND_IS_IDENTICAL:
1257
2.54k
    case ZEND_CASE_STRICT:
1258
2.54k
      return (binary_op_type) is_identical_function;
1259
849
    case ZEND_IS_NOT_IDENTICAL:
1260
849
      return (binary_op_type) is_not_identical_function;
1261
2.53k
    case ZEND_IS_EQUAL:
1262
2.54k
    case ZEND_CASE:
1263
2.54k
      return (binary_op_type) is_equal_function;
1264
1.37k
    case ZEND_IS_NOT_EQUAL:
1265
1.37k
      return (binary_op_type) is_not_equal_function;
1266
13.3k
    case ZEND_IS_SMALLER:
1267
13.3k
      return (binary_op_type) is_smaller_function;
1268
1.52k
    case ZEND_IS_SMALLER_OR_EQUAL:
1269
1.52k
      return (binary_op_type) is_smaller_or_equal_function;
1270
883
    case ZEND_SPACESHIP:
1271
883
      return (binary_op_type) compare_function;
1272
25.1k
    case ZEND_BW_OR:
1273
25.1k
      return (binary_op_type) bitwise_or_function;
1274
7.34k
    case ZEND_BW_AND:
1275
7.34k
      return (binary_op_type) bitwise_and_function;
1276
5.94k
    case ZEND_BW_XOR:
1277
5.94k
      return (binary_op_type) bitwise_xor_function;
1278
1.74k
    case ZEND_BOOL_XOR:
1279
1.74k
      return (binary_op_type) boolean_xor_function;
1280
0
    default:
1281
0
      ZEND_UNREACHABLE();
1282
0
      return (binary_op_type) NULL;
1283
164k
  }
1284
164k
}