zend_verify_type_inference.h

Go to the documentation of this file.

/*
   +----------------------------------------------------------------------+
   | Zend Engine                                                          |
   +----------------------------------------------------------------------+
   | Copyright (c) Zend Technologies Ltd. (http://www.zend.com)           |
   +----------------------------------------------------------------------+
   | This source file is subject to version 2.00 of the Zend license,     |
   | that is bundled with this package in the file LICENSE, and is        |
   | available through the world-wide-web at the following url:           |
   | http://www.zend.com/license/2_00.txt.                                |
   | If you did not receive a copy of the Zend license and are unable to  |
   | obtain it through the world-wide-web, please send a note to          |
   | license@zend.com so we can mail you a copy immediately.              |
   +----------------------------------------------------------------------+
*/
 
#include "zend_type_info.h"
#include "zend_compile.h"
 
#define VM_TRACE_START()
#define VM_TRACE_END()
#define VM_TRACE(op) zend_verify_inference_use(execute_data, OPLINE); \
    { \
        zend_execute_data *__current_ex = NULL; \
        const zend_op *__current_op = NULL; \
        if (OPLINE->opcode != ZEND_GENERATOR_RETURN) { \
            __current_ex = execute_data; __current_op = OPLINE; \
        }
#define VM_TRACE_OP_END(op) \
        if (__current_ex && __current_op) { \
            zend_verify_inference_def(__current_ex, __current_op); \
        } \
    }
 
#define ZEND_VERIFY_TYPE_INFERENCE_ERROR(msg, ...) \
    do { \
        fprintf(stderr, "Inference verification failed at %04d %s (" msg ")\n", (int)(opline - EX(func)->op_array.opcodes), operand, __VA_ARGS__); \
        _exit(139); \
    } while (0)
 
static void zend_verify_type_inference(zval *value, uint32_t type_mask, uint8_t op_type, zend_execute_data *execute_data, const zend_op *opline, const char *operand)
{
    if (type_mask == MAY_BE_CLASS) {
        return;
    }
 
    if (Z_TYPE_P(value) == IS_INDIRECT) {
        if (!(type_mask & MAY_BE_INDIRECT)) {
            ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_INDIRECT", type_mask);
        }
        value = Z_INDIRECT_P(value);
    }
 
    /* Verifying RC inference is currently not possible because type information is based on the SSA
     * built without ZEND_SSA_RC_INFERENCE, which is missing various definitions for RC-modifying
     * operations. Support could be added by repeating SSA-construction and type inference with the
     * given flag. */
    // if (Z_REFCOUNTED_P(value)) {
    //  if (Z_REFCOUNT_P(value) == 1 && !(type_mask & MAY_BE_RC1)) {
    //      ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_RC1", type_mask);
    //  }
    //  if (Z_REFCOUNT_P(value) > 1 && !(type_mask & MAY_BE_RCN)) {
    //      ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_RCN", type_mask);
    //  }
    // }
 
    if (Z_TYPE_P(value) == IS_REFERENCE) {
        if (!(type_mask & MAY_BE_REF)) {
            ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_REF", type_mask);
        }
        value = Z_REFVAL_P(value);
    }
 
    if (!(type_mask & (1u << Z_TYPE_P(value)))) {
        if (Z_TYPE_P(value) == IS_UNUSED && op_type == IS_VAR && (type_mask & MAY_BE_NULL)) {
            /* FETCH_OBJ_* for typed property may return IS_UNDEF. This is an exception. */
        } else {
            ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing type %d", type_mask, Z_TYPE_P(value));
        }
    }
 
    if (Z_TYPE_P(value) == IS_ARRAY) {
        HashTable *ht = Z_ARRVAL_P(value);
        uint32_t num_checked = 0;
        zend_string *str;
        zval *val;
        if (HT_IS_INITIALIZED(ht)) {
            if (HT_IS_PACKED(ht) && !MAY_BE_PACKED(type_mask)) {
                ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_ARRAY_PACKED", type_mask);
            }
            if (!HT_IS_PACKED(ht) && !MAY_BE_HASH(type_mask)) {
                ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_ARRAY_HASH", type_mask);
            }
        } else {
            if (!(type_mask & MAY_BE_ARRAY_EMPTY)) {
                ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_ARRAY_EMPTY", type_mask);
            }
        }
        ZEND_HASH_FOREACH_STR_KEY_VAL(ht, str, val) {
            if (str) {
                if (!(type_mask & MAY_BE_ARRAY_KEY_STRING)) {
                    ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_ARRAY_KEY_STRING", type_mask);
                    break;
                }
            } else {
                if (!(type_mask & MAY_BE_ARRAY_KEY_LONG)) {
                    ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing MAY_BE_ARRAY_KEY_LONG", type_mask);
                    break;
                }
            }
 
            uint32_t array_type = 1u << (Z_TYPE_P(val) + MAY_BE_ARRAY_SHIFT);
            if (!(type_mask & array_type)) {
                ZEND_VERIFY_TYPE_INFERENCE_ERROR("mask 0x%x missing array type %d", type_mask, Z_TYPE_P(val));
                break;
            }
 
            /* Don't check all elements of large arrays. */
            if (++num_checked > 16) {
                break;
            }
        } ZEND_HASH_FOREACH_END();
    }
}
 
/* Clang reports false positive unused warnings. */
#ifdef __clang__
__attribute__((unused))
#endif
static void zend_verify_inference_use(zend_execute_data *execute_data, const zend_op *opline)
{
    if (opline->op1_use_type
     && (opline->op1_type & (IS_TMP_VAR|IS_VAR|IS_CV))
     && opline->opcode != ZEND_ROPE_ADD
     && opline->opcode != ZEND_ROPE_END) {
        zend_verify_type_inference(EX_VAR(opline->op1.var), opline->op1_use_type, opline->op1_type, execute_data, opline, "op1_use");
    }
    if (opline->op2_use_type
     && (opline->op2_type & (IS_TMP_VAR|IS_VAR|IS_CV))) {
        zend_verify_type_inference(EX_VAR(opline->op2.var), opline->op2_use_type, opline->op2_type, execute_data, opline, "op2_use");
    }
    if (opline->result_use_type
     && (opline->result_type & (IS_TMP_VAR|IS_VAR|IS_CV))) {
        zend_verify_type_inference(EX_VAR(opline->result.var), opline->result_use_type, opline->result_type, execute_data, opline, "result_use");
    }
}
 
/* Clang reports false positive unused warnings. */
#ifdef __clang__
__attribute__((unused))
#endif
static void zend_verify_inference_def(zend_execute_data *execute_data, const zend_op *opline)
{
    if (EG(exception)) {
        return;
    }
    if (opline->op1_def_type
     && (opline->op1_type & (IS_TMP_VAR|IS_VAR|IS_CV))
     // array is actually changed by the the following instruction(s)
     && opline->opcode != ZEND_FETCH_DIM_W
     && opline->opcode != ZEND_FETCH_DIM_RW
     && opline->opcode != ZEND_FETCH_DIM_FUNC_ARG
     && opline->opcode != ZEND_FETCH_LIST_W) {
        zend_verify_type_inference(EX_VAR(opline->op1.var), opline->op1_def_type, opline->op1_type, execute_data, opline, "op1_def");
    }
    if (opline->op2_def_type
     && (opline->op2_type & (IS_TMP_VAR|IS_VAR|IS_CV))
     /* ZEND_FE_FETCH_R[W] does not define a result in the last iteration. */
     && opline->opcode != ZEND_FE_FETCH_R
     && opline->opcode != ZEND_FE_FETCH_RW) {
        zend_verify_type_inference(EX_VAR(opline->op2.var), opline->op2_def_type, opline->op2_type, execute_data, opline, "op2_def");
    }
    if (opline->result_def_type
     && (opline->result_type & (IS_TMP_VAR|IS_VAR|IS_CV))
     && opline->opcode != ZEND_ROPE_INIT
     && opline->opcode != ZEND_ROPE_ADD
     /* Some jump opcode handlers don't set result when it's never read. */
     && opline->opcode != ZEND_JMP_SET
     && opline->opcode != ZEND_JMP_NULL
     && opline->opcode != ZEND_COALESCE
     && opline->opcode != ZEND_ASSERT_CHECK
     /* Smart branches may not declare result. */
     && !zend_is_smart_branch(opline)
     /* User calls only initialize result when returning from the called function. */
     && opline->opcode != ZEND_DO_FCALL
     && opline->opcode != ZEND_DO_UCALL
     && opline->opcode != ZEND_DO_FCALL_BY_NAME
     /* ZEND_FE_FETCH_R[W] does not define a result in the last iteration. */
     && opline->opcode != ZEND_FE_FETCH_R
     && opline->opcode != ZEND_FE_FETCH_RW) {
        zend_verify_type_inference(EX_VAR(opline->result.var), opline->result_def_type, opline->result_type, execute_data, opline, "result_def");
 
        /* Verify return value in the context of caller. */
        if ((opline->opcode == ZEND_RETURN || opline->opcode == ZEND_RETURN_BY_REF)
         && execute_data->prev_execute_data
         && execute_data->prev_execute_data->func
         && ZEND_USER_CODE(execute_data->prev_execute_data->func->type)) {
            zend_execute_data *prev_execute_data = execute_data->prev_execute_data;
            const zend_op *opline = execute_data->prev_execute_data->opline;
            zend_verify_type_inference(ZEND_CALL_VAR(prev_execute_data, opline->result.var), opline->result_def_type, opline->result_type, prev_execute_data, opline, "result_def");
        }
    }
}