1 /*
2 +----------------------------------------------------------------------+
3 | Zend OPcache, Escape Analysis |
4 +----------------------------------------------------------------------+
5 | Copyright (c) The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | http://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@php.net> |
16 +----------------------------------------------------------------------+
17 */
18
19 #include "php.h"
20 #include "Optimizer/zend_optimizer.h"
21 #include "Optimizer/zend_optimizer_internal.h"
22 #include "zend_bitset.h"
23 #include "zend_cfg.h"
24 #include "zend_ssa.h"
25 #include "zend_inference.h"
26 #include "zend_dump.h"
27
28 /*
29 * T. Kotzmann and H. Mossenbock. Escape analysis in the context of dynamic
30 * compilation and deoptimization. In Proceedings of the International
31 * Conference on Virtual Execution Environments, pages 111-120, Chicago,
32 * June 2005
33 */
34
union_find_init(int * parent,int * size,int count)35 static zend_always_inline void union_find_init(int *parent, int *size, int count) /* {{{ */
36 {
37 int i;
38
39 for (i = 0; i < count; i++) {
40 parent[i] = i;
41 size[i] = 1;
42 }
43 }
44 /* }}} */
45
union_find_root(int * parent,int i)46 static zend_always_inline int union_find_root(int *parent, int i) /* {{{ */
47 {
48 int p = parent[i];
49
50 while (i != p) {
51 p = parent[p];
52 parent[i] = p;
53 i = p;
54 p = parent[i];
55 }
56 return i;
57 }
58 /* }}} */
59
union_find_unite(int * parent,int * size,int i,int j)60 static zend_always_inline void union_find_unite(int *parent, int *size, int i, int j) /* {{{ */
61 {
62 int r1 = union_find_root(parent, i);
63 int r2 = union_find_root(parent, j);
64
65 if (r1 != r2) {
66 if (size[r1] < size[r2]) {
67 parent[r1] = r2;
68 size[r2] += size[r1];
69 } else {
70 parent[r2] = r1;
71 size[r1] += size[r2];
72 }
73 }
74 }
75 /* }}} */
76
zend_build_equi_escape_sets(int * parent,zend_op_array * op_array,zend_ssa * ssa)77 static int zend_build_equi_escape_sets(int *parent, zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
78 {
79 zend_ssa_var *ssa_vars = ssa->vars;
80 int ssa_vars_count = ssa->vars_count;
81 zend_ssa_phi *p;
82 int i, j;
83 int *size;
84 ALLOCA_FLAG(use_heap)
85
86 size = do_alloca(sizeof(int) * ssa_vars_count, use_heap);
87 if (!size) {
88 return FAILURE;
89 }
90 union_find_init(parent, size, ssa_vars_count);
91
92 for (i = 0; i < ssa_vars_count; i++) {
93 if (ssa_vars[i].definition_phi) {
94 p = ssa_vars[i].definition_phi;
95 if (p->pi >= 0) {
96 union_find_unite(parent, size, i, p->sources[0]);
97 } else {
98 for (j = 0; j < ssa->cfg.blocks[p->block].predecessors_count; j++) {
99 union_find_unite(parent, size, i, p->sources[j]);
100 }
101 }
102 } else if (ssa_vars[i].definition >= 0) {
103 int def = ssa_vars[i].definition;
104 zend_ssa_op *op = ssa->ops + def;
105 zend_op *opline = op_array->opcodes + def;
106
107 if (op->op1_def >= 0) {
108 if (op->op1_use >= 0) {
109 if (opline->opcode != ZEND_ASSIGN) {
110 union_find_unite(parent, size, op->op1_def, op->op1_use);
111 }
112 }
113 if (opline->opcode == ZEND_ASSIGN && op->op2_use >= 0) {
114 union_find_unite(parent, size, op->op1_def, op->op2_use);
115 }
116 }
117 if (op->op2_def >= 0) {
118 if (op->op2_use >= 0) {
119 union_find_unite(parent, size, op->op2_def, op->op2_use);
120 }
121 }
122 if (op->result_def >= 0) {
123 if (op->result_use >= 0) {
124 if (opline->opcode != ZEND_QM_ASSIGN) {
125 union_find_unite(parent, size, op->result_def, op->result_use);
126 }
127 }
128 if (opline->opcode == ZEND_QM_ASSIGN && op->op1_use >= 0) {
129 union_find_unite(parent, size, op->result_def, op->op1_use);
130 }
131 if (opline->opcode == ZEND_ASSIGN && op->op2_use >= 0) {
132 union_find_unite(parent, size, op->result_def, op->op2_use);
133 }
134 if (opline->opcode == ZEND_ASSIGN && op->op1_def >= 0) {
135 union_find_unite(parent, size, op->result_def, op->op1_def);
136 }
137 }
138 }
139 }
140
141 for (i = 0; i < ssa_vars_count; i++) {
142 parent[i] = union_find_root(parent, i);
143 }
144
145 free_alloca(size, use_heap);
146
147 return SUCCESS;
148 }
149 /* }}} */
150
get_class_entry(const zend_script * script,zend_string * lcname)151 static inline zend_class_entry *get_class_entry(const zend_script *script, zend_string *lcname) /* {{{ */
152 {
153 zend_class_entry *ce = script ? zend_hash_find_ptr(&script->class_table, lcname) : NULL;
154 if (ce) {
155 return ce;
156 }
157
158 ce = zend_hash_find_ptr(CG(class_table), lcname);
159 if (ce && ce->type == ZEND_INTERNAL_CLASS) {
160 return ce;
161 }
162
163 return NULL;
164 }
165 /* }}} */
166
is_allocation_def(zend_op_array * op_array,zend_ssa * ssa,int def,int var,const zend_script * script)167 static int is_allocation_def(zend_op_array *op_array, zend_ssa *ssa, int def, int var, const zend_script *script) /* {{{ */
168 {
169 zend_ssa_op *op = ssa->ops + def;
170 zend_op *opline = op_array->opcodes + def;
171
172 if (op->result_def == var) {
173 switch (opline->opcode) {
174 case ZEND_INIT_ARRAY:
175 return 1;
176 case ZEND_NEW:
177 /* objects with destructors should escape */
178 if (opline->op1_type == IS_CONST) {
179 zend_class_entry *ce = get_class_entry(script, Z_STR_P(CRT_CONSTANT_EX(op_array, opline, opline->op1, ssa->rt_constants)+1));
180 uint32_t forbidden_flags = ZEND_ACC_INHERITED
181 /* These flags will always cause an exception */
182 | ZEND_ACC_IMPLICIT_ABSTRACT_CLASS | ZEND_ACC_EXPLICIT_ABSTRACT_CLASS
183 | ZEND_ACC_INTERFACE | ZEND_ACC_TRAIT;
184 if (ce && !ce->create_object && !ce->constructor &&
185 !ce->destructor && !ce->__get && !ce->__set &&
186 !(ce->ce_flags & forbidden_flags) &&
187 (ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
188 return 1;
189 }
190 }
191 break;
192 case ZEND_QM_ASSIGN:
193 if (opline->op1_type == IS_CONST
194 && Z_TYPE_P(CRT_CONSTANT_EX(op_array, opline, opline->op1, ssa->rt_constants)) == IS_ARRAY) {
195 return 1;
196 }
197 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_ARRAY)) {
198 return 1;
199 }
200 break;
201 case ZEND_ASSIGN:
202 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_ARRAY)) {
203 return 1;
204 }
205 break;
206 }
207 } else if (op->op1_def == var) {
208 switch (opline->opcode) {
209 case ZEND_ASSIGN:
210 if (opline->op2_type == IS_CONST
211 && Z_TYPE_P(CRT_CONSTANT_EX(op_array, opline, opline->op2, ssa->rt_constants)) == IS_ARRAY) {
212 return 1;
213 }
214 if (opline->op2_type == IS_CV && (OP2_INFO() & MAY_BE_ARRAY)) {
215 return 1;
216 }
217 break;
218 case ZEND_ASSIGN_DIM:
219 case ZEND_ASSIGN_OBJ:
220 case ZEND_ASSIGN_OBJ_REF:
221 if (OP1_INFO() & (MAY_BE_UNDEF | MAY_BE_NULL | MAY_BE_FALSE)) {
222 /* implicit object/array allocation */
223 return 1;
224 }
225 break;
226 }
227 }
228
229 return 0;
230 }
231 /* }}} */
232
is_local_def(zend_op_array * op_array,zend_ssa * ssa,int def,int var,const zend_script * script)233 static int is_local_def(zend_op_array *op_array, zend_ssa *ssa, int def, int var, const zend_script *script) /* {{{ */
234 {
235 zend_ssa_op *op = ssa->ops + def;
236 zend_op *opline = op_array->opcodes + def;
237
238 if (op->result_def == var) {
239 switch (opline->opcode) {
240 case ZEND_INIT_ARRAY:
241 case ZEND_ADD_ARRAY_ELEMENT:
242 case ZEND_QM_ASSIGN:
243 case ZEND_ASSIGN:
244 return 1;
245 case ZEND_NEW:
246 /* objects with destructors should escape */
247 if (opline->op1_type == IS_CONST) {
248 zend_class_entry *ce = get_class_entry(script, Z_STR_P(CRT_CONSTANT_EX(op_array, opline, opline->op1, ssa->rt_constants)+1));
249 if (ce && !ce->create_object && !ce->constructor &&
250 !ce->destructor && !ce->__get && !ce->__set &&
251 !(ce->ce_flags & ZEND_ACC_INHERITED)) {
252 return 1;
253 }
254 }
255 break;
256 }
257 } else if (op->op1_def == var) {
258 switch (opline->opcode) {
259 case ZEND_ASSIGN:
260 case ZEND_ASSIGN_DIM:
261 case ZEND_ASSIGN_OBJ:
262 case ZEND_ASSIGN_OBJ_REF:
263 case ZEND_ASSIGN_DIM_OP:
264 case ZEND_ASSIGN_OBJ_OP:
265 case ZEND_PRE_INC_OBJ:
266 case ZEND_PRE_DEC_OBJ:
267 case ZEND_POST_INC_OBJ:
268 case ZEND_POST_DEC_OBJ:
269 return 1;
270 }
271 }
272
273 return 0;
274 }
275 /* }}} */
276
is_escape_use(zend_op_array * op_array,zend_ssa * ssa,int use,int var)277 static int is_escape_use(zend_op_array *op_array, zend_ssa *ssa, int use, int var) /* {{{ */
278 {
279 zend_ssa_op *op = ssa->ops + use;
280 zend_op *opline = op_array->opcodes + use;
281
282 if (op->op1_use == var) {
283 switch (opline->opcode) {
284 case ZEND_ASSIGN:
285 /* no_val */
286 break;
287 case ZEND_QM_ASSIGN:
288 if (opline->op1_type == IS_CV) {
289 if (OP1_INFO() & MAY_BE_OBJECT) {
290 /* object aliasing */
291 return 1;
292 }
293 }
294 break;
295 case ZEND_ISSET_ISEMPTY_DIM_OBJ:
296 case ZEND_ISSET_ISEMPTY_PROP_OBJ:
297 case ZEND_FETCH_DIM_R:
298 case ZEND_FETCH_OBJ_R:
299 case ZEND_FETCH_DIM_IS:
300 case ZEND_FETCH_OBJ_IS:
301 break;
302 case ZEND_ASSIGN_OP:
303 return 1;
304 case ZEND_ASSIGN_DIM_OP:
305 case ZEND_ASSIGN_OBJ_OP:
306 case ZEND_ASSIGN_STATIC_PROP_OP:
307 case ZEND_ASSIGN_DIM:
308 case ZEND_ASSIGN_OBJ:
309 case ZEND_ASSIGN_OBJ_REF:
310 break;
311 case ZEND_PRE_INC_OBJ:
312 case ZEND_PRE_DEC_OBJ:
313 case ZEND_POST_INC_OBJ:
314 case ZEND_POST_DEC_OBJ:
315 break;
316 case ZEND_INIT_ARRAY:
317 case ZEND_ADD_ARRAY_ELEMENT:
318 if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) {
319 return 1;
320 }
321 if (OP1_INFO() & MAY_BE_OBJECT) {
322 /* object aliasing */
323 return 1;
324 }
325 /* reference dependencies processed separately */
326 break;
327 case ZEND_OP_DATA:
328 if ((opline-1)->opcode != ZEND_ASSIGN_DIM
329 && (opline-1)->opcode != ZEND_ASSIGN_OBJ) {
330 return 1;
331 }
332 if (OP1_INFO() & MAY_BE_OBJECT) {
333 /* object aliasing */
334 return 1;
335 }
336 opline--;
337 op--;
338 if (opline->op1_type != IS_CV
339 || (OP1_INFO() & MAY_BE_REF)
340 || (op->op1_def >= 0 && ssa->vars[op->op1_def].alias)) {
341 /* asignment into escaping structure */
342 return 1;
343 }
344 /* reference dependencies processed separately */
345 break;
346 default:
347 return 1;
348 }
349 }
350
351 if (op->op2_use == var) {
352 switch (opline->opcode) {
353 case ZEND_ASSIGN:
354 if (opline->op1_type != IS_CV
355 || (OP1_INFO() & MAY_BE_REF)
356 || (op->op1_def >= 0 && ssa->vars[op->op1_def].alias)) {
357 /* asignment into escaping variable */
358 return 1;
359 }
360 if (opline->op2_type == IS_CV || opline->result_type != IS_UNUSED) {
361 if (OP2_INFO() & MAY_BE_OBJECT) {
362 /* object aliasing */
363 return 1;
364 }
365 }
366 break;
367 default:
368 return 1;
369 }
370 }
371
372 if (op->result_use == var) {
373 switch (opline->opcode) {
374 case ZEND_ASSIGN:
375 case ZEND_QM_ASSIGN:
376 case ZEND_INIT_ARRAY:
377 case ZEND_ADD_ARRAY_ELEMENT:
378 break;
379 default:
380 return 1;
381 }
382 }
383
384 return 0;
385 }
386 /* }}} */
387
zend_ssa_escape_analysis(const zend_script * script,zend_op_array * op_array,zend_ssa * ssa)388 int zend_ssa_escape_analysis(const zend_script *script, zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
389 {
390 zend_ssa_var *ssa_vars = ssa->vars;
391 int ssa_vars_count = ssa->vars_count;
392 int i, root, use;
393 int *ees;
394 zend_bool has_allocations;
395 int num_non_escaped;
396 ALLOCA_FLAG(use_heap)
397
398 if (!ssa_vars) {
399 return SUCCESS;
400 }
401
402 has_allocations = 0;
403 for (i = op_array->last_var; i < ssa_vars_count; i++) {
404 if (ssa_vars[i].definition >= 0
405 && (ssa->var_info[i].type & (MAY_BE_ARRAY|MAY_BE_OBJECT))
406 && is_allocation_def(op_array, ssa, ssa_vars[i].definition, i, script)) {
407 has_allocations = 1;
408 break;
409 }
410 }
411 if (!has_allocations) {
412 return SUCCESS;
413 }
414
415
416 /* 1. Build EES (Equi-Escape Sets) */
417 ees = do_alloca(sizeof(int) * ssa_vars_count, use_heap);
418 if (!ees) {
419 return FAILURE;
420 }
421
422 if (zend_build_equi_escape_sets(ees, op_array, ssa) != SUCCESS) {
423 return FAILURE;
424 }
425
426 /* 2. Identify Allocations */
427 num_non_escaped = 0;
428 for (i = op_array->last_var; i < ssa_vars_count; i++) {
429 root = ees[i];
430 if (ssa_vars[root].escape_state > ESCAPE_STATE_NO_ESCAPE) {
431 /* already escape. skip */
432 } else if (ssa_vars[i].alias && (ssa->var_info[i].type & MAY_BE_REF)) {
433 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
434 num_non_escaped--;
435 }
436 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
437 } else if (ssa_vars[i].definition >= 0
438 && (ssa->var_info[i].type & (MAY_BE_ARRAY|MAY_BE_OBJECT))) {
439 if (!is_local_def(op_array, ssa, ssa_vars[i].definition, i, script)) {
440 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
441 num_non_escaped--;
442 }
443 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
444 } else if (ssa_vars[root].escape_state == ESCAPE_STATE_UNKNOWN
445 && is_allocation_def(op_array, ssa, ssa_vars[i].definition, i, script)) {
446 ssa_vars[root].escape_state = ESCAPE_STATE_NO_ESCAPE;
447 num_non_escaped++;
448 }
449 }
450 }
451
452 /* 3. Mark escaped EES */
453 if (num_non_escaped) {
454 for (i = 0; i < ssa_vars_count; i++) {
455 if (ssa_vars[i].use_chain >= 0) {
456 root = ees[i];
457 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
458 FOREACH_USE(ssa_vars + i, use) {
459 if (is_escape_use(op_array, ssa, use, i)) {
460 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
461 num_non_escaped--;
462 if (num_non_escaped == 0) {
463 i = ssa_vars_count;
464 }
465 break;
466 }
467 } FOREACH_USE_END();
468 }
469 }
470 }
471 }
472
473 /* 4. Process referential dependencies */
474 if (num_non_escaped) {
475 zend_bool changed;
476
477 do {
478 changed = 0;
479 for (i = 0; i < ssa_vars_count; i++) {
480 if (ssa_vars[i].use_chain >= 0) {
481 root = ees[i];
482 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
483 FOREACH_USE(ssa_vars + i, use) {
484 zend_ssa_op *op = ssa->ops + use;
485 zend_op *opline = op_array->opcodes + use;
486 int enclosing_root;
487
488 if (opline->opcode == ZEND_OP_DATA &&
489 ((opline-1)->opcode == ZEND_ASSIGN_DIM ||
490 (opline-1)->opcode == ZEND_ASSIGN_OBJ ||
491 (opline-1)->opcode == ZEND_ASSIGN_OBJ_REF) &&
492 op->op1_use == i &&
493 (op-1)->op1_use >= 0) {
494 enclosing_root = ees[(op-1)->op1_use];
495 } else if ((opline->opcode == ZEND_INIT_ARRAY ||
496 opline->opcode == ZEND_ADD_ARRAY_ELEMENT) &&
497 op->op1_use == i &&
498 op->result_def >= 0) {
499 enclosing_root = ees[op->result_def];
500 } else {
501 continue;
502 }
503
504 if (ssa_vars[enclosing_root].escape_state == ESCAPE_STATE_UNKNOWN ||
505 ssa_vars[enclosing_root].escape_state > ssa_vars[root].escape_state) {
506 if (ssa_vars[enclosing_root].escape_state == ESCAPE_STATE_UNKNOWN) {
507 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
508 } else {
509 ssa_vars[root].escape_state = ssa_vars[enclosing_root].escape_state;
510 }
511 if (ssa_vars[root].escape_state == ESCAPE_STATE_GLOBAL_ESCAPE) {
512 num_non_escaped--;
513 if (num_non_escaped == 0) {
514 changed = 0;
515 } else {
516 changed = 1;
517 }
518 break;
519 } else {
520 changed = 1;
521 }
522 }
523 } FOREACH_USE_END();
524 }
525 }
526 }
527 } while (changed);
528 }
529
530 /* 5. Propagate values of escape sets to variables */
531 for (i = 0; i < ssa_vars_count; i++) {
532 root = ees[i];
533 if (i != root) {
534 ssa_vars[i].escape_state = ssa_vars[root].escape_state;
535 }
536 }
537
538 free_alloca(ees, use_heap);
539
540 return SUCCESS;
541 }
542 /* }}} */
543
