Optimize ZEND_COUNT opcodes on arrays in the jit

Avoid the overhead of a call and checking types
when the argument is definitely an array.
Avoid the overhead of gc when `__destruct` won't get called.

This seemed cheap enough to check for in the jit.

The below example took 0.688 seconds before the optimization,
and 0.512 seconds after the optimization, giving the same result

```php
<?php
/** @jit */
function bench_count(int $n): int {
    $total = 0;
    $arr = [];
    for ($i = 0; $i < $n; $i++) {
        $arr[] = $i;
        $total += count($arr);
    }
    return $total;
}

function main() {
    $n = 1000;
    $iterations = 50000;
    $start = microtime(true);
    $result = 0;
    for ($i = 0; $i < $iterations; $i++) {
        $result += bench_count($n);
    }
    $elapsed = microtime(true) - $start;

    printf("Total for n=%d, iterations=%d = %d, elapsed=%.3f\n", $n, $iterations, $result, $elapsed);
}
main();
```

Before

```asm
mov $0x7feb8cf8a858, %r15
mov $ZEND_COUNT_SPEC_CV_UNUSED_HANDLER, %rax
call *%rax
```

After

```asm
mov 0x70(%r14), %rdi -- pass in the zend_array
mov $zend_array_count, %rax
call *%rax
mov %rax, 0x90(%r14) -- set the long value
mov $0x4, 0x98(%r14) -- set the IS_LONG type flag
; This would have more error handling code for temporaries
```

Author: TysonAndre

Zend/zend_hash.c

@@ -439,7 +439,7 @@ static uint32_t zend_array_recalc_elements(HashTable *ht)
 }
 /* }}} */
 
-ZEND_API uint32_t zend_array_count(HashTable *ht)
+ZEND_API uint32_t ZEND_FASTCALL zend_array_count(HashTable *ht)
 {
 	uint32_t num;
 	if (UNEXPECTED(HT_FLAGS(ht) & HASH_FLAG_HAS_EMPTY_IND)) {

Zend/zend_hash.h

@@ -300,7 +300,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_rehash(HashTable *ht);
 ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
 ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
 ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2);
-ZEND_API uint32_t zend_array_count(HashTable *ht);
+ZEND_API uint32_t ZEND_FASTCALL zend_array_count(HashTable *ht);
 ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source);
 ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht);
 ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht);

ext/opcache/jit/zend_jit.c

@@ -2836,6 +2836,15 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
 							goto jit_failure;
 						}
 						goto done;
+					case ZEND_COUNT:
+						op1_info = OP1_INFO();
+						if ((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
+							break;
+						}
+						if (!zend_jit_count(&dasm_state, opline, op_array, op1_info)) {
+							goto jit_failure;
+						}
+						goto done;
 					case ZEND_FETCH_THIS:
 						if (!zend_jit_fetch_this(&dasm_state, opline, op_array)) {
 							goto jit_failure;

ext/opcache/jit/zend_jit_x86.dasc

@@ -424,6 +424,12 @@ static void* dasm_labels[zend_lb_MAX];
 ||	}
 |.endmacro
 
+/* The caller is responsible for passing the parameters, if there are any.
+ * If there are any parameters, The way that is done depends on whether the function is declared as ZEND_FASTCALL.
+ *
+ * With ZEND_FASTCALL: This file's usage of zend_array_count is an example of a single-parameter function getting called.
+ * Without ZEND_FASTCALL: This file's usage of zend_interrupt_function is an example of a single-parameter function that is ZEND_FASTCALL getting called.
+ */
 |.macro EXT_CALL, func, tmp_reg
 |	.if X64
 ||		if (IS_32BIT(dasm_end) && IS_32BIT(func)) {
@@ -10836,6 +10842,47 @@ static int zend_jit_strlen(dasm_State **Dst, const zend_op *opline, const zend_o
 	return 1;
 }
 
+static int zend_jit_count(dasm_State **Dst, const zend_op *opline, const zend_op_array *op_array, uint32_t op1_info)
+{
+	zend_jit_addr res_addr = RES_ADDR();
+
+	if (opline->op1_type == IS_CONST) {
+		zval *zv;
+		size_t count;
+
+		zv = RT_CONSTANT(opline, opline->op1);
+		ZEND_ASSERT(Z_TYPE_P(zv) == IS_ARRAY);
+		count = zend_array_count(Z_ARRVAL_P(zv));
+
+		|	SET_ZVAL_LVAL res_addr, count
+		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
+	} else {
+		zend_jit_addr op1_addr = OP1_ADDR();
+
+		ZEND_ASSERT((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) == MAY_BE_ARRAY);
+		// Note: Conservatively always using zend_array_count because arrays may contain entries with IS_UNDEF at runtime, and op1_info doesn't represent that.
+		// Special cases for arrays include $GLOBALS, as well as arrays that were created from objects.
+		// (e.g. `$x = new self(); unset($x->declaredProp); echo count(get_object_vars($x))`).
+
+		|	GET_ZVAL_PTR FCARG1a, op1_addr
+		|	EXT_CALL zend_array_count, r0
+		|	SET_ZVAL_LVAL res_addr, eax
+		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
+		if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
+			// Temporary expressions need to be freed.
+			// Anything containing objects or resources might throw when freed due to the destructors.
+			zend_bool gc = (op1_info & (MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_REF)) != 0;
+			// TODO: Could put the zval in r0 when GC is possible, to avoid a second load from memory?
+			|	GET_ZVAL_PTR FCARG1a, op1_addr
+			|	ZVAL_PTR_DTOR op1_addr, op1_info, gc, 0, opline
+			if (gc) {
+				zend_jit_check_exception(Dst);
+			}
+		}
+	}
+	return 1;
+}
+
 static int zend_jit_fetch_this(dasm_State **Dst, const zend_op *opline, const zend_op_array *op_array)
 {
 	zend_jit_addr res_addr = RES_ADDR();

ext/opcache/tests/jit/count_001.phpt

@@ -0,0 +1,38 @@
+--TEST--
+JIT COUNT: 001
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+;opcache.jit_debug=1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+class C {
+    public static function create_array(int $i): array {
+        return array_fill(0, $i, new stdClass());
+    }
+
+    public static function foo() {
+        $x = [self::create_array(5)];
+        echo count(self::create_array(0)), "\n";
+        echo count(self::create_array(1)), "\n";
+        echo count($x[0]), "\n";
+        $a = [];
+        for ($i = 0; $i < 4; $i++) {
+            $a[] = $i;
+            echo count($a) . "\n";
+        }
+    }
+}
+C::foo();
+--EXPECT--
+0
+1
+5
+1
+2
+3
+4