Link static var to CV from JMP_STATIC_DEF

Author: iluuu1994

Zend/Optimizer/sccp.c

@@ -249,6 +249,7 @@ static bool can_replace_op1(
 		case ZEND_ROPE_ADD:
 		case ZEND_ROPE_END:
 		case ZEND_BIND_STATIC:
+		case ZEND_JMP_STATIC_DEF:
 		case ZEND_BIND_GLOBAL:
 		case ZEND_MAKE_REF:
 		case ZEND_UNSET_CV:

Zend/Optimizer/zend_dfg.c

@@ -150,6 +150,7 @@ static zend_always_inline void _zend_dfg_add_use_def_op(const zend_op_array *op_
 		case ZEND_POST_DEC:
 		case ZEND_BIND_GLOBAL:
 		case ZEND_BIND_STATIC:
+		case ZEND_JMP_STATIC_DEF:
 		case ZEND_SEND_VAR_NO_REF:
 		case ZEND_SEND_VAR_NO_REF_EX:
 		case ZEND_SEND_VAR_EX:

Zend/Optimizer/zend_inference.c

@@ -2930,6 +2930,10 @@ static zend_always_inline zend_result _zend_update_type_info(
 			}
 			UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
 			break;
+		case ZEND_JMP_STATIC_DEF:
+			tmp = MAY_BE_ANY | MAY_BE_ARRAY_KEY_ANY | MAY_BE_ARRAY_OF_ANY | MAY_BE_ARRAY_OF_REF | MAY_BE_REF;
+			UPDATE_SSA_TYPE(tmp, ssa_op->op1_def);
+			break;
 		case ZEND_SEND_VAR:
 			if (ssa_op->op1_def >= 0) {
 				tmp = t1;
@@ -4347,6 +4351,7 @@ static void zend_mark_cv_references(const zend_op_array *op_array, const zend_sc
 					case ZEND_SEND_REF:
 					case ZEND_SEND_VAR_EX:
 					case ZEND_SEND_FUNC_ARG:
+					case ZEND_JMP_STATIC_DEF:
 						break;
 					case ZEND_INIT_ARRAY:
 					case ZEND_ADD_ARRAY_ELEMENT:
@@ -4502,6 +4507,7 @@ ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op
 				case ZEND_ASSIGN_REF:
 				case ZEND_BIND_GLOBAL:
 				case ZEND_BIND_STATIC:
+				case ZEND_JMP_STATIC_DEF:
 				case ZEND_FETCH_DIM_IS:
 				case ZEND_FETCH_OBJ_IS:
 				case ZEND_SEND_REF:
@@ -4739,6 +4745,7 @@ ZEND_API bool zend_may_throw_ex(const zend_op *opline, const zend_ssa_op *ssa_op
 		case ZEND_UNSET_VAR:
 			return (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY));
 		case ZEND_BIND_STATIC:
+		case ZEND_JMP_STATIC_DEF:
 			if (t1 & (MAY_BE_OBJECT|MAY_BE_RESOURCE|MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_ARRAY)) {
 				/* Destructor may throw. */
 				return 1;

Zend/Optimizer/zend_ssa.c

@@ -679,6 +679,7 @@ static zend_always_inline int _zend_ssa_rename_op(const zend_op_array *op_array,
 		case ZEND_POST_DEC:
 		case ZEND_BIND_GLOBAL:
 		case ZEND_BIND_STATIC:
+		case ZEND_JMP_STATIC_DEF:
 		case ZEND_SEND_VAR_NO_REF:
 		case ZEND_SEND_VAR_NO_REF_EX:
 		case ZEND_SEND_VAR_EX:

Zend/zend_compile.c

@@ -4904,6 +4904,8 @@ static void zend_compile_static_var(zend_ast *ast) /* {{{ */
 
 		uint32_t static_def_jmp_opnum = get_next_op_number();
 		opline = zend_emit_op(NULL, ZEND_JMP_STATIC_DEF, NULL, NULL);
+		opline->op1_type = IS_CV;
+		opline->op1.var = lookup_cv(var_name);
 		opline->extended_value = placeholder_offset;
 
 		znode expr;
@@ -4914,16 +4916,7 @@ static void zend_compile_static_var(zend_ast *ast) /* {{{ */
 		opline->op1.var = lookup_cv(var_name);
 		opline->extended_value = placeholder_offset | ZEND_BIND_REF;
 
-		uint32_t skip_bind_static_jmp_opnum = zend_emit_jump(0);
-
 		zend_update_jump_target_to_next(static_def_jmp_opnum);
-
-		opline = zend_emit_op(NULL, ZEND_BIND_STATIC, NULL, NULL);
-		opline->op1_type = IS_CV;
-		opline->op1.var = lookup_cv(var_name);
-		opline->extended_value = placeholder_offset | ZEND_BIND_REF;
-
-		zend_update_jump_target_to_next(skip_bind_static_jmp_opnum);
 	}
 }
 /* }}} */

Zend/zend_vm_def.h

@@ -8894,11 +8894,14 @@ ZEND_VM_HANDLER(183, ZEND_BIND_STATIC, CV, ANY, REF)
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-ZEND_VM_HANDLER(203, ZEND_JMP_STATIC_DEF, ANY, JMP_ADDR)
+ZEND_VM_HANDLER(203, ZEND_JMP_STATIC_DEF, CV, JMP_ADDR)
 {
 	USE_OPLINE
 	HashTable *ht;
 	zval *value;
+	zval *variable_ptr;
+
+	variable_ptr = GET_OP1_ZVAL_PTR_PTR_UNDEF(BP_VAR_W);
 
 	ht = ZEND_MAP_PTR_GET(EX(func)->op_array.static_variables_ptr);
 	if (!ht) {
@@ -8910,7 +8913,13 @@ ZEND_VM_HANDLER(203, ZEND_JMP_STATIC_DEF, ANY, JMP_ADDR)
 	if (Z_TYPE_EXTRA_P(value) & IS_STATIC_VAR_UNINITIALIZED) {
 		ZEND_VM_NEXT_OPCODE();
 	} else {
+		SAVE_OPLINE();
+		zval_ptr_dtor(variable_ptr);
+		ZEND_ASSERT(Z_TYPE_P(value) == IS_REFERENCE);
+		Z_ADDREF_P(value);
+		ZVAL_REF(variable_ptr, Z_REF_P(value));
 		ZEND_VM_JMP_EX(OP_JMP_ADDR(opline, opline->op2), 0);
+		ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 	}
 }
 

Zend/zend_vm_execute.h

@@ -1353,7 +1353,7 @@
 	_(2544, ZEND_FETCH_GLOBALS_SPEC_UNUSED_UNUSED) \
 	_(2545, ZEND_VERIFY_NEVER_TYPE_SPEC_UNUSED_UNUSED) \
 	_(2546, ZEND_CALLABLE_CONVERT_SPEC_UNUSED_UNUSED) \
-	_(2547, ZEND_JMP_STATIC_DEF_SPEC) \
+	_(2547, ZEND_JMP_STATIC_DEF_SPEC_CV) \
 	_(2548, ZEND_RECV_NOTYPE_SPEC) \
 	_(2549, ZEND_JMP_FORWARD_SPEC) \
 	_(2555, ZEND_ADD_LONG_NO_OVERFLOW_SPEC_TMPVARCV_CONST) \

Zend/zend_vm_handlers.h

@@ -433,7 +433,7 @@ static uint32_t zend_vm_opcodes_flags[204] = {
 	0x00000101,
 	0x00000101,
 	0x00000101,
-	0x00002000,
+	0x00002001,
 };
 
 ZEND_API const char* ZEND_FASTCALL zend_get_opcode_name(zend_uchar opcode) {