Add debug assertion on type narrowing

This ensures that this will show up as a fuzzing failure.

Improve file/line information for narrowing warning

Report the file/line of the opline rather than the include location.

This should make issues like #8251 easier to debug.

Fix typr inference

Fixes oss-fuzz #45020

Remove JMPZNZ opcode

While JMPZNZ can avoid execution of a separate JMP opcode in some
cases, it also prevents smart branch optimization, so creating
JMPZNZ may actually have a negat

Remove JMPZNZ opcode

While JMPZNZ can avoid execution of a separate JMP opcode in some
cases, it also prevents smart branch optimization, so creating
JMPZNZ may actually have a negative effect. It also adds additional
complexity for optimizations.

Drop JMPZNZ in favor of JMPZ+JMP or JMPNZ+JMP.

Closes GH-7857.

show more ...

Fixed assertion when check "instanceof" on unlinked class

Reuse get_class_entry_from_op1() helper

Export and reuse this helper in places that fetch a class entry
from op1.

Sink op_array scope case into get_class_entry()

This handles references to the current class through its name
rather than self (and for cases where is is not linked yet and
thus not

Sink op_array scope case into get_class_entry()

This handles references to the current class through its name
rather than self (and for cases where is is not linked yet and
thus not covered by the context lookup). Rather than handling this
only for FETCH_CLASS_CONSTANT optimization, integrate this into
the generic get_class_entry() utility.

show more ...

Deprecate implicit dynamic properties

Writing to a proprety that hasn't been declared is deprecated,
unless the class uses the #[AllowDynamicProperties] attribute or
defines __get()/

Deprecate implicit dynamic properties

Writing to a proprety that hasn't been declared is deprecated,
unless the class uses the #[AllowDynamicProperties] attribute or
defines __get()/__set().

RFC: https://wiki.php.net/rfc/deprecate_dynamic_properties

show more ...

Fix inference if FETCH_DIM_W user optimized away

In this case the user may be a FREE.

Also add the test file that I forgot in
3ce472d1a6c4d1df61db0cdd79e656f20f4fbf0d.

Fix array cast type inference wrt packed arrays

Use KEY_LONG instead of PACKED if it's possible for the array to
be empty. It won't be packed in that case.

Fixes oss-fuzz #39650.

Move TYPE_CHECK handling from sccp to inference

The handling of TYPE_CHECK makes for an awkward special case,
because it is determined outside the usual SCCP framework. Instead
move

Move TYPE_CHECK handling from sccp to inference

The handling of TYPE_CHECK makes for an awkward special case,
because it is determined outside the usual SCCP framework. Instead
move the logic into type inference (to infer a more specific
may_be_true or may_be_false if possible). This will get picked up
by SCCP through the existing logic to make use of type and range
information.

However, this also requires us to make use of type info in
feasible edge marking, otherwise we would regress existing
optimization power.

show more ...

Fix inference for INIT_ARRAY with illegal offset type

Extract assign_dim_array_result_type() helper that can be reused
for INIT_ARRAY and implements all this logic correctly.

Fi

Fix inference for INIT_ARRAY with illegal offset type

Extract assign_dim_array_result_type() helper that can be reused
for INIT_ARRAY and implements all this logic correctly.

Fixes oss-fuzz 5156868775870464.

show more ...

Check against FAILURE instead of different then SUCCESS

Voidify zend_mark_cv_references()

It always returned SUCCESS

Voidify zend_infer_ranges()

It always returned SUCCESS

Voidify zend_ssa_find_false_dependencies()

It always returned SUCCESS

Voidify zend_ssa_find_sccs()

It always returned SUCCESS

Use more appropriate types in Optimizer

Mainly using zend_result and bool instead of int

Separate zend_array_type_info() to avoid loop inlining

Better specialization for packed/hash arrays

- improved packed/hash inference.
- added hash guards for ASSIGN_DIM, ASSIGN_DIM_OP, FETCH_DIM_W* instructions
- more accurate invariant

Better specialization for packed/hash arrays

- improved packed/hash inference.
- added hash guards for ASSIGN_DIM, ASSIGN_DIM_OP, FETCH_DIM_W* instructions
- more accurate invariant type guards motion
- invariant packed/hash guards motion
- rename MAY_BE_ARRAY_HASH into MAY_BE_ARRAY_NUMERIC_HASH and add MAY_BE_ARRAY_STRING_HASH
- cleanup

show more ...

Make private functions "static" and remove unused zend_inference_check_recursive_dependencies().

Always use CE_CACHE, remove TYPE_HAS_CE (#7336)

Currently, CE_CACHE on strings is only used with opcache interned strings. This
patch extends usage to non-opcache interned strings as wel

Always use CE_CACHE, remove TYPE_HAS_CE (#7336)

Currently, CE_CACHE on strings is only used with opcache interned strings. This
patch extends usage to non-opcache interned strings as well. This means that
most type strings can now make use of CE_CACHE even if opcache is not loaded,
which allows us to remove TYPE_HAS_CE kind, and fix some discrepancies
depending on whether a type stores a resolved or non-resolved name.

There are two cases where CE_CACHE will not be used:

* When opcache is not used and a permanent interned string (that is not an
internal class name) is used as a type name during the request. In this case
we can't allocate a map_ptr index for the permanent string, as it would be
not be in the permanent map_ptr index space.
* When opcache is used but the script is not cached (e.g. eval'd code or
opcache full). If opcache is used, we can't allocate additional map_ptr
indexes at runtime, because they may conflict with indexes allocated by
opcache.

In these two cases we would end up not using CE caching for property types
(argument/return types still have the separate cache slot).

show more ...

Improve Range Inference

Support for simple negative range constraints on induction variables

FETCH_STATIC_PROP_IS may return undef

We don't go out of our way to convert IS_UNDEF to IS_NULL for
this opcode. Reflect this in type info.

Transfer MAY_BE_INDIRECT for VERIFY_RETURN

If the input is indirect, the output will be indirect too.