Allocate property type lists on arena

Arg/return types are immutable, while property types are not, so
allocate them on arena, otherwise we run into opcache issues.

Might need adjustments in some more places to handle arena vs
non-arena.

Author: nikic

Zend/zend_compile.c

@@ -5424,7 +5424,8 @@ static zend_bool zend_type_contains_traversable(zend_type type) {
 
 // TODO: Ideally we'd canonicalize "iterable" into "array|Traversable" and essentially
 // treat it as a built-in type alias.
-static zend_type zend_compile_typename(zend_ast *ast, zend_bool force_allow_null) /* {{{ */
+static zend_type zend_compile_typename(
+		zend_ast *ast, zend_bool force_allow_null, zend_bool use_arena) /* {{{ */
 {
 	zend_bool allow_null = force_allow_null;
 	zend_type type = ZEND_TYPE_INIT_NONE(0);
@@ -5458,16 +5459,27 @@ static zend_type zend_compile_typename(zend_ast *ast, zend_bool force_allow_null
 					if (ZEND_TYPE_HAS_LIST(type)) {
 						/* Add name to existing name list. */
 						zend_type_list *old_list = ZEND_TYPE_LIST(type);
-						list = erealloc(old_list, ZEND_TYPE_LIST_SIZE(old_list->num_types + 1));
+						if (use_arena) {
+							// TODO: Add a zend_arena_realloc API?
+							list = zend_arena_alloc(
+								&CG(arena), ZEND_TYPE_LIST_SIZE(old_list->num_types + 1));
+							memcpy(list, old_list, ZEND_TYPE_LIST_SIZE(old_list->num_types));
+						} else {
+							list = erealloc(old_list, ZEND_TYPE_LIST_SIZE(old_list->num_types + 1));
+						}
 						list->types[list->num_types++] = ZEND_TYPE_NAME(single_type);
 					} else {
 						/* Switch from single name to name list. */
-						list = emalloc(ZEND_TYPE_LIST_SIZE(2));
+						size_t size = ZEND_TYPE_LIST_SIZE(2);
+						list = use_arena ? zend_arena_alloc(&CG(arena), size) : emalloc(size);
 						list->num_types = 2;
 						list->types[0] = ZEND_TYPE_NAME(type);
 						list->types[1] = ZEND_TYPE_NAME(single_type);
 					}
 					ZEND_TYPE_SET_LIST(type, list);
+					if (use_arena) {
+						ZEND_TYPE_FULL_MASK(type) |= _ZEND_TYPE_ARENA_BIT;
+					}
 
 					/* Check for trivially redundant class types */
 					for (size_t i = 0; i < list->num_types - 1; i++) {
@@ -5557,7 +5569,8 @@ void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast) /* {{{ */
 		/* Use op_array->arg_info[-1] for return type */
 		arg_infos = safe_emalloc(sizeof(zend_arg_info), list->children + 1, 0);
 		arg_infos->name = NULL;
-		arg_infos->type = zend_compile_typename(return_type_ast, 0);
+		arg_infos->type = zend_compile_typename(
+			return_type_ast, /* force_allow_null */ 0, /* use_arena */ 0);
 		ZEND_TYPE_FULL_MASK(arg_infos->type) |= _ZEND_ARG_INFO_FLAGS(
 			(op_array->fn_flags & ZEND_ACC_RETURN_REFERENCE) != 0, /* is_variadic */ 0);
 		arg_infos++;
@@ -5633,7 +5646,8 @@ void zend_compile_params(zend_ast *ast, zend_ast *return_type_ast) /* {{{ */
 			uint32_t default_type = default_ast ? Z_TYPE(default_node.u.constant) : IS_UNDEF;
 
 			op_array->fn_flags |= ZEND_ACC_HAS_TYPE_HINTS;
-			arg_info->type = zend_compile_typename(type_ast, default_type == IS_NULL);
+			arg_info->type = zend_compile_typename(
+				type_ast, default_type == IS_NULL, /* use_arena */ 0);
 
 			if (ZEND_TYPE_FULL_MASK(arg_info->type) & MAY_BE_VOID) {
 				zend_error_noreturn(E_COMPILE_ERROR, "void cannot be used as a parameter type");
@@ -6162,7 +6176,7 @@ void zend_compile_prop_decl(zend_ast *ast, zend_ast *type_ast, uint32_t flags) /
 		zend_type type = ZEND_TYPE_INIT_NONE(0);
 
 		if (type_ast) {
-			type = zend_compile_typename(type_ast, 0);
+			type = zend_compile_typename(type_ast, /* force_allow_null */ 0, /* use_arena */ 1);
 
 			if (ZEND_TYPE_FULL_MASK(type) & (MAY_BE_VOID|MAY_BE_CALLABLE)) {
 				zend_string *str = zend_type_to_string(type);

Zend/zend_opcode.c

@@ -110,7 +110,9 @@ static void zend_always_inline zend_type_release(zend_type *type) {
 				zend_string_release(ZEND_TYPE_LIST_GET_NAME(entry));
 			}
 		} ZEND_TYPE_LIST_FOREACH_END();
-		efree(ZEND_TYPE_LIST(*type));
+		if (!ZEND_TYPE_USES_ARENA(*type)) {
+			efree(ZEND_TYPE_LIST(*type));
+		}
 	} else if (ZEND_TYPE_HAS_NAME(*type)) {
 		zend_string_release(ZEND_TYPE_NAME(*type));
 	}
@@ -140,8 +142,8 @@ ZEND_API void zend_function_dtor(zval *zv)
 
 	if (function->type == ZEND_USER_FUNCTION) {
 		ZEND_ASSERT(function->common.function_name);
-		destroy_op_array(&function->op_array);
-		/* op_arrays are allocated on arena, so we don't have to free them */
+	destroy_op_array(&function->op_array);
+	/* op_arrays are allocated on arena, so we don't have to free them */
 	} else {
 		ZEND_ASSERT(function->type == ZEND_INTERNAL_FUNCTION);
 		ZEND_ASSERT(function->common.function_name);

Zend/zend_types.h

@@ -139,10 +139,12 @@ typedef struct {
 #define _ZEND_TYPE_MASK ((1u << 24) - 1)
 #define _ZEND_TYPE_MAY_BE_MASK ((1u << (IS_VOID+1)) - 1)
 /* Only one of these bits may be set. */
-#define _ZEND_TYPE_LIST_BIT (1u << 21)
-#define _ZEND_TYPE_CE_BIT   (1u << 22)
 #define _ZEND_TYPE_NAME_BIT (1u << 23)
+#define _ZEND_TYPE_CE_BIT   (1u << 22)
+#define _ZEND_TYPE_LIST_BIT (1u << 21)
 #define _ZEND_TYPE_KIND_MASK (_ZEND_TYPE_LIST_BIT|_ZEND_TYPE_CE_BIT|_ZEND_TYPE_NAME_BIT)
+/* Whether the type list is arena allocated */
+#define _ZEND_TYPE_ARENA_BIT (1u << 20)
 /* Must have same value as MAY_BE_NULL */
 #define _ZEND_TYPE_NULLABLE_BIT 0x2
 
@@ -161,6 +163,9 @@ typedef struct {
 #define ZEND_TYPE_HAS_LIST(t) \
 	((((t).type_mask) & _ZEND_TYPE_LIST_BIT) != 0)
 
+#define ZEND_TYPE_USES_ARENA(t) \
+	((((t).type_mask) & _ZEND_TYPE_ARENA_BIT) != 0)
+
 #define ZEND_TYPE_IS_ONLY_MASK(t) \
 	(ZEND_TYPE_IS_SET(t) && (t).ptr == NULL)
 

ext/opcache/zend_accelerator_util_funcs.c

@@ -234,6 +234,11 @@ static void zend_hash_clone_prop_info(HashTable *ht)
 			}
 
 			if (ZEND_TYPE_HAS_LIST(prop_info->type)) {
+				zend_type_list *list = ZEND_TYPE_LIST(prop_info->type);
+				ZEND_ASSERT(IN_ARENA(list));
+				list = ARENA_REALLOC(list);
+				ZEND_TYPE_SET_PTR(prop_info->type, list);
+
 				void **entry;
 				ZEND_TYPE_LIST_FOREACH_PTR(ZEND_TYPE_LIST(prop_info->type), entry) {
 					if (ZEND_TYPE_LIST_IS_CE(*entry)) {

ext/opcache/zend_persist.c

@@ -262,7 +262,17 @@ static void zend_persist_type(zend_type *type) {
 	if (ZEND_TYPE_HAS_LIST(*type)) {
 		void **entry;
 		zend_type_list *list = ZEND_TYPE_LIST(*type);
-		list = zend_shared_memdup_put_free(list, ZEND_TYPE_LIST_SIZE(list->num_types));
+		if (ZEND_TYPE_USES_ARENA(*type)) {
+			if (!ZCG(is_immutable_class)) {
+				list = zend_shared_memdup_arena_put(list, ZEND_TYPE_LIST_SIZE(list->num_types));
+			} else {
+				/* Moved from arena to SHM because type list was fully resolved. */
+				list = zend_shared_memdup_put(list, ZEND_TYPE_LIST_SIZE(list->num_types));
+				ZEND_TYPE_FULL_MASK(*type) &= ~_ZEND_TYPE_ARENA_BIT;
+			}
+		} else {
+			list = zend_shared_memdup_put_free(list, ZEND_TYPE_LIST_SIZE(list->num_types));
+		}
 		ZEND_TYPE_SET_PTR(*type, list);
 
 		ZEND_TYPE_LIST_FOREACH_PTR(list, entry) {

ext/opcache/zend_persist_calc.c

@@ -152,7 +152,11 @@ static void zend_persist_type_calc(zend_type *type)
 {
 	if (ZEND_TYPE_HAS_LIST(*type)) {
 		void **entry;
-		ADD_SIZE(ZEND_TYPE_LIST_SIZE(ZEND_TYPE_LIST(*type)->num_types));
+		if (ZEND_TYPE_USES_ARENA(*type) && !ZCG(is_immutable_class)) {
+			ADD_ARENA_SIZE(ZEND_TYPE_LIST_SIZE(ZEND_TYPE_LIST(*type)->num_types));
+		} else {
+			ADD_SIZE(ZEND_TYPE_LIST_SIZE(ZEND_TYPE_LIST(*type)->num_types));
+		}
 		ZEND_TYPE_LIST_FOREACH_PTR(ZEND_TYPE_LIST(*type), entry) {
 			zend_string *type_name = ZEND_TYPE_LIST_GET_NAME(*entry);
 			ADD_INTERNED_STRING(type_name);