Fix memory leak

Fixes oss-fuzz #50616

Fix SSA reconstruction when body of "foreach" loop is removed

Fixes oss-fuzz #49483

Fix incorrect optimization of ASSIGN_OP that may lead to memory leak

Fixes oss-fuzz #42506

Fix incorrect JMP optimization

Fixes oss-fuzz #42155

Fix bug #81652

We need to check not only for defs but also for uses of the
variable.

Drop pi nodes for both old/new pred in replace_predecessor

We also need to drop pi nodes for new_pred here, as the pi node
restriction for new_pred is not necessarily true for control

Drop pi nodes for both old/new pred in replace_predecessor

We also need to drop pi nodes for new_pred here, as the pi node
restriction for new_pred is not necessarily true for control
coming from old_pred as well.

Fixes oss-fuzz #40782.

show more ...

Fixed incorrect optimization that may cause JIT assertion

Don't replace tmp with cv in YIELD argument

For by-ref generators, these may have different behavior.

Fixes oss-fuzz 6059739298004992.

Handle pi nodes in replace_predecessor

If we're removing a predecessor because it already exists during
replacement, we should also drop pi nodes for that predecessor.

Fixes oss

Handle pi nodes in replace_predecessor

If we're removing a predecessor because it already exists during
replacement, we should also drop pi nodes for that predecessor.

Fixes oss-fuzz #39276.

show more ...

Check that POST_INC/DEC has use in DFA optimization

We'd have usually converted it into a PRE_INC if there is no use,
but that's not guaranteed. If there is no use at this point, make

Check that POST_INC/DEC has use in DFA optimization

We'd have usually converted it into a PRE_INC if there is no use,
but that's not guaranteed. If there is no use at this point, make
sure we don't try to use the sentinel value.

show more ...

Optimize out result value of ASSIGN, ASSIGN_OP and INC/DEC opcodes, if possible.

Only replace IN_ARRAY result type for JMPZ/JMPNZ

Replacing the result type in the general case is dangerous,
because not all opcodes support both VAR and TMP. One common case
is the

Only replace IN_ARRAY result type for JMPZ/JMPNZ

Replacing the result type in the general case is dangerous,
because not all opcodes support both VAR and TMP. One common case
is the in_array() result being passed to SEND_VAR, which would
have to be changed to SEND_VAL.

Rather than complicating this logic, reduce the scope to only
doing the type replacement for JMPZ and JMPNZ. The only reason
we're doing this in the first place is to enable the smart branch
optimization, so we can limit it to the relevant opcodes. Replacing
the result type may be marginally useful in other cases as well
(as it may avoid reference checks), but not worth the bother.

show more ...

Optimize out MAY_BE_LONG +/- 0 and MAY_BE_DOUBLE +/- 0.0

Implement nullsafe ?-> operator

RFC: https://wiki.php.net/rfc/nullsafe_operator

Closes GH-5619.

Co-authored-by: Nikita Popov <nikita.ppv@gmail.com>

Implement match expression

RFC: https://wiki.php.net/rfc/match_expression_v2

Closes GH-5371.

Use zend_string_equals API in a couple places

Handle NULL caller_call_opline

This can happen if there is an EXIT in the call arguments, in which
case the DO_CALL opcode may be eliminated as unreachable.

Merge EX variants of INFO macros

Add static return type

RFC: https://wiki.php.net/rfc/static_return_type

The "static" type is represented as MAY_BE_STATIC, rather than
a class type like "self" and "parent", as

Add static return type

RFC: https://wiki.php.net/rfc/static_return_type

The "static" type is represented as MAY_BE_STATIC, rather than
a class type like "self" and "parent", as it has special
resolution semantics, and cannot be cached in the runtime cache.

Closes GH-5062.

show more ...

Implement union types

According to RFC: https://wiki.php.net/rfc/union_types_v2

The type representation now makes use of both the pointer payload
and the type mask at the same t

Implement union types

According to RFC: https://wiki.php.net/rfc/union_types_v2

The type representation now makes use of both the pointer payload
and the type mask at the same time. Additionall, zend_type_list is
introduced as a new kind of pointer payload, which is used to store
multiple class types. Each of the class types is a tagged pointer,
which may be either a class name or class entry. The latter is only
used for typed properties, while arguments/returns will instead use
cache slots. A type list can contain a mix of both names and CEs at
the same time, as not all classes may be resolvable.

One thing this is missing is support for union types in arginfo
and stubs, which I want to handle separately.

I've also dropped the special object code from the JIT implementation
for now -- I plan to add this back in a different form at a later time.
For now I did not want to include non-trivial JIT changes together
with large functional changes.

Another possible piece of follow-up work is to implement "iterable"
as an internal alias for "array|Traversable". I believe this will
eliminate quite a few special-cases that had to be implemented.

Closes GH-4838.

show more ...

Make zend_type a 2-field struct

We now store the pointer payload and the type mask separately. This
is in preparation for union types, where we will be using both at
the same time.

Make zend_type a 2-field struct

We now store the pointer payload and the type mask separately. This
is in preparation for union types, where we will be using both at
the same time.

To avoid increasing the size of arginfo structures, the
pass_by_reference and is_variadic fields are now stored as part of
the type_mask (8-bit are reserved for custom use).

Different types of pointer payloads are distinguished based on bits
in the type_mask.

show more ...

Optimize VERIFY_RETURN_TYPE for TMP operands as well

Only exclude CONST operands, which use a different instruction
format (they have a return operand).

Check class linking in VERIFY_RETURN_TYPE optimization

instanceof_function() requires linked classes. I'm not reusing
unlinked_instanceof() here, because it performs class loading,
w

Check class linking in VERIFY_RETURN_TYPE optimization

instanceof_function() requires linked classes. I'm not reusing
unlinked_instanceof() here, because it performs class loading,
which wouldn't be right here, I think.

show more ...

SAMRT BRANCH improvement.

Avoid need of insertion NOP opcoes between unrelated SMART BRANCH instruction and following JMPZ/JMPNZ.
Now instead of checking the opcode of following instruct

SAMRT BRANCH improvement.

Avoid need of insertion NOP opcoes between unrelated SMART BRANCH instruction and following JMPZ/JMPNZ.
Now instead of checking the opcode of following instruction, the same information is encoded into SMART BRANH result_type.

show more ...

Avoid "$a = $a + ..." to "$a += ..." conversion (compound assignments work slower).
Added DFA optimization patters (e.g. "$a = $a + 1" to "++$a"), that previously worked only for compound assignm

Avoid "$a = $a + ..." to "$a += ..." conversion (compound assignments work slower).
Added DFA optimization patters (e.g. "$a = $a + 1" to "++$a"), that previously worked only for compound assignments.

show more ...