1 /*
2 +----------------------------------------------------------------------+
3 | Zend Engine, SSA - Static Single Assignment Form |
4 +----------------------------------------------------------------------+
5 | Copyright (c) 1998-2018 The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | http://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@zend.com> |
16 | Nikita Popov <nikic@php.net> |
17 +----------------------------------------------------------------------+
18 */
19
20 #include "php.h"
21 #include "zend_compile.h"
22 #include "zend_dfg.h"
23 #include "zend_ssa.h"
24 #include "zend_dump.h"
25 #include "zend_inference.h"
26 #include "Optimizer/zend_optimizer_internal.h"
27
dominates(const zend_basic_block * blocks,int a,int b)28 static zend_bool dominates(const zend_basic_block *blocks, int a, int b) {
29 while (blocks[b].level > blocks[a].level) {
30 b = blocks[b].idom;
31 }
32 return a == b;
33 }
34
dominates_other_predecessors(const zend_cfg * cfg,const zend_basic_block * block,int check,int exclude)35 static zend_bool dominates_other_predecessors(
36 const zend_cfg *cfg, const zend_basic_block *block, int check, int exclude) {
37 int i;
38 for (i = 0; i < block->predecessors_count; i++) {
39 int predecessor = cfg->predecessors[block->predecessor_offset + i];
40 if (predecessor != exclude && !dominates(cfg->blocks, check, predecessor)) {
41 return 0;
42 }
43 }
44 return 1;
45 }
46
needs_pi(const zend_op_array * op_array,zend_dfg * dfg,zend_ssa * ssa,int from,int to,int var)47 static zend_bool needs_pi(const zend_op_array *op_array, zend_dfg *dfg, zend_ssa *ssa, int from, int to, int var) /* {{{ */
48 {
49 zend_basic_block *from_block, *to_block;
50 int other_successor;
51
52 if (!DFG_ISSET(dfg->in, dfg->size, to, var)) {
53 /* Variable is not live, certainly won't benefit from pi */
54 return 0;
55 }
56
57 /* Make sure that both sucessors of the from block aren't the same. Pi nodes are associated
58 * with predecessor blocks, so we can't distinguish which edge the pi belongs to. */
59 from_block = &ssa->cfg.blocks[from];
60 ZEND_ASSERT(from_block->successors_count == 2);
61 if (from_block->successors[0] == from_block->successors[1]) {
62 return 0;
63 }
64
65 to_block = &ssa->cfg.blocks[to];
66 if (to_block->predecessors_count == 1) {
67 /* Always place pi if one predecessor (an if branch) */
68 return 1;
69 }
70
71 /* Check that the other successor of the from block does not dominate all other predecessors.
72 * If it does, we'd probably end up annihilating a positive+negative pi assertion. */
73 other_successor = from_block->successors[0] == to
74 ? from_block->successors[1] : from_block->successors[0];
75 return !dominates_other_predecessors(&ssa->cfg, to_block, other_successor, from);
76 }
77 /* }}} */
78
add_pi(zend_arena ** arena,const zend_op_array * op_array,zend_dfg * dfg,zend_ssa * ssa,int from,int to,int var)79 static zend_ssa_phi *add_pi(
80 zend_arena **arena, const zend_op_array *op_array, zend_dfg *dfg, zend_ssa *ssa,
81 int from, int to, int var) /* {{{ */
82 {
83 zend_ssa_phi *phi;
84 if (!needs_pi(op_array, dfg, ssa, from, to, var)) {
85 return NULL;
86 }
87
88 phi = zend_arena_calloc(arena, 1,
89 ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)) +
90 ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->cfg.blocks[to].predecessors_count) +
91 sizeof(void*) * ssa->cfg.blocks[to].predecessors_count);
92 phi->sources = (int*)(((char*)phi) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)));
93 memset(phi->sources, 0xff, sizeof(int) * ssa->cfg.blocks[to].predecessors_count);
94 phi->use_chains = (zend_ssa_phi**)(((char*)phi->sources) + ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->cfg.blocks[to].predecessors_count));
95
96 phi->pi = from;
97 phi->var = var;
98 phi->ssa_var = -1;
99 phi->next = ssa->blocks[to].phis;
100 ssa->blocks[to].phis = phi;
101
102 /* Block "to" now defines "var" via the pi statement, so add it to the "def" set. Note that
103 * this is not entirely accurate, because the pi is actually placed along the edge from->to.
104 * If there is a back-edge to "to" this may result in non-minimal SSA form. */
105 DFG_SET(dfg->def, dfg->size, to, var);
106
107 /* If there are multiple predecessors in the target block, we need to place a phi there.
108 * However this can (generally) not be expressed in terms of dominance frontiers, so place it
109 * explicitly. dfg->use here really is dfg->phi, we're reusing the set. */
110 if (ssa->cfg.blocks[to].predecessors_count > 1) {
111 DFG_SET(dfg->use, dfg->size, to, var);
112 }
113
114 return phi;
115 }
116 /* }}} */
117
pi_range(zend_ssa_phi * phi,int min_var,int max_var,zend_long min,zend_long max,char underflow,char overflow,char negative)118 static void pi_range(
119 zend_ssa_phi *phi, int min_var, int max_var, zend_long min, zend_long max,
120 char underflow, char overflow, char negative) /* {{{ */
121 {
122 zend_ssa_range_constraint *constraint = &phi->constraint.range;
123 constraint->min_var = min_var;
124 constraint->max_var = max_var;
125 constraint->min_ssa_var = -1;
126 constraint->max_ssa_var = -1;
127 constraint->range.min = min;
128 constraint->range.max = max;
129 constraint->range.underflow = underflow;
130 constraint->range.overflow = overflow;
131 constraint->negative = negative ? NEG_INIT : NEG_NONE;
132 phi->has_range_constraint = 1;
133 }
134 /* }}} */
135
pi_range_equals(zend_ssa_phi * phi,int var,zend_long val)136 static inline void pi_range_equals(zend_ssa_phi *phi, int var, zend_long val) {
137 pi_range(phi, var, var, val, val, 0, 0, 0);
138 }
pi_range_not_equals(zend_ssa_phi * phi,int var,zend_long val)139 static inline void pi_range_not_equals(zend_ssa_phi *phi, int var, zend_long val) {
140 pi_range(phi, var, var, val, val, 0, 0, 1);
141 }
pi_range_min(zend_ssa_phi * phi,int var,zend_long val)142 static inline void pi_range_min(zend_ssa_phi *phi, int var, zend_long val) {
143 pi_range(phi, var, -1, val, ZEND_LONG_MAX, 0, 1, 0);
144 }
pi_range_max(zend_ssa_phi * phi,int var,zend_long val)145 static inline void pi_range_max(zend_ssa_phi *phi, int var, zend_long val) {
146 pi_range(phi, -1, var, ZEND_LONG_MIN, val, 1, 0, 0);
147 }
148
pi_type_mask(zend_ssa_phi * phi,uint32_t type_mask)149 static void pi_type_mask(zend_ssa_phi *phi, uint32_t type_mask) {
150 phi->has_range_constraint = 0;
151 phi->constraint.type.ce = NULL;
152 phi->constraint.type.type_mask = MAY_BE_REF|MAY_BE_RC1|MAY_BE_RCN;
153 phi->constraint.type.type_mask |= type_mask;
154 if (type_mask & MAY_BE_NULL) {
155 phi->constraint.type.type_mask |= MAY_BE_UNDEF;
156 }
157 }
pi_not_type_mask(zend_ssa_phi * phi,uint32_t type_mask)158 static inline void pi_not_type_mask(zend_ssa_phi *phi, uint32_t type_mask) {
159 uint32_t relevant = MAY_BE_ANY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
160 pi_type_mask(phi, ~type_mask & relevant);
161 }
mask_for_type_check(uint32_t type)162 static inline uint32_t mask_for_type_check(uint32_t type) {
163 if (type == _IS_BOOL) {
164 return MAY_BE_TRUE|MAY_BE_FALSE;
165 } else if (type == IS_ARRAY) {
166 return MAY_BE_ARRAY|MAY_BE_ARRAY_KEY_ANY|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_OF_REF;
167 } else {
168 return 1 << type;
169 }
170 }
171
172 /* We can interpret $a + 5 == 0 as $a = 0 - 5, i.e. shift the adjustment to the other operand.
173 * This negated adjustment is what is written into the "adjustment" parameter. */
find_adjusted_tmp_var(const zend_op_array * op_array,uint32_t build_flags,zend_op * opline,uint32_t var_num,zend_long * adjustment)174 static int find_adjusted_tmp_var(const zend_op_array *op_array, uint32_t build_flags, zend_op *opline, uint32_t var_num, zend_long *adjustment) /* {{{ */
175 {
176 zend_op *op = opline;
177 zval *zv;
178
179 while (op != op_array->opcodes) {
180 op--;
181 if (op->result_type != IS_TMP_VAR || op->result.var != var_num) {
182 continue;
183 }
184
185 if (op->opcode == ZEND_POST_DEC) {
186 if (op->op1_type == IS_CV) {
187 *adjustment = -1;
188 return EX_VAR_TO_NUM(op->op1.var);
189 }
190 } else if (op->opcode == ZEND_POST_INC) {
191 if (op->op1_type == IS_CV) {
192 *adjustment = 1;
193 return EX_VAR_TO_NUM(op->op1.var);
194 }
195 } else if (op->opcode == ZEND_ADD) {
196 if (op->op1_type == IS_CV && op->op2_type == IS_CONST) {
197 zv = CRT_CONSTANT(op->op2);
198 if (Z_TYPE_P(zv) == IS_LONG
199 && Z_LVAL_P(zv) != ZEND_LONG_MIN) {
200 *adjustment = -Z_LVAL_P(zv);
201 return EX_VAR_TO_NUM(op->op1.var);
202 }
203 } else if (op->op2_type == IS_CV && op->op1_type == IS_CONST) {
204 zv = CRT_CONSTANT(op->op1);
205 if (Z_TYPE_P(zv) == IS_LONG
206 && Z_LVAL_P(zv) != ZEND_LONG_MIN) {
207 *adjustment = -Z_LVAL_P(zv);
208 return EX_VAR_TO_NUM(op->op2.var);
209 }
210 }
211 } else if (op->opcode == ZEND_SUB) {
212 if (op->op1_type == IS_CV && op->op2_type == IS_CONST) {
213 zv = CRT_CONSTANT(op->op2);
214 if (Z_TYPE_P(zv) == IS_LONG) {
215 *adjustment = Z_LVAL_P(zv);
216 return EX_VAR_TO_NUM(op->op1.var);
217 }
218 }
219 }
220 break;
221 }
222 return -1;
223 }
224 /* }}} */
225
add_will_overflow(zend_long a,zend_long b)226 static inline zend_bool add_will_overflow(zend_long a, zend_long b) {
227 return (b > 0 && a > ZEND_LONG_MAX - b)
228 || (b < 0 && a < ZEND_LONG_MIN - b);
229 }
sub_will_overflow(zend_long a,zend_long b)230 static inline zend_bool sub_will_overflow(zend_long a, zend_long b) {
231 return (b > 0 && a < ZEND_LONG_MIN + b)
232 || (b < 0 && a > ZEND_LONG_MAX + b);
233 }
234
235 /* e-SSA construction: Pi placement (Pi is actually a Phi with single
236 * source and constraint).
237 * Order of Phis is importent, Pis must be placed before Phis
238 */
place_essa_pis(zend_arena ** arena,const zend_script * script,const zend_op_array * op_array,uint32_t build_flags,zend_ssa * ssa,zend_dfg * dfg)239 static void place_essa_pis(
240 zend_arena **arena, const zend_script *script, const zend_op_array *op_array,
241 uint32_t build_flags, zend_ssa *ssa, zend_dfg *dfg) /* {{{ */ {
242 zend_basic_block *blocks = ssa->cfg.blocks;
243 int j, blocks_count = ssa->cfg.blocks_count;
244 for (j = 0; j < blocks_count; j++) {
245 zend_ssa_phi *pi;
246 zend_op *opline = op_array->opcodes + blocks[j].start + blocks[j].len - 1;
247 int bt; /* successor block number if a condition is true */
248 int bf; /* successor block number if a condition is false */
249
250 if ((blocks[j].flags & ZEND_BB_REACHABLE) == 0 || blocks[j].len == 0) {
251 continue;
252 }
253 /* the last instruction of basic block is conditional branch,
254 * based on comparison of CV(s)
255 */
256 switch (opline->opcode) {
257 case ZEND_JMPZ:
258 case ZEND_JMPZNZ:
259 bf = blocks[j].successors[0];
260 bt = blocks[j].successors[1];
261 break;
262 case ZEND_JMPNZ:
263 bt = blocks[j].successors[0];
264 bf = blocks[j].successors[1];
265 break;
266 default:
267 continue;
268 }
269 if (opline->op1_type == IS_TMP_VAR &&
270 ((opline-1)->opcode == ZEND_IS_EQUAL ||
271 (opline-1)->opcode == ZEND_IS_NOT_EQUAL ||
272 (opline-1)->opcode == ZEND_IS_SMALLER ||
273 (opline-1)->opcode == ZEND_IS_SMALLER_OR_EQUAL) &&
274 opline->op1.var == (opline-1)->result.var) {
275 int var1 = -1;
276 int var2 = -1;
277 zend_long val1 = 0;
278 zend_long val2 = 0;
279 // long val = 0;
280
281 if ((opline-1)->op1_type == IS_CV) {
282 var1 = EX_VAR_TO_NUM((opline-1)->op1.var);
283 } else if ((opline-1)->op1_type == IS_TMP_VAR) {
284 var1 = find_adjusted_tmp_var(
285 op_array, build_flags, opline, (opline-1)->op1.var, &val2);
286 }
287
288 if ((opline-1)->op2_type == IS_CV) {
289 var2 = EX_VAR_TO_NUM((opline-1)->op2.var);
290 } else if ((opline-1)->op2_type == IS_TMP_VAR) {
291 var2 = find_adjusted_tmp_var(
292 op_array, build_flags, opline, (opline-1)->op2.var, &val1);
293 }
294
295 if (var1 >= 0 && var2 >= 0) {
296 if (!sub_will_overflow(val1, val2) && !sub_will_overflow(val2, val1)) {
297 zend_long tmp = val1;
298 val1 -= val2;
299 val2 -= tmp;
300 } else {
301 var1 = -1;
302 var2 = -1;
303 }
304 } else if (var1 >= 0 && var2 < 0) {
305 zend_long add_val2 = 0;
306 if ((opline-1)->op2_type == IS_CONST) {
307 zval *zv = CRT_CONSTANT((opline-1)->op2);
308
309 if (Z_TYPE_P(zv) == IS_LONG) {
310 add_val2 = Z_LVAL_P(zv);
311 } else if (Z_TYPE_P(zv) == IS_FALSE) {
312 add_val2 = 0;
313 } else if (Z_TYPE_P(zv) == IS_TRUE) {
314 add_val2 = 1;
315 } else {
316 var1 = -1;
317 }
318 } else {
319 var1 = -1;
320 }
321 if (!add_will_overflow(val2, add_val2)) {
322 val2 += add_val2;
323 } else {
324 var1 = -1;
325 }
326 } else if (var1 < 0 && var2 >= 0) {
327 zend_long add_val1 = 0;
328 if ((opline-1)->op1_type == IS_CONST) {
329 zval *zv = CRT_CONSTANT((opline-1)->op1);
330 if (Z_TYPE_P(zv) == IS_LONG) {
331 add_val1 = Z_LVAL_P(CRT_CONSTANT((opline-1)->op1));
332 } else if (Z_TYPE_P(zv) == IS_FALSE) {
333 add_val1 = 0;
334 } else if (Z_TYPE_P(zv) == IS_TRUE) {
335 add_val1 = 1;
336 } else {
337 var2 = -1;
338 }
339 } else {
340 var2 = -1;
341 }
342 if (!add_will_overflow(val1, add_val1)) {
343 val1 += add_val1;
344 } else {
345 var2 = -1;
346 }
347 }
348
349 if (var1 >= 0) {
350 if ((opline-1)->opcode == ZEND_IS_EQUAL) {
351 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
352 pi_range_equals(pi, var2, val2);
353 }
354 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
355 pi_range_not_equals(pi, var2, val2);
356 }
357 } else if ((opline-1)->opcode == ZEND_IS_NOT_EQUAL) {
358 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
359 pi_range_equals(pi, var2, val2);
360 }
361 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
362 pi_range_not_equals(pi, var2, val2);
363 }
364 } else if ((opline-1)->opcode == ZEND_IS_SMALLER) {
365 if (val2 > ZEND_LONG_MIN) {
366 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
367 pi_range_max(pi, var2, val2-1);
368 }
369 }
370 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
371 pi_range_min(pi, var2, val2);
372 }
373 } else if ((opline-1)->opcode == ZEND_IS_SMALLER_OR_EQUAL) {
374 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var1))) {
375 pi_range_max(pi, var2, val2);
376 }
377 if (val2 < ZEND_LONG_MAX) {
378 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var1))) {
379 pi_range_min(pi, var2, val2+1);
380 }
381 }
382 }
383 }
384 if (var2 >= 0) {
385 if((opline-1)->opcode == ZEND_IS_EQUAL) {
386 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
387 pi_range_equals(pi, var1, val1);
388 }
389 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
390 pi_range_not_equals(pi, var1, val1);
391 }
392 } else if ((opline-1)->opcode == ZEND_IS_NOT_EQUAL) {
393 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
394 pi_range_equals(pi, var1, val1);
395 }
396 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
397 pi_range_not_equals(pi, var1, val1);
398 }
399 } else if ((opline-1)->opcode == ZEND_IS_SMALLER) {
400 if (val1 < ZEND_LONG_MAX) {
401 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
402 pi_range_min(pi, var1, val1+1);
403 }
404 }
405 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
406 pi_range_max(pi, var1, val1);
407 }
408 } else if ((opline-1)->opcode == ZEND_IS_SMALLER_OR_EQUAL) {
409 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var2))) {
410 pi_range_min(pi, var1, val1);
411 }
412 if (val1 > ZEND_LONG_MIN) {
413 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var2))) {
414 pi_range_max(pi, var1, val1-1);
415 }
416 }
417 }
418 }
419 } else if (opline->op1_type == IS_TMP_VAR &&
420 ((opline-1)->opcode == ZEND_POST_INC ||
421 (opline-1)->opcode == ZEND_POST_DEC) &&
422 opline->op1.var == (opline-1)->result.var &&
423 (opline-1)->op1_type == IS_CV) {
424 int var = EX_VAR_TO_NUM((opline-1)->op1.var);
425
426 if ((opline-1)->opcode == ZEND_POST_DEC) {
427 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
428 pi_range_equals(pi, -1, -1);
429 }
430 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
431 pi_range_not_equals(pi, -1, -1);
432 }
433 } else if ((opline-1)->opcode == ZEND_POST_INC) {
434 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
435 pi_range_equals(pi, -1, 1);
436 }
437 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
438 pi_range_not_equals(pi, -1, 1);
439 }
440 }
441 } else if (opline->op1_type == IS_VAR &&
442 ((opline-1)->opcode == ZEND_PRE_INC ||
443 (opline-1)->opcode == ZEND_PRE_DEC) &&
444 opline->op1.var == (opline-1)->result.var &&
445 (opline-1)->op1_type == IS_CV) {
446 int var = EX_VAR_TO_NUM((opline-1)->op1.var);
447
448 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
449 pi_range_equals(pi, -1, 0);
450 }
451 /* speculative */
452 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
453 pi_range_not_equals(pi, -1, 0);
454 }
455 } else if (opline->op1_type == IS_TMP_VAR && (opline-1)->opcode == ZEND_TYPE_CHECK &&
456 opline->op1.var == (opline-1)->result.var && (opline-1)->op1_type == IS_CV) {
457 int var = EX_VAR_TO_NUM((opline-1)->op1.var);
458 uint32_t type = (opline-1)->extended_value;
459 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
460 pi_type_mask(pi, mask_for_type_check(type));
461 }
462 if (type != IS_RESOURCE) {
463 /* is_resource() may return false for closed resources */
464 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
465 pi_not_type_mask(pi, mask_for_type_check(type));
466 }
467 }
468 } else if (opline->op1_type == IS_TMP_VAR &&
469 ((opline-1)->opcode == ZEND_IS_IDENTICAL
470 || (opline-1)->opcode == ZEND_IS_NOT_IDENTICAL) &&
471 opline->op1.var == (opline-1)->result.var) {
472 int var;
473 zval *val;
474 uint32_t type_mask;
475 if ((opline-1)->op1_type == IS_CV && (opline-1)->op2_type == IS_CONST) {
476 var = EX_VAR_TO_NUM((opline-1)->op1.var);
477 val = CRT_CONSTANT((opline-1)->op2);
478 } else if ((opline-1)->op1_type == IS_CONST && (opline-1)->op2_type == IS_CV) {
479 var = EX_VAR_TO_NUM((opline-1)->op2.var);
480 val = CRT_CONSTANT((opline-1)->op1);
481 } else {
482 continue;
483 }
484
485 /* We're interested in === null/true/false comparisons here, because they eliminate
486 * a type in the false-branch. Other === VAL comparisons are unlikely to be useful. */
487 if (Z_TYPE_P(val) != IS_NULL && Z_TYPE_P(val) != IS_TRUE && Z_TYPE_P(val) != IS_FALSE) {
488 continue;
489 }
490
491 type_mask = _const_op_type(val);
492 if ((opline-1)->opcode == ZEND_IS_IDENTICAL) {
493 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
494 pi_type_mask(pi, type_mask);
495 }
496 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
497 pi_not_type_mask(pi, type_mask);
498 }
499 } else {
500 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bf, var))) {
501 pi_type_mask(pi, type_mask);
502 }
503 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
504 pi_not_type_mask(pi, type_mask);
505 }
506 }
507 } else if (opline->op1_type == IS_TMP_VAR && (opline-1)->opcode == ZEND_INSTANCEOF &&
508 opline->op1.var == (opline-1)->result.var && (opline-1)->op1_type == IS_CV &&
509 (opline-1)->op2_type == IS_CONST) {
510 int var = EX_VAR_TO_NUM((opline-1)->op1.var);
511 zend_string *lcname = Z_STR_P(CRT_CONSTANT((opline-1)->op2) + 1);
512 zend_class_entry *ce = script ? zend_hash_find_ptr(&script->class_table, lcname) : NULL;
513 if (!ce) {
514 ce = zend_hash_find_ptr(CG(class_table), lcname);
515 if (!ce || ce->type != ZEND_INTERNAL_CLASS) {
516 continue;
517 }
518 }
519
520 if ((pi = add_pi(arena, op_array, dfg, ssa, j, bt, var))) {
521 pi_type_mask(pi, MAY_BE_OBJECT);
522 pi->constraint.type.ce = ce;
523 }
524 }
525 }
526 }
527 /* }}} */
528
zend_ssa_rename(const zend_op_array * op_array,uint32_t build_flags,zend_ssa * ssa,int * var,int n)529 static int zend_ssa_rename(const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa, int *var, int n) /* {{{ */
530 {
531 zend_basic_block *blocks = ssa->cfg.blocks;
532 zend_ssa_block *ssa_blocks = ssa->blocks;
533 zend_ssa_op *ssa_ops = ssa->ops;
534 int ssa_vars_count = ssa->vars_count;
535 int i, j;
536 zend_op *opline, *end;
537 int *tmp = NULL;
538 ALLOCA_FLAG(use_heap);
539
540 // FIXME: Can we optimize this copying out in some cases?
541 if (blocks[n].next_child >= 0) {
542 tmp = do_alloca(sizeof(int) * (op_array->last_var + op_array->T), use_heap);
543 memcpy(tmp, var, sizeof(int) * (op_array->last_var + op_array->T));
544 var = tmp;
545 }
546
547 if (ssa_blocks[n].phis) {
548 zend_ssa_phi *phi = ssa_blocks[n].phis;
549 do {
550 if (phi->ssa_var < 0) {
551 phi->ssa_var = ssa_vars_count;
552 var[phi->var] = ssa_vars_count;
553 ssa_vars_count++;
554 } else {
555 var[phi->var] = phi->ssa_var;
556 }
557 phi = phi->next;
558 } while (phi);
559 }
560
561 opline = op_array->opcodes + blocks[n].start;
562 end = opline + blocks[n].len;
563 for (; opline < end; opline++) {
564 uint32_t k = opline - op_array->opcodes;
565 if (opline->opcode != ZEND_OP_DATA) {
566 zend_op *next = opline + 1;
567 if (next < end && next->opcode == ZEND_OP_DATA) {
568 if (next->op1_type == IS_CV) {
569 ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
570 //USE_SSA_VAR(next->op1.var);
571 } else if (next->op1_type & (IS_VAR|IS_TMP_VAR)) {
572 ssa_ops[k + 1].op1_use = var[EX_VAR_TO_NUM(next->op1.var)];
573 //USE_SSA_VAR(op_array->last_var + next->op1.var);
574 }
575 if (next->op2_type == IS_CV) {
576 ssa_ops[k + 1].op2_use = var[EX_VAR_TO_NUM(next->op2.var)];
577 //USE_SSA_VAR(next->op2.var);
578 } else if (next->op2_type & (IS_VAR|IS_TMP_VAR)) {
579 ssa_ops[k + 1].op2_use = var[EX_VAR_TO_NUM(next->op2.var)];
580 //USE_SSA_VAR(op_array->last_var + next->op2.var);
581 }
582 }
583 if (opline->op1_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
584 ssa_ops[k].op1_use = var[EX_VAR_TO_NUM(opline->op1.var)];
585 //USE_SSA_VAR(op_array->last_var + opline->op1.var)
586 }
587 if (opline->opcode == ZEND_FE_FETCH_R || opline->opcode == ZEND_FE_FETCH_RW) {
588 if (opline->op2_type == IS_CV) {
589 ssa_ops[k].op2_use = var[EX_VAR_TO_NUM(opline->op2.var)];
590 }
591 ssa_ops[k].op2_def = ssa_vars_count;
592 var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
593 ssa_vars_count++;
594 //NEW_SSA_VAR(opline->op2.var)
595 } else if (opline->op2_type & (IS_CV|IS_VAR|IS_TMP_VAR)) {
596 ssa_ops[k].op2_use = var[EX_VAR_TO_NUM(opline->op2.var)];
597 //USE_SSA_VAR(op_array->last_var + opline->op2.var)
598 }
599 switch (opline->opcode) {
600 case ZEND_ASSIGN:
601 if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op2_type == IS_CV) {
602 ssa_ops[k].op2_def = ssa_vars_count;
603 var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
604 ssa_vars_count++;
605 //NEW_SSA_VAR(opline->op2.var)
606 }
607 if (opline->op1_type == IS_CV) {
608 ssa_ops[k].op1_def = ssa_vars_count;
609 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
610 ssa_vars_count++;
611 //NEW_SSA_VAR(opline->op1.var)
612 }
613 break;
614 case ZEND_ASSIGN_REF:
615 //TODO: ???
616 if (opline->op2_type == IS_CV) {
617 ssa_ops[k].op2_def = ssa_vars_count;
618 var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
619 ssa_vars_count++;
620 //NEW_SSA_VAR(opline->op2.var)
621 }
622 if (opline->op1_type == IS_CV) {
623 ssa_ops[k].op1_def = ssa_vars_count;
624 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
625 ssa_vars_count++;
626 //NEW_SSA_VAR(opline->op1.var)
627 }
628 break;
629 case ZEND_BIND_GLOBAL:
630 case ZEND_BIND_STATIC:
631 if (opline->op1_type == IS_CV) {
632 ssa_ops[k].op1_def = ssa_vars_count;
633 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
634 ssa_vars_count++;
635 //NEW_SSA_VAR(opline->op1.var)
636 }
637 break;
638 case ZEND_ASSIGN_DIM:
639 case ZEND_ASSIGN_OBJ:
640 if (opline->op1_type == IS_CV) {
641 ssa_ops[k].op1_def = ssa_vars_count;
642 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
643 ssa_vars_count++;
644 //NEW_SSA_VAR(opline->op1.var)
645 }
646 if ((build_flags & ZEND_SSA_RC_INFERENCE) && next->op1_type == IS_CV) {
647 ssa_ops[k + 1].op1_def = ssa_vars_count;
648 var[EX_VAR_TO_NUM(next->op1.var)] = ssa_vars_count;
649 ssa_vars_count++;
650 //NEW_SSA_VAR(next->op1.var)
651 }
652 break;
653 case ZEND_ADD_ARRAY_ELEMENT:
654 ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
655 case ZEND_INIT_ARRAY:
656 if (((build_flags & ZEND_SSA_RC_INFERENCE)
657 || (opline->extended_value & ZEND_ARRAY_ELEMENT_REF))
658 && opline->op1_type == IS_CV) {
659 ssa_ops[k].op1_def = ssa_vars_count;
660 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
661 ssa_vars_count++;
662 //NEW_SSA_VAR(opline+->op1.var)
663 }
664 break;
665 case ZEND_SEND_VAR:
666 case ZEND_CAST:
667 case ZEND_QM_ASSIGN:
668 case ZEND_JMP_SET:
669 case ZEND_COALESCE:
670 if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op1_type == IS_CV) {
671 ssa_ops[k].op1_def = ssa_vars_count;
672 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
673 ssa_vars_count++;
674 //NEW_SSA_VAR(opline->op1.var)
675 }
676 break;
677 case ZEND_SEND_VAR_NO_REF:
678 case ZEND_SEND_VAR_NO_REF_EX:
679 case ZEND_SEND_VAR_EX:
680 case ZEND_SEND_REF:
681 case ZEND_SEND_UNPACK:
682 case ZEND_FE_RESET_RW:
683 //TODO: ???
684 if (opline->op1_type == IS_CV) {
685 ssa_ops[k].op1_def = ssa_vars_count;
686 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
687 ssa_vars_count++;
688 //NEW_SSA_VAR(opline->op1.var)
689 }
690 break;
691 case ZEND_FE_RESET_R:
692 if ((build_flags & ZEND_SSA_RC_INFERENCE) && opline->op1_type == IS_CV) {
693 ssa_ops[k].op1_def = ssa_vars_count;
694 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
695 ssa_vars_count++;
696 //NEW_SSA_VAR(opline->op1.var)
697 }
698 break;
699 case ZEND_ASSIGN_ADD:
700 case ZEND_ASSIGN_SUB:
701 case ZEND_ASSIGN_MUL:
702 case ZEND_ASSIGN_DIV:
703 case ZEND_ASSIGN_MOD:
704 case ZEND_ASSIGN_SL:
705 case ZEND_ASSIGN_SR:
706 case ZEND_ASSIGN_CONCAT:
707 case ZEND_ASSIGN_BW_OR:
708 case ZEND_ASSIGN_BW_AND:
709 case ZEND_ASSIGN_BW_XOR:
710 case ZEND_ASSIGN_POW:
711 case ZEND_PRE_INC:
712 case ZEND_PRE_DEC:
713 case ZEND_POST_INC:
714 case ZEND_POST_DEC:
715 if (opline->op1_type == IS_CV) {
716 ssa_ops[k].op1_def = ssa_vars_count;
717 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
718 ssa_vars_count++;
719 //NEW_SSA_VAR(opline->op1.var)
720 }
721 break;
722 case ZEND_UNSET_CV:
723 ssa_ops[k].op1_def = ssa_vars_count;
724 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
725 ssa_vars_count++;
726 break;
727 case ZEND_UNSET_DIM:
728 case ZEND_UNSET_OBJ:
729 case ZEND_FETCH_DIM_W:
730 case ZEND_FETCH_DIM_RW:
731 case ZEND_FETCH_DIM_FUNC_ARG:
732 case ZEND_FETCH_DIM_UNSET:
733 case ZEND_FETCH_OBJ_W:
734 case ZEND_FETCH_OBJ_RW:
735 case ZEND_FETCH_OBJ_FUNC_ARG:
736 case ZEND_FETCH_OBJ_UNSET:
737 if (opline->op1_type == IS_CV) {
738 ssa_ops[k].op1_def = ssa_vars_count;
739 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
740 ssa_vars_count++;
741 //NEW_SSA_VAR(opline->op1.var)
742 }
743 break;
744 case ZEND_BIND_LEXICAL:
745 if (opline->extended_value || (build_flags & ZEND_SSA_RC_INFERENCE)) {
746 ssa_ops[k].op2_def = ssa_vars_count;
747 var[EX_VAR_TO_NUM(opline->op2.var)] = ssa_vars_count;
748 ssa_vars_count++;
749 }
750 break;
751 case ZEND_YIELD:
752 if (opline->op1_type == IS_CV
753 && ((op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE)
754 || (build_flags & ZEND_SSA_RC_INFERENCE))) {
755 ssa_ops[k].op1_def = ssa_vars_count;
756 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
757 ssa_vars_count++;
758 }
759 break;
760 case ZEND_VERIFY_RETURN_TYPE:
761 if (opline->op1_type & (IS_TMP_VAR|IS_VAR|IS_CV)) {
762 ssa_ops[k].op1_def = ssa_vars_count;
763 var[EX_VAR_TO_NUM(opline->op1.var)] = ssa_vars_count;
764 ssa_vars_count++;
765 //NEW_SSA_VAR(opline->op1.var)
766 }
767 break;
768 default:
769 break;
770 }
771 if (opline->result_type == IS_CV) {
772 if ((build_flags & ZEND_SSA_USE_CV_RESULTS)
773 && opline->opcode != ZEND_RECV) {
774 ssa_ops[k].result_use = var[EX_VAR_TO_NUM(opline->result.var)];
775 }
776 ssa_ops[k].result_def = ssa_vars_count;
777 var[EX_VAR_TO_NUM(opline->result.var)] = ssa_vars_count;
778 ssa_vars_count++;
779 //NEW_SSA_VAR(opline->result.var)
780 } else if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
781 ssa_ops[k].result_def = ssa_vars_count;
782 var[EX_VAR_TO_NUM(opline->result.var)] = ssa_vars_count;
783 ssa_vars_count++;
784 //NEW_SSA_VAR(op_array->last_var + opline->result.var)
785 }
786 }
787 }
788
789 for (i = 0; i < blocks[n].successors_count; i++) {
790 int succ = blocks[n].successors[i];
791 zend_ssa_phi *p;
792 for (p = ssa_blocks[succ].phis; p; p = p->next) {
793 if (p->pi == n) {
794 /* e-SSA Pi */
795 if (p->has_range_constraint) {
796 if (p->constraint.range.min_var >= 0) {
797 p->constraint.range.min_ssa_var = var[p->constraint.range.min_var];
798 }
799 if (p->constraint.range.max_var >= 0) {
800 p->constraint.range.max_ssa_var = var[p->constraint.range.max_var];
801 }
802 }
803 for (j = 0; j < blocks[succ].predecessors_count; j++) {
804 p->sources[j] = var[p->var];
805 }
806 if (p->ssa_var < 0) {
807 p->ssa_var = ssa_vars_count;
808 ssa_vars_count++;
809 }
810 } else if (p->pi < 0) {
811 /* Normal Phi */
812 for (j = 0; j < blocks[succ].predecessors_count; j++)
813 if (ssa->cfg.predecessors[blocks[succ].predecessor_offset + j] == n) {
814 break;
815 }
816 ZEND_ASSERT(j < blocks[succ].predecessors_count);
817 p->sources[j] = var[p->var];
818 }
819 }
820 for (p = ssa_blocks[succ].phis; p && (p->pi >= 0); p = p->next) {
821 if (p->pi == n) {
822 zend_ssa_phi *q = p->next;
823 while (q) {
824 if (q->pi < 0 && q->var == p->var) {
825 for (j = 0; j < blocks[succ].predecessors_count; j++) {
826 if (ssa->cfg.predecessors[blocks[succ].predecessor_offset + j] == n) {
827 break;
828 }
829 }
830 ZEND_ASSERT(j < blocks[succ].predecessors_count);
831 q->sources[j] = p->ssa_var;
832 }
833 q = q->next;
834 }
835 }
836 }
837 }
838
839 ssa->vars_count = ssa_vars_count;
840
841 j = blocks[n].children;
842 while (j >= 0) {
843 // FIXME: Tail call optimization?
844 if (zend_ssa_rename(op_array, build_flags, ssa, var, j) != SUCCESS)
845 return FAILURE;
846 j = blocks[j].next_child;
847 }
848
849 if (tmp) {
850 free_alloca(tmp, use_heap);
851 }
852
853 return SUCCESS;
854 }
855 /* }}} */
856
zend_build_ssa(zend_arena ** arena,const zend_script * script,const zend_op_array * op_array,uint32_t build_flags,zend_ssa * ssa,uint32_t * func_flags)857 int zend_build_ssa(zend_arena **arena, const zend_script *script, const zend_op_array *op_array, uint32_t build_flags, zend_ssa *ssa, uint32_t *func_flags) /* {{{ */
858 {
859 zend_basic_block *blocks = ssa->cfg.blocks;
860 zend_ssa_block *ssa_blocks;
861 int blocks_count = ssa->cfg.blocks_count;
862 uint32_t set_size;
863 zend_bitset def, in, phi;
864 int *var = NULL;
865 int i, j, k, changed;
866 zend_dfg dfg;
867 ALLOCA_FLAG(dfg_use_heap)
868 ALLOCA_FLAG(var_use_heap)
869
870 if ((blocks_count * (op_array->last_var + op_array->T)) > 4 * 1024 * 1024) {
871 /* Don't buld SSA for very big functions */
872 return FAILURE;
873 }
874
875 ssa->rt_constants = (build_flags & ZEND_RT_CONSTANTS);
876 ssa_blocks = zend_arena_calloc(arena, blocks_count, sizeof(zend_ssa_block));
877 ssa->blocks = ssa_blocks;
878
879 /* Compute Variable Liveness */
880 dfg.vars = op_array->last_var + op_array->T;
881 dfg.size = set_size = zend_bitset_len(dfg.vars);
882 dfg.tmp = do_alloca((set_size * sizeof(zend_ulong)) * (blocks_count * 4 + 1), dfg_use_heap);
883 memset(dfg.tmp, 0, (set_size * sizeof(zend_ulong)) * (blocks_count * 4 + 1));
884 dfg.def = dfg.tmp + set_size;
885 dfg.use = dfg.def + set_size * blocks_count;
886 dfg.in = dfg.use + set_size * blocks_count;
887 dfg.out = dfg.in + set_size * blocks_count;
888
889 if (zend_build_dfg(op_array, &ssa->cfg, &dfg, build_flags) != SUCCESS) {
890 free_alloca(dfg.tmp, dfg_use_heap);
891 return FAILURE;
892 }
893
894 if (build_flags & ZEND_SSA_DEBUG_LIVENESS) {
895 zend_dump_dfg(op_array, &ssa->cfg, &dfg);
896 }
897
898 def = dfg.def;
899 in = dfg.in;
900
901 /* Reuse the "use" set, as we no longer need it */
902 phi = dfg.use;
903 zend_bitset_clear(phi, set_size * blocks_count);
904
905 /* Place e-SSA pis. This will add additional "def" points, so it must
906 * happen before def propagation. */
907 place_essa_pis(arena, script, op_array, build_flags, ssa, &dfg);
908
909 /* SSA construction, Step 1: Propagate "def" sets in merge points */
910 do {
911 changed = 0;
912 for (j = 0; j < blocks_count; j++) {
913 zend_bitset def_j = def + j * set_size, phi_j = phi + j * set_size;
914 if ((blocks[j].flags & ZEND_BB_REACHABLE) == 0) {
915 continue;
916 }
917 if (blocks[j].predecessors_count > 1) {
918 if (blocks[j].flags & ZEND_BB_IRREDUCIBLE_LOOP) {
919 /* Prevent any values from flowing into irreducible loops by
920 replacing all incoming values with explicit phis. The
921 register allocator depends on this property. */
922 zend_bitset_union(phi_j, in + (j * set_size), set_size);
923 } else {
924 for (k = 0; k < blocks[j].predecessors_count; k++) {
925 i = ssa->cfg.predecessors[blocks[j].predecessor_offset + k];
926 while (i != -1 && i != blocks[j].idom) {
927 zend_bitset_union_with_intersection(
928 phi_j, phi_j, def + (i * set_size), in + (j * set_size), set_size);
929 i = blocks[i].idom;
930 }
931 }
932 }
933 if (!zend_bitset_subset(phi_j, def_j, set_size)) {
934 zend_bitset_union(def_j, phi_j, set_size);
935 changed = 1;
936 }
937 }
938 }
939 } while (changed);
940
941 /* SSA construction, Step 2: Phi placement based on Dominance Frontiers */
942 var = do_alloca(sizeof(int) * (op_array->last_var + op_array->T), var_use_heap);
943 if (!var) {
944 free_alloca(dfg.tmp, dfg_use_heap);
945 return FAILURE;
946 }
947
948 for (j = 0; j < blocks_count; j++) {
949 if ((blocks[j].flags & ZEND_BB_REACHABLE) == 0) {
950 continue;
951 }
952 if (!zend_bitset_empty(phi + j * set_size, set_size)) {
953 ZEND_BITSET_REVERSE_FOREACH(phi + j * set_size, set_size, i) {
954 zend_ssa_phi *phi = zend_arena_calloc(arena, 1,
955 ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)) +
956 ZEND_MM_ALIGNED_SIZE(sizeof(int) * blocks[j].predecessors_count) +
957 sizeof(void*) * blocks[j].predecessors_count);
958
959 phi->sources = (int*)(((char*)phi) + ZEND_MM_ALIGNED_SIZE(sizeof(zend_ssa_phi)));
960 memset(phi->sources, 0xff, sizeof(int) * blocks[j].predecessors_count);
961 phi->use_chains = (zend_ssa_phi**)(((char*)phi->sources) + ZEND_MM_ALIGNED_SIZE(sizeof(int) * ssa->cfg.blocks[j].predecessors_count));
962
963 phi->pi = -1;
964 phi->var = i;
965 phi->ssa_var = -1;
966
967 /* Place phis after pis */
968 {
969 zend_ssa_phi **pp = &ssa_blocks[j].phis;
970 while (*pp) {
971 if ((*pp)->pi < 0) {
972 break;
973 }
974 pp = &(*pp)->next;
975 }
976 phi->next = *pp;
977 *pp = phi;
978 }
979 } ZEND_BITSET_FOREACH_END();
980 }
981 }
982
983 if (build_flags & ZEND_SSA_DEBUG_PHI_PLACEMENT) {
984 zend_dump_phi_placement(op_array, ssa);
985 }
986
987 /* SSA construction, Step 3: Renaming */
988 ssa->ops = zend_arena_calloc(arena, op_array->last, sizeof(zend_ssa_op));
989 memset(ssa->ops, 0xff, op_array->last * sizeof(zend_ssa_op));
990 memset(var + op_array->last_var, 0xff, op_array->T * sizeof(int));
991 /* Create uninitialized SSA variables for each CV */
992 for (j = 0; j < op_array->last_var; j++) {
993 var[j] = j;
994 }
995 ssa->vars_count = op_array->last_var;
996 if (zend_ssa_rename(op_array, build_flags, ssa, var, 0) != SUCCESS) {
997 free_alloca(var, var_use_heap);
998 free_alloca(dfg.tmp, dfg_use_heap);
999 return FAILURE;
1000 }
1001
1002 free_alloca(var, var_use_heap);
1003 free_alloca(dfg.tmp, dfg_use_heap);
1004
1005 return SUCCESS;
1006 }
1007 /* }}} */
1008
zend_ssa_compute_use_def_chains(zend_arena ** arena,const zend_op_array * op_array,zend_ssa * ssa)1009 int zend_ssa_compute_use_def_chains(zend_arena **arena, const zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
1010 {
1011 zend_ssa_var *ssa_vars;
1012 int i;
1013
1014 if (!ssa->vars) {
1015 ssa->vars = zend_arena_calloc(arena, ssa->vars_count, sizeof(zend_ssa_var));
1016 }
1017 ssa_vars = ssa->vars;
1018
1019 for (i = 0; i < op_array->last_var; i++) {
1020 ssa_vars[i].var = i;
1021 ssa_vars[i].scc = -1;
1022 ssa_vars[i].definition = -1;
1023 ssa_vars[i].use_chain = -1;
1024 }
1025 for (i = op_array->last_var; i < ssa->vars_count; i++) {
1026 ssa_vars[i].var = -1;
1027 ssa_vars[i].scc = -1;
1028 ssa_vars[i].definition = -1;
1029 ssa_vars[i].use_chain = -1;
1030 }
1031
1032 for (i = op_array->last - 1; i >= 0; i--) {
1033 zend_ssa_op *op = ssa->ops + i;
1034
1035 if (op->op1_use >= 0) {
1036 op->op1_use_chain = ssa_vars[op->op1_use].use_chain;
1037 ssa_vars[op->op1_use].use_chain = i;
1038 }
1039 if (op->op2_use >= 0 && op->op2_use != op->op1_use) {
1040 op->op2_use_chain = ssa_vars[op->op2_use].use_chain;
1041 ssa_vars[op->op2_use].use_chain = i;
1042 }
1043 if (op->result_use >= 0 && op->result_use != op->op1_use && op->result_use != op->op2_use) {
1044 op->res_use_chain = ssa_vars[op->result_use].use_chain;
1045 ssa_vars[op->result_use].use_chain = i;
1046 }
1047 if (op->op1_def >= 0) {
1048 ssa_vars[op->op1_def].var = EX_VAR_TO_NUM(op_array->opcodes[i].op1.var);
1049 ssa_vars[op->op1_def].definition = i;
1050 }
1051 if (op->op2_def >= 0) {
1052 ssa_vars[op->op2_def].var = EX_VAR_TO_NUM(op_array->opcodes[i].op2.var);
1053 ssa_vars[op->op2_def].definition = i;
1054 }
1055 if (op->result_def >= 0) {
1056 ssa_vars[op->result_def].var = EX_VAR_TO_NUM(op_array->opcodes[i].result.var);
1057 ssa_vars[op->result_def].definition = i;
1058 }
1059 }
1060
1061 for (i = 0; i < ssa->cfg.blocks_count; i++) {
1062 zend_ssa_phi *phi = ssa->blocks[i].phis;
1063 while (phi) {
1064 phi->block = i;
1065 ssa_vars[phi->ssa_var].var = phi->var;
1066 ssa_vars[phi->ssa_var].definition_phi = phi;
1067 if (phi->pi >= 0) {
1068 zend_ssa_phi *p;
1069
1070 ZEND_ASSERT(phi->sources[0] >= 0);
1071 p = ssa_vars[phi->sources[0]].phi_use_chain;
1072 while (p && p != phi) {
1073 p = zend_ssa_next_use_phi(ssa, phi->sources[0], p);
1074 }
1075 if (!p) {
1076 phi->use_chains[0] = ssa_vars[phi->sources[0]].phi_use_chain;
1077 ssa_vars[phi->sources[0]].phi_use_chain = phi;
1078 }
1079 if (phi->has_range_constraint) {
1080 /* min and max variables can't be used together */
1081 zend_ssa_range_constraint *constraint = &phi->constraint.range;
1082 if (constraint->min_ssa_var >= 0) {
1083 phi->sym_use_chain = ssa_vars[constraint->min_ssa_var].sym_use_chain;
1084 ssa_vars[constraint->min_ssa_var].sym_use_chain = phi;
1085 } else if (constraint->max_ssa_var >= 0) {
1086 phi->sym_use_chain = ssa_vars[constraint->max_ssa_var].sym_use_chain;
1087 ssa_vars[constraint->max_ssa_var].sym_use_chain = phi;
1088 }
1089 }
1090 } else {
1091 int j;
1092
1093 for (j = 0; j < ssa->cfg.blocks[i].predecessors_count; j++) {
1094 zend_ssa_phi *p;
1095
1096 ZEND_ASSERT(phi->sources[j] >= 0);
1097 p = ssa_vars[phi->sources[j]].phi_use_chain;
1098 while (p && p != phi) {
1099 p = zend_ssa_next_use_phi(ssa, phi->sources[j], p);
1100 }
1101 if (!p) {
1102 phi->use_chains[j] = ssa_vars[phi->sources[j]].phi_use_chain;
1103 ssa_vars[phi->sources[j]].phi_use_chain = phi;
1104 }
1105 }
1106 }
1107 phi = phi->next;
1108 }
1109 }
1110
1111 /* Mark indirectly accessed variables */
1112 for (i = 0; i < op_array->last_var; i++) {
1113 if (ssa->cfg.dynamic) {
1114 ssa_vars[i].alias = SYMTABLE_ALIAS;
1115 } else if (zend_string_equals_literal(op_array->vars[i], "php_errormsg")) {
1116 ssa_vars[i].alias = PHP_ERRORMSG_ALIAS;
1117 } else if (zend_string_equals_literal(op_array->vars[i], "http_response_header")) {
1118 ssa_vars[i].alias = HTTP_RESPONSE_HEADER_ALIAS;
1119 }
1120 }
1121 for (i = op_array->last_var; i < ssa->vars_count; i++) {
1122 if (ssa_vars[i].var < op_array->last_var) {
1123 ssa_vars[i].alias = ssa_vars[ssa_vars[i].var].alias;
1124 }
1125 }
1126
1127 return SUCCESS;
1128 }
1129 /* }}} */
1130
zend_ssa_unlink_use_chain(zend_ssa * ssa,int op,int var)1131 int zend_ssa_unlink_use_chain(zend_ssa *ssa, int op, int var) /* {{{ */
1132 {
1133 if (ssa->vars[var].use_chain == op) {
1134 ssa->vars[var].use_chain = zend_ssa_next_use(ssa->ops, var, op);
1135 return 1;
1136 } else {
1137 int use = ssa->vars[var].use_chain;
1138
1139 while (use >= 0) {
1140 if (ssa->ops[use].result_use == var) {
1141 if (ssa->ops[use].res_use_chain == op) {
1142 ssa->ops[use].res_use_chain = zend_ssa_next_use(ssa->ops, var, op);
1143 return 1;
1144 } else {
1145 use = ssa->ops[use].res_use_chain;
1146 }
1147 } else if (ssa->ops[use].op1_use == var) {
1148 if (ssa->ops[use].op1_use_chain == op) {
1149 ssa->ops[use].op1_use_chain = zend_ssa_next_use(ssa->ops, var, op);
1150 return 1;
1151 } else {
1152 use = ssa->ops[use].op1_use_chain;
1153 }
1154 } else if (ssa->ops[use].op2_use == var) {
1155 if (ssa->ops[use].op2_use_chain == op) {
1156 ssa->ops[use].op2_use_chain = zend_ssa_next_use(ssa->ops, var, op);
1157 return 1;
1158 } else {
1159 use = ssa->ops[use].op2_use_chain;
1160 }
1161 } else {
1162 break;
1163 }
1164 }
1165 /* something wrong */
1166 ZEND_ASSERT(0);
1167 return 0;
1168 }
1169 }
1170 /* }}} */
1171
zend_ssa_remove_instr(zend_ssa * ssa,zend_op * opline,zend_ssa_op * ssa_op)1172 void zend_ssa_remove_instr(zend_ssa *ssa, zend_op *opline, zend_ssa_op *ssa_op) /* {{{ */
1173 {
1174 if (ssa_op->result_use >= 0) {
1175 zend_ssa_unlink_use_chain(ssa, ssa_op - ssa->ops, ssa_op->result_use);
1176 ssa_op->result_use = -1;
1177 ssa_op->res_use_chain = -1;
1178 }
1179 if (ssa_op->op1_use >= 0) {
1180 if (ssa_op->op1_use != ssa_op->op2_use) {
1181 zend_ssa_unlink_use_chain(ssa, ssa_op - ssa->ops, ssa_op->op1_use);
1182 } else {
1183 ssa_op->op2_use_chain = ssa_op->op1_use_chain;
1184 }
1185 ssa_op->op1_use = -1;
1186 ssa_op->op1_use_chain = -1;
1187 }
1188 if (ssa_op->op2_use >= 0) {
1189 zend_ssa_unlink_use_chain(ssa, ssa_op - ssa->ops, ssa_op->op2_use);
1190 ssa_op->op2_use = -1;
1191 ssa_op->op2_use_chain = -1;
1192 }
1193
1194 /* We let the caller make sure that all defs are gone */
1195 ZEND_ASSERT(ssa_op->result_def == -1);
1196 ZEND_ASSERT(ssa_op->op1_def == -1);
1197 ZEND_ASSERT(ssa_op->op2_def == -1);
1198
1199 MAKE_NOP(opline);
1200 }
1201 /* }}} */
1202
zend_ssa_next_use_phi_ptr(zend_ssa * ssa,int var,zend_ssa_phi * p)1203 static inline zend_ssa_phi **zend_ssa_next_use_phi_ptr(zend_ssa *ssa, int var, zend_ssa_phi *p) /* {{{ */
1204 {
1205 if (p->pi >= 0) {
1206 return &p->use_chains[0];
1207 } else {
1208 int j;
1209 for (j = 0; j < ssa->cfg.blocks[p->block].predecessors_count; j++) {
1210 if (p->sources[j] == var) {
1211 return &p->use_chains[j];
1212 }
1213 }
1214 }
1215 ZEND_ASSERT(0);
1216 return NULL;
1217 }
1218 /* }}} */
1219
1220 /* May be called even if source is not used in the phi (useful when removing uses in a phi
1221 * with multiple identical operands) */
zend_ssa_remove_use_of_phi_source(zend_ssa * ssa,zend_ssa_phi * phi,int source,zend_ssa_phi * next_use_phi)1222 static inline void zend_ssa_remove_use_of_phi_source(zend_ssa *ssa, zend_ssa_phi *phi, int source, zend_ssa_phi *next_use_phi) /* {{{ */
1223 {
1224 zend_ssa_phi **cur = &ssa->vars[source].phi_use_chain;
1225 while (*cur && *cur != phi) {
1226 cur = zend_ssa_next_use_phi_ptr(ssa, source, *cur);
1227 }
1228 if (*cur) {
1229 *cur = next_use_phi;
1230 }
1231 }
1232 /* }}} */
1233
zend_ssa_remove_uses_of_phi_sources(zend_ssa * ssa,zend_ssa_phi * phi)1234 static void zend_ssa_remove_uses_of_phi_sources(zend_ssa *ssa, zend_ssa_phi *phi) /* {{{ */
1235 {
1236 int source;
1237 FOREACH_PHI_SOURCE(phi, source) {
1238 zend_ssa_remove_use_of_phi_source(ssa, phi, source, zend_ssa_next_use_phi(ssa, source, phi));
1239 } FOREACH_PHI_SOURCE_END();
1240 }
1241 /* }}} */
1242
zend_ssa_remove_phi_from_block(zend_ssa * ssa,zend_ssa_phi * phi)1243 static void zend_ssa_remove_phi_from_block(zend_ssa *ssa, zend_ssa_phi *phi) /* {{{ */
1244 {
1245 zend_ssa_block *block = &ssa->blocks[phi->block];
1246 zend_ssa_phi **cur = &block->phis;
1247 while (*cur != phi) {
1248 ZEND_ASSERT(*cur != NULL);
1249 cur = &(*cur)->next;
1250 }
1251 *cur = (*cur)->next;
1252 }
1253 /* }}} */
1254
zend_ssa_remove_defs_of_instr(zend_ssa * ssa,zend_ssa_op * ssa_op)1255 static inline void zend_ssa_remove_defs_of_instr(zend_ssa *ssa, zend_ssa_op *ssa_op) /* {{{ */
1256 {
1257 if (ssa_op->op1_def >= 0) {
1258 zend_ssa_remove_uses_of_var(ssa, ssa_op->op1_def);
1259 zend_ssa_remove_op1_def(ssa, ssa_op);
1260 }
1261 if (ssa_op->op2_def >= 0) {
1262 zend_ssa_remove_uses_of_var(ssa, ssa_op->op2_def);
1263 zend_ssa_remove_op2_def(ssa, ssa_op);
1264 }
1265 if (ssa_op->result_def >= 0) {
1266 zend_ssa_remove_uses_of_var(ssa, ssa_op->result_def);
1267 zend_ssa_remove_result_def(ssa, ssa_op);
1268 }
1269 }
1270 /* }}} */
1271
zend_ssa_remove_phi_source(zend_ssa * ssa,zend_ssa_phi * phi,int pred_offset,int predecessors_count)1272 static inline void zend_ssa_remove_phi_source(zend_ssa *ssa, zend_ssa_phi *phi, int pred_offset, int predecessors_count) /* {{{ */
1273 {
1274 int j, var_num = phi->sources[pred_offset];
1275 zend_ssa_phi *next_phi = phi->use_chains[pred_offset];
1276
1277 predecessors_count--;
1278 if (pred_offset < predecessors_count) {
1279 memmove(phi->sources + pred_offset, phi->sources + pred_offset + 1, (predecessors_count - pred_offset) * sizeof(uint32_t));
1280 memmove(phi->use_chains + pred_offset, phi->use_chains + pred_offset + 1, (predecessors_count - pred_offset) * sizeof(zend_ssa_phi*));
1281 }
1282
1283 /* Check if they same var is used in a different phi operand as well, in this case we don't
1284 * need to adjust the use chain (but may have to move the next pointer). */
1285 for (j = 0; j < predecessors_count; j++) {
1286 if (phi->sources[j] == var_num) {
1287 if (j < pred_offset) {
1288 if (next_phi == NULL) {
1289 next_phi = phi->use_chains[pred_offset];
1290 } else {
1291 ZEND_ASSERT(phi->use_chains[pred_offset] == NULL);
1292 }
1293 } else if (j >= pred_offset) {
1294 phi->use_chains[j] = next_phi;
1295 }
1296 return;
1297 }
1298 }
1299
1300 /* Variable only used in one operand, remove the phi from the use chain. */
1301 zend_ssa_remove_use_of_phi_source(ssa, phi, var_num, next_phi);
1302 }
1303 /* }}} */
1304
zend_ssa_remove_phi(zend_ssa * ssa,zend_ssa_phi * phi)1305 void zend_ssa_remove_phi(zend_ssa *ssa, zend_ssa_phi *phi) /* {{{ */
1306 {
1307 ZEND_ASSERT(phi->ssa_var >= 0);
1308 ZEND_ASSERT(ssa->vars[phi->ssa_var].use_chain < 0
1309 && ssa->vars[phi->ssa_var].phi_use_chain == NULL);
1310 zend_ssa_remove_uses_of_phi_sources(ssa, phi);
1311 zend_ssa_remove_phi_from_block(ssa, phi);
1312 ssa->vars[phi->ssa_var].definition_phi = NULL;
1313 phi->ssa_var = -1;
1314 }
1315 /* }}} */
1316
zend_ssa_remove_uses_of_var(zend_ssa * ssa,int var_num)1317 void zend_ssa_remove_uses_of_var(zend_ssa *ssa, int var_num) /* {{{ */
1318 {
1319 zend_ssa_var *var = &ssa->vars[var_num];
1320 zend_ssa_phi *phi;
1321 int use;
1322 FOREACH_PHI_USE(var, phi) {
1323 int i, end = NUM_PHI_SOURCES(phi);
1324 for (i = 0; i < end; i++) {
1325 if (phi->sources[i] == var_num) {
1326 phi->use_chains[i] = NULL;
1327 }
1328 }
1329 } FOREACH_PHI_USE_END();
1330 var->phi_use_chain = NULL;
1331 FOREACH_USE(var, use) {
1332 zend_ssa_op *ssa_op = &ssa->ops[use];
1333 if (ssa_op->op1_use == var_num) {
1334 ssa_op->op1_use = -1;
1335 ssa_op->op1_use_chain = -1;
1336 }
1337 if (ssa_op->op2_use == var_num) {
1338 ssa_op->op2_use = -1;
1339 ssa_op->op2_use_chain = -1;
1340 }
1341 if (ssa_op->result_use == var_num) {
1342 ssa_op->result_use = -1;
1343 ssa_op->res_use_chain = -1;
1344 }
1345 } FOREACH_USE_END();
1346 var->use_chain = -1;
1347 }
1348 /* }}} */
1349
zend_ssa_remove_predecessor(zend_ssa * ssa,int from,int to)1350 void zend_ssa_remove_predecessor(zend_ssa *ssa, int from, int to) /* {{{ */
1351 {
1352 zend_basic_block *next_block = &ssa->cfg.blocks[to];
1353 zend_ssa_block *next_ssa_block = &ssa->blocks[to];
1354 zend_ssa_phi *phi;
1355 int j;
1356
1357 /* Find at which predecessor offset this block is referenced */
1358 int pred_offset = -1;
1359 int *predecessors = &ssa->cfg.predecessors[next_block->predecessor_offset];
1360
1361 for (j = 0; j < next_block->predecessors_count; j++) {
1362 if (predecessors[j] == from) {
1363 pred_offset = j;
1364 break;
1365 }
1366 }
1367
1368 /* If there are duplicate successors, the predecessors may have been removed in
1369 * a previous iteration already. */
1370 if (pred_offset == -1) {
1371 return;
1372 }
1373
1374 /* For phis in successor blocks, remove the operands associated with this block */
1375 for (phi = next_ssa_block->phis; phi; phi = phi->next) {
1376 if (phi->pi >= 0) {
1377 if (phi->pi == from) {
1378 zend_ssa_remove_uses_of_var(ssa, phi->ssa_var);
1379 zend_ssa_remove_phi(ssa, phi);
1380 }
1381 } else {
1382 ZEND_ASSERT(phi->sources[pred_offset] >= 0);
1383 zend_ssa_remove_phi_source(ssa, phi, pred_offset, next_block->predecessors_count);
1384 }
1385 }
1386
1387 /* Remove this predecessor */
1388 next_block->predecessors_count--;
1389 if (pred_offset < next_block->predecessors_count) {
1390 predecessors = &ssa->cfg.predecessors[next_block->predecessor_offset + pred_offset];
1391 memmove(predecessors, predecessors + 1, (next_block->predecessors_count - pred_offset) * sizeof(uint32_t));
1392 }
1393 }
1394 /* }}} */
1395
zend_ssa_remove_block(zend_op_array * op_array,zend_ssa * ssa,int i)1396 void zend_ssa_remove_block(zend_op_array *op_array, zend_ssa *ssa, int i) /* {{{ */
1397 {
1398 zend_basic_block *block = &ssa->cfg.blocks[i];
1399 zend_ssa_block *ssa_block = &ssa->blocks[i];
1400 int *predecessors;
1401 zend_ssa_phi *phi;
1402 int j, s;
1403
1404 block->flags &= ~ZEND_BB_REACHABLE;
1405
1406 /* Removes phis in this block */
1407 for (phi = ssa_block->phis; phi; phi = phi->next) {
1408 zend_ssa_remove_uses_of_var(ssa, phi->ssa_var);
1409 zend_ssa_remove_phi(ssa, phi);
1410 }
1411
1412 /* Remove instructions in this block */
1413 for (j = block->start; j < block->start + block->len; j++) {
1414 if (op_array->opcodes[j].opcode == ZEND_NOP) {
1415 continue;
1416 }
1417
1418 if (op_array->opcodes[j].result_type & (IS_TMP_VAR|IS_VAR)) {
1419 zend_optimizer_remove_live_range_ex(op_array, op_array->opcodes[j].result.var, j);
1420 }
1421 zend_ssa_remove_defs_of_instr(ssa, &ssa->ops[j]);
1422 zend_ssa_remove_instr(ssa, &op_array->opcodes[j], &ssa->ops[j]);
1423 }
1424
1425 for (s = 0; s < block->successors_count; s++) {
1426 zend_ssa_remove_predecessor(ssa, i, block->successors[s]);
1427 }
1428
1429 /* Remove successors of predecessors */
1430 predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
1431 for (j = 0; j < block->predecessors_count; j++) {
1432 if (predecessors[j] >= 0) {
1433 zend_basic_block *prev_block = &ssa->cfg.blocks[predecessors[j]];
1434
1435 for (s = 0; s < prev_block->successors_count; s++) {
1436 if (prev_block->successors[s] == i) {
1437 memmove(prev_block->successors + s,
1438 prev_block->successors + s + 1,
1439 sizeof(int) * (prev_block->successors_count - s - 1));
1440 prev_block->successors_count--;
1441 s--;
1442 }
1443 }
1444 }
1445 }
1446
1447 block->successors_count = 0;
1448 block->predecessors_count = 0;
1449
1450 /* Remove from dominators tree */
1451 if (block->idom >= 0) {
1452 j = ssa->cfg.blocks[block->idom].children;
1453 if (j == i) {
1454 ssa->cfg.blocks[block->idom].children = block->next_child;
1455 } else if (j >= 0) {
1456 while (ssa->cfg.blocks[j].next_child >= 0) {
1457 if (ssa->cfg.blocks[j].next_child == i) {
1458 ssa->cfg.blocks[j].next_child = block->next_child;
1459 break;
1460 }
1461 j = ssa->cfg.blocks[j].next_child;
1462 }
1463 }
1464 }
1465 block->idom = -1;
1466 block->level = -1;
1467 block->children = -1;
1468 block->next_child = -1;
1469 }
1470 /* }}} */
1471
propagate_phi_type_widening(zend_ssa * ssa,int var)1472 static void propagate_phi_type_widening(zend_ssa *ssa, int var) /* {{{ */
1473 {
1474 zend_ssa_phi *phi;
1475 FOREACH_PHI_USE(&ssa->vars[var], phi) {
1476 if (ssa->var_info[var].type & ~ssa->var_info[phi->ssa_var].type) {
1477 ssa->var_info[phi->ssa_var].type |= ssa->var_info[var].type;
1478 propagate_phi_type_widening(ssa, phi->ssa_var);
1479 }
1480 } FOREACH_PHI_USE_END();
1481 }
1482 /* }}} */
1483
zend_ssa_rename_var_uses(zend_ssa * ssa,int old,int new,zend_bool update_types)1484 void zend_ssa_rename_var_uses(zend_ssa *ssa, int old, int new, zend_bool update_types) /* {{{ */
1485 {
1486 zend_ssa_var *old_var = &ssa->vars[old];
1487 zend_ssa_var *new_var = &ssa->vars[new];
1488 int use;
1489 zend_ssa_phi *phi;
1490
1491 ZEND_ASSERT(old >= 0 && new >= 0);
1492 ZEND_ASSERT(old != new);
1493
1494 /* Only a no_val is both variables are */
1495 new_var->no_val &= old_var->no_val;
1496
1497 /* Update ssa_op use chains */
1498 FOREACH_USE(old_var, use) {
1499 zend_ssa_op *ssa_op = &ssa->ops[use];
1500
1501 /* If the op already uses the new var, don't add the op to the use
1502 * list again. Instead move the use_chain to the correct operand. */
1503 zend_bool add_to_use_chain = 1;
1504 if (ssa_op->result_use == new) {
1505 add_to_use_chain = 0;
1506 } else if (ssa_op->op1_use == new) {
1507 if (ssa_op->result_use == old) {
1508 ssa_op->res_use_chain = ssa_op->op1_use_chain;
1509 ssa_op->op1_use_chain = -1;
1510 }
1511 add_to_use_chain = 0;
1512 } else if (ssa_op->op2_use == new) {
1513 if (ssa_op->result_use == old) {
1514 ssa_op->res_use_chain = ssa_op->op2_use_chain;
1515 ssa_op->op2_use_chain = -1;
1516 } else if (ssa_op->op1_use == old) {
1517 ssa_op->op1_use_chain = ssa_op->op2_use_chain;
1518 ssa_op->op2_use_chain = -1;
1519 }
1520 add_to_use_chain = 0;
1521 }
1522
1523 /* Perform the actual renaming */
1524 if (ssa_op->result_use == old) {
1525 ssa_op->result_use = new;
1526 }
1527 if (ssa_op->op1_use == old) {
1528 ssa_op->op1_use = new;
1529 }
1530 if (ssa_op->op2_use == old) {
1531 ssa_op->op2_use = new;
1532 }
1533
1534 /* Add op to use chain of new var (if it isn't already). We use the
1535 * first use chain of (result, op1, op2) that has the new variable. */
1536 if (add_to_use_chain) {
1537 if (ssa_op->result_use == new) {
1538 ssa_op->res_use_chain = new_var->use_chain;
1539 new_var->use_chain = use;
1540 } else if (ssa_op->op1_use == new) {
1541 ssa_op->op1_use_chain = new_var->use_chain;
1542 new_var->use_chain = use;
1543 } else {
1544 ZEND_ASSERT(ssa_op->op2_use == new);
1545 ssa_op->op2_use_chain = new_var->use_chain;
1546 new_var->use_chain = use;
1547 }
1548 }
1549 } FOREACH_USE_END();
1550 old_var->use_chain = -1;
1551
1552 /* Update phi use chains */
1553 FOREACH_PHI_USE(old_var, phi) {
1554 int j;
1555 zend_bool after_first_new_source = 0;
1556
1557 /* If the phi already uses the new var, find its use chain, as we may
1558 * need to move it to a different source operand. */
1559 zend_ssa_phi **existing_use_chain_ptr = NULL;
1560 for (j = 0; j < ssa->cfg.blocks[phi->block].predecessors_count; j++) {
1561 if (phi->sources[j] == new) {
1562 existing_use_chain_ptr = &phi->use_chains[j];
1563 break;
1564 }
1565 }
1566
1567 for (j = 0; j < ssa->cfg.blocks[phi->block].predecessors_count; j++) {
1568 if (phi->sources[j] == new) {
1569 after_first_new_source = 1;
1570 } else if (phi->sources[j] == old) {
1571 phi->sources[j] = new;
1572
1573 /* Either move existing use chain to this source, or add the phi
1574 * to the phi use chain of the new variables. Do this only once. */
1575 if (!after_first_new_source) {
1576 if (existing_use_chain_ptr) {
1577 phi->use_chains[j] = *existing_use_chain_ptr;
1578 *existing_use_chain_ptr = NULL;
1579 } else {
1580 phi->use_chains[j] = new_var->phi_use_chain;
1581 new_var->phi_use_chain = phi;
1582 }
1583 after_first_new_source = 1;
1584 }
1585 }
1586 }
1587
1588 /* Make sure phi result types are not incorrectly narrow after renaming.
1589 * This should not normally happen, but can occur if we DCE an assignment
1590 * or unset and there is an improper phi-indirected use lateron. */
1591 // TODO Alternatively we could rerun type-inference after DCE
1592 if (update_types && (ssa->var_info[new].type & ~ssa->var_info[phi->ssa_var].type)) {
1593 ssa->var_info[phi->ssa_var].type |= ssa->var_info[new].type;
1594 propagate_phi_type_widening(ssa, phi->ssa_var);
1595 }
1596 } FOREACH_PHI_USE_END();
1597 old_var->phi_use_chain = NULL;
1598 }
1599 /* }}} */
1600
1601 /*
1602 * Local variables:
1603 * tab-width: 4
1604 * c-basic-offset: 4
1605 * indent-tabs-mode: t
1606 * End:
1607 */
1608
