Fix fallback paths in fast_long_{add,sub}_function #17666
Conversation
This was asked to be checked in php#17472 (comment) There are 3 issues: 1) The constant LONG_SIGN_MASK is wrong. Commit 98df5c9 changed this to avoid UB but did this incorrectly. The right fix was using zend_ulong. 2) The UB in the if can overflow, and can be fixed by using zend_ulong for the sum/sub. 3) fast_long_sub_function() has a problem when result aliases. This is fixed in the same way as fast_long_add_function() works.
|
Test failures in |
See #17669. |
|
No ABI break here. |
Zend/zend_operators.h
Outdated
| @@ -49,7 +49,7 @@ | |||
| #include "zend_multiply.h" | |||
| #include "zend_object_handlers.h" | |||
|
|
|||
| #define LONG_SIGN_MASK ZEND_LONG_MIN | |||
| #define LONG_SIGN_MASK (((zend_ulong)1) << (8*sizeof(zend_long)-1)) | |||
There was a problem hiding this comment.
The spec is complicated, but I'm not sure this is actually undefined behavior. FWIU, & is well defined for both signed and unsigned integers. In the case of two integers with the same conversion rank, the signed integer will be converted to an unsigned one.
In any case, I find the new and explicit solution a bit more obvious.
There was a problem hiding this comment.
The old code (((zend_long)1) << (8*sizeof(zend_long)-1)) (note zend_ulong->zend_long next to the 1) was UB. UBSAN complained at this computation.
There was a problem hiding this comment.
The old yes, but the new doesn't. ZEND_LONG_MIN should be equivalent to only the signed bit being set. The only difference between the old and new solution is the signedness, if I understand correctly. Anyway, this looks fine, this wasn't meant as an argument, just trying to understand. 🙂
Edit: I guess ZEND_LONG_MIN is only correct for 2's complement, which is the only binary representation in practice. I'm not sure if this is the only case where we rely on 2's complement, but as mentioned, the new solution is fine too.
There was a problem hiding this comment.
Ah right, I guess I mixed up ZEND_LONG_MIN with 32/64 bit longs... I'll change that back (to keep the diff as small as possible).
There was a problem hiding this comment.
In theory, your new solution is better because it supports all integer representations supported by C. In practice, it likely doesn't matter.
There was a problem hiding this comment.
Maybe so. However, we rely on 2s complement in a lot of other places, can you even get a 1s complement system somewhere nowadays?
There was a problem hiding this comment.
We could add a respective check to configure.ac.
Zend/zend_operators.h
Outdated
| ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2)); | ||
| } else { | ||
| ZVAL_LONG(result, Z_LVAL_P(op1) - Z_LVAL_P(op2)); |
There was a problem hiding this comment.
I guess we're not actually testing this branch? Probably would only be used on some pretty esoteric platforms.
There was a problem hiding this comment.
I guess we're not actually testing this branch?
My bad (#17472) ;)
Probably would only be used on some pretty esoteric platforms.
Possibly not even that. Would require a compiler without ASM goto support, no builtins (SADDL etc.) and non Windows system. Plus, that compiler would need to support C11 (or at least the subset we're using).
There was a problem hiding this comment.
It's better to perform the integer math once, keeping the result in a temporary variable.
Otherwise C compiler may generate longer fast path code.
Zend/zend_operators.h
Outdated
| ZVAL_DOUBLE(result, (double) Z_LVAL_P(op1) - (double) Z_LVAL_P(op2)); | ||
| } else { | ||
| ZVAL_LONG(result, Z_LVAL_P(op1) - Z_LVAL_P(op2)); |
There was a problem hiding this comment.
It's better to perform the integer math once, keeping the result in a temporary variable.
Otherwise C compiler may generate longer fast path code.
This was asked to be checked in php#17472 (comment) There are 2 issues: 1) The UB in the if can overflow, and can be fixed by using zend_ulong for the sum/sub. 2) fast_long_sub_function() has a problem when result aliases. This is fixed in the same way as fast_long_add_function() works. Closes phpGH-17666.
This was asked to be checked in #17472 (comment)
There are 2 issues:
for the add/sub.
This is fixed in the same way as fast_long_add_function() works.