1 /*
2 +----------------------------------------------------------------------+
3 | Zend Engine, e-SSA based Type & Range Inference |
4 +----------------------------------------------------------------------+
5 | Copyright (c) The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | https://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@php.net> |
16 +----------------------------------------------------------------------+
17 */
18
19 #include "zend_compile.h"
20 #include "zend_generators.h"
21 #include "zend_inference.h"
22 #include "zend_func_info.h"
23 #include "zend_call_graph.h"
24 #include "zend_closures.h"
25 #include "zend_worklist.h"
26 #include "zend_optimizer_internal.h"
27
28 /* The used range inference algorithm is described in:
29 * V. Campos, R. Rodrigues, I. de Assis Costa and F. Pereira.
30 * "Speed and Precision in Range Analysis", SBLP'12.
31 *
32 * There are a couple degrees of freedom, we use:
33 * * Propagation on SCCs.
34 * * e-SSA for live range splitting.
35 * * Only intra-procedural inference.
36 * * Widening with warmup passes, but without jump sets.
37 */
38
39 /* Whether to handle symbolic range constraints */
40 #define SYM_RANGE
41
42 /* Whether to handle negative range constraints */
43 /* Negative range inference is buggy, so disabled for now */
44 #undef NEG_RANGE
45
46 /* Number of warmup passes to use prior to widening */
47 #define RANGE_WARMUP_PASSES 16
48
49 /* Logging for range inference in general */
50 #if 0
51 #define LOG_SSA_RANGE(...) fprintf(stderr, __VA_ARGS__)
52 #else
53 #define LOG_SSA_RANGE(...)
54 #endif
55
56 /* Logging for negative range constraints */
57 #if 0
58 #define LOG_NEG_RANGE(...) fprintf(stderr, __VA_ARGS__)
59 #else
60 #define LOG_NEG_RANGE(...)
61 #endif
62
63 /* Pop elements in unspecified order from worklist until it is empty */
64 #define WHILE_WORKLIST(worklist, len, i) do { \
65 bool _done = 0; \
66 while (!_done) { \
67 _done = 1; \
68 ZEND_BITSET_FOREACH(worklist, len, i) { \
69 zend_bitset_excl(worklist, i); \
70 _done = 0;
71
72 #define WHILE_WORKLIST_END() \
73 } ZEND_BITSET_FOREACH_END(); \
74 } \
75 } while (0)
76
77 #define CHECK_SCC_VAR(var2) \
78 do { \
79 if (!ssa->vars[var2].no_val) { \
80 if (ssa->vars[var2].scc < 0) { \
81 zend_ssa_check_scc_var(op_array, ssa, var2, index, stack); \
82 } \
83 if (ssa->vars[var2].scc < ssa->vars[var].scc) { \
84 ssa->vars[var].scc = ssa->vars[var2].scc; \
85 is_root = 0; \
86 } \
87 } \
88 } while (0)
89
90 #define CHECK_SCC_ENTRY(var2) \
91 do { \
92 if (ssa->vars[var2].scc != ssa->vars[var].scc) { \
93 ssa->vars[var2].scc_entry = 1; \
94 } \
95 } while (0)
96
97 #define ADD_SCC_VAR(_var) \
98 do { \
99 if (ssa->vars[_var].scc == scc && \
100 !(ssa->var_info[_var].type & MAY_BE_REF)) { \
101 zend_bitset_incl(worklist, _var); \
102 } \
103 } while (0)
104
105 #define ADD_SCC_VAR_1(_var) \
106 do { \
107 if (ssa->vars[_var].scc == scc && \
108 !(ssa->var_info[_var].type & MAY_BE_REF) && \
109 !zend_bitset_in(visited, _var)) { \
110 zend_bitset_incl(worklist, _var); \
111 } \
112 } while (0)
113
114 #define FOR_EACH_DEFINED_VAR(line, MACRO) \
115 do { \
116 if (ssa->ops[line].op1_def >= 0) { \
117 MACRO(ssa->ops[line].op1_def); \
118 } \
119 if (ssa->ops[line].op2_def >= 0) { \
120 MACRO(ssa->ops[line].op2_def); \
121 } \
122 if (ssa->ops[line].result_def >= 0) { \
123 MACRO(ssa->ops[line].result_def); \
124 } \
125 if (op_array->opcodes[line].opcode == ZEND_OP_DATA) { \
126 if (ssa->ops[line-1].op1_def >= 0) { \
127 MACRO(ssa->ops[line-1].op1_def); \
128 } \
129 if (ssa->ops[line-1].op2_def >= 0) { \
130 MACRO(ssa->ops[line-1].op2_def); \
131 } \
132 if (ssa->ops[line-1].result_def >= 0) { \
133 MACRO(ssa->ops[line-1].result_def); \
134 } \
135 } else if ((uint32_t)line+1 < op_array->last && \
136 op_array->opcodes[line+1].opcode == ZEND_OP_DATA) { \
137 if (ssa->ops[line+1].op1_def >= 0) { \
138 MACRO(ssa->ops[line+1].op1_def); \
139 } \
140 if (ssa->ops[line+1].op2_def >= 0) { \
141 MACRO(ssa->ops[line+1].op2_def); \
142 } \
143 if (ssa->ops[line+1].result_def >= 0) { \
144 MACRO(ssa->ops[line+1].result_def); \
145 } \
146 } \
147 } while (0)
148
149
150 #define FOR_EACH_VAR_USAGE(_var, MACRO) \
151 do { \
152 zend_ssa_phi *p = ssa->vars[_var].phi_use_chain; \
153 int use = ssa->vars[_var].use_chain; \
154 while (use >= 0) { \
155 FOR_EACH_DEFINED_VAR(use, MACRO); \
156 use = zend_ssa_next_use(ssa->ops, _var, use); \
157 } \
158 p = ssa->vars[_var].phi_use_chain; \
159 while (p) { \
160 MACRO(p->ssa_var); \
161 p = zend_ssa_next_use_phi(ssa, _var, p); \
162 } \
163 } while (0)
164
add_will_overflow(zend_long a,zend_long b)165 static inline bool add_will_overflow(zend_long a, zend_long b) {
166 return (b > 0 && a > ZEND_LONG_MAX - b)
167 || (b < 0 && a < ZEND_LONG_MIN - b);
168 }
169 #if 0
170 static inline bool sub_will_overflow(zend_long a, zend_long b) {
171 return (b > 0 && a < ZEND_LONG_MIN + b)
172 || (b < 0 && a > ZEND_LONG_MAX + b);
173 }
174 #endif
175
176 #if 0
177 /* Recursive Pearce's SCC algorithm implementation */
178 static void zend_ssa_check_scc_var(const zend_op_array *op_array, zend_ssa *ssa, int var, int *index, zend_worklist_stack *stack) /* {{{ */
179 {
180 int is_root = 1;
181 #ifdef SYM_RANGE
182 zend_ssa_phi *p;
183 #endif
184
185 ssa->vars[var].scc = *index;
186 (*index)++;
187
188 FOR_EACH_VAR_USAGE(var, CHECK_SCC_VAR);
189
190 #ifdef SYM_RANGE
191 /* Process symbolic control-flow constraints */
192 p = ssa->vars[var].sym_use_chain;
193 while (p) {
194 CHECK_SCC_VAR(p->ssa_var);
195 p = p->sym_use_chain;
196 }
197 #endif
198
199 if (is_root) {
200 ssa->sccs--;
201 while (stack->len > 0) {
202 int var2 = zend_worklist_stack_peek(stack);
203 if (ssa->vars[var2].scc < ssa->vars[var].scc) {
204 break;
205 }
206 zend_worklist_stack_pop(stack);
207 ssa->vars[var2].scc = ssa->sccs;
208 (*index)--;
209 }
210 ssa->vars[var].scc = ssa->sccs;
211 ssa->vars[var].scc_entry = 1;
212 (*index)--;
213 } else {
214 zend_worklist_stack_push(stack, var);
215 }
216 }
217 /* }}} */
218
219 ZEND_API void zend_ssa_find_sccs(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
220 {
221 int index = 0;
222 zend_worklist_stack stack;
223 int j;
224 ALLOCA_FLAG(stack_use_heap)
225
226 ZEND_WORKLIST_STACK_ALLOCA(&stack, ssa->vars_count, stack_use_heap);
227
228 /* Find SCCs using Pearce's algorithm. */
229 ssa->sccs = ssa->vars_count;
230 for (j = 0; j < ssa->vars_count; j++) {
231 if (!ssa->vars[j].no_val && ssa->vars[j].scc < 0) {
232 zend_ssa_check_scc_var(op_array, ssa, j, &index, &stack);
233 }
234 }
235
236 if (ssa->sccs) {
237 /* Shift SCC indexes. */
238 for (j = 0; j < ssa->vars_count; j++) {
239 if (ssa->vars[j].scc >= 0) {
240 ssa->vars[j].scc -= ssa->sccs;
241 }
242 }
243 }
244 ssa->sccs = ssa->vars_count - ssa->sccs;
245
246 for (j = 0; j < ssa->vars_count; j++) {
247 if (ssa->vars[j].scc >= 0) {
248 int var = j;
249 FOR_EACH_VAR_USAGE(var, CHECK_SCC_ENTRY);
250 }
251 }
252
253 ZEND_WORKLIST_STACK_FREE_ALLOCA(&stack, stack_use_heap);
254 }
255 /* }}} */
256
257 #else
258 /* Iterative Pearce's SCC algorithm implementation */
259
260 typedef struct _zend_scc_iterator {
261 int state;
262 int last;
263 union {
264 int use;
265 zend_ssa_phi *phi;
266 };
267 } zend_scc_iterator;
268
zend_scc_next(const zend_op_array * op_array,zend_ssa * ssa,int var,zend_scc_iterator * iterator)269 static int zend_scc_next(const zend_op_array *op_array, zend_ssa *ssa, int var, zend_scc_iterator *iterator) /* {{{ */
270 {
271 zend_ssa_phi *phi;
272 int use, var2;
273
274 switch (iterator->state) {
275 case 0: goto state_0;
276 case 1: use = iterator->use; goto state_1;
277 case 2: use = iterator->use; goto state_2;
278 case 3: use = iterator->use; goto state_3;
279 case 4: use = iterator->use; goto state_4;
280 case 5: use = iterator->use; goto state_5;
281 case 6: use = iterator->use; goto state_6;
282 case 7: use = iterator->use; goto state_7;
283 case 8: use = iterator->use; goto state_8;
284 case 9: phi = iterator->phi; goto state_9;
285 #ifdef SYM_RANGE
286 case 10: phi = iterator->phi; goto state_10;
287 #endif
288 case 11: goto state_11;
289 }
290
291 state_0:
292 use = ssa->vars[var].use_chain;
293 while (use >= 0) {
294 iterator->use = use;
295 var2 = ssa->ops[use].op1_def;
296 if (var2 >= 0 && !ssa->vars[var2].no_val) {
297 iterator->state = 1;
298 return var2;
299 }
300 state_1:
301 var2 = ssa->ops[use].op2_def;
302 if (var2 >= 0 && !ssa->vars[var2].no_val) {
303 iterator->state = 2;
304 return var2;
305 }
306 state_2:
307 var2 = ssa->ops[use].result_def;
308 if (var2 >= 0 && !ssa->vars[var2].no_val) {
309 iterator->state = 3;
310 return var2;
311 }
312 state_3:
313 if (op_array->opcodes[use].opcode == ZEND_OP_DATA) {
314 var2 = ssa->ops[use-1].op1_def;
315 if (var2 >= 0 && !ssa->vars[var2].no_val) {
316 iterator->state = 4;
317 return var2;
318 }
319 state_4:
320 var2 = ssa->ops[use-1].op2_def;
321 if (var2 >= 0 && !ssa->vars[var2].no_val) {
322 iterator->state = 5;
323 return var2;
324 }
325 state_5:
326 var2 = ssa->ops[use-1].result_def;
327 if (var2 >= 0 && !ssa->vars[var2].no_val) {
328 iterator->state = 8;
329 return var2;
330 }
331 } else if ((uint32_t)use+1 < op_array->last &&
332 op_array->opcodes[use+1].opcode == ZEND_OP_DATA) {
333 var2 = ssa->ops[use+1].op1_def;
334 if (var2 >= 0 && !ssa->vars[var2].no_val) {
335 iterator->state = 6;
336 return var2;
337 }
338 state_6:
339 var2 = ssa->ops[use+1].op2_def;
340 if (var2 >= 0 && !ssa->vars[var2].no_val) {
341 iterator->state = 7;
342 return var2;
343 }
344 state_7:
345 var2 = ssa->ops[use+1].result_def;
346 if (var2 >= 0 && !ssa->vars[var2].no_val) {
347 iterator->state = 8;
348 return var2;
349 }
350 }
351 state_8:
352 use = zend_ssa_next_use(ssa->ops, var, use);
353 }
354
355 phi = ssa->vars[var].phi_use_chain;
356 while (phi) {
357 var2 = phi->ssa_var;
358 if (!ssa->vars[var2].no_val) {
359 iterator->state = 9;
360 iterator->phi = phi;
361 return var2;
362 }
363 state_9:
364 phi = zend_ssa_next_use_phi(ssa, var, phi);
365 }
366
367 #ifdef SYM_RANGE
368 /* Process symbolic control-flow constraints */
369 phi = ssa->vars[var].sym_use_chain;
370 while (phi) {
371 var2 = phi->ssa_var;
372 if (!ssa->vars[var2].no_val) {
373 iterator->state = 10;
374 iterator->phi = phi;
375 return var2;
376 }
377 state_10:
378 phi = phi->sym_use_chain;
379 }
380 #endif
381
382 iterator->state = 11;
383 state_11:
384 return -1;
385 }
386 /* }}} */
387
zend_ssa_check_scc_var(const zend_op_array * op_array,zend_ssa * ssa,int var,int * index,zend_worklist_stack * stack,zend_worklist_stack * vstack,zend_scc_iterator * iterators)388 static void zend_ssa_check_scc_var(const zend_op_array *op_array, zend_ssa *ssa, int var, int *index, zend_worklist_stack *stack, zend_worklist_stack *vstack, zend_scc_iterator *iterators) /* {{{ */
389 {
390 restart:
391 zend_worklist_stack_push(vstack, var);
392 iterators[var].state = 0;
393 iterators[var].last = -1;
394 ssa->vars[var].scc_entry = 1;
395 ssa->vars[var].scc = *index;
396 (*index)++;
397
398 while (vstack->len > 0) {
399 var = zend_worklist_stack_peek(vstack);
400 while (1) {
401 int var2;
402
403 if (iterators[var].last >= 0) {
404 /* finish edge */
405 var2 = iterators[var].last;
406 if (ssa->vars[var2].scc < ssa->vars[var].scc) {
407 ssa->vars[var].scc = ssa->vars[var2].scc;
408 ssa->vars[var].scc_entry = 0;
409 }
410 }
411 var2 = zend_scc_next(op_array, ssa, var, iterators + var);
412 iterators[var].last = var2;
413 if (var2 < 0) break;
414 /* begin edge */
415 if (ssa->vars[var2].scc < 0) {
416 var = var2;
417 goto restart;
418 }
419 }
420
421 /* finish visiting */
422 zend_worklist_stack_pop(vstack);
423 if (ssa->vars[var].scc_entry) {
424 ssa->sccs--;
425 while (stack->len > 0) {
426 int var2 = zend_worklist_stack_peek(stack);
427 if (ssa->vars[var2].scc < ssa->vars[var].scc) {
428 break;
429 }
430 zend_worklist_stack_pop(stack);
431 ssa->vars[var2].scc = ssa->sccs;
432 (*index)--;
433 }
434 ssa->vars[var].scc = ssa->sccs;
435 (*index)--;
436 } else {
437 zend_worklist_stack_push(stack, var);
438 }
439 }
440 }
441 /* }}} */
442
zend_ssa_find_sccs(const zend_op_array * op_array,zend_ssa * ssa)443 ZEND_API void zend_ssa_find_sccs(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
444 {
445 int index = 0;
446 zend_worklist_stack stack, vstack;
447 zend_scc_iterator *iterators;
448 int j;
449 ALLOCA_FLAG(stack_use_heap)
450 ALLOCA_FLAG(vstack_use_heap)
451 ALLOCA_FLAG(iterators_use_heap)
452
453 iterators = do_alloca(sizeof(zend_scc_iterator) * ssa->vars_count, iterators_use_heap);
454 ZEND_WORKLIST_STACK_ALLOCA(&vstack, ssa->vars_count, vstack_use_heap);
455 ZEND_WORKLIST_STACK_ALLOCA(&stack, ssa->vars_count, stack_use_heap);
456
457 /* Find SCCs using Pearce's algorithm. */
458 ssa->sccs = ssa->vars_count;
459 for (j = 0; j < ssa->vars_count; j++) {
460 if (!ssa->vars[j].no_val && ssa->vars[j].scc < 0) {
461 zend_ssa_check_scc_var(op_array, ssa, j, &index, &stack, &vstack, iterators);
462 }
463 }
464
465 if (ssa->sccs) {
466 /* Shift SCC indexes. */
467 for (j = 0; j < ssa->vars_count; j++) {
468 if (ssa->vars[j].scc >= 0) {
469 ssa->vars[j].scc -= ssa->sccs;
470 }
471 }
472 }
473 ssa->sccs = ssa->vars_count - ssa->sccs;
474
475 for (j = 0; j < ssa->vars_count; j++) {
476 if (ssa->vars[j].scc >= 0) {
477 int var = j;
478 FOR_EACH_VAR_USAGE(var, CHECK_SCC_ENTRY);
479 }
480 }
481
482 ZEND_WORKLIST_STACK_FREE_ALLOCA(&stack, stack_use_heap);
483 ZEND_WORKLIST_STACK_FREE_ALLOCA(&vstack, vstack_use_heap);
484 free_alloca(iterators, iterators_use_heap);
485 }
486 /* }}} */
487
488 #endif
489
zend_ssa_find_false_dependencies(const zend_op_array * op_array,zend_ssa * ssa)490 ZEND_API void zend_ssa_find_false_dependencies(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
491 {
492 zend_ssa_var *ssa_vars = ssa->vars;
493 zend_ssa_op *ssa_ops = ssa->ops;
494 int ssa_vars_count = ssa->vars_count;
495 zend_bitset worklist;
496 int i, j, use;
497 zend_ssa_phi *p;
498 ALLOCA_FLAG(use_heap);
499
500 if (!op_array->function_name || !ssa->vars || !ssa->ops) {
501 return;
502 }
503
504 worklist = do_alloca(sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count), use_heap);
505 memset(worklist, 0, sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count));
506
507 for (i = 0; i < ssa_vars_count; i++) {
508 ssa_vars[i].no_val = 1; /* mark as unused */
509 use = ssa->vars[i].use_chain;
510 while (use >= 0) {
511 if (!zend_ssa_is_no_val_use(&op_array->opcodes[use], &ssa->ops[use], i)) {
512 ssa_vars[i].no_val = 0; /* used directly */
513 zend_bitset_incl(worklist, i);
514 break;
515 }
516 use = zend_ssa_next_use(ssa_ops, i, use);
517 }
518 }
519
520 WHILE_WORKLIST(worklist, zend_bitset_len(ssa_vars_count), i) {
521 if (ssa_vars[i].definition_phi) {
522 /* mark all possible sources as used */
523 p = ssa_vars[i].definition_phi;
524 if (p->pi >= 0) {
525 if (ssa_vars[p->sources[0]].no_val) {
526 ssa_vars[p->sources[0]].no_val = 0; /* used indirectly */
527 zend_bitset_incl(worklist, p->sources[0]);
528 }
529 } else {
530 for (j = 0; j < ssa->cfg.blocks[p->block].predecessors_count; j++) {
531 ZEND_ASSERT(p->sources[j] >= 0);
532 if (ssa->vars[p->sources[j]].no_val) {
533 ssa_vars[p->sources[j]].no_val = 0; /* used indirectly */
534 zend_bitset_incl(worklist, p->sources[j]);
535 }
536 }
537 }
538 }
539 } WHILE_WORKLIST_END();
540
541 free_alloca(worklist, use_heap);
542 }
543 /* }}} */
544
545 /* From "Hacker's Delight" */
minOR(zend_ulong a,zend_ulong b,zend_ulong c,zend_ulong d)546 zend_ulong minOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
547 {
548 zend_ulong m, temp;
549
550 m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
551 while (m != 0) {
552 if (~a & c & m) {
553 temp = (a | m) & -m;
554 if (temp <= b) {
555 a = temp;
556 break;
557 }
558 } else if (a & ~c & m) {
559 temp = (c | m) & -m;
560 if (temp <= d) {
561 c = temp;
562 break;
563 }
564 }
565 m = m >> 1;
566 }
567 return a | c;
568 }
569
maxOR(zend_ulong a,zend_ulong b,zend_ulong c,zend_ulong d)570 zend_ulong maxOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
571 {
572 zend_ulong m, temp;
573
574 m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
575 while (m != 0) {
576 if (b & d & m) {
577 temp = (b - m) | (m - 1);
578 if (temp >= a) {
579 b = temp;
580 break;
581 }
582 temp = (d - m) | (m - 1);
583 if (temp >= c) {
584 d = temp;
585 break;
586 }
587 }
588 m = m >> 1;
589 }
590 return b | d;
591 }
592
minAND(zend_ulong a,zend_ulong b,zend_ulong c,zend_ulong d)593 zend_ulong minAND(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
594 {
595 zend_ulong m, temp;
596
597 m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
598 while (m != 0) {
599 if (~a & ~c & m) {
600 temp = (a | m) & -m;
601 if (temp <= b) {
602 a = temp;
603 break;
604 }
605 temp = (c | m) & -m;
606 if (temp <= d) {
607 c = temp;
608 break;
609 }
610 }
611 m = m >> 1;
612 }
613 return a & c;
614 }
615
maxAND(zend_ulong a,zend_ulong b,zend_ulong c,zend_ulong d)616 zend_ulong maxAND(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
617 {
618 zend_ulong m, temp;
619
620 m = Z_UL(1) << (sizeof(zend_ulong) * 8 - 1);
621 while (m != 0) {
622 if (b & ~d & m) {
623 temp = (b | ~m) | (m - 1);
624 if (temp >= a) {
625 b = temp;
626 break;
627 }
628 } else if (~b & d & m) {
629 temp = (d | ~m) | (m - 1);
630 if (temp >= c) {
631 d = temp;
632 break;
633 }
634 }
635 m = m >> 1;
636 }
637 return b & d;
638 }
639
minXOR(zend_ulong a,zend_ulong b,zend_ulong c,zend_ulong d)640 zend_ulong minXOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
641 {
642 return minAND(a, b, ~d, ~c) | minAND(~b, ~a, c, d);
643 }
644
maxXOR(zend_ulong a,zend_ulong b,zend_ulong c,zend_ulong d)645 zend_ulong maxXOR(zend_ulong a, zend_ulong b, zend_ulong c, zend_ulong d)
646 {
647 return maxOR(0, maxAND(a, b, ~d, ~c), 0, maxAND(~b, ~a, c, d));
648 }
649
650 /* Based on "Hacker's Delight" */
651
652 /*
653 0: + + + + 0 0 0 0 => 0 0 + min/max
654 2: + + - + 0 0 1 0 => 1 0 ? min(a,b,c,-1)/max(a,b,0,d)
655 3: + + - - 0 0 1 1 => 1 1 - min/max
656 8: - + + + 1 0 0 0 => 1 0 ? min(a,-1,b,d)/max(0,b,c,d)
657 a: - + - + 1 0 1 0 => 1 0 ? MIN(a,c)/max(0,b,0,d)
658 b: - + - - 1 0 1 1 => 1 1 - c/-1
659 c: - - + + 1 1 0 0 => 1 1 - min/max
660 e: - - - + 1 1 1 0 => 1 1 - a/-1
661 f - - - - 1 1 1 1 => 1 1 - min/max
662 */
zend_ssa_range_or(zend_long a,zend_long b,zend_long c,zend_long d,zend_ssa_range * tmp)663 static void zend_ssa_range_or(zend_long a, zend_long b, zend_long c, zend_long d, zend_ssa_range *tmp)
664 {
665 int x = ((a < 0) ? 8 : 0) |
666 ((b < 0) ? 4 : 0) |
667 ((c < 0) ? 2 : 0) |
668 ((d < 0) ? 1 : 0);
669 switch (x) {
670 case 0x0:
671 case 0x3:
672 case 0xc:
673 case 0xf:
674 tmp->min = minOR(a, b, c, d);
675 tmp->max = maxOR(a, b, c, d);
676 break;
677 case 0x2:
678 tmp->min = minOR(a, b, c, -1);
679 tmp->max = maxOR(a, b, 0, d);
680 break;
681 case 0x8:
682 tmp->min = minOR(a, -1, c, d);
683 tmp->max = maxOR(0, b, c, d);
684 break;
685 case 0xa:
686 tmp->min = MIN(a, c);
687 tmp->max = maxOR(0, b, 0, d);
688 break;
689 case 0xb:
690 tmp->min = c;
691 tmp->max = -1;
692 break;
693 case 0xe:
694 tmp->min = a;
695 tmp->max = -1;
696 break;
697 }
698 }
699
700 /*
701 0: + + + + 0 0 0 0 => 0 0 + min/max
702 2: + + - + 0 0 1 0 => 0 0 + 0/b
703 3: + + - - 0 0 1 1 => 0 0 + min/max
704 8: - + + + 1 0 0 0 => 0 0 + 0/d
705 a: - + - + 1 0 1 0 => 1 0 ? min(a,-1,c,-1)/NAX(b,d)
706 b: - + - - 1 0 1 1 => 1 0 ? min(a,-1,c,d)/max(0,b,c,d)
707 c: - - + + 1 1 0 0 => 1 1 - min/max
708 e: - - - + 1 1 1 0 => 1 0 ? min(a,b,c,-1)/max(a,b,0,d)
709 f - - - - 1 1 1 1 => 1 1 - min/max
710 */
zend_ssa_range_and(zend_long a,zend_long b,zend_long c,zend_long d,zend_ssa_range * tmp)711 static void zend_ssa_range_and(zend_long a, zend_long b, zend_long c, zend_long d, zend_ssa_range *tmp)
712 {
713 int x = ((a < 0) ? 8 : 0) |
714 ((b < 0) ? 4 : 0) |
715 ((c < 0) ? 2 : 0) |
716 ((d < 0) ? 1 : 0);
717 switch (x) {
718 case 0x0:
719 case 0x3:
720 case 0xc:
721 case 0xf:
722 tmp->min = minAND(a, b, c, d);
723 tmp->max = maxAND(a, b, c, d);
724 break;
725 case 0x2:
726 tmp->min = 0;
727 tmp->max = b;
728 break;
729 case 0x8:
730 tmp->min = 0;
731 tmp->max = d;
732 break;
733 case 0xa:
734 tmp->min = minAND(a, -1, c, -1);
735 tmp->max = MAX(b, d);
736 break;
737 case 0xb:
738 tmp->min = minAND(a, -1, c, d);
739 tmp->max = maxAND(0, b, c, d);
740 break;
741 case 0xe:
742 tmp->min = minAND(a, b, c, -1);
743 tmp->max = maxAND(a, b, 0, d);
744 break;
745 }
746 }
747
zend_abs_range(zend_long min,zend_long max,zend_long * abs_min,zend_long * abs_max)748 static inline bool zend_abs_range(
749 zend_long min, zend_long max, zend_long *abs_min, zend_long *abs_max) {
750 if (min == ZEND_LONG_MIN) {
751 /* Cannot take absolute value of LONG_MIN */
752 return 0;
753 }
754
755 if (min >= 0) {
756 *abs_min = min;
757 *abs_max = max;
758 } else if (max <= 0) {
759 *abs_min = -max;
760 *abs_max = -min;
761 } else {
762 /* Range crossing zero */
763 *abs_min = 0;
764 *abs_max = MAX(max, -min);
765 }
766
767 return 1;
768 }
769
safe_shift_left(zend_long n,zend_long s)770 static inline zend_long safe_shift_left(zend_long n, zend_long s) {
771 return (zend_long) ((zend_ulong) n << (zend_ulong) s);
772 }
773
shift_left_overflows(zend_long n,zend_long s)774 static inline bool shift_left_overflows(zend_long n, zend_long s) {
775 /* This considers shifts that shift in the sign bit to be overflowing as well */
776 if (n >= 0) {
777 return s >= SIZEOF_ZEND_LONG * 8 - 1 || safe_shift_left(n, s) < n;
778 } else {
779 return s >= SIZEOF_ZEND_LONG * 8 || safe_shift_left(n, s) > n;
780 }
781 }
782
783 /* If b does not divide a exactly, return the two adjacent values between which the real result
784 * lies. */
float_div(zend_long a,zend_long b,zend_long * r1,zend_long * r2)785 static void float_div(zend_long a, zend_long b, zend_long *r1, zend_long *r2) {
786 *r1 = *r2 = a / b;
787 if (a % b != 0) {
788 if (*r2 < 0) {
789 (*r2)--;
790 } else {
791 (*r2)++;
792 }
793 }
794 }
795
zend_inference_calc_binary_op_range(const zend_op_array * op_array,zend_ssa * ssa,zend_op * opline,zend_ssa_op * ssa_op,zend_uchar opcode,zend_ssa_range * tmp)796 static bool zend_inference_calc_binary_op_range(
797 const zend_op_array *op_array, zend_ssa *ssa,
798 zend_op *opline, zend_ssa_op *ssa_op, zend_uchar opcode, zend_ssa_range *tmp) {
799 zend_long op1_min, op2_min, op1_max, op2_max, t1, t2, t3, t4;
800
801 switch (opcode) {
802 case ZEND_ADD:
803 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
804 op1_min = OP1_MIN_RANGE();
805 op2_min = OP2_MIN_RANGE();
806 op1_max = OP1_MAX_RANGE();
807 op2_max = OP2_MAX_RANGE();
808 if (OP1_RANGE_UNDERFLOW() ||
809 OP2_RANGE_UNDERFLOW() ||
810 zend_add_will_overflow(op1_min, op2_min)) {
811 tmp->underflow = 1;
812 tmp->min = ZEND_LONG_MIN;
813 } else {
814 tmp->min = op1_min + op2_min;
815 }
816 if (OP1_RANGE_OVERFLOW() ||
817 OP2_RANGE_OVERFLOW() ||
818 zend_add_will_overflow(op1_max, op2_max)) {
819 tmp->overflow = 1;
820 tmp->max = ZEND_LONG_MAX;
821 } else {
822 tmp->max = op1_max + op2_max;
823 }
824 return 1;
825 }
826 break;
827 case ZEND_SUB:
828 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
829 op1_min = OP1_MIN_RANGE();
830 op2_min = OP2_MIN_RANGE();
831 op1_max = OP1_MAX_RANGE();
832 op2_max = OP2_MAX_RANGE();
833 if (OP1_RANGE_UNDERFLOW() ||
834 OP2_RANGE_OVERFLOW() ||
835 zend_sub_will_overflow(op1_min, op2_max)) {
836 tmp->underflow = 1;
837 tmp->min = ZEND_LONG_MIN;
838 } else {
839 tmp->min = op1_min - op2_max;
840 }
841 if (OP1_RANGE_OVERFLOW() ||
842 OP2_RANGE_UNDERFLOW() ||
843 zend_sub_will_overflow(op1_max, op2_min)) {
844 tmp->overflow = 1;
845 tmp->max = ZEND_LONG_MAX;
846 } else {
847 tmp->max = op1_max - op2_min;
848 }
849 return 1;
850 }
851 break;
852 case ZEND_MUL:
853 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
854 double dummy;
855 zend_long t1_overflow, t2_overflow, t3_overflow, t4_overflow;
856 op1_min = OP1_MIN_RANGE();
857 op2_min = OP2_MIN_RANGE();
858 op1_max = OP1_MAX_RANGE();
859 op2_max = OP2_MAX_RANGE();
860 /* Suppress uninit variable warnings, these will only be used if the overflow
861 * flags are all false. */
862 t1 = t2 = t3 = t4 = 0;
863 ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_min, t1, dummy, t1_overflow);
864 ZEND_SIGNED_MULTIPLY_LONG(op1_min, op2_max, t2, dummy, t2_overflow);
865 ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_min, t3, dummy, t3_overflow);
866 ZEND_SIGNED_MULTIPLY_LONG(op1_max, op2_max, t4, dummy, t4_overflow);
867 (void) dummy;
868
869 // FIXME: more careful overflow checks?
870 if (OP1_RANGE_UNDERFLOW() || OP2_RANGE_UNDERFLOW() ||
871 OP1_RANGE_OVERFLOW() || OP2_RANGE_OVERFLOW() ||
872 t1_overflow || t2_overflow || t3_overflow || t4_overflow
873 ) {
874 tmp->underflow = 1;
875 tmp->overflow = 1;
876 tmp->min = ZEND_LONG_MIN;
877 tmp->max = ZEND_LONG_MAX;
878 } else {
879 tmp->min = MIN(MIN(t1, t2), MIN(t3, t4));
880 tmp->max = MAX(MAX(t1, t2), MAX(t3, t4));
881 }
882 return 1;
883 }
884 break;
885 case ZEND_DIV:
886 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
887 op1_min = OP1_MIN_RANGE();
888 op2_min = OP2_MIN_RANGE();
889 op1_max = OP1_MAX_RANGE();
890 op2_max = OP2_MAX_RANGE();
891
892 /* If op2 crosses zero, then floating point values close to zero might be
893 * possible, which will result in arbitrarily large results (overflow). Also
894 * avoid dividing LONG_MIN by -1, which is UB. */
895 if (OP1_RANGE_UNDERFLOW() || OP2_RANGE_UNDERFLOW() ||
896 OP1_RANGE_OVERFLOW() || OP2_RANGE_OVERFLOW() ||
897 (op2_min <= 0 && op2_max >= 0) ||
898 (op1_min == ZEND_LONG_MIN && op2_max == -1)
899 ) {
900 tmp->underflow = 1;
901 tmp->overflow = 1;
902 tmp->min = ZEND_LONG_MIN;
903 tmp->max = ZEND_LONG_MAX;
904 } else {
905 zend_long t1_, t2_, t3_, t4_;
906 float_div(op1_min, op2_min, &t1, &t1_);
907 float_div(op1_min, op2_max, &t2, &t2_);
908 float_div(op1_max, op2_min, &t3, &t3_);
909 float_div(op1_max, op2_max, &t4, &t4_);
910
911 tmp->min = MIN(MIN(MIN(t1, t2), MIN(t3, t4)), MIN(MIN(t1_, t2_), MIN(t3_, t4_)));
912 tmp->max = MAX(MAX(MAX(t1, t2), MAX(t3, t4)), MAX(MAX(t1_, t2_), MAX(t3_, t4_)));
913 }
914 return 1;
915 }
916 break;
917 case ZEND_MOD:
918 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
919 if (OP1_RANGE_UNDERFLOW() ||
920 OP2_RANGE_UNDERFLOW() ||
921 OP1_RANGE_OVERFLOW() ||
922 OP2_RANGE_OVERFLOW()) {
923 tmp->min = ZEND_LONG_MIN;
924 tmp->max = ZEND_LONG_MAX;
925 } else {
926 zend_long op2_abs_min, op2_abs_max;
927
928 op1_min = OP1_MIN_RANGE();
929 op2_min = OP2_MIN_RANGE();
930 op1_max = OP1_MAX_RANGE();
931 op2_max = OP2_MAX_RANGE();
932 if (!zend_abs_range(op2_min, op2_max, &op2_abs_min, &op2_abs_max)) {
933 break;
934 }
935
936 if (op2_abs_max == 0) {
937 /* Always modulus by zero, nothing we can do */
938 break;
939 }
940 if (op2_abs_min == 0) {
941 /* Ignore the modulus by zero case, which will throw */
942 op2_abs_min++;
943 }
944
945 if (op1_min >= 0) {
946 tmp->min = op1_max < op2_abs_min ? op1_min : 0;
947 tmp->max = MIN(op1_max, op2_abs_max - 1);
948 } else if (op1_max <= 0) {
949 tmp->min = MAX(op1_min, -op2_abs_max + 1);
950 tmp->max = op1_min > -op2_abs_min ? op1_max : 0;
951 } else {
952 tmp->min = MAX(op1_min, -op2_abs_max + 1);
953 tmp->max = MIN(op1_max, op2_abs_max - 1);
954 }
955 }
956 return 1;
957 }
958 break;
959 case ZEND_SL:
960 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
961 if (OP1_RANGE_UNDERFLOW() ||
962 OP2_RANGE_UNDERFLOW() ||
963 OP1_RANGE_OVERFLOW() ||
964 OP2_RANGE_OVERFLOW()) {
965 tmp->min = ZEND_LONG_MIN;
966 tmp->max = ZEND_LONG_MAX;
967 } else {
968 op1_min = OP1_MIN_RANGE();
969 op2_min = OP2_MIN_RANGE();
970 op1_max = OP1_MAX_RANGE();
971 op2_max = OP2_MAX_RANGE();
972
973 /* Shifts by negative numbers will throw, ignore them */
974 if (op2_min < 0) {
975 op2_min = 0;
976 }
977 if (op2_max < 0) {
978 op2_max = 0;
979 }
980
981 if (shift_left_overflows(op1_min, op2_max)
982 || shift_left_overflows(op1_max, op2_max)) {
983 tmp->min = ZEND_LONG_MIN;
984 tmp->max = ZEND_LONG_MAX;
985 } else {
986 t1 = safe_shift_left(op1_min, op2_min);
987 t2 = safe_shift_left(op1_min, op2_max);
988 t3 = safe_shift_left(op1_max, op2_min);
989 t4 = safe_shift_left(op1_max, op2_max);
990 tmp->min = MIN(MIN(t1, t2), MIN(t3, t4));
991 tmp->max = MAX(MAX(t1, t2), MAX(t3, t4));
992 }
993 }
994 return 1;
995 }
996 break;
997 case ZEND_SR:
998 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
999 if (OP1_RANGE_UNDERFLOW() ||
1000 OP2_RANGE_UNDERFLOW() ||
1001 OP1_RANGE_OVERFLOW() ||
1002 OP2_RANGE_OVERFLOW()) {
1003 tmp->min = ZEND_LONG_MIN;
1004 tmp->max = ZEND_LONG_MAX;
1005 } else {
1006 op1_min = OP1_MIN_RANGE();
1007 op2_min = OP2_MIN_RANGE();
1008 op1_max = OP1_MAX_RANGE();
1009 op2_max = OP2_MAX_RANGE();
1010
1011 /* Shifts by negative numbers will throw, ignore them */
1012 if (op2_min < 0) {
1013 op2_min = 0;
1014 }
1015 if (op2_max < 0) {
1016 op2_max = 0;
1017 }
1018
1019 /* Shifts by more than the integer size will be 0 or -1 */
1020 if (op2_min >= SIZEOF_ZEND_LONG * 8) {
1021 op2_min = SIZEOF_ZEND_LONG * 8 - 1;
1022 }
1023 if (op2_max >= SIZEOF_ZEND_LONG * 8) {
1024 op2_max = SIZEOF_ZEND_LONG * 8 - 1;
1025 }
1026
1027 t1 = op1_min >> op2_min;
1028 t2 = op1_min >> op2_max;
1029 t3 = op1_max >> op2_min;
1030 t4 = op1_max >> op2_max;
1031 tmp->min = MIN(MIN(t1, t2), MIN(t3, t4));
1032 tmp->max = MAX(MAX(t1, t2), MAX(t3, t4));
1033 }
1034 return 1;
1035 }
1036 break;
1037 case ZEND_BW_OR:
1038 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
1039 if (OP1_RANGE_UNDERFLOW() ||
1040 OP2_RANGE_UNDERFLOW() ||
1041 OP1_RANGE_OVERFLOW() ||
1042 OP2_RANGE_OVERFLOW()) {
1043 tmp->min = ZEND_LONG_MIN;
1044 tmp->max = ZEND_LONG_MAX;
1045 } else {
1046 op1_min = OP1_MIN_RANGE();
1047 op2_min = OP2_MIN_RANGE();
1048 op1_max = OP1_MAX_RANGE();
1049 op2_max = OP2_MAX_RANGE();
1050 zend_ssa_range_or(op1_min, op1_max, op2_min, op2_max, tmp);
1051 }
1052 return 1;
1053 }
1054 break;
1055 case ZEND_BW_AND:
1056 if (OP1_HAS_RANGE() && OP2_HAS_RANGE()) {
1057 if (OP1_RANGE_UNDERFLOW() ||
1058 OP2_RANGE_UNDERFLOW() ||
1059 OP1_RANGE_OVERFLOW() ||
1060 OP2_RANGE_OVERFLOW()) {
1061 tmp->min = ZEND_LONG_MIN;
1062 tmp->max = ZEND_LONG_MAX;
1063 } else {
1064 op1_min = OP1_MIN_RANGE();
1065 op2_min = OP2_MIN_RANGE();
1066 op1_max = OP1_MAX_RANGE();
1067 op2_max = OP2_MAX_RANGE();
1068 zend_ssa_range_and(op1_min, op1_max, op2_min, op2_max, tmp);
1069 }
1070 return 1;
1071 }
1072 break;
1073 case ZEND_BW_XOR:
1074 // TODO
1075 break;
1076 EMPTY_SWITCH_DEFAULT_CASE()
1077 }
1078 return 0;
1079 }
1080
zend_inference_calc_range(const zend_op_array * op_array,zend_ssa * ssa,int var,int widening,int narrowing,zend_ssa_range * tmp)1081 static bool zend_inference_calc_range(const zend_op_array *op_array, zend_ssa *ssa, int var, int widening, int narrowing, zend_ssa_range *tmp)
1082 {
1083 uint32_t line;
1084 zend_op *opline;
1085 zend_ssa_op *ssa_op;
1086
1087 if (ssa->vars[var].definition_phi) {
1088 zend_ssa_phi *p = ssa->vars[var].definition_phi;
1089 int i;
1090
1091 tmp->underflow = 0;
1092 tmp->min = ZEND_LONG_MAX;
1093 tmp->max = ZEND_LONG_MIN;
1094 tmp->overflow = 0;
1095 if (p->pi >= 0 && p->has_range_constraint) {
1096 zend_ssa_range_constraint *constraint = &p->constraint.range;
1097 if (constraint->negative) {
1098 int src1 = p->sources[0];
1099
1100 if (ssa->var_info[src1].has_range) {
1101 *tmp = ssa->var_info[src1].range;
1102 if (constraint->range.min == constraint->range.max
1103 && !constraint->range.underflow
1104 && !constraint->range.overflow
1105 && p->constraint.range.min_ssa_var < 0
1106 && p->constraint.range.max_ssa_var < 0
1107 && ssa->vars[src1].definition >= 0) {
1108 /* Check for constrained induction variable */
1109 line = ssa->vars[src1].definition;
1110 opline = op_array->opcodes + line;
1111 switch (opline->opcode) {
1112 case ZEND_PRE_DEC:
1113 case ZEND_POST_DEC:
1114 if (!tmp->underflow) {
1115 zend_ssa_phi *p = ssa->vars[ssa->ops[line].op1_use].definition_phi;
1116
1117 if (p && p->pi < 0
1118 && ssa->cfg.blocks[p->block].predecessors_count == 2
1119 && p->sources[1] == var
1120 && ssa->var_info[p->sources[0]].has_range
1121 && ssa->var_info[p->sources[0]].range.min > constraint->range.max) {
1122 tmp->min = constraint->range.max + 1;
1123 }
1124 }
1125 break;
1126 case ZEND_PRE_INC:
1127 case ZEND_POST_INC:
1128 if (!tmp->overflow) {
1129 zend_ssa_phi *p = ssa->vars[ssa->ops[line].op1_use].definition_phi;
1130
1131 if (p && p->pi < 0
1132 && ssa->cfg.blocks[p->block].predecessors_count == 2
1133 && p->sources[1] == var
1134 && ssa->var_info[p->sources[0]].has_range
1135 && ssa->var_info[p->sources[0]].range.max < constraint->range.min) {
1136 tmp->max = constraint->range.min - 1;
1137 }
1138 }
1139 break;
1140 }
1141 }
1142 } else if (narrowing) {
1143 tmp->underflow = 1;
1144 tmp->min = ZEND_LONG_MIN;
1145 tmp->max = ZEND_LONG_MAX;
1146 tmp->overflow = 1;
1147 }
1148
1149 #ifdef NEG_RANGE
1150 if (constraint->min_ssa_var < 0 &&
1151 constraint->max_ssa_var < 0 &&
1152 ssa->var_info[p->ssa_var].has_range) {
1153 LOG_NEG_RANGE("%s() #%d [%ld..%ld] -> [%ld..%ld]?\n",
1154 ZSTR_VAL(op_array->function_name),
1155 p->ssa_var,
1156 ssa->var_info[p->ssa_var].range.min,
1157 ssa->var_info[p->ssa_var].range.max,
1158 tmp->min,
1159 tmp->max);
1160 if (constraint->negative == NEG_USE_LT &&
1161 tmp->max >= constraint->range.min) {
1162 tmp->overflow = 0;
1163 tmp->max = constraint->range.min - 1;
1164 LOG_NEG_RANGE(" => [%ld..%ld]\n", tmp->min, tmp->max);
1165 } else if (constraint->negative == NEG_USE_GT &&
1166 tmp->min <= constraint->range.max) {
1167 tmp->underflow = 0;
1168 tmp->min = constraint->range.max + 1;
1169 LOG_NEG_RANGE(" => [%ld..%ld]\n", tmp->min, tmp->max);
1170 }
1171 }
1172 #endif
1173 } else if (ssa->var_info[p->sources[0]].has_range) {
1174 /* intersection */
1175 *tmp = ssa->var_info[p->sources[0]].range;
1176 if (constraint->min_ssa_var < 0) {
1177 tmp->underflow = constraint->range.underflow && tmp->underflow;
1178 tmp->min = MAX(constraint->range.min, tmp->min);
1179 #ifdef SYM_RANGE
1180 } else if (narrowing && ssa->var_info[constraint->min_ssa_var].has_range) {
1181 tmp->underflow = ssa->var_info[constraint->min_ssa_var].range.underflow && tmp->underflow;
1182 if (!add_will_overflow(ssa->var_info[constraint->min_ssa_var].range.min, constraint->range.min)) {
1183 tmp->min = MAX(ssa->var_info[constraint->min_ssa_var].range.min + constraint->range.min, tmp->min);
1184 }
1185 #endif
1186 }
1187 if (constraint->max_ssa_var < 0) {
1188 tmp->max = MIN(constraint->range.max, tmp->max);
1189 tmp->overflow = constraint->range.overflow && tmp->overflow;
1190 #ifdef SYM_RANGE
1191 } else if (narrowing && ssa->var_info[constraint->max_ssa_var].has_range) {
1192 if (!add_will_overflow(ssa->var_info[constraint->max_ssa_var].range.max, constraint->range.max)) {
1193 tmp->max = MIN(ssa->var_info[constraint->max_ssa_var].range.max + constraint->range.max, tmp->max);
1194 }
1195 tmp->overflow = ssa->var_info[constraint->max_ssa_var].range.overflow && tmp->overflow;
1196 #endif
1197 }
1198 } else if (narrowing) {
1199 if (constraint->min_ssa_var < 0) {
1200 tmp->underflow = constraint->range.underflow;
1201 tmp->min = constraint->range.min;
1202 #ifdef SYM_RANGE
1203 } else if (narrowing && ssa->var_info[constraint->min_ssa_var].has_range) {
1204 if (add_will_overflow(ssa->var_info[constraint->min_ssa_var].range.min, constraint->range.min)) {
1205 tmp->underflow = 1;
1206 tmp->min = ZEND_LONG_MIN;
1207 } else {
1208 tmp->underflow = ssa->var_info[constraint->min_ssa_var].range.underflow;
1209 tmp->min = ssa->var_info[constraint->min_ssa_var].range.min + constraint->range.min;
1210 }
1211 #endif
1212 } else {
1213 tmp->underflow = 1;
1214 tmp->min = ZEND_LONG_MIN;
1215 }
1216 if (constraint->max_ssa_var < 0) {
1217 tmp->max = constraint->range.max;
1218 tmp->overflow = constraint->range.overflow;
1219 #ifdef SYM_RANGE
1220 } else if (narrowing && ssa->var_info[constraint->max_ssa_var].has_range) {
1221 if (add_will_overflow(ssa->var_info[constraint->max_ssa_var].range.max, constraint->range.max)) {
1222 tmp->overflow = 1;
1223 tmp->max = ZEND_LONG_MAX;
1224 } else {
1225 tmp->max = ssa->var_info[constraint->max_ssa_var].range.max + constraint->range.max;
1226 tmp->overflow = ssa->var_info[constraint->max_ssa_var].range.overflow;
1227 }
1228 #endif
1229 } else {
1230 tmp->max = ZEND_LONG_MAX;
1231 tmp->overflow = 1;
1232 }
1233 }
1234 } else {
1235 for (i = 0; i < ssa->cfg.blocks[p->block].predecessors_count; i++) {
1236 ZEND_ASSERT(p->sources[i] >= 0);
1237 if (ssa->var_info[p->sources[i]].has_range) {
1238 /* union */
1239 tmp->underflow |= ssa->var_info[p->sources[i]].range.underflow;
1240 tmp->min = MIN(tmp->min, ssa->var_info[p->sources[i]].range.min);
1241 tmp->max = MAX(tmp->max, ssa->var_info[p->sources[i]].range.max);
1242 tmp->overflow |= ssa->var_info[p->sources[i]].range.overflow;
1243 } else if (narrowing) {
1244 tmp->underflow = 1;
1245 tmp->min = ZEND_LONG_MIN;
1246 tmp->max = ZEND_LONG_MAX;
1247 tmp->overflow = 1;
1248 }
1249 }
1250 }
1251 return (tmp->min <= tmp->max);
1252 } else if (ssa->vars[var].definition < 0) {
1253 return 0;
1254 }
1255 line = ssa->vars[var].definition;
1256 opline = op_array->opcodes + line;
1257 ssa_op = &ssa->ops[line];
1258
1259 return zend_inference_propagate_range(op_array, ssa, opline, ssa_op, var, tmp);
1260 }
1261
zend_inference_propagate_range(const zend_op_array * op_array,zend_ssa * ssa,zend_op * opline,zend_ssa_op * ssa_op,int var,zend_ssa_range * tmp)1262 ZEND_API bool zend_inference_propagate_range(const zend_op_array *op_array, zend_ssa *ssa, zend_op *opline, zend_ssa_op* ssa_op, int var, zend_ssa_range *tmp)
1263 {
1264 tmp->underflow = 0;
1265 tmp->overflow = 0;
1266 switch (opline->opcode) {
1267 case ZEND_ADD:
1268 case ZEND_SUB:
1269 case ZEND_MUL:
1270 case ZEND_DIV:
1271 case ZEND_MOD:
1272 case ZEND_SL:
1273 case ZEND_SR:
1274 case ZEND_BW_OR:
1275 case ZEND_BW_AND:
1276 case ZEND_BW_XOR:
1277 if (ssa_op->result_def == var) {
1278 return zend_inference_calc_binary_op_range(
1279 op_array, ssa, opline, ssa_op, opline->opcode, tmp);
1280 }
1281 break;
1282
1283 case ZEND_BW_NOT:
1284 if (ssa_op->result_def == var) {
1285 if (OP1_HAS_RANGE()) {
1286 if (OP1_RANGE_UNDERFLOW() ||
1287 OP1_RANGE_OVERFLOW()) {
1288 tmp->min = ZEND_LONG_MIN;
1289 tmp->max = ZEND_LONG_MAX;
1290 } else {
1291 zend_long op1_min = OP1_MIN_RANGE();
1292 zend_long op1_max = OP1_MAX_RANGE();
1293 tmp->min = ~op1_max;
1294 tmp->max = ~op1_min;
1295 }
1296 return 1;
1297 }
1298 }
1299 break;
1300 case ZEND_CAST:
1301 if (ssa_op->op1_def == var) {
1302 if (ssa_op->op1_def >= 0) {
1303 if (OP1_HAS_RANGE()) {
1304 tmp->underflow = OP1_RANGE_UNDERFLOW();
1305 tmp->min = OP1_MIN_RANGE();
1306 tmp->max = OP1_MAX_RANGE();
1307 tmp->overflow = OP1_RANGE_OVERFLOW();
1308 return 1;
1309 }
1310 }
1311 } else if (ssa_op->result_def == var) {
1312 if (opline->extended_value == IS_LONG) {
1313 if (OP1_HAS_RANGE()) {
1314 tmp->min = OP1_MIN_RANGE();
1315 tmp->max = OP1_MAX_RANGE();
1316 return 1;
1317 } else {
1318 tmp->min = ZEND_LONG_MIN;
1319 tmp->max = ZEND_LONG_MAX;
1320 return 1;
1321 }
1322 }
1323 }
1324 break;
1325 case ZEND_QM_ASSIGN:
1326 case ZEND_JMP_SET:
1327 case ZEND_COALESCE:
1328 case ZEND_COPY_TMP:
1329 if (ssa_op->op1_def == var) {
1330 if (ssa_op->op1_def >= 0) {
1331 if (OP1_HAS_RANGE()) {
1332 tmp->underflow = OP1_RANGE_UNDERFLOW();
1333 tmp->min = OP1_MIN_RANGE();
1334 tmp->max = OP1_MAX_RANGE();
1335 tmp->overflow = OP1_RANGE_OVERFLOW();
1336 return 1;
1337 }
1338 }
1339 }
1340 if (ssa_op->result_def == var) {
1341 if (OP1_HAS_RANGE()) {
1342 tmp->min = OP1_MIN_RANGE();
1343 tmp->max = OP1_MAX_RANGE();
1344 tmp->underflow = OP1_RANGE_UNDERFLOW();
1345 tmp->overflow = OP1_RANGE_OVERFLOW();
1346 return 1;
1347 }
1348 }
1349 break;
1350 case ZEND_SEND_VAR:
1351 if (ssa_op->op1_def == var) {
1352 if (ssa_op->op1_def >= 0) {
1353 if (OP1_HAS_RANGE()) {
1354 tmp->underflow = OP1_RANGE_UNDERFLOW();
1355 tmp->min = OP1_MIN_RANGE();
1356 tmp->max = OP1_MAX_RANGE();
1357 tmp->overflow = OP1_RANGE_OVERFLOW();
1358 return 1;
1359 }
1360 }
1361 }
1362 break;
1363 case ZEND_PRE_INC:
1364 if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1365 if (OP1_HAS_RANGE()) {
1366 tmp->min = OP1_MIN_RANGE();
1367 tmp->max = OP1_MAX_RANGE();
1368 tmp->underflow = OP1_RANGE_UNDERFLOW();
1369 tmp->overflow = OP1_RANGE_OVERFLOW();
1370 if (tmp->max < ZEND_LONG_MAX) {
1371 tmp->max++;
1372 } else {
1373 tmp->overflow = 1;
1374 }
1375 if (tmp->min < ZEND_LONG_MAX && !tmp->underflow) {
1376 tmp->min++;
1377 }
1378 return 1;
1379 }
1380 }
1381 break;
1382 case ZEND_PRE_DEC:
1383 if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1384 if (OP1_HAS_RANGE()) {
1385 tmp->min = OP1_MIN_RANGE();
1386 tmp->max = OP1_MAX_RANGE();
1387 tmp->underflow = OP1_RANGE_UNDERFLOW();
1388 tmp->overflow = OP1_RANGE_OVERFLOW();
1389 if (tmp->min > ZEND_LONG_MIN) {
1390 tmp->min--;
1391 } else {
1392 tmp->underflow = 1;
1393 }
1394 if (tmp->max > ZEND_LONG_MIN && !tmp->overflow) {
1395 tmp->max--;
1396 }
1397 return 1;
1398 }
1399 }
1400 break;
1401 case ZEND_POST_INC:
1402 if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1403 if (OP1_HAS_RANGE()) {
1404 tmp->min = OP1_MIN_RANGE();
1405 tmp->max = OP1_MAX_RANGE();
1406 tmp->underflow = OP1_RANGE_UNDERFLOW();
1407 tmp->overflow = OP1_RANGE_OVERFLOW();
1408 if (ssa_op->result_def == var) {
1409 return 1;
1410 }
1411 if (tmp->max < ZEND_LONG_MAX) {
1412 tmp->max++;
1413 } else {
1414 tmp->overflow = 1;
1415 }
1416 if (tmp->min < ZEND_LONG_MAX && !tmp->underflow) {
1417 tmp->min++;
1418 }
1419 return 1;
1420 }
1421 }
1422 break;
1423 case ZEND_POST_DEC:
1424 if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1425 if (OP1_HAS_RANGE()) {
1426 tmp->min = OP1_MIN_RANGE();
1427 tmp->max = OP1_MAX_RANGE();
1428 tmp->underflow = OP1_RANGE_UNDERFLOW();
1429 tmp->overflow = OP1_RANGE_OVERFLOW();
1430 if (ssa_op->result_def == var) {
1431 return 1;
1432 }
1433 if (tmp->min > ZEND_LONG_MIN) {
1434 tmp->min--;
1435 } else {
1436 tmp->underflow = 1;
1437 }
1438 if (tmp->max > ZEND_LONG_MIN && !tmp->overflow) {
1439 tmp->max--;
1440 }
1441 return 1;
1442 }
1443 }
1444 break;
1445 case ZEND_UNSET_DIM:
1446 case ZEND_UNSET_OBJ:
1447 if (ssa_op->op1_def == var) {
1448 /* If op1 is scalar, UNSET_DIM and UNSET_OBJ have no effect, so we can keep
1449 * the previous ranges. */
1450 if (OP1_HAS_RANGE()) {
1451 tmp->min = OP1_MIN_RANGE();
1452 tmp->max = OP1_MAX_RANGE();
1453 tmp->underflow = OP1_RANGE_UNDERFLOW();
1454 tmp->overflow = OP1_RANGE_OVERFLOW();
1455 return 1;
1456 }
1457 }
1458 break;
1459 case ZEND_ASSIGN:
1460 if (ssa_op->op1_def == var || ssa_op->op2_def == var || ssa_op->result_def == var) {
1461 if (OP2_HAS_RANGE()) {
1462 tmp->min = OP2_MIN_RANGE();
1463 tmp->max = OP2_MAX_RANGE();
1464 tmp->underflow = OP2_RANGE_UNDERFLOW();
1465 tmp->overflow = OP2_RANGE_OVERFLOW();
1466 return 1;
1467 }
1468 }
1469 break;
1470 case ZEND_ASSIGN_DIM:
1471 case ZEND_ASSIGN_OBJ:
1472 case ZEND_ASSIGN_STATIC_PROP:
1473 case ZEND_ASSIGN_DIM_OP:
1474 case ZEND_ASSIGN_OBJ_OP:
1475 case ZEND_ASSIGN_STATIC_PROP_OP:
1476 if ((ssa_op+1)->op1_def == var) {
1477 opline++;
1478 ssa_op++;
1479 if (OP1_HAS_RANGE()) {
1480 tmp->min = OP1_MIN_RANGE();
1481 tmp->max = OP1_MAX_RANGE();
1482 tmp->underflow = OP1_RANGE_UNDERFLOW();
1483 tmp->overflow = OP1_RANGE_OVERFLOW();
1484 }
1485 return 1;
1486 }
1487 break;
1488 case ZEND_ASSIGN_OP:
1489 if (opline->extended_value != ZEND_CONCAT
1490 && opline->extended_value != ZEND_POW) {
1491 if (ssa_op->op1_def == var || ssa_op->result_def == var) {
1492 return zend_inference_calc_binary_op_range(
1493 op_array, ssa, opline, ssa_op,
1494 opline->extended_value, tmp);
1495 }
1496 }
1497 break;
1498 case ZEND_OP_DATA:
1499 if (ssa_op->op1_def == var) {
1500 if ((opline-1)->opcode == ZEND_ASSIGN_DIM ||
1501 (opline-1)->opcode == ZEND_ASSIGN_OBJ ||
1502 (opline-1)->opcode == ZEND_ASSIGN_STATIC_PROP ||
1503 (opline-1)->opcode == ZEND_ASSIGN_DIM_OP ||
1504 (opline-1)->opcode == ZEND_ASSIGN_OBJ_OP ||
1505 (opline-1)->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
1506 if (OP1_HAS_RANGE()) {
1507 tmp->min = OP1_MIN_RANGE();
1508 tmp->max = OP1_MAX_RANGE();
1509 tmp->underflow = OP1_RANGE_UNDERFLOW();
1510 tmp->overflow = OP1_RANGE_OVERFLOW();
1511 return 1;
1512 }
1513 }
1514 break;
1515 }
1516 break;
1517 case ZEND_RECV:
1518 case ZEND_RECV_INIT:
1519 if (ssa_op->result_def == var) {
1520 if (op_array->arg_info &&
1521 opline->op1.num <= op_array->num_args) {
1522 zend_type type = op_array->arg_info[opline->op1.num-1].type;
1523 uint32_t mask = ZEND_TYPE_PURE_MASK_WITHOUT_NULL(type);
1524 if (mask == MAY_BE_LONG) {
1525 tmp->underflow = 0;
1526 tmp->min = ZEND_LONG_MIN;
1527 tmp->max = ZEND_LONG_MAX;
1528 tmp->overflow = 0;
1529 return 1;
1530 }
1531 }
1532 }
1533 break;
1534 case ZEND_STRLEN:
1535 if (ssa_op->result_def == var) {
1536 #if SIZEOF_ZEND_LONG == 4
1537 /* The length of a string is a non-negative integer. However, on 32-bit
1538 * platforms overflows into negative lengths may occur, so it's better
1539 * to not assume any particular range. */
1540 tmp->min = ZEND_LONG_MIN;
1541 #else
1542 tmp->min = 0;
1543 #endif
1544 tmp->max = ZEND_LONG_MAX;
1545 return 1;
1546 }
1547 break;
1548 case ZEND_FUNC_NUM_ARGS:
1549 tmp->min = 0;
1550 tmp->max = ZEND_LONG_MAX;
1551 return 1;
1552 case ZEND_COUNT:
1553 /* count() on Countable objects may return negative numbers */
1554 tmp->min = ZEND_LONG_MIN;
1555 tmp->max = ZEND_LONG_MAX;
1556 return 1;
1557 case ZEND_DO_FCALL:
1558 case ZEND_DO_ICALL:
1559 case ZEND_DO_UCALL:
1560 case ZEND_DO_FCALL_BY_NAME:
1561 if (ssa_op->result_def == var) {
1562 zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
1563 zend_call_info *call_info;
1564 if (!func_info || !func_info->call_map) {
1565 break;
1566 }
1567
1568 call_info = func_info->call_map[opline - op_array->opcodes];
1569 if (!call_info || call_info->is_prototype) {
1570 break;
1571 }
1572 if (call_info->callee_func->type == ZEND_USER_FUNCTION) {
1573 func_info = ZEND_FUNC_INFO(&call_info->callee_func->op_array);
1574 if (func_info && func_info->return_info.has_range) {
1575 *tmp = func_info->return_info.range;
1576 return 1;
1577 }
1578 }
1579 //TODO: we can't use type inference for internal functions at this point ???
1580 #if 0
1581 uint32_t type;
1582
1583 type = zend_get_func_info(call_info, ssa);
1584 if (!(type & (MAY_BE_ANY - (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG)))) {
1585 tmp->underflow = 0;
1586 tmp->min = 0;
1587 tmp->max = 0;
1588 tmp->overflow = 0;
1589 if (type & MAY_BE_LONG) {
1590 tmp->min = ZEND_LONG_MIN;
1591 tmp->max = ZEND_LONG_MAX;
1592 } else if (type & MAY_BE_TRUE) {
1593 if (!(type & (MAY_BE_NULL|MAY_BE_FALSE))) {
1594 tmp->min = 1;
1595 }
1596 tmp->max = 1;
1597 }
1598 return 1;
1599 }
1600 #endif
1601 }
1602 break;
1603 // FIXME: support for more opcodes
1604 default:
1605 break;
1606 }
1607 return 0;
1608 }
1609
zend_inference_init_range(const zend_op_array * op_array,zend_ssa * ssa,int var,bool underflow,zend_long min,zend_long max,bool overflow)1610 static void zend_inference_init_range(const zend_op_array *op_array, zend_ssa *ssa, int var, bool underflow, zend_long min, zend_long max, bool overflow)
1611 {
1612 if (underflow) {
1613 min = ZEND_LONG_MIN;
1614 }
1615 if (overflow) {
1616 max = ZEND_LONG_MAX;
1617 }
1618 ssa->var_info[var].has_range = 1;
1619 ssa->var_info[var].range.underflow = underflow;
1620 ssa->var_info[var].range.min = min;
1621 ssa->var_info[var].range.max = max;
1622 ssa->var_info[var].range.overflow = overflow;
1623 LOG_SSA_RANGE(" change range (init SCC %2d) %2d [%s%ld..%ld%s]\n", ssa->vars[var].scc, var, (underflow?"-- ":""), min, max, (overflow?" ++":""));
1624 }
1625
zend_inference_widening_meet(zend_ssa_var_info * var_info,zend_ssa_range * r)1626 static bool zend_inference_widening_meet(zend_ssa_var_info *var_info, zend_ssa_range *r)
1627 {
1628 if (!var_info->has_range) {
1629 var_info->has_range = 1;
1630 } else {
1631 if (r->underflow ||
1632 var_info->range.underflow ||
1633 r->min < var_info->range.min) {
1634 r->underflow = 1;
1635 r->min = ZEND_LONG_MIN;
1636 }
1637 if (r->overflow ||
1638 var_info->range.overflow ||
1639 r->max > var_info->range.max) {
1640 r->overflow = 1;
1641 r->max = ZEND_LONG_MAX;
1642 }
1643 if (var_info->range.min == r->min &&
1644 var_info->range.max == r->max &&
1645 var_info->range.underflow == r->underflow &&
1646 var_info->range.overflow == r->overflow) {
1647 return 0;
1648 }
1649 }
1650 var_info->range = *r;
1651 return 1;
1652 }
1653
zend_ssa_range_widening(const zend_op_array * op_array,zend_ssa * ssa,int var,int scc)1654 static bool zend_ssa_range_widening(const zend_op_array *op_array, zend_ssa *ssa, int var, int scc)
1655 {
1656 zend_ssa_range tmp;
1657
1658 if (zend_inference_calc_range(op_array, ssa, var, 1, 0, &tmp)) {
1659 if (zend_inference_widening_meet(&ssa->var_info[var], &tmp)) {
1660 LOG_SSA_RANGE(" change range (widening SCC %2d) %2d [%s%ld..%ld%s]\n", scc, var, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":""));
1661 return 1;
1662 }
1663 }
1664 return 0;
1665 }
1666
zend_inference_narrowing_meet(zend_ssa_var_info * var_info,zend_ssa_range * r)1667 static bool zend_inference_narrowing_meet(zend_ssa_var_info *var_info, zend_ssa_range *r)
1668 {
1669 if (!var_info->has_range) {
1670 var_info->has_range = 1;
1671 } else {
1672 if (!r->underflow &&
1673 !var_info->range.underflow &&
1674 var_info->range.min < r->min) {
1675 r->min = var_info->range.min;
1676 }
1677 if (!r->overflow &&
1678 !var_info->range.overflow &&
1679 var_info->range.max > r->max) {
1680 r->max = var_info->range.max;
1681 }
1682 if (r->underflow) {
1683 r->min = ZEND_LONG_MIN;
1684 }
1685 if (r->overflow) {
1686 r->max = ZEND_LONG_MAX;
1687 }
1688 if (var_info->range.min == r->min &&
1689 var_info->range.max == r->max &&
1690 var_info->range.underflow == r->underflow &&
1691 var_info->range.overflow == r->overflow) {
1692 return 0;
1693 }
1694 }
1695 var_info->range = *r;
1696 return 1;
1697 }
1698
zend_ssa_range_narrowing(const zend_op_array * op_array,zend_ssa * ssa,int var,int scc)1699 static bool zend_ssa_range_narrowing(const zend_op_array *op_array, zend_ssa *ssa, int var, int scc)
1700 {
1701 zend_ssa_range tmp;
1702
1703 if (zend_inference_calc_range(op_array, ssa, var, 0, 1, &tmp)) {
1704 if (zend_inference_narrowing_meet(&ssa->var_info[var], &tmp)) {
1705 LOG_SSA_RANGE(" change range (narrowing SCC %2d) %2d [%s%ld..%ld%s]\n", scc, var, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":""));
1706 return 1;
1707 }
1708 }
1709 return 0;
1710 }
1711
1712 #ifdef NEG_RANGE
1713 # define CHECK_INNER_CYCLE(var2) \
1714 do { \
1715 if (ssa->vars[var2].scc == ssa->vars[var].scc && \
1716 !ssa->vars[var2].scc_entry && \
1717 !zend_bitset_in(visited, var2) && \
1718 zend_check_inner_cycles(op_array, ssa, worklist, visited, var2)) { \
1719 return 1; \
1720 } \
1721 } while (0)
1722
zend_check_inner_cycles(const zend_op_array * op_array,zend_ssa * ssa,zend_bitset worklist,zend_bitset visited,int var)1723 static bool zend_check_inner_cycles(const zend_op_array *op_array, zend_ssa *ssa, zend_bitset worklist, zend_bitset visited, int var)
1724 {
1725 if (zend_bitset_in(worklist, var)) {
1726 return 1;
1727 }
1728 zend_bitset_incl(worklist, var);
1729 FOR_EACH_VAR_USAGE(var, CHECK_INNER_CYCLE);
1730 zend_bitset_incl(visited, var);
1731 return 0;
1732 }
1733 #endif
1734
zend_infer_ranges_warmup(const zend_op_array * op_array,zend_ssa * ssa,int * scc_var,int * next_scc_var,int scc)1735 static void zend_infer_ranges_warmup(const zend_op_array *op_array, zend_ssa *ssa, int *scc_var, int *next_scc_var, int scc)
1736 {
1737 int worklist_len = zend_bitset_len(ssa->vars_count);
1738 int j, n;
1739 zend_ssa_range tmp;
1740 ALLOCA_FLAG(use_heap)
1741 zend_bitset worklist = do_alloca(sizeof(zend_ulong) * worklist_len * 2, use_heap);
1742 zend_bitset visited = worklist + worklist_len;
1743 #ifdef NEG_RANGE
1744 int has_inner_cycles = 0;
1745
1746 memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
1747 memset(visited, 0, sizeof(zend_ulong) * worklist_len);
1748 j = scc_var[scc];
1749 while (j >= 0) {
1750 if (!zend_bitset_in(visited, j) &&
1751 zend_check_inner_cycles(op_array, ssa, worklist, visited, j)) {
1752 has_inner_cycles = 1;
1753 break;
1754 }
1755 j = next_scc_var[j];
1756 }
1757 #endif
1758
1759 memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
1760
1761 for (n = 0; n < RANGE_WARMUP_PASSES; n++) {
1762 j= scc_var[scc];
1763 while (j >= 0) {
1764 if (ssa->vars[j].scc_entry
1765 && !(ssa->var_info[j].type & MAY_BE_REF)) {
1766 zend_bitset_incl(worklist, j);
1767 }
1768 j = next_scc_var[j];
1769 }
1770
1771 memset(visited, 0, sizeof(zend_ulong) * worklist_len);
1772
1773 WHILE_WORKLIST(worklist, worklist_len, j) {
1774 if (zend_inference_calc_range(op_array, ssa, j, 0, 0, &tmp)) {
1775 #ifdef NEG_RANGE
1776 if (!has_inner_cycles &&
1777 ssa->var_info[j].has_range &&
1778 ssa->vars[j].definition_phi &&
1779 ssa->vars[j].definition_phi->pi >= 0 &&
1780 ssa->vars[j].definition_phi->has_range_constraint &&
1781 ssa->vars[j].definition_phi->constraint.range.negative &&
1782 ssa->vars[j].definition_phi->constraint.range.min_ssa_var < 0 &&
1783 ssa->vars[j].definition_phi->constraint.range.max_ssa_var < 0) {
1784 zend_ssa_range_constraint *constraint =
1785 &ssa->vars[j].definition_phi->constraint.range;
1786 if (tmp.min == ssa->var_info[j].range.min &&
1787 tmp.max == ssa->var_info[j].range.max) {
1788 if (constraint->negative == NEG_INIT) {
1789 LOG_NEG_RANGE("#%d INVARIANT\n", j);
1790 constraint->negative = NEG_INVARIANT;
1791 }
1792 } else if (tmp.min == ssa->var_info[j].range.min &&
1793 tmp.max == ssa->var_info[j].range.max + 1 &&
1794 tmp.max < constraint->range.min) {
1795 if (constraint->negative == NEG_INIT ||
1796 constraint->negative == NEG_INVARIANT) {
1797 LOG_NEG_RANGE("#%d LT\n", j);
1798 constraint->negative = NEG_USE_LT;
1799 //???NEG
1800 } else if (constraint->negative == NEG_USE_GT) {
1801 LOG_NEG_RANGE("#%d UNKNOWN\n", j);
1802 constraint->negative = NEG_UNKNOWN;
1803 }
1804 } else if (tmp.max == ssa->var_info[j].range.max &&
1805 tmp.min == ssa->var_info[j].range.min - 1 &&
1806 tmp.min > constraint->range.max) {
1807 if (constraint->negative == NEG_INIT ||
1808 constraint->negative == NEG_INVARIANT) {
1809 LOG_NEG_RANGE("#%d GT\n", j);
1810 constraint->negative = NEG_USE_GT;
1811 //???NEG
1812 } else if (constraint->negative == NEG_USE_LT) {
1813 LOG_NEG_RANGE("#%d UNKNOWN\n", j);
1814 constraint->negative = NEG_UNKNOWN;
1815 }
1816 } else {
1817 LOG_NEG_RANGE("#%d UNKNOWN\n", j);
1818 constraint->negative = NEG_UNKNOWN;
1819 }
1820 }
1821 #endif
1822 if (zend_inference_narrowing_meet(&ssa->var_info[j], &tmp)) {
1823 LOG_SSA_RANGE(" change range (warmup %2d SCC %2d) %2d [%s%ld..%ld%s]\n", n, scc, j, (tmp.underflow?"-- ":""), tmp.min, tmp.max, (tmp.overflow?" ++":""));
1824 zend_bitset_incl(visited, j);
1825 FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR_1);
1826 }
1827 }
1828 } WHILE_WORKLIST_END();
1829 }
1830 free_alloca(worklist, use_heap);
1831 }
1832
zend_infer_ranges(const zend_op_array * op_array,zend_ssa * ssa)1833 static void zend_infer_ranges(const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
1834 {
1835 int worklist_len = zend_bitset_len(ssa->vars_count);
1836 zend_bitset worklist;
1837 int *next_scc_var;
1838 int *scc_var;
1839 zend_ssa_phi *p;
1840 zend_ssa_range tmp;
1841 int scc, j;
1842 ALLOCA_FLAG(use_heap);
1843
1844 worklist = do_alloca(
1845 ZEND_MM_ALIGNED_SIZE(sizeof(zend_ulong) * worklist_len) +
1846 ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->vars_count) +
1847 sizeof(int) * ssa->sccs, use_heap);
1848 next_scc_var = (int*)((char*)worklist + ZEND_MM_ALIGNED_SIZE(sizeof(zend_ulong) * worklist_len));
1849 scc_var = (int*)((char*)next_scc_var + ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->vars_count));
1850
1851 LOG_SSA_RANGE("Range Inference\n");
1852
1853 /* Create linked lists of SSA variables for each SCC */
1854 memset(scc_var, -1, sizeof(int) * ssa->sccs);
1855 for (j = 0; j < ssa->vars_count; j++) {
1856 if (ssa->vars[j].scc >= 0) {
1857 next_scc_var[j] = scc_var[ssa->vars[j].scc];
1858 scc_var[ssa->vars[j].scc] = j;
1859 }
1860 }
1861
1862 for (scc = 0; scc < ssa->sccs; scc++) {
1863 j = scc_var[scc];
1864 if (next_scc_var[j] < 0) {
1865 /* SCC with a single element */
1866 if (ssa->var_info[j].type & MAY_BE_REF) {
1867 /* pass */
1868 } else if (zend_inference_calc_range(op_array, ssa, j, 0, 1, &tmp)) {
1869 zend_inference_init_range(op_array, ssa, j, tmp.underflow, tmp.min, tmp.max, tmp.overflow);
1870 } else {
1871 zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1);
1872 }
1873 } else {
1874 /* Find SCC entry points */
1875 memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
1876 do {
1877 if (ssa->vars[j].scc_entry
1878 && !(ssa->var_info[j].type & MAY_BE_REF)) {
1879 zend_bitset_incl(worklist, j);
1880 }
1881 j = next_scc_var[j];
1882 } while (j >= 0);
1883
1884 #if RANGE_WARMUP_PASSES > 0
1885 zend_infer_ranges_warmup(op_array, ssa, scc_var, next_scc_var, scc);
1886 j = scc_var[scc];
1887 do {
1888 if (!(ssa->var_info[j].type & MAY_BE_REF)) {
1889 zend_bitset_incl(worklist, j);
1890 }
1891 j = next_scc_var[j];
1892 } while (j >= 0);
1893 #endif
1894
1895 /* widening */
1896 WHILE_WORKLIST(worklist, worklist_len, j) {
1897 if (zend_ssa_range_widening(op_array, ssa, j, scc)) {
1898 FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1899 }
1900 } WHILE_WORKLIST_END();
1901
1902 /* initialize missing ranges */
1903 for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
1904 if (!ssa->var_info[j].has_range
1905 && !(ssa->var_info[j].type & MAY_BE_REF)) {
1906 zend_inference_init_range(op_array, ssa, j, 1, ZEND_LONG_MIN, ZEND_LONG_MAX, 1);
1907 FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1908 }
1909 }
1910
1911 /* widening (second round) */
1912 WHILE_WORKLIST(worklist, worklist_len, j) {
1913 if (zend_ssa_range_widening(op_array, ssa, j, scc)) {
1914 FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1915 }
1916 } WHILE_WORKLIST_END();
1917
1918 /* Add all SCC entry variables into worklist for narrowing */
1919 for (j = scc_var[scc]; j >= 0; j = next_scc_var[j]) {
1920 if (ssa->vars[j].definition_phi
1921 && ssa->vars[j].definition_phi->pi < 0
1922 && !(ssa->var_info[j].type & MAY_BE_REF)) {
1923 /* narrowing Phi functions first */
1924 zend_ssa_range_narrowing(op_array, ssa, j, scc);
1925 }
1926 zend_bitset_incl(worklist, j);
1927 }
1928
1929 /* narrowing */
1930 WHILE_WORKLIST(worklist, worklist_len, j) {
1931 if (zend_ssa_range_narrowing(op_array, ssa, j, scc)) {
1932 FOR_EACH_VAR_USAGE(j, ADD_SCC_VAR);
1933 #ifdef SYM_RANGE
1934 /* Process symbolic control-flow constraints */
1935 p = ssa->vars[j].sym_use_chain;
1936 while (p) {
1937 ADD_SCC_VAR(p->ssa_var);
1938 p = p->sym_use_chain;
1939 }
1940 #endif
1941 }
1942 } WHILE_WORKLIST_END();
1943 }
1944 }
1945
1946 free_alloca(worklist, use_heap);
1947 }
1948 /* }}} */
1949
get_ssa_alias_types(zend_ssa_alias_kind alias)1950 static uint32_t get_ssa_alias_types(zend_ssa_alias_kind alias) {
1951 if (alias == HTTP_RESPONSE_HEADER_ALIAS) {
1952 return MAY_BE_ARRAY | MAY_BE_ARRAY_KEY_LONG | MAY_BE_ARRAY_OF_STRING | MAY_BE_RC1 | MAY_BE_RCN;
1953 } else {
1954 return MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
1955 }
1956 }
1957
1958 #define UPDATE_SSA_TYPE(_type, _var) \
1959 do { \
1960 uint32_t __type = (_type) & ~MAY_BE_GUARD; \
1961 int __var = (_var); \
1962 if (__type & MAY_BE_REF) { \
1963 __type |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF; \
1964 } \
1965 if (__var >= 0) { \
1966 zend_ssa_var *__ssa_var = &ssa_vars[__var]; \
1967 if (__ssa_var->var < op_array->num_args) { \
1968 if (__type & MAY_BE_RC1) { \
1969 /* TODO: may be captured by exception backtreace */ \
1970 __type |= MAY_BE_RCN; \
1971 } \
1972 } \
1973 if (__ssa_var->var < op_array->last_var) { \
1974 if (__type & (MAY_BE_REF|MAY_BE_RCN)) { \
1975 __type |= MAY_BE_RC1 | MAY_BE_RCN; \
1976 } \
1977 if ((__type & MAY_BE_RC1) && (__type & MAY_BE_STRING)) {\
1978 /* TODO: support for array keys and ($str . "")*/ \
1979 __type |= MAY_BE_RCN; \
1980 } \
1981 if (__ssa_var->alias) { \
1982 __type |= get_ssa_alias_types(__ssa_var->alias); \
1983 } \
1984 } \
1985 if (ssa_var_info[__var].type != __type) { \
1986 ZEND_ASSERT(ssa_opcodes != NULL || \
1987 __ssa_var->var >= op_array->last_var || \
1988 (ssa_var_info[__var].type & MAY_BE_REF) \
1989 == (__type & MAY_BE_REF)); \
1990 if (ssa_var_info[__var].type & ~__type) { \
1991 emit_type_narrowing_warning(op_array, ssa, __var); \
1992 return FAILURE; \
1993 } \
1994 ssa_var_info[__var].type = __type; \
1995 if (update_worklist) { \
1996 add_usages(op_array, ssa, worklist, __var); \
1997 } \
1998 } \
1999 /*zend_bitset_excl(worklist, var);*/ \
2000 } \
2001 } while (0)
2002
2003 #define UPDATE_SSA_OBJ_TYPE(_ce, _is_instanceof, var) \
2004 do { \
2005 if (var >= 0) { \
2006 if (ssa_var_info[var].ce != (_ce) || \
2007 ssa_var_info[var].is_instanceof != (_is_instanceof)) { \
2008 ssa_var_info[var].ce = (_ce); \
2009 ssa_var_info[var].is_instanceof = (_is_instanceof); \
2010 if (update_worklist) { \
2011 add_usages(op_array, ssa, worklist, var); \
2012 } \
2013 } \
2014 /*zend_bitset_excl(worklist, var);*/ \
2015 } \
2016 } while (0)
2017
2018 #define COPY_SSA_OBJ_TYPE(from_var, to_var) do { \
2019 if ((from_var) >= 0 && (ssa_var_info[(from_var)].type & MAY_BE_OBJECT) \
2020 && ssa_var_info[(from_var)].ce && !(ssa_var_info[(to_var)].type & MAY_BE_REF)) { \
2021 UPDATE_SSA_OBJ_TYPE(ssa_var_info[(from_var)].ce, \
2022 ssa_var_info[(from_var)].is_instanceof, (to_var)); \
2023 } else { \
2024 UPDATE_SSA_OBJ_TYPE(NULL, 0, (to_var)); \
2025 } \
2026 } while (0)
2027
add_usages(const zend_op_array * op_array,zend_ssa * ssa,zend_bitset worklist,int var)2028 static void add_usages(const zend_op_array *op_array, zend_ssa *ssa, zend_bitset worklist, int var)
2029 {
2030 if (ssa->vars[var].phi_use_chain) {
2031 zend_ssa_phi *p = ssa->vars[var].phi_use_chain;
2032 do {
2033 zend_bitset_incl(worklist, p->ssa_var);
2034 p = zend_ssa_next_use_phi(ssa, var, p);
2035 } while (p);
2036 }
2037 if (ssa->vars[var].use_chain >= 0) {
2038 int use = ssa->vars[var].use_chain;
2039 zend_ssa_op *op;
2040
2041 do {
2042 op = ssa->ops + use;
2043 if (op->result_def >= 0) {
2044 zend_bitset_incl(worklist, op->result_def);
2045 }
2046 if (op->op1_def >= 0) {
2047 zend_bitset_incl(worklist, op->op1_def);
2048 }
2049 if (op->op2_def >= 0) {
2050 zend_bitset_incl(worklist, op->op2_def);
2051 }
2052 if (op_array->opcodes[use].opcode == ZEND_OP_DATA) {
2053 op--;
2054 if (op->result_def >= 0) {
2055 zend_bitset_incl(worklist, op->result_def);
2056 }
2057 if (op->op1_def >= 0) {
2058 zend_bitset_incl(worklist, op->op1_def);
2059 }
2060 if (op->op2_def >= 0) {
2061 zend_bitset_incl(worklist, op->op2_def);
2062 }
2063 } else if (use + 1 < op_array->last
2064 && op_array->opcodes[use + 1].opcode == ZEND_OP_DATA) {
2065 op++;
2066 if (op->result_def >= 0) {
2067 zend_bitset_incl(worklist, op->result_def);
2068 }
2069 if (op->op1_def >= 0) {
2070 zend_bitset_incl(worklist, op->op1_def);
2071 }
2072 if (op->op2_def >= 0) {
2073 zend_bitset_incl(worklist, op->op2_def);
2074 }
2075 }
2076 use = zend_ssa_next_use(ssa->ops, var, use);
2077 } while (use >= 0);
2078 }
2079 }
2080
emit_type_narrowing_warning(const zend_op_array * op_array,zend_ssa * ssa,int var)2081 static void emit_type_narrowing_warning(const zend_op_array *op_array, zend_ssa *ssa, int var)
2082 {
2083 int def_op_num = ssa->vars[var].definition;
2084 const zend_op *def_opline = def_op_num >= 0 ? &op_array->opcodes[def_op_num] : NULL;
2085 const char *def_op_name = def_opline ? zend_get_opcode_name(def_opline->opcode) : "PHI";
2086 uint32_t lineno = def_opline ? def_opline->lineno : 0;
2087 zend_error_at(
2088 E_WARNING, op_array->filename, lineno,
2089 "Narrowing occurred during type inference of %s. Please file a bug report on https://github.com/php/php-src/issues", def_op_name);
2090 #if ZEND_DEBUG
2091 ZEND_ASSERT(0 && "Narrowing during type inference");
2092 #endif
2093 }
2094
zend_array_type_info(const zval * zv)2095 ZEND_API uint32_t ZEND_FASTCALL zend_array_type_info(const zval *zv)
2096 {
2097 HashTable *ht = Z_ARRVAL_P(zv);
2098 uint32_t tmp = MAY_BE_ARRAY;
2099 zend_string *str;
2100 zval *val;
2101
2102 if (Z_REFCOUNTED_P(zv)) {
2103 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2104 } else {
2105 tmp |= MAY_BE_RCN;
2106 }
2107
2108 if (zend_hash_num_elements(ht) == 0) {
2109 tmp |= MAY_BE_ARRAY_EMPTY;
2110 } else if (HT_IS_PACKED(ht)) {
2111 tmp |= MAY_BE_ARRAY_PACKED;
2112 ZEND_HASH_PACKED_FOREACH_VAL(ht, val) {
2113 tmp |= 1 << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
2114 } ZEND_HASH_FOREACH_END();
2115 } else {
2116 ZEND_HASH_MAP_FOREACH_STR_KEY_VAL(ht, str, val) {
2117 if (str) {
2118 tmp |= MAY_BE_ARRAY_STRING_HASH;
2119 } else {
2120 tmp |= MAY_BE_ARRAY_NUMERIC_HASH;
2121 }
2122 tmp |= 1 << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
2123 } ZEND_HASH_FOREACH_END();
2124 }
2125 return tmp;
2126 }
2127
2128
zend_array_element_type(uint32_t t1,zend_uchar op_type,int write,int insert)2129 ZEND_API uint32_t zend_array_element_type(uint32_t t1, zend_uchar op_type, int write, int insert)
2130 {
2131 uint32_t tmp = 0;
2132
2133 if (t1 & MAY_BE_OBJECT) {
2134 if (!write) {
2135 /* can't be REF because of ZVAL_COPY_DEREF() usage */
2136 tmp |= MAY_BE_ANY | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2137 } else {
2138 tmp |= MAY_BE_ANY | MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2139 }
2140 if (write) {
2141 tmp |= MAY_BE_INDIRECT;
2142 }
2143 }
2144 if (t1 & MAY_BE_ARRAY) {
2145 if (insert) {
2146 tmp |= MAY_BE_NULL;
2147 } else {
2148 tmp |= MAY_BE_NULL | ((t1 & MAY_BE_ARRAY_OF_ANY) >> MAY_BE_ARRAY_SHIFT);
2149 if (tmp & MAY_BE_ARRAY) {
2150 tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2151 }
2152 if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2153 if (!write) {
2154 /* can't be REF because of ZVAL_COPY_DEREF() usage */
2155 tmp |= MAY_BE_RCN;
2156 if ((op_type & (IS_VAR|IS_TMP_VAR)) && (t1 & MAY_BE_RC1)) {
2157 tmp |= MAY_BE_RC1;
2158 }
2159 } else if (t1 & MAY_BE_ARRAY_OF_REF) {
2160 tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN;
2161 } else {
2162 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2163 }
2164 }
2165 }
2166 if (write) {
2167 tmp |= MAY_BE_INDIRECT;
2168 }
2169 }
2170 if (t1 & MAY_BE_STRING) {
2171 tmp |= MAY_BE_STRING | MAY_BE_RC1;
2172 if (write) {
2173 tmp |= MAY_BE_NULL;
2174 }
2175 }
2176 if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2177 tmp |= MAY_BE_NULL;
2178 if (write) {
2179 tmp |= MAY_BE_INDIRECT;
2180 }
2181 }
2182 if (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE)) {
2183 if (!write) {
2184 tmp |= MAY_BE_NULL;
2185 }
2186 }
2187 return tmp;
2188 }
2189
assign_dim_array_result_type(uint32_t arr_type,uint32_t dim_type,uint32_t value_type,zend_uchar dim_op_type)2190 static uint32_t assign_dim_array_result_type(
2191 uint32_t arr_type, uint32_t dim_type, uint32_t value_type, zend_uchar dim_op_type) {
2192 uint32_t tmp = 0;
2193 /* Only add key type if we have a value type. We want to maintain the invariant that a
2194 * key type exists iff a value type exists even in dead code that may use empty types. */
2195 if (value_type & (MAY_BE_ANY|MAY_BE_UNDEF)) {
2196 if (value_type & MAY_BE_UNDEF) {
2197 value_type |= MAY_BE_NULL;
2198 }
2199 if (dim_op_type == IS_UNUSED) {
2200 if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2201 tmp |= MAY_BE_ARRAY_PACKED;
2202 }
2203 tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
2204 } else {
2205 if (dim_type & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) {
2206 if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2207 tmp |= MAY_BE_ARRAY_PACKED;
2208 }
2209 tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
2210 }
2211 if (dim_type & MAY_BE_STRING) {
2212 tmp |= MAY_BE_ARRAY_KEY_STRING;
2213 if (dim_op_type != IS_CONST) {
2214 // FIXME: numeric string
2215 if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2216 tmp |= MAY_BE_ARRAY_PACKED;
2217 }
2218 tmp |= MAY_BE_HASH_ONLY(arr_type) ? MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
2219 }
2220 }
2221 if (dim_type & (MAY_BE_UNDEF|MAY_BE_NULL)) {
2222 tmp |= MAY_BE_ARRAY_KEY_STRING;
2223 }
2224 }
2225 }
2226 /* Only add value type if we have a key type. It might be that the key type is illegal
2227 * for arrays. */
2228 if (tmp & MAY_BE_ARRAY_KEY_ANY) {
2229 tmp |= (value_type & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
2230 }
2231 tmp &= ~MAY_BE_ARRAY_EMPTY;
2232 return tmp;
2233 }
2234
assign_dim_result_type(uint32_t arr_type,uint32_t dim_type,uint32_t value_type,zend_uchar dim_op_type)2235 static uint32_t assign_dim_result_type(
2236 uint32_t arr_type, uint32_t dim_type, uint32_t value_type, zend_uchar dim_op_type) {
2237 uint32_t tmp = arr_type & ~(MAY_BE_RC1|MAY_BE_RCN);
2238
2239 if (arr_type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
2240 tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
2241 tmp |= MAY_BE_ARRAY|MAY_BE_RC1;
2242 }
2243 if (tmp & (MAY_BE_ARRAY|MAY_BE_STRING)) {
2244 tmp |= MAY_BE_RC1;
2245 }
2246 if (tmp & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2247 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2248 }
2249 if (tmp & MAY_BE_ARRAY) {
2250 tmp |= assign_dim_array_result_type(arr_type, dim_type, value_type, dim_op_type);
2251 }
2252 return tmp;
2253 }
2254
2255 /* For binary ops that have compound assignment operators */
binary_op_result_type(zend_ssa * ssa,zend_uchar opcode,uint32_t t1,uint32_t t2,int result_var,zend_long optimization_level)2256 static uint32_t binary_op_result_type(
2257 zend_ssa *ssa, zend_uchar opcode, uint32_t t1, uint32_t t2, int result_var,
2258 zend_long optimization_level) {
2259 uint32_t tmp = 0;
2260 uint32_t t1_type = (t1 & MAY_BE_ANY) | (t1 & MAY_BE_UNDEF ? MAY_BE_NULL : 0);
2261 uint32_t t2_type = (t2 & MAY_BE_ANY) | (t2 & MAY_BE_UNDEF ? MAY_BE_NULL : 0);
2262
2263 if (!(ZEND_OPTIMIZER_IGNORE_OVERLOADING & optimization_level)) {
2264 /* Handle potentially overloaded operators.
2265 * This could be made more precise by checking the class type, if known. */
2266 if ((t1_type & MAY_BE_OBJECT) || (t2_type & MAY_BE_OBJECT)) {
2267 /* This is somewhat GMP specific. */
2268 tmp |= MAY_BE_OBJECT | MAY_BE_FALSE | MAY_BE_RC1;
2269 }
2270 }
2271
2272 switch (opcode) {
2273 case ZEND_ADD:
2274 if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) {
2275 if (result_var < 0 ||
2276 !ssa->var_info[result_var].has_range ||
2277 ssa->var_info[result_var].range.underflow ||
2278 ssa->var_info[result_var].range.overflow) {
2279 /* may overflow */
2280 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2281 } else {
2282 tmp |= MAY_BE_LONG;
2283 }
2284 } else if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) {
2285 tmp |= MAY_BE_DOUBLE;
2286 } else if (t1_type == MAY_BE_ARRAY && t2_type == MAY_BE_ARRAY) {
2287 tmp |= MAY_BE_ARRAY | MAY_BE_RC1;
2288 tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2289 tmp |= t2 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2290 } else {
2291 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2292 if ((t1_type & MAY_BE_ARRAY) && (t2_type & MAY_BE_ARRAY)) {
2293 tmp |= MAY_BE_ARRAY | MAY_BE_RC1;
2294 tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2295 tmp |= t2 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
2296 }
2297 }
2298 break;
2299 case ZEND_SUB:
2300 case ZEND_MUL:
2301 if (t1_type == MAY_BE_LONG && t2_type == MAY_BE_LONG) {
2302 if (result_var < 0 ||
2303 !ssa->var_info[result_var].has_range ||
2304 ssa->var_info[result_var].range.underflow ||
2305 ssa->var_info[result_var].range.overflow) {
2306 /* may overflow */
2307 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2308 } else {
2309 tmp |= MAY_BE_LONG;
2310 }
2311 } else if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) {
2312 tmp |= MAY_BE_DOUBLE;
2313 } else {
2314 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2315 }
2316 break;
2317 case ZEND_DIV:
2318 case ZEND_POW:
2319 if (t1_type == MAY_BE_DOUBLE || t2_type == MAY_BE_DOUBLE) {
2320 tmp |= MAY_BE_DOUBLE;
2321 } else {
2322 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2323 }
2324 /* Division by zero results in Inf/-Inf/Nan (double), so it doesn't need any special
2325 * handling */
2326 break;
2327 case ZEND_MOD:
2328 tmp |= MAY_BE_LONG;
2329 /* Division by zero results in an exception, so it doesn't need any special handling */
2330 break;
2331 case ZEND_BW_OR:
2332 case ZEND_BW_AND:
2333 case ZEND_BW_XOR:
2334 if ((t1_type & MAY_BE_STRING) && (t2_type & MAY_BE_STRING)) {
2335 tmp |= MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN;
2336 }
2337 if ((t1_type & ~MAY_BE_STRING) || (t2_type & ~MAY_BE_STRING)) {
2338 tmp |= MAY_BE_LONG;
2339 }
2340 break;
2341 case ZEND_SL:
2342 case ZEND_SR:
2343 tmp |= MAY_BE_LONG;
2344 break;
2345 case ZEND_CONCAT:
2346 case ZEND_FAST_CONCAT:
2347 /* TODO: +MAY_BE_OBJECT ??? */
2348 tmp = MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN;
2349 break;
2350 EMPTY_SWITCH_DEFAULT_CASE()
2351 }
2352 return tmp;
2353 }
2354
zend_convert_type_declaration_mask(uint32_t type_mask)2355 static uint32_t zend_convert_type_declaration_mask(uint32_t type_mask) {
2356 uint32_t result_mask = type_mask & MAY_BE_ANY;
2357 if (type_mask & MAY_BE_VOID) {
2358 result_mask |= MAY_BE_NULL;
2359 }
2360 if (type_mask & MAY_BE_CALLABLE) {
2361 result_mask |= MAY_BE_STRING|MAY_BE_OBJECT|MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
2362 }
2363 if (type_mask & MAY_BE_STATIC) {
2364 result_mask |= MAY_BE_OBJECT;
2365 }
2366 if (type_mask & MAY_BE_ARRAY) {
2367 result_mask |= MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
2368 }
2369 return result_mask;
2370 }
2371
zend_convert_type(const zend_script * script,zend_type type,zend_class_entry ** pce)2372 static uint32_t zend_convert_type(const zend_script *script, zend_type type, zend_class_entry **pce)
2373 {
2374 if (pce) {
2375 *pce = NULL;
2376 }
2377
2378 if (!ZEND_TYPE_IS_SET(type)) {
2379 return MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF|MAY_BE_RC1|MAY_BE_RCN;
2380 }
2381
2382 uint32_t tmp = zend_convert_type_declaration_mask(ZEND_TYPE_PURE_MASK(type));
2383 if (ZEND_TYPE_IS_COMPLEX(type)) {
2384 tmp |= MAY_BE_OBJECT;
2385 if (pce) {
2386 /* As we only have space to store one CE,
2387 * we use a plain object type for class unions. */
2388 if (ZEND_TYPE_HAS_NAME(type)) {
2389 zend_string *lcname = zend_string_tolower(ZEND_TYPE_NAME(type));
2390 // TODO: Pass through op_array.
2391 *pce = zend_optimizer_get_class_entry(script, NULL, lcname);
2392 zend_string_release_ex(lcname, 0);
2393 }
2394 }
2395 }
2396 if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2397 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2398 }
2399 return tmp;
2400 }
2401
zend_fetch_arg_info_type(const zend_script * script,zend_arg_info * arg_info,zend_class_entry ** pce)2402 ZEND_API uint32_t zend_fetch_arg_info_type(const zend_script *script, zend_arg_info *arg_info, zend_class_entry **pce)
2403 {
2404 return zend_convert_type(script, arg_info->type, pce);
2405 }
2406
lookup_prop_info(zend_class_entry * ce,zend_string * name,zend_class_entry * scope)2407 static zend_property_info *lookup_prop_info(zend_class_entry *ce, zend_string *name, zend_class_entry *scope) {
2408 zend_property_info *prop_info;
2409
2410 /* If the class is linked, reuse the precise runtime logic. */
2411 if ((ce->ce_flags & ZEND_ACC_LINKED)
2412 && (!scope || (scope->ce_flags & ZEND_ACC_LINKED))) {
2413 zend_class_entry *prev_scope = EG(fake_scope);
2414 EG(fake_scope) = scope;
2415 prop_info = zend_get_property_info(ce, name, 1);
2416 EG(fake_scope) = prev_scope;
2417 if (prop_info && prop_info != ZEND_WRONG_PROPERTY_INFO) {
2418 return prop_info;
2419 }
2420 return NULL;
2421 }
2422
2423 /* Otherwise, handle only some safe cases */
2424 prop_info = zend_hash_find_ptr(&ce->properties_info, name);
2425 if (prop_info &&
2426 ((prop_info->ce == scope) ||
2427 (!scope && (prop_info->flags & ZEND_ACC_PUBLIC)))
2428 ) {
2429 return prop_info;
2430 }
2431 return NULL;
2432 }
2433
zend_fetch_prop_info(const zend_op_array * op_array,zend_ssa * ssa,zend_op * opline,zend_ssa_op * ssa_op)2434 static zend_property_info *zend_fetch_prop_info(const zend_op_array *op_array, zend_ssa *ssa, zend_op *opline, zend_ssa_op *ssa_op)
2435 {
2436 zend_property_info *prop_info = NULL;
2437 if (opline->op2_type == IS_CONST) {
2438 zend_class_entry *ce = NULL;
2439
2440 if (opline->op1_type == IS_UNUSED && !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
2441 ce = op_array->scope;
2442 } else if (ssa_op->op1_use >= 0) {
2443 ce = ssa->var_info[ssa_op->op1_use].ce;
2444 }
2445 if (ce) {
2446 prop_info = lookup_prop_info(ce,
2447 Z_STR_P(CRT_CONSTANT(opline->op2)),
2448 op_array->scope);
2449 if (prop_info && (prop_info->flags & ZEND_ACC_STATIC)) {
2450 prop_info = NULL;
2451 }
2452 }
2453 }
2454 return prop_info;
2455 }
2456
zend_fetch_static_prop_info(const zend_script * script,const zend_op_array * op_array,zend_ssa * ssa,zend_op * opline)2457 static zend_property_info *zend_fetch_static_prop_info(const zend_script *script, const zend_op_array *op_array, zend_ssa *ssa, zend_op *opline)
2458 {
2459 zend_property_info *prop_info = NULL;
2460 if (opline->op1_type == IS_CONST) {
2461 zend_class_entry *ce = NULL;
2462 if (opline->op2_type == IS_UNUSED) {
2463 int fetch_type = opline->op2.num & ZEND_FETCH_CLASS_MASK;
2464 switch (fetch_type) {
2465 case ZEND_FETCH_CLASS_SELF:
2466 case ZEND_FETCH_CLASS_STATIC:
2467 /* We enforce that static property types cannot change during inheritance, so
2468 * handling static the same way as self here is legal. */
2469 ce = op_array->scope;
2470 break;
2471 case ZEND_FETCH_CLASS_PARENT:
2472 if (op_array->scope && (op_array->scope->ce_flags & ZEND_ACC_LINKED)) {
2473 ce = op_array->scope->parent;
2474 }
2475 break;
2476 }
2477 } else if (opline->op2_type == IS_CONST) {
2478 zval *zv = CRT_CONSTANT(opline->op2);
2479 ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(zv + 1));
2480 }
2481
2482 if (ce) {
2483 zval *zv = CRT_CONSTANT(opline->op1);
2484 prop_info = lookup_prop_info(ce, Z_STR_P(zv), op_array->scope);
2485 if (prop_info && !(prop_info->flags & ZEND_ACC_STATIC)) {
2486 prop_info = NULL;
2487 }
2488 }
2489 }
2490 return prop_info;
2491 }
2492
zend_fetch_prop_type(const zend_script * script,zend_property_info * prop_info,zend_class_entry ** pce)2493 static uint32_t zend_fetch_prop_type(const zend_script *script, zend_property_info *prop_info, zend_class_entry **pce)
2494 {
2495 if (!prop_info) {
2496 if (pce) {
2497 *pce = NULL;
2498 }
2499 return MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;
2500 }
2501
2502 return zend_convert_type(script, prop_info->type, pce);
2503 }
2504
result_may_be_separated(zend_ssa * ssa,zend_ssa_op * ssa_op)2505 static bool result_may_be_separated(zend_ssa *ssa, zend_ssa_op *ssa_op)
2506 {
2507 int tmp_var = ssa_op->result_def;
2508
2509 if (ssa->vars[tmp_var].use_chain >= 0
2510 && !ssa->vars[tmp_var].phi_use_chain) {
2511 zend_ssa_op *use_op = &ssa->ops[ssa->vars[tmp_var].use_chain];
2512
2513 /* TODO: analize instructions between ssa_op and use_op */
2514 if (use_op == ssa_op + 1) {
2515 if ((use_op->op1_use == tmp_var && use_op->op1_use_chain < 0)
2516 || (use_op->op2_use == tmp_var && use_op->op2_use_chain < 0)) {
2517 return 0;
2518 }
2519 }
2520 }
2521 return 1;
2522 }
2523
_zend_update_type_info(const zend_op_array * op_array,zend_ssa * ssa,const zend_script * script,zend_bitset worklist,zend_op * opline,zend_ssa_op * ssa_op,const zend_op ** ssa_opcodes,zend_long optimization_level,bool update_worklist)2524 static zend_always_inline zend_result _zend_update_type_info(
2525 const zend_op_array *op_array,
2526 zend_ssa *ssa,
2527 const zend_script *script,
2528 zend_bitset worklist,
2529 zend_op *opline,
2530 zend_ssa_op *ssa_op,
2531 const zend_op **ssa_opcodes,
2532 zend_long optimization_level,
2533 bool update_worklist)
2534 {
2535 uint32_t t1, t2;
2536 uint32_t tmp, orig;
2537 zend_ssa_var *ssa_vars = ssa->vars;
2538 zend_ssa_var_info *ssa_var_info = ssa->var_info;
2539 zend_class_entry *ce;
2540 int j;
2541
2542 if (opline->opcode == ZEND_OP_DATA) {
2543 opline--;
2544 ssa_op--;
2545 }
2546
2547 t1 = OP1_INFO();
2548 t2 = OP2_INFO();
2549
2550 /* If one of the operands cannot have any type, this means the operand derives from
2551 * unreachable code. Propagate the empty result early, so that that the following
2552 * code may assume that operands have at least one type. */
2553 if (!(t1 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
2554 || !(t2 & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS))
2555 || (ssa_op->result_use >= 0 && !(RES_USE_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)))
2556 || ((opline->opcode == ZEND_ASSIGN_DIM_OP
2557 || opline->opcode == ZEND_ASSIGN_OBJ_OP
2558 || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP
2559 || opline->opcode == ZEND_ASSIGN_DIM
2560 || opline->opcode == ZEND_ASSIGN_OBJ)
2561 && !(OP1_DATA_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF|MAY_BE_CLASS)) /*&& 0*/)) {
2562 tmp = 0;
2563 if (ssa_op->result_def >= 0 && !(ssa_var_info[ssa_op->result_def].type & MAY_BE_REF)) {
2564 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2565 }
2566 if (ssa_op->op1_def >= 0 && !(ssa_var_info[ssa_op->op1_def].type & MAY_BE_REF)) {
2567 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2568 }
2569 if (ssa_op->op2_def >= 0 && !(ssa_var_info[ssa_op->op2_def].type & MAY_BE_REF)) {
2570 UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
2571 }
2572 if (opline->opcode == ZEND_ASSIGN_DIM_OP
2573 || opline->opcode == ZEND_ASSIGN_OBJ_OP
2574 || opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP
2575 || opline->opcode == ZEND_ASSIGN_DIM
2576 || opline->opcode == ZEND_ASSIGN_OBJ) {
2577 if ((ssa_op+1)->op1_def >= 0 && !(ssa_var_info[(ssa_op+1)->op1_def].type & MAY_BE_REF)) {
2578 UPDATE_SSA_TYPE(tmp, (ssa_op+1)->op1_def);
2579 }
2580 }
2581 return SUCCESS;
2582 }
2583
2584 switch (opline->opcode) {
2585 case ZEND_ADD:
2586 case ZEND_SUB:
2587 case ZEND_MUL:
2588 case ZEND_DIV:
2589 case ZEND_POW:
2590 case ZEND_MOD:
2591 case ZEND_BW_OR:
2592 case ZEND_BW_AND:
2593 case ZEND_BW_XOR:
2594 case ZEND_SL:
2595 case ZEND_SR:
2596 case ZEND_CONCAT:
2597 tmp = binary_op_result_type(ssa, opline->opcode, t1, t2, ssa_op->result_def, optimization_level);
2598 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2599 break;
2600 case ZEND_BW_NOT:
2601 tmp = 0;
2602 if (t1 & MAY_BE_STRING) {
2603 tmp |= MAY_BE_STRING | MAY_BE_RC1 | MAY_BE_RCN;
2604 }
2605 if (t1 & (MAY_BE_ANY-MAY_BE_STRING)) {
2606 tmp |= MAY_BE_LONG;
2607 }
2608 if (!(ZEND_OPTIMIZER_IGNORE_OVERLOADING & optimization_level)) {
2609 if (t1 & MAY_BE_OBJECT) {
2610 /* Potentially overloaded operator. */
2611 tmp |= MAY_BE_OBJECT | MAY_BE_RC1;
2612 }
2613 }
2614 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2615 break;
2616 case ZEND_BEGIN_SILENCE:
2617 UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def);
2618 break;
2619 case ZEND_BOOL_NOT:
2620 case ZEND_BOOL_XOR:
2621 case ZEND_IS_IDENTICAL:
2622 case ZEND_IS_NOT_IDENTICAL:
2623 case ZEND_IS_EQUAL:
2624 case ZEND_IS_NOT_EQUAL:
2625 case ZEND_IS_SMALLER:
2626 case ZEND_IS_SMALLER_OR_EQUAL:
2627 case ZEND_INSTANCEOF:
2628 case ZEND_JMPZ_EX:
2629 case ZEND_JMPNZ_EX:
2630 case ZEND_CASE:
2631 case ZEND_CASE_STRICT:
2632 case ZEND_BOOL:
2633 case ZEND_ISSET_ISEMPTY_CV:
2634 case ZEND_ISSET_ISEMPTY_VAR:
2635 case ZEND_ISSET_ISEMPTY_DIM_OBJ:
2636 case ZEND_ISSET_ISEMPTY_PROP_OBJ:
2637 case ZEND_ISSET_ISEMPTY_STATIC_PROP:
2638 case ZEND_ASSERT_CHECK:
2639 case ZEND_IN_ARRAY:
2640 case ZEND_ARRAY_KEY_EXISTS:
2641 UPDATE_SSA_TYPE(MAY_BE_FALSE|MAY_BE_TRUE, ssa_op->result_def);
2642 break;
2643 case ZEND_CAST:
2644 if (ssa_op->op1_def >= 0) {
2645 tmp = t1;
2646 if ((t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) &&
2647 (opline->extended_value == IS_ARRAY ||
2648 opline->extended_value == IS_OBJECT)) {
2649 tmp |= MAY_BE_RCN;
2650 } else if ((t1 & MAY_BE_STRING) &&
2651 opline->extended_value == IS_STRING) {
2652 tmp |= MAY_BE_RCN;
2653 }
2654 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2655 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2656 }
2657 tmp = 1 << opline->extended_value;
2658 if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2659 if ((tmp & MAY_BE_ANY) == (t1 & MAY_BE_ANY)) {
2660 tmp |= (t1 & MAY_BE_RC1) | MAY_BE_RCN;
2661 } else if ((opline->extended_value == IS_ARRAY ||
2662 opline->extended_value == IS_OBJECT) &&
2663 (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT))) {
2664 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2665 } else if (opline->extended_value == IS_STRING &&
2666 (t1 & (MAY_BE_STRING|MAY_BE_OBJECT))) {
2667 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2668 } else {
2669 tmp |= MAY_BE_RC1;
2670 if (opline->extended_value == IS_ARRAY
2671 && (t1 & (MAY_BE_UNDEF|MAY_BE_NULL))) {
2672 tmp |= MAY_BE_RCN;
2673 }
2674 }
2675 }
2676 if (opline->extended_value == IS_ARRAY) {
2677 if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL)) {
2678 tmp |= MAY_BE_ARRAY_EMPTY;
2679 }
2680 if (t1 & MAY_BE_ARRAY) {
2681 tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF);
2682 }
2683 if (t1 & MAY_BE_OBJECT) {
2684 tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
2685 } else if (t1 & (MAY_BE_ANY - MAY_BE_NULL)) {
2686 tmp |= ((t1 & (MAY_BE_ANY - MAY_BE_NULL)) << MAY_BE_ARRAY_SHIFT) | ((t1 & MAY_BE_NULL) ? MAY_BE_ARRAY_KEY_LONG : MAY_BE_ARRAY_PACKED);
2687 }
2688 }
2689 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2690 break;
2691 case ZEND_QM_ASSIGN:
2692 case ZEND_JMP_SET:
2693 case ZEND_COALESCE:
2694 case ZEND_COPY_TMP:
2695 if (ssa_op->op1_def >= 0) {
2696 tmp = t1;
2697 if (t1 & (MAY_BE_RC1|MAY_BE_REF)) {
2698 tmp |= MAY_BE_RCN;
2699 }
2700 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2701 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2702 }
2703 tmp = t1 & ~(MAY_BE_UNDEF|MAY_BE_REF);
2704 if (t1 & MAY_BE_UNDEF) {
2705 tmp |= MAY_BE_NULL;
2706 }
2707 if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2708 tmp |= (t1 & (MAY_BE_RC1|MAY_BE_RCN));
2709 if (opline->opcode == ZEND_COPY_TMP || opline->op1_type == IS_CV) {
2710 tmp |= MAY_BE_RCN;
2711 }
2712 }
2713 if (opline->opcode == ZEND_COALESCE || opline->opcode == ZEND_JMP_SET) {
2714 /* COALESCE and JMP_SET result can't be null */
2715 tmp &= ~MAY_BE_NULL;
2716 if (opline->opcode == ZEND_JMP_SET) {
2717 /* JMP_SET result can't be false either */
2718 tmp &= ~MAY_BE_FALSE;
2719 }
2720 }
2721 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2722 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def);
2723 break;
2724 case ZEND_JMP_NULL:
2725 {
2726 uint32_t short_circuiting_type = opline->extended_value & ZEND_SHORT_CIRCUITING_CHAIN_MASK;
2727 if (short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_EXPR) {
2728 tmp = MAY_BE_NULL;
2729 } else if (short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_ISSET) {
2730 tmp = MAY_BE_FALSE;
2731 } else {
2732 ZEND_ASSERT(short_circuiting_type == ZEND_SHORT_CIRCUITING_CHAIN_EMPTY);
2733 tmp = MAY_BE_TRUE;
2734 }
2735 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2736 break;
2737 }
2738 case ZEND_ASSIGN_OP:
2739 case ZEND_ASSIGN_DIM_OP:
2740 case ZEND_ASSIGN_OBJ_OP:
2741 case ZEND_ASSIGN_STATIC_PROP_OP:
2742 {
2743 zend_property_info *prop_info = NULL;
2744 orig = 0;
2745 tmp = 0;
2746 if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
2747 prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op);
2748 orig = t1;
2749 t1 = zend_fetch_prop_type(script, prop_info, NULL);
2750 t2 = OP1_DATA_INFO();
2751 } else if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
2752 if (t1 & MAY_BE_ARRAY_OF_REF) {
2753 tmp |= MAY_BE_REF;
2754 }
2755 orig = t1;
2756 t1 = zend_array_element_type(t1, opline->op1_type, 1, 0);
2757 t2 = OP1_DATA_INFO();
2758 } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
2759 prop_info = zend_fetch_static_prop_info(script, op_array, ssa, opline);
2760 t1 = zend_fetch_prop_type(script, prop_info, NULL);
2761 t2 = OP1_DATA_INFO();
2762 } else {
2763 if (t1 & MAY_BE_REF) {
2764 tmp |= MAY_BE_REF;
2765 }
2766 }
2767
2768 tmp |= binary_op_result_type(
2769 ssa, opline->extended_value, t1, t2,
2770 opline->opcode == ZEND_ASSIGN_OP ? ssa_op->op1_def : -1, optimization_level);
2771 if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY)) {
2772 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2773 }
2774 if (tmp & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
2775 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
2776 }
2777
2778 if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
2779 if (opline->op1_type == IS_CV) {
2780 orig = assign_dim_result_type(orig, OP2_INFO(), tmp, opline->op2_type);
2781 UPDATE_SSA_TYPE(orig, ssa_op->op1_def);
2782 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2783 }
2784 } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
2785 if (opline->op1_type == IS_CV) {
2786 orig = (orig & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN;
2787 UPDATE_SSA_TYPE(orig, ssa_op->op1_def);
2788 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2789 }
2790 } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
2791 /* Nothing to do */
2792 } else {
2793 if (opline->opcode == ZEND_ASSIGN_OP && ssa_op->result_def >= 0 && (tmp & MAY_BE_RC1)) {
2794 tmp |= MAY_BE_RCN;
2795 }
2796 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2797 }
2798 if (ssa_op->result_def >= 0) {
2799 ce = NULL;
2800 if (opline->opcode == ZEND_ASSIGN_DIM_OP) {
2801 if (opline->op2_type == IS_UNUSED) {
2802 /* When appending to an array and the LONG_MAX key is already used
2803 * null will be returned. */
2804 tmp |= MAY_BE_NULL;
2805 }
2806 if (t2 & (MAY_BE_ARRAY | MAY_BE_OBJECT)) {
2807 /* Arrays and objects cannot be used as keys. */
2808 tmp |= MAY_BE_NULL;
2809 }
2810 if (t1 & (MAY_BE_ANY - (MAY_BE_NULL | MAY_BE_FALSE | MAY_BE_STRING | MAY_BE_ARRAY))) {
2811 /* null and false are implicitly converted to array, anything else
2812 * results in a null return value. */
2813 tmp |= MAY_BE_NULL;
2814 }
2815 if (tmp & MAY_BE_REF) {
2816 /* Typed reference may cause auto conversion */
2817 tmp |= MAY_BE_ANY;
2818 }
2819 } else if (opline->opcode == ZEND_ASSIGN_OBJ_OP) {
2820 /* The return value must also satisfy the property type */
2821 if (prop_info) {
2822 t1 = zend_fetch_prop_type(script, prop_info, &ce);
2823 if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
2824 && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
2825 /* DOUBLE may be auto-converted to LONG */
2826 tmp |= MAY_BE_LONG;
2827 tmp &= ~MAY_BE_DOUBLE;
2828 } else if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING)) == MAY_BE_STRING
2829 && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
2830 /* LONG/DOUBLE may be auto-converted to STRING */
2831 tmp |= MAY_BE_STRING;
2832 tmp &= ~(MAY_BE_LONG|MAY_BE_DOUBLE);
2833 }
2834 tmp &= t1;
2835 } else {
2836 tmp |= MAY_BE_LONG | MAY_BE_STRING;
2837 }
2838 } else if (opline->opcode == ZEND_ASSIGN_STATIC_PROP_OP) {
2839 /* The return value must also satisfy the property type */
2840 if (prop_info) {
2841 t1 = zend_fetch_prop_type(script, prop_info, &ce);
2842 if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_LONG
2843 && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE)) == MAY_BE_DOUBLE) {
2844 /* DOUBLE may be auto-converted to LONG */
2845 tmp |= MAY_BE_LONG;
2846 tmp &= ~MAY_BE_DOUBLE;
2847 } else if ((t1 & (MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING)) == MAY_BE_STRING
2848 && (tmp & (MAY_BE_LONG|MAY_BE_DOUBLE))) {
2849 /* LONG/DOUBLE may be auto-converted to STRING */
2850 tmp |= MAY_BE_STRING;
2851 tmp &= ~(MAY_BE_LONG|MAY_BE_DOUBLE);
2852 }
2853 tmp &= t1;
2854 } else {
2855 tmp |= MAY_BE_LONG | MAY_BE_STRING;
2856 }
2857 } else {
2858 if (tmp & MAY_BE_REF) {
2859 /* Typed reference may cause auto conversion */
2860 tmp |= MAY_BE_ANY;
2861 }
2862 }
2863 tmp &= ~MAY_BE_REF;
2864 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2865 if (ce) {
2866 UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
2867 }
2868 }
2869 break;
2870 }
2871 case ZEND_PRE_INC:
2872 case ZEND_PRE_DEC:
2873 tmp = 0;
2874 if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2875 tmp |= MAY_BE_RC1;
2876 if (ssa_op->result_def >= 0) {
2877 tmp |= MAY_BE_RCN;
2878 }
2879 }
2880 if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) {
2881 if (!ssa_var_info[ssa_op->op1_use].has_range ||
2882 (opline->opcode == ZEND_PRE_DEC &&
2883 (ssa_var_info[ssa_op->op1_use].range.underflow ||
2884 ssa_var_info[ssa_op->op1_use].range.min == ZEND_LONG_MIN)) ||
2885 (opline->opcode == ZEND_PRE_INC &&
2886 (ssa_var_info[ssa_op->op1_use].range.overflow ||
2887 ssa_var_info[ssa_op->op1_use].range.max == ZEND_LONG_MAX))) {
2888 /* may overflow */
2889 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2890 } else {
2891 tmp |= MAY_BE_LONG;
2892 }
2893 } else {
2894 if (t1 & (MAY_BE_UNDEF | MAY_BE_NULL)) {
2895 if (opline->opcode == ZEND_PRE_INC) {
2896 tmp |= MAY_BE_LONG;
2897 } else {
2898 tmp |= MAY_BE_NULL;
2899 }
2900 }
2901 if (t1 & MAY_BE_LONG) {
2902 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2903 }
2904 if (t1 & MAY_BE_DOUBLE) {
2905 tmp |= MAY_BE_DOUBLE;
2906 }
2907 if (t1 & MAY_BE_STRING) {
2908 tmp |= MAY_BE_STRING | MAY_BE_LONG | MAY_BE_DOUBLE;
2909 }
2910 tmp |= t1 & (MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_OBJECT);
2911 }
2912 if (ssa_op->result_def >= 0) {
2913 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2914 }
2915 if (ssa_op->op1_def >= 0) {
2916 if (t1 & MAY_BE_REF) {
2917 tmp |= MAY_BE_REF;
2918 }
2919 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2920 }
2921 break;
2922 case ZEND_POST_INC:
2923 case ZEND_POST_DEC:
2924 if (ssa_op->result_def >= 0) {
2925 tmp = 0;
2926 if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2927 tmp |= MAY_BE_RC1|MAY_BE_RCN;
2928 }
2929 tmp |= t1 & ~(MAY_BE_UNDEF|MAY_BE_REF|MAY_BE_RCN);
2930 if (t1 & MAY_BE_UNDEF) {
2931 tmp |= MAY_BE_NULL;
2932 }
2933 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
2934 }
2935 tmp = 0;
2936 if (t1 & MAY_BE_REF) {
2937 tmp |= MAY_BE_REF;
2938 }
2939 if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
2940 tmp |= MAY_BE_RC1;
2941 }
2942 if ((t1 & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG) {
2943 if (!ssa_var_info[ssa_op->op1_use].has_range ||
2944 (opline->opcode == ZEND_POST_DEC &&
2945 (ssa_var_info[ssa_op->op1_use].range.underflow ||
2946 ssa_var_info[ssa_op->op1_use].range.min == ZEND_LONG_MIN)) ||
2947 (opline->opcode == ZEND_POST_INC &&
2948 (ssa_var_info[ssa_op->op1_use].range.overflow ||
2949 ssa_var_info[ssa_op->op1_use].range.max == ZEND_LONG_MAX))) {
2950 /* may overflow */
2951 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2952 } else {
2953 tmp |= MAY_BE_LONG;
2954 }
2955 } else {
2956 if (t1 & (MAY_BE_UNDEF | MAY_BE_NULL)) {
2957 if (opline->opcode == ZEND_POST_INC) {
2958 tmp |= MAY_BE_LONG;
2959 } else {
2960 tmp |= MAY_BE_NULL;
2961 }
2962 }
2963 if (t1 & MAY_BE_LONG) {
2964 tmp |= MAY_BE_LONG | MAY_BE_DOUBLE;
2965 }
2966 if (t1 & MAY_BE_DOUBLE) {
2967 tmp |= MAY_BE_DOUBLE;
2968 }
2969 if (t1 & MAY_BE_STRING) {
2970 tmp |= MAY_BE_STRING | MAY_BE_LONG | MAY_BE_DOUBLE;
2971 }
2972 tmp |= t1 & (MAY_BE_FALSE | MAY_BE_TRUE | MAY_BE_RESOURCE | MAY_BE_ARRAY | MAY_BE_OBJECT | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_KEY_ANY);
2973 }
2974 if (ssa_op->op1_def >= 0) {
2975 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2976 }
2977 break;
2978 case ZEND_ASSIGN_DIM:
2979 if (opline->op1_type == IS_CV) {
2980 tmp = assign_dim_result_type(t1, t2, OP1_DATA_INFO(), opline->op2_type);
2981 tmp |= ssa->var_info[ssa_op->op1_def].type & (MAY_BE_ARRAY_PACKED|MAY_BE_ARRAY_NUMERIC_HASH|MAY_BE_ARRAY_STRING_HASH);
2982 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
2983 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
2984 }
2985 if (ssa_op->result_def >= 0) {
2986 tmp = 0;
2987 if (t1 & MAY_BE_STRING) {
2988 tmp |= MAY_BE_STRING | MAY_BE_NULL;
2989 }
2990 if (t1 & MAY_BE_OBJECT) {
2991 tmp |= (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF);
2992 }
2993 if (t1 & (MAY_BE_ARRAY|MAY_BE_FALSE|MAY_BE_NULL|MAY_BE_UNDEF)) {
2994 tmp |= (OP1_DATA_INFO() & (MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF));
2995
2996 if (OP1_DATA_INFO() & MAY_BE_UNDEF) {
2997 tmp |= MAY_BE_NULL;
2998 }
2999 if (t1 & MAY_BE_ARRAY_OF_REF) {
3000 /* A scalar type conversion may occur when assigning to a typed reference. */
3001 tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING;
3002 }
3003 }
3004 if (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE)) {
3005 tmp |= MAY_BE_NULL;
3006 }
3007 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3008 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3009 }
3010 if ((ssa_op+1)->op1_def >= 0) {
3011 opline++;
3012 ssa_op++;
3013 tmp = OP1_INFO();
3014 if (tmp & (MAY_BE_ANY | MAY_BE_REF)) {
3015 if (tmp & MAY_BE_RC1) {
3016 tmp |= MAY_BE_RCN;
3017 }
3018 }
3019 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3020 }
3021 break;
3022 case ZEND_ASSIGN_OBJ:
3023 if (opline->op1_type == IS_CV) {
3024 tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN;
3025 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3026 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3027 }
3028 if (ssa_op->result_def >= 0) {
3029 // TODO: If there is no __set we might do better
3030 tmp = zend_fetch_prop_type(script,
3031 zend_fetch_prop_info(op_array, ssa, opline, ssa_op), &ce);
3032 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3033 if (ce) {
3034 UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3035 }
3036 }
3037 if ((ssa_op+1)->op1_def >= 0) {
3038 opline++;
3039 ssa_op++;
3040 tmp = OP1_INFO();
3041 if (tmp & MAY_BE_RC1) {
3042 tmp |= MAY_BE_RCN;
3043 }
3044 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3045 }
3046 break;
3047 case ZEND_ASSIGN_STATIC_PROP:
3048 if (ssa_op->result_def >= 0) {
3049 tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_RC1 | MAY_BE_RCN;
3050 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3051 }
3052 if ((ssa_op+1)->op1_def >= 0) {
3053 opline++;
3054 ssa_op++;
3055 tmp = OP1_INFO();
3056 if (tmp & MAY_BE_RC1) {
3057 tmp |= MAY_BE_RCN;
3058 }
3059 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3060 }
3061 break;
3062 case ZEND_PRE_INC_OBJ:
3063 case ZEND_PRE_DEC_OBJ:
3064 case ZEND_POST_INC_OBJ:
3065 case ZEND_POST_DEC_OBJ:
3066 if (opline->op1_type == IS_CV) {
3067 tmp = (t1 & (MAY_BE_REF|MAY_BE_OBJECT))|MAY_BE_RC1|MAY_BE_RCN;
3068 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3069 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3070 }
3071 if (ssa_op->result_def >= 0) {
3072 // TODO: ???
3073 tmp = MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3074 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3075 }
3076 break;
3077 case ZEND_ASSIGN:
3078 if (ssa_op->op2_def >= 0) {
3079 tmp = t2;
3080 if (tmp & MAY_BE_RC1) {
3081 tmp |= MAY_BE_RCN;
3082 }
3083 UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3084 }
3085 tmp = t2 & ~(MAY_BE_UNDEF|MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN);
3086 if (t2 & MAY_BE_UNDEF) {
3087 tmp |= MAY_BE_NULL;
3088 }
3089 if (t1 & MAY_BE_REF) {
3090 tmp |= MAY_BE_REF;
3091 }
3092 if (t2 & MAY_BE_REF) {
3093 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3094 } else if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
3095 tmp |= t2 & (MAY_BE_RC1|MAY_BE_RCN);
3096 } else if (t2 & (MAY_BE_RC1|MAY_BE_RCN)) {
3097 tmp |= MAY_BE_RCN;
3098 }
3099 if (RETURN_VALUE_USED(opline) && (tmp & MAY_BE_RC1)) {
3100 tmp |= MAY_BE_RCN;
3101 }
3102 if (ssa_op->op1_def >= 0) {
3103 if (ssa_var_info[ssa_op->op1_def].use_as_double) {
3104 tmp &= ~MAY_BE_LONG;
3105 tmp |= MAY_BE_DOUBLE;
3106 }
3107 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3108 COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op1_def);
3109 }
3110 if (ssa_op->result_def >= 0) {
3111 if (tmp & MAY_BE_REF) {
3112 /* A scalar type conversion may occur when assigning to a typed reference. */
3113 tmp &= ~MAY_BE_REF;
3114 tmp |= MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN;
3115 }
3116 if ((tmp & (MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_RCN) {
3117 /* refcount may be indirectly decremented. Make an exception if the result is used in the next instruction */
3118 if (!ssa_opcodes) {
3119 if (ssa->vars[ssa_op->result_def].use_chain < 0
3120 || opline + 1 != op_array->opcodes + ssa->vars[ssa_op->result_def].use_chain) {
3121 tmp |= MAY_BE_RC1;
3122 }
3123 } else {
3124 if (ssa->vars[ssa_op->result_def].use_chain < 0
3125 || opline + 1 != ssa_opcodes[ssa->vars[ssa_op->result_def].use_chain]) {
3126 tmp |= MAY_BE_RC1;
3127 }
3128 }
3129 }
3130 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3131 COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def);
3132 }
3133 break;
3134 case ZEND_ASSIGN_REF:
3135 // TODO: ???
3136 if (opline->op2_type == IS_CV) {
3137 tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3138 if (t2 & MAY_BE_UNDEF) {
3139 tmp |= MAY_BE_NULL;
3140 }
3141 UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3142 }
3143 if (opline->op2_type == IS_VAR && opline->extended_value == ZEND_RETURNS_FUNCTION) {
3144 tmp = (MAY_BE_REF | MAY_BE_RCN | MAY_BE_RC1 | t2) & ~MAY_BE_UNDEF;
3145 } else {
3146 tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3147 }
3148 if (t2 & MAY_BE_UNDEF) {
3149 tmp |= MAY_BE_NULL;
3150 }
3151 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3152 if (ssa_op->result_def >= 0) {
3153 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3154 }
3155 break;
3156 case ZEND_ASSIGN_OBJ_REF:
3157 if (opline->op1_type == IS_CV) {
3158 tmp = t1;
3159 if (tmp & MAY_BE_OBJECT) {
3160 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3161 }
3162 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3163 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3164 }
3165
3166 t2 = OP1_DATA_INFO();
3167 if ((opline+1)->op1_type == IS_VAR && (opline->extended_value & ZEND_RETURNS_FUNCTION)) {
3168 tmp = (MAY_BE_REF | MAY_BE_RCN | MAY_BE_RC1 | t2) & ~MAY_BE_UNDEF;
3169 } else {
3170 tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3171 }
3172 if (t2 & MAY_BE_UNDEF) {
3173 tmp |= MAY_BE_NULL;
3174 }
3175 if (ssa_op->result_def >= 0) {
3176 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3177 }
3178 if ((opline+1)->op1_type == IS_CV) {
3179 opline++;
3180 ssa_op++;
3181 tmp = (MAY_BE_REF | t2) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3182 if (t2 & MAY_BE_UNDEF) {
3183 tmp |= MAY_BE_NULL;
3184 }
3185 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3186 }
3187 break;
3188 case ZEND_ASSIGN_STATIC_PROP_REF:
3189 if (ssa_op->result_def >= 0) {
3190 UPDATE_SSA_TYPE(MAY_BE_REF, ssa_op->result_def);
3191 }
3192 if ((opline+1)->op1_type == IS_CV) {
3193 opline++;
3194 ssa_op++;
3195 UPDATE_SSA_TYPE(MAY_BE_REF, ssa_op->op1_def);
3196 }
3197 break;
3198 case ZEND_BIND_GLOBAL:
3199 tmp = MAY_BE_REF | MAY_BE_ANY
3200 | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3201 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3202 break;
3203 case ZEND_BIND_STATIC:
3204 tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF
3205 | ((opline->extended_value & ZEND_BIND_REF) ? MAY_BE_REF : (MAY_BE_RC1 | MAY_BE_RCN));
3206 if (opline->extended_value & ZEND_BIND_IMPLICIT) {
3207 tmp |= MAY_BE_UNDEF;
3208 }
3209 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3210 break;
3211 case ZEND_SEND_VAR:
3212 if (ssa_op->op1_def >= 0) {
3213 tmp = t1;
3214 if (t1 & (MAY_BE_RC1|MAY_BE_REF)) {
3215 tmp |= MAY_BE_RCN;
3216 }
3217 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3218 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3219 }
3220 break;
3221 case ZEND_BIND_LEXICAL:
3222 if (ssa_op->op2_def >= 0) {
3223 if (opline->extended_value & ZEND_BIND_REF) {
3224 tmp = t2 | MAY_BE_REF;
3225 } else {
3226 tmp = t2 & ~(MAY_BE_RC1|MAY_BE_RCN);
3227 if (t2 & (MAY_BE_RC1|MAY_BE_RCN)) {
3228 tmp |= MAY_BE_RCN;
3229 }
3230 }
3231 UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3232 COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->op2_def);
3233 }
3234 break;
3235 case ZEND_YIELD:
3236 if (ssa_op->op1_def >= 0) {
3237 if (op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE) {
3238 tmp = t1 | MAY_BE_REF;
3239 } else {
3240 tmp = t1 & ~(MAY_BE_RC1|MAY_BE_RCN);
3241 if (t1 & (MAY_BE_RC1|MAY_BE_RCN)) {
3242 tmp |= MAY_BE_RCN;
3243 }
3244 }
3245 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3246 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3247 }
3248 if (ssa_op->result_def >= 0) {
3249 tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF
3250 | MAY_BE_RC1 | MAY_BE_RCN;
3251 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3252 }
3253 break;
3254 case ZEND_SEND_VAR_EX:
3255 case ZEND_SEND_FUNC_ARG:
3256 if (ssa_op->op1_def >= 0) {
3257 tmp = (t1 & MAY_BE_UNDEF)|MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3258 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3259 }
3260 break;
3261 case ZEND_SEND_REF:
3262 if (ssa_op->op1_def >= 0) {
3263 tmp = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3264 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3265 }
3266 break;
3267 case ZEND_SEND_UNPACK:
3268 if (ssa_op->op1_def >= 0) {
3269 tmp = t1;
3270 if (t1 & MAY_BE_ARRAY) {
3271 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3272 if (t1 & MAY_BE_ARRAY_OF_ANY) {
3273 /* SEND_UNPACK may acquire references into the array */
3274 tmp |= MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3275 }
3276 }
3277 if (t1 & MAY_BE_OBJECT) {
3278 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3279 }
3280 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3281 }
3282 break;
3283 case ZEND_FAST_CONCAT:
3284 case ZEND_ROPE_INIT:
3285 case ZEND_ROPE_ADD:
3286 case ZEND_ROPE_END:
3287 UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def);
3288 break;
3289 case ZEND_RECV:
3290 case ZEND_RECV_INIT:
3291 case ZEND_RECV_VARIADIC:
3292 {
3293 /* Typehinting */
3294 zend_arg_info *arg_info = &op_array->arg_info[opline->op1.num-1];
3295
3296 ce = NULL;
3297 tmp = zend_fetch_arg_info_type(script, arg_info, &ce);
3298 if (ZEND_ARG_SEND_MODE(arg_info)) {
3299 tmp |= MAY_BE_REF;
3300 ce = NULL;
3301 }
3302
3303 if (opline->opcode == ZEND_RECV_VARIADIC) {
3304 uint32_t elem_type = tmp & MAY_BE_REF
3305 ? MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF
3306 : (tmp & MAY_BE_ANY) << MAY_BE_ARRAY_SHIFT;
3307 tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|elem_type;
3308 ce = NULL;
3309 }
3310
3311 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3312 if (ce) {
3313 UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3314 } else {
3315 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3316 }
3317 break;
3318 }
3319 case ZEND_DECLARE_ANON_CLASS:
3320 UPDATE_SSA_TYPE(MAY_BE_CLASS, ssa_op->result_def);
3321 if (script && (ce = zend_hash_find_ptr(&script->class_table, Z_STR_P(CRT_CONSTANT(opline->op1)))) != NULL) {
3322 UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def);
3323 }
3324 break;
3325 case ZEND_FETCH_CLASS:
3326 UPDATE_SSA_TYPE(MAY_BE_CLASS, ssa_op->result_def);
3327 if (opline->op2_type == IS_UNUSED) {
3328 switch (opline->op1.num & ZEND_FETCH_CLASS_MASK) {
3329 case ZEND_FETCH_CLASS_SELF:
3330 if (op_array->scope) {
3331 UPDATE_SSA_OBJ_TYPE(op_array->scope, 0, ssa_op->result_def);
3332 } else {
3333 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3334 }
3335 break;
3336 case ZEND_FETCH_CLASS_PARENT:
3337 if (op_array->scope && op_array->scope->parent && (op_array->scope->ce_flags & ZEND_ACC_LINKED)) {
3338 UPDATE_SSA_OBJ_TYPE(op_array->scope->parent, 0, ssa_op->result_def);
3339 } else {
3340 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3341 }
3342 break;
3343 case ZEND_FETCH_CLASS_STATIC:
3344 default:
3345 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3346 break;
3347 }
3348 } else if (opline->op2_type == IS_CONST) {
3349 zval *zv = CRT_CONSTANT(opline->op2);
3350 if (Z_TYPE_P(zv) == IS_STRING) {
3351 ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(zv+1));
3352 UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def);
3353 } else {
3354 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3355 }
3356 } else {
3357 COPY_SSA_OBJ_TYPE(ssa_op->op2_use, ssa_op->result_def);
3358 }
3359 break;
3360 case ZEND_NEW:
3361 tmp = MAY_BE_RC1|MAY_BE_RCN|MAY_BE_OBJECT;
3362 ce = zend_optimizer_get_class_entry_from_op1(script, op_array, opline);
3363 if (ce) {
3364 UPDATE_SSA_OBJ_TYPE(ce, 0, ssa_op->result_def);
3365 } else if ((t1 & MAY_BE_CLASS) && ssa_op->op1_use >= 0 && ssa_var_info[ssa_op->op1_use].ce) {
3366 UPDATE_SSA_OBJ_TYPE(ssa_var_info[ssa_op->op1_use].ce, ssa_var_info[ssa_op->op1_use].is_instanceof, ssa_op->result_def);
3367 } else {
3368 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3369 }
3370 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3371 break;
3372 case ZEND_CLONE:
3373 UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_OBJECT, ssa_op->result_def);
3374 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def);
3375 break;
3376 case ZEND_INIT_ARRAY:
3377 case ZEND_ADD_ARRAY_ELEMENT:
3378 if (ssa_op->op1_def >= 0) {
3379 if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) {
3380 tmp = (MAY_BE_REF | t1) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3381 if (t1 & MAY_BE_UNDEF) {
3382 tmp |= MAY_BE_NULL;
3383 }
3384 } else if ((t1 & (MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_REF) {
3385 tmp = (MAY_BE_REF | t1) & ~(MAY_BE_UNDEF|MAY_BE_RC1|MAY_BE_RCN);
3386 if (t1 & MAY_BE_UNDEF) {
3387 tmp |= MAY_BE_NULL;
3388 }
3389 } else if (t1 & MAY_BE_REF) {
3390 tmp = (MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | t1);
3391 } else {
3392 tmp = t1;
3393 if (t1 & MAY_BE_RC1) {
3394 tmp |= MAY_BE_RCN;
3395 }
3396 }
3397 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3398 }
3399 if (ssa_op->result_def >= 0) {
3400 uint32_t arr_type;
3401 if (opline->opcode == ZEND_INIT_ARRAY) {
3402 arr_type = 0;
3403 } else {
3404 arr_type = RES_USE_INFO();
3405 }
3406 tmp = MAY_BE_RC1|MAY_BE_ARRAY|arr_type;
3407 if (opline->opcode == ZEND_INIT_ARRAY && opline->op1_type == IS_UNUSED) {
3408 tmp |= MAY_BE_ARRAY_EMPTY;
3409 }
3410 if (opline->op1_type != IS_UNUSED
3411 && (opline->op2_type == IS_UNUSED
3412 || (t2 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE|MAY_BE_STRING)))) {
3413 tmp |= assign_dim_array_result_type(arr_type, t2, t1, opline->op2_type);
3414 if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) {
3415 tmp |= MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3416 }
3417 }
3418 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3419 }
3420 break;
3421 case ZEND_ADD_ARRAY_UNPACK:
3422 tmp = ssa_var_info[ssa_op->result_use].type;
3423 ZEND_ASSERT(tmp & MAY_BE_ARRAY);
3424 tmp |= t1 & (MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF);
3425 if (t1 & MAY_BE_OBJECT) {
3426 tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY;
3427 }
3428 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3429 break;
3430 case ZEND_UNSET_CV:
3431 tmp = MAY_BE_UNDEF;
3432 if (!op_array->function_name) {
3433 /* In global scope, we know nothing */
3434 tmp |= MAY_BE_REF;
3435 }
3436 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3437 break;
3438 case ZEND_UNSET_DIM:
3439 case ZEND_UNSET_OBJ:
3440 if (ssa_op->op1_def >= 0) {
3441 UPDATE_SSA_TYPE(t1, ssa_op->op1_def);
3442 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3443 }
3444 break;
3445 case ZEND_FE_RESET_R:
3446 case ZEND_FE_RESET_RW:
3447 if (ssa_op->op1_def >= 0) {
3448 tmp = t1;
3449 if (opline->opcode == ZEND_FE_RESET_RW) {
3450 tmp |= MAY_BE_REF;
3451 } else if (t1 & MAY_BE_RC1) {
3452 tmp |= MAY_BE_RCN;
3453 }
3454 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3455 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3456 }
3457 if (opline->opcode == ZEND_FE_RESET_RW) {
3458 //???
3459 tmp = MAY_BE_REF | (t1 & (MAY_BE_ARRAY | MAY_BE_OBJECT));
3460 } else {
3461 tmp = MAY_BE_RC1 | MAY_BE_RCN | (t1 & (MAY_BE_ARRAY | MAY_BE_OBJECT | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF));
3462 }
3463 /* The result is set to UNDEF for invalid foreach inputs. */
3464 if ((t1 & (MAY_BE_ANY | MAY_BE_UNDEF)) & ~(MAY_BE_ARRAY | MAY_BE_OBJECT)) {
3465 tmp |= MAY_BE_UNDEF;
3466 }
3467 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3468 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->result_def);
3469 break;
3470 case ZEND_FE_FETCH_R:
3471 case ZEND_FE_FETCH_RW:
3472 tmp = 0;
3473 if (opline->op2_type == IS_CV) {
3474 tmp = t2 & MAY_BE_REF;
3475 }
3476 if (t1 & MAY_BE_OBJECT) {
3477 if (opline->opcode == ZEND_FE_FETCH_RW) {
3478 tmp |= MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3479 } else {
3480 tmp |= MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3481 if (opline->op2_type != IS_CV) {
3482 tmp |= MAY_BE_REF;
3483 }
3484 }
3485 }
3486 if (t1 & MAY_BE_ARRAY) {
3487 if (opline->opcode == ZEND_FE_FETCH_RW) {
3488 tmp |= MAY_BE_REF | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3489 } else {
3490 tmp |= ((t1 & MAY_BE_ARRAY_OF_ANY) >> MAY_BE_ARRAY_SHIFT);
3491 if (tmp & MAY_BE_ARRAY) {
3492 tmp |= MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3493 }
3494 if (t1 & MAY_BE_ARRAY_OF_REF) {
3495 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3496 if (opline->op2_type != IS_CV) {
3497 tmp |= MAY_BE_REF;
3498 }
3499 } else if (tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
3500 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3501 }
3502 }
3503 }
3504 UPDATE_SSA_TYPE(tmp, ssa_op->op2_def);
3505 if (ssa_op->result_def >= 0) {
3506 tmp = (ssa_op->result_use >= 0) ? RES_USE_INFO() : 0;
3507 if (t1 & MAY_BE_OBJECT) {
3508 tmp |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3509 }
3510 if (t1 & MAY_BE_ARRAY) {
3511 if (t1 & MAY_BE_ARRAY_KEY_LONG) {
3512 tmp |= MAY_BE_LONG;
3513 }
3514 if (t1 & MAY_BE_ARRAY_KEY_STRING) {
3515 tmp |= MAY_BE_STRING | MAY_BE_RCN;
3516 }
3517 }
3518 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3519 }
3520 break;
3521 case ZEND_FETCH_DIM_R:
3522 case ZEND_FETCH_DIM_IS:
3523 case ZEND_FETCH_DIM_RW:
3524 case ZEND_FETCH_DIM_W:
3525 case ZEND_FETCH_DIM_UNSET:
3526 case ZEND_FETCH_DIM_FUNC_ARG:
3527 case ZEND_FETCH_LIST_R:
3528 case ZEND_FETCH_LIST_W:
3529 if (ssa_op->op1_def >= 0) {
3530 uint32_t key_type = 0;
3531 tmp = t1 & ~(MAY_BE_RC1|MAY_BE_RCN);
3532 if (opline->opcode == ZEND_FETCH_DIM_W ||
3533 opline->opcode == ZEND_FETCH_DIM_RW ||
3534 opline->opcode == ZEND_FETCH_DIM_FUNC_ARG ||
3535 opline->opcode == ZEND_FETCH_LIST_W) {
3536 if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3537 if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) {
3538 tmp &= ~(MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE);
3539 }
3540 tmp |= MAY_BE_ARRAY | MAY_BE_RC1;
3541 }
3542 if (t1 & (MAY_BE_STRING|MAY_BE_ARRAY)) {
3543 tmp |= MAY_BE_RC1;
3544 if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG) {
3545 tmp |= t1 & MAY_BE_RCN;
3546 }
3547 }
3548 if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
3549 tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN);
3550 }
3551 if (opline->op2_type == IS_UNUSED) {
3552 if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3553 key_type |= MAY_BE_ARRAY_PACKED;
3554 }
3555 if (t1 & MAY_BE_ARRAY) {
3556 key_type |= MAY_BE_HASH_ONLY(t1) ?
3557 MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
3558 }
3559 } else {
3560 if (t2 & (MAY_BE_LONG|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_RESOURCE|MAY_BE_DOUBLE)) {
3561 if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3562 key_type |= MAY_BE_ARRAY_PACKED;
3563 }
3564 if (t1 & MAY_BE_ARRAY) {
3565 key_type |= MAY_BE_HASH_ONLY(t1) ?
3566 MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
3567 }
3568 }
3569 if (t2 & MAY_BE_STRING) {
3570 key_type |= MAY_BE_ARRAY_KEY_STRING;
3571 if (opline->op2_type != IS_CONST) {
3572 // FIXME: numeric string
3573 if (t1 & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE)) {
3574 key_type |= MAY_BE_ARRAY_PACKED;
3575 }
3576 if (t1 & MAY_BE_ARRAY) {
3577 key_type |= MAY_BE_HASH_ONLY(t1) ?
3578 MAY_BE_ARRAY_NUMERIC_HASH : MAY_BE_ARRAY_KEY_LONG;
3579 }
3580 }
3581 }
3582 if (t2 & (MAY_BE_UNDEF | MAY_BE_NULL)) {
3583 key_type |= MAY_BE_ARRAY_KEY_STRING;
3584 }
3585 }
3586 } else if (opline->opcode == ZEND_FETCH_DIM_UNSET) {
3587 if (t1 & MAY_BE_ARRAY) {
3588 tmp |= MAY_BE_RC1;
3589 }
3590 if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE)) {
3591 tmp |= t1 & (MAY_BE_RC1|MAY_BE_RCN);
3592 }
3593 }
3594 if ((key_type & (MAY_BE_ARRAY_KEY_LONG|MAY_BE_ARRAY_KEY_STRING))
3595 && (opline->opcode == ZEND_FETCH_DIM_RW
3596 || opline->opcode == ZEND_FETCH_DIM_W
3597 || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG
3598 || opline->opcode == ZEND_FETCH_LIST_W)) {
3599 j = ssa_vars[ssa_op->result_def].use_chain;
3600 if (j < 0) {
3601 /* no uses */
3602 tmp |= key_type | MAY_BE_ARRAY | MAY_BE_ARRAY_OF_NULL;
3603 }
3604 while (j >= 0) {
3605 zend_uchar opcode;
3606
3607 if (!ssa_opcodes) {
3608 if (j != (opline - op_array->opcodes) + 1) {
3609 /* Use must be in next opline */
3610 tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3611 break;
3612 }
3613 opcode = op_array->opcodes[j].opcode;
3614 } else {
3615 if (ssa_opcodes[j] != opline + 1) {
3616 /* Use must be in next opline */
3617 tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3618 break;
3619 }
3620 opcode = ssa_opcodes[j]->opcode;
3621 }
3622 switch (opcode) {
3623 case ZEND_FETCH_DIM_W:
3624 case ZEND_FETCH_DIM_RW:
3625 case ZEND_FETCH_DIM_FUNC_ARG:
3626 case ZEND_FETCH_LIST_W:
3627 case ZEND_ASSIGN_DIM:
3628 case ZEND_ASSIGN_DIM_OP:
3629 tmp |= key_type | MAY_BE_ARRAY | MAY_BE_ARRAY_OF_ARRAY;
3630 break;
3631 case ZEND_SEND_VAR_EX:
3632 case ZEND_SEND_FUNC_ARG:
3633 case ZEND_SEND_VAR_NO_REF:
3634 case ZEND_SEND_VAR_NO_REF_EX:
3635 case ZEND_SEND_REF:
3636 case ZEND_ASSIGN_REF:
3637 case ZEND_YIELD:
3638 case ZEND_INIT_ARRAY:
3639 case ZEND_ADD_ARRAY_ELEMENT:
3640 case ZEND_RETURN_BY_REF:
3641 case ZEND_VERIFY_RETURN_TYPE:
3642 case ZEND_MAKE_REF:
3643 case ZEND_FE_RESET_RW:
3644 tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3645 break;
3646 case ZEND_PRE_INC:
3647 case ZEND_PRE_DEC:
3648 case ZEND_POST_INC:
3649 case ZEND_POST_DEC:
3650 if (tmp & MAY_BE_ARRAY_OF_LONG) {
3651 /* may overflow */
3652 tmp |= key_type | MAY_BE_ARRAY_OF_DOUBLE;
3653 } else if (!(tmp & (MAY_BE_ARRAY_OF_LONG|MAY_BE_ARRAY_OF_DOUBLE))) {
3654 tmp |= key_type | MAY_BE_ARRAY_OF_LONG | MAY_BE_ARRAY_OF_DOUBLE;
3655 }
3656 break;
3657 case ZEND_FETCH_OBJ_W:
3658 case ZEND_FETCH_OBJ_RW:
3659 case ZEND_FETCH_OBJ_FUNC_ARG:
3660 case ZEND_ASSIGN_OBJ:
3661 case ZEND_ASSIGN_OBJ_OP:
3662 case ZEND_ASSIGN_OBJ_REF:
3663 case ZEND_PRE_INC_OBJ:
3664 case ZEND_PRE_DEC_OBJ:
3665 case ZEND_POST_INC_OBJ:
3666 case ZEND_POST_DEC_OBJ:
3667 /* These will result in an error exception, unless the element
3668 * is already an object. */
3669 break;
3670 case ZEND_SEND_VAR:
3671 case ZEND_FETCH_DIM_R:
3672 /* This can occur if a DIM_FETCH_FUNC_ARG with UNUSED op2 is left
3673 * behind, because it can't be converted to DIM_FETCH_R. */
3674 break;
3675 case ZEND_FREE:
3676 /* This may happen if the using opcode is DCEd. */
3677 break;
3678 EMPTY_SWITCH_DEFAULT_CASE()
3679 }
3680 j = zend_ssa_next_use(ssa->ops, ssa_op->result_def, j);
3681 if (j >= 0) {
3682 tmp |= key_type | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3683 break;
3684 }
3685 }
3686 if (opline->opcode != ZEND_FETCH_DIM_FUNC_ARG) {
3687 tmp &= ~MAY_BE_ARRAY_EMPTY;
3688 }
3689 }
3690 if (!(tmp & MAY_BE_ARRAY)
3691 || (tmp & MAY_BE_ARRAY_KEY_ANY)
3692 || opline->opcode == ZEND_FETCH_DIM_FUNC_ARG
3693 || opline->opcode == ZEND_FETCH_DIM_R
3694 || opline->opcode == ZEND_FETCH_DIM_IS
3695 || opline->opcode == ZEND_FETCH_DIM_UNSET
3696 || opline->opcode == ZEND_FETCH_LIST_R) {
3697 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3698 } else {
3699 /* invalid key type */
3700 return SUCCESS;
3701 }
3702 COPY_SSA_OBJ_TYPE(ssa_op->op1_use, ssa_op->op1_def);
3703 }
3704 /* FETCH_LIST on a string behaves like FETCH_R on null */
3705 tmp = zend_array_element_type(
3706 opline->opcode != ZEND_FETCH_LIST_R ? t1 : ((t1 & ~MAY_BE_STRING) | MAY_BE_NULL),
3707 opline->op1_type,
3708 opline->opcode != ZEND_FETCH_DIM_R && opline->opcode != ZEND_FETCH_DIM_IS
3709 && opline->opcode != ZEND_FETCH_LIST_R,
3710 opline->op2_type == IS_UNUSED);
3711 if (opline->opcode == ZEND_FETCH_DIM_FUNC_ARG && (t1 & (MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_RESOURCE))) {
3712 tmp |= MAY_BE_NULL;
3713 }
3714 if (opline->opcode == ZEND_FETCH_DIM_IS && (t1 & MAY_BE_STRING)) {
3715 tmp |= MAY_BE_NULL;
3716 }
3717 if ((tmp & (MAY_BE_RC1|MAY_BE_RCN)) == MAY_BE_RCN && opline->result_type == IS_TMP_VAR) {
3718 /* refcount may be indirectly decremented. Make an exception if the result is used in the next instruction */
3719 if (!ssa_opcodes) {
3720 if (ssa->vars[ssa_op->result_def].use_chain < 0
3721 || opline + 1 != op_array->opcodes + ssa->vars[ssa_op->result_def].use_chain) {
3722 tmp |= MAY_BE_RC1;
3723 }
3724 } else {
3725 if (ssa->vars[ssa_op->result_def].use_chain < 0
3726 || opline + 1 != ssa_opcodes[ssa->vars[ssa_op->result_def].use_chain]) {
3727 tmp |= MAY_BE_RC1;
3728 }
3729 }
3730 }
3731 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3732 break;
3733 case ZEND_FETCH_THIS:
3734 if (!(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
3735 UPDATE_SSA_OBJ_TYPE(op_array->scope, 1, ssa_op->result_def);
3736 }
3737 UPDATE_SSA_TYPE(MAY_BE_RCN|MAY_BE_OBJECT, ssa_op->result_def);
3738 break;
3739 case ZEND_FETCH_OBJ_R:
3740 case ZEND_FETCH_OBJ_IS:
3741 case ZEND_FETCH_OBJ_RW:
3742 case ZEND_FETCH_OBJ_W:
3743 case ZEND_FETCH_OBJ_UNSET:
3744 case ZEND_FETCH_OBJ_FUNC_ARG:
3745 if (ssa_op->result_def >= 0) {
3746 uint32_t tmp = 0;
3747 ce = NULL;
3748 if (opline->op1_type != IS_UNUSED
3749 && (t1 & (MAY_BE_ANY | MAY_BE_UNDEF) & ~MAY_BE_OBJECT)) {
3750 tmp |= MAY_BE_NULL;
3751 }
3752 if (opline->op1_type == IS_UNUSED || (t1 & MAY_BE_OBJECT)) {
3753 zend_property_info *prop_info = zend_fetch_prop_info(op_array, ssa, opline, ssa_op);
3754 tmp |= zend_fetch_prop_type(script, prop_info, &ce);
3755 if (opline->opcode != ZEND_FETCH_OBJ_R && opline->opcode != ZEND_FETCH_OBJ_IS) {
3756 tmp |= MAY_BE_REF | MAY_BE_INDIRECT;
3757 if ((opline->extended_value & ZEND_FETCH_OBJ_FLAGS) == ZEND_FETCH_DIM_WRITE) {
3758 tmp |= MAY_BE_UNDEF;
3759 }
3760 ce = NULL;
3761 } else if (!(opline->op1_type & (IS_VAR|IS_TMP_VAR)) || !(t1 & MAY_BE_RC1)) {
3762 zend_class_entry *ce = NULL;
3763
3764 if (opline->op1_type == IS_UNUSED) {
3765 ce = op_array->scope;
3766 } else if (ssa_op->op1_use >= 0 && !ssa->var_info[ssa_op->op1_use].is_instanceof) {
3767 ce = ssa->var_info[ssa_op->op1_use].ce;
3768 }
3769 /* Unset properties will resort back to __get/__set */
3770 if (ce
3771 && !ce->create_object
3772 && !ce->__get
3773 && !result_may_be_separated(ssa, ssa_op)) {
3774 tmp &= ~MAY_BE_RC1;
3775 }
3776 if (opline->opcode == ZEND_FETCH_OBJ_IS) {
3777 /* IS check may return null for uninitialized typed property. */
3778 tmp |= MAY_BE_NULL;
3779 }
3780 }
3781 }
3782 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3783 if (ce) {
3784 UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3785 }
3786 }
3787 break;
3788 case ZEND_FETCH_STATIC_PROP_R:
3789 case ZEND_FETCH_STATIC_PROP_IS:
3790 case ZEND_FETCH_STATIC_PROP_RW:
3791 case ZEND_FETCH_STATIC_PROP_W:
3792 case ZEND_FETCH_STATIC_PROP_UNSET:
3793 case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
3794 tmp = zend_fetch_prop_type(script,
3795 zend_fetch_static_prop_info(script, op_array, ssa, opline), &ce);
3796 if (opline->opcode != ZEND_FETCH_STATIC_PROP_R
3797 && opline->opcode != ZEND_FETCH_STATIC_PROP_IS) {
3798 tmp |= MAY_BE_REF | MAY_BE_INDIRECT;
3799 if ((opline->extended_value & ZEND_FETCH_OBJ_FLAGS) == ZEND_FETCH_DIM_WRITE) {
3800 tmp |= MAY_BE_UNDEF;
3801 }
3802 ce = NULL;
3803 } else {
3804 if (!result_may_be_separated(ssa, ssa_op)) {
3805 tmp &= ~MAY_BE_RC1;
3806 }
3807 if (opline->opcode == ZEND_FETCH_STATIC_PROP_IS) {
3808 tmp |= MAY_BE_UNDEF;
3809 }
3810 }
3811 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3812 if (ce) {
3813 UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3814 }
3815 break;
3816 case ZEND_DO_FCALL:
3817 case ZEND_DO_ICALL:
3818 case ZEND_DO_UCALL:
3819 case ZEND_DO_FCALL_BY_NAME:
3820 if (ssa_op->result_def >= 0) {
3821 zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
3822 zend_call_info *call_info;
3823
3824 if (!func_info || !func_info->call_map) {
3825 goto unknown_opcode;
3826 }
3827 call_info = func_info->call_map[opline - op_array->opcodes];
3828 if (!call_info) {
3829 goto unknown_opcode;
3830 }
3831
3832 zend_class_entry *ce;
3833 bool ce_is_instanceof;
3834 tmp = zend_get_func_info(call_info, ssa, &ce, &ce_is_instanceof);
3835 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3836 if (ce) {
3837 UPDATE_SSA_OBJ_TYPE(ce, ce_is_instanceof, ssa_op->result_def);
3838 }
3839 }
3840 break;
3841 case ZEND_CALLABLE_CONVERT:
3842 UPDATE_SSA_TYPE(MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN, ssa_op->result_def);
3843 UPDATE_SSA_OBJ_TYPE(zend_ce_closure, /* is_instanceof */ false, ssa_op->result_def);
3844 break;
3845 case ZEND_FETCH_CONSTANT:
3846 case ZEND_FETCH_CLASS_CONSTANT:
3847 UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def);
3848 break;
3849 case ZEND_STRLEN:
3850 tmp = MAY_BE_LONG;
3851 if (t1 & (MAY_BE_ANY - (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING))) {
3852 tmp |= MAY_BE_NULL;
3853 }
3854 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3855 break;
3856 case ZEND_COUNT:
3857 case ZEND_FUNC_NUM_ARGS:
3858 UPDATE_SSA_TYPE(MAY_BE_LONG, ssa_op->result_def);
3859 break;
3860 case ZEND_FUNC_GET_ARGS:
3861 UPDATE_SSA_TYPE(MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ARRAY|MAY_BE_ARRAY_EMPTY|MAY_BE_ARRAY_PACKED|MAY_BE_ARRAY_OF_ANY, ssa_op->result_def);
3862 break;
3863 case ZEND_GET_CLASS:
3864 case ZEND_GET_CALLED_CLASS:
3865 UPDATE_SSA_TYPE(MAY_BE_FALSE|MAY_BE_STRING|MAY_BE_RCN, ssa_op->result_def);
3866 break;
3867 case ZEND_GET_TYPE:
3868 UPDATE_SSA_TYPE(MAY_BE_STRING|MAY_BE_RC1|MAY_BE_RCN, ssa_op->result_def);
3869 break;
3870 case ZEND_TYPE_CHECK: {
3871 uint32_t expected_type_mask = opline->extended_value;
3872 if (t1 & MAY_BE_UNDEF) {
3873 t1 |= MAY_BE_NULL;
3874 }
3875 tmp = 0;
3876 if (t1 & expected_type_mask) {
3877 tmp |= MAY_BE_TRUE;
3878 if ((t1 & expected_type_mask) & MAY_BE_RESOURCE) {
3879 tmp |= MAY_BE_FALSE;
3880 }
3881 }
3882 if (t1 & (MAY_BE_ANY - expected_type_mask)) {
3883 tmp |= MAY_BE_FALSE;
3884 }
3885 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3886 break;
3887 }
3888 case ZEND_DEFINED:
3889 UPDATE_SSA_TYPE(MAY_BE_FALSE|MAY_BE_TRUE, ssa_op->result_def);
3890 break;
3891 case ZEND_VERIFY_RETURN_TYPE:
3892 if (t1 & MAY_BE_REF) {
3893 tmp = t1;
3894 ce = NULL;
3895 } else {
3896 zend_arg_info *ret_info = op_array->arg_info - 1;
3897 tmp = zend_fetch_arg_info_type(script, ret_info, &ce);
3898 tmp |= (t1 & MAY_BE_INDIRECT);
3899
3900 // TODO: We could model more precisely how illegal types are converted.
3901 uint32_t extra_types = t1 & ~tmp;
3902 if (!extra_types) {
3903 tmp &= t1;
3904 }
3905 }
3906 if (opline->op1_type & (IS_TMP_VAR|IS_VAR|IS_CV)) {
3907 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3908 if (ce) {
3909 UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->op1_def);
3910 } else {
3911 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->op1_def);
3912 }
3913 } else {
3914 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3915 if (ce) {
3916 UPDATE_SSA_OBJ_TYPE(ce, 1, ssa_op->result_def);
3917 } else {
3918 UPDATE_SSA_OBJ_TYPE(NULL, 0, ssa_op->result_def);
3919 }
3920 }
3921 break;
3922 case ZEND_MAKE_REF:
3923 tmp = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN|MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
3924 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3925 if (ssa_op->op1_def >= 0) {
3926 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3927 }
3928 break;
3929 case ZEND_CATCH:
3930 /* Forbidden opcodes */
3931 ZEND_UNREACHABLE();
3932 break;
3933 default:
3934 unknown_opcode:
3935 if (ssa_op->op1_def >= 0) {
3936 tmp = MAY_BE_ANY | MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3937 UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
3938 }
3939 if (ssa_op->result_def >= 0) {
3940 tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
3941 if (opline->result_type == IS_TMP_VAR) {
3942 if (opline->opcode == ZEND_FETCH_R || opline->opcode == ZEND_FETCH_IS) {
3943 /* Variable reference counter may be decremented before use */
3944 /* See: ext/opcache/tests/jit/fetch_r_001.phpt */
3945 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3946 } else {
3947 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3948 }
3949 } else if (opline->result_type == IS_CV) {
3950 tmp |= MAY_BE_RC1 | MAY_BE_RCN;
3951 } else {
3952 tmp |= MAY_BE_REF | MAY_BE_RC1 | MAY_BE_RCN;
3953 switch (opline->opcode) {
3954 case ZEND_FETCH_W:
3955 case ZEND_FETCH_RW:
3956 case ZEND_FETCH_FUNC_ARG:
3957 case ZEND_FETCH_UNSET:
3958 case ZEND_FETCH_DIM_W:
3959 case ZEND_FETCH_DIM_RW:
3960 case ZEND_FETCH_DIM_FUNC_ARG:
3961 case ZEND_FETCH_DIM_UNSET:
3962 case ZEND_FETCH_OBJ_W:
3963 case ZEND_FETCH_OBJ_RW:
3964 case ZEND_FETCH_OBJ_FUNC_ARG:
3965 case ZEND_FETCH_OBJ_UNSET:
3966 case ZEND_FETCH_STATIC_PROP_W:
3967 case ZEND_FETCH_STATIC_PROP_RW:
3968 case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
3969 case ZEND_FETCH_STATIC_PROP_UNSET:
3970 tmp |= MAY_BE_INDIRECT;
3971 break;
3972 }
3973 }
3974 UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
3975 }
3976 break;
3977 }
3978
3979 return SUCCESS;
3980 }
3981
zend_update_type_info(const zend_op_array * op_array,zend_ssa * ssa,const zend_script * script,zend_op * opline,zend_ssa_op * ssa_op,const zend_op ** ssa_opcodes,zend_long optimization_level)3982 ZEND_API zend_result zend_update_type_info(
3983 const zend_op_array *op_array,
3984 zend_ssa *ssa,
3985 const zend_script *script,
3986 zend_op *opline,
3987 zend_ssa_op *ssa_op,
3988 const zend_op **ssa_opcodes,
3989 zend_long optimization_level)
3990 {
3991 return _zend_update_type_info(op_array, ssa, script, NULL, opline, ssa_op, ssa_opcodes, optimization_level, 0);
3992 }
3993
get_class_entry_rank(zend_class_entry * ce)3994 static uint32_t get_class_entry_rank(zend_class_entry *ce) {
3995 uint32_t rank = 0;
3996 if (ce->ce_flags & ZEND_ACC_LINKED) {
3997 while (ce->parent) {
3998 rank++;
3999 ce = ce->parent;
4000 }
4001 }
4002 return rank;
4003 }
4004
4005 /* Compute least common ancestor on class inheritance tree only */
join_class_entries(zend_class_entry * ce1,zend_class_entry * ce2,int * is_instanceof)4006 static zend_class_entry *join_class_entries(
4007 zend_class_entry *ce1, zend_class_entry *ce2, int *is_instanceof) {
4008 uint32_t rank1, rank2;
4009 if (ce1 == ce2) {
4010 return ce1;
4011 }
4012 if (!ce1 || !ce2) {
4013 return NULL;
4014 }
4015
4016 rank1 = get_class_entry_rank(ce1);
4017 rank2 = get_class_entry_rank(ce2);
4018
4019 while (rank1 != rank2) {
4020 if (rank1 > rank2) {
4021 ce1 = !(ce1->ce_flags & ZEND_ACC_LINKED) ? NULL : ce1->parent;
4022 rank1--;
4023 } else {
4024 ce2 = !(ce2->ce_flags & ZEND_ACC_LINKED) ? NULL : ce2->parent;
4025 rank2--;
4026 }
4027 }
4028
4029 while (ce1 != ce2) {
4030 ce1 = !(ce1->ce_flags & ZEND_ACC_LINKED) ? NULL : ce1->parent;
4031 ce2 = !(ce2->ce_flags & ZEND_ACC_LINKED) ? NULL : ce2->parent;
4032 }
4033
4034 if (ce1) {
4035 *is_instanceof = 1;
4036 }
4037 return ce1;
4038 }
4039
safe_instanceof(zend_class_entry * ce1,zend_class_entry * ce2)4040 static bool safe_instanceof(zend_class_entry *ce1, zend_class_entry *ce2) {
4041 if (ce1 == ce2) {
4042 return 1;
4043 }
4044 if (!(ce1->ce_flags & ZEND_ACC_LINKED)) {
4045 /* This case could be generalized, similarly to unlinked_instanceof */
4046 return 0;
4047 }
4048 return instanceof_function(ce1, ce2);
4049 }
4050
zend_infer_types_ex(const zend_op_array * op_array,const zend_script * script,zend_ssa * ssa,zend_bitset worklist,zend_long optimization_level)4051 static zend_result zend_infer_types_ex(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_bitset worklist, zend_long optimization_level)
4052 {
4053 zend_basic_block *blocks = ssa->cfg.blocks;
4054 zend_ssa_var *ssa_vars = ssa->vars;
4055 zend_ssa_var_info *ssa_var_info = ssa->var_info;
4056 int ssa_vars_count = ssa->vars_count;
4057 int i, j;
4058 uint32_t tmp, worklist_len = zend_bitset_len(ssa_vars_count);
4059 bool update_worklist = 1;
4060 const zend_op **ssa_opcodes = NULL;
4061
4062 while (!zend_bitset_empty(worklist, worklist_len)) {
4063 j = zend_bitset_first(worklist, worklist_len);
4064 zend_bitset_excl(worklist, j);
4065 if (ssa_vars[j].definition_phi) {
4066 zend_ssa_phi *p = ssa_vars[j].definition_phi;
4067 if (p->pi >= 0) {
4068 zend_class_entry *ce = ssa_var_info[p->sources[0]].ce;
4069 int is_instanceof = ssa_var_info[p->sources[0]].is_instanceof;
4070 tmp = get_ssa_var_info(ssa, p->sources[0]);
4071
4072 if (!p->has_range_constraint) {
4073 zend_ssa_type_constraint *constraint = &p->constraint.type;
4074 tmp &= constraint->type_mask;
4075 if (!(tmp & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
4076 tmp &= ~(MAY_BE_RC1|MAY_BE_RCN);
4077 }
4078 if ((tmp & MAY_BE_OBJECT) && constraint->ce && ce != constraint->ce) {
4079 if (!ce) {
4080 ce = constraint->ce;
4081 is_instanceof = 1;
4082 } else if (is_instanceof && safe_instanceof(constraint->ce, ce)) {
4083 ce = constraint->ce;
4084 } else {
4085 /* Ignore the constraint (either ce instanceof constraint->ce or
4086 * they are unrelated, as far as we can statically determine) */
4087 }
4088 }
4089 }
4090
4091 UPDATE_SSA_TYPE(tmp, j);
4092 if (tmp & MAY_BE_REF) {
4093 UPDATE_SSA_OBJ_TYPE(NULL, 0, j);
4094 } else {
4095 UPDATE_SSA_OBJ_TYPE(ce, is_instanceof, j);
4096 }
4097 } else {
4098 int first = 1;
4099 int is_instanceof = 0;
4100 zend_class_entry *ce = NULL;
4101
4102 tmp = 0;
4103 for (i = 0; i < blocks[p->block].predecessors_count; i++) {
4104 tmp |= get_ssa_var_info(ssa, p->sources[i]);
4105 }
4106 UPDATE_SSA_TYPE(tmp, j);
4107 for (i = 0; i < blocks[p->block].predecessors_count; i++) {
4108 zend_ssa_var_info *info;
4109
4110 ZEND_ASSERT(p->sources[i] >= 0);
4111 info = &ssa_var_info[p->sources[i]];
4112 if (info->type & MAY_BE_OBJECT) {
4113 if (first) {
4114 ce = info->ce;
4115 is_instanceof = info->is_instanceof;
4116 first = 0;
4117 } else {
4118 is_instanceof |= info->is_instanceof;
4119 ce = join_class_entries(ce, info->ce, &is_instanceof);
4120 }
4121 }
4122 }
4123 UPDATE_SSA_OBJ_TYPE(ce, ce ? is_instanceof : 0, j);
4124 }
4125 } else if (ssa_vars[j].definition >= 0) {
4126 i = ssa_vars[j].definition;
4127 if (_zend_update_type_info(op_array, ssa, script, worklist, op_array->opcodes + i, ssa->ops + i, NULL, optimization_level, 1) == FAILURE) {
4128 return FAILURE;
4129 }
4130 }
4131 }
4132 return SUCCESS;
4133 }
4134
is_narrowable_instr(zend_op * opline)4135 static bool is_narrowable_instr(zend_op *opline) {
4136 return opline->opcode == ZEND_ADD || opline->opcode == ZEND_SUB
4137 || opline->opcode == ZEND_MUL || opline->opcode == ZEND_DIV;
4138 }
4139
is_effective_op1_double_cast(zend_op * opline,zval * op2)4140 static bool is_effective_op1_double_cast(zend_op *opline, zval *op2) {
4141 return (opline->opcode == ZEND_ADD && Z_LVAL_P(op2) == 0)
4142 || (opline->opcode == ZEND_SUB && Z_LVAL_P(op2) == 0)
4143 || (opline->opcode == ZEND_MUL && Z_LVAL_P(op2) == 1)
4144 || (opline->opcode == ZEND_DIV && Z_LVAL_P(op2) == 1);
4145 }
is_effective_op2_double_cast(zend_op * opline,zval * op1)4146 static bool is_effective_op2_double_cast(zend_op *opline, zval *op1) {
4147 /* In PHP it holds that (double)(0-$int) is bitwise identical to 0.0-(double)$int,
4148 * so allowing SUB here is fine. */
4149 return (opline->opcode == ZEND_ADD && Z_LVAL_P(op1) == 0)
4150 || (opline->opcode == ZEND_SUB && Z_LVAL_P(op1) == 0)
4151 || (opline->opcode == ZEND_MUL && Z_LVAL_P(op1) == 1);
4152 }
4153
4154 /* This function recursively checks whether it's possible to convert an integer variable
4155 * initialization to a double initialization. The basic idea is that if the value is used
4156 * only in add/sub/mul/div ("narrowable" instructions) with a double result value, then it
4157 * will be cast to double at that point anyway, so we may as well do it earlier already.
4158 *
4159 * The tricky case are chains of operations, where it's not necessarily a given that converting
4160 * an integer to double before the chain of operations is the same as converting it after the
4161 * chain. What this function does is detect two cases where it is safe:
4162 * * If the operations only involve constants, then we can simply verify that performing the
4163 * calculation on integers and doubles yields the same value.
4164 * * Even if one operand is not known, we may be able to determine that the operations with the
4165 * integer replaced by a double only acts as an effective double cast on the unknown operand.
4166 * E.g. 0+$i and 0.0+$i only differ by that cast. If then the consuming instruction of this
4167 * result will perform a double cast anyway, the conversion is safe.
4168 *
4169 * The checks happens recursively, while keeping track of which variables are already visited to
4170 * avoid infinite loops. An iterative, worklist driven approach would be possible, but the state
4171 * management more cumbersome to implement, so we don't bother for now.
4172 */
can_convert_to_double(const zend_op_array * op_array,zend_ssa * ssa,int var_num,zval * value,zend_bitset visited)4173 static bool can_convert_to_double(
4174 const zend_op_array *op_array, zend_ssa *ssa, int var_num,
4175 zval *value, zend_bitset visited) {
4176 zend_ssa_var *var = &ssa->vars[var_num];
4177 zend_ssa_phi *phi;
4178 int use;
4179 uint32_t type;
4180
4181 if (zend_bitset_in(visited, var_num)) {
4182 return 1;
4183 }
4184 zend_bitset_incl(visited, var_num);
4185
4186 for (use = var->use_chain; use >= 0; use = zend_ssa_next_use(ssa->ops, var_num, use)) {
4187 zend_op *opline = &op_array->opcodes[use];
4188 zend_ssa_op *ssa_op = &ssa->ops[use];
4189
4190 if (zend_ssa_is_no_val_use(opline, ssa_op, var_num)) {
4191 continue;
4192 }
4193
4194 if (!is_narrowable_instr(opline)) {
4195 return 0;
4196 }
4197
4198 /* Instruction always returns double, the conversion is certainly fine */
4199 type = ssa->var_info[ssa_op->result_def].type;
4200 if ((type & MAY_BE_ANY) == MAY_BE_DOUBLE) {
4201 continue;
4202 }
4203
4204 /* UNDEF signals that the previous result is an effective double cast, this is only allowed
4205 * if this instruction would have done the cast anyway (previous check). */
4206 if (Z_ISUNDEF_P(value)) {
4207 return 0;
4208 }
4209
4210 /* Check that narrowing can actually be useful */
4211 if ((type & MAY_BE_ANY) & ~(MAY_BE_LONG|MAY_BE_DOUBLE)) {
4212 return 0;
4213 }
4214
4215 {
4216 /* For calculation on original values */
4217 zval orig_op1, orig_op2, orig_result;
4218 /* For calculation with var_num cast to double */
4219 zval dval_op1, dval_op2, dval_result;
4220
4221 ZVAL_UNDEF(&orig_op1);
4222 ZVAL_UNDEF(&dval_op1);
4223 if (ssa_op->op1_use == var_num) {
4224 ZVAL_COPY_VALUE(&orig_op1, value);
4225 ZVAL_DOUBLE(&dval_op1, (double) Z_LVAL_P(value));
4226 } else if (opline->op1_type == IS_CONST) {
4227 zval *zv = CRT_CONSTANT(opline->op1);
4228 if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_DOUBLE) {
4229 ZVAL_COPY_VALUE(&orig_op1, zv);
4230 ZVAL_COPY_VALUE(&dval_op1, zv);
4231 }
4232 }
4233
4234 ZVAL_UNDEF(&orig_op2);
4235 ZVAL_UNDEF(&dval_op2);
4236 if (ssa_op->op2_use == var_num) {
4237 ZVAL_COPY_VALUE(&orig_op2, value);
4238 ZVAL_DOUBLE(&dval_op2, (double) Z_LVAL_P(value));
4239 } else if (opline->op2_type == IS_CONST) {
4240 zval *zv = CRT_CONSTANT(opline->op2);
4241 if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_DOUBLE) {
4242 ZVAL_COPY_VALUE(&orig_op2, zv);
4243 ZVAL_COPY_VALUE(&dval_op2, zv);
4244 }
4245 }
4246
4247 ZEND_ASSERT(!Z_ISUNDEF(orig_op1) || !Z_ISUNDEF(orig_op2));
4248 if (Z_ISUNDEF(orig_op1)) {
4249 if (opline->opcode == ZEND_MUL && Z_LVAL(orig_op2) == 0) {
4250 ZVAL_LONG(&orig_result, 0);
4251 } else if (is_effective_op1_double_cast(opline, &orig_op2)) {
4252 ZVAL_UNDEF(&orig_result);
4253 } else {
4254 return 0;
4255 }
4256 } else if (Z_ISUNDEF(orig_op2)) {
4257 if (opline->opcode == ZEND_MUL && Z_LVAL(orig_op1) == 0) {
4258 ZVAL_LONG(&orig_result, 0);
4259 } else if (is_effective_op2_double_cast(opline, &orig_op1)) {
4260 ZVAL_UNDEF(&orig_result);
4261 } else {
4262 return 0;
4263 }
4264 } else {
4265 zend_uchar opcode = opline->opcode;
4266
4267 if (opcode == ZEND_ASSIGN_OP) {
4268 opcode = opline->extended_value;
4269 }
4270
4271 /* Avoid division by zero */
4272 if (opcode == ZEND_DIV && zval_get_double(&orig_op2) == 0.0) {
4273 return 0;
4274 }
4275
4276 get_binary_op(opcode)(&orig_result, &orig_op1, &orig_op2);
4277 get_binary_op(opcode)(&dval_result, &dval_op1, &dval_op2);
4278 ZEND_ASSERT(Z_TYPE(dval_result) == IS_DOUBLE);
4279 if (zval_get_double(&orig_result) != Z_DVAL(dval_result)) {
4280 return 0;
4281 }
4282 }
4283
4284 if (!can_convert_to_double(op_array, ssa, ssa_op->result_def, &orig_result, visited)) {
4285 return 0;
4286 }
4287 }
4288 }
4289
4290 for (phi = var->phi_use_chain; phi; phi = zend_ssa_next_use_phi(ssa, var_num, phi)) {
4291 /* Check that narrowing can actually be useful */
4292 type = ssa->var_info[phi->ssa_var].type;
4293 if ((type & MAY_BE_ANY) & ~(MAY_BE_LONG|MAY_BE_DOUBLE)) {
4294 return 0;
4295 }
4296
4297 if (!can_convert_to_double(op_array, ssa, phi->ssa_var, value, visited)) {
4298 return 0;
4299 }
4300 }
4301
4302 return 1;
4303 }
4304
zend_type_narrowing(const zend_op_array * op_array,const zend_script * script,zend_ssa * ssa,zend_long optimization_level)4305 static zend_result zend_type_narrowing(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level)
4306 {
4307 uint32_t bitset_len = zend_bitset_len(ssa->vars_count);
4308 zend_bitset visited, worklist;
4309 int i, v;
4310 zend_op *opline;
4311 bool narrowed = 0;
4312 ALLOCA_FLAG(use_heap)
4313
4314 visited = ZEND_BITSET_ALLOCA(2 * bitset_len, use_heap);
4315 worklist = visited + bitset_len;
4316
4317 zend_bitset_clear(worklist, bitset_len);
4318
4319 for (v = op_array->last_var; v < ssa->vars_count; v++) {
4320 if ((ssa->var_info[v].type & (MAY_BE_REF | MAY_BE_ANY | MAY_BE_UNDEF)) != MAY_BE_LONG) continue;
4321 if (ssa->vars[v].definition < 0) continue;
4322 if (ssa->vars[v].no_val) continue;
4323 opline = op_array->opcodes + ssa->vars[v].definition;
4324 /* Go through assignments of literal integers and check if they can be converted to
4325 * doubles instead, in the hope that we'll narrow long|double to double. */
4326 if (opline->opcode == ZEND_ASSIGN && opline->result_type == IS_UNUSED &&
4327 opline->op1_type == IS_CV && opline->op2_type == IS_CONST) {
4328 zval *value = CRT_CONSTANT(opline->op2);
4329
4330 zend_bitset_clear(visited, bitset_len);
4331 if (can_convert_to_double(op_array, ssa, v, value, visited)) {
4332 narrowed = 1;
4333 ssa->var_info[v].use_as_double = 1;
4334 /* The "visited" vars are exactly those which may change their type due to
4335 * narrowing. Reset their types and add them to the type inference worklist */
4336 ZEND_BITSET_FOREACH(visited, bitset_len, i) {
4337 ssa->var_info[i].type &= ~MAY_BE_ANY;
4338 } ZEND_BITSET_FOREACH_END();
4339 zend_bitset_union(worklist, visited, bitset_len);
4340 }
4341 }
4342 }
4343
4344 if (!narrowed) {
4345 free_alloca(visited, use_heap);
4346 return SUCCESS;
4347 }
4348
4349 if (zend_infer_types_ex(op_array, script, ssa, worklist, optimization_level) == FAILURE) {
4350 free_alloca(visited, use_heap);
4351 return FAILURE;
4352 }
4353
4354 free_alloca(visited, use_heap);
4355 return SUCCESS;
4356 }
4357
is_recursive_tail_call(const zend_op_array * op_array,zend_op * opline)4358 static bool is_recursive_tail_call(const zend_op_array *op_array,
4359 zend_op *opline)
4360 {
4361 zend_func_info *info = ZEND_FUNC_INFO(op_array);
4362
4363 if (info->ssa.ops && info->ssa.vars && info->call_map &&
4364 info->ssa.ops[opline - op_array->opcodes].op1_use >= 0 &&
4365 info->ssa.vars[info->ssa.ops[opline - op_array->opcodes].op1_use].definition >= 0) {
4366
4367 zend_op *op = op_array->opcodes + info->ssa.vars[info->ssa.ops[opline - op_array->opcodes].op1_use].definition;
4368
4369 if (op->opcode == ZEND_DO_UCALL) {
4370 zend_call_info *call_info = info->call_map[op - op_array->opcodes];
4371 if (call_info && op_array == &call_info->callee_func->op_array) {
4372 return 1;
4373 }
4374 }
4375 }
4376 return 0;
4377 }
4378
zend_get_return_info_from_signature_only(const zend_function * func,const zend_script * script,zend_class_entry ** ce,bool * ce_is_instanceof,bool use_tentative_return_info)4379 uint32_t zend_get_return_info_from_signature_only(
4380 const zend_function *func, const zend_script *script,
4381 zend_class_entry **ce, bool *ce_is_instanceof, bool use_tentative_return_info) {
4382 uint32_t type;
4383 if (func->common.fn_flags & ZEND_ACC_HAS_RETURN_TYPE &&
4384 (use_tentative_return_info || !ZEND_ARG_TYPE_IS_TENTATIVE(func->common.arg_info - 1))
4385 ) {
4386 zend_arg_info *ret_info = func->common.arg_info - 1;
4387 type = zend_fetch_arg_info_type(script, ret_info, ce);
4388 *ce_is_instanceof = ce != NULL;
4389 } else {
4390 type = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF
4391 | MAY_BE_RC1 | MAY_BE_RCN;
4392 *ce = NULL;
4393 *ce_is_instanceof = false;
4394 }
4395
4396 /* For generators RETURN_REFERENCE refers to the yielded values. */
4397 if ((func->common.fn_flags & ZEND_ACC_RETURN_REFERENCE)
4398 && !(func->common.fn_flags & ZEND_ACC_GENERATOR)) {
4399 type |= MAY_BE_REF;
4400 *ce = NULL;
4401 *ce_is_instanceof = 0;
4402 }
4403 return type;
4404 }
4405
zend_init_func_return_info(const zend_op_array * op_array,const zend_script * script,zend_ssa_var_info * ret)4406 ZEND_API void zend_init_func_return_info(
4407 const zend_op_array *op_array, const zend_script *script, zend_ssa_var_info *ret)
4408 {
4409 ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE));
4410
4411 zend_ssa_range tmp_range = {0, 0, 0, 0};
4412 bool is_instanceof = false;
4413 ret->type = zend_get_return_info_from_signature_only(
4414 (zend_function *) op_array, script, &ret->ce, &is_instanceof, /* use_tentative_return_info */ 1);
4415 ret->is_instanceof = is_instanceof;
4416 ret->range = tmp_range;
4417 ret->has_range = 0;
4418 }
4419
zend_func_return_info(const zend_op_array * op_array,const zend_script * script,int recursive,int widening,zend_ssa_var_info * ret)4420 static void zend_func_return_info(const zend_op_array *op_array,
4421 const zend_script *script,
4422 int recursive,
4423 int widening,
4424 zend_ssa_var_info *ret)
4425 {
4426 zend_func_info *info = ZEND_FUNC_INFO(op_array);
4427 zend_ssa *ssa = &info->ssa;
4428 int blocks_count = info->ssa.cfg.blocks_count;
4429 zend_basic_block *blocks = info->ssa.cfg.blocks;
4430 int j;
4431 uint32_t t1;
4432 uint32_t tmp = 0;
4433 zend_class_entry *tmp_ce = NULL;
4434 int tmp_is_instanceof = -1;
4435 zend_class_entry *arg_ce;
4436 int arg_is_instanceof;
4437 zend_ssa_range tmp_range = {0, 0, 0, 0};
4438 int tmp_has_range = -1;
4439
4440 if (op_array->fn_flags & ZEND_ACC_GENERATOR) {
4441 ret->type = MAY_BE_OBJECT | MAY_BE_RC1 | MAY_BE_RCN;
4442 ret->ce = zend_ce_generator;
4443 ret->is_instanceof = 0;
4444 ret->range = tmp_range;
4445 ret->has_range = 0;
4446 return;
4447 }
4448
4449 if (!ret->type) {
4450 /* We will intersect the type later. */
4451 ret->type = MAY_BE_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ARRAY_KEY_ANY
4452 | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF;
4453 }
4454
4455 for (j = 0; j < blocks_count; j++) {
4456 if ((blocks[j].flags & ZEND_BB_REACHABLE) && blocks[j].len != 0) {
4457 zend_op *opline = op_array->opcodes + blocks[j].start + blocks[j].len - 1;
4458
4459 if (opline->opcode == ZEND_RETURN || opline->opcode == ZEND_RETURN_BY_REF) {
4460 zend_ssa_op *ssa_op = ssa->ops ? &ssa->ops[opline - op_array->opcodes] : NULL;
4461 if (!recursive && ssa_op && info->ssa.var_info &&
4462 ssa_op->op1_use >= 0 &&
4463 info->ssa.var_info[ssa_op->op1_use].recursive) {
4464 continue;
4465 }
4466 if (is_recursive_tail_call(op_array, opline)) {
4467 continue;
4468 }
4469 t1 = OP1_INFO();
4470 if (t1 & MAY_BE_UNDEF) {
4471 t1 |= MAY_BE_NULL;
4472 }
4473 if (opline->opcode == ZEND_RETURN) {
4474 if (t1 & MAY_BE_RC1) {
4475 t1 |= MAY_BE_RCN;
4476 }
4477 t1 &= ~(MAY_BE_UNDEF | MAY_BE_REF);
4478 } else {
4479 t1 |= MAY_BE_REF;
4480 t1 &= ~(MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN);
4481 }
4482 tmp |= t1;
4483
4484 if (ssa_op && info->ssa.var_info &&
4485 ssa_op->op1_use >= 0 && !(t1 & MAY_BE_REF) &&
4486 info->ssa.var_info[ssa_op->op1_use].ce) {
4487 arg_ce = info->ssa.var_info[ssa_op->op1_use].ce;
4488 arg_is_instanceof = info->ssa.var_info[ssa_op->op1_use].is_instanceof;
4489 } else {
4490 arg_ce = NULL;
4491 arg_is_instanceof = 0;
4492 }
4493
4494 if (tmp_is_instanceof < 0) {
4495 tmp_ce = arg_ce;
4496 tmp_is_instanceof = arg_is_instanceof;
4497 } else if (arg_ce && arg_ce == tmp_ce) {
4498 if (tmp_is_instanceof != arg_is_instanceof) {
4499 tmp_is_instanceof = 1;
4500 }
4501 } else {
4502 tmp_ce = NULL;
4503 tmp_is_instanceof = 0;
4504 }
4505
4506 if (opline->op1_type == IS_CONST) {
4507 zval *zv = CRT_CONSTANT(opline->op1);
4508
4509 if (Z_TYPE_P(zv) == IS_LONG) {
4510 if (tmp_has_range < 0) {
4511 tmp_has_range = 1;
4512 tmp_range.underflow = 0;
4513 tmp_range.min = Z_LVAL_P(zv);
4514 tmp_range.max = Z_LVAL_P(zv);
4515 tmp_range.overflow = 0;
4516 } else if (tmp_has_range) {
4517 if (!tmp_range.underflow) {
4518 tmp_range.min = MIN(tmp_range.min, Z_LVAL_P(zv));
4519 }
4520 if (!tmp_range.overflow) {
4521 tmp_range.max = MAX(tmp_range.max, Z_LVAL_P(zv));
4522 }
4523 }
4524 } else {
4525 tmp_has_range = 0;
4526 }
4527 } else if (ssa_op && info->ssa.var_info && ssa_op->op1_use >= 0) {
4528 if (info->ssa.var_info[ssa_op->op1_use].has_range) {
4529 if (tmp_has_range < 0) {
4530 tmp_has_range = 1;
4531 tmp_range = info->ssa.var_info[ssa_op->op1_use].range;
4532 } else if (tmp_has_range) {
4533 /* union */
4534 if (info->ssa.var_info[ssa_op->op1_use].range.underflow) {
4535 tmp_range.underflow = 1;
4536 tmp_range.min = ZEND_LONG_MIN;
4537 } else {
4538 tmp_range.min = MIN(tmp_range.min, info->ssa.var_info[ssa_op->op1_use].range.min);
4539 }
4540 if (info->ssa.var_info[ssa_op->op1_use].range.overflow) {
4541 tmp_range.overflow = 1;
4542 tmp_range.max = ZEND_LONG_MAX;
4543 } else {
4544 tmp_range.max = MAX(tmp_range.max, info->ssa.var_info[ssa_op->op1_use].range.max);
4545 }
4546 }
4547 } else if (!widening) {
4548 tmp_has_range = 1;
4549 tmp_range.underflow = 1;
4550 tmp_range.min = ZEND_LONG_MIN;
4551 tmp_range.max = ZEND_LONG_MAX;
4552 tmp_range.overflow = 1;
4553 }
4554 } else {
4555 tmp_has_range = 0;
4556 }
4557 }
4558 }
4559 }
4560
4561 if (!(op_array->fn_flags & ZEND_ACC_HAS_RETURN_TYPE)) {
4562 if (tmp_is_instanceof < 0) {
4563 tmp_is_instanceof = 0;
4564 tmp_ce = NULL;
4565 }
4566 if (tmp_has_range < 0) {
4567 tmp_has_range = 0;
4568 }
4569 ret->ce = tmp_ce;
4570 ret->is_instanceof = tmp_is_instanceof;
4571 }
4572 ret->type &= tmp;
4573 ret->range = tmp_range;
4574 ret->has_range = tmp_has_range;
4575 }
4576
zend_infer_types(const zend_op_array * op_array,const zend_script * script,zend_ssa * ssa,zend_long optimization_level)4577 static zend_result zend_infer_types(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level)
4578 {
4579 int ssa_vars_count = ssa->vars_count;
4580 int j;
4581 zend_bitset worklist;
4582 ALLOCA_FLAG(use_heap);
4583
4584 worklist = do_alloca(sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count), use_heap);
4585 memset(worklist, 0, sizeof(zend_ulong) * zend_bitset_len(ssa_vars_count));
4586
4587 /* Type Inference */
4588 for (j = op_array->last_var; j < ssa_vars_count; j++) {
4589 zend_bitset_incl(worklist, j);
4590 }
4591
4592 if (zend_infer_types_ex(op_array, script, ssa, worklist, optimization_level) == FAILURE) {
4593 free_alloca(worklist, use_heap);
4594 return FAILURE;
4595 }
4596
4597 if (optimization_level & ZEND_OPTIMIZER_NARROW_TO_DOUBLE) {
4598 /* Narrowing integer initialization to doubles */
4599 zend_type_narrowing(op_array, script, ssa, optimization_level);
4600 }
4601
4602 if (ZEND_FUNC_INFO(op_array)) {
4603 zend_func_return_info(op_array, script, 1, 0, &ZEND_FUNC_INFO(op_array)->return_info);
4604 }
4605
4606 free_alloca(worklist, use_heap);
4607 return SUCCESS;
4608 }
4609
zend_mark_cv_references(const zend_op_array * op_array,const zend_script * script,zend_ssa * ssa)4610 static void zend_mark_cv_references(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa)
4611 {
4612 int var, def;
4613 const zend_op *opline;
4614 zend_arg_info *arg_info;
4615 uint32_t worklist_len = zend_bitset_len(ssa->vars_count);
4616 zend_bitset worklist;
4617 ALLOCA_FLAG(use_heap);
4618
4619 worklist = do_alloca(sizeof(zend_ulong) * worklist_len, use_heap);
4620 memset(worklist, 0, sizeof(zend_ulong) * worklist_len);
4621
4622 /* Collect SSA variables which definitions creates PHP reference */
4623 for (var = 0; var < ssa->vars_count; var++) {
4624 def = ssa->vars[var].definition;
4625 if (def >= 0 && ssa->vars[var].var < op_array->last_var) {
4626 opline = op_array->opcodes + def;
4627 if (ssa->ops[def].result_def == var) {
4628 switch (opline->opcode) {
4629 case ZEND_RECV:
4630 case ZEND_RECV_INIT:
4631 arg_info = &op_array->arg_info[opline->op1.num-1];
4632 if (!ZEND_ARG_SEND_MODE(arg_info)) {
4633 continue;
4634 }
4635 break;
4636 default:
4637 continue;
4638 }
4639 } else if (ssa->ops[def].op1_def == var) {
4640 switch (opline->opcode) {
4641 case ZEND_ASSIGN_REF:
4642 case ZEND_MAKE_REF:
4643 case ZEND_FE_RESET_RW:
4644 case ZEND_BIND_GLOBAL:
4645 case ZEND_SEND_REF:
4646 case ZEND_SEND_VAR_EX:
4647 case ZEND_SEND_FUNC_ARG:
4648 break;
4649 case ZEND_INIT_ARRAY:
4650 case ZEND_ADD_ARRAY_ELEMENT:
4651 if (!(opline->extended_value & ZEND_ARRAY_ELEMENT_REF)) {
4652 continue;
4653 }
4654 break;
4655 case ZEND_BIND_STATIC:
4656 if (!(opline->extended_value & ZEND_BIND_REF)) {
4657 continue;
4658 }
4659 break;
4660 case ZEND_YIELD:
4661 if (!(op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE)) {
4662 continue;
4663 }
4664 break;
4665 case ZEND_OP_DATA:
4666 switch ((opline-1)->opcode) {
4667 case ZEND_ASSIGN_OBJ_REF:
4668 case ZEND_ASSIGN_STATIC_PROP_REF:
4669 break;
4670 default:
4671 continue;
4672 }
4673 break;
4674 default:
4675 continue;
4676 }
4677 } else if (ssa->ops[def].op2_def == var) {
4678 switch (opline->opcode) {
4679 case ZEND_ASSIGN_REF:
4680 case ZEND_FE_FETCH_RW:
4681 break;
4682 case ZEND_BIND_LEXICAL:
4683 if (!(opline->extended_value & ZEND_BIND_REF)) {
4684 continue;
4685 }
4686 break;
4687 default:
4688 continue;
4689 }
4690 } else {
4691 ZEND_UNREACHABLE();
4692 }
4693 zend_bitset_incl(worklist, var);
4694 } else if (ssa->var_info[var].type & MAY_BE_REF) {
4695 zend_bitset_incl(worklist, var);
4696 } else if (ssa->vars[var].alias == SYMTABLE_ALIAS) {
4697 zend_bitset_incl(worklist, var);
4698 }
4699 }
4700
4701 /* Set and propagate MAY_BE_REF */
4702 WHILE_WORKLIST(worklist, worklist_len, var) {
4703
4704 ssa->var_info[var].type |= MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
4705
4706 if (ssa->vars[var].phi_use_chain) {
4707 zend_ssa_phi *p = ssa->vars[var].phi_use_chain;
4708 do {
4709 if (!(ssa->var_info[p->ssa_var].type & MAY_BE_REF)) {
4710 zend_bitset_incl(worklist, p->ssa_var);
4711 }
4712 p = zend_ssa_next_use_phi(ssa, var, p);
4713 } while (p);
4714 }
4715
4716 if (ssa->vars[var].use_chain >= 0) {
4717 int use = ssa->vars[var].use_chain;
4718 FOREACH_USE(&ssa->vars[var], use) {
4719 zend_ssa_op *op = ssa->ops + use;
4720 if (op->op1_use == var && op->op1_def >= 0) {
4721 if (!(ssa->var_info[op->op1_def].type & MAY_BE_REF)) {
4722 /* Unset breaks references (outside global scope). */
4723 if (op_array->opcodes[use].opcode == ZEND_UNSET_CV
4724 && op_array->function_name) {
4725 continue;
4726 }
4727 zend_bitset_incl(worklist, op->op1_def);
4728 }
4729 }
4730 if (op->op2_use == var && op->op2_def >= 0) {
4731 if (!(ssa->var_info[op->op2_def].type & MAY_BE_REF)) {
4732 zend_bitset_incl(worklist, op->op2_def);
4733 }
4734 }
4735 if (op->result_use == var && op->result_def >= 0) {
4736 if (!(ssa->var_info[op->result_def].type & MAY_BE_REF)) {
4737 zend_bitset_incl(worklist, op->result_def);
4738 }
4739 }
4740 } FOREACH_USE_END();
4741 }
4742 } WHILE_WORKLIST_END();
4743
4744 free_alloca(worklist, use_heap);
4745 }
4746
zend_ssa_inference(zend_arena ** arena,const zend_op_array * op_array,const zend_script * script,zend_ssa * ssa,zend_long optimization_level)4747 ZEND_API zend_result zend_ssa_inference(zend_arena **arena, const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_long optimization_level) /* {{{ */
4748 {
4749 zend_ssa_var_info *ssa_var_info;
4750 int i;
4751
4752 if (!ssa->var_info) {
4753 ssa->var_info = zend_arena_calloc(arena, ssa->vars_count, sizeof(zend_ssa_var_info));
4754 }
4755 ssa_var_info = ssa->var_info;
4756
4757 if (!op_array->function_name) {
4758 for (i = 0; i < op_array->last_var; i++) {
4759 ssa_var_info[i].type = MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF;
4760 ssa_var_info[i].has_range = 0;
4761 }
4762 } else {
4763 for (i = 0; i < op_array->last_var; i++) {
4764 ssa_var_info[i].type = MAY_BE_UNDEF;
4765 ssa_var_info[i].has_range = 0;
4766 if (ssa->vars[i].alias) {
4767 ssa_var_info[i].type |= get_ssa_alias_types(ssa->vars[i].alias);
4768 }
4769 }
4770 }
4771 for (i = op_array->last_var; i < ssa->vars_count; i++) {
4772 ssa_var_info[i].type = 0;
4773 ssa_var_info[i].has_range = 0;
4774 }
4775
4776 zend_mark_cv_references(op_array, script, ssa);
4777
4778 zend_infer_ranges(op_array, ssa);
4779
4780 if (zend_infer_types(op_array, script, ssa, optimization_level) == FAILURE) {
4781 return FAILURE;
4782 }
4783
4784 return SUCCESS;
4785 }
4786 /* }}} */
4787
zend_may_throw_ex(const zend_op * opline,const zend_ssa_op * ssa_op,const zend_op_array * op_array,zend_ssa * ssa,uint32_t t1,uint32_t t2)4788 ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op, const zend_op_array *op_array, zend_ssa *ssa, uint32_t t1, uint32_t t2)
4789 {
4790 if (opline->op1_type == IS_CV) {
4791 if (t1 & MAY_BE_UNDEF) {
4792 switch (opline->opcode) {
4793 case ZEND_UNSET_VAR:
4794 case ZEND_ISSET_ISEMPTY_VAR:
4795 return 1;
4796 case ZEND_ISSET_ISEMPTY_DIM_OBJ:
4797 case ZEND_ISSET_ISEMPTY_PROP_OBJ:
4798 case ZEND_ASSIGN:
4799 case ZEND_ASSIGN_DIM:
4800 case ZEND_ASSIGN_REF:
4801 case ZEND_BIND_GLOBAL:
4802 case ZEND_BIND_STATIC:
4803 case ZEND_FETCH_DIM_IS:
4804 case ZEND_FETCH_OBJ_IS:
4805 case ZEND_SEND_REF:
4806 case ZEND_UNSET_CV:
4807 case ZEND_ISSET_ISEMPTY_CV:
4808 case ZEND_MAKE_REF:
4809 case ZEND_FETCH_DIM_W:
4810 break;
4811 default:
4812 /* undefined variable warning */
4813 return 1;
4814 }
4815 }
4816 } else if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
4817 if ((t1 & MAY_BE_RC1)
4818 && (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) {
4819 switch (opline->opcode) {
4820 case ZEND_CASE:
4821 case ZEND_CASE_STRICT:
4822 case ZEND_FE_FETCH_R:
4823 case ZEND_FE_FETCH_RW:
4824 case ZEND_FETCH_LIST_R:
4825 case ZEND_QM_ASSIGN:
4826 case ZEND_SEND_VAL:
4827 case ZEND_SEND_VAL_EX:
4828 case ZEND_SEND_VAR:
4829 case ZEND_SEND_VAR_EX:
4830 case ZEND_SEND_FUNC_ARG:
4831 case ZEND_SEND_VAR_NO_REF:
4832 case ZEND_SEND_VAR_NO_REF_EX:
4833 case ZEND_SEND_REF:
4834 case ZEND_SEPARATE:
4835 case ZEND_END_SILENCE:
4836 case ZEND_MAKE_REF:
4837 break;
4838 default:
4839 /* destructor may be called */
4840 return 1;
4841 }
4842 }
4843 }
4844
4845 if (opline->op2_type == IS_CV) {
4846 if (t2 & MAY_BE_UNDEF) {
4847 switch (opline->opcode) {
4848 case ZEND_ASSIGN_REF:
4849 case ZEND_FE_FETCH_R:
4850 case ZEND_FE_FETCH_RW:
4851 break;
4852 default:
4853 /* undefined variable warning */
4854 return 1;
4855 }
4856 }
4857 } else if (opline->op2_type & (IS_TMP_VAR|IS_VAR)) {
4858 if ((t2 & MAY_BE_RC1)
4859 && (t2 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) {
4860 switch (opline->opcode) {
4861 case ZEND_ASSIGN:
4862 case ZEND_FE_FETCH_R:
4863 case ZEND_FE_FETCH_RW:
4864 break;
4865 default:
4866 /* destructor may be called */
4867 return 1;
4868 }
4869 }
4870 }
4871
4872 switch (opline->opcode) {
4873 case ZEND_NOP:
4874 case ZEND_IS_IDENTICAL:
4875 case ZEND_IS_NOT_IDENTICAL:
4876 case ZEND_QM_ASSIGN:
4877 case ZEND_JMP:
4878 case ZEND_CHECK_VAR:
4879 case ZEND_MAKE_REF:
4880 case ZEND_BEGIN_SILENCE:
4881 case ZEND_END_SILENCE:
4882 case ZEND_FREE:
4883 case ZEND_FE_FREE:
4884 case ZEND_SEPARATE:
4885 case ZEND_TYPE_CHECK:
4886 case ZEND_DEFINED:
4887 case ZEND_ISSET_ISEMPTY_THIS:
4888 case ZEND_COALESCE:
4889 case ZEND_SWITCH_LONG:
4890 case ZEND_SWITCH_STRING:
4891 case ZEND_MATCH:
4892 case ZEND_ISSET_ISEMPTY_VAR:
4893 case ZEND_ISSET_ISEMPTY_CV:
4894 case ZEND_FUNC_NUM_ARGS:
4895 case ZEND_FUNC_GET_ARGS:
4896 case ZEND_COPY_TMP:
4897 case ZEND_CASE_STRICT:
4898 case ZEND_JMP_NULL:
4899 return 0;
4900 case ZEND_SEND_VAR:
4901 case ZEND_SEND_VAL:
4902 case ZEND_SEND_REF:
4903 case ZEND_SEND_VAR_EX:
4904 case ZEND_SEND_FUNC_ARG:
4905 case ZEND_CHECK_FUNC_ARG:
4906 /* May throw for named params. */
4907 return opline->op2_type == IS_CONST;
4908 case ZEND_INIT_FCALL:
4909 /* can't throw, because call is resolved at compile time */
4910 return 0;
4911 case ZEND_BIND_GLOBAL:
4912 if ((opline+1)->opcode == ZEND_BIND_GLOBAL) {
4913 return zend_may_throw(opline + 1, ssa_op ? ssa_op + 1 : NULL, op_array, ssa);
4914 }
4915 return 0;
4916 case ZEND_ADD:
4917 if ((t1 & MAY_BE_ANY) == MAY_BE_ARRAY
4918 && (t2 & MAY_BE_ANY) == MAY_BE_ARRAY) {
4919 return 0;
4920 }
4921 return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
4922 (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
4923 case ZEND_DIV:
4924 if (!OP2_HAS_RANGE() ||
4925 (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) {
4926 /* Division by zero */
4927 return 1;
4928 }
4929 ZEND_FALLTHROUGH;
4930 case ZEND_SUB:
4931 case ZEND_MUL:
4932 case ZEND_POW:
4933 return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
4934 (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
4935 /* Ops may throw if not an integer */
4936 case ZEND_MOD:
4937 if (!OP2_HAS_RANGE() ||
4938 (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) {
4939 /* Division by zero */
4940 return 1;
4941 }
4942 ZEND_FALLTHROUGH;
4943 case ZEND_SL:
4944 case ZEND_SR:
4945 return (t1 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
4946 (t2 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
4947 !OP2_HAS_RANGE() ||
4948 OP2_MIN_RANGE() < 0;
4949 case ZEND_CONCAT:
4950 case ZEND_FAST_CONCAT:
4951 return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) ||
4952 (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
4953 case ZEND_BW_OR:
4954 case ZEND_BW_AND:
4955 case ZEND_BW_XOR:
4956 if ((t1 & MAY_BE_ANY) == MAY_BE_STRING
4957 && (t2 & MAY_BE_ANY) == MAY_BE_STRING) {
4958 return 0;
4959 }
4960 return (t1 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
4961 (t2 & (MAY_BE_STRING|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
4962 case ZEND_BW_NOT:
4963 return (t1 & (MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
4964 case ZEND_PRE_INC:
4965 case ZEND_POST_INC:
4966 case ZEND_PRE_DEC:
4967 case ZEND_POST_DEC:
4968 return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
4969 case ZEND_BOOL_NOT:
4970 case ZEND_JMPZ:
4971 case ZEND_JMPNZ:
4972 case ZEND_JMPZ_EX:
4973 case ZEND_JMPNZ_EX:
4974 case ZEND_BOOL:
4975 case ZEND_JMP_SET:
4976 return (t1 & MAY_BE_OBJECT);
4977 case ZEND_BOOL_XOR:
4978 return (t1 & MAY_BE_OBJECT) || (t2 & MAY_BE_OBJECT);
4979 case ZEND_IS_EQUAL:
4980 case ZEND_IS_NOT_EQUAL:
4981 case ZEND_IS_SMALLER:
4982 case ZEND_IS_SMALLER_OR_EQUAL:
4983 case ZEND_CASE:
4984 case ZEND_SPACESHIP:
4985 if ((t1 & MAY_BE_ANY) == MAY_BE_NULL
4986 || (t2 & MAY_BE_ANY) == MAY_BE_NULL) {
4987 return 0;
4988 }
4989 return (t1 & (MAY_BE_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_OBJECT)) || (t2 & (MAY_BE_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_OBJECT));
4990 case ZEND_ASSIGN_OP:
4991 if (opline->extended_value == ZEND_ADD) {
4992 if ((t1 & MAY_BE_ANY) == MAY_BE_ARRAY
4993 && (t2 & MAY_BE_ANY) == MAY_BE_ARRAY) {
4994 return 0;
4995 }
4996 return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
4997 (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
4998 } else if (opline->extended_value == ZEND_DIV ||
4999 opline->extended_value == ZEND_MOD) {
5000 if (!OP2_HAS_RANGE() ||
5001 (OP2_MIN_RANGE() <= 0 && OP2_MAX_RANGE() >= 0)) {
5002 /* Division by zero */
5003 return 1;
5004 }
5005 return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5006 (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5007 } else if (opline->extended_value == ZEND_SUB ||
5008 opline->extended_value == ZEND_MUL ||
5009 opline->extended_value == ZEND_POW) {
5010 return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5011 (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5012 } else if (opline->extended_value == ZEND_SL ||
5013 opline->extended_value == ZEND_SR) {
5014 return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5015 (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5016 !OP2_HAS_RANGE() ||
5017 OP2_MIN_RANGE() < 0;
5018 } else if (opline->extended_value == ZEND_CONCAT) {
5019 return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT)) ||
5020 (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
5021 } else if (opline->extended_value == ZEND_BW_OR ||
5022 opline->extended_value == ZEND_BW_AND ||
5023 opline->extended_value == ZEND_BW_XOR) {
5024 if ((t1 & MAY_BE_ANY) == MAY_BE_STRING
5025 && (t2 & MAY_BE_ANY) == MAY_BE_STRING) {
5026 return 0;
5027 }
5028 return (t1 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE)) ||
5029 (t2 & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5030 }
5031 return 1;
5032 case ZEND_ASSIGN:
5033 if (t1 & MAY_BE_REF) {
5034 return 1;
5035 }
5036 ZEND_FALLTHROUGH;
5037 case ZEND_UNSET_VAR:
5038 return (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY));
5039 case ZEND_BIND_STATIC:
5040 if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY)) {
5041 /* Destructor may throw. */
5042 return 1;
5043 } else {
5044 zval *value = (zval*)((char*)op_array->static_variables->arData + (opline->extended_value & ~(ZEND_BIND_REF|ZEND_BIND_IMPLICIT|ZEND_BIND_EXPLICIT)));
5045 /* May throw if initializer is CONSTANT_AST. */
5046 return Z_TYPE_P(value) == IS_CONSTANT_AST;
5047 }
5048 case ZEND_ASSIGN_DIM:
5049 if ((opline+1)->op1_type == IS_CV) {
5050 if (_ssa_op1_info(op_array, ssa, opline+1, ssa_op+1) & MAY_BE_UNDEF) {
5051 return 1;
5052 }
5053 }
5054 if (t1 & (MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_REF)) {
5055 return 1;
5056 }
5057 return (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_TRUE|MAY_BE_FALSE|MAY_BE_STRING|MAY_BE_LONG|MAY_BE_DOUBLE)) || opline->op2_type == IS_UNUSED ||
5058 (t2 & (MAY_BE_UNDEF|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5059 case ZEND_ASSIGN_OBJ:
5060 if (t1 & (MAY_BE_ANY-MAY_BE_OBJECT)) {
5061 return 1;
5062 }
5063 if ((opline+1)->op1_type == IS_CV) {
5064 if (_ssa_op1_info(op_array, ssa, opline+1, ssa_op+1) & MAY_BE_UNDEF) {
5065 return 1;
5066 }
5067 }
5068 if (ssa_op->op1_use) {
5069 zend_ssa_var_info *var_info = ssa->var_info + ssa_op->op1_use;
5070 zend_class_entry *ce = var_info->ce;
5071
5072 if (var_info->is_instanceof ||
5073 !ce || ce->create_object || ce->__get || ce->__set || ce->parent) {
5074 return 1;
5075 }
5076
5077 if (opline->op2_type != IS_CONST) {
5078 return 1;
5079 }
5080
5081 zend_string *prop_name = Z_STR_P(CRT_CONSTANT(opline->op2));
5082 if (ZSTR_LEN(prop_name) > 0 && ZSTR_VAL(prop_name)[0] == '\0') {
5083 return 1;
5084 }
5085
5086 zend_property_info *prop_info =
5087 zend_hash_find_ptr(&ce->properties_info, prop_name);
5088 if (prop_info) {
5089 if (ZEND_TYPE_IS_SET(prop_info->type)) {
5090 return 1;
5091 }
5092 return !(prop_info->flags & ZEND_ACC_PUBLIC)
5093 && prop_info->ce != op_array->scope;
5094 } else {
5095 return !(ce->ce_flags & ZEND_ACC_ALLOW_DYNAMIC_PROPERTIES);
5096 }
5097 }
5098 return 1;
5099 case ZEND_ROPE_INIT:
5100 case ZEND_ROPE_ADD:
5101 case ZEND_ROPE_END:
5102 return t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT);
5103 case ZEND_INIT_ARRAY:
5104 return (opline->op2_type != IS_UNUSED) && (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5105 case ZEND_ADD_ARRAY_ELEMENT:
5106 return (opline->op2_type == IS_UNUSED) || (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5107 case ZEND_STRLEN:
5108 return (t1 & MAY_BE_ANY) != MAY_BE_STRING;
5109 case ZEND_COUNT:
5110 return (t1 & MAY_BE_ANY) != MAY_BE_ARRAY;
5111 case ZEND_RECV_INIT:
5112 if (Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_CONSTANT_AST) {
5113 return 1;
5114 }
5115 if (op_array->fn_flags & ZEND_ACC_HAS_TYPE_HINTS) {
5116 uint32_t arg_num = opline->op1.num;
5117 zend_arg_info *cur_arg_info;
5118
5119 if (EXPECTED(arg_num <= op_array->num_args)) {
5120 cur_arg_info = &op_array->arg_info[arg_num-1];
5121 } else if (UNEXPECTED(op_array->fn_flags & ZEND_ACC_VARIADIC)) {
5122 cur_arg_info = &op_array->arg_info[op_array->num_args];
5123 } else {
5124 return 0;
5125 }
5126 return ZEND_TYPE_IS_SET(cur_arg_info->type);
5127 } else {
5128 return 0;
5129 }
5130 case ZEND_FETCH_IS:
5131 return (t2 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
5132 case ZEND_ISSET_ISEMPTY_DIM_OBJ:
5133 return (t1 & MAY_BE_OBJECT) || (t2 & (MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT));
5134 case ZEND_FETCH_DIM_IS:
5135 return (t1 & MAY_BE_OBJECT) || (t2 & (MAY_BE_DOUBLE|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE));
5136 case ZEND_CAST:
5137 switch (opline->extended_value) {
5138 case IS_LONG:
5139 case IS_DOUBLE:
5140 return (t1 & MAY_BE_OBJECT);
5141 case IS_STRING:
5142 return (t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT));
5143 case IS_ARRAY:
5144 return (t1 & MAY_BE_OBJECT);
5145 case IS_OBJECT:
5146 return 0;
5147 EMPTY_SWITCH_DEFAULT_CASE()
5148 }
5149 /* GCC is getting confused here for the Wimplicit-fallthrough warning with
5150 * EMPTY_SWITCH_DEFAULT_CASE() macro */
5151 return 0;
5152 case ZEND_ARRAY_KEY_EXISTS:
5153 if ((t2 & MAY_BE_ANY) != MAY_BE_ARRAY) {
5154 return 1;
5155 }
5156 if ((t1 & (MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE))) {
5157 return 1;
5158 }
5159 return 0;
5160 case ZEND_FE_RESET_R:
5161 case ZEND_FE_RESET_RW:
5162 if ((t1 & (MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
5163 return 1;
5164 }
5165 return 0;
5166 case ZEND_FE_FETCH_R:
5167 if ((t1 & (MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
5168 return 1;
5169 }
5170 if (opline->op2_type == IS_CV
5171 && (t2 & MAY_BE_RC1)
5172 && (t2 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY))) {
5173 return 1;
5174 }
5175 return 0;
5176 case ZEND_FETCH_DIM_W:
5177 case ZEND_FETCH_LIST_W:
5178 if (t1 & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE|MAY_BE_STRING|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)) {
5179 return 1;
5180 }
5181 if (t2 & (MAY_BE_RESOURCE|MAY_BE_ARRAY|MAY_BE_OBJECT)) {
5182 return 1;
5183 }
5184 if (opline->op2_type == IS_UNUSED) {
5185 return 1;
5186 }
5187 return 0;
5188 default:
5189 return 1;
5190 }
5191 }
5192
zend_may_throw(const zend_op * opline,const zend_ssa_op * ssa_op,const zend_op_array * op_array,zend_ssa * ssa)5193 ZEND_API bool zend_may_throw(const zend_op *opline, const zend_ssa_op *ssa_op, const zend_op_array *op_array, zend_ssa *ssa)
5194 {
5195 return zend_may_throw_ex(opline, ssa_op, op_array, ssa, OP1_INFO(), OP2_INFO());
5196 }
5197