xref: /php-src/Zend/Optimizer/zend_optimizer.c (revision 56cf09f2)
1 /*
2    +----------------------------------------------------------------------+
3    | Zend OPcache                                                         |
4    +----------------------------------------------------------------------+
5    | Copyright (c) The PHP Group                                          |
6    +----------------------------------------------------------------------+
7    | This source file is subject to version 3.01 of the PHP license,      |
8    | that is bundled with this package in the file LICENSE, and is        |
9    | available through the world-wide-web at the following url:           |
10    | https://www.php.net/license/3_01.txt                                 |
11    | If you did not receive a copy of the PHP license and are unable to   |
12    | obtain it through the world-wide-web, please send a note to          |
13    | license@php.net so we can mail you a copy immediately.               |
14    +----------------------------------------------------------------------+
15    | Authors: Andi Gutmans <andi@php.net>                                 |
16    |          Zeev Suraski <zeev@php.net>                                 |
17    |          Stanislav Malyshev <stas@zend.com>                          |
18    |          Dmitry Stogov <dmitry@php.net>                              |
19    +----------------------------------------------------------------------+
20 */
21 
22 #include "Optimizer/zend_optimizer.h"
23 #include "Optimizer/zend_optimizer_internal.h"
24 #include "zend_API.h"
25 #include "zend_constants.h"
26 #include "zend_execute.h"
27 #include "zend_vm.h"
28 #include "zend_cfg.h"
29 #include "zend_func_info.h"
30 #include "zend_call_graph.h"
31 #include "zend_inference.h"
32 #include "zend_dump.h"
33 #include "php.h"
34 #include "zend_observer.h"
35 
36 #ifndef ZEND_OPTIMIZER_MAX_REGISTERED_PASSES
37 # define ZEND_OPTIMIZER_MAX_REGISTERED_PASSES 32
38 #endif
39 
40 struct {
41 	zend_optimizer_pass_t pass[ZEND_OPTIMIZER_MAX_REGISTERED_PASSES];
42 	int last;
43 } zend_optimizer_registered_passes = {{NULL}, 0};
44 
zend_optimizer_collect_constant(zend_optimizer_ctx * ctx,zval * name,zval * value)45 void zend_optimizer_collect_constant(zend_optimizer_ctx *ctx, zval *name, zval* value)
46 {
47 	if (!ctx->constants) {
48 		ctx->constants = zend_arena_alloc(&ctx->arena, sizeof(HashTable));
49 		zend_hash_init(ctx->constants, 16, NULL, zval_ptr_dtor_nogc, 0);
50 	}
51 
52 	if (zend_hash_add(ctx->constants, Z_STR_P(name), value)) {
53 		Z_TRY_ADDREF_P(value);
54 	}
55 }
56 
zend_optimizer_eval_binary_op(zval * result,uint8_t opcode,zval * op1,zval * op2)57 zend_result zend_optimizer_eval_binary_op(zval *result, uint8_t opcode, zval *op1, zval *op2) /* {{{ */
58 {
59 	if (zend_binary_op_produces_error(opcode, op1, op2)) {
60 		return FAILURE;
61 	}
62 
63 	binary_op_type binary_op = get_binary_op(opcode);
64 	return binary_op(result, op1, op2);
65 }
66 /* }}} */
67 
zend_optimizer_eval_unary_op(zval * result,uint8_t opcode,zval * op1)68 zend_result zend_optimizer_eval_unary_op(zval *result, uint8_t opcode, zval *op1) /* {{{ */
69 {
70 	unary_op_type unary_op = get_unary_op(opcode);
71 
72 	if (unary_op) {
73 		if (zend_unary_op_produces_error(opcode, op1)) {
74 			return FAILURE;
75 		}
76 		return unary_op(result, op1);
77 	} else { /* ZEND_BOOL */
78 		ZVAL_BOOL(result, zend_is_true(op1));
79 		return SUCCESS;
80 	}
81 }
82 /* }}} */
83 
zend_optimizer_eval_cast(zval * result,uint32_t type,zval * op1)84 zend_result zend_optimizer_eval_cast(zval *result, uint32_t type, zval *op1) /* {{{ */
85 {
86 	switch (type) {
87 		case IS_NULL:
88 			ZVAL_NULL(result);
89 			return SUCCESS;
90 		case _IS_BOOL:
91 			ZVAL_BOOL(result, zval_is_true(op1));
92 			return SUCCESS;
93 		case IS_LONG:
94 			ZVAL_LONG(result, zval_get_long(op1));
95 			return SUCCESS;
96 		case IS_DOUBLE:
97 			ZVAL_DOUBLE(result, zval_get_double(op1));
98 			return SUCCESS;
99 		case IS_STRING:
100 			/* Conversion from double to string takes into account run-time
101 			   'precision' setting and cannot be evaluated at compile-time */
102 			if (Z_TYPE_P(op1) != IS_ARRAY && Z_TYPE_P(op1) != IS_DOUBLE) {
103 				ZVAL_STR(result, zval_get_string(op1));
104 				return SUCCESS;
105 			}
106 			break;
107 		case IS_ARRAY:
108 			ZVAL_COPY(result, op1);
109 			convert_to_array(result);
110 			return SUCCESS;
111 	}
112 	return FAILURE;
113 }
114 /* }}} */
115 
zend_optimizer_eval_strlen(zval * result,const zval * op1)116 zend_result zend_optimizer_eval_strlen(zval *result, const zval *op1) /* {{{ */
117 {
118 	if (Z_TYPE_P(op1) != IS_STRING) {
119 		return FAILURE;
120 	}
121 	ZVAL_LONG(result, Z_STRLEN_P(op1));
122 	return SUCCESS;
123 }
124 /* }}} */
125 
zend_optimizer_eval_special_func_call(zval * result,zend_string * name,zend_string * arg)126 zend_result zend_optimizer_eval_special_func_call(
127 		zval *result, zend_string *name, zend_string *arg) {
128 	if (zend_string_equals_literal(name, "function_exists") ||
129 			zend_string_equals_literal(name, "is_callable")) {
130 		zend_string *lc_name = zend_string_tolower(arg);
131 		zend_internal_function *func = zend_hash_find_ptr(EG(function_table), lc_name);
132 		zend_string_release_ex(lc_name, 0);
133 
134 		if (func && func->type == ZEND_INTERNAL_FUNCTION
135 				&& func->module->type == MODULE_PERSISTENT
136 #ifdef ZEND_WIN32
137 				&& func->module->handle == NULL
138 #endif
139 		) {
140 			ZVAL_TRUE(result);
141 			return SUCCESS;
142 		}
143 		return FAILURE;
144 	}
145 	if (zend_string_equals_literal(name, "extension_loaded")) {
146 		zend_string *lc_name = zend_string_tolower(arg);
147 		zend_module_entry *m = zend_hash_find_ptr(&module_registry, lc_name);
148 		zend_string_release_ex(lc_name, 0);
149 
150 		if (!m) {
151 			if (PG(enable_dl)) {
152 				return FAILURE;
153 			}
154 			ZVAL_FALSE(result);
155 			return SUCCESS;
156 		}
157 
158 		if (m->type == MODULE_PERSISTENT
159 #ifdef ZEND_WIN32
160 			&& m->handle == NULL
161 #endif
162 		) {
163 			ZVAL_TRUE(result);
164 			return SUCCESS;
165 		}
166 		return FAILURE;
167 	}
168 	if (zend_string_equals_literal(name, "constant")) {
169 		return zend_optimizer_get_persistent_constant(arg, result, 1) ? SUCCESS : FAILURE;
170 	}
171 	if (zend_string_equals_literal(name, "dirname")) {
172 		if (!IS_ABSOLUTE_PATH(ZSTR_VAL(arg), ZSTR_LEN(arg))) {
173 			return FAILURE;
174 		}
175 
176 		zend_string *dirname = zend_string_init(ZSTR_VAL(arg), ZSTR_LEN(arg), 0);
177 		ZSTR_LEN(dirname) = zend_dirname(ZSTR_VAL(dirname), ZSTR_LEN(dirname));
178 		if (IS_ABSOLUTE_PATH(ZSTR_VAL(dirname), ZSTR_LEN(dirname))) {
179 			ZVAL_STR(result, dirname);
180 			return SUCCESS;
181 		}
182 		zend_string_release_ex(dirname, 0);
183 		return FAILURE;
184 	}
185 	if (zend_string_equals_literal(name, "ini_get")) {
186 		zend_ini_entry *ini_entry = zend_hash_find_ptr(EG(ini_directives), arg);
187 		if (!ini_entry) {
188 			if (PG(enable_dl)) {
189 				return FAILURE;
190 			}
191 			ZVAL_FALSE(result);
192 		} else if (ini_entry->modifiable != ZEND_INI_SYSTEM) {
193 			return FAILURE;
194 		} else if (ini_entry->value) {
195 			ZVAL_STR_COPY(result, ini_entry->value);
196 		} else {
197 			ZVAL_EMPTY_STRING(result);
198 		}
199 		return SUCCESS;
200 	}
201 	return FAILURE;
202 }
203 
zend_optimizer_get_collected_constant(HashTable * constants,zval * name,zval * value)204 bool zend_optimizer_get_collected_constant(HashTable *constants, zval *name, zval* value)
205 {
206 	zval *val;
207 
208 	if ((val = zend_hash_find(constants, Z_STR_P(name))) != NULL) {
209 		ZVAL_COPY(value, val);
210 		return 1;
211 	}
212 	return 0;
213 }
214 
zend_optimizer_convert_to_free_op1(zend_op_array * op_array,zend_op * opline)215 void zend_optimizer_convert_to_free_op1(zend_op_array *op_array, zend_op *opline)
216 {
217 	if (opline->op1_type == IS_CV) {
218 		opline->opcode = ZEND_CHECK_VAR;
219 		SET_UNUSED(opline->op2);
220 		SET_UNUSED(opline->result);
221 		opline->extended_value = 0;
222 	} else if (opline->op1_type & (IS_TMP_VAR|IS_VAR)) {
223 		opline->opcode = ZEND_FREE;
224 		SET_UNUSED(opline->op2);
225 		SET_UNUSED(opline->result);
226 		opline->extended_value = 0;
227 	} else {
228 		ZEND_ASSERT(opline->op1_type == IS_CONST);
229 		literal_dtor(&ZEND_OP1_LITERAL(opline));
230 		MAKE_NOP(opline);
231 	}
232 }
233 
zend_optimizer_add_literal(zend_op_array * op_array,const zval * zv)234 int zend_optimizer_add_literal(zend_op_array *op_array, const zval *zv)
235 {
236 	int i = op_array->last_literal;
237 	op_array->last_literal++;
238 	op_array->literals = (zval*)erealloc(op_array->literals, op_array->last_literal * sizeof(zval));
239 	ZVAL_COPY_VALUE(&op_array->literals[i], zv);
240 	Z_EXTRA(op_array->literals[i]) = 0;
241 	return i;
242 }
243 
zend_optimizer_add_literal_string(zend_op_array * op_array,zend_string * str)244 static inline int zend_optimizer_add_literal_string(zend_op_array *op_array, zend_string *str) {
245 	zval zv;
246 	ZVAL_STR(&zv, str);
247 	zend_string_hash_val(str);
248 	return zend_optimizer_add_literal(op_array, &zv);
249 }
250 
drop_leading_backslash(zval * val)251 static inline void drop_leading_backslash(zval *val) {
252 	if (Z_STRVAL_P(val)[0] == '\\') {
253 		zend_string *str = zend_string_init(Z_STRVAL_P(val) + 1, Z_STRLEN_P(val) - 1, 0);
254 		zval_ptr_dtor_nogc(val);
255 		ZVAL_STR(val, str);
256 	}
257 }
258 
alloc_cache_slots(zend_op_array * op_array,uint32_t num)259 static inline uint32_t alloc_cache_slots(zend_op_array *op_array, uint32_t num) {
260 	uint32_t ret = op_array->cache_size;
261 	op_array->cache_size += num * sizeof(void *);
262 	return ret;
263 }
264 
265 #define REQUIRES_STRING(val) do { \
266 	if (Z_TYPE_P(val) != IS_STRING) { \
267 		return 0; \
268 	} \
269 } while (0)
270 
271 #define TO_STRING_NOWARN(val) do { \
272 	if (Z_TYPE_P(val) >= IS_ARRAY) { \
273 		return 0; \
274 	} \
275 	convert_to_string(val); \
276 } while (0)
277 
zend_optimizer_update_op1_const(zend_op_array * op_array,zend_op * opline,zval * val)278 bool zend_optimizer_update_op1_const(zend_op_array *op_array,
279                                     zend_op       *opline,
280                                     zval          *val)
281 {
282 	switch (opline->opcode) {
283 		case ZEND_OP_DATA:
284 			switch ((opline-1)->opcode) {
285 				case ZEND_ASSIGN_OBJ_REF:
286 				case ZEND_ASSIGN_STATIC_PROP_REF:
287 					return 0;
288 			}
289 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
290 			break;
291 		case ZEND_FREE:
292 		case ZEND_CHECK_VAR:
293 			MAKE_NOP(opline);
294 			zval_ptr_dtor_nogc(val);
295 			return 1;
296 		case ZEND_SEND_VAR_EX:
297 		case ZEND_SEND_FUNC_ARG:
298 		case ZEND_FETCH_DIM_W:
299 		case ZEND_FETCH_DIM_RW:
300 		case ZEND_FETCH_DIM_FUNC_ARG:
301 		case ZEND_FETCH_DIM_UNSET:
302 		case ZEND_FETCH_LIST_W:
303 		case ZEND_ASSIGN_DIM:
304 		case ZEND_RETURN_BY_REF:
305 		case ZEND_INSTANCEOF:
306 		case ZEND_MAKE_REF:
307 		case ZEND_SEPARATE:
308 		case ZEND_SEND_VAR_NO_REF:
309 		case ZEND_SEND_VAR_NO_REF_EX:
310 			return 0;
311 		case ZEND_CATCH:
312 			REQUIRES_STRING(val);
313 			drop_leading_backslash(val);
314 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
315 			opline->extended_value = alloc_cache_slots(op_array, 1) | (opline->extended_value & ZEND_LAST_CATCH);
316 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
317 			break;
318 		case ZEND_DEFINED:
319 			REQUIRES_STRING(val);
320 			drop_leading_backslash(val);
321 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
322 			opline->extended_value = alloc_cache_slots(op_array, 1);
323 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
324 			break;
325 		case ZEND_NEW:
326 			REQUIRES_STRING(val);
327 			drop_leading_backslash(val);
328 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
329 			opline->op2.num = alloc_cache_slots(op_array, 1);
330 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
331 			break;
332 		case ZEND_INIT_STATIC_METHOD_CALL:
333 			REQUIRES_STRING(val);
334 			drop_leading_backslash(val);
335 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
336 			if (opline->op2_type != IS_CONST) {
337 				opline->result.num = alloc_cache_slots(op_array, 1);
338 			}
339 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
340 			break;
341 		case ZEND_FETCH_CLASS_CONSTANT:
342 			REQUIRES_STRING(val);
343 			drop_leading_backslash(val);
344 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
345 			if (opline->op2_type != IS_CONST) {
346 				opline->extended_value = alloc_cache_slots(op_array, 1);
347 			}
348 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
349 			break;
350 		case ZEND_ASSIGN_OP:
351 		case ZEND_ASSIGN_DIM_OP:
352 		case ZEND_ASSIGN_OBJ_OP:
353 			break;
354 		case ZEND_ASSIGN_STATIC_PROP_OP:
355 		case ZEND_ASSIGN_STATIC_PROP:
356 		case ZEND_ASSIGN_STATIC_PROP_REF:
357 		case ZEND_FETCH_STATIC_PROP_R:
358 		case ZEND_FETCH_STATIC_PROP_W:
359 		case ZEND_FETCH_STATIC_PROP_RW:
360 		case ZEND_FETCH_STATIC_PROP_IS:
361 		case ZEND_FETCH_STATIC_PROP_UNSET:
362 		case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
363 		case ZEND_UNSET_STATIC_PROP:
364 		case ZEND_ISSET_ISEMPTY_STATIC_PROP:
365 		case ZEND_PRE_INC_STATIC_PROP:
366 		case ZEND_PRE_DEC_STATIC_PROP:
367 		case ZEND_POST_INC_STATIC_PROP:
368 		case ZEND_POST_DEC_STATIC_PROP:
369 			TO_STRING_NOWARN(val);
370 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
371 			if (opline->op2_type == IS_CONST && (opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS) + sizeof(void*) == op_array->cache_size) {
372 				op_array->cache_size += sizeof(void *);
373 			} else {
374 				opline->extended_value = alloc_cache_slots(op_array, 3) | (opline->extended_value & ZEND_FETCH_OBJ_FLAGS);
375 			}
376 			break;
377 		case ZEND_SEND_VAR:
378 			opline->opcode = ZEND_SEND_VAL;
379 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
380 			break;
381 		case ZEND_CASE:
382 			opline->opcode = ZEND_IS_EQUAL;
383 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
384 			break;
385 		case ZEND_CASE_STRICT:
386 			opline->opcode = ZEND_IS_IDENTICAL;
387 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
388 			break;
389 		case ZEND_VERIFY_RETURN_TYPE:
390 			/* This would require a non-local change.
391 			 * zend_optimizer_replace_by_const() supports this. */
392 			return 0;
393 		case ZEND_COPY_TMP:
394 		case ZEND_FETCH_CLASS_NAME:
395 			return 0;
396 		case ZEND_ECHO:
397 		{
398 			zval zv;
399 			if (Z_TYPE_P(val) != IS_STRING && zend_optimizer_eval_cast(&zv, IS_STRING, val) == SUCCESS) {
400 				zval_ptr_dtor_nogc(val);
401 				val = &zv;
402 			}
403 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
404 			if (Z_TYPE_P(val) == IS_STRING && Z_STRLEN_P(val) == 0) {
405 				MAKE_NOP(opline);
406 				return 1;
407 			}
408 			/* TODO: In a subsequent pass, *after* this step and compacting nops, combine consecutive ZEND_ECHOs using the block information from ssa->cfg */
409 			/* (e.g. for ext/opcache/tests/opt/sccp_010.phpt) */
410 			break;
411 		}
412 		case ZEND_CONCAT:
413 		case ZEND_FAST_CONCAT:
414 		case ZEND_FETCH_R:
415 		case ZEND_FETCH_W:
416 		case ZEND_FETCH_RW:
417 		case ZEND_FETCH_IS:
418 		case ZEND_FETCH_UNSET:
419 		case ZEND_FETCH_FUNC_ARG:
420 		case ZEND_ISSET_ISEMPTY_VAR:
421 		case ZEND_UNSET_VAR:
422 			TO_STRING_NOWARN(val);
423 			if (opline->opcode == ZEND_CONCAT && opline->op2_type == IS_CONST) {
424 				opline->opcode = ZEND_FAST_CONCAT;
425 			}
426 			ZEND_FALLTHROUGH;
427 		default:
428 			opline->op1.constant = zend_optimizer_add_literal(op_array, val);
429 			break;
430 	}
431 
432 	opline->op1_type = IS_CONST;
433 	if (Z_TYPE(ZEND_OP1_LITERAL(opline)) == IS_STRING) {
434 		zend_string_hash_val(Z_STR(ZEND_OP1_LITERAL(opline)));
435 	}
436 	return 1;
437 }
438 
zend_optimizer_update_op2_const(zend_op_array * op_array,zend_op * opline,zval * val)439 bool zend_optimizer_update_op2_const(zend_op_array *op_array,
440                                     zend_op       *opline,
441                                     zval          *val)
442 {
443 	zval tmp;
444 
445 	switch (opline->opcode) {
446 		case ZEND_ASSIGN_REF:
447 		case ZEND_FAST_CALL:
448 			return 0;
449 		case ZEND_FETCH_CLASS:
450 		case ZEND_INSTANCEOF:
451 			REQUIRES_STRING(val);
452 			drop_leading_backslash(val);
453 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
454 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
455 			opline->extended_value = alloc_cache_slots(op_array, 1);
456 			break;
457 		case ZEND_INIT_FCALL_BY_NAME:
458 			REQUIRES_STRING(val);
459 			drop_leading_backslash(val);
460 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
461 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
462 			opline->result.num = alloc_cache_slots(op_array, 1);
463 			break;
464 		case ZEND_ASSIGN_STATIC_PROP:
465 		case ZEND_ASSIGN_STATIC_PROP_REF:
466 		case ZEND_FETCH_STATIC_PROP_R:
467 		case ZEND_FETCH_STATIC_PROP_W:
468 		case ZEND_FETCH_STATIC_PROP_RW:
469 		case ZEND_FETCH_STATIC_PROP_IS:
470 		case ZEND_FETCH_STATIC_PROP_UNSET:
471 		case ZEND_FETCH_STATIC_PROP_FUNC_ARG:
472 		case ZEND_UNSET_STATIC_PROP:
473 		case ZEND_ISSET_ISEMPTY_STATIC_PROP:
474 		case ZEND_PRE_INC_STATIC_PROP:
475 		case ZEND_PRE_DEC_STATIC_PROP:
476 		case ZEND_POST_INC_STATIC_PROP:
477 		case ZEND_POST_DEC_STATIC_PROP:
478 		case ZEND_ASSIGN_STATIC_PROP_OP:
479 			REQUIRES_STRING(val);
480 			drop_leading_backslash(val);
481 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
482 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
483 			if (opline->op1_type != IS_CONST) {
484 				opline->extended_value = alloc_cache_slots(op_array, 1) | (opline->extended_value & (ZEND_RETURNS_FUNCTION|ZEND_ISEMPTY|ZEND_FETCH_OBJ_FLAGS));
485 			}
486 			break;
487 		case ZEND_INIT_FCALL:
488 			REQUIRES_STRING(val);
489 			if (Z_REFCOUNT_P(val) == 1) {
490 				zend_str_tolower(Z_STRVAL_P(val), Z_STRLEN_P(val));
491 			} else {
492 				ZVAL_STR(&tmp, zend_string_tolower(Z_STR_P(val)));
493 				zval_ptr_dtor_nogc(val);
494 				val = &tmp;
495 			}
496 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
497 			opline->result.num = alloc_cache_slots(op_array, 1);
498 			break;
499 		case ZEND_INIT_DYNAMIC_CALL:
500 			if (Z_TYPE_P(val) == IS_STRING) {
501 				if (zend_memrchr(Z_STRVAL_P(val), ':', Z_STRLEN_P(val))) {
502 					return 0;
503 				}
504 
505 				if (zend_optimizer_classify_function(Z_STR_P(val), opline->extended_value)) {
506 					/* Dynamic call to various special functions must stay dynamic,
507 					 * otherwise would drop a warning */
508 					return 0;
509 				}
510 
511 				opline->opcode = ZEND_INIT_FCALL_BY_NAME;
512 				drop_leading_backslash(val);
513 				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
514 				zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
515 				opline->result.num = alloc_cache_slots(op_array, 1);
516 			} else {
517 				opline->op2.constant = zend_optimizer_add_literal(op_array, val);
518 			}
519 			break;
520 		case ZEND_INIT_METHOD_CALL:
521 			REQUIRES_STRING(val);
522 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
523 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
524 			opline->result.num = alloc_cache_slots(op_array, 2);
525 			break;
526 		case ZEND_INIT_STATIC_METHOD_CALL:
527 			REQUIRES_STRING(val);
528 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
529 			zend_optimizer_add_literal_string(op_array, zend_string_tolower(Z_STR_P(val)));
530 			if (opline->op1_type != IS_CONST) {
531 				opline->result.num = alloc_cache_slots(op_array, 2);
532 			}
533 			break;
534 		case ZEND_ASSIGN_OBJ:
535 		case ZEND_ASSIGN_OBJ_REF:
536 		case ZEND_FETCH_OBJ_R:
537 		case ZEND_FETCH_OBJ_W:
538 		case ZEND_FETCH_OBJ_RW:
539 		case ZEND_FETCH_OBJ_IS:
540 		case ZEND_FETCH_OBJ_UNSET:
541 		case ZEND_FETCH_OBJ_FUNC_ARG:
542 		case ZEND_UNSET_OBJ:
543 		case ZEND_PRE_INC_OBJ:
544 		case ZEND_PRE_DEC_OBJ:
545 		case ZEND_POST_INC_OBJ:
546 		case ZEND_POST_DEC_OBJ:
547 			TO_STRING_NOWARN(val);
548 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
549 			opline->extended_value = alloc_cache_slots(op_array, 3);
550 			break;
551 		case ZEND_ASSIGN_OBJ_OP:
552 			TO_STRING_NOWARN(val);
553 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
554 			ZEND_ASSERT((opline + 1)->opcode == ZEND_OP_DATA);
555 			(opline + 1)->extended_value = alloc_cache_slots(op_array, 3);
556 			break;
557 		case ZEND_ISSET_ISEMPTY_PROP_OBJ:
558 			TO_STRING_NOWARN(val);
559 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
560 			opline->extended_value = alloc_cache_slots(op_array, 3) | (opline->extended_value & ZEND_ISEMPTY);
561 			break;
562 		case ZEND_ASSIGN_DIM_OP:
563 		case ZEND_ISSET_ISEMPTY_DIM_OBJ:
564 		case ZEND_ASSIGN_DIM:
565 		case ZEND_UNSET_DIM:
566 		case ZEND_FETCH_DIM_R:
567 		case ZEND_FETCH_DIM_W:
568 		case ZEND_FETCH_DIM_RW:
569 		case ZEND_FETCH_DIM_IS:
570 		case ZEND_FETCH_DIM_FUNC_ARG:
571 		case ZEND_FETCH_DIM_UNSET:
572 		case ZEND_FETCH_LIST_R:
573 		case ZEND_FETCH_LIST_W:
574 			if (Z_TYPE_P(val) == IS_STRING) {
575 				zend_ulong index;
576 
577 				if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
578 					ZVAL_LONG(&tmp, index);
579 					opline->op2.constant = zend_optimizer_add_literal(op_array, &tmp);
580 					zend_string_hash_val(Z_STR_P(val));
581 					zend_optimizer_add_literal(op_array, val);
582 					Z_EXTRA(op_array->literals[opline->op2.constant]) = ZEND_EXTRA_VALUE;
583 					break;
584 				}
585 			}
586 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
587 			break;
588 		case ZEND_ADD_ARRAY_ELEMENT:
589 		case ZEND_INIT_ARRAY:
590 			if (Z_TYPE_P(val) == IS_STRING) {
591 				zend_ulong index;
592 				if (ZEND_HANDLE_NUMERIC(Z_STR_P(val), index)) {
593 					zval_ptr_dtor_nogc(val);
594 					ZVAL_LONG(val, index);
595 				}
596 			}
597 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
598 			break;
599 		case ZEND_ROPE_INIT:
600 		case ZEND_ROPE_ADD:
601 		case ZEND_ROPE_END:
602 		case ZEND_CONCAT:
603 		case ZEND_FAST_CONCAT:
604 			TO_STRING_NOWARN(val);
605 			if (opline->opcode == ZEND_CONCAT && opline->op1_type == IS_CONST) {
606 				opline->opcode = ZEND_FAST_CONCAT;
607 			}
608 			ZEND_FALLTHROUGH;
609 		default:
610 			opline->op2.constant = zend_optimizer_add_literal(op_array, val);
611 			break;
612 	}
613 
614 	opline->op2_type = IS_CONST;
615 	if (Z_TYPE(ZEND_OP2_LITERAL(opline)) == IS_STRING) {
616 		zend_string_hash_val(Z_STR(ZEND_OP2_LITERAL(opline)));
617 	}
618 	return 1;
619 }
620 
zend_optimizer_replace_by_const(zend_op_array * op_array,zend_op * opline,uint8_t type,uint32_t var,zval * val)621 bool zend_optimizer_replace_by_const(zend_op_array *op_array,
622                                     zend_op       *opline,
623                                     uint8_t        type,
624                                     uint32_t       var,
625                                     zval          *val)
626 {
627 	zend_op *end = op_array->opcodes + op_array->last;
628 
629 	while (opline < end) {
630 		if (opline->op1_type == type &&
631 			opline->op1.var == var) {
632 			switch (opline->opcode) {
633 				/* In most cases IS_TMP_VAR operand may be used only once.
634 				 * The operands are usually destroyed by the opcode handler.
635 				 * However, there are some exception which keep the operand alive. In that case
636 				 * we want to try to replace all uses of the temporary.
637 				 */
638 				case ZEND_FETCH_LIST_R:
639 				case ZEND_CASE:
640 				case ZEND_CASE_STRICT:
641 				case ZEND_SWITCH_LONG:
642 				case ZEND_SWITCH_STRING:
643 				case ZEND_MATCH:
644 				case ZEND_JMP_NULL: {
645 					zend_op *end = op_array->opcodes + op_array->last;
646 					while (opline < end) {
647 						if (opline->op1_type == type && opline->op1.var == var) {
648 							/* If this opcode doesn't keep the operand alive, we're done. Check
649 							 * this early, because op replacement may modify the opline. */
650 							bool is_last = opline->opcode != ZEND_FETCH_LIST_R
651 								&& opline->opcode != ZEND_CASE
652 								&& opline->opcode != ZEND_CASE_STRICT
653 								&& opline->opcode != ZEND_SWITCH_LONG
654 								&& opline->opcode != ZEND_SWITCH_STRING
655 								&& opline->opcode != ZEND_MATCH
656 								&& opline->opcode != ZEND_JMP_NULL
657 								&& (opline->opcode != ZEND_FREE
658 									|| opline->extended_value != ZEND_FREE_ON_RETURN);
659 
660 							Z_TRY_ADDREF_P(val);
661 							if (!zend_optimizer_update_op1_const(op_array, opline, val)) {
662 								zval_ptr_dtor(val);
663 								return 0;
664 							}
665 							if (is_last) {
666 								break;
667 							}
668 						}
669 						opline++;
670 					}
671 					zval_ptr_dtor_nogc(val);
672 					return 1;
673 				}
674 				case ZEND_VERIFY_RETURN_TYPE: {
675 					zend_arg_info *ret_info = op_array->arg_info - 1;
676 					if (!ZEND_TYPE_CONTAINS_CODE(ret_info->type, Z_TYPE_P(val))
677 						|| (op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE)) {
678 						return 0;
679 					}
680 					MAKE_NOP(opline);
681 
682 					/* zend_handle_loops_and_finally may inserts other oplines */
683 					do {
684 						++opline;
685 					} while (opline->opcode != ZEND_RETURN && opline->opcode != ZEND_RETURN_BY_REF);
686 					ZEND_ASSERT(opline->op1.var == var);
687 
688 					break;
689 				}
690 				default:
691 					break;
692 			}
693 			return zend_optimizer_update_op1_const(op_array, opline, val);
694 		}
695 
696 		if (opline->op2_type == type &&
697 			opline->op2.var == var) {
698 			return zend_optimizer_update_op2_const(op_array, opline, val);
699 		}
700 		opline++;
701 	}
702 
703 	return 1;
704 }
705 
706 /* Update jump offsets after a jump was migrated to another opline */
zend_optimizer_migrate_jump(zend_op_array * op_array,zend_op * new_opline,zend_op * opline)707 void zend_optimizer_migrate_jump(zend_op_array *op_array, zend_op *new_opline, zend_op *opline) {
708 	switch (new_opline->opcode) {
709 		case ZEND_JMP:
710 		case ZEND_FAST_CALL:
711 			ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op1, ZEND_OP1_JMP_ADDR(opline));
712 			break;
713 		case ZEND_JMPZ:
714 		case ZEND_JMPNZ:
715 		case ZEND_JMPZ_EX:
716 		case ZEND_JMPNZ_EX:
717 		case ZEND_FE_RESET_R:
718 		case ZEND_FE_RESET_RW:
719 		case ZEND_JMP_SET:
720 		case ZEND_COALESCE:
721 		case ZEND_ASSERT_CHECK:
722 		case ZEND_JMP_NULL:
723 		case ZEND_BIND_INIT_STATIC_OR_JMP:
724 		case ZEND_JMP_FRAMELESS:
725 			ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op2, ZEND_OP2_JMP_ADDR(opline));
726 			break;
727 		case ZEND_FE_FETCH_R:
728 		case ZEND_FE_FETCH_RW:
729 			new_opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value));
730 			break;
731 		case ZEND_CATCH:
732 			if (!(opline->extended_value & ZEND_LAST_CATCH)) {
733 				ZEND_SET_OP_JMP_ADDR(new_opline, new_opline->op2, ZEND_OP2_JMP_ADDR(opline));
734 			}
735 			break;
736 		case ZEND_SWITCH_LONG:
737 		case ZEND_SWITCH_STRING:
738 		case ZEND_MATCH:
739 		{
740 			HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
741 			zval *zv;
742 			ZEND_HASH_FOREACH_VAL(jumptable, zv) {
743 				Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv)));
744 			} ZEND_HASH_FOREACH_END();
745 			new_opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, new_opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value));
746 			break;
747 		}
748 	}
749 }
750 
751 /* Shift jump offsets based on shiftlist */
zend_optimizer_shift_jump(zend_op_array * op_array,zend_op * opline,uint32_t * shiftlist)752 void zend_optimizer_shift_jump(zend_op_array *op_array, zend_op *opline, uint32_t *shiftlist) {
753 	switch (opline->opcode) {
754 		case ZEND_JMP:
755 		case ZEND_FAST_CALL:
756 			ZEND_SET_OP_JMP_ADDR(opline, opline->op1, ZEND_OP1_JMP_ADDR(opline) - shiftlist[ZEND_OP1_JMP_ADDR(opline) - op_array->opcodes]);
757 			break;
758 		case ZEND_JMPZ:
759 		case ZEND_JMPNZ:
760 		case ZEND_JMPZ_EX:
761 		case ZEND_JMPNZ_EX:
762 		case ZEND_FE_RESET_R:
763 		case ZEND_FE_RESET_RW:
764 		case ZEND_JMP_SET:
765 		case ZEND_COALESCE:
766 		case ZEND_ASSERT_CHECK:
767 		case ZEND_JMP_NULL:
768 		case ZEND_BIND_INIT_STATIC_OR_JMP:
769 		case ZEND_JMP_FRAMELESS:
770 			ZEND_SET_OP_JMP_ADDR(opline, opline->op2, ZEND_OP2_JMP_ADDR(opline) - shiftlist[ZEND_OP2_JMP_ADDR(opline) - op_array->opcodes]);
771 			break;
772 		case ZEND_CATCH:
773 			if (!(opline->extended_value & ZEND_LAST_CATCH)) {
774 				ZEND_SET_OP_JMP_ADDR(opline, opline->op2, ZEND_OP2_JMP_ADDR(opline) - shiftlist[ZEND_OP2_JMP_ADDR(opline) - op_array->opcodes]);
775 			}
776 			break;
777 		case ZEND_FE_FETCH_R:
778 		case ZEND_FE_FETCH_RW:
779 			opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]);
780 			break;
781 		case ZEND_SWITCH_LONG:
782 		case ZEND_SWITCH_STRING:
783 		case ZEND_MATCH:
784 		{
785 			HashTable *jumptable = Z_ARRVAL(ZEND_OP2_LITERAL(opline));
786 			zval *zv;
787 			ZEND_HASH_FOREACH_VAL(jumptable, zv) {
788 				Z_LVAL_P(zv) = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv)) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, Z_LVAL_P(zv))]);
789 			} ZEND_HASH_FOREACH_END();
790 			opline->extended_value = ZEND_OPLINE_NUM_TO_OFFSET(op_array, opline, ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value) - shiftlist[ZEND_OFFSET_TO_OPLINE_NUM(op_array, opline, opline->extended_value)]);
791 			break;
792 		}
793 	}
794 }
795 
zend_optimizer_get_class_entry(const zend_script * script,const zend_op_array * op_array,zend_string * lcname)796 zend_class_entry *zend_optimizer_get_class_entry(
797 		const zend_script *script, const zend_op_array *op_array, zend_string *lcname) {
798 	zend_class_entry *ce = script ? zend_hash_find_ptr(&script->class_table, lcname) : NULL;
799 	if (ce) {
800 		return ce;
801 	}
802 
803 	ce = zend_hash_find_ptr(CG(class_table), lcname);
804 	if (ce
805 	 && (ce->type == ZEND_INTERNAL_CLASS
806 	  || (op_array && ce->info.user.filename == op_array->filename))) {
807 		return ce;
808 	}
809 
810 	if (op_array && op_array->scope && zend_string_equals_ci(op_array->scope->name, lcname)) {
811 		return op_array->scope;
812 	}
813 
814 	return NULL;
815 }
816 
zend_optimizer_get_class_entry_from_op1(const zend_script * script,const zend_op_array * op_array,const zend_op * opline)817 zend_class_entry *zend_optimizer_get_class_entry_from_op1(
818 		const zend_script *script, const zend_op_array *op_array, const zend_op *opline) {
819 	if (opline->op1_type == IS_CONST) {
820 		zval *op1 = CRT_CONSTANT(opline->op1);
821 		if (Z_TYPE_P(op1) == IS_STRING) {
822 			return zend_optimizer_get_class_entry(script, op_array, Z_STR_P(op1 + 1));
823 		}
824 	} else if (opline->op1_type == IS_UNUSED && op_array->scope
825 			&& !(op_array->scope->ce_flags & ZEND_ACC_TRAIT)
826 			&& ((opline->op1.num & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_SELF
827 				|| ((opline->op1.num & ZEND_FETCH_CLASS_MASK) == ZEND_FETCH_CLASS_STATIC
828 					&& (op_array->scope->ce_flags & ZEND_ACC_FINAL)))) {
829 		return op_array->scope;
830 	}
831 	return NULL;
832 }
833 
zend_fetch_class_const_info(const zend_script * script,const zend_op_array * op_array,const zend_op * opline,bool * is_prototype)834 const zend_class_constant *zend_fetch_class_const_info(
835 	const zend_script *script, const zend_op_array *op_array, const zend_op *opline, bool *is_prototype) {
836 	const zend_class_entry *ce = NULL;
837 	bool is_static_reference = false;
838 
839 	if (!opline || !op_array || opline->op2_type != IS_CONST || Z_TYPE_P(CRT_CONSTANT(opline->op2)) != IS_STRING) {
840 		return NULL;
841 	}
842 	if (opline->op1_type == IS_CONST) {
843 		zval *op1 = CRT_CONSTANT(opline->op1);
844 		if (Z_TYPE_P(op1) == IS_STRING) {
845 			if (script) {
846 				ce = zend_optimizer_get_class_entry(script, op_array, Z_STR_P(op1 + 1));
847 			} else {
848 				zend_class_entry *tmp = zend_hash_find_ptr(EG(class_table), Z_STR_P(op1 + 1));
849 				if (tmp != NULL) {
850 					if (tmp->type == ZEND_INTERNAL_CLASS) {
851 						ce = tmp;
852 					} else if (tmp->type == ZEND_USER_CLASS
853 						&& tmp->info.user.filename
854 						&& tmp->info.user.filename == op_array->filename) {
855 						ce = tmp;
856 					}
857 				}
858 			}
859 		}
860 	} else if (opline->op1_type == IS_UNUSED
861 		&& op_array->scope && !(op_array->scope->ce_flags & ZEND_ACC_TRAIT)
862 		&& !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
863 		int fetch_type = opline->op1.num & ZEND_FETCH_CLASS_MASK;
864 		if (fetch_type == ZEND_FETCH_CLASS_SELF) {
865 			ce = op_array->scope;
866 		} else if (fetch_type == ZEND_FETCH_CLASS_STATIC) {
867 			ce = op_array->scope;
868 			is_static_reference = true;
869 		} else if (fetch_type == ZEND_FETCH_CLASS_PARENT) {
870 			if (op_array->scope->ce_flags & ZEND_ACC_LINKED) {
871 				ce = op_array->scope->parent;
872 			}
873 		}
874 	}
875 	if (!ce || (ce->ce_flags & ZEND_ACC_TRAIT)) {
876 		return NULL;
877 	}
878 	zend_class_constant *const_info = zend_hash_find_ptr(&ce->constants_table, Z_STR_P(CRT_CONSTANT(opline->op2)));
879 	if (!const_info) {
880 		return NULL;
881 	}
882 	if ((ZEND_CLASS_CONST_FLAGS(const_info) & ZEND_ACC_DEPRECATED)
883 		|| ((ZEND_CLASS_CONST_FLAGS(const_info) & ZEND_ACC_PPP_MASK) != ZEND_ACC_PUBLIC && const_info->ce != op_array->scope)) {
884 		return NULL;
885 	}
886 	*is_prototype = is_static_reference
887 		&& !(const_info->ce->ce_flags & ZEND_ACC_FINAL) && !(ZEND_CLASS_CONST_FLAGS(const_info) & ZEND_ACC_FINAL);
888 
889 	return const_info;
890 }
891 
zend_optimizer_get_called_func(zend_script * script,zend_op_array * op_array,zend_op * opline,bool * is_prototype)892 zend_function *zend_optimizer_get_called_func(
893 		zend_script *script, zend_op_array *op_array, zend_op *opline, bool *is_prototype)
894 {
895 	*is_prototype = 0;
896 	switch (opline->opcode) {
897 		case ZEND_INIT_FCALL:
898 		{
899 			zend_string *function_name = Z_STR_P(CRT_CONSTANT(opline->op2));
900 			zend_function *func;
901 			if (script && (func = zend_hash_find_ptr(&script->function_table, function_name)) != NULL) {
902 				return func;
903 			} else if ((func = zend_hash_find_ptr(EG(function_table), function_name)) != NULL) {
904 				if (func->type == ZEND_INTERNAL_FUNCTION) {
905 					return func;
906 				} else if (func->type == ZEND_USER_FUNCTION &&
907 				           func->op_array.filename &&
908 				           func->op_array.filename == op_array->filename) {
909 					return func;
910 				}
911 			}
912 			break;
913 		}
914 		case ZEND_INIT_FCALL_BY_NAME:
915 		case ZEND_INIT_NS_FCALL_BY_NAME:
916 			if (opline->op2_type == IS_CONST && Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_STRING) {
917 				zval *function_name = CRT_CONSTANT(opline->op2) + 1;
918 				zend_function *func;
919 				if (script && (func = zend_hash_find_ptr(&script->function_table, Z_STR_P(function_name)))) {
920 					return func;
921 				} else if ((func = zend_hash_find_ptr(EG(function_table), Z_STR_P(function_name))) != NULL) {
922 					if (func->type == ZEND_INTERNAL_FUNCTION) {
923 						return func;
924 					} else if (func->type == ZEND_USER_FUNCTION &&
925 					           func->op_array.filename &&
926 					           func->op_array.filename == op_array->filename) {
927 						return func;
928 					}
929 				}
930 			}
931 			break;
932 		case ZEND_INIT_STATIC_METHOD_CALL:
933 			if (opline->op2_type == IS_CONST && Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_STRING) {
934 				zend_class_entry *ce = zend_optimizer_get_class_entry_from_op1(
935 					script, op_array, opline);
936 				if (ce) {
937 					zend_string *func_name = Z_STR_P(CRT_CONSTANT(opline->op2) + 1);
938 					zend_function *fbc = zend_hash_find_ptr(&ce->function_table, func_name);
939 					if (fbc) {
940 						bool is_public = (fbc->common.fn_flags & ZEND_ACC_PUBLIC) != 0;
941 						bool same_scope = fbc->common.scope == op_array->scope;
942 						if (is_public || same_scope) {
943 							return fbc;
944 						}
945 					}
946 				}
947 			}
948 			break;
949 		case ZEND_INIT_METHOD_CALL:
950 			if (opline->op1_type == IS_UNUSED
951 					&& opline->op2_type == IS_CONST && Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_STRING
952 					&& op_array->scope
953 					&& !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)
954 					&& !(op_array->scope->ce_flags & ZEND_ACC_TRAIT)) {
955 				zend_string *method_name = Z_STR_P(CRT_CONSTANT(opline->op2) + 1);
956 				zend_function *fbc = zend_hash_find_ptr(
957 					&op_array->scope->function_table, method_name);
958 				if (fbc) {
959 					bool is_private = (fbc->common.fn_flags & ZEND_ACC_PRIVATE) != 0;
960 					if (is_private) {
961 						/* Only use private method if in the same scope. We can't even use it
962 						 * as a prototype, as it may be overridden with changed signature. */
963 						bool same_scope = fbc->common.scope == op_array->scope;
964 						return same_scope ? fbc : NULL;
965 					}
966 					/* Prototype methods are potentially overridden. fbc still contains useful type information.
967 					 * Some optimizations may not be applied, like inlining or inferring the send-mode of superfluous args.
968 					 * A method cannot be overridden if the class or method is final. */
969 					if ((fbc->common.fn_flags & ZEND_ACC_FINAL) == 0 &&
970 						(fbc->common.scope->ce_flags & ZEND_ACC_FINAL) == 0) {
971 						*is_prototype = true;
972 					}
973 					return fbc;
974 				}
975 			}
976 			break;
977 		case ZEND_NEW:
978 		{
979 			zend_class_entry *ce = zend_optimizer_get_class_entry_from_op1(
980 				script, op_array, opline);
981 			if (ce && ce->type == ZEND_USER_CLASS) {
982 				return ce->constructor;
983 			}
984 			break;
985 		}
986 	}
987 	return NULL;
988 }
989 
zend_optimizer_classify_function(zend_string * name,uint32_t num_args)990 uint32_t zend_optimizer_classify_function(zend_string *name, uint32_t num_args) {
991 	if (zend_string_equals_literal(name, "extract")) {
992 		return ZEND_FUNC_INDIRECT_VAR_ACCESS;
993 	} else if (zend_string_equals_literal(name, "compact")) {
994 		return ZEND_FUNC_INDIRECT_VAR_ACCESS;
995 	} else if (zend_string_equals_literal(name, "get_defined_vars")) {
996 		return ZEND_FUNC_INDIRECT_VAR_ACCESS;
997 	} else if (zend_string_equals_literal(name, "db2_execute")) {
998 		return ZEND_FUNC_INDIRECT_VAR_ACCESS;
999 	} else if (zend_string_equals_literal(name, "func_num_args")) {
1000 		return ZEND_FUNC_VARARG;
1001 	} else if (zend_string_equals_literal(name, "func_get_arg")) {
1002 		return ZEND_FUNC_VARARG;
1003 	} else if (zend_string_equals_literal(name, "func_get_args")) {
1004 		return ZEND_FUNC_VARARG;
1005 	} else {
1006 		return 0;
1007 	}
1008 }
1009 
zend_optimizer_get_loop_var_def(const zend_op_array * op_array,zend_op * free_opline)1010 zend_op *zend_optimizer_get_loop_var_def(const zend_op_array *op_array, zend_op *free_opline) {
1011 	uint32_t var = free_opline->op1.var;
1012 	ZEND_ASSERT(zend_optimizer_is_loop_var_free(free_opline));
1013 
1014 	while (--free_opline >= op_array->opcodes) {
1015 		if ((free_opline->result_type & (IS_TMP_VAR|IS_VAR)) && free_opline->result.var == var) {
1016 			return free_opline;
1017 		}
1018 	}
1019 	return NULL;
1020 }
1021 
zend_optimize(zend_op_array * op_array,zend_optimizer_ctx * ctx)1022 static void zend_optimize(zend_op_array      *op_array,
1023                           zend_optimizer_ctx *ctx)
1024 {
1025 	if (op_array->type == ZEND_EVAL_CODE) {
1026 		return;
1027 	}
1028 
1029 	if (ctx->debug_level & ZEND_DUMP_BEFORE_OPTIMIZER) {
1030 		zend_dump_op_array(op_array, ZEND_DUMP_LIVE_RANGES, "before optimizer", NULL);
1031 	}
1032 
1033 	/* pass 1 (Simple local optimizations)
1034 	 * - persistent constant substitution (true, false, null, etc)
1035 	 * - constant casting (ADD expects numbers, CONCAT strings, etc)
1036 	 * - constant expression evaluation
1037 	 * - optimize constant conditional JMPs
1038 	 * - pre-evaluate constant function calls
1039 	 * - eliminate FETCH $GLOBALS followed by FETCH_DIM/UNSET_DIM/ISSET_ISEMPTY_DIM
1040 	 */
1041 	if (ZEND_OPTIMIZER_PASS_1 & ctx->optimization_level) {
1042 		zend_optimizer_pass1(op_array, ctx);
1043 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_1) {
1044 			zend_dump_op_array(op_array, 0, "after pass 1", NULL);
1045 		}
1046 	}
1047 
1048 	/* pass 3: (Jump optimization)
1049 	 * - optimize series of JMPs
1050 	 */
1051 	if (ZEND_OPTIMIZER_PASS_3 & ctx->optimization_level) {
1052 		zend_optimizer_pass3(op_array, ctx);
1053 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_3) {
1054 			zend_dump_op_array(op_array, 0, "after pass 3", NULL);
1055 		}
1056 	}
1057 
1058 	/* pass 4:
1059 	 * - INIT_FCALL_BY_NAME -> DO_FCALL
1060 	 */
1061 	if (ZEND_OPTIMIZER_PASS_4 & ctx->optimization_level) {
1062 		zend_optimize_func_calls(op_array, ctx);
1063 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_4) {
1064 			zend_dump_op_array(op_array, 0, "after pass 4", NULL);
1065 		}
1066 	}
1067 
1068 	/* pass 5:
1069 	 * - CFG optimization
1070 	 */
1071 	if (ZEND_OPTIMIZER_PASS_5 & ctx->optimization_level) {
1072 		zend_optimize_cfg(op_array, ctx);
1073 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_5) {
1074 			zend_dump_op_array(op_array, 0, "after pass 5", NULL);
1075 		}
1076 	}
1077 
1078 	/* pass 6:
1079 	 * - DFA optimization
1080 	 */
1081 	if ((ZEND_OPTIMIZER_PASS_6 & ctx->optimization_level) &&
1082 	    !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level)) {
1083 		zend_optimize_dfa(op_array, ctx);
1084 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_6) {
1085 			zend_dump_op_array(op_array, 0, "after pass 6", NULL);
1086 		}
1087 	}
1088 
1089 	/* pass 9:
1090 	 * - Optimize temp variables usage
1091 	 */
1092 	if ((ZEND_OPTIMIZER_PASS_9 & ctx->optimization_level) &&
1093 	    !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level)) {
1094 		zend_optimize_temporary_variables(op_array, ctx);
1095 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_9) {
1096 			zend_dump_op_array(op_array, 0, "after pass 9", NULL);
1097 		}
1098 	}
1099 
1100 	/* pass 10:
1101 	 * - remove NOPs
1102 	 */
1103 	if (((ZEND_OPTIMIZER_PASS_10|ZEND_OPTIMIZER_PASS_5) & ctx->optimization_level) == ZEND_OPTIMIZER_PASS_10) {
1104 		zend_optimizer_nop_removal(op_array, ctx);
1105 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_10) {
1106 			zend_dump_op_array(op_array, 0, "after pass 10", NULL);
1107 		}
1108 	}
1109 
1110 	/* pass 11:
1111 	 * - Compact literals table
1112 	 */
1113 	if ((ZEND_OPTIMIZER_PASS_11 & ctx->optimization_level) &&
1114 	    (!(ZEND_OPTIMIZER_PASS_6 & ctx->optimization_level) ||
1115 	     !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level))) {
1116 		zend_optimizer_compact_literals(op_array, ctx);
1117 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_11) {
1118 			zend_dump_op_array(op_array, 0, "after pass 11", NULL);
1119 		}
1120 	}
1121 
1122 	if ((ZEND_OPTIMIZER_PASS_13 & ctx->optimization_level) &&
1123 	    (!(ZEND_OPTIMIZER_PASS_6 & ctx->optimization_level) ||
1124 	     !(ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level))) {
1125 		zend_optimizer_compact_vars(op_array);
1126 		if (ctx->debug_level & ZEND_DUMP_AFTER_PASS_13) {
1127 			zend_dump_op_array(op_array, 0, "after pass 13", NULL);
1128 		}
1129 	}
1130 
1131 	if (ZEND_OPTIMIZER_PASS_7 & ctx->optimization_level) {
1132 		return;
1133 	}
1134 
1135 	if (ctx->debug_level & ZEND_DUMP_AFTER_OPTIMIZER) {
1136 		zend_dump_op_array(op_array, 0, "after optimizer", NULL);
1137 	}
1138 }
1139 
zend_revert_pass_two(zend_op_array * op_array)1140 static void zend_revert_pass_two(zend_op_array *op_array)
1141 {
1142 	zend_op *opline, *end;
1143 
1144 	ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO) != 0);
1145 
1146 	opline = op_array->opcodes;
1147 	end = opline + op_array->last;
1148 	while (opline < end) {
1149 		if (opline->op1_type == IS_CONST) {
1150 			ZEND_PASS_TWO_UNDO_CONSTANT(op_array, opline, opline->op1);
1151 		}
1152 		if (opline->op2_type == IS_CONST) {
1153 			ZEND_PASS_TWO_UNDO_CONSTANT(op_array, opline, opline->op2);
1154 		}
1155 		/* reset smart branch flags IS_SMART_BRANCH_JMP[N]Z */
1156 		opline->result_type &= (IS_TMP_VAR|IS_VAR|IS_CV|IS_CONST);
1157 		opline++;
1158 	}
1159 #if !ZEND_USE_ABS_CONST_ADDR
1160 	if (op_array->literals) {
1161 		zval *literals = emalloc(sizeof(zval) * op_array->last_literal);
1162 		memcpy(literals, op_array->literals, sizeof(zval) * op_array->last_literal);
1163 		op_array->literals = literals;
1164 	}
1165 #endif
1166 
1167 	op_array->T -= ZEND_OBSERVER_ENABLED;
1168 
1169 	op_array->fn_flags &= ~ZEND_ACC_DONE_PASS_TWO;
1170 }
1171 
zend_redo_pass_two(zend_op_array * op_array)1172 static void zend_redo_pass_two(zend_op_array *op_array)
1173 {
1174 	zend_op *opline, *end;
1175 #if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1176 	zend_op *old_opcodes = op_array->opcodes;
1177 #endif
1178 
1179 	ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO) == 0);
1180 
1181 #if !ZEND_USE_ABS_CONST_ADDR
1182 	if (op_array->last_literal) {
1183 		op_array->opcodes = (zend_op *) erealloc(op_array->opcodes,
1184 			ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16) +
1185 			sizeof(zval) * op_array->last_literal);
1186 		memcpy(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16),
1187 			op_array->literals, sizeof(zval) * op_array->last_literal);
1188 		efree(op_array->literals);
1189 		op_array->literals = (zval*)(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16));
1190 	} else {
1191 		if (op_array->literals) {
1192 			efree(op_array->literals);
1193 		}
1194 		op_array->literals = NULL;
1195 	}
1196 #endif
1197 
1198 	op_array->T += ZEND_OBSERVER_ENABLED; // reserve last temporary for observers if enabled
1199 
1200 	opline = op_array->opcodes;
1201 	end = opline + op_array->last;
1202 	while (opline < end) {
1203 		if (opline->op1_type == IS_CONST) {
1204 			ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op1);
1205 		}
1206 		if (opline->op2_type == IS_CONST) {
1207 			ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op2);
1208 		}
1209 		/* fix jumps to point to new array */
1210 		switch (opline->opcode) {
1211 #if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1212 			case ZEND_JMP:
1213 			case ZEND_FAST_CALL:
1214 				opline->op1.jmp_addr = &op_array->opcodes[opline->op1.jmp_addr - old_opcodes];
1215 				break;
1216 			case ZEND_JMPZ:
1217 			case ZEND_JMPNZ:
1218 			case ZEND_JMPZ_EX:
1219 			case ZEND_JMPNZ_EX:
1220 			case ZEND_JMP_SET:
1221 			case ZEND_COALESCE:
1222 			case ZEND_FE_RESET_R:
1223 			case ZEND_FE_RESET_RW:
1224 			case ZEND_ASSERT_CHECK:
1225 			case ZEND_JMP_NULL:
1226 			case ZEND_BIND_INIT_STATIC_OR_JMP:
1227 			case ZEND_JMP_FRAMELESS:
1228 				opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1229 				break;
1230 			case ZEND_CATCH:
1231 				if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1232 					opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1233 				}
1234 				break;
1235 			case ZEND_FE_FETCH_R:
1236 			case ZEND_FE_FETCH_RW:
1237 			case ZEND_SWITCH_LONG:
1238 			case ZEND_SWITCH_STRING:
1239 			case ZEND_MATCH:
1240 				/* relative extended_value don't have to be changed */
1241 				break;
1242 #endif
1243 			case ZEND_IS_IDENTICAL:
1244 			case ZEND_IS_NOT_IDENTICAL:
1245 			case ZEND_IS_EQUAL:
1246 			case ZEND_IS_NOT_EQUAL:
1247 			case ZEND_IS_SMALLER:
1248 			case ZEND_IS_SMALLER_OR_EQUAL:
1249 			case ZEND_CASE:
1250 			case ZEND_CASE_STRICT:
1251 			case ZEND_ISSET_ISEMPTY_CV:
1252 			case ZEND_ISSET_ISEMPTY_VAR:
1253 			case ZEND_ISSET_ISEMPTY_DIM_OBJ:
1254 			case ZEND_ISSET_ISEMPTY_PROP_OBJ:
1255 			case ZEND_ISSET_ISEMPTY_STATIC_PROP:
1256 			case ZEND_INSTANCEOF:
1257 			case ZEND_TYPE_CHECK:
1258 			case ZEND_DEFINED:
1259 			case ZEND_IN_ARRAY:
1260 			case ZEND_ARRAY_KEY_EXISTS:
1261 				if (opline->result_type & IS_TMP_VAR) {
1262 					/* reinitialize result_type of smart branch instructions */
1263 					if (opline + 1 < end) {
1264 						if ((opline+1)->opcode == ZEND_JMPZ
1265 						 && (opline+1)->op1_type == IS_TMP_VAR
1266 						 && (opline+1)->op1.var == opline->result.var) {
1267 							opline->result_type = IS_SMART_BRANCH_JMPZ | IS_TMP_VAR;
1268 						} else if ((opline+1)->opcode == ZEND_JMPNZ
1269 						 && (opline+1)->op1_type == IS_TMP_VAR
1270 						 && (opline+1)->op1.var == opline->result.var) {
1271 							opline->result_type = IS_SMART_BRANCH_JMPNZ | IS_TMP_VAR;
1272 						}
1273 					}
1274 				}
1275 				break;
1276 		}
1277 		ZEND_VM_SET_OPCODE_HANDLER(opline);
1278 		opline++;
1279 	}
1280 
1281 	op_array->fn_flags |= ZEND_ACC_DONE_PASS_TWO;
1282 }
1283 
zend_redo_pass_two_ex(zend_op_array * op_array,zend_ssa * ssa)1284 static void zend_redo_pass_two_ex(zend_op_array *op_array, zend_ssa *ssa)
1285 {
1286 	zend_op *opline, *end;
1287 #if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1288 	zend_op *old_opcodes = op_array->opcodes;
1289 #endif
1290 
1291 	ZEND_ASSERT((op_array->fn_flags & ZEND_ACC_DONE_PASS_TWO) == 0);
1292 
1293 #if !ZEND_USE_ABS_CONST_ADDR
1294 	if (op_array->last_literal) {
1295 		op_array->opcodes = (zend_op *) erealloc(op_array->opcodes,
1296 			ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16) +
1297 			sizeof(zval) * op_array->last_literal);
1298 		memcpy(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16),
1299 			op_array->literals, sizeof(zval) * op_array->last_literal);
1300 		efree(op_array->literals);
1301 		op_array->literals = (zval*)(((char*)op_array->opcodes) + ZEND_MM_ALIGNED_SIZE_EX(sizeof(zend_op) * op_array->last, 16));
1302 	} else {
1303 		if (op_array->literals) {
1304 			efree(op_array->literals);
1305 		}
1306 		op_array->literals = NULL;
1307 	}
1308 #endif
1309 
1310 	opline = op_array->opcodes;
1311 	end = opline + op_array->last;
1312 	while (opline < end) {
1313 		zend_ssa_op *ssa_op = &ssa->ops[opline - op_array->opcodes];
1314 		uint32_t op1_info = opline->op1_type == IS_UNUSED ? 0 : (OP1_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY));
1315 		uint32_t op2_info = opline->op1_type == IS_UNUSED ? 0 : (OP2_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY));
1316 		uint32_t res_info =
1317 			(opline->opcode == ZEND_PRE_INC ||
1318 			 opline->opcode == ZEND_PRE_DEC ||
1319 			 opline->opcode == ZEND_POST_INC ||
1320 			 opline->opcode == ZEND_POST_DEC) ?
1321 				((ssa->ops[opline - op_array->opcodes].op1_def >= 0) ? (OP1_DEF_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY)) : MAY_BE_ANY) :
1322 				(opline->result_type == IS_UNUSED ? 0 : (RES_INFO() & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF|MAY_BE_ARRAY_OF_ANY|MAY_BE_ARRAY_KEY_ANY)));
1323 
1324 		if (opline->op1_type == IS_CONST) {
1325 			ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op1);
1326 		}
1327 		if (opline->op2_type == IS_CONST) {
1328 			ZEND_PASS_TWO_UPDATE_CONSTANT(op_array, opline, opline->op2);
1329 		}
1330 
1331 		/* fix jumps to point to new array */
1332 		switch (opline->opcode) {
1333 #if ZEND_USE_ABS_JMP_ADDR && !ZEND_USE_ABS_CONST_ADDR
1334 			case ZEND_JMP:
1335 			case ZEND_FAST_CALL:
1336 				opline->op1.jmp_addr = &op_array->opcodes[opline->op1.jmp_addr - old_opcodes];
1337 				break;
1338 			case ZEND_JMPZ:
1339 			case ZEND_JMPNZ:
1340 			case ZEND_JMPZ_EX:
1341 			case ZEND_JMPNZ_EX:
1342 			case ZEND_JMP_SET:
1343 			case ZEND_COALESCE:
1344 			case ZEND_FE_RESET_R:
1345 			case ZEND_FE_RESET_RW:
1346 			case ZEND_ASSERT_CHECK:
1347 			case ZEND_JMP_NULL:
1348 			case ZEND_BIND_INIT_STATIC_OR_JMP:
1349 			case ZEND_JMP_FRAMELESS:
1350 				opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1351 				break;
1352 			case ZEND_CATCH:
1353 				if (!(opline->extended_value & ZEND_LAST_CATCH)) {
1354 					opline->op2.jmp_addr = &op_array->opcodes[opline->op2.jmp_addr - old_opcodes];
1355 				}
1356 				break;
1357 			case ZEND_FE_FETCH_R:
1358 			case ZEND_FE_FETCH_RW:
1359 			case ZEND_SWITCH_LONG:
1360 			case ZEND_SWITCH_STRING:
1361 			case ZEND_MATCH:
1362 				/* relative extended_value don't have to be changed */
1363 				break;
1364 #endif
1365 			case ZEND_IS_IDENTICAL:
1366 			case ZEND_IS_NOT_IDENTICAL:
1367 			case ZEND_IS_EQUAL:
1368 			case ZEND_IS_NOT_EQUAL:
1369 			case ZEND_IS_SMALLER:
1370 			case ZEND_IS_SMALLER_OR_EQUAL:
1371 			case ZEND_CASE:
1372 			case ZEND_CASE_STRICT:
1373 			case ZEND_ISSET_ISEMPTY_CV:
1374 			case ZEND_ISSET_ISEMPTY_VAR:
1375 			case ZEND_ISSET_ISEMPTY_DIM_OBJ:
1376 			case ZEND_ISSET_ISEMPTY_PROP_OBJ:
1377 			case ZEND_ISSET_ISEMPTY_STATIC_PROP:
1378 			case ZEND_INSTANCEOF:
1379 			case ZEND_TYPE_CHECK:
1380 			case ZEND_DEFINED:
1381 			case ZEND_IN_ARRAY:
1382 			case ZEND_ARRAY_KEY_EXISTS:
1383 				if (opline->result_type & IS_TMP_VAR) {
1384 					/* reinitialize result_type of smart branch instructions */
1385 					if (opline + 1 < end) {
1386 						if ((opline+1)->opcode == ZEND_JMPZ
1387 						 && (opline+1)->op1_type == IS_TMP_VAR
1388 						 && (opline+1)->op1.var == opline->result.var) {
1389 							opline->result_type = IS_SMART_BRANCH_JMPZ | IS_TMP_VAR;
1390 						} else if ((opline+1)->opcode == ZEND_JMPNZ
1391 						 && (opline+1)->op1_type == IS_TMP_VAR
1392 						 && (opline+1)->op1.var == opline->result.var) {
1393 							opline->result_type = IS_SMART_BRANCH_JMPNZ | IS_TMP_VAR;
1394 						}
1395 					}
1396 				}
1397 				break;
1398 		}
1399 #ifdef ZEND_VERIFY_TYPE_INFERENCE
1400 		if (ssa_op->op1_use >= 0) {
1401 			opline->op1_use_type = ssa->var_info[ssa_op->op1_use].type;
1402 		}
1403 		if (ssa_op->op2_use >= 0) {
1404 			opline->op2_use_type = ssa->var_info[ssa_op->op2_use].type;
1405 		}
1406 		if (ssa_op->result_use >= 0) {
1407 			opline->result_use_type = ssa->var_info[ssa_op->result_use].type;
1408 		}
1409 		if (ssa_op->op1_def >= 0) {
1410 			opline->op1_def_type = ssa->var_info[ssa_op->op1_def].type;
1411 		}
1412 		if (ssa_op->op2_def >= 0) {
1413 			opline->op2_def_type = ssa->var_info[ssa_op->op2_def].type;
1414 		}
1415 		if (ssa_op->result_def >= 0) {
1416 			opline->result_def_type = ssa->var_info[ssa_op->result_def].type;
1417 		}
1418 #endif
1419 		zend_vm_set_opcode_handler_ex(opline, op1_info, op2_info, res_info);
1420 		opline++;
1421 	}
1422 
1423 	op_array->fn_flags |= ZEND_ACC_DONE_PASS_TWO;
1424 }
1425 
zend_optimize_op_array(zend_op_array * op_array,zend_optimizer_ctx * ctx)1426 static void zend_optimize_op_array(zend_op_array      *op_array,
1427                                    zend_optimizer_ctx *ctx)
1428 {
1429 	/* Revert pass_two() */
1430 	zend_revert_pass_two(op_array);
1431 
1432 	/* Do actual optimizations */
1433 	zend_optimize(op_array, ctx);
1434 
1435 	/* Redo pass_two() */
1436 	zend_redo_pass_two(op_array);
1437 
1438 	if (op_array->live_range) {
1439 		zend_recalc_live_ranges(op_array, NULL);
1440 	}
1441 }
1442 
zend_adjust_fcall_stack_size(zend_op_array * op_array,zend_optimizer_ctx * ctx)1443 static void zend_adjust_fcall_stack_size(zend_op_array *op_array, zend_optimizer_ctx *ctx)
1444 {
1445 	zend_function *func;
1446 	zend_op *opline, *end;
1447 
1448 	opline = op_array->opcodes;
1449 	end = opline + op_array->last;
1450 	while (opline < end) {
1451 		if (opline->opcode == ZEND_INIT_FCALL) {
1452 			func = zend_hash_find_ptr(
1453 				&ctx->script->function_table,
1454 				Z_STR_P(RT_CONSTANT(opline, opline->op2)));
1455 			if (func) {
1456 				opline->op1.num = zend_vm_calc_used_stack(opline->extended_value, func);
1457 			}
1458 		}
1459 		opline++;
1460 	}
1461 }
1462 
zend_adjust_fcall_stack_size_graph(zend_op_array * op_array)1463 static void zend_adjust_fcall_stack_size_graph(zend_op_array *op_array)
1464 {
1465 	zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
1466 
1467 	if (func_info) {
1468 		zend_call_info *call_info =func_info->callee_info;
1469 
1470 		while (call_info) {
1471 			zend_op *opline = call_info->caller_init_opline;
1472 
1473 			if (opline && call_info->callee_func && opline->opcode == ZEND_INIT_FCALL) {
1474 				ZEND_ASSERT(!call_info->is_prototype);
1475 				opline->op1.num = zend_vm_calc_used_stack(opline->extended_value, call_info->callee_func);
1476 			}
1477 			call_info = call_info->next_callee;
1478 		}
1479 	}
1480 }
1481 
needs_live_range(zend_op_array * op_array,zend_op * def_opline)1482 static bool needs_live_range(zend_op_array *op_array, zend_op *def_opline) {
1483 	zend_func_info *func_info = ZEND_FUNC_INFO(op_array);
1484 	zend_ssa_op *ssa_op = &func_info->ssa.ops[def_opline - op_array->opcodes];
1485 	int ssa_var = ssa_op->result_def;
1486 	if (ssa_var < 0) {
1487 		/* Be conservative. */
1488 		return 1;
1489 	}
1490 
1491 	/* If the variable is used by a PHI, this may be the assignment of the final branch of a
1492 	 * ternary/etc structure. While this is where the live range starts, the value from the other
1493 	 * branch may also be used. As such, use the type of the PHI node for the following check. */
1494 	if (func_info->ssa.vars[ssa_var].phi_use_chain) {
1495 		ssa_var = func_info->ssa.vars[ssa_var].phi_use_chain->ssa_var;
1496 	}
1497 
1498 	uint32_t type = func_info->ssa.var_info[ssa_var].type;
1499 	return (type & (MAY_BE_STRING|MAY_BE_ARRAY|MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_REF)) != 0;
1500 }
1501 
zend_foreach_op_array_helper(zend_op_array * op_array,zend_op_array_func_t func,void * context)1502 static void zend_foreach_op_array_helper(
1503 		zend_op_array *op_array, zend_op_array_func_t func, void *context) {
1504 	func(op_array, context);
1505 	for (uint32_t i = 0; i < op_array->num_dynamic_func_defs; i++) {
1506 		zend_foreach_op_array_helper(op_array->dynamic_func_defs[i], func, context);
1507 	}
1508 }
1509 
zend_foreach_op_array(zend_script * script,zend_op_array_func_t func,void * context)1510 void zend_foreach_op_array(zend_script *script, zend_op_array_func_t func, void *context)
1511 {
1512 	zval *zv;
1513 	zend_op_array *op_array;
1514 
1515 	zend_foreach_op_array_helper(&script->main_op_array, func, context);
1516 
1517 	ZEND_HASH_MAP_FOREACH_PTR(&script->function_table, op_array) {
1518 		zend_foreach_op_array_helper(op_array, func, context);
1519 	} ZEND_HASH_FOREACH_END();
1520 
1521 	ZEND_HASH_MAP_FOREACH_VAL(&script->class_table, zv) {
1522 		if (Z_TYPE_P(zv) == IS_ALIAS_PTR) {
1523 			continue;
1524 		}
1525 		zend_class_entry *ce = Z_CE_P(zv);
1526 		ZEND_HASH_MAP_FOREACH_PTR(&ce->function_table, op_array) {
1527 			if (op_array->scope == ce
1528 					&& op_array->type == ZEND_USER_FUNCTION
1529 					&& !(op_array->fn_flags & ZEND_ACC_ABSTRACT)
1530 					&& !(op_array->fn_flags & ZEND_ACC_TRAIT_CLONE)) {
1531 				zend_foreach_op_array_helper(op_array, func, context);
1532 			}
1533 		} ZEND_HASH_FOREACH_END();
1534 	} ZEND_HASH_FOREACH_END();
1535 }
1536 
step_optimize_op_array(zend_op_array * op_array,void * context)1537 static void step_optimize_op_array(zend_op_array *op_array, void *context) {
1538 	zend_optimize_op_array(op_array, (zend_optimizer_ctx *) context);
1539 }
1540 
step_adjust_fcall_stack_size(zend_op_array * op_array,void * context)1541 static void step_adjust_fcall_stack_size(zend_op_array *op_array, void *context) {
1542 	zend_adjust_fcall_stack_size(op_array, (zend_optimizer_ctx *) context);
1543 }
1544 
step_dump_after_optimizer(zend_op_array * op_array,void * context)1545 static void step_dump_after_optimizer(zend_op_array *op_array, void *context) {
1546 	zend_dump_op_array(op_array, ZEND_DUMP_LIVE_RANGES, "after optimizer", NULL);
1547 }
1548 
zend_optimizer_call_registered_passes(zend_script * script,void * ctx)1549 static void zend_optimizer_call_registered_passes(zend_script *script, void *ctx) {
1550 	for (int i = 0; i < zend_optimizer_registered_passes.last; i++) {
1551 		if (!zend_optimizer_registered_passes.pass[i]) {
1552 			continue;
1553 		}
1554 
1555 		zend_optimizer_registered_passes.pass[i](script, ctx);
1556 	}
1557 }
1558 
zend_optimize_script(zend_script * script,zend_long optimization_level,zend_long debug_level)1559 ZEND_API void zend_optimize_script(zend_script *script, zend_long optimization_level, zend_long debug_level)
1560 {
1561 	zend_op_array *op_array;
1562 	zend_string *name;
1563 	zend_optimizer_ctx ctx;
1564 	zval *zv;
1565 
1566 	ctx.arena = zend_arena_create(64 * 1024);
1567 	ctx.script = script;
1568 	ctx.constants = NULL;
1569 	ctx.optimization_level = optimization_level;
1570 	ctx.debug_level = debug_level;
1571 
1572 	if ((ZEND_OPTIMIZER_PASS_6 & optimization_level) &&
1573 	    (ZEND_OPTIMIZER_PASS_7 & optimization_level)) {
1574 		/* Optimize using call-graph */
1575 		zend_call_graph call_graph;
1576 		zend_build_call_graph(&ctx.arena, script, &call_graph);
1577 
1578 		int i;
1579 		zend_func_info *func_info;
1580 
1581 		for (i = 0; i < call_graph.op_arrays_count; i++) {
1582 			zend_revert_pass_two(call_graph.op_arrays[i]);
1583 			zend_optimize(call_graph.op_arrays[i], &ctx);
1584 		}
1585 
1586 	    zend_analyze_call_graph(&ctx.arena, script, &call_graph);
1587 
1588 		for (i = 0; i < call_graph.op_arrays_count; i++) {
1589 			func_info = ZEND_FUNC_INFO(call_graph.op_arrays[i]);
1590 			if (func_info) {
1591 				func_info->call_map = zend_build_call_map(&ctx.arena, func_info, call_graph.op_arrays[i]);
1592 				if (call_graph.op_arrays[i]->fn_flags & ZEND_ACC_HAS_RETURN_TYPE) {
1593 					zend_init_func_return_info(call_graph.op_arrays[i], script, &func_info->return_info);
1594 				}
1595 			}
1596 		}
1597 
1598 		for (i = 0; i < call_graph.op_arrays_count; i++) {
1599 			func_info = ZEND_FUNC_INFO(call_graph.op_arrays[i]);
1600 			if (func_info) {
1601 				if (zend_dfa_analyze_op_array(call_graph.op_arrays[i], &ctx, &func_info->ssa) == SUCCESS) {
1602 					func_info->flags = func_info->ssa.cfg.flags;
1603 				} else {
1604 					ZEND_SET_FUNC_INFO(call_graph.op_arrays[i], NULL);
1605 				}
1606 			}
1607 		}
1608 
1609 		//TODO: perform inner-script inference???
1610 		for (i = 0; i < call_graph.op_arrays_count; i++) {
1611 			func_info = ZEND_FUNC_INFO(call_graph.op_arrays[i]);
1612 			if (func_info) {
1613 				zend_dfa_optimize_op_array(call_graph.op_arrays[i], &ctx, &func_info->ssa, func_info->call_map);
1614 			}
1615 		}
1616 
1617 		if (debug_level & ZEND_DUMP_AFTER_PASS_7) {
1618 			for (i = 0; i < call_graph.op_arrays_count; i++) {
1619 				zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 7", NULL);
1620 			}
1621 		}
1622 
1623 		if (ZEND_OPTIMIZER_PASS_9 & optimization_level) {
1624 			for (i = 0; i < call_graph.op_arrays_count; i++) {
1625 				zend_optimize_temporary_variables(call_graph.op_arrays[i], &ctx);
1626 				if (debug_level & ZEND_DUMP_AFTER_PASS_9) {
1627 					zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 9", NULL);
1628 				}
1629 			}
1630 		}
1631 
1632 		if (ZEND_OPTIMIZER_PASS_11 & optimization_level) {
1633 			for (i = 0; i < call_graph.op_arrays_count; i++) {
1634 				zend_optimizer_compact_literals(call_graph.op_arrays[i], &ctx);
1635 				if (debug_level & ZEND_DUMP_AFTER_PASS_11) {
1636 					zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 11", NULL);
1637 				}
1638 			}
1639 		}
1640 
1641 		if (ZEND_OPTIMIZER_PASS_13 & optimization_level) {
1642 			for (i = 0; i < call_graph.op_arrays_count; i++) {
1643 				zend_optimizer_compact_vars(call_graph.op_arrays[i]);
1644 				if (debug_level & ZEND_DUMP_AFTER_PASS_13) {
1645 					zend_dump_op_array(call_graph.op_arrays[i], 0, "after pass 13", NULL);
1646 				}
1647 			}
1648 		}
1649 
1650 		if (ZEND_OBSERVER_ENABLED) {
1651 			for (i = 0; i < call_graph.op_arrays_count; i++) {
1652 				++call_graph.op_arrays[i]->T; // ensure accurate temporary count for stack size precalculation
1653 			}
1654 		}
1655 
1656 		if (ZEND_OPTIMIZER_PASS_12 & optimization_level) {
1657 			for (i = 0; i < call_graph.op_arrays_count; i++) {
1658 				zend_adjust_fcall_stack_size_graph(call_graph.op_arrays[i]);
1659 			}
1660 		}
1661 
1662 		for (i = 0; i < call_graph.op_arrays_count; i++) {
1663 			op_array = call_graph.op_arrays[i];
1664 			func_info = ZEND_FUNC_INFO(op_array);
1665 			if (func_info && func_info->ssa.var_info) {
1666 				zend_redo_pass_two_ex(op_array, &func_info->ssa);
1667 				if (op_array->live_range) {
1668 					zend_recalc_live_ranges(op_array, needs_live_range);
1669 				}
1670 			} else {
1671 				op_array->T -= ZEND_OBSERVER_ENABLED; // redo_pass_two will re-increment it
1672 
1673 				zend_redo_pass_two(op_array);
1674 				if (op_array->live_range) {
1675 					zend_recalc_live_ranges(op_array, NULL);
1676 				}
1677 			}
1678 		}
1679 
1680 		for (i = 0; i < call_graph.op_arrays_count; i++) {
1681 			ZEND_SET_FUNC_INFO(call_graph.op_arrays[i], NULL);
1682 		}
1683 	} else {
1684 		zend_foreach_op_array(script, step_optimize_op_array, &ctx);
1685 
1686 		if (ZEND_OPTIMIZER_PASS_12 & optimization_level) {
1687 			zend_foreach_op_array(script, step_adjust_fcall_stack_size, &ctx);
1688 		}
1689 	}
1690 
1691 	ZEND_HASH_MAP_FOREACH_VAL(&script->class_table, zv) {
1692 		if (Z_TYPE_P(zv) == IS_ALIAS_PTR) {
1693 			continue;
1694 		}
1695 		zend_class_entry *ce = Z_CE_P(zv);
1696 		ZEND_HASH_MAP_FOREACH_STR_KEY_PTR(&ce->function_table, name, op_array) {
1697 			if (op_array->scope != ce && op_array->type == ZEND_USER_FUNCTION) {
1698 				zend_op_array *orig_op_array =
1699 					zend_hash_find_ptr(&op_array->scope->function_table, name);
1700 
1701 				ZEND_ASSERT(orig_op_array != NULL);
1702 				if (orig_op_array != op_array) {
1703 					uint32_t fn_flags = op_array->fn_flags;
1704 					zend_function *prototype = op_array->prototype;
1705 					HashTable *ht = op_array->static_variables;
1706 
1707 					*op_array = *orig_op_array;
1708 					op_array->fn_flags = fn_flags;
1709 					op_array->prototype = prototype;
1710 					op_array->static_variables = ht;
1711 				}
1712 			}
1713 		} ZEND_HASH_FOREACH_END();
1714 	} ZEND_HASH_FOREACH_END();
1715 
1716 	zend_optimizer_call_registered_passes(script, &ctx);
1717 
1718 	if ((debug_level & ZEND_DUMP_AFTER_OPTIMIZER) &&
1719 			(ZEND_OPTIMIZER_PASS_7 & optimization_level)) {
1720 		zend_foreach_op_array(script, step_dump_after_optimizer, NULL);
1721 	}
1722 
1723 	if (ctx.constants) {
1724 		zend_hash_destroy(ctx.constants);
1725 	}
1726 	zend_arena_destroy(ctx.arena);
1727 }
1728 
zend_optimizer_register_pass(zend_optimizer_pass_t pass)1729 ZEND_API int zend_optimizer_register_pass(zend_optimizer_pass_t pass)
1730 {
1731 	if (!pass) {
1732 		return -1;
1733 	}
1734 
1735 	if (zend_optimizer_registered_passes.last == ZEND_OPTIMIZER_MAX_REGISTERED_PASSES) {
1736 		return -1;
1737 	}
1738 
1739 	zend_optimizer_registered_passes.pass[
1740 		zend_optimizer_registered_passes.last++] = pass;
1741 
1742 	return zend_optimizer_registered_passes.last;
1743 }
1744 
zend_optimizer_unregister_pass(int idx)1745 ZEND_API void zend_optimizer_unregister_pass(int idx)
1746 {
1747 	zend_optimizer_registered_passes.pass[idx-1] = NULL;
1748 }
1749 
zend_optimizer_startup(void)1750 zend_result zend_optimizer_startup(void)
1751 {
1752 	return zend_func_info_startup();
1753 }
1754 
zend_optimizer_shutdown(void)1755 zend_result zend_optimizer_shutdown(void)
1756 {
1757 	return zend_func_info_shutdown();
1758 }
1759