1 /*
2    +----------------------------------------------------------------------+
3    | Zend Engine, e-SSA based Type & Range Inference                      |
4    +----------------------------------------------------------------------+
5    | Copyright (c) 1998-2018 The PHP Group                                |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | http://www.php.net/license/3_01.txt                                  |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Dmitry Stogov <dmitry@zend.com>                             |
16    +----------------------------------------------------------------------+
17 */
18 
19 #ifndef ZEND_INFERENCE_H
20 #define ZEND_INFERENCE_H
21 
22 #include "zend_optimizer.h"
23 #include "zend_ssa.h"
24 #include "zend_bitset.h"
25 
26 /* Bitmask for type inference (zend_ssa_var_info.type) */
27 #include "zend_type_info.h"
28 
29 #define MAY_BE_IN_REG               (1<<25) /* value allocated in CPU register */
30 
31 //TODO: remome MAY_BE_RC1, MAY_BE_RCN???
32 #define MAY_BE_RC1                  (1<<27) /* may be non-reference with refcount == 1 */
33 #define MAY_BE_RCN                  (1<<28) /* may be non-reference with refcount > 1  */
34 
35 #define MAY_HAVE_DTOR \
36 	(MAY_BE_OBJECT|MAY_BE_RESOURCE \
37 	|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE)
38 
39 #define DEFINE_SSA_OP_HAS_RANGE(opN) \
40 	static zend_always_inline zend_bool _ssa_##opN##_has_range(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) \
41 	{ \
42 		if (opline->opN##_type == IS_CONST) { \
43 			zval *zv = CRT_CONSTANT_EX(op_array, opline->opN, ssa->rt_constants); \
44 			return (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_TRUE || Z_TYPE_P(zv) == IS_FALSE || Z_TYPE_P(zv) == IS_NULL); \
45 		} else { \
46 			return (opline->opN##_type != IS_UNUSED && \
47 		        ssa->ops && \
48 		        ssa->var_info && \
49 		        ssa->ops[opline - op_array->opcodes].opN##_use >= 0 && \
50 			    ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].has_range); \
51 		} \
52 		return 0; \
53 	}
54 
55 #define DEFINE_SSA_OP_MIN_RANGE(opN) \
56 	static zend_always_inline zend_long _ssa_##opN##_min_range(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) \
57 	{ \
58 		if (opline->opN##_type == IS_CONST) { \
59 			zval *zv = CRT_CONSTANT_EX(op_array, opline->opN, ssa->rt_constants); \
60 			if (Z_TYPE_P(zv) == IS_LONG) { \
61 				return Z_LVAL_P(zv); \
62 			} else if (Z_TYPE_P(zv) == IS_TRUE) { \
63 				return 1; \
64 			} else if (Z_TYPE_P(zv) == IS_FALSE) { \
65 				return 0; \
66 			} else if (Z_TYPE_P(zv) == IS_NULL) { \
67 				return 0; \
68 			} \
69 		} else if (opline->opN##_type != IS_UNUSED && \
70 		    ssa->ops && \
71 		    ssa->var_info && \
72 		    ssa->ops[opline - op_array->opcodes].opN##_use >= 0 && \
73 		    ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].has_range) { \
74 			return ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].range.min; \
75 		} \
76 		return ZEND_LONG_MIN; \
77 	}
78 
79 #define DEFINE_SSA_OP_MAX_RANGE(opN) \
80 	static zend_always_inline zend_long _ssa_##opN##_max_range(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) \
81 	{ \
82 		if (opline->opN##_type == IS_CONST) { \
83 			zval *zv = CRT_CONSTANT_EX(op_array, opline->opN, ssa->rt_constants); \
84 			if (Z_TYPE_P(zv) == IS_LONG) { \
85 				return Z_LVAL_P(zv); \
86 			} else if (Z_TYPE_P(zv) == IS_TRUE) { \
87 				return 1; \
88 			} else if (Z_TYPE_P(zv) == IS_FALSE) { \
89 				return 0; \
90 			} else if (Z_TYPE_P(zv) == IS_NULL) { \
91 				return 0; \
92 			} \
93 		} else if (opline->opN##_type != IS_UNUSED && \
94 		    ssa->ops && \
95 		    ssa->var_info && \
96 		    ssa->ops[opline - op_array->opcodes].opN##_use >= 0 && \
97 		    ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].has_range) { \
98 			return ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].range.max; \
99 		} \
100 		return ZEND_LONG_MAX; \
101 	}
102 
103 #define DEFINE_SSA_OP_RANGE_UNDERFLOW(opN) \
104 	static zend_always_inline char _ssa_##opN##_range_underflow(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) \
105 	{ \
106 		if (opline->opN##_type == IS_CONST) { \
107 			zval *zv = CRT_CONSTANT_EX(op_array, opline->opN, ssa->rt_constants); \
108 			if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_TRUE || Z_TYPE_P(zv) == IS_FALSE || Z_TYPE_P(zv) == IS_NULL) { \
109 				return 0; \
110 			} \
111 		} else if (opline->opN##_type != IS_UNUSED && \
112 		    ssa->ops && \
113 		    ssa->var_info && \
114 		    ssa->ops[opline - op_array->opcodes].opN##_use >= 0 && \
115 		    ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].has_range) { \
116 			return ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].range.underflow; \
117 		} \
118 		return 1; \
119 	}
120 
121 #define DEFINE_SSA_OP_RANGE_OVERFLOW(opN) \
122 	static zend_always_inline char _ssa_##opN##_range_overflow(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) \
123 	{ \
124 		if (opline->opN##_type == IS_CONST) { \
125 			zval *zv = CRT_CONSTANT_EX(op_array, opline->opN, ssa->rt_constants); \
126 			if (Z_TYPE_P(zv) == IS_LONG || Z_TYPE_P(zv) == IS_TRUE || Z_TYPE_P(zv) == IS_FALSE || Z_TYPE_P(zv) == IS_NULL) { \
127 				return 0; \
128 			} \
129 		} else if (opline->opN##_type != IS_UNUSED && \
130 		    ssa->ops && \
131 		    ssa->var_info && \
132 		    ssa->ops[opline - op_array->opcodes].opN##_use >= 0 && \
133 		    ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].has_range) { \
134 			return ssa->var_info[ssa->ops[opline - op_array->opcodes].opN##_use].range.overflow; \
135 		} \
136 		return 1; \
137 	}
138 
139 DEFINE_SSA_OP_HAS_RANGE(op1)
DEFINE_SSA_OP_MIN_RANGE(op1)140 DEFINE_SSA_OP_MIN_RANGE(op1)
141 DEFINE_SSA_OP_MAX_RANGE(op1)
142 DEFINE_SSA_OP_RANGE_UNDERFLOW(op1)
143 DEFINE_SSA_OP_RANGE_OVERFLOW(op1)
144 DEFINE_SSA_OP_HAS_RANGE(op2)
145 DEFINE_SSA_OP_MIN_RANGE(op2)
146 DEFINE_SSA_OP_MAX_RANGE(op2)
147 DEFINE_SSA_OP_RANGE_UNDERFLOW(op2)
148 DEFINE_SSA_OP_RANGE_OVERFLOW(op2)
149 
150 #define OP1_HAS_RANGE()         (_ssa_op1_has_range (op_array, ssa, opline))
151 #define OP1_MIN_RANGE()         (_ssa_op1_min_range (op_array, ssa, opline))
152 #define OP1_MAX_RANGE()         (_ssa_op1_max_range (op_array, ssa, opline))
153 #define OP1_RANGE_UNDERFLOW()   (_ssa_op1_range_underflow (op_array, ssa, opline))
154 #define OP1_RANGE_OVERFLOW()    (_ssa_op1_range_overflow (op_array, ssa, opline))
155 #define OP2_HAS_RANGE()         (_ssa_op2_has_range (op_array, ssa, opline))
156 #define OP2_MIN_RANGE()         (_ssa_op2_min_range (op_array, ssa, opline))
157 #define OP2_MAX_RANGE()         (_ssa_op2_max_range (op_array, ssa, opline))
158 #define OP2_RANGE_UNDERFLOW()   (_ssa_op2_range_underflow (op_array, ssa, opline))
159 #define OP2_RANGE_OVERFLOW()    (_ssa_op2_range_overflow (op_array, ssa, opline))
160 
161 static zend_always_inline uint32_t _const_op_type(const zval *zv) {
162 	if (Z_TYPE_P(zv) == IS_CONSTANT) {
163 		return MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY;
164 	} else if (Z_TYPE_P(zv) == IS_CONSTANT_AST) {
165 		return MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY;
166 	} else if (Z_TYPE_P(zv) == IS_ARRAY) {
167 		HashTable *ht = Z_ARRVAL_P(zv);
168 		uint32_t tmp = MAY_BE_ARRAY;
169 		zend_string *str;
170 		zval *val;
171 
172 		if (Z_REFCOUNTED_P(zv)) {
173 			tmp |= MAY_BE_RC1 | MAY_BE_RCN;
174 		} else {
175 			tmp |= MAY_BE_RCN;
176 		}
177 
178 		ZEND_HASH_FOREACH_STR_KEY_VAL(ht, str, val) {
179 			if (str) {
180 				tmp |= MAY_BE_ARRAY_KEY_STRING;
181 			} else {
182 				tmp |= MAY_BE_ARRAY_KEY_LONG;
183 			}
184 			tmp |= 1 << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
185 		} ZEND_HASH_FOREACH_END();
186 		return tmp;
187 	} else {
188 		uint32_t tmp = (1 << Z_TYPE_P(zv));
189 
190 		if (Z_REFCOUNTED_P(zv)) {
191 			tmp |= MAY_BE_RC1 | MAY_BE_RCN;
192 		} else if (Z_TYPE_P(zv) == IS_STRING) {
193 			tmp |= MAY_BE_RCN;
194 		}
195 		return tmp;
196 	}
197 }
198 
get_ssa_var_info(const zend_ssa * ssa,int ssa_var_num)199 static zend_always_inline uint32_t get_ssa_var_info(const zend_ssa *ssa, int ssa_var_num)
200 {
201 	if (ssa->var_info && ssa_var_num >= 0) {
202 		return ssa->var_info[ssa_var_num].type;
203 	} else {
204 		return MAY_BE_UNDEF | MAY_BE_RC1 | MAY_BE_RCN | MAY_BE_REF | MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_ERROR;
205 	}
206 }
207 
208 #define DEFINE_SSA_OP_INFO(opN) \
209 	static zend_always_inline uint32_t _ssa_##opN##_info(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) \
210 	{																		\
211 		if (opline->opN##_type == IS_CONST) {							\
212 			return _const_op_type(CRT_CONSTANT_EX(op_array, opline->opN, ssa->rt_constants)); \
213 		} else { \
214 			return get_ssa_var_info(ssa, ssa->ops ? ssa->ops[opline - op_array->opcodes].opN##_use : -1); \
215 		} \
216 	}
217 
218 #define DEFINE_SSA_OP_DEF_INFO(opN) \
219 	static zend_always_inline uint32_t _ssa_##opN##_def_info(const zend_op_array *op_array, const zend_ssa *ssa, const zend_op *opline) \
220 	{ \
221 		return get_ssa_var_info(ssa, ssa->ops ? ssa->ops[opline - op_array->opcodes].opN##_def : -1); \
222 	}
223 
224 
225 DEFINE_SSA_OP_INFO(op1)
226 DEFINE_SSA_OP_INFO(op2)
227 DEFINE_SSA_OP_INFO(result)
228 DEFINE_SSA_OP_DEF_INFO(op1)
229 DEFINE_SSA_OP_DEF_INFO(op2)
230 DEFINE_SSA_OP_DEF_INFO(result)
231 
232 #define OP1_INFO()              (_ssa_op1_info(op_array, ssa, opline))
233 #define OP2_INFO()              (_ssa_op2_info(op_array, ssa, opline))
234 #define OP1_DATA_INFO()         (_ssa_op1_info(op_array, ssa, (opline+1)))
235 #define OP2_DATA_INFO()         (_ssa_op2_info(op_array, ssa, (opline+1)))
236 #define RES_USE_INFO()          (_ssa_result_info(op_array, ssa, opline))
237 #define OP1_DEF_INFO()          (_ssa_op1_def_info(op_array, ssa, opline))
238 #define OP2_DEF_INFO()          (_ssa_op2_def_info(op_array, ssa, opline))
239 #define OP1_DATA_DEF_INFO()     (_ssa_op1_def_info(op_array, ssa, (opline+1)))
240 #define OP2_DATA_DEF_INFO()     (_ssa_op2_def_info(op_array, ssa, (opline+1)))
241 #define RES_INFO()              (_ssa_result_def_info(op_array, ssa, opline))
242 
243 
244 BEGIN_EXTERN_C()
245 
246 int zend_ssa_find_false_dependencies(const zend_op_array *op_array, zend_ssa *ssa);
247 int zend_ssa_find_sccs(const zend_op_array *op_array, zend_ssa *ssa);
248 int zend_ssa_inference(zend_arena **raena, const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa);
249 
250 uint32_t zend_array_element_type(uint32_t t1, int write, int insert);
251 
252 int  zend_inference_calc_range(const zend_op_array *op_array, zend_ssa *ssa, int var, int widening, int narrowing, zend_ssa_range *tmp);
253 void zend_inference_init_range(const zend_op_array *op_array, zend_ssa *ssa, int var, zend_bool underflow, zend_long min, zend_long max, zend_bool overflow);
254 int  zend_inference_narrowing_meet(zend_ssa_var_info *var_info, zend_ssa_range *r);
255 int  zend_inference_widening_meet(zend_ssa_var_info *var_info, zend_ssa_range *r);
256 void zend_inference_check_recursive_dependencies(zend_op_array *op_array);
257 
258 int  zend_infer_types_ex(const zend_op_array *op_array, const zend_script *script, zend_ssa *ssa, zend_bitset worklist);
259 
260 void zend_init_func_return_info(const zend_op_array   *op_array,
261                                 const zend_script     *script,
262                                 zend_ssa_var_info     *ret);
263 void zend_func_return_info(const zend_op_array   *op_array,
264                            const zend_script     *script,
265                            int                    recursive,
266                            int                    widening,
267                            zend_ssa_var_info     *ret);
268 
269 int zend_may_throw(const zend_op *opline, zend_op_array *op_array, zend_ssa *ssa);
270 
271 END_EXTERN_C()
272 
273 #endif /* ZEND_INFERENCE_H */
274 
275 /*
276  * Local variables:
277  * tab-width: 4
278  * c-basic-offset: 4
279  * indent-tabs-mode: t
280  * End:
281  */
282