1 /*
2 +----------------------------------------------------------------------+
3 | Zend OPcache |
4 +----------------------------------------------------------------------+
5 | Copyright (c) 1998-2018 The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | http://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@zend.com> |
16 +----------------------------------------------------------------------+
17 */
18
19 #include "php.h"
20 #include "Optimizer/zend_optimizer.h"
21 #include "Optimizer/zend_optimizer_internal.h"
22 #include "zend_API.h"
23 #include "zend_constants.h"
24 #include "zend_execute.h"
25 #include "zend_vm.h"
26 #include "zend_bitset.h"
27 #include "zend_cfg.h"
28 #include "zend_ssa.h"
29 #include "zend_func_info.h"
30 #include "zend_call_graph.h"
31 #include "zend_inference.h"
32 #include "zend_dump.h"
33
zend_dfa_analyze_op_array(zend_op_array * op_array,zend_optimizer_ctx * ctx,zend_ssa * ssa,uint32_t * flags)34 int zend_dfa_analyze_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa, uint32_t *flags)
35 {
36 uint32_t build_flags;
37
38 if (op_array->last_try_catch) {
39 /* TODO: we can't analyze functions with try/catch/finally ??? */
40 return FAILURE;
41 }
42
43 /* Build SSA */
44 memset(ssa, 0, sizeof(zend_ssa));
45
46 if (zend_build_cfg(&ctx->arena, op_array,
47 ZEND_CFG_NO_ENTRY_PREDECESSORS, &ssa->cfg, flags) != SUCCESS) {
48 return FAILURE;
49 }
50
51 if (*flags & ZEND_FUNC_INDIRECT_VAR_ACCESS) {
52 /* TODO: we can't analyze functions with indirect variable access ??? */
53 return FAILURE;
54 }
55
56 if (zend_cfg_build_predecessors(&ctx->arena, &ssa->cfg) != SUCCESS) {
57 return FAILURE;
58 }
59
60 if (ctx->debug_level & ZEND_DUMP_DFA_CFG) {
61 zend_dump_op_array(op_array, ZEND_DUMP_CFG, "dfa cfg", &ssa->cfg);
62 }
63
64 /* Compute Dominators Tree */
65 if (zend_cfg_compute_dominators_tree(op_array, &ssa->cfg) != SUCCESS) {
66 return FAILURE;
67 }
68
69 /* Identify reducible and irreducible loops */
70 if (zend_cfg_identify_loops(op_array, &ssa->cfg, flags) != SUCCESS) {
71 return FAILURE;
72 }
73
74 if (ctx->debug_level & ZEND_DUMP_DFA_DOMINATORS) {
75 zend_dump_dominators(op_array, &ssa->cfg);
76 }
77
78 build_flags = 0;
79 if (ctx->debug_level & ZEND_DUMP_DFA_LIVENESS) {
80 build_flags |= ZEND_SSA_DEBUG_LIVENESS;
81 }
82 if (ctx->debug_level & ZEND_DUMP_DFA_PHI) {
83 build_flags |= ZEND_SSA_DEBUG_PHI_PLACEMENT;
84 }
85 if (zend_build_ssa(&ctx->arena, ctx->script, op_array, build_flags, ssa, flags) != SUCCESS) {
86 return FAILURE;
87 }
88
89 if (ctx->debug_level & ZEND_DUMP_DFA_SSA) {
90 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "before dfa pass", ssa);
91 }
92
93
94 if (zend_ssa_compute_use_def_chains(&ctx->arena, op_array, ssa) != SUCCESS){
95 return FAILURE;
96 }
97
98 if (zend_ssa_find_false_dependencies(op_array, ssa) != SUCCESS) {
99 return FAILURE;
100 }
101
102 if (zend_ssa_find_sccs(op_array, ssa) != SUCCESS){
103 return FAILURE;
104 }
105
106 if (zend_ssa_inference(&ctx->arena, op_array, ctx->script, ssa) != SUCCESS) {
107 return FAILURE;
108 }
109
110 if (ctx->debug_level & ZEND_DUMP_DFA_SSA_VARS) {
111 zend_dump_ssa_variables(op_array, ssa, 0);
112 }
113
114 return SUCCESS;
115 }
116
zend_ssa_remove_nops(zend_op_array * op_array,zend_ssa * ssa)117 static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa)
118 {
119 zend_basic_block *blocks = ssa->cfg.blocks;
120 zend_basic_block *end = blocks + ssa->cfg.blocks_count;
121 zend_basic_block *b;
122 zend_func_info *func_info;
123 int j;
124 uint32_t i;
125 uint32_t target = 0;
126 uint32_t *shiftlist;
127 ALLOCA_FLAG(use_heap);
128
129 shiftlist = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last, use_heap);
130 memset(shiftlist, 0, sizeof(uint32_t) * op_array->last);
131 for (b = blocks; b < end; b++) {
132 if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
133 uint32_t end;
134 if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
135 /* Only keep the FREE for the loop var */
136 ZEND_ASSERT(op_array->opcodes[b->start].opcode == ZEND_FREE
137 || op_array->opcodes[b->start].opcode == ZEND_FE_FREE);
138 b->len = 1;
139 }
140
141 end = b->start + b->len;
142 i = b->start;
143 b->start = target;
144 while (i < end) {
145 shiftlist[i] = i - target;
146 if (EXPECTED(op_array->opcodes[i].opcode != ZEND_NOP) ||
147 /* Keep NOP to support ZEND_VM_SMART_BRANCH. Using "target-1" instead of
148 * "i-1" here to check the last non-NOP instruction. */
149 (target > 0 &&
150 i + 1 < op_array->last &&
151 (op_array->opcodes[i+1].opcode == ZEND_JMPZ ||
152 op_array->opcodes[i+1].opcode == ZEND_JMPNZ) &&
153 zend_is_smart_branch(op_array->opcodes + target - 1))) {
154 if (i != target) {
155 op_array->opcodes[target] = op_array->opcodes[i];
156 ssa->ops[target] = ssa->ops[i];
157 }
158 target++;
159 }
160 i++;
161 }
162 if (target != end && b->len != 0) {
163 zend_op *opline;
164 zend_op *new_opline;
165
166 b->len = target - b->start;
167 opline = op_array->opcodes + end - 1;
168 if (opline->opcode == ZEND_NOP) {
169 continue;
170 }
171
172 new_opline = op_array->opcodes + target - 1;
173 switch (new_opline->opcode) {
174 case ZEND_JMP:
175 case ZEND_FAST_CALL:
176 ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op1, ZEND_OP1_JMP_ADDR(opline));
177 break;
178 case ZEND_JMPZNZ:
179 new_opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value));
180 /* break missing intentionally */
181 case ZEND_JMPZ:
182 case ZEND_JMPNZ:
183 case ZEND_JMPZ_EX:
184 case ZEND_JMPNZ_EX:
185 case ZEND_FE_RESET_R:
186 case ZEND_FE_RESET_RW:
187 case ZEND_JMP_SET:
188 case ZEND_COALESCE:
189 case ZEND_ASSERT_CHECK:
190 ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op2, ZEND_OP2_JMP_ADDR(opline));
191 break;
192 case ZEND_CATCH:
193 if (!opline->result.num) {
194 new_opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value));
195 }
196 break;
197 case ZEND_DECLARE_ANON_CLASS:
198 case ZEND_DECLARE_ANON_INHERITED_CLASS:
199 case ZEND_FE_FETCH_R:
200 case ZEND_FE_FETCH_RW:
201 new_opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value));
202 break;
203 }
204 }
205 }
206 }
207
208 if (target != op_array->last) {
209 /* reset rest opcodes */
210 for (i = target; i < op_array->last; i++) {
211 MAKE_NOP(op_array->opcodes + i);
212 }
213
214 /* update SSA variables */
215 for (j = 0; j < ssa->vars_count; j++) {
216 if (ssa->vars[j].definition >= 0) {
217 ssa->vars[j].definition -= shiftlist[ssa->vars[j].definition];
218 }
219 if (ssa->vars[j].use_chain >= 0) {
220 ssa->vars[j].use_chain -= shiftlist[ssa->vars[j].use_chain];
221 }
222 }
223 for (i = 0; i < op_array->last; i++) {
224 if (ssa->ops[i].op1_use_chain >= 0) {
225 ssa->ops[i].op1_use_chain -= shiftlist[ssa->ops[i].op1_use_chain];
226 }
227 if (ssa->ops[i].op2_use_chain >= 0) {
228 ssa->ops[i].op2_use_chain -= shiftlist[ssa->ops[i].op2_use_chain];
229 }
230 if (ssa->ops[i].res_use_chain >= 0) {
231 ssa->ops[i].res_use_chain -= shiftlist[ssa->ops[i].res_use_chain];
232 }
233 }
234
235 /* update branch targets */
236 for (b = blocks; b < end; b++) {
237 if ((b->flags & ZEND_BB_REACHABLE) && b->len != 0) {
238 zend_op *opline = op_array->opcodes + b->start + b->len - 1;
239
240 switch (opline->opcode) {
241 case ZEND_JMP:
242 case ZEND_FAST_CALL:
243 ZEND_SET_OP_JMP_ADDR(opline, opline->op1, ZEND_OP1_JMP_ADDR(opline) - shiftlist[ZEND_OP1_JMP_ADDR(opline) - op_array->opcodes]);
244 break;
245 case ZEND_JMPZNZ:
246 opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]);
247 /* break missing intentionally */
248 case ZEND_JMPZ:
249 case ZEND_JMPNZ:
250 case ZEND_JMPZ_EX:
251 case ZEND_JMPNZ_EX:
252 case ZEND_FE_RESET_R:
253 case ZEND_FE_RESET_RW:
254 case ZEND_JMP_SET:
255 case ZEND_COALESCE:
256 case ZEND_ASSERT_CHECK:
257 ZEND_SET_OP_JMP_ADDR(opline, opline->op2, ZEND_OP2_JMP_ADDR(opline) - shiftlist[ZEND_OP2_JMP_ADDR(opline) - op_array->opcodes]);
258 break;
259 case ZEND_DECLARE_ANON_CLASS:
260 case ZEND_DECLARE_ANON_INHERITED_CLASS:
261 case ZEND_FE_FETCH_R:
262 case ZEND_FE_FETCH_RW:
263 case ZEND_CATCH:
264 opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]);
265 break;
266 }
267 }
268 }
269
270 /* update brk/cont array */
271 for (j = 0; j < op_array->last_live_range; j++) {
272 op_array->live_range[j].start -= shiftlist[op_array->live_range[j].start];
273 op_array->live_range[j].end -= shiftlist[op_array->live_range[j].end];
274 }
275
276 /* update try/catch array */
277 for (j = 0; j < op_array->last_try_catch; j++) {
278 op_array->try_catch_array[j].try_op -= shiftlist[op_array->try_catch_array[j].try_op];
279 op_array->try_catch_array[j].catch_op -= shiftlist[op_array->try_catch_array[j].catch_op];
280 if (op_array->try_catch_array[j].finally_op) {
281 op_array->try_catch_array[j].finally_op -= shiftlist[op_array->try_catch_array[j].finally_op];
282 op_array->try_catch_array[j].finally_end -= shiftlist[op_array->try_catch_array[j].finally_end];
283 }
284 }
285
286 /* update early binding list */
287 if (op_array->early_binding != (uint32_t)-1) {
288 uint32_t *opline_num = &op_array->early_binding;
289
290 do {
291 *opline_num -= shiftlist[*opline_num];
292 opline_num = &ZEND_RESULT(&op_array->opcodes[*opline_num]).opline_num;
293 } while (*opline_num != (uint32_t)-1);
294 }
295
296 /* update call graph */
297 func_info = ZEND_FUNC_INFO(op_array);
298 if (func_info) {
299 zend_call_info *call_info = func_info->callee_info;
300 while (call_info) {
301 call_info->caller_init_opline -=
302 shiftlist[call_info->caller_init_opline - op_array->opcodes];
303 call_info->caller_call_opline -=
304 shiftlist[call_info->caller_call_opline - op_array->opcodes];
305 call_info = call_info->next_callee;
306 }
307 }
308
309 op_array->last = target;
310 }
311 free_alloca(shiftlist, use_heap);
312 }
313
can_elide_return_type_check(zend_op_array * op_array,zend_ssa * ssa,zend_ssa_op * ssa_op)314 static inline zend_bool can_elide_return_type_check(
315 zend_op_array *op_array, zend_ssa *ssa, zend_ssa_op *ssa_op) {
316 zend_arg_info *info = &op_array->arg_info[-1];
317 zend_ssa_var_info *use_info = &ssa->var_info[ssa_op->op1_use];
318 zend_ssa_var_info *def_info = &ssa->var_info[ssa_op->op1_def];
319
320 if (use_info->type & MAY_BE_REF) {
321 return 0;
322 }
323
324 /* A type is possible that is not in the allowed types */
325 if ((use_info->type & (MAY_BE_ANY|MAY_BE_UNDEF)) & ~(def_info->type & MAY_BE_ANY)) {
326 return 0;
327 }
328
329 if (info->type_hint == IS_CALLABLE) {
330 return 0;
331 }
332
333 if (info->class_name) {
334 if (!use_info->ce || !def_info->ce || !instanceof_function(use_info->ce, def_info->ce)) {
335 return 0;
336 }
337 }
338
339 return 1;
340 }
341
opline_supports_assign_contraction(zend_ssa * ssa,zend_op * opline,int src_var,uint32_t cv_var)342 static zend_bool opline_supports_assign_contraction(
343 zend_ssa *ssa, zend_op *opline, int src_var, uint32_t cv_var) {
344 if (opline->opcode == ZEND_NEW) {
345 /* see Zend/tests/generators/aborted_yield_during_new.phpt */
346 return 0;
347 }
348
349 if (opline->opcode == ZEND_DO_ICALL || opline->opcode == ZEND_DO_UCALL
350 || opline->opcode == ZEND_DO_FCALL || opline->opcode == ZEND_DO_FCALL_BY_NAME) {
351 /* Function calls may dtor the return value after it has already been written -- allow
352 * direct assignment only for types where a double-dtor does not matter. */
353 uint32_t type = ssa->var_info[src_var].type;
354 uint32_t simple = MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE;
355 return !((type & MAY_BE_ANY) & ~simple);
356 }
357
358 if (opline->opcode == ZEND_POST_INC || opline->opcode == ZEND_POST_DEC) {
359 /* POST_INC/DEC write the result variable before performing the inc/dec. For $i = $i++
360 * eliding the temporary variable would thus yield an incorrect result. */
361 return opline->op1_type != IS_CV || opline->op1.var != cv_var;
362 }
363
364 if (opline->opcode == ZEND_INIT_ARRAY) {
365 /* INIT_ARRAY initializes the result array before reading key/value. */
366 return (opline->op1_type != IS_CV || opline->op1.var != cv_var)
367 && (opline->op2_type != IS_CV || opline->op2.var != cv_var);
368 }
369
370 if (opline->opcode == ZEND_CAST
371 && (opline->extended_value == IS_ARRAY || opline->extended_value == IS_OBJECT)) {
372 /* CAST to array/object may initialize the result to an empty array/object before
373 * reading the expression. */
374 return opline->op1_type != IS_CV || opline->op1.var != cv_var;
375 }
376
377 return 1;
378 }
379
zend_dfa_optimize_op_array(zend_op_array * op_array,zend_optimizer_ctx * ctx,zend_ssa * ssa)380 void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa)
381 {
382 if (ctx->debug_level & ZEND_DUMP_BEFORE_DFA_PASS) {
383 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "before dfa pass", ssa);
384 }
385
386 if (ssa->var_info) {
387 int op_1;
388 int v;
389 int remove_nops = 0;
390 zend_op *opline;
391 zval tmp;
392
393 for (v = op_array->last_var; v < ssa->vars_count; v++) {
394
395 op_1 = ssa->vars[v].definition;
396
397 if (op_1 < 0) {
398 continue;
399 }
400
401 opline = op_array->opcodes + op_1;
402
403 /* Convert LONG constants to DOUBLE */
404 if (ssa->var_info[v].use_as_double) {
405 if (opline->opcode == ZEND_ASSIGN
406 && opline->op2_type == IS_CONST
407 && ssa->ops[op_1].op1_def == v
408 && !RETURN_VALUE_USED(opline)
409 ) {
410
411 // op_1: ASSIGN ? -> #v [use_as_double], long(?) => ASSIGN ? -> #v, double(?)
412
413 zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
414 ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
415 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
416 opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
417
418 } else if (opline->opcode == ZEND_QM_ASSIGN
419 && opline->op1_type == IS_CONST
420 ) {
421
422 // op_1: QM_ASSIGN #v [use_as_double], long(?) => QM_ASSIGN #v, double(?)
423
424 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
425 ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
426 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
427 opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
428 }
429
430 } else {
431 if (opline->opcode == ZEND_ADD
432 || opline->opcode == ZEND_SUB
433 || opline->opcode == ZEND_MUL
434 || opline->opcode == ZEND_IS_EQUAL
435 || opline->opcode == ZEND_IS_NOT_EQUAL
436 || opline->opcode == ZEND_IS_SMALLER
437 || opline->opcode == ZEND_IS_SMALLER_OR_EQUAL
438 ) {
439
440 if (opline->op1_type == IS_CONST
441 && opline->op2_type != IS_CONST
442 && (OP2_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
443 && Z_TYPE_INFO_P(CT_CONSTANT_EX(op_array, opline->op1.constant)) == IS_LONG
444 ) {
445
446 // op_1: #v.? = ADD long(?), #?.? [double] => #v.? = ADD double(?), #?.? [double]
447
448 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
449 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
450 opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
451
452 } else if (opline->op1_type != IS_CONST
453 && opline->op2_type == IS_CONST
454 && (OP1_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
455 && Z_TYPE_INFO_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
456 ) {
457
458 // op_1: #v.? = ADD #?.? [double], long(?) => #v.? = ADD #?.? [double], double(?)
459
460 zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
461 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
462 opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
463 }
464 }
465 }
466
467 if (ssa->vars[v].var >= op_array->last_var) {
468 /* skip TMP and VAR */
469 continue;
470 }
471
472 if (opline->opcode == ZEND_ASSIGN
473 && ssa->ops[op_1].op1_def == v
474 && !RETURN_VALUE_USED(opline)
475 ) {
476 int orig_var = ssa->ops[op_1].op1_use;
477
478 if (orig_var >= 0
479 && !(ssa->var_info[orig_var].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
480 ) {
481
482 int src_var = ssa->ops[op_1].op2_use;
483
484 if ((opline->op2_type & (IS_TMP_VAR|IS_VAR))
485 && src_var >= 0
486 && !(ssa->var_info[src_var].type & MAY_BE_REF)
487 && ssa->vars[src_var].definition >= 0
488 && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
489 && ssa->ops[ssa->vars[src_var].definition].result_use < 0
490 && ssa->vars[src_var].use_chain == op_1
491 && ssa->ops[op_1].op2_use_chain < 0
492 && !ssa->vars[src_var].phi_use_chain
493 && !ssa->vars[src_var].sym_use_chain
494 && opline_supports_assign_contraction(
495 ssa, &op_array->opcodes[ssa->vars[src_var].definition],
496 src_var, opline->op1.var)
497 ) {
498
499 int op_2 = ssa->vars[src_var].definition;
500
501 // op_2: #src_var.T = OP ... => #v.CV = OP ...
502 // op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, #src_var.T NOP
503
504 if (zend_ssa_unlink_use_chain(ssa, op_1, orig_var)) {
505 /* Reconstruct SSA */
506 ssa->vars[v].definition = op_2;
507 ssa->ops[op_2].result_def = v;
508
509 ssa->vars[src_var].definition = -1;
510 ssa->vars[src_var].use_chain = -1;
511
512 ssa->ops[op_1].op1_use = -1;
513 ssa->ops[op_1].op2_use = -1;
514 ssa->ops[op_1].op1_def = -1;
515 ssa->ops[op_1].op1_use_chain = -1;
516
517 /* Update opcodes */
518 op_array->opcodes[op_2].result_type = opline->op1_type;
519 op_array->opcodes[op_2].result.var = opline->op1.var;
520 MAKE_NOP(opline);
521 remove_nops = 1;
522 }
523 } else if (opline->op2_type == IS_CONST
524 || ((opline->op2_type & (IS_TMP_VAR|IS_VAR|IS_CV))
525 && ssa->ops[op_1].op2_use >= 0
526 && ssa->ops[op_1].op2_def < 0)
527 ) {
528
529 // op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, CONST|TMPVAR => QM_ASSIGN v.CV, CONST|TMPVAR
530
531 if (zend_ssa_unlink_use_chain(ssa, op_1, orig_var)) {
532 /* Reconstruct SSA */
533 ssa->ops[op_1].result_def = v;
534 ssa->ops[op_1].op1_def = -1;
535 ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
536 ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
537 ssa->ops[op_1].op2_use = -1;
538 ssa->ops[op_1].op2_use_chain = -1;
539
540 /* Update opcode */
541 opline->result_type = opline->op1_type;
542 opline->result.var = opline->op1.var;
543 opline->op1_type = opline->op2_type;
544 opline->op1.var = opline->op2.var;
545 opline->op2_type = IS_UNUSED;
546 opline->op2.var = 0;
547 opline->opcode = ZEND_QM_ASSIGN;
548 }
549 }
550 }
551
552 } else if (opline->opcode == ZEND_ASSIGN_ADD
553 && opline->extended_value == 0
554 && ssa->ops[op_1].op1_def == v
555 && opline->op2_type == IS_CONST
556 && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
557 && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
558 && ssa->ops[op_1].op1_use >= 0
559 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
560
561 // op_1: ASSIGN_ADD #?.CV [undef,null,int,foat] ->#v.CV, int(1) => PRE_INC #?.CV ->#v.CV
562
563 opline->opcode = ZEND_PRE_INC;
564 SET_UNUSED(opline->op2);
565
566 } else if (opline->opcode == ZEND_ASSIGN_SUB
567 && opline->extended_value == 0
568 && ssa->ops[op_1].op1_def == v
569 && opline->op2_type == IS_CONST
570 && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
571 && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
572 && ssa->ops[op_1].op1_use >= 0
573 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
574
575 // op_1: ASSIGN_SUB #?.CV [undef,null,int,foat] -> #v.CV, int(1) => PRE_DEC #?.CV ->#v.CV
576
577 opline->opcode = ZEND_PRE_DEC;
578 SET_UNUSED(opline->op2);
579
580 } else if (opline->opcode == ZEND_VERIFY_RETURN_TYPE
581 && ssa->ops[op_1].op1_def == v
582 && ssa->ops[op_1].op1_use >= 0
583 && ssa->ops[op_1].op1_use_chain == -1
584 && ssa->vars[v].use_chain >= 0
585 && can_elide_return_type_check(op_array, ssa, &ssa->ops[op_1])) {
586
587 // op_1: VERIFY_RETURN_TYPE #orig_var.CV [T] -> #v.CV [T] => NOP
588
589 int orig_var = ssa->ops[op_1].op1_use;
590 if (zend_ssa_unlink_use_chain(ssa, op_1, orig_var)) {
591
592 int ret = ssa->vars[v].use_chain;
593
594 ssa->ops[ret].op1_use = orig_var;
595 ssa->ops[ret].op1_use_chain = ssa->vars[orig_var].use_chain;
596 ssa->vars[orig_var].use_chain = ret;
597
598 ssa->vars[v].definition = -1;
599 ssa->vars[v].use_chain = -1;
600
601 ssa->ops[op_1].op1_def = -1;
602 ssa->ops[op_1].op1_use = -1;
603
604 MAKE_NOP(opline);
605 remove_nops = 1;
606 }
607
608 } else if (ssa->ops[op_1].op1_def == v
609 && !RETURN_VALUE_USED(opline)
610 && ssa->ops[op_1].op1_use >= 0
611 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
612 && (opline->opcode == ZEND_ASSIGN_ADD
613 || opline->opcode == ZEND_ASSIGN_SUB
614 || opline->opcode == ZEND_ASSIGN_MUL
615 || opline->opcode == ZEND_ASSIGN_DIV
616 || opline->opcode == ZEND_ASSIGN_MOD
617 || opline->opcode == ZEND_ASSIGN_SL
618 || opline->opcode == ZEND_ASSIGN_SR
619 || opline->opcode == ZEND_ASSIGN_BW_OR
620 || opline->opcode == ZEND_ASSIGN_BW_AND
621 || opline->opcode == ZEND_ASSIGN_BW_XOR)
622 && opline->extended_value == 0) {
623
624 // op_1: ASSIGN_ADD #orig_var.CV [undef,null,bool,int,double] -> #v.CV, ? => #v.CV = ADD #orig_var.CV, ?
625
626 /* Reconstruct SSA */
627 ssa->ops[op_1].result_def = ssa->ops[op_1].op1_def;
628 ssa->ops[op_1].op1_def = -1;
629
630 /* Update opcode */
631 opline->opcode -= (ZEND_ASSIGN_ADD - ZEND_ADD);
632 opline->result_type = opline->op1_type;
633 opline->result.var = opline->op1.var;
634
635 }
636 }
637
638 if (remove_nops) {
639 zend_ssa_remove_nops(op_array, ssa);
640 }
641 }
642
643 if (ctx->debug_level & ZEND_DUMP_AFTER_DFA_PASS) {
644 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after dfa pass", ssa);
645 }
646 }
647
zend_optimize_dfa(zend_op_array * op_array,zend_optimizer_ctx * ctx)648 void zend_optimize_dfa(zend_op_array *op_array, zend_optimizer_ctx *ctx)
649 {
650 void *checkpoint = zend_arena_checkpoint(ctx->arena);
651 uint32_t flags = 0;
652 zend_ssa ssa;
653
654 if (zend_dfa_analyze_op_array(op_array, ctx, &ssa, &flags) != SUCCESS) {
655 zend_arena_release(&ctx->arena, checkpoint);
656 return;
657 }
658
659 zend_dfa_optimize_op_array(op_array, ctx, &ssa);
660
661 /* Destroy SSA */
662 zend_arena_release(&ctx->arena, checkpoint);
663 }
664
665 /*
666 * Local variables:
667 * tab-width: 4
668 * c-basic-offset: 4
669 * indent-tabs-mode: t
670 * End:
671 */
672
