Fixed oss-fuzz #62294: Unsetting variable after ++/-- on string variable warning

Closes GH-12202

Fix OSS-fuzz #60709 unseting op via globals

It turns out not just NULL is affected nor -- but also on booleans and this also affects properties

[RFC] Path to Saner Increment/Decrement operators (#10358)

* Add behavioural tests for incdec operators

* Add support to ++/-- for objects castable to _IS_NUMBER

* Add str_

[RFC] Path to Saner Increment/Decrement operators (#10358)

* Add behavioural tests for incdec operators

* Add support to ++/-- for objects castable to _IS_NUMBER

* Add str_increment() function

* Add str_decrement() function

RFC: https://wiki.php.net/rfc/saner-inc-dec-operators

Co-authored-by: Ilija Tovilo <ilija.tovilo@me.com>
Co-authored-by: Arnaud Le Blanc <arnaud.lb@gmail.com>

show more ...

Fix GH-11507: String concatenation performance regression in 8.3

When the code was moved to solve the uaf for memory overflow, this
caused the refcount to be higher than one in some self

Fix GH-11507: String concatenation performance regression in 8.3

When the code was moved to solve the uaf for memory overflow, this
caused the refcount to be higher than one in some self-concatenation
scenarios. This in turn causes quadratic time performance problems when
these concatenations happen in a loop.

Closes GH-11508.

show more ...

Zend: Expose zendi_try_get_long() function via a public API (#10175)

Fix concat_function use-after-free on out-of-memory error (#11297)

Introduced by GH-10049

Fix string coercion for $a .= $a (#11296)

free_op2_string may be set to false when the operands are not strings, and
`result == op1 == op2`, by re-using the same string for both operands

Fix string coercion for $a .= $a (#11296)

free_op2_string may be set to false when the operands are not strings, and
`result == op1 == op2`, by re-using the same string for both operands. In that
case, the string should still be copied to result because result is not actually
a string. Also change the op1 branch to stay consistent.

Introduced by GH-10049

show more ...

Fix #97836 and #81705: Segfault / type confusion in concat_function

The following sequence of actions was happening which caused a null
pointer dereference:
1. debug_backtrace() retu

Fix #97836 and #81705: Segfault / type confusion in concat_function

The following sequence of actions was happening which caused a null
pointer dereference:
1. debug_backtrace() returns an array
2. The concatenation to $c will transform the array to a string via
`zval_get_string_func` for op2 and output a warning.
Note that zval op1 is of type string due to the first do-while
sequence.
3. The warning of an implicit "array to string conversion" triggers
the ob_start callback to run. This code transform $c (==op1) to a long.
4. The code below the 2 do-while sequences assume that both op1 and op2
are strings, but this is no longer the case. A dereference of the
string will therefore result in a null pointer dereference.

The solution used here is to work with the zend_string directly instead
of with the ops.

For the tests:
Co-authored-by: changochen1@gmail.com
Co-authored-by: cmbecker69@gmx.de
Co-authored-by: yukik@risec.co.jp

Closes GH-10049.

show more ...

Implement NEON-accelerated version of BLOCKCONV for lowercasing and uppercasing strings (#11161)

Since lowercasing and uppercasing is a common operation for both
internal purposes and us

Implement NEON-accelerated version of BLOCKCONV for lowercasing and uppercasing strings (#11161)

Since lowercasing and uppercasing is a common operation for both
internal purposes and userland purposes, it makes sense to implement a
NEON accelerated version for this.

show more ...

Endless recursion when using + on array in foreach

This reverts commit 84b4020eb4a8ebc45cb80164d4589cbf818f47f2.

Fixes GH-11171

Micro-optimize double comparison (#11061)

When using ZEND_NORMALIZE_BOOL(a - b) where a and b are doubles, this
generates the following instruction sequence on x64:
subsd xmm0, xmm

Micro-optimize double comparison (#11061)

When using ZEND_NORMALIZE_BOOL(a - b) where a and b are doubles, this
generates the following instruction sequence on x64:
subsd xmm0, xmm1
pxor xmm1, xmm1
comisd xmm0, xmm1
...

whereas if we use ZEND_THREEWAY_COMPARE we get two instructions less:
ucomisd xmm0, xmm1

The only difference is that the threeway compare uses *u*comisd instead
of comisd. The difference is that it will cause a FP signal if a
signaling NAN is used, but as far as I'm aware this doesn't matter for
our use case.

Similarly, the amount of instructions on AArch64 is also quite a bit
lower for this code compared to the old code.

** Results **

Using the benchmark https://gist.github.com/nielsdos/b36517d81a1af74d96baa3576c2b70df
I used hyperfine: hyperfine --runs 25 --warmup 3 './sapi/cli/php sort_double.php'
No extensions such as opcache used during benchmarking.

BEFORE THIS PATCH
-----------------
Time (mean ± σ): 255.5 ms ± 2.2 ms [User: 251.0 ms, System: 2.5 ms]
Range (min … max): 251.5 ms … 260.7 ms 25 runs

AFTER THIS PATCH
----------------
Time (mean ± σ): 236.2 ms ± 2.8 ms [User: 228.9 ms, System: 5.0 ms]
Range (min … max): 231.5 ms … 242.7 ms 25 runs

show more ...

Fix add_function_array() assertion when op2 contains op1

Fixes GH-10085
Closes GH-10975
Co-authored-by: Dmitry Stogov <dmitry@zend.com>

Fix undefined behaviour in string uppercasing and lowercasing

At least on 32-bit, the address computations overflow in running the
test on CI with UBSAN enabled. Fix it by reordering the

Fix undefined behaviour in string uppercasing and lowercasing

At least on 32-bit, the address computations overflow in running the
test on CI with UBSAN enabled. Fix it by reordering the arithmetic.
Since a part of the expression is already used in the code above the
computation, this should not negatively affect performance.

Closes GH-10936.

show more ...

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleadi

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleading, so let's use a
C99 integer instead.

On all architectures currently supported by PHP, `zend_uchar` and
`uint8_t` are identical. This change is only about code readability.

show more ...

Make various pointers const in Zend/ (#10608)

* Zend/zend_operators: pass const pointers to zend_is_identical()

* Zend/zend_operators: pass const pointers to zend_get_{long,double}(

Make various pointers const in Zend/ (#10608)

* Zend/zend_operators: pass const pointers to zend_is_identical()

* Zend/zend_operators: pass const pointers to zend_get_{long,double}()

* Zend/Optimizer/sccp: make pointers const

* Zend/Optimizer/scdf: make pointers const

* Zend/Optimizer/zend_worklist: make pointers const

* Zend/Optimizer/zend_optimizer: make pointers const

* Zend/zend_compile: make pointers const

show more ...

Introduce convenience macros for copying flags that hold when concatenating two strings

This abstracts away, and cleans up, the flag handling for properties of
strings that hold when con

Introduce convenience macros for copying flags that hold when concatenating two strings

This abstracts away, and cleans up, the flag handling for properties of
strings that hold when concatenating two strings if they both hold that
property. (These macros also work with simply copies of strings because
a copy of a string can be considered a concatenation with the empty
string.) This gets rid of some branches and some repetitive code, and
leaves room for adding more flags like these in the future.

show more ...

Use AVX2 to accelerate strto{upper,lower} (only on 'AVX2-native' builds for now)

On short strings, there is no difference in performance. However, for
strings around 10,000 bytes long, t

Use AVX2 to accelerate strto{upper,lower} (only on 'AVX2-native' builds for now)

On short strings, there is no difference in performance. However, for
strings around 10,000 bytes long, the AVX2-accelerated function is
about 55% faster than the SSE2-accelerated one.

show more ...

Concatenating two valid UTF-8 strings produces a valid UTF-8 string

The UTF-8 valid flag needs to be copied upon interning,
otherwise strings that are concatenated at compile time lose t

Concatenating two valid UTF-8 strings produces a valid UTF-8 string

The UTF-8 valid flag needs to be copied upon interning,
otherwise strings that are concatenated at compile time lose this information.

However, if previously this string was interned without the flag it is not added
E.g. in the case the string is an existing class name.

Co-authored-by: Niels Dossche <7771979+nielsdos@users.noreply.github.com>

show more ...

Mark numeric strings as valid UTF-8

Fix GH-8329 Print true/false instead of bool in error and debug messages (#8385)

Tweak SSE2-accelerated strtoupper() and strtolower() for speed

I learned this trick for doing a faster bounds check with both upper
and lower bounds by reading a disassembler listing of

Tweak SSE2-accelerated strtoupper() and strtolower() for speed

I learned this trick for doing a faster bounds check with both upper
and lower bounds by reading a disassembler listing of optimized code
produced by GCC; instead of doing 2 compares to check the upper and the
lower bound, add an immediate value to shift the range you are testing
for to the far low or high end of the range of possible values for the
type in question, and then a single compare will do. Intstead of
compare + compare + AND, you just do ADD + compare.

From microbenchmarking on my development PC, this makes strtoupper()
about 10% faster on long strings (~10,000 bytes).

show more ...

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07f7371ee2b5fac17de147926780e427fae6.
This reverts commit f377e15751d3aa48b69cd9bcc366ede7803d511f.
This reverts commit b4ba16fe189b109144aff669e11d81365160104b.
This reverts commit 694ec1deea36e366b28b6349a52be49824e1a1a8.
This reverts commit 6b34de8eba9f66882ae16e6073af28783670ac53.
This reverts commit aa1cd02a4367834026ea2205ea13a2f904455aa1.
This reverts commit 308fd311ea6fcf3094b448df7f2b264f08e4fe4f.
This reverts commit 16203b53e1822a37b6ba6f2ab198bb435d05fdad.
This reverts commit 738fb5ca5412f5e833a7fab82b11519e635a3357.
This reverts commit 9fdbefacd3c382d731aa175b7bdc002ec9cb2b30.
This reverts commit cd4a7c1d90562ebb5f89caf94d00d579631b9fbe.
This reverts commit 928685eba2b2f0ded90e7f78fd806ea164002f6e.
This reverts commit 01e5ffc85cd4357fd7b5b7ceefa29f2d10ca26b7.

show more ...

Zend/zend_{operators,variables}: include cleanup

Zend/zend_operators: make several pointers const

Merge remote-tracking branch 'upstream/PHP-8.1'