xref: /PHP-8.0/ext/opcache/Optimizer/block_pass.c (revision 229e80c6) 
1 /*
2    +----------------------------------------------------------------------+
3    | Zend OPcache                                                         |
4    +----------------------------------------------------------------------+
5    | Copyright (c) The PHP Group                                          |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@php.net>                                 |
16    |          Zeev Suraski <zeev@php.net>                                 |
17    |          Stanislav Malyshev <stas@zend.com>                          |
18    |          Dmitry Stogov <dmitry@php.net>                              |
19    +----------------------------------------------------------------------+
20 */
21 
22 #include "php.h"
23 #include "Optimizer/zend_optimizer.h"
24 #include "Optimizer/zend_optimizer_internal.h"
25 #include "zend_API.h"
26 #include "zend_constants.h"
27 #include "zend_execute.h"
28 #include "zend_vm.h"
29 #include "zend_bitset.h"
30 #include "zend_cfg.h"
31 #include "zend_dump.h"
32 
33 /* Checks if a constant (like "true") may be replaced by its value */
zend_optimizer_get_persistent_constant(zend_string * name,zval * result,int copy)34 int zend_optimizer_get_persistent_constant(zend_string *name, zval *result, int copy)
35 {
36 	zend_constant *c = zend_hash_find_ptr(EG(zend_constants), name);
37 	if (c) {
38 		if ((ZEND_CONSTANT_FLAGS(c) & CONST_PERSISTENT)
39 		 && !(ZEND_CONSTANT_FLAGS(c) & CONST_DEPRECATED)
40 		 && (!(ZEND_CONSTANT_FLAGS(c) & CONST_NO_FILE_CACHE)
41 		  || !(CG(compiler_options) & ZEND_COMPILE_WITH_FILE_CACHE))) {
42 			ZVAL_COPY_VALUE(result, &c->value);
43 			if (copy) {
44 				Z_TRY_ADDREF_P(result);
45 			}
46 			return 1;
47 		} else {
48 			return 0;
49 		}
50 	}
51 
52 	/* Special constants null/true/false can always be substituted. */
53 	c = zend_get_special_const(ZSTR_VAL(name), ZSTR_LEN(name));
54 	if (c) {
55 		ZVAL_COPY_VALUE(result, &c->value);
56 		return 1;
57 	}
58 	return 0;
59 }
60 
61 /* Data dependencies macros */
62 
63 #define VAR_SOURCE(op) Tsource[VAR_NUM(op.var)]
64 #define SET_VAR_SOURCE(opline) Tsource[VAR_NUM(opline->result.var)] = opline
65 
strip_leading_nops(zend_op_array * op_array,zend_basic_block * b)66 static void strip_leading_nops(zend_op_array *op_array, zend_basic_block *b)
67 {
68 	zend_op *opcodes = op_array->opcodes;
69 
70 	do {
71 		b->start++;
72 		b->len--;
73 	} while (b->len > 0 && opcodes[b->start].opcode == ZEND_NOP);
74 }
75 
strip_nops(zend_op_array * op_array,zend_basic_block * b)76 static void strip_nops(zend_op_array *op_array, zend_basic_block *b)
77 {
78 	uint32_t i, j;
79 
80 	if (b->len == 0) {
81 		return;
82 	}
83 
84 	if (op_array->opcodes[b->start].opcode == ZEND_NOP) {
85 		strip_leading_nops(op_array, b);
86 	}
87 
88 	if (b->len == 0) {
89 		return;
90 	}
91 
92 	/* strip the inside NOPs */
93 	i = j = b->start + 1;
94 	while (i < b->start + b->len) {
95 		if (op_array->opcodes[i].opcode != ZEND_NOP) {
96 			if (i != j) {
97 				op_array->opcodes[j] = op_array->opcodes[i];
98 			}
99 			j++;
100 		}
101 		i++;
102 	}
103 	b->len = j - b->start;
104 	while (j < i) {
105 		MAKE_NOP(op_array->opcodes + j);
106 		j++;
107 	}
108 }
109 
get_const_switch_target(zend_cfg * cfg,zend_op_array * op_array,zend_basic_block * block,zend_op * opline,zval * val)110 static int get_const_switch_target(zend_cfg *cfg, zend_op_array *op_array, zend_basic_block *block, zend_op *opline, zval *val) {
111 	HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
112 	zval *zv;
113 	if ((opline->opcode == ZEND_SWITCH_LONG && Z_TYPE_P(val) != IS_LONG)
114 			|| (opline->opcode == ZEND_SWITCH_STRING && Z_TYPE_P(val) != IS_STRING)) {
115 		/* fallback to next block */
116 		return block->successors[block->successors_count - 1];
117 	}
118 	if (opline->opcode == ZEND_MATCH && Z_TYPE_P(val) != IS_LONG && Z_TYPE_P(val) != IS_STRING) {
119 		/* always jump to the default arm */
120 		return block->successors[block->successors_count - 1];
121 	}
122 	if (Z_TYPE_P(val) == IS_LONG) {
123 		zv = zend_hash_index_find(jumptable, Z_LVAL_P(val));
124 	} else {
125 		ZEND_ASSERT(Z_TYPE_P(val) == IS_STRING);
126 		zv = zend_hash_find(jumptable, Z_STR_P(val));
127 	}
128 	if (!zv) {
129 		/* default */
130 		return block->successors[block->successors_count - (opline->opcode == ZEND_MATCH ? 1 : 2)];
131 	}
132 	return cfg->map[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv))];
133 }
134 
zend_optimize_block(zend_basic_block * block,zend_op_array * op_array,zend_bitset used_ext,zend_cfg * cfg,zend_op ** Tsource,uint32_t * opt_count)135 static void zend_optimize_block(zend_basic_block *block, zend_op_array *op_array, zend_bitset used_ext, zend_cfg *cfg, zend_op **Tsource, uint32_t *opt_count)
136 {
137 	zend_op *opline, *src;
138 	zend_op *end, *last_op = NULL;
139 
140 	if (block->len == 0) {
141 		return;
142 	}
143 
144 	if (op_array->opcodes[block->start].opcode == ZEND_NOP) {
145 		/* remove leading NOPs */
146 		strip_leading_nops(op_array, block);
147 	}
148 
149 	opline = op_array->opcodes + block->start;
150 	end = opline + block->len;
151 	while (opline < end) {
152 		/* Constant Propagation: strip X = QM_ASSIGN(const) */
153 		if (opline->op1_type == IS_TMP_VAR &&
154 		    opline->opcode != ZEND_FREE) {
155 			src = VAR_SOURCE(opline->op1);
156 			if (src &&
157 			    src->opcode == ZEND_QM_ASSIGN &&
158 			    src->op1_type == IS_CONST
159 			) {
160 				znode_op op1 = opline->op1;
161 				if (opline->opcode == ZEND_VERIFY_RETURN_TYPE) {
162 					COPY_NODE(opline->result, opline->op1);
163 					COPY_NODE(opline->op1, src->op1);
164 					VAR_SOURCE(op1) = NULL;
165 					MAKE_NOP(src);
166 					++(*opt_count);
167 				} else {
168 					zval c;
169 					ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
170 					if (zend_optimizer_update_op1_const(op_array, opline, &c)) {
171 						VAR_SOURCE(op1) = NULL;
172 						literal_dtor(&ZEND_OP1_LITERAL(src));
173 						MAKE_NOP(src);
174 						++(*opt_count);
175 					} else {
176 						zval_ptr_dtor_nogc(&c);
177 					}
178 				}
179 			}
180 		}
181 
182 		/* Constant Propagation: strip X = QM_ASSIGN(const) */
183 		if (opline->op2_type == IS_TMP_VAR) {
184 			src = VAR_SOURCE(opline->op2);
185 			if (src &&
186 			    src->opcode == ZEND_QM_ASSIGN &&
187 			    src->op1_type == IS_CONST) {
188 
189 				znode_op op2 = opline->op2;
190 				zval c;
191 
192 				ZVAL_COPY(&c, &ZEND_OP1_LITERAL(src));
193 				if (zend_optimizer_update_op2_const(op_array, opline, &c)) {
194 					VAR_SOURCE(op2) = NULL;
195 					literal_dtor(&ZEND_OP1_LITERAL(src));
196 					MAKE_NOP(src);
197 					++(*opt_count);
198 				} else {
199 					zval_ptr_dtor_nogc(&c);
200 				}
201 			}
202 		}
203 
204 		switch (opline->opcode) {
205 			case ZEND_ECHO:
206 				if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
207 					src = VAR_SOURCE(opline->op1);
208 					if (src &&
209 					    src->opcode == ZEND_CAST &&
210 					    src->extended_value == IS_STRING) {
211 						/* T = CAST(X, String), ECHO(T) => NOP, ECHO(X) */
212 						VAR_SOURCE(opline->op1) = NULL;
213 						COPY_NODE(opline->op1, src->op1);
214 						MAKE_NOP(src);
215 						++(*opt_count);
216 					}
217 				} else if (opline->op1_type == IS_CONST &&
218 				           Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_DOUBLE) {
219 					if (last_op == opline - 1) {
220 						/* compress consecutive ECHO's.
221 						 * Float to string conversion may be affected by current
222 						 * locale setting.
223 						 */
224 						int l, old_len;
225 
226 						if (Z_TYPE(ZEND_OP1_LITERAL(opline)) != IS_STRING) {
227 							convert_to_string(&ZEND_OP1_LITERAL(opline));
228 						}
229 						if (Z_TYPE(ZEND_OP1_LITERAL(last_op)) != IS_STRING) {
230 							convert_to_string(&ZEND_OP1_LITERAL(last_op));
231 						}
232 						old_len = Z_STRLEN(ZEND_OP1_LITERAL(last_op));
233 						l = old_len + Z_STRLEN(ZEND_OP1_LITERAL(opline));
234 						if (!Z_REFCOUNTED(ZEND_OP1_LITERAL(last_op))) {
235 							zend_string *tmp = zend_string_alloc(l, 0);
236 							memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP1_LITERAL(last_op)), old_len);
237 							Z_STR(ZEND_OP1_LITERAL(last_op)) = tmp;
238 						} else {
239 							Z_STR(ZEND_OP1_LITERAL(last_op)) = zend_string_extend(Z_STR(ZEND_OP1_LITERAL(last_op)), l, 0);
240 						}
241 						Z_TYPE_INFO(ZEND_OP1_LITERAL(last_op)) = IS_STRING_EX;
242 						memcpy(Z_STRVAL(ZEND_OP1_LITERAL(last_op)) + old_len, Z_STRVAL(ZEND_OP1_LITERAL(opline)), Z_STRLEN(ZEND_OP1_LITERAL(opline)));
243 						Z_STRVAL(ZEND_OP1_LITERAL(last_op))[l] = '\0';
244 						zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
245 						ZVAL_STR(&ZEND_OP1_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP1_LITERAL(last_op))));
246 						ZVAL_NULL(&ZEND_OP1_LITERAL(last_op));
247 						MAKE_NOP(last_op);
248 						++(*opt_count);
249 					}
250 					last_op = opline;
251 				}
252 				break;
253 
254 			case ZEND_FREE:
255 				if (opline->op1_type == IS_TMP_VAR) {
256 					src = VAR_SOURCE(opline->op1);
257 					if (src) {
258 						switch (src->opcode) {
259 							case ZEND_BOOL:
260 							case ZEND_BOOL_NOT:
261 								/* T = BOOL(X), FREE(T) => T = BOOL(X) */
262 								/* The remaining BOOL is removed by a separate optimization */
263 								VAR_SOURCE(opline->op1) = NULL;
264 								MAKE_NOP(opline);
265 								++(*opt_count);
266 								break;
267 							case ZEND_ASSIGN:
268 							case ZEND_ASSIGN_DIM:
269 							case ZEND_ASSIGN_OBJ:
270 							case ZEND_ASSIGN_STATIC_PROP:
271 							case ZEND_ASSIGN_OP:
272 							case ZEND_ASSIGN_DIM_OP:
273 							case ZEND_ASSIGN_OBJ_OP:
274 							case ZEND_ASSIGN_STATIC_PROP_OP:
275 							case ZEND_PRE_INC:
276 							case ZEND_PRE_DEC:
277 							case ZEND_PRE_INC_OBJ:
278 							case ZEND_PRE_DEC_OBJ:
279 							case ZEND_PRE_INC_STATIC_PROP:
280 							case ZEND_PRE_DEC_STATIC_PROP:
281 								src->result_type = IS_UNUSED;
282 								VAR_SOURCE(opline->op1) = NULL;
283 								MAKE_NOP(opline);
284 								++(*opt_count);
285 								break;
286 							default:
287 								break;
288 						}
289 					}
290 				} else if (opline->op1_type == IS_VAR) {
291 					src = VAR_SOURCE(opline->op1);
292 					/* V = OP, FREE(V) => OP. NOP */
293 					if (src &&
294 					    src->opcode != ZEND_FETCH_R &&
295 					    src->opcode != ZEND_FETCH_STATIC_PROP_R &&
296 					    src->opcode != ZEND_FETCH_DIM_R &&
297 					    src->opcode != ZEND_FETCH_OBJ_R &&
298 					    src->opcode != ZEND_NEW &&
299 					    src->opcode != ZEND_FETCH_THIS) {
300 						src->result_type = IS_UNUSED;
301 						MAKE_NOP(opline);
302 						++(*opt_count);
303 						if (src->opcode == ZEND_QM_ASSIGN) {
304 							if (src->op1_type & (IS_VAR|IS_TMP_VAR)) {
305 								src->opcode = ZEND_FREE;
306 							} else {
307 								MAKE_NOP(src);
308 							}
309 						}
310 					}
311 				}
312 				break;
313 
314 #if 0
315 		/* pre-evaluate functions:
316 		   constant(x)
317 		   function_exists(x)
318 		   extension_loaded(x)
319 		   BAD: interacts badly with Accelerator
320 		*/
321 		if((opline->op1_type & IS_VAR) &&
322 		   VAR_SOURCE(opline->op1) && VAR_SOURCE(opline->op1)->opcode == ZEND_DO_CF_FCALL &&
323 		   VAR_SOURCE(opline->op1)->extended_value == 1) {
324 			zend_op *fcall = VAR_SOURCE(opline->op1);
325 			zend_op *sv = fcall-1;
326 			if(sv >= block->start_opline && sv->opcode == ZEND_SEND_VAL &&
327 			   sv->op1_type == IS_CONST && Z_TYPE(OPLINE_OP1_LITERAL(sv)) == IS_STRING &&
328 			   Z_LVAL(OPLINE_OP2_LITERAL(sv)) == 1
329 			   ) {
330 				zval *arg = &OPLINE_OP1_LITERAL(sv);
331 				char *fname = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].function_name;
332 				int flen = FUNCTION_CACHE->funcs[Z_LVAL(ZEND_OP1_LITERAL(fcall))].name_len;
333 				if((flen == sizeof("function_exists")-1 && zend_binary_strcasecmp(fname, flen, "function_exists", sizeof("function_exists")-1) == 0) ||
334 						  (flen == sizeof("is_callable")-1 && zend_binary_strcasecmp(fname, flen, "is_callable", sizeof("is_callable")-1) == 0)
335 						  ) {
336 					zend_function *function;
337 					if((function = zend_hash_find_ptr(EG(function_table), Z_STR_P(arg))) != NULL) {
338 						literal_dtor(arg);
339 						MAKE_NOP(sv);
340 						MAKE_NOP(fcall);
341 						LITERAL_BOOL(opline->op1, 1);
342 						opline->op1_type = IS_CONST;
343 					}
344 				} else if(flen == sizeof("constant")-1 && zend_binary_strcasecmp(fname, flen, "constant", sizeof("constant")-1) == 0) {
345 					zval c;
346 					if(zend_optimizer_get_persistent_constant(Z_STR_P(arg), &c, 1 ELS_CC) != 0) {
347 						literal_dtor(arg);
348 						MAKE_NOP(sv);
349 						MAKE_NOP(fcall);
350 						ZEND_OP1_LITERAL(opline) = zend_optimizer_add_literal(op_array, &c);
351 						/* no copy ctor - get already copied it */
352 						opline->op1_type = IS_CONST;
353 					}
354 				} else if(flen == sizeof("extension_loaded")-1 && zend_binary_strcasecmp(fname, flen, "extension_loaded", sizeof("extension_loaded")-1) == 0) {
355 					if(zend_hash_exists(&module_registry, Z_STR_P(arg))) {
356 						literal_dtor(arg);
357 						MAKE_NOP(sv);
358 						MAKE_NOP(fcall);
359 						LITERAL_BOOL(opline->op1, 1);
360 						opline->op1_type = IS_CONST;
361 					}
362 				}
363 			}
364 		}
365 #endif
366 
367 			case ZEND_FETCH_LIST_R:
368 			case ZEND_FETCH_LIST_W:
369 				if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
370 					/* LIST variable will be deleted later by FREE */
371 					Tsource[VAR_NUM(opline->op1.var)] = NULL;
372 				}
373 				break;
374 
375 			case ZEND_SWITCH_LONG:
376 			case ZEND_SWITCH_STRING:
377 			case ZEND_MATCH:
378 				if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
379 					/* SWITCH variable will be deleted later by FREE, so we can't optimize it */
380 					Tsource[VAR_NUM(opline->op1.var)] = NULL;
381 					break;
382 				}
383 				if (opline->op1_type == IS_CONST) {
384 					int target = get_const_switch_target(cfg, op_array, block, opline, &ZEND_OP1_LITERAL(opline));
385 					literal_dtor(&ZEND_OP1_LITERAL(opline));
386 					literal_dtor(&ZEND_OP2_LITERAL(opline));
387 					opline->opcode = ZEND_JMP;
388 					opline->op1_type = IS_UNUSED;
389 					opline->op2_type = IS_UNUSED;
390 					block->successors_count = 1;
391 					block->successors[0] = target;
392 				}
393 				break;
394 
395 			case ZEND_CASE:
396 			case ZEND_CASE_STRICT:
397 			case ZEND_COPY_TMP:
398 				if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
399 					/* Variable will be deleted later by FREE, so we can't optimize it */
400 					Tsource[VAR_NUM(opline->op1.var)] = NULL;
401 					break;
402 				}
403 				/* break missing intentionally */
404 
405 			case ZEND_IS_EQUAL:
406 			case ZEND_IS_NOT_EQUAL:
407 				if (opline->op1_type == IS_CONST &&
408 				    opline->op2_type == IS_CONST) {
409 					goto optimize_constant_binary_op;
410 				}
411 		        /* IS_EQ(TRUE, X)      => BOOL(X)
412 		         * IS_EQ(FALSE, X)     => BOOL_NOT(X)
413 		         * IS_NOT_EQ(TRUE, X)  => BOOL_NOT(X)
414 		         * IS_NOT_EQ(FALSE, X) => BOOL(X)
415 		         * CASE(TRUE, X)       => BOOL(X)
416 		         * CASE(FALSE, X)      => BOOL_NOT(X)
417 		         */
418 				if (opline->op1_type == IS_CONST &&
419 					(Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_FALSE ||
420 					 Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_TRUE)) {
421 					/* Optimization of comparison with "null" is not safe,
422 					 * because ("0" == null) is not equal to !("0")
423 					 */
424 					opline->opcode =
425 						((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP1_LITERAL(opline))) == IS_TRUE)) ?
426 						ZEND_BOOL : ZEND_BOOL_NOT;
427 					COPY_NODE(opline->op1, opline->op2);
428 					SET_UNUSED(opline->op2);
429 					++(*opt_count);
430 					goto optimize_bool;
431 				} else if (opline->op2_type == IS_CONST &&
432 				           (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_FALSE ||
433 				            Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_TRUE)) {
434 					/* Optimization of comparison with "null" is not safe,
435 					 * because ("0" == null) is not equal to !("0")
436 					 */
437 					opline->opcode =
438 						((opline->opcode != ZEND_IS_NOT_EQUAL) == ((Z_TYPE(ZEND_OP2_LITERAL(opline))) == IS_TRUE)) ?
439 						ZEND_BOOL : ZEND_BOOL_NOT;
440 					SET_UNUSED(opline->op2);
441 					++(*opt_count);
442 					goto optimize_bool;
443 				}
444 				break;
445 
446 			case ZEND_BOOL:
447 			case ZEND_BOOL_NOT:
448 			optimize_bool:
449 				if (opline->op1_type == IS_CONST) {
450 					goto optimize_const_unary_op;
451 				}
452 				if (opline->op1_type == IS_TMP_VAR &&
453 				    !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
454 					src = VAR_SOURCE(opline->op1);
455 					if (src) {
456 						switch (src->opcode) {
457 							case ZEND_BOOL_NOT:
458 								/* T = BOOL_NOT(X) + BOOL(T) -> NOP, BOOL_NOT(X) */
459 								VAR_SOURCE(opline->op1) = NULL;
460 								COPY_NODE(opline->op1, src->op1);
461 								opline->opcode = (opline->opcode == ZEND_BOOL) ? ZEND_BOOL_NOT : ZEND_BOOL;
462 								MAKE_NOP(src);
463 								++(*opt_count);
464 								goto optimize_bool;
465 							case ZEND_BOOL:
466 								/* T = BOOL(X) + BOOL(T) -> NOP, BOOL(X) */
467 								VAR_SOURCE(opline->op1) = NULL;
468 								COPY_NODE(opline->op1, src->op1);
469 								MAKE_NOP(src);
470 								++(*opt_count);
471 								goto optimize_bool;
472 							case ZEND_IS_EQUAL:
473 								if (opline->opcode == ZEND_BOOL_NOT) {
474 									src->opcode = ZEND_IS_NOT_EQUAL;
475 								}
476 								COPY_NODE(src->result, opline->result);
477 								SET_VAR_SOURCE(src);
478 								MAKE_NOP(opline);
479 								++(*opt_count);
480 								break;
481 							case ZEND_IS_NOT_EQUAL:
482 								if (opline->opcode == ZEND_BOOL_NOT) {
483 									src->opcode = ZEND_IS_EQUAL;
484 								}
485 								COPY_NODE(src->result, opline->result);
486 								SET_VAR_SOURCE(src);
487 								MAKE_NOP(opline);
488 								++(*opt_count);
489 								break;
490 							case ZEND_IS_IDENTICAL:
491 								if (opline->opcode == ZEND_BOOL_NOT) {
492 									src->opcode = ZEND_IS_NOT_IDENTICAL;
493 								}
494 								COPY_NODE(src->result, opline->result);
495 								SET_VAR_SOURCE(src);
496 								MAKE_NOP(opline);
497 								++(*opt_count);
498 								break;
499 							case ZEND_IS_NOT_IDENTICAL:
500 								if (opline->opcode == ZEND_BOOL_NOT) {
501 									src->opcode = ZEND_IS_IDENTICAL;
502 								}
503 								COPY_NODE(src->result, opline->result);
504 								SET_VAR_SOURCE(src);
505 								MAKE_NOP(opline);
506 								++(*opt_count);
507 								break;
508 							case ZEND_IS_SMALLER:
509 								if (opline->opcode == ZEND_BOOL_NOT) {
510 									zend_uchar tmp_type;
511 									uint32_t tmp;
512 
513 									src->opcode = ZEND_IS_SMALLER_OR_EQUAL;
514 									tmp_type = src->op1_type;
515 									src->op1_type = src->op2_type;
516 									src->op2_type = tmp_type;
517 									tmp = src->op1.num;
518 									src->op1.num = src->op2.num;
519 									src->op2.num = tmp;
520 								}
521 								COPY_NODE(src->result, opline->result);
522 								SET_VAR_SOURCE(src);
523 								MAKE_NOP(opline);
524 								++(*opt_count);
525 								break;
526 							case ZEND_IS_SMALLER_OR_EQUAL:
527 								if (opline->opcode == ZEND_BOOL_NOT) {
528 									zend_uchar tmp_type;
529 									uint32_t tmp;
530 
531 									src->opcode = ZEND_IS_SMALLER;
532 									tmp_type = src->op1_type;
533 									src->op1_type = src->op2_type;
534 									src->op2_type = tmp_type;
535 									tmp = src->op1.num;
536 									src->op1.num = src->op2.num;
537 									src->op2.num = tmp;
538 								}
539 								COPY_NODE(src->result, opline->result);
540 								SET_VAR_SOURCE(src);
541 								MAKE_NOP(opline);
542 								++(*opt_count);
543 								break;
544 							case ZEND_ISSET_ISEMPTY_CV:
545 							case ZEND_ISSET_ISEMPTY_VAR:
546 							case ZEND_ISSET_ISEMPTY_DIM_OBJ:
547 							case ZEND_ISSET_ISEMPTY_PROP_OBJ:
548 							case ZEND_ISSET_ISEMPTY_STATIC_PROP:
549 							case ZEND_INSTANCEOF:
550 							case ZEND_TYPE_CHECK:
551 							case ZEND_DEFINED:
552 							case ZEND_IN_ARRAY:
553 							case ZEND_ARRAY_KEY_EXISTS:
554 								if (opline->opcode == ZEND_BOOL_NOT) {
555 									break;
556 								}
557 								COPY_NODE(src->result, opline->result);
558 								SET_VAR_SOURCE(src);
559 								MAKE_NOP(opline);
560 								++(*opt_count);
561 								break;
562 						}
563 					}
564 				}
565 				break;
566 
567 			case ZEND_JMPZ:
568 			case ZEND_JMPNZ:
569 			    while (1) {
570 					if (opline->op1_type == IS_CONST) {
571 						++(*opt_count);
572 						block->successors_count = 1;
573 						if (zend_is_true(&ZEND_OP1_LITERAL(opline)) ==
574 						    (opline->opcode == ZEND_JMPZ)) {
575 
576 							MAKE_NOP(opline);
577 							block->successors[0] = block->successors[1];
578 							block->len--;
579 							cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
580 							break;
581 						} else {
582 							zend_basic_block *next = cfg->blocks + block->successors[1];
583 
584 							next->flags &= ~ZEND_BB_FOLLOW;
585 							if (!(next->flags & (ZEND_BB_TARGET|ZEND_BB_PROTECTED))) {
586 								next->flags &= ~ZEND_BB_REACHABLE;
587 							}
588 							opline->opcode = ZEND_JMP;
589 							COPY_NODE(opline->op1, opline->op2);
590 							break;
591 						}
592 					} else if (opline->op1_type == IS_TMP_VAR &&
593 					           !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
594 						src = VAR_SOURCE(opline->op1);
595 						if (src) {
596 							if (src->opcode == ZEND_BOOL_NOT) {
597 								VAR_SOURCE(opline->op1) = NULL;
598 								COPY_NODE(opline->op1, src->op1);
599 								/* T = BOOL_NOT(X) + JMPZ(T) -> NOP, JMPNZ(X) */
600 								opline->opcode = INV_COND(opline->opcode);
601 								MAKE_NOP(src);
602 								++(*opt_count);
603 								continue;
604 							} else if (src->opcode == ZEND_BOOL ||
605 							           src->opcode == ZEND_QM_ASSIGN) {
606 								VAR_SOURCE(opline->op1) = NULL;
607 								COPY_NODE(opline->op1, src->op1);
608 								MAKE_NOP(src);
609 								++(*opt_count);
610 								continue;
611 							}
612 						}
613 					}
614 					break;
615 				}
616 				break;
617 
618 			case ZEND_JMPZNZ:
619 				while (1) {
620 					if (opline->op1_type == IS_CONST) {
621 						++(*opt_count);
622 						if (zend_is_true(&ZEND_OP1_LITERAL(opline))) {
623 							zend_op *target_opline = ZEND_OFFSET_TO_OPLINE(opline, opline->extended_value);
624 							ZEND_SET_OP_JMP_ADDR(opline, opline->op1, target_opline);
625 							block->successors[0] = block->successors[1];
626 						} else {
627 							zend_op *target_opline = ZEND_OP2_JMP_ADDR(opline);
628 							ZEND_SET_OP_JMP_ADDR(opline, opline->op1, target_opline);
629 						}
630 						block->successors_count = 1;
631 						opline->op1_type = IS_UNUSED;
632 						opline->extended_value = 0;
633 						opline->opcode = ZEND_JMP;
634 						break;
635 					} else if (opline->op1_type == IS_TMP_VAR &&
636 					           !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
637 						src = VAR_SOURCE(opline->op1);
638 						if (src) {
639 							if (src->opcode == ZEND_BOOL_NOT) {
640 								/* T = BOOL_NOT(X) + JMPZNZ(T,L1,L2) -> NOP, JMPZNZ(X,L2,L1) */
641 								uint32_t tmp;
642 
643 								VAR_SOURCE(opline->op1) = NULL;
644 								COPY_NODE(opline->op1, src->op1);
645 								tmp = block->successors[0];
646 								block->successors[0] = block->successors[1];
647 								block->successors[1] = tmp;
648 								MAKE_NOP(src);
649 								++(*opt_count);
650 								continue;
651 							} else if (src->opcode == ZEND_BOOL ||
652 							           src->opcode == ZEND_QM_ASSIGN) {
653 								VAR_SOURCE(opline->op1) = NULL;
654 								COPY_NODE(opline->op1, src->op1);
655 								MAKE_NOP(src);
656 								++(*opt_count);
657 								continue;
658 							}
659 						}
660 					}
661 					break;
662 				}
663 				break;
664 
665 			case ZEND_JMPZ_EX:
666 			case ZEND_JMPNZ_EX:
667 				while (1) {
668 					if (opline->op1_type == IS_CONST) {
669 						if (zend_is_true(&ZEND_OP1_LITERAL(opline)) ==
670 						    (opline->opcode == ZEND_JMPZ_EX)) {
671 
672 							++(*opt_count);
673 							opline->opcode = ZEND_QM_ASSIGN;
674 							zval_ptr_dtor_nogc(&ZEND_OP1_LITERAL(opline));
675 							ZVAL_BOOL(&ZEND_OP1_LITERAL(opline), opline->opcode == ZEND_JMPZ_EX);
676 							opline->op2.num = 0;
677 							block->successors_count = 1;
678 							block->successors[0] = block->successors[1];
679 							cfg->blocks[block->successors[0]].flags |= ZEND_BB_FOLLOW;
680 							break;
681 						}
682 					} else if (opline->op1_type == IS_TMP_VAR &&
683 					           (!zend_bitset_in(used_ext, VAR_NUM(opline->op1.var)) ||
684 					            opline->result.var == opline->op1.var)) {
685 						src = VAR_SOURCE(opline->op1);
686 						if (src) {
687 							if (src->opcode == ZEND_BOOL ||
688 							    src->opcode == ZEND_QM_ASSIGN) {
689 								VAR_SOURCE(opline->op1) = NULL;
690 								COPY_NODE(opline->op1, src->op1);
691 								MAKE_NOP(src);
692 								++(*opt_count);
693 								continue;
694 							}
695 						}
696 					}
697 					break;
698 				}
699 				break;
700 
701 			case ZEND_CONCAT:
702 			case ZEND_FAST_CONCAT:
703 				if (opline->op1_type == IS_CONST &&
704 				    opline->op2_type == IS_CONST) {
705 					goto optimize_constant_binary_op;
706 				}
707 
708 				if (opline->op2_type == IS_CONST &&
709 				    opline->op1_type == IS_TMP_VAR) {
710 
711 					src = VAR_SOURCE(opline->op1);
712 				    if (src &&
713 					    (src->opcode == ZEND_CONCAT ||
714 					     src->opcode == ZEND_FAST_CONCAT) &&
715 					    src->op2_type == IS_CONST) {
716 						/* compress consecutive CONCATs */
717 						int l, old_len;
718 
719 						if (Z_TYPE(ZEND_OP2_LITERAL(opline)) != IS_STRING) {
720 							convert_to_string(&ZEND_OP2_LITERAL(opline));
721 						}
722 						if (Z_TYPE(ZEND_OP2_LITERAL(src)) != IS_STRING) {
723 							convert_to_string(&ZEND_OP2_LITERAL(src));
724 						}
725 
726 						VAR_SOURCE(opline->op1) = NULL;
727 						COPY_NODE(opline->op1, src->op1);
728 						old_len = Z_STRLEN(ZEND_OP2_LITERAL(src));
729 						l = old_len + Z_STRLEN(ZEND_OP2_LITERAL(opline));
730 						if (!Z_REFCOUNTED(ZEND_OP2_LITERAL(src))) {
731 							zend_string *tmp = zend_string_alloc(l, 0);
732 							memcpy(ZSTR_VAL(tmp), Z_STRVAL(ZEND_OP2_LITERAL(src)), old_len);
733 							Z_STR(ZEND_OP2_LITERAL(src)) = tmp;
734 						} else {
735 							Z_STR(ZEND_OP2_LITERAL(src)) = zend_string_extend(Z_STR(ZEND_OP2_LITERAL(src)), l, 0);
736 						}
737 						Z_TYPE_INFO(ZEND_OP2_LITERAL(src)) = IS_STRING_EX;
738 						memcpy(Z_STRVAL(ZEND_OP2_LITERAL(src)) + old_len, Z_STRVAL(ZEND_OP2_LITERAL(opline)), Z_STRLEN(ZEND_OP2_LITERAL(opline)));
739 						Z_STRVAL(ZEND_OP2_LITERAL(src))[l] = '\0';
740 						zval_ptr_dtor_str(&ZEND_OP2_LITERAL(opline));
741 						ZVAL_STR(&ZEND_OP2_LITERAL(opline), zend_new_interned_string(Z_STR(ZEND_OP2_LITERAL(src))));
742 						ZVAL_NULL(&ZEND_OP2_LITERAL(src));
743 						MAKE_NOP(src);
744 						++(*opt_count);
745 					}
746 				}
747 
748 				if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
749 					src = VAR_SOURCE(opline->op1);
750 					if (src &&
751 					    src->opcode == ZEND_CAST &&
752 					    src->extended_value == IS_STRING &&
753 					    src->op1_type != IS_CONST) {
754 						/* convert T1 = CAST(STRING, X), T2 = CONCAT(T1, Y) to T2 = CONCAT(X,Y) */
755 						VAR_SOURCE(opline->op1) = NULL;
756 						COPY_NODE(opline->op1, src->op1);
757 						MAKE_NOP(src);
758 						++(*opt_count);
759 					}
760 	            }
761 				if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
762 					src = VAR_SOURCE(opline->op2);
763 					if (src &&
764 					    src->opcode == ZEND_CAST &&
765 					    src->extended_value == IS_STRING &&
766 					    src->op1_type != IS_CONST) {
767 						/* convert T1 = CAST(STRING, X), T2 = CONCAT(Y, T1) to T2 = CONCAT(Y,X) */
768 						zend_op *src = VAR_SOURCE(opline->op2);
769 						VAR_SOURCE(opline->op2) = NULL;
770 						COPY_NODE(opline->op2, src->op1);
771 						MAKE_NOP(src);
772 						++(*opt_count);
773 					}
774 				}
775 				if (opline->op1_type == IS_CONST &&
776 				    Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_STRING &&
777 				    Z_STRLEN(ZEND_OP1_LITERAL(opline)) == 0) {
778 					/* convert CONCAT('', X) => CAST(STRING, X) */
779 					literal_dtor(&ZEND_OP1_LITERAL(opline));
780 					opline->opcode = ZEND_CAST;
781 					opline->extended_value = IS_STRING;
782 					COPY_NODE(opline->op1, opline->op2);
783 					opline->op2_type = IS_UNUSED;
784 					opline->op2.var = 0;
785 					++(*opt_count);
786 				} else if (opline->op2_type == IS_CONST &&
787 			           Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING &&
788 			           Z_STRLEN(ZEND_OP2_LITERAL(opline)) == 0) {
789 					/* convert CONCAT(X, '') => CAST(STRING, X) */
790 					literal_dtor(&ZEND_OP2_LITERAL(opline));
791 					opline->opcode = ZEND_CAST;
792 					opline->extended_value = IS_STRING;
793 					opline->op2_type = IS_UNUSED;
794 					opline->op2.var = 0;
795 					++(*opt_count);
796 				} else if (opline->opcode == ZEND_CONCAT &&
797 				           (opline->op1_type == IS_CONST ||
798 				            (opline->op1_type == IS_TMP_VAR &&
799 				             VAR_SOURCE(opline->op1) &&
800 				             (VAR_SOURCE(opline->op1)->opcode == ZEND_FAST_CONCAT ||
801 				              VAR_SOURCE(opline->op1)->opcode == ZEND_ROPE_END ||
802 				              VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CONSTANT ||
803 				              VAR_SOURCE(opline->op1)->opcode == ZEND_FETCH_CLASS_CONSTANT))) &&
804 				           (opline->op2_type == IS_CONST ||
805 				            (opline->op2_type == IS_TMP_VAR &&
806 				             VAR_SOURCE(opline->op2) &&
807 				             (VAR_SOURCE(opline->op2)->opcode == ZEND_FAST_CONCAT ||
808 				              VAR_SOURCE(opline->op2)->opcode == ZEND_ROPE_END ||
809 				              VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CONSTANT ||
810 				              VAR_SOURCE(opline->op2)->opcode == ZEND_FETCH_CLASS_CONSTANT)))) {
811 					opline->opcode = ZEND_FAST_CONCAT;
812 					++(*opt_count);
813 				}
814 				break;
815 
816 			case ZEND_ADD:
817 			case ZEND_SUB:
818 			case ZEND_MUL:
819 			case ZEND_DIV:
820 			case ZEND_MOD:
821 			case ZEND_SL:
822 			case ZEND_SR:
823 			case ZEND_IS_SMALLER:
824 			case ZEND_IS_SMALLER_OR_EQUAL:
825 			case ZEND_IS_IDENTICAL:
826 			case ZEND_IS_NOT_IDENTICAL:
827 			case ZEND_BOOL_XOR:
828 			case ZEND_BW_OR:
829 			case ZEND_BW_AND:
830 			case ZEND_BW_XOR:
831 				if (opline->op1_type == IS_CONST &&
832 				    opline->op2_type == IS_CONST) {
833 					/* evaluate constant expressions */
834 					zval result;
835 
836 optimize_constant_binary_op:
837 					if (zend_optimizer_eval_binary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline), &ZEND_OP2_LITERAL(opline)) == SUCCESS) {
838 						literal_dtor(&ZEND_OP1_LITERAL(opline));
839 						literal_dtor(&ZEND_OP2_LITERAL(opline));
840 						opline->opcode = ZEND_QM_ASSIGN;
841 						SET_UNUSED(opline->op2);
842 						zend_optimizer_update_op1_const(op_array, opline, &result);
843 						++(*opt_count);
844 					}
845 				}
846 				break;
847 
848 			case ZEND_BW_NOT:
849 				if (opline->op1_type == IS_CONST) {
850 					/* evaluate constant unary ops */
851 					zval result;
852 
853 optimize_const_unary_op:
854 					if (zend_optimizer_eval_unary_op(&result, opline->opcode, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
855 						literal_dtor(&ZEND_OP1_LITERAL(opline));
856 						opline->opcode = ZEND_QM_ASSIGN;
857 						zend_optimizer_update_op1_const(op_array, opline, &result);
858 						++(*opt_count);
859 					}
860 				}
861 				break;
862 
863 			case ZEND_CAST:
864 				if (opline->op1_type == IS_CONST) {
865 					/* cast of constant operand */
866 					zval result;
867 
868 					if (zend_optimizer_eval_cast(&result, opline->extended_value, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
869 						literal_dtor(&ZEND_OP1_LITERAL(opline));
870 						opline->opcode = ZEND_QM_ASSIGN;
871 						opline->extended_value = 0;
872 						zend_optimizer_update_op1_const(op_array, opline, &result);
873 						++(*opt_count);
874 					}
875 				}
876 				break;
877 
878 			case ZEND_STRLEN:
879 				if (opline->op1_type == IS_CONST) {
880 					zval result;
881 
882 					if (zend_optimizer_eval_strlen(&result, &ZEND_OP1_LITERAL(opline)) == SUCCESS) {
883 						literal_dtor(&ZEND_OP1_LITERAL(opline));
884 						opline->opcode = ZEND_QM_ASSIGN;
885 						zend_optimizer_update_op1_const(op_array, opline, &result);
886 						++(*opt_count);
887 					}
888 				}
889 				break;
890 
891 			case ZEND_RETURN:
892 			case ZEND_EXIT:
893 				if (opline->op1_type == IS_TMP_VAR) {
894 					src = VAR_SOURCE(opline->op1);
895 					if (src && src->opcode == ZEND_QM_ASSIGN) {
896 						zend_op *op = src + 1;
897 						zend_bool optimize = 1;
898 
899 						while (op < opline) {
900 							if ((op->op1_type == opline->op1_type
901 							  && op->op1.var == opline->op1.var)
902 							 || (op->op2_type == opline->op1_type
903 							  && op->op2.var == opline->op1.var)) {
904 								optimize = 0;
905 								break;
906 							}
907 							op++;
908 						}
909 
910 						if (optimize) {
911 							/* T = QM_ASSIGN(X), RETURN(T) to NOP, RETURN(X) */
912 							VAR_SOURCE(opline->op1) = NULL;
913 							COPY_NODE(opline->op1, src->op1);
914 							MAKE_NOP(src);
915 							++(*opt_count);
916 						}
917 					}
918 				}
919 				break;
920 
921 			case ZEND_QM_ASSIGN:
922 				if (opline->op1_type == opline->result_type &&
923 				    opline->op1.var == opline->result.var) {
924 					/* strip T = QM_ASSIGN(T) */
925 					MAKE_NOP(opline);
926 					++(*opt_count);
927 				} else if (opline->op1_type == IS_TMP_VAR &&
928 				           opline->result_type == IS_TMP_VAR &&
929 				           !zend_bitset_in(used_ext, VAR_NUM(opline->op1.var))) {
930 					/* T1 = ..., T2 = QM_ASSIGN(T1) to T2 = ..., NOP */
931 					src = VAR_SOURCE(opline->op1);
932 					if (src &&
933 						src->opcode != ZEND_COPY_TMP &&
934 						src->opcode != ZEND_ADD_ARRAY_ELEMENT &&
935 						src->opcode != ZEND_ADD_ARRAY_UNPACK &&
936 						(src->opcode != ZEND_DECLARE_LAMBDA_FUNCTION ||
937 						 src == opline -1)) {
938 						src->result.var = opline->result.var;
939 						VAR_SOURCE(opline->op1) = NULL;
940 						VAR_SOURCE(opline->result) = src;
941 						MAKE_NOP(opline);
942 						++(*opt_count);
943 					}
944 				}
945 				break;
946 		}
947 
948 		/* get variable source */
949 		if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
950 			SET_VAR_SOURCE(opline);
951 		}
952 		opline++;
953 	}
954 }
955 
956 /* Rebuild plain (optimized) op_array from CFG */
assemble_code_blocks(zend_cfg * cfg,zend_op_array * op_array,zend_optimizer_ctx * ctx)957 static void assemble_code_blocks(zend_cfg *cfg, zend_op_array *op_array, zend_optimizer_ctx *ctx)
958 {
959 	zend_basic_block *blocks = cfg->blocks;
960 	zend_basic_block *end = blocks + cfg->blocks_count;
961 	zend_basic_block *b;
962 	zend_op *new_opcodes;
963 	zend_op *opline;
964 	uint32_t len = 0;
965 	int n;
966 
967 	for (b = blocks; b < end; b++) {
968 		if (b->len == 0) {
969 			continue;
970 		}
971 		if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
972 			if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
973 				/* Only keep the FREE for the loop var */
974 				ZEND_ASSERT(op_array->opcodes[b->start].opcode == ZEND_FREE
975 						|| op_array->opcodes[b->start].opcode == ZEND_FE_FREE);
976 				len += b->len = 1;
977 				continue;
978 			}
979 
980 			opline = op_array->opcodes + b->start + b->len - 1;
981 			if (opline->opcode == ZEND_JMP) {
982 				zend_basic_block *next = b + 1;
983 
984 				while (next < end && !(next->flags & ZEND_BB_REACHABLE)) {
985 					next++;
986 				}
987 				if (next < end && next == blocks + b->successors[0]) {
988 					/* JMP to the next block - strip it */
989 					MAKE_NOP(opline);
990 					b->len--;
991 				}
992 			} else if (b->len == 1 && opline->opcode == ZEND_NOP) {
993 				/* skip empty block */
994 				b->len--;
995 			}
996 			len += b->len;
997 		} else {
998 			/* this block will not be used, delete all constants there */
999 			zend_op *op = op_array->opcodes + b->start;
1000 			zend_op *end = op + b->len;
1001 			for (; op < end; op++) {
1002 				if (op->op1_type == IS_CONST) {
1003 					literal_dtor(&ZEND_OP1_LITERAL(op));
1004 				}
1005 				if (op->op2_type == IS_CONST) {
1006 					literal_dtor(&ZEND_OP2_LITERAL(op));
1007 				}
1008 			}
1009 		}
1010 	}
1011 
1012 	new_opcodes = emalloc(len * sizeof(zend_op));
1013 	opline = new_opcodes;
1014 
1015 	/* Copy code of reachable blocks into a single buffer */
1016 	for (b = blocks; b < end; b++) {
1017 		if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1018 			memcpy(opline, op_array->opcodes + b->start, b->len * sizeof(zend_op));
1019 			b->start = opline - new_opcodes;
1020 			opline += b->len;
1021 		}
1022 	}
1023 
1024 	/* adjust jump targets */
1025 	efree(op_array->opcodes);
1026 	op_array->opcodes = new_opcodes;
1027 	op_array->last = len;
1028 
1029 	for (b = blocks; b < end; b++) {
1030 		if (!(b->flags & ZEND_BB_REACHABLE) || b->len == 0) {
1031 			continue;
1032 		}
1033 		opline = op_array->opcodes + b->start + b->len - 1;
1034 		switch (opline->opcode) {
1035 			case ZEND_FAST_CALL:
1036 			case ZEND_JMP:
1037 				ZEND_SET_OP_JMP_ADDR(opline, opline->op1, new_opcodes + blocks[b->successors[0]].start);
1038 				break;
1039 			case ZEND_JMPZNZ:
1040 				opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[1]].start);
1041 				/* break missing intentionally */
1042 			case ZEND_JMPZ:
1043 			case ZEND_JMPNZ:
1044 			case ZEND_JMPZ_EX:
1045 			case ZEND_JMPNZ_EX:
1046 			case ZEND_FE_RESET_R:
1047 			case ZEND_FE_RESET_RW:
1048 			case ZEND_JMP_SET:
1049 			case ZEND_COALESCE:
1050 			case ZEND_ASSERT_CHECK:
1051 			case ZEND_JMP_NULL:
1052 				ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1053 				break;
1054 			case ZEND_CATCH:
1055 				if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1056 					ZEND_SET_OP_JMP_ADDR(opline, opline->op2, new_opcodes + blocks[b->successors[0]].start);
1057 				}
1058 				break;
1059 			case ZEND_FE_FETCH_R:
1060 			case ZEND_FE_FETCH_RW:
1061 				opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[0]].start);
1062 				break;
1063 			case ZEND_SWITCH_LONG:
1064 			case ZEND_SWITCH_STRING:
1065 			case ZEND_MATCH:
1066 			{
1067 				HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
1068 				zval *zv;
1069 				uint32_t s = 0;
1070 				ZEND_ASSERT(b->successors_count == (opline->opcode == ZEND_MATCH ? 1 : 2) + zend_hash_num_elements(jumptable));
1071 
1072 				ZEND_HASH_FOREACH_VAL(jumptable, zv) {
1073 					Z_LVAL_P(zv) = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1074 				} ZEND_HASH_FOREACH_END();
1075 				opline->extended_value = ZEND_OPLINE_TO_OFFSET(opline, new_opcodes + blocks[b->successors[s++]].start);
1076 				break;
1077 			}
1078 		}
1079 	}
1080 
1081 	/* adjust exception jump targets & remove unused try_catch_array entries */
1082 	if (op_array->last_try_catch) {
1083 		int i, j;
1084 		uint32_t *map;
1085 		ALLOCA_FLAG(use_heap);
1086 
1087 		map = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last_try_catch, use_heap);
1088 		for (i = 0, j = 0; i< op_array->last_try_catch; i++) {
1089 			if (blocks[cfg->map[op_array->try_catch_array[i].try_op]].flags & ZEND_BB_REACHABLE) {
1090 				map[i] = j;
1091 				op_array->try_catch_array[j].try_op = blocks[cfg->map[op_array->try_catch_array[i].try_op]].start;
1092 				if (op_array->try_catch_array[i].catch_op) {
1093 					op_array->try_catch_array[j].catch_op = blocks[cfg->map[op_array->try_catch_array[i].catch_op]].start;
1094 				} else {
1095 					op_array->try_catch_array[j].catch_op =  0;
1096 				}
1097 				if (op_array->try_catch_array[i].finally_op) {
1098 					op_array->try_catch_array[j].finally_op = blocks[cfg->map[op_array->try_catch_array[i].finally_op]].start;
1099 				} else {
1100 					op_array->try_catch_array[j].finally_op =  0;
1101 				}
1102 				if (!op_array->try_catch_array[i].finally_end) {
1103 					op_array->try_catch_array[j].finally_end = 0;
1104 				} else {
1105 					op_array->try_catch_array[j].finally_end = blocks[cfg->map[op_array->try_catch_array[i].finally_end]].start;
1106 				}
1107 				j++;
1108 			}
1109 		}
1110 		if (i != j) {
1111 			op_array->last_try_catch = j;
1112 			if (j == 0) {
1113 				efree(op_array->try_catch_array);
1114 				op_array->try_catch_array = NULL;
1115 			}
1116 
1117 			if (op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK) {
1118 				zend_op *opline = new_opcodes;
1119 				zend_op *end = opline + len;
1120 				while (opline < end) {
1121 					if (opline->opcode == ZEND_FAST_RET &&
1122 					    opline->op2.num != (uint32_t)-1 &&
1123 					    opline->op2.num < (uint32_t)j) {
1124 						opline->op2.num = map[opline->op2.num];
1125 					}
1126 					opline++;
1127 				}
1128 			}
1129 		}
1130 		free_alloca(map, use_heap);
1131 	}
1132 
1133 	/* adjust early binding list */
1134 	if (op_array->fn_flags & ZEND_ACC_EARLY_BINDING) {
1135 		ZEND_ASSERT(op_array == &ctx->script->main_op_array);
1136 		ctx->script->first_early_binding_opline =
1137 			zend_build_delayed_early_binding_list(op_array);
1138 	}
1139 
1140 	/* rebuild map (just for printing) */
1141 	memset(cfg->map, -1, sizeof(int) * op_array->last);
1142 	for (n = 0; n < cfg->blocks_count; n++) {
1143 		if (cfg->blocks[n].flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1144 			cfg->map[cfg->blocks[n].start] = n;
1145 		}
1146 	}
1147 }
1148 
get_target_block(const zend_cfg * cfg,zend_basic_block * block,int n,uint32_t * opt_count)1149 static zend_always_inline zend_basic_block *get_target_block(const zend_cfg *cfg, zend_basic_block *block, int n, uint32_t *opt_count)
1150 {
1151 	int b;
1152 	zend_basic_block *target_block = cfg->blocks + block->successors[n];
1153 
1154 	if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1155 		do {
1156 			b = target_block->successors[0];
1157 			target_block = cfg->blocks + b;
1158 		} while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1159 		block->successors[n] = b;
1160 		++(*opt_count);
1161 	}
1162 	return target_block;
1163 }
1164 
get_follow_block(const zend_cfg * cfg,zend_basic_block * block,int n,uint32_t * opt_count)1165 static zend_always_inline zend_basic_block *get_follow_block(const zend_cfg *cfg, zend_basic_block *block, int n, uint32_t *opt_count)
1166 {
1167 	int b;
1168 	zend_basic_block *target_block = cfg->blocks + block->successors[n];
1169 
1170 	if (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED)) {
1171 		do {
1172 			b = target_block->successors[0];
1173 			target_block = cfg->blocks + b;
1174 		} while (target_block->len == 0 && !(target_block->flags & ZEND_BB_PROTECTED));
1175 		block->successors[n] = b;
1176 		++(*opt_count);
1177 	}
1178 	return target_block;
1179 }
1180 
get_next_block(const zend_cfg * cfg,zend_basic_block * block)1181 static zend_always_inline zend_basic_block *get_next_block(const zend_cfg *cfg, zend_basic_block *block)
1182 {
1183 	zend_basic_block *next_block = block + 1;
1184 	zend_basic_block *end = cfg->blocks + cfg->blocks_count;
1185 
1186 	while (1) {
1187 		if (next_block == end) {
1188 			return NULL;
1189 		} else if (next_block->flags & ZEND_BB_REACHABLE) {
1190 			break;
1191 		}
1192 		next_block++;
1193 	}
1194 	while (next_block->len == 0 && !(next_block->flags & ZEND_BB_PROTECTED)) {
1195 		next_block = cfg->blocks + next_block->successors[0];
1196 	}
1197 	return next_block;
1198 }
1199 
1200 
1201 /* we use "jmp_hitlist" to avoid infinity loops during jmp optimization */
in_hitlist(int target,int * jmp_hitlist,int jmp_hitlist_count)1202 static zend_always_inline int in_hitlist(int target, int *jmp_hitlist, int jmp_hitlist_count)
1203 {
1204 	int i;
1205 
1206 	for (i = 0; i < jmp_hitlist_count; i++) {
1207 		if (jmp_hitlist[i] == target) {
1208 			return 1;
1209 		}
1210 	}
1211 	return 0;
1212 }
1213 
1214 #define CHECK_LOOP(target) \
1215 	if (EXPECTED(!in_hitlist(target, jmp_hitlist, jmp_hitlist_count))) { \
1216 		jmp_hitlist[jmp_hitlist_count++] = target;	\
1217 	} else { \
1218 		break; \
1219 	}
1220 
zend_jmp_optimization(zend_basic_block * block,zend_op_array * op_array,const zend_cfg * cfg,int * jmp_hitlist,uint32_t * opt_count)1221 static void zend_jmp_optimization(zend_basic_block *block, zend_op_array *op_array, const zend_cfg *cfg, int *jmp_hitlist, uint32_t *opt_count)
1222 {
1223 	/* last_op is the last opcode of the current block */
1224 	zend_basic_block *target_block, *follow_block, *next_block;
1225 	zend_op *last_op, *target;
1226 	int next, jmp_hitlist_count;
1227 
1228 	if (block->len == 0) {
1229 		return;
1230 	}
1231 
1232 	last_op = op_array->opcodes + block->start + block->len - 1;
1233 	switch (last_op->opcode) {
1234 		case ZEND_JMP:
1235 			jmp_hitlist_count = 0;
1236 
1237 			target_block = get_target_block(cfg, block, 0, opt_count);
1238 			while (target_block->len == 1) {
1239 				target = op_array->opcodes + target_block->start;
1240 				if (target->opcode == ZEND_JMP) {
1241 					/* JMP L, L: JMP L1 -> JMP L1 */
1242 					next = target_block->successors[0];
1243 				} else {
1244 					break;
1245 				}
1246 				CHECK_LOOP(next);
1247 				block->successors[0] = next;
1248 				++(*opt_count);
1249 				target_block = get_target_block(cfg, block, 0, opt_count);
1250 			}
1251 
1252 			next_block = get_next_block(cfg, block);
1253 			if (target_block == next_block) {
1254 				/* JMP(next) -> NOP */
1255 				MAKE_NOP(last_op);
1256 				++(*opt_count);
1257 				block->len--;
1258 			} else if (target_block->len == 1) {
1259 				target = op_array->opcodes + target_block->start;
1260 				if (target->opcode == ZEND_JMPZNZ) {
1261 					/* JMP L, L: JMPZNZ L1,L2 -> JMPZNZ L1,L2 */
1262 					*last_op = *target;
1263 					if (last_op->op1_type == IS_CONST) {
1264 						zval zv;
1265 						ZVAL_COPY(&zv, &ZEND_OP1_LITERAL(last_op));
1266 						last_op->op1.constant = zend_optimizer_add_literal(op_array, &zv);
1267 					}
1268 					block->successors_count = 2;
1269 					block->successors[0] = target_block->successors[0];
1270 					block->successors[1] = target_block->successors[1];
1271 					++(*opt_count);
1272 					goto optimize_jmpznz;
1273 				} else if ((target->opcode == ZEND_RETURN ||
1274 				            target->opcode == ZEND_RETURN_BY_REF ||
1275 				            target->opcode == ZEND_GENERATOR_RETURN ||
1276 				            target->opcode == ZEND_EXIT) &&
1277 				           !(op_array->fn_flags & ZEND_ACC_HAS_FINALLY_BLOCK)) {
1278 					/* JMP L, L: RETURN to immediate RETURN */
1279 					*last_op = *target;
1280 					if (last_op->op1_type == IS_CONST) {
1281 						zval zv;
1282 						ZVAL_COPY(&zv, &ZEND_OP1_LITERAL(last_op));
1283 						last_op->op1.constant = zend_optimizer_add_literal(op_array, &zv);
1284 					}
1285 					block->successors_count = 0;
1286 					++(*opt_count);
1287 				}
1288 			}
1289 			break;
1290 
1291 		case ZEND_JMP_SET:
1292 		case ZEND_COALESCE:
1293 		case ZEND_JMP_NULL:
1294 			jmp_hitlist_count = 0;
1295 
1296 			target_block = get_target_block(cfg, block, 0, opt_count);
1297 			while (target_block->len == 1) {
1298 				target = op_array->opcodes + target_block->start;
1299 
1300 				if (target->opcode == ZEND_JMP) {
1301 					/* JMP_SET(X, L), L: JMP(L2) -> JMP_SET(X, L2) */
1302 					next = target_block->successors[0];
1303 					CHECK_LOOP(next);
1304 					block->successors[0] = next;
1305 					++(*opt_count);
1306 				} else {
1307 					break;
1308 				}
1309 				target_block = get_target_block(cfg, block, 0, opt_count);
1310 			}
1311 			break;
1312 
1313 		case ZEND_JMPZ:
1314 		case ZEND_JMPNZ:
1315 			jmp_hitlist_count = 0;
1316 
1317 			target_block = get_target_block(cfg, block, 0, opt_count);
1318 			while (target_block->len == 1) {
1319 				target = op_array->opcodes + target_block->start;
1320 
1321 				if (target->opcode == ZEND_JMP) {
1322 					/* JMPZ(X, L), L: JMP(L2) -> JMPZ(X, L2) */
1323 					next = target_block->successors[0];
1324 				} else if (target->opcode == last_op->opcode &&
1325 				           SAME_VAR(target->op1, last_op->op1)) {
1326 					/* JMPZ(X, L), L: JMPZ(X, L2) -> JMPZ(X, L2) */
1327 					next = target_block->successors[0];
1328 				} else if (target->opcode == INV_COND(last_op->opcode) &&
1329 				           SAME_VAR(target->op1, last_op->op1)) {
1330 					/* JMPZ(X, L), L: JMPNZ(X, L2) -> JMPZ(X, L+1) */
1331 					next = target_block->successors[1];
1332 				} else if (target->opcode == ZEND_JMPZNZ &&
1333 				           SAME_VAR(target->op1, last_op->op1)) {
1334 					/* JMPZ(X, L), L: JMPZNZ(X, L2, L3) -> JMPZ(X, L2) */
1335 					next = target_block->successors[last_op->opcode == ZEND_JMPNZ];
1336 				} else {
1337 					break;
1338 				}
1339 				CHECK_LOOP(next);
1340 				block->successors[0] = next;
1341 				++(*opt_count);
1342 				target_block = get_target_block(cfg, block, 0, opt_count);
1343 			}
1344 
1345 			follow_block = get_follow_block(cfg, block, 1, opt_count);
1346 			if (target_block == follow_block) {
1347 				/* L: JMP[N]Z(X, L+1) -> NOP or FREE(X) */
1348 				if (last_op->op1_type == IS_CV) {
1349 					last_op->opcode = ZEND_CHECK_VAR;
1350 					last_op->op2.num = 0;
1351 				} else if (last_op->op1_type & (IS_VAR|IS_TMP_VAR)) {
1352 					last_op->opcode = ZEND_FREE;
1353 					last_op->op2.num = 0;
1354 				} else {
1355 					MAKE_NOP(last_op);
1356 					block->len--;
1357 				}
1358 				block->successors_count = 1;
1359 				++(*opt_count);
1360 			} else if (follow_block->len == 1) {
1361 				target = op_array->opcodes + follow_block->start;
1362 				if (target->opcode == ZEND_JMP) {
1363 				    if (block->successors[0] == follow_block->successors[0]) {
1364 						/* JMPZ(X,L1), JMP(L1) -> NOP, JMP(L1) */
1365 						if (last_op->op1_type == IS_CV) {
1366 							last_op->opcode = ZEND_CHECK_VAR;
1367 							last_op->op2.num = 0;
1368 						} else if (last_op->op1_type & (IS_VAR|IS_TMP_VAR)) {
1369 							last_op->opcode = ZEND_FREE;
1370 							last_op->op2.num = 0;
1371 						} else {
1372 							MAKE_NOP(last_op);
1373 							block->len--;
1374 						}
1375 						block->successors[0] = follow_block - cfg->blocks;
1376 						block->successors_count = 1;
1377 						++(*opt_count);
1378 						break;
1379 					} else if (!(follow_block->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED))) {
1380 						next_block = get_next_block(cfg, follow_block);
1381 
1382 						if (target_block == next_block) {
1383 							/* JMPZ(X,L1) JMP(L2) L1: -> JMPNZ(X,L2) NOP*/
1384 
1385 							last_op->opcode = INV_COND(last_op->opcode);
1386 
1387 							block->successors[0] = follow_block->successors[0];
1388 							block->successors[1] = next_block - cfg->blocks;
1389 
1390 							follow_block->flags &= ~ZEND_BB_REACHABLE;
1391 							MAKE_NOP(target);
1392 							follow_block->len = 0;
1393 
1394 							next_block->flags |= ZEND_BB_FOLLOW;
1395 
1396 							break;
1397 						}
1398 					}
1399 
1400 					/* JMPZ(X,L1), JMP(L2) -> JMPZNZ(X,L1,L2) */
1401 					if (last_op->opcode == ZEND_JMPZ) {
1402 						block->successors[1] = follow_block->successors[0];
1403 					} else {
1404 						block->successors[1] = block->successors[0];
1405 						block->successors[0] = follow_block->successors[0];
1406 					}
1407 					last_op->opcode = ZEND_JMPZNZ;
1408 					++(*opt_count);
1409 				}
1410 			}
1411 			break;
1412 
1413 		case ZEND_JMPNZ_EX:
1414 		case ZEND_JMPZ_EX:
1415 			jmp_hitlist_count = 0;
1416 
1417 			target_block = get_target_block(cfg, block, 0, opt_count);
1418 			while (target_block->len == 1) {
1419 				target = op_array->opcodes + target_block->start;
1420 
1421 				if (target->opcode == ZEND_JMP) {
1422 					/* T = JMPZ_EX(X, L), L: JMP(L2) -> T = JMPZ(X, L2) */
1423 					next = target_block->successors[0];
1424 				} else if (target->opcode == last_op->opcode-3 &&
1425 				           (SAME_VAR(target->op1, last_op->result) ||
1426 				            SAME_VAR(target->op1, last_op->op1))) {
1427 					/* T = JMPZ_EX(X, L1), L1: JMPZ({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1428 					next = target_block->successors[0];
1429 				} else if (target->opcode == last_op->opcode &&
1430 				           target->result.var == last_op->result.var &&
1431 				           (SAME_VAR(target->op1, last_op->result) ||
1432 				            SAME_VAR(target->op1, last_op->op1))) {
1433 					/* T = JMPZ_EX(X, L1), L1: T = JMPZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L2) */
1434 					next = target_block->successors[0];
1435 				} else if (target->opcode == ZEND_JMPZNZ &&
1436 				           (SAME_VAR(target->op1, last_op->result) ||
1437 				            SAME_VAR(target->op1, last_op->op1))) {
1438 					/* T = JMPZ_EX(X, L), L: JMPZNZ({X|T}, L2, L3) -> T = JMPZ_EX(X, L2) */
1439 					next = target_block->successors[last_op->opcode == ZEND_JMPNZ_EX];
1440 				} else if (target->opcode == INV_EX_COND(last_op->opcode) &&
1441 				           (SAME_VAR(target->op1, last_op->result) ||
1442 				            SAME_VAR(target->op1, last_op->op1))) {
1443 					/* T = JMPZ_EX(X, L1), L1: JMPNZ({X|T1}, L2) -> T = JMPZ_EX(X, L1+1) */
1444 					next = target_block->successors[1];
1445 				} else if (target->opcode == INV_EX_COND_EX(last_op->opcode) &&
1446 				           target->result.var == last_op->result.var &&
1447 				           (SAME_VAR(target->op1, last_op->result) ||
1448 				            SAME_VAR(target->op1, last_op->op1))) {
1449 					/* T = JMPZ_EX(X, L1), L1: T = JMPNZ_EX({X|T}, L2) -> T = JMPZ_EX(X, L1+1) */
1450 					next = target_block->successors[1];
1451 				} else if (target->opcode == ZEND_BOOL &&
1452 				           (SAME_VAR(target->op1, last_op->result) ||
1453 				            SAME_VAR(target->op1, last_op->op1))) {
1454 					/* convert Y = JMPZ_EX(X,L1), L1: Z = BOOL(Y) to
1455 					   Z = JMPZ_EX(X,L1+1) */
1456 
1457 					/* NOTE: This optimization pattern is not safe, but works, */
1458 					/*       because result of JMPZ_EX instruction             */
1459 					/*       is not used on the following path and             */
1460 					/*       should be used once on the branch path.           */
1461 					/*                                                         */
1462 					/*       The pattern works well only if jums processed in  */
1463 					/*       direct order, otherwise it breaks JMPZ_EX         */
1464 					/*       sequences too early.                              */
1465 					last_op->result.var = target->result.var;
1466 					next = target_block->successors[0];
1467 				} else {
1468 					break;
1469 				}
1470 				CHECK_LOOP(next);
1471 				block->successors[0] = next;
1472 				++(*opt_count);
1473 				target_block = get_target_block(cfg, block, 0, opt_count);
1474 			}
1475 
1476 			follow_block = get_follow_block(cfg, block, 1, opt_count);
1477 			if (target_block == follow_block) {
1478 				/* L: T = JMP[N]Z_EX(X, L+1) -> T = BOOL(X) */
1479 				last_op->opcode = ZEND_BOOL;
1480 				last_op->op2.num = 0;
1481 				block->successors_count = 1;
1482 				++(*opt_count);
1483 				break;
1484 			}
1485 			break;
1486 
1487 		case ZEND_JMPZNZ: {
1488 optimize_jmpznz:
1489 			jmp_hitlist_count = 0;
1490 			target_block = get_target_block(cfg, block, 0, opt_count);
1491 			while (target_block->len == 1) {
1492 				target = op_array->opcodes + target_block->start;
1493 
1494 				if (target->opcode == ZEND_JMP) {
1495 					/* JMPZNZ(X, L1, L2), L1: JMP(L3) -> JMPZNZ(X, L3, L2) */
1496 					next = target_block->successors[0];
1497 				} else if ((target->opcode == ZEND_JMPZ || target->opcode == ZEND_JMPZNZ) &&
1498 				           SAME_VAR(target->op1, last_op->op1)) {
1499 					/* JMPZNZ(X, L1, L2), L1: JMPZ(X, L3) -> JMPZNZ(X, L3, L2) */
1500 					next = target_block->successors[0];
1501 				} else if (target->opcode == ZEND_JMPNZ &&
1502 				           SAME_VAR(target->op1, last_op->op1)) {
1503 					/* JMPZNZ(X, L1, L2), L1: X = JMPNZ(X, L3) -> JMPZNZ(X, L1+1, L2) */
1504 					next = target_block->successors[1];
1505 				} else {
1506 					break;
1507 				}
1508 				CHECK_LOOP(next);
1509 				block->successors[0] = next;
1510 				++(*opt_count);
1511 				target_block = get_target_block(cfg, block, 0, opt_count);
1512 			}
1513 
1514 			jmp_hitlist_count = 0;
1515 			follow_block = get_target_block(cfg, block, 1, opt_count);
1516 			while (follow_block->len == 1) {
1517 				target = op_array->opcodes + follow_block->start;
1518 
1519 				if (target->opcode == ZEND_JMP) {
1520 					/* JMPZNZ(X, L1, L2), L2: JMP(L3) -> JMPZNZ(X, L1, L3) */
1521 					next = follow_block->successors[0];
1522 				} else if (target->opcode == ZEND_JMPNZ &&
1523 				           SAME_VAR(target->op1, last_op->op1)) {
1524 					/* JMPZNZ(X, L1, L2), L2: X = JMPNZ(X, L3) -> JMPZNZ(X, L1, L3) */
1525 					next = follow_block->successors[0];
1526 				} else if ((target->opcode == ZEND_JMPZ || target->opcode == ZEND_JMPZNZ) &&
1527 				           SAME_VAR(target->op1, last_op->op1)) {
1528 					/* JMPZNZ(X, L1, L2), L2: JMPZ(X, L3) -> JMPZNZ(X, L1, L2+1) */
1529 					next = follow_block->successors[1];
1530 				} else {
1531 					break;
1532 				}
1533 				CHECK_LOOP(next);
1534 				block->successors[1] = next;
1535 				++(*opt_count);
1536 				follow_block = get_target_block(cfg, block, 1, opt_count);
1537 			}
1538 
1539 			next_block = get_next_block(cfg, block);
1540 			if (target_block == follow_block &&
1541 			    !(last_op->op1_type & (IS_VAR|IS_TMP_VAR))) {
1542 				/* JMPZNZ(?,L,L) -> JMP(L) */
1543 				last_op->opcode = ZEND_JMP;
1544 				SET_UNUSED(last_op->op1);
1545 				SET_UNUSED(last_op->op2);
1546 				last_op->extended_value = 0;
1547 				block->successors_count = 1;
1548 				++(*opt_count);
1549 			} else if (target_block == next_block) {
1550 				/* jumping to next on Z - can follow to it and jump only on NZ */
1551 				/* JMPZNZ(X,L1,L2) L1: -> JMPNZ(X,L2) */
1552 				int tmp = block->successors[0];
1553 				last_op->opcode = ZEND_JMPNZ;
1554 				block->successors[0] = block->successors[1];
1555 				block->successors[1] = tmp;
1556 				++(*opt_count);
1557 			} else if (follow_block == next_block) {
1558 				/* jumping to next on NZ - can follow to it and jump only on Z */
1559 				/* JMPZNZ(X,L1,L2) L2: -> JMPZ(X,L1) */
1560 				last_op->opcode = ZEND_JMPZ;
1561 				++(*opt_count);
1562 			}
1563 			break;
1564 		}
1565 	}
1566 }
1567 
1568 /* Global data dependencies */
1569 
1570 /* Find a set of variables which are used outside of the block where they are
1571  * defined. We won't apply some optimization patterns for such variables. */
zend_t_usage(zend_cfg * cfg,zend_op_array * op_array,zend_bitset used_ext,zend_optimizer_ctx * ctx)1572 static void zend_t_usage(zend_cfg *cfg, zend_op_array *op_array, zend_bitset used_ext, zend_optimizer_ctx *ctx)
1573 {
1574 	int n;
1575 	zend_basic_block *block, *next_block;
1576 	uint32_t var_num;
1577 	uint32_t bitset_len;
1578 	zend_bitset usage;
1579 	zend_bitset defined_here;
1580 	void *checkpoint;
1581 	zend_op *opline, *end;
1582 
1583 
1584 	if (op_array->T == 0) {
1585 		/* shortcut - if no Ts, nothing to do */
1586 		return;
1587 	}
1588 
1589 	checkpoint = zend_arena_checkpoint(ctx->arena);
1590 	bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1591 	defined_here = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1592 
1593 	zend_bitset_clear(defined_here, bitset_len);
1594 	for (n = 1; n < cfg->blocks_count; n++) {
1595 		block = cfg->blocks + n;
1596 
1597 		if (!(block->flags & ZEND_BB_REACHABLE)) {
1598 			continue;
1599 		}
1600 
1601 		opline = op_array->opcodes + block->start;
1602 		end = opline + block->len;
1603 		if (!(block->flags & ZEND_BB_FOLLOW) ||
1604 		    (block->flags & ZEND_BB_TARGET)) {
1605 			/* Skip continuation of "extended" BB */
1606 			zend_bitset_clear(defined_here, bitset_len);
1607 		}
1608 
1609 		while (opline<end) {
1610 			if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1611 				var_num = VAR_NUM(opline->op1.var);
1612 				if (!zend_bitset_in(defined_here, var_num)) {
1613 					zend_bitset_incl(used_ext, var_num);
1614 				}
1615 			}
1616 			if (opline->op2_type == IS_VAR) {
1617 				var_num = VAR_NUM(opline->op2.var);
1618 				if (opline->opcode == ZEND_FE_FETCH_R ||
1619 				    opline->opcode == ZEND_FE_FETCH_RW) {
1620 					/* these opcode use the op2 as result */
1621 					zend_bitset_incl(defined_here, var_num);
1622 				} else if (!zend_bitset_in(defined_here, var_num)) {
1623 					zend_bitset_incl(used_ext, var_num);
1624 				}
1625 			} else if (opline->op2_type == IS_TMP_VAR) {
1626 				var_num = VAR_NUM(opline->op2.var);
1627 				if (!zend_bitset_in(defined_here, var_num)) {
1628 					zend_bitset_incl(used_ext, var_num);
1629 				}
1630 			}
1631 
1632 			if (opline->result_type == IS_VAR) {
1633 				var_num = VAR_NUM(opline->result.var);
1634 				zend_bitset_incl(defined_here, var_num);
1635 			} else if (opline->result_type == IS_TMP_VAR) {
1636 				var_num = VAR_NUM(opline->result.var);
1637 				switch (opline->opcode) {
1638 					case ZEND_ADD_ARRAY_ELEMENT:
1639 					case ZEND_ADD_ARRAY_UNPACK:
1640 					case ZEND_ROPE_ADD:
1641 						/* these opcodes use the result as argument */
1642 						if (!zend_bitset_in(defined_here, var_num)) {
1643 							zend_bitset_incl(used_ext, var_num);
1644 						}
1645 						break;
1646 					default :
1647 						zend_bitset_incl(defined_here, var_num);
1648 				}
1649 			}
1650 			opline++;
1651 		}
1652 	}
1653 
1654 	if (ctx->debug_level & ZEND_DUMP_BLOCK_PASS_VARS) {
1655 		int printed = 0;
1656 		uint32_t i;
1657 
1658 		for (i = op_array->last_var; i< op_array->T; i++) {
1659 			if (zend_bitset_in(used_ext, i)) {
1660 				if (!printed) {
1661 					fprintf(stderr, "NON-LOCAL-VARS: %d", i);
1662 					printed = 1;
1663 				} else {
1664 					fprintf(stderr, ", %d", i);
1665 				}
1666 			}
1667 		}
1668 		if (printed) {
1669 			fprintf(stderr, "\n");
1670 		}
1671 	}
1672 
1673 	usage = defined_here;
1674 	next_block = NULL;
1675 	for (n = cfg->blocks_count; n > 0;) {
1676 		block = cfg->blocks + (--n);
1677 
1678 		if (!(block->flags & ZEND_BB_REACHABLE) || block->len == 0) {
1679 			continue;
1680 		}
1681 
1682 		end = op_array->opcodes + block->start;
1683 		opline = end + block->len - 1;
1684 		if (!next_block ||
1685 		    !(next_block->flags & ZEND_BB_FOLLOW) ||
1686 		    (next_block->flags & ZEND_BB_TARGET)) {
1687 			/* Skip continuation of "extended" BB */
1688 			zend_bitset_copy(usage, used_ext, bitset_len);
1689 		} else if (block->successors_count > 1) {
1690 			zend_bitset_union(usage, used_ext, bitset_len);
1691 		}
1692 		next_block = block;
1693 
1694 		while (opline >= end) {
1695 			/* usage checks */
1696 			if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
1697 				if (!zend_bitset_in(usage, VAR_NUM(opline->result.var))) {
1698 					switch (opline->opcode) {
1699 						case ZEND_ASSIGN_OP:
1700 						case ZEND_ASSIGN_DIM_OP:
1701 						case ZEND_ASSIGN_OBJ_OP:
1702 						case ZEND_ASSIGN_STATIC_PROP_OP:
1703 						case ZEND_PRE_INC:
1704 						case ZEND_PRE_DEC:
1705 						case ZEND_ASSIGN:
1706 						case ZEND_ASSIGN_REF:
1707 						case ZEND_DO_FCALL:
1708 						case ZEND_DO_ICALL:
1709 						case ZEND_DO_UCALL:
1710 						case ZEND_DO_FCALL_BY_NAME:
1711 							opline->result_type = IS_UNUSED;
1712 							break;
1713 						case ZEND_POST_INC:
1714 						case ZEND_POST_DEC:
1715 						case ZEND_POST_INC_OBJ:
1716 						case ZEND_POST_DEC_OBJ:
1717 						case ZEND_POST_INC_STATIC_PROP:
1718 						case ZEND_POST_DEC_STATIC_PROP:
1719 							opline->opcode -= 2;
1720 							opline->result_type = IS_UNUSED;
1721 							break;
1722 						case ZEND_QM_ASSIGN:
1723 						case ZEND_BOOL:
1724 						case ZEND_BOOL_NOT:
1725 							if (opline->op1_type == IS_CV) {
1726 								opline->opcode = ZEND_CHECK_VAR;
1727 								SET_UNUSED(opline->result);
1728 							} else if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
1729 								opline->opcode = ZEND_FREE;
1730 								SET_UNUSED(opline->result);
1731 							} else {
1732 								if (opline->op1_type == IS_CONST) {
1733 									literal_dtor(&ZEND_OP1_LITERAL(opline));
1734 								}
1735 								MAKE_NOP(opline);
1736 							}
1737 							break;
1738 						case ZEND_JMPZ_EX:
1739 						case ZEND_JMPNZ_EX:
1740 							opline->opcode -= 3;
1741 							SET_UNUSED(opline->result);
1742 							break;
1743 						case ZEND_ADD_ARRAY_ELEMENT:
1744 						case ZEND_ADD_ARRAY_UNPACK:
1745 						case ZEND_ROPE_ADD:
1746 							zend_bitset_incl(usage, VAR_NUM(opline->result.var));
1747 							break;
1748 					}
1749 				} else {
1750 					switch (opline->opcode) {
1751 						case ZEND_ADD_ARRAY_ELEMENT:
1752 						case ZEND_ADD_ARRAY_UNPACK:
1753 						case ZEND_ROPE_ADD:
1754 							break;
1755 						default:
1756 							zend_bitset_excl(usage, VAR_NUM(opline->result.var));
1757 							break;
1758 					}
1759 				}
1760 			}
1761 
1762 			if (opline->op2_type == IS_VAR) {
1763 				switch (opline->opcode) {
1764 					case ZEND_FE_FETCH_R:
1765 					case ZEND_FE_FETCH_RW:
1766 						zend_bitset_excl(usage, VAR_NUM(opline->op2.var));
1767 						break;
1768 					default:
1769 						zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1770 						break;
1771 				}
1772 			} else if (opline->op2_type == IS_TMP_VAR) {
1773 				zend_bitset_incl(usage, VAR_NUM(opline->op2.var));
1774 			}
1775 
1776 			if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
1777 				zend_bitset_incl(usage, VAR_NUM(opline->op1.var));
1778 			}
1779 
1780 			opline--;
1781 		}
1782 	}
1783 
1784 	zend_arena_release(&ctx->arena, checkpoint);
1785 }
1786 
zend_merge_blocks(zend_op_array * op_array,zend_cfg * cfg,uint32_t * opt_count)1787 static void zend_merge_blocks(zend_op_array *op_array, zend_cfg *cfg, uint32_t *opt_count)
1788 {
1789 	int i;
1790 	zend_basic_block *b, *bb;
1791 	zend_basic_block *prev = NULL;
1792 
1793 	for (i = 0; i < cfg->blocks_count; i++) {
1794 		b = cfg->blocks + i;
1795 		if (b->flags & ZEND_BB_REACHABLE) {
1796 			if ((b->flags & ZEND_BB_FOLLOW) &&
1797 			    !(b->flags & (ZEND_BB_TARGET | ZEND_BB_PROTECTED)) &&
1798 			    prev && prev->successors_count == 1 && prev->successors[0] == i)
1799 			{
1800 				zend_op *last_op = op_array->opcodes + prev->start + prev->len - 1;
1801 				if (prev->len != 0 && last_op->opcode == ZEND_JMP) {
1802 					MAKE_NOP(last_op);
1803 				}
1804 
1805 				for (bb = prev + 1; bb != b; bb++) {
1806 					zend_op *op = op_array->opcodes + bb->start;
1807 					zend_op *end = op + bb->len;
1808 					while (op < end) {
1809 						if (op->op1_type == IS_CONST) {
1810 							literal_dtor(&ZEND_OP1_LITERAL(op));
1811 						}
1812 						if (op->op2_type == IS_CONST) {
1813 							literal_dtor(&ZEND_OP2_LITERAL(op));
1814 						}
1815 						MAKE_NOP(op);
1816 						op++;
1817 					}
1818 					/* make block empty */
1819 					bb->len = 0;
1820 				}
1821 
1822 				/* re-link */
1823 				prev->flags |= (b->flags & ZEND_BB_EXIT);
1824 				prev->len = b->start + b->len - prev->start;
1825 				prev->successors_count = b->successors_count;
1826 				if (b->successors != b->successors_storage) {
1827 					prev->successors = b->successors;
1828 					b->successors = b->successors_storage;
1829 				} else {
1830 					memcpy(prev->successors, b->successors, b->successors_count * sizeof(int));
1831 				}
1832 
1833 				/* unlink & make block empty and unreachable */
1834 				b->flags = 0;
1835 				b->len = 0;
1836 				b->successors_count = 0;
1837 				++(*opt_count);
1838 			} else {
1839 				prev = b;
1840 			}
1841 		}
1842 	}
1843 }
1844 
1845 #define PASSES 3
1846 
zend_optimize_cfg(zend_op_array * op_array,zend_optimizer_ctx * ctx)1847 void zend_optimize_cfg(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1848 {
1849 	zend_cfg cfg;
1850 	zend_basic_block *blocks, *end, *b;
1851 	int pass;
1852 	uint32_t bitset_len;
1853 	zend_bitset usage;
1854 	void *checkpoint;
1855 	zend_op **Tsource;
1856 	uint32_t opt_count;
1857 	int *jmp_hitlist;
1858 
1859     /* Build CFG */
1860 	checkpoint = zend_arena_checkpoint(ctx->arena);
1861 	if (zend_build_cfg(&ctx->arena, op_array, 0, &cfg) != SUCCESS) {
1862 		zend_arena_release(&ctx->arena, checkpoint);
1863 		return;
1864 	}
1865 
1866 	if (cfg.blocks_count * (op_array->last_var + op_array->T) > 64 * 1024 * 1024) {
1867 		zend_arena_release(&ctx->arena, checkpoint);
1868 		return;
1869 	}
1870 
1871 	if (ctx->debug_level & ZEND_DUMP_BEFORE_BLOCK_PASS) {
1872 		zend_dump_op_array(op_array, ZEND_DUMP_CFG, "before block pass", &cfg);
1873 	}
1874 
1875 	bitset_len = zend_bitset_len(op_array->last_var + op_array->T);
1876 	Tsource = zend_arena_calloc(&ctx->arena, op_array->last_var + op_array->T, sizeof(zend_op *));
1877 	usage = zend_arena_alloc(&ctx->arena, bitset_len * ZEND_BITSET_ELM_SIZE);
1878 	jmp_hitlist = zend_arena_alloc(&ctx->arena, cfg.blocks_count * sizeof(int));
1879 
1880 	blocks = cfg.blocks;
1881 	end = blocks + cfg.blocks_count;
1882 	for (pass = 0; pass < PASSES; pass++) {
1883 		opt_count = 0;
1884 
1885 		/* Compute data dependencies */
1886 		zend_bitset_clear(usage, bitset_len);
1887 		zend_t_usage(&cfg, op_array, usage, ctx);
1888 
1889 		/* optimize each basic block separately */
1890 		for (b = blocks; b < end; b++) {
1891 			if (!(b->flags & ZEND_BB_REACHABLE)) {
1892 				continue;
1893 			}
1894 			/* we track data dependencies only inside a single basic block */
1895 			if (!(b->flags & ZEND_BB_FOLLOW) ||
1896 			    (b->flags & ZEND_BB_TARGET)) {
1897 				/* Skip continuation of "extended" BB */
1898 				memset(Tsource, 0, (op_array->last_var + op_array->T) * sizeof(zend_op *));
1899 			}
1900 			zend_optimize_block(b, op_array, usage, &cfg, Tsource, &opt_count);
1901 		}
1902 
1903 		/* Eliminate NOPs */
1904 		for (b = blocks; b < end; b++) {
1905 			if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
1906 				strip_nops(op_array, b);
1907 			}
1908 		}
1909 
1910 		opt_count = 0;
1911 
1912 		/* Jump optimization for each block */
1913 		for (b = blocks; b < end; b++) {
1914 			if (b->flags & ZEND_BB_REACHABLE) {
1915 				zend_jmp_optimization(b, op_array, &cfg, jmp_hitlist, &opt_count);
1916 			}
1917 		}
1918 
1919 		/* Eliminate unreachable basic blocks */
1920 		zend_cfg_remark_reachable_blocks(op_array, &cfg);
1921 
1922 		/* Merge Blocks */
1923 		zend_merge_blocks(op_array, &cfg, &opt_count);
1924 
1925 		if (opt_count == 0) {
1926 			break;
1927 		}
1928 	}
1929 
1930 	assemble_code_blocks(&cfg, op_array, ctx);
1931 
1932 	if (ctx->debug_level & ZEND_DUMP_AFTER_BLOCK_PASS) {
1933 		zend_dump_op_array(op_array, ZEND_DUMP_CFG | ZEND_DUMP_HIDE_UNREACHABLE, "after block pass", &cfg);
1934 	}
1935 
1936 	/* Destroy CFG */
1937 	zend_arena_release(&ctx->arena, checkpoint);
1938 }
1939