Coverage Report

Created: 2026-04-01 06:49

next uncovered line (L), next uncovered region (R), next uncovered branch (B)
/src/php-src/Zend/Optimizer/scdf.c
Line
Count
Source
1
/*
2
   +----------------------------------------------------------------------+
3
   | Zend Engine, Sparse Conditional Data Flow Propagation Framework      |
4
   +----------------------------------------------------------------------+
5
   | Copyright (c) The PHP Group                                          |
6
   +----------------------------------------------------------------------+
7
   | This source file is subject to version 3.01 of the PHP license,      |
8
   | that is bundled with this package in the file LICENSE, and is        |
9
   | available through the world-wide-web at the following url:           |
10
   | https://www.php.net/license/3_01.txt                                 |
11
   | If you did not receive a copy of the PHP license and are unable to   |
12
   | obtain it through the world-wide-web, please send a note to          |
13
   | license@php.net so we can mail you a copy immediately.               |
14
   +----------------------------------------------------------------------+
15
   | Authors: Nikita Popov <nikic@php.net>                                |
16
   +----------------------------------------------------------------------+
17
*/
18
19
#include "Optimizer/zend_optimizer_internal.h"
20
#include "Optimizer/scdf.h"
21
22
/* This defines a generic framework for sparse conditional dataflow propagation. The algorithm is
23
 * based on "Sparse conditional constant propagation" by Wegman and Zadeck. We're using a
24
 * generalized implementation as described in chapter 8.3 of the SSA book.
25
 *
26
 * Every SSA variable is associated with an element on a finite-height lattice, those value can only
27
 * ever be lowered during the operation of the algorithm. If a value is lowered all instructions and
28
 * phis using that value need to be reconsidered (this is done by adding the variable to a
29
 * worklist). For phi functions the result is computed by applying the meet operation to the
30
 * operands. This continues until a fixed point is reached.
31
 *
32
 * The algorithm is control-flow sensitive: All blocks except the start block are initially assumed
33
 * to be unreachable. When considering a branch instruction, we determine the feasible successors
34
 * based on the current state of the variable lattice. If a new edge becomes feasible we either have
35
 * to mark the successor block executable and consider all instructions in it, or, if the target is
36
 * already executable, we only have to reconsider the phi functions (as we only consider phi
37
 * operands which are associated with a feasible edge).
38
 *
39
 * The generic framework requires the definition of three functions:
40
 * * visit_instr() should recompute the lattice values of all SSA variables defined by an
41
 *   instruction.
42
 * * visit_phi() should recompute the lattice value of the SSA variable defined by the phi. While
43
 *   doing this it should only consider operands for which scfg_is_edge_feasible() returns true.
44
 * * get_feasible_successors() should determine the feasible successors for a branch instruction.
45
 *   Note that this callback only needs to handle conditional branches (with two successors).
46
 */
47
48
#if 0
49
#define DEBUG_PRINT(...) fprintf(stderr, __VA_ARGS__)
50
#else
51
#define DEBUG_PRINT(...)
52
#endif
53
54
185k
void scdf_mark_edge_feasible(scdf_ctx *scdf, int from, int to) {
55
185k
  uint32_t edge = scdf_edge(&scdf->ssa->cfg, from, to);
56
57
185k
  if (zend_bitset_in(scdf->feasible_edges, edge)) {
58
    /* We already handled this edge */
59
3.59k
    return;
60
3.59k
  }
61
62
181k
  DEBUG_PRINT("Marking edge %d->%d feasible\n", from, to);
63
181k
  zend_bitset_incl(scdf->feasible_edges, edge);
64
65
181k
  if (!zend_bitset_in(scdf->executable_blocks, to)) {
66
169k
    if (!zend_bitset_in(scdf->block_worklist, to)) {
67
124k
      DEBUG_PRINT("Adding block %d to worklist\n", to);
68
124k
    }
69
169k
    zend_bitset_incl(scdf->block_worklist, to);
70
169k
  } else {
71
    /* Block is already executable, only a new edge became feasible.
72
     * Reevaluate phi nodes to account for changed source operands. */
73
11.5k
    const zend_ssa_block *ssa_block = &scdf->ssa->blocks[to];
74
41.6k
    for (const zend_ssa_phi *phi = ssa_block->phis; phi; phi = phi->next) {
75
30.1k
      zend_bitset_excl(scdf->phi_var_worklist, phi->ssa_var);
76
30.1k
      scdf->handlers.visit_phi(scdf, phi);
77
30.1k
    }
78
11.5k
  }
79
181k
}
80
81
66.4k
void scdf_init(zend_optimizer_ctx *ctx, scdf_ctx *scdf, zend_op_array *op_array, zend_ssa *ssa) {
82
66.4k
  scdf->op_array = op_array;
83
66.4k
  scdf->ssa = ssa;
84
85
66.4k
  scdf->instr_worklist_len = zend_bitset_len(op_array->last);
86
66.4k
  scdf->phi_var_worklist_len = zend_bitset_len(ssa->vars_count);
87
66.4k
  scdf->block_worklist_len = zend_bitset_len(ssa->cfg.blocks_count);
88
89
66.4k
  scdf->instr_worklist = zend_arena_calloc(&ctx->arena,
90
66.4k
    scdf->instr_worklist_len + scdf->phi_var_worklist_len + 2 * scdf->block_worklist_len + zend_bitset_len(ssa->cfg.edges_count),
91
66.4k
    sizeof(zend_ulong));
92
93
66.4k
  scdf->phi_var_worklist = scdf->instr_worklist + scdf->instr_worklist_len;
94
66.4k
  scdf->block_worklist = scdf->phi_var_worklist + scdf->phi_var_worklist_len;
95
66.4k
  scdf->executable_blocks = scdf->block_worklist + scdf->block_worklist_len;
96
66.4k
  scdf->feasible_edges = scdf->executable_blocks + scdf->block_worklist_len;
97
98
66.4k
  zend_bitset_incl(scdf->block_worklist, 0);
99
66.4k
  zend_bitset_incl(scdf->executable_blocks, 0);
100
66.4k
}
101
102
66.4k
void scdf_solve(scdf_ctx *scdf, const char *name) {
103
66.4k
  const zend_ssa *ssa = scdf->ssa;
104
66.4k
  DEBUG_PRINT("Start SCDF solve (%s)\n", name);
105
136k
  while (!zend_bitset_empty(scdf->instr_worklist, scdf->instr_worklist_len)
106
134k
    || !zend_bitset_empty(scdf->phi_var_worklist, scdf->phi_var_worklist_len)
107
132k
    || !zend_bitset_empty(scdf->block_worklist, scdf->block_worklist_len)
108
69.8k
  ) {
109
69.8k
    int i;
110
75.6k
    while ((i = zend_bitset_pop_first(scdf->phi_var_worklist, scdf->phi_var_worklist_len)) >= 0) {
111
5.76k
      const zend_ssa_phi *phi = ssa->vars[i].definition_phi;
112
5.76k
      ZEND_ASSERT(phi);
113
5.76k
      if (zend_bitset_in(scdf->executable_blocks, phi->block)) {
114
4.84k
        scdf->handlers.visit_phi(scdf, phi);
115
4.84k
      }
116
5.76k
    }
117
118
81.8k
    while ((i = zend_bitset_pop_first(scdf->instr_worklist, scdf->instr_worklist_len)) >= 0) {
119
12.0k
      int block_num = ssa->cfg.map[i];
120
12.0k
      if (zend_bitset_in(scdf->executable_blocks, block_num)) {
121
9.37k
        zend_basic_block *block = &ssa->cfg.blocks[block_num];
122
9.37k
        zend_op *opline = &scdf->op_array->opcodes[i];
123
9.37k
        zend_ssa_op *ssa_op = &ssa->ops[i];
124
9.37k
        if (opline->opcode == ZEND_OP_DATA) {
125
39
          opline--;
126
39
          ssa_op--;
127
39
        }
128
9.37k
        scdf->handlers.visit_instr(scdf, opline, ssa_op);
129
9.37k
        if (i == block->start + block->len - 1) {
130
3.38k
          if (block->successors_count == 1) {
131
1.39k
            scdf_mark_edge_feasible(scdf, block_num, block->successors[0]);
132
1.99k
          } else if (block->successors_count > 1) {
133
1.98k
            scdf->handlers.mark_feasible_successors(scdf, block_num, block, opline, ssa_op);
134
1.98k
          }
135
3.38k
        }
136
9.37k
      }
137
12.0k
    }
138
139
260k
    while ((i = zend_bitset_pop_first(scdf->block_worklist, scdf->block_worklist_len)) >= 0) {
140
      /* This block is now live. Interpret phis and instructions in it. */
141
190k
      zend_basic_block *block = &ssa->cfg.blocks[i];
142
190k
      const zend_ssa_block *ssa_block = &ssa->blocks[i];
143
144
190k
      DEBUG_PRINT("Pop block %d from worklist\n", i);
145
190k
      zend_bitset_incl(scdf->executable_blocks, i);
146
147
334k
      for (const zend_ssa_phi *phi = ssa_block->phis; phi; phi = phi->next) {
148
143k
        zend_bitset_excl(scdf->phi_var_worklist, phi->ssa_var);
149
143k
        scdf->handlers.visit_phi(scdf, phi);
150
143k
      }
151
152
190k
      if (block->len == 0) {
153
        /* Zero length blocks don't have a last instruction that would normally do this */
154
98
        scdf_mark_edge_feasible(scdf, i, block->successors[0]);
155
190k
      } else {
156
190k
        zend_op *opline = NULL;
157
190k
        uint32_t j, end = block->start + block->len;
158
1.56M
        for (j = block->start; j < end; j++) {
159
1.37M
          opline = &scdf->op_array->opcodes[j];
160
1.37M
          zend_bitset_excl(scdf->instr_worklist, j);
161
1.37M
          if (opline->opcode != ZEND_OP_DATA) {
162
1.35M
            scdf->handlers.visit_instr(scdf, opline, &ssa->ops[j]);
163
1.35M
          }
164
1.37M
        }
165
190k
        if (block->successors_count == 1) {
166
61.2k
          scdf_mark_edge_feasible(scdf, i, block->successors[0]);
167
129k
        } else if (block->successors_count > 1) {
168
61.0k
          ZEND_ASSERT(opline && "Should have opline in non-empty block");
169
61.0k
          if (opline->opcode == ZEND_OP_DATA) {
170
0
            opline--;
171
0
            j--;
172
0
          }
173
61.0k
          scdf->handlers.mark_feasible_successors(scdf, i, block, opline, &ssa->ops[j-1]);
174
61.0k
        }
175
190k
      }
176
190k
    }
177
69.8k
  }
178
66.4k
}
179
180
/* If a live range starts in a reachable block and ends in an unreachable block, we should
181
 * not eliminate the latter. While it cannot be reached, the FREE opcode of the loop var
182
 * is necessary for the correctness of temporary compaction. */
183
static bool is_live_loop_var_free(
184
628
    const scdf_ctx *scdf, const zend_op *opline, const zend_ssa_op *ssa_op) {
185
628
  if (!zend_optimizer_is_loop_var_free(opline)) {
186
596
    return false;
187
596
  }
188
189
32
  int var = ssa_op->op1_use;
190
32
  if (var < 0) {
191
4
    return false;
192
4
  }
193
194
28
  const zend_ssa_var *ssa_var = &scdf->ssa->vars[var];
195
28
  uint32_t def_block;
196
28
  if (ssa_var->definition >= 0) {
197
12
    def_block = scdf->ssa->cfg.map[ssa_var->definition];
198
16
  } else {
199
16
    def_block = ssa_var->definition_phi->block;
200
16
  }
201
28
  return zend_bitset_in(scdf->executable_blocks, def_block);
202
32
}
203
204
3.80k
static bool kept_alive_by_loop_var_free(const scdf_ctx *scdf, const zend_basic_block *block) {
205
3.80k
  const zend_op_array *op_array = scdf->op_array;
206
3.80k
  const zend_cfg *cfg = &scdf->ssa->cfg;
207
3.80k
  if (!(cfg->flags & ZEND_FUNC_FREE_LOOP_VAR)) {
208
3.53k
    return false;
209
3.53k
  }
210
211
843
  for (uint32_t i = block->start; i < block->start + block->len; i++) {
212
590
    if (is_live_loop_var_free(scdf, &op_array->opcodes[i], &scdf->ssa->ops[i])) {
213
14
      return true;
214
14
    }
215
590
  }
216
253
  return false;
217
267
}
218
219
14
static uint32_t cleanup_loop_var_free_block(const scdf_ctx *scdf, const zend_basic_block *block) {
220
14
  zend_ssa *ssa = scdf->ssa;
221
14
  const zend_op_array *op_array = scdf->op_array;
222
14
  const zend_cfg *cfg = &ssa->cfg;
223
14
  int block_num = block - cfg->blocks;
224
14
  uint32_t removed_ops = 0;
225
226
  /* Removes phi nodes */
227
18
  for (zend_ssa_phi *phi = ssa->blocks[block_num].phis; phi; phi = phi->next) {
228
4
    zend_ssa_remove_uses_of_var(ssa, phi->ssa_var);
229
4
    zend_ssa_remove_phi(ssa, phi);
230
4
  }
231
232
52
  for (uint32_t i = block->start; i < block->start + block->len; i++) {
233
38
    zend_op *opline = &op_array->opcodes[i];
234
38
    zend_ssa_op *ssa_op = &scdf->ssa->ops[i];
235
38
    if (opline->opcode == ZEND_NOP
236
38
     || is_live_loop_var_free(scdf, opline, ssa_op)) {
237
14
      continue;
238
14
    }
239
240
    /* While we have to preserve the loop var free, we can still remove other instructions
241
     * in the block. */
242
24
    zend_ssa_remove_defs_of_instr(ssa, ssa_op);
243
24
    zend_ssa_remove_instr(ssa, opline, ssa_op);
244
24
    removed_ops++;
245
24
  }
246
247
14
  zend_ssa_remove_block_from_cfg(ssa, block_num);
248
249
14
  return removed_ops;
250
14
}
251
252
/* Removes unreachable blocks. This will remove both the instructions (and phis) in the
253
 * blocks, as well as remove them from the successor / predecessor lists and mark them
254
 * unreachable. Blocks already marked unreachable are not removed. */
255
66.4k
uint32_t scdf_remove_unreachable_blocks(const scdf_ctx *scdf) {
256
66.4k
  zend_ssa *ssa = scdf->ssa;
257
66.4k
  uint32_t removed_ops = 0;
258
260k
  for (uint32_t i = 0; i < ssa->cfg.blocks_count; i++) {
259
194k
    const zend_basic_block *block = &ssa->cfg.blocks[i];
260
194k
    if (!zend_bitset_in(scdf->executable_blocks, i) && (block->flags & ZEND_BB_REACHABLE)) {
261
3.80k
      if (!kept_alive_by_loop_var_free(scdf, block)) {
262
3.78k
        removed_ops += block->len;
263
3.78k
        zend_ssa_remove_block(scdf->op_array, ssa, i);
264
3.78k
      } else {
265
14
        removed_ops += cleanup_loop_var_free_block(scdf, block);
266
14
      }
267
3.80k
    }
268
194k
  }
269
66.4k
  return removed_ops;
270
66.4k
}