1 /*
2 +----------------------------------------------------------------------+
3 | Zend OPcache, Escape Analysis |
4 +----------------------------------------------------------------------+
5 | Copyright (c) The PHP Group |
6 +----------------------------------------------------------------------+
7 | This source file is subject to version 3.01 of the PHP license, |
8 | that is bundled with this package in the file LICENSE, and is |
9 | available through the world-wide-web at the following url: |
10 | http://www.php.net/license/3_01.txt |
11 | If you did not receive a copy of the PHP license and are unable to |
12 | obtain it through the world-wide-web, please send a note to |
13 | license@php.net so we can mail you a copy immediately. |
14 +----------------------------------------------------------------------+
15 | Authors: Dmitry Stogov <dmitry@php.net> |
16 +----------------------------------------------------------------------+
17 */
18
19 #include "php.h"
20 #include "Optimizer/zend_optimizer.h"
21 #include "Optimizer/zend_optimizer_internal.h"
22 #include "zend_bitset.h"
23 #include "zend_cfg.h"
24 #include "zend_ssa.h"
25 #include "zend_inference.h"
26 #include "zend_dump.h"
27
28 /*
29 * T. Kotzmann and H. Mossenbock. Escape analysis in the context of dynamic
30 * compilation and deoptimization. In Proceedings of the International
31 * Conference on Virtual Execution Environments, pages 111-120, Chicago,
32 * June 2005
33 */
34
union_find_init(int * parent,int * size,int count)35 static zend_always_inline void union_find_init(int *parent, int *size, int count) /* {{{ */
36 {
37 int i;
38
39 for (i = 0; i < count; i++) {
40 parent[i] = i;
41 size[i] = 1;
42 }
43 }
44 /* }}} */
45
union_find_root(int * parent,int i)46 static zend_always_inline int union_find_root(int *parent, int i) /* {{{ */
47 {
48 int p = parent[i];
49
50 while (i != p) {
51 p = parent[p];
52 parent[i] = p;
53 i = p;
54 p = parent[i];
55 }
56 return i;
57 }
58 /* }}} */
59
union_find_unite(int * parent,int * size,int i,int j)60 static zend_always_inline void union_find_unite(int *parent, int *size, int i, int j) /* {{{ */
61 {
62 int r1 = union_find_root(parent, i);
63 int r2 = union_find_root(parent, j);
64
65 if (r1 != r2) {
66 if (size[r1] < size[r2]) {
67 parent[r1] = r2;
68 size[r2] += size[r1];
69 } else {
70 parent[r2] = r1;
71 size[r1] += size[r2];
72 }
73 }
74 }
75 /* }}} */
76
zend_build_equi_escape_sets(int * parent,zend_op_array * op_array,zend_ssa * ssa)77 static int zend_build_equi_escape_sets(int *parent, zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
78 {
79 zend_ssa_var *ssa_vars = ssa->vars;
80 int ssa_vars_count = ssa->vars_count;
81 zend_ssa_phi *p;
82 int i, j;
83 int *size;
84 ALLOCA_FLAG(use_heap)
85
86 size = do_alloca(sizeof(int) * ssa_vars_count, use_heap);
87 if (!size) {
88 return FAILURE;
89 }
90 union_find_init(parent, size, ssa_vars_count);
91
92 for (i = 0; i < ssa_vars_count; i++) {
93 if (ssa_vars[i].definition_phi) {
94 p = ssa_vars[i].definition_phi;
95 if (p->pi >= 0) {
96 union_find_unite(parent, size, i, p->sources[0]);
97 } else {
98 for (j = 0; j < ssa->cfg.blocks[p->block].predecessors_count; j++) {
99 union_find_unite(parent, size, i, p->sources[j]);
100 }
101 }
102 } else if (ssa_vars[i].definition >= 0) {
103 int def = ssa_vars[i].definition;
104 zend_ssa_op *op = ssa->ops + def;
105 zend_op *opline = op_array->opcodes + def;
106
107 if (op->op1_def >= 0) {
108 if (op->op1_use >= 0) {
109 if (opline->opcode != ZEND_ASSIGN) {
110 union_find_unite(parent, size, op->op1_def, op->op1_use);
111 }
112 }
113 if (opline->opcode == ZEND_ASSIGN && op->op2_use >= 0) {
114 union_find_unite(parent, size, op->op1_def, op->op2_use);
115 }
116 }
117 if (op->op2_def >= 0) {
118 if (op->op2_use >= 0) {
119 union_find_unite(parent, size, op->op2_def, op->op2_use);
120 }
121 }
122 if (op->result_def >= 0) {
123 if (op->result_use >= 0) {
124 if (opline->opcode != ZEND_QM_ASSIGN) {
125 union_find_unite(parent, size, op->result_def, op->result_use);
126 }
127 }
128 if (opline->opcode == ZEND_QM_ASSIGN && op->op1_use >= 0) {
129 union_find_unite(parent, size, op->result_def, op->op1_use);
130 }
131 if (opline->opcode == ZEND_ASSIGN && op->op2_use >= 0) {
132 union_find_unite(parent, size, op->result_def, op->op2_use);
133 }
134 if (opline->opcode == ZEND_ASSIGN && op->op1_def >= 0) {
135 union_find_unite(parent, size, op->result_def, op->op1_def);
136 }
137 }
138 }
139 }
140
141 for (i = 0; i < ssa_vars_count; i++) {
142 parent[i] = union_find_root(parent, i);
143 }
144
145 free_alloca(size, use_heap);
146
147 return SUCCESS;
148 }
149 /* }}} */
150
get_class_entry(const zend_script * script,zend_string * lcname)151 static inline zend_class_entry *get_class_entry(const zend_script *script, zend_string *lcname) /* {{{ */
152 {
153 zend_class_entry *ce = script ? zend_hash_find_ptr(&script->class_table, lcname) : NULL;
154 if (ce) {
155 return ce;
156 }
157
158 ce = zend_hash_find_ptr(CG(class_table), lcname);
159 if (ce && ce->type == ZEND_INTERNAL_CLASS) {
160 return ce;
161 }
162
163 return NULL;
164 }
165 /* }}} */
166
is_allocation_def(zend_op_array * op_array,zend_ssa * ssa,int def,int var,const zend_script * script)167 static int is_allocation_def(zend_op_array *op_array, zend_ssa *ssa, int def, int var, const zend_script *script) /* {{{ */
168 {
169 zend_ssa_op *ssa_op = ssa->ops + def;
170 zend_op *opline = op_array->opcodes + def;
171
172 if (ssa_op->result_def == var) {
173 switch (opline->opcode) {
174 case ZEND_INIT_ARRAY:
175 return 1;
176 case ZEND_NEW:
177 /* objects with destructors should escape */
178 if (opline->op1_type == IS_CONST) {
179 zend_class_entry *ce = get_class_entry(script, Z_STR_P(CRT_CONSTANT(opline->op1)+1));
180 uint32_t forbidden_flags =
181 /* These flags will always cause an exception */
182 ZEND_ACC_IMPLICIT_ABSTRACT_CLASS | ZEND_ACC_EXPLICIT_ABSTRACT_CLASS
183 | ZEND_ACC_INTERFACE | ZEND_ACC_TRAIT;
184 if (ce && !ce->parent && !ce->create_object && !ce->constructor &&
185 !ce->destructor && !ce->__get && !ce->__set &&
186 !(ce->ce_flags & forbidden_flags) &&
187 (ce->ce_flags & ZEND_ACC_CONSTANTS_UPDATED)) {
188 return 1;
189 }
190 }
191 break;
192 case ZEND_QM_ASSIGN:
193 if (opline->op1_type == IS_CONST
194 && Z_TYPE_P(CRT_CONSTANT(opline->op1)) == IS_ARRAY) {
195 return 1;
196 }
197 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_ARRAY)) {
198 return 1;
199 }
200 break;
201 case ZEND_ASSIGN:
202 if (opline->op1_type == IS_CV && (OP1_INFO() & MAY_BE_ARRAY)) {
203 return 1;
204 }
205 break;
206 }
207 } else if (ssa_op->op1_def == var) {
208 switch (opline->opcode) {
209 case ZEND_ASSIGN:
210 if (opline->op2_type == IS_CONST
211 && Z_TYPE_P(CRT_CONSTANT(opline->op2)) == IS_ARRAY) {
212 return 1;
213 }
214 if (opline->op2_type == IS_CV && (OP2_INFO() & MAY_BE_ARRAY)) {
215 return 1;
216 }
217 break;
218 case ZEND_ASSIGN_DIM:
219 if (OP1_INFO() & (MAY_BE_UNDEF | MAY_BE_NULL | MAY_BE_FALSE)) {
220 /* implicit object/array allocation */
221 return 1;
222 }
223 break;
224 }
225 }
226
227 return 0;
228 }
229 /* }}} */
230
is_local_def(zend_op_array * op_array,zend_ssa * ssa,int def,int var,const zend_script * script)231 static int is_local_def(zend_op_array *op_array, zend_ssa *ssa, int def, int var, const zend_script *script) /* {{{ */
232 {
233 zend_ssa_op *op = ssa->ops + def;
234 zend_op *opline = op_array->opcodes + def;
235
236 if (op->result_def == var) {
237 switch (opline->opcode) {
238 case ZEND_INIT_ARRAY:
239 case ZEND_ADD_ARRAY_ELEMENT:
240 case ZEND_QM_ASSIGN:
241 case ZEND_ASSIGN:
242 return 1;
243 case ZEND_NEW:
244 /* objects with destructors should escape */
245 if (opline->op1_type == IS_CONST) {
246 zend_class_entry *ce = get_class_entry(script, Z_STR_P(CRT_CONSTANT(opline->op1)+1));
247 if (ce && !ce->create_object && !ce->constructor &&
248 !ce->destructor && !ce->__get && !ce->__set && !ce->parent) {
249 return 1;
250 }
251 }
252 break;
253 }
254 } else if (op->op1_def == var) {
255 switch (opline->opcode) {
256 case ZEND_ASSIGN:
257 case ZEND_ASSIGN_DIM:
258 case ZEND_ASSIGN_OBJ:
259 case ZEND_ASSIGN_OBJ_REF:
260 case ZEND_ASSIGN_DIM_OP:
261 case ZEND_ASSIGN_OBJ_OP:
262 case ZEND_PRE_INC_OBJ:
263 case ZEND_PRE_DEC_OBJ:
264 case ZEND_POST_INC_OBJ:
265 case ZEND_POST_DEC_OBJ:
266 return 1;
267 }
268 }
269
270 return 0;
271 }
272 /* }}} */
273
is_escape_use(zend_op_array * op_array,zend_ssa * ssa,int use,int var)274 static int is_escape_use(zend_op_array *op_array, zend_ssa *ssa, int use, int var) /* {{{ */
275 {
276 zend_ssa_op *ssa_op = ssa->ops + use;
277 zend_op *opline = op_array->opcodes + use;
278
279 if (ssa_op->op1_use == var) {
280 switch (opline->opcode) {
281 case ZEND_ASSIGN:
282 /* no_val */
283 break;
284 case ZEND_QM_ASSIGN:
285 if (opline->op1_type == IS_CV) {
286 if (OP1_INFO() & MAY_BE_OBJECT) {
287 /* object aliasing */
288 return 1;
289 }
290 }
291 break;
292 case ZEND_ISSET_ISEMPTY_DIM_OBJ:
293 case ZEND_ISSET_ISEMPTY_PROP_OBJ:
294 case ZEND_FETCH_DIM_R:
295 case ZEND_FETCH_OBJ_R:
296 case ZEND_FETCH_DIM_IS:
297 case ZEND_FETCH_OBJ_IS:
298 break;
299 case ZEND_ASSIGN_OP:
300 return 1;
301 case ZEND_ASSIGN_DIM_OP:
302 case ZEND_ASSIGN_OBJ_OP:
303 case ZEND_ASSIGN_STATIC_PROP_OP:
304 case ZEND_ASSIGN_DIM:
305 case ZEND_ASSIGN_OBJ:
306 case ZEND_ASSIGN_OBJ_REF:
307 break;
308 case ZEND_PRE_INC_OBJ:
309 case ZEND_PRE_DEC_OBJ:
310 case ZEND_POST_INC_OBJ:
311 case ZEND_POST_DEC_OBJ:
312 break;
313 case ZEND_INIT_ARRAY:
314 case ZEND_ADD_ARRAY_ELEMENT:
315 if (opline->extended_value & ZEND_ARRAY_ELEMENT_REF) {
316 return 1;
317 }
318 if (OP1_INFO() & MAY_BE_OBJECT) {
319 /* object aliasing */
320 return 1;
321 }
322 /* reference dependencies processed separately */
323 break;
324 case ZEND_OP_DATA:
325 if ((opline-1)->opcode != ZEND_ASSIGN_DIM
326 && (opline-1)->opcode != ZEND_ASSIGN_OBJ) {
327 return 1;
328 }
329 if (OP1_INFO() & MAY_BE_OBJECT) {
330 /* object aliasing */
331 return 1;
332 }
333 opline--;
334 ssa_op--;
335 if (opline->op1_type != IS_CV
336 || (OP1_INFO() & MAY_BE_REF)
337 || (ssa_op->op1_def >= 0 && ssa->vars[ssa_op->op1_def].alias)) {
338 /* assignment into escaping structure */
339 return 1;
340 }
341 /* reference dependencies processed separately */
342 break;
343 default:
344 return 1;
345 }
346 }
347
348 if (ssa_op->op2_use == var) {
349 switch (opline->opcode) {
350 case ZEND_ASSIGN:
351 if (opline->op1_type != IS_CV
352 || (OP1_INFO() & MAY_BE_REF)
353 || (ssa_op->op1_def >= 0 && ssa->vars[ssa_op->op1_def].alias)) {
354 /* assignment into escaping variable */
355 return 1;
356 }
357 if (opline->op2_type == IS_CV || opline->result_type != IS_UNUSED) {
358 if (OP2_INFO() & MAY_BE_OBJECT) {
359 /* object aliasing */
360 return 1;
361 }
362 }
363 break;
364 default:
365 return 1;
366 }
367 }
368
369 if (ssa_op->result_use == var) {
370 switch (opline->opcode) {
371 case ZEND_ASSIGN:
372 case ZEND_QM_ASSIGN:
373 case ZEND_INIT_ARRAY:
374 case ZEND_ADD_ARRAY_ELEMENT:
375 break;
376 default:
377 return 1;
378 }
379 }
380
381 return 0;
382 }
383 /* }}} */
384
zend_ssa_escape_analysis(const zend_script * script,zend_op_array * op_array,zend_ssa * ssa)385 int zend_ssa_escape_analysis(const zend_script *script, zend_op_array *op_array, zend_ssa *ssa) /* {{{ */
386 {
387 zend_ssa_var *ssa_vars = ssa->vars;
388 int ssa_vars_count = ssa->vars_count;
389 int i, root, use;
390 int *ees;
391 zend_bool has_allocations;
392 int num_non_escaped;
393 ALLOCA_FLAG(use_heap)
394
395 if (!ssa_vars) {
396 return SUCCESS;
397 }
398
399 has_allocations = 0;
400 for (i = op_array->last_var; i < ssa_vars_count; i++) {
401 if (ssa_vars[i].definition >= 0
402 && (ssa->var_info[i].type & (MAY_BE_ARRAY|MAY_BE_OBJECT))
403 && is_allocation_def(op_array, ssa, ssa_vars[i].definition, i, script)) {
404 has_allocations = 1;
405 break;
406 }
407 }
408 if (!has_allocations) {
409 return SUCCESS;
410 }
411
412
413 /* 1. Build EES (Equi-Escape Sets) */
414 ees = do_alloca(sizeof(int) * ssa_vars_count, use_heap);
415 if (!ees) {
416 return FAILURE;
417 }
418
419 if (zend_build_equi_escape_sets(ees, op_array, ssa) != SUCCESS) {
420 return FAILURE;
421 }
422
423 /* 2. Identify Allocations */
424 num_non_escaped = 0;
425 for (i = op_array->last_var; i < ssa_vars_count; i++) {
426 root = ees[i];
427 if (ssa_vars[root].escape_state > ESCAPE_STATE_NO_ESCAPE) {
428 /* already escape. skip */
429 } else if (ssa_vars[i].alias && (ssa->var_info[i].type & MAY_BE_REF)) {
430 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
431 num_non_escaped--;
432 }
433 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
434 } else if (ssa_vars[i].definition >= 0
435 && (ssa->var_info[i].type & (MAY_BE_ARRAY|MAY_BE_OBJECT))) {
436 if (!is_local_def(op_array, ssa, ssa_vars[i].definition, i, script)) {
437 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
438 num_non_escaped--;
439 }
440 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
441 } else if (ssa_vars[root].escape_state == ESCAPE_STATE_UNKNOWN
442 && is_allocation_def(op_array, ssa, ssa_vars[i].definition, i, script)) {
443 ssa_vars[root].escape_state = ESCAPE_STATE_NO_ESCAPE;
444 num_non_escaped++;
445 }
446 }
447 }
448
449 /* 3. Mark escaped EES */
450 if (num_non_escaped) {
451 for (i = 0; i < ssa_vars_count; i++) {
452 if (ssa_vars[i].use_chain >= 0) {
453 root = ees[i];
454 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
455 FOREACH_USE(ssa_vars + i, use) {
456 if (is_escape_use(op_array, ssa, use, i)) {
457 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
458 num_non_escaped--;
459 if (num_non_escaped == 0) {
460 i = ssa_vars_count;
461 }
462 break;
463 }
464 } FOREACH_USE_END();
465 }
466 }
467 }
468 }
469
470 /* 4. Process referential dependencies */
471 if (num_non_escaped) {
472 zend_bool changed;
473
474 do {
475 changed = 0;
476 for (i = 0; i < ssa_vars_count; i++) {
477 if (ssa_vars[i].use_chain >= 0) {
478 root = ees[i];
479 if (ssa_vars[root].escape_state == ESCAPE_STATE_NO_ESCAPE) {
480 FOREACH_USE(ssa_vars + i, use) {
481 zend_ssa_op *op = ssa->ops + use;
482 zend_op *opline = op_array->opcodes + use;
483 int enclosing_root;
484
485 if (opline->opcode == ZEND_OP_DATA &&
486 ((opline-1)->opcode == ZEND_ASSIGN_DIM ||
487 (opline-1)->opcode == ZEND_ASSIGN_OBJ ||
488 (opline-1)->opcode == ZEND_ASSIGN_OBJ_REF) &&
489 op->op1_use == i &&
490 (op-1)->op1_use >= 0) {
491 enclosing_root = ees[(op-1)->op1_use];
492 } else if ((opline->opcode == ZEND_INIT_ARRAY ||
493 opline->opcode == ZEND_ADD_ARRAY_ELEMENT) &&
494 op->op1_use == i &&
495 op->result_def >= 0) {
496 enclosing_root = ees[op->result_def];
497 } else {
498 continue;
499 }
500
501 if (ssa_vars[enclosing_root].escape_state == ESCAPE_STATE_UNKNOWN ||
502 ssa_vars[enclosing_root].escape_state > ssa_vars[root].escape_state) {
503 if (ssa_vars[enclosing_root].escape_state == ESCAPE_STATE_UNKNOWN) {
504 ssa_vars[root].escape_state = ESCAPE_STATE_GLOBAL_ESCAPE;
505 } else {
506 ssa_vars[root].escape_state = ssa_vars[enclosing_root].escape_state;
507 }
508 if (ssa_vars[root].escape_state == ESCAPE_STATE_GLOBAL_ESCAPE) {
509 num_non_escaped--;
510 if (num_non_escaped == 0) {
511 changed = 0;
512 } else {
513 changed = 1;
514 }
515 break;
516 } else {
517 changed = 1;
518 }
519 }
520 } FOREACH_USE_END();
521 }
522 }
523 }
524 } while (changed);
525 }
526
527 /* 5. Propagate values of escape sets to variables */
528 for (i = 0; i < ssa_vars_count; i++) {
529 root = ees[i];
530 if (i != root) {
531 ssa_vars[i].escape_state = ssa_vars[root].escape_state;
532 }
533 }
534
535 free_alloca(ees, use_heap);
536
537 return SUCCESS;
538 }
539 /* }}} */
540