Initial prototyping implicit move

Fix NPE, tweaks

The optimization may not affect backtraces

Author: nielsdos

Zend/Optimizer/dfa_pass.c

@@ -1066,6 +1066,51 @@ static bool zend_dfa_try_to_replace_result(zend_op_array *op_array, zend_ssa *ss
 	return 0;
 }
 
+/* Sets a flag on SEND ops when a copy can be a avoided. */
+static void zend_dfa_optimize_send_copies(zend_op_array *op_array, zend_ssa *ssa, zend_call_info **call_map)
+{
+	for (int v = 0; v < ssa->vars_count; v++) {
+		int var = ssa->vars[v].var;
+		if (var >= op_array->last_var) {
+			continue;
+		}
+
+		uint32_t type = ssa->var_info[v].type;
+		/* Unsetting a CV is always fine if it gets overwritten afterwards. Since type inference often infers
+		 * very wide types, we are very loose in matching types. */
+		if ((type & (MAY_BE_REF|MAY_BE_UNDEF)) || !(type & MAY_BE_RC1) || !(type & (MAY_BE_STRING|MAY_BE_ARRAY))) {
+			continue;
+		}
+
+		int use = ssa->vars[v].use_chain;
+		if (use >= 0
+			&& (op_array->opcodes[use].opcode == ZEND_SEND_VAR || op_array->opcodes[use].opcode == ZEND_SEND_VAR_EX) // TODO
+			&& op_array->opcodes[use].op2_type == IS_UNUSED) {
+			int next_use = zend_ssa_next_use(ssa->ops, v, use);
+
+			/* The next use must be an assignment of the call result, immediately after the call such that the
+			 * unset variable can never be observed.
+			 * It is also safe to optimize if there are no indirect accesses through func_get_args() etc,
+			 * no more uses, and it is not part of a loop. */
+			if ((next_use < 0
+					&& var >= op_array->num_args /* NULL must not be visible in backtraces */
+					&& !(ssa->cfg.flags & ZEND_FUNC_VARARG)
+					&& !(ssa->cfg.blocks[ssa->cfg.map[use]].flags & ZEND_BB_LOOP_HEADER)
+					&& ssa->cfg.blocks[ssa->cfg.map[use]].loop_header == -1)
+				|| (next_use >= 0
+					&& op_array->opcodes[next_use].opcode == ZEND_ASSIGN
+					&& ssa->ops[next_use].op1_use == v
+					&& ssa->ops[next_use].op2_use >= 0
+					&& call_map[use]
+					&& call_map[use]->caller_call_opline + 1 == op_array->opcodes + next_use
+					&& ssa->ops[call_map[use]->caller_call_opline - op_array->opcodes].result_def == ssa->ops[next_use].op2_use)) {
+				ZEND_ASSERT(op_array->opcodes[use].extended_value == 0);
+				op_array->opcodes[use].extended_value = 1;
+			}
+		}
+	}
+}
+
 void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx, zend_ssa *ssa, zend_call_info **call_map)
 {
 	if (ctx->debug_level & ZEND_DUMP_BEFORE_DFA_PASS) {
@@ -1124,6 +1169,11 @@ void zend_dfa_optimize_op_array(zend_op_array *op_array, zend_optimizer_ctx *ctx
 #endif
 		}
 
+		/* Optimization should not be done on main because of globals. Pass depends on CFG & call graph. */
+		if (call_map && op_array->function_name) {
+			zend_dfa_optimize_send_copies(op_array, ssa, call_map);
+		}
+
 		for (v = op_array->last_var; v < ssa->vars_count; v++) {
 
 			op_1 = ssa->vars[v].definition;

Zend/zend_vm_def.h

@@ -9900,7 +9900,7 @@ ZEND_VM_C_LABEL(fetch_dim_r_index_undef):
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_SEND_VAR, op->op2_type == IS_UNUSED && (op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0, ZEND_SEND_VAR_SIMPLE, CV|VAR, NUM)
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_SEND_VAR, op->op2_type == IS_UNUSED && !op->extended_value && (op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0, ZEND_SEND_VAR_SIMPLE, CV|VAR, NUM)
 {
 	USE_OPLINE
 	zval *varptr, *arg;
@@ -9917,6 +9917,20 @@ ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_SEND_VAR, op->op2_type == IS_UNUSED && (op1_i
 	ZEND_VM_NEXT_OPCODE();
 }
 
+ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_SEND_VAR, op->extended_value /* extended_value implies here OP2 UNUSED and OP1 not UNDEF or REF */, ZEND_SEND_VAR_SIMPLE_EXT, CV, NUM)
+{
+	USE_OPLINE
+	zval *varptr, *arg;
+
+	varptr = GET_OP1_ZVAL_PTR_UNDEF(BP_VAR_R);
+	arg = ZEND_CALL_VAR(EX(call), opline->result.var);
+
+	ZVAL_COPY_VALUE(arg, varptr);
+	ZVAL_UNDEF(varptr);
+
+	ZEND_VM_NEXT_OPCODE();
+}
+
 ZEND_VM_HOT_TYPE_SPEC_HANDLER(ZEND_SEND_VAR_EX, op->op2_type == IS_UNUSED && op->op2.num <= MAX_ARG_FLAG_NUM && (op1_info & (MAY_BE_UNDEF|MAY_BE_REF)) == 0, ZEND_SEND_VAR_EX_SIMPLE, CV|VAR, UNUSED|NUM)
 {
 	USE_OPLINE

Zend/zend_vm_execute.h

@@ -1850,10 +1850,11 @@
 	_(3455, ZEND_FETCH_DIM_R_INDEX_SPEC_CV_TMPVARCV) \
 	_(3458, ZEND_SEND_VAR_SIMPLE_SPEC_VAR) \
 	_(3460, ZEND_SEND_VAR_SIMPLE_SPEC_CV) \
-	_(3463, ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_UNUSED) \
-	_(3465, ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_UNUSED) \
-	_(3466, ZEND_SEND_VAL_SIMPLE_SPEC_CONST) \
-	_(3467, ZEND_SEND_VAL_EX_SIMPLE_SPEC_CONST) \
-	_(3468, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_UNUSED) \
-	_(3469, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_USED) \
-	_(3469+1, ZEND_NULL)
+	_(3461, ZEND_SEND_VAR_SIMPLE_EXT_SPEC_CV) \
+	_(3464, ZEND_SEND_VAR_EX_SIMPLE_SPEC_VAR_UNUSED) \
+	_(3466, ZEND_SEND_VAR_EX_SIMPLE_SPEC_CV_UNUSED) \
+	_(3467, ZEND_SEND_VAL_SIMPLE_SPEC_CONST) \
+	_(3468, ZEND_SEND_VAL_EX_SIMPLE_SPEC_CONST) \
+	_(3469, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_UNUSED) \
+	_(3470, ZEND_FE_FETCH_R_SIMPLE_SPEC_VAR_CV_RETVAL_USED) \
+	_(3470+1, ZEND_NULL)