This has been the case at least since PHP 5.4. Thanks to Girgias for
pointing it out.
It appears that there are several global variables internal to mbstring
which can be queried via mb_get_info() and which could be NULL, but
at the very least, we know that "mbstring.http_input" is one of them.
* fix segfault in `ZEND_BIND_STATIC`
In case a `ZEND_BIND_STATIC` is being executed, while the current chunk is full,
the `zend_array_dup()` call will trigger a OOM in ZendMM which will crash, as
the opline might be a dangling pointer.
* add missing test
* `assert()`ing seems easier than trying to make the compiler to not optimize
* moved from function call to INI setting, so we can use this in other places as well
* make `assert()` work no NDEBUG builds
* document magic number
* fix segfault in `ZEND_FUNC_GET_ARGS`
In case a `ZEND_FUNC_GET_ARGS` is being executed, while the current chunk is
full, the `zend_new_array()` call will trigger a OOM in ZendMM which will crash,
as the opline might be a dangling pointer.
---------
Co-authored-by: Florian Engelhardt <florian@engelhardt.tc>
php_strip_url_passwd modifies url in-place. We cannot assume from
php_message_handler_for_zend that data is a temporary, modifiable string.
Fixes oss-fuzz #64209
Closes GH-12733
- Adds -Wall YFLAGS when using the scripts/dev/genfiles to have similar
output there in case things need to be fixed.
- Syncs @ suppression operators across the bison calls.
php_strip_url_passwd modifies url in-place. We cannot assume from
php_message_handler_for_zend that data is a temporary, modifiable string.
Fixes oss-fuzz #64209
Closes GH-12733
Right-shifting a negative number is unspecified (i.e.
implementation-defined) behaviour [1]. If we take a look at the
generated assembly [2], we see that the wrong value is computed.
Fix it by using Z_UL instead of Z_L.
While we're at it, just change every occurrence of this pattern to use
Z_UL instead of casting.
[1] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1548.pdf §6.5.7.5
[2] https://godbolt.org/z/4Y1qKKjsh
Closes GH-12613.
* PHP-8.3:
Fixed GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT
ext/intl: change when the locale is invalid for the 8.1/8.2 serie.
* PHP-8.2:
Fixed GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT
ext/intl: change when the locale is invalid for the 8.1/8.2 serie.
* IR update
* Use folding to allow constant folding and common subexpression elimination
* Implement IR JIT for INIT_FCALL, INIT_FCALL_BY_NAME and INIT_NS_FCALL_BY_NAME
* Implement IR JIT for SEND_VAL and SEND_VAL_EX
* Implement IR JIT for SEND_REF
* Implement IR JIT for SEND_VAR* instructions (incompltere - few tests failures)
* Implement IR JIT for CHECK_FUNC_ARG
* Implement IR JIT for CHECK_UNDEF_ARGS
* Implement IR JIT for ROPE_INIT, ROPE_ADD and ROPE_END
* Implement IR JIT for FREE, FE_FREE, ECHO, STRLEN and COUNT
* Implement IR JIT for IN_ARRAY
* Implement IR JIT support for separate VM stack overflow check
* Implement IR JIT for INIT_DYNAMIC_CALL
* Implemenr IR JIT for INIT_METHOD_CALL
* Fix IR JIT for IN_ARRAY and COUNT
* Implement IR JIT for VERIFY_RETURN_TYPE
* Force C compiler to store preserved registers to allow JIT using them
* Implement IR JIT for DO_FCALL, DO_UCALL, DO_ICALL and DO_FCALL_BY_NAME
* Implement IR JIT for FETCH_CONSTANT
* Fix (reverse) guard conditions
* Implement IR JIT for RECV and RECV_INIT
* Implement IR JIT for RETURN
* Implement IR JIT for BIND_GLOBAL
* Fix guard for: int++ => double
* Fix exception handling
* Allow deoptimization of zval type only (if some register is spilled by the IR engine)
* Fix overflow handling
* Implement IR JIT for FE_RESET_R and FE_FETCH_R
* Eliminate extra temporary register
* Better registers usage
* Implement IR JIT for FETCH_DIM_* and ISSET_DIM
* Implement IR JIT for ASSIGN_DIM and ASSIGN_DIM_OP
* cleanup
* Generae IR that produces a better x86[_64] code
* Allow trace register allocation for live ranges terminated before entering a called function
* Remove following END->BEGIN nodes during IR construction
* Remove useless (duplicate) guard
* Avoid useless exception check
* Prevent duplicate store
* Eliminate repatable re-assignment of stack zval types
* Enable combination of some instructions with the following SEND_VAL for IR JIT
* Avoid generation of useless RLOADs
* Eliminatare refcouting in a sequence of FETCH_DIM_R
* Fix assertion
* Remove ZREG_ZVAL_ADDREF flag from an element of abstract stack
* Implement IR JIT for FETCH_OBJ_*
* Implement IR JIT for ASSIGN_OBJ
* Implement IR JIT for ASSIGN_OBJ_OP
* cleanup
* Implement IR JIT for (PRE/POST)_(INC/DEC)_OBJ
* ws
* cleanup
* Fix IR JIT for constructor call
* Fix opcache.jit=1201 IR JIT.
With opcache.jit=1201 we still have to generate code for follow and target basic blocks with single exiting VM instruction. We mat just omit the entry point.
* Fix IR construction for the case when both IF targets are the same
* Avoid PHP LEAVE code duplication in function IR JIT.
* Reload operands from memeory when overflow (this improves hot code)
* Implement IR JIT for SWITCH_LONG, SWITCH_STRING and MATCH
* Initialize result to IS_UNDEF
* Fix JIT integraion with observer (Zend/tests/gh10346.phpt failure)
* Fix incorrect compilation of FE_FETCH with predicted empty array
* Fix register allocation
* Use sign extension inxted of zero
* Fix trace register allocator
* cleanp
* Fix address sanitizer warning
* Calculate JIT trace prologue sixe on startup (to avoid magic constants).
* Add cgecks for merge arrays overflow (this should be refactored using lists)
* Cache TLS access to perform corresponding read once per basic block
* cleanup unused variable
* Fix IR JIT support for CLANG build (CALL VM without global register variables)
* Fix IR JIT for CALL VM with global register variables
* Allow %rpb ysage in JIT for CALL VM (we save and restore it in prologue/epilogue anyway)
* cleanup
* Allocate enough fixed stack to keep preserved registers
* We don't have to care about x29 and x30
* cleanup (JMPZ/NZ_EX work fine)
* Revert "cleanup (JMPZ/NZ_EX work fine)"
This reverts commit cf8dd74a040e225d290d8ac4f5e33df638e6f8b8.
* Don't allocate register for PHP variables that are loaded from memory and used once
* Eliminate redundand deoptimization stores
* cleanup
* cleanup
* cleanup
* Optimization for constant comparison
* Cleanup and elimination of dead deoptimization stores
* Eliminate duplicate constant loading
* Set proper initial SP offset info for GDB backtraces
This doesn't take into account the following SP/FP modifications
* Add spill stores
* Remove low limit on number of deoptimization constants
* Emit dead code only when it's really necessary for IR graph
* cleanup
* cleanup
* Prefer loading long constants from memory (instead of loading immediate value)
* Regiter disasm labels using macros (add missing helpers)
* Make IR franework to care about GUARD JMP reordering
* Avoid reloading
* Improve register allocation for IR tracing JIT
* Add comment
* Fix deoptimization on result type guard of FETCH_DIM_R and FETCH_OBJ_R
* If HYBRID VM can't provide some stack space for JIT code in "red zone" then JIT has to reserve stack space itself
* Dump IR for stubs only if disassembling of stubs is requested
* Revert "Dump IR for stubs only if disassembling of stubs is requested"
This reverts commit d8b56bec129bc23c2b16f1f3c6367190181b6fdb.
* Dump IR for stubs only if disassembling of stubs is requested (another approach)
* Improve overflow deoptimization for ADD(_,1) and SUB(_,1)
Now we deoptimize to the next instruction, load constant result, and remove op1 from SNAPSHOT
* Switch to IR Builder API
* Switch to new IR builder macros
* Fix jit_set_Z_TYPE_INFO() call. op3 is a simple constant (not a ir_ref).
* Generate better code
* Enable empty ENTRY block merging
* Improve code generated for array separation/creation before an update
(ASSIGN_DIM, ASSING_DIM_OP, etc)
* Fix incorrect deleteion of PHI source (op1 is used for control link)
* Load constant once
* cleanup
* Improve control-flow to avoid two IS_ARRAY checks for REFERENCEs
* Update comments
* cleanup
* Clenup comments
* Fix AAarch 64 build (disable stack adjustment auto-detection)
* Add filename and line number to closure names
* Reserve stack for parameter passing
* Increase size of CPU stack reserved for JIT-ed code
* Fix addess sanitizer warnings
* Clenup: introduce OPTIMIZE_FOR_SIZE macro (disabled by default)
* Port 08e7591206 to IR JIT
Fix (at lease part of the) #GH-10635: ARM64 function JIT causes impossible assertion
* cleanup
* Preload constant and use tests that may be compiled into better code
* Convert helpers to stubs
* Introduce a helper data structure (ir_refs) to collect references for the following use in (MERGE/PHI)_N
* Use ir_refs
* Improve code generated by zend_jit_zval_copy_deref()
* Use "cold" attribute to influence IR block scheduler and achieve better code layout
* Keep info collected by recursion analyzer
* Use HTTPS URL to allow fetching without a SSH key
* Update IR
* Update IR
* Add IR JIT support for Wondows (Win64 support is incomplete)
* Update IR
* Update IR
* Fix support for Windows ZTS build
* Fix stack alignment
* Cleanup ir_ctx.control usage
* Fixed support for irreducable (incomplete) and merged loops
* Revert "Fixed support for irreducable (incomplete) and merged loops"
This reverts commit 672b5b89f47e8b81745fb73c86e0bcb0937daf16.
* Generate better code for RECV_ENTRies
* Use simpler and more efficient checks
* Switch to new ENTRY node concept
* Limit register usage across the OSR ENTRY point
* Upate MEM type only if we write to memory
* Use LOOP_END without a reference edge
* Use new ir_init() prototype
* Delay LOAD for better LOAD fusion
* Fix RECV/RECV_INIT compilation with opcache.jit=1235
* iPtoperly compile fake closures (they mau be called as regular functions)
* Fix reabase
* Fix rebase and add --with-capstone support for IR JIT
* Replace zend_uchar -> uint8_t
* IR JIT support for delayed destructor for zend_assign_to_typed_ref/prop
* Handle zend_execute_internal in IR JIT
* Fix readonly+clone IR JIT issues
* Switch to ir_ctx.mflags
* Ckeanup "inputs_count" access
* Disable CSE for nodes bound to PHP local varibles
The stack slots for temporaty variables may be reused and in case of
spilling this may cause clobbering of the value.
(ext/standard/tests/strings/htmlentities20.phpt on x86 with tracing JIT)
* Fix deoptimization code when link traces
See ext/zlib/tests/bug75273.phpt failure
* Fix missing type store
This fixes ext/openssl/tests/openssl_error_string_basic_openssl3.phpt
* Fix tracing JIT for overflowing INC/DEC
Fixes tests/lang/operators/preinc_basiclong_64bit.phpt
* Remove ir_remove_unreachable_blocks() call. Now it's called by ir_build_cfg(), when necessary.
* IR JIT: Fixed inaccurate range inference usage for UNDEF/NULL/FALSE
* IR JIT: Fixed GH-11127 (JIT fault)
* Avoid allocation of unused exit point
* Don't record already stored PHP variables in SNAPSHOTs
* Delay variable load
* Disable CSE across ENTRY
* Fixed disabling CSE
* Fix deoptimization
* Fixed deoptimization
* Disable incorrect register allocation
* Fix JIT for INDENTICAL+JMPZ_EX
* Add comments
* Fixed missed type stores
* IR JIT: added support for CLDEMOTE
* Fixed incorrect constant usage
* Disable compilation of PHP functions with irreducible CGF
* Fixed liveness check
* Fixed code for constant conditional jump
* Add type store to avoid use-after-free
* Fixed liveness analyses
* Gnerate SNAPSHOT for virtual method calls
* More accurate search for staticaly inferred info about a trace SSA vaiable
* Fix incorrect result use type_info
* Fix JMPZ/NZ_EX support and missing type store
* Fixed trace type inference and missing type store
* Store type of unused CV to prevent possible following use after free
* Fixed deoptimizaton info
* Fixed stack layout
* Implemented support for veneers on AArch64
* Dsable CSE to avoid over-optimization
* Don't bind nodes for TMP PHP variables
* Re-enable CSE for temporary variables as we don't bind them anymore
* Switch to CPU stack spill slots
* Add codegen info dump
* Initialize CV variables through FP (this enables some folding optimizatios)
* Use zero-extension that can be eliminated
* Avoid generation of dead PHIs
* Increase preallocated spill stack size
* Enable IR based JIT by default
* Fixed build with -disable-opcache-jit
* Use explicit type conversion & force load values to registerts
* Fix IR build
* Checkout submodules in github actions
* Fixed Windows build
* Fixed Windows build
* Fixed reattach to IR JIT SHM
* Update IR
* Checkout submodules in nightly CI
* Fix MACOS ZTS in IR JIT
* Update ir
* Fixed incorrect register allocation
* Fixed incorect code generation
* Fixed tracing jit for BIND_INIT_STATIC_OR_JMP
* Update README
* Typos
* Revert JIT disabling for run-tests.php workers
* Fixed code review issues
* Update IR
* Update IR
* Update IR
* Allow exit_point duplication, when the deoptimization info differs because of spilling
* Use bound spill slots for CV (once again)
* Improve error handling
* Removed IR submodule
* Remove IR submodule from workflows
* Embed IR
IR commit: 8977307f4e96ee03847d7f2eb809b3080f9ed662
* Add .gitignore
* Fixed according to feedback
* Force C saving preserved registers only for HYBRID VM
* Update IR
IR commit: a2f8452b3d35a756cba38924f5c51a48a7207494
* cleanup
* Replace ZEND_ASSERT(0) by ZEND_UNREACHABLE()
* Update IR and remove unused IR files
IR commit: 399a38771393c202a741336643118991290b4b1b
* Fixed inconsistency between IR code-generation and register-allocation
* Update IR
IR commit: 86685504274b0c71d9985b3c926dccaca2cacf9b
* Update ir_PHI*() according to IR construction API changes
* Fixed 32-bit build
* Update IR
IR commit: d0686408e20cd8c8640e37ed52ab81403a2383cb
* Support for ir_TAILCALL() prototype changes
* Update IR
IR commit: d72ae866e09d17e879378767aceb91d51894818c
* Fixed incorrect extension (ZEXT->SEXT)
* Fix SSA dominance
* Update IR
IR commit: d60d92516dc5f89b93cdf1df7a54141e83226b07
* Fixed support ir_ctx.ret_type
When redeclaring an overridden static property with a trait we're removing the
property from the class. However, because the property itself does not belong to
the class we must not free its associated data.
This issue is exposed by 9a250cc9d6 in PHP 8.3+ because duplicate static
properties in traits are no longer skipped, but redeclared.
Fixes GH-12468
This currently uses ZVAL_COPY_OR_DUP, which copies the value and handles
refcounting. However, internal classes cannot have refcounted default
properties because of constraints imposed by
zend_declare_typed_property(). So copying the value is sufficient.
While this doesn't really improve the performance for our benchmarks, it
improves performance for cases where a lot of temporary internal objects
are instantiated. For example, when instantiating DOM classes: DOM
objects are transient, so lots of temporary objects are created.
Commit d86314939c added an additional parameter to Z_PARAM_FUNC_EX.
To maintain compatibility with third-party extensions, we keep
Z_PARAM_FUNC_EX as it used to be, and add Z_PARAM_FUNC_EX2 instead.
The constant name is usually interend. Without opcache, compilation always
interns strings. Without opcache, compilation does not intern (new) strings, but
persisting of script does. If a script is not stored in shm the constant name
will not be interned.
The building of enum backing stores was missing a addref for the constant name,
leading to a double-free when releasing constants and backing stores of enums.
Fixes GH-12366
Closes GH-12405
* PHP-8.3:
Fix compile error with -Werror=incompatible-function-pointer-types and old libxml2
Fix GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT
Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML
* PHP-8.2:
Fix GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT
Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML
* PHP-8.1:
Fix GH-10008: Narrowing occurred during type inference of ZEND_ADD_ARRAY_ELEMENT
Fix type error on XSLTProcessor::transformToDoc return value with SimpleXML
This test triggers narrowing for two ops: first ZEND_ADD_ARRAY_ELEMENT,
and then ZEND_ASSIGN.
The type inference happens in the following order:
1) The ZEND_ADD_ARRAY_ELEMENT infers type 0x40e04080 (packed flag is set),
arr_type=0 at this point because it hasn't been set by ZEND_INIT_ARRAY yet.
2) The ZEND_INIT_ARRAY infers type 0x40804080
3) The ZEND_ADD_ARRAY_ELEMENT infers type 0x40e04080, arr_type=0x40804080,
which does not have the packed flag set while the existing result of
ZEND_ADD_ARRAY_ELEMENT has the packed flag set.
This seems to occur because of the phi node introduced by the while
loop. If I remove the loop the problem goes away.
As Arnaud noted, this seems to be caused by a too wide type inference
for arr_type==0. We should keep the invariant that if x>=y then
key_type(x) >= key_type(y).
If we write the possible results down in a table we get:
```
arr_type resulting key type
--------------- --------------------------------------------------------------------------
HASH_ONLY -> MAY_BE_ARRAY_NUMERIC_HASH
PACKED_ONLY -> MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED (== MAY_BE_ARRAY_KEY_LONG)
HASH || PACKED -> MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED (== MAY_BE_ARRAY_KEY_LONG)
0 -> MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED (== MAY_BE_ARRAY_KEY_LONG)
```
As we can see, `HASH_ONLY > 0` but
`MAY_BE_ARRAY_NUMERIC_HASH < MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED`,
which violates the invariant.
Instead if we modify the zero case to have MAY_BE_ARRAY_NUMERIC_HASH instead,
we get the following table which satisfies the invariant.
```
arr_type resulting key type
--------------- --------------------------------------------------------------------------
HASH_ONLY -> MAY_BE_ARRAY_NUMERIC_HASH
PACKED_ONLY -> MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED (== MAY_BE_ARRAY_KEY_LONG)
HASH || PACKED -> MAY_BE_ARRAY_NUMERIC_HASH | MAY_BE_ARRAY_PACKED (== MAY_BE_ARRAY_KEY_LONG)
0 -> MAY_BE_ARRAY_NUMERIC_HASH
```
Broke in 1ffbb73.
Closes GH-10294.
* Make sure core module has number 0
Some places, possibly also outside PHP, assume the core extension has
module number 0. After 8a812c3fda this wasn't the case anymore as
reported in [1]. Fix it by changing how the next module ID is computed.
[1] https://github.com/php/php-src/pull/12246#issuecomment-1731432377
* Add assertion
* Add test
When we try to load an extension multiple times, we still overwrite the
type, module number, and handle. If the module number is used to
indicate module boundaries (e.g. in reflection and in dom, see e.g.
dom_objects_set_class_ex), then all sorts of errors can happen.
In the case of ext/dom, OP's error happens because the following
happens:
- The property handler is set up incorrectly in
dom_objects_set_class_ex() because the wrong module number is
specified. The class highest in the hierarchy is DOMNode, so the
property handler is incorrectly set to that of DOMNode instead of
DOMDocument.
- The documentElement property doesn't exist on DOMNode, it only exists
on DOMDocument, so it tries to read using zend_std_read_property().
As there is no user property called documentElement, that read
operation returns an undef value.
However, the type is still checked, resulting in the strange exception.
Solve this by changing the API such that the data is only overwritten if
it's owned data.
Closes GH-12246.
ZEND_UNREACHABLE() currently expands to the following in GCC:
if (__builtin_expect(!(0), 0)) __builtin_unreachable();
Even though the branch is always executed, GCC does not recognize the outer
branch as unreachable. Removing the if fixes some unexpected warnings.
Closes GH-12248
When declaring the same static property with a doc block in a class and in a trait,
the doc block of the property in the class is leaked. While at it, possibly fix doc
comment for internal classes.
Close GH-12238
