1 /*
2 +----------------------------------------------------------------------+
3 | Zend OPcache |
4 +----------------------------------------------------------------------+
5 | Copyright (c) The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | https://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@php.net> |
16 +----------------------------------------------------------------------+
17 */
18
19 #include "Optimizer/zend_optimizer.h"
20 #include "Optimizer/zend_optimizer_internal.h"
21 #include "zend_API.h"
22 #include "zend_constants.h"
23 #include "zend_execute.h"
24 #include "zend_vm.h"
25 #include "zend_bitset.h"
26 #include "zend_cfg.h"
27 #include "zend_ssa.h"
28 #include "zend_func_info.h"
29 #include "zend_call_graph.h"
30 #include "zend_inference.h"
31 #include "zend_dump.h"
32
33 #ifndef ZEND_DEBUG_DFA
34 # define ZEND_DEBUG_DFA ZEND_DEBUG
35 #endif
36
37 #if ZEND_DEBUG_DFA
38 # include "ssa_integrity.c"
39 #endif
40
zend_dfa_analyze_op_array(zend_op_array * op_array,zend_optimizer_ctx * ctx,zend_ssa * ssa)41 zend_result zend_dfa_analyze_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa)
42 {
43 uint32_t build_flags;
44
45 if (op_array->last_try_catch) {
46 /* TODO: we can't analyze functions with try/catch/finally ??? */
47 return FAILURE;
48 }
49
50 /* Build SSA */
51 memset(ssa, 0, sizeof(zend_ssa));
52
53 zend_build_cfg(&ctx->arena, op_array, ZEND_CFG_NO_ENTRY_PREDECESSORS, &ssa->cfg);
54
55 if ((ssa->cfg.flags & ZEND_FUNC_INDIRECT_VAR_ACCESS)) {
56 /* TODO: we can't analyze functions with indirect variable access ??? */
57 return FAILURE;
58 }
59
60 zend_cfg_build_predecessors(&ctx->arena, &ssa->cfg);
61
62 if (ctx->debug_level & ZEND_DUMP_DFA_CFG) {
63 zend_dump_op_array(op_array, ZEND_DUMP_CFG, "dfa cfg", &ssa->cfg);
64 }
65
66 /* Compute Dominators Tree */
67 zend_cfg_compute_dominators_tree(op_array, &ssa->cfg);
68
69 /* Identify reducible and irreducible loops */
70 zend_cfg_identify_loops(op_array, &ssa->cfg);
71
72 if (ctx->debug_level & ZEND_DUMP_DFA_DOMINATORS) {
73 zend_dump_dominators(op_array, &ssa->cfg);
74 }
75
76 build_flags = 0;
77 if (ctx->debug_level & ZEND_DUMP_DFA_LIVENESS) {
78 build_flags |= ZEND_SSA_DEBUG_LIVENESS;
79 }
80 if (ctx->debug_level & ZEND_DUMP_DFA_PHI) {
81 build_flags |= ZEND_SSA_DEBUG_PHI_PLACEMENT;
82 }
83 if (zend_build_ssa(&ctx->arena, ctx->script, op_array, build_flags, ssa) == FAILURE) {
84 return FAILURE;
85 }
86
87 if (ctx->debug_level & ZEND_DUMP_DFA_SSA) {
88 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "dfa ssa", ssa);
89 }
90
91
92 zend_ssa_compute_use_def_chains(&ctx->arena, op_array, ssa);
93
94 zend_ssa_find_false_dependencies(op_array, ssa);
95
96 zend_ssa_find_sccs(op_array, ssa);
97
98 if (zend_ssa_inference(&ctx->arena, op_array, ctx->script, ssa, ctx->optimization_level) == FAILURE) {
99 return FAILURE;
100 }
101
102 if (zend_ssa_escape_analysis(ctx->script, op_array, ssa) == FAILURE) {
103 return FAILURE;
104 }
105
106 if (ctx->debug_level & ZEND_DUMP_DFA_SSA_VARS) {
107 zend_dump_ssa_variables(op_array, ssa, 0);
108 }
109
110 return SUCCESS;
111 }
112
zend_ssa_remove_nops(zend_op_array * op_array,zend_ssa * ssa,zend_optimizer_ctx * ctx)113 static void zend_ssa_remove_nops(zend_op_array *op_array, zend_ssa *ssa, zend_optimizer_ctx *ctx)
114 {
115 zend_basic_block *blocks = ssa->cfg.blocks;
116 zend_basic_block *blocks_end = blocks + ssa->cfg.blocks_count;
117 zend_basic_block *b;
118 zend_func_info *func_info;
119 int j;
120 uint32_t i = 0;
121 uint32_t target = 0;
122 uint32_t *shiftlist;
123 ALLOCA_FLAG(use_heap);
124
125 shiftlist = (uint32_t *)do_alloca(sizeof(uint32_t) * op_array->last, use_heap);
126 memset(shiftlist, 0, sizeof(uint32_t) * op_array->last);
127 /* remove empty callee_info */
128 func_info = ZEND_FUNC_INFO(op_array);
129 if (func_info) {
130 zend_call_info **call_info = &func_info->callee_info;
131 while ((*call_info)) {
132 if ((*call_info)->caller_init_opline->opcode == ZEND_NOP) {
133 *call_info = (*call_info)->next_callee;
134 } else {
135 call_info = &(*call_info)->next_callee;
136 }
137 }
138 }
139
140 for (b = blocks; b < blocks_end; b++) {
141 if (b->flags & (ZEND_BB_REACHABLE|ZEND_BB_UNREACHABLE_FREE)) {
142 if (b->len) {
143 uint32_t new_start, old_end;
144 while (i < b->start) {
145 shiftlist[i] = i - target;
146 i++;
147 }
148
149 if (b->flags & ZEND_BB_UNREACHABLE_FREE) {
150 /* Only keep the FREE for the loop var */
151 ZEND_ASSERT(op_array->opcodes[b->start].opcode == ZEND_FREE
152 || op_array->opcodes[b->start].opcode == ZEND_FE_FREE);
153 b->len = 1;
154 }
155
156 new_start = target;
157 old_end = b->start + b->len;
158 while (i < old_end) {
159 shiftlist[i] = i - target;
160 if (EXPECTED(op_array->opcodes[i].opcode != ZEND_NOP)) {
161 if (i != target) {
162 op_array->opcodes[target] = op_array->opcodes[i];
163 ssa->ops[target] = ssa->ops[i];
164 ssa->cfg.map[target] = b - blocks;
165 }
166 target++;
167 }
168 i++;
169 }
170 b->start = new_start;
171 if (target != old_end) {
172 zend_op *opline;
173 zend_op *new_opline;
174
175 b->len = target - b->start;
176 opline = op_array->opcodes + old_end - 1;
177 if (opline->opcode == ZEND_NOP) {
178 continue;
179 }
180
181 new_opline = op_array->opcodes + target - 1;
182 zend_optimizer_migrate_jump(op_array, new_opline, opline);
183 }
184 } else {
185 b->start = target;
186 }
187 } else {
188 b->start = target;
189 b->len = 0;
190 }
191 }
192
193 if (target != op_array->last) {
194 /* reset rest opcodes */
195 for (i = target; i < op_array->last; i++) {
196 MAKE_NOP(op_array->opcodes + i);
197 }
198
199 /* update SSA variables */
200 for (j = 0; j < ssa->vars_count; j++) {
201 if (ssa->vars[j].definition >= 0) {
202 ssa->vars[j].definition -= shiftlist[ssa->vars[j].definition];
203 }
204 if (ssa->vars[j].use_chain >= 0) {
205 ssa->vars[j].use_chain -= shiftlist[ssa->vars[j].use_chain];
206 }
207 }
208 for (i = 0; i < op_array->last; i++) {
209 if (ssa->ops[i].op1_use_chain >= 0) {
210 ssa->ops[i].op1_use_chain -= shiftlist[ssa->ops[i].op1_use_chain];
211 }
212 if (ssa->ops[i].op2_use_chain >= 0) {
213 ssa->ops[i].op2_use_chain -= shiftlist[ssa->ops[i].op2_use_chain];
214 }
215 if (ssa->ops[i].res_use_chain >= 0) {
216 ssa->ops[i].res_use_chain -= shiftlist[ssa->ops[i].res_use_chain];
217 }
218 }
219
220 /* update branch targets */
221 for (b = blocks; b < blocks_end; b++) {
222 if ((b->flags & ZEND_BB_REACHABLE) && b->len != 0) {
223 zend_op *opline = op_array->opcodes + b->start + b->len - 1;
224 zend_optimizer_shift_jump(op_array, opline, shiftlist);
225 }
226 }
227
228 /* update try/catch array */
229 for (j = 0; j < op_array->last_try_catch; j++) {
230 op_array->try_catch_array[j].try_op -= shiftlist[op_array->try_catch_array[j].try_op];
231 op_array->try_catch_array[j].catch_op -= shiftlist[op_array->try_catch_array[j].catch_op];
232 if (op_array->try_catch_array[j].finally_op) {
233 op_array->try_catch_array[j].finally_op -= shiftlist[op_array->try_catch_array[j].finally_op];
234 op_array->try_catch_array[j].finally_end -= shiftlist[op_array->try_catch_array[j].finally_end];
235 }
236 }
237
238 /* update call graph */
239 if (func_info) {
240 zend_call_info *call_info = func_info->callee_info;
241 while (call_info) {
242 call_info->caller_init_opline -=
243 shiftlist[call_info->caller_init_opline - op_array->opcodes];
244 if (call_info->caller_call_opline) {
245 call_info->caller_call_opline -=
246 shiftlist[call_info->caller_call_opline - op_array->opcodes];
247 }
248 call_info = call_info->next_callee;
249 }
250 }
251
252 op_array->last = target;
253 }
254 free_alloca(shiftlist, use_heap);
255 }
256
safe_instanceof(zend_class_entry * ce1,zend_class_entry * ce2)257 static bool safe_instanceof(zend_class_entry *ce1, zend_class_entry *ce2) {
258 if (ce1 == ce2) {
259 return 1;
260 }
261 if (!(ce1->ce_flags & ZEND_ACC_LINKED)) {
262 /* This case could be generalized, similarly to unlinked_instanceof */
263 return 0;
264 }
265 return instanceof_function(ce1, ce2);
266 }
267
can_elide_list_type(const zend_script * script,const zend_op_array * op_array,const zend_ssa_var_info * use_info,zend_type type)268 static inline bool can_elide_list_type(
269 const zend_script *script, const zend_op_array *op_array,
270 const zend_ssa_var_info *use_info, zend_type type)
271 {
272 zend_type *single_type;
273 /* For intersection: result==false is failure, default is success.
274 * For union: result==true is success, default is failure. */
275 bool is_intersection = ZEND_TYPE_IS_INTERSECTION(type);
276 ZEND_TYPE_FOREACH(type, single_type) {
277 if (ZEND_TYPE_HAS_LIST(*single_type)) {
278 ZEND_ASSERT(!is_intersection);
279 return can_elide_list_type(script, op_array, use_info, *single_type);
280 }
281 if (ZEND_TYPE_HAS_NAME(*single_type)) {
282 zend_string *lcname = zend_string_tolower(ZEND_TYPE_NAME(*single_type));
283 zend_class_entry *ce = zend_optimizer_get_class_entry(script, op_array, lcname);
284 zend_string_release(lcname);
285 bool result = ce && safe_instanceof(use_info->ce, ce);
286 if (result == !is_intersection) {
287 return result;
288 }
289 }
290 } ZEND_TYPE_FOREACH_END();
291 return is_intersection;
292 }
293
can_elide_return_type_check(const zend_script * script,zend_op_array * op_array,zend_ssa * ssa,zend_ssa_op * ssa_op)294 static inline bool can_elide_return_type_check(
295 const zend_script *script, zend_op_array *op_array, zend_ssa *ssa, zend_ssa_op *ssa_op) {
296 zend_arg_info *arg_info = &op_array->arg_info[-1];
297 zend_ssa_var_info *use_info = &ssa->var_info[ssa_op->op1_use];
298 uint32_t use_type = use_info->type & (MAY_BE_ANY|MAY_BE_UNDEF);
299 if (use_type & MAY_BE_REF) {
300 return 0;
301 }
302
303 if (use_type & MAY_BE_UNDEF) {
304 use_type &= ~MAY_BE_UNDEF;
305 use_type |= MAY_BE_NULL;
306 }
307
308 uint32_t disallowed_types = use_type & ~ZEND_TYPE_PURE_MASK(arg_info->type);
309 if (!disallowed_types) {
310 /* Only contains allowed types. */
311 return true;
312 }
313
314 if (disallowed_types == MAY_BE_OBJECT && use_info->ce && ZEND_TYPE_IS_COMPLEX(arg_info->type)) {
315 return can_elide_list_type(script, op_array, use_info, arg_info->type);
316 }
317
318 return false;
319 }
320
opline_supports_assign_contraction(zend_op_array * op_array,zend_ssa * ssa,zend_op * opline,int src_var,uint32_t cv_var)321 static bool opline_supports_assign_contraction(
322 zend_op_array *op_array, zend_ssa *ssa, zend_op *opline, int src_var, uint32_t cv_var) {
323 if (opline->opcode == ZEND_NEW) {
324 /* see Zend/tests/generators/aborted_yield_during_new.phpt */
325 return 0;
326 }
327
328 if (opline->opcode == ZEND_DO_ICALL || opline->opcode == ZEND_DO_UCALL
329 || opline->opcode == ZEND_DO_FCALL || opline->opcode == ZEND_DO_FCALL_BY_NAME) {
330 /* Function calls may dtor the return value after it has already been written -- allow
331 * direct assignment only for types where a double-dtor does not matter. */
332 uint32_t type = ssa->var_info[src_var].type;
333 uint32_t simple = MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_LONG|MAY_BE_DOUBLE;
334 return !((type & MAY_BE_ANY) & ~simple);
335 }
336
337 if (opline->opcode == ZEND_POST_INC || opline->opcode == ZEND_POST_DEC) {
338 /* POST_INC/DEC write the result variable before performing the inc/dec. For $i = $i++
339 * eliding the temporary variable would thus yield an incorrect result. */
340 return opline->op1_type != IS_CV || opline->op1.var != cv_var;
341 }
342
343 if (opline->opcode == ZEND_INIT_ARRAY) {
344 /* INIT_ARRAY initializes the result array before reading key/value. */
345 return (opline->op1_type != IS_CV || opline->op1.var != cv_var)
346 && (opline->op2_type != IS_CV || opline->op2.var != cv_var);
347 }
348
349 if (opline->opcode == ZEND_CAST
350 && (opline->extended_value == IS_ARRAY || opline->extended_value == IS_OBJECT)) {
351 /* CAST to array/object may initialize the result to an empty array/object before
352 * reading the expression. */
353 return opline->op1_type != IS_CV || opline->op1.var != cv_var;
354 }
355
356 if ((opline->opcode == ZEND_ASSIGN_OP
357 || opline->opcode == ZEND_ASSIGN_OBJ
358 || opline->opcode == ZEND_ASSIGN_DIM
359 || opline->opcode == ZEND_ASSIGN_OBJ_OP
360 || opline->opcode == ZEND_ASSIGN_DIM_OP)
361 && opline->op1_type == IS_CV
362 && opline->op1.var == cv_var
363 && zend_may_throw(opline, &ssa->ops[ssa->vars[src_var].definition], op_array, ssa)) {
364 return 0;
365 }
366
367 return 1;
368 }
369
variable_defined_or_used_in_range(zend_ssa * ssa,int var,int start,int end)370 static bool variable_defined_or_used_in_range(zend_ssa *ssa, int var, int start, int end)
371 {
372 while (start < end) {
373 const zend_ssa_op *ssa_op = &ssa->ops[start];
374 if ((ssa_op->op1_def >= 0 && ssa->vars[ssa_op->op1_def].var == var) ||
375 (ssa_op->op2_def >= 0 && ssa->vars[ssa_op->op2_def].var == var) ||
376 (ssa_op->result_def >= 0 && ssa->vars[ssa_op->result_def].var == var) ||
377 (ssa_op->op1_use >= 0 && ssa->vars[ssa_op->op1_use].var == var) ||
378 (ssa_op->op2_use >= 0 && ssa->vars[ssa_op->op2_use].var == var) ||
379 (ssa_op->result_use >= 0 && ssa->vars[ssa_op->result_use].var == var)
380 ) {
381 return 1;
382 }
383 start++;
384 }
385 return 0;
386 }
387
zend_dfa_optimize_calls(zend_op_array * op_array,zend_ssa * ssa)388 int zend_dfa_optimize_calls(zend_op_array *op_array, zend_ssa *ssa)
389 {
390 zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
391 int removed_ops = 0;
392
393 if (func_info->callee_info) {
394 zend_call_info *call_info = func_info->callee_info;
395
396 do {
397 if (call_info->caller_call_opline
398 && call_info->caller_call_opline->opcode == ZEND_DO_ICALL
399 && call_info->callee_func
400 && zend_string_equals_literal(call_info->callee_func->common.function_name, "in_array")
401 && (call_info->caller_init_opline->extended_value == 2
402 || (call_info->caller_init_opline->extended_value == 3
403 && (call_info->caller_call_opline - 1)->opcode == ZEND_SEND_VAL
404 && (call_info->caller_call_opline - 1)->op1_type == IS_CONST))) {
405
406 zend_op *send_array;
407 zend_op *send_needly;
408 bool strict = 0;
409 ZEND_ASSERT(!call_info->is_prototype);
410
411 if (call_info->caller_init_opline->extended_value == 2) {
412 send_array = call_info->caller_call_opline - 1;
413 send_needly = call_info->caller_call_opline - 2;
414 } else {
415 if (zend_is_true(CT_CONSTANT_EX(op_array, (call_info->caller_call_opline - 1)->op1.constant))) {
416 strict = 1;
417 }
418 send_array = call_info->caller_call_opline - 2;
419 send_needly = call_info->caller_call_opline - 3;
420 }
421
422 if (send_array->opcode == ZEND_SEND_VAL
423 && send_array->op1_type == IS_CONST
424 && Z_TYPE_P(CT_CONSTANT_EX(op_array, send_array->op1.constant)) == IS_ARRAY
425 && (send_needly->opcode == ZEND_SEND_VAL
426 || send_needly->opcode == ZEND_SEND_VAR)
427 ) {
428 bool ok = 1;
429
430 HashTable *src = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, send_array->op1.constant));
431 HashTable *dst;
432 zval *val, tmp;
433 zend_ulong idx;
434
435 ZVAL_TRUE(&tmp);
436 dst = zend_new_array(zend_hash_num_elements(src));
437 if (strict) {
438 ZEND_HASH_FOREACH_VAL(src, val) {
439 if (Z_TYPE_P(val) == IS_STRING) {
440 zend_hash_add(dst, Z_STR_P(val), &tmp);
441 } else if (Z_TYPE_P(val) == IS_LONG) {
442 zend_hash_index_add(dst, Z_LVAL_P(val), &tmp);
443 } else {
444 zend_array_destroy(dst);
445 ok = 0;
446 break;
447 }
448 } ZEND_HASH_FOREACH_END();
449 } else {
450 ZEND_HASH_FOREACH_VAL(src, val) {
451 if (Z_TYPE_P(val) != IS_STRING || ZEND_HANDLE_NUMERIC(Z_STR_P(val), idx)) {
452 zend_array_destroy(dst);
453 ok = 0;
454 break;
455 }
456 zend_hash_add(dst, Z_STR_P(val), &tmp);
457 } ZEND_HASH_FOREACH_END();
458 }
459
460 if (ok) {
461 uint32_t op_num = send_needly - op_array->opcodes;
462 zend_ssa_op *ssa_op = ssa->ops + op_num;
463
464 if (ssa_op->op1_use >= 0) {
465 /* Reconstruct SSA */
466 int var_num = ssa_op->op1_use;
467 zend_ssa_var *var = ssa->vars + var_num;
468
469 ZEND_ASSERT(ssa_op->op1_def < 0);
470 zend_ssa_unlink_use_chain(ssa, op_num, ssa_op->op1_use);
471 ssa_op->op1_use = -1;
472 ssa_op->op1_use_chain = -1;
473 op_num = call_info->caller_call_opline - op_array->opcodes;
474 ssa_op = ssa->ops + op_num;
475 ssa_op->op1_use = var_num;
476 ssa_op->op1_use_chain = var->use_chain;
477 var->use_chain = op_num;
478 }
479
480 ZVAL_ARR(&tmp, dst);
481
482 /* Update opcode */
483 call_info->caller_call_opline->opcode = ZEND_IN_ARRAY;
484 call_info->caller_call_opline->extended_value = strict;
485 call_info->caller_call_opline->op1_type = send_needly->op1_type;
486 call_info->caller_call_opline->op1.num = send_needly->op1.num;
487 call_info->caller_call_opline->op2_type = IS_CONST;
488 call_info->caller_call_opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
489 if (call_info->caller_init_opline->extended_value == 3) {
490 MAKE_NOP(call_info->caller_call_opline - 1);
491 }
492 MAKE_NOP(call_info->caller_init_opline);
493 MAKE_NOP(send_needly);
494 MAKE_NOP(send_array);
495 removed_ops++;
496
497 op_num = call_info->caller_call_opline - op_array->opcodes;
498 ssa_op = ssa->ops + op_num;
499 if (ssa_op->result_def >= 0) {
500 int var = ssa_op->result_def;
501 int use = ssa->vars[var].use_chain;
502
503 /* If the result is used only in a JMPZ/JMPNZ, replace result type with
504 * IS_TMP_VAR, which will enable use of smart branches. Don't do this
505 * in other cases, as not all opcodes support both VAR and TMP. */
506 if (ssa->vars[var].phi_use_chain == NULL
507 && ssa->ops[use].op1_use == var
508 && ssa->ops[use].op1_use_chain == -1
509 && (op_array->opcodes[use].opcode == ZEND_JMPZ
510 || op_array->opcodes[use].opcode == ZEND_JMPNZ)) {
511 call_info->caller_call_opline->result_type = IS_TMP_VAR;
512 op_array->opcodes[use].op1_type = IS_TMP_VAR;
513 }
514 }
515 }
516 }
517 }
518 call_info = call_info->next_callee;
519 } while (call_info);
520 }
521
522 return removed_ops;
523 }
524
take_successor_0(zend_ssa * ssa,int block_num,zend_basic_block * block)525 static zend_always_inline void take_successor_0(zend_ssa *ssa, int block_num, zend_basic_block *block)
526 {
527 if (block->successors_count == 2) {
528 if (block->successors[1] != block->successors[0]) {
529 zend_ssa_remove_predecessor(ssa, block_num, block->successors[1]);
530 }
531 block->successors_count = 1;
532 }
533 }
534
take_successor_1(zend_ssa * ssa,int block_num,zend_basic_block * block)535 static zend_always_inline void take_successor_1(zend_ssa *ssa, int block_num, zend_basic_block *block)
536 {
537 if (block->successors_count == 2) {
538 if (block->successors[1] != block->successors[0]) {
539 zend_ssa_remove_predecessor(ssa, block_num, block->successors[0]);
540 block->successors[0] = block->successors[1];
541 }
542 block->successors_count = 1;
543 }
544 }
545
take_successor_ex(zend_ssa * ssa,int block_num,zend_basic_block * block,int target_block)546 static zend_always_inline void take_successor_ex(zend_ssa *ssa, int block_num, zend_basic_block *block, int target_block)
547 {
548 int i;
549
550 for (i = 0; i < block->successors_count; i++) {
551 if (block->successors[i] != target_block) {
552 zend_ssa_remove_predecessor(ssa, block_num, block->successors[i]);
553 }
554 }
555 block->successors[0] = target_block;
556 block->successors_count = 1;
557 }
558
compress_block(zend_op_array * op_array,zend_basic_block * block)559 static void compress_block(zend_op_array *op_array, zend_basic_block *block)
560 {
561 while (block->len > 0) {
562 zend_op *opline = &op_array->opcodes[block->start + block->len - 1];
563
564 if (opline->opcode == ZEND_NOP) {
565 block->len--;
566 } else {
567 break;
568 }
569 }
570 }
571
replace_predecessor(zend_ssa * ssa,int block_id,int old_pred,int new_pred)572 static void replace_predecessor(zend_ssa *ssa, int block_id, int old_pred, int new_pred) {
573 zend_basic_block *block = &ssa->cfg.blocks[block_id];
574 int *predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
575 zend_ssa_phi *phi;
576
577 int i;
578 int old_pred_idx = -1;
579 int new_pred_idx = -1;
580 for (i = 0; i < block->predecessors_count; i++) {
581 if (predecessors[i] == old_pred) {
582 old_pred_idx = i;
583 }
584 if (predecessors[i] == new_pred) {
585 new_pred_idx = i;
586 }
587 }
588
589 ZEND_ASSERT(old_pred_idx != -1);
590 if (new_pred_idx == -1) {
591 /* If the new predecessor doesn't exist yet, simply rewire the old one */
592 predecessors[old_pred_idx] = new_pred;
593 } else {
594 /* Otherwise, rewiring the old predecessor would make the new predecessor appear
595 * twice, which violates our CFG invariants. Remove the old predecessor instead. */
596 memmove(
597 predecessors + old_pred_idx,
598 predecessors + old_pred_idx + 1,
599 sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
600 );
601
602 /* Also remove the corresponding phi node entries */
603 for (phi = ssa->blocks[block_id].phis; phi; phi = phi->next) {
604 if (phi->pi >= 0) {
605 if (phi->pi == old_pred || phi->pi == new_pred) {
606 zend_ssa_rename_var_uses(
607 ssa, phi->ssa_var, phi->sources[0], /* update_types */ 0);
608 zend_ssa_remove_phi(ssa, phi);
609 }
610 } else {
611 memmove(
612 phi->sources + old_pred_idx,
613 phi->sources + old_pred_idx + 1,
614 sizeof(int) * (block->predecessors_count - old_pred_idx - 1)
615 );
616 }
617 }
618
619 block->predecessors_count--;
620 }
621 }
622
zend_ssa_replace_control_link(zend_op_array * op_array,zend_ssa * ssa,int from,int to,int new_to)623 static void zend_ssa_replace_control_link(zend_op_array *op_array, zend_ssa *ssa, int from, int to, int new_to)
624 {
625 zend_basic_block *src = &ssa->cfg.blocks[from];
626 zend_basic_block *old = &ssa->cfg.blocks[to];
627 zend_basic_block *dst = &ssa->cfg.blocks[new_to];
628 int i;
629 zend_op *opline;
630
631 for (i = 0; i < src->successors_count; i++) {
632 if (src->successors[i] == to) {
633 src->successors[i] = new_to;
634 }
635 }
636
637 if (src->len > 0) {
638 opline = op_array->opcodes + src->start + src->len - 1;
639 switch (opline->opcode) {
640 case ZEND_JMP:
641 case ZEND_FAST_CALL:
642 ZEND_ASSERT(ZEND_OP1_JMP_ADDR(opline) == op_array->opcodes + old->start);
643 ZEND_SET_OP_JMP_ADDR(opline, opline->op1, op_array->opcodes + dst->start);
644 break;
645 case ZEND_JMPZ:
646 case ZEND_JMPNZ:
647 case ZEND_JMPZ_EX:
648 case ZEND_JMPNZ_EX:
649 case ZEND_FE_RESET_R:
650 case ZEND_FE_RESET_RW:
651 case ZEND_JMP_SET:
652 case ZEND_COALESCE:
653 case ZEND_ASSERT_CHECK:
654 case ZEND_JMP_NULL:
655 if (ZEND_OP2_JMP_ADDR(opline) == op_array->opcodes + old->start) {
656 ZEND_SET_OP_JMP_ADDR(opline, opline->op2, op_array->opcodes + dst->start);
657 }
658 break;
659 case ZEND_CATCH:
660 if (!(opline->extended_value & ZEND_LAST_CATCH)) {
661 if (ZEND_OP2_JMP_ADDR(opline) == op_array->opcodes + old->start) {
662 ZEND_SET_OP_JMP_ADDR(opline, opline->op2, op_array->opcodes + dst->start);
663 }
664 }
665 break;
666 case ZEND_FE_FETCH_R:
667 case ZEND_FE_FETCH_RW:
668 if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) == old->start) {
669 opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
670 }
671 break;
672 case ZEND_SWITCH_LONG:
673 case ZEND_SWITCH_STRING:
674 case ZEND_MATCH:
675 {
676 HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
677 zval *zv;
678 ZEND_HASH_FOREACH_VAL(jumptable, zv) {
679 if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv)) == old->start) {
680 Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
681 }
682 } ZEND_HASH_FOREACH_END();
683 if (ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) == old->start) {
684 opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, dst->start);
685 }
686 break;
687 }
688 }
689 }
690
691 replace_predecessor(ssa, new_to, to, from);
692 }
693
zend_ssa_unlink_block(zend_op_array * op_array,zend_ssa * ssa,zend_basic_block * block,int block_num)694 static void zend_ssa_unlink_block(zend_op_array *op_array, zend_ssa *ssa, zend_basic_block *block, int block_num)
695 {
696 if (block->predecessors_count == 1 && ssa->blocks[block_num].phis == NULL) {
697 int *predecessors, i;
698 zend_basic_block *fe_fetch_block = NULL;
699
700 ZEND_ASSERT(block->successors_count == 1);
701 predecessors = &ssa->cfg.predecessors[block->predecessor_offset];
702 if (block->predecessors_count == 1 && (block->flags & ZEND_BB_FOLLOW)) {
703 zend_basic_block *pred_block = &ssa->cfg.blocks[predecessors[0]];
704
705 if (pred_block->len > 0 && (pred_block->flags & ZEND_BB_REACHABLE)) {
706 if ((op_array->opcodes[pred_block->start + pred_block->len - 1].opcode == ZEND_FE_FETCH_R
707 || op_array->opcodes[pred_block->start + pred_block->len - 1].opcode == ZEND_FE_FETCH_RW)
708 && op_array->opcodes[pred_block->start + pred_block->len - 1].op2_type == IS_CV) {
709 fe_fetch_block = pred_block;
710 }
711 }
712 }
713 for (i = 0; i < block->predecessors_count; i++) {
714 zend_ssa_replace_control_link(op_array, ssa, predecessors[i], block_num, block->successors[0]);
715 }
716 zend_ssa_remove_block(op_array, ssa, block_num);
717 if (fe_fetch_block && fe_fetch_block->successors[0] == fe_fetch_block->successors[1]) {
718 /* The body of "foreach" loop was removed */
719 int ssa_var = ssa->ops[fe_fetch_block->start + fe_fetch_block->len - 1].op2_def;
720 if (ssa_var >= 0) {
721 zend_ssa_remove_uses_of_var(ssa, ssa_var);
722 }
723 }
724 }
725 }
726
zend_dfa_optimize_jmps(zend_op_array * op_array,zend_ssa * ssa)727 static int zend_dfa_optimize_jmps(zend_op_array *op_array, zend_ssa *ssa)
728 {
729 int removed_ops = 0;
730 int block_num = 0;
731
732 for (block_num = 1; block_num < ssa->cfg.blocks_count; block_num++) {
733 zend_basic_block *block = &ssa->cfg.blocks[block_num];
734
735 if (!(block->flags & ZEND_BB_REACHABLE)) {
736 continue;
737 }
738 compress_block(op_array, block);
739 if (block->len == 0) {
740 zend_ssa_unlink_block(op_array, ssa, block, block_num);
741 }
742 }
743
744 block_num = 0;
745 while (block_num < ssa->cfg.blocks_count
746 && !(ssa->cfg.blocks[block_num].flags & ZEND_BB_REACHABLE)) {
747 block_num++;
748 }
749 while (block_num < ssa->cfg.blocks_count) {
750 int next_block_num = block_num + 1;
751 zend_basic_block *block = &ssa->cfg.blocks[block_num];
752 uint32_t op_num;
753 zend_op *opline;
754 zend_ssa_op *ssa_op;
755 bool can_follow = 1;
756
757 while (next_block_num < ssa->cfg.blocks_count
758 && !(ssa->cfg.blocks[next_block_num].flags & ZEND_BB_REACHABLE)) {
759 if (ssa->cfg.blocks[next_block_num].flags & ZEND_BB_UNREACHABLE_FREE) {
760 can_follow = 0;
761 }
762 next_block_num++;
763 }
764
765 if (block->len) {
766 op_num = block->start + block->len - 1;
767 opline = op_array->opcodes + op_num;
768 ssa_op = ssa->ops + op_num;
769
770 switch (opline->opcode) {
771 case ZEND_JMP:
772 optimize_jmp:
773 if (block->successors[0] == next_block_num && can_follow) {
774 MAKE_NOP(opline);
775 removed_ops++;
776 goto optimize_nop;
777 }
778 break;
779 case ZEND_JMPZ:
780 optimize_jmpz:
781 if (opline->op1_type == IS_CONST) {
782 if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
783 MAKE_NOP(opline);
784 removed_ops++;
785 take_successor_1(ssa, block_num, block);
786 goto optimize_nop;
787 } else {
788 opline->opcode = ZEND_JMP;
789 COPY_NODE(opline->op1, opline->op2);
790 take_successor_0(ssa, block_num, block);
791 goto optimize_jmp;
792 }
793 } else {
794 if (block->successors[0] == next_block_num && can_follow) {
795 take_successor_0(ssa, block_num, block);
796 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_UNDEF)) {
797 opline->opcode = ZEND_CHECK_VAR;
798 opline->op2.num = 0;
799 } else if (opline->op1_type == IS_CV || !(OP1_INFO() & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
800 zend_ssa_remove_instr(ssa, opline, ssa_op);
801 removed_ops++;
802 goto optimize_nop;
803 } else {
804 opline->opcode = ZEND_FREE;
805 opline->op2.num = 0;
806 }
807 }
808 }
809 break;
810 case ZEND_JMPNZ:
811 optimize_jmpnz:
812 if (opline->op1_type == IS_CONST) {
813 if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
814 opline->opcode = ZEND_JMP;
815 COPY_NODE(opline->op1, opline->op2);
816 take_successor_0(ssa, block_num, block);
817 goto optimize_jmp;
818 } else {
819 MAKE_NOP(opline);
820 removed_ops++;
821 take_successor_1(ssa, block_num, block);
822 goto optimize_nop;
823 }
824 } else if (block->successors_count == 2) {
825 if (block->successors[0] == next_block_num && can_follow) {
826 take_successor_0(ssa, block_num, block);
827 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_UNDEF)) {
828 opline->opcode = ZEND_CHECK_VAR;
829 opline->op2.num = 0;
830 } else if (opline->op1_type == IS_CV || !(OP1_INFO() & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
831 zend_ssa_remove_instr(ssa, opline, ssa_op);
832 removed_ops++;
833 goto optimize_nop;
834 } else {
835 opline->opcode = ZEND_FREE;
836 opline->op2.num = 0;
837 }
838 }
839 }
840 break;
841 case ZEND_JMPZ_EX:
842 if (ssa->vars[ssa_op->result_def].use_chain < 0
843 && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
844 opline->opcode = ZEND_JMPZ;
845 opline->result_type = IS_UNUSED;
846 zend_ssa_remove_result_def(ssa, ssa_op);
847 goto optimize_jmpz;
848 } else if (opline->op1_type == IS_CONST) {
849 if (zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
850 opline->opcode = ZEND_QM_ASSIGN;
851 take_successor_1(ssa, block_num, block);
852 }
853 }
854 break;
855 case ZEND_JMPNZ_EX:
856 if (ssa->vars[ssa_op->result_def].use_chain < 0
857 && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
858 opline->opcode = ZEND_JMPNZ;
859 opline->result_type = IS_UNUSED;
860 zend_ssa_remove_result_def(ssa, ssa_op);
861 goto optimize_jmpnz;
862 } else if (opline->op1_type == IS_CONST) {
863 if (!zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
864 opline->opcode = ZEND_QM_ASSIGN;
865 take_successor_1(ssa, block_num, block);
866 }
867 }
868 break;
869 case ZEND_JMP_SET:
870 if (ssa->vars[ssa_op->result_def].use_chain < 0
871 && ssa->vars[ssa_op->result_def].phi_use_chain == NULL) {
872 opline->opcode = ZEND_JMPNZ;
873 opline->result_type = IS_UNUSED;
874 zend_ssa_remove_result_def(ssa, ssa_op);
875 goto optimize_jmpnz;
876 } else if (opline->op1_type == IS_CONST) {
877 if (!zend_is_true(CT_CONSTANT_EX(op_array, opline->op1.constant))) {
878 MAKE_NOP(opline);
879 removed_ops++;
880 take_successor_1(ssa, block_num, block);
881 zend_ssa_remove_result_def(ssa, ssa_op);
882 goto optimize_nop;
883 }
884 }
885 break;
886 case ZEND_COALESCE:
887 {
888 zend_ssa_var *var = &ssa->vars[ssa_op->result_def];
889 if (opline->op1_type == IS_CONST
890 && var->use_chain < 0 && var->phi_use_chain == NULL) {
891 if (Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op1.constant)) == IS_NULL) {
892 zend_ssa_remove_result_def(ssa, ssa_op);
893 MAKE_NOP(opline);
894 removed_ops++;
895 take_successor_1(ssa, block_num, block);
896 goto optimize_nop;
897 } else {
898 opline->opcode = ZEND_JMP;
899 opline->result_type = IS_UNUSED;
900 zend_ssa_remove_result_def(ssa, ssa_op);
901 COPY_NODE(opline->op1, opline->op2);
902 take_successor_0(ssa, block_num, block);
903 goto optimize_jmp;
904 }
905 }
906 break;
907 }
908 case ZEND_JMP_NULL:
909 {
910 zend_ssa_var *var = &ssa->vars[ssa_op->result_def];
911 if (opline->op1_type == IS_CONST
912 && var->use_chain < 0 && var->phi_use_chain == NULL) {
913 if (Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op1.constant)) == IS_NULL) {
914 opline->opcode = ZEND_JMP;
915 opline->result_type = IS_UNUSED;
916 zend_ssa_remove_result_def(ssa, ssa_op);
917 COPY_NODE(opline->op1, opline->op2);
918 take_successor_0(ssa, block_num, block);
919 goto optimize_jmp;
920 } else {
921 zend_ssa_remove_result_def(ssa, ssa_op);
922 MAKE_NOP(opline);
923 removed_ops++;
924 take_successor_1(ssa, block_num, block);
925 goto optimize_nop;
926 }
927 }
928 break;
929 }
930 case ZEND_SWITCH_LONG:
931 case ZEND_SWITCH_STRING:
932 case ZEND_MATCH:
933 if (opline->op1_type == IS_CONST) {
934 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
935 zend_uchar type = Z_TYPE_P(zv);
936 bool correct_type =
937 (opline->opcode == ZEND_SWITCH_LONG && type == IS_LONG)
938 || (opline->opcode == ZEND_SWITCH_STRING && type == IS_STRING)
939 || (opline->opcode == ZEND_MATCH && (type == IS_LONG || type == IS_STRING));
940
941 /* Switch statements have a fallback chain for loose comparison. In those
942 * cases the SWITCH_* instruction is a NOP. Match does strict comparison and
943 * thus jumps to the default branch on mismatched types, so we need to
944 * convert MATCH to a jmp. */
945 if (!correct_type && opline->opcode != ZEND_MATCH) {
946 removed_ops++;
947 MAKE_NOP(opline);
948 opline->extended_value = 0;
949 take_successor_ex(ssa, block_num, block, block->successors[block->successors_count - 1]);
950 goto optimize_nop;
951 }
952
953 uint32_t target;
954 if (correct_type) {
955 HashTable *jmptable = Z_ARRVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant));
956 zval *jmp_zv = type == IS_LONG
957 ? zend_hash_index_find(jmptable, Z_LVAL_P(zv))
958 : zend_hash_find(jmptable, Z_STR_P(zv));
959
960 if (jmp_zv) {
961 target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(jmp_zv));
962 } else {
963 target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value);
964 }
965 } else {
966 ZEND_ASSERT(opline->opcode == ZEND_MATCH);
967 target = ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value);
968 }
969 opline->opcode = ZEND_JMP;
970 opline->extended_value = 0;
971 SET_UNUSED(opline->op1);
972 ZEND_SET_OP_JMP_ADDR(opline, opline->op1, op_array->opcodes + target);
973 SET_UNUSED(opline->op2);
974 take_successor_ex(ssa, block_num, block, ssa->cfg.map[target]);
975 goto optimize_jmp;
976 }
977 break;
978 case ZEND_NOP:
979 optimize_nop:
980 compress_block(op_array, block);
981 if (block->len == 0) {
982 if (block_num > 0) {
983 zend_ssa_unlink_block(op_array, ssa, block, block_num);
984 /* backtrack to previous basic block */
985 do {
986 block_num--;
987 } while (block_num >= 0
988 && !(ssa->cfg.blocks[block_num].flags & ZEND_BB_REACHABLE));
989 if (block_num >= 0) {
990 continue;
991 }
992 }
993 }
994 break;
995 default:
996 break;
997 }
998 }
999
1000 block_num = next_block_num;
1001 }
1002
1003 return removed_ops;
1004 }
1005
zend_dfa_try_to_replace_result(zend_op_array * op_array,zend_ssa * ssa,int def,int cv_var)1006 static bool zend_dfa_try_to_replace_result(zend_op_array *op_array, zend_ssa *ssa, int def, int cv_var)
1007 {
1008 int result_var = ssa->ops[def].result_def;
1009 int cv = EX_NUM_TO_VAR(ssa->vars[cv_var].var);
1010
1011 if (result_var >= 0
1012 && !(ssa->var_info[cv_var].type & MAY_BE_REF)
1013 && ssa->vars[cv_var].alias == NO_ALIAS
1014 && ssa->vars[result_var].phi_use_chain == NULL
1015 && ssa->vars[result_var].sym_use_chain == NULL) {
1016 int use = ssa->vars[result_var].use_chain;
1017
1018 if (use >= 0
1019 && zend_ssa_next_use(ssa->ops, result_var, use) < 0
1020 && op_array->opcodes[use].opcode != ZEND_FREE
1021 && op_array->opcodes[use].opcode != ZEND_SEND_VAL
1022 && op_array->opcodes[use].opcode != ZEND_SEND_VAL_EX
1023 && op_array->opcodes[use].opcode != ZEND_VERIFY_RETURN_TYPE
1024 && op_array->opcodes[use].opcode != ZEND_YIELD) {
1025 if (use > def) {
1026 int i = use;
1027 const zend_op *opline = &op_array->opcodes[use];
1028
1029 while (i > def) {
1030 if ((opline->op1_type == IS_CV && opline->op1.var == cv)
1031 || (opline->op2_type == IS_CV && opline->op2.var == cv)
1032 || (opline->result_type == IS_CV && opline->result.var == cv)) {
1033 return 0;
1034 }
1035 opline--;
1036 i--;
1037 }
1038
1039 /* Update opcodes and reconstruct SSA */
1040 ssa->vars[result_var].definition = -1;
1041 ssa->vars[result_var].use_chain = -1;
1042 ssa->ops[def].result_def = -1;
1043
1044 op_array->opcodes[def].result_type = IS_UNUSED;
1045 op_array->opcodes[def].result.var = 0;
1046
1047 if (ssa->ops[use].op1_use == result_var) {
1048 ssa->ops[use].op1_use = cv_var;
1049 ssa->ops[use].op1_use_chain = ssa->vars[cv_var].use_chain;
1050 ssa->vars[cv_var].use_chain = use;
1051
1052 op_array->opcodes[use].op1_type = IS_CV;
1053 op_array->opcodes[use].op1.var = cv;
1054 } else if (ssa->ops[use].op2_use == result_var) {
1055 ssa->ops[use].op2_use = cv_var;
1056 ssa->ops[use].op2_use_chain = ssa->vars[cv_var].use_chain;
1057 ssa->vars[cv_var].use_chain = use;
1058
1059 op_array->opcodes[use].op2_type = IS_CV;
1060 op_array->opcodes[use].op2.var = cv;
1061 } else if (ssa->ops[use].result_use == result_var) {
1062 ssa->ops[use].result_use = cv_var;
1063 ssa->ops[use].res_use_chain = ssa->vars[cv_var].use_chain;
1064 ssa->vars[cv_var].use_chain = use;
1065
1066 op_array->opcodes[use].result_type = IS_CV;
1067 op_array->opcodes[use].result.var = cv;
1068 }
1069
1070 return 1;
1071 }
1072 }
1073 }
1074
1075 return 0;
1076 }
1077
zend_dfa_optimize_op_array(zend_op_array * op_array,zend_optimizer_ctx * ctx,zend_ssa * ssa,zend_call_info ** call_map)1078 void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa, zend_call_info **call_map)
1079 {
1080 if (ctx->debug_level & ZEND_DUMP_BEFORE_DFA_PASS) {
1081 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "before dfa pass", ssa);
1082 }
1083
1084 if (ssa->var_info) {
1085 int op_1;
1086 int v;
1087 int remove_nops = 0;
1088 zend_op *opline;
1089 zend_ssa_op *ssa_op;
1090 zval tmp;
1091
1092 #if ZEND_DEBUG_DFA
1093 ssa_verify_integrity(op_array, ssa, "before dfa");
1094 #endif
1095
1096 if (ZEND_OPTIMIZER_PASS_8 & ctx->optimization_level) {
1097 if (sccp_optimize_op_array(ctx, op_array, ssa, call_map)) {
1098 remove_nops = 1;
1099 }
1100
1101 if (zend_dfa_optimize_jmps(op_array, ssa)) {
1102 remove_nops = 1;
1103 }
1104
1105 #if ZEND_DEBUG_DFA
1106 ssa_verify_integrity(op_array, ssa, "after sccp");
1107 #endif
1108 if (ZEND_FUNC_INFO(op_array)) {
1109 if (zend_dfa_optimize_calls(op_array, ssa)) {
1110 remove_nops = 1;
1111 }
1112 }
1113 if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_8) {
1114 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after sccp pass", ssa);
1115 }
1116 #if ZEND_DEBUG_DFA
1117 ssa_verify_integrity(op_array, ssa, "after calls");
1118 #endif
1119 }
1120
1121 if (ZEND_OPTIMIZER_PASS_14 & ctx->optimization_level) {
1122 if (dce_optimize_op_array(op_array, ctx, ssa, 0)) {
1123 remove_nops = 1;
1124 }
1125 if (zend_dfa_optimize_jmps(op_array, ssa)) {
1126 remove_nops = 1;
1127 }
1128 if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_14) {
1129 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after dce pass", ssa);
1130 }
1131 #if ZEND_DEBUG_DFA
1132 ssa_verify_integrity(op_array, ssa, "after dce");
1133 #endif
1134 }
1135
1136 for (v = op_array->last_var; v < ssa->vars_count; v++) {
1137
1138 op_1 = ssa->vars[v].definition;
1139
1140 if (op_1 < 0) {
1141 continue;
1142 }
1143
1144 opline = op_array->opcodes + op_1;
1145 ssa_op = &ssa->ops[op_1];
1146
1147 /* Convert LONG constants to DOUBLE */
1148 if (ssa->var_info[v].use_as_double) {
1149 if (opline->opcode == ZEND_ASSIGN
1150 && opline->op2_type == IS_CONST
1151 && ssa->ops[op_1].op1_def == v
1152 && !RETURN_VALUE_USED(opline)
1153 ) {
1154
1155 // op_1: ASSIGN ? -> #v [use_as_double], long(?) => ASSIGN ? -> #v, double(?)
1156
1157 zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1158 ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
1159 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1160 opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
1161
1162 } else if (opline->opcode == ZEND_QM_ASSIGN
1163 && opline->op1_type == IS_CONST
1164 ) {
1165
1166 // op_1: QM_ASSIGN #v [use_as_double], long(?) => QM_ASSIGN #v, double(?)
1167
1168 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1169 ZEND_ASSERT(Z_TYPE_INFO_P(zv) == IS_LONG);
1170 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1171 opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
1172 }
1173
1174 } else {
1175 if (opline->opcode == ZEND_ADD
1176 || opline->opcode == ZEND_SUB
1177 || opline->opcode == ZEND_MUL
1178 || opline->opcode == ZEND_IS_EQUAL
1179 || opline->opcode == ZEND_IS_NOT_EQUAL
1180 || opline->opcode == ZEND_IS_SMALLER
1181 || opline->opcode == ZEND_IS_SMALLER_OR_EQUAL
1182 ) {
1183
1184 if (opline->op1_type == IS_CONST && opline->op2_type != IS_CONST) {
1185 zval *zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1186
1187 if ((OP2_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
1188 && Z_TYPE_INFO_P(zv) == IS_LONG) {
1189
1190 // op_1: #v.? = ADD long(?), #?.? [double] => #v.? = ADD double(?), #?.? [double]
1191
1192 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1193 opline->op1.constant = zend_optimizer_add_literal(op_array, &tmp);
1194 zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1195 }
1196 if (opline->opcode == ZEND_ADD) {
1197 zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1198
1199 if (((OP2_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG
1200 && Z_TYPE_INFO_P(zv) == IS_LONG
1201 && Z_LVAL_P(zv) == 0)
1202 || ((OP2_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_DOUBLE
1203 && Z_TYPE_INFO_P(zv) == IS_DOUBLE
1204 && Z_DVAL_P(zv) == 0.0)) {
1205
1206 // op_1: #v.? = ADD 0, #?.? [double,long] => #v.? = QM_ASSIGN #?.?
1207
1208 opline->opcode = ZEND_QM_ASSIGN;
1209 opline->op1_type = opline->op2_type;
1210 opline->op1.var = opline->op2.var;
1211 opline->op2_type = IS_UNUSED;
1212 opline->op2.num = 0;
1213 ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1214 ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1215 ssa->ops[op_1].op2_use = -1;
1216 ssa->ops[op_1].op2_use_chain = -1;
1217 }
1218 } else if (opline->opcode == ZEND_MUL
1219 && (OP2_INFO() & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1220 zv = CT_CONSTANT_EX(op_array, opline->op1.constant);
1221
1222 if ((Z_TYPE_INFO_P(zv) == IS_LONG
1223 && Z_LVAL_P(zv) == 2)
1224 || (Z_TYPE_INFO_P(zv) == IS_DOUBLE
1225 && Z_DVAL_P(zv) == 2.0
1226 && !(OP2_INFO() & MAY_BE_LONG))) {
1227
1228 // op_1: #v.? = MUL 2, #x.? [double,long] => #v.? = ADD #x.?, #x.?
1229
1230 opline->opcode = ZEND_ADD;
1231 opline->op1_type = opline->op2_type;
1232 opline->op1.var = opline->op2.var;
1233 ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1234 ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1235 }
1236 }
1237 } else if (opline->op1_type != IS_CONST && opline->op2_type == IS_CONST) {
1238 zval *zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1239
1240 if ((OP1_INFO() & MAY_BE_ANY) == MAY_BE_DOUBLE
1241 && Z_TYPE_INFO_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG) {
1242
1243 // op_1: #v.? = ADD #?.? [double], long(?) => #v.? = ADD #?.? [double], double(?)
1244
1245 ZVAL_DOUBLE(&tmp, zval_get_double(zv));
1246 opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
1247 zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1248 }
1249 if (opline->opcode == ZEND_ADD || opline->opcode == ZEND_SUB) {
1250 if (((OP1_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_LONG
1251 && Z_TYPE_INFO_P(zv) == IS_LONG
1252 && Z_LVAL_P(zv) == 0)
1253 || ((OP1_INFO() & (MAY_BE_ANY|MAY_BE_UNDEF)) == MAY_BE_DOUBLE
1254 && Z_TYPE_INFO_P(zv) == IS_DOUBLE
1255 && Z_DVAL_P(zv) == 0.0)) {
1256
1257 // op_1: #v.? = ADD #?.? [double,long], 0 => #v.? = QM_ASSIGN #?.?
1258
1259 opline->opcode = ZEND_QM_ASSIGN;
1260 opline->op2_type = IS_UNUSED;
1261 opline->op2.num = 0;
1262 }
1263 } else if (opline->opcode == ZEND_MUL
1264 && (OP1_INFO() & ((MAY_BE_ANY|MAY_BE_UNDEF)-(MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1265 zv = CT_CONSTANT_EX(op_array, opline->op2.constant);
1266
1267 if ((Z_TYPE_INFO_P(zv) == IS_LONG
1268 && Z_LVAL_P(zv) == 2)
1269 || (Z_TYPE_INFO_P(zv) == IS_DOUBLE
1270 && Z_DVAL_P(zv) == 2.0
1271 && !(OP1_INFO() & MAY_BE_LONG))) {
1272
1273 // op_1: #v.? = MUL #x.? [double,long], 2 => #v.? = ADD #x.?, #x.?
1274
1275 opline->opcode = ZEND_ADD;
1276 opline->op2_type = opline->op1_type;
1277 opline->op2.var = opline->op1.var;
1278 ssa->ops[op_1].op2_use = ssa->ops[op_1].op1_use;
1279 ssa->ops[op_1].op2_use_chain = ssa->ops[op_1].op1_use_chain;
1280 }
1281 }
1282 }
1283 } else if (opline->opcode == ZEND_CONCAT) {
1284 if (!(OP1_INFO() & MAY_BE_OBJECT)
1285 && !(OP2_INFO() & MAY_BE_OBJECT)) {
1286 opline->opcode = ZEND_FAST_CONCAT;
1287 }
1288 } else if (opline->opcode == ZEND_VERIFY_RETURN_TYPE
1289 && opline->op1_type != IS_CONST
1290 && ssa->ops[op_1].op1_def == v
1291 && ssa->ops[op_1].op1_use >= 0) {
1292 int orig_var = ssa->ops[op_1].op1_use;
1293 int ret = ssa->vars[v].use_chain;
1294
1295 if (ssa->ops[op_1].op1_use_chain == -1
1296 && can_elide_return_type_check(ctx->script, op_array, ssa, &ssa->ops[op_1])) {
1297
1298 // op_1: VERIFY_RETURN_TYPE #orig_var.? [T] -> #v.? [T] => NOP
1299
1300 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1301
1302 if (ret >= 0) {
1303 ssa->ops[ret].op1_use = orig_var;
1304 ssa->ops[ret].op1_use_chain = ssa->vars[orig_var].use_chain;
1305 ssa->vars[orig_var].use_chain = ret;
1306 }
1307
1308 ssa->vars[v].definition = -1;
1309 ssa->vars[v].use_chain = -1;
1310
1311 ssa->ops[op_1].op1_def = -1;
1312 ssa->ops[op_1].op1_use = -1;
1313
1314 MAKE_NOP(opline);
1315 remove_nops = 1;
1316 } else if (ret >= 0
1317 && ssa->ops[ret].op1_use == v
1318 && ssa->ops[ret].op1_use_chain == -1
1319 && can_elide_return_type_check(ctx->script, op_array, ssa, &ssa->ops[op_1])) {
1320
1321 // op_1: VERIFY_RETURN_TYPE #orig_var.? [T] -> #v.? [T] => NOP
1322
1323 zend_ssa_replace_use_chain(ssa, op_1, ret, orig_var);
1324
1325 ssa->ops[ret].op1_use = orig_var;
1326 ssa->ops[ret].op1_use_chain = ssa->ops[op_1].op1_use_chain;
1327
1328 ssa->vars[v].definition = -1;
1329 ssa->vars[v].use_chain = -1;
1330
1331 ssa->ops[op_1].op1_def = -1;
1332 ssa->ops[op_1].op1_use = -1;
1333
1334 MAKE_NOP(opline);
1335 remove_nops = 1;
1336 }
1337 }
1338 }
1339
1340 if (opline->opcode == ZEND_QM_ASSIGN
1341 && ssa->ops[op_1].result_def == v
1342 && opline->op1_type & (IS_TMP_VAR|IS_VAR)
1343 && !(ssa->var_info[v].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1344 ) {
1345
1346 int src_var = ssa->ops[op_1].op1_use;
1347
1348 if (src_var >= 0
1349 && !(ssa->var_info[src_var].type & MAY_BE_REF)
1350 && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
1351 && ssa->vars[src_var].definition >= 0
1352 && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
1353 && ssa->ops[ssa->vars[src_var].definition].result_use < 0
1354 && ssa->vars[src_var].use_chain == op_1
1355 && ssa->ops[op_1].op1_use_chain < 0
1356 && !ssa->vars[src_var].phi_use_chain
1357 && !ssa->vars[src_var].sym_use_chain
1358 && opline_supports_assign_contraction(
1359 op_array, ssa, &op_array->opcodes[ssa->vars[src_var].definition],
1360 src_var, opline->result.var)
1361 && !variable_defined_or_used_in_range(ssa, EX_VAR_TO_NUM(opline->result.var),
1362 ssa->vars[src_var].definition+1, op_1)
1363 ) {
1364
1365 int orig_var = ssa->ops[op_1].result_use;
1366 int op_2 = ssa->vars[src_var].definition;
1367
1368 // op_2: #src_var.T = OP ... => #v.CV = OP ...
1369 // op_1: QM_ASSIGN #src_var.T #orig_var.CV [undef,scalar] -> #v.CV, NOP
1370
1371 if (orig_var >= 0) {
1372 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1373 }
1374
1375 /* Reconstruct SSA */
1376 ssa->vars[v].definition = op_2;
1377 ssa->ops[op_2].result_def = v;
1378
1379 ssa->vars[src_var].definition = -1;
1380 ssa->vars[src_var].use_chain = -1;
1381
1382 ssa->ops[op_1].op1_use = -1;
1383 ssa->ops[op_1].op1_def = -1;
1384 ssa->ops[op_1].op1_use_chain = -1;
1385 ssa->ops[op_1].result_use = -1;
1386 ssa->ops[op_1].result_def = -1;
1387 ssa->ops[op_1].res_use_chain = -1;
1388
1389 /* Update opcodes */
1390 op_array->opcodes[op_2].result_type = opline->result_type;
1391 op_array->opcodes[op_2].result.var = opline->result.var;
1392
1393 MAKE_NOP(opline);
1394 remove_nops = 1;
1395
1396 if (op_array->opcodes[op_2].opcode == ZEND_SUB
1397 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1398 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1399 && op_array->opcodes[op_2].op2_type == IS_CONST
1400 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1401 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1402 && ssa->ops[op_2].op1_use >= 0
1403 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1404
1405 op_array->opcodes[op_2].opcode = ZEND_PRE_DEC;
1406 SET_UNUSED(op_array->opcodes[op_2].op2);
1407 SET_UNUSED(op_array->opcodes[op_2].result);
1408
1409 ssa->ops[op_2].result_def = -1;
1410 ssa->ops[op_2].op1_def = v;
1411
1412 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1413 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1414 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1415 && op_array->opcodes[op_2].op2_type == IS_CONST
1416 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1417 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1418 && ssa->ops[op_2].op1_use >= 0
1419 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1420
1421 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1422 SET_UNUSED(op_array->opcodes[op_2].op2);
1423 SET_UNUSED(op_array->opcodes[op_2].result);
1424
1425 ssa->ops[op_2].result_def = -1;
1426 ssa->ops[op_2].op1_def = v;
1427
1428 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1429 && op_array->opcodes[op_2].op2_type == op_array->opcodes[op_2].result_type
1430 && op_array->opcodes[op_2].op2.var == op_array->opcodes[op_2].result.var
1431 && op_array->opcodes[op_2].op1_type == IS_CONST
1432 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == IS_LONG
1433 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == 1
1434 && ssa->ops[op_2].op2_use >= 0
1435 && !(ssa->var_info[ssa->ops[op_2].op2_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1436
1437 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1438 op_array->opcodes[op_2].op1_type = op_array->opcodes[op_2].op2_type;
1439 op_array->opcodes[op_2].op1.var = op_array->opcodes[op_2].op2.var;
1440 SET_UNUSED(op_array->opcodes[op_2].op2);
1441 SET_UNUSED(op_array->opcodes[op_2].result);
1442
1443 ssa->ops[op_2].result_def = -1;
1444 ssa->ops[op_2].op1_def = v;
1445 ssa->ops[op_2].op1_use = ssa->ops[op_2].op2_use;
1446 ssa->ops[op_2].op1_use_chain = ssa->ops[op_2].op2_use_chain;
1447 ssa->ops[op_2].op2_use = -1;
1448 ssa->ops[op_2].op2_use_chain = -1;
1449 }
1450 }
1451 }
1452
1453 if (ssa->vars[v].var >= op_array->last_var) {
1454 /* skip TMP and VAR */
1455 continue;
1456 }
1457
1458 if (ssa->ops[op_1].op1_def == v
1459 && RETURN_VALUE_USED(opline)) {
1460 if (opline->opcode == ZEND_ASSIGN
1461 || opline->opcode == ZEND_ASSIGN_OP
1462 || opline->opcode == ZEND_PRE_INC
1463 || opline->opcode == ZEND_PRE_DEC) {
1464 zend_dfa_try_to_replace_result(op_array, ssa, op_1, v);
1465 } else if (opline->opcode == ZEND_POST_INC) {
1466 int result_var = ssa->ops[op_1].result_def;
1467
1468 if (result_var >= 0
1469 && (ssa->var_info[result_var].type & ((MAY_BE_ANY|MAY_BE_REF|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1470 int use = ssa->vars[result_var].use_chain;
1471
1472 if (use >= 0 && op_array->opcodes[use].opcode == ZEND_IS_SMALLER
1473 && ssa->ops[use].op1_use == result_var
1474 && zend_dfa_try_to_replace_result(op_array, ssa, op_1, v)) {
1475 opline->opcode = ZEND_PRE_INC;
1476 op_array->opcodes[use].opcode = ZEND_IS_SMALLER_OR_EQUAL;
1477 }
1478 }
1479 } else if (opline->opcode == ZEND_POST_DEC) {
1480 int result_var = ssa->ops[op_1].result_def;
1481
1482 if (result_var >= 0
1483 && (ssa->var_info[result_var].type & ((MAY_BE_ANY|MAY_BE_REF|MAY_BE_UNDEF) - (MAY_BE_LONG|MAY_BE_DOUBLE))) == 0) {
1484 int use = ssa->vars[result_var].use_chain;
1485
1486 if (use >= 0 && op_array->opcodes[use].opcode == ZEND_IS_SMALLER
1487 && ssa->ops[use].op2_use == result_var
1488 && zend_dfa_try_to_replace_result(op_array, ssa, op_1, v)) {
1489 opline->opcode = ZEND_PRE_DEC;
1490 op_array->opcodes[use].opcode = ZEND_IS_SMALLER_OR_EQUAL;
1491 }
1492 }
1493 }
1494 }
1495
1496 if (opline->opcode == ZEND_ASSIGN
1497 && ssa->ops[op_1].op1_def == v
1498 && !RETURN_VALUE_USED(opline)
1499 ) {
1500 int orig_var = ssa->ops[op_1].op1_use;
1501
1502 if (orig_var >= 0
1503 && !(ssa->var_info[orig_var].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1504 ) {
1505 int src_var = ssa->ops[op_1].op2_use;
1506
1507 if ((opline->op2_type & (IS_TMP_VAR|IS_VAR))
1508 && src_var >= 0
1509 && !(ssa->var_info[src_var].type & MAY_BE_REF)
1510 && (ssa->var_info[src_var].type & (MAY_BE_UNDEF|MAY_BE_ANY))
1511 && ssa->vars[src_var].definition >= 0
1512 && ssa->ops[ssa->vars[src_var].definition].result_def == src_var
1513 && ssa->ops[ssa->vars[src_var].definition].result_use < 0
1514 && ssa->vars[src_var].use_chain == op_1
1515 && ssa->ops[op_1].op2_use_chain < 0
1516 && !ssa->vars[src_var].phi_use_chain
1517 && !ssa->vars[src_var].sym_use_chain
1518 && opline_supports_assign_contraction(
1519 op_array, ssa, &op_array->opcodes[ssa->vars[src_var].definition],
1520 src_var, opline->op1.var)
1521 && !variable_defined_or_used_in_range(ssa, EX_VAR_TO_NUM(opline->op1.var),
1522 ssa->vars[src_var].definition+1, op_1)
1523 ) {
1524
1525 int op_2 = ssa->vars[src_var].definition;
1526
1527 // op_2: #src_var.T = OP ... => #v.CV = OP ...
1528 // op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, #src_var.T NOP
1529
1530 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1531 /* Reconstruct SSA */
1532 ssa->vars[v].definition = op_2;
1533 ssa->ops[op_2].result_def = v;
1534
1535 ssa->vars[src_var].definition = -1;
1536 ssa->vars[src_var].use_chain = -1;
1537
1538 ssa->ops[op_1].op1_use = -1;
1539 ssa->ops[op_1].op2_use = -1;
1540 ssa->ops[op_1].op1_def = -1;
1541 ssa->ops[op_1].op1_use_chain = -1;
1542
1543 /* Update opcodes */
1544 op_array->opcodes[op_2].result_type = opline->op1_type;
1545 op_array->opcodes[op_2].result.var = opline->op1.var;
1546
1547 MAKE_NOP(opline);
1548 remove_nops = 1;
1549
1550 if (op_array->opcodes[op_2].opcode == ZEND_SUB
1551 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1552 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1553 && op_array->opcodes[op_2].op2_type == IS_CONST
1554 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1555 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1556 && ssa->ops[op_2].op1_use >= 0
1557 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1558
1559 op_array->opcodes[op_2].opcode = ZEND_PRE_DEC;
1560 SET_UNUSED(op_array->opcodes[op_2].op2);
1561 SET_UNUSED(op_array->opcodes[op_2].result);
1562
1563 ssa->ops[op_2].result_def = -1;
1564 ssa->ops[op_2].op1_def = v;
1565
1566 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1567 && op_array->opcodes[op_2].op1_type == op_array->opcodes[op_2].result_type
1568 && op_array->opcodes[op_2].op1.var == op_array->opcodes[op_2].result.var
1569 && op_array->opcodes[op_2].op2_type == IS_CONST
1570 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == IS_LONG
1571 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op2.constant)) == 1
1572 && ssa->ops[op_2].op1_use >= 0
1573 && !(ssa->var_info[ssa->ops[op_2].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1574
1575 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1576 SET_UNUSED(op_array->opcodes[op_2].op2);
1577 SET_UNUSED(op_array->opcodes[op_2].result);
1578
1579 ssa->ops[op_2].result_def = -1;
1580 ssa->ops[op_2].op1_def = v;
1581
1582 } else if (op_array->opcodes[op_2].opcode == ZEND_ADD
1583 && op_array->opcodes[op_2].op2_type == op_array->opcodes[op_2].result_type
1584 && op_array->opcodes[op_2].op2.var == op_array->opcodes[op_2].result.var
1585 && op_array->opcodes[op_2].op1_type == IS_CONST
1586 && Z_TYPE_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == IS_LONG
1587 && Z_LVAL_P(CT_CONSTANT_EX(op_array, op_array->opcodes[op_2].op1.constant)) == 1
1588 && ssa->ops[op_2].op2_use >= 0
1589 && !(ssa->var_info[ssa->ops[op_2].op2_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1590
1591 op_array->opcodes[op_2].opcode = ZEND_PRE_INC;
1592 op_array->opcodes[op_2].op1_type = op_array->opcodes[op_2].op2_type;
1593 op_array->opcodes[op_2].op1.var = op_array->opcodes[op_2].op2.var;
1594 SET_UNUSED(op_array->opcodes[op_2].op2);
1595 SET_UNUSED(op_array->opcodes[op_2].result);
1596
1597 ssa->ops[op_2].result_def = -1;
1598 ssa->ops[op_2].op1_def = v;
1599 ssa->ops[op_2].op1_use = ssa->ops[op_2].op2_use;
1600 ssa->ops[op_2].op1_use_chain = ssa->ops[op_2].op2_use_chain;
1601 ssa->ops[op_2].op2_use = -1;
1602 ssa->ops[op_2].op2_use_chain = -1;
1603 }
1604 } else if (opline->op2_type == IS_CONST
1605 || ((opline->op2_type & (IS_TMP_VAR|IS_VAR|IS_CV))
1606 && ssa->ops[op_1].op2_use >= 0
1607 && ssa->ops[op_1].op2_def < 0)
1608 ) {
1609
1610 // op_1: ASSIGN #orig_var.CV [undef,scalar] -> #v.CV, CONST|TMPVAR => QM_ASSIGN v.CV, CONST|TMPVAR
1611
1612 if (ssa->ops[op_1].op1_use != ssa->ops[op_1].op2_use) {
1613 zend_ssa_unlink_use_chain(ssa, op_1, orig_var);
1614 } else {
1615 ssa->ops[op_1].op2_use_chain = ssa->ops[op_1].op1_use_chain;
1616 }
1617
1618 /* Reconstruct SSA */
1619 ssa->ops[op_1].result_def = v;
1620 ssa->ops[op_1].op1_def = -1;
1621 ssa->ops[op_1].op1_use = ssa->ops[op_1].op2_use;
1622 ssa->ops[op_1].op1_use_chain = ssa->ops[op_1].op2_use_chain;
1623 ssa->ops[op_1].op2_use = -1;
1624 ssa->ops[op_1].op2_use_chain = -1;
1625
1626 /* Update opcode */
1627 opline->result_type = opline->op1_type;
1628 opline->result.var = opline->op1.var;
1629 opline->op1_type = opline->op2_type;
1630 opline->op1.var = opline->op2.var;
1631 opline->op2_type = IS_UNUSED;
1632 opline->op2.var = 0;
1633 opline->opcode = ZEND_QM_ASSIGN;
1634 }
1635 }
1636
1637 } else if (opline->opcode == ZEND_ASSIGN_OP
1638 && opline->extended_value == ZEND_ADD
1639 && ssa->ops[op_1].op1_def == v
1640 && opline->op2_type == IS_CONST
1641 && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
1642 && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
1643 && ssa->ops[op_1].op1_use >= 0
1644 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1645
1646 // op_1: ASSIGN_ADD #?.CV [undef,null,int,foat] ->#v.CV, int(1) => PRE_INC #?.CV ->#v.CV
1647
1648 opline->opcode = ZEND_PRE_INC;
1649 opline->extended_value = 0;
1650 SET_UNUSED(opline->op2);
1651
1652 } else if (opline->opcode == ZEND_ASSIGN_OP
1653 && opline->extended_value == ZEND_SUB
1654 && ssa->ops[op_1].op1_def == v
1655 && opline->op2_type == IS_CONST
1656 && Z_TYPE_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == IS_LONG
1657 && Z_LVAL_P(CT_CONSTANT_EX(op_array, opline->op2.constant)) == 1
1658 && ssa->ops[op_1].op1_use >= 0
1659 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_UNDEF|MAY_BE_NULL|MAY_BE_FALSE|MAY_BE_TRUE|MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))) {
1660
1661 // op_1: ASSIGN_SUB #?.CV [undef,null,int,foat] -> #v.CV, int(1) => PRE_DEC #?.CV ->#v.CV
1662
1663 opline->opcode = ZEND_PRE_DEC;
1664 opline->extended_value = 0;
1665 SET_UNUSED(opline->op2);
1666
1667 } else if (ssa->ops[op_1].op1_def == v
1668 && !RETURN_VALUE_USED(opline)
1669 && ssa->ops[op_1].op1_use >= 0
1670 && !(ssa->var_info[ssa->ops[op_1].op1_use].type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF))
1671 && opline->opcode == ZEND_ASSIGN_OP
1672 && opline->extended_value != ZEND_CONCAT) {
1673
1674 // op_1: ASSIGN_OP #orig_var.CV [undef,null,bool,int,double] -> #v.CV, ? => #v.CV = ADD #orig_var.CV, ?
1675
1676 /* Reconstruct SSA */
1677 ssa->ops[op_1].result_def = ssa->ops[op_1].op1_def;
1678 ssa->ops[op_1].op1_def = -1;
1679
1680 /* Update opcode */
1681 opline->opcode = opline->extended_value;
1682 opline->extended_value = 0;
1683 opline->result_type = opline->op1_type;
1684 opline->result.var = opline->op1.var;
1685
1686 }
1687 }
1688
1689 #if ZEND_DEBUG_DFA
1690 ssa_verify_integrity(op_array, ssa, "after dfa");
1691 #endif
1692
1693 if (remove_nops) {
1694 zend_ssa_remove_nops(op_array, ssa, ctx);
1695 #if ZEND_DEBUG_DFA
1696 ssa_verify_integrity(op_array, ssa, "after nop");
1697 #endif
1698 }
1699 }
1700
1701 if (ctx->debug_level & ZEND_DUMP_AFTER_DFA_PASS) {
1702 zend_dump_op_array(op_array, ZEND_DUMP_SSA, "after dfa pass", ssa);
1703 }
1704 }
1705
zend_optimize_dfa(zend_op_array * op_array,zend_optimizer_ctx * ctx)1706 void zend_optimize_dfa(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1707 {
1708 void *checkpoint = zend_arena_checkpoint(ctx->arena);
1709 zend_ssa ssa;
1710
1711 if (zend_dfa_analyze_op_array(op_array, ctx, &ssa) == FAILURE) {
1712 zend_arena_release(&ctx->arena, checkpoint);
1713 return;
1714 }
1715
1716 zend_dfa_optimize_op_array(op_array, ctx, &ssa, NULL);
1717
1718 /* Destroy SSA */
1719 zend_arena_release(&ctx->arena, checkpoint);
1720 }
1721
