Cast the parameter type of arm BLOCKCONV_LOAD (#14159)

When building with gcc in the Arm environment, a runtime error due to an
overflow occurred, so we fixed it.

closes #14159

Fixed oss-fuzz #62294: Unsetting variable after ++/-- on string variable warning

Closes GH-12202

Fix OSS-fuzz #60709 unseting op via globals

It turns out not just NULL is affected nor -- but also on booleans and this also affects properties

[RFC] Path to Saner Increment/Decrement operators (#10358)

* Add behavioural tests for incdec operators

* Add support to ++/-- for objects castable to _IS_NUMBER

* Add str_

[RFC] Path to Saner Increment/Decrement operators (#10358)

* Add behavioural tests for incdec operators

* Add support to ++/-- for objects castable to _IS_NUMBER

* Add str_increment() function

* Add str_decrement() function

RFC: https://wiki.php.net/rfc/saner-inc-dec-operators

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Arnaud Le Blanc <arnaud.lb@gmail.com>

show more ...

Fix GH-11507: String concatenation performance regression in 8.3

When the code was moved to solve the uaf for memory overflow, this
caused the refcount to be higher than one in some self

Fix GH-11507: String concatenation performance regression in 8.3

When the code was moved to solve the uaf for memory overflow, this
caused the refcount to be higher than one in some self-concatenation
scenarios. This in turn causes quadratic time performance problems when
these concatenations happen in a loop.

Closes GH-11508.

show more ...

Zend: Expose zendi_try_get_long() function via a public API (#10175)

Fix concat_function use-after-free on out-of-memory error (#11297)

Introduced by GH-10049

Fix string coercion for $a .= $a (#11296)

free_op2_string may be set to false when the operands are not strings, and
`result == op1 == op2`, by re-using the same string for both operands

Fix string coercion for $a .= $a (#11296)

free_op2_string may be set to false when the operands are not strings, and
`result == op1 == op2`, by re-using the same string for both operands. In that
case, the string should still be copied to result because result is not actually
a string. Also change the op1 branch to stay consistent.

Introduced by GH-10049

show more ...

Fix #97836 and #81705: Segfault / type confusion in concat_function

The following sequence of actions was happening which caused a null
pointer dereference:
1. debug_backtrace() retu

Fix #97836 and #81705: Segfault / type confusion in concat_function

The following sequence of actions was happening which caused a null
pointer dereference:
1. debug_backtrace() returns an array
2. The concatenation to $c will transform the array to a string via
`zval_get_string_func` for op2 and output a warning.
Note that zval op1 is of type string due to the first do-while
sequence.
3. The warning of an implicit "array to string conversion" triggers
the ob_start callback to run. This code transform $c (==op1) to a long.
4. The code below the 2 do-while sequences assume that both op1 and op2
are strings, but this is no longer the case. A dereference of the
string will therefore result in a null pointer dereference.

The solution used here is to work with the zend_string directly instead
of with the ops.

For the tests:
Co-authored-by: changochen1@gmail.com
Co-authored-by: cmbecker69@gmx.de
Co-authored-by: yukik@risec.co.jp

Closes GH-10049.

show more ...

Implement NEON-accelerated version of BLOCKCONV for lowercasing and uppercasing strings (#11161)

Since lowercasing and uppercasing is a common operation for both
internal purposes and us

Implement NEON-accelerated version of BLOCKCONV for lowercasing and uppercasing strings (#11161)

Since lowercasing and uppercasing is a common operation for both
internal purposes and userland purposes, it makes sense to implement a
NEON accelerated version for this.

show more ...

Merge branch 'PHP-8.2'

* PHP-8.2:
Endless recursion when using + on array in foreach

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Endless recursion when using + on array in foreach

Endless recursion when using + on array in foreach

This reverts commit 84b4020eb4a8ebc45cb80164d4589cbf818f47f2.

Fixes GH-11171

Micro-optimize double comparison (#11061)

When using ZEND_NORMALIZE_BOOL(a - b) where a and b are doubles, this
generates the following instruction sequence on x64:
subsd xmm0, xmm

Micro-optimize double comparison (#11061)

When using ZEND_NORMALIZE_BOOL(a - b) where a and b are doubles, this
generates the following instruction sequence on x64:
subsd xmm0, xmm1
pxor xmm1, xmm1
comisd xmm0, xmm1
...

whereas if we use ZEND_THREEWAY_COMPARE we get two instructions less:
ucomisd xmm0, xmm1

The only difference is that the threeway compare uses *u*comisd instead
of comisd. The difference is that it will cause a FP signal if a
signaling NAN is used, but as far as I'm aware this doesn't matter for
our use case.

Similarly, the amount of instructions on AArch64 is also quite a bit
lower for this code compared to the old code.

** Results **

Using the benchmark https://gist.github.com/nielsdos/b36517d81a1af74d96baa3576c2b70df
I used hyperfine: hyperfine --runs 25 --warmup 3 './sapi/cli/php sort_double.php'
No extensions such as opcache used during benchmarking.

BEFORE THIS PATCH
-----------------
Time (mean ± σ): 255.5 ms ± 2.2 ms [User: 251.0 ms, System: 2.5 ms]
Range (min … max): 251.5 ms … 260.7 ms 25 runs

AFTER THIS PATCH
----------------
Time (mean ± σ): 236.2 ms ± 2.8 ms [User: 228.9 ms, System: 5.0 ms]
Range (min … max): 231.5 ms … 242.7 ms 25 runs

show more ...

Merge branch 'PHP-8.2'

* PHP-8.2:
Fix add_function_array() assertion when op2 contains op1

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Fix add_function_array() assertion when op2 contains op1

Fix add_function_array() assertion when op2 contains op1

Fixes GH-10085
Closes GH-10975
Co-authored-by: Dmitry Stogov <dmitry@zend.com>

Merge branch 'PHP-8.2'

* PHP-8.2:
Fix undefined behaviour in string uppercasing and lowercasing

Merge branch 'PHP-8.1' into PHP-8.2

* PHP-8.1:
Fix undefined behaviour in string uppercasing and lowercasing

Fix undefined behaviour in string uppercasing and lowercasing

At least on 32-bit, the address computations overflow in running the
test on CI with UBSAN enabled. Fix it by reordering the

Fix undefined behaviour in string uppercasing and lowercasing

At least on 32-bit, the address computations overflow in running the
test on CI with UBSAN enabled. Fix it by reordering the arithmetic.
Since a part of the expression is already used in the code above the
computation, this should not negatively affect performance.

Closes GH-10936.

show more ...

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleadi

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleading, so let's use a
C99 integer instead.

On all architectures currently supported by PHP, `zend_uchar` and
`uint8_t` are identical. This change is only about code readability.

show more ...

Make various pointers const in Zend/ (#10608)

* Zend/zend_operators: pass const pointers to zend_is_identical()

* Zend/zend_operators: pass const pointers to zend_get_{long,double}(

Make various pointers const in Zend/ (#10608)

* Zend/zend_operators: pass const pointers to zend_is_identical()

* Zend/zend_operators: pass const pointers to zend_get_{long,double}()

* Zend/Optimizer/sccp: make pointers const

* Zend/Optimizer/scdf: make pointers const

* Zend/Optimizer/zend_worklist: make pointers const

* Zend/Optimizer/zend_optimizer: make pointers const

* Zend/zend_compile: make pointers const

show more ...

Introduce convenience macros for copying flags that hold when concatenating two strings

This abstracts away, and cleans up, the flag handling for properties of
strings that hold when con

Introduce convenience macros for copying flags that hold when concatenating two strings

This abstracts away, and cleans up, the flag handling for properties of
strings that hold when concatenating two strings if they both hold that
property. (These macros also work with simply copies of strings because
a copy of a string can be considered a concatenation with the empty
string.) This gets rid of some branches and some repetitive code, and
leaves room for adding more flags like these in the future.

show more ...

Use AVX2 to accelerate strto{upper,lower} (only on 'AVX2-native' builds for now)

On short strings, there is no difference in performance. However, for
strings around 10,000 bytes long, t

Use AVX2 to accelerate strto{upper,lower} (only on 'AVX2-native' builds for now)

On short strings, there is no difference in performance. However, for
strings around 10,000 bytes long, the AVX2-accelerated function is
about 55% faster than the SSE2-accelerated one.

show more ...

Concatenating two valid UTF-8 strings produces a valid UTF-8 string

The UTF-8 valid flag needs to be copied upon interning,
otherwise strings that are concatenated at compile time lose t

Concatenating two valid UTF-8 strings produces a valid UTF-8 string

The UTF-8 valid flag needs to be copied upon interning,
otherwise strings that are concatenated at compile time lose this information.

However, if previously this string was interned without the flag it is not added
E.g. in the case the string is an existing class name.

Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>

show more ...