Coverage Report

Created: 2025-11-16 06:23

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/Optimizer/block_pass.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Stanislav Malyshev <stas@zend.com>                          |
18
   |          Dmitry Stogov <dmitry@php.net>                              |
19
   +----------------------------------------------------------------------+
20
*/
21
22
#include "Optimizer/zend_optimizer.h"
23
#include "Optimizer/zend_optimizer_internal.h"
24
#include "zend_API.h"
25
#include "zend_constants.h"
26
#include "zend_execute.h"
27
#include "zend_vm.h"
28
#include "zend_bitset.h"
29
#include "zend_cfg.h"
30
#include "zend_dump.h"
31
32
/* Checks if a constant (like "true") may be replaced by its value */
33
bool zend_optimizer_get_persistent_constant(zend_string *name, zval *result, bool copy)
34
51.9k
{
35
51.9k
  const zend_constant *c = zend_hash_find_ptr(EG(zend_constants), name);
36
51.9k
  if (c) {
37
56
    if ((ZEND_CONSTANT_FLAGS(c) & CONST_PERSISTENT)
38
56
     && !(ZEND_CONSTANT_FLAGS(c) & CONST_DEPRECATED)
39
0
     && (!(ZEND_CONSTANT_FLAGS(c) & CONST_NO_FILE_CACHE)
40
0
      || !(CG(compiler_options) & ZEND_COMPILE_WITH_FILE_CACHE))) {
41
0
      ZVAL_COPY_VALUE(result, &c->value);
42
0
      if (copy) {
43
0
        Z_TRY_ADDREF_P(result);
44
0
      }
45
0
      return true;
46
56
    } else {
47
56
      return false;
48
56
    }
49
56
  }
50
51
  /* Special constants null/true/false can always be substituted. */
52
51.8k
  c = zend_get_special_const(ZSTR_VAL(name), ZSTR_LEN(name));
53
51.8k
  if (c) {
54
0
    ZVAL_COPY_VALUE(result, &c->value);
55
0
    return true;
56
0
  }
57
51.8k
  return false;
58
51.8k
}
59
60
/* Data dependencies macros */
61
62
1.75M
#define VAR_SOURCE(op) Tsource[VAR_NUM(op.var)]
63
1.59M
#define SET_VAR_SOURCE(opline) Tsource[VAR_NUM(opline->result.var)] = opline
64
65
static void strip_leading_nops(const zend_op_array *op_array, zend_basic_block *b)
66
9.65k
{
67
9.65k
  const zend_op *opcodes = op_array->opcodes;
68
69
11.6k
  do {
70
11.6k
    b->start++;
71
11.6k
    b->len--;
72
11.6k
  } while (b->len > 0 && opcodes[b->start].opcode == ZEND_NOP);
73
9.65k
}
74
75
static void strip_nops(const zend_op_array *op_array, zend_basic_block *b)
76
533k
{
77
533k
  uint32_t i, j;
78
79
533k
  if (b->len == 0) {
80
1.08k
    return;
81
1.08k
  }
82
83
532k
  if (op_array->opcodes[b->start].opcode == ZEND_NOP) {
84
3.94k
    strip_leading_nops(op_array, b);
85
3.94k
  }
86
87
532k
  if (b->len == 0) {
88
316
    return;
89
316
  }
90
91
  /* strip the inside NOPs */
92
532k
  i = j = b->start + 1;
93
3.36M
  while (i < b->start + b->len) {
94
2.83M
    if (op_array->opcodes[i].opcode != ZEND_NOP) {
95
2.80M
      if (i != j) {
96
56.1k
        op_array->opcodes[j] = op_array->opcodes[i];
97
56.1k
      }
98
2.80M
      j++;
99
2.80M
    }
100
2.83M
    i++;
101
2.83M
  }
102
532k
  b->len = j - b->start;
103
559k
  while (j < i) {
104
27.8k
    MAKE_NOP(op_array->opcodes + j);
105
27.8k
    j++;
106
27.8k
  }
107
532k
}
108
109
68
static uint32_t get_const_switch_target(const zend_cfg *cfg, const zend_op_array *op_array, const zend_basic_block *block, zend_op *opline, const zval *val) {
110
68
  HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
111
68
  zval *zv;
112
68
  if ((opline->opcode == ZEND_SWITCH_LONG && Z_TYPE_P(val) != IS_LONG)
113
68
      || (opline->opcode == ZEND_SWITCH_STRING && Z_TYPE_P(val) != IS_STRING)) {
114
    /* fallback to next block */
115
0
    return block->successors[block->successors_count - 1];
116
0
  }
117
68
  if (opline->opcode == ZEND_MATCH && Z_TYPE_P(val) != IS_LONG && Z_TYPE_P(val) != IS_STRING) {
118
    /* always jump to the default arm */
119
12
    return block->successors[block->successors_count - 1];
120
12
  }
121
56
  if (Z_TYPE_P(val) == IS_LONG) {
122
28
    zv = zend_hash_index_find(jumptable, Z_LVAL_P(val));
123
28
  } else {
124
28
    ZEND_ASSERT(Z_TYPE_P(val) == IS_STRING);
125
28
    zv = zend_hash_find(jumptable, Z_STR_P(val));
126
28
  }
127
56
  if (!zv) {
128
    /* default */
129
36
    return block->successors[block->successors_count - (opline->opcode == ZEND_MATCH ? 1 : 2)];
130
36
  }
131
20
  return cfg->map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv))];
132
56
}
133
134
static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array, zend_bitset used_ext, zend_cfg *cfg, zend_op **Tsource, uint32_t *opt_count)
135
533k
{
136
533k
  zend_op *opline, *src;
137
533k
  zend_op *end, *last_op = NULL;
138
139
533k
  if (block->len == 0) {
140
232
    return;
141
232
  }
142
143
533k
  if (op_array->opcodes[block->start].opcode == ZEND_NOP) {
144
    /* remove leading NOPs */
145
5.71k
    strip_leading_nops(op_array, block);
146
5.71k
  }
147
148
533k
  opline = op_array->opcodes + block->start;
149
533k
  end = opline + block->len;
150
3.90M
  while (opline < end) {
151
    /* Constant Propagation: strip X = QM_ASSIGN(const) */
152
3.37M
    if (opline->op1_type == IS_TMP_VAR &&
153
755k
        opline->opcode != ZEND_FREE) {
154
723k
      src = VAR_SOURCE(opline->op1);
155
723k
      if (src &&
156
677k
          src->opcode == ZEND_QM_ASSIGN &&
157
4.26k
          src->op1_type == IS_CONST
158
723k
      ) {
159
1.97k
        znode_op op1 = opline->op1;
160
1.97k
        if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
161
2
          COPY_NODE(opline->result, opline->op1);
162
2
          COPY_NODE(opline->op1, src->op1);
163
2
          VAR_SOURCE(op1) = NULL;
164
2
          MAKE_NOP(src);
165
2
          ++(*opt_count);
166
1.96k
        } else {
167
1.96k
          zval c;
168
1.96k
          ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
169
1.96k
          if (opline->opcode != ZEND_CASE
170
1.96k
           && opline->opcode != ZEND_CASE_STRICT
171
1.96k
           && opline->opcode != ZEND_FETCH_LIST_R
172
1.96k
           && opline->opcode != ZEND_SWITCH_LONG
173
1.96k
           && opline->opcode != ZEND_SWITCH_STRING
174
1.96k
           && opline->opcode != ZEND_MATCH
175
1.95k
           && opline->opcode != ZEND_MATCH_ERROR
176
1.95k
           && zend_optimizer_update_op1_const(op_array, opline, &c)) {
177
1.90k
            VAR_SOURCE(op1) = NULL;
178
1.90k
            if (opline->opcode != ZEND_JMP_NULL
179
1.89k
             && !zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
180
1.15k
              literal_dtor(&ZEND_OP1_LITERAL(src));
181
1.15k
              MAKE_NOP(src);
182
1.15k
            }
183
1.90k
            ++(*opt_count);
184
1.90k
          } else {
185
64
            zval_ptr_dtor_nogc(&c);
186
64
          }
187
1.96k
        }
188
1.97k
      }
189
723k
    }
190
191
    /* Constant Propagation: strip X = QM_ASSIGN(const) */
192
3.37M
    if (opline->op2_type == IS_TMP_VAR) {
193
525k
      src = VAR_SOURCE(opline->op2);
194
525k
      if (src &&
195
491k
          src->opcode == ZEND_QM_ASSIGN &&
196
116
          src->op1_type == IS_CONST) {
197
198
88
        znode_op op2 = opline->op2;
199
88
        zval c;
200
201
88
        ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
202
88
        if (zend_optimizer_update_op2_const(op_array, opline, &c)) {
203
76
          VAR_SOURCE(op2) = NULL;
204
76
          if (!zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
205
76
            literal_dtor(&ZEND_OP1_LITERAL(src));
206
76
            MAKE_NOP(src);
207
76
          }
208
76
          ++(*opt_count);
209
76
        } else {
210
12
          zval_ptr_dtor_nogc(&c);
211
12
        }
212
88
      }
213
525k
    }
214
215
3.37M
    switch (opline->opcode) {
216
166k
      case ZEND_ECHO:
217
166k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
218
36.5k
          src = VAR_SOURCE(opline->op1);
219
36.5k
          if (src &&
220
33.6k
              src->opcode == ZEND_CAST &&
221
126
              src->extended_value == IS_STRING) {
222
            /* T = CAST(X, String), ECHO(T) => NOP, ECHO(X) */
223
80
            VAR_SOURCE(opline->op1) = NULL;
224
80
            COPY_NODE(opline->op1, src->op1);
225
80
            MAKE_NOP(src);
226
80
            ++(*opt_count);
227
80
          }
228
129k
        } else if (opline->op1_type == IS_CONST &&
229
128k
                   Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_DOUBLE) {
230
128k
          if (last_op == opline - 1) {
231
            /* compress consecutive ECHO's.
232
             * Float to string conversion may be affected by current
233
             * locale setting.
234
             */
235
5.44k
            size_t l, old_len;
236
237
5.44k
            if (Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_STRING) {
238
50
              convert_to_string(&ZEND_OP1_LITERAL(opline));
239
50
            }
240
5.44k
            if (Z_TYPE(ZEND_OP1_LITERAL(last_op)) != IS_STRING) {
241
33
              convert_to_string(&ZEND_OP1_LITERAL(last_op));
242
33
            }
243
5.44k
            old_len = Z_STRLEN(ZEND_OP1_LITERAL(last_op));
244
5.44k
            l = old_len + Z_STRLEN(ZEND_OP1_LITERAL(opline));
245
5.44k
            if (!Z_REFCOUNTED(ZEND_OP1_LITERAL(last_op))) {
246
2.13k
              zend_string *tmp = zend_string_alloc(l, 0);
247
2.13k
              memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP1_LITERAL(last_op)), old_len);
248
2.13k
              Z_STR(ZEND_OP1_LITERAL(last_op)) = tmp;
249
3.30k
            } else {
250
3.30k
              Z_STR(ZEND_OP1_LITERAL(last_op)) = zend_string_extend(Z_STR(ZEND_OP1_LITERAL(last_op)), l, 0);
251
3.30k
            }
252
5.44k
            Z_TYPE_INFO(ZEND_OP1_LITERAL(last_op)) = IS_STRING_EX;
253
5.44k
            memcpy(Z_STRVAL(ZEND_OP1_LITERAL(last_op)) + old_len, Z_STRVAL(ZEND_OP1_LITERAL(opline)), Z_STRLEN(ZEND_OP1_LITERAL(opline)));
254
5.44k
            Z_STRVAL(ZEND_OP1_LITERAL(last_op))[l] = '\0';
255
5.44k
            zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
256
5.44k
            ZVAL_STR(&ZEND_OP1_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP1_LITERAL(last_op))));
257
5.44k
            ZVAL_NULL(&ZEND_OP1_LITERAL(last_op));
258
5.44k
            MAKE_NOP(last_op);
259
5.44k
            ++(*opt_count);
260
5.44k
          }
261
128k
          last_op = opline;
262
128k
        }
263
166k
        break;
264
265
542
      case ZEND_MATCH_ERROR:
266
542
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
267
222
          src = VAR_SOURCE(opline->op1);
268
222
          VAR_SOURCE(opline->op1) = NULL;
269
222
        }
270
542
        break;
271
272
50.8k
      case ZEND_FREE:
273
        /* Note: Only remove the source if the source is local to this block.
274
         * If it's not local, then the other blocks successors must also eventually either FREE or consume the temporary,
275
         * hence removing the temporary is not safe in the general case, especially when other consumers are not FREE.
276
         * A FREE may not be removed without also removing the source's result, because otherwise that would cause a memory leak. */
277
50.8k
        if (opline->extended_value == ZEND_FREE_VOID_CAST) {
278
          /* Keep the ZEND_FREE opcode alive. */
279
50.8k
        } else if (opline->op1_type == IS_TMP_VAR) {
280
31.9k
          src = VAR_SOURCE(opline->op1);
281
31.9k
          if (src) {
282
28.3k
            switch (src->opcode) {
283
53
              case ZEND_BOOL:
284
253
              case ZEND_BOOL_NOT:
285
                /* T = BOOL(X), FREE(T) => T = BOOL(X) */
286
                /* The remaining BOOL is removed by a separate optimization */
287
                /* The source is a bool, no source removals take place, so this may be done non-locally. */
288
253
                VAR_SOURCE(opline->op1) = NULL;
289
253
                MAKE_NOP(opline);
290
253
                ++(*opt_count);
291
253
                break;
292
784
              case ZEND_ASSIGN:
293
790
              case ZEND_ASSIGN_DIM:
294
795
              case ZEND_ASSIGN_OBJ:
295
795
              case ZEND_ASSIGN_STATIC_PROP:
296
1.14k
              case ZEND_ASSIGN_OP:
297
1.15k
              case ZEND_ASSIGN_DIM_OP:
298
1.15k
              case ZEND_ASSIGN_OBJ_OP:
299
1.15k
              case ZEND_ASSIGN_STATIC_PROP_OP:
300
1.15k
              case ZEND_PRE_INC:
301
1.15k
              case ZEND_PRE_DEC:
302
1.15k
              case ZEND_PRE_INC_OBJ:
303
1.15k
              case ZEND_PRE_DEC_OBJ:
304
1.15k
              case ZEND_PRE_INC_STATIC_PROP:
305
1.15k
              case ZEND_PRE_DEC_STATIC_PROP:
306
1.15k
                if (src < op_array->opcodes + block->start) {
307
0
                  break;
308
0
                }
309
1.15k
                src->result_type = IS_UNUSED;
310
1.15k
                VAR_SOURCE(opline->op1) = NULL;
311
1.15k
                MAKE_NOP(opline);
312
1.15k
                ++(*opt_count);
313
1.15k
                break;
314
26.9k
              default:
315
26.9k
                break;
316
28.3k
            }
317
28.3k
          }
318
31.9k
        } else if (opline->op1_type == IS_VAR) {
319
18.8k
          src = VAR_SOURCE(opline->op1);
320
          /* V = OP, FREE(V) => OP. NOP */
321
18.8k
          if (src >= op_array->opcodes + block->start &&
322
17.9k
              src->opcode != ZEND_FETCH_R &&
323
17.9k
              src->opcode != ZEND_FETCH_STATIC_PROP_R &&
324
17.9k
              src->opcode != ZEND_FETCH_DIM_R &&
325
17.9k
              src->opcode != ZEND_FETCH_OBJ_R &&
326
17.9k
              src->opcode != ZEND_NEW &&
327
1.11k
              src->opcode != ZEND_FETCH_THIS) {
328
1.11k
            src->result_type = IS_UNUSED;
329
1.11k
            MAKE_NOP(opline);
330
1.11k
            ++(*opt_count);
331
1.11k
            if (src->opcode == ZEND_QM_ASSIGN) {
332
32
              if (src->op1_type & (IS_VAR|IS_TMP_VAR)) {
333
0
                src->opcode = ZEND_FREE;
334
32
              } else {
335
32
                MAKE_NOP(src);
336
32
              }
337
32
            }
338
1.11k
          }
339
18.8k
        }
340
50.8k
        break;
341
342
#if 0
343
    /* pre-evaluate functions:
344
       constant(x)
345
       function_exists(x)
346
       extension_loaded(x)
347
       BAD: interacts badly with Accelerator
348
    */
349
    if((opline->op1_type & IS_VAR) &&
350
       VAR_SOURCE(opline->op1) && VAR_SOURCE(opline->op1)->opcode == ZEND_DO_CF_FCALL &&
351
       VAR_SOURCE(opline->op1)->extended_value == 1) {
352
      zend_op *fcall = VAR_SOURCE(opline->op1);
353
      zend_op *sv = fcall-1;
354
      if(sv >= block->start_opline && sv->opcode == ZEND_SEND_VAL &&
355
         sv->op1_type == IS_CONST && Z_TYPE(OPLINE_OP1_LITERAL(sv)) == IS_STRING &&
356
         Z_LVAL(OPLINE_OP2_LITERAL(sv)) == 1
357
         ) {
358
        zval *arg = &OPLINE_OP1_LITERAL(sv);
359
        char *fname = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].function_name;
360
        size_t flen = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].name_len;
361
        if((flen == sizeof("function_exists")-1 && zend_binary_strcasecmp(fname, flen, "function_exists", sizeof("function_exists")-1) == 0) ||
362
              (flen == sizeof("is_callable")-1 && zend_binary_strcasecmp(fname, flen, "is_callable", sizeof("is_callable")-1) == 0)
363
              ) {
364
          zend_function *function;
365
          if((function = zend_hash_find_ptr(EG(function_table), Z_STR_P(arg))) != NULL) {
366
            literal_dtor(arg);
367
            MAKE_NOP(sv);
368
            MAKE_NOP(fcall);
369
            LITERAL_BOOL(opline->op1, 1);
370
            opline->op1_type = IS_CONST;
371
          }
372
        } else if(flen == sizeof("constant")-1 && zend_binary_strcasecmp(fname, flen, "constant", sizeof("constant")-1) == 0) {
373
          zval c;
374
          if (zend_optimizer_get_persistent_constant(Z_STR_P(arg), &c, true ELS_CC)) {
375
            literal_dtor(arg);
376
            MAKE_NOP(sv);
377
            MAKE_NOP(fcall);
378
            ZEND_OP1_LITERAL(opline) = zend_optimizer_add_literal(op_array, &c);
379
            /* no copy ctor - get already copied it */
380
            opline->op1_type = IS_CONST;
381
          }
382
        } else if(flen == sizeof("extension_loaded")-1 && zend_binary_strcasecmp(fname, flen, "extension_loaded", sizeof("extension_loaded")-1) == 0) {
383
          if(zend_hash_exists(&module_registry, Z_STR_P(arg))) {
384
            literal_dtor(arg);
385
            MAKE_NOP(sv);
386
            MAKE_NOP(fcall);
387
            LITERAL_BOOL(opline->op1, 1);
388
            opline->op1_type = IS_CONST;
389
          }
390
        }
391
      }
392
    }
393
#endif
394
395
50.8k
      case ZEND_FETCH_LIST_R:
396
1.93k
      case ZEND_FETCH_LIST_W:
397
1.93k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
398
          /* LIST variable will be deleted later by FREE */
399
1.64k
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
400
1.64k
        }
401
1.93k
        break;
402
403
8
      case ZEND_SWITCH_LONG:
404
73
      case ZEND_SWITCH_STRING:
405
373
      case ZEND_MATCH:
406
373
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
407
          /* SWITCH variable will be deleted later by FREE, so we can't optimize it */
408
127
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
409
127
          break;
410
127
        }
411
246
        if (opline->op1_type == IS_CONST) {
412
68
          uint32_t target = get_const_switch_target(cfg, op_array, block, opline, &ZEND_OP1_LITERAL(opline));
413
68
          literal_dtor(&ZEND_OP1_LITERAL(opline));
414
68
          literal_dtor(&ZEND_OP2_LITERAL(opline));
415
68
          opline->opcode = ZEND_JMP;
416
68
          opline->op1_type = IS_UNUSED;
417
68
          opline->op2_type = IS_UNUSED;
418
68
          block->successors_count = 1;
419
68
          block->successors[0] = target;
420
68
        }
421
246
        break;
422
423
0
      case ZEND_EXT_STMT:
424
0
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
425
          /* Variable will be deleted later by FREE, so we can't optimize it */
426
0
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
427
0
          break;
428
0
        }
429
0
        break;
430
431
171
      case ZEND_CASE:
432
411
      case ZEND_CASE_STRICT:
433
3.33k
      case ZEND_COPY_TMP:
434
3.33k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
435
          /* Variable will be deleted later by FREE, so we can't optimize it */
436
3.33k
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
437
3.33k
          break;
438
3.33k
        }
439
0
        if (opline->op1_type == IS_CONST &&
440
0
            opline->op2_type == IS_CONST) {
441
0
          goto optimize_constant_binary_op;
442
0
        }
443
            /*
444
             * CASE(TRUE, X)       => BOOL(X)
445
             * CASE(FALSE, X)      => BOOL_NOT(X)
446
             */
447
0
        if (opline->op1_type == IS_CONST &&
448
0
          (Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_FALSE ||
449
0
           Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_TRUE)) {
450
          /* Optimization of comparison with "null" is not safe,
451
           * because ("0" == null) is not equal to !("0")
452
           */
453
0
          opline->opcode =
454
0
            ((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP1_LITERAL(opline))) == IS_TRUE)) ?
455
0
            ZEND_BOOL : ZEND_BOOL_NOT;
456
0
          COPY_NODE(opline->op1, opline->op2);
457
0
          SET_UNUSED(opline->op2);
458
0
          ++(*opt_count);
459
0
          goto optimize_bool;
460
0
        } else if (opline->op2_type == IS_CONST &&
461
0
                   (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_FALSE ||
462
0
                    Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_TRUE)) {
463
          /* Optimization of comparison with "null" is not safe,
464
           * because ("0" == null) is not equal to !("0")
465
           */
466
0
          opline->opcode =
467
0
            ((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP2_LITERAL(opline))) == IS_TRUE)) ?
468
0
            ZEND_BOOL : ZEND_BOOL_NOT;
469
0
          SET_UNUSED(opline->op2);
470
0
          ++(*opt_count);
471
0
          goto optimize_bool;
472
0
        }
473
0
        break;
474
475
22.1k
      case ZEND_IS_EQUAL:
476
24.9k
      case ZEND_IS_NOT_EQUAL:
477
24.9k
        if (opline->op1_type == IS_CONST &&
478
0
          opline->op2_type == IS_CONST) {
479
0
          goto optimize_constant_binary_op;
480
0
        }
481
        /* IS_EQ(TRUE, X)      => BOOL(X)
482
         * IS_EQ(FALSE, X)     => BOOL_NOT(X)
483
         * IS_NOT_EQ(TRUE, X)  => BOOL_NOT(X)
484
         * IS_NOT_EQ(FALSE, X) => BOOL(X)
485
         * Those optimizations are not safe if the other operand ends up being NAN
486
         * as BOOL/BOOL_NOT will warn, while IS_EQUAL/IS_NOT_EQUAL do not.
487
         */
488
24.9k
        break;
489
24.9k
      case ZEND_IS_IDENTICAL:
490
2.43k
        if (opline->op1_type == IS_CONST &&
491
0
          opline->op2_type == IS_CONST) {
492
0
          goto optimize_constant_binary_op;
493
0
        }
494
495
2.43k
        if (opline->op1_type == IS_CONST &&
496
0
          (Z_TYPE(ZEND_OP1_LITERAL(opline)) <= IS_TRUE && Z_TYPE(ZEND_OP1_LITERAL(opline)) >= IS_NULL)) {
497
          /* IS_IDENTICAL(TRUE, T)  => TYPE_CHECK(T, TRUE)
498
           * IS_IDENTICAL(FALSE, T) => TYPE_CHECK(T, FALSE)
499
           * IS_IDENTICAL(NULL, T)  => TYPE_CHECK(T, NULL)
500
           */
501
0
          opline->opcode = ZEND_TYPE_CHECK;
502
0
          opline->extended_value = (1 << Z_TYPE(ZEND_OP1_LITERAL(opline)));
503
0
          COPY_NODE(opline->op1, opline->op2);
504
0
          SET_UNUSED(opline->op2);
505
0
          ++(*opt_count);
506
0
          goto optimize_type_check;
507
2.43k
        } else if (opline->op2_type == IS_CONST &&
508
1.59k
          (Z_TYPE(ZEND_OP2_LITERAL(opline)) <= IS_TRUE && Z_TYPE(ZEND_OP2_LITERAL(opline)) >= IS_NULL)) {
509
          /* IS_IDENTICAL(T, TRUE)  => TYPE_CHECK(T, TRUE)
510
           * IS_IDENTICAL(T, FALSE) => TYPE_CHECK(T, FALSE)
511
           * IS_IDENTICAL(T, NULL)  => TYPE_CHECK(T, NULL)
512
           */
513
108
          opline->opcode = ZEND_TYPE_CHECK;
514
108
          opline->extended_value = (1 << Z_TYPE(ZEND_OP2_LITERAL(opline)));
515
108
          SET_UNUSED(opline->op2);
516
108
          ++(*opt_count);
517
108
          goto optimize_type_check;
518
108
        }
519
2.32k
        break;
520
2.32k
      case ZEND_TYPE_CHECK:
521
1.34k
optimize_type_check:
522
1.34k
        if (opline->extended_value == (1 << IS_TRUE) || opline->extended_value == (1 << IS_FALSE)) {
523
206
          if (opline->op1_type == IS_TMP_VAR &&
524
160
            !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
525
160
            src = VAR_SOURCE(opline->op1);
526
527
160
            if (src) {
528
160
              switch (src->opcode) {
529
0
                case ZEND_BOOL:
530
0
                case ZEND_BOOL_NOT:
531
                  /* T = BOOL(X)     + TYPE_CHECK(T, TRUE)  -> BOOL(X), NOP
532
                   * T = BOOL(X)     + TYPE_CHECK(T, FALSE) -> BOOL_NOT(X), NOP
533
                   * T = BOOL_NOT(X) + TYPE_CHECK(T, TRUE)  -> BOOL_NOT(X), NOP
534
                   * T = BOOL_NOT(X) + TYPE_CHECK(T, FALSE) -> BOOL(X), NOP
535
                   */
536
0
                  src->opcode =
537
0
                    ((src->opcode == ZEND_BOOL) == (opline->extended_value == (1 << IS_TRUE))) ?
538
0
                    ZEND_BOOL : ZEND_BOOL_NOT;
539
0
                  COPY_NODE(src->result, opline->result);
540
0
                  SET_VAR_SOURCE(src);
541
0
                  MAKE_NOP(opline);
542
0
                  ++(*opt_count);
543
0
                  break;
544
160
              }
545
160
            }
546
160
          }
547
206
        }
548
1.34k
        break;
549
  
550
6.28k
      case ZEND_BOOL:
551
15.5k
      case ZEND_BOOL_NOT:
552
21.4k
      optimize_bool:
553
21.4k
        if (opline->op1_type == IS_CONST) {
554
2.15k
          goto optimize_const_unary_op;
555
2.15k
        }
556
19.2k
        if (opline->op1_type == IS_TMP_VAR &&
557
16.6k
            !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
558
15.9k
          src = VAR_SOURCE(opline->op1);
559
15.9k
          if (src) {
560
15.9k
            switch (src->opcode) {
561
3.07k
              case ZEND_BOOL_NOT:
562
                /* T = BOOL_NOT(X) + BOOL(T) -> NOP, BOOL_NOT(X) */
563
3.07k
                VAR_SOURCE(opline->op1) = NULL;
564
3.07k
                COPY_NODE(opline->op1, src->op1);
565
3.07k
                opline->opcode = (opline->opcode == ZEND_BOOL) ? ZEND_BOOL_NOT : ZEND_BOOL;
566
3.07k
                MAKE_NOP(src);
567
3.07k
                ++(*opt_count);
568
3.07k
                goto optimize_bool;
569
2.81k
              case ZEND_BOOL:
570
                /* T = BOOL(X) + BOOL(T) -> NOP, BOOL(X) */
571
2.81k
                VAR_SOURCE(opline->op1) = NULL;
572
2.81k
                COPY_NODE(opline->op1, src->op1);
573
2.81k
                MAKE_NOP(src);
574
2.81k
                ++(*opt_count);
575
2.81k
                goto optimize_bool;
576
202
              case ZEND_IS_EQUAL:
577
202
                if (opline->opcode == ZEND_BOOL_NOT) {
578
0
                  src->opcode = ZEND_IS_NOT_EQUAL;
579
0
                }
580
202
                COPY_NODE(src->result, opline->result);
581
202
                SET_VAR_SOURCE(src);
582
202
                MAKE_NOP(opline);
583
202
                ++(*opt_count);
584
202
                break;
585
192
              case ZEND_IS_NOT_EQUAL:
586
192
                if (opline->opcode == ZEND_BOOL_NOT) {
587
0
                  src->opcode = ZEND_IS_EQUAL;
588
0
                }
589
192
                COPY_NODE(src->result, opline->result);
590
192
                SET_VAR_SOURCE(src);
591
192
                MAKE_NOP(opline);
592
192
                ++(*opt_count);
593
192
                break;
594
173
              case ZEND_IS_IDENTICAL:
595
173
                if (opline->opcode == ZEND_BOOL_NOT) {
596
0
                  src->opcode = ZEND_IS_NOT_IDENTICAL;
597
0
                }
598
173
                COPY_NODE(src->result, opline->result);
599
173
                SET_VAR_SOURCE(src);
600
173
                MAKE_NOP(opline);
601
173
                ++(*opt_count);
602
173
                break;
603
65
              case ZEND_IS_NOT_IDENTICAL:
604
65
                if (opline->opcode == ZEND_BOOL_NOT) {
605
0
                  src->opcode = ZEND_IS_IDENTICAL;
606
0
                }
607
65
                COPY_NODE(src->result, opline->result);
608
65
                SET_VAR_SOURCE(src);
609
65
                MAKE_NOP(opline);
610
65
                ++(*opt_count);
611
65
                break;
612
130
              case ZEND_IS_SMALLER:
613
130
                if (opline->opcode == ZEND_BOOL_NOT) {
614
0
                  uint8_t tmp_type;
615
0
                  uint32_t tmp;
616
617
0
                  src->opcode = ZEND_IS_SMALLER_OR_EQUAL;
618
0
                  tmp_type = src->op1_type;
619
0
                  src->op1_type = src->op2_type;
620
0
                  src->op2_type = tmp_type;
621
0
                  tmp = src->op1.num;
622
0
                  src->op1.num = src->op2.num;
623
0
                  src->op2.num = tmp;
624
0
                }
625
130
                COPY_NODE(src->result, opline->result);
626
130
                SET_VAR_SOURCE(src);
627
130
                MAKE_NOP(opline);
628
130
                ++(*opt_count);
629
130
                break;
630
237
              case ZEND_IS_SMALLER_OR_EQUAL:
631
237
                if (opline->opcode == ZEND_BOOL_NOT) {
632
0
                  uint8_t tmp_type;
633
0
                  uint32_t tmp;
634
635
0
                  src->opcode = ZEND_IS_SMALLER;
636
0
                  tmp_type = src->op1_type;
637
0
                  src->op1_type = src->op2_type;
638
0
                  src->op2_type = tmp_type;
639
0
                  tmp = src->op1.num;
640
0
                  src->op1.num = src->op2.num;
641
0
                  src->op2.num = tmp;
642
0
                }
643
237
                COPY_NODE(src->result, opline->result);
644
237
                SET_VAR_SOURCE(src);
645
237
                MAKE_NOP(opline);
646
237
                ++(*opt_count);
647
237
                break;
648
10
              case ZEND_ISSET_ISEMPTY_CV:
649
28
              case ZEND_ISSET_ISEMPTY_VAR:
650
291
              case ZEND_ISSET_ISEMPTY_DIM_OBJ:
651
351
              case ZEND_ISSET_ISEMPTY_PROP_OBJ:
652
365
              case ZEND_ISSET_ISEMPTY_STATIC_PROP:
653
402
              case ZEND_INSTANCEOF:
654
517
              case ZEND_TYPE_CHECK:
655
524
              case ZEND_DEFINED:
656
524
              case ZEND_IN_ARRAY:
657
552
              case ZEND_ARRAY_KEY_EXISTS:
658
552
                if (opline->opcode == ZEND_BOOL_NOT) {
659
423
                  break;
660
423
                }
661
129
                COPY_NODE(src->result, opline->result);
662
129
                SET_VAR_SOURCE(src);
663
129
                MAKE_NOP(opline);
664
129
                ++(*opt_count);
665
129
                break;
666
15.9k
            }
667
15.9k
          }
668
15.9k
        }
669
13.3k
        break;
670
671
27.8k
      case ZEND_JMPZ:
672
38.3k
      case ZEND_JMPNZ:
673
39.8k
          while (1) {
674
39.8k
          if (opline->op1_type == IS_CONST) {
675
684
            ++(*opt_count);
676
684
            block->successors_count = 1;
677
684
            if (zend_is_true(&ZEND_OP1_LITERAL(opline)) ==
678
684
                (opline->opcode == ZEND_JMPZ)) {
679
680
298
              MAKE_NOP(opline);
681
298
              block->successors[0] = block->successors[1];
682
298
              block->len--;
683
298
              cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
684
298
              break;
685
386
            } else {
686
386
              zend_basic_block *next = cfg->blocks + block->successors[1];
687
688
386
              next->flags &= ~ZEND_BB_FOLLOW;
689
386
              if (!(next->flags & (ZEND_BB_TARGET|ZEND_BB_PROTECTED))) {
690
318
                next->flags &= ~ZEND_BB_REACHABLE;
691
318
              }
692
386
              opline->opcode = ZEND_JMP;
693
386
              COPY_NODE(opline->op1, opline->op2);
694
386
              break;
695
386
            }
696
39.1k
          } else if (opline->op1_type == IS_TMP_VAR &&
697
36.4k
                     !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
698
35.8k
            src = VAR_SOURCE(opline->op1);
699
35.8k
            if (src) {
700
35.8k
              if (src->opcode == ZEND_BOOL_NOT) {
701
705
                VAR_SOURCE(opline->op1) = NULL;
702
705
                COPY_NODE(opline->op1, src->op1);
703
                /* T = BOOL_NOT(X) + JMPZ(T) -> NOP, JMPNZ(X) */
704
705
                opline->opcode = INV_COND(opline->opcode);
705
705
                MAKE_NOP(src);
706
705
                ++(*opt_count);
707
705
                continue;
708
35.1k
              } else if (src->opcode == ZEND_BOOL ||
709
34.3k
                         src->opcode == ZEND_QM_ASSIGN) {
710
787
                VAR_SOURCE(opline->op1) = NULL;
711
787
                COPY_NODE(opline->op1, src->op1);
712
787
                MAKE_NOP(src);
713
787
                ++(*opt_count);
714
787
                continue;
715
787
              }
716
35.8k
            }
717
35.8k
          }
718
37.6k
          break;
719
39.8k
        }
720
38.3k
        break;
721
722
2.35k
      case ZEND_JMPZ_EX:
723
4.95k
      case ZEND_JMPNZ_EX:
724
5.61k
        while (1) {
725
5.61k
          if (opline->op1_type == IS_CONST) {
726
1.09k
            bool is_jmpz_ex = opline->opcode == ZEND_JMPZ_EX;
727
1.09k
            if (zend_is_true(&ZEND_OP1_LITERAL(opline)) == is_jmpz_ex) {
728
729
329
              ++(*opt_count);
730
329
              opline->opcode = ZEND_QM_ASSIGN;
731
329
              zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
732
329
              ZVAL_BOOL(&ZEND_OP1_LITERAL(opline), is_jmpz_ex);
733
329
              opline->op2.num = 0;
734
329
              block->successors_count = 1;
735
329
              block->successors[0] = block->successors[1];
736
329
              cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
737
329
              break;
738
329
            }
739
4.51k
          } else if (opline->op1_type == IS_TMP_VAR &&
740
4.24k
                     (!zend_bitset_in(used_ext, VAR_NUM(opline->op1.var)) ||
741
3.68k
                      opline->result.var == opline->op1.var)) {
742
3.68k
            src = VAR_SOURCE(opline->op1);
743
3.68k
            if (src) {
744
3.13k
              if (src->opcode == ZEND_BOOL ||
745
2.49k
                  src->opcode == ZEND_QM_ASSIGN) {
746
657
                VAR_SOURCE(opline->op1) = NULL;
747
657
                COPY_NODE(opline->op1, src->op1);
748
657
                MAKE_NOP(src);
749
657
                ++(*opt_count);
750
657
                continue;
751
657
              }
752
3.13k
            }
753
3.68k
          }
754
4.62k
          break;
755
5.61k
        }
756
4.95k
        break;
757
758
70.8k
      case ZEND_CONCAT:
759
97.5k
      case ZEND_FAST_CONCAT:
760
97.5k
        if (opline->op1_type == IS_CONST &&
761
21.9k
            opline->op2_type == IS_CONST) {
762
0
          goto optimize_constant_binary_op;
763
0
        }
764
765
97.5k
        if (opline->op2_type == IS_CONST &&
766
37.1k
            opline->op1_type == IS_TMP_VAR) {
767
768
24.3k
          src = VAR_SOURCE(opline->op1);
769
24.3k
            if (src &&
770
24.2k
              (src->opcode == ZEND_CONCAT ||
771
19.9k
               src->opcode == ZEND_FAST_CONCAT) &&
772
22.4k
              src->op2_type == IS_CONST) {
773
            /* compress consecutive CONCATs */
774
909
            size_t l, old_len;
775
776
909
            if (Z_TYPE(ZEND_OP2_LITERAL(opline)) != IS_STRING) {
777
0
              convert_to_string(&ZEND_OP2_LITERAL(opline));
778
0
            }
779
909
            if (Z_TYPE(ZEND_OP2_LITERAL(src)) != IS_STRING) {
780
0
              convert_to_string(&ZEND_OP2_LITERAL(src));
781
0
            }
782
783
909
            VAR_SOURCE(opline->op1) = NULL;
784
909
            COPY_NODE(opline->op1, src->op1);
785
909
            old_len = Z_STRLEN(ZEND_OP2_LITERAL(src));
786
909
            l = old_len + Z_STRLEN(ZEND_OP2_LITERAL(opline));
787
909
            if (!Z_REFCOUNTED(ZEND_OP2_LITERAL(src))) {
788
266
              zend_string *tmp = zend_string_alloc(l, 0);
789
266
              memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP2_LITERAL(src)), old_len);
790
266
              Z_STR(ZEND_OP2_LITERAL(src)) = tmp;
791
643
            } else {
792
643
              Z_STR(ZEND_OP2_LITERAL(src)) = zend_string_extend(Z_STR(ZEND_OP2_LITERAL(src)), l, 0);
793
643
            }
794
909
            Z_TYPE_INFO(ZEND_OP2_LITERAL(src)) = IS_STRING_EX;
795
909
            memcpy(Z_STRVAL(ZEND_OP2_LITERAL(src)) + old_len, Z_STRVAL(ZEND_OP2_LITERAL(opline)), Z_STRLEN(ZEND_OP2_LITERAL(opline)));
796
909
            Z_STRVAL(ZEND_OP2_LITERAL(src))[l] = '\0';
797
909
            zval_ptr_dtor_str(&ZEND_OP2_LITERAL(opline));
798
909
            ZVAL_STR(&ZEND_OP2_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP2_LITERAL(src))));
799
909
            ZVAL_NULL(&ZEND_OP2_LITERAL(src));
800
909
            MAKE_NOP(src);
801
909
            ++(*opt_count);
802
909
          }
803
24.3k
        }
804
805
97.5k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
806
38.8k
          src = VAR_SOURCE(opline->op1);
807
38.8k
          if (src &&
808
38.5k
              src->opcode == ZEND_CAST &&
809
148
              src->extended_value == IS_STRING &&
810
4
              src->op1_type != IS_CONST) {
811
            /* convert T1 = CAST(STRING, X), T2 = CONCAT(T1, Y) to T2 = CONCAT(X,Y) */
812
2
            VAR_SOURCE(opline->op1) = NULL;
813
2
            COPY_NODE(opline->op1, src->op1);
814
2
            MAKE_NOP(src);
815
2
            ++(*opt_count);
816
2
          }
817
38.8k
              }
818
97.5k
        if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
819
58.3k
          src = VAR_SOURCE(opline->op2);
820
58.3k
          if (src &&
821
58.2k
              src->opcode == ZEND_CAST &&
822
152
              src->extended_value == IS_STRING &&
823
60
              src->op1_type != IS_CONST) {
824
            /* convert T1 = CAST(STRING, X), T2 = CONCAT(Y, T1) to T2 = CONCAT(Y,X) */
825
14
            VAR_SOURCE(opline->op2) = NULL;
826
14
            COPY_NODE(opline->op2, src->op1);
827
14
            MAKE_NOP(src);
828
14
            ++(*opt_count);
829
14
          }
830
58.3k
        }
831
97.5k
        if (opline->op1_type == IS_CONST &&
832
21.9k
            Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_STRING &&
833
21.9k
            Z_STRLEN(ZEND_OP1_LITERAL(opline)) == 0) {
834
          /* convert CONCAT('', X) => CAST(STRING, X) */
835
12
          literal_dtor(&ZEND_OP1_LITERAL(opline));
836
12
          opline->opcode = ZEND_CAST;
837
12
          opline->extended_value = IS_STRING;
838
12
          COPY_NODE(opline->op1, opline->op2);
839
12
          opline->op2_type = IS_UNUSED;
840
12
          opline->op2.var = 0;
841
12
          ++(*opt_count);
842
97.5k
        } else if (opline->op2_type == IS_CONST &&
843
37.1k
                 Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING &&
844
37.1k
                 Z_STRLEN(ZEND_OP2_LITERAL(opline)) == 0) {
845
          /* convert CONCAT(X, '') => CAST(STRING, X) */
846
22
          literal_dtor(&ZEND_OP2_LITERAL(opline));
847
22
          opline->opcode = ZEND_CAST;
848
22
          opline->extended_value = IS_STRING;
849
22
          opline->op2_type = IS_UNUSED;
850
22
          opline->op2.var = 0;
851
22
          ++(*opt_count);
852
97.5k
        } else if (opline->opcode == ZEND_CONCAT &&
853
70.7k
                   (opline->op1_type == IS_CONST ||
854
58.5k
                    (opline->op1_type == IS_TMP_VAR &&
855
24.6k
                     VAR_SOURCE(opline->op1) &&
856
24.3k
                     (VAR_SOURCE(opline->op1)->opcode == ZEND_FAST_CONCAT ||
857
13.8k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_ROPE_END ||
858
13.7k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CONSTANT ||
859
10.6k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CLASS_CONSTANT))) &&
860
25.9k
                   (opline->op2_type == IS_CONST ||
861
16.4k
                    (opline->op2_type == IS_TMP_VAR &&
862
14.3k
                     VAR_SOURCE(opline->op2) &&
863
14.3k
                     (VAR_SOURCE(opline->op2)->opcode == ZEND_FAST_CONCAT ||
864
14.3k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_ROPE_END ||
865
5.24k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CONSTANT ||
866
21.1k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CLASS_CONSTANT)))) {
867
21.1k
          opline->opcode = ZEND_FAST_CONCAT;
868
21.1k
          ++(*opt_count);
869
21.1k
        }
870
97.5k
        break;
871
872
11.5k
      case ZEND_ADD:
873
21.5k
      case ZEND_SUB:
874
31.6k
      case ZEND_MUL:
875
43.0k
      case ZEND_DIV:
876
47.5k
      case ZEND_MOD:
877
51.1k
      case ZEND_SL:
878
52.8k
      case ZEND_SR:
879
62.2k
      case ZEND_IS_SMALLER:
880
65.5k
      case ZEND_IS_SMALLER_OR_EQUAL:
881
66.0k
      case ZEND_IS_NOT_IDENTICAL:
882
68.4k
      case ZEND_BOOL_XOR:
883
70.2k
      case ZEND_BW_OR:
884
83.6k
      case ZEND_BW_AND:
885
93.6k
      case ZEND_BW_XOR:
886
93.6k
        if (opline->op1_type == IS_CONST &&
887
16.5k
            opline->op2_type == IS_CONST) {
888
          /* evaluate constant expressions */
889
11.8k
          zval result;
890
891
11.8k
optimize_constant_binary_op:
892
11.8k
          if (zend_optimizer_eval_binary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline), &ZEND_OP2_LITERAL(opline)) == SUCCESS) {
893
4
            literal_dtor(&ZEND_OP1_LITERAL(opline));
894
4
            literal_dtor(&ZEND_OP2_LITERAL(opline));
895
4
            opline->opcode = ZEND_QM_ASSIGN;
896
4
            SET_UNUSED(opline->op2);
897
4
            zend_optimizer_update_op1_const(op_array, opline, &result);
898
4
            ++(*opt_count);
899
4
          }
900
11.8k
        }
901
93.6k
        break;
902
903
93.6k
      case ZEND_BW_NOT:
904
22.3k
        if (opline->op1_type == IS_CONST) {
905
          /* evaluate constant unary ops */
906
196
          zval result;
907
908
2.35k
optimize_const_unary_op:
909
2.35k
          if (zend_optimizer_eval_unary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
910
2.14k
            literal_dtor(&ZEND_OP1_LITERAL(opline));
911
2.14k
            opline->opcode = ZEND_QM_ASSIGN;
912
2.14k
            zend_optimizer_update_op1_const(op_array, opline, &result);
913
2.14k
            ++(*opt_count);
914
2.14k
          }
915
2.35k
        }
916
24.4k
        break;
917
918
24.4k
      case ZEND_CAST:
919
3.11k
        if (opline->op1_type == IS_CONST) {
920
          /* cast of constant operand */
921
329
          zval result;
922
923
329
          if (zend_optimizer_eval_cast(&result, opline->extended_value, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
924
4
            literal_dtor(&ZEND_OP1_LITERAL(opline));
925
4
            opline->opcode = ZEND_QM_ASSIGN;
926
4
            opline->extended_value = 0;
927
4
            zend_optimizer_update_op1_const(op_array, opline, &result);
928
4
            ++(*opt_count);
929
4
          }
930
329
        }
931
3.11k
        break;
932
933
2.85k
      case ZEND_STRLEN:
934
2.85k
        if (opline->op1_type == IS_CONST) {
935
18
          zval result;
936
937
18
          if (zend_optimizer_eval_strlen(&result, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
938
0
            literal_dtor(&ZEND_OP1_LITERAL(opline));
939
0
            opline->opcode = ZEND_QM_ASSIGN;
940
0
            zend_optimizer_update_op1_const(op_array, opline, &result);
941
0
            ++(*opt_count);
942
0
          }
943
18
        }
944
2.85k
        break;
945
946
139k
      case ZEND_RETURN:
947
139k
        if (opline->op1_type == IS_TMP_VAR) {
948
3.99k
          src = VAR_SOURCE(opline->op1);
949
3.99k
          if (src && src->opcode == ZEND_QM_ASSIGN) {
950
144
            zend_op *op = src + 1;
951
144
            bool optimize = true;
952
953
144
            while (op < opline) {
954
24
              if ((op->op1_type == opline->op1_type
955
4
                && op->op1.var == opline->op1.var)
956
20
               || (op->op2_type == opline->op1_type
957
24
                && op->op2.var == opline->op1.var)) {
958
24
                optimize = false;
959
24
                break;
960
24
              }
961
0
              op++;
962
0
            }
963
964
144
            if (optimize) {
965
              /* T = QM_ASSIGN(X), RETURN(T) to NOP, RETURN(X) */
966
120
              VAR_SOURCE(opline->op1) = NULL;
967
120
              COPY_NODE(opline->op1, src->op1);
968
120
              MAKE_NOP(src);
969
120
              ++(*opt_count);
970
120
            }
971
144
          }
972
3.99k
        }
973
139k
        break;
974
975
17.9k
      case ZEND_QM_ASSIGN:
976
17.9k
        if (opline->op1_type == opline->result_type &&
977
4.62k
            opline->op1.var == opline->result.var) {
978
          /* strip T = QM_ASSIGN(T) */
979
0
          MAKE_NOP(opline);
980
0
          ++(*opt_count);
981
17.9k
        } else if (opline->op1_type == IS_TMP_VAR &&
982
4.62k
                   opline->result_type == IS_TMP_VAR &&
983
4.62k
                   !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
984
          /* T1 = ..., T2 = QM_ASSIGN(T1) to T2 = ..., NOP */
985
2.19k
          src = VAR_SOURCE(opline->op1);
986
2.19k
          if (src &&
987
2.19k
            src->opcode != ZEND_COPY_TMP &&
988
2.19k
            src->opcode != ZEND_ADD_ARRAY_ELEMENT &&
989
2.19k
            src->opcode != ZEND_ADD_ARRAY_UNPACK &&
990
2.19k
            (src->opcode != ZEND_DECLARE_LAMBDA_FUNCTION ||
991
2.19k
             src == opline -1)) {
992
2.19k
            src->result.var = opline->result.var;
993
2.19k
            VAR_SOURCE(opline->op1) = NULL;
994
2.19k
            VAR_SOURCE(opline->result) = src;
995
2.19k
            MAKE_NOP(opline);
996
2.19k
            ++(*opt_count);
997
2.19k
          }
998
2.19k
        }
999
17.9k
        break;
1000
3.37M
    }
1001
1002
    /* get variable source */
1003
3.37M
    if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
1004
1.59M
      SET_VAR_SOURCE(opline);
1005
1.59M
    }
1006
3.37M
    opline++;
1007
3.37M
  }
1008
533k
}
1009
1010
/* Rebuild plain (optimized) op_array from CFG */
1011
static void assemble_code_blocks(const zend_cfg *cfg, zend_op_array *op_array, zend_optimizer_ctx *ctx)
1012
98.6k
{
1013
98.6k
  zend_basic_block *blocks = cfg->blocks;
1014
98.6k
  const zend_basic_block *end = blocks + cfg->blocks_count;
1015
98.6k
  zend_basic_block *b;
1016
98.6k
  zend_op *new_opcodes;
1017
98.6k
  zend_op *opline;
1018
98.6k
  uint32_t len = 0;
1019
1020
493k
  for (b = blocks; b < end; b++) {
1021
395k
    if (b->len == 0) {
1022
33.8k
      continue;
1023
33.8k
    }
1024
361k
    if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1025
345k
      opline = op_array->opcodes + b->start + b->len - 1;
1026
345k
      if (opline->opcode == ZEND_JMP) {
1027
47.9k
        const zend_basic_block *next = b + 1;
1028
1029
58.5k
        while (next < end && !(next->flags & ZEND_BB_REACHABLE)) {
1030
10.6k
          next++;
1031
10.6k
        }
1032
47.9k
        if (next < end && next == blocks + b->successors[0]) {
1033
          /* JMP to the next block - strip it */
1034
12
          MAKE_NOP(opline);
1035
12
          b->len--;
1036
12
        }
1037
297k
      } else if (b->len == 1 && opline->opcode == ZEND_NOP) {
1038
        /* skip empty block */
1039
0
        b->len--;
1040
0
      }
1041
345k
      len += b->len;
1042
345k
    } else {
1043
      /* this block will not be used, delete all constants there */
1044
15.8k
      const zend_op *op = op_array->opcodes + b->start;
1045
15.8k
      const zend_op *last_op = op + b->len;
1046
36.4k
      for (; op < last_op; op++) {
1047
20.5k
        if (op->op1_type == IS_CONST) {
1048
14.2k
          literal_dtor(&ZEND_OP1_LITERAL(op));
1049
14.2k
        }
1050
20.5k
        if (op->op2_type == IS_CONST) {
1051
585
          literal_dtor(&ZEND_OP2_LITERAL(op));
1052
585
        }
1053
20.5k
      }
1054
15.8k
    }
1055
361k
  }
1056
1057
98.6k
  new_opcodes = emalloc(len * sizeof(zend_op));
1058
98.6k
  opline = new_opcodes;
1059
1060
  /* Copy code of reachable blocks into a single buffer */
1061
493k
  for (b = blocks; b < end; b++) {
1062
395k
    if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1063
345k
      memcpy(opline, op_array->opcodes + b->start, b->len * sizeof(zend_op));
1064
345k
      b->start = opline - new_opcodes;
1065
345k
      opline += b->len;
1066
345k
    }
1067
395k
  }
1068
1069
  /* adjust jump targets */
1070
98.6k
  efree(op_array->opcodes);
1071
98.6k
  op_array->opcodes = new_opcodes;
1072
98.6k
  op_array->last = len;
1073
1074
493k
  for (b = blocks; b < end; b++) {
1075
395k
    if (!(b->flags & ZEND_BB_REACHABLE) || b->len == 0) {
1076
49.7k
      continue;
1077
49.7k
    }
1078
345k
    opline = op_array->opcodes + b->start + b->len - 1;
1079
345k
    switch (opline->opcode) {
1080
651
      case ZEND_FAST_CALL:
1081
48.5k
      case ZEND_JMP:
1082
48.5k
        ZEND_SET_OP_JMP_ADDR(opline, opline->op1, new_opcodes + blocks[b->successors[0]].start);
1083
48.5k
        break;
1084
16.0k
      case ZEND_JMPZ:
1085
24.6k
      case ZEND_JMPNZ:
1086
25.9k
      case ZEND_JMPZ_EX:
1087
27.3k
      case ZEND_JMPNZ_EX:
1088
39.8k
      case ZEND_FE_RESET_R:
1089
40.5k
      case ZEND_FE_RESET_RW:
1090
41.8k
      case ZEND_JMP_SET:
1091
45.9k
      case ZEND_COALESCE:
1092
47.3k
      case ZEND_ASSERT_CHECK:
1093
79.5k
      case ZEND_JMP_NULL:
1094
79.7k
      case ZEND_BIND_INIT_STATIC_OR_JMP:
1095
79.7k
      case ZEND_JMP_FRAMELESS:
1096
79.7k
        ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1097
79.7k
        break;
1098
5.38k
      case ZEND_CATCH:
1099
5.38k
        if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1100
4.02k
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1101
4.02k
        }
1102
5.38k
        break;
1103
12.4k
      case ZEND_FE_FETCH_R:
1104
13.2k
      case ZEND_FE_FETCH_RW:
1105
13.2k
        opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[0]].start);
1106
13.2k
        break;
1107
8
      case ZEND_SWITCH_LONG:
1108
58
      case ZEND_SWITCH_STRING:
1109
220
      case ZEND_MATCH:
1110
220
      {
1111
220
        const HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
1112
220
        zval *zv;
1113
220
        uint32_t s = 0;
1114
220
        ZEND_ASSERT(b->successors_count == (opline->opcode == ZEND_MATCH ? 1 : 2) + zend_hash_num_elements(jumptable));
1115
1116
2.00k
        ZEND_HASH_FOREACH_VAL(jumptable, zv) {
1117
2.00k
          Z_LVAL_P(zv) = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1118
2.00k
        } ZEND_HASH_FOREACH_END();
1119
220
        opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1120
220
        break;
1121
220
      }
1122
345k
    }
1123
345k
  }
1124
1125
  /* adjust exception jump targets & remove unused try_catch_array entries */
1126
98.6k
  if (op_array->last_try_catch) {
1127
24.4k
    uint32_t i, j;
1128
24.4k
    uint32_t *map;
1129
24.4k
    ALLOCA_FLAG(use_heap);
1130
1131
24.4k
    map = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last_try_catch, use_heap);
1132
55.1k
    for (i = 0, j = 0; i< op_array->last_try_catch; i++) {
1133
30.6k
      if (blocks[cfg->map[op_array->try_catch_array[i].try_op]].flags & ZEND_BB_REACHABLE) {
1134
30.6k
        map[i] = j;
1135
30.6k
        op_array->try_catch_array[j].try_op = blocks[cfg->map[op_array->try_catch_array[i].try_op]].start;
1136
30.6k
        if (op_array->try_catch_array[i].catch_op) {
1137
30.0k
          op_array->try_catch_array[j].catch_op = blocks[cfg->map[op_array->try_catch_array[i].catch_op]].start;
1138
30.0k
        } else {
1139
584
          op_array->try_catch_array[j].catch_op =  0;
1140
584
        }
1141
30.6k
        if (op_array->try_catch_array[i].finally_op) {
1142
727
          op_array->try_catch_array[j].finally_op = blocks[cfg->map[op_array->try_catch_array[i].finally_op]].start;
1143
29.9k
        } else {
1144
29.9k
          op_array->try_catch_array[j].finally_op =  0;
1145
29.9k
        }
1146
30.6k
        if (!op_array->try_catch_array[i].finally_end) {
1147
29.9k
          op_array->try_catch_array[j].finally_end = 0;
1148
29.9k
        } else {
1149
727
          op_array->try_catch_array[j].finally_end = blocks[cfg->map[op_array->try_catch_array[i].finally_end]].start;
1150
727
        }
1151
30.6k
        j++;
1152
30.6k
      }
1153
30.6k
    }
1154
24.4k
    if (i != j) {
1155
9
      op_array->last_try_catch = j;
1156
9
      if (j == 0) {
1157
5
        efree(op_array->try_catch_array);
1158
5
        op_array->try_catch_array = NULL;
1159
5
      }
1160
1161
9
      if (op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) {
1162
0
        zend_op *finally_opline = new_opcodes;
1163
0
        const zend_op *last_finally_op = finally_opline + len;
1164
0
        while (finally_opline < last_finally_op) {
1165
0
          if (finally_opline->opcode == ZEND_FAST_RET &&
1166
0
              finally_opline->op2.num != (uint32_t)-1 &&
1167
0
              finally_opline->op2.num < j) {
1168
0
            finally_opline->op2.num = map[finally_opline->op2.num];
1169
0
          }
1170
0
          finally_opline++;
1171
0
        }
1172
0
      }
1173
9
    }
1174
24.4k
    free_alloca(map, use_heap);
1175
24.4k
  }
1176
1177
  /* rebuild map (just for printing) */
1178
98.6k
  memset(cfg->map, -1, sizeof(int) * op_array->last);
1179
493k
  for (int n = 0; n < cfg->blocks_count; n++) {
1180
395k
    if (cfg->blocks[n].flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1181
345k
      cfg->map[cfg->blocks[n].start] = n;
1182
345k
    }
1183
395k
  }
1184
98.6k
}
1185
1186
static zend_always_inline zend_basic_block *get_target_block(const zend_cfg *cfg, const zend_basic_block *block, int n, uint32_t *opt_count)
1187
168k
{
1188
168k
  int b;
1189
168k
  zend_basic_block *target_block = cfg->blocks + block->successors[n];
1190
1191
168k
  if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1192
170
    do {
1193
170
      b = target_block->successors[0];
1194
170
      target_block = cfg->blocks + b;
1195
170
    } while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1196
136
    block->successors[n] = b;
1197
136
    ++(*opt_count);
1198
136
  }
1199
168k
  return target_block;
1200
168k
}
1201
1202
static zend_always_inline zend_basic_block *get_follow_block(const zend_cfg *cfg, const zend_basic_block *block, int n, uint32_t *opt_count)
1203
42.3k
{
1204
42.3k
  int b;
1205
42.3k
  zend_basic_block *target_block = cfg->blocks + block->successors[n];
1206
1207
42.3k
  if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1208
937
    do {
1209
937
      b = target_block->successors[0];
1210
937
      target_block = cfg->blocks + b;
1211
937
    } while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1212
841
    block->successors[n] = b;
1213
841
    ++(*opt_count);
1214
841
  }
1215
42.3k
  return target_block;
1216
42.3k
}
1217
1218
static zend_always_inline zend_basic_block *get_next_block(const zend_cfg *cfg, zend_basic_block *block)
1219
85.3k
{
1220
85.3k
  zend_basic_block *next_block = block + 1;
1221
85.3k
  const zend_basic_block *end = cfg->blocks + cfg->blocks_count;
1222
1223
99.3k
  while (1) {
1224
99.3k
    if (next_block == end) {
1225
757
      return NULL;
1226
98.6k
    } else if (next_block->flags & ZEND_BB_REACHABLE) {
1227
84.6k
      break;
1228
84.6k
    }
1229
13.9k
    next_block++;
1230
13.9k
  }
1231
84.7k
  while (next_block->len == 0 && !(next_block->flags & ZEND_BB_PROTECTED)) {
1232
91
    next_block = cfg->blocks + next_block->successors[0];
1233
91
  }
1234
84.6k
  return next_block;
1235
85.3k
}
1236
1237
1238
/* we use "jmp_hitlist" to avoid infinity loops during jmp optimization */
1239
static zend_always_inline bool in_hitlist(int target, const int *jmp_hitlist, int jmp_hitlist_count)
1240
642
{
1241
642
  int i;
1242
1243
810
  for (i = 0; i < jmp_hitlist_count; i++) {
1244
378
    if (jmp_hitlist[i] == target) {
1245
210
      return 1;
1246
210
    }
1247
378
  }
1248
432
  return 0;
1249
642
}
1250
1251
#define CHECK_LOOP(target) \
1252
642
  if (EXPECTED(!in_hitlist(target, jmp_hitlist, jmp_hitlist_count))) { \
1253
432
    jmp_hitlist[jmp_hitlist_count++] = target;  \
1254
432
  } else { \
1255
210
    break; \
1256
210
  }
1257
1258
static void zend_jmp_optimization(zend_basic_block *block, zend_op_array *op_array, const zend_cfg *cfg, int *jmp_hitlist, uint32_t *opt_count)
1259
533k
{
1260
  /* last_op is the last opcode of the current block */
1261
533k
  zend_basic_block *target_block, *follow_block, *next_block;
1262
533k
  zend_op *last_op, *target;
1263
533k
  int next, jmp_hitlist_count;
1264
1265
533k
  if (block->len == 0) {
1266
1.40k
    return;
1267
1.40k
  }
1268
1269
531k
  last_op = op_array->opcodes + block->start + block->len - 1;
1270
531k
  switch (last_op->opcode) {
1271
84.6k
    case ZEND_JMP:
1272
84.6k
      jmp_hitlist_count = 0;
1273
1274
84.6k
      target_block = get_target_block(cfg, block, 0, opt_count);
1275
84.6k
      while (target_block->len == 1) {
1276
44.9k
        target = op_array->opcodes + target_block->start;
1277
44.9k
        if (target->opcode == ZEND_JMP) {
1278
          /* JMP L, L: JMP L1 -> JMP L1 */
1279
76
          next = target_block->successors[0];
1280
44.9k
        } else {
1281
44.9k
          break;
1282
44.9k
        }
1283
76
        CHECK_LOOP(next);
1284
40
        block->successors[0] = next;
1285
40
        ++(*opt_count);
1286
40
        target_block = get_target_block(cfg, block, 0, opt_count);
1287
40
      }
1288
1289
84.6k
      next_block = get_next_block(cfg, block);
1290
84.6k
      if (target_block == next_block) {
1291
        /* JMP(next) -> NOP */
1292
951
        MAKE_NOP(last_op);
1293
951
        ++(*opt_count);
1294
951
        block->len--;
1295
83.6k
      } else if (target_block->len == 1) {
1296
44.6k
        target = op_array->opcodes + target_block->start;
1297
44.6k
        if ((target->opcode == ZEND_RETURN ||
1298
44.4k
                    target->opcode == ZEND_RETURN_BY_REF ||
1299
44.4k
                    target->opcode == ZEND_GENERATOR_RETURN) &&
1300
318
                   !(op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK)) {
1301
          /* JMP L, L: RETURN to immediate RETURN */
1302
46
          *last_op = *target;
1303
46
          if (last_op->op1_type == IS_CONST) {
1304
46
            zval zv;
1305
46
            ZVAL_COPY(&zv, &ZEND_OP1_LITERAL(last_op));
1306
46
            last_op->op1.constant = zend_optimizer_add_literal(op_array, &zv);
1307
46
          }
1308
46
          block->successors_count = 0;
1309
46
          ++(*opt_count);
1310
46
        }
1311
44.6k
      }
1312
84.6k
      break;
1313
1314
1.89k
    case ZEND_JMP_SET:
1315
7.79k
    case ZEND_COALESCE:
1316
40.7k
    case ZEND_JMP_NULL:
1317
40.7k
      jmp_hitlist_count = 0;
1318
1319
40.7k
      target_block = get_target_block(cfg, block, 0, opt_count);
1320
40.7k
      while (target_block->len == 1) {
1321
4.76k
        target = op_array->opcodes + target_block->start;
1322
1323
4.76k
        if (target->opcode == ZEND_JMP) {
1324
          /* JMP_SET(X, L), L: JMP(L2) -> JMP_SET(X, L2) */
1325
32
          next = target_block->successors[0];
1326
32
          CHECK_LOOP(next);
1327
32
          block->successors[0] = next;
1328
32
          ++(*opt_count);
1329
4.73k
        } else {
1330
4.73k
          break;
1331
4.73k
        }
1332
32
        target_block = get_target_block(cfg, block, 0, opt_count);
1333
32
      }
1334
40.7k
      break;
1335
1336
26.8k
    case ZEND_JMPZ:
1337
37.6k
    case ZEND_JMPNZ:
1338
37.6k
      jmp_hitlist_count = 0;
1339
1340
37.6k
      target_block = get_target_block(cfg, block, 0, opt_count);
1341
38.0k
      while (target_block->len == 1) {
1342
25.4k
        target = op_array->opcodes + target_block->start;
1343
1344
25.4k
        if (target->opcode == ZEND_JMP) {
1345
          /* JMPZ(X, L), L: JMP(L2) -> JMPZ(X, L2) */
1346
86
          next = target_block->successors[0];
1347
25.3k
        } else if (target->opcode == last_op->opcode &&
1348
754
                   SAME_VAR(target->op1, last_op->op1)) {
1349
          /* JMPZ(X, L), L: JMPZ(X, L2) -> JMPZ(X, L2) */
1350
424
          next = target_block->successors[0];
1351
24.9k
        } else if (target->opcode == INV_COND(last_op->opcode) &&
1352
125
                   SAME_VAR(target->op1, last_op->op1)) {
1353
          /* JMPZ(X, L), L: JMPNZ(X, L2) -> JMPZ(X, L+1) */
1354
22
          next = target_block->successors[1];
1355
24.8k
        } else {
1356
24.8k
          break;
1357
24.8k
        }
1358
532
        CHECK_LOOP(next);
1359
358
        block->successors[0] = next;
1360
358
        ++(*opt_count);
1361
358
        target_block = get_target_block(cfg, block, 0, opt_count);
1362
358
      }
1363
1364
37.6k
      follow_block = get_follow_block(cfg, block, 1, opt_count);
1365
37.6k
      if (target_block == follow_block) {
1366
        /* L: JMP[N]Z(X, L+1) -> NOP or FREE(X) */
1367
617
        zend_optimizer_convert_to_free_op1(op_array, last_op);
1368
617
        if (last_op->opcode == ZEND_NOP) {
1369
0
          block->len--;
1370
0
        }
1371
617
        block->successors_count = 1;
1372
617
        ++(*opt_count);
1373
37.0k
      } else if (follow_block->len == 1) {
1374
7.50k
        target = op_array->opcodes + follow_block->start;
1375
7.50k
        if (target->opcode == ZEND_JMP) {
1376
1.00k
            if (block->successors[0] == follow_block->successors[0]) {
1377
            /* JMPZ(X,L1), JMP(L1) -> NOP, JMP(L1) */
1378
224
            zend_optimizer_convert_to_free_op1(op_array, last_op);
1379
224
            if (last_op->opcode == ZEND_NOP) {
1380
0
              block->len--;
1381
0
            }
1382
224
            block->successors[0] = follow_block - cfg->blocks;
1383
224
            block->successors_count = 1;
1384
224
            ++(*opt_count);
1385
224
            break;
1386
779
          } else if (!(follow_block->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED))) {
1387
779
            next_block = get_next_block(cfg, follow_block);
1388
1389
779
            if (target_block == next_block) {
1390
              /* JMPZ(X,L1) JMP(L2) L1: -> JMPNZ(X,L2) NOP*/
1391
1392
394
              last_op->opcode = INV_COND(last_op->opcode);
1393
1394
394
              block->successors[0] = follow_block->successors[0];
1395
394
              block->successors[1] = next_block - cfg->blocks;
1396
1397
394
              follow_block->flags &= ~ZEND_BB_REACHABLE;
1398
394
              MAKE_NOP(target);
1399
394
              follow_block->len = 0;
1400
1401
394
              next_block->flags |= ZEND_BB_FOLLOW;
1402
1403
394
              break;
1404
394
            }
1405
779
          }
1406
1.00k
        }
1407
7.50k
      }
1408
37.0k
      break;
1409
1410
37.0k
    case ZEND_JMPNZ_EX:
1411
4.62k
    case ZEND_JMPZ_EX:
1412
4.62k
      jmp_hitlist_count = 0;
1413
1414
4.62k
      target_block = get_target_block(cfg, block, 0, opt_count);
1415
4.63k
      while (target_block->len == 1) {
1416
1.73k
        target = op_array->opcodes + target_block->start;
1417
1418
1.73k
        if (target->opcode == ZEND_JMP) {
1419
          /* T = JMPZ_EX(X, L), L: JMP(L2) -> T = JMPZ(X, L2) */
1420
0
          next = target_block->successors[0];
1421
1.73k
        } else if (target->opcode == last_op->opcode-3 &&
1422
0
                   (SAME_VAR(target->op1, last_op->result) ||
1423
0
                    SAME_VAR(target->op1, last_op->op1))) {
1424
          /* T = JMPZ_EX(X, L1), L1: JMPZ({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1425
0
          next = target_block->successors[0];
1426
1.73k
        } else if (target->opcode == last_op->opcode &&
1427
0
                   target->result.var == last_op->result.var &&
1428
0
                   (SAME_VAR(target->op1, last_op->result) ||
1429
0
                    SAME_VAR(target->op1, last_op->op1))) {
1430
          /* T = JMPZ_EX(X, L1), L1: T = JMPZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1431
0
          next = target_block->successors[0];
1432
1.73k
        } else if (target->opcode == INV_EX_COND(last_op->opcode) &&
1433
2
                   (SAME_VAR(target->op1, last_op->result) ||
1434
2
                    SAME_VAR(target->op1, last_op->op1))) {
1435
          /* T = JMPZ_EX(X, L1), L1: JMPNZ({X|T1}, L2) -> T = JMPZ_EX(X, L1+1) */
1436
2
          next = target_block->successors[1];
1437
1.73k
        } else if (target->opcode == INV_EX_COND_EX(last_op->opcode) &&
1438
144
                   target->result.var == last_op->result.var &&
1439
120
                   (SAME_VAR(target->op1, last_op->result) ||
1440
120
                    SAME_VAR(target->op1, last_op->op1))) {
1441
          /* T = JMPZ_EX(X, L1), L1: T = JMPNZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L1+1) */
1442
0
          next = target_block->successors[1];
1443
1.73k
        } else if (target->opcode == ZEND_BOOL &&
1444
0
                   (SAME_VAR(target->op1, last_op->result) ||
1445
0
                    SAME_VAR(target->op1, last_op->op1))) {
1446
          /* convert Y = JMPZ_EX(X,L1), L1: Z = BOOL(Y) to
1447
             Z = JMPZ_EX(X,L1+1) */
1448
1449
          /* NOTE: This optimization pattern is not safe, but works, */
1450
          /*       because result of JMPZ_EX instruction             */
1451
          /*       is not used on the following path and             */
1452
          /*       should be used once on the branch path.           */
1453
          /*                                                         */
1454
          /*       The pattern works well only if jumps processed in */
1455
          /*       direct order, otherwise it breaks JMPZ_EX         */
1456
          /*       sequences too early.                              */
1457
0
          last_op->result.var = target->result.var;
1458
0
          next = target_block->successors[0];
1459
1.73k
        } else {
1460
1.73k
          break;
1461
1.73k
        }
1462
2
        CHECK_LOOP(next);
1463
2
        block->successors[0] = next;
1464
2
        ++(*opt_count);
1465
2
        target_block = get_target_block(cfg, block, 0, opt_count);
1466
2
      }
1467
1468
4.62k
      follow_block = get_follow_block(cfg, block, 1, opt_count);
1469
4.62k
      if (target_block == follow_block) {
1470
        /* L: T = JMP[N]Z_EX(X, L+1) -> T = BOOL(X) */
1471
0
        last_op->opcode = ZEND_BOOL;
1472
0
        last_op->op2.num = 0;
1473
0
        block->successors_count = 1;
1474
0
        ++(*opt_count);
1475
0
        break;
1476
0
      }
1477
4.62k
      break;
1478
531k
  }
1479
531k
}
1480
1481
/* Global data dependencies */
1482
1483
/* Find a set of variables which are used outside of the block where they are
1484
 * defined. We won't apply some optimization patterns for such variables. */
1485
static void zend_t_usage(const zend_cfg *cfg, const zend_op_array *op_array, zend_bitset used_ext, zend_optimizer_ctx *ctx)
1486
123k
{
1487
123k
  int n;
1488
123k
  zend_basic_block *block, *next_block;
1489
123k
  uint32_t var_num;
1490
123k
  uint32_t bitset_len;
1491
123k
  zend_bitset usage;
1492
123k
  zend_bitset defined_here;
1493
123k
  void *checkpoint;
1494
123k
  zend_op *opline, *end;
1495
1496
1497
123k
  if (op_array->T == 0) {
1498
    /* shortcut - if no Ts, nothing to do */
1499
14.7k
    return;
1500
14.7k
  }
1501
1502
108k
  checkpoint = zend_arena_checkpoint(ctx->arena);
1503
108k
  bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1504
108k
  defined_here = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1505
1506
108k
  zend_bitset_clear(defined_here, bitset_len);
1507
569k
  for (n = 1; n < cfg->blocks_count; n++) {
1508
460k
    block = cfg->blocks + n;
1509
1510
460k
    if (!(block->flags & ZEND_BB_REACHABLE)) {
1511
50.4k
      continue;
1512
50.4k
    }
1513
1514
410k
    opline = op_array->opcodes + block->start;
1515
410k
    end = opline + block->len;
1516
410k
    if (!(block->flags & ZEND_BB_FOLLOW) ||
1517
302k
        (block->flags & ZEND_BB_TARGET)) {
1518
      /* Skip continuation of "extended" BB */
1519
212k
      zend_bitset_clear(defined_here, bitset_len);
1520
212k
    }
1521
1522
2.27M
    while (opline<end) {
1523
1.86M
      if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1524
541k
        var_num = VAR_NUM(opline->op1.var);
1525
541k
        if (!zend_bitset_in(defined_here, var_num)) {
1526
241k
          zend_bitset_incl(used_ext, var_num);
1527
241k
        }
1528
541k
      }
1529
1.86M
      if (opline->op2_type == IS_VAR) {
1530
53.7k
        var_num = VAR_NUM(opline->op2.var);
1531
53.7k
        if (opline->opcode == ZEND_FE_FETCH_R ||
1532
53.4k
            opline->opcode == ZEND_FE_FETCH_RW) {
1533
          /* these opcode use the op2 as result */
1534
257
          zend_bitset_incl(defined_here, var_num);
1535
53.4k
        } else if (!zend_bitset_in(defined_here, var_num)) {
1536
158
          zend_bitset_incl(used_ext, var_num);
1537
158
        }
1538
1.80M
      } else if (opline->op2_type == IS_TMP_VAR) {
1539
274k
        var_num = VAR_NUM(opline->op2.var);
1540
274k
        if (!zend_bitset_in(defined_here, var_num)) {
1541
33.6k
          zend_bitset_incl(used_ext, var_num);
1542
33.6k
        }
1543
274k
      }
1544
1545
1.86M
      if (opline->result_type == IS_VAR) {
1546
125k
        var_num = VAR_NUM(opline->result.var);
1547
125k
        zend_bitset_incl(defined_here, var_num);
1548
1.73M
      } else if (opline->result_type == IS_TMP_VAR) {
1549
747k
        var_num = VAR_NUM(opline->result.var);
1550
747k
        switch (opline->opcode) {
1551
3.86k
          case ZEND_ADD_ARRAY_ELEMENT:
1552
3.91k
          case ZEND_ADD_ARRAY_UNPACK:
1553
214k
          case ZEND_ROPE_ADD:
1554
            /* these opcodes use the result as argument */
1555
214k
            if (!zend_bitset_in(defined_here, var_num)) {
1556
177k
              zend_bitset_incl(used_ext, var_num);
1557
177k
            }
1558
214k
            break;
1559
533k
          default :
1560
533k
            zend_bitset_incl(defined_here, var_num);
1561
747k
        }
1562
747k
      }
1563
1.86M
      opline++;
1564
1.86M
    }
1565
410k
  }
1566
1567
108k
  if (ctx->debug_level & ZEND_DUMP_BLOCK_PASS_VARS) {
1568
0
    bool printed = false;
1569
0
    uint32_t i;
1570
1571
0
    for (i = op_array->last_var; i< op_array->T; i++) {
1572
0
      if (zend_bitset_in(used_ext, i)) {
1573
0
        if (!printed) {
1574
0
          fprintf(stderr, "NON-LOCAL-VARS: %d", i);
1575
0
          printed = true;
1576
0
        } else {
1577
0
          fprintf(stderr, ", %d", i);
1578
0
        }
1579
0
      }
1580
0
    }
1581
0
    if (printed) {
1582
0
      fprintf(stderr, "\n");
1583
0
    }
1584
0
  }
1585
1586
108k
  usage = defined_here;
1587
108k
  next_block = NULL;
1588
677k
  for (n = cfg->blocks_count; n > 0;) {
1589
569k
    block = cfg->blocks + (--n);
1590
1591
569k
    if (!(block->flags & ZEND_BB_REACHABLE) || block->len == 0) {
1592
50.6k
      continue;
1593
50.6k
    }
1594
1595
518k
    end = op_array->opcodes + block->start;
1596
518k
    opline = end + block->len - 1;
1597
518k
    if (!next_block ||
1598
409k
        !(next_block->flags & ZEND_BB_FOLLOW) ||
1599
321k
        (next_block->flags & ZEND_BB_TARGET)) {
1600
      /* Skip continuation of "extended" BB */
1601
321k
      zend_bitset_copy(usage, used_ext, bitset_len);
1602
321k
    } else if (block->successors_count > 1) {
1603
117k
      zend_bitset_union(usage, used_ext, bitset_len);
1604
117k
    }
1605
518k
    next_block = block;
1606
1607
3.86M
    while (opline >= end) {
1608
      /* usage checks */
1609
3.34M
      if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
1610
1.60M
        if (!zend_bitset_in(usage, VAR_NUM(opline->result.var))) {
1611
7.99k
          switch (opline->opcode) {
1612
0
            case ZEND_ASSIGN_OP:
1613
0
            case ZEND_ASSIGN_DIM_OP:
1614
0
            case ZEND_ASSIGN_OBJ_OP:
1615
0
            case ZEND_ASSIGN_STATIC_PROP_OP:
1616
0
            case ZEND_PRE_INC:
1617
0
            case ZEND_PRE_DEC:
1618
0
            case ZEND_ASSIGN:
1619
0
            case ZEND_ASSIGN_REF:
1620
0
            case ZEND_DO_FCALL:
1621
0
            case ZEND_DO_ICALL:
1622
0
            case ZEND_DO_UCALL:
1623
0
            case ZEND_DO_FCALL_BY_NAME:
1624
0
              opline->result_type = IS_UNUSED;
1625
0
              break;
1626
0
            case ZEND_POST_INC:
1627
0
            case ZEND_POST_DEC:
1628
0
            case ZEND_POST_INC_OBJ:
1629
0
            case ZEND_POST_DEC_OBJ:
1630
0
            case ZEND_POST_INC_STATIC_PROP:
1631
0
            case ZEND_POST_DEC_STATIC_PROP:
1632
0
              opline->opcode -= 2;
1633
0
              opline->result_type = IS_UNUSED;
1634
0
              break;
1635
754
            case ZEND_QM_ASSIGN:
1636
1.77k
            case ZEND_BOOL:
1637
4.25k
            case ZEND_BOOL_NOT:
1638
4.25k
              zend_optimizer_convert_to_free_op1(op_array, opline);
1639
4.25k
              break;
1640
1.71k
            case ZEND_JMPZ_EX:
1641
3.64k
            case ZEND_JMPNZ_EX:
1642
3.64k
              opline->opcode -= 3;
1643
3.64k
              SET_UNUSED(opline->result);
1644
3.64k
              break;
1645
0
            case ZEND_ADD_ARRAY_ELEMENT:
1646
0
            case ZEND_ADD_ARRAY_UNPACK:
1647
0
            case ZEND_ROPE_ADD:
1648
0
              zend_bitset_incl(usage, VAR_NUM(opline->result.var));
1649
0
              break;
1650
7.99k
          }
1651
1.59M
        } else {
1652
1.59M
          switch (opline->opcode) {
1653
42.4k
            case ZEND_ADD_ARRAY_ELEMENT:
1654
42.6k
            case ZEND_ADD_ARRAY_UNPACK:
1655
322k
            case ZEND_ROPE_ADD:
1656
322k
              break;
1657
1.27M
            default:
1658
1.27M
              zend_bitset_excl(usage, VAR_NUM(opline->result.var));
1659
1.27M
              break;
1660
1.59M
          }
1661
1.59M
        }
1662
1.60M
      }
1663
1664
3.34M
      if (opline->op2_type == IS_VAR) {
1665
85.0k
        switch (opline->opcode) {
1666
237
          case ZEND_FE_FETCH_R:
1667
257
          case ZEND_FE_FETCH_RW:
1668
257
            zend_bitset_excl(usage, VAR_NUM(opline->op2.var));
1669
257
            break;
1670
84.7k
          default:
1671
84.7k
            zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1672
84.7k
            break;
1673
85.0k
        }
1674
3.26M
      } else if (opline->op2_type == IS_TMP_VAR) {
1675
525k
        zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1676
525k
      }
1677
1678
3.34M
      if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1679
931k
        zend_bitset_incl(usage, VAR_NUM(opline->op1.var));
1680
931k
      }
1681
1682
3.34M
      opline--;
1683
3.34M
    }
1684
518k
  }
1685
1686
108k
  zend_arena_release(&ctx->arena, checkpoint);
1687
108k
}
1688
1689
static void zend_merge_blocks(const zend_op_array *op_array, const zend_cfg *cfg, uint32_t *opt_count)
1690
123k
{
1691
123k
  int i;
1692
123k
  zend_basic_block *b, *bb;
1693
123k
  zend_basic_block *prev = NULL;
1694
1695
710k
  for (i = 0; i < cfg->blocks_count; i++) {
1696
587k
    b = cfg->blocks + i;
1697
587k
    if (b->flags & ZEND_BB_REACHABLE) {
1698
530k
      if ((b->flags & ZEND_BB_FOLLOW) &&
1699
301k
          !(b->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED)) &&
1700
145k
          prev && prev->successors_count == 1 && prev->successors[0] == i)
1701
30.5k
      {
1702
30.5k
        zend_op *last_op = op_array->opcodes + prev->start + prev->len - 1;
1703
30.5k
        if (prev->len != 0 && last_op->opcode == ZEND_JMP) {
1704
0
          MAKE_NOP(last_op);
1705
0
        }
1706
1707
34.1k
        for (bb = prev + 1; bb != b; bb++) {
1708
3.57k
          zend_op *op = op_array->opcodes + bb->start;
1709
3.57k
          const zend_op *end = op + bb->len;
1710
6.71k
          while (op < end) {
1711
3.14k
            if (op->op1_type == IS_CONST) {
1712
1.22k
              literal_dtor(&ZEND_OP1_LITERAL(op));
1713
1.22k
            }
1714
3.14k
            if (op->op2_type == IS_CONST) {
1715
672
              literal_dtor(&ZEND_OP2_LITERAL(op));
1716
672
            }
1717
3.14k
            MAKE_NOP(op);
1718
3.14k
            op++;
1719
3.14k
          }
1720
          /* make block empty */
1721
3.57k
          bb->len = 0;
1722
3.57k
        }
1723
1724
        /* re-link */
1725
30.5k
        prev->flags |= (b->flags & ZEND_BB_EXIT);
1726
30.5k
        prev->len = b->start + b->len - prev->start;
1727
30.5k
        prev->successors_count = b->successors_count;
1728
30.5k
        if (b->successors != b->successors_storage) {
1729
50
          prev->successors = b->successors;
1730
50
          b->successors = b->successors_storage;
1731
30.5k
        } else {
1732
30.5k
          memcpy(prev->successors, b->successors, b->successors_count * sizeof(int));
1733
30.5k
        }
1734
1735
        /* unlink & make block empty and unreachable */
1736
30.5k
        b->flags = 0;
1737
30.5k
        b->len = 0;
1738
30.5k
        b->successors_count = 0;
1739
30.5k
        ++(*opt_count);
1740
500k
      } else {
1741
500k
        prev = b;
1742
500k
      }
1743
530k
    }
1744
587k
  }
1745
123k
}
1746
1747
123k
#define PASSES 3
1748
1749
void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1750
98.6k
{
1751
98.6k
  zend_cfg cfg;
1752
98.6k
  zend_basic_block *blocks, *end, *b;
1753
98.6k
  int pass;
1754
98.6k
  uint32_t bitset_len;
1755
98.6k
  zend_bitset usage;
1756
98.6k
  void *checkpoint;
1757
98.6k
  zend_op **Tsource;
1758
98.6k
  uint32_t opt_count;
1759
98.6k
  int *jmp_hitlist;
1760
1761
    /* Build CFG */
1762
98.6k
  checkpoint = zend_arena_checkpoint(ctx->arena);
1763
98.6k
  zend_build_cfg(&ctx->arena, op_array, 0, &cfg);
1764
1765
98.6k
  if (cfg.blocks_count * (op_array->last_var + op_array->T) > 64 * 1024 * 1024) {
1766
0
    zend_arena_release(&ctx->arena, checkpoint);
1767
0
    return;
1768
0
  }
1769
1770
98.6k
  if (ctx->debug_level & ZEND_DUMP_BEFORE_BLOCK_PASS) {
1771
0
    zend_dump_op_array(op_array, ZEND_DUMP_CFG, "before block pass", &cfg);
1772
0
  }
1773
1774
98.6k
  bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1775
98.6k
  Tsource = zend_arena_calloc(&ctx->arena, op_array->last_var + op_array->T, sizeof(zend_op *));
1776
98.6k
  usage = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1777
98.6k
  jmp_hitlist = zend_arena_alloc(&ctx->arena, cfg.blocks_count * sizeof(int));
1778
1779
98.6k
  blocks = cfg.blocks;
1780
98.6k
  end = blocks + cfg.blocks_count;
1781
123k
  for (pass = 0; pass < PASSES; pass++) {
1782
123k
    opt_count = 0;
1783
1784
    /* Compute data dependencies */
1785
123k
    zend_bitset_clear(usage, bitset_len);
1786
123k
    zend_t_usage(&cfg, op_array, usage, ctx);
1787
1788
    /* optimize each basic block separately */
1789
710k
    for (b = blocks; b < end; b++) {
1790
587k
      if (!(b->flags & ZEND_BB_REACHABLE)) {
1791
53.7k
        continue;
1792
53.7k
      }
1793
      /* we track data dependencies only inside a single basic block */
1794
533k
      if (!(b->flags & ZEND_BB_FOLLOW) ||
1795
336k
          (b->flags & ZEND_BB_TARGET)) {
1796
        /* Skip continuation of "extended" BB */
1797
336k
        memset(Tsource, 0, (op_array->last_var + op_array->T) * sizeof(zend_op *));
1798
336k
      }
1799
533k
      zend_optimize_block(b, op_array, usage, &cfg, Tsource, &opt_count);
1800
533k
    }
1801
1802
    /* Eliminate NOPs */
1803
710k
    for (b = blocks; b < end; b++) {
1804
587k
      if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
1805
        /* In unreachable_free blocks only preserve loop var frees. */
1806
94
        for (uint32_t i = b->start; i < b->start + b->len; i++) {
1807
64
          zend_op *opline = &op_array->opcodes[i];
1808
64
          if (!zend_optimizer_is_loop_var_free(opline)) {
1809
34
            MAKE_NOP(opline);
1810
34
          }
1811
64
        }
1812
30
      }
1813
587k
      if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1814
533k
        strip_nops(op_array, b);
1815
533k
      }
1816
587k
    }
1817
1818
123k
    opt_count = 0;
1819
1820
    /* Jump optimization for each block */
1821
710k
    for (b = blocks; b < end; b++) {
1822
587k
      if (b->flags & ZEND_BB_REACHABLE) {
1823
533k
        zend_jmp_optimization(b, op_array, &cfg, jmp_hitlist, &opt_count);
1824
533k
      }
1825
587k
    }
1826
1827
    /* Eliminate unreachable basic blocks */
1828
123k
    zend_cfg_remark_reachable_blocks(op_array, &cfg);
1829
1830
    /* Merge Blocks */
1831
123k
    zend_merge_blocks(op_array, &cfg, &opt_count);
1832
1833
123k
    if (opt_count == 0) {
1834
98.5k
      break;
1835
98.5k
    }
1836
123k
  }
1837
1838
98.6k
  assemble_code_blocks(&cfg, op_array, ctx);
1839
1840
98.6k
  if (ctx->debug_level & ZEND_DUMP_AFTER_BLOCK_PASS) {
1841
0
    zend_dump_op_array(op_array, ZEND_DUMP_CFG | ZEND_DUMP_HIDE_UNREACHABLE, "after block pass", &cfg);
1842
0
  }
1843
1844
  /* Destroy CFG */
1845
98.6k
  zend_arena_release(&ctx->arena, checkpoint);
1846
98.6k
}