/*

+----------------------------------------------------------------------+

| Zend Engine |

+----------------------------------------------------------------------+

| Copyright © Zend Technologies Ltd., a subsidiary company of |

| Perforce Software, Inc., and Contributors. |

+----------------------------------------------------------------------+

| This source file is subject to the Modified BSD License that is |

| bundled with this package in the file LICENSE, and is available |

| through the World Wide Web at <https://www.php.net/license/>. |

| |

| SPDX-License-Identifier: BSD-3-Clause |

+----------------------------------------------------------------------+

| Authors: Andi Gutmans <[email protected]> |

| Zeev Suraski <[email protected]> |

| Nikita Popov <[email protected]> |

+----------------------------------------------------------------------+

*/

#include <zend_language_parser.h>

#include "zend.h"

#include "zend_ast.h"

#include "zend_attributes.h"

#include "zend_compile.h"

#include "zend_constants.h"

#include "zend_llist.h"

#include "zend_API.h"

#include "zend_exceptions.h"

#include "zend_interfaces.h"

#include "zend_types.h"

#include "zend_virtual_cwd.h"

#include "zend_multibyte.h"

#include "zend_language_scanner.h"

#include "zend_inheritance.h"

#include "zend_vm.h"

#include "zend_enum.h"

#include "zend_observer.h"

#include "zend_call_stack.h"

#include "zend_frameless_function.h"

#include "zend_property_hooks.h"

#define SET_NODE(target, src) do { \

target ## _type = (src)->op_type; \

if ((src)->op_type == IS_CONST) { \

target.constant = zend_add_literal(&(src)->u.constant); \

} else { \

target = (src)->u.op; \

} \

} while (0)

#define GET_NODE(target, src) do { \

(target)->op_type = src ## _type; \

if ((target)->op_type == IS_CONST) { \

ZVAL_COPY_VALUE(&(target)->u.constant, CT_CONSTANT(src)); \

} else { \

(target)->u.op = src; \

} \

} while (0)

#define FC(member) (CG(file_context).member)

typedef struct _zend_loop_var {

uint8_t opcode;

uint8_t var_type;

uint32_t var_num;

uint32_t try_catch_offset;

} zend_loop_var;

static inline uint32_t zend_alloc_cache_slots(unsigned count) {

if (count == 0) {

/* Even if no cache slots are desired, the VM handler may still want to acquire

* CACHE_ADDR() unconditionally. Returning zero makes sure that the address

* calculation is still legal and ubsan does not complain. */

return 0;

}

zend_op_array *op_array = CG(active_op_array);

uint32_t ret = op_array->cache_size;

op_array->cache_size += count * sizeof(void*);

return ret;

}

static inline uint32_t zend_alloc_cache_slot(void) {

return zend_alloc_cache_slots(1);

}

ZEND_API zend_op_array *(*zend_compile_file)(zend_file_handle *file_handle, int type);

ZEND_API zend_op_array *(*zend_compile_string)(zend_string *source_string, const char *filename, zend_compile_position position);

#ifndef ZTS

ZEND_API zend_compiler_globals compiler_globals;

ZEND_API zend_executor_globals executor_globals;

#endif

static zend_op *zend_emit_op(znode *result, uint8_t opcode, znode *op1, znode *op2);

static bool zend_try_ct_eval_array(zval *result, zend_ast *ast);

static void zend_eval_const_expr(zend_ast **ast_ptr);

static zend_op *zend_compile_var(znode *result, zend_ast *ast, uint32_t type, bool by_ref);

static zend_op *zend_delayed_compile_var(znode *result, zend_ast *ast, uint32_t type, bool by_ref);

static void zend_compile_expr(znode *result, zend_ast *ast);

static void zend_compile_stmt(zend_ast *ast);

static void zend_compile_assign(znode *result, zend_ast *ast, bool stmt, uint32_t type);

#ifdef ZEND_CHECK_STACK_LIMIT

zend_never_inline static void zend_stack_limit_error(void)

{

size_t max_stack_size = 0;

if ((uintptr_t) EG(stack_base) > (uintptr_t) EG(stack_limit)) {

max_stack_size = (size_t) ((uintptr_t) EG(stack_base) - (uintptr_t) EG(stack_limit));

}

zend_error_noreturn(E_COMPILE_ERROR,

"Maximum call stack size of %zu bytes (zend.max_allowed_stack_size - zend.reserved_stack_size) reached during compilation. Try splitting expression",

max_stack_size);

}

static void zend_check_stack_limit(void)

{

if (UNEXPECTED(zend_call_stack_overflowed(EG(stack_limit)))) {

zend_stack_limit_error();

}

}

#else /* ZEND_CHECK_STACK_LIMIT */

static void zend_check_stack_limit(void)

{

}

#endif /* ZEND_CHECK_STACK_LIMIT */

static void init_op(zend_op *op)

{

MAKE_NOP(op);

op->extended_value = 0;

op->lineno = CG(zend_lineno);

#ifdef ZEND_VERIFY_TYPE_INFERENCE

op->op1_use_type = 0;

op->op2_use_type = 0;

op->result_use_type = 0;

op->op1_def_type = 0;

op->op2_def_type = 0;

op->result_def_type = 0;

#endif

}

static zend_always_inline uint32_t get_next_op_number(void)

{

return CG(active_op_array)->last;

}

static zend_op *get_next_op(void)

{

zend_op_array *op_array = CG(active_op_array);

uint32_t next_op_num = op_array->last++;

zend_op *next_op;

if (UNEXPECTED(next_op_num >= CG(context).opcodes_size)) {

CG(context).opcodes_size *= 4;

op_array->opcodes = erealloc(op_array->opcodes, CG(context).opcodes_size * sizeof(zend_op));

}

next_op = &(op_array->opcodes[next_op_num]);

init_op(next_op);

return next_op;

}

static zend_brk_cont_element *get_next_brk_cont_element(void)

{

CG(context).last_brk_cont++;

CG(context).brk_cont_array = erealloc(CG(context).brk_cont_array, sizeof(zend_brk_cont_element) * CG(context).last_brk_cont);

return &CG(context).brk_cont_array[CG(context).last_brk_cont-1];

}

static zend_string *zend_build_runtime_definition_key(zend_string *name, uint32_t start_lineno) /* {{{ */

{

zend_string *filename = CG(active_op_array)->filename;

zend_string *result = zend_strpprintf(0, "%c%s%s:%" PRIu32 "$%" PRIx32,

'\0', ZSTR_VAL(name), ZSTR_VAL(filename), start_lineno, CG(rtd_key_counter)++);

return zend_new_interned_string(result);

}

/* }}} */

static bool zend_get_unqualified_name(const zend_string *name, const char **result, size_t *result_len) /* {{{ */

{

const char *ns_separator = zend_memrchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));

if (ns_separator != NULL) {

*result = ns_separator + 1;

*result_len = ZSTR_VAL(name) + ZSTR_LEN(name) - *result;

return true;

}

return false;

}

/* }}} */

struct reserved_class_name {

const char *name;

size_t len;

};

static const struct reserved_class_name reserved_class_names[] = {

{ZEND_STRL("bool")},

{ZEND_STRL("false")},

{ZEND_STRL("float")},

{ZEND_STRL("int")},

{ZEND_STRL("null")},

{ZEND_STRL("parent")},

{ZEND_STRL("self")},

{ZEND_STRL("static")},

{ZEND_STRL("string")},

{ZEND_STRL("true")},

{ZEND_STRL("void")},

{ZEND_STRL("never")},

{ZEND_STRL("iterable")},

{ZEND_STRL("object")},

{ZEND_STRL("mixed")},

/* These are not usable as class names because they're proper tokens,

* but they are here for class aliases. */

{ZEND_STRL("array")},

{ZEND_STRL("callable")},

{NULL, 0}

};

static bool zend_is_reserved_class_name(const zend_string *name) /* {{{ */

{

const struct reserved_class_name *reserved = reserved_class_names;

const char *uqname = ZSTR_VAL(name);

size_t uqname_len = ZSTR_LEN(name);

zend_get_unqualified_name(name, &uqname, &uqname_len);

for (; reserved->name; ++reserved) {

if (uqname_len == reserved->len

&& zend_binary_strcasecmp(uqname, uqname_len, reserved->name, reserved->len) == 0

) {

return true;

}

}

return false;

}

/* }}} */

void zend_assert_valid_class_name(const zend_string *name, const char *type) /* {{{ */

{

if (zend_is_reserved_class_name(name)) {

zend_error_noreturn(E_COMPILE_ERROR,

"Cannot use \"%s\" as %s as it is reserved", ZSTR_VAL(name), type);

}

if (zend_string_equals_literal(name, "_")) {

zend_error(E_DEPRECATED, "Using \"_\" as %s is deprecated since 8.4", type);

}

}

/* }}} */

typedef struct _builtin_type_info {

const char* name;

const size_t name_len;

const uint8_t type;

} builtin_type_info;

static const builtin_type_info builtin_types[] = {

{ZEND_STRL("null"), IS_NULL},

{ZEND_STRL("true"), IS_TRUE},

{ZEND_STRL("false"), IS_FALSE},

{ZEND_STRL("int"), IS_LONG},

{ZEND_STRL("float"), IS_DOUBLE},

{ZEND_STRL("string"), IS_STRING},

{ZEND_STRL("bool"), _IS_BOOL},

{ZEND_STRL("void"), IS_VOID},

{ZEND_STRL("never"), IS_NEVER},

{ZEND_STRL("iterable"), IS_ITERABLE},

{ZEND_STRL("object"), IS_OBJECT},

{ZEND_STRL("mixed"), IS_MIXED},

{NULL, 0, IS_UNDEF}

};

typedef struct {

const char *name;

size_t name_len;

const char *correct_name;

} confusable_type_info;

static const confusable_type_info confusable_types[] = {

{ZEND_STRL("boolean"), "bool"},

{ZEND_STRL("integer"), "int"},

{ZEND_STRL("double"), "float"},

{ZEND_STRL("resource"), NULL},

{NULL, 0, NULL},

};

static zend_always_inline uint8_t zend_lookup_builtin_type_by_name(const zend_string *name) /* {{{ */

{

const builtin_type_info *info = &builtin_types[0];

for (; info->name; ++info) {

if (ZSTR_LEN(name) == info->name_len

&& zend_binary_strcasecmp(ZSTR_VAL(name), ZSTR_LEN(name), info->name, info->name_len) == 0

) {

return info->type;

}

}

return 0;

}

/* }}} */

static zend_always_inline bool zend_is_confusable_type(const zend_string *name, const char **correct_name) /* {{{ */

{

const confusable_type_info *info = confusable_types;

/* Intentionally using case-sensitive comparison here, because "integer" is likely intended

* as a scalar type, while "Integer" is likely a class type. */

for (; info->name; ++info) {

if (zend_string_equals_cstr(name, info->name, info->name_len)) {

*correct_name = info->correct_name;

return 1;

}

}

return 0;

}

/* }}} */

static bool zend_is_not_imported(zend_string *name) {

/* Assuming "name" is unqualified here. */

return !FC(imports) || zend_hash_find_ptr_lc(FC(imports), name) == NULL;

}

void zend_oparray_context_begin(zend_oparray_context *prev_context, zend_op_array *op_array) /* {{{ */

{

*prev_context = CG(context);

CG(context).prev = CG(context).op_array ? prev_context : NULL;

CG(context).op_array = op_array;

CG(context).opcodes_size = INITIAL_OP_ARRAY_SIZE;

CG(context).vars_size = 0;

CG(context).literals_size = 0;

CG(context).fast_call_var = -1;

CG(context).try_catch_offset = -1;

CG(context).current_brk_cont = -1;

CG(context).last_brk_cont = 0;

CG(context).has_assigned_to_http_response_header = false;

CG(context).brk_cont_array = NULL;

CG(context).labels = NULL;

CG(context).in_jmp_frameless_branch = false;

CG(context).active_property_info_name = NULL;

CG(context).active_property_hook_kind = (zend_property_hook_kind)-1;

}

/* }}} */

void zend_oparray_context_end(const zend_oparray_context *prev_context) /* {{{ */

{

if (CG(context).brk_cont_array) {

efree(CG(context).brk_cont_array);

CG(context).brk_cont_array = NULL;

}

if (CG(context).labels) {

zend_hash_destroy(CG(context).labels);

FREE_HASHTABLE(CG(context).labels);

CG(context).labels = NULL;

}

CG(context) = *prev_context;

}

/* }}} */

static void zend_reset_import_tables(void) /* {{{ */

{

if (FC(imports)) {

zend_hash_destroy(FC(imports));

efree(FC(imports));

FC(imports) = NULL;

}

if (FC(imports_function)) {

zend_hash_destroy(FC(imports_function));

efree(FC(imports_function));

FC(imports_function) = NULL;

}

if (FC(imports_const)) {

zend_hash_destroy(FC(imports_const));

efree(FC(imports_const));

FC(imports_const) = NULL;

}

zend_hash_clean(&FC(seen_symbols));

}

/* }}} */

static void zend_end_namespace(void) /* {{{ */ {

FC(in_namespace) = 0;

zend_reset_import_tables();

if (FC(current_namespace)) {

zend_string_release_ex(FC(current_namespace), 0);

FC(current_namespace) = NULL;

}

}

/* }}} */

void zend_file_context_begin(zend_file_context *prev_context) /* {{{ */

{

*prev_context = CG(file_context);

FC(imports) = NULL;

FC(imports_function) = NULL;

FC(imports_const) = NULL;

FC(current_namespace) = NULL;

FC(in_namespace) = 0;

FC(has_bracketed_namespaces) = 0;

FC(declarables).ticks = 0;

zend_hash_init(&FC(seen_symbols), 8, NULL, NULL, 0);

}

/* }}} */

void zend_file_context_end(const zend_file_context *prev_context) /* {{{ */

{

zend_end_namespace();

zend_hash_destroy(&FC(seen_symbols));

CG(file_context) = *prev_context;

}

/* }}} */

void zend_init_compiler_data_structures(void) /* {{{ */

{

zend_stack_init(&CG(loop_var_stack), sizeof(zend_loop_var));

zend_stack_init(&CG(delayed_oplines_stack), sizeof(zend_op));

zend_stack_init(&CG(short_circuiting_opnums), sizeof(uint32_t));

CG(active_class_entry) = NULL;

CG(in_compilation) = 0;

CG(skip_shebang) = 0;

CG(encoding_declared) = 0;

CG(memoized_exprs) = NULL;

CG(memoize_mode) = ZEND_MEMOIZE_NONE;

}

/* }}} */

static void zend_register_seen_symbol(zend_string *name, uint32_t kind) {

zval *zv = zend_hash_find(&FC(seen_symbols), name);

if (zv) {

Z_LVAL_P(zv) |= kind;

} else {

zval tmp;

ZVAL_LONG(&tmp, kind);

zend_hash_add_new(&FC(seen_symbols), name, &tmp);

}

}

static bool zend_have_seen_symbol(zend_string *name, uint32_t kind) {

const zval *zv = zend_hash_find(&FC(seen_symbols), name);

return zv && (Z_LVAL_P(zv) & kind) != 0;

}

void init_compiler(void) /* {{{ */

{

CG(arena) = zend_arena_create(64 * 1024);

CG(active_op_array) = NULL;

memset(&CG(context), 0, sizeof(CG(context)));

zend_init_compiler_data_structures();

zend_init_rsrc_list();

zend_stream_init();

CG(unclean_shutdown) = 0;

CG(delayed_variance_obligations) = NULL;

CG(delayed_autoloads) = NULL;

CG(unlinked_uses) = NULL;

CG(current_linking_class) = NULL;

}

/* }}} */

void shutdown_compiler(void) /* {{{ */

{

/* Reset filename before destroying the arena, as file cache may use arena allocated strings. */

zend_restore_compiled_filename(NULL);

zend_stack_destroy(&CG(loop_var_stack));

zend_stack_destroy(&CG(delayed_oplines_stack));

zend_stack_destroy(&CG(short_circuiting_opnums));

if (CG(delayed_variance_obligations)) {

zend_hash_destroy(CG(delayed_variance_obligations));

FREE_HASHTABLE(CG(delayed_variance_obligations));

CG(delayed_variance_obligations) = NULL;

}

if (CG(delayed_autoloads)) {

zend_hash_destroy(CG(delayed_autoloads));

FREE_HASHTABLE(CG(delayed_autoloads));

CG(delayed_autoloads) = NULL;

}

if (CG(unlinked_uses)) {

zend_hash_destroy(CG(unlinked_uses));

FREE_HASHTABLE(CG(unlinked_uses));

CG(unlinked_uses) = NULL;

}

CG(current_linking_class) = NULL;

}

/* }}} */

ZEND_API zend_string *zend_set_compiled_filename(zend_string *new_compiled_filename) /* {{{ */

{

CG(compiled_filename) = zend_string_copy(new_compiled_filename);

return new_compiled_filename;

}

/* }}} */

ZEND_API void zend_restore_compiled_filename(zend_string *original_compiled_filename) /* {{{ */

{

if (CG(compiled_filename)) {

zend_string_release(CG(compiled_filename));

CG(compiled_filename) = NULL;

}

CG(compiled_filename) = original_compiled_filename;

}

/* }}} */

ZEND_API zend_string *zend_get_compiled_filename(void) /* {{{ */

{

return CG(compiled_filename);

}

/* }}} */

ZEND_API uint32_t zend_get_compiled_lineno(void) /* {{{ */

{

return CG(zend_lineno);

}

/* }}} */

ZEND_API bool zend_is_compiling(void) /* {{{ */

{

return CG(in_compilation);

}

/* }}} */

static zend_always_inline uint32_t get_temporary_variable(void) /* {{{ */

{

return (uint32_t)CG(active_op_array)->T++;

}

/* }}} */

static uint32_t lookup_cv(zend_string *name) /* {{{ */{

zend_op_array *op_array = CG(active_op_array);

int i = 0;

zend_ulong hash_value = zend_string_hash_val(name);

while (i < op_array->last_var) {

if (ZSTR_H(op_array->vars[i]) == hash_value

&& zend_string_equals(op_array->vars[i], name)) {

return EX_NUM_TO_VAR(i);

}

i++;

}

i = op_array->last_var;

op_array->last_var++;

if (op_array->last_var > CG(context).vars_size) {

CG(context).vars_size += 16; /* FIXME */

op_array->vars = erealloc(op_array->vars, CG(context).vars_size * sizeof(zend_string*));

}

op_array->vars[i] = zend_string_copy(name);

return EX_NUM_TO_VAR(i);

}

/* }}} */

zend_string *zval_make_interned_string(zval *zv)

{

ZEND_ASSERT(Z_TYPE_P(zv) == IS_STRING);

Z_STR_P(zv) = zend_new_interned_string(Z_STR_P(zv));

if (ZSTR_IS_INTERNED(Z_STR_P(zv))) {

Z_TYPE_FLAGS_P(zv) = 0;

}

return Z_STR_P(zv);

}

/* Common part of zend_add_literal and zend_append_individual_literal */

static inline void zend_insert_literal(const zend_op_array *op_array, zval *zv, int literal_position) /* {{{ */

{

zval *lit = CT_CONSTANT_EX(op_array, literal_position);

if (Z_TYPE_P(zv) == IS_STRING) {

zval_make_interned_string(zv);

}

ZVAL_COPY_VALUE(lit, zv);

Z_EXTRA_P(lit) = 0;

}

/* }}} */

/* Is used while compiling a function, using the context to keep track

of an approximate size to avoid to relocate to often.

Literals are truncated to actual size in the second compiler pass (pass_two()). */

static int zend_add_literal(zval *zv) /* {{{ */

{

zend_op_array *op_array = CG(active_op_array);

uint32_t i = op_array->last_literal;

op_array->last_literal++;

if (i >= CG(context).literals_size) {

while (i >= CG(context).literals_size) {

CG(context).literals_size += 16; /* FIXME */

}

op_array->literals = (zval*)erealloc(op_array->literals, CG(context).literals_size * sizeof(zval));

}

zend_insert_literal(op_array, zv, i);

return i;

}

/* }}} */

static inline int zend_add_literal_string(zend_string **str) /* {{{ */

{

int ret;

zval zv;

ZVAL_STR(&zv, *str);

ret = zend_add_literal(&zv);

*str = Z_STR(zv);

return ret;

}

/* }}} */

static int zend_add_func_name_literal(zend_string *name) /* {{{ */

{

/* Original name */

int ret = zend_add_literal_string(&name);

/* Lowercased name */

zend_string *lc_name = zend_string_tolower(name);

zend_add_literal_string(&lc_name);

return ret;

}

/* }}} */

static int zend_add_ns_func_name_literal(zend_string *name) /* {{{ */

{

const char *unqualified_name;

size_t unqualified_name_len;

/* Original name */

int ret = zend_add_literal_string(&name);

/* Lowercased name */

zend_string *lc_name = zend_string_tolower(name);

zend_add_literal_string(&lc_name);

/* Lowercased unqualified name */

if (zend_get_unqualified_name(name, &unqualified_name, &unqualified_name_len)) {

lc_name = zend_string_alloc(unqualified_name_len, 0);

zend_str_tolower_copy(ZSTR_VAL(lc_name), unqualified_name, unqualified_name_len);

zend_add_literal_string(&lc_name);

}

return ret;

}

/* }}} */

static int zend_add_class_name_literal(zend_string *name) /* {{{ */

{

/* Original name */

int ret = zend_add_literal_string(&name);

/* Lowercased name */

zend_string *lc_name = zend_string_tolower(name);

zend_add_literal_string(&lc_name);

return ret;

}

/* }}} */

static int zend_add_const_name_literal(zend_string *name, bool unqualified) /* {{{ */

{

zend_string *tmp_name;

int ret = zend_add_literal_string(&name);

size_t ns_len = 0, after_ns_len = ZSTR_LEN(name);

const char *after_ns = zend_memrchr(ZSTR_VAL(name), '\\', ZSTR_LEN(name));

if (after_ns) {

after_ns += 1;

ns_len = after_ns - ZSTR_VAL(name) - 1;

after_ns_len = ZSTR_LEN(name) - ns_len - 1;

/* lowercased namespace name & original constant name */

tmp_name = zend_string_init(ZSTR_VAL(name), ZSTR_LEN(name), 0);

zend_str_tolower(ZSTR_VAL(tmp_name), ns_len);

zend_add_literal_string(&tmp_name);

if (!unqualified) {

return ret;

}

} else {

after_ns = ZSTR_VAL(name);

}

/* original unqualified constant name */

tmp_name = zend_string_init(after_ns, after_ns_len, 0);

zend_add_literal_string(&tmp_name);

return ret;

}

/* }}} */

#define LITERAL_STR(op, str) do { \

zval _c; \

ZVAL_STR(&_c, str); \

op.constant = zend_add_literal(&_c); \

} while (0)

void zend_stop_lexing(void)

{

if (LANG_SCNG(on_event)) {

LANG_SCNG(on_event)(ON_STOP, END, 0, NULL, 0, LANG_SCNG(on_event_context));

}

LANG_SCNG(yy_cursor) = LANG_SCNG(yy_limit);

}

static inline void zend_begin_loop(

uint8_t free_opcode, const znode *loop_var, bool is_switch) /* {{{ */

{

zend_brk_cont_element *brk_cont_element;

int parent = CG(context).current_brk_cont;

zend_loop_var info = {0};

CG(context).current_brk_cont = CG(context).last_brk_cont;

brk_cont_element = get_next_brk_cont_element();

brk_cont_element->parent = parent;

brk_cont_element->is_switch = is_switch;

if (loop_var && (loop_var->op_type & (IS_VAR|IS_TMP_VAR))) {

uint32_t start = get_next_op_number();

info.opcode = free_opcode;

info.var_type = loop_var->op_type;

info.var_num = loop_var->u.op.var;

brk_cont_element->start = start;

} else {

info.opcode = ZEND_NOP;

/* The start field is used to free temporary variables in case of exceptions.

* We won't try to free something of we don't have loop variable. */

brk_cont_element->start = -1;

}

zend_stack_push(&CG(loop_var_stack), &info);

}

/* }}} */

static inline void zend_end_loop(int cont_addr, const znode *var_node) /* {{{ */

{

uint32_t end = get_next_op_number();

zend_brk_cont_element *brk_cont_element

= &CG(context).brk_cont_array[CG(context).current_brk_cont];

brk_cont_element->cont = cont_addr;

brk_cont_element->brk = end;

CG(context).current_brk_cont = brk_cont_element->parent;

zend_stack_del_top(&CG(loop_var_stack));

}

/* }}} */

bool zend_op_may_elide_result(uint8_t opcode)

{

switch (opcode) {

case ZEND_ASSIGN:

case ZEND_ASSIGN_DIM:

case ZEND_ASSIGN_OBJ:

case ZEND_ASSIGN_STATIC_PROP:

case ZEND_ASSIGN_OP:

case ZEND_ASSIGN_DIM_OP:

case ZEND_ASSIGN_OBJ_OP:

case ZEND_ASSIGN_STATIC_PROP_OP:

case ZEND_PRE_INC_STATIC_PROP:

case ZEND_PRE_DEC_STATIC_PROP:

case ZEND_PRE_INC_OBJ:

case ZEND_PRE_DEC_OBJ:

case ZEND_PRE_INC:

case ZEND_PRE_DEC:

case ZEND_DO_FCALL:

case ZEND_DO_ICALL:

case ZEND_DO_UCALL:

case ZEND_DO_FCALL_BY_NAME:

case ZEND_YIELD:

case ZEND_YIELD_FROM:

case ZEND_INCLUDE_OR_EVAL:

return true;

default:

return false;

}

}

static void zend_do_free(znode *op1) /* {{{ */

{

if (op1->op_type == IS_TMP_VAR) {

zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];

while (opline->opcode == ZEND_END_SILENCE ||

opline->opcode == ZEND_OP_DATA) {

opline--;

}

if (opline->result_type == IS_TMP_VAR && opline->result.var == op1->u.op.var) {

switch (opline->opcode) {

case ZEND_BOOL:

case ZEND_BOOL_NOT:

/* boolean results don't have to be freed */

return;

case ZEND_POST_INC_STATIC_PROP:

case ZEND_POST_DEC_STATIC_PROP:

case ZEND_POST_INC_OBJ:

case ZEND_POST_DEC_OBJ:

case ZEND_POST_INC:

case ZEND_POST_DEC:

/* convert $i++ to ++$i */

opline->opcode -= 2;

SET_UNUSED(opline->result);

return;

default:

if (zend_op_may_elide_result(opline->opcode)) {

SET_UNUSED(opline->result);

return;

}

break;

}

}

zend_emit_op(NULL, ZEND_FREE, op1, NULL);

} else if (op1->op_type == IS_VAR) {

zend_op *opline = &CG(active_op_array)->opcodes[CG(active_op_array)->last-1];

while (opline->opcode == ZEND_END_SILENCE ||

opline->opcode == ZEND_EXT_FCALL_END ||

opline->opcode == ZEND_OP_DATA) {

opline--;

}

if (opline->result_type == IS_VAR

&& opline->result.var == op1->u.op.var) {

if (opline->opcode == ZEND_FETCH_THIS) {

opline->opcode = ZEND_NOP;

}

if (!ZEND_OP_IS_FRAMELESS_ICALL(opline->opcode)) {

SET_UNUSED(opline->result);

} else {

/* Frameless calls usually use the return value, so always emit a free. This should be

* faster than checking RETURN_VALUE_USED inside the handler. */

zend_emit_op(NULL, ZEND_FREE, op1, NULL);

}

} else {

while (opline >= CG(active_op_array)->opcodes) {

if ((opline->opcode == ZEND_FETCH_LIST_R ||

opline->opcode == ZEND_FETCH_LIST_W ||

opline->opcode == ZEND_EXT_STMT) &&

opline->op1_type == IS_VAR &&

opline->op1.var == op1->u.op.var) {

zend_emit_op(NULL, ZEND_FREE, op1, NULL);

return;

}

if (opline->result_type == IS_VAR

&& opline->result.var == op1->u.op.var) {

if (opline->opcode == ZEND_NEW) {

zend_emit_op(NULL, ZEND_FREE, op1, NULL);

}

break;

}

opline--;

}

}

} else if (op1->op_type == IS_CONST) {

/* Destroy value without using GC: When opcache moves arrays into SHM it will

* free the zend_array structure, so references to it from outside the op array

* become invalid. GC would cause such a reference in the root buffer. */

zval_ptr_dtor_nogc(&op1->u.constant);

}

}

/* }}} */

static const char *zend_modifier_token_to_string(uint32_t token)

{

switch (token) {

case T_PUBLIC:

return "public";

case T_PROTECTED:

return "protected";

case T_PRIVATE:

return "private";

case T_STATIC:

return "static";

case T_FINAL:

return "final";

case T_READONLY:

return "readonly";

case T_ABSTRACT:

return "abstract";

case T_PUBLIC_SET:

return "public(set)";

case T_PROTECTED_SET:

return "protected(set)";

case T_PRIVATE_SET:

return "private(set)";

default: ZEND_UNREACHABLE();

}

}

uint32_t zend_modifier_token_to_flag(zend_modifier_target target, uint32_t token)

{

switch (token) {

case T_PUBLIC:

if (target != ZEND_MODIFIER_TARGET_PROPERTY_HOOK) {

return ZEND_ACC_PUBLIC;

}

break;

case T_PROTECTED:

if (target != ZEND_MODIFIER_TARGET_PROPERTY_HOOK) {

return ZEND_ACC_PROTECTED;

}

break;

case T_PRIVATE:

if (target != ZEND_MODIFIER_TARGET_PROPERTY_HOOK) {

return ZEND_ACC_PRIVATE;

}

break;

case T_READONLY:

if (target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_CPP) {

return ZEND_ACC_READONLY;

}

break;

case T_ABSTRACT:

if (target == ZEND_MODIFIER_TARGET_METHOD || target == ZEND_MODIFIER_TARGET_PROPERTY) {

return ZEND_ACC_ABSTRACT;

}

break;

case T_FINAL:

return ZEND_ACC_FINAL;

case T_STATIC:

if (target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_METHOD) {

return ZEND_ACC_STATIC;

}

break;

case T_PUBLIC_SET:

if (target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_CPP) {

return ZEND_ACC_PUBLIC_SET;

}

break;

case T_PROTECTED_SET:

if (target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_CPP) {

return ZEND_ACC_PROTECTED_SET;

}

break;

case T_PRIVATE_SET:

if (target == ZEND_MODIFIER_TARGET_PROPERTY || target == ZEND_MODIFIER_TARGET_CPP) {

return ZEND_ACC_PRIVATE_SET;

}

break;

}

char *member;

if (target == ZEND_MODIFIER_TARGET_PROPERTY) {

member = "property";

} else if (target == ZEND_MODIFIER_TARGET_METHOD) {

member = "method";

} else if (target == ZEND_MODIFIER_TARGET_CONSTANT) {

member = "class constant";

} else if (target == ZEND_MODIFIER_TARGET_CPP) {

member = "parameter";

} else if (target == ZEND_MODIFIER_TARGET_PROPERTY_HOOK) {

member = "property hook";

} else {

ZEND_UNREACHABLE();

}

zend_throw_exception_ex(zend_ce_compile_error, 0,

"Cannot use the %s modifier on a %s", zend_modifier_token_to_string(token), member);

return 0;

}

uint32_t zend_modifier_list_to_flags(zend_modifier_target target, zend_ast *modifiers)

{

uint32_t flags = 0;

const zend_ast_list *modifier_list = zend_ast_get_list(modifiers);

for (uint32_t i = 0; i < modifier_list->children; i++) {

uint32_t token = (uint32_t) Z_LVAL_P(zend_ast_get_zval(modifier_list->child[i]));

uint32_t new_flag = zend_modifier_token_to_flag(target, token);

if (!new_flag) {

return 0;

}

/* Don't error immediately for duplicate flags, we want to prioritize the errors from zend_add_member_modifier(). */

bool duplicate_flag = (flags & new_flag);

flags = zend_add_member_modifier(flags, new_flag, target);

if (!flags) {

return 0;

}

if (duplicate_flag) {

zend_throw_exception_ex(zend_ce_compile_error, 0,

"Multiple %s modifiers are not allowed", zend_modifier_token_to_string(token));

return 0;

}

}

return flags;

}

uint32_t zend_add_class_modifier(uint32_t flags, uint32_t new_flag) /* {{{ */

{

uint32_t new_flags = flags | new_flag;

if ((flags & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS) && (new_flag & ZEND_ACC_EXPLICIT_ABSTRACT_CLASS)) {

zend_throw_exception(zend_ce_compile_error,