1 /*
2 +----------------------------------------------------------------------+
3 | Zend JIT |
4 +----------------------------------------------------------------------+
5 | Copyright (c) The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | https://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@php.net> |
16 +----------------------------------------------------------------------+
17 */
18
19 #include "Zend/zend_API.h"
20
undef_result_after_exception(void)21 static ZEND_COLD void undef_result_after_exception(void) {
22 const zend_op *opline = EG(opline_before_exception);
23 ZEND_ASSERT(EG(exception));
24 if (opline && opline->result_type & (IS_VAR | IS_TMP_VAR)) {
25 zend_execute_data *execute_data = EG(current_execute_data);
26 ZVAL_UNDEF(EX_VAR(opline->result.var));
27 }
28 }
29
_zend_jit_init_func_run_time_cache(zend_op_array * op_array)30 static zend_never_inline zend_function* ZEND_FASTCALL _zend_jit_init_func_run_time_cache(zend_op_array *op_array) /* {{{ */
31 {
32 void **run_time_cache;
33
34 run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
35 memset(run_time_cache, 0, op_array->cache_size);
36 ZEND_MAP_PTR_SET(op_array->run_time_cache, run_time_cache);
37 return (zend_function*)op_array;
38 }
39 /* }}} */
40
zend_jit_init_func_run_time_cache_helper(zend_op_array * op_array)41 static zend_never_inline zend_op_array* ZEND_FASTCALL zend_jit_init_func_run_time_cache_helper(zend_op_array *op_array) /* {{{ */
42 {
43 void **run_time_cache;
44
45 if (!RUN_TIME_CACHE(op_array)) {
46 run_time_cache = zend_arena_alloc(&CG(arena), op_array->cache_size);
47 memset(run_time_cache, 0, op_array->cache_size);
48 ZEND_MAP_PTR_SET(op_array->run_time_cache, run_time_cache);
49 }
50 return op_array;
51 }
52 /* }}} */
53
zend_jit_find_func_helper(zend_string * name,void ** cache_slot)54 static zend_function* ZEND_FASTCALL zend_jit_find_func_helper(zend_string *name, void **cache_slot)
55 {
56 zval *func = zend_hash_find_known_hash(EG(function_table), name);
57 zend_function *fbc;
58
59 if (UNEXPECTED(func == NULL)) {
60 return NULL;
61 }
62 fbc = Z_FUNC_P(func);
63 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
64 fbc = _zend_jit_init_func_run_time_cache(&fbc->op_array);
65 }
66 *cache_slot = fbc;
67 return fbc;
68 }
69
zend_jit_jmp_frameless_helper(zval * func_name,void ** cache_slot)70 static uint32_t ZEND_FASTCALL zend_jit_jmp_frameless_helper(zval *func_name, void **cache_slot)
71 {
72 zval *func = zend_hash_find_known_hash(EG(function_table), Z_STR_P(func_name));
73 zend_jmp_fl_result result = (func == NULL) + 1;
74 *cache_slot = (void *)(uintptr_t)result;
75 return result;
76 }
77
zend_jit_find_ns_func_helper(zval * func_name,void ** cache_slot)78 static zend_function* ZEND_FASTCALL zend_jit_find_ns_func_helper(zval *func_name, void **cache_slot)
79 {
80 zval *func = zend_hash_find_known_hash(EG(function_table), Z_STR_P(func_name + 1));
81 zend_function *fbc;
82
83 if (func == NULL) {
84 func = zend_hash_find_known_hash(EG(function_table), Z_STR_P(func_name + 2));
85 if (UNEXPECTED(func == NULL)) {
86 return NULL;
87 }
88 }
89 fbc = Z_FUNC_P(func);
90 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
91 fbc = _zend_jit_init_func_run_time_cache(&fbc->op_array);
92 }
93 *cache_slot = fbc;
94 return fbc;
95 }
96
zend_jit_invalid_method_call(zval * object)97 static ZEND_COLD void ZEND_FASTCALL zend_jit_invalid_method_call(zval *object)
98 {
99 zend_execute_data *execute_data = EG(current_execute_data);
100 const zend_op *opline = EX(opline);
101 zval *function_name = function_name = RT_CONSTANT(opline, opline->op2);;
102
103 if (Z_TYPE_P(object) == IS_UNDEF && opline->op1_type == IS_CV) {
104 zend_string *cv = EX(func)->op_array.vars[EX_VAR_TO_NUM(opline->op1.var)];
105
106 zend_error_unchecked(E_WARNING, "Undefined variable $%S", cv);
107 if (UNEXPECTED(EG(exception) != NULL)) {
108 return;
109 }
110 object = &EG(uninitialized_zval);
111 }
112 zend_throw_error(NULL, "Call to a member function %s() on %s",
113 Z_STRVAL_P(function_name), zend_zval_value_name(object));
114 }
115
zend_jit_invalid_method_call_tmp(zval * object)116 static ZEND_COLD void ZEND_FASTCALL zend_jit_invalid_method_call_tmp(zval *object)
117 {
118 zend_execute_data *execute_data = EG(current_execute_data);
119 const zend_op *opline = EX(opline);
120
121 zend_jit_invalid_method_call(object);
122 zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));
123 }
124
zend_undefined_method(const zend_class_entry * ce,const zend_string * method)125 static zend_never_inline ZEND_COLD void ZEND_FASTCALL zend_undefined_method(const zend_class_entry *ce, const zend_string *method)
126 {
127 zend_throw_error(NULL, "Call to undefined method %s::%s()", ZSTR_VAL(ce->name), ZSTR_VAL(method));
128 }
129
zend_jit_unref_helper(zval * zv)130 static void ZEND_FASTCALL zend_jit_unref_helper(zval *zv)
131 {
132 zend_reference *ref;
133
134 ZEND_ASSERT(Z_ISREF_P(zv));
135 ref = Z_REF_P(zv);
136 ZVAL_COPY_VALUE(zv, &ref->val);
137 if (GC_DELREF(ref) == 0) {
138 efree_size(ref, sizeof(zend_reference));
139 } else {
140 Z_TRY_ADDREF_P(zv);
141 }
142 }
143
zend_jit_find_method_helper(zend_object * obj,zval * function_name,zend_object ** obj_ptr)144 static zend_function* ZEND_FASTCALL zend_jit_find_method_helper(zend_object *obj, zval *function_name, zend_object **obj_ptr)
145 {
146 zend_execute_data *execute_data = EG(current_execute_data);
147 const zend_op *opline = EX(opline);
148 zend_class_entry *called_scope = obj->ce;
149 zend_function *fbc;
150
151 fbc = obj->handlers->get_method(obj_ptr, Z_STR_P(function_name), function_name + 1);
152 if (UNEXPECTED(fbc == NULL)) {
153 if (EXPECTED(!EG(exception))) {
154 zend_undefined_method(called_scope, Z_STR_P(function_name));
155 }
156 return NULL;
157 }
158
159 if (EXPECTED(fbc->type == ZEND_USER_FUNCTION) && UNEXPECTED(!RUN_TIME_CACHE(&fbc->op_array))) {
160 zend_init_func_run_time_cache(&fbc->op_array);
161 }
162
163 if (UNEXPECTED(obj != *obj_ptr)) {
164 return fbc;
165 }
166
167 if (EXPECTED(!(fbc->common.fn_flags & (ZEND_ACC_CALL_VIA_TRAMPOLINE|ZEND_ACC_NEVER_CACHE)))) {
168 CACHE_POLYMORPHIC_PTR(opline->result.num, called_scope, fbc);
169 }
170
171 return fbc;
172 }
173
zend_jit_find_method_tmp_helper(zend_object * obj,zval * function_name,zend_object ** obj_ptr)174 static zend_function* ZEND_FASTCALL zend_jit_find_method_tmp_helper(zend_object *obj, zval *function_name, zend_object **obj_ptr)
175 {
176 zend_function *fbc;
177
178 fbc = zend_jit_find_method_helper(obj, function_name, obj_ptr);
179 if (!fbc) {
180 if (GC_DELREF(obj) == 0) {
181 zend_objects_store_del(obj);
182 }
183 } else if (obj != *obj_ptr) {
184 GC_ADDREF(*obj_ptr);
185 if (GC_DELREF(obj) == 0) {
186 zend_objects_store_del(obj);
187 }
188 }
189 return fbc;
190 }
191
zend_jit_push_static_metod_call_frame(zend_object * obj,zend_function * fbc,uint32_t num_args)192 static zend_execute_data* ZEND_FASTCALL zend_jit_push_static_metod_call_frame(zend_object *obj, zend_function *fbc, uint32_t num_args)
193 {
194 zend_class_entry *scope = obj->ce;
195
196 return zend_vm_stack_push_call_frame(ZEND_CALL_NESTED_FUNCTION, fbc, num_args, scope);
197 }
198
zend_jit_push_static_metod_call_frame_tmp(zend_object * obj,zend_function * fbc,uint32_t num_args)199 static zend_execute_data* ZEND_FASTCALL zend_jit_push_static_metod_call_frame_tmp(zend_object *obj, zend_function *fbc, uint32_t num_args)
200 {
201 zend_class_entry *scope = obj->ce;
202
203 if (GC_DELREF(obj) == 0) {
204 zend_objects_store_del(obj);
205 if (UNEXPECTED(EG(exception))) {
206 return NULL;
207 }
208 }
209
210 return zend_vm_stack_push_call_frame(ZEND_CALL_NESTED_FUNCTION, fbc, num_args, scope);
211 }
212
zend_jit_extend_stack_helper(uint32_t used_stack,zend_function * fbc)213 static zend_execute_data* ZEND_FASTCALL zend_jit_extend_stack_helper(uint32_t used_stack, zend_function *fbc)
214 {
215 zend_execute_data *call = (zend_execute_data*)zend_vm_stack_extend(used_stack);
216 call->func = fbc;
217 ZEND_CALL_INFO(call) = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_ALLOCATED;
218 return call;
219 }
220
zend_jit_int_extend_stack_helper(uint32_t used_stack)221 static zend_execute_data* ZEND_FASTCALL zend_jit_int_extend_stack_helper(uint32_t used_stack)
222 {
223 zend_execute_data *call = (zend_execute_data*)zend_vm_stack_extend(used_stack);
224 ZEND_CALL_INFO(call) = ZEND_CALL_NESTED_FUNCTION | ZEND_CALL_ALLOCATED;
225 return call;
226 }
227
zend_jit_symtable_find(HashTable * ht,zend_string * str)228 static zval* ZEND_FASTCALL zend_jit_symtable_find(HashTable *ht, zend_string *str)
229 {
230 zend_ulong idx;
231 register const char *tmp = str->val;
232
233 do {
234 if (*tmp > '9') {
235 break;
236 } else if (*tmp < '0') {
237 if (*tmp != '-') {
238 break;
239 }
240 tmp++;
241 if (*tmp > '9' || *tmp < '0') {
242 break;
243 }
244 }
245 if (_zend_handle_numeric_str_ex(str->val, str->len, &idx)) {
246 return zend_hash_index_find(ht, idx);
247 }
248 } while (0);
249
250 return zend_hash_find(ht, str);
251 }
252
zend_jit_hash_index_lookup_rw_no_packed(HashTable * ht,zend_long idx)253 static zval* ZEND_FASTCALL zend_jit_hash_index_lookup_rw_no_packed(HashTable *ht, zend_long idx)
254 {
255 zval *retval = NULL;
256
257 if (!HT_IS_PACKED(ht)) {
258 retval = _zend_hash_index_find(ht, idx);
259 }
260 if (!retval) {
261 retval = zend_undefined_offset_write(ht, idx);
262 }
263 return retval;
264 }
265
zend_jit_hash_index_lookup_rw(HashTable * ht,zend_long idx)266 static zval* ZEND_FASTCALL zend_jit_hash_index_lookup_rw(HashTable *ht, zend_long idx)
267 {
268 zval *retval = zend_hash_index_find(ht, idx);
269
270 if (!retval) {
271 retval = zend_undefined_offset_write(ht, idx);
272 }
273 return retval;
274 }
275
zend_jit_hash_lookup_rw(HashTable * ht,zend_string * str)276 static zval* ZEND_FASTCALL zend_jit_hash_lookup_rw(HashTable *ht, zend_string *str)
277 {
278 zval *retval = zend_hash_find_known_hash(ht, str);
279 if (!retval) {
280 /* Key may be released while throwing the undefined index warning. */
281 retval = zend_undefined_index_write(ht, str);
282 }
283 return retval;
284 }
285
zend_jit_symtable_lookup_rw(HashTable * ht,zend_string * str)286 static zval* ZEND_FASTCALL zend_jit_symtable_lookup_rw(HashTable *ht, zend_string *str)
287 {
288 zend_ulong idx;
289 register const char *tmp = str->val;
290 zval *retval;
291
292 do {
293 if (*tmp > '9') {
294 break;
295 } else if (*tmp < '0') {
296 if (*tmp != '-') {
297 break;
298 }
299 tmp++;
300 if (*tmp > '9' || *tmp < '0') {
301 break;
302 }
303 }
304 if (_zend_handle_numeric_str_ex(str->val, str->len, &idx)) {
305 retval = zend_hash_index_find(ht, idx);
306 if (!retval) {
307 retval = zend_undefined_offset_write(ht, idx);
308 }
309 return retval;
310 }
311 } while (0);
312
313 retval = zend_hash_find(ht, str);
314 if (!retval) {
315 /* Key may be released while throwing the undefined index warning. */
316 retval = zend_undefined_index_write(ht, str);
317 }
318 return retval;
319 }
320
zend_jit_symtable_lookup_w(HashTable * ht,zend_string * str)321 static zval* ZEND_FASTCALL zend_jit_symtable_lookup_w(HashTable *ht, zend_string *str)
322 {
323 zend_ulong idx;
324 register const char *tmp = str->val;
325
326 do {
327 if (*tmp > '9') {
328 break;
329 } else if (*tmp < '0') {
330 if (*tmp != '-') {
331 break;
332 }
333 tmp++;
334 if (*tmp > '9' || *tmp < '0') {
335 break;
336 }
337 }
338 if (_zend_handle_numeric_str_ex(str->val, str->len, &idx)) {
339 return zend_hash_index_lookup(ht, idx);
340 }
341 } while (0);
342
343 return zend_hash_lookup(ht, str);
344 }
345
zend_jit_undefined_op_helper(uint32_t var)346 static int ZEND_FASTCALL zend_jit_undefined_op_helper(uint32_t var)
347 {
348 const zend_execute_data *execute_data = EG(current_execute_data);
349 zend_string *cv = EX(func)->op_array.vars[EX_VAR_TO_NUM(var)];
350
351 zend_error_unchecked(E_WARNING, "Undefined variable $%S", cv);
352 return EG(exception) == NULL;
353 }
354
zend_jit_undefined_op_helper_write(HashTable * ht,uint32_t var)355 static int ZEND_FASTCALL zend_jit_undefined_op_helper_write(HashTable *ht, uint32_t var)
356 {
357 const zend_execute_data *execute_data = EG(current_execute_data);
358 zend_string *cv = EX(func)->op_array.vars[EX_VAR_TO_NUM(var)];
359
360 /* The array may be destroyed while throwing the notice.
361 * Temporarily increase the refcount to detect this situation. */
362 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
363 GC_ADDREF(ht);
364 }
365 zend_error_unchecked(E_WARNING, "Undefined variable $%S", cv);
366 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
367 if (!GC_REFCOUNT(ht)) {
368 zend_array_destroy(ht);
369 }
370 return 0;
371 }
372 return EG(exception) == NULL;
373 }
374
zend_jit_fetch_dim_r_helper(zend_array * ht,zval * dim,zval * result)375 static void ZEND_FASTCALL zend_jit_fetch_dim_r_helper(zend_array *ht, zval *dim, zval *result)
376 {
377 zend_ulong hval;
378 zend_string *offset_key;
379 zval *retval;
380 zend_execute_data *execute_data;
381 const zend_op *opline;
382
383 if (Z_TYPE_P(dim) == IS_REFERENCE) {
384 dim = Z_REFVAL_P(dim);
385 }
386
387 switch (Z_TYPE_P(dim)) {
388 case IS_LONG:
389 hval = Z_LVAL_P(dim);
390 goto num_index;
391 case IS_STRING:
392 offset_key = Z_STR_P(dim);
393 goto str_index;
394 case IS_UNDEF:
395 /* The array may be destroyed while throwing the notice.
396 * Temporarily increase the refcount to detect this situation. */
397 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
398 GC_ADDREF(ht);
399 }
400 execute_data = EG(current_execute_data);
401 opline = EX(opline);
402 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
403 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
404 zend_array_destroy(ht);
405 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
406 if (EG(exception)) {
407 ZVAL_UNDEF(EX_VAR(opline->result.var));
408 } else {
409 ZVAL_NULL(EX_VAR(opline->result.var));
410 }
411 }
412 return;
413 }
414 if (EG(exception)) {
415 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
416 ZVAL_UNDEF(EX_VAR(opline->result.var));
417 }
418 return;
419 }
420 ZEND_FALLTHROUGH;
421 case IS_NULL:
422 offset_key = ZSTR_EMPTY_ALLOC();
423 goto str_index;
424 case IS_DOUBLE:
425 hval = zend_dval_to_lval(Z_DVAL_P(dim));
426 if (!zend_is_long_compatible(Z_DVAL_P(dim), hval)) {
427 /* The array may be destroyed while throwing the notice.
428 * Temporarily increase the refcount to detect this situation. */
429 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
430 GC_ADDREF(ht);
431 }
432 execute_data = EG(current_execute_data);
433 opline = EX(opline);
434 zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
435 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
436 zend_array_destroy(ht);
437 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
438 if (EG(exception)) {
439 ZVAL_UNDEF(EX_VAR(opline->result.var));
440 } else {
441 ZVAL_NULL(EX_VAR(opline->result.var));
442 }
443 }
444 return;
445 }
446 if (EG(exception)) {
447 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
448 ZVAL_UNDEF(EX_VAR(opline->result.var));
449 }
450 return;
451 }
452 }
453 goto num_index;
454 case IS_RESOURCE:
455 /* The array may be destroyed while throwing the notice.
456 * Temporarily increase the refcount to detect this situation. */
457 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
458 GC_ADDREF(ht);
459 }
460 execute_data = EG(current_execute_data);
461 opline = EX(opline);
462 zend_use_resource_as_offset(dim);
463 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
464 zend_array_destroy(ht);
465 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
466 if (EG(exception)) {
467 ZVAL_UNDEF(EX_VAR(opline->result.var));
468 } else {
469 ZVAL_NULL(EX_VAR(opline->result.var));
470 }
471 }
472 return;
473 }
474 if (EG(exception)) {
475 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
476 ZVAL_UNDEF(EX_VAR(opline->result.var));
477 }
478 return;
479 }
480 hval = Z_RES_HANDLE_P(dim);
481 goto num_index;
482 case IS_FALSE:
483 hval = 0;
484 goto num_index;
485 case IS_TRUE:
486 hval = 1;
487 goto num_index;
488 default:
489 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), dim, BP_VAR_R);
490 undef_result_after_exception();
491 return;
492 }
493
494 str_index:
495 if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
496 goto num_index;
497 }
498 retval = zend_hash_find(ht, offset_key);
499 if (!retval) {
500 zend_error(E_WARNING, "Undefined array key \"%s\"", ZSTR_VAL(offset_key));
501 ZVAL_NULL(result);
502 return;
503 }
504 ZVAL_COPY_DEREF(result, retval);
505 return;
506
507 num_index:
508 ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
509 ZVAL_COPY_DEREF(result, retval);
510 return;
511
512 num_undef:
513 zend_error(E_WARNING, "Undefined array key " ZEND_LONG_FMT, hval);
514 ZVAL_NULL(result);
515 }
516
zend_jit_fetch_dim_is_helper(zend_array * ht,zval * dim,zval * result)517 static void ZEND_FASTCALL zend_jit_fetch_dim_is_helper(zend_array *ht, zval *dim, zval *result)
518 {
519 zend_ulong hval;
520 zend_string *offset_key;
521 zval *retval;
522 zend_execute_data *execute_data;
523 const zend_op *opline;
524
525 if (Z_TYPE_P(dim) == IS_REFERENCE) {
526 dim = Z_REFVAL_P(dim);
527 }
528
529 switch (Z_TYPE_P(dim)) {
530 case IS_LONG:
531 hval = Z_LVAL_P(dim);
532 goto num_index;
533 case IS_STRING:
534 offset_key = Z_STR_P(dim);
535 goto str_index;
536 case IS_UNDEF:
537 /* The array may be destroyed while throwing the notice.
538 * Temporarily increase the refcount to detect this situation. */
539 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
540 GC_ADDREF(ht);
541 }
542 execute_data = EG(current_execute_data);
543 opline = EX(opline);
544 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
545 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
546 zend_array_destroy(ht);
547 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
548 if (EG(exception)) {
549 ZVAL_UNDEF(EX_VAR(opline->result.var));
550 } else {
551 ZVAL_NULL(EX_VAR(opline->result.var));
552 }
553 }
554 return;
555 }
556 if (EG(exception)) {
557 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
558 ZVAL_UNDEF(EX_VAR(opline->result.var));
559 }
560 return;
561 }
562 ZEND_FALLTHROUGH;
563 case IS_NULL:
564 offset_key = ZSTR_EMPTY_ALLOC();
565 goto str_index;
566 case IS_DOUBLE:
567 hval = zend_dval_to_lval(Z_DVAL_P(dim));
568 if (!zend_is_long_compatible(Z_DVAL_P(dim), hval)) {
569 /* The array may be destroyed while throwing the notice.
570 * Temporarily increase the refcount to detect this situation. */
571 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
572 GC_ADDREF(ht);
573 }
574 execute_data = EG(current_execute_data);
575 opline = EX(opline);
576 zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
577 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
578 zend_array_destroy(ht);
579 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
580 if (EG(exception)) {
581 ZVAL_UNDEF(EX_VAR(opline->result.var));
582 } else {
583 ZVAL_NULL(EX_VAR(opline->result.var));
584 }
585 }
586 return;
587 }
588 if (EG(exception)) {
589 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
590 ZVAL_UNDEF(EX_VAR(opline->result.var));
591 }
592 return;
593 }
594 }
595 goto num_index;
596 case IS_RESOURCE:
597 /* The array may be destroyed while throwing the notice.
598 * Temporarily increase the refcount to detect this situation. */
599 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
600 GC_ADDREF(ht);
601 }
602 execute_data = EG(current_execute_data);
603 opline = EX(opline);
604 zend_use_resource_as_offset(dim);
605 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
606 zend_array_destroy(ht);
607 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
608 if (EG(exception)) {
609 ZVAL_UNDEF(EX_VAR(opline->result.var));
610 } else {
611 ZVAL_NULL(EX_VAR(opline->result.var));
612 }
613 }
614 return;
615 }
616 if (EG(exception)) {
617 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
618 ZVAL_UNDEF(EX_VAR(opline->result.var));
619 }
620 return;
621 }
622 hval = Z_RES_HANDLE_P(dim);
623 goto num_index;
624 case IS_FALSE:
625 hval = 0;
626 goto num_index;
627 case IS_TRUE:
628 hval = 1;
629 goto num_index;
630 default:
631 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), dim,
632 EG(current_execute_data)->opline->opcode == ZEND_ISSET_ISEMPTY_DIM_OBJ ?
633 BP_VAR_IS : BP_VAR_RW);
634 undef_result_after_exception();
635 return;
636 }
637
638 str_index:
639 if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
640 goto num_index;
641 }
642 retval = zend_hash_find(ht, offset_key);
643 if (!retval) {
644 ZVAL_NULL(result);
645 return;
646 }
647 ZVAL_COPY_DEREF(result, retval);
648 return;
649
650 num_index:
651 ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
652 ZVAL_COPY_DEREF(result, retval);
653 return;
654
655 num_undef:
656 ZVAL_NULL(result);
657 }
658
zend_jit_fetch_dim_isset_helper(zend_array * ht,zval * dim)659 static int ZEND_FASTCALL zend_jit_fetch_dim_isset_helper(zend_array *ht, zval *dim)
660 {
661 zend_ulong hval;
662 zend_string *offset_key;
663 zval *retval;
664
665 if (Z_TYPE_P(dim) == IS_REFERENCE) {
666 dim = Z_REFVAL_P(dim);
667 }
668
669 switch (Z_TYPE_P(dim)) {
670 case IS_LONG:
671 hval = Z_LVAL_P(dim);
672 goto num_index;
673 case IS_STRING:
674 offset_key = Z_STR_P(dim);
675 goto str_index;
676 case IS_UNDEF:
677 /* The array may be destroyed while throwing the notice.
678 * Temporarily increase the refcount to detect this situation. */
679 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
680 GC_ADDREF(ht);
681 }
682 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
683 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
684 zend_array_destroy(ht);
685 return 0;
686 }
687 if (EG(exception)) {
688 return 0;
689 }
690 ZEND_FALLTHROUGH;
691 case IS_NULL:
692 offset_key = ZSTR_EMPTY_ALLOC();
693 goto str_index;
694 case IS_DOUBLE:
695 hval = zend_dval_to_lval(Z_DVAL_P(dim));
696 if (!zend_is_long_compatible(Z_DVAL_P(dim), hval)) {
697 /* The array may be destroyed while throwing the notice.
698 * Temporarily increase the refcount to detect this situation. */
699 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
700 GC_ADDREF(ht);
701 }
702 zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
703 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
704 zend_array_destroy(ht);
705 return 0;
706 }
707 if (EG(exception)) {
708 return 0;
709 }
710 }
711 goto num_index;
712 case IS_RESOURCE:
713 /* The array may be destroyed while throwing the notice.
714 * Temporarily increase the refcount to detect this situation. */
715 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
716 GC_ADDREF(ht);
717 }
718 zend_use_resource_as_offset(dim);
719 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && !GC_DELREF(ht)) {
720 zend_array_destroy(ht);
721 return 0;
722 }
723 if (EG(exception)) {
724 return 0;
725 }
726 hval = Z_RES_HANDLE_P(dim);
727 goto num_index;
728 case IS_FALSE:
729 hval = 0;
730 goto num_index;
731 case IS_TRUE:
732 hval = 1;
733 goto num_index;
734 default:
735 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), dim, BP_VAR_IS);
736 return 0;
737 }
738
739 str_index:
740 if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
741 goto num_index;
742 }
743 retval = zend_hash_find(ht, offset_key);
744 if (!retval) {
745 return 0;
746 }
747 if (UNEXPECTED(Z_TYPE_P(retval) == IS_REFERENCE)) {
748 retval = Z_REFVAL_P(retval);
749 }
750 return Z_TYPE_P(retval) > IS_NULL;
751
752 num_index:
753 ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
754 if (UNEXPECTED(Z_TYPE_P(retval) == IS_REFERENCE)) {
755 retval = Z_REFVAL_P(retval);
756 }
757 return (Z_TYPE_P(retval) > IS_NULL);
758
759 num_undef:
760 return 0;
761 }
762
zend_jit_fetch_dim_rw_helper(zend_array * ht,zval * dim)763 static zval* ZEND_FASTCALL zend_jit_fetch_dim_rw_helper(zend_array *ht, zval *dim)
764 {
765 zend_ulong hval;
766 zend_string *offset_key;
767 zval *retval;
768 zend_execute_data *execute_data;
769 const zend_op *opline;
770
771 if (Z_TYPE_P(dim) == IS_REFERENCE) {
772 dim = Z_REFVAL_P(dim);
773 }
774
775 switch (Z_TYPE_P(dim)) {
776 case IS_LONG:
777 hval = Z_LVAL_P(dim);
778 goto num_index;
779 case IS_STRING:
780 offset_key = Z_STR_P(dim);
781 goto str_index;
782 case IS_UNDEF:
783 execute_data = EG(current_execute_data);
784 opline = EX(opline);
785 if (UNEXPECTED(opline->opcode == ZEND_HANDLE_EXCEPTION)) {
786 opline = EG(opline_before_exception);
787 }
788 if (opline && !zend_jit_undefined_op_helper_write(ht, opline->op2.var)) {
789 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
790 if (EG(exception)) {
791 ZVAL_UNDEF(EX_VAR(opline->result.var));
792 } else {
793 ZVAL_NULL(EX_VAR(opline->result.var));
794 }
795 }
796 return NULL;
797 }
798 ZEND_FALLTHROUGH;
799 case IS_NULL:
800 offset_key = ZSTR_EMPTY_ALLOC();
801 goto str_index;
802 case IS_DOUBLE:
803 hval = zend_dval_to_lval(Z_DVAL_P(dim));
804 if (!zend_is_long_compatible(Z_DVAL_P(dim), hval)) {
805 /* The array may be destroyed while throwing the notice.
806 * Temporarily increase the refcount to detect this situation. */
807 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
808 GC_ADDREF(ht);
809 }
810 execute_data = EG(current_execute_data);
811 opline = EX(opline);
812 zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
813 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
814 if (!GC_REFCOUNT(ht)) {
815 zend_array_destroy(ht);
816 }
817 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
818 if (EG(exception)) {
819 ZVAL_UNDEF(EX_VAR(opline->result.var));
820 } else {
821 ZVAL_NULL(EX_VAR(opline->result.var));
822 }
823 }
824 return NULL;
825 }
826 if (EG(exception)) {
827 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
828 ZVAL_UNDEF(EX_VAR(opline->result.var));
829 }
830 return NULL;
831 }
832 }
833 goto num_index;
834 case IS_RESOURCE:
835 /* The array may be destroyed while throwing the notice.
836 * Temporarily increase the refcount to detect this situation. */
837 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
838 GC_ADDREF(ht);
839 }
840 execute_data = EG(current_execute_data);
841 opline = EX(opline);
842 zend_use_resource_as_offset(dim);
843 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
844 if (!GC_REFCOUNT(ht)) {
845 zend_array_destroy(ht);
846 }
847 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
848 if (EG(exception)) {
849 ZVAL_UNDEF(EX_VAR(opline->result.var));
850 } else {
851 ZVAL_NULL(EX_VAR(opline->result.var));
852 }
853 }
854 return NULL;
855 }
856 if (EG(exception)) {
857 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
858 ZVAL_UNDEF(EX_VAR(opline->result.var));
859 }
860 return NULL;
861 }
862 hval = Z_RES_HANDLE_P(dim);
863 goto num_index;
864 case IS_FALSE:
865 hval = 0;
866 goto num_index;
867 case IS_TRUE:
868 hval = 1;
869 goto num_index;
870 default:
871 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), dim, BP_VAR_RW);
872 undef_result_after_exception();
873 return NULL;
874 }
875
876 str_index:
877 if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
878 goto num_index;
879 }
880 retval = zend_hash_find(ht, offset_key);
881 if (!retval) {
882 /* Key may be released while throwing the undefined index warning. */
883 retval = zend_undefined_index_write(ht, offset_key);
884 }
885 return retval;
886
887 num_index:
888 ZEND_HASH_INDEX_FIND(ht, hval, retval, num_undef);
889 return retval;
890
891 num_undef:
892 return zend_undefined_offset_write(ht, hval);
893 }
894
zend_jit_fetch_dim_w_helper(zend_array * ht,zval * dim)895 static zval* ZEND_FASTCALL zend_jit_fetch_dim_w_helper(zend_array *ht, zval *dim)
896 {
897 zend_ulong hval;
898 zend_string *offset_key;
899 zval *retval;
900 zend_execute_data *execute_data;
901 const zend_op *opline;
902
903 if (Z_TYPE_P(dim) == IS_REFERENCE) {
904 dim = Z_REFVAL_P(dim);
905 }
906
907 switch (Z_TYPE_P(dim)) {
908 case IS_LONG:
909 hval = Z_LVAL_P(dim);
910 goto num_index;
911 case IS_STRING:
912 offset_key = Z_STR_P(dim);
913 goto str_index;
914 case IS_UNDEF:
915 execute_data = EG(current_execute_data);
916 opline = EX(opline);
917 if (!zend_jit_undefined_op_helper_write(ht, opline->op2.var)) {
918 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
919 if (EG(exception)) {
920 ZVAL_UNDEF(EX_VAR(opline->result.var));
921 } else {
922 ZVAL_NULL(EX_VAR(opline->result.var));
923 }
924 }
925 if (opline->opcode == ZEND_ASSIGN_DIM
926 && ((opline+1)->op1_type & (IS_VAR | IS_TMP_VAR))) {
927 zval_ptr_dtor_nogc(EX_VAR((opline+1)->op1.var));
928 }
929 return NULL;
930 }
931 ZEND_FALLTHROUGH;
932 case IS_NULL:
933 offset_key = ZSTR_EMPTY_ALLOC();
934 goto str_index;
935 case IS_DOUBLE:
936 hval = zend_dval_to_lval(Z_DVAL_P(dim));
937 if (!zend_is_long_compatible(Z_DVAL_P(dim), hval)) {
938 /* The array may be destroyed while throwing the notice.
939 * Temporarily increase the refcount to detect this situation. */
940 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
941 GC_ADDREF(ht);
942 }
943 execute_data = EG(current_execute_data);
944 opline = EX(opline);
945 zend_incompatible_double_to_long_error(Z_DVAL_P(dim));
946 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
947 if (!GC_REFCOUNT(ht)) {
948 zend_array_destroy(ht);
949 }
950 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
951 if (EG(exception)) {
952 ZVAL_UNDEF(EX_VAR(opline->result.var));
953 } else {
954 ZVAL_NULL(EX_VAR(opline->result.var));
955 }
956 }
957 return NULL;
958 }
959 if (EG(exception)) {
960 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
961 ZVAL_UNDEF(EX_VAR(opline->result.var));
962 }
963 return NULL;
964 }
965 }
966 goto num_index;
967 case IS_RESOURCE:
968 /* The array may be destroyed while throwing the notice.
969 * Temporarily increase the refcount to detect this situation. */
970 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE)) {
971 GC_ADDREF(ht);
972 }
973 execute_data = EG(current_execute_data);
974 opline = EX(opline);
975 zend_use_resource_as_offset(dim);
976 if (!(GC_FLAGS(ht) & IS_ARRAY_IMMUTABLE) && GC_DELREF(ht) != 1) {
977 if (!GC_REFCOUNT(ht)) {
978 zend_array_destroy(ht);
979 }
980 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
981 if (EG(exception)) {
982 ZVAL_UNDEF(EX_VAR(opline->result.var));
983 } else {
984 ZVAL_NULL(EX_VAR(opline->result.var));
985 }
986 }
987 return NULL;
988 }
989 if (EG(exception)) {
990 if (opline->result_type & (IS_VAR | IS_TMP_VAR)) {
991 ZVAL_UNDEF(EX_VAR(opline->result.var));
992 }
993 return NULL;
994 }
995 hval = Z_RES_HANDLE_P(dim);
996 goto num_index;
997 case IS_FALSE:
998 hval = 0;
999 goto num_index;
1000 case IS_TRUE:
1001 hval = 1;
1002 goto num_index;
1003 default:
1004 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_ARRAY), dim, BP_VAR_R);
1005 undef_result_after_exception();
1006 if (EG(opline_before_exception)
1007 && (EG(opline_before_exception)+1)->opcode == ZEND_OP_DATA
1008 && ((EG(opline_before_exception)+1)->op1_type & (IS_VAR|IS_TMP_VAR))) {
1009 zend_execute_data *execute_data = EG(current_execute_data);
1010
1011 zval_ptr_dtor_nogc(EX_VAR((EG(opline_before_exception)+1)->op1.var));
1012 }
1013 return NULL;
1014 }
1015
1016 str_index:
1017 if (ZEND_HANDLE_NUMERIC(offset_key, hval)) {
1018 goto num_index;
1019 }
1020 return zend_hash_lookup(ht, offset_key);
1021
1022 num_index:
1023 ZEND_HASH_INDEX_LOOKUP(ht, hval, retval);
1024 return retval;
1025 }
1026
1027 /* type is one of the BP_VAR_* constants */
zend_check_string_offset(zval * dim,int type)1028 static zend_never_inline zend_long zend_check_string_offset(zval *dim, int type)
1029 {
1030 zend_long offset;
1031
1032 try_again:
1033 switch(Z_TYPE_P(dim)) {
1034 case IS_LONG:
1035 return Z_LVAL_P(dim);
1036 case IS_STRING:
1037 {
1038 bool trailing_data = false;
1039 /* For BC reasons we allow errors so that we can warn on leading numeric string */
1040 if (IS_LONG == is_numeric_string_ex(Z_STRVAL_P(dim), Z_STRLEN_P(dim), &offset, NULL,
1041 /* allow errors */ true, NULL, &trailing_data)) {
1042 if (UNEXPECTED(trailing_data)
1043 && EG(current_execute_data)->opline->opcode != ZEND_FETCH_DIM_UNSET) {
1044 zend_error(E_WARNING, "Illegal string offset \"%s\"", Z_STRVAL_P(dim));
1045 }
1046 return offset;
1047 }
1048 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_STRING), dim, BP_VAR_R);
1049 return 0;
1050 }
1051 case IS_UNDEF:
1052 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
1053 ZEND_FALLTHROUGH;
1054 case IS_DOUBLE:
1055 case IS_NULL:
1056 case IS_FALSE:
1057 case IS_TRUE:
1058 zend_error(E_WARNING, "String offset cast occurred");
1059 break;
1060 case IS_REFERENCE:
1061 dim = Z_REFVAL_P(dim);
1062 goto try_again;
1063 default:
1064 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_STRING), dim, type);
1065 return 0;
1066 }
1067
1068 return zval_get_long_func(dim, /* is_strict */ false);
1069 }
1070
zend_jit_fetch_dim_str_offset(zend_string * str,zend_long offset)1071 static zend_always_inline zend_string* zend_jit_fetch_dim_str_offset(zend_string *str, zend_long offset)
1072 {
1073 if (UNEXPECTED((zend_ulong)offset >= (zend_ulong)ZSTR_LEN(str))) {
1074 if (EXPECTED(offset < 0)) {
1075 /* Handle negative offset */
1076 zend_long real_offset = (zend_long)ZSTR_LEN(str) + offset;
1077
1078 if (EXPECTED(real_offset >= 0)) {
1079 return ZSTR_CHAR((uint8_t)ZSTR_VAL(str)[real_offset]);
1080 }
1081 }
1082 zend_error(E_WARNING, "Uninitialized string offset " ZEND_LONG_FMT, offset);
1083 return ZSTR_EMPTY_ALLOC();
1084 } else {
1085 return ZSTR_CHAR((uint8_t)ZSTR_VAL(str)[offset]);
1086 }
1087 }
1088
zend_jit_fetch_dim_str_offset_r_helper(zend_string * str,zend_long offset)1089 static zend_string* ZEND_FASTCALL zend_jit_fetch_dim_str_offset_r_helper(zend_string *str, zend_long offset)
1090 {
1091 return zend_jit_fetch_dim_str_offset(str, offset);
1092 }
1093
zend_jit_fetch_dim_str_r_helper(zend_string * str,zval * dim)1094 static zend_string* ZEND_FASTCALL zend_jit_fetch_dim_str_r_helper(zend_string *str, zval *dim)
1095 {
1096 zend_long offset;
1097
1098 if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1099 if (!(GC_FLAGS(str) & IS_STR_INTERNED)) {
1100 GC_ADDREF(str);
1101 }
1102 offset = zend_check_string_offset(dim, BP_VAR_R);
1103 if (!(GC_FLAGS(str) & IS_STR_INTERNED) && UNEXPECTED(GC_DELREF(str) == 0)) {
1104 zend_string *ret = zend_jit_fetch_dim_str_offset(str, offset);
1105 zend_string_efree(str);
1106 return ret;
1107 }
1108 } else {
1109 offset = Z_LVAL_P(dim);
1110 }
1111 if (UNEXPECTED(EG(exception) != NULL)) {
1112 return ZSTR_EMPTY_ALLOC();
1113 }
1114 return zend_jit_fetch_dim_str_offset(str, offset);
1115 }
1116
zend_jit_fetch_dim_str_is_helper(zend_string * str,zval * dim,zval * result)1117 static void ZEND_FASTCALL zend_jit_fetch_dim_str_is_helper(zend_string *str, zval *dim, zval *result)
1118 {
1119 zend_long offset;
1120
1121 try_string_offset:
1122 if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1123 switch (Z_TYPE_P(dim)) {
1124 /* case IS_LONG: */
1125 case IS_STRING:
1126 if (IS_LONG == is_numeric_string(Z_STRVAL_P(dim), Z_STRLEN_P(dim), NULL, NULL, false)) {
1127 break;
1128 }
1129 ZVAL_NULL(result);
1130 return;
1131 case IS_UNDEF:
1132 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
1133 case IS_DOUBLE:
1134 case IS_NULL:
1135 case IS_FALSE:
1136 case IS_TRUE:
1137 break;
1138 case IS_REFERENCE:
1139 dim = Z_REFVAL_P(dim);
1140 goto try_string_offset;
1141 default:
1142 zend_illegal_container_offset(ZSTR_KNOWN(ZEND_STR_STRING), dim,
1143 EG(current_execute_data)->opline->opcode == ZEND_ISSET_ISEMPTY_DIM_OBJ ?
1144 BP_VAR_IS : BP_VAR_RW);
1145 ZVAL_NULL(result);
1146 return;
1147 }
1148
1149 offset = zval_get_long_func(dim, /* is_strict */ false);
1150 } else {
1151 offset = Z_LVAL_P(dim);
1152 }
1153
1154 if ((zend_ulong)offset >= (zend_ulong)ZSTR_LEN(str)) {
1155 if (offset < 0) {
1156 /* Handle negative offset */
1157 zend_long real_offset = (zend_long)ZSTR_LEN(str) + offset;
1158
1159 if (real_offset >= 0) {
1160 ZVAL_CHAR(result, (uint8_t)ZSTR_VAL(str)[real_offset]);
1161 return;
1162 }
1163 }
1164 ZVAL_NULL(result);
1165 } else {
1166 ZVAL_CHAR(result, (uint8_t)ZSTR_VAL(str)[offset]);
1167 }
1168 }
1169
zend_jit_fetch_dim_obj_r_helper(zval * container,zval * dim,zval * result)1170 static void ZEND_FASTCALL zend_jit_fetch_dim_obj_r_helper(zval *container, zval *dim, zval *result)
1171 {
1172 zval *retval;
1173 zend_object *obj = Z_OBJ_P(container);
1174
1175 GC_ADDREF(obj);
1176 if (UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
1177 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
1178 dim = &EG(uninitialized_zval);
1179 }
1180
1181 retval = obj->handlers->read_dimension(obj, dim, BP_VAR_R, result);
1182
1183 if (retval) {
1184 if (result != retval) {
1185 ZVAL_COPY_DEREF(result, retval);
1186 } else if (UNEXPECTED(Z_ISREF_P(retval))) {
1187 zend_unwrap_reference(retval);
1188 }
1189 } else {
1190 ZVAL_NULL(result);
1191 }
1192 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
1193 zend_objects_store_del(obj);
1194 }
1195 }
1196
zend_jit_fetch_dim_obj_is_helper(zval * container,zval * dim,zval * result)1197 static void ZEND_FASTCALL zend_jit_fetch_dim_obj_is_helper(zval *container, zval *dim, zval *result)
1198 {
1199 zval *retval;
1200 zend_object *obj = Z_OBJ_P(container);
1201
1202 GC_ADDREF(obj);
1203 if (UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
1204 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
1205 dim = &EG(uninitialized_zval);
1206 }
1207
1208 retval = obj->handlers->read_dimension(obj, dim, BP_VAR_IS, result);
1209
1210 if (retval) {
1211 if (result != retval) {
1212 ZVAL_COPY_DEREF(result, retval);
1213 } else if (UNEXPECTED(Z_ISREF_P(retval))) {
1214 zend_unwrap_reference(result);
1215 }
1216 } else {
1217 ZVAL_NULL(result);
1218 }
1219 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
1220 zend_objects_store_del(obj);
1221 }
1222 }
1223
zend_assign_to_string_offset(zval * str,zval * dim,zval * value,zval * result)1224 static zend_never_inline void zend_assign_to_string_offset(zval *str, zval *dim, zval *value, zval *result)
1225 {
1226 uint8_t c;
1227 size_t string_len;
1228 zend_long offset;
1229 zend_string *s;
1230
1231 /* separate string */
1232 if (Z_REFCOUNTED_P(str) && Z_REFCOUNT_P(str) == 1) {
1233 s = Z_STR_P(str);
1234 } else {
1235 s = zend_string_init(Z_STRVAL_P(str), Z_STRLEN_P(str), 0);
1236 ZSTR_H(s) = ZSTR_H(Z_STR_P(str));
1237 if (Z_REFCOUNTED_P(str)) {
1238 GC_DELREF(Z_STR_P(str));
1239 }
1240 ZVAL_NEW_STR(str, s);
1241 }
1242
1243 if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1244 /* The string may be destroyed while throwing the notice.
1245 * Temporarily increase the refcount to detect this situation. */
1246 GC_ADDREF(s);
1247 offset = zend_check_string_offset(dim, BP_VAR_W);
1248 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1249 zend_string_efree(s);
1250 if (result) {
1251 ZVAL_NULL(result);
1252 }
1253 return;
1254 }
1255 if (UNEXPECTED(EG(exception) != NULL)) {
1256 if (UNEXPECTED(result)) {
1257 ZVAL_UNDEF(result);
1258 }
1259 return;
1260 }
1261 } else {
1262 offset = Z_LVAL_P(dim);
1263 }
1264 if (offset < -(zend_long)ZSTR_LEN(s)) {
1265 /* Error on negative offset */
1266 zend_error(E_WARNING, "Illegal string offset " ZEND_LONG_FMT, offset);
1267 if (result) {
1268 ZVAL_NULL(result);
1269 }
1270 return;
1271 }
1272
1273 if (Z_TYPE_P(value) != IS_STRING) {
1274 zend_string *tmp;
1275
1276 /* The string may be destroyed while throwing the notice.
1277 * Temporarily increase the refcount to detect this situation. */
1278 GC_ADDREF(s);
1279
1280 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
1281 const zend_op *op_data = EG(current_execute_data)->opline + 1;
1282 ZEND_ASSERT(op_data->opcode == ZEND_OP_DATA && op_data->op1_type == IS_CV);
1283 zend_jit_undefined_op_helper(op_data->op1.var);
1284 value = &EG(uninitialized_zval);
1285 }
1286
1287 /* Convert to string, just the time to pick the 1st byte */
1288 tmp = zval_try_get_string_func(value);
1289
1290 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1291 zend_string_efree(s);
1292 if (tmp) {
1293 zend_string_release_ex(tmp, 0);
1294 }
1295 if (result) {
1296 ZVAL_NULL(result);
1297 }
1298 return;
1299 }
1300 if (UNEXPECTED(!tmp)) {
1301 if (result) {
1302 ZVAL_UNDEF(result);
1303 }
1304 return;
1305 }
1306
1307 if (UNEXPECTED(!tmp)) {
1308 if (result) {
1309 ZVAL_UNDEF(result);
1310 }
1311 return;
1312 }
1313
1314 string_len = ZSTR_LEN(tmp);
1315 c = (uint8_t)ZSTR_VAL(tmp)[0];
1316 zend_string_release(tmp);
1317 } else {
1318 string_len = Z_STRLEN_P(value);
1319 c = (uint8_t)Z_STRVAL_P(value)[0];
1320 }
1321
1322
1323 if (string_len != 1) {
1324 if (string_len == 0) {
1325 /* Error on empty input string */
1326 zend_throw_error(NULL, "Cannot assign an empty string to a string offset");
1327 if (result) {
1328 ZVAL_NULL(result);
1329 }
1330 return;
1331 }
1332
1333 /* The string may be destroyed while throwing the notice.
1334 * Temporarily increase the refcount to detect this situation. */
1335 GC_ADDREF(s);
1336 zend_error(E_WARNING, "Only the first byte will be assigned to the string offset");
1337 if (UNEXPECTED(GC_DELREF(s) == 0)) {
1338 zend_string_efree(s);
1339 if (result) {
1340 ZVAL_NULL(result);
1341 }
1342 return;
1343 }
1344 /* Illegal offset assignment */
1345 if (UNEXPECTED(EG(exception) != NULL)) {
1346 if (result) {
1347 ZVAL_UNDEF(result);
1348 }
1349 return;
1350 }
1351 }
1352
1353 if (offset < 0) { /* Handle negative offset */
1354 offset += (zend_long)ZSTR_LEN(s);
1355 }
1356
1357 if ((size_t)offset >= ZSTR_LEN(s)) {
1358 /* Extend string if needed */
1359 zend_long old_len = ZSTR_LEN(s);
1360 ZVAL_NEW_STR(str, zend_string_extend(s, (size_t)offset + 1, 0));
1361 memset(Z_STRVAL_P(str) + old_len, ' ', offset - old_len);
1362 Z_STRVAL_P(str)[offset+1] = 0;
1363 } else {
1364 zend_string_forget_hash_val(Z_STR_P(str));
1365 }
1366
1367 Z_STRVAL_P(str)[offset] = c;
1368
1369 if (result) {
1370 /* Return the new character */
1371 ZVAL_CHAR(result, c);
1372 }
1373 }
1374
zend_jit_fetch_dim_obj_helper(zval * object_ptr,zval * dim,zval * result,int type)1375 static zend_always_inline void ZEND_FASTCALL zend_jit_fetch_dim_obj_helper(zval *object_ptr, zval *dim, zval *result, int type)
1376 {
1377 zval *retval;
1378
1379 if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) {
1380 zend_object *obj = Z_OBJ_P(object_ptr);
1381
1382 GC_ADDREF(obj);
1383 if (dim && UNEXPECTED(Z_ISUNDEF_P(dim))) {
1384 const zend_op *opline = EG(current_execute_data)->opline;
1385 zend_jit_undefined_op_helper(opline->op2.var);
1386 dim = &EG(uninitialized_zval);
1387 }
1388
1389 retval = obj->handlers->read_dimension(obj, dim, type, result);
1390 if (UNEXPECTED(retval == &EG(uninitialized_zval))) {
1391 zend_class_entry *ce = obj->ce;
1392
1393 ZVAL_NULL(result);
1394 zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
1395 } else if (EXPECTED(retval && Z_TYPE_P(retval) != IS_UNDEF)) {
1396 if (!Z_ISREF_P(retval)) {
1397 if (result != retval) {
1398 ZVAL_COPY(result, retval);
1399 retval = result;
1400 }
1401 if (Z_TYPE_P(retval) != IS_OBJECT) {
1402 zend_class_entry *ce = obj->ce;
1403 zend_error(E_NOTICE, "Indirect modification of overloaded element of %s has no effect", ZSTR_VAL(ce->name));
1404 }
1405 } else if (UNEXPECTED(Z_REFCOUNT_P(retval) == 1)) {
1406 ZVAL_UNREF(retval);
1407 }
1408 if (result != retval) {
1409 ZVAL_INDIRECT(result, retval);
1410 }
1411 } else {
1412 ZEND_ASSERT(EG(exception) && "read_dimension() returned NULL without exception");
1413 ZVAL_UNDEF(result);
1414 }
1415 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
1416 zend_objects_store_del(obj);
1417 }
1418 } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) {
1419 if (!dim) {
1420 zend_throw_error(NULL, "[] operator not supported for strings");
1421 } else {
1422 if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1423 zend_check_string_offset(dim, BP_VAR_RW);
1424 }
1425 zend_wrong_string_offset_error();
1426 }
1427 ZVAL_UNDEF(result);
1428 } else if (Z_TYPE_P(object_ptr) == IS_FALSE) {
1429 zend_array *arr = zend_new_array(0);
1430 ZVAL_ARR(object_ptr, arr);
1431 GC_ADDREF(arr);
1432 zend_false_to_array_deprecated();
1433 if (UNEXPECTED(GC_DELREF(arr) == 0)) {
1434 zend_array_destroy(arr);
1435 ZVAL_NULL(result);
1436 return;
1437 }
1438 SEPARATE_ARRAY(object_ptr);
1439 arr = Z_ARRVAL_P(object_ptr);
1440 zval *var;
1441 if (dim) {
1442 if (type == BP_VAR_W) {
1443 var = zend_jit_fetch_dim_w_helper(arr, dim);
1444 } else {
1445 ZEND_ASSERT(type == BP_VAR_RW);
1446 var = zend_jit_fetch_dim_rw_helper(arr, dim);
1447 }
1448 } else {
1449 var = zend_hash_next_index_insert_new(arr, &EG(uninitialized_zval));
1450 }
1451 if (var) {
1452 ZVAL_INDIRECT(result, var);
1453 } else {
1454 ZVAL_UNDEF(result);
1455 }
1456 } else {
1457 if (type == BP_VAR_UNSET) {
1458 zend_throw_error(NULL, "Cannot unset offset in a non-array variable");
1459 ZVAL_UNDEF(result);
1460 } else {
1461 zend_throw_error(NULL, "Cannot use a scalar value as an array");
1462 ZVAL_UNDEF(result);
1463 }
1464 }
1465 }
1466
zend_jit_fetch_dim_obj_w_helper(zval * object_ptr,zval * dim,zval * result)1467 static void ZEND_FASTCALL zend_jit_fetch_dim_obj_w_helper(zval *object_ptr, zval *dim, zval *result)
1468 {
1469 zend_jit_fetch_dim_obj_helper(object_ptr, dim, result, BP_VAR_W);
1470 }
1471
zend_jit_fetch_dim_obj_rw_helper(zval * object_ptr,zval * dim,zval * result)1472 static void ZEND_FASTCALL zend_jit_fetch_dim_obj_rw_helper(zval *object_ptr, zval *dim, zval *result)
1473 {
1474 zend_jit_fetch_dim_obj_helper(object_ptr, dim, result, BP_VAR_RW);
1475 }
1476
1477 //static void ZEND_FASTCALL zend_jit_fetch_dim_obj_unset_helper(zval *object_ptr, zval *dim, zval *result)
1478 //{
1479 // zend_jit_fetch_dim_obj_helper(object_ptr, dim, result, BP_VAR_UNSET);
1480 //}
1481
zend_jit_assign_dim_helper(zval * object_ptr,zval * dim,zval * value,zval * result)1482 static void ZEND_FASTCALL zend_jit_assign_dim_helper(zval *object_ptr, zval *dim, zval *value, zval *result)
1483 {
1484 if (EXPECTED(Z_TYPE_P(object_ptr) == IS_OBJECT)) {
1485 zend_object *obj = Z_OBJ_P(object_ptr);
1486
1487 GC_ADDREF(obj);
1488 if (dim && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
1489 const zend_op *opline = EG(current_execute_data)->opline;
1490 zend_jit_undefined_op_helper(opline->op2.var);
1491 dim = &EG(uninitialized_zval);
1492 }
1493
1494 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
1495 const zend_op *op_data = EG(current_execute_data)->opline + 1;
1496 ZEND_ASSERT(op_data->opcode == ZEND_OP_DATA && op_data->op1_type == IS_CV);
1497 zend_jit_undefined_op_helper(op_data->op1.var);
1498 value = &EG(uninitialized_zval);
1499 } else {
1500 ZVAL_DEREF(value);
1501 }
1502
1503 obj->handlers->write_dimension(obj, dim, value);
1504 if (result) {
1505 if (EXPECTED(!EG(exception))) {
1506 ZVAL_COPY(result, value);
1507 } else {
1508 ZVAL_UNDEF(result);
1509 }
1510 }
1511 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
1512 zend_objects_store_del(obj);
1513 }
1514 return;
1515 } else if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING) && EXPECTED(dim != NULL)) {
1516 zend_assign_to_string_offset(object_ptr, dim, value, result);
1517 return;
1518 }
1519
1520 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
1521 const zend_op *op_data = EG(current_execute_data)->opline + 1;
1522 ZEND_ASSERT(op_data->opcode == ZEND_OP_DATA && op_data->op1_type == IS_CV);
1523 zend_jit_undefined_op_helper(op_data->op1.var);
1524 value = &EG(uninitialized_zval);
1525 }
1526
1527 if (EXPECTED(Z_TYPE_P(object_ptr) == IS_STRING)) {
1528 zend_throw_error(NULL, "[] operator not supported for strings");
1529 if (result) {
1530 ZVAL_UNDEF(result);
1531 }
1532 } else if (Z_TYPE_P(object_ptr) == IS_FALSE) {
1533 zend_array *arr = zend_new_array(0);
1534 ZVAL_ARR(object_ptr, arr);
1535 GC_ADDREF(arr);
1536 zend_false_to_array_deprecated();
1537 if (UNEXPECTED(GC_DELREF(arr) == 0)) {
1538 zend_array_destroy(arr);
1539 if (result) {
1540 ZVAL_NULL(result);
1541 }
1542 return;
1543 }
1544 SEPARATE_ARRAY(object_ptr);
1545 arr = Z_ARRVAL_P(object_ptr);
1546 zval *var = dim
1547 ? zend_jit_fetch_dim_w_helper(arr, dim)
1548 : zend_hash_next_index_insert_new(arr, &EG(uninitialized_zval));
1549 if (!var) {
1550 if (result) {
1551 ZVAL_UNDEF(result);
1552 }
1553 return;
1554 }
1555
1556 ZVAL_COPY_DEREF(var, value);
1557 if (result) {
1558 ZVAL_COPY(result, var);
1559 }
1560 } else {
1561 if (dim && UNEXPECTED(Z_TYPE_P(dim) == IS_UNDEF)) {
1562 const zend_op *opline = EG(current_execute_data)->opline;
1563 zend_jit_undefined_op_helper(opline->op2.var);
1564 dim = &EG(uninitialized_zval);
1565 }
1566 zend_throw_error(NULL, "Cannot use a scalar value as an array");
1567 if (result) {
1568 ZVAL_UNDEF(result);
1569 }
1570 }
1571 }
1572
zend_jit_assign_dim_op_helper(zval * container,zval * dim,zval * value,binary_op_type binary_op)1573 static void ZEND_FASTCALL zend_jit_assign_dim_op_helper(zval *container, zval *dim, zval *value, binary_op_type binary_op)
1574 {
1575 if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
1576 zend_object *obj = Z_OBJ_P(container);
1577 zval *z;
1578 zval rv, res;
1579
1580 GC_ADDREF(obj);
1581 if (dim && UNEXPECTED(Z_ISUNDEF_P(dim))) {
1582 const zend_op *opline = EG(current_execute_data)->opline;
1583 zend_jit_undefined_op_helper(opline->op2.var);
1584 dim = &EG(uninitialized_zval);
1585 }
1586
1587 z = obj->handlers->read_dimension(obj, dim, BP_VAR_R, &rv);
1588 if (z != NULL) {
1589
1590 if (binary_op(&res, Z_ISREF_P(z) ? Z_REFVAL_P(z) : z, value) == SUCCESS) {
1591 obj->handlers->write_dimension(obj, dim, &res);
1592 }
1593 if (z == &rv) {
1594 zval_ptr_dtor(&rv);
1595 }
1596 zval_ptr_dtor(&res);
1597 } else {
1598 /* Exception is thrown in this case */
1599 GC_DELREF(obj);
1600 return;
1601 }
1602 if (UNEXPECTED(GC_DELREF(obj) == 0)) {
1603 zend_objects_store_del(obj);
1604 //??? if (retval) {
1605 //??? ZVAL_NULL(retval);
1606 //??? }
1607 }
1608 } else if (UNEXPECTED(Z_TYPE_P(container) == IS_STRING)) {
1609 if (!dim) {
1610 zend_throw_error(NULL, "[] operator not supported for strings");
1611 } else {
1612 if (UNEXPECTED(Z_TYPE_P(dim) != IS_LONG)) {
1613 zend_check_string_offset(dim, BP_VAR_RW);
1614 }
1615 zend_wrong_string_offset_error();
1616 }
1617 } else if (Z_TYPE_P(container) == IS_FALSE) {
1618 zend_array *arr = zend_new_array(0);
1619 ZVAL_ARR(container, arr);
1620 GC_ADDREF(arr);
1621 zend_false_to_array_deprecated();
1622 if (UNEXPECTED(GC_DELREF(arr) == 0)) {
1623 zend_array_destroy(arr);
1624 return;
1625 }
1626 SEPARATE_ARRAY(container);
1627 arr = Z_ARRVAL_P(container);
1628 zval *var = dim
1629 ? zend_jit_fetch_dim_rw_helper(arr, dim)
1630 : zend_hash_next_index_insert_new(arr, &EG(uninitialized_zval));
1631 if (var) {
1632 binary_op(var, var, value);
1633 }
1634 } else {
1635 zend_throw_error(NULL, "Cannot use a scalar value as an array");
1636 }
1637 }
1638
zend_jit_fast_assign_concat_helper(zval * op1,zval * op2)1639 static void ZEND_FASTCALL zend_jit_fast_assign_concat_helper(zval *op1, zval *op2)
1640 {
1641 size_t op1_len = Z_STRLEN_P(op1);
1642 size_t op2_len = Z_STRLEN_P(op2);
1643 size_t result_len = op1_len + op2_len;
1644 zend_string *result_str;
1645 uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
1646
1647 if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1648 zend_throw_error(NULL, "String size overflow");
1649 return;
1650 }
1651
1652 do {
1653 if (Z_REFCOUNTED_P(op1)) {
1654 if (GC_REFCOUNT(Z_STR_P(op1)) == 1) {
1655 result_str = perealloc(Z_STR_P(op1), ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(result_len)), 0);
1656 ZSTR_LEN(result_str) = result_len;
1657 zend_string_forget_hash_val(result_str);
1658 if (UNEXPECTED(Z_STR_P(op1) == Z_STR_P(op2))) {
1659 ZVAL_NEW_STR(op2, result_str);
1660 }
1661 break;
1662 }
1663 GC_DELREF(Z_STR_P(op1));
1664 }
1665 result_str = zend_string_alloc(result_len, 0);
1666 memcpy(ZSTR_VAL(result_str), Z_STRVAL_P(op1), op1_len);
1667 } while(0);
1668
1669 GC_ADD_FLAGS(result_str, flags);
1670 ZVAL_NEW_STR(op1, result_str);
1671 memcpy(ZSTR_VAL(result_str) + op1_len, Z_STRVAL_P(op2), op2_len);
1672 ZSTR_VAL(result_str)[result_len] = '\0';
1673 }
1674
zend_jit_fast_concat_helper(zval * result,zval * op1,zval * op2)1675 static void ZEND_FASTCALL zend_jit_fast_concat_helper(zval *result, zval *op1, zval *op2)
1676 {
1677 size_t op1_len = Z_STRLEN_P(op1);
1678 size_t op2_len = Z_STRLEN_P(op2);
1679 size_t result_len = op1_len + op2_len;
1680 zend_string *result_str;
1681 uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
1682
1683 if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1684 zend_throw_error(NULL, "String size overflow");
1685 return;
1686 }
1687
1688 result_str = zend_string_alloc(result_len, 0);
1689 GC_ADD_FLAGS(result_str, flags);
1690 memcpy(ZSTR_VAL(result_str), Z_STRVAL_P(op1), op1_len);
1691
1692 ZVAL_NEW_STR(result, result_str);
1693
1694 memcpy(ZSTR_VAL(result_str) + op1_len, Z_STRVAL_P(op2), op2_len);
1695 ZSTR_VAL(result_str)[result_len] = '\0';
1696 }
1697
zend_jit_fast_concat_tmp_helper(zval * result,zval * op1,zval * op2)1698 static void ZEND_FASTCALL zend_jit_fast_concat_tmp_helper(zval *result, zval *op1, zval *op2)
1699 {
1700 zend_string *op1_str = Z_STR_P(op1);
1701 size_t op1_len = ZSTR_LEN(op1_str);
1702 size_t op2_len = Z_STRLEN_P(op2);
1703 size_t result_len = op1_len + op2_len;
1704 zend_string *result_str;
1705 uint32_t flags = ZSTR_GET_COPYABLE_CONCAT_PROPERTIES_BOTH(Z_STR_P(op1), Z_STR_P(op2));
1706
1707 if (UNEXPECTED(op1_len > SIZE_MAX - op2_len)) {
1708 zend_throw_error(NULL, "String size overflow");
1709 return;
1710 }
1711
1712 do {
1713 if (!ZSTR_IS_INTERNED(op1_str)) {
1714 if (GC_REFCOUNT(op1_str) == 1) {
1715 Z_STR_P(op1) = result_str =
1716 perealloc(op1_str, ZEND_MM_ALIGNED_SIZE(_ZSTR_STRUCT_SIZE(result_len)), 0);
1717 ZSTR_LEN(result_str) = result_len;
1718 zend_string_forget_hash_val(result_str);
1719 break;
1720 }
1721 GC_DELREF(op1_str);
1722 }
1723 result_str = zend_string_alloc(result_len, 0);
1724 memcpy(ZSTR_VAL(result_str), ZSTR_VAL(op1_str), op1_len);
1725 } while (0);
1726
1727 GC_ADD_FLAGS(result_str, flags);
1728 ZVAL_NEW_STR(result, result_str);
1729
1730 memcpy(ZSTR_VAL(result_str) + op1_len, Z_STRVAL_P(op2), op2_len);
1731 ZSTR_VAL(result_str)[result_len] = '\0';
1732 }
1733
zend_jit_isset_dim_helper(zval * container,zval * offset)1734 static int ZEND_FASTCALL zend_jit_isset_dim_helper(zval *container, zval *offset)
1735 {
1736 if (UNEXPECTED(Z_TYPE_P(offset) == IS_UNDEF)) {
1737 zend_jit_undefined_op_helper(EG(current_execute_data)->opline->op2.var);
1738 offset = &EG(uninitialized_zval);
1739 }
1740
1741 if (EXPECTED(Z_TYPE_P(container) == IS_OBJECT)) {
1742 return Z_OBJ_HT_P(container)->has_dimension(Z_OBJ_P(container), offset, 0);
1743 } else if (EXPECTED(Z_TYPE_P(container) == IS_STRING)) { /* string offsets */
1744 zend_long lval;
1745
1746 if (EXPECTED(Z_TYPE_P(offset) == IS_LONG)) {
1747 lval = Z_LVAL_P(offset);
1748 isset_str_offset:
1749 if (UNEXPECTED(lval < 0)) { /* Handle negative offset */
1750 lval += (zend_long)Z_STRLEN_P(container);
1751 }
1752 if (EXPECTED(lval >= 0) && (size_t)lval < Z_STRLEN_P(container)) {
1753 return 1;
1754 }
1755 } else {
1756 ZVAL_DEREF(offset);
1757 if (Z_TYPE_P(offset) < IS_STRING /* simple scalar types */
1758 || (Z_TYPE_P(offset) == IS_STRING /* or numeric string */
1759 && IS_LONG == is_numeric_string(Z_STRVAL_P(offset), Z_STRLEN_P(offset), NULL, NULL, false))) {
1760 lval = zval_get_long_ex(offset, /* is_strict */ true);
1761 goto isset_str_offset;
1762 }
1763 }
1764 }
1765 return 0;
1766 }
1767
zend_jit_free_call_frame(zend_execute_data * call)1768 static void ZEND_FASTCALL zend_jit_free_call_frame(zend_execute_data *call)
1769 {
1770 zend_vm_stack_free_call_frame(call);
1771 }
1772
zend_jit_fetch_global_helper(zend_string * varname,void ** cache_slot)1773 static zend_reference* ZEND_FASTCALL zend_jit_fetch_global_helper(zend_string *varname, void **cache_slot)
1774 {
1775 zval *value;
1776 uintptr_t idx;
1777 zend_reference *ref;
1778
1779 /* We store "hash slot index" + 1 (NULL is a mark of uninitialized cache slot) */
1780 idx = (uintptr_t)CACHED_PTR_EX(cache_slot) - 1;
1781 if (EXPECTED(idx < EG(symbol_table).nNumUsed * sizeof(Bucket))) {
1782 Bucket *p = (Bucket*)((char*)EG(symbol_table).arData + idx);
1783
1784 if (EXPECTED(p->key == varname) ||
1785 (EXPECTED(p->h == ZSTR_H(varname)) &&
1786 EXPECTED(p->key != NULL) &&
1787 EXPECTED(zend_string_equal_content(p->key, varname)))) {
1788
1789 value = (zval*)p; /* value = &p->val; */
1790 goto check_indirect;
1791 }
1792 }
1793
1794 value = zend_hash_find_known_hash(&EG(symbol_table), varname);
1795 if (UNEXPECTED(value == NULL)) {
1796 value = zend_hash_add_new(&EG(symbol_table), varname, &EG(uninitialized_zval));
1797 idx = (char*)value - (char*)EG(symbol_table).arData;
1798 /* Store "hash slot index" + 1 (NULL is a mark of uninitialized cache slot) */
1799 CACHE_PTR_EX(cache_slot, (void*)(idx + 1));
1800 } else {
1801 idx = (char*)value - (char*)EG(symbol_table).arData;
1802 /* Store "hash slot index" + 1 (NULL is a mark of uninitialized cache slot) */
1803 CACHE_PTR_EX(cache_slot, (void*)(idx + 1));
1804 check_indirect:
1805 /* GLOBAL variable may be an INDIRECT pointer to CV */
1806 if (UNEXPECTED(Z_TYPE_P(value) == IS_INDIRECT)) {
1807 value = Z_INDIRECT_P(value);
1808 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
1809 ZVAL_NULL(value);
1810 }
1811 }
1812 }
1813
1814 if (UNEXPECTED(!Z_ISREF_P(value))) {
1815 ZVAL_MAKE_REF_EX(value, 2);
1816 ref = Z_REF_P(value);
1817 } else {
1818 ref = Z_REF_P(value);
1819 GC_ADDREF(ref);
1820 }
1821
1822 return ref;
1823 }
1824
zend_jit_verify_arg_slow(zval * arg,zend_arg_info * arg_info)1825 static bool ZEND_FASTCALL zend_jit_verify_arg_slow(zval *arg, zend_arg_info *arg_info)
1826 {
1827 zend_execute_data *execute_data = EG(current_execute_data);
1828 const zend_op *opline = EX(opline);
1829 void **cache_slot = CACHE_ADDR(opline->extended_value);
1830 bool ret = zend_check_user_type_slow(
1831 &arg_info->type, arg, /* ref */ NULL, cache_slot, /* is_return_type */ false);
1832 if (UNEXPECTED(!ret)) {
1833 zend_verify_arg_error(EX(func), arg_info, opline->op1.num, arg);
1834 return 0;
1835 }
1836 return ret;
1837 }
1838
zend_jit_verify_return_slow(zval * arg,const zend_op_array * op_array,zend_arg_info * arg_info,void ** cache_slot)1839 static void ZEND_FASTCALL zend_jit_verify_return_slow(zval *arg, const zend_op_array *op_array, zend_arg_info *arg_info, void **cache_slot)
1840 {
1841 if (UNEXPECTED(!zend_check_user_type_slow(
1842 &arg_info->type, arg, /* ref */ NULL, cache_slot, /* is_return_type */ true))) {
1843 zend_verify_return_error((zend_function*)op_array, arg);
1844 }
1845 }
1846
zend_jit_fetch_obj_r_slow(zend_object * zobj)1847 static void ZEND_FASTCALL zend_jit_fetch_obj_r_slow(zend_object *zobj)
1848 {
1849 zval *retval;
1850 zend_execute_data *execute_data = EG(current_execute_data);
1851 const zend_op *opline = EX(opline);
1852 zend_string *name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
1853 zval *result = EX_VAR(opline->result.var);
1854 void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);
1855
1856 retval = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, result);
1857 if (retval != result) {
1858 ZVAL_COPY_DEREF(result, retval);
1859 } else if (UNEXPECTED(Z_ISREF_P(retval))) {
1860 zend_unwrap_reference(retval);
1861 }
1862 }
1863
zend_jit_fetch_obj_r_dynamic(zend_object * zobj,intptr_t prop_offset)1864 static void ZEND_FASTCALL zend_jit_fetch_obj_r_dynamic(zend_object *zobj, intptr_t prop_offset)
1865 {
1866 if (zobj->properties) {
1867 zval *retval;
1868 zend_execute_data *execute_data = EG(current_execute_data);
1869 const zend_op *opline = EX(opline);
1870 zend_string *name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
1871 zval *result = EX_VAR(opline->result.var);
1872 void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);
1873
1874 if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(prop_offset)) {
1875 intptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(prop_offset);
1876
1877 if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
1878 Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
1879
1880 if (EXPECTED(p->key == name) ||
1881 (EXPECTED(p->h == ZSTR_H(name)) &&
1882 EXPECTED(p->key != NULL) &&
1883 EXPECTED(zend_string_equal_content(p->key, name)))) {
1884 ZVAL_COPY_DEREF(result, &p->val);
1885 return;
1886 }
1887 }
1888 CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
1889 }
1890
1891 retval = zend_hash_find_known_hash(zobj->properties, name);
1892
1893 if (EXPECTED(retval)) {
1894 intptr_t idx = (char*)retval - (char*)zobj->properties->arData;
1895 CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
1896 ZVAL_COPY_DEREF(result, retval);
1897 return;
1898 }
1899 }
1900 zend_jit_fetch_obj_r_slow(zobj);
1901 }
1902
zend_jit_fetch_obj_is_slow(zend_object * zobj)1903 static void ZEND_FASTCALL zend_jit_fetch_obj_is_slow(zend_object *zobj)
1904 {
1905 zval *retval;
1906 zend_execute_data *execute_data = EG(current_execute_data);
1907 const zend_op *opline = EX(opline);
1908 zend_string *name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
1909 zval *result = EX_VAR(opline->result.var);
1910 void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);
1911
1912 retval = zobj->handlers->read_property(zobj, name, BP_VAR_IS, cache_slot, result);
1913 if (retval != result) {
1914 ZVAL_COPY_DEREF(result, retval);
1915 } else if (UNEXPECTED(Z_ISREF_P(retval))) {
1916 zend_unwrap_reference(retval);
1917 }
1918 }
1919
zend_jit_fetch_obj_is_dynamic(zend_object * zobj,intptr_t prop_offset)1920 static void ZEND_FASTCALL zend_jit_fetch_obj_is_dynamic(zend_object *zobj, intptr_t prop_offset)
1921 {
1922 if (zobj->properties) {
1923 zval *retval;
1924 zend_execute_data *execute_data = EG(current_execute_data);
1925 const zend_op *opline = EX(opline);
1926 zend_string *name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
1927 zval *result = EX_VAR(opline->result.var);
1928 void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);
1929
1930 if (!IS_UNKNOWN_DYNAMIC_PROPERTY_OFFSET(prop_offset)) {
1931 intptr_t idx = ZEND_DECODE_DYN_PROP_OFFSET(prop_offset);
1932
1933 if (EXPECTED(idx < zobj->properties->nNumUsed * sizeof(Bucket))) {
1934 Bucket *p = (Bucket*)((char*)zobj->properties->arData + idx);
1935
1936 if (EXPECTED(p->key == name) ||
1937 (EXPECTED(p->h == ZSTR_H(name)) &&
1938 EXPECTED(p->key != NULL) &&
1939 EXPECTED(zend_string_equal_content(p->key, name)))) {
1940 ZVAL_COPY_DEREF(result, &p->val);
1941 return;
1942 }
1943 }
1944 CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_DYNAMIC_PROPERTY_OFFSET);
1945 }
1946
1947 retval = zend_hash_find_known_hash(zobj->properties, name);
1948
1949 if (EXPECTED(retval)) {
1950 intptr_t idx = (char*)retval - (char*)zobj->properties->arData;
1951 CACHE_PTR_EX(cache_slot + 1, (void*)ZEND_ENCODE_DYN_PROP_OFFSET(idx));
1952 ZVAL_COPY_DEREF(result, retval);
1953 return;
1954 }
1955 }
1956 zend_jit_fetch_obj_is_slow(zobj);
1957 }
1958
promotes_to_array(zval * val)1959 static zend_always_inline bool promotes_to_array(zval *val) {
1960 return Z_TYPE_P(val) <= IS_FALSE
1961 || (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE);
1962 }
1963
check_type_array_assignable(zend_type type)1964 static zend_always_inline bool check_type_array_assignable(zend_type type) {
1965 if (!ZEND_TYPE_IS_SET(type)) {
1966 return 1;
1967 }
1968 return (ZEND_TYPE_FULL_MASK(type) & MAY_BE_ARRAY) != 0;
1969 }
1970
zend_object_fetch_property_type_info(zend_object * obj,zval * slot)1971 static zend_property_info *zend_object_fetch_property_type_info(
1972 zend_object *obj, zval *slot)
1973 {
1974 if (EXPECTED(!ZEND_CLASS_HAS_TYPE_HINTS(obj->ce))) {
1975 return NULL;
1976 }
1977
1978 /* Not a declared property */
1979 if (UNEXPECTED(slot < obj->properties_table ||
1980 slot >= obj->properties_table + obj->ce->default_properties_count)) {
1981 return NULL;
1982 }
1983
1984 return zend_get_typed_property_info_for_slot(obj, slot);
1985 }
1986
zend_throw_auto_init_in_prop_error(zend_property_info * prop,const char * type)1987 static zend_never_inline ZEND_COLD void zend_throw_auto_init_in_prop_error(zend_property_info *prop, const char *type) {
1988 zend_string *type_str = zend_type_to_string(prop->type);
1989 zend_type_error(
1990 "Cannot auto-initialize an %s inside property %s::$%s of type %s",
1991 type,
1992 ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
1993 ZSTR_VAL(type_str)
1994 );
1995 zend_string_release(type_str);
1996 }
1997
zend_throw_access_uninit_prop_by_ref_error(zend_property_info * prop)1998 static zend_never_inline ZEND_COLD void zend_throw_access_uninit_prop_by_ref_error(
1999 zend_property_info *prop) {
2000 zend_throw_error(NULL,
2001 "Cannot access uninitialized non-nullable property %s::$%s by reference",
2002 ZSTR_VAL(prop->ce->name),
2003 zend_get_unmangled_property_name(prop->name));
2004 }
2005
zend_handle_fetch_obj_flags(zval * result,zval * ptr,zend_object * obj,zend_property_info * prop_info,uint32_t flags)2006 static zend_never_inline bool zend_handle_fetch_obj_flags(
2007 zval *result, zval *ptr, zend_object *obj, zend_property_info *prop_info, uint32_t flags)
2008 {
2009 switch (flags) {
2010 case ZEND_FETCH_DIM_WRITE:
2011 if (promotes_to_array(ptr)) {
2012 if (!prop_info) {
2013 prop_info = zend_object_fetch_property_type_info(obj, ptr);
2014 if (!prop_info) {
2015 break;
2016 }
2017 }
2018 if (!check_type_array_assignable(prop_info->type)) {
2019 zend_throw_auto_init_in_prop_error(prop_info, "array");
2020 if (result) ZVAL_ERROR(result);
2021 return 0;
2022 }
2023 }
2024 break;
2025 case ZEND_FETCH_REF:
2026 if (Z_TYPE_P(ptr) != IS_REFERENCE) {
2027 if (!prop_info) {
2028 prop_info = zend_object_fetch_property_type_info(obj, ptr);
2029 if (!prop_info) {
2030 break;
2031 }
2032 }
2033 if (Z_TYPE_P(ptr) == IS_UNDEF) {
2034 if (!ZEND_TYPE_ALLOW_NULL(prop_info->type)) {
2035 zend_throw_access_uninit_prop_by_ref_error(prop_info);
2036 if (result) ZVAL_ERROR(result);
2037 return 0;
2038 }
2039 ZVAL_NULL(ptr);
2040 }
2041
2042 ZVAL_NEW_REF(ptr, ptr);
2043 ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(ptr), prop_info);
2044 }
2045 break;
2046 EMPTY_SWITCH_DEFAULT_CASE()
2047 }
2048 return 1;
2049 }
2050
zend_jit_fetch_obj_w_slow(zend_object * zobj)2051 static void ZEND_FASTCALL zend_jit_fetch_obj_w_slow(zend_object *zobj)
2052 {
2053 zval *retval;
2054 zend_execute_data *execute_data = EG(current_execute_data);
2055 const zend_op *opline = EX(opline);
2056 zend_string *name = Z_STR_P(RT_CONSTANT(opline, opline->op2));
2057 zval *result = EX_VAR(opline->result.var);
2058 void **cache_slot = CACHE_ADDR(opline->extended_value & ~ZEND_FETCH_OBJ_FLAGS);
2059
2060 retval = zobj->handlers->get_property_ptr_ptr(zobj, name, BP_VAR_W, cache_slot);
2061 if (NULL == retval) {
2062 retval = zobj->handlers->read_property(zobj, name, BP_VAR_W, cache_slot, result);
2063 if (retval == result) {
2064 if (UNEXPECTED(Z_ISREF_P(retval) && Z_REFCOUNT_P(retval) == 1)) {
2065 ZVAL_UNREF(retval);
2066 }
2067 return;
2068 }
2069 if (UNEXPECTED(EG(exception))) {
2070 ZVAL_ERROR(result);
2071 return;
2072 }
2073 } else if (UNEXPECTED(Z_ISERROR_P(retval))) {
2074 ZVAL_ERROR(result);
2075 return;
2076 }
2077
2078 ZVAL_INDIRECT(result, retval);
2079
2080 /* Support for typed properties */
2081 do {
2082 uint32_t flags = opline->extended_value & ZEND_FETCH_OBJ_FLAGS;
2083
2084 if (flags) {
2085 zend_property_info *prop_info = NULL;
2086
2087 if (opline->op2_type == IS_CONST) {
2088 prop_info = CACHED_PTR_EX(cache_slot + 2);
2089 if (!prop_info) {
2090 break;
2091 }
2092 }
2093 if (UNEXPECTED(!zend_handle_fetch_obj_flags(result, retval, zobj, prop_info, flags))) {
2094 return;
2095 }
2096 }
2097 } while (0);
2098
2099 if (UNEXPECTED(Z_TYPE_P(retval) == IS_UNDEF)) {
2100 ZVAL_NULL(retval);
2101 }
2102 }
2103
zend_jit_check_array_promotion(zval * val,zend_property_info * prop)2104 static void ZEND_FASTCALL zend_jit_check_array_promotion(zval *val, zend_property_info *prop)
2105 {
2106 zend_execute_data *execute_data = EG(current_execute_data);
2107 const zend_op *opline = execute_data->opline;
2108 zval *result = EX_VAR(opline->result.var);
2109
2110 if ((Z_TYPE_P(val) <= IS_FALSE
2111 || (Z_ISREF_P(val) && Z_TYPE_P(Z_REFVAL_P(val)) <= IS_FALSE))
2112 && ZEND_TYPE_IS_SET(prop->type)
2113 && (ZEND_TYPE_FULL_MASK(prop->type) & MAY_BE_ARRAY) == 0) {
2114 zend_string *type_str = zend_type_to_string(prop->type);
2115 zend_type_error(
2116 "Cannot auto-initialize an array inside property %s::$%s of type %s",
2117 ZSTR_VAL(prop->ce->name), zend_get_unmangled_property_name(prop->name),
2118 ZSTR_VAL(type_str)
2119 );
2120 zend_string_release(type_str);
2121 ZVAL_ERROR(result);
2122 } else {
2123 ZVAL_INDIRECT(result, val);
2124 }
2125 }
2126
zend_jit_create_typed_ref(zval * val,zend_property_info * prop,zval * result)2127 static void ZEND_FASTCALL zend_jit_create_typed_ref(zval *val, zend_property_info *prop, zval *result)
2128 {
2129 if (!Z_ISREF_P(val)) {
2130 ZVAL_NEW_REF(val, val);
2131 ZEND_REF_ADD_TYPE_SOURCE(Z_REF_P(val), prop);
2132 }
2133 ZVAL_INDIRECT(result, val);
2134 }
2135
zend_jit_extract_helper(zend_refcounted * garbage)2136 static void ZEND_FASTCALL zend_jit_extract_helper(zend_refcounted *garbage)
2137 {
2138 zend_execute_data *execute_data = EG(current_execute_data);
2139 const zend_op *opline = execute_data->opline;
2140 zval *zv = EX_VAR(opline->result.var);
2141
2142 if (EXPECTED(Z_TYPE_P(zv) == IS_INDIRECT)) {
2143 ZVAL_COPY(zv, Z_INDIRECT_P(zv));
2144 }
2145 rc_dtor_func(garbage);
2146 }
2147
zend_jit_vm_stack_free_args_helper(zend_execute_data * call)2148 static void ZEND_FASTCALL zend_jit_vm_stack_free_args_helper(zend_execute_data *call)
2149 {
2150 zend_vm_stack_free_args(call);
2151 }
2152
zend_jit_assign_to_typed_ref_helper(zend_reference * ref,zval * value,uint8_t value_type)2153 static zend_always_inline zval* zend_jit_assign_to_typed_ref_helper(zend_reference *ref, zval *value, uint8_t value_type)
2154 {
2155 zval variable;
2156
2157 ZVAL_REF(&variable, ref);
2158 return zend_assign_to_variable(&variable, value, value_type, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)));
2159 }
2160
zend_jit_assign_const_to_typed_ref(zend_reference * ref,zval * value)2161 static zval* ZEND_FASTCALL zend_jit_assign_const_to_typed_ref(zend_reference *ref, zval *value)
2162 {
2163 return zend_jit_assign_to_typed_ref_helper(ref, value, IS_CONST);
2164 }
2165
zend_jit_assign_tmp_to_typed_ref(zend_reference * ref,zval * value)2166 static zval* ZEND_FASTCALL zend_jit_assign_tmp_to_typed_ref(zend_reference *ref, zval *value)
2167 {
2168 return zend_jit_assign_to_typed_ref_helper(ref, value, IS_TMP_VAR);
2169 }
2170
zend_jit_assign_var_to_typed_ref(zend_reference * ref,zval * value)2171 static zval* ZEND_FASTCALL zend_jit_assign_var_to_typed_ref(zend_reference *ref, zval *value)
2172 {
2173 return zend_jit_assign_to_typed_ref_helper(ref, value, IS_VAR);
2174 }
2175
zend_jit_assign_cv_to_typed_ref(zend_reference * ref,zval * value)2176 static zval* ZEND_FASTCALL zend_jit_assign_cv_to_typed_ref(zend_reference *ref, zval *value)
2177 {
2178 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
2179 const zend_op *opline = EG(current_execute_data)->opline;
2180 uint32_t var;
2181 if (opline->opcode == ZEND_ASSIGN) {
2182 var = opline->op2.var;
2183 } else {
2184 ZEND_ASSERT((opline + 1)->opcode == ZEND_OP_DATA);
2185 var = (opline + 1)->op1.var;
2186 }
2187 zend_jit_undefined_op_helper(var);
2188 value = &EG(uninitialized_zval);
2189 }
2190 return zend_jit_assign_to_typed_ref_helper(ref, value, IS_CV);
2191 }
2192
zend_jit_assign_to_typed_ref2_helper(zend_reference * ref,zval * value,zval * result,uint8_t value_type)2193 static zend_always_inline zval* zend_jit_assign_to_typed_ref2_helper(zend_reference *ref, zval *value, zval *result, uint8_t value_type)
2194 {
2195 zval variable, *ret;
2196 zend_refcounted *garbage = NULL;
2197
2198 ZVAL_REF(&variable, ref);
2199 ret = zend_assign_to_variable_ex(&variable, value, value_type, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data)), &garbage);
2200 ZVAL_COPY(result, ret);
2201 if (garbage) {
2202 GC_DTOR(garbage);
2203 }
2204 return ret;
2205 }
2206
zend_jit_assign_const_to_typed_ref2(zend_reference * ref,zval * value,zval * result)2207 static zval* ZEND_FASTCALL zend_jit_assign_const_to_typed_ref2(zend_reference *ref, zval *value, zval *result)
2208 {
2209 return zend_jit_assign_to_typed_ref2_helper(ref, value, result, IS_CONST);
2210 }
2211
zend_jit_assign_tmp_to_typed_ref2(zend_reference * ref,zval * value,zval * result)2212 static zval* ZEND_FASTCALL zend_jit_assign_tmp_to_typed_ref2(zend_reference *ref, zval *value, zval *result)
2213 {
2214 return zend_jit_assign_to_typed_ref2_helper(ref, value, result, IS_TMP_VAR);
2215 }
2216
zend_jit_assign_var_to_typed_ref2(zend_reference * ref,zval * value,zval * result)2217 static zval* ZEND_FASTCALL zend_jit_assign_var_to_typed_ref2(zend_reference *ref, zval *value, zval *result)
2218 {
2219 return zend_jit_assign_to_typed_ref2_helper(ref, value, result, IS_VAR);
2220 }
2221
zend_jit_assign_cv_to_typed_ref2(zend_reference * ref,zval * value,zval * result)2222 static zval* ZEND_FASTCALL zend_jit_assign_cv_to_typed_ref2(zend_reference *ref, zval *value, zval *result)
2223 {
2224 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
2225 const zend_op *opline = EG(current_execute_data)->opline;
2226 uint32_t var;
2227 if (opline->opcode == ZEND_ASSIGN) {
2228 var = opline->op2.var;
2229 } else {
2230 ZEND_ASSERT((opline + 1)->opcode == ZEND_OP_DATA);
2231 var = (opline + 1)->op1.var;
2232 }
2233 zend_jit_undefined_op_helper(var);
2234 value = &EG(uninitialized_zval);
2235 }
2236 return zend_jit_assign_to_typed_ref2_helper(ref, value, result, IS_CV);
2237 }
2238
zend_jit_get_prop_not_accepting_double(zend_reference * ref)2239 static zend_property_info *zend_jit_get_prop_not_accepting_double(zend_reference *ref)
2240 {
2241 zend_property_info *prop;
2242 ZEND_REF_FOREACH_TYPE_SOURCES(ref, prop) {
2243 if (!(ZEND_TYPE_FULL_MASK(prop->type) & MAY_BE_DOUBLE)) {
2244 return prop;
2245 }
2246 } ZEND_REF_FOREACH_TYPE_SOURCES_END();
2247 return NULL;
2248 }
2249
zend_jit_throw_inc_ref_error(zend_reference * ref,zend_property_info * error_prop)2250 static ZEND_COLD void zend_jit_throw_inc_ref_error(zend_reference *ref, zend_property_info *error_prop)
2251 {
2252 zend_string *type_str = zend_type_to_string(error_prop->type);
2253
2254 zend_type_error(
2255 "Cannot increment a reference held by property %s::$%s of type %s past its maximal value",
2256 ZSTR_VAL(error_prop->ce->name),
2257 zend_get_unmangled_property_name(error_prop->name),
2258 ZSTR_VAL(type_str));
2259 zend_string_release(type_str);
2260 }
2261
zend_jit_throw_dec_ref_error(zend_reference * ref,zend_property_info * error_prop)2262 static ZEND_COLD void zend_jit_throw_dec_ref_error(zend_reference *ref, zend_property_info *error_prop)
2263 {
2264 zend_string *type_str = zend_type_to_string(error_prop->type);
2265
2266 zend_type_error(
2267 "Cannot decrement a reference held by property %s::$%s of type %s past its minimal value",
2268 ZSTR_VAL(error_prop->ce->name),
2269 zend_get_unmangled_property_name(error_prop->name),
2270 ZSTR_VAL(type_str));
2271 zend_string_release(type_str);
2272 }
2273
zend_jit_pre_inc_typed_ref(zend_reference * ref,zval * ret)2274 static void ZEND_FASTCALL zend_jit_pre_inc_typed_ref(zend_reference *ref, zval *ret)
2275 {
2276 zval *var_ptr = &ref->val;
2277 zval tmp;
2278
2279 ZVAL_COPY(&tmp, var_ptr);
2280
2281 increment_function(var_ptr);
2282
2283 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE(tmp) == IS_LONG) {
2284 zend_property_info *error_prop = zend_jit_get_prop_not_accepting_double(ref);
2285 if (UNEXPECTED(error_prop)) {
2286 zend_jit_throw_inc_ref_error(ref, error_prop);
2287 ZVAL_LONG(var_ptr, ZEND_LONG_MAX);
2288 }
2289 } else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
2290 zval_ptr_dtor(var_ptr);
2291 ZVAL_COPY_VALUE(var_ptr, &tmp);
2292 } else {
2293 zval_ptr_dtor(&tmp);
2294 }
2295 if (ret) {
2296 ZVAL_COPY(ret, var_ptr);
2297 }
2298 }
2299
zend_jit_pre_dec_typed_ref(zend_reference * ref,zval * ret)2300 static void ZEND_FASTCALL zend_jit_pre_dec_typed_ref(zend_reference *ref, zval *ret)
2301 {
2302 zval *var_ptr = &ref->val;
2303 zval tmp;
2304
2305 ZVAL_COPY(&tmp, var_ptr);
2306
2307 decrement_function(var_ptr);
2308
2309 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE(tmp) == IS_LONG) {
2310 zend_property_info *error_prop = zend_jit_get_prop_not_accepting_double(ref);
2311 if (UNEXPECTED(error_prop)) {
2312 zend_jit_throw_dec_ref_error(ref, error_prop);
2313 ZVAL_LONG(var_ptr, ZEND_LONG_MIN);
2314 }
2315 } else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
2316 zval_ptr_dtor(var_ptr);
2317 ZVAL_COPY_VALUE(var_ptr, &tmp);
2318 } else {
2319 zval_ptr_dtor(&tmp);
2320 }
2321 if (ret) {
2322 ZVAL_COPY(ret, var_ptr);
2323 }
2324 }
2325
zend_jit_post_inc_typed_ref(zend_reference * ref,zval * ret)2326 static void ZEND_FASTCALL zend_jit_post_inc_typed_ref(zend_reference *ref, zval *ret)
2327 {
2328 zval *var_ptr = &ref->val;
2329 ZVAL_COPY(ret, var_ptr);
2330
2331 increment_function(var_ptr);
2332
2333 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(ret) == IS_LONG) {
2334 zend_property_info *error_prop = zend_jit_get_prop_not_accepting_double(ref);
2335 if (UNEXPECTED(error_prop)) {
2336 zend_jit_throw_inc_ref_error(ref, error_prop);
2337 ZVAL_LONG(var_ptr, ZEND_LONG_MAX);
2338 }
2339 } else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
2340 zval_ptr_dtor(var_ptr);
2341 ZVAL_COPY_VALUE(var_ptr, ret);
2342 }
2343 }
2344
zend_jit_post_dec_typed_ref(zend_reference * ref,zval * ret)2345 static void ZEND_FASTCALL zend_jit_post_dec_typed_ref(zend_reference *ref, zval *ret)
2346 {
2347 zval *var_ptr = &ref->val;
2348 ZVAL_COPY(ret, var_ptr);
2349
2350 decrement_function(var_ptr);
2351
2352 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(ret) == IS_LONG) {
2353 zend_property_info *error_prop = zend_jit_get_prop_not_accepting_double(ref);
2354 if (UNEXPECTED(error_prop)) {
2355 zend_jit_throw_dec_ref_error(ref, error_prop);
2356 ZVAL_LONG(var_ptr, ZEND_LONG_MIN);
2357 }
2358 } else if (UNEXPECTED(!zend_verify_ref_assignable_zval(ref, var_ptr, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
2359 zval_ptr_dtor(var_ptr);
2360 ZVAL_COPY_VALUE(var_ptr, ret);
2361 }
2362 }
2363
zend_jit_assign_op_to_typed_ref(zend_reference * ref,zval * val,binary_op_type binary_op)2364 static void ZEND_FASTCALL zend_jit_assign_op_to_typed_ref(zend_reference *ref, zval *val, binary_op_type binary_op)
2365 {
2366 zval z_copy;
2367
2368 /* Make sure that in-place concatenation is used if the LHS is a string. */
2369 if (binary_op == concat_function && Z_TYPE(ref->val) == IS_STRING) {
2370 concat_function(&ref->val, &ref->val, val);
2371 ZEND_ASSERT(Z_TYPE(ref->val) == IS_STRING && "Concat should return string");
2372 return;
2373 }
2374
2375 binary_op(&z_copy, &ref->val, val);
2376 if (EXPECTED(zend_verify_ref_assignable_zval(ref, &z_copy, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
2377 zval_ptr_dtor(&ref->val);
2378 ZVAL_COPY_VALUE(&ref->val, &z_copy);
2379 } else {
2380 zval_ptr_dtor(&z_copy);
2381 }
2382 }
2383
zend_jit_assign_op_to_typed_ref_tmp(zend_reference * ref,zval * val,binary_op_type binary_op)2384 static void ZEND_FASTCALL zend_jit_assign_op_to_typed_ref_tmp(zend_reference *ref, zval *val, binary_op_type binary_op)
2385 {
2386 zval z_copy;
2387
2388 binary_op(&z_copy, &ref->val, val);
2389 if (EXPECTED(zend_verify_ref_assignable_zval(ref, &z_copy, ZEND_CALL_USES_STRICT_TYPES(EG(current_execute_data))))) {
2390 zval_ptr_dtor(&ref->val);
2391 ZVAL_COPY_VALUE(&ref->val, &z_copy);
2392 } else {
2393 zval_ptr_dtor(&z_copy);
2394 }
2395 zval_ptr_dtor_nogc(val);
2396 }
2397
zend_jit_only_vars_by_reference(zval * arg)2398 static void ZEND_FASTCALL zend_jit_only_vars_by_reference(zval *arg)
2399 {
2400 ZVAL_NEW_REF(arg, arg);
2401 zend_error(E_NOTICE, "Only variables should be passed by reference");
2402 }
2403
zend_jit_invalid_array_access(zval * container)2404 static void ZEND_FASTCALL zend_jit_invalid_array_access(zval *container)
2405 {
2406 zend_error(E_WARNING, "Trying to access array offset on %s", zend_zval_value_name(container));
2407 }
2408
zend_jit_invalid_property_read(zval * container,const char * property_name)2409 static void ZEND_FASTCALL zend_jit_invalid_property_read(zval *container, const char *property_name)
2410 {
2411 zend_error(E_WARNING, "Attempt to read property \"%s\" on %s", property_name, zend_zval_value_name(container));
2412 }
2413
zend_jit_invalid_property_write(zval * container,const char * property_name)2414 static void ZEND_FASTCALL zend_jit_invalid_property_write(zval *container, const char *property_name)
2415 {
2416 zend_throw_error(NULL,
2417 "Attempt to modify property \"%s\" on %s",
2418 property_name, zend_zval_value_name(container));
2419 }
2420
zend_jit_invalid_property_incdec(zval * container,const char * property_name)2421 static void ZEND_FASTCALL zend_jit_invalid_property_incdec(zval *container, const char *property_name)
2422 {
2423 zend_execute_data *execute_data = EG(current_execute_data);
2424 const zend_op *opline = EX(opline);
2425
2426 if (Z_TYPE_P(container) == IS_UNDEF && opline->op1_type == IS_CV) {
2427 zend_string *cv = EX(func)->op_array.vars[EX_VAR_TO_NUM(opline->op1.var)];
2428
2429 zend_error_unchecked(E_WARNING, "Undefined variable $%S", cv);
2430 }
2431 if (opline->result_type & (IS_VAR|IS_TMP_VAR)) {
2432 ZVAL_UNDEF(EX_VAR(opline->result.var));
2433 }
2434 zend_throw_error(NULL,
2435 "Attempt to increment/decrement property \"%s\" on %s",
2436 property_name, zend_zval_value_name(container));
2437 if (opline->op1_type == IS_VAR) {
2438 zval_ptr_dtor_nogc(EX_VAR(opline->op1.var));
2439 }
2440 }
2441
zend_jit_invalid_property_assign(zval * container,const char * property_name)2442 static void ZEND_FASTCALL zend_jit_invalid_property_assign(zval *container, const char *property_name)
2443 {
2444 zend_throw_error(NULL,
2445 "Attempt to assign property \"%s\" on %s",
2446 property_name, zend_zval_value_name(container));
2447 }
2448
zend_jit_invalid_property_assign_op(zval * container,const char * property_name)2449 static void ZEND_FASTCALL zend_jit_invalid_property_assign_op(zval *container, const char *property_name)
2450 {
2451 if (Z_TYPE_P(container) == IS_UNDEF) {
2452 const zend_execute_data *execute_data = EG(current_execute_data);
2453
2454 zend_jit_undefined_op_helper(EX(opline)->op1.var);
2455 }
2456 zend_jit_invalid_property_assign(container, property_name);
2457 }
2458
zend_jit_prepare_assign_dim_ref(zval * ref)2459 static zval * ZEND_FASTCALL zend_jit_prepare_assign_dim_ref(zval *ref) {
2460 zval *val = Z_REFVAL_P(ref);
2461 if (Z_TYPE_P(val) <= IS_FALSE) {
2462 if (ZEND_REF_HAS_TYPE_SOURCES(Z_REF_P(ref))
2463 && !zend_verify_ref_array_assignable(Z_REF_P(ref))) {
2464 return NULL;
2465 }
2466 if (Z_TYPE_P(val) == IS_FALSE) {
2467 ZVAL_ARR(val, zend_new_array(8));
2468 zend_false_to_array_deprecated();
2469 if (EG(exception)) {
2470 return NULL;
2471 }
2472 } else {
2473 ZVAL_ARR(val, zend_new_array(8));
2474 }
2475 }
2476 return val;
2477 }
2478
zend_jit_pre_inc(zval * var_ptr,zval * ret)2479 static void ZEND_FASTCALL zend_jit_pre_inc(zval *var_ptr, zval *ret)
2480 {
2481 increment_function(var_ptr);
2482 ZVAL_COPY(ret, var_ptr);
2483 }
2484
zend_jit_pre_dec(zval * var_ptr,zval * ret)2485 static void ZEND_FASTCALL zend_jit_pre_dec(zval *var_ptr, zval *ret)
2486 {
2487 decrement_function(var_ptr);
2488 ZVAL_COPY(ret, var_ptr);
2489 }
2490
2491 #define HT_POISONED_PTR ((HashTable *) (intptr_t) -1)
2492
_zend_hash_iterators_remove(HashTable * ht)2493 static zend_never_inline void ZEND_FASTCALL _zend_hash_iterators_remove(HashTable *ht)
2494 {
2495 HashTableIterator *iter = EG(ht_iterators);
2496 HashTableIterator *end = iter + EG(ht_iterators_used);
2497
2498 while (iter != end) {
2499 if (iter->ht == ht) {
2500 iter->ht = HT_POISONED_PTR;
2501 }
2502 iter++;
2503 }
2504 }
2505
zend_jit_array_free(HashTable * ht)2506 static void ZEND_FASTCALL zend_jit_array_free(HashTable *ht)
2507 {
2508 GC_REMOVE_FROM_BUFFER(ht);
2509 if (UNEXPECTED(HT_HAS_ITERATORS(ht))) {
2510 _zend_hash_iterators_remove(ht);
2511 }
2512 if (!(EXPECTED(HT_FLAGS(ht) & HASH_FLAG_UNINITIALIZED))) {
2513 efree(HT_GET_DATA_ADDR(ht));
2514 }
2515 FREE_HASHTABLE(ht);
2516 }
2517
zend_jit_zval_array_dup(zval * arr)2518 static HashTable *ZEND_FASTCALL zend_jit_zval_array_dup(zval *arr)
2519 {
2520 HashTable *ht;
2521
2522 Z_TRY_DELREF_P(arr);
2523 ht = Z_ARRVAL_P(arr);
2524 ht = zend_array_dup(ht);
2525 ZVAL_ARR(arr, ht);
2526 return ht;
2527 }
2528
zend_jit_add_arrays_helper(zend_array * op1,zend_array * op2)2529 static zend_array *ZEND_FASTCALL zend_jit_add_arrays_helper(zend_array *op1, zend_array *op2)
2530 {
2531 zend_array *res;
2532 res = zend_array_dup(op1);
2533 zend_hash_merge(res, op2, zval_add_ref, 0);
2534 return res;
2535 }
2536
zend_jit_assign_obj_helper(zend_object * zobj,zend_string * name,zval * value,void ** cache_slot,zval * result)2537 static void ZEND_FASTCALL zend_jit_assign_obj_helper(zend_object *zobj, zend_string *name, zval *value, void **cache_slot, zval *result)
2538 {
2539 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
2540 const zend_op *op_data = EG(current_execute_data)->opline + 1;
2541 ZEND_ASSERT(op_data->opcode == ZEND_OP_DATA && op_data->op1_type == IS_CV);
2542 zend_jit_undefined_op_helper(op_data->op1.var);
2543 value = &EG(uninitialized_zval);
2544 }
2545
2546 ZVAL_DEREF(value);
2547 value = zobj->handlers->write_property(zobj, name, value, cache_slot);
2548 if (result && value) {
2549 ZVAL_COPY_DEREF(result, value);
2550 }
2551 }
2552
zend_jit_assign_to_typed_prop(zval * property_val,zend_property_info * info,zval * value,zval * result)2553 static void ZEND_FASTCALL zend_jit_assign_to_typed_prop(zval *property_val, zend_property_info *info, zval *value, zval *result)
2554 {
2555 zend_execute_data *execute_data = EG(current_execute_data);
2556 zend_refcounted *garbage = NULL;
2557 zval tmp;
2558
2559 if (UNEXPECTED(Z_TYPE_P(value) == IS_UNDEF)) {
2560 const zend_op *op_data = execute_data->opline + 1;
2561 ZEND_ASSERT(op_data->opcode == ZEND_OP_DATA && op_data->op1_type == IS_CV);
2562 zend_jit_undefined_op_helper(op_data->op1.var);
2563 value = &EG(uninitialized_zval);
2564 }
2565
2566 if (UNEXPECTED((info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(property_val) & IS_PROP_REINITABLE))) {
2567 zend_readonly_property_modification_error(info);
2568 if (result) {
2569 ZVAL_UNDEF(result);
2570 }
2571 return;
2572 }
2573
2574 ZVAL_DEREF(value);
2575 ZVAL_COPY(&tmp, value);
2576
2577 if (UNEXPECTED(!zend_verify_property_type(info, &tmp, EX_USES_STRICT_TYPES()))) {
2578 zval_ptr_dtor(&tmp);
2579 if (result) {
2580 ZVAL_NULL(result);
2581 }
2582 return;
2583 }
2584
2585 Z_PROP_FLAG_P(property_val) &= ~IS_PROP_REINITABLE;
2586
2587 value = zend_assign_to_variable_ex(property_val, &tmp, IS_TMP_VAR, EX_USES_STRICT_TYPES(), &garbage);
2588 if (result) {
2589 ZVAL_COPY_DEREF(result, value);
2590 }
2591 if (garbage) {
2592 GC_DTOR(garbage);
2593 }
2594 }
2595
_zend_jit_assign_op_overloaded_property(zend_object * object,zend_string * name,void ** cache_slot,zval * value,binary_op_type binary_op)2596 static zend_never_inline void _zend_jit_assign_op_overloaded_property(zend_object *object, zend_string *name, void **cache_slot, zval *value, binary_op_type binary_op)
2597 {
2598 zval *z;
2599 zval rv, res;
2600
2601 GC_ADDREF(object);
2602 z = object->handlers->read_property(object, name, BP_VAR_R, cache_slot, &rv);
2603 if (UNEXPECTED(EG(exception))) {
2604 OBJ_RELEASE(object);
2605 //??? if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2606 //??? ZVAL_UNDEF(EX_VAR(opline->result.var));
2607 //??? }
2608 return;
2609 }
2610 if (binary_op(&res, z, value) == SUCCESS) {
2611 object->handlers->write_property(object, name, &res, cache_slot);
2612 }
2613 //??? if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2614 //??? ZVAL_COPY(EX_VAR(opline->result.var), &res);
2615 //??? }
2616 if (z == &rv) {
2617 zval_ptr_dtor(z);
2618 }
2619 zval_ptr_dtor(&res);
2620 OBJ_RELEASE(object);
2621 }
2622
zend_jit_assign_op_to_typed_prop(zval * zptr,zend_property_info * prop_info,zval * value,binary_op_type binary_op)2623 static void ZEND_FASTCALL zend_jit_assign_op_to_typed_prop(zval *zptr, zend_property_info *prop_info, zval *value, binary_op_type binary_op)
2624 {
2625 zend_execute_data *execute_data = EG(current_execute_data);
2626 zval z_copy;
2627
2628 if (UNEXPECTED((prop_info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(zptr) & IS_PROP_REINITABLE))) {
2629 zend_readonly_property_modification_error(prop_info);
2630 return;
2631 }
2632
2633 ZVAL_DEREF(zptr);
2634 /* Make sure that in-place concatenation is used if the LHS is a string. */
2635 if (binary_op == concat_function && Z_TYPE_P(zptr) == IS_STRING) {
2636 concat_function(zptr, zptr, value);
2637 ZEND_ASSERT(Z_TYPE_P(zptr) == IS_STRING && "Concat should return string");
2638 return;
2639 }
2640
2641 binary_op(&z_copy, zptr, value);
2642 if (EXPECTED(zend_verify_property_type(prop_info, &z_copy, EX_USES_STRICT_TYPES()))) {
2643 Z_PROP_FLAG_P(zptr) &= ~IS_PROP_REINITABLE;
2644 zval_ptr_dtor(zptr);
2645 ZVAL_COPY_VALUE(zptr, &z_copy);
2646 } else {
2647 zval_ptr_dtor(&z_copy);
2648 }
2649 }
2650
zend_jit_assign_obj_op_helper(zend_object * zobj,zend_string * name,zval * value,void ** cache_slot,binary_op_type binary_op)2651 static void ZEND_FASTCALL zend_jit_assign_obj_op_helper(zend_object *zobj, zend_string *name, zval *value, void **cache_slot, binary_op_type binary_op)
2652 {
2653 zval *zptr;
2654 zend_property_info *prop_info;
2655
2656 if (EXPECTED((zptr = zobj->handlers->get_property_ptr_ptr(zobj, name, BP_VAR_RW, cache_slot)) != NULL)) {
2657 if (UNEXPECTED(Z_ISERROR_P(zptr))) {
2658 //??? if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2659 //??? ZVAL_NULL(EX_VAR(opline->result.var));
2660 //??? }
2661 } else {
2662 //??? zval *orig_zptr = zptr;
2663 zend_reference *ref;
2664
2665 do {
2666 if (UNEXPECTED(Z_ISREF_P(zptr))) {
2667 ref = Z_REF_P(zptr);
2668 zptr = Z_REFVAL_P(zptr);
2669 if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(ref))) {
2670 zend_jit_assign_op_to_typed_ref(ref, value, binary_op);
2671 break;
2672 }
2673 }
2674
2675 //??? if (OP2_TYPE == IS_CONST) {
2676 prop_info = (zend_property_info*)CACHED_PTR_EX(cache_slot + 2);
2677 //??? } else {
2678 //??? prop_info = zend_object_fetch_property_type_info(Z_OBJ_P(object), orig_zptr);
2679 //??? }
2680 if (prop_info) {
2681 /* special case for typed properties */
2682 zend_jit_assign_op_to_typed_prop(zptr, prop_info, value, binary_op);
2683 } else {
2684 binary_op(zptr, zptr, value);
2685 }
2686 } while (0);
2687
2688 //??? if (UNEXPECTED(RETURN_VALUE_USED(opline))) {
2689 //??? ZVAL_COPY(EX_VAR(opline->result.var), zptr);
2690 //??? }
2691 }
2692 } else {
2693 _zend_jit_assign_op_overloaded_property(zobj, name, cache_slot, value, binary_op);
2694 }
2695 }
2696
_zend_jit_throw_inc_prop_error(zend_property_info * prop)2697 static ZEND_COLD zend_long _zend_jit_throw_inc_prop_error(zend_property_info *prop)
2698 {
2699 zend_string *type_str = zend_type_to_string(prop->type);
2700 zend_type_error("Cannot increment property %s::$%s of type %s past its maximal value",
2701 ZSTR_VAL(prop->ce->name),
2702 zend_get_unmangled_property_name(prop->name),
2703 ZSTR_VAL(type_str));
2704 zend_string_release(type_str);
2705 return ZEND_LONG_MAX;
2706 }
2707
_zend_jit_throw_dec_prop_error(zend_property_info * prop)2708 static ZEND_COLD zend_long _zend_jit_throw_dec_prop_error(zend_property_info *prop)
2709 {
2710 zend_string *type_str = zend_type_to_string(prop->type);
2711 zend_type_error("Cannot decrement property %s::$%s of type %s past its minimal value",
2712 ZSTR_VAL(prop->ce->name),
2713 zend_get_unmangled_property_name(prop->name),
2714 ZSTR_VAL(type_str));
2715 zend_string_release(type_str);
2716 return ZEND_LONG_MIN;
2717 }
2718
zend_jit_inc_typed_prop(zval * var_ptr,zend_property_info * prop_info)2719 static void ZEND_FASTCALL zend_jit_inc_typed_prop(zval *var_ptr, zend_property_info *prop_info)
2720 {
2721 ZEND_ASSERT(Z_TYPE_P(var_ptr) != IS_UNDEF);
2722
2723 if (UNEXPECTED((prop_info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(var_ptr) & IS_PROP_REINITABLE))) {
2724 zend_readonly_property_modification_error(prop_info);
2725 return;
2726 }
2727
2728 zend_execute_data *execute_data = EG(current_execute_data);
2729 zval tmp;
2730
2731 ZVAL_DEREF(var_ptr);
2732 ZVAL_COPY(&tmp, var_ptr);
2733
2734 increment_function(var_ptr);
2735
2736 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE(tmp) == IS_LONG) {
2737 if (!(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2738 zend_long val = _zend_jit_throw_inc_prop_error(prop_info);
2739 ZVAL_LONG(var_ptr, val);
2740 } else {
2741 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2742 }
2743 } else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
2744 zval_ptr_dtor(var_ptr);
2745 ZVAL_COPY_VALUE(var_ptr, &tmp);
2746 } else {
2747 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2748 zval_ptr_dtor(&tmp);
2749 }
2750 }
2751
zend_jit_dec_typed_prop(zval * var_ptr,zend_property_info * prop_info)2752 static void ZEND_FASTCALL zend_jit_dec_typed_prop(zval *var_ptr, zend_property_info *prop_info)
2753 {
2754 ZEND_ASSERT(Z_TYPE_P(var_ptr) != IS_UNDEF);
2755
2756 if (UNEXPECTED((prop_info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(var_ptr) & IS_PROP_REINITABLE))) {
2757 zend_readonly_property_modification_error(prop_info);
2758 return;
2759 }
2760
2761 zend_execute_data *execute_data = EG(current_execute_data);
2762 zval tmp;
2763
2764 ZVAL_DEREF(var_ptr);
2765 ZVAL_COPY(&tmp, var_ptr);
2766
2767 decrement_function(var_ptr);
2768
2769 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE(tmp) == IS_LONG) {
2770 if (!(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2771 zend_long val = _zend_jit_throw_dec_prop_error(prop_info);
2772 ZVAL_LONG(var_ptr, val);
2773 } else {
2774 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2775 }
2776 } else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
2777 zval_ptr_dtor(var_ptr);
2778 ZVAL_COPY_VALUE(var_ptr, &tmp);
2779 } else {
2780 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2781 zval_ptr_dtor(&tmp);
2782 }
2783 }
2784
zend_jit_pre_inc_typed_prop(zval * var_ptr,zend_property_info * prop_info,zval * result)2785 static void ZEND_FASTCALL zend_jit_pre_inc_typed_prop(zval *var_ptr, zend_property_info *prop_info, zval *result)
2786 {
2787 ZVAL_DEREF(var_ptr);
2788 zend_jit_inc_typed_prop(var_ptr, prop_info);
2789 ZVAL_COPY(result, var_ptr);
2790 }
2791
zend_jit_pre_dec_typed_prop(zval * var_ptr,zend_property_info * prop_info,zval * result)2792 static void ZEND_FASTCALL zend_jit_pre_dec_typed_prop(zval *var_ptr, zend_property_info *prop_info, zval *result)
2793 {
2794 ZVAL_DEREF(var_ptr);
2795 zend_jit_dec_typed_prop(var_ptr, prop_info);
2796 ZVAL_COPY(result, var_ptr);
2797 }
2798
zend_jit_post_inc_typed_prop(zval * var_ptr,zend_property_info * prop_info,zval * result)2799 static void ZEND_FASTCALL zend_jit_post_inc_typed_prop(zval *var_ptr, zend_property_info *prop_info, zval *result)
2800 {
2801 ZEND_ASSERT(Z_TYPE_P(var_ptr) != IS_UNDEF);
2802
2803 if (UNEXPECTED((prop_info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(var_ptr) & IS_PROP_REINITABLE))) {
2804 zend_readonly_property_modification_error(prop_info);
2805 if (result) {
2806 ZVAL_UNDEF(result);
2807 }
2808 return;
2809 }
2810
2811 zend_execute_data *execute_data = EG(current_execute_data);
2812
2813 ZVAL_DEREF(var_ptr);
2814 ZVAL_COPY(result, var_ptr);
2815
2816 increment_function(var_ptr);
2817
2818 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(result) == IS_LONG) {
2819 if (!(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2820 zend_long val = _zend_jit_throw_inc_prop_error(prop_info);
2821 ZVAL_LONG(var_ptr, val);
2822 } else {
2823 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2824 }
2825 } else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
2826 zval_ptr_dtor(var_ptr);
2827 ZVAL_COPY_VALUE(var_ptr, result);
2828 ZVAL_UNDEF(result);
2829 } else {
2830 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2831 }
2832 }
2833
zend_jit_post_dec_typed_prop(zval * var_ptr,zend_property_info * prop_info,zval * result)2834 static void ZEND_FASTCALL zend_jit_post_dec_typed_prop(zval *var_ptr, zend_property_info *prop_info, zval *result)
2835 {
2836 ZEND_ASSERT(Z_TYPE_P(var_ptr) != IS_UNDEF);
2837
2838 if (UNEXPECTED((prop_info->flags & ZEND_ACC_READONLY) && !(Z_PROP_FLAG_P(var_ptr) & IS_PROP_REINITABLE))) {
2839 zend_readonly_property_modification_error(prop_info);
2840 if (result) {
2841 ZVAL_UNDEF(result);
2842 }
2843 return;
2844 }
2845
2846 zend_execute_data *execute_data = EG(current_execute_data);
2847
2848 ZVAL_DEREF(var_ptr);
2849 ZVAL_COPY(result, var_ptr);
2850
2851 decrement_function(var_ptr);
2852
2853 if (UNEXPECTED(Z_TYPE_P(var_ptr) == IS_DOUBLE) && Z_TYPE_P(result) == IS_LONG) {
2854 if (!(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2855 zend_long val = _zend_jit_throw_dec_prop_error(prop_info);
2856 ZVAL_LONG(var_ptr, val);
2857 } else {
2858 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2859 }
2860 } else if (UNEXPECTED(!zend_verify_property_type(prop_info, var_ptr, EX_USES_STRICT_TYPES()))) {
2861 zval_ptr_dtor(var_ptr);
2862 ZVAL_COPY_VALUE(var_ptr, result);
2863 ZVAL_UNDEF(result);
2864 } else {
2865 Z_PROP_FLAG_P(var_ptr) &= ~IS_PROP_REINITABLE;
2866 }
2867 }
2868
zend_jit_pre_inc_obj_helper(zend_object * zobj,zend_string * name,void ** cache_slot,zval * result)2869 static void ZEND_FASTCALL zend_jit_pre_inc_obj_helper(zend_object *zobj, zend_string *name, void **cache_slot, zval *result)
2870 {
2871 zval *prop;
2872
2873 if (EXPECTED((prop = zobj->handlers->get_property_ptr_ptr(zobj, name, BP_VAR_RW, cache_slot)) != NULL)) {
2874 if (UNEXPECTED(Z_ISERROR_P(prop))) {
2875 if (UNEXPECTED(result)) {
2876 ZVAL_NULL(result);
2877 }
2878 } else {
2879 zend_property_info *prop_info = (zend_property_info *) CACHED_PTR_EX(cache_slot + 2);
2880
2881 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
2882 fast_long_increment_function(prop);
2883 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && prop_info
2884 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2885 zend_long val = _zend_jit_throw_inc_prop_error(prop_info);
2886 ZVAL_LONG(prop, val);
2887 }
2888 } else {
2889 do {
2890 if (Z_ISREF_P(prop)) {
2891 zend_reference *ref = Z_REF_P(prop);
2892 prop = Z_REFVAL_P(prop);
2893 if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(ref))) {
2894 zend_jit_pre_inc_typed_ref(ref, result);
2895 break;
2896 }
2897 }
2898
2899 if (prop_info) {
2900 zend_jit_inc_typed_prop(prop, prop_info);
2901 } else {
2902 increment_function(prop);
2903 }
2904 } while (0);
2905 }
2906 if (UNEXPECTED(result)) {
2907 ZVAL_COPY(result, prop);
2908 }
2909 }
2910 } else {
2911 zval rv;
2912 zval *z;
2913 zval z_copy;
2914
2915 GC_ADDREF(zobj);
2916 z = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, &rv);
2917 if (UNEXPECTED(EG(exception))) {
2918 OBJ_RELEASE(zobj);
2919 if (UNEXPECTED(result)) {
2920 ZVAL_NULL(result);
2921 }
2922 return;
2923 }
2924
2925 ZVAL_COPY_DEREF(&z_copy, z);
2926 increment_function(&z_copy);
2927 if (UNEXPECTED(result)) {
2928 ZVAL_COPY(result, &z_copy);
2929 }
2930 zobj->handlers->write_property(zobj, name, &z_copy, cache_slot);
2931 OBJ_RELEASE(zobj);
2932 zval_ptr_dtor(&z_copy);
2933 if (z == &rv) {
2934 zval_ptr_dtor(z);
2935 }
2936 }
2937 }
2938
zend_jit_pre_dec_obj_helper(zend_object * zobj,zend_string * name,void ** cache_slot,zval * result)2939 static void ZEND_FASTCALL zend_jit_pre_dec_obj_helper(zend_object *zobj, zend_string *name, void **cache_slot, zval *result)
2940 {
2941 zval *prop;
2942
2943 if (EXPECTED((prop = zobj->handlers->get_property_ptr_ptr(zobj, name, BP_VAR_RW, cache_slot)) != NULL)) {
2944 if (UNEXPECTED(Z_ISERROR_P(prop))) {
2945 if (UNEXPECTED(result)) {
2946 ZVAL_NULL(result);
2947 }
2948 } else {
2949 zend_property_info *prop_info = (zend_property_info *) CACHED_PTR_EX(cache_slot + 2);
2950
2951 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
2952 fast_long_decrement_function(prop);
2953 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && prop_info
2954 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
2955 zend_long val = _zend_jit_throw_dec_prop_error(prop_info);
2956 ZVAL_LONG(prop, val);
2957 }
2958 } else {
2959 do {
2960 if (Z_ISREF_P(prop)) {
2961 zend_reference *ref = Z_REF_P(prop);
2962 prop = Z_REFVAL_P(prop);
2963 if (UNEXPECTED(ZEND_REF_HAS_TYPE_SOURCES(ref))) {
2964 zend_jit_pre_dec_typed_ref(ref, result);
2965 break;
2966 }
2967 }
2968
2969 if (prop_info) {
2970 zend_jit_dec_typed_prop(prop, prop_info);
2971 } else {
2972 decrement_function(prop);
2973 }
2974 } while (0);
2975 }
2976 if (UNEXPECTED(result)) {
2977 ZVAL_COPY(result, prop);
2978 }
2979 }
2980 } else {
2981 zval rv;
2982 zval *z;
2983 zval z_copy;
2984
2985 GC_ADDREF(zobj);
2986 z = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, &rv);
2987 if (UNEXPECTED(EG(exception))) {
2988 OBJ_RELEASE(zobj);
2989 if (UNEXPECTED(result)) {
2990 ZVAL_NULL(result);
2991 }
2992 return;
2993 }
2994
2995 ZVAL_COPY_DEREF(&z_copy, z);
2996 decrement_function(&z_copy);
2997 if (UNEXPECTED(result)) {
2998 ZVAL_COPY(result, &z_copy);
2999 }
3000 zobj->handlers->write_property(zobj, name, &z_copy, cache_slot);
3001 OBJ_RELEASE(zobj);
3002 zval_ptr_dtor(&z_copy);
3003 if (z == &rv) {
3004 zval_ptr_dtor(z);
3005 }
3006 }
3007 }
3008
zend_jit_post_inc_obj_helper(zend_object * zobj,zend_string * name,void ** cache_slot,zval * result)3009 static void ZEND_FASTCALL zend_jit_post_inc_obj_helper(zend_object *zobj, zend_string *name, void **cache_slot, zval *result)
3010 {
3011 zval *prop;
3012
3013 if (EXPECTED((prop = zobj->handlers->get_property_ptr_ptr(zobj, name, BP_VAR_RW, cache_slot)) != NULL)) {
3014 if (UNEXPECTED(Z_ISERROR_P(prop))) {
3015 ZVAL_NULL(result);
3016 } else {
3017 zend_property_info *prop_info = (zend_property_info*)CACHED_PTR_EX(cache_slot + 2);
3018
3019 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
3020 ZVAL_LONG(result, Z_LVAL_P(prop));
3021 fast_long_increment_function(prop);
3022 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && prop_info
3023 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
3024 zend_long val = _zend_jit_throw_inc_prop_error(prop_info);
3025 ZVAL_LONG(prop, val);
3026 }
3027 } else {
3028 if (Z_ISREF_P(prop)) {
3029 zend_reference *ref = Z_REF_P(prop);
3030 prop = Z_REFVAL_P(prop);
3031 if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
3032 zend_jit_post_inc_typed_ref(ref, result);
3033 return;
3034 }
3035 }
3036
3037 if (prop_info) {
3038 zend_jit_post_inc_typed_prop(prop, prop_info, result);
3039 } else {
3040 ZVAL_COPY(result, prop);
3041 increment_function(prop);
3042 }
3043 }
3044 }
3045 } else {
3046 zval rv;
3047 zval *z;
3048 zval z_copy;
3049
3050 GC_ADDREF(zobj);
3051 z = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, &rv);
3052 if (UNEXPECTED(EG(exception))) {
3053 OBJ_RELEASE(zobj);
3054 ZVAL_UNDEF(result);
3055 return;
3056 }
3057
3058 ZVAL_COPY_DEREF(&z_copy, z);
3059 ZVAL_COPY(result, &z_copy);
3060 increment_function(&z_copy);
3061 zobj->handlers->write_property(zobj, name, &z_copy, cache_slot);
3062 OBJ_RELEASE(zobj);
3063 zval_ptr_dtor(&z_copy);
3064 if (z == &rv) {
3065 zval_ptr_dtor(z);
3066 }
3067 }
3068 }
3069
zend_jit_post_dec_obj_helper(zend_object * zobj,zend_string * name,void ** cache_slot,zval * result)3070 static void ZEND_FASTCALL zend_jit_post_dec_obj_helper(zend_object *zobj, zend_string *name, void **cache_slot, zval *result)
3071 {
3072 zval *prop;
3073
3074 if (EXPECTED((prop = zobj->handlers->get_property_ptr_ptr(zobj, name, BP_VAR_RW, cache_slot)) != NULL)) {
3075 if (UNEXPECTED(Z_ISERROR_P(prop))) {
3076 ZVAL_NULL(result);
3077 } else {
3078 zend_property_info *prop_info = (zend_property_info*)CACHED_PTR_EX(cache_slot + 2);
3079
3080 if (EXPECTED(Z_TYPE_P(prop) == IS_LONG)) {
3081 ZVAL_LONG(result, Z_LVAL_P(prop));
3082 fast_long_decrement_function(prop);
3083 if (UNEXPECTED(Z_TYPE_P(prop) != IS_LONG) && prop_info
3084 && !(ZEND_TYPE_FULL_MASK(prop_info->type) & MAY_BE_DOUBLE)) {
3085 zend_long val = _zend_jit_throw_dec_prop_error(prop_info);
3086 ZVAL_LONG(prop, val);
3087 }
3088 } else {
3089 if (Z_ISREF_P(prop)) {
3090 zend_reference *ref = Z_REF_P(prop);
3091 prop = Z_REFVAL_P(prop);
3092 if (ZEND_REF_HAS_TYPE_SOURCES(ref)) {
3093 zend_jit_post_dec_typed_ref(ref, result);
3094 return;
3095 }
3096 }
3097
3098 if (prop_info) {
3099 zend_jit_post_dec_typed_prop(prop, prop_info, result);
3100 } else {
3101 ZVAL_COPY(result, prop);
3102 decrement_function(prop);
3103 }
3104 }
3105 }
3106 } else {
3107 zval rv;
3108 zval *z;
3109 zval z_copy;
3110
3111 GC_ADDREF(zobj);
3112 z = zobj->handlers->read_property(zobj, name, BP_VAR_R, cache_slot, &rv);
3113 if (UNEXPECTED(EG(exception))) {
3114 OBJ_RELEASE(zobj);
3115 ZVAL_UNDEF(result);
3116 return;
3117 }
3118
3119 ZVAL_COPY_DEREF(&z_copy, z);
3120 ZVAL_COPY(result, &z_copy);
3121 decrement_function(&z_copy);
3122 zobj->handlers->write_property(zobj, name, &z_copy, cache_slot);
3123 OBJ_RELEASE(zobj);
3124 zval_ptr_dtor(&z_copy);
3125 if (z == &rv) {
3126 zval_ptr_dtor(z);
3127 }
3128 }
3129 }
3130
zend_jit_free_trampoline_helper(zend_function * func)3131 static void ZEND_FASTCALL zend_jit_free_trampoline_helper(zend_function *func)
3132 {
3133 ZEND_ASSERT(func->common.fn_flags & ZEND_ACC_CALL_VIA_TRAMPOLINE);
3134 zend_string_release_ex(func->common.function_name, 0);
3135 zend_free_trampoline(func);
3136 }
3137
zend_jit_exception_in_interrupt_handler_helper(void)3138 static void ZEND_FASTCALL zend_jit_exception_in_interrupt_handler_helper(void)
3139 {
3140 if (EG(exception)) {
3141 /* We have to UNDEF result, because ZEND_HANDLE_EXCEPTION is going to free it */
3142 const zend_op *throw_op = EG(opline_before_exception);
3143
3144 if (throw_op
3145 && throw_op->result_type & (IS_TMP_VAR|IS_VAR)
3146 && throw_op->opcode != ZEND_ADD_ARRAY_ELEMENT
3147 && throw_op->opcode != ZEND_ADD_ARRAY_UNPACK
3148 && throw_op->opcode != ZEND_ROPE_INIT
3149 && throw_op->opcode != ZEND_ROPE_ADD) {
3150 ZVAL_UNDEF(ZEND_CALL_VAR(EG(current_execute_data), throw_op->result.var));
3151 }
3152 }
3153 }
3154
zend_jit_rope_end(zend_string ** rope,uint32_t count)3155 static zend_string* ZEND_FASTCALL zend_jit_rope_end(zend_string **rope, uint32_t count)
3156 {
3157 zend_string *ret;
3158 uint32_t i;
3159 size_t len = 0;
3160
3161 uint32_t flags = ZSTR_COPYABLE_CONCAT_PROPERTIES;
3162 for (i = 0; i <= count; i++) {
3163 flags &= ZSTR_GET_COPYABLE_CONCAT_PROPERTIES(rope[i]);
3164 len += ZSTR_LEN(rope[i]);
3165 }
3166 ret = zend_string_alloc(len, 0);
3167 GC_ADD_FLAGS(ret, flags);
3168
3169 char *target = ZSTR_VAL(ret);
3170 for (i = 0; i <= count; i++) {
3171 target = zend_mempcpy(target, ZSTR_VAL(rope[i]), ZSTR_LEN(rope[i]));
3172 zend_string_release_ex(rope[i], 0);
3173 }
3174 *target = '\0';
3175 return ret;
3176 }
3177
