Move value for ARRAY_SET_PLACEHOLDER to op2, and op2.num to extended_value

Author: iluuu1994

Zend/Optimizer/escape_analysis.c

@@ -317,7 +317,7 @@ static bool is_escape_use(zend_op_array *op_array, zend_ssa *ssa, int use, int v
 				}
 				ZEND_FALLTHROUGH;
 			case ZEND_ARRAY_SET_PLACEHOLDER:
-				if (OP1_INFO() & MAY_BE_OBJECT) {
+				if (OP2_INFO() & MAY_BE_OBJECT) {
 					/* object aliasing */
 					return 1;
 				}
@@ -495,11 +495,14 @@ zend_result zend_ssa_escape_analysis(const zend_script *script, zend_op_array *o
 							    (op-1)->op1_use >= 0) {
 								enclosing_root = ees[(op-1)->op1_use];
 							} else if ((opline->opcode == ZEND_INIT_ARRAY ||
-							     opline->opcode == ZEND_ADD_ARRAY_ELEMENT ||
-								 opline->opcode == ZEND_ARRAY_SET_PLACEHOLDER) &&
+							     opline->opcode == ZEND_ADD_ARRAY_ELEMENT) &&
 							    op->op1_use == i &&
 							    op->result_def >= 0) {
 								enclosing_root = ees[op->result_def];
+							} else if (opline->opcode == ZEND_ARRAY_SET_PLACEHOLDER
+							 && op->op2_use == i
+							 && op->result_def >= 0) {
+								enclosing_root = ees[op->result_def];
 							} else {
 								continue;
 							}

Zend/Optimizer/sccp.c

@@ -1190,7 +1190,7 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 			zval *result = &ctx->values[ssa_op->result_use];
 
 			SKIP_IF_TOP(result);
-			SKIP_IF_TOP(op1);
+			SKIP_IF_TOP(op2);
 
 #if 1
 			/* FIXME: See below. */
@@ -1204,12 +1204,12 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 
 			/* FIXME: Avoid dup-ing the array in every step. */
 			zend_array *array = zend_array_dup(Z_ARRVAL_P(result));
-			zval *element = (zval*)((uintptr_t)array->arData + opline->op2.num);
+			zval *element = (zval*)((uintptr_t)array->arData + opline->extended_value);
 
 			zval tmp;
 			ZVAL_ARR(&tmp, array);
 
-			if (IS_BOT(op1)) {
+			if (IS_BOT(op2)) {
 #if 1
 				/* FIXME: Handle partial arrays. Deleting hashes is problematic
 				 * because it changes the offsets for the placeholders. */
@@ -1232,8 +1232,8 @@ static void sccp_visit_instr(scdf_ctx *scdf, zend_op *opline, zend_ssa_op *ssa_o
 				MAKE_PARTIAL_ARRAY(&tmp);
 #endif
 			} else {
-				ZVAL_COPY(element, op1);
-				if (IS_PARTIAL_ARRAY(op1)) {
+				ZVAL_COPY(element, op2);
+				if (IS_PARTIAL_ARRAY(op2)) {
 					MAKE_PARTIAL_ARRAY(&tmp);
 				}
 			}

Zend/Optimizer/zend_inference.c

@@ -3460,7 +3460,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 			break;
 		}
 		case ZEND_ARRAY_SET_PLACEHOLDER: {
-			// FIXME: op1 RC inference
+			// FIXME: op2 RC inference
 			uint32_t tmp = RES_USE_INFO();
 			if ((tmp & MAY_BE_ARRAY_OF_ANY) == MAY_BE_ARRAY_OF_ANY) {
 				ZEND_ASSERT(ssa_op->result_use != -1);
@@ -3473,7 +3473,7 @@ static zend_always_inline zend_result _zend_update_type_info(
 				}
 			}
 			uint32_t dim_type = ((tmp & MAY_BE_ARRAY_KEY_LONG) ? MAY_BE_LONG : 0) | ((tmp & MAY_BE_ARRAY_KEY_STRING) ? MAY_BE_STRING : 0);
-			tmp |= assign_dim_array_result_type(tmp, dim_type, t1, IS_CONST);
+			tmp |= assign_dim_array_result_type(tmp, dim_type, t2, IS_CONST);
 			UPDATE_SSA_TYPE(tmp, ssa_op->result_def);
 			break;
 		}

Zend/zend_compile.c

@@ -10813,8 +10813,8 @@ static void zend_compile_array(znode *result, zend_ast *ast) /* {{{ */
 				continue;
 			}
 
-			opline = zend_emit_op(NULL, ZEND_ARRAY_SET_PLACEHOLDER, &value_node, NULL);
-			opline->op2.num = (uintptr_t) element - (HT_IS_PACKED(template) ? (uintptr_t) template->arPacked : (uintptr_t) template->arData);
+			opline = zend_emit_op(NULL, ZEND_ARRAY_SET_PLACEHOLDER, NULL, &value_node);
+			opline->extended_value = (uintptr_t) element - (HT_IS_PACKED(template) ? (uintptr_t) template->arPacked : (uintptr_t) template->arData);
 			SET_NODE(opline->result, result);
 		} else if (opnum_init == -1) {
 			opnum_init = get_next_op_number();

Zend/zend_variables.c

@@ -48,7 +48,8 @@ static const zend_rc_dtor_func_t zend_rc_dtor_func[] = {
 	[IS_OBJECT] =       (zend_rc_dtor_func_t)zend_objects_store_del,
 	[IS_RESOURCE] =     (zend_rc_dtor_func_t)zend_list_free,
 	[IS_REFERENCE] =    (zend_rc_dtor_func_t)zend_reference_destroy,
-	[IS_CONSTANT_AST] = (zend_rc_dtor_func_t)zend_ast_ref_destroy
+	[IS_CONSTANT_AST] = (zend_rc_dtor_func_t)zend_ast_ref_destroy,
+	[_IS_ERROR] =       (zend_rc_dtor_func_t)zend_empty_destroy,
 };
 
 ZEND_API void ZEND_FASTCALL rc_dtor_func(zend_refcounted *p)

Zend/zend_vm_def.h

@@ -6243,24 +6243,24 @@ ZEND_VM_C_LABEL(num_index):
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();
 }
 
-ZEND_VM_HANDLER(211, ZEND_ARRAY_SET_PLACEHOLDER, CONST|TMP|VAR|CV, UNUSED|NUM)
+ZEND_VM_HANDLER(211, ZEND_ARRAY_SET_PLACEHOLDER, UNUSED, CONST|TMP|VAR|CV, NUM)
 {
 	USE_OPLINE
 	zval *expr_ptr, new_expr, *element;
 	zend_array *array;
 
 	SAVE_OPLINE();
 
-	expr_ptr = GET_OP1_ZVAL_PTR(BP_VAR_R);
+	expr_ptr = GET_OP2_ZVAL_PTR(BP_VAR_R);
 
-	if (OP1_TYPE == IS_TMP_VAR) {
+	if (OP2_TYPE == IS_TMP_VAR) {
 		/* pass */
-	} else if (OP1_TYPE == IS_CONST) {
+	} else if (OP2_TYPE == IS_CONST) {
 		Z_TRY_ADDREF_P(expr_ptr);
-	} else if (OP1_TYPE == IS_CV) {
+	} else if (OP2_TYPE == IS_CV) {
 		ZVAL_DEREF(expr_ptr);
 		Z_TRY_ADDREF_P(expr_ptr);
-	} else /* if (OP1_TYPE == IS_VAR) */ {
+	} else /* if (OP2_TYPE == IS_VAR) */ {
 		if (UNEXPECTED(Z_ISREF_P(expr_ptr))) {
 			zend_refcounted *ref = Z_COUNTED_P(expr_ptr);
 
@@ -6276,7 +6276,7 @@ ZEND_VM_HANDLER(211, ZEND_ARRAY_SET_PLACEHOLDER, CONST|TMP|VAR|CV, UNUSED|NUM)
 	}
 
 	array = Z_ARRVAL_P(EX_VAR(opline->result.var));
-	element = (zval*)((uintptr_t)array->arData + opline->op2.num);
+	element = (zval*)((uintptr_t)array->arData + opline->extended_value);
 	ZVAL_COPY_VALUE(element, expr_ptr);
 
 	ZEND_VM_NEXT_OPCODE_CHECK_EXCEPTION();