Coverage Report

Created: 2025-07-23 06:33

/src/php-src/Zend/Optimizer/zend_optimizer.c
Line
Count
Source (jump to first uncovered line)
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Stanislav Malyshev <stas@zend.com>                          |
18
   |          Dmitry Stogov <dmitry@php.net>                              |
19
   +----------------------------------------------------------------------+
20
*/
21
22
#include "Optimizer/zend_optimizer.h"
23
#include "Optimizer/zend_optimizer_internal.h"
24
#include "zend_API.h"
25
#include "zend_constants.h"
26
#include "zend_execute.h"
27
#include "zend_vm.h"
28
#include "zend_cfg.h"
29
#include "zend_func_info.h"
30
#include "zend_call_graph.h"
31
#include "zend_inference.h"
32
#include "zend_dump.h"
33
#include "php.h"
34
35
#ifndef ZEND_OPTIMIZER_MAX_REGISTERED_PASSES
36
0
# define ZEND_OPTIMIZER_MAX_REGISTERED_PASSES 32
37
#endif
38
39
struct {
40
  zend_optimizer_pass_t pass[ZEND_OPTIMIZER_MAX_REGISTERED_PASSES];
41
  int last;
42
} zend_optimizer_registered_passes = {{NULL}, 0};
43
44
void zend_optimizer_collect_constant(zend_optimizer_ctx *ctx, zval *name, zval* value)
45
0
{
46
0
  if (!ctx->constants) {
47
0
    ctx->constants = zend_arena_alloc(&ctx->arena, sizeof(HashTable));
48
0
    zend_hash_init(ctx->constants, 16, NULL, zval_ptr_dtor_nogc, 0);
49
0
  }
50
51
0
  if (zend_hash_add(ctx->constants, Z_STR_P(name), value)) {
52
0
    Z_TRY_ADDREF_P(value);
53
0
  }
54
0
}
55
56
zend_result zend_optimizer_eval_binary_op(zval *result, uint8_t opcode, zval *op1, zval *op2) /* {{{ */
57
34.8k
{
58
34.8k
  if (zend_binary_op_produces_error(opcode, op1, op2)) {
59
31.2k
    return FAILURE;
60
31.2k
  }
61
62
3.54k
  binary_op_type binary_op = get_binary_op(opcode);
63
3.54k
  return binary_op(result, op1, op2);
64
34.8k
}
65
/* }}} */
66
67
zend_result zend_optimizer_eval_unary_op(zval *result, uint8_t opcode, zval *op1) /* {{{ */
68
3.67k
{
69
3.67k
  unary_op_type unary_op = get_unary_op(opcode);
70
71
3.67k
  if (unary_op) {
72
1.24k
    if (zend_unary_op_produces_error(opcode, op1)) {
73
955
      return FAILURE;
74
955
    }
75
286
    return unary_op(result, op1);
76
2.43k
  } else { /* ZEND_BOOL */
77
2.43k
    ZVAL_BOOL(result, zend_is_true(op1));
78
2.43k
    return SUCCESS;
79
2.43k
  }
80
3.67k
}
81
/* }}} */
82
83
zend_result zend_optimizer_eval_cast(zval *result, uint32_t type, zval *op1) /* {{{ */
84
13.0k
{
85
13.0k
  if (zend_try_ct_eval_cast(result, type, op1)) {
86
11.9k
    return SUCCESS;
87
11.9k
  }
88
1.03k
  return FAILURE;
89
13.0k
}
90
/* }}} */
91
92
zend_result zend_optimizer_eval_strlen(zval *result, const zval *op1) /* {{{ */
93
30
{
94
30
  if (Z_TYPE_P(op1) != IS_STRING) {
95
30
    return FAILURE;
96
30
  }
97
0
  ZVAL_LONG(result, Z_STRLEN_P(op1));
98
0
  return SUCCESS;
99
30
}
100
/* }}} */
101
102
zend_result zend_optimizer_eval_special_func_call(
103
0
    zval *result, zend_string *name, zend_string *arg) {
104
0
  if (zend_string_equals_literal(name, "function_exists") ||
105
0
      zend_string_equals_literal(name, "is_callable")) {
106
0
    zend_string *lc_name = zend_string_tolower(arg);
107
0
    zend_internal_function *func = zend_hash_find_ptr(EG(function_table), lc_name);
108
0
    zend_string_release_ex(lc_name, 0);
109
110
0
    if (func && func->type == ZEND_INTERNAL_FUNCTION
111
0
        && func->module->type == MODULE_PERSISTENT
112
#ifdef ZEND_WIN32
113
        && func->module->handle == NULL
114
#endif
115
0
    ) {
116
0
      ZVAL_TRUE(result);
117
0
      return SUCCESS;
118
0
    }
119
0
    return FAILURE;
120
0
  }
121
0
  if (zend_string_equals_literal(name, "extension_loaded")) {
122
0
    zend_string *lc_name = zend_string_tolower(arg);
123
0
    zend_module_entry *m = zend_hash_find_ptr(&module_registry, lc_name);
124
0
    zend_string_release_ex(lc_name, 0);
125
126
0
    if (!m) {
127
0
      if (PG(enable_dl)) {
128
0
        return FAILURE;
129
0
      }
130
0
      ZVAL_FALSE(result);
131
0
      return SUCCESS;
132
0
    }
133
134
0
    if (m->type == MODULE_PERSISTENT
135
#ifdef ZEND_WIN32
136
      && m->handle == NULL
137
#endif
138
0
    ) {
139
0
      ZVAL_TRUE(result);
140
0
      return SUCCESS;
141
0
    }
142
0
    return FAILURE;
143
0
  }
144
0
  if (zend_string_equals_literal(name, "constant")) {
145
0
    return zend_optimizer_get_persistent_constant(arg, result, 1) ? SUCCESS : FAILURE;
146
0
  }
147
0
  if (zend_string_equals_literal(name, "dirname")) {
148
0
    if (!IS_ABSOLUTE_PATH(ZSTR_VAL(arg), ZSTR_LEN(arg))) {
149
0
      return FAILURE;
150
0
    }
151
152
0
    zend_string *dirname = zend_string_init(ZSTR_VAL(arg), ZSTR_LEN(arg), 0);
153
0
    ZSTR_LEN(dirname) = zend_dirname(ZSTR_VAL(dirname), ZSTR_LEN(dirname));
154
0
    if (IS_ABSOLUTE_PATH(ZSTR_VAL(dirname), ZSTR_LEN(dirname))) {
155
0
      ZVAL_STR(result, dirname);
156
0
      return SUCCESS;
157
0
    }
158
0
    zend_string_release_ex(dirname, 0);
159
0
    return FAILURE;
160
0
  }
161
0
  if (zend_string_equals_literal(name, "ini_get")) {
162
0
    zend_ini_entry *ini_entry = zend_hash_find_ptr(EG(ini_directives), arg);
163
0
    if (!ini_entry) {
164
0
      if (PG(enable_dl)) {
165
0
        return FAILURE;
166
0
      }
167
0
      ZVAL_FALSE(result);
168
0
    } else if (ini_entry->modifiable != ZEND_INI_SYSTEM) {
169
0
      return FAILURE;
170
0
    } else if (ini_entry->value) {
171
0
      ZVAL_STR_COPY(result, ini_entry->value);
172
0
    } else {
173
0
      ZVAL_EMPTY_STRING(result);
174
0
    }
175
0
    return SUCCESS;
176
0
  }
177
0
  return FAILURE;
178
0
}
179
180
bool zend_optimizer_get_collected_constant(HashTable *constants, zval *name, zval* value)
181
0
{
182
0
  zval *val;
183
184
0
  if ((val = zend_hash_find(constants, Z_STR_P(name))) != NULL) {
185
0
    ZVAL_COPY(value, val);
186
0
    return 1;
187
0
  }
188
0
  return 0;
189
0
}
190
191
void zend_optimizer_convert_to_free_op1(zend_op_array *op_array, zend_op *opline)
192
6.52k
{
193
6.52k
  if (opline->op1_type == IS_CV) {
194
64
    opline->opcode = ZEND_CHECK_VAR;
195
64
    SET_UNUSED(opline->op2);
196
64
    SET_UNUSED(opline->result);
197
64
    opline->extended_value = 0;
198
6.46k
  } else if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
199
4.91k
    opline->opcode = ZEND_FREE;
200
4.91k
    SET_UNUSED(opline->op2);
201
4.91k
    SET_UNUSED(opline->result);
202
4.91k
    opline->extended_value = 0;
203
4.91k
  } else {
204
1.55k
    ZEND_ASSERT(opline->op1_type == IS_CONST);
205
1.55k
    literal_dtor(&ZEND_OP1_LITERAL(opline));
206
1.55k
    MAKE_NOP(opline);
207
1.55k
  }
208
6.52k
}
209
210
int zend_optimizer_add_literal(zend_op_array *op_array, const zval *zv)
211
31.5k
{
212
31.5k
  int i = op_array->last_literal;
213
31.5k
  op_array->last_literal++;
214
31.5k
  op_array->literals = (zval*)erealloc(op_array->literals, op_array->last_literal * sizeof(zval));
215
31.5k
  ZVAL_COPY_VALUE(&op_array->literals[i], zv);
216
31.5k
  Z_EXTRA(op_array->literals[i]) = 0;
217
31.5k
  return i;
218
31.5k
}
219
220
100
static inline int zend_optimizer_add_literal_string(zend_op_array *op_array, zend_string *str) {
221
100
  zval zv;
222
100
  ZVAL_STR(&zv, str);
223
100
  zend_string_hash_val(str);
224
100
  return zend_optimizer_add_literal(op_array, &zv);
225
100
}
226
227
98
static inline void drop_leading_backslash(zval *val) {
228
98
  if (Z_STRVAL_P(val)[0] == '\\') {
229
6
    zend_string *str = zend_string_init(Z_STRVAL_P(val) + 1, Z_STRLEN_P(val) - 1, 0);
230
6
    zval_ptr_dtor_nogc(val);
231
6
    ZVAL_STR(val, str);
232
6
  }
233
98
}
234
235
220
static inline uint32_t alloc_cache_slots(zend_op_array *op_array, uint32_t num) {
236
220
  uint32_t ret = op_array->cache_size;
237
220
  op_array->cache_size += num * sizeof(void *);
238
220
  return ret;
239
220
}
240
241
120
#define REQUIRES_STRING(val) do { \
242
120
  if (Z_TYPE_P(val) != IS_STRING) { \
243
20
    return 0; \
244
20
  } \
245
120
} while (0)
246
247
2.38k
#define TO_STRING_NOWARN(val) do { \
248
2.38k
  if (Z_TYPE_P(val) >= IS_ARRAY) { \
249
4
    return 0; \
250
4
  } \
251
2.38k
  convert_to_string(val); \
252
2.37k
} while (0)
253
254
bool zend_optimizer_update_op1_const(zend_op_array *op_array,
255
                                    zend_op       *opline,
256
                                    zval          *val)
257
13.0k
{
258
13.0k
  switch (opline->opcode) {
259
515
    case ZEND_OP_DATA:
260
515
      switch ((opline-1)->opcode) {
261
0
        case ZEND_ASSIGN_OBJ_REF:
262
0
        case ZEND_ASSIGN_STATIC_PROP_REF:
263
0
          return 0;
264
515
      }
265
515
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
266
515
      break;
267
1.05k
    case ZEND_FREE:
268
1.05k
    case ZEND_CHECK_VAR:
269
1.05k
      MAKE_NOP(opline);
270
1.05k
      zval_ptr_dtor_nogc(val);
271
1.05k
      return 1;
272
0
    case ZEND_SEND_VAR_EX:
273
0
    case ZEND_SEND_FUNC_ARG:
274
0
    case ZEND_FETCH_DIM_W:
275
0
    case ZEND_FETCH_DIM_RW:
276
8
    case ZEND_FETCH_DIM_FUNC_ARG:
277
8
    case ZEND_FETCH_DIM_UNSET:
278
8
    case ZEND_FETCH_LIST_W:
279
8
    case ZEND_ASSIGN_DIM:
280
42
    case ZEND_RETURN_BY_REF:
281
42
    case ZEND_INSTANCEOF:
282
42
    case ZEND_MAKE_REF:
283
48
    case ZEND_SEPARATE:
284
48
    case ZEND_SEND_VAR_NO_REF:
285
70
    case ZEND_SEND_VAR_NO_REF_EX:
286
70
      return 0;
287
0
    case ZEND_CATCH:
288
0
      REQUIRES_STRING(val);
289
0
      drop_leading_backslash(val);
290
0
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
291
0
      opline->extended_value = alloc_cache_slots(op_array, 1) | (opline->extended_value & ZEND_LAST_CATCH);
292
0
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
293
0
      break;
294
0
    case ZEND_DEFINED:
295
0
      REQUIRES_STRING(val);
296
0
      drop_leading_backslash(val);
297
0
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
298
0
      opline->extended_value = alloc_cache_slots(op_array, 1);
299
0
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
300
0
      break;
301
10
    case ZEND_NEW:
302
10
      REQUIRES_STRING(val);
303
10
      drop_leading_backslash(val);
304
10
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
305
10
      opline->op2.num = alloc_cache_slots(op_array, 1);
306
10
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
307
10
      break;
308
8
    case ZEND_INIT_STATIC_METHOD_CALL:
309
8
      REQUIRES_STRING(val);
310
8
      drop_leading_backslash(val);
311
8
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
312
8
      if (opline->op2_type != IS_CONST) {
313
0
        opline->result.num = alloc_cache_slots(op_array, 1);
314
0
      }
315
8
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
316
8
      break;
317
12
    case ZEND_FETCH_CLASS_CONSTANT:
318
12
      REQUIRES_STRING(val);
319
10
      drop_leading_backslash(val);
320
10
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
321
10
      if (opline->op2_type != IS_CONST) {
322
4
        opline->extended_value = alloc_cache_slots(op_array, 1);
323
4
      }
324
10
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
325
10
      break;
326
0
    case ZEND_ASSIGN_OP:
327
0
    case ZEND_ASSIGN_DIM_OP:
328
0
    case ZEND_ASSIGN_OBJ_OP:
329
0
      break;
330
0
    case ZEND_ASSIGN_STATIC_PROP_OP:
331
0
    case ZEND_ASSIGN_STATIC_PROP:
332
0
    case ZEND_ASSIGN_STATIC_PROP_REF:
333
4
    case ZEND_FETCH_STATIC_PROP_R:
334
4
    case ZEND_FETCH_STATIC_PROP_W:
335
4
    case ZEND_FETCH_STATIC_PROP_RW:
336
4
    case ZEND_FETCH_STATIC_PROP_IS:
337
4
    case ZEND_FETCH_STATIC_PROP_UNSET:
338
4
    case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
339
4
    case ZEND_UNSET_STATIC_PROP:
340
4
    case ZEND_ISSET_ISEMPTY_STATIC_PROP:
341
4
    case ZEND_PRE_INC_STATIC_PROP:
342
4
    case ZEND_PRE_DEC_STATIC_PROP:
343
4
    case ZEND_POST_INC_STATIC_PROP:
344
4
    case ZEND_POST_DEC_STATIC_PROP:
345
4
      TO_STRING_NOWARN(val);
346
4
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
347
4
      if (opline->op2_type == IS_CONST && (opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS) + sizeof(void*) == op_array->cache_size) {
348
0
        op_array->cache_size += sizeof(void *);
349
4
      } else {
350
4
        opline->extended_value = alloc_cache_slots(op_array, 3) | (opline->extended_value & ZEND_FETCH_OBJ_FLAGS);
351
4
      }
352
4
      break;
353
296
    case ZEND_SEND_VAR:
354
296
      opline->opcode = ZEND_SEND_VAL;
355
296
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
356
296
      break;
357
20
    case ZEND_CASE:
358
20
      opline->opcode = ZEND_IS_EQUAL;
359
20
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
360
20
      break;
361
2
    case ZEND_CASE_STRICT:
362
2
      opline->opcode = ZEND_IS_IDENTICAL;
363
2
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
364
2
      break;
365
0
    case ZEND_VERIFY_RETURN_TYPE:
366
      /* This would require a non-local change.
367
       * zend_optimizer_replace_by_const() supports this. */
368
0
      return 0;
369
0
    case ZEND_COPY_TMP:
370
8
    case ZEND_FETCH_CLASS_NAME:
371
8
      return 0;
372
1.08k
    case ZEND_ECHO:
373
1.08k
    {
374
1.08k
      zval zv;
375
1.08k
      if (Z_TYPE_P(val) != IS_STRING && zend_optimizer_eval_cast(&zv, IS_STRING, val) == SUCCESS) {
376
14
        zval_ptr_dtor_nogc(val);
377
14
        val = &zv;
378
14
      }
379
1.08k
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
380
1.08k
      if (Z_TYPE_P(val) == IS_STRING && Z_STRLEN_P(val) == 0) {
381
6
        MAKE_NOP(opline);
382
6
        return 1;
383
6
      }
384
      /* TODO: In a subsequent pass, *after* this step and compacting nops, combine consecutive ZEND_ECHOs using the block information from ssa->cfg */
385
      /* (e.g. for ext/opcache/tests/opt/sccp_010.phpt) */
386
1.08k
      break;
387
1.08k
    }
388
1.08k
    case ZEND_CONCAT:
389
99
    case ZEND_FAST_CONCAT:
390
103
    case ZEND_FETCH_R:
391
103
    case ZEND_FETCH_W:
392
103
    case ZEND_FETCH_RW:
393
103
    case ZEND_FETCH_IS:
394
103
    case ZEND_FETCH_UNSET:
395
103
    case ZEND_FETCH_FUNC_ARG:
396
107
    case ZEND_ISSET_ISEMPTY_VAR:
397
107
    case ZEND_UNSET_VAR:
398
107
      TO_STRING_NOWARN(val);
399
107
      if (opline->opcode == ZEND_CONCAT && opline->op2_type == IS_CONST) {
400
93
        opline->opcode = ZEND_FAST_CONCAT;
401
93
      }
402
107
      ZEND_FALLTHROUGH;
403
9.95k
    default:
404
9.95k
      opline->op1.constant = zend_optimizer_add_literal(op_array, val);
405
9.95k
      break;
406
13.0k
  }
407
408
11.9k
  opline->op1_type = IS_CONST;
409
11.9k
  if (Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_STRING) {
410
2.27k
    zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
411
2.27k
  }
412
11.9k
  return 1;
413
13.0k
}
414
415
bool zend_optimizer_update_op2_const(zend_op_array *op_array,
416
                                    zend_op       *opline,
417
                                    zval          *val)
418
5.46k
{
419
5.46k
  zval tmp;
420
421
5.46k
  switch (opline->opcode) {
422
74
    case ZEND_ASSIGN_REF:
423
74
    case ZEND_FAST_CALL:
424
74
      return 0;
425
52
    case ZEND_FETCH_CLASS:
426
52
    case ZEND_INSTANCEOF:
427
52
      REQUIRES_STRING(val);
428
38
      drop_leading_backslash(val);
429
38
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
430
38
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
431
38
      opline->extended_value = alloc_cache_slots(op_array, 1);
432
38
      break;
433
0
    case ZEND_INIT_FCALL_BY_NAME:
434
0
      REQUIRES_STRING(val);
435
0
      drop_leading_backslash(val);
436
0
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
437
0
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
438
0
      opline->result.num = alloc_cache_slots(op_array, 1);
439
0
      break;
440
0
    case ZEND_ASSIGN_STATIC_PROP:
441
0
    case ZEND_ASSIGN_STATIC_PROP_REF:
442
30
    case ZEND_FETCH_STATIC_PROP_R:
443
30
    case ZEND_FETCH_STATIC_PROP_W:
444
30
    case ZEND_FETCH_STATIC_PROP_RW:
445
30
    case ZEND_FETCH_STATIC_PROP_IS:
446
30
    case ZEND_FETCH_STATIC_PROP_UNSET:
447
36
    case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
448
36
    case ZEND_UNSET_STATIC_PROP:
449
36
    case ZEND_ISSET_ISEMPTY_STATIC_PROP:
450
36
    case ZEND_PRE_INC_STATIC_PROP:
451
36
    case ZEND_PRE_DEC_STATIC_PROP:
452
36
    case ZEND_POST_INC_STATIC_PROP:
453
36
    case ZEND_POST_DEC_STATIC_PROP:
454
36
    case ZEND_ASSIGN_STATIC_PROP_OP:
455
36
      REQUIRES_STRING(val);
456
32
      drop_leading_backslash(val);
457
32
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
458
32
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
459
32
      if (opline->op1_type != IS_CONST) {
460
0
        opline->extended_value = alloc_cache_slots(op_array, 1) | (opline->extended_value & (ZEND_RETURNS_FUNCTION|ZEND_ISEMPTY|ZEND_FETCH_OBJ_FLAGS));
461
0
      }
462
32
      break;
463
0
    case ZEND_INIT_FCALL:
464
0
      REQUIRES_STRING(val);
465
0
      if (Z_REFCOUNT_P(val) == 1) {
466
0
        zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
467
0
      } else {
468
0
        ZVAL_STR(&tmp, zend_string_tolower(Z_STR_P(val)));
469
0
        zval_ptr_dtor_nogc(val);
470
0
        val = &tmp;
471
0
      }
472
0
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
473
0
      opline->result.num = alloc_cache_slots(op_array, 1);
474
0
      break;
475
53
    case ZEND_INIT_DYNAMIC_CALL:
476
53
      if (Z_TYPE_P(val) == IS_STRING) {
477
22
        if (zend_memrchr(Z_STRVAL_P(val), ':', Z_STRLEN_P(val))) {
478
10
          return 0;
479
10
        }
480
481
12
        if (zend_optimizer_classify_function(Z_STR_P(val), opline->extended_value)) {
482
          /* Dynamic call to various special functions must stay dynamic,
483
           * otherwise would drop a warning */
484
12
          return 0;
485
12
        }
486
487
0
        opline->opcode = ZEND_INIT_FCALL_BY_NAME;
488
0
        drop_leading_backslash(val);
489
0
        opline->op2.constant = zend_optimizer_add_literal(op_array, val);
490
0
        zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
491
0
        opline->result.num = alloc_cache_slots(op_array, 1);
492
31
      } else {
493
31
        opline->op2.constant = zend_optimizer_add_literal(op_array, val);
494
31
      }
495
31
      break;
496
31
    case ZEND_INIT_METHOD_CALL:
497
0
      REQUIRES_STRING(val);
498
0
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
499
0
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
500
0
      opline->result.num = alloc_cache_slots(op_array, 2);
501
0
      break;
502
2
    case ZEND_INIT_STATIC_METHOD_CALL:
503
2
      REQUIRES_STRING(val);
504
2
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
505
2
      zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
506
2
      if (opline->op1_type != IS_CONST) {
507
2
        opline->result.num = alloc_cache_slots(op_array, 2);
508
2
      }
509
2
      break;
510
30
    case ZEND_ASSIGN_OBJ:
511
34
    case ZEND_ASSIGN_OBJ_REF:
512
60
    case ZEND_FETCH_OBJ_R:
513
60
    case ZEND_FETCH_OBJ_W:
514
60
    case ZEND_FETCH_OBJ_RW:
515
60
    case ZEND_FETCH_OBJ_IS:
516
60
    case ZEND_FETCH_OBJ_UNSET:
517
60
    case ZEND_FETCH_OBJ_FUNC_ARG:
518
60
    case ZEND_UNSET_OBJ:
519
60
    case ZEND_PRE_INC_OBJ:
520
68
    case ZEND_PRE_DEC_OBJ:
521
68
    case ZEND_POST_INC_OBJ:
522
68
    case ZEND_POST_DEC_OBJ:
523
68
      TO_STRING_NOWARN(val);
524
68
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
525
68
      opline->extended_value = alloc_cache_slots(op_array, 3);
526
68
      break;
527
94
    case ZEND_ASSIGN_OBJ_OP:
528
94
      TO_STRING_NOWARN(val);
529
94
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
530
94
      ZEND_ASSERT((opline + 1)->opcode == ZEND_OP_DATA);
531
94
      (opline + 1)->extended_value = alloc_cache_slots(op_array, 3);
532
94
      break;
533
0
    case ZEND_ISSET_ISEMPTY_PROP_OBJ:
534
0
      TO_STRING_NOWARN(val);
535
0
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
536
0
      opline->extended_value = alloc_cache_slots(op_array, 3) | (opline->extended_value & ZEND_ISEMPTY);
537
0
      break;
538
8
    case ZEND_ASSIGN_DIM_OP:
539
41
    case ZEND_ISSET_ISEMPTY_DIM_OBJ:
540
247
    case ZEND_ASSIGN_DIM:
541
325
    case ZEND_UNSET_DIM:
542
425
    case ZEND_FETCH_DIM_R:
543
469
    case ZEND_FETCH_DIM_W:
544
469
    case ZEND_FETCH_DIM_RW:
545
469
    case ZEND_FETCH_DIM_IS:
546
481
    case ZEND_FETCH_DIM_FUNC_ARG:
547
481
    case ZEND_FETCH_DIM_UNSET:
548
481
    case ZEND_FETCH_LIST_R:
549
481
    case ZEND_FETCH_LIST_W:
550
481
      if (Z_TYPE_P(val) == IS_STRING) {
551
196
        zend_ulong index;
552
553
196
        if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
554
148
          ZVAL_LONG(&tmp, index);
555
148
          opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
556
148
          zend_string_hash_val(Z_STR_P(val));
557
148
          zend_optimizer_add_literal(op_array, val);
558
148
          Z_EXTRA(op_array->literals[opline->op2.constant]) = ZEND_EXTRA_VALUE;
559
148
          break;
560
148
        }
561
196
      }
562
333
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
563
333
      break;
564
4
    case ZEND_ADD_ARRAY_ELEMENT:
565
8
    case ZEND_INIT_ARRAY:
566
8
      if (Z_TYPE_P(val) == IS_STRING) {
567
0
        zend_ulong index;
568
0
        if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
569
0
          zval_ptr_dtor_nogc(val);
570
0
          ZVAL_LONG(val, index);
571
0
        }
572
0
      }
573
8
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
574
8
      break;
575
0
    case ZEND_ROPE_INIT:
576
1.93k
    case ZEND_ROPE_ADD:
577
1.93k
    case ZEND_ROPE_END:
578
2.10k
    case ZEND_CONCAT:
579
2.10k
    case ZEND_FAST_CONCAT:
580
2.10k
      TO_STRING_NOWARN(val);
581
2.10k
      if (opline->opcode == ZEND_CONCAT && opline->op1_type == IS_CONST) {
582
30
        opline->opcode = ZEND_FAST_CONCAT;
583
30
      }
584
2.10k
      ZEND_FALLTHROUGH;
585
4.59k
    default:
586
4.59k
      opline->op2.constant = zend_optimizer_add_literal(op_array, val);
587
4.59k
      break;
588
5.46k
  }
589
590
5.34k
  opline->op2_type = IS_CONST;
591
5.34k
  if (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING) {
592
2.71k
    zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
593
2.71k
  }
594
5.34k
  return 1;
595
5.46k
}
596
597
bool zend_optimizer_replace_by_const(zend_op_array *op_array,
598
                                    zend_op       *opline,
599
                                    uint8_t        type,
600
                                    uint32_t       var,
601
                                    zval          *val)
602
2.43k
{
603
2.43k
  zend_op *end = op_array->opcodes + op_array->last;
604
605
2.47k
  while (opline < end) {
606
2.47k
    if (opline->op1_type == type &&
607
2.47k
      opline->op1.var == var) {
608
2.11k
      switch (opline->opcode) {
609
        /* In most cases IS_TMP_VAR operand may be used only once.
610
         * The operands are usually destroyed by the opcode handler.
611
         * However, there are some exception which keep the operand alive. In that case
612
         * we want to try to replace all uses of the temporary.
613
         */
614
0
        case ZEND_FETCH_LIST_R:
615
6
        case ZEND_CASE:
616
6
        case ZEND_CASE_STRICT:
617
6
        case ZEND_SWITCH_LONG:
618
6
        case ZEND_SWITCH_STRING:
619
6
        case ZEND_MATCH:
620
6
        case ZEND_MATCH_ERROR:
621
12
        case ZEND_JMP_NULL: {
622
12
          zend_op *end = op_array->opcodes + op_array->last;
623
54
          while (opline < end) {
624
54
            if (opline->op1_type == type && opline->op1.var == var) {
625
              /* If this opcode doesn't keep the operand alive, we're done. Check
626
               * this early, because op replacement may modify the opline. */
627
24
              bool is_last = opline->opcode != ZEND_FETCH_LIST_R
628
24
                && opline->opcode != ZEND_CASE
629
24
                && opline->opcode != ZEND_CASE_STRICT
630
24
                && opline->opcode != ZEND_SWITCH_LONG
631
24
                && opline->opcode != ZEND_SWITCH_STRING
632
24
                && opline->opcode != ZEND_MATCH
633
24
                && opline->opcode != ZEND_MATCH_ERROR
634
24
                && opline->opcode != ZEND_JMP_NULL
635
24
                && (opline->opcode != ZEND_FREE
636
12
                  || opline->extended_value != ZEND_FREE_ON_RETURN);
637
638
24
              Z_TRY_ADDREF_P(val);
639
24
              if (!zend_optimizer_update_op1_const(op_array, opline, val)) {
640
0
                zval_ptr_dtor(val);
641
0
                return 0;
642
0
              }
643
24
              if (is_last) {
644
12
                break;
645
12
              }
646
24
            }
647
42
            opline++;
648
42
          }
649
12
          zval_ptr_dtor_nogc(val);
650
12
          return 1;
651
12
        }
652
4
        case ZEND_VERIFY_RETURN_TYPE: {
653
4
          zend_arg_info *ret_info = op_array->arg_info - 1;
654
4
          if (!ZEND_TYPE_CONTAINS_CODE(ret_info->type, Z_TYPE_P(val))
655
4
            || (op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE)) {
656
0
            return 0;
657
0
          }
658
4
          MAKE_NOP(opline);
659
660
          /* zend_handle_loops_and_finally may inserts other oplines */
661
4
          do {
662
4
            ++opline;
663
4
          } while (opline->opcode != ZEND_RETURN && opline->opcode != ZEND_RETURN_BY_REF);
664
4
          ZEND_ASSERT(opline->op1.var == var);
665
666
4
          break;
667
4
        }
668
2.10k
        default:
669
2.10k
          break;
670
2.11k
      }
671
2.10k
      return zend_optimizer_update_op1_const(op_array, opline, val);
672
2.11k
    }
673
674
358
    if (opline->op2_type == type &&
675
358
      opline->op2.var == var) {
676
314
      return zend_optimizer_update_op2_const(op_array, opline, val);
677
314
    }
678
44
    opline++;
679
44
  }
680
681
0
  return 1;
682
2.43k
}
683
684
/* Update jump offsets after a jump was migrated to another opline */
685
32.7k
void zend_optimizer_migrate_jump(zend_op_array *op_array, zend_op *new_opline, zend_op *opline) {
686
32.7k
  switch (new_opline->opcode) {
687
3.58k
    case ZEND_JMP:
688
3.58k
    case ZEND_FAST_CALL:
689
3.58k
      ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op1, ZEND_OP1_JMP_ADDR(opline));
690
3.58k
      break;
691
1.98k
    case ZEND_JMPZ:
692
5.54k
    case ZEND_JMPNZ:
693
5.69k
    case ZEND_JMPZ_EX:
694
6.02k
    case ZEND_JMPNZ_EX:
695
6.29k
    case ZEND_FE_RESET_R:
696
6.29k
    case ZEND_FE_RESET_RW:
697
6.45k
    case ZEND_JMP_SET:
698
7.25k
    case ZEND_COALESCE:
699
7.28k
    case ZEND_ASSERT_CHECK:
700
11.4k
    case ZEND_JMP_NULL:
701
11.4k
    case ZEND_BIND_INIT_STATIC_OR_JMP:
702
11.4k
    case ZEND_JMP_FRAMELESS:
703
11.4k
      ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op2, ZEND_OP2_JMP_ADDR(opline));
704
11.4k
      break;
705
263
    case ZEND_FE_FETCH_R:
706
271
    case ZEND_FE_FETCH_RW:
707
271
      new_opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value));
708
271
      break;
709
0
    case ZEND_CATCH:
710
0
      if (!(opline->extended_value & ZEND_LAST_CATCH)) {
711
0
        ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op2, ZEND_OP2_JMP_ADDR(opline));
712
0
      }
713
0
      break;
714
0
    case ZEND_SWITCH_LONG:
715
0
    case ZEND_SWITCH_STRING:
716
0
    case ZEND_MATCH:
717
0
    {
718
0
      HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
719
0
      zval *zv;
720
0
      ZEND_HASH_FOREACH_VAL(jumptable, zv) {
721
0
        Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv)));
722
0
      } ZEND_HASH_FOREACH_END();
723
0
      new_opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value));
724
0
      break;
725
0
    }
726
32.7k
  }
727
32.7k
}
728
729
/* Shift jump offsets based on shiftlist */
730
51.7k
void zend_optimizer_shift_jump(zend_op_array *op_array, zend_op *opline, uint32_t *shiftlist) {
731
51.7k
  switch (opline->opcode) {
732
4.76k
    case ZEND_JMP:
733
4.76k
    case ZEND_FAST_CALL:
734
4.76k
      ZEND_SET_OP_JMP_ADDR(opline, opline->op1, ZEND_OP1_JMP_ADDR(opline) - shiftlist[ZEND_OP1_JMP_ADDR(opline) - op_array->opcodes]);
735
4.76k
      break;
736
2.58k
    case ZEND_JMPZ:
737
6.77k
    case ZEND_JMPNZ:
738
6.99k
    case ZEND_JMPZ_EX:
739
7.42k
    case ZEND_JMPNZ_EX:
740
7.80k
    case ZEND_FE_RESET_R:
741
7.82k
    case ZEND_FE_RESET_RW:
742
8.00k
    case ZEND_JMP_SET:
743
9.28k
    case ZEND_COALESCE:
744
9.41k
    case ZEND_ASSERT_CHECK:
745
20.1k
    case ZEND_JMP_NULL:
746
20.1k
    case ZEND_BIND_INIT_STATIC_OR_JMP:
747
20.1k
    case ZEND_JMP_FRAMELESS:
748
20.1k
      ZEND_SET_OP_JMP_ADDR(opline, opline->op2, ZEND_OP2_JMP_ADDR(opline) - shiftlist[ZEND_OP2_JMP_ADDR(opline) - op_array->opcodes]);
749
20.1k
      break;
750
0
    case ZEND_CATCH:
751
0
      if (!(opline->extended_value & ZEND_LAST_CATCH)) {
752
0
        ZEND_SET_OP_JMP_ADDR(opline, opline->op2, ZEND_OP2_JMP_ADDR(opline) - shiftlist[ZEND_OP2_JMP_ADDR(opline) - op_array->opcodes]);
753
0
      }
754
0
      break;
755
384
    case ZEND_FE_FETCH_R:
756
400
    case ZEND_FE_FETCH_RW:
757
400
      opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]);
758
400
      break;
759
0
    case ZEND_SWITCH_LONG:
760
8
    case ZEND_SWITCH_STRING:
761
44
    case ZEND_MATCH:
762
44
    {
763
44
      HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
764
44
      zval *zv;
765
288
      ZEND_HASH_FOREACH_VAL(jumptable, zv) {
766
288
        Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv)) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv))]);
767
288
      } ZEND_HASH_FOREACH_END();
768
44
      opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]);
769
44
      break;
770
8
    }
771
51.7k
  }
772
51.7k
}
773
774
static bool zend_optimizer_ignore_class(zval *ce_zv, zend_string *filename)
775
85.3k
{
776
85.3k
  zend_class_entry *ce = Z_PTR_P(ce_zv);
777
778
85.3k
  if (ce->ce_flags & ZEND_ACC_PRELOADED) {
779
0
    Bucket *ce_bucket = (Bucket*)((uintptr_t)ce_zv - XtOffsetOf(Bucket, val));
780
0
    size_t offset = ce_bucket - EG(class_table)->arData;
781
0
    if (offset < EG(persistent_classes_count)) {
782
0
      return false;
783
0
    }
784
0
  }
785
85.3k
  return ce->type == ZEND_USER_CLASS
786
85.3k
    && (!ce->info.user.filename || ce->info.user.filename != filename);
787
85.3k
}
788
789
static bool zend_optimizer_ignore_function(zval *fbc_zv, zend_string *filename)
790
182k
{
791
182k
  zend_function *fbc = Z_PTR_P(fbc_zv);
792
793
182k
  if (fbc->type == ZEND_INTERNAL_FUNCTION) {
794
182k
    return false;
795
182k
  } else if (fbc->type == ZEND_USER_FUNCTION) {
796
0
    if (fbc->op_array.fn_flags & ZEND_ACC_PRELOADED) {
797
0
      Bucket *fbc_bucket = (Bucket*)((uintptr_t)fbc_zv - XtOffsetOf(Bucket, val));
798
0
      size_t offset = fbc_bucket - EG(function_table)->arData;
799
0
      if (offset < EG(persistent_functions_count)) {
800
0
        return false;
801
0
      }
802
0
    }
803
0
    return !fbc->op_array.filename || fbc->op_array.filename != filename;
804
0
  } else {
805
0
    ZEND_ASSERT(fbc->type == ZEND_EVAL_CODE);
806
0
    return true;
807
0
  }
808
182k
}
809
810
zend_class_entry *zend_optimizer_get_class_entry(
811
155k
    const zend_script *script, const zend_op_array *op_array, zend_string *lcname) {
812
155k
  zend_class_entry *ce = script ? zend_hash_find_ptr(&script->class_table, lcname) : NULL;
813
155k
  if (ce) {
814
51.9k
    return ce;
815
51.9k
  }
816
817
103k
  zval *ce_zv = zend_hash_find(CG(class_table), lcname);
818
103k
  if (ce_zv && !zend_optimizer_ignore_class(ce_zv, op_array ? op_array->filename : NULL)) {
819
85.3k
    return Z_PTR_P(ce_zv);
820
85.3k
  }
821
822
18.0k
  if (op_array && op_array->scope && zend_string_equals_ci(op_array->scope->name, lcname)) {
823
99
    return op_array->scope;
824
99
  }
825
826
17.9k
  return NULL;
827
18.0k
}
828
829
zend_class_entry *zend_optimizer_get_class_entry_from_op1(
830
146k
    const zend_script *script, const zend_op_array *op_array, const zend_op *opline) {
831
146k
  if (opline->op1_type == IS_CONST) {
832
141k
    zval *op1 = CRT_CONSTANT(opline->op1);
833
141k
    if (Z_TYPE_P(op1) == IS_STRING) {
834
141k
      return zend_optimizer_get_class_entry(script, op_array, Z_STR_P(op1 + 1));
835
141k
    }
836
141k
  } else if (opline->op1_type == IS_UNUSED && op_array->scope
837
5.26k
      && !(op_array->scope->ce_flags & ZEND_ACC_TRAIT)
838
5.26k
      && ((opline->op1.num & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_SELF
839
1.36k
        || ((opline->op1.num & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_STATIC
840
829
          && (op_array->scope->ce_flags & ZEND_ACC_FINAL)))) {
841
574
    return op_array->scope;
842
574
  }
843
4.69k
  return NULL;
844
146k
}
845
846
const zend_class_constant *zend_fetch_class_const_info(
847
7.91k
  const zend_script *script, const zend_op_array *op_array, const zend_op *opline, bool *is_prototype) {
848
7.91k
  const zend_class_entry *ce = NULL;
849
7.91k
  bool is_static_reference = false;
850
851
7.91k
  if (!opline || !op_array || opline->op2_type != IS_CONST || Z_TYPE_P(CRT_CONSTANT(opline->op2)) != IS_STRING) {
852
144
    return NULL;
853
144
  }
854
7.76k
  if (opline->op1_type == IS_CONST) {
855
6.79k
    zval *op1 = CRT_CONSTANT(opline->op1);
856
6.79k
    if (Z_TYPE_P(op1) == IS_STRING) {
857
6.79k
      if (script) {
858
6.79k
        ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(op1 + 1));
859
6.79k
      } else {
860
0
        zval *ce_zv = zend_hash_find(EG(class_table), Z_STR_P(op1 + 1));
861
0
        if (ce_zv && !zend_optimizer_ignore_class(ce_zv, op_array->filename)) {
862
0
          ce = Z_PTR_P(ce_zv);
863
0
        }
864
0
      }
865
6.79k
    }
866
6.79k
  } else if (opline->op1_type == IS_UNUSED
867
974
    && op_array->scope && !(op_array->scope->ce_flags & ZEND_ACC_TRAIT)
868
974
    && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
869
369
    int fetch_type = opline->op1.num & ZEND_FETCH_CLASS_MASK;
870
369
    if (fetch_type == ZEND_FETCH_CLASS_SELF) {
871
241
      ce = op_array->scope;
872
241
    } else if (fetch_type == ZEND_FETCH_CLASS_STATIC) {
873
96
      ce = op_array->scope;
874
96
      is_static_reference = true;
875
96
    } else if (fetch_type == ZEND_FETCH_CLASS_PARENT) {
876
32
      if (op_array->scope->ce_flags & ZEND_ACC_LINKED) {
877
20
        ce = op_array->scope->parent;
878
20
      }
879
32
    }
880
369
  }
881
7.76k
  if (!ce || (ce->ce_flags & ZEND_ACC_TRAIT)) {
882
4.53k
    return NULL;
883
4.53k
  }
884
3.23k
  zend_class_constant *const_info = zend_hash_find_ptr(&ce->constants_table, Z_STR_P(CRT_CONSTANT(opline->op2)));
885
3.23k
  if (!const_info) {
886
428
    return NULL;
887
428
  }
888
2.80k
  if ((ZEND_CLASS_CONST_FLAGS(const_info) & ZEND_ACC_DEPRECATED)
889
2.80k
    || ((ZEND_CLASS_CONST_FLAGS(const_info) & ZEND_ACC_PPP_MASK) != ZEND_ACC_PUBLIC && const_info->ce != op_array->scope)) {
890
72
    return NULL;
891
72
  }
892
2.73k
  *is_prototype = is_static_reference
893
2.73k
    && !(const_info->ce->ce_flags & ZEND_ACC_FINAL) && !(ZEND_CLASS_CONST_FLAGS(const_info) & ZEND_ACC_FINAL);
894
895
2.73k
  return const_info;
896
2.80k
}
897
898
zend_function *zend_optimizer_get_called_func(
899
    zend_script *script, zend_op_array *op_array, zend_op *opline, bool *is_prototype)
900
408k
{
901
408k
  *is_prototype = 0;
902
408k
  switch (opline->opcode) {
903
224k
    case ZEND_INIT_FCALL:
904
224k
    {
905
224k
      zend_string *function_name = Z_STR_P(CRT_CONSTANT(opline->op2));
906
224k
      zend_function *func;
907
224k
      zval *func_zv;
908
224k
      if (script && (func = zend_hash_find_ptr(&script->function_table, function_name)) != NULL) {
909
41.8k
        return func;
910
182k
      } else if ((func_zv = zend_hash_find(EG(function_table), function_name)) != NULL) {
911
182k
        if (!zend_optimizer_ignore_function(func_zv, op_array->filename)) {
912
182k
          return Z_PTR_P(func_zv);
913
182k
        }
914
182k
      }
915
0
      break;
916
224k
    }
917
9.51k
    case ZEND_INIT_FCALL_BY_NAME:
918
12.5k
    case ZEND_INIT_NS_FCALL_BY_NAME:
919
12.5k
      if (opline->op2_type == IS_CONST && Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_STRING) {
920
12.5k
        zval *function_name = CRT_CONSTANT(opline->op2) + 1;
921
12.5k
        zend_function *func;
922
12.5k
        zval *func_zv;
923
12.5k
        if (script && (func = zend_hash_find_ptr(&script->function_table, Z_STR_P(function_name)))) {
924
1.49k
          return func;
925
11.0k
        } else if ((func_zv = zend_hash_find(EG(function_table), Z_STR_P(function_name))) != NULL) {
926
10
          if (!zend_optimizer_ignore_function(func_zv, op_array->filename)) {
927
10
            return Z_PTR_P(func_zv);
928
10
          }
929
10
        }
930
12.5k
      }
931
11.0k
      break;
932
12.7k
    case ZEND_INIT_STATIC_METHOD_CALL:
933
12.7k
      if (opline->op2_type == IS_CONST && Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_STRING) {
934
11.6k
        zend_class_entry *ce = zend_optimizer_get_class_entry_from_op1(
935
11.6k
          script, op_array, opline);
936
11.6k
        if (ce) {
937
8.47k
          zend_string *func_name = Z_STR_P(CRT_CONSTANT(opline->op2) + 1);
938
8.47k
          zend_function *fbc = zend_hash_find_ptr(&ce->function_table, func_name);
939
8.47k
          if (fbc) {
940
7.57k
            bool is_public = (fbc->common.fn_flags & ZEND_ACC_PUBLIC) != 0;
941
7.57k
            bool same_scope = fbc->common.scope == op_array->scope;
942
7.57k
            if (is_public || same_scope) {
943
7.39k
              return fbc;
944
7.39k
            }
945
7.57k
          }
946
8.47k
        }
947
11.6k
      }
948
5.35k
      break;
949
88.8k
    case ZEND_INIT_METHOD_CALL:
950
88.8k
      if (opline->op1_type == IS_UNUSED
951
88.8k
          && opline->op2_type == IS_CONST && Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_STRING
952
88.8k
          && op_array->scope
953
88.8k
          && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)
954
88.8k
          && !(op_array->scope->ce_flags & ZEND_ACC_TRAIT)) {
955
998
        zend_string *method_name = Z_STR_P(CRT_CONSTANT(opline->op2) + 1);
956
998
        zend_function *fbc = zend_hash_find_ptr(
957
998
          &op_array->scope->function_table, method_name);
958
998
        if (fbc) {
959
792
          bool is_private = (fbc->common.fn_flags & ZEND_ACC_PRIVATE) != 0;
960
792
          if (is_private) {
961
            /* Only use private method if in the same scope. We can't even use it
962
             * as a prototype, as it may be overridden with changed signature. */
963
184
            bool same_scope = fbc->common.scope == op_array->scope;
964
184
            return same_scope ? fbc : NULL;
965
184
          }
966
          /* Prototype methods are potentially overridden. fbc still contains useful type information.
967
           * Some optimizations may not be applied, like inlining or inferring the send-mode of superfluous args.
968
           * A method cannot be overridden if the class or method is final. */
969
608
          if ((fbc->common.fn_flags & ZEND_ACC_FINAL) == 0 &&
970
608
            (fbc->common.scope->ce_flags & ZEND_ACC_FINAL) == 0) {
971
600
            *is_prototype = true;
972
600
          }
973
608
          return fbc;
974
792
        }
975
998
      }
976
88.0k
      break;
977
88.0k
    case ZEND_INIT_PARENT_PROPERTY_HOOK_CALL: {
978
400
      zend_class_entry *scope = op_array->scope;
979
400
      ZEND_ASSERT(scope != NULL);
980
400
      if ((scope->ce_flags & ZEND_ACC_LINKED) && scope->parent) {
981
392
        zend_class_entry *parent_scope = scope->parent;
982
392
        zend_string *prop_name = Z_STR_P(CRT_CONSTANT(opline->op1));
983
392
        zend_property_hook_kind hook_kind = opline->op2.num;
984
392
        zend_property_info *prop_info = zend_get_property_info(parent_scope, prop_name, /* silent */ true);
985
986
392
        if (prop_info
987
392
          && prop_info != ZEND_WRONG_PROPERTY_INFO
988
392
          && !(prop_info->flags & ZEND_ACC_PRIVATE)
989
392
          && prop_info->hooks) {
990
156
          zend_function *fbc = prop_info->hooks[hook_kind];
991
156
          if (fbc) {
992
148
            *is_prototype = false;
993
148
            return fbc;
994
148
          }
995
156
        }
996
392
      }
997
252
      break;
998
400
    }
999
69.5k
    case ZEND_NEW:
1000
69.5k
    {
1001
69.5k
      zend_class_entry *ce = zend_optimizer_get_class_entry_from_op1(
1002
69.5k
        script, op_array, opline);
1003
69.5k
      if (ce && ce->type == ZEND_USER_CLASS) {
1004
13.6k
        return ce->constructor;
1005
13.6k
      }
1006
55.9k
      break;
1007
69.5k
    }
1008
408k
  }
1009
160k
  return NULL;
1010
408k
}
1011
1012
160k
uint32_t zend_optimizer_classify_function(zend_string *name, uint32_t num_args) {
1013
160k
  if (zend_string_equals_literal(name, "extract")) {
1014
44
    return ZEND_FUNC_INDIRECT_VAR_ACCESS;
1015
160k
  } else if (zend_string_equals_literal(name, "compact")) {
1016
82
    return ZEND_FUNC_INDIRECT_VAR_ACCESS;
1017
160k
  } else if (zend_string_equals_literal(name, "get_defined_vars")) {
1018
124
    return ZEND_FUNC_INDIRECT_VAR_ACCESS;
1019
160k
  } else if (zend_string_equals_literal(name, "db2_execute")) {
1020
0
    return ZEND_FUNC_INDIRECT_VAR_ACCESS;
1021
160k
  } else if (zend_string_equals_literal(name, "func_num_args")) {
1022
18
    return ZEND_FUNC_VARARG;
1023
160k
  } else if (zend_string_equals_literal(name, "func_get_arg")) {
1024
454
    return ZEND_FUNC_VARARG;
1025
160k
  } else if (zend_string_equals_literal(name, "func_get_args")) {
1026
62
    return ZEND_FUNC_VARARG;
1027
159k
  } else {
1028
159k
    return 0;
1029
159k
  }
1030
160k
}
1031
1032
108
zend_op *zend_optimizer_get_loop_var_def(const zend_op_array *op_array, zend_op *free_opline) {
1033
108
  uint32_t var = free_opline->op1.var;
1034
108
  ZEND_ASSERT(zend_optimizer_is_loop_var_free(free_opline));
1035
1036
1.07k
  while (--free_opline >= op_array->opcodes) {
1037
1.06k
    if ((free_opline->result_type & (IS_TMP_VAR|IS_VAR)) && free_opline->result.var == var) {
1038
106
      return free_opline;
1039
106
    }
1040
1.06k
  }
1041
2
  return NULL;
1042
108
}
1043
1044
static void zend_optimize(zend_op_array      *op_array,
1045
                          zend_optimizer_ctx *ctx)
1046
111k
{
1047
111k
  if (op_array->type == ZEND_EVAL_CODE) {
1048
0
    return;
1049
0
  }
1050
1051
111k
  if (ctx->debug_level & ZEND_DUMP_BEFORE_OPTIMIZER) {
1052
0
    zend_dump_op_array(op_array, ZEND_DUMP_LIVE_RANGES, "before optimizer", NULL);
1053
0
  }
1054
1055
  /* pass 1 (Simple local optimizations)
1056
   * - persistent constant substitution (true, false, null, etc)
1057
   * - constant casting (ADD expects numbers, CONCAT strings, etc)
1058
   * - constant expression evaluation
1059
   * - optimize constant conditional JMPs
1060
   * - pre-evaluate constant function calls
1061
   * - eliminate FETCH $GLOBALS followed by FETCH_DIM/UNSET_DIM/ISSET_ISEMPTY_DIM
1062
   */
1063
111k
  if (ZEND_OPTIMIZER_PASS_1 & ctx->optimization_level) {
1064
111k
    zend_optimizer_pass1(op_array, ctx);
1065
111k
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_1) {
1066
0
      zend_dump_op_array(op_array, 0, "after pass 1", NULL);
1067
0
    }
1068
111k
  }
1069
1070
  /* pass 3: (Jump optimization)
1071
   * - optimize series of JMPs
1072
   */
1073
111k
  if (ZEND_OPTIMIZER_PASS_3 & ctx->optimization_level) {
1074
111k
    zend_optimizer_pass3(op_array, ctx);
1075
111k
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_3) {
1076
0
      zend_dump_op_array(op_array, 0, "after pass 3", NULL);
1077
0
    }
1078
111k
  }
1079
1080
  /* pass 4:
1081
   * - INIT_FCALL_BY_NAME -> DO_FCALL
1082
   */
1083
111k
  if (ZEND_OPTIMIZER_PASS_4 & ctx->optimization_level) {
1084
111k
    zend_optimize_func_calls(op_array, ctx);
1085
111k
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_4) {
1086
0
      zend_dump_op_array(op_array, 0, "after pass 4", NULL);
1087
0
    }
1088
111k
  }
1089
1090
  /* pass 5:
1091
   * - CFG optimization
1092
   */
1093
111k
  if (ZEND_OPTIMIZER_PASS_5 & ctx->optimization_level) {
1094
111k
    zend_optimize_cfg(op_array, ctx);
1095
111k
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_5) {
1096
0
      zend_dump_op_array(op_array, 0, "after pass 5", NULL);
1097
0
    }
1098
111k
  }
1099
1100
  /* pass 6:
1101
   * - DFA optimization
1102
   */
1103
111k
  if ((ZEND_OPTIMIZER_PASS_6 & ctx->optimization_level) &&
1104
111k
      !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level)) {
1105
0
    zend_optimize_dfa(op_array, ctx);
1106
0
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_6) {
1107
0
      zend_dump_op_array(op_array, 0, "after pass 6", NULL);
1108
0
    }
1109
0
  }
1110
1111
  /* pass 9:
1112
   * - Optimize temp variables usage
1113
   */
1114
111k
  if ((ZEND_OPTIMIZER_PASS_9 & ctx->optimization_level) &&
1115
111k
      !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level)) {
1116
0
    zend_optimize_temporary_variables(op_array, ctx);
1117
0
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_9) {
1118
0
      zend_dump_op_array(op_array, 0, "after pass 9", NULL);
1119
0
    }
1120
0
  }
1121
1122
  /* pass 10:
1123
   * - remove NOPs
1124
   */
1125
111k
  if (((ZEND_OPTIMIZER_PASS_10|ZEND_OPTIMIZER_PASS_5) & ctx->optimization_level) == ZEND_OPTIMIZER_PASS_10) {
1126
0
    zend_optimizer_nop_removal(op_array, ctx);
1127
0
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_10) {
1128
0
      zend_dump_op_array(op_array, 0, "after pass 10", NULL);
1129
0
    }
1130
0
  }
1131
1132
  /* pass 11:
1133
   * - Compact literals table
1134
   */
1135
111k
  if ((ZEND_OPTIMIZER_PASS_11 & ctx->optimization_level) &&
1136
111k
      (!(ZEND_OPTIMIZER_PASS_6 & ctx->optimization_level) ||
1137
111k
       !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level))) {
1138
0
    zend_optimizer_compact_literals(op_array, ctx);
1139
0
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_11) {
1140
0
      zend_dump_op_array(op_array, 0, "after pass 11", NULL);
1141
0
    }
1142
0
  }
1143
1144
111k
  if ((ZEND_OPTIMIZER_PASS_13 & ctx->optimization_level) &&
1145
111k
      (!(ZEND_OPTIMIZER_PASS_6 & ctx->optimization_level) ||
1146
111k
       !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level))) {
1147
0
    zend_optimizer_compact_vars(op_array);
1148
0
    if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_13) {
1149
0
      zend_dump_op_array(op_array, 0, "after pass 13", NULL);
1150
0
    }
1151
0
  }
1152
1153
111k
  if (ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level) {
1154
111k
    return;
1155
111k
  }
1156
1157
0
  if (ctx->debug_level & ZEND_DUMP_AFTER_OPTIMIZER) {
1158
0
    zend_dump_op_array(op_array, 0, "after optimizer", NULL);
1159
0
  }
1160
0
}
1161
1162
static void zend_revert_pass_two(zend_op_array *op_array)
1163
111k
{
1164
111k
  zend_op *opline, *end;
1165
1166
111k
  ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO) != 0);
1167
1168
111k
  opline = op_array->opcodes;
1169
111k
  end = opline + op_array->last;
1170
3.05M
  while (opline < end) {
1171
2.94M
    if (opline->op1_type == IS_CONST) {
1172
505k
      ZEND_PASS_TWO_UNDO_CONSTANT(op_array, opline, opline->op1);
1173
505k
    }
1174
2.94M
    if (opline->op2_type == IS_CONST) {
1175
710k
      ZEND_PASS_TWO_UNDO_CONSTANT(op_array, opline, opline->op2);
1176
710k
    }
1177
    /* reset smart branch flags IS_SMART_BRANCH_JMP[N]Z */
1178
2.94M
    opline->result_type &= (IS_TMP_VAR|IS_VAR|IS_CV|IS_CONST);
1179
2.94M
    opline++;
1180
2.94M
  }
1181
111k
#if !ZEND_USE_ABS_CONST_ADDR
1182
111k
  if (op_array->literals) {
1183
111k
    zval *literals = emalloc(sizeof(zval) * op_array->last_literal);
1184
111k
    memcpy(literals, op_array->literals, sizeof(zval) * op_array->last_literal);
1185
111k
    op_array->literals = literals;
1186
111k
  }
1187
111k
#endif
1188
1189
111k
  op_array->fn_flags &= ~ZEND_ACC_DONE_PASS_TWO;
1190
111k
}
1191
1192
static void zend_redo_pass_two(zend_op_array *op_array)
1193
33.2k
{
1194
33.2k
  zend_op *opline, *end;
1195
#if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1196
  zend_op *old_opcodes = op_array->opcodes;
1197
#endif
1198
1199
33.2k
  ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO) == 0);
1200
1201
33.2k
#if !ZEND_USE_ABS_CONST_ADDR
1202
33.2k
  if (op_array->last_literal) {
1203
33.2k
    op_array->opcodes = (zend_op *) erealloc(op_array->opcodes,
1204
33.2k
      ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16) +
1205
33.2k
      sizeof(zval) * op_array->last_literal);
1206
33.2k
    memcpy(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16),
1207
33.2k
      op_array->literals, sizeof(zval) * op_array->last_literal);
1208
33.2k
    efree(op_array->literals);
1209
33.2k
    op_array->literals = (zval*)(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16));
1210
33.2k
  } else {
1211
20
    if (op_array->literals) {
1212
20
      efree(op_array->literals);
1213
20
    }
1214
20
    op_array->literals = NULL;
1215
20
  }
1216
33.2k
#endif
1217
1218
33.2k
  opline = op_array->opcodes;
1219
33.2k
  end = opline + op_array->last;
1220
1.14M
  while (opline < end) {
1221
1.10M
    if (opline->op1_type == IS_CONST) {
1222
246k
      ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op1);
1223
246k
    }
1224
1.10M
    if (opline->op2_type == IS_CONST) {
1225
199k
      ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op2);
1226
199k
    }
1227
    /* fix jumps to point to new array */
1228
1.10M
    switch (opline->opcode) {
1229
#if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1230
      case ZEND_JMP:
1231
      case ZEND_FAST_CALL:
1232
        opline->op1.jmp_addr = &op_array->opcodes[opline->op1.jmp_addr - old_opcodes];
1233
        break;
1234
      case ZEND_JMPZ:
1235
      case ZEND_JMPNZ:
1236
      case ZEND_JMPZ_EX:
1237
      case ZEND_JMPNZ_EX:
1238
      case ZEND_JMP_SET:
1239
      case ZEND_COALESCE:
1240
      case ZEND_FE_RESET_R:
1241
      case ZEND_FE_RESET_RW:
1242
      case ZEND_ASSERT_CHECK:
1243
      case ZEND_JMP_NULL:
1244
      case ZEND_BIND_INIT_STATIC_OR_JMP:
1245
      case ZEND_JMP_FRAMELESS:
1246
        opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1247
        break;
1248
      case ZEND_CATCH:
1249
        if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1250
          opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1251
        }
1252
        break;
1253
      case ZEND_FE_FETCH_R:
1254
      case ZEND_FE_FETCH_RW:
1255
      case ZEND_SWITCH_LONG:
1256
      case ZEND_SWITCH_STRING:
1257
      case ZEND_MATCH:
1258
        /* relative extended_value don't have to be changed */
1259
        break;
1260
#endif
1261
154
      case ZEND_IS_IDENTICAL:
1262
202
      case ZEND_IS_NOT_IDENTICAL:
1263
11.2k
      case ZEND_IS_EQUAL:
1264
11.6k
      case ZEND_IS_NOT_EQUAL:
1265
13.9k
      case ZEND_IS_SMALLER:
1266
14.6k
      case ZEND_IS_SMALLER_OR_EQUAL:
1267
14.6k
      case ZEND_CASE:
1268
14.6k
      case ZEND_CASE_STRICT:
1269
14.6k
      case ZEND_ISSET_ISEMPTY_CV:
1270
14.8k
      case ZEND_ISSET_ISEMPTY_VAR:
1271
15.1k
      case ZEND_ISSET_ISEMPTY_DIM_OBJ:
1272
15.3k
      case ZEND_ISSET_ISEMPTY_PROP_OBJ:
1273
15.3k
      case ZEND_ISSET_ISEMPTY_STATIC_PROP:
1274
15.4k
      case ZEND_INSTANCEOF:
1275
15.6k
      case ZEND_TYPE_CHECK:
1276
15.6k
      case ZEND_DEFINED:
1277
15.6k
      case ZEND_IN_ARRAY:
1278
15.6k
      case ZEND_ARRAY_KEY_EXISTS:
1279
15.6k
        if (opline->result_type & IS_TMP_VAR) {
1280
          /* reinitialize result_type of smart branch instructions */
1281
15.6k
          if (opline + 1 < end) {
1282
15.6k
            if ((opline+1)->opcode == ZEND_JMPZ
1283
15.6k
             && (opline+1)->op1_type == IS_TMP_VAR
1284
15.6k
             && (opline+1)->op1.var == opline->result.var) {
1285
10.9k
              opline->result_type = IS_SMART_BRANCH_JMPZ | IS_TMP_VAR;
1286
10.9k
            } else if ((opline+1)->opcode == ZEND_JMPNZ
1287
4.76k
             && (opline+1)->op1_type == IS_TMP_VAR
1288
4.76k
             && (opline+1)->op1.var == opline->result.var) {
1289
1.85k
              opline->result_type = IS_SMART_BRANCH_JMPNZ | IS_TMP_VAR;
1290
1.85k
            }
1291
15.6k
          }
1292
15.6k
        }
1293
15.6k
        break;
1294
1.10M
    }
1295
1.10M
    ZEND_VM_SET_OPCODE_HANDLER(opline);
1296
1.10M
    opline++;
1297
1.10M
  }
1298
1299
33.2k
  op_array->fn_flags |= ZEND_ACC_DONE_PASS_TWO;
1300
33.2k
}
1301
1302
static void zend_redo_pass_two_ex(zend_op_array *op_array, zend_ssa *ssa)
1303
78.5k
{
1304
78.5k
  zend_op *opline, *end;
1305
#if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1306
  zend_op *old_opcodes = op_array->opcodes;
1307
#endif
1308
1309
78.5k
  ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO) == 0);
1310
1311
78.5k
#if !ZEND_USE_ABS_CONST_ADDR
1312
78.5k
  if (op_array->last_literal) {
1313
76.7k
    op_array->opcodes = (zend_op *) erealloc(op_array->opcodes,
1314
76.7k
      ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16) +
1315
76.7k
      sizeof(zval) * op_array->last_literal);
1316
76.7k
    memcpy(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16),
1317
76.7k
      op_array->literals, sizeof(zval) * op_array->last_literal);
1318
76.7k
    efree(op_array->literals);
1319
76.7k
    op_array->literals = (zval*)(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16));
1320
76.7k
  } else {
1321
1.80k
    if (op_array->literals) {
1322
1.79k
      efree(op_array->literals);
1323
1.79k
    }
1324
1.80k
    op_array->literals = NULL;
1325
1.80k
  }
1326
78.5k
#endif
1327
1328
78.5k
  opline = op_array->opcodes;
1329
78.5k
  end = opline + op_array->last;
1330
1.79M
  while (opline < end) {
1331
1.71M
    zend_ssa_op *ssa_op = &ssa->ops[opline - op_array->opcodes];
1332
1.71M
    uint32_t op1_info = opline->op1_type == IS_UNUSED ? 0 : (OP1_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY));
1333
1.71M
    uint32_t op2_info = opline->op1_type == IS_UNUSED ? 0 : (OP2_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY));
1334
1.71M
    uint32_t res_info =
1335
1.71M
      (opline->opcode == ZEND_PRE_INC ||
1336
1.71M
       opline->opcode == ZEND_PRE_DEC ||
1337
1.71M
       opline->opcode == ZEND_POST_INC ||
1338
1.71M
       opline->opcode == ZEND_POST_DEC) ?
1339
6.43k
        ((ssa->ops[opline - op_array->opcodes].op1_def >= 0) ? (OP1_DEF_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY)) : MAY_BE_ANY) :
1340
1.71M
        (opline->result_type == IS_UNUSED ? 0 : (RES_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY)));
1341
1342
1.71M
    if (opline->op1_type == IS_CONST) {
1343
243k
      ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op1);
1344
243k
    }
1345
1.71M
    if (opline->op2_type == IS_CONST) {
1346
497k
      ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op2);
1347
497k
    }
1348
1349
    /* fix jumps to point to new array */
1350
1.71M
    switch (opline->opcode) {
1351
#if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1352
      case ZEND_JMP:
1353
      case ZEND_FAST_CALL:
1354
        opline->op1.jmp_addr = &op_array->opcodes[opline->op1.jmp_addr - old_opcodes];
1355
        break;
1356
      case ZEND_JMPZ:
1357
      case ZEND_JMPNZ:
1358
      case ZEND_JMPZ_EX:
1359
      case ZEND_JMPNZ_EX:
1360
      case ZEND_JMP_SET:
1361
      case ZEND_COALESCE:
1362
      case ZEND_FE_RESET_R:
1363
      case ZEND_FE_RESET_RW:
1364
      case ZEND_ASSERT_CHECK:
1365
      case ZEND_JMP_NULL:
1366
      case ZEND_BIND_INIT_STATIC_OR_JMP:
1367
      case ZEND_JMP_FRAMELESS:
1368
        opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1369
        break;
1370
      case ZEND_CATCH:
1371
        if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1372
          opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1373
        }
1374
        break;
1375
      case ZEND_FE_FETCH_R:
1376
      case ZEND_FE_FETCH_RW:
1377
      case ZEND_SWITCH_LONG:
1378
      case ZEND_SWITCH_STRING:
1379
      case ZEND_MATCH:
1380
        /* relative extended_value don't have to be changed */
1381
        break;
1382
#endif
1383
1.81k
      case ZEND_IS_IDENTICAL:
1384
2.39k
      case ZEND_IS_NOT_IDENTICAL:
1385
5.32k
      case ZEND_IS_EQUAL:
1386
7.16k
      case ZEND_IS_NOT_EQUAL:
1387
16.1k
      case ZEND_IS_SMALLER:
1388
18.1k
      case ZEND_IS_SMALLER_OR_EQUAL:
1389
18.1k
      case ZEND_CASE:
1390
18.2k
      case ZEND_CASE_STRICT:
1391
18.3k
      case ZEND_ISSET_ISEMPTY_CV:
1392
18.3k
      case ZEND_ISSET_ISEMPTY_VAR:
1393
20.3k
      case ZEND_ISSET_ISEMPTY_DIM_OBJ:
1394
20.9k
      case ZEND_ISSET_ISEMPTY_PROP_OBJ:
1395
21.0k
      case ZEND_ISSET_ISEMPTY_STATIC_PROP:
1396
21.3k
      case ZEND_INSTANCEOF:
1397
22.1k
      case ZEND_TYPE_CHECK:
1398
22.2k
      case ZEND_DEFINED:
1399
22.2k
      case ZEND_IN_ARRAY:
1400
22.3k
      case ZEND_ARRAY_KEY_EXISTS:
1401
22.3k
        if (opline->result_type & IS_TMP_VAR) {
1402
          /* reinitialize result_type of smart branch instructions */
1403
22.1k
          if (opline + 1 < end) {
1404
22.1k
            if ((opline+1)->opcode == ZEND_JMPZ
1405
22.1k
             && (opline+1)->op1_type == IS_TMP_VAR
1406
22.1k
             && (opline+1)->op1.var == opline->result.var) {
1407
4.76k
              opline->result_type = IS_SMART_BRANCH_JMPZ | IS_TMP_VAR;
1408
17.3k
            } else if ((opline+1)->opcode == ZEND_JMPNZ
1409
17.3k
             && (opline+1)->op1_type == IS_TMP_VAR
1410
17.3k
             && (opline+1)->op1.var == opline->result.var) {
1411
5.32k
              opline->result_type = IS_SMART_BRANCH_JMPNZ | IS_TMP_VAR;
1412
5.32k
            }
1413
22.1k
          }
1414
22.1k
        }
1415
22.3k
        break;
1416
1.71M
    }
1417
#ifdef ZEND_VERIFY_TYPE_INFERENCE
1418
    if (ssa_op->op1_use >= 0) {
1419
      opline->op1_use_type = ssa->var_info[ssa_op->op1_use].type;
1420
    }
1421
    if (ssa_op->op2_use >= 0) {
1422
      opline->op2_use_type = ssa->var_info[ssa_op->op2_use].type;
1423
    }
1424
    if (ssa_op->result_use >= 0) {
1425
      opline->result_use_type = ssa->var_info[ssa_op->result_use].type;
1426
    }
1427
    if (ssa_op->op1_def >= 0) {
1428
      opline->op1_def_type = ssa->var_info[ssa_op->op1_def].type;
1429
    }
1430
    if (ssa_op->op2_def >= 0) {
1431
      opline->op2_def_type = ssa->var_info[ssa_op->op2_def].type;
1432
    }
1433
    if (ssa_op->result_def >= 0) {
1434
      opline->result_def_type = ssa->var_info[ssa_op->result_def].type;
1435
    }
1436
#endif
1437
1.71M
    zend_vm_set_opcode_handler_ex(opline, op1_info, op2_info, res_info);
1438
1.71M
    opline++;
1439
1.71M
  }
1440
1441
78.5k
  op_array->fn_flags |= ZEND_ACC_DONE_PASS_TWO;
1442
78.5k
}
1443
1444
static void zend_optimize_op_array(zend_op_array      *op_array,
1445
                                   zend_optimizer_ctx *ctx)
1446
0
{
1447
  /* Revert pass_two() */
1448
0
  zend_revert_pass_two(op_array);
1449
1450
  /* Do actual optimizations */
1451
0
  zend_optimize(op_array, ctx);
1452
1453
  /* Redo pass_two() */
1454
0
  zend_redo_pass_two(op_array);
1455
1456
0
  if (op_array->live_range) {
1457
0
    zend_recalc_live_ranges(op_array, NULL);
1458
0
  }
1459
0
}
1460
1461
static void zend_adjust_fcall_stack_size(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1462
0
{
1463
0
  zend_function *func;
1464
0
  zend_op *opline, *end;
1465
1466
0
  opline = op_array->opcodes;
1467
0
  end = opline + op_array->last;
1468
0
  while (opline < end) {
1469
0
    if (opline->opcode == ZEND_INIT_FCALL) {
1470
0
      func = zend_hash_find_ptr(
1471
0
        &ctx->script->function_table,
1472
0
        Z_STR_P(RT_CONSTANT(opline, opline->op2)));
1473
0
      if (func) {
1474
0
        opline->op1.num = zend_vm_calc_used_stack(opline->extended_value, func);
1475
0
      }
1476
0
    }
1477
0
    opline++;
1478
0
  }
1479
0
}
1480
1481
static void zend_adjust_fcall_stack_size_graph(zend_op_array *op_array)
1482
111k
{
1483
111k
  zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
1484
1485
111k
  if (func_info) {
1486
78.5k
    zend_call_info *call_info =func_info->callee_info;
1487
1488
161k
    while (call_info) {
1489
82.8k
      zend_op *opline = call_info->caller_init_opline;
1490
1491
82.8k
      if (opline && call_info->callee_func && opline->opcode == ZEND_INIT_FCALL) {
1492
79.2k
        ZEND_ASSERT(!call_info->is_prototype);
1493
79.2k
        opline->op1.num = zend_vm_calc_used_stack(opline->extended_value, call_info->callee_func);
1494
79.2k
      }
1495
82.8k
      call_info = call_info->next_callee;
1496
82.8k
    }
1497
78.5k
  }
1498
111k
}
1499
1500
56.5k
static bool needs_live_range(zend_op_array *op_array, zend_op *def_opline) {
1501
56.5k
  zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
1502
56.5k
  zend_ssa_op *ssa_op = &func_info->ssa.ops[def_opline - op_array->opcodes];
1503
56.5k
  int ssa_var = ssa_op->result_def;
1504
56.5k
  if (ssa_var < 0) {
1505
    /* Be conservative. */
1506
134
    return 1;
1507
134
  }
1508
1509
  /* If the variable is used by a PHI, this may be the assignment of the final branch of a
1510
   * ternary/etc structure. While this is where the live range starts, the value from the other
1511
   * branch may also be used. As such, use the type of the PHI node for the following check. */
1512
56.3k
  if (func_info->ssa.vars[ssa_var].phi_use_chain) {
1513
727
    ssa_var = func_info->ssa.vars[ssa_var].phi_use_chain->ssa_var;
1514
727
  }
1515
1516
56.3k
  uint32_t type = func_info->ssa.var_info[ssa_var].type;
1517
56.3k
  return (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)) != 0;
1518
56.5k
}
1519
1520
static void zend_foreach_op_array_helper(
1521
223k
    zend_op_array *op_array, zend_op_array_func_t func, void *context) {
1522
223k
  func(op_array, context);
1523
240k
  for (uint32_t i = 0; i < op_array->num_dynamic_func_defs; i++) {
1524
16.9k
    zend_foreach_op_array_helper(op_array->dynamic_func_defs[i], func, context);
1525
16.9k
  }
1526
223k
}
1527
1528
void zend_foreach_op_array(zend_script *script, zend_op_array_func_t func, void *context)
1529
137k
{
1530
137k
  zval *zv;
1531
137k
  zend_op_array *op_array;
1532
1533
137k
  zend_foreach_op_array_helper(&script->main_op_array, func, context);
1534
1535
328k
  ZEND_HASH_MAP_FOREACH_PTR(&script->function_table, op_array) {
1536
328k
    zend_foreach_op_array_helper(op_array, func, context);
1537
328k
  } ZEND_HASH_FOREACH_END();
1538
1539
371k
  ZEND_HASH_MAP_FOREACH_VAL(&script->class_table, zv) {
1540
371k
    if (Z_TYPE_P(zv) == IS_ALIAS_PTR) {
1541
0
      continue;
1542
0
    }
1543
48.7k
    zend_class_entry *ce = Z_CE_P(zv);
1544
211k
    ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, op_array) {
1545
211k
      if (op_array->scope == ce
1546
56.8k
          && op_array->type == ZEND_USER_FUNCTION
1547
56.8k
          && !(op_array->fn_flags & ZEND_ACC_ABSTRACT)
1548
56.8k
          && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
1549
38.8k
        zend_foreach_op_array_helper(op_array, func, context);
1550
38.8k
      }
1551
211k
    } ZEND_HASH_FOREACH_END();
1552
1553
48.7k
    zend_property_info *property;
1554
163k
    ZEND_HASH_MAP_FOREACH_PTR(&ce->properties_info, property) {
1555
163k
      zend_function **hooks = property->hooks;
1556
163k
      if (property->ce == ce && property->hooks) {
1557
7.87k
        for (uint32_t i = 0; i < ZEND_PROPERTY_HOOK_COUNT; i++) {
1558
5.24k
          zend_function *hook = hooks[i];
1559
5.24k
          if (hook && hook->common.scope == ce && !(hooks[i]->op_array.fn_flags & ZEND_ACC_TRAIT_CLONE)) {
1560
3.38k
            zend_foreach_op_array_helper(&hooks[i]->op_array, func, context);
1561
3.38k
          }
1562
5.24k
        }
1563
2.62k
      }
1564
163k
    } ZEND_HASH_FOREACH_END();
1565
48.7k
  } ZEND_HASH_FOREACH_END();
1566
137k
}
1567
1568
0
static void step_optimize_op_array(zend_op_array *op_array, void *context) {
1569
0
  zend_optimize_op_array(op_array, (zend_optimizer_ctx *) context);
1570
0
}
1571
1572
0
static void step_adjust_fcall_stack_size(zend_op_array *op_array, void *context) {
1573
0
  zend_adjust_fcall_stack_size(op_array, (zend_optimizer_ctx *) context);
1574
0
}
1575
1576
0
static void step_dump_after_optimizer(zend_op_array *op_array, void *context) {
1577
0
  zend_dump_op_array(op_array, ZEND_DUMP_LIVE_RANGES, "after optimizer", NULL);
1578
0
}
1579
1580
68.5k
static void zend_optimizer_call_registered_passes(zend_script *script, void *ctx) {
1581
68.5k
  for (int i = 0; i < zend_optimizer_registered_passes.last; i++) {
1582
0
    if (!zend_optimizer_registered_passes.pass[i]) {
1583
0
      continue;
1584
0
    }
1585
1586
0
    zend_optimizer_registered_passes.pass[i](script, ctx);
1587
0
  }
1588
68.5k
}
1589
1590
ZEND_API void zend_optimize_script(zend_script *script, zend_long optimization_level, zend_long debug_level)
1591
68.5k
{
1592
68.5k
  zend_op_array *op_array;
1593
68.5k
  zend_string *name;
1594
68.5k
  zend_optimizer_ctx ctx;
1595
68.5k
  zval *zv;
1596
1597
68.5k
  ctx.arena = zend_arena_create(64 * 1024);
1598
68.5k
  ctx.script = script;
1599
68.5k
  ctx.constants = NULL;
1600
68.5k
  ctx.optimization_level = optimization_level;
1601
68.5k
  ctx.debug_level = debug_level;
1602
1603
68.5k
  if ((ZEND_OPTIMIZER_PASS_6 & optimization_level) &&
1604
68.5k
      (ZEND_OPTIMIZER_PASS_7 & optimization_level)) {
1605
    /* Optimize using call-graph */
1606
68.5k
    zend_call_graph call_graph;
1607
68.5k
    zend_build_call_graph(&ctx.arena, script, &call_graph);
1608
1609
68.5k
    int i;
1610
68.5k
    zend_func_info *func_info;
1611
1612
180k
    for (i = 0; i < call_graph.op_arrays_count; i++) {
1613
111k
      zend_revert_pass_two(call_graph.op_arrays[i]);
1614
111k
      zend_optimize(call_graph.op_arrays[i], &ctx);
1615
111k
    }
1616
1617
68.5k
      zend_analyze_call_graph(&ctx.arena, script, &call_graph);
1618
1619
180k
    for (i = 0; i < call_graph.op_arrays_count; i++) {
1620
111k
      func_info = ZEND_FUNC_INFO(call_graph.op_arrays[i]);
1621
111k
      if (func_info) {
1622
111k
        func_info->call_map = zend_build_call_map(&ctx.arena, func_info, call_graph.op_arrays[i]);
1623
111k
        if (call_graph.op_arrays[i]->fn_flags & ZEND_ACC_HAS_RETURN_TYPE) {
1624
6.72k
          zend_init_func_return_info(call_graph.op_arrays[i], script, &func_info->return_info);
1625
6.72k
        }
1626
111k
      }
1627
111k
    }
1628
1629
180k
    for (i = 0; i < call_graph.op_arrays_count; i++) {
1630
111k
      func_info = ZEND_FUNC_INFO(call_graph.op_arrays[i]);
1631
111k
      if (func_info) {
1632
111k
        if (zend_dfa_analyze_op_array(call_graph.op_arrays[i], &ctx, &func_info->ssa) == SUCCESS) {
1633
78.5k
          func_info->flags = func_info->ssa.cfg.flags;
1634
78.5k
        } else {
1635
33.2k
          ZEND_SET_FUNC_INFO(call_graph.op_arrays[i], NULL);
1636
33.2k
        }
1637
111k
      }
1638
111k
    }
1639
1640
    //TODO: perform inner-script inference???
1641
180k
    for (i = 0; i < call_graph.op_arrays_count; i++) {
1642
111k
      func_info = ZEND_FUNC_INFO(call_graph.op_arrays[i]);
1643
111k
      if (func_info) {
1644
78.5k
        zend_dfa_optimize_op_array(call_graph.op_arrays[i], &ctx, &func_info->ssa, func_info->call_map);
1645
78.5k
      }
1646
111k
    }
1647
1648
68.5k
    if (debug_level & ZEND_DUMP_AFTER_PASS_7) {
1649
0
      for (i = 0; i < call_graph.op_arrays_count; i++) {
1650
0
        zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 7", NULL);
1651
0
      }
1652
0
    }
1653
1654
68.5k
    if (ZEND_OPTIMIZER_PASS_9 & optimization_level) {
1655
180k
      for (i = 0; i < call_graph.op_arrays_count; i++) {
1656
111k
        zend_optimize_temporary_variables(call_graph.op_arrays[i], &ctx);
1657
111k
        if (debug_level & ZEND_DUMP_AFTER_PASS_9) {
1658
0
          zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 9", NULL);
1659
0
        }
1660
111k
      }
1661
68.5k
    }
1662
1663
68.5k
    if (ZEND_OPTIMIZER_PASS_11 & optimization_level) {
1664
180k
      for (i = 0; i < call_graph.op_arrays_count; i++) {
1665
111k
        zend_optimizer_compact_literals(call_graph.op_arrays[i], &ctx);
1666
111k
        if (debug_level & ZEND_DUMP_AFTER_PASS_11) {
1667
0
          zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 11", NULL);
1668
0
        }
1669
111k
      }
1670
68.5k
    }
1671
1672
68.5k
    if (ZEND_OPTIMIZER_PASS_13 & optimization_level) {
1673
180k
      for (i = 0; i < call_graph.op_arrays_count; i++) {
1674
111k
        zend_optimizer_compact_vars(call_graph.op_arrays[i]);
1675
111k
        if (debug_level & ZEND_DUMP_AFTER_PASS_13) {
1676
0
          zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 13", NULL);
1677
0
        }
1678
111k
      }
1679
68.5k
    }
1680
1681
68.5k
    if (ZEND_OPTIMIZER_PASS_12 & optimization_level) {
1682
180k
      for (i = 0; i < call_graph.op_arrays_count; i++) {
1683
111k
        zend_adjust_fcall_stack_size_graph(call_graph.op_arrays[i]);
1684
111k
      }
1685
68.5k
    }
1686
1687
180k
    for (i = 0; i < call_graph.op_arrays_count; i++) {
1688
111k
      op_array = call_graph.op_arrays[i];
1689
111k
      func_info = ZEND_FUNC_INFO(op_array);
1690
111k
      if (func_info && func_info->ssa.var_info) {
1691
78.5k
        zend_redo_pass_two_ex(op_array, &func_info->ssa);
1692
78.5k
        if (op_array->live_range) {
1693
33.9k
          zend_recalc_live_ranges(op_array, needs_live_range);
1694
33.9k
        }
1695
78.5k
      } else {
1696
33.2k
        zend_redo_pass_two(op_array);
1697
33.2k
        if (op_array->live_range) {
1698
29.9k
          zend_recalc_live_ranges(op_array, NULL);
1699
29.9k
        }
1700
33.2k
      }
1701
111k
    }
1702
1703
180k
    for (i = 0; i < call_graph.op_arrays_count; i++) {
1704
111k
      ZEND_SET_FUNC_INFO(call_graph.op_arrays[i], NULL);
1705
111k
    }
1706
68.5k
  } else {
1707
0
    zend_foreach_op_array(script, step_optimize_op_array, &ctx);
1708
1709
0
    if (ZEND_OPTIMIZER_PASS_12 & optimization_level) {
1710
0
      zend_foreach_op_array(script, step_adjust_fcall_stack_size, &ctx);
1711
0
    }
1712
0
  }
1713
1714
185k
  ZEND_HASH_MAP_FOREACH_VAL(&script->class_table, zv) {
1715
185k
    if (Z_TYPE_P(zv) == IS_ALIAS_PTR) {
1716
0
      continue;
1717
0
    }
1718
24.3k
    zend_class_entry *ce = Z_CE_P(zv);
1719
105k
    ZEND_HASH_MAP_FOREACH_STR_KEY_PTR(&ce->function_table, name, op_array) {
1720
105k
      if (op_array->scope != ce && op_array->type == ZEND_USER_FUNCTION) {
1721
1.61k
        zend_op_array *orig_op_array =
1722
1.61k
          zend_hash_find_ptr(&op_array->scope->function_table, name);
1723
1724
1.61k
        ZEND_ASSERT(orig_op_array != NULL);
1725
1.61k
        if (orig_op_array != op_array) {
1726
0
          uint32_t fn_flags = op_array->fn_flags;
1727
0
          zend_function *prototype = op_array->prototype;
1728
0
          HashTable *ht = op_array->static_variables;
1729
1730
0
          *op_array = *orig_op_array;
1731
0
          op_array->fn_flags = fn_flags;
1732
0
          op_array->prototype = prototype;
1733
0
          op_array->static_variables = ht;
1734
0
        }
1735
1.61k
      }
1736
105k
    } ZEND_HASH_FOREACH_END();
1737
24.3k
  } ZEND_HASH_FOREACH_END();
1738
1739
68.5k
  zend_optimizer_call_registered_passes(script, &ctx);
1740
1741
68.5k
  if ((debug_level & ZEND_DUMP_AFTER_OPTIMIZER) &&
1742
68.5k
      (ZEND_OPTIMIZER_PASS_7 & optimization_level)) {
1743
0
    zend_foreach_op_array(script, step_dump_after_optimizer, NULL);
1744
0
  }
1745
1746
68.5k
  if (ctx.constants) {
1747
0
    zend_hash_destroy(ctx.constants);
1748
0
  }
1749
68.5k
  zend_arena_destroy(ctx.arena);
1750
68.5k
}
1751
1752
ZEND_API int zend_optimizer_register_pass(zend_optimizer_pass_t pass)
1753
0
{
1754
0
  if (!pass) {
1755
0
    return -1;
1756
0
  }
1757
1758
0
  if (zend_optimizer_registered_passes.last == ZEND_OPTIMIZER_MAX_REGISTERED_PASSES) {
1759
0
    return -1;
1760
0
  }
1761
1762
0
  zend_optimizer_registered_passes.pass[
1763
0
    zend_optimizer_registered_passes.last++] = pass;
1764
1765
0
  return zend_optimizer_registered_passes.last;
1766
0
}
1767
1768
ZEND_API void zend_optimizer_unregister_pass(int idx)
1769
0
{
1770
0
  zend_optimizer_registered_passes.pass[idx-1] = NULL;
1771
0
}
1772
1773
zend_result zend_optimizer_startup(void)
1774
16
{
1775
16
  return zend_func_info_startup();
1776
16
}
1777
1778
zend_result zend_optimizer_shutdown(void)
1779
0
{
1780
0
  return zend_func_info_shutdown();
1781
0
}