Fix GH-13834: Applying non-zero offset 36 to null pointer in zend_jit.c (#13846)

* Fix GH-13834: Applying non-zero offset 36 to null pointer in zend_jit.c

ssa_op can be NULL in func

Fix GH-13834: Applying non-zero offset 36 to null pointer in zend_jit.c (#13846)

* Fix GH-13834: Applying non-zero offset 36 to null pointer in zend_jit.c

ssa_op can be NULL in function JIT. Doing pointer arithmetic on a NULL
pointer is undefined behaviour. Undefined behaviour can be dangerous
because the optimizer may assume then that the variable is not actually
NULL.

To solve this:
1. Add ADVANCE_SSA_OP() to safely add an offset to ssa_op in zend_jit.c
2. For inference, add an extra offset argument to the helper functions.

To reproduce this, use Clang (not GCC) on a test like
sapi/cli/tests/gh12363.phpt (or other tests also work).

* Remove -fno-sanitize=pointer-overflow flag from CI

* Fix NULL pointer offsets added to the stack_map

* Fix an offset add on a potentially NULL ssa->ops

* Fix NULL pointer arithmetic in zend_range_info()

* Address review comments

show more ...

Implement stackless internal function calls

Co-authored-by: Dmitry Stogov <dmitry@zend.com>

Closes GH-12461

Fix GH-13232: Segmentation fault will be reported when JIT is off but JIT_debug is still on

Closes GH-13234.

Prevent starting JIT on x86_64 with buffuer size above 2G

Restored support for CPU cache demotion

Report fatal error if JIT cannot be enabled

Closes GH-12403

Don't JIT after fatal errors

Fixed missed type store

Fixes oss-fuzz #63601

Prevent starting JIT on AArch64 with buffuer aize above 128M

B and BL instructions are limited by 128M offset

Remove old JIT implementation (#12498)

* Remove old JIT implementation

* Remove ext/opcache/jit/zend_jit_vtune.c

A new PHP JIT implementation based on IR JIT framework (#12079)

* IR update

* Use folding to allow constant folding and common subexpression elimination

* Implement IR JIT

A new PHP JIT implementation based on IR JIT framework (#12079)

* IR update

* Use folding to allow constant folding and common subexpression elimination

* Implement IR JIT for INIT_FCALL, INIT_FCALL_BY_NAME and INIT_NS_FCALL_BY_NAME

* Implement IR JIT for SEND_VAL and SEND_VAL_EX

* Implement IR JIT for SEND_REF

* Implement IR JIT for SEND_VAR* instructions (incompltere - few tests failures)

* Implement IR JIT for CHECK_FUNC_ARG

* Implement IR JIT for CHECK_UNDEF_ARGS

* Implement IR JIT for ROPE_INIT, ROPE_ADD and ROPE_END

* Implement IR JIT for FREE, FE_FREE, ECHO, STRLEN and COUNT

* Implement IR JIT for IN_ARRAY

* Implement IR JIT support for separate VM stack overflow check

* Implement IR JIT for INIT_DYNAMIC_CALL

* Implemenr IR JIT for INIT_METHOD_CALL

* Fix IR JIT for IN_ARRAY and COUNT

* Implement IR JIT for VERIFY_RETURN_TYPE

* Force C compiler to store preserved registers to allow JIT using them

* Implement IR JIT for DO_FCALL, DO_UCALL, DO_ICALL and DO_FCALL_BY_NAME

* Implement IR JIT for FETCH_CONSTANT

* Fix (reverse) guard conditions

* Implement IR JIT for RECV and RECV_INIT

* Implement IR JIT for RETURN

* Implement IR JIT for BIND_GLOBAL

* Fix guard for: int++ => double

* Fix exception handling

* Allow deoptimization of zval type only (if some register is spilled by the IR engine)

* Fix overflow handling

* Implement IR JIT for FE_RESET_R and FE_FETCH_R

* Eliminate extra temporary register

* Better registers usage

* Implement IR JIT for FETCH_DIM_* and ISSET_DIM

* Implement IR JIT for ASSIGN_DIM and ASSIGN_DIM_OP

* cleanup

* Generae IR that produces a better x86[_64] code

* Allow trace register allocation for live ranges terminated before entering a called function

* Remove following END->BEGIN nodes during IR construction

* Remove useless (duplicate) guard

* Avoid useless exception check

* Prevent duplicate store

* Eliminate repatable re-assignment of stack zval types

* Enable combination of some instructions with the following SEND_VAL for IR JIT

* Avoid generation of useless RLOADs

* Eliminatare refcouting in a sequence of FETCH_DIM_R

* Fix assertion

* Remove ZREG_ZVAL_ADDREF flag from an element of abstract stack

* Implement IR JIT for FETCH_OBJ_*

* Implement IR JIT for ASSIGN_OBJ

* Implement IR JIT for ASSIGN_OBJ_OP

* cleanup

* Implement IR JIT for (PRE/POST)_(INC/DEC)_OBJ

* ws

* cleanup

* Fix IR JIT for constructor call

* Fix opcache.jit=1201 IR JIT.

With opcache.jit=1201 we still have to generate code for follow and target basic blocks with single exiting VM instruction. We mat just omit the entry point.

* Fix IR construction for the case when both IF targets are the same

* Avoid PHP LEAVE code duplication in function IR JIT.

* Reload operands from memeory when overflow (this improves hot code)

* Implement IR JIT for SWITCH_LONG, SWITCH_STRING and MATCH

* Initialize result to IS_UNDEF

* Fix JIT integraion with observer (Zend/tests/gh10346.phpt failure)

* Fix incorrect compilation of FE_FETCH with predicted empty array

* Fix register allocation

* Use sign extension inxted of zero

* Fix trace register allocator

* cleanp

* Fix address sanitizer warning

* Calculate JIT trace prologue sixe on startup (to avoid magic constants).

* Add cgecks for merge arrays overflow (this should be refactored using lists)

* Cache TLS access to perform corresponding read once per basic block

* cleanup unused variable

* Fix IR JIT support for CLANG build (CALL VM without global register variables)

* Fix IR JIT for CALL VM with global register variables

* Allow %rpb ysage in JIT for CALL VM (we save and restore it in prologue/epilogue anyway)

* cleanup

* Allocate enough fixed stack to keep preserved registers

* We don't have to care about x29 and x30

* cleanup (JMPZ/NZ_EX work fine)

* Revert "cleanup (JMPZ/NZ_EX work fine)"

This reverts commit cf8dd74a040e225d290d8ac4f5e33df638e6f8b8.

* Don't allocate register for PHP variables that are loaded from memory and used once

* Eliminate redundand deoptimization stores

* cleanup

* cleanup

* cleanup

* Optimization for constant comparison

* Cleanup and elimination of dead deoptimization stores

* Eliminate duplicate constant loading

* Set proper initial SP offset info for GDB backtraces

This doesn't take into account the following SP/FP modifications

* Add spill stores

* Remove low limit on number of deoptimization constants

* Emit dead code only when it's really necessary for IR graph

* cleanup

* cleanup

* Prefer loading long constants from memory (instead of loading immediate value)

* Regiter disasm labels using macros (add missing helpers)

* Make IR franework to care about GUARD JMP reordering

* Avoid reloading

* Improve register allocation for IR tracing JIT

* Add comment

* Fix deoptimization on result type guard of FETCH_DIM_R and FETCH_OBJ_R

* If HYBRID VM can't provide some stack space for JIT code in "red zone" then JIT has to reserve stack space itself

* Dump IR for stubs only if disassembling of stubs is requested

* Revert "Dump IR for stubs only if disassembling of stubs is requested"

This reverts commit d8b56bec129bc23c2b16f1f3c6367190181b6fdb.

* Dump IR for stubs only if disassembling of stubs is requested (another approach)

* Improve overflow deoptimization for ADD(_,1) and SUB(_,1)

Now we deoptimize to the next instruction, load constant result, and remove op1 from SNAPSHOT

* Switch to IR Builder API

* Switch to new IR builder macros

* Fix jit_set_Z_TYPE_INFO() call. op3 is a simple constant (not a ir_ref).

* Generate better code

* Enable empty ENTRY block merging

* Improve code generated for array separation/creation before an update

(ASSIGN_DIM, ASSING_DIM_OP, etc)

* Fix incorrect deleteion of PHI source (op1 is used for control link)

* Load constant once

* cleanup

* Improve control-flow to avoid two IS_ARRAY checks for REFERENCEs

* Update comments

* cleanup

* Clenup comments

* Fix AAarch 64 build (disable stack adjustment auto-detection)

* Add filename and line number to closure names

* Reserve stack for parameter passing

* Increase size of CPU stack reserved for JIT-ed code

* Fix addess sanitizer warnings

* Clenup: introduce OPTIMIZE_FOR_SIZE macro (disabled by default)

* Port 08e759120690520e99f9f2d38afeb21bcd1de197 to IR JIT

Fix (at lease part of the) #GH-10635: ARM64 function JIT causes impossible assertion

* cleanup

* Preload constant and use tests that may be compiled into better code

* Convert helpers to stubs

* Introduce a helper data structure (ir_refs) to collect references for the following use in (MERGE/PHI)_N

* Use ir_refs

* Improve code generated by zend_jit_zval_copy_deref()

* Use "cold" attribute to influence IR block scheduler and achieve better code layout

* Keep info collected by recursion analyzer

* Use HTTPS URL to allow fetching without a SSH key

* Update IR

* Update IR

* Add IR JIT support for Wondows (Win64 support is incomplete)

* Update IR

* Update IR

* Fix support for Windows ZTS build

* Fix stack alignment

* Cleanup ir_ctx.control usage

* Fixed support for irreducable (incomplete) and merged loops

* Revert "Fixed support for irreducable (incomplete) and merged loops"

This reverts commit 672b5b89f47e8b81745fb73c86e0bcb0937daf16.

* Generate better code for RECV_ENTRies

* Use simpler and more efficient checks

* Switch to new ENTRY node concept

* Limit register usage across the OSR ENTRY point

* Upate MEM type only if we write to memory

* Use LOOP_END without a reference edge

* Use new ir_init() prototype

* Delay LOAD for better LOAD fusion

* Fix RECV/RECV_INIT compilation with opcache.jit=1235

* iPtoperly compile fake closures (they mau be called as regular functions)

* Fix reabase

* Fix rebase and add --with-capstone support for IR JIT

* Replace zend_uchar -> uint8_t

* IR JIT support for delayed destructor for zend_assign_to_typed_ref/prop

* Handle zend_execute_internal in IR JIT

* Fix readonly+clone IR JIT issues

* Switch to ir_ctx.mflags

* Ckeanup "inputs_count" access

* Disable CSE for nodes bound to PHP local varibles

The stack slots for temporaty variables may be reused and in case of
spilling this may cause clobbering of the value.

(ext/standard/tests/strings/htmlentities20.phpt on x86 with tracing JIT)

* Fix deoptimization code when link traces

See ext/zlib/tests/bug75273.phpt failure

* Fix missing type store

This fixes ext/openssl/tests/openssl_error_string_basic_openssl3.phpt

* Fix tracing JIT for overflowing INC/DEC

Fixes tests/lang/operators/preinc_basiclong_64bit.phpt

* Remove ir_remove_unreachable_blocks() call. Now it's called by ir_build_cfg(), when necessary.

* IR JIT: Fixed inaccurate range inference usage for UNDEF/NULL/FALSE

* IR JIT: Fixed GH-11127 (JIT fault)

* Avoid allocation of unused exit point

* Don't record already stored PHP variables in SNAPSHOTs

* Delay variable load

* Disable CSE across ENTRY

* Fixed disabling CSE

* Fix deoptimization

* Fixed deoptimization

* Disable incorrect register allocation

* Fix JIT for INDENTICAL+JMPZ_EX

* Add comments

* Fixed missed type stores

* IR JIT: added support for CLDEMOTE

* Fixed incorrect constant usage

* Disable compilation of PHP functions with irreducible CGF

* Fixed liveness check

* Fixed code for constant conditional jump

* Add type store to avoid use-after-free

* Fixed liveness analyses

* Gnerate SNAPSHOT for virtual method calls

* More accurate search for staticaly inferred info about a trace SSA vaiable

* Fix incorrect result use type_info

* Fix JMPZ/NZ_EX support and missing type store

* Fixed trace type inference and missing type store

* Store type of unused CV to prevent possible following use after free

* Fixed deoptimizaton info

* Fixed stack layout

* Implemented support for veneers on AArch64

* Dsable CSE to avoid over-optimization

* Don't bind nodes for TMP PHP variables

* Re-enable CSE for temporary variables as we don't bind them anymore

* Switch to CPU stack spill slots

* Add codegen info dump

* Initialize CV variables through FP (this enables some folding optimizatios)

* Use zero-extension that can be eliminated

* Avoid generation of dead PHIs

* Increase preallocated spill stack size

* Enable IR based JIT by default

* Fixed build with -disable-opcache-jit

* Use explicit type conversion & force load values to registerts

* Fix IR build

* Checkout submodules in github actions

* Fixed Windows build

* Fixed Windows build

* Fixed reattach to IR JIT SHM

* Update IR

* Checkout submodules in nightly CI

* Fix MACOS ZTS in IR JIT

* Update ir

* Fixed incorrect register allocation

* Fixed incorect code generation

* Fixed tracing jit for BIND_INIT_STATIC_OR_JMP

* Update README

* Typos

* Revert JIT disabling for run-tests.php workers

* Fixed code review issues

* Update IR

* Update IR

* Update IR

* Allow exit_point duplication, when the deoptimization info differs because of spilling

* Use bound spill slots for CV (once again)

* Improve error handling

* Removed IR submodule

* Remove IR submodule from workflows

* Embed IR

IR commit: 8977307f4e96ee03847d7f2eb809b3080f9ed662

* Add .gitignore

* Fixed according to feedback

* Force C saving preserved registers only for HYBRID VM

* Update IR

IR commit: a2f8452b3d35a756cba38924f5c51a48a7207494

* cleanup

* Replace ZEND_ASSERT(0) by ZEND_UNREACHABLE()

* Update IR and remove unused IR files

IR commit: 399a38771393c202a741336643118991290b4b1b

* Fixed inconsistency between IR code-generation and register-allocation

* Update IR

IR commit: 86685504274b0c71d9985b3c926dccaca2cacf9b

* Update ir_PHI*() according to IR construction API changes

* Fixed 32-bit build

* Update IR

IR commit: d0686408e20cd8c8640e37ed52ab81403a2383cb

* Support for ir_TAILCALL() prototype changes

* Update IR

IR commit: d72ae866e09d17e879378767aceb91d51894818c

* Fixed incorrect extension (ZEXT->SEXT)

* Fix SSA dominance

* Update IR

IR commit: d60d92516dc5f89b93cdf1df7a54141e83226b07

* Fixed support ir_ctx.ret_type

show more ...

Fix GH-12380: JIT+private array property access inside closure accesses private property in child class

For private fields, the scope has to be taken into account, otherwise
the property

Fix GH-12380: JIT+private array property access inside closure accesses private property in child class

For private fields, the scope has to be taken into account, otherwise
the property info may come from the wrong ce.

Closes GH-12381.

show more ...

More usage of known zend_str instead of C string (#11381)

Allow arbitrary expressions in static variable initializer

Closes GH-9301

Cacheline demote to improve performance (#11101)

Once code is emitted to JIT buffer, hint the hardware to
demote the corresponding cache lines to more distant level
so other CPUs can

Cacheline demote to improve performance (#11101)

Once code is emitted to JIT buffer, hint the hardware to
demote the corresponding cache lines to more distant level
so other CPUs can access them more quickly.
This gets nearly 1% performance gain on our workload.

Signed-off-by: Xue,Wang <xue1.wang@intel.com>
Signed-off-by: Tao,Su <tao.su@intel.com>
Signed-off-by: Hu,chen <hu1.chen@intel.com>

show more ...

JIT: Align JIT stubs (#11149)

Fixed phpGH-11120

Signed-off-by: PeterYang12 <yuhan.yang@intel.com>

Use capstone explicitly, drop oprofile (GH 10876) (#10918)

* ext/opcache/config.m4: new --with-opcache-capstone flag.

Until now, libcapstone has been detected "automagically" and us

Use capstone explicitly, drop oprofile (GH 10876) (#10918)

* ext/opcache/config.m4: new --with-opcache-capstone flag.

Until now, libcapstone has been detected "automagically" and used for
JIT disassembly whenever it is available on the system used to compile
PHP. This can have some unintended consequences, however: many users
have capstone installed for some other purpose, and are surprised to
find that PHP breaks when capstone is later uninstalled.

To address this, we have introduced a new --with-opcache-capstone flag
that is disabled by default, and that makes the user's preference
explicit. It is ignored unless the JIT is enabled.

* ext/opcache: drop support for the oprofile JIT profiler.

Recently we have replaced the "automagic" detection of capstone at
build time with a --with-opcache-capstone flag. The detection of
oprofile causes similar problems and would likely have the same
solution; however, it was suggested that we might remove oprofile
altogether. So, this commit removes it:

* Remove the detection bits from ext/opcache/config.m4.
* Drop HAVE_OPROFILE ifdef blocks.
* Delete ext/opcache/jit/zend_jit_oprofile.c.
* Undefine the ZEND_JIT_DEBUG_OPROFILE constant.

show more ...

Fix module shutdown crash during ZTS JIT shutdown

Commit a21195650e53 fixed a leak by adding a TSRM destructor for the
JIT globals in ZTS mode. In case the main thread shuts down the TSR

Fix module shutdown crash during ZTS JIT shutdown

Commit a21195650e53 fixed a leak by adding a TSRM destructor for the
JIT globals in ZTS mode. In case the main thread shuts down the TSRM, it
will call all the destructors. The JIT globals destructor will be
invoked, but will always access the main thread globals using JIT_G.
This means that instead of freeing the JIT globals in the different
threads, the one in the main thread is freed repeatedly over and over,
crashing PHP. Fix it by always passing the pointer instead of relying on
JIT_G.

Closes GH-10835.

show more ...

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleadi

zend_compiler, ...: use `uint8_t` instead of `zend_uchar` (#10621)

`zend_uchar` suggests that the value is an ASCII character, but here,
it's about very small integers. This is misleading, so let's use a
C99 integer instead.

On all architectures currently supported by PHP, `zend_uchar` and
`uint8_t` are identical. This change is only about code readability.

show more ...

ext/opcache/zend_jit: call TSRM dtor before unloading opcache.so (#10533)

Commit a21195650e53e added a TSRM destructor, but that destructor
will get called by tsrm_shutdown(), which is a

ext/opcache/zend_jit: call TSRM dtor before unloading opcache.so (#10533)

Commit a21195650e53e added a TSRM destructor, but that destructor
will get called by tsrm_shutdown(), which is after opcache.so has
already been unloaded, resulting in a shutdown crash, e.g.:

#0 0x00007fad01737500 in ?? ()
#1 0x000055ac54e723c4 in tsrm_shutdown () at TSRM/TSRM.c:194
#2 0x000055ac54c42180 in main (argc=80, argv=0x55ac57bc14d0) at sapi/cli/php_cli.c:1388

By calling ts_free_id() before opcache.so gets unloaded, we can easily
fix this crash bug.

show more ...

ext/opcache/zend_jit: cast function to fix -Wincompatible-pointer-types (#10527)

* ext/opcache/zend_jit: cast function to fix -Wincompatible-pointer-types

Regression by commit a2119

ext/opcache/zend_jit: cast function to fix -Wincompatible-pointer-types (#10527)

* ext/opcache/zend_jit: cast function to fix -Wincompatible-pointer-types

Regression by commit a21195650e53e34266806a8c379dd5a91f0dbb61

* TSRM/win32: fix ts_allocate_dtor cast

The dtor was casted to ts_allocate_ctor; luckily, ts_allocate_dtor and
ts_allocate_ctor just happen to be the same type.

show more ...

Fix possible exit_counters memory leak in ZTS build

Delay debug JIT op_array dump until actual JIT-ing

Previously function JIT for the whole script (opcache.jit=1205) dumped
all op_arrays before JIT-ing the first functon. This complicated

Delay debug JIT op_array dump until actual JIT-ing

Previously function JIT for the whole script (opcache.jit=1205) dumped
all op_arrays before JIT-ing the first functon. This complicated debugging
of particular JIT-ed function and leaded to usage of opcache.jit=1204.
Now both options should produce similar op_array/disasm interlived
output.

show more ...

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07

Revert GH-10220

Cf. <https://github.com/php/php-src/pull/10220#issuecomment-1383739816>.

This reverts commit ecc880f491d66081298a16634629f149459706a9.
This reverts commit 588a07f7371ee2b5fac17de147926780e427fae6.
This reverts commit f377e15751d3aa48b69cd9bcc366ede7803d511f.
This reverts commit b4ba16fe189b109144aff669e11d81365160104b.
This reverts commit 694ec1deea36e366b28b6349a52be49824e1a1a8.
This reverts commit 6b34de8eba9f66882ae16e6073af28783670ac53.
This reverts commit aa1cd02a4367834026ea2205ea13a2f904455aa1.
This reverts commit 308fd311ea6fcf3094b448df7f2b264f08e4fe4f.
This reverts commit 16203b53e1822a37b6ba6f2ab198bb435d05fdad.
This reverts commit 738fb5ca5412f5e833a7fab82b11519e635a3357.
This reverts commit 9fdbefacd3c382d731aa175b7bdc002ec9cb2b30.
This reverts commit cd4a7c1d90562ebb5f89caf94d00d579631b9fbe.
This reverts commit 928685eba2b2f0ded90e7f78fd806ea164002f6e.
This reverts commit 01e5ffc85cd4357fd7b5b7ceefa29f2d10ca26b7.

show more ...

ext/{standard,json,random,...}: add missing includes