Coverage Report

Created: 2026-02-09 07:07

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/Optimizer/block_pass.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend OPcache                                                         |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Andi Gutmans <andi@php.net>                                 |
16
   |          Zeev Suraski <zeev@php.net>                                 |
17
   |          Stanislav Malyshev <stas@zend.com>                          |
18
   |          Dmitry Stogov <dmitry@php.net>                              |
19
   +----------------------------------------------------------------------+
20
*/
21
22
#include "Optimizer/zend_optimizer.h"
23
#include "Optimizer/zend_optimizer_internal.h"
24
#include "zend_API.h"
25
#include "zend_constants.h"
26
#include "zend_execute.h"
27
#include "zend_vm.h"
28
#include "zend_bitset.h"
29
#include "zend_cfg.h"
30
#include "zend_dump.h"
31
32
/* Checks if a constant (like "true") may be replaced by its value */
33
bool zend_optimizer_get_persistent_constant(zend_string *name, zval *result, bool copy)
34
20.4k
{
35
20.4k
  const zend_constant *c = zend_hash_find_ptr(EG(zend_constants), name);
36
20.4k
  if (c) {
37
30
    if ((ZEND_CONSTANT_FLAGS(c) & CONST_PERSISTENT)
38
30
     && !(ZEND_CONSTANT_FLAGS(c) & CONST_DEPRECATED)
39
0
     && (!(ZEND_CONSTANT_FLAGS(c) & CONST_NO_FILE_CACHE)
40
0
      || !(CG(compiler_options) & ZEND_COMPILE_WITH_FILE_CACHE))) {
41
0
      ZVAL_COPY_VALUE(result, &c->value);
42
0
      if (copy) {
43
0
        Z_TRY_ADDREF_P(result);
44
0
      }
45
0
      return true;
46
30
    } else {
47
30
      return false;
48
30
    }
49
30
  }
50
51
  /* Special constants null/true/false can always be substituted. */
52
20.4k
  c = zend_get_special_const(ZSTR_VAL(name), ZSTR_LEN(name));
53
20.4k
  if (c) {
54
0
    ZVAL_COPY_VALUE(result, &c->value);
55
0
    return true;
56
0
  }
57
20.4k
  return false;
58
20.4k
}
59
60
/* Data dependencies macros */
61
62
1.87M
#define VAR_SOURCE(op) Tsource[VAR_NUM(op.var)]
63
1.48M
#define SET_VAR_SOURCE(opline) Tsource[VAR_NUM(opline->result.var)] = opline
64
65
static void strip_leading_nops(const zend_op_array *op_array, zend_basic_block *b)
66
9.61k
{
67
9.61k
  const zend_op *opcodes = op_array->opcodes;
68
69
11.6k
  do {
70
11.6k
    b->start++;
71
11.6k
    b->len--;
72
11.6k
  } while (b->len > 0 && opcodes[b->start].opcode == ZEND_NOP);
73
9.61k
}
74
75
static void strip_nops(const zend_op_array *op_array, zend_basic_block *b)
76
526k
{
77
526k
  uint32_t i, j;
78
79
526k
  if (b->len == 0) {
80
1.01k
    return;
81
1.01k
  }
82
83
525k
  if (op_array->opcodes[b->start].opcode == ZEND_NOP) {
84
3.63k
    strip_leading_nops(op_array, b);
85
3.63k
  }
86
87
525k
  if (b->len == 0) {
88
296
    return;
89
296
  }
90
91
  /* strip the inside NOPs */
92
524k
  i = j = b->start + 1;
93
3.15M
  while (i < b->start + b->len) {
94
2.63M
    if (op_array->opcodes[i].opcode != ZEND_NOP) {
95
2.60M
      if (i != j) {
96
57.1k
        op_array->opcodes[j] = op_array->opcodes[i];
97
57.1k
      }
98
2.60M
      j++;
99
2.60M
    }
100
2.63M
    i++;
101
2.63M
  }
102
524k
  b->len = j - b->start;
103
549k
  while (j < i) {
104
24.7k
    MAKE_NOP(op_array->opcodes + j);
105
24.7k
    j++;
106
24.7k
  }
107
524k
}
108
109
76
static uint32_t get_const_switch_target(const zend_cfg *cfg, const zend_op_array *op_array, const zend_basic_block *block, zend_op *opline, const zval *val) {
110
76
  HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
111
76
  zval *zv;
112
76
  if ((opline->opcode == ZEND_SWITCH_LONG && Z_TYPE_P(val) != IS_LONG)
113
76
      || (opline->opcode == ZEND_SWITCH_STRING && Z_TYPE_P(val) != IS_STRING)) {
114
    /* fallback to next block */
115
8
    return block->successors[block->successors_count - 1];
116
8
  }
117
68
  if (opline->opcode == ZEND_MATCH && Z_TYPE_P(val) != IS_LONG && Z_TYPE_P(val) != IS_STRING) {
118
    /* always jump to the default arm */
119
14
    return block->successors[block->successors_count - 1];
120
14
  }
121
54
  if (Z_TYPE_P(val) == IS_LONG) {
122
30
    zv = zend_hash_index_find(jumptable, Z_LVAL_P(val));
123
30
  } else {
124
24
    ZEND_ASSERT(Z_TYPE_P(val) == IS_STRING);
125
24
    zv = zend_hash_find(jumptable, Z_STR_P(val));
126
24
  }
127
54
  if (!zv) {
128
    /* default */
129
30
    return block->successors[block->successors_count - (opline->opcode == ZEND_MATCH ? 1 : 2)];
130
30
  }
131
24
  return cfg->map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv))];
132
54
}
133
134
static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array, zend_bitset used_ext, zend_cfg *cfg, zend_op **Tsource, uint32_t *opt_count)
135
526k
{
136
526k
  zend_op *opline, *src;
137
526k
  zend_op *end, *last_op = NULL;
138
139
526k
  if (block->len == 0) {
140
230
    return;
141
230
  }
142
143
525k
  if (op_array->opcodes[block->start].opcode == ZEND_NOP) {
144
    /* remove leading NOPs */
145
5.98k
    strip_leading_nops(op_array, block);
146
5.98k
  }
147
148
525k
  opline = op_array->opcodes + block->start;
149
525k
  end = opline + block->len;
150
3.68M
  while (opline < end) {
151
    /* Constant Propagation: strip X = QM_ASSIGN(const) */
152
3.16M
    if (opline->op1_type == IS_TMP_VAR &&
153
878k
        opline->opcode != ZEND_FREE) {
154
846k
      src = VAR_SOURCE(opline->op1);
155
846k
      if (src &&
156
746k
          src->opcode == ZEND_QM_ASSIGN &&
157
2.66k
          src->op1_type == IS_CONST
158
846k
      ) {
159
1.79k
        znode_op op1 = opline->op1;
160
1.79k
        if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
161
2
          COPY_NODE(opline->result, opline->op1);
162
2
          COPY_NODE(opline->op1, src->op1);
163
2
          VAR_SOURCE(op1) = NULL;
164
2
          MAKE_NOP(src);
165
2
          ++(*opt_count);
166
1.78k
        } else {
167
1.78k
          zval c;
168
1.78k
          ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
169
1.78k
          if (opline->opcode != ZEND_CASE
170
1.78k
           && opline->opcode != ZEND_CASE_STRICT
171
1.77k
           && opline->opcode != ZEND_FETCH_LIST_R
172
1.75k
           && opline->opcode != ZEND_SWITCH_LONG
173
1.75k
           && opline->opcode != ZEND_SWITCH_STRING
174
1.75k
           && opline->opcode != ZEND_MATCH
175
1.75k
           && opline->opcode != ZEND_MATCH_ERROR
176
1.74k
           && zend_optimizer_update_op1_const(op_array, opline, &c)) {
177
1.69k
            VAR_SOURCE(op1) = NULL;
178
1.69k
            if (opline->opcode != ZEND_JMP_NULL
179
1.68k
             && !zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
180
1.16k
              literal_dtor(&ZEND_OP1_LITERAL(src));
181
1.16k
              MAKE_NOP(src);
182
1.16k
            }
183
1.69k
            ++(*opt_count);
184
1.69k
          } else {
185
96
            zval_ptr_dtor_nogc(&c);
186
96
          }
187
1.78k
        }
188
1.79k
      }
189
846k
    }
190
191
    /* Constant Propagation: strip X = QM_ASSIGN(const) */
192
3.16M
    if (opline->op2_type == IS_TMP_VAR) {
193
528k
      src = VAR_SOURCE(opline->op2);
194
528k
      if (src &&
195
491k
          src->opcode == ZEND_QM_ASSIGN &&
196
562
          src->op1_type == IS_CONST) {
197
198
150
        znode_op op2 = opline->op2;
199
150
        zval c;
200
201
150
        ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
202
150
        if (zend_optimizer_update_op2_const(op_array, opline, &c)) {
203
140
          VAR_SOURCE(op2) = NULL;
204
140
          if (!zend_bitset_in(used_ext, VAR_NUM(src->result.var))) {
205
140
            literal_dtor(&ZEND_OP1_LITERAL(src));
206
140
            MAKE_NOP(src);
207
140
          }
208
140
          ++(*opt_count);
209
140
        } else {
210
10
          zval_ptr_dtor_nogc(&c);
211
10
        }
212
150
      }
213
528k
    }
214
215
3.16M
    switch (opline->opcode) {
216
165k
      case ZEND_ECHO:
217
165k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
218
37.2k
          src = VAR_SOURCE(opline->op1);
219
37.2k
          if (src &&
220
34.4k
              src->opcode == ZEND_CAST &&
221
129
              src->extended_value == IS_STRING) {
222
            /* T = CAST(X, String), ECHO(T) => NOP, ECHO(X) */
223
83
            VAR_SOURCE(opline->op1) = NULL;
224
83
            COPY_NODE(opline->op1, src->op1);
225
83
            MAKE_NOP(src);
226
83
            ++(*opt_count);
227
83
          }
228
127k
        } else if (opline->op1_type == IS_CONST &&
229
126k
                   Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_DOUBLE) {
230
126k
          if (last_op == opline - 1) {
231
            /* compress consecutive ECHO's.
232
             * Float to string conversion may be affected by current
233
             * locale setting.
234
             */
235
4.86k
            size_t l, old_len;
236
237
4.86k
            if (Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_STRING) {
238
50
              convert_to_string(&ZEND_OP1_LITERAL(opline));
239
50
            }
240
4.86k
            if (Z_TYPE(ZEND_OP1_LITERAL(last_op)) != IS_STRING) {
241
24
              convert_to_string(&ZEND_OP1_LITERAL(last_op));
242
24
            }
243
4.86k
            old_len = Z_STRLEN(ZEND_OP1_LITERAL(last_op));
244
4.86k
            l = old_len + Z_STRLEN(ZEND_OP1_LITERAL(opline));
245
4.86k
            if (!Z_REFCOUNTED(ZEND_OP1_LITERAL(last_op))) {
246
1.66k
              zend_string *tmp = zend_string_alloc(l, 0);
247
1.66k
              memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP1_LITERAL(last_op)), old_len);
248
1.66k
              Z_STR(ZEND_OP1_LITERAL(last_op)) = tmp;
249
3.20k
            } else {
250
3.20k
              Z_STR(ZEND_OP1_LITERAL(last_op)) = zend_string_extend(Z_STR(ZEND_OP1_LITERAL(last_op)), l, 0);
251
3.20k
            }
252
4.86k
            Z_TYPE_INFO(ZEND_OP1_LITERAL(last_op)) = IS_STRING_EX;
253
4.86k
            memcpy(Z_STRVAL(ZEND_OP1_LITERAL(last_op)) + old_len, Z_STRVAL(ZEND_OP1_LITERAL(opline)), Z_STRLEN(ZEND_OP1_LITERAL(opline)));
254
4.86k
            Z_STRVAL(ZEND_OP1_LITERAL(last_op))[l] = '\0';
255
4.86k
            zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
256
4.86k
            ZVAL_STR(&ZEND_OP1_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP1_LITERAL(last_op))));
257
4.86k
            ZVAL_NULL(&ZEND_OP1_LITERAL(last_op));
258
4.86k
            MAKE_NOP(last_op);
259
4.86k
            ++(*opt_count);
260
4.86k
          }
261
126k
          last_op = opline;
262
126k
        }
263
165k
        break;
264
265
464
      case ZEND_MATCH_ERROR:
266
464
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
267
132
          src = VAR_SOURCE(opline->op1);
268
132
          VAR_SOURCE(opline->op1) = NULL;
269
132
        }
270
464
        break;
271
272
31.9k
      case ZEND_FREE:
273
        /* Note: Only remove the source if the source is local to this block.
274
         * If it's not local, then the other blocks successors must also eventually either FREE or consume the temporary,
275
         * hence removing the temporary is not safe in the general case, especially when other consumers are not FREE.
276
         * A FREE may not be removed without also removing the source's result, because otherwise that would cause a memory leak. */
277
31.9k
        if (opline->extended_value == ZEND_FREE_VOID_CAST) {
278
          /* Keep the ZEND_FREE opcode alive. */
279
31.9k
        } else if (opline->op1_type == IS_TMP_VAR) {
280
31.6k
          src = VAR_SOURCE(opline->op1);
281
31.6k
          if (src) {
282
27.2k
            switch (src->opcode) {
283
25
              case ZEND_BOOL:
284
222
              case ZEND_BOOL_NOT:
285
                /* T = BOOL(X), FREE(T) => T = BOOL(X) */
286
                /* The remaining BOOL is removed by a separate optimization */
287
                /* The source is a bool, no source removals take place, so this may be done non-locally. */
288
222
                VAR_SOURCE(opline->op1) = NULL;
289
222
                MAKE_NOP(opline);
290
222
                ++(*opt_count);
291
222
                break;
292
236
              case ZEND_QM_ASSIGN:
293
236
                if (src < op_array->opcodes + block->start) {
294
22
                  break;
295
22
                }
296
214
                src->result_type = IS_UNUSED;
297
214
                VAR_SOURCE(opline->op1) = NULL;
298
214
                MAKE_NOP(opline);
299
214
                ++(*opt_count);
300
214
                if (src->op1_type & (IS_VAR|IS_TMP_VAR)) {
301
94
                  src->opcode = ZEND_FREE;
302
120
                } else if (src->op1_type == IS_CONST) {
303
116
                  MAKE_NOP(src);
304
116
                } else if (src->op1_type == IS_CV) {
305
4
                  src->opcode = ZEND_CHECK_VAR;
306
4
                  SET_UNUSED(src->result);
307
4
                }
308
214
                break;
309
26.7k
              default:
310
26.7k
                if (!zend_op_may_elide_result(src->opcode)) {
311
23.7k
                  break;
312
23.7k
                }
313
3.03k
                if (src < op_array->opcodes + block->start) {
314
8
                  break;
315
8
                }
316
3.02k
                src->result_type = IS_UNUSED;
317
3.02k
                VAR_SOURCE(opline->op1) = NULL;
318
3.02k
                MAKE_NOP(opline);
319
3.02k
                ++(*opt_count);
320
3.02k
                break;
321
27.2k
            }
322
27.2k
          }
323
31.6k
        } else if (opline->op1_type == IS_VAR) {
324
226
          src = VAR_SOURCE(opline->op1);
325
          /* V = OP, FREE(V) => OP. NOP */
326
226
          if (src >= op_array->opcodes + block->start &&
327
6
              src->opcode != ZEND_FETCH_R &&
328
4
              src->opcode != ZEND_FETCH_STATIC_PROP_R &&
329
4
              src->opcode != ZEND_FETCH_DIM_R &&
330
4
              src->opcode != ZEND_FETCH_OBJ_R &&
331
0
              src->opcode != ZEND_NEW &&
332
0
              src->opcode != ZEND_FETCH_THIS) {
333
0
            src->result_type = IS_UNUSED;
334
0
            MAKE_NOP(opline);
335
0
            ++(*opt_count);
336
0
            if (src->opcode == ZEND_QM_ASSIGN) {
337
0
              if (src->op1_type & (IS_VAR|IS_TMP_VAR)) {
338
0
                src->opcode = ZEND_FREE;
339
0
              } else {
340
0
                MAKE_NOP(src);
341
0
              }
342
0
            }
343
0
          }
344
226
        }
345
31.9k
        break;
346
347
#if 0
348
    /* pre-evaluate functions:
349
       constant(x)
350
       function_exists(x)
351
       extension_loaded(x)
352
       BAD: interacts badly with Accelerator
353
    */
354
    if((opline->op1_type & IS_VAR) &&
355
       VAR_SOURCE(opline->op1) && VAR_SOURCE(opline->op1)->opcode == ZEND_DO_CF_FCALL &&
356
       VAR_SOURCE(opline->op1)->extended_value == 1) {
357
      zend_op *fcall = VAR_SOURCE(opline->op1);
358
      zend_op *sv = fcall-1;
359
      if(sv >= block->start_opline && sv->opcode == ZEND_SEND_VAL &&
360
         sv->op1_type == IS_CONST && Z_TYPE(OPLINE_OP1_LITERAL(sv)) == IS_STRING &&
361
         Z_LVAL(OPLINE_OP2_LITERAL(sv)) == 1
362
         ) {
363
        zval *arg = &OPLINE_OP1_LITERAL(sv);
364
        char *fname = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].function_name;
365
        size_t flen = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].name_len;
366
        if((flen == sizeof("function_exists")-1 && zend_binary_strcasecmp(fname, flen, "function_exists", sizeof("function_exists")-1) == 0) ||
367
              (flen == sizeof("is_callable")-1 && zend_binary_strcasecmp(fname, flen, "is_callable", sizeof("is_callable")-1) == 0)
368
              ) {
369
          zend_function *function;
370
          if((function = zend_hash_find_ptr(EG(function_table), Z_STR_P(arg))) != NULL) {
371
            literal_dtor(arg);
372
            MAKE_NOP(sv);
373
            MAKE_NOP(fcall);
374
            LITERAL_BOOL(opline->op1, 1);
375
            opline->op1_type = IS_CONST;
376
          }
377
        } else if(flen == sizeof("constant")-1 && zend_binary_strcasecmp(fname, flen, "constant", sizeof("constant")-1) == 0) {
378
          zval c;
379
          if (zend_optimizer_get_persistent_constant(Z_STR_P(arg), &c, true ELS_CC)) {
380
            literal_dtor(arg);
381
            MAKE_NOP(sv);
382
            MAKE_NOP(fcall);
383
            ZEND_OP1_LITERAL(opline) = zend_optimizer_add_literal(op_array, &c);
384
            /* no copy ctor - get already copied it */
385
            opline->op1_type = IS_CONST;
386
          }
387
        } else if(flen == sizeof("extension_loaded")-1 && zend_binary_strcasecmp(fname, flen, "extension_loaded", sizeof("extension_loaded")-1) == 0) {
388
          if(zend_hash_exists(&module_registry, Z_STR_P(arg))) {
389
            literal_dtor(arg);
390
            MAKE_NOP(sv);
391
            MAKE_NOP(fcall);
392
            LITERAL_BOOL(opline->op1, 1);
393
            opline->op1_type = IS_CONST;
394
          }
395
        }
396
      }
397
    }
398
#endif
399
400
31.9k
      case ZEND_FETCH_LIST_R:
401
1.78k
      case ZEND_FETCH_LIST_W:
402
1.78k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
403
          /* LIST variable will be deleted later by FREE */
404
1.49k
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
405
1.49k
        }
406
1.78k
        break;
407
408
14
      case ZEND_SWITCH_LONG:
409
87
      case ZEND_SWITCH_STRING:
410
361
      case ZEND_MATCH:
411
361
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
412
          /* SWITCH variable will be deleted later by FREE, so we can't optimize it */
413
75
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
414
75
          break;
415
75
        }
416
286
        if (opline->op1_type == IS_CONST) {
417
76
          uint32_t target = get_const_switch_target(cfg, op_array, block, opline, &ZEND_OP1_LITERAL(opline));
418
76
          literal_dtor(&ZEND_OP1_LITERAL(opline));
419
76
          literal_dtor(&ZEND_OP2_LITERAL(opline));
420
76
          opline->opcode = ZEND_JMP;
421
76
          opline->op1_type = IS_UNUSED;
422
76
          opline->op2_type = IS_UNUSED;
423
76
          block->successors_count = 1;
424
76
          block->successors[0] = target;
425
76
        }
426
286
        break;
427
428
0
      case ZEND_EXT_STMT:
429
0
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
430
          /* Variable will be deleted later by FREE, so we can't optimize it */
431
0
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
432
0
          break;
433
0
        }
434
0
        break;
435
436
184
      case ZEND_CASE:
437
430
      case ZEND_CASE_STRICT:
438
3.40k
      case ZEND_COPY_TMP:
439
3.40k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
440
          /* Variable will be deleted later by FREE, so we can't optimize it */
441
3.40k
          Tsource[VAR_NUM(opline->op1.var)] = NULL;
442
3.40k
          break;
443
3.40k
        }
444
0
        if (opline->op1_type == IS_CONST &&
445
0
            opline->op2_type == IS_CONST) {
446
0
          goto optimize_constant_binary_op;
447
0
        }
448
            /*
449
             * CASE(TRUE, X)       => BOOL(X)
450
             * CASE(FALSE, X)      => BOOL_NOT(X)
451
             */
452
0
        if (opline->op1_type == IS_CONST &&
453
0
          (Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_FALSE ||
454
0
           Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_TRUE)) {
455
          /* Optimization of comparison with "null" is not safe,
456
           * because ("0" == null) is not equal to !("0")
457
           */
458
0
          opline->opcode =
459
0
            ((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP1_LITERAL(opline))) == IS_TRUE)) ?
460
0
            ZEND_BOOL : ZEND_BOOL_NOT;
461
0
          COPY_NODE(opline->op1, opline->op2);
462
0
          SET_UNUSED(opline->op2);
463
0
          ++(*opt_count);
464
0
          goto optimize_bool;
465
0
        } else if (opline->op2_type == IS_CONST &&
466
0
                   (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_FALSE ||
467
0
                    Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_TRUE)) {
468
          /* Optimization of comparison with "null" is not safe,
469
           * because ("0" == null) is not equal to !("0")
470
           */
471
0
          opline->opcode =
472
0
            ((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP2_LITERAL(opline))) == IS_TRUE)) ?
473
0
            ZEND_BOOL : ZEND_BOOL_NOT;
474
0
          SET_UNUSED(opline->op2);
475
0
          ++(*opt_count);
476
0
          goto optimize_bool;
477
0
        }
478
0
        break;
479
480
25.5k
      case ZEND_IS_EQUAL:
481
28.6k
      case ZEND_IS_NOT_EQUAL:
482
28.6k
        if (opline->op1_type == IS_CONST &&
483
0
          opline->op2_type == IS_CONST) {
484
0
          goto optimize_constant_binary_op;
485
0
        }
486
        /* IS_EQ(TRUE, X)      => BOOL(X)
487
         * IS_EQ(FALSE, X)     => BOOL_NOT(X)
488
         * IS_NOT_EQ(TRUE, X)  => BOOL_NOT(X)
489
         * IS_NOT_EQ(FALSE, X) => BOOL(X)
490
         * Those optimizations are not safe if the other operand ends up being NAN
491
         * as BOOL/BOOL_NOT will warn, while IS_EQUAL/IS_NOT_EQUAL do not.
492
         */
493
28.6k
        break;
494
28.6k
      case ZEND_IS_IDENTICAL:
495
2.34k
        if (opline->op1_type == IS_CONST &&
496
0
          opline->op2_type == IS_CONST) {
497
0
          goto optimize_constant_binary_op;
498
0
        }
499
500
2.34k
        if (opline->op1_type == IS_CONST &&
501
0
          (Z_TYPE(ZEND_OP1_LITERAL(opline)) <= IS_TRUE && Z_TYPE(ZEND_OP1_LITERAL(opline)) >= IS_NULL)) {
502
          /* IS_IDENTICAL(TRUE, T)  => TYPE_CHECK(T, TRUE)
503
           * IS_IDENTICAL(FALSE, T) => TYPE_CHECK(T, FALSE)
504
           * IS_IDENTICAL(NULL, T)  => TYPE_CHECK(T, NULL)
505
           */
506
0
          opline->opcode = ZEND_TYPE_CHECK;
507
0
          opline->extended_value = (1 << Z_TYPE(ZEND_OP1_LITERAL(opline)));
508
0
          COPY_NODE(opline->op1, opline->op2);
509
0
          SET_UNUSED(opline->op2);
510
0
          ++(*opt_count);
511
0
          goto optimize_type_check;
512
2.34k
        } else if (opline->op2_type == IS_CONST &&
513
1.44k
          (Z_TYPE(ZEND_OP2_LITERAL(opline)) <= IS_TRUE && Z_TYPE(ZEND_OP2_LITERAL(opline)) >= IS_NULL)) {
514
          /* IS_IDENTICAL(T, TRUE)  => TYPE_CHECK(T, TRUE)
515
           * IS_IDENTICAL(T, FALSE) => TYPE_CHECK(T, FALSE)
516
           * IS_IDENTICAL(T, NULL)  => TYPE_CHECK(T, NULL)
517
           */
518
118
          opline->opcode = ZEND_TYPE_CHECK;
519
118
          opline->extended_value = (1 << Z_TYPE(ZEND_OP2_LITERAL(opline)));
520
118
          SET_UNUSED(opline->op2);
521
118
          ++(*opt_count);
522
118
          goto optimize_type_check;
523
118
        }
524
2.22k
        break;
525
2.22k
      case ZEND_TYPE_CHECK:
526
1.26k
optimize_type_check:
527
1.26k
        if (opline->extended_value == (1 << IS_TRUE) || opline->extended_value == (1 << IS_FALSE)) {
528
189
          if (opline->op1_type == IS_TMP_VAR &&
529
169
            !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
530
167
            src = VAR_SOURCE(opline->op1);
531
532
167
            if (src) {
533
167
              switch (src->opcode) {
534
0
                case ZEND_BOOL:
535
2
                case ZEND_BOOL_NOT:
536
                  /* T = BOOL(X)     + TYPE_CHECK(T, TRUE)  -> BOOL(X), NOP
537
                   * T = BOOL(X)     + TYPE_CHECK(T, FALSE) -> BOOL_NOT(X), NOP
538
                   * T = BOOL_NOT(X) + TYPE_CHECK(T, TRUE)  -> BOOL_NOT(X), NOP
539
                   * T = BOOL_NOT(X) + TYPE_CHECK(T, FALSE) -> BOOL(X), NOP
540
                   */
541
2
                  src->opcode =
542
2
                    ((src->opcode == ZEND_BOOL) == (opline->extended_value == (1 << IS_TRUE))) ?
543
2
                    ZEND_BOOL : ZEND_BOOL_NOT;
544
2
                  COPY_NODE(src->result, opline->result);
545
2
                  SET_VAR_SOURCE(src);
546
2
                  MAKE_NOP(opline);
547
2
                  ++(*opt_count);
548
2
                  break;
549
167
              }
550
167
            }
551
167
          }
552
189
        }
553
1.26k
        break;
554
  
555
5.09k
      case ZEND_BOOL:
556
12.2k
      case ZEND_BOOL_NOT:
557
15.4k
      optimize_bool:
558
15.4k
        if (opline->op1_type == IS_CONST) {
559
1.67k
          goto optimize_const_unary_op;
560
1.67k
        }
561
13.7k
        if (opline->op1_type == IS_TMP_VAR &&
562
12.0k
            !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
563
11.5k
          src = VAR_SOURCE(opline->op1);
564
11.5k
          if (src) {
565
11.5k
            switch (src->opcode) {
566
1.76k
              case ZEND_BOOL_NOT:
567
                /* T = BOOL_NOT(X) + BOOL(T) -> NOP, BOOL_NOT(X) */
568
1.76k
                VAR_SOURCE(opline->op1) = NULL;
569
1.76k
                COPY_NODE(opline->op1, src->op1);
570
1.76k
                opline->opcode = (opline->opcode == ZEND_BOOL) ? ZEND_BOOL_NOT : ZEND_BOOL;
571
1.76k
                MAKE_NOP(src);
572
1.76k
                ++(*opt_count);
573
1.76k
                goto optimize_bool;
574
1.42k
              case ZEND_BOOL:
575
                /* T = BOOL(X) + BOOL(T) -> NOP, BOOL(X) */
576
1.42k
                VAR_SOURCE(opline->op1) = NULL;
577
1.42k
                COPY_NODE(opline->op1, src->op1);
578
1.42k
                MAKE_NOP(src);
579
1.42k
                ++(*opt_count);
580
1.42k
                goto optimize_bool;
581
207
              case ZEND_IS_EQUAL:
582
207
                if (opline->opcode == ZEND_BOOL_NOT) {
583
0
                  src->opcode = ZEND_IS_NOT_EQUAL;
584
0
                }
585
207
                COPY_NODE(src->result, opline->result);
586
207
                SET_VAR_SOURCE(src);
587
207
                MAKE_NOP(opline);
588
207
                ++(*opt_count);
589
207
                break;
590
171
              case ZEND_IS_NOT_EQUAL:
591
171
                if (opline->opcode == ZEND_BOOL_NOT) {
592
0
                  src->opcode = ZEND_IS_EQUAL;
593
0
                }
594
171
                COPY_NODE(src->result, opline->result);
595
171
                SET_VAR_SOURCE(src);
596
171
                MAKE_NOP(opline);
597
171
                ++(*opt_count);
598
171
                break;
599
121
              case ZEND_IS_IDENTICAL:
600
121
                if (opline->opcode == ZEND_BOOL_NOT) {
601
0
                  src->opcode = ZEND_IS_NOT_IDENTICAL;
602
0
                }
603
121
                COPY_NODE(src->result, opline->result);
604
121
                SET_VAR_SOURCE(src);
605
121
                MAKE_NOP(opline);
606
121
                ++(*opt_count);
607
121
                break;
608
92
              case ZEND_IS_NOT_IDENTICAL:
609
92
                if (opline->opcode == ZEND_BOOL_NOT) {
610
0
                  src->opcode = ZEND_IS_IDENTICAL;
611
0
                }
612
92
                COPY_NODE(src->result, opline->result);
613
92
                SET_VAR_SOURCE(src);
614
92
                MAKE_NOP(opline);
615
92
                ++(*opt_count);
616
92
                break;
617
126
              case ZEND_IS_SMALLER:
618
126
                if (opline->opcode == ZEND_BOOL_NOT) {
619
2
                  uint8_t tmp_type;
620
2
                  uint32_t tmp;
621
622
2
                  src->opcode = ZEND_IS_SMALLER_OR_EQUAL;
623
2
                  tmp_type = src->op1_type;
624
2
                  src->op1_type = src->op2_type;
625
2
                  src->op2_type = tmp_type;
626
2
                  tmp = src->op1.num;
627
2
                  src->op1.num = src->op2.num;
628
2
                  src->op2.num = tmp;
629
2
                }
630
126
                COPY_NODE(src->result, opline->result);
631
126
                SET_VAR_SOURCE(src);
632
126
                MAKE_NOP(opline);
633
126
                ++(*opt_count);
634
126
                break;
635
294
              case ZEND_IS_SMALLER_OR_EQUAL:
636
294
                if (opline->opcode == ZEND_BOOL_NOT) {
637
2
                  uint8_t tmp_type;
638
2
                  uint32_t tmp;
639
640
2
                  src->opcode = ZEND_IS_SMALLER;
641
2
                  tmp_type = src->op1_type;
642
2
                  src->op1_type = src->op2_type;
643
2
                  src->op2_type = tmp_type;
644
2
                  tmp = src->op1.num;
645
2
                  src->op1.num = src->op2.num;
646
2
                  src->op2.num = tmp;
647
2
                }
648
294
                COPY_NODE(src->result, opline->result);
649
294
                SET_VAR_SOURCE(src);
650
294
                MAKE_NOP(opline);
651
294
                ++(*opt_count);
652
294
                break;
653
10
              case ZEND_ISSET_ISEMPTY_CV:
654
20
              case ZEND_ISSET_ISEMPTY_VAR:
655
216
              case ZEND_ISSET_ISEMPTY_DIM_OBJ:
656
268
              case ZEND_ISSET_ISEMPTY_PROP_OBJ:
657
288
              case ZEND_ISSET_ISEMPTY_STATIC_PROP:
658
330
              case ZEND_INSTANCEOF:
659
461
              case ZEND_TYPE_CHECK:
660
472
              case ZEND_DEFINED:
661
472
              case ZEND_IN_ARRAY:
662
500
              case ZEND_ARRAY_KEY_EXISTS:
663
500
                if (opline->opcode == ZEND_BOOL_NOT) {
664
353
                  break;
665
353
                }
666
147
                COPY_NODE(src->result, opline->result);
667
147
                SET_VAR_SOURCE(src);
668
147
                MAKE_NOP(opline);
669
147
                ++(*opt_count);
670
147
                break;
671
11.5k
            }
672
11.5k
          }
673
11.5k
        }
674
10.6k
        break;
675
676
30.9k
      case ZEND_JMPZ:
677
42.8k
      case ZEND_JMPNZ:
678
44.3k
          while (1) {
679
44.3k
          if (opline->op1_type == IS_CONST) {
680
585
            ++(*opt_count);
681
585
            block->successors_count = 1;
682
585
            if (zend_is_true(&ZEND_OP1_LITERAL(opline)) ==
683
585
                (opline->opcode == ZEND_JMPZ)) {
684
685
250
              MAKE_NOP(opline);
686
250
              block->successors[0] = block->successors[1];
687
250
              block->len--;
688
250
              cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
689
250
              break;
690
335
            } else {
691
335
              zend_basic_block *next = cfg->blocks + block->successors[1];
692
693
335
              next->flags &= ~ZEND_BB_FOLLOW;
694
335
              if (!(next->flags & (ZEND_BB_TARGET|ZEND_BB_PROTECTED))) {
695
275
                next->flags &= ~ZEND_BB_REACHABLE;
696
275
              }
697
335
              opline->opcode = ZEND_JMP;
698
335
              COPY_NODE(opline->op1, opline->op2);
699
335
              break;
700
335
            }
701
43.7k
          } else if (opline->op1_type == IS_TMP_VAR &&
702
41.8k
                     !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
703
41.4k
            src = VAR_SOURCE(opline->op1);
704
41.4k
            if (src) {
705
41.4k
              if (src->opcode == ZEND_BOOL_NOT) {
706
880
                VAR_SOURCE(opline->op1) = NULL;
707
880
                COPY_NODE(opline->op1, src->op1);
708
                /* T = BOOL_NOT(X) + JMPZ(T) -> NOP, JMPNZ(X) */
709
880
                opline->opcode = INV_COND(opline->opcode);
710
880
                MAKE_NOP(src);
711
880
                ++(*opt_count);
712
880
                continue;
713
40.5k
              } else if (src->opcode == ZEND_BOOL ||
714
39.8k
                         src->opcode == ZEND_QM_ASSIGN) {
715
669
                VAR_SOURCE(opline->op1) = NULL;
716
669
                COPY_NODE(opline->op1, src->op1);
717
669
                MAKE_NOP(src);
718
669
                ++(*opt_count);
719
669
                continue;
720
669
              }
721
41.4k
            }
722
41.4k
          }
723
42.2k
          break;
724
44.3k
        }
725
42.8k
        break;
726
727
1.86k
      case ZEND_JMPZ_EX:
728
3.63k
      case ZEND_JMPNZ_EX:
729
4.02k
        while (1) {
730
4.02k
          if (opline->op1_type == IS_CONST) {
731
767
            bool is_jmpz_ex = opline->opcode == ZEND_JMPZ_EX;
732
767
            if (zend_is_true(&ZEND_OP1_LITERAL(opline)) == is_jmpz_ex) {
733
734
221
              ++(*opt_count);
735
221
              opline->opcode = ZEND_QM_ASSIGN;
736
221
              zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
737
221
              ZVAL_BOOL(&ZEND_OP1_LITERAL(opline), is_jmpz_ex);
738
221
              opline->op2.num = 0;
739
221
              block->successors_count = 1;
740
221
              block->successors[0] = block->successors[1];
741
221
              cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
742
221
              break;
743
221
            }
744
3.25k
          } else if (opline->op1_type == IS_TMP_VAR &&
745
3.18k
                     (!zend_bitset_in(used_ext, VAR_NUM(opline->op1.var)) ||
746
2.81k
                      opline->result.var == opline->op1.var)) {
747
2.81k
            src = VAR_SOURCE(opline->op1);
748
2.81k
            if (src) {
749
2.37k
              if (src->opcode == ZEND_BOOL ||
750
1.99k
                  src->opcode == ZEND_QM_ASSIGN) {
751
389
                VAR_SOURCE(opline->op1) = NULL;
752
389
                COPY_NODE(opline->op1, src->op1);
753
389
                MAKE_NOP(src);
754
389
                ++(*opt_count);
755
389
                continue;
756
389
              }
757
2.37k
            }
758
2.81k
          }
759
3.41k
          break;
760
4.02k
        }
761
3.63k
        break;
762
763
65.5k
      case ZEND_CONCAT:
764
98.9k
      case ZEND_FAST_CONCAT:
765
98.9k
        if (opline->op1_type == IS_CONST &&
766
27.2k
            opline->op2_type == IS_CONST) {
767
12
          goto optimize_constant_binary_op;
768
12
        }
769
770
98.9k
        if (opline->op2_type == IS_CONST &&
771
42.6k
            opline->op1_type == IS_TMP_VAR) {
772
773
33.1k
          src = VAR_SOURCE(opline->op1);
774
33.1k
            if (src &&
775
33.0k
              (src->opcode == ZEND_CONCAT ||
776
29.1k
               src->opcode == ZEND_FAST_CONCAT) &&
777
27.2k
              src->op2_type == IS_CONST) {
778
            /* compress consecutive CONCATs */
779
902
            size_t l, old_len;
780
781
902
            if (Z_TYPE(ZEND_OP2_LITERAL(opline)) != IS_STRING) {
782
0
              convert_to_string(&ZEND_OP2_LITERAL(opline));
783
0
            }
784
902
            if (Z_TYPE(ZEND_OP2_LITERAL(src)) != IS_STRING) {
785
0
              convert_to_string(&ZEND_OP2_LITERAL(src));
786
0
            }
787
788
902
            VAR_SOURCE(opline->op1) = NULL;
789
902
            COPY_NODE(opline->op1, src->op1);
790
902
            old_len = Z_STRLEN(ZEND_OP2_LITERAL(src));
791
902
            l = old_len + Z_STRLEN(ZEND_OP2_LITERAL(opline));
792
902
            if (!Z_REFCOUNTED(ZEND_OP2_LITERAL(src))) {
793
232
              zend_string *tmp = zend_string_alloc(l, 0);
794
232
              memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP2_LITERAL(src)), old_len);
795
232
              Z_STR(ZEND_OP2_LITERAL(src)) = tmp;
796
670
            } else {
797
670
              Z_STR(ZEND_OP2_LITERAL(src)) = zend_string_extend(Z_STR(ZEND_OP2_LITERAL(src)), l, 0);
798
670
            }
799
902
            Z_TYPE_INFO(ZEND_OP2_LITERAL(src)) = IS_STRING_EX;
800
902
            memcpy(Z_STRVAL(ZEND_OP2_LITERAL(src)) + old_len, Z_STRVAL(ZEND_OP2_LITERAL(opline)), Z_STRLEN(ZEND_OP2_LITERAL(opline)));
801
902
            Z_STRVAL(ZEND_OP2_LITERAL(src))[l] = '\0';
802
902
            zval_ptr_dtor_str(&ZEND_OP2_LITERAL(opline));
803
902
            ZVAL_STR(&ZEND_OP2_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP2_LITERAL(src))));
804
902
            ZVAL_NULL(&ZEND_OP2_LITERAL(src));
805
902
            MAKE_NOP(src);
806
902
            ++(*opt_count);
807
902
          }
808
33.1k
        }
809
810
98.9k
        if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
811
38.9k
          src = VAR_SOURCE(opline->op1);
812
38.9k
          if (src &&
813
38.6k
              src->opcode == ZEND_CAST &&
814
114
              src->extended_value == IS_STRING &&
815
6
              src->op1_type != IS_CONST) {
816
            /* convert T1 = CAST(STRING, X), T2 = CONCAT(T1, Y) to T2 = CONCAT(X,Y) */
817
4
            VAR_SOURCE(opline->op1) = NULL;
818
4
            COPY_NODE(opline->op1, src->op1);
819
4
            MAKE_NOP(src);
820
4
            ++(*opt_count);
821
4
          }
822
38.9k
              }
823
98.9k
        if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
824
53.7k
          src = VAR_SOURCE(opline->op2);
825
53.7k
          if (src &&
826
53.6k
              src->opcode == ZEND_CAST &&
827
160
              src->extended_value == IS_STRING &&
828
68
              src->op1_type != IS_CONST) {
829
            /* convert T1 = CAST(STRING, X), T2 = CONCAT(Y, T1) to T2 = CONCAT(Y,X) */
830
52
            VAR_SOURCE(opline->op2) = NULL;
831
52
            COPY_NODE(opline->op2, src->op1);
832
52
            MAKE_NOP(src);
833
52
            ++(*opt_count);
834
52
          }
835
53.7k
        }
836
98.9k
        if (opline->op1_type == IS_CONST &&
837
27.2k
            Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_STRING &&
838
27.2k
            Z_STRLEN(ZEND_OP1_LITERAL(opline)) == 0) {
839
          /* convert CONCAT('', X) => CAST(STRING, X) */
840
12
          literal_dtor(&ZEND_OP1_LITERAL(opline));
841
12
          opline->opcode = ZEND_CAST;
842
12
          opline->extended_value = IS_STRING;
843
12
          COPY_NODE(opline->op1, opline->op2);
844
12
          opline->op2_type = IS_UNUSED;
845
12
          opline->op2.var = 0;
846
12
          ++(*opt_count);
847
98.9k
        } else if (opline->op2_type == IS_CONST &&
848
42.6k
                 Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING &&
849
42.6k
                 Z_STRLEN(ZEND_OP2_LITERAL(opline)) == 0) {
850
          /* convert CONCAT(X, '') => CAST(STRING, X) */
851
18
          literal_dtor(&ZEND_OP2_LITERAL(opline));
852
18
          opline->opcode = ZEND_CAST;
853
18
          opline->extended_value = IS_STRING;
854
18
          opline->op2_type = IS_UNUSED;
855
18
          opline->op2.var = 0;
856
18
          ++(*opt_count);
857
98.9k
        } else if (opline->opcode == ZEND_CONCAT &&
858
65.4k
                   (opline->op1_type == IS_CONST ||
859
50.7k
                    (opline->op1_type == IS_TMP_VAR &&
860
27.0k
                     VAR_SOURCE(opline->op1) &&
861
26.8k
                     (VAR_SOURCE(opline->op1)->opcode == ZEND_FAST_CONCAT ||
862
13.9k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_ROPE_END ||
863
13.8k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CONSTANT ||
864
12.7k
                      VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CLASS_CONSTANT))) &&
865
28.8k
                   (opline->op2_type == IS_CONST ||
866
16.7k
                    (opline->op2_type == IS_TMP_VAR &&
867
16.3k
                     VAR_SOURCE(opline->op2) &&
868
16.3k
                     (VAR_SOURCE(opline->op2)->opcode == ZEND_FAST_CONCAT ||
869
16.1k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_ROPE_END ||
870
4.56k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CONSTANT ||
871
25.1k
                      VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CLASS_CONSTANT)))) {
872
25.1k
          opline->opcode = ZEND_FAST_CONCAT;
873
25.1k
          ++(*opt_count);
874
25.1k
        }
875
98.9k
        break;
876
877
9.17k
      case ZEND_ADD:
878
15.9k
      case ZEND_SUB:
879
24.1k
      case ZEND_MUL:
880
28.6k
      case ZEND_DIV:
881
32.7k
      case ZEND_MOD:
882
35.1k
      case ZEND_SL:
883
36.4k
      case ZEND_SR:
884
46.2k
      case ZEND_IS_SMALLER:
885
49.8k
      case ZEND_IS_SMALLER_OR_EQUAL:
886
50.5k
      case ZEND_IS_NOT_IDENTICAL:
887
52.5k
      case ZEND_BOOL_XOR:
888
54.1k
      case ZEND_BW_OR:
889
68.1k
      case ZEND_BW_AND:
890
80.2k
      case ZEND_BW_XOR:
891
80.2k
        if (opline->op1_type == IS_CONST &&
892
15.4k
            opline->op2_type == IS_CONST) {
893
          /* evaluate constant expressions */
894
10.6k
          zval result;
895
896
10.6k
optimize_constant_binary_op:
897
10.6k
          if (zend_optimizer_eval_binary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline), &ZEND_OP2_LITERAL(opline)) == SUCCESS) {
898
30
            literal_dtor(&ZEND_OP1_LITERAL(opline));
899
30
            literal_dtor(&ZEND_OP2_LITERAL(opline));
900
30
            opline->opcode = ZEND_QM_ASSIGN;
901
30
            SET_UNUSED(opline->op2);
902
30
            zend_optimizer_update_op1_const(op_array, opline, &result);
903
30
            ++(*opt_count);
904
30
          }
905
10.6k
        }
906
80.2k
        break;
907
908
80.2k
      case ZEND_BW_NOT:
909
20.3k
        if (opline->op1_type == IS_CONST) {
910
          /* evaluate constant unary ops */
911
125
          zval result;
912
913
1.79k
optimize_const_unary_op:
914
1.79k
          if (zend_optimizer_eval_unary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
915
1.64k
            literal_dtor(&ZEND_OP1_LITERAL(opline));
916
1.64k
            opline->opcode = ZEND_QM_ASSIGN;
917
1.64k
            zend_optimizer_update_op1_const(op_array, opline, &result);
918
1.64k
            ++(*opt_count);
919
1.64k
          }
920
1.79k
        }
921
21.9k
        break;
922
923
21.9k
      case ZEND_CAST:
924
3.06k
        if (opline->op1_type == IS_CONST) {
925
          /* cast of constant operand */
926
325
          zval result;
927
928
325
          if (zend_optimizer_eval_cast(&result, opline->extended_value, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
929
4
            literal_dtor(&ZEND_OP1_LITERAL(opline));
930
4
            opline->opcode = ZEND_QM_ASSIGN;
931
4
            opline->extended_value = 0;
932
4
            zend_optimizer_update_op1_const(op_array, opline, &result);
933
4
            ++(*opt_count);
934
4
          }
935
325
        }
936
3.06k
        break;
937
938
2.81k
      case ZEND_STRLEN:
939
2.81k
        if (opline->op1_type == IS_CONST) {
940
38
          zval result;
941
942
38
          if (zend_optimizer_eval_strlen(&result, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
943
0
            literal_dtor(&ZEND_OP1_LITERAL(opline));
944
0
            opline->opcode = ZEND_QM_ASSIGN;
945
0
            zend_optimizer_update_op1_const(op_array, opline, &result);
946
0
            ++(*opt_count);
947
0
          }
948
38
        }
949
2.81k
        break;
950
951
116k
      case ZEND_RETURN:
952
116k
        if (opline->op1_type == IS_TMP_VAR) {
953
6.41k
          src = VAR_SOURCE(opline->op1);
954
6.41k
          if (src && src->opcode == ZEND_QM_ASSIGN) {
955
28
            zend_op *op = src + 1;
956
28
            bool optimize = true;
957
958
28
            while (op < opline) {
959
28
              if ((op->op1_type == opline->op1_type
960
6
                && op->op1.var == opline->op1.var)
961
22
               || (op->op2_type == opline->op1_type
962
28
                && op->op2.var == opline->op1.var)) {
963
28
                optimize = false;
964
28
                break;
965
28
              }
966
0
              op++;
967
0
            }
968
969
28
            if (optimize) {
970
              /* T = QM_ASSIGN(X), RETURN(T) to NOP, RETURN(X) */
971
0
              VAR_SOURCE(opline->op1) = NULL;
972
0
              COPY_NODE(opline->op1, src->op1);
973
0
              MAKE_NOP(src);
974
0
              ++(*opt_count);
975
0
            }
976
28
          }
977
6.41k
        }
978
116k
        break;
979
980
16.0k
      case ZEND_QM_ASSIGN:
981
16.0k
        if (opline->op1_type == opline->result_type &&
982
4.46k
            opline->op1.var == opline->result.var) {
983
          /* strip T = QM_ASSIGN(T) */
984
0
          MAKE_NOP(opline);
985
0
          ++(*opt_count);
986
16.0k
        } else if (opline->op1_type == IS_TMP_VAR &&
987
4.46k
                   opline->result_type == IS_TMP_VAR &&
988
4.46k
                   !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
989
          /* T1 = ..., T2 = QM_ASSIGN(T1) to T2 = ..., NOP */
990
2.60k
          src = VAR_SOURCE(opline->op1);
991
2.60k
          if (src &&
992
2.60k
            src->opcode != ZEND_COPY_TMP &&
993
            /* See gh20628_borked_live_range_calc.phpt. */
994
2.60k
            src->opcode != ZEND_NEW &&
995
2.56k
            src->opcode != ZEND_ADD_ARRAY_ELEMENT &&
996
2.56k
            src->opcode != ZEND_ADD_ARRAY_UNPACK &&
997
2.56k
            (src->opcode != ZEND_DECLARE_LAMBDA_FUNCTION ||
998
2.56k
             src == opline -1)) {
999
2.56k
            src->result.var = opline->result.var;
1000
2.56k
            VAR_SOURCE(opline->op1) = NULL;
1001
2.56k
            VAR_SOURCE(opline->result) = src;
1002
2.56k
            MAKE_NOP(opline);
1003
2.56k
            ++(*opt_count);
1004
2.56k
          }
1005
2.60k
        }
1006
16.0k
        break;
1007
3.16M
    }
1008
1009
    /* get variable source */
1010
3.16M
    if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
1011
1.48M
      SET_VAR_SOURCE(opline);
1012
1.48M
    }
1013
3.16M
    opline++;
1014
3.16M
  }
1015
525k
}
1016
1017
/* Rebuild plain (optimized) op_array from CFG */
1018
static void assemble_code_blocks(const zend_cfg *cfg, zend_op_array *op_array, zend_optimizer_ctx *ctx)
1019
89.7k
{
1020
89.7k
  zend_basic_block *blocks = cfg->blocks;
1021
89.7k
  const zend_basic_block *end = blocks + cfg->blocks_count;
1022
89.7k
  zend_basic_block *b;
1023
89.7k
  zend_op *new_opcodes;
1024
89.7k
  zend_op *opline;
1025
89.7k
  uint32_t len = 0;
1026
1027
481k
  for (b = blocks; b < end; b++) {
1028
391k
    if (b->len == 0) {
1029
29.4k
      continue;
1030
29.4k
    }
1031
361k
    if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1032
345k
      opline = op_array->opcodes + b->start + b->len - 1;
1033
345k
      if (opline->opcode == ZEND_JMP) {
1034
54.0k
        const zend_basic_block *next = b + 1;
1035
1036
66.5k
        while (next < end && !(next->flags & ZEND_BB_REACHABLE)) {
1037
12.5k
          next++;
1038
12.5k
        }
1039
54.0k
        if (next < end && next == blocks + b->successors[0]) {
1040
          /* JMP to the next block - strip it */
1041
16
          MAKE_NOP(opline);
1042
16
          b->len--;
1043
16
        }
1044
291k
      } else if (b->len == 1 && opline->opcode == ZEND_NOP) {
1045
        /* skip empty block */
1046
0
        b->len--;
1047
0
      }
1048
345k
      len += b->len;
1049
345k
    } else {
1050
      /* this block will not be used, delete all constants there */
1051
16.4k
      const zend_op *op = op_array->opcodes + b->start;
1052
16.4k
      const zend_op *last_op = op + b->len;
1053
37.3k
      for (; op < last_op; op++) {
1054
20.9k
        if (op->op1_type == IS_CONST) {
1055
14.7k
          literal_dtor(&ZEND_OP1_LITERAL(op));
1056
14.7k
        }
1057
20.9k
        if (op->op2_type == IS_CONST) {
1058
538
          literal_dtor(&ZEND_OP2_LITERAL(op));
1059
538
        }
1060
20.9k
      }
1061
16.4k
    }
1062
361k
  }
1063
1064
89.7k
  new_opcodes = emalloc(len * sizeof(zend_op));
1065
89.7k
  opline = new_opcodes;
1066
1067
  /* Copy code of reachable blocks into a single buffer */
1068
481k
  for (b = blocks; b < end; b++) {
1069
391k
    if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1070
345k
      memcpy(opline, op_array->opcodes + b->start, b->len * sizeof(zend_op));
1071
345k
      b->start = opline - new_opcodes;
1072
345k
      opline += b->len;
1073
345k
    }
1074
391k
  }
1075
1076
  /* adjust jump targets */
1077
89.7k
  efree(op_array->opcodes);
1078
89.7k
  op_array->opcodes = new_opcodes;
1079
89.7k
  op_array->last = len;
1080
1081
481k
  for (b = blocks; b < end; b++) {
1082
391k
    if (!(b->flags & ZEND_BB_REACHABLE) || b->len == 0) {
1083
45.9k
      continue;
1084
45.9k
    }
1085
345k
    opline = op_array->opcodes + b->start + b->len - 1;
1086
345k
    switch (opline->opcode) {
1087
682
      case ZEND_FAST_CALL:
1088
54.7k
      case ZEND_JMP:
1089
54.7k
        ZEND_SET_OP_JMP_ADDR(opline, opline->op1, new_opcodes + blocks[b->successors[0]].start);
1090
54.7k
        break;
1091
17.7k
      case ZEND_JMPZ:
1092
27.5k
      case ZEND_JMPNZ:
1093
28.5k
      case ZEND_JMPZ_EX:
1094
29.4k
      case ZEND_JMPNZ_EX:
1095
43.5k
      case ZEND_FE_RESET_R:
1096
44.3k
      case ZEND_FE_RESET_RW:
1097
45.9k
      case ZEND_JMP_SET:
1098
49.3k
      case ZEND_COALESCE:
1099
50.4k
      case ZEND_ASSERT_CHECK:
1100
85.3k
      case ZEND_JMP_NULL:
1101
85.5k
      case ZEND_BIND_INIT_STATIC_OR_JMP:
1102
85.5k
      case ZEND_JMP_FRAMELESS:
1103
85.5k
        ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1104
85.5k
        break;
1105
6.24k
      case ZEND_CATCH:
1106
6.24k
        if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1107
4.75k
          ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1108
4.75k
        }
1109
6.24k
        break;
1110
14.0k
      case ZEND_FE_FETCH_R:
1111
14.8k
      case ZEND_FE_FETCH_RW:
1112
14.8k
        opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[0]].start);
1113
14.8k
        break;
1114
14
      case ZEND_SWITCH_LONG:
1115
68
      case ZEND_SWITCH_STRING:
1116
206
      case ZEND_MATCH:
1117
206
      {
1118
206
        const HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
1119
206
        zval *zv;
1120
206
        uint32_t s = 0;
1121
206
        ZEND_ASSERT(b->successors_count == (opline->opcode == ZEND_MATCH ? 1 : 2) + zend_hash_num_elements(jumptable));
1122
1123
2.04k
        ZEND_HASH_FOREACH_VAL(jumptable, zv) {
1124
2.04k
          Z_LVAL_P(zv) = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1125
2.04k
        } ZEND_HASH_FOREACH_END();
1126
206
        opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1127
206
        break;
1128
206
      }
1129
345k
    }
1130
345k
  }
1131
1132
  /* adjust exception jump targets & remove unused try_catch_array entries */
1133
89.7k
  if (op_array->last_try_catch) {
1134
21.0k
    uint32_t i, j;
1135
21.0k
    uint32_t *map;
1136
21.0k
    ALLOCA_FLAG(use_heap);
1137
1138
21.0k
    map = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last_try_catch, use_heap);
1139
48.2k
    for (i = 0, j = 0; i< op_array->last_try_catch; i++) {
1140
27.2k
      if (blocks[cfg->map[op_array->try_catch_array[i].try_op]].flags & ZEND_BB_REACHABLE) {
1141
27.2k
        map[i] = j;
1142
27.2k
        op_array->try_catch_array[j].try_op = blocks[cfg->map[op_array->try_catch_array[i].try_op]].start;
1143
27.2k
        if (op_array->try_catch_array[i].catch_op) {
1144
26.6k
          op_array->try_catch_array[j].catch_op = blocks[cfg->map[op_array->try_catch_array[i].catch_op]].start;
1145
26.6k
        } else {
1146
615
          op_array->try_catch_array[j].catch_op =  0;
1147
615
        }
1148
27.2k
        if (op_array->try_catch_array[i].finally_op) {
1149
748
          op_array->try_catch_array[j].finally_op = blocks[cfg->map[op_array->try_catch_array[i].finally_op]].start;
1150
26.4k
        } else {
1151
26.4k
          op_array->try_catch_array[j].finally_op =  0;
1152
26.4k
        }
1153
27.2k
        if (!op_array->try_catch_array[i].finally_end) {
1154
26.4k
          op_array->try_catch_array[j].finally_end = 0;
1155
26.4k
        } else {
1156
748
          op_array->try_catch_array[j].finally_end = blocks[cfg->map[op_array->try_catch_array[i].finally_end]].start;
1157
748
        }
1158
27.2k
        j++;
1159
27.2k
      }
1160
27.2k
    }
1161
21.0k
    if (i != j) {
1162
12
      op_array->last_try_catch = j;
1163
12
      if (j == 0) {
1164
6
        efree(op_array->try_catch_array);
1165
6
        op_array->try_catch_array = NULL;
1166
6
      }
1167
1168
12
      if (op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) {
1169
0
        zend_op *finally_opline = new_opcodes;
1170
0
        const zend_op *last_finally_op = finally_opline + len;
1171
0
        while (finally_opline < last_finally_op) {
1172
0
          if (finally_opline->opcode == ZEND_FAST_RET &&
1173
0
              finally_opline->op2.num != (uint32_t)-1 &&
1174
0
              finally_opline->op2.num < j) {
1175
0
            finally_opline->op2.num = map[finally_opline->op2.num];
1176
0
          }
1177
0
          finally_opline++;
1178
0
        }
1179
0
      }
1180
12
    }
1181
21.0k
    free_alloca(map, use_heap);
1182
21.0k
  }
1183
1184
  /* rebuild map (just for printing) */
1185
89.7k
  memset(cfg->map, -1, sizeof(int) * op_array->last);
1186
481k
  for (int n = 0; n < cfg->blocks_count; n++) {
1187
391k
    if (cfg->blocks[n].flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1188
345k
      cfg->map[cfg->blocks[n].start] = n;
1189
345k
    }
1190
391k
  }
1191
89.7k
}
1192
1193
static zend_always_inline zend_basic_block *get_target_block(const zend_cfg *cfg, const zend_basic_block *block, int n, uint32_t *opt_count)
1194
183k
{
1195
183k
  int b;
1196
183k
  zend_basic_block *target_block = cfg->blocks + block->successors[n];
1197
1198
183k
  if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1199
264
    do {
1200
264
      b = target_block->successors[0];
1201
264
      target_block = cfg->blocks + b;
1202
264
    } while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1203
190
    block->successors[n] = b;
1204
190
    ++(*opt_count);
1205
190
  }
1206
183k
  return target_block;
1207
183k
}
1208
1209
static zend_always_inline zend_basic_block *get_follow_block(const zend_cfg *cfg, const zend_basic_block *block, int n, uint32_t *opt_count)
1210
45.6k
{
1211
45.6k
  int b;
1212
45.6k
  zend_basic_block *target_block = cfg->blocks + block->successors[n];
1213
1214
45.6k
  if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1215
869
    do {
1216
869
      b = target_block->successors[0];
1217
869
      target_block = cfg->blocks + b;
1218
869
    } while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1219
801
    block->successors[n] = b;
1220
801
    ++(*opt_count);
1221
801
  }
1222
45.6k
  return target_block;
1223
45.6k
}
1224
1225
static zend_always_inline zend_basic_block *get_next_block(const zend_cfg *cfg, zend_basic_block *block)
1226
96.0k
{
1227
96.0k
  zend_basic_block *next_block = block + 1;
1228
96.0k
  const zend_basic_block *end = cfg->blocks + cfg->blocks_count;
1229
1230
111k
  while (1) {
1231
111k
    if (next_block == end) {
1232
1.19k
      return NULL;
1233
110k
    } else if (next_block->flags & ZEND_BB_REACHABLE) {
1234
94.8k
      break;
1235
94.8k
    }
1236
15.9k
    next_block++;
1237
15.9k
  }
1238
94.9k
  while (next_block->len == 0 && !(next_block->flags & (ZEND_BB_TARGET|ZEND_BB_PROTECTED))) {
1239
59
    next_block = cfg->blocks + next_block->successors[0];
1240
59
  }
1241
94.8k
  return next_block;
1242
96.0k
}
1243
1244
1245
/* we use "jmp_hitlist" to avoid infinity loops during jmp optimization */
1246
static zend_always_inline bool in_hitlist(int target, const int *jmp_hitlist, int jmp_hitlist_count)
1247
666
{
1248
666
  int i;
1249
1250
666
  for (i = 0; i < jmp_hitlist_count; i++) {
1251
255
    if (jmp_hitlist[i] == target) {
1252
255
      return 1;
1253
255
    }
1254
255
  }
1255
411
  return 0;
1256
666
}
1257
1258
#define CHECK_LOOP(target) \
1259
666
  if (EXPECTED(!in_hitlist(target, jmp_hitlist, jmp_hitlist_count))) { \
1260
411
    jmp_hitlist[jmp_hitlist_count++] = target;  \
1261
411
  } else { \
1262
255
    break; \
1263
255
  }
1264
1265
static void zend_jmp_optimization(zend_basic_block *block, zend_op_array *op_array, const zend_cfg *cfg, int *jmp_hitlist, uint32_t *opt_count)
1266
525k
{
1267
  /* last_op is the last opcode of the current block */
1268
525k
  zend_basic_block *target_block, *follow_block, *next_block;
1269
525k
  zend_op *last_op, *target;
1270
525k
  int next, jmp_hitlist_count;
1271
1272
525k
  if (block->len == 0) {
1273
1.31k
    return;
1274
1.31k
  }
1275
1276
524k
  last_op = op_array->opcodes + block->start + block->len - 1;
1277
524k
  switch (last_op->opcode) {
1278
95.2k
    case ZEND_JMP:
1279
95.2k
      jmp_hitlist_count = 0;
1280
1281
95.2k
      target_block = get_target_block(cfg, block, 0, opt_count);
1282
95.3k
      while (target_block->len == 1) {
1283
50.6k
        target = op_array->opcodes + target_block->start;
1284
50.6k
        if (target->opcode == ZEND_JMP) {
1285
          /* JMP L, L: JMP L1 -> JMP L1 */
1286
44
          next = target_block->successors[0];
1287
50.6k
        } else {
1288
50.6k
          break;
1289
50.6k
        }
1290
44
        CHECK_LOOP(next);
1291
26
        block->successors[0] = next;
1292
26
        ++(*opt_count);
1293
26
        target_block = get_target_block(cfg, block, 0, opt_count);
1294
26
      }
1295
1296
95.2k
      next_block = get_next_block(cfg, block);
1297
95.2k
      if (target_block == next_block) {
1298
        /* JMP(next) -> NOP */
1299
910
        MAKE_NOP(last_op);
1300
910
        ++(*opt_count);
1301
910
        block->len--;
1302
94.3k
      } else if (target_block->len == 1) {
1303
50.4k
        target = op_array->opcodes + target_block->start;
1304
50.4k
        if ((target->opcode == ZEND_RETURN ||
1305
50.2k
                    target->opcode == ZEND_RETURN_BY_REF ||
1306
50.2k
                    target->opcode == ZEND_GENERATOR_RETURN) &&
1307
310
                   !(op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK)) {
1308
          /* JMP L, L: RETURN to immediate RETURN */
1309
38
          *last_op = *target;
1310
38
          if (last_op->op1_type == IS_CONST) {
1311
38
            zval zv;
1312
38
            ZVAL_COPY(&zv, &ZEND_OP1_LITERAL(last_op));
1313
38
            last_op->op1.constant = zend_optimizer_add_literal(op_array, &zv);
1314
38
          }
1315
38
          block->successors_count = 0;
1316
38
          ++(*opt_count);
1317
38
        }
1318
50.4k
      }
1319
95.2k
      break;
1320
1321
2.11k
    case ZEND_JMP_SET:
1322
6.94k
    case ZEND_COALESCE:
1323
42.4k
    case ZEND_JMP_NULL:
1324
42.4k
      jmp_hitlist_count = 0;
1325
1326
42.4k
      target_block = get_target_block(cfg, block, 0, opt_count);
1327
42.4k
      while (target_block->len == 1) {
1328
3.90k
        target = op_array->opcodes + target_block->start;
1329
1330
3.90k
        if (target->opcode == ZEND_JMP) {
1331
          /* JMP_SET(X, L), L: JMP(L2) -> JMP_SET(X, L2) */
1332
32
          next = target_block->successors[0];
1333
32
          CHECK_LOOP(next);
1334
32
          block->successors[0] = next;
1335
32
          ++(*opt_count);
1336
3.87k
        } else {
1337
3.87k
          break;
1338
3.87k
        }
1339
32
        target_block = get_target_block(cfg, block, 0, opt_count);
1340
32
      }
1341
42.4k
      break;
1342
1343
29.8k
    case ZEND_JMPZ:
1344
42.2k
    case ZEND_JMPNZ:
1345
42.2k
      jmp_hitlist_count = 0;
1346
1347
42.2k
      target_block = get_target_block(cfg, block, 0, opt_count);
1348
42.5k
      while (target_block->len == 1) {
1349
28.7k
        target = op_array->opcodes + target_block->start;
1350
1351
28.7k
        if (target->opcode == ZEND_JMP) {
1352
          /* JMPZ(X, L), L: JMP(L2) -> JMPZ(X, L2) */
1353
88
          next = target_block->successors[0];
1354
28.6k
        } else if (target->opcode == last_op->opcode &&
1355
924
                   SAME_VAR(target->op1, last_op->op1)) {
1356
          /* JMPZ(X, L), L: JMPZ(X, L2) -> JMPZ(X, L2) */
1357
478
          next = target_block->successors[0];
1358
28.1k
        } else if (target->opcode == INV_COND(last_op->opcode) &&
1359
123
                   SAME_VAR(target->op1, last_op->op1)) {
1360
          /* JMPZ(X, L), L: JMPNZ(X, L2) -> JMPZ(X, L+1) */
1361
20
          next = target_block->successors[1];
1362
28.1k
        } else {
1363
28.1k
          break;
1364
28.1k
        }
1365
586
        CHECK_LOOP(next);
1366
349
        block->successors[0] = next;
1367
349
        ++(*opt_count);
1368
349
        target_block = get_target_block(cfg, block, 0, opt_count);
1369
349
      }
1370
1371
42.2k
      follow_block = get_follow_block(cfg, block, 1, opt_count);
1372
42.2k
      if (target_block == follow_block) {
1373
        /* L: JMP[N]Z(X, L+1) -> NOP or FREE(X) */
1374
590
        zend_optimizer_convert_to_free_op1(op_array, last_op);
1375
590
        if (last_op->opcode == ZEND_NOP) {
1376
0
          block->len--;
1377
0
        }
1378
590
        block->successors_count = 1;
1379
590
        ++(*opt_count);
1380
41.6k
      } else if (follow_block->len == 1) {
1381
8.07k
        target = op_array->opcodes + follow_block->start;
1382
8.07k
        if (target->opcode == ZEND_JMP) {
1383
967
            if (block->successors[0] == follow_block->successors[0]) {
1384
            /* JMPZ(X,L1), JMP(L1) -> NOP, JMP(L1) */
1385
189
            zend_optimizer_convert_to_free_op1(op_array, last_op);
1386
189
            if (last_op->opcode == ZEND_NOP) {
1387
0
              block->len--;
1388
0
            }
1389
189
            block->successors[0] = follow_block - cfg->blocks;
1390
189
            block->successors_count = 1;
1391
189
            ++(*opt_count);
1392
189
            break;
1393
778
          } else if (!(follow_block->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED))) {
1394
778
            next_block = get_next_block(cfg, follow_block);
1395
1396
778
            if (target_block == next_block) {
1397
              /* JMPZ(X,L1) JMP(L2) L1: -> JMPNZ(X,L2) NOP*/
1398
1399
316
              last_op->opcode = INV_COND(last_op->opcode);
1400
1401
316
              block->successors[0] = follow_block->successors[0];
1402
316
              block->successors[1] = next_block - cfg->blocks;
1403
1404
316
              follow_block->flags &= ~ZEND_BB_REACHABLE;
1405
316
              MAKE_NOP(target);
1406
316
              follow_block->len = 0;
1407
1408
316
              next_block->flags |= ZEND_BB_FOLLOW;
1409
1410
316
              break;
1411
316
            }
1412
778
          }
1413
967
        }
1414
8.07k
      }
1415
41.7k
      break;
1416
1417
41.7k
    case ZEND_JMPNZ_EX:
1418
3.41k
    case ZEND_JMPZ_EX:
1419
3.41k
      jmp_hitlist_count = 0;
1420
1421
3.41k
      target_block = get_target_block(cfg, block, 0, opt_count);
1422
3.41k
      while (target_block->len == 1) {
1423
1.34k
        target = op_array->opcodes + target_block->start;
1424
1425
1.34k
        if (target->opcode == ZEND_JMP) {
1426
          /* T = JMPZ_EX(X, L), L: JMP(L2) -> T = JMPZ(X, L2) */
1427
0
          next = target_block->successors[0];
1428
1.34k
        } else if (target->opcode == last_op->opcode-3 &&
1429
0
                   (SAME_VAR(target->op1, last_op->result) ||
1430
0
                    SAME_VAR(target->op1, last_op->op1))) {
1431
          /* T = JMPZ_EX(X, L1), L1: JMPZ({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1432
0
          next = target_block->successors[0];
1433
1.34k
        } else if (target->opcode == last_op->opcode &&
1434
0
                   target->result.var == last_op->result.var &&
1435
0
                   (SAME_VAR(target->op1, last_op->result) ||
1436
0
                    SAME_VAR(target->op1, last_op->op1))) {
1437
          /* T = JMPZ_EX(X, L1), L1: T = JMPZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1438
0
          next = target_block->successors[0];
1439
1.34k
        } else if (target->opcode == INV_EX_COND(last_op->opcode) &&
1440
4
                   (SAME_VAR(target->op1, last_op->result) ||
1441
4
                    SAME_VAR(target->op1, last_op->op1))) {
1442
          /* T = JMPZ_EX(X, L1), L1: JMPNZ({X|T1}, L2) -> T = JMPZ_EX(X, L1+1) */
1443
4
          next = target_block->successors[1];
1444
1.33k
        } else if (target->opcode == INV_EX_COND_EX(last_op->opcode) &&
1445
56
                   target->result.var == last_op->result.var &&
1446
48
                   (SAME_VAR(target->op1, last_op->result) ||
1447
48
                    SAME_VAR(target->op1, last_op->op1))) {
1448
          /* T = JMPZ_EX(X, L1), L1: T = JMPNZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L1+1) */
1449
0
          next = target_block->successors[1];
1450
1.33k
        } else if (target->opcode == ZEND_BOOL &&
1451
0
                   (SAME_VAR(target->op1, last_op->result) ||
1452
0
                    SAME_VAR(target->op1, last_op->op1))) {
1453
          /* convert Y = JMPZ_EX(X,L1), L1: Z = BOOL(Y) to
1454
             Z = JMPZ_EX(X,L1+1) */
1455
1456
          /* NOTE: This optimization pattern is not safe, but works, */
1457
          /*       because result of JMPZ_EX instruction             */
1458
          /*       is not used on the following path and             */
1459
          /*       should be used once on the branch path.           */
1460
          /*                                                         */
1461
          /*       The pattern works well only if jumps processed in */
1462
          /*       direct order, otherwise it breaks JMPZ_EX         */
1463
          /*       sequences too early.                              */
1464
0
          last_op->result.var = target->result.var;
1465
0
          next = target_block->successors[0];
1466
1.33k
        } else {
1467
1.33k
          break;
1468
1.33k
        }
1469
4
        CHECK_LOOP(next);
1470
4
        block->successors[0] = next;
1471
4
        ++(*opt_count);
1472
4
        target_block = get_target_block(cfg, block, 0, opt_count);
1473
4
      }
1474
1475
3.41k
      follow_block = get_follow_block(cfg, block, 1, opt_count);
1476
3.41k
      if (target_block == follow_block) {
1477
        /* L: T = JMP[N]Z_EX(X, L+1) -> T = BOOL(X) */
1478
0
        last_op->opcode = ZEND_BOOL;
1479
0
        last_op->op2.num = 0;
1480
0
        block->successors_count = 1;
1481
0
        ++(*opt_count);
1482
0
        break;
1483
0
      }
1484
3.41k
      break;
1485
524k
  }
1486
524k
}
1487
1488
/* Global data dependencies */
1489
1490
/* Find a set of variables which are used outside of the block where they are
1491
 * defined. We won't apply some optimization patterns for such variables. */
1492
static void zend_t_usage(const zend_cfg *cfg, const zend_op_array *op_array, zend_bitset used_ext, zend_optimizer_ctx *ctx)
1493
111k
{
1494
111k
  int n;
1495
111k
  zend_basic_block *block, *next_block;
1496
111k
  uint32_t var_num;
1497
111k
  uint32_t bitset_len;
1498
111k
  zend_bitset usage;
1499
111k
  zend_bitset defined_here;
1500
111k
  void *checkpoint;
1501
111k
  zend_op *opline, *end;
1502
1503
1504
111k
  if (op_array->T == 0) {
1505
    /* shortcut - if no Ts, nothing to do */
1506
13.3k
    return;
1507
13.3k
  }
1508
1509
97.8k
  checkpoint = zend_arena_checkpoint(ctx->arena);
1510
97.8k
  bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1511
97.8k
  defined_here = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1512
1513
97.8k
  zend_bitset_clear(defined_here, bitset_len);
1514
559k
  for (n = 1; n < cfg->blocks_count; n++) {
1515
461k
    block = cfg->blocks + n;
1516
1517
461k
    if (!(block->flags & ZEND_BB_REACHABLE)) {
1518
46.6k
      continue;
1519
46.6k
    }
1520
1521
415k
    opline = op_array->opcodes + block->start;
1522
415k
    end = opline + block->len;
1523
415k
    if (!(block->flags & ZEND_BB_FOLLOW) ||
1524
307k
        (block->flags & ZEND_BB_TARGET)) {
1525
      /* Skip continuation of "extended" BB */
1526
219k
      zend_bitset_clear(defined_here, bitset_len);
1527
219k
    }
1528
1529
2.30M
    while (opline<end) {
1530
1.88M
      if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1531
547k
        var_num = VAR_NUM(opline->op1.var);
1532
547k
        if (!zend_bitset_in(defined_here, var_num)) {
1533
260k
          zend_bitset_incl(used_ext, var_num);
1534
260k
        }
1535
547k
      }
1536
1.88M
      if (opline->op2_type == IS_VAR) {
1537
757
        var_num = VAR_NUM(opline->op2.var);
1538
757
        if (opline->opcode == ZEND_FE_FETCH_R ||
1539
757
            opline->opcode == ZEND_FE_FETCH_RW) {
1540
          /* these opcode use the op2 as result */
1541
14
          zend_bitset_incl(defined_here, var_num);
1542
743
        } else if (!zend_bitset_in(defined_here, var_num)) {
1543
2
          zend_bitset_incl(used_ext, var_num);
1544
2
        }
1545
1.88M
      } else if (opline->op2_type == IS_TMP_VAR) {
1546
366k
        var_num = VAR_NUM(opline->op2.var);
1547
366k
        if (!zend_bitset_in(defined_here, var_num)) {
1548
37.1k
          zend_bitset_incl(used_ext, var_num);
1549
37.1k
        }
1550
366k
      }
1551
1552
1.88M
      if (opline->result_type == IS_VAR) {
1553
9.20k
        var_num = VAR_NUM(opline->result.var);
1554
9.20k
        zend_bitset_incl(defined_here, var_num);
1555
1.87M
      } else if (opline->result_type == IS_TMP_VAR) {
1556
907k
        var_num = VAR_NUM(opline->result.var);
1557
907k
        switch (opline->opcode) {
1558
5.79k
          case ZEND_ADD_ARRAY_ELEMENT:
1559
5.83k
          case ZEND_ADD_ARRAY_UNPACK:
1560
248k
          case ZEND_ROPE_ADD:
1561
            /* these opcodes use the result as argument */
1562
248k
            if (!zend_bitset_in(defined_here, var_num)) {
1563
193k
              zend_bitset_incl(used_ext, var_num);
1564
193k
            }
1565
248k
            break;
1566
658k
          default :
1567
658k
            zend_bitset_incl(defined_here, var_num);
1568
907k
        }
1569
907k
      }
1570
1.88M
      opline++;
1571
1.88M
    }
1572
415k
  }
1573
1574
97.8k
  if (ctx->debug_level & ZEND_DUMP_BLOCK_PASS_VARS) {
1575
0
    bool printed = false;
1576
0
    uint32_t i;
1577
1578
0
    for (i = op_array->last_var; i< op_array->T; i++) {
1579
0
      if (zend_bitset_in(used_ext, i)) {
1580
0
        if (!printed) {
1581
0
          fprintf(stderr, "NON-LOCAL-VARS: %d", i);
1582
0
          printed = true;
1583
0
        } else {
1584
0
          fprintf(stderr, ", %d", i);
1585
0
        }
1586
0
      }
1587
0
    }
1588
0
    if (printed) {
1589
0
      fprintf(stderr, "\n");
1590
0
    }
1591
0
  }
1592
1593
97.8k
  usage = defined_here;
1594
97.8k
  next_block = NULL;
1595
657k
  for (n = cfg->blocks_count; n > 0;) {
1596
559k
    block = cfg->blocks + (--n);
1597
1598
559k
    if (!(block->flags & ZEND_BB_REACHABLE) || block->len == 0) {
1599
46.8k
      continue;
1600
46.8k
    }
1601
1602
512k
    end = op_array->opcodes + block->start;
1603
512k
    opline = end + block->len - 1;
1604
512k
    if (!next_block ||
1605
414k
        !(next_block->flags & ZEND_BB_FOLLOW) ||
1606
317k
        (next_block->flags & ZEND_BB_TARGET)) {
1607
      /* Skip continuation of "extended" BB */
1608
317k
      zend_bitset_copy(usage, used_ext, bitset_len);
1609
317k
    } else if (block->successors_count > 1) {
1610
126k
      zend_bitset_union(usage, used_ext, bitset_len);
1611
126k
    }
1612
512k
    next_block = block;
1613
1614
3.65M
    while (opline >= end) {
1615
      /* usage checks */
1616
3.13M
      if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
1617
1.49M
        if (!zend_bitset_in(usage, VAR_NUM(opline->result.var))) {
1618
8.28k
          switch (opline->opcode) {
1619
0
            case ZEND_ASSIGN_OP:
1620
0
            case ZEND_ASSIGN_DIM_OP:
1621
0
            case ZEND_ASSIGN_OBJ_OP:
1622
0
            case ZEND_ASSIGN_STATIC_PROP_OP:
1623
0
            case ZEND_PRE_INC:
1624
0
            case ZEND_PRE_DEC:
1625
0
            case ZEND_ASSIGN:
1626
0
            case ZEND_ASSIGN_REF:
1627
0
            case ZEND_DO_FCALL:
1628
0
            case ZEND_DO_ICALL:
1629
0
            case ZEND_DO_UCALL:
1630
0
            case ZEND_DO_FCALL_BY_NAME:
1631
0
              opline->result_type = IS_UNUSED;
1632
0
              break;
1633
0
            case ZEND_POST_INC:
1634
0
            case ZEND_POST_DEC:
1635
0
            case ZEND_POST_INC_OBJ:
1636
0
            case ZEND_POST_DEC_OBJ:
1637
0
            case ZEND_POST_INC_STATIC_PROP:
1638
0
            case ZEND_POST_DEC_STATIC_PROP:
1639
0
              opline->opcode -= 2;
1640
0
              opline->result_type = IS_UNUSED;
1641
0
              break;
1642
535
            case ZEND_QM_ASSIGN:
1643
1.47k
            case ZEND_BOOL:
1644
4.78k
            case ZEND_BOOL_NOT:
1645
4.78k
              zend_optimizer_convert_to_free_op1(op_array, opline);
1646
4.78k
              break;
1647
1.61k
            case ZEND_JMPZ_EX:
1648
3.40k
            case ZEND_JMPNZ_EX:
1649
3.40k
              opline->opcode -= 3;
1650
3.40k
              SET_UNUSED(opline->result);
1651
3.40k
              break;
1652
0
            case ZEND_ADD_ARRAY_ELEMENT:
1653
0
            case ZEND_ADD_ARRAY_UNPACK:
1654
0
            case ZEND_ROPE_ADD:
1655
0
              zend_bitset_incl(usage, VAR_NUM(opline->result.var));
1656
0
              break;
1657
8.28k
          }
1658
1.48M
        } else {
1659
1.48M
          switch (opline->opcode) {
1660
46.4k
            case ZEND_ADD_ARRAY_ELEMENT:
1661
46.5k
            case ZEND_ADD_ARRAY_UNPACK:
1662
367k
            case ZEND_ROPE_ADD:
1663
367k
              break;
1664
1.11M
            default:
1665
1.11M
              zend_bitset_excl(usage, VAR_NUM(opline->result.var));
1666
1.11M
              break;
1667
1.48M
          }
1668
1.48M
        }
1669
1.49M
      }
1670
1671
3.13M
      if (opline->op2_type == IS_VAR) {
1672
2.06k
        switch (opline->opcode) {
1673
0
          case ZEND_FE_FETCH_R:
1674
14
          case ZEND_FE_FETCH_RW:
1675
14
            zend_bitset_excl(usage, VAR_NUM(opline->op2.var));
1676
14
            break;
1677
2.05k
          default:
1678
2.05k
            zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1679
2.05k
            break;
1680
2.06k
        }
1681
3.13M
      } else if (opline->op2_type == IS_TMP_VAR) {
1682
528k
        zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1683
528k
      }
1684
1685
3.13M
      if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1686
899k
        zend_bitset_incl(usage, VAR_NUM(opline->op1.var));
1687
899k
      }
1688
1689
3.13M
      opline--;
1690
3.13M
    }
1691
512k
  }
1692
1693
97.8k
  zend_arena_release(&ctx->arena, checkpoint);
1694
97.8k
}
1695
1696
static void zend_merge_blocks(const zend_op_array *op_array, const zend_cfg *cfg, uint32_t *opt_count)
1697
111k
{
1698
111k
  int i;
1699
111k
  zend_basic_block *b, *bb;
1700
111k
  zend_basic_block *prev = NULL;
1701
1702
686k
  for (i = 0; i < cfg->blocks_count; i++) {
1703
575k
    b = cfg->blocks + i;
1704
575k
    if (b->flags & ZEND_BB_REACHABLE) {
1705
523k
      if ((b->flags & ZEND_BB_FOLLOW) &&
1706
306k
          !(b->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED)) &&
1707
151k
          prev && prev->successors_count == 1 && prev->successors[0] == i)
1708
26.6k
      {
1709
26.6k
        zend_op *last_op = op_array->opcodes + prev->start + prev->len - 1;
1710
26.6k
        if (prev->len != 0 && last_op->opcode == ZEND_JMP) {
1711
0
          MAKE_NOP(last_op);
1712
0
        }
1713
1714
29.8k
        for (bb = prev + 1; bb != b; bb++) {
1715
3.17k
          zend_op *op = op_array->opcodes + bb->start;
1716
3.17k
          const zend_op *end = op + bb->len;
1717
5.82k
          while (op < end) {
1718
2.64k
            if (op->op1_type == IS_CONST) {
1719
934
              literal_dtor(&ZEND_OP1_LITERAL(op));
1720
934
            }
1721
2.64k
            if (op->op2_type == IS_CONST) {
1722
614
              literal_dtor(&ZEND_OP2_LITERAL(op));
1723
614
            }
1724
2.64k
            MAKE_NOP(op);
1725
2.64k
            op++;
1726
2.64k
          }
1727
          /* make block empty */
1728
3.17k
          bb->len = 0;
1729
3.17k
        }
1730
1731
        /* re-link */
1732
26.6k
        prev->flags |= (b->flags & ZEND_BB_EXIT);
1733
26.6k
        prev->len = b->start + b->len - prev->start;
1734
26.6k
        prev->successors_count = b->successors_count;
1735
26.6k
        if (b->successors != b->successors_storage) {
1736
72
          prev->successors = b->successors;
1737
72
          b->successors = b->successors_storage;
1738
26.6k
        } else {
1739
26.6k
          memcpy(prev->successors, b->successors, b->successors_count * sizeof(int));
1740
26.6k
        }
1741
1742
        /* unlink & make block empty and unreachable */
1743
26.6k
        b->flags = 0;
1744
26.6k
        b->len = 0;
1745
26.6k
        b->successors_count = 0;
1746
26.6k
        ++(*opt_count);
1747
497k
      } else {
1748
497k
        prev = b;
1749
497k
      }
1750
523k
    }
1751
575k
  }
1752
111k
}
1753
1754
111k
#define PASSES 3
1755
1756
void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1757
89.7k
{
1758
89.7k
  zend_cfg cfg;
1759
89.7k
  zend_basic_block *blocks, *end, *b;
1760
89.7k
  int pass;
1761
89.7k
  uint32_t bitset_len;
1762
89.7k
  zend_bitset usage;
1763
89.7k
  void *checkpoint;
1764
89.7k
  zend_op **Tsource;
1765
89.7k
  uint32_t opt_count;
1766
89.7k
  int *jmp_hitlist;
1767
1768
    /* Build CFG */
1769
89.7k
  checkpoint = zend_arena_checkpoint(ctx->arena);
1770
89.7k
  zend_build_cfg(&ctx->arena, op_array, 0, &cfg);
1771
1772
89.7k
  if (cfg.blocks_count * (op_array->last_var + op_array->T) > 64 * 1024 * 1024) {
1773
0
    zend_arena_release(&ctx->arena, checkpoint);
1774
0
    return;
1775
0
  }
1776
1777
89.7k
  if (ctx->debug_level & ZEND_DUMP_BEFORE_BLOCK_PASS) {
1778
0
    zend_dump_op_array(op_array, ZEND_DUMP_CFG, "before block pass", &cfg);
1779
0
  }
1780
1781
89.7k
  bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1782
89.7k
  Tsource = zend_arena_calloc(&ctx->arena, op_array->last_var + op_array->T, sizeof(zend_op *));
1783
89.7k
  usage = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1784
89.7k
  jmp_hitlist = zend_arena_alloc(&ctx->arena, cfg.blocks_count * sizeof(int));
1785
1786
89.7k
  blocks = cfg.blocks;
1787
89.7k
  end = blocks + cfg.blocks_count;
1788
111k
  for (pass = 0; pass < PASSES; pass++) {
1789
111k
    opt_count = 0;
1790
1791
    /* Compute data dependencies */
1792
111k
    zend_bitset_clear(usage, bitset_len);
1793
111k
    zend_t_usage(&cfg, op_array, usage, ctx);
1794
1795
    /* optimize each basic block separately */
1796
686k
    for (b = blocks; b < end; b++) {
1797
575k
      if (!(b->flags & ZEND_BB_REACHABLE)) {
1798
49.7k
        continue;
1799
49.7k
      }
1800
      /* we track data dependencies only inside a single basic block */
1801
526k
      if (!(b->flags & ZEND_BB_FOLLOW) ||
1802
330k
          (b->flags & ZEND_BB_TARGET)) {
1803
        /* Skip continuation of "extended" BB */
1804
330k
        memset(Tsource, 0, (op_array->last_var + op_array->T) * sizeof(zend_op *));
1805
330k
      }
1806
526k
      zend_optimize_block(b, op_array, usage, &cfg, Tsource, &opt_count);
1807
526k
    }
1808
1809
    /* Eliminate NOPs */
1810
686k
    for (b = blocks; b < end; b++) {
1811
575k
      if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
1812
        /* In unreachable_free blocks only preserve loop var frees. */
1813
68
        for (uint32_t i = b->start; i < b->start + b->len; i++) {
1814
44
          zend_op *opline = &op_array->opcodes[i];
1815
44
          if (!zend_optimizer_is_loop_var_free(opline)) {
1816
20
            MAKE_NOP(opline);
1817
20
          }
1818
44
        }
1819
24
      }
1820
575k
      if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1821
526k
        strip_nops(op_array, b);
1822
526k
      }
1823
575k
    }
1824
1825
111k
    opt_count = 0;
1826
1827
    /* Jump optimization for each block */
1828
686k
    for (b = blocks; b < end; b++) {
1829
575k
      if (b->flags & ZEND_BB_REACHABLE) {
1830
525k
        zend_jmp_optimization(b, op_array, &cfg, jmp_hitlist, &opt_count);
1831
525k
      }
1832
575k
    }
1833
1834
    /* Eliminate unreachable basic blocks */
1835
111k
    zend_cfg_remark_reachable_blocks(op_array, &cfg);
1836
1837
    /* Merge Blocks */
1838
111k
    zend_merge_blocks(op_array, &cfg, &opt_count);
1839
1840
111k
    if (opt_count == 0) {
1841
89.6k
      break;
1842
89.6k
    }
1843
111k
  }
1844
1845
89.7k
  assemble_code_blocks(&cfg, op_array, ctx);
1846
1847
89.7k
  if (ctx->debug_level & ZEND_DUMP_AFTER_BLOCK_PASS) {
1848
0
    zend_dump_op_array(op_array, ZEND_DUMP_CFG | ZEND_DUMP_HIDE_UNREACHABLE, "after block pass", &cfg);
1849
0
  }
1850
1851
  /* Destroy CFG */
1852
89.7k
  zend_arena_release(&ctx->arena, checkpoint);
1853
89.7k
}