1 /*
2 +----------------------------------------------------------------------+
3 | Zend OPcache |
4 +----------------------------------------------------------------------+
5 | Copyright (c) The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | https://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@php.net> |
16 +----------------------------------------------------------------------+
17 */
18
19 #include "Optimizer/zend_optimizer.h"
20 #include "Optimizer/zend_optimizer_internal.h"
21 #include "zend_API.h"
22 #include "zend_constants.h"
23 #include "zend_execute.h"
24 #include "zend_vm.h"
25 #include "zend_bitset.h"
26 #include "zend_cfg.h"
27 #include "zend_ssa.h"
28 #include "zend_func_info.h"
29 #include "zend_call_graph.h"
30 #include "zend_inference.h"
31 #include "zend_dump.h"
32
33 #ifndef ZEND_DEBUG_DFA
34 # define ZEND_DEBUG_DFA ZEND_DEBUG
35 #endif
36
37 #if ZEND_DEBUG_DFA
38 # include "ssa_integrity.c"
39 #endif
40
zend_dfa_analyze_op_array(zend_op_array * op_array,zend_optimizer_ctx * ctx,zend_ssa * ssa)41 zend_result zend_dfa_analyze_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa)
42 {
43 uint32_t build_flags;
44
45 if (op_array->last_try_catch) {
46 /* TODO: we can't analyze functions with try/catch/finally ??? */
47 return FAILURE;
48 }
49
50 /* Build SSA */
51 memset(ssa, 0, sizeof(zend_ssa));
52
53 zend_build_cfg(&ctx->arena, op_array, ZEND_CFG_NO_ENTRY_PREDECESSORS, &ssa->cfg);
54
55 if ((ssa->cfg.flags & ZEND_FUNC_INDIRECT_VAR_ACCESS)) {
56 /* TODO: we can't analyze functions with indirect variable access ??? */
57 return FAILURE;
58 }
59
60 zend_cfg_build_predecessors(&ctx->arena, &ssa->cfg);
61
62 if (ctx->debug_level & ZEND_DUMP_DFA_CFG) {
63 zend_dump_op_array(op_array, ZEND_DUMP_CFG, "dfa cfg", &ssa->cfg);
64 }
65
66 /* Compute Dominators Tree */
67 zend_cfg_compute_dominators_tree(op_array, &ssa->cfg);
68
69 /* Identify reducible and irreducible loops */
70 zend_cfg_identify_loops(op_array, &ssa->cfg);
71
72 if (ctx->debug_level & ZEND_DUMP_DFA_DOMINATORS) {
73 zend_dump_dominators(op_array, &ssa->cfg);
74 }
75
76 build_flags = 0;
77 if (ctx->debug_level & ZEND_DUMP_DFA_LIVENESS) {
78 build_flags |= ZEND_SSA_DEBUG_LIVENESS;
79 }
80 if (ctx->debug_level & ZEND_DUMP_DFA_PHI) {
81 build_flags |= ZEND_SSA_DEBUG_PHI_PLACEMENT;
82 }
83 if (zend_build_ssa(&ctx->arena, ctx->script, op_array, build_flags, ssa) == FAILURE) {
84 return FAILURE;
85 }
86
87 if (ctx->debug_level & ZEND_DUMP_DFA_SSA) {
88 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "dfa ssa", ssa);
89 }
90
91
92 zend_ssa_compute_use_def_chains(&ctx->arena, op_array, ssa);
93
94 zend_ssa_find_false_dependencies(op_array, ssa);
95
96 zend_ssa_find_sccs(op_array, ssa);
97
98 if (zend_ssa_inference(&ctx->arena, op_array, ctx->script, ssa, ctx->optimization_level) == FAILURE) {
99 return FAILURE;
100 }
101
102 if (zend_ssa_escape_analysis(ctx->script, op_array, ssa) == FAILURE) {
103 return FAILURE;
104 }
105
106 if (ctx->debug_level & ZEND_DUMP_DFA_SSA_VARS) {
107 zend_dump_ssa_variables(op_array, ssa, 0);
108 }
109
110 return SUCCESS;
111 }
112
zend_ssa_remove_nops(zend_op_array * op_array,zend_ssa * ssa,zend_optimizer_ctx * ctx)113 static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_optimizer_ctx *ctx)
114 {
115 zend_basic_block *blocks = ssa->cfg.blocks;
116 zend_basic_block *blocks_end = blocks + ssa->cfg.blocks_count;
117 zend_basic_block *b;
118 zend_func_info *func_info;
119 int j;
120 uint32_t i = 0;
121 uint32_t target = 0;
122 uint32_t *shiftlist;
123 ALLOCA_FLAG(use_heap);
124
125 shiftlist = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last, use_heap);
126 memset(shiftlist, 0, sizeof(uint32_t) * op_array->last);
127 /* remove empty callee_info */
128 func_info = ZEND_FUNC_INFO(op_array);
129 if (func_info) {
130 zend_call_info **call_info = &func_info->callee_info;
131 while ((*call_info)) {
132 if ((*call_info)->caller_init_opline->opcode == ZEND_NOP) {
133 *call_info = (*call_info)->next_callee;
134 } else {
135 call_info = &(*call_info)->next_callee;
136 }
137 }
138 }
139
140 for (b = blocks; b < blocks_end; b++) {
141 if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
142 if (b->len) {
143 uint32_t new_start, old_end;
144 while (i < b->start) {
145 shiftlist[i] = i - target;
146 i++;
147 }
148
149 if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
150 /* Only keep the FREE for the loop var */
151 ZEND_ASSERT(op_array->opcodes[b->start].opcode == ZEND_FREE
152 || op_array->opcodes[b->start].opcode == ZEND_FE_FREE);
153 b->len = 1;
154 }
155
156 new_start = target;
157 old_end = b->start + b->len;
158 while (i < old_end) {
159 shiftlist[i] = i - target;
160 if (EXPECTED(op_array->opcodes[i].opcode != ZEND_NOP)) {
161 if (i != target) {
162 op_array->opcodes[target] = op_array->opcodes[i];
163 ssa->ops[target] = ssa->ops[i];
164 ssa->cfg.map[target] = b - blocks;
165 }
166 target++;
167 }
168 i++;
169 }
170 b->start = new_start;
171 if (target != old_end) {
172 zend_op *opline;
173 zend_op *new_opline;
174
175 b->len = target - b->start;
176 opline = op_array->opcodes + old_end - 1;
177 if (opline->opcode == ZEND_NOP) {
178 continue;
179 }
180
181 new_opline = op_array->opcodes + target - 1;
182 zend_optimizer_migrate_jump(op_array, new_opline, opline);
183 }
184 } else {
185 b->start = target;
186 }
187 } else {
188 b->start = target;
189 b->len = 0;
190 }
191 }
192
193 if (target != op_array->last) {
194 /* reset rest opcodes */
195 for (i = target; i < op_array->last; i++) {
196 MAKE_NOP(op_array->opcodes + i);
197 }
198
199 /* update SSA variables */
200 for (j = 0; j < ssa->vars_count; j++) {
201 if (ssa->vars[j].definition >= 0) {
202 ssa->vars[j].definition -= shiftlist[ssa->vars[j].definition];
203 }
204 if (ssa->vars[j].use_chain >= 0) {
205 ssa->vars[j].use_chain -= shiftlist[ssa->vars[j].use_chain];
206 }
207 }
208 for (i = 0; i < op_array->last; i++) {
209 if (ssa->ops[i].op1_use_chain >= 0) {
210 ssa->ops[i].op1_use_chain -= shiftlist[ssa->ops[i].op1_use_chain];
211 }
212 if (ssa->ops[i].op2_use_chain >= 0) {
213 ssa->ops[i].op2_use_chain -= shiftlist[ssa->ops[i].op2_use_chain];
214 }
215 if (ssa->ops[i].res_use_chain >= 0) {
216 ssa->ops[i].res_use_chain -= shiftlist[ssa->ops[i].res_use_chain];
217 }
218 }
219
220 /* update branch targets */
221 for (b = blocks; b < blocks_end; b++) {
222 if ((b->flags & ZEND_BB_REACHABLE) && b->len != 0) {
223 zend_op *opline = op_array->opcodes + b->start + b->len - 1;
224 zend_optimizer_shift_jump(op_array, opline, shiftlist);
225 }
226 }
227
228 /* update try/catch array */
229 for (j = 0; j < op_array->last_try_catch; j++) {
230 op_array->try_catch_array[j].try_op -= shiftlist[op_array->try_catch_array[j].try_op];
231 op_array->try_catch_array[j].catch_op -= shiftlist[op_array->try_catch_array[j].catch_op];
232 if (op_array->try_catch_array[j].finally_op) {
233 op_array->try_catch_array[j].finally_op -= shiftlist[op_array->try_catch_array[j].finally_op];
234 op_array->try_catch_array[j].finally_end -= shiftlist[op_array->try_catch_array[j].finally_end];
235 }
236 }
237
238 /* update call graph */
239 if (func_info) {
240 zend_call_info *call_info = func_info->callee_info;
241 while (call_info) {
242 call_info->caller_init_opline -=
243 shiftlist[call_info->caller_init_opline - op_array->opcodes];
244 if (call_info->caller_call_opline) {
245 call_info->caller_call_opline -=
246 shiftlist[call_info->caller_call_opline - op_array->opcodes];
247 }
248 call_info = call_info->next_callee;
249 }
250 }
251
252 op_array->last = target;
253 }
254 free_alloca(shiftlist, use_heap);
255 }
256
safe_instanceof(zend_class_entry * ce1,zend_class_entry * ce2)257 static bool safe_instanceof(zend_class_entry *ce1, zend_class_entry *ce2) {
258 if (ce1 == ce2) {
259 return 1;
260 }
261 if (!(ce1->ce_flags & ZEND_ACC_LINKED)) {
262 /* This case could be generalized, similarly to unlinked_instanceof */
263 return 0;
264 }
265 return instanceof_function(ce1, ce2);
266 }
267
can_elide_list_type(const zend_script * script,const zend_op_array * op_array,const zend_ssa_var_info * use_info,zend_type type)268 static inline bool can_elide_list_type(
269 const zend_script *script, const zend_op_array *op_array,
270 const zend_ssa_var_info *use_info, zend_type type)
271 {
272 zend_type *single_type;
273 /* For intersection: result==false is failure, default is success.
274 * For union: result==true is success, default is failure. */
275 bool is_intersection = ZEND_TYPE_IS_INTERSECTION(type);
276 ZEND_TYPE_FOREACH(type, single_type) {
277 if (ZEND_TYPE_HAS_LIST(*single_type)) {
278 ZEND_ASSERT(!is_intersection);
279 return can_elide_list_type(script, op_array, use_info, *single_type);
280 }
281 if (ZEND_TYPE_HAS_NAME(*single_type)) {
282 zend_string *lcname = zend_string_tolower(ZEND_TYPE_NAME(*single_type));
283 zend_class_entry *ce = zend_optimizer_get_class_entry(script, op_array, lcname);
284 zend_string_release(lcname);
285 bool result = ce && safe_instanceof(use_info->ce, ce);
286 if (result == !is_intersection) {
287 return result;
288 }
289 }
290 } ZEND_TYPE_FOREACH_END();
291 return is_intersection;
292 }
293
can_elide_return_type_check(const zend_script * script,zend_op_array * op_array,zend_ssa * ssa,zend_ssa_op * ssa_op)294 static inline bool can_elide_return_type_check(
295 const zend_script *script, zend_op_array *op_array, zend_ssa *ssa, zend_ssa_op *ssa_op) {
296 zend_arg_info *arg_info = &op_array->arg_info[-1];
297 zend_ssa_var_info *use_info = &ssa->var_info[ssa_op->op1_use];
298 uint32_t use_type = use_info->type & (MAY_BE_ANY|MAY_BE_UNDEF);
299 if (use_type & MAY_BE_REF) {
300 return 0;
301 }
302
303 if (use_type & MAY_BE_UNDEF) {
304 use_type &= ~MAY_BE_UNDEF;
305 use_type |= MAY_BE_NULL;
306 }
307
308 uint32_t disallowed_types = use_type & ~ZEND_TYPE_PURE_MASK(arg_info->type);
309 if (!disallowed_types) {
310 /* Only contains allowed types. */
311 return true;
312 }
313
314 if (disallowed_types == MAY_BE_OBJECT && use_info->ce && ZEND_TYPE_IS_COMPLEX(arg_info->type)) {
315 return can_elide_list_type(script, op_array, use_info, arg_info->type);
316 }
317
318 return false;
319 }
320
opline_supports_assign_contraction(zend_op_array * op_array,zend_ssa * ssa,zend_op * opline,int src_var,uint32_t cv_var)321 static bool opline_supports_assign_contraction(
322 zend_op_array *op_array, zend_ssa *ssa, zend_op *opline, int src_var, uint32_t cv_var) {
323 if (opline->opcode == ZEND_NEW) {
324 /* see Zend/tests/generators/aborted_yield_during_new.phpt */
325 return 0;
326 }
327
328 if (opline->opcode == ZEND_DO_ICALL || opline->opcode == ZEND_DO_UCALL
329 || opline->opcode == ZEND_DO_FCALL || opline->opcode == ZEND_DO_FCALL_BY_NAME) {
330 /* Function calls may dtor the return value after it has already been written -- allow
331 * direct assignment only for types where a double-dtor does not matter. */
332 uint32_t type = ssa->var_info[src_var].type;
333 uint32_t simple = MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE;
334 return !((type & MAY_BE_ANY) & ~simple);
335 }
336
337 if (opline->opcode == ZEND_POST_INC || opline->opcode == ZEND_POST_DEC) {
338 /* POST_INC/DEC write the result variable before performing the inc/dec. For $i = $i++
339 * eliding the temporary variable would thus yield an incorrect result. */
340 return opline->op1_type != IS_CV || opline->op1.var != cv_var;
341 }
342
343 if (opline->opcode == ZEND_INIT_ARRAY) {
344 /* INIT_ARRAY initializes the result array before reading key/value. */
345 return (opline->op1_type != IS_CV || opline->op1.var != cv_var)
346 && (opline->op2_type != IS_CV || opline->op2.var != cv_var);
347 }
348
349 if (opline->opcode == ZEND_CAST
350 && (opline->extended_value == IS_ARRAY || opline->extended_value == IS_OBJECT)) {
351 /* CAST to array/object may initialize the result to an empty array/object before
352 * reading the expression. */
353 return opline->op1_type != IS_CV || opline->op1.var != cv_var;
354 }
355
356 if ((opline->opcode == ZEND_ASSIGN_OP
357 || opline->opcode == ZEND_ASSIGN_OBJ
358 || opline->opcode == ZEND_ASSIGN_DIM
359 || opline->opcode == ZEND_ASSIGN_OBJ_OP
360 || opline->opcode == ZEND_ASSIGN_DIM_OP)
361 && opline->op1_type == IS_CV
362 && opline->op1.var == cv_var
363 && zend_may_throw(opline, &ssa->ops[ssa->vars[src_var].definition], op_array, ssa)) {
364 return 0;
365 }
366
367 return 1;
368 }
369
variable_defined_or_used_in_range(zend_ssa * ssa,int var,int start,int end)370 static bool variable_defined_or_used_in_range(zend_ssa *ssa, int var, int start, int end)
371 {
372 while (start < end) {
373 const zend_ssa_op *ssa_op = &ssa->ops[start];
374 if ((ssa_op->op1_def >= 0 && ssa->vars[ssa_op->op1_def].var == var) ||
375 (ssa_op->op2_def >= 0 && ssa->vars[ssa_op->op2_def].var == var) ||
376 (ssa_op->result_def >= 0 && ssa->vars[ssa_op->result_def].var == var) ||
377 (ssa_op->op1_use >= 0 && ssa->vars[ssa_op->op1_use].var == var) ||
378 (ssa_op->op2_use >= 0 && ssa->vars[ssa_op->op2_use].var == var) ||
379 (ssa_op->result_use >= 0 && ssa->vars[ssa_op->result_use].var == var)
380 ) {
381 return 1;
382 }
383 start++;
384 }
385 return 0;
386 }
387
zend_dfa_optimize_calls(zend_op_array * op_array,zend_ssa * ssa)388 int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
389 {
390 zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
391 int removed_ops = 0;
392
393 if (func_info->callee_info) {
394 zend_call_info *call_info = func_info->callee_info;
395
396 do {
397 if (call_info->caller_call_opline
398 && call_info->caller_call_opline->opcode == ZEND_DO_ICALL
399 && call_info->callee_func
400 && zend_string_equals_literal(call_info->callee_func->common.function_name, "in_array")
401 && (call_info->caller_init_opline->extended_value == 2
402 || (call_info->caller_init_opline->extended_value == 3
403 && (call_info->caller_call_opline - 1)->opcode == ZEND_SEND_VAL
404 && (call_info->caller_call_opline - 1)->op1_type == IS_CONST))) {
405
406 zend_op *send_array;
407 zend_op *send_needly;
408 bool strict = 0;
409 ZEND_ASSERT(!call_info->is_prototype);
410
411 if (call_info->caller_init_opline->extended_value == 2) {
412 send_array = call_info->caller_call_opline - 1;
413 send_needly = call_info->caller_call_opline - 2;
414 } else {
415 if (zend_is_true(CT_CONSTANT_EX(op_array, (call_info->caller_call_opline - 1)->op1.constant))) {
416 strict = 1;
417 }
418 send_array = call_info->caller_call_opline - 2;
419 send_needly = call_info->caller_call_opline - 3;
420 }
421
422 if (send_array->opcode == ZEND_SEND_VAL
423 && send_array->op1_type == IS_CONST
424 && Z_TYPE_P(CT_CONSTANT_EX(op_array, send_array->op1.constant)) == IS_ARRAY
425 && (send_needly->opcode == ZEND_SEND_VAL
426 || send_needly->opcode == ZEND_SEND_VAR)
427 ) {
428 bool ok = 1;
429
430 HashTable *src = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, send_array->op1.constant));
431 HashTable *dst;
432 zval *val, tmp;
433 zend_ulong idx;
434
435 ZVAL_TRUE(&tmp);
436 dst = zend_new_array(zend_hash_num_elements(src));
437 if (strict) {
438 ZEND_HASH_FOREACH_VAL(src, val) {
439 if (Z_TYPE_P(val) == IS_STRING) {
440 zend_hash_add(dst, Z_STR_P(val), &tmp);
441 } else if (Z_TYPE_P(val) == IS_LONG) {
442 zend_hash_index_add(dst, Z_LVAL_P(val), &tmp);
443 } else {
444 zend_array_destroy(dst);
445 ok = 0;
446 break;
447 }
448 } ZEND_HASH_FOREACH_END();
449 } else {
450 ZEND_HASH_FOREACH_VAL(src, val) {
451 if (Z_TYPE_P(val) != IS_STRING || ZEND_HANDLE_NUMERIC(Z_STR_P(val), idx)) {
452 zend_array_destroy(dst);
453 ok = 0;
454 break;
455 }
456 zend_hash_add(dst, Z_STR_P(val), &tmp);
457 } ZEND_HASH_FOREACH_END();
458 }
459
460 if (ok) {
461 uint32_t op_num = send_needly - op_array->opcodes;
462 zend_ssa_op *ssa_op = ssa->ops + op_num;
463
464 if (ssa_op->op1_use >= 0) {
465 /* Reconstruct SSA */
466 int var_num = ssa_op->op1_use;
467 zend_ssa_var *var = ssa->vars + var_num;
468
469 ZEND_ASSERT(ssa_op->op1_def < 0);
470 zend_ssa_unlink_use_chain(ssa, op_num, ssa_op->op1_use);
471 ssa_op->op1_use = -1;
472 ssa_op->op1_use_chain = -1;
473 op_num = call_info->caller_call_opline - op_array->opcodes;
474 ssa_op = ssa->ops + op_num;
475 ssa_op->op1_use = var_num;
476 ssa_op->op1_use_chain = var->use_chain;
477 var->use_chain = op_num;
478 }
479
480 ZVAL_ARR(&tmp, dst);
481
482 /* Update opcode */
483 call_info->caller_call_opline->opcode = ZEND_IN_ARRAY;
484 call_info->caller_call_opline->extended_value = strict;
485 call_info->caller_call_opline->op1_type = send_needly->op1_type;
486 call_info->caller_call_opline->op1.num = send_needly->op1.num;
487 call_info->caller_call_opline->op2_type = IS_CONST;
488 call_info->caller_call_opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
489 if (call_info->caller_init_opline->extended_value == 3) {
490 MAKE_NOP(call_info->caller_call_opline - 1);
491 }
492 MAKE_NOP(call_info->caller_init_opline);
493 MAKE_NOP(send_needly);
494 MAKE_NOP(send_array);
495 removed_ops++;
496
497 op_num = call_info->caller_call_opline - op_array->opcodes;
498 ssa_op = ssa->ops + op_num;
499 if (ssa_op->result_def >= 0) {
500 int var = ssa_op->result_def;
501 int use = ssa->vars[var].use_chain;
502
503 /* If the result is used only in a JMPZ/JMPNZ, replace result type with
504 * IS_TMP_VAR, which will enable use of smart branches. Don't do this
505 * in other cases, as not all opcodes support both VAR and TMP. */
506 if (ssa->vars[var].phi_use_chain == NULL
507 && ssa->ops[use].op1_use == var
508 && ssa->ops[use].op1_use_chain == -1
509 && (op_array->opcodes[use].opcode == ZEND_JMPZ
510 || op_array->opcodes[use].opcode == ZEND_JMPNZ)) {
511 call_info->caller_call_opline->result_type = IS_TMP_VAR;
512 op_array->opcodes[use].op1_type = IS_TMP_VAR;
513 }
514 }
515 }
516 }
517 }
518 call_info = call_info->next_callee;
519 } while (call_info);
520 }
521
522 return removed_ops;
523 }
524
take_successor_0(zend_ssa * ssa,int block_num,zend_basic_block * block)525 static zend_always_inline void take_successor_0(zend_ssa *ssa, int block_num, zend_basic_block *block)
526 {
527 if (block->successors_count == 2) {
528 if (block->successors[1] != block->successors[0]) {
529 zend_ssa_remove_predecessor(ssa, block_num, block->successors[1]);
530 }
531 block->successors_count = 1;
532 }
533 }
534
take_successor_1(zend_ssa * ssa,int block_num,zend_basic_block * block)535 static zend_always_inline void take_successor_1(zend_ssa *ssa, int block_num, zend_basic_block *block)
536 {
537 if (block->successors_count == 2) {
538 if (block->successors[1] != block->successors[0]) {
539 zend_ssa_remove_predecessor(ssa, block_num, block->successors[0]);
540 block->successors[0] = block->successors[1];
541 }
542 block->successors_count = 1;
543 }
544 }
545
take_successor_ex(zend_ssa * ssa,int block_num,zend_basic_block * block,int target_block)546 static zend_always_inline void take_successor_ex(zend_ssa *ssa, int block_num, zend_basic_block *block, int target_block)
547 {
548 int i;
549
550 for (i = 0; i < block->successors_count; i++) {
551 if (block->successors[i] != target_block) {
552 zend_ssa_remove_predecessor(ssa, block_num, block->successors[i]);
553 }
554 }
555 block->successors[0] = target_block;
556 block->successors_count = 1;
557 }
558
compress_block(zend_op_array * op_array,zend_basic_block * block)559 static void compress_block(zend_op_array *op_array, zend_basic_block *block)
560 {
561 while (block->len > 0) {
562 zend_op *opline = &op_array->opcodes[block->start + block->len - 1];
563
564 if (opline->opcode == ZEND_NOP) {
565 block->len--;
566 } else {
567 break;
568 }
569 }
570 }
571
replace_predecessor(zend_ssa * ssa,int block_id,int old_pred,int new_pred)572 static void replace_predecessor(zend_ssa *ssa, int block_id, int old_pred, int new_pred) {
573 zend_basic_block *block = &ssa->cfg.blocks[block_id];
574 int *predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
575 zend_ssa_phi *phi;
576
577 int i;
578 int old_pred_idx = -1;
579 int new_pred_idx = -1;
580 for (i = 0; i < block->predecessors_count; i++) {
581 if (predecessors[i] == old_pred) {
582 old_pred_idx = i;
583 }
584 if (predecessors[i] == new_pred) {
585 new_pred_idx = i;
586 }
587 }
588
589 ZEND_ASSERT(old_pred_idx != -1);
590 if (new_pred_idx == -1) {
591 /* If the new predecessor doesn't exist yet, simply rewire the old one */
592 predecessors[old_pred_idx] = new_pred;
593 } else {
594 /* Otherwise, rewiring the old predecessor would make the new predecessor appear
595 * twice, which violates our CFG invariants. Remove the old predecessor instead. */
596 memmove(
597 predecessors + old_pred_idx,
598 predecessors + old_pred_idx + 1,
599 sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
600 );
601
602 /* Also remove the corresponding phi node entries */
603 for (phi = ssa->blocks[block_id].phis; phi; phi = phi->next) {
604 if (phi->pi >= 0) {
605 if (phi->pi == old_pred || phi->pi == new_pred) {
606 zend_ssa_rename_var_uses(
607 ssa, phi->ssa_var, phi->sources[0], /* update_types */ 0);
608 zend_ssa_remove_phi(ssa, phi);
609 }
610 } else {
611 memmove(
612 phi->sources + old_pred_idx,
613 phi->sources + old_pred_idx + 1,
614 sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
615 );
616 }
617 }
618
619 block->predecessors_count--;
620 }
621 }
622
zend_ssa_replace_control_link(zend_op_array * op_array,zend_ssa * ssa,int from,int to,int new_to)623 static void zend_ssa_replace_control_link(zend_op_array *op_array, zend_ssa *ssa, int from, int to, int new_to)
624 {
625 zend_basic_block *src = &ssa->cfg.blocks[from];
626 zend_basic_block *old = &ssa->cfg.blocks[to];
627 zend_basic_block *dst = &ssa->cfg.blocks[new_to];
628 int i;
629 zend_op *opline;
630
631 for (i = 0; i < src->successors_count; i++) {
632 if (src->successors[i] == to) {
633 src->successors[i] = new_to;
634 }
635 }
636
637 if (src->len > 0) {
638 opline = op_array->opcodes + src->start + src->len - 1;
639 switch (opline->opcode) {
640 case ZEND_JMP:
641 case ZEND_FAST_CALL:
642 ZEND_ASSERT(ZEND_OP1_JMP_ADDR(opline) == op_array->opcodes + old->start);
643 ZEND_SET_OP_JMP_ADDR(opline, opline->op1, op_array->opcodes + dst->start);
644 break;
645 case ZEND_JMPZ:
646 case ZEND_JMPNZ:
647 case ZEND_JMPZ_EX:
648 case ZEND_JMPNZ_EX:
649 case ZEND_FE_RESET_R:
650 case ZEND_FE_RESET_RW:
651 case ZEND_JMP_SET:
652 case ZEND_COALESCE:
653 case ZEND_ASSERT_CHECK:
654 case ZEND_JMP_NULL:
655 case ZEND_BIND_INIT_STATIC_OR_JMP:
656 if (ZEND_OP2_JMP_ADDR(opline) == op_array->opcodes + old->start) {
657 ZEND_SET_OP_JMP_ADDR(opline, opline->op2, op_array->opcodes + dst->start);
658 }
659 break;
660 case ZEND_CATCH:
661 if (!(opline->extended_value & ZEND_LAST_CATCH)) {
662 if (ZEND_OP2_JMP_ADDR(opline) == op_array->opcodes + old->start) {
663 ZEND_SET_OP_JMP_ADDR(opline, opline->op2, op_array->opcodes + dst->start);
664 }
665 }
666 break;
667 case ZEND_FE_FETCH_R:
668 case ZEND_FE_FETCH_RW:
669 if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) == old->start) {
670 opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
671 }
672 break;
673 case ZEND_SWITCH_LONG:
674 case ZEND_SWITCH_STRING:
675 case ZEND_MATCH:
676 {
677 HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
678 zval *zv;
679 ZEND_HASH_FOREACH_VAL(jumptable, zv) {
680 if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv)) == old->start) {
681 Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
682 }
683 } ZEND_HASH_FOREACH_END();
684 if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) == old->start) {
685 opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
686 }
687 break;
688 }
689 }
690 }
691
692 replace_predecessor(ssa, new_to, to, from);
693 }
694
zend_ssa_unlink_block(zend_op_array * op_array,zend_ssa * ssa,zend_basic_block * block,int block_num)695 static void zend_ssa_unlink_block(zend_op_array *op_array, zend_ssa *ssa, zend_basic_block *block, int block_num)
696 {
697 if (block->predecessors_count == 1 && ssa->blocks[block_num].phis == NULL) {
698 int *predecessors, i;
699 zend_basic_block *fe_fetch_block = NULL;
700
701 ZEND_ASSERT(block->successors_count == 1);
702 predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
703 if (block->predecessors_count == 1 && (block->flags & ZEND_BB_FOLLOW)) {
704 zend_basic_block *pred_block = &ssa->cfg.blocks[predecessors[0]];
705
706 if (pred_block->len > 0 && (pred_block->flags & ZEND_BB_REACHABLE)) {
707 if ((op_array->opcodes[pred_block->start + pred_block->len - 1].opcode == ZEND_FE_FETCH_R
708 || op_array->opcodes[pred_block->start + pred_block->len - 1].opcode == ZEND_FE_FETCH_RW)
709 && op_array->opcodes[pred_block->start + pred_block->len - 1].op2_type == IS_CV) {
710 fe_fetch_block = pred_block;
711 }
712 }
713 }
714 for (i = 0; i < block->predecessors_count; i++) {
715 zend_ssa_replace_control_link(op_array, ssa, predecessors[i], block_num, block->successors[0]);
716 }
717 zend_ssa_remove_block(op_array, ssa, block_num);
718 if (fe_fetch_block && fe_fetch_block->successors[0] == fe_fetch_block->successors[1]) {
719 /* The body of "foreach" loop was removed */
720 int ssa_var = ssa->ops[fe_fetch_block->start + fe_fetch_block->len - 1].op2_def;
721 if (ssa_var >= 0) {
722 zend_ssa_remove_uses_of_var(ssa, ssa_var);
723 }
724 }
725 }
726 }
727
zend_dfa_optimize_jmps(zend_op_array * op_array,zend_ssa * ssa)728 static int zend_dfa_optimize_jmps(zend_op_array *op_array, zend_ssa *ssa)
729 {
730 int removed_ops = 0;
731 int block_num = 0;
732
733 for (block_num = 1; block_num < ssa->cfg.blocks_count; block_num++) {
734 zend_basic_block *block = &ssa->cfg.blocks[block_num];
735
736 if (!(block->flags & ZEND_BB_REACHABLE)) {
737 continue;
738 }
739 compress_block(op_array, block);
740 if (block->len == 0) {
741 zend_ssa_unlink_block(op_array, ssa, block, block_num);
742 }
743 }
744
745 block_num = 0;
746 while (block_num < ssa->cfg.blocks_count
747 && !(ssa->cfg.blocks[block_num].flags & ZEND_BB_REACHABLE)) {
748 block_num++;
749 }
750 while (block_num < ssa->cfg.blocks_count) {
751 int next_block_num = block_num + 1;
752 zend_basic_block *block = &ssa->cfg.blocks[block_num];
753 uint32_t op_num;
754 zend_op *opline;
755 zend_ssa_op *ssa_op;
756 bool can_follow = 1;
757
758 while (next_block_num < ssa->cfg.blocks_count
759 && !(ssa->cfg.blocks[next_block_num].flags & ZEND_BB_REACHABLE)) {
760 if (ssa->cfg.blocks[next_block_num].flags & ZEND_BB_UNREACHABLE_FREE) {
761 can_follow = 0;
762 }
763 next_block_num++;
764 }
765
766 if (block->len) {
767 op_num = block->start + block->len - 1;
768 opline = op_array->opcodes + op_num;
769 ssa_op = ssa->ops + op_num;
770
771 switch (opline->opcode) {
772 case ZEND_JMP:
773 optimize_jmp:
774 if (block->successors[0] == next_block_num && can_follow) {
775 MAKE_NOP(opline);
776 removed_ops++;
777 goto optimize_nop;
778 }
779 break;
780 case ZEND_JMPZ:
781 optimize_jmpz:
782 if (opline->op1_type == IS_CONST) {
783 if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
784 MAKE_NOP(opline);
785 removed_ops++;
786 take_successor_1(ssa, block_num, block);
787 goto optimize_nop;
788 } else {
789 opline->opcode = ZEND_JMP;
790 COPY_NODE(opline->op1, opline->op2);
791 take_successor_0(ssa, block_num, block);
792 goto optimize_jmp;
793 }
794 } else {
795 if (block->successors[0] == next_block_num && can_follow) {
796 take_successor_0(ssa, block_num, block);
797 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_UNDEF)) {
798 opline->opcode = ZEND_CHECK_VAR;
799 opline->op2.num = 0;
800 } else if (opline->op1_type == IS_CV || !(OP1_INFO() & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
801 zend_ssa_remove_instr(ssa, opline, ssa_op);
802 removed_ops++;
803 goto optimize_nop;
804 } else {
805 opline->opcode = ZEND_FREE;
806 opline->op2.num = 0;
807 }
808 }
809 }
810 break;
811 case ZEND_JMPNZ:
812 optimize_jmpnz:
813 if (opline->op1_type == IS_CONST) {
814 if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
815 opline->opcode = ZEND_JMP;
816 COPY_NODE(opline->op1, opline->op2);
817 take_successor_0(ssa, block_num, block);
818 goto optimize_jmp;
819 } else {
820 MAKE_NOP(opline);
821 removed_ops++;
822 take_successor_1(ssa, block_num, block);
823 goto optimize_nop;
824 }
825 } else if (block->successors_count == 2) {
826 if (block->successors[0] == next_block_num && can_follow) {
827 take_successor_0(ssa, block_num, block);
828 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_UNDEF)) {
829 opline->opcode = ZEND_CHECK_VAR;
830 opline->op2.num = 0;
831 } else if (opline->op1_type == IS_CV || !(OP1_INFO() & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
832 zend_ssa_remove_instr(ssa, opline, ssa_op);
833 removed_ops++;
834 goto optimize_nop;
835 } else {
836 opline->opcode = ZEND_FREE;
837 opline->op2.num = 0;
838 }
839 }
840 }
841 break;
842 case ZEND_JMPZ_EX:
843 if (ssa->vars[ssa_op->result_def].use_chain < 0
844 && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
845 opline->opcode = ZEND_JMPZ;
846 opline->result_type = IS_UNUSED;
847 zend_ssa_remove_result_def(ssa, ssa_op);
848 goto optimize_jmpz;
849 } else if (opline->op1_type == IS_CONST) {
850 if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
851 opline->opcode = ZEND_BOOL;
852 take_successor_1(ssa, block_num, block);
853 }
854 }
855 break;
856 case ZEND_JMPNZ_EX:
857 if (ssa->vars[ssa_op->result_def].use_chain < 0
858 && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
859 opline->opcode = ZEND_JMPNZ;
860 opline->result_type = IS_UNUSED;
861 zend_ssa_remove_result_def(ssa, ssa_op);
862 goto optimize_jmpnz;
863 } else if (opline->op1_type == IS_CONST) {
864 if (!zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
865 opline->opcode = ZEND_BOOL;
866 take_successor_1(ssa, block_num, block);
867 }
868 }
869 break;
870 case ZEND_JMP_SET:
871 if (ssa->vars[ssa_op->result_def].use_chain < 0
872 && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
873 opline->opcode = ZEND_JMPNZ;
874 opline->result_type = IS_UNUSED;
875 zend_ssa_remove_result_def(ssa, ssa_op);
876 goto optimize_jmpnz;
877 } else if (opline->op1_type == IS_CONST) {
878 if (!zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
879 MAKE_NOP(opline);
880 removed_ops++;
881 take_successor_1(ssa, block_num, block);
882 zend_ssa_remove_result_def(ssa, ssa_op);
883 goto optimize_nop;
884 }
885 }
886 break;
887 case ZEND_COALESCE:
888 {
889 zend_ssa_var *var = &ssa->vars[ssa_op->result_def];
890 if (opline->op1_type == IS_CONST
891 && var->use_chain < 0 && var->phi_use_chain == NULL) {
892 if (Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op1.constant)) == IS_NULL) {
893 zend_ssa_remove_result_def(ssa, ssa_op);
894 MAKE_NOP(opline);
895 removed_ops++;
896 take_successor_1(ssa, block_num, block);
897 goto optimize_nop;
898 } else {
899 opline->opcode = ZEND_JMP;
900 opline->result_type = IS_UNUSED;
901 zend_ssa_remove_result_def(ssa, ssa_op);
902 COPY_NODE(opline->op1, opline->op2);
903 take_successor_0(ssa, block_num, block);
904 goto optimize_jmp;
905 }
906 }
907 break;
908 }
909 case ZEND_JMP_NULL:
910 {
911 zend_ssa_var *var = &ssa->vars[ssa_op->result_def];
912 if (opline->op1_type == IS_CONST
913 && var->use_chain < 0 && var->phi_use_chain == NULL) {
914 if (Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op1.constant)) == IS_NULL) {
915 opline->opcode = ZEND_JMP;
916 opline->result_type = IS_UNUSED;
917 zend_ssa_remove_result_def(ssa, ssa_op);
918 COPY_NODE(opline->op1, opline->op2);
919 take_successor_0(ssa, block_num, block);
920 goto optimize_jmp;
921 } else {
922 zend_ssa_remove_result_def(ssa, ssa_op);
923 MAKE_NOP(opline);
924 removed_ops++;
925 take_successor_1(ssa, block_num, block);
926 goto optimize_nop;
927 }
928 }
929 break;
930 }
931 case ZEND_SWITCH_LONG:
932 case ZEND_SWITCH_STRING:
933 case ZEND_MATCH:
934 if (opline->op1_type == IS_CONST) {
935 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
936 uint8_t type = Z_TYPE_P(zv);
937 bool correct_type =
938 (opline->opcode == ZEND_SWITCH_LONG && type == IS_LONG)
939 || (opline->opcode == ZEND_SWITCH_STRING && type == IS_STRING)
940 || (opline->opcode == ZEND_MATCH && (type == IS_LONG || type == IS_STRING));
941
942 /* Switch statements have a fallback chain for loose comparison. In those
943 * cases the SWITCH_* instruction is a NOP. Match does strict comparison and
944 * thus jumps to the default branch on mismatched types, so we need to
945 * convert MATCH to a jmp. */
946 if (!correct_type && opline->opcode != ZEND_MATCH) {
947 removed_ops++;
948 MAKE_NOP(opline);
949 opline->extended_value = 0;
950 take_successor_ex(ssa, block_num, block, block->successors[block->successors_count - 1]);
951 goto optimize_nop;
952 }
953
954 uint32_t target;
955 if (correct_type) {
956 HashTable *jmptable = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant));
957 zval *jmp_zv = type == IS_LONG
958 ? zend_hash_index_find(jmptable, Z_LVAL_P(zv))
959 : zend_hash_find(jmptable, Z_STR_P(zv));
960
961 if (jmp_zv) {
962 target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(jmp_zv));
963 } else {
964 target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value);
965 }
966 } else {
967 ZEND_ASSERT(opline->opcode == ZEND_MATCH);
968 target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value);
969 }
970 opline->opcode = ZEND_JMP;
971 opline->extended_value = 0;
972 SET_UNUSED(opline->op1);
973 ZEND_SET_OP_JMP_ADDR(opline, opline->op1, op_array->opcodes + target);
974 SET_UNUSED(opline->op2);
975 take_successor_ex(ssa, block_num, block, ssa->cfg.map[target]);
976 goto optimize_jmp;
977 }
978 break;
979 case ZEND_NOP:
980 optimize_nop:
981 compress_block(op_array, block);
982 if (block->len == 0) {
983 if (block_num > 0) {
984 zend_ssa_unlink_block(op_array, ssa, block, block_num);
985 /* backtrack to previous basic block */
986 do {
987 block_num--;
988 } while (block_num >= 0
989 && !(ssa->cfg.blocks[block_num].flags & ZEND_BB_REACHABLE));
990 if (block_num >= 0) {
991 continue;
992 }
993 }
994 }
995 break;
996 default:
997 break;
998 }
999 }
1000
1001 block_num = next_block_num;
1002 }
1003
1004 return removed_ops;
1005 }
1006
zend_dfa_try_to_replace_result(zend_op_array * op_array,zend_ssa * ssa,int def,int cv_var)1007 static bool zend_dfa_try_to_replace_result(zend_op_array *op_array, zend_ssa *ssa, int def, int cv_var)
1008 {
1009 int result_var = ssa->ops[def].result_def;
1010 int cv = EX_NUM_TO_VAR(ssa->vars[cv_var].var);
1011
1012 if (result_var >= 0
1013 && !(ssa->var_info[cv_var].type & MAY_BE_REF)
1014 && ssa->vars[cv_var].alias == NO_ALIAS
1015 && ssa->vars[result_var].phi_use_chain == NULL
1016 && ssa->vars[result_var].sym_use_chain == NULL) {
1017 int use = ssa->vars[result_var].use_chain;
1018
1019 if (use >= 0
1020 && zend_ssa_next_use(ssa->ops, result_var, use) < 0
1021 && op_array->opcodes[use].opcode != ZEND_FREE
1022 && op_array->opcodes[use].opcode != ZEND_SEND_VAL
1023 && op_array->opcodes[use].opcode != ZEND_SEND_VAL_EX
1024 && op_array->opcodes[use].opcode != ZEND_VERIFY_RETURN_TYPE
1025 && op_array->opcodes[use].opcode != ZEND_YIELD) {
1026 if (use > def) {
1027 int i = use;
1028 const zend_op *opline = &op_array->opcodes[use];
1029
1030 while (i > def) {
1031 if ((opline->op1_type == IS_CV && opline->op1.var == cv)
1032 || (opline->op2_type == IS_CV && opline->op2.var == cv)
1033 || (opline->result_type == IS_CV && opline->result.var == cv)) {
1034 return 0;
1035 }
1036 opline--;
1037 i--;
1038 }
1039
1040 /* Update opcodes and reconstruct SSA */
1041 ssa->vars[result_var].definition = -1;
1042 ssa->vars[result_var].use_chain = -1;
1043 ssa->ops[def].result_def = -1;
1044
1045 op_array->opcodes[def].result_type = IS_UNUSED;
1046 op_array->opcodes[def].result.var = 0;
1047
1048 if (ssa->ops[use].op1_use == result_var) {
1049 ssa->ops[use].op1_use = cv_var;
1050 ssa->ops[use].op1_use_chain = ssa->vars[cv_var].use_chain;
1051 ssa->vars[cv_var].use_chain = use;
1052
1053 op_array->opcodes[use].op1_type = IS_CV;
1054 op_array->opcodes[use].op1.var = cv;
1055 } else if (ssa->ops[use].op2_use == result_var) {
1056 ssa->ops[use].op2_use = cv_var;
1057 ssa->ops[use].op2_use_chain = ssa->vars[cv_var].use_chain;
1058 ssa->vars[cv_var].use_chain = use;
1059
1060 op_array->opcodes[use].op2_type = IS_CV;
1061 op_array->opcodes[use].op2.var = cv;
1062 } else if (ssa->ops[use].result_use == result_var) {
1063 ssa->ops[use].result_use = cv_var;
1064 ssa->ops[use].res_use_chain = ssa->vars[cv_var].use_chain;
1065 ssa->vars[cv_var].use_chain = use;
1066
1067 op_array->opcodes[use].result_type = IS_CV;
1068 op_array->opcodes[use].result.var = cv;
1069 }
1070
1071 return 1;
1072 }
1073 }
1074 }
1075
1076 return 0;
1077 }
1078
zend_dfa_optimize_op_array(zend_op_array * op_array,zend_optimizer_ctx * ctx,zend_ssa * ssa,zend_call_info ** call_map)1079 void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa, zend_call_info **call_map)
1080 {
1081 if (ctx->debug_level & ZEND_DUMP_BEFORE_DFA_PASS) {
1082 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "before dfa pass", ssa);
1083 }
1084
1085 if (ssa->var_info) {
1086 int op_1;
1087 int v;
1088 int remove_nops = 0;
1089 zend_op *opline;
1090 zend_ssa_op *ssa_op;
1091 zval tmp;
1092
1093 #if ZEND_DEBUG_DFA
1094 ssa_verify_integrity(op_array, ssa, "before dfa");
1095 #endif
1096
1097 if (ZEND_OPTIMIZER_PASS_8 & ctx->optimization_level) {
1098 if (sccp_optimize_op_array(ctx, op_array, ssa, call_map)) {
1099 remove_nops = 1;
1100 }
1101
1102 if (zend_dfa_optimize_jmps(op_array, ssa)) {
1103 remove_nops = 1;
1104 }
1105
1106 #if ZEND_DEBUG_DFA
1107 ssa_verify_integrity(op_array, ssa, "after sccp");
1108 #endif
1109 if (ZEND_FUNC_INFO(op_array)) {
1110 if (zend_dfa_optimize_calls(op_array, ssa)) {
1111 remove_nops = 1;
1112 }
1113 }
1114 if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_8) {
1115 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after sccp pass", ssa);
1116 }
1117 #if ZEND_DEBUG_DFA
1118 ssa_verify_integrity(op_array, ssa, "after calls");
1119 #endif
1120 }
1121
1122 if (ZEND_OPTIMIZER_PASS_14 & ctx->optimization_level) {
1123 if (dce_optimize_op_array(op_array, ctx, ssa, 0)) {
1124 remove_nops = 1;
1125 }
1126 if (zend_dfa_optimize_jmps(op_array, ssa)) {
1127 remove_nops = 1;
1128 }
1129 if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_14) {
1130 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after dce pass", ssa);
1131 }
1132 #if ZEND_DEBUG_DFA
1133 ssa_verify_integrity(op_array, ssa, "after dce");
1134 #endif
1135 }
1136
1137 for (v = op_array->last_var; v < ssa->vars_count; v++) {
1138
1139 op_1 = ssa->vars[v].definition;
1140
1141 if (op_1 < 0) {
1142 continue;
1143 }
1144
1145 opline = op_array->opcodes + op_1;
1146 ssa_op = &ssa->ops[op_1];
1147
1148 /* Convert LONG constants to DOUBLE */
1149 if (ssa->var_info[v].use_as_double) {
1150 if (opline->opcode == ZEND_ASSIGN
1151 && opline->op2_type == IS_CONST
1152 && ssa->ops[op_1].op1_def == v
1153 && !RETURN_VALUE_USED(opline)
1154 ) {
1155
1156 // op_1: ASSIGN ? -> #v [use_as_double], long(?) => ASSIGN ? -> #v, double(?)
1157
1158 zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1159 ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
1160 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1161 opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
1162
1163 } else if (opline->opcode == ZEND_QM_ASSIGN
1164 && opline->op1_type == IS_CONST
1165 ) {
1166
1167 // op_1: QM_ASSIGN #v [use_as_double], long(?) => QM_ASSIGN #v, double(?)
1168
1169 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1170 ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
1171 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1172 opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
1173 }
1174
1175 } else {
1176 if (opline->opcode == ZEND_ADD
1177 || opline->opcode == ZEND_SUB
1178 || opline->opcode == ZEND_MUL
1179 || opline->opcode == ZEND_IS_EQUAL
1180 || opline->opcode == ZEND_IS_NOT_EQUAL
1181 || opline->opcode == ZEND_IS_SMALLER
1182 || opline->opcode == ZEND_IS_SMALLER_OR_EQUAL
1183 ) {
1184
1185 if (opline->op1_type == IS_CONST && opline->op2_type != IS_CONST) {
1186 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1187
1188 if ((OP2_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
1189 && Z_TYPE_INFO_P(zv) == IS_LONG) {
1190
1191 // op_1: #v.? = ADD long(?), #?.? [double] => #v.? = ADD double(?), #?.? [double]
1192
1193 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1194 opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
1195 zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1196 }
1197 if (opline->opcode == ZEND_ADD) {
1198 zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1199
1200 if (((OP2_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG
1201 && Z_TYPE_INFO_P(zv) == IS_LONG
1202 && Z_LVAL_P(zv) == 0)
1203 || ((OP2_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_DOUBLE
1204 && Z_TYPE_INFO_P(zv) == IS_DOUBLE
1205 && Z_DVAL_P(zv) == 0.0)) {
1206
1207 // op_1: #v.? = ADD 0, #?.? [double,long] => #v.? = QM_ASSIGN #?.?
1208
1209 opline->opcode = ZEND_QM_ASSIGN;
1210 opline->op1_type = opline->op2_type;
1211 opline->op1.var = opline->op2.var;
1212 opline->op2_type = IS_UNUSED;
1213 opline->op2.num = 0;
1214 ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1215 ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1216 ssa->ops[op_1].op2_use = -1;
1217 ssa->ops[op_1].op2_use_chain = -1;
1218 }
1219 } else if (opline->opcode == ZEND_MUL
1220 && (OP2_INFO() & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1221 zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1222
1223 if ((Z_TYPE_INFO_P(zv) == IS_LONG
1224 && Z_LVAL_P(zv) == 2)
1225 || (Z_TYPE_INFO_P(zv) == IS_DOUBLE
1226 && Z_DVAL_P(zv) == 2.0
1227 && !(OP2_INFO() & MAY_BE_LONG))) {
1228
1229 // op_1: #v.? = MUL 2, #x.? [double,long] => #v.? = ADD #x.?, #x.?
1230
1231 opline->opcode = ZEND_ADD;
1232 opline->op1_type = opline->op2_type;
1233 opline->op1.var = opline->op2.var;
1234 ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1235 ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1236 }
1237 }
1238 } else if (opline->op1_type != IS_CONST && opline->op2_type == IS_CONST) {
1239 zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1240
1241 if ((OP1_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
1242 && Z_TYPE_INFO_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG) {
1243
1244 // op_1: #v.? = ADD #?.? [double], long(?) => #v.? = ADD #?.? [double], double(?)
1245
1246 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1247 opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
1248 zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1249 }
1250 if (opline->opcode == ZEND_ADD || opline->opcode == ZEND_SUB) {
1251 if (((OP1_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG
1252 && Z_TYPE_INFO_P(zv) == IS_LONG
1253 && Z_LVAL_P(zv) == 0)
1254 || ((OP1_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_DOUBLE
1255 && Z_TYPE_INFO_P(zv) == IS_DOUBLE
1256 && Z_DVAL_P(zv) == 0.0)) {
1257
1258 // op_1: #v.? = ADD #?.? [double,long], 0 => #v.? = QM_ASSIGN #?.?
1259
1260 opline->opcode = ZEND_QM_ASSIGN;
1261 opline->op2_type = IS_UNUSED;
1262 opline->op2.num = 0;
1263 }
1264 } else if (opline->opcode == ZEND_MUL
1265 && (OP1_INFO() & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1266 zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1267
1268 if ((Z_TYPE_INFO_P(zv) == IS_LONG
1269 && Z_LVAL_P(zv) == 2)
1270 || (Z_TYPE_INFO_P(zv) == IS_DOUBLE
1271 && Z_DVAL_P(zv) == 2.0
1272 && !(OP1_INFO() & MAY_BE_LONG))) {
1273
1274 // op_1: #v.? = MUL #x.? [double,long], 2 => #v.? = ADD #x.?, #x.?
1275
1276 opline->opcode = ZEND_ADD;
1277 opline->op2_type = opline->op1_type;
1278 opline->op2.var = opline->op1.var;
1279 ssa->ops[op_1].op2_use = ssa->ops[op_1].op1_use;
1280 ssa->ops[op_1].op2_use_chain = ssa->ops[op_1].op1_use_chain;
1281 }
1282 }
1283 }
1284 } else if (opline->opcode == ZEND_CONCAT) {
1285 if (!(OP1_INFO() & MAY_BE_OBJECT)
1286 && !(OP2_INFO() & MAY_BE_OBJECT)) {
1287 opline->opcode = ZEND_FAST_CONCAT;
1288 }
1289 } else if (opline->opcode == ZEND_VERIFY_RETURN_TYPE
1290 && opline->op1_type != IS_CONST
1291 && ssa->ops[op_1].op1_def == v
1292 && ssa->ops[op_1].op1_use >= 0) {
1293 int orig_var = ssa->ops[op_1].op1_use;
1294 int ret = ssa->vars[v].use_chain;
1295
1296 if (ssa->ops[op_1].op1_use_chain == -1
1297 && can_elide_return_type_check(ctx->script, op_array, ssa, &ssa->ops[op_1])) {
1298
1299 // op_1: VERIFY_RETURN_TYPE #orig_var.? [T] -> #v.? [T] => NOP
1300
1301 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1302
1303 if (ret >= 0) {
1304 ssa->ops[ret].op1_use = orig_var;
1305 ssa->ops[ret].op1_use_chain = ssa->vars[orig_var].use_chain;
1306 ssa->vars[orig_var].use_chain = ret;
1307 }
1308
1309 ssa->vars[v].definition = -1;
1310 ssa->vars[v].use_chain = -1;
1311
1312 ssa->ops[op_1].op1_def = -1;
1313 ssa->ops[op_1].op1_use = -1;
1314
1315 MAKE_NOP(opline);
1316 remove_nops = 1;
1317 } else if (ret >= 0
1318 && ssa->ops[ret].op1_use == v
1319 && ssa->ops[ret].op1_use_chain == -1
1320 && can_elide_return_type_check(ctx->script, op_array, ssa, &ssa->ops[op_1])) {
1321
1322 // op_1: VERIFY_RETURN_TYPE #orig_var.? [T] -> #v.? [T] => NOP
1323
1324 zend_ssa_replace_use_chain(ssa, op_1, ret, orig_var);
1325
1326 ssa->ops[ret].op1_use = orig_var;
1327 ssa->ops[ret].op1_use_chain = ssa->ops[op_1].op1_use_chain;
1328
1329 ssa->vars[v].definition = -1;
1330 ssa->vars[v].use_chain = -1;
1331
1332 ssa->ops[op_1].op1_def = -1;
1333 ssa->ops[op_1].op1_use = -1;
1334
1335 MAKE_NOP(opline);
1336 remove_nops = 1;
1337 }
1338 }
1339 }
1340
1341 if (opline->opcode == ZEND_QM_ASSIGN
1342 && ssa->ops[op_1].result_def == v
1343 && opline->op1_type & (IS_TMP_VAR|IS_VAR)
1344 && !(ssa->var_info[v].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1345 ) {
1346
1347 int src_var = ssa->ops[op_1].op1_use;
1348
1349 if (src_var >= 0
1350 && !(ssa->var_info[src_var].type & MAY_BE_REF)
1351 && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
1352 && ssa->vars[src_var].definition >= 0
1353 && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
1354 && ssa->ops[ssa->vars[src_var].definition].result_use < 0
1355 && ssa->vars[src_var].use_chain == op_1
1356 && ssa->ops[op_1].op1_use_chain < 0
1357 && !ssa->vars[src_var].phi_use_chain
1358 && !ssa->vars[src_var].sym_use_chain
1359 && opline_supports_assign_contraction(
1360 op_array, ssa, &op_array->opcodes[ssa->vars[src_var].definition],
1361 src_var, opline->result.var)
1362 && !variable_defined_or_used_in_range(ssa, EX_VAR_TO_NUM(opline->result.var),
1363 ssa->vars[src_var].definition+1, op_1)
1364 ) {
1365
1366 int orig_var = ssa->ops[op_1].result_use;
1367 int op_2 = ssa->vars[src_var].definition;
1368
1369 // op_2: #src_var.T = OP ... => #v.CV = OP ...
1370 // op_1: QM_ASSIGN #src_var.T #orig_var.CV [undef,scalar] -> #v.CV, NOP
1371
1372 if (orig_var >= 0) {
1373 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1374 }
1375
1376 /* Reconstruct SSA */
1377 ssa->vars[v].definition = op_2;
1378 ssa->ops[op_2].result_def = v;
1379
1380 ssa->vars[src_var].definition = -1;
1381 ssa->vars[src_var].use_chain = -1;
1382
1383 ssa->ops[op_1].op1_use = -1;
1384 ssa->ops[op_1].op1_def = -1;
1385 ssa->ops[op_1].op1_use_chain = -1;
1386 ssa->ops[op_1].result_use = -1;
1387 ssa->ops[op_1].result_def = -1;
1388 ssa->ops[op_1].res_use_chain = -1;
1389
1390 /* Update opcodes */
1391 op_array->opcodes[op_2].result_type = opline->result_type;
1392 op_array->opcodes[op_2].result.var = opline->result.var;
1393
1394 MAKE_NOP(opline);
1395 remove_nops = 1;
1396
1397 if (op_array->opcodes[op_2].opcode == ZEND_SUB
1398 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1399 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1400 && op_array->opcodes[op_2].op2_type == IS_CONST
1401 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1402 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1403 && ssa->ops[op_2].op1_use >= 0
1404 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1405
1406 op_array->opcodes[op_2].opcode = ZEND_PRE_DEC;
1407 SET_UNUSED(op_array->opcodes[op_2].op2);
1408 SET_UNUSED(op_array->opcodes[op_2].result);
1409
1410 ssa->ops[op_2].result_def = -1;
1411 ssa->ops[op_2].op1_def = v;
1412
1413 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1414 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1415 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1416 && op_array->opcodes[op_2].op2_type == IS_CONST
1417 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1418 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1419 && ssa->ops[op_2].op1_use >= 0
1420 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1421
1422 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1423 SET_UNUSED(op_array->opcodes[op_2].op2);
1424 SET_UNUSED(op_array->opcodes[op_2].result);
1425
1426 ssa->ops[op_2].result_def = -1;
1427 ssa->ops[op_2].op1_def = v;
1428
1429 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1430 && op_array->opcodes[op_2].op2_type == op_array->opcodes[op_2].result_type
1431 && op_array->opcodes[op_2].op2.var == op_array->opcodes[op_2].result.var
1432 && op_array->opcodes[op_2].op1_type == IS_CONST
1433 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == IS_LONG
1434 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == 1
1435 && ssa->ops[op_2].op2_use >= 0
1436 && !(ssa->var_info[ssa->ops[op_2].op2_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1437
1438 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1439 op_array->opcodes[op_2].op1_type = op_array->opcodes[op_2].op2_type;
1440 op_array->opcodes[op_2].op1.var = op_array->opcodes[op_2].op2.var;
1441 SET_UNUSED(op_array->opcodes[op_2].op2);
1442 SET_UNUSED(op_array->opcodes[op_2].result);
1443
1444 ssa->ops[op_2].result_def = -1;
1445 ssa->ops[op_2].op1_def = v;
1446 ssa->ops[op_2].op1_use = ssa->ops[op_2].op2_use;
1447 ssa->ops[op_2].op1_use_chain = ssa->ops[op_2].op2_use_chain;
1448 ssa->ops[op_2].op2_use = -1;
1449 ssa->ops[op_2].op2_use_chain = -1;
1450 }
1451 }
1452 }
1453
1454 if (ssa->vars[v].var >= op_array->last_var) {
1455 /* skip TMP and VAR */
1456 continue;
1457 }
1458
1459 if (ssa->ops[op_1].op1_def == v
1460 && RETURN_VALUE_USED(opline)) {
1461 if (opline->opcode == ZEND_ASSIGN
1462 || opline->opcode == ZEND_ASSIGN_OP
1463 || opline->opcode == ZEND_PRE_INC
1464 || opline->opcode == ZEND_PRE_DEC) {
1465 zend_dfa_try_to_replace_result(op_array, ssa, op_1, v);
1466 } else if (opline->opcode == ZEND_POST_INC) {
1467 int result_var = ssa->ops[op_1].result_def;
1468
1469 if (result_var >= 0
1470 && (ssa->var_info[result_var].type & ((MAY_BE_ANY|MAY_BE_REF|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1471 int use = ssa->vars[result_var].use_chain;
1472
1473 if (use >= 0 && op_array->opcodes[use].opcode == ZEND_IS_SMALLER
1474 && ssa->ops[use].op1_use == result_var
1475 && zend_dfa_try_to_replace_result(op_array, ssa, op_1, v)) {
1476 opline->opcode = ZEND_PRE_INC;
1477 op_array->opcodes[use].opcode = ZEND_IS_SMALLER_OR_EQUAL;
1478 }
1479 }
1480 } else if (opline->opcode == ZEND_POST_DEC) {
1481 int result_var = ssa->ops[op_1].result_def;
1482
1483 if (result_var >= 0
1484 && (ssa->var_info[result_var].type & ((MAY_BE_ANY|MAY_BE_REF|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1485 int use = ssa->vars[result_var].use_chain;
1486
1487 if (use >= 0 && op_array->opcodes[use].opcode == ZEND_IS_SMALLER
1488 && ssa->ops[use].op2_use == result_var
1489 && zend_dfa_try_to_replace_result(op_array, ssa, op_1, v)) {
1490 opline->opcode = ZEND_PRE_DEC;
1491 op_array->opcodes[use].opcode = ZEND_IS_SMALLER_OR_EQUAL;
1492 }
1493 }
1494 }
1495 }
1496
1497 if (opline->opcode == ZEND_ASSIGN
1498 && ssa->ops[op_1].op1_def == v
1499 && !RETURN_VALUE_USED(opline)
1500 ) {
1501 int orig_var = ssa->ops[op_1].op1_use;
1502
1503 if (orig_var >= 0
1504 && !(ssa->var_info[orig_var].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1505 ) {
1506 int src_var = ssa->ops[op_1].op2_use;
1507
1508 if ((opline->op2_type & (IS_TMP_VAR|IS_VAR))
1509 && src_var >= 0
1510 && !(ssa->var_info[src_var].type & MAY_BE_REF)
1511 && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
1512 && ssa->vars[src_var].definition >= 0
1513 && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
1514 && ssa->ops[ssa->vars[src_var].definition].result_use < 0
1515 && ssa->vars[src_var].use_chain == op_1
1516 && ssa->ops[op_1].op2_use_chain < 0
1517 && !ssa->vars[src_var].phi_use_chain
1518 && !ssa->vars[src_var].sym_use_chain
1519 && opline_supports_assign_contraction(
1520 op_array, ssa, &op_array->opcodes[ssa->vars[src_var].definition],
1521 src_var, opline->op1.var)
1522 && !variable_defined_or_used_in_range(ssa, EX_VAR_TO_NUM(opline->op1.var),
1523 ssa->vars[src_var].definition+1, op_1)
1524 ) {
1525
1526 int op_2 = ssa->vars[src_var].definition;
1527
1528 // op_2: #src_var.T = OP ... => #v.CV = OP ...
1529 // op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, #src_var.T NOP
1530
1531 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1532 /* Reconstruct SSA */
1533 ssa->vars[v].definition = op_2;
1534 ssa->ops[op_2].result_def = v;
1535
1536 ssa->vars[src_var].definition = -1;
1537 ssa->vars[src_var].use_chain = -1;
1538
1539 ssa->ops[op_1].op1_use = -1;
1540 ssa->ops[op_1].op2_use = -1;
1541 ssa->ops[op_1].op1_def = -1;
1542 ssa->ops[op_1].op1_use_chain = -1;
1543
1544 /* Update opcodes */
1545 op_array->opcodes[op_2].result_type = opline->op1_type;
1546 op_array->opcodes[op_2].result.var = opline->op1.var;
1547
1548 MAKE_NOP(opline);
1549 remove_nops = 1;
1550
1551 if (op_array->opcodes[op_2].opcode == ZEND_SUB
1552 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1553 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1554 && op_array->opcodes[op_2].op2_type == IS_CONST
1555 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1556 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1557 && ssa->ops[op_2].op1_use >= 0
1558 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1559
1560 op_array->opcodes[op_2].opcode = ZEND_PRE_DEC;
1561 SET_UNUSED(op_array->opcodes[op_2].op2);
1562 SET_UNUSED(op_array->opcodes[op_2].result);
1563
1564 ssa->ops[op_2].result_def = -1;
1565 ssa->ops[op_2].op1_def = v;
1566
1567 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1568 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1569 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1570 && op_array->opcodes[op_2].op2_type == IS_CONST
1571 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1572 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1573 && ssa->ops[op_2].op1_use >= 0
1574 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1575
1576 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1577 SET_UNUSED(op_array->opcodes[op_2].op2);
1578 SET_UNUSED(op_array->opcodes[op_2].result);
1579
1580 ssa->ops[op_2].result_def = -1;
1581 ssa->ops[op_2].op1_def = v;
1582
1583 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1584 && op_array->opcodes[op_2].op2_type == op_array->opcodes[op_2].result_type
1585 && op_array->opcodes[op_2].op2.var == op_array->opcodes[op_2].result.var
1586 && op_array->opcodes[op_2].op1_type == IS_CONST
1587 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == IS_LONG
1588 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == 1
1589 && ssa->ops[op_2].op2_use >= 0
1590 && !(ssa->var_info[ssa->ops[op_2].op2_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1591
1592 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1593 op_array->opcodes[op_2].op1_type = op_array->opcodes[op_2].op2_type;
1594 op_array->opcodes[op_2].op1.var = op_array->opcodes[op_2].op2.var;
1595 SET_UNUSED(op_array->opcodes[op_2].op2);
1596 SET_UNUSED(op_array->opcodes[op_2].result);
1597
1598 ssa->ops[op_2].result_def = -1;
1599 ssa->ops[op_2].op1_def = v;
1600 ssa->ops[op_2].op1_use = ssa->ops[op_2].op2_use;
1601 ssa->ops[op_2].op1_use_chain = ssa->ops[op_2].op2_use_chain;
1602 ssa->ops[op_2].op2_use = -1;
1603 ssa->ops[op_2].op2_use_chain = -1;
1604 }
1605 } else if (opline->op2_type == IS_CONST
1606 || ((opline->op2_type & (IS_TMP_VAR|IS_VAR|IS_CV))
1607 && ssa->ops[op_1].op2_use >= 0
1608 && ssa->ops[op_1].op2_def < 0)
1609 ) {
1610
1611 // op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, CONST|TMPVAR => QM_ASSIGN v.CV, CONST|TMPVAR
1612
1613 if (ssa->ops[op_1].op1_use != ssa->ops[op_1].op2_use) {
1614 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1615 } else {
1616 ssa->ops[op_1].op2_use_chain = ssa->ops[op_1].op1_use_chain;
1617 }
1618
1619 /* Reconstruct SSA */
1620 ssa->ops[op_1].result_def = v;
1621 ssa->ops[op_1].op1_def = -1;
1622 ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1623 ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1624 ssa->ops[op_1].op2_use = -1;
1625 ssa->ops[op_1].op2_use_chain = -1;
1626
1627 /* Update opcode */
1628 opline->result_type = opline->op1_type;
1629 opline->result.var = opline->op1.var;
1630 opline->op1_type = opline->op2_type;
1631 opline->op1.var = opline->op2.var;
1632 opline->op2_type = IS_UNUSED;
1633 opline->op2.var = 0;
1634 opline->opcode = ZEND_QM_ASSIGN;
1635 }
1636 }
1637
1638 } else if (opline->opcode == ZEND_ASSIGN_OP
1639 && opline->extended_value == ZEND_ADD
1640 && ssa->ops[op_1].op1_def == v
1641 && opline->op2_type == IS_CONST
1642 && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
1643 && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
1644 && ssa->ops[op_1].op1_use >= 0
1645 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1646
1647 // op_1: ASSIGN_ADD #?.CV [undef,null,int,foat] ->#v.CV, int(1) => PRE_INC #?.CV ->#v.CV
1648
1649 opline->opcode = ZEND_PRE_INC;
1650 opline->extended_value = 0;
1651 SET_UNUSED(opline->op2);
1652
1653 } else if (opline->opcode == ZEND_ASSIGN_OP
1654 && opline->extended_value == ZEND_SUB
1655 && ssa->ops[op_1].op1_def == v
1656 && opline->op2_type == IS_CONST
1657 && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
1658 && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
1659 && ssa->ops[op_1].op1_use >= 0
1660 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1661
1662 // op_1: ASSIGN_SUB #?.CV [undef,null,int,foat] -> #v.CV, int(1) => PRE_DEC #?.CV ->#v.CV
1663
1664 opline->opcode = ZEND_PRE_DEC;
1665 opline->extended_value = 0;
1666 SET_UNUSED(opline->op2);
1667
1668 } else if (ssa->ops[op_1].op1_def == v
1669 && !RETURN_VALUE_USED(opline)
1670 && ssa->ops[op_1].op1_use >= 0
1671 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1672 && opline->opcode == ZEND_ASSIGN_OP
1673 && opline->extended_value != ZEND_CONCAT) {
1674
1675 // op_1: ASSIGN_OP #orig_var.CV [undef,null,bool,int,double] -> #v.CV, ? => #v.CV = ADD #orig_var.CV, ?
1676
1677 /* Reconstruct SSA */
1678 ssa->ops[op_1].result_def = ssa->ops[op_1].op1_def;
1679 ssa->ops[op_1].op1_def = -1;
1680
1681 /* Update opcode */
1682 opline->opcode = opline->extended_value;
1683 opline->extended_value = 0;
1684 opline->result_type = opline->op1_type;
1685 opline->result.var = opline->op1.var;
1686
1687 }
1688 }
1689
1690 #if ZEND_DEBUG_DFA
1691 ssa_verify_integrity(op_array, ssa, "after dfa");
1692 #endif
1693
1694 if (remove_nops) {
1695 zend_ssa_remove_nops(op_array, ssa, ctx);
1696 #if ZEND_DEBUG_DFA
1697 ssa_verify_integrity(op_array, ssa, "after nop");
1698 #endif
1699 }
1700 }
1701
1702 if (ctx->debug_level & ZEND_DUMP_AFTER_DFA_PASS) {
1703 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after dfa pass", ssa);
1704 }
1705 }
1706
zend_optimize_dfa(zend_op_array * op_array,zend_optimizer_ctx * ctx)1707 void zend_optimize_dfa(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1708 {
1709 void *checkpoint = zend_arena_checkpoint(ctx->arena);
1710 zend_ssa ssa;
1711
1712 if (zend_dfa_analyze_op_array(op_array, ctx, &ssa) == FAILURE) {
1713 zend_arena_release(&ctx->arena, checkpoint);
1714 return;
1715 }
1716
1717 zend_dfa_optimize_op_array(op_array, ctx, &ssa, NULL);
1718
1719 /* Destroy SSA */
1720 zend_arena_release(&ctx->arena, checkpoint);
1721 }
1722
