Add zend_jit_trace support for ZEND_COUNT

Author: TysonAndre

ext/opcache/jit/zend_jit.c

@@ -3215,7 +3215,7 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
 						if ((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
 							break;
 						}
-						if (!zend_jit_count(&dasm_state, opline, op_array, op1_info)) {
+						if (!zend_jit_count(&dasm_state, opline, op1_info, OP1_REG_ADDR())) {
 							goto jit_failure;
 						}
 						goto done;

ext/opcache/jit/zend_jit_trace.c

@@ -1581,6 +1581,7 @@ static zend_ssa *zend_jit_trace_build_tssa(zend_jit_trace_rec *trace_buffer, uin
 					/* break missing intentionally */
 				case ZEND_ECHO:
 				case ZEND_STRLEN:
+				case ZEND_COUNT:
 				case ZEND_QM_ASSIGN:
 				case ZEND_FE_RESET_R:
 				case ZEND_FE_FETCH_R:
@@ -5497,6 +5498,33 @@ static const void *zend_jit_trace(zend_jit_trace_rec *trace_buffer, uint32_t par
 							goto jit_failure;
 						}
 						goto done;
+					case ZEND_COUNT:
+						op1_info = OP1_INFO();
+						CHECK_OP1_TRACE_TYPE();
+						if ((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
+							break;
+						}
+						op1_info = OP1_INFO();
+						op1_addr = OP1_REG_ADDR();
+						if (orig_op1_type == (IS_TRACE_REFERENCE|IS_ARRAY)) {
+							if (!zend_jit_fetch_reference(&dasm_state, opline, orig_op1_type, &op1_info, &op1_addr,
+									!ssa->var_info[ssa_op->op1_use].guarded_reference, 1)) {
+								goto jit_failure;
+							}
+							if (opline->op1_type == IS_CV
+							 && ssa->vars[ssa_op->op1_use].alias == NO_ALIAS) {
+								ssa->var_info[ssa_op->op1_use].guarded_reference = 1;
+							}
+						} else {
+							CHECK_OP1_TRACE_TYPE();
+							if ((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
+								break;
+							}
+						}
+						if (!zend_jit_count(&dasm_state, opline, op1_info, op1_addr)) {
+							goto jit_failure;
+						}
+						goto done;
 					case ZEND_FETCH_THIS:
 						delayed_fetch_this = 0;
 						if (ssa_op->result_def >= 0 && opline->result_type != IS_CV) {

ext/opcache/jit/zend_jit_x86.dasc

@@ -14249,6 +14249,37 @@ static int zend_jit_strlen(dasm_State **Dst, const zend_op *opline, uint32_t op1
 	return 1;
 }
 
+static int zend_jit_count(dasm_State **Dst, const zend_op *opline, uint32_t op1_info, zend_jit_addr op1_addr)
+{
+	zend_jit_addr res_addr = RES_ADDR();
+
+	if (opline->op1_type == IS_CONST) {
+		return 0;
+		/*
+		zval *zv;
+		zend_long count;
+
+		zv = RT_CONSTANT(opline, opline->op1);
+		ZEND_ASSERT(Z_TYPE_P(zv) == IS_ARRAY);
+		count = zend_hash_num_elements(Z_ARRVAL_P(zv));
+
+		|	SET_ZVAL_LVAL res_addr, count
+		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
+		*/
+	} else {
+		ZEND_ASSERT((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) == MAY_BE_ARRAY);
+		// Note: See the implementation of ZEND_COUNT in Zend/zend_vm_def.h - arrays do not contain IS_UNDEF starting in php 8.1+.
+
+		|	GET_ZVAL_PTR r0, op1_addr
+		// Sign-extend the 32-bit value to a potentially 64-bit zend_long
+		|	mov eax, dword [r0 + offsetof(HashTable, nNumOfElements)]
+		|	SET_ZVAL_LVAL res_addr, r0
+		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
+		|	FREE_OP opline->op1_type, opline->op1, op1_info, 0, opline
+	}
+	return 1;
+}
+
 static int zend_jit_load_this(dasm_State **Dst, uint32_t var)
 {
 	zend_jit_addr var_addr = ZEND_ADDR_MEM_ZVAL(ZREG_FP, var);
@@ -15024,43 +15055,6 @@ static int zend_jit_fetch_constant(dasm_State          **Dst,
 	return 1;
 }
 
-static int zend_jit_count(dasm_State **Dst, const zend_op *opline, const zend_op_array *op_array, uint32_t op1_info)
-{
-	zend_jit_addr res_addr = RES_ADDR();
-
-	if (opline->op1_type == IS_CONST) {
-		zval *zv;
-		size_t count;
-
-		zv = RT_CONSTANT(opline, opline->op1);
-		ZEND_ASSERT(Z_TYPE_P(zv) == IS_ARRAY);
-		count = zend_array_count(Z_ARRVAL_P(zv));
-
-		|	SET_ZVAL_LVAL res_addr, count
-		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
-	} else {
-		zend_jit_addr op1_addr = OP1_ADDR();
-
-		ZEND_ASSERT((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) == MAY_BE_ARRAY);
-		// Note: See the implementation of ZEND_COUNT in Zend/zend_vm_def.h - arrays do not contain IS_UNDEF starting in php 8.1+.
-
-		|	GET_ZVAL_PTR FCARG1a, op1_addr
-		|	mov r0, [FCARG1a + offsetof(HashTable, nNumOfElements)]
-		|	SET_ZVAL_LVAL res_addr, r0
-		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
-		if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
-			// Temporary expressions need to be freed.
-			// Anything containing objects or resources might throw when freed due to the destructors.
-			zend_bool gc = (op1_info & (MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_REF)) != 0;
-			|	ZVAL_PTR_DTOR op1_addr, op1_info, gc, 0, opline
-			if (gc) {
-				zend_jit_check_exception(Dst);
-			}
-		}
-	}
-	return 1;
-}
-
 static int zend_jit_in_array(dasm_State **Dst, const zend_op *opline, uint32_t op1_info, zend_jit_addr op1_addr,  zend_uchar smart_branch_opcode, uint32_t target_label, uint32_t target_label2, const void *exit_addr)
 {
 	HashTable *ht = Z_ARRVAL_P(RT_CONSTANT(opline, opline->op2));

ext/opcache/tests/jit/count_001.phpt

@@ -26,8 +26,13 @@ class C {
             echo count($a) . "\n";
         }
     }
+    public static function count_ref(array &$ref): int {
+        return count($ref);
+    }
 }
 C::foo();
+$x = ['x', 'y', 'z', 'a', new stdClass()];
+echo C::count_ref($x), "\n";
 --EXPECT--
 0
 1
@@ -36,3 +41,4 @@ C::foo();
 2
 3
 4
+5