Optimize ZEND_COUNT opcodes on arrays in the jit

Avoid the overhead of a call and checking types
when the argument is definitely an array.
Avoid the overhead of gc when `__destruct` won't get called.

This seemed cheap enough to check for in the jit.

Because of https://wiki.php.net/rfc/restrict_globals_usage
we can be sure in the ZEND_COUNT handler that the array count does not have to
be recomputed in php 8.1.

The below example took 0.854 seconds before the optimization,
and 0.564 seconds after the optimization, giving the same result

```php
<?php
/** @jit */
function bench_count(int $n): int {
    $total = 0;
    $arr = [];
    for ($i = 0; $i < $n; $i++) {
        $arr[] = $i;
        $total += count($arr);
    }
    return $total;
}

function main() {
    $n = 1000;
    $iterations = 50000;
    $start = microtime(true);
    $result = 0;
    for ($i = 0; $i < $iterations; $i++) {
        $result += bench_count($n);
    }
    $elapsed = microtime(true) - $start;

    printf("Total for n=%d, iterations=%d = %d, elapsed=%.3f\n", $n, $iterations, $result, $elapsed);
}
main();
```

Before

```asm
mov $0x7feb8cf8a858, %r15
mov $ZEND_COUNT_SPEC_CV_UNUSED_HANDLER, %rax
call *%rax
```

After

```asm
mov 0x70(%r14), %rdi - Copy the count from the `zend_array*` pointer
mov %rdi, (%rax)     - Store the count in the destination's value
mov $0x4, 0x8(%rax)  - Store IS_LONG(4) in the destination's type
```

Author: TysonAndre

Zend/zend_hash.h

@@ -298,7 +298,7 @@ ZEND_API void ZEND_FASTCALL zend_hash_rehash(HashTable *ht);
 ZEND_API HashTable* ZEND_FASTCALL _zend_new_array_0(void);
 ZEND_API HashTable* ZEND_FASTCALL _zend_new_array(uint32_t size);
 ZEND_API HashTable* ZEND_FASTCALL zend_new_pair(zval *val1, zval *val2);
-ZEND_API uint32_t zend_array_count(HashTable *ht);
+ZEND_API uint32_t ZEND_FASTCALL zend_array_count(HashTable *ht);
 ZEND_API HashTable* ZEND_FASTCALL zend_array_dup(HashTable *source);
 ZEND_API void ZEND_FASTCALL zend_array_destroy(HashTable *ht);
 ZEND_API void ZEND_FASTCALL zend_symtable_clean(HashTable *ht);

ext/opcache/jit/zend_jit.c

@@ -3210,6 +3210,15 @@ static int zend_jit(const zend_op_array *op_array, zend_ssa *ssa, const zend_op
 							goto jit_failure;
 						}
 						goto done;
+					case ZEND_COUNT:
+						op1_info = OP1_INFO();
+						if ((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) != MAY_BE_ARRAY) {
+							break;
+						}
+						if (!zend_jit_count(&dasm_state, opline, op_array, op1_info)) {
+							goto jit_failure;
+						}
+						goto done;
 					case ZEND_FETCH_THIS:
 						if (!zend_jit_fetch_this(&dasm_state, opline, op_array, 0)) {
 							goto jit_failure;

ext/opcache/jit/zend_jit_x86.dasc

@@ -374,6 +374,12 @@ static void* dasm_labels[zend_lb_MAX];
 ||	}
 |.endmacro
 
+/* The caller is responsible for passing the parameters, if there are any.
+ * If there are any parameters, The way that is done depends on whether the function is declared as ZEND_FASTCALL.
+ *
+ * With ZEND_FASTCALL: This file's usage of zend_array_count is an example of a single-parameter function getting called.
+ * Without ZEND_FASTCALL: This file's usage of zend_interrupt_function is an example of a single-parameter function that is ZEND_FASTCALL getting called.
+ */
 |.macro EXT_CALL, func, tmp_reg
 |	.if X64
 ||		if (IS_32BIT(dasm_end) && IS_32BIT(func)) {
@@ -9197,7 +9203,7 @@ static int zend_jit_init_fcall(dasm_State **Dst, const zend_op *opline, uint32_t
 #endif
 		/* load constant address later */
 	} else if (func && op_array == &func->op_array) {
-		/* recursive call */		
+		/* recursive call */
 		if (!(func->op_array.fn_flags & ZEND_ACC_IMMUTABLE) ||
 		    (sizeof(void*) == 8 && !IS_SIGNED_32BIT(func))) {
 			|	mov r0, EX->func
@@ -15015,6 +15021,43 @@ static int zend_jit_fetch_constant(dasm_State          **Dst,
 	return 1;
 }
 
+static int zend_jit_count(dasm_State **Dst, const zend_op *opline, const zend_op_array *op_array, uint32_t op1_info)
+{
+	zend_jit_addr res_addr = RES_ADDR();
+
+	if (opline->op1_type == IS_CONST) {
+		zval *zv;
+		size_t count;
+
+		zv = RT_CONSTANT(opline, opline->op1);
+		ZEND_ASSERT(Z_TYPE_P(zv) == IS_ARRAY);
+		count = zend_array_count(Z_ARRVAL_P(zv));
+
+		|	SET_ZVAL_LVAL res_addr, count
+		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
+	} else {
+		zend_jit_addr op1_addr = OP1_ADDR();
+
+		ZEND_ASSERT((op1_info & (MAY_BE_UNDEF|MAY_BE_ANY|MAY_BE_REF)) == MAY_BE_ARRAY);
+		// Note: See the implementation of ZEND_COUNT in Zend/zend_vm_def.h - arrays do not contain IS_UNDEF starting in php 8.1+.
+
+		|	GET_ZVAL_PTR FCARG1a, op1_addr
+		|	mov r0, [FCARG1a + offsetof(HashTable, nNumOfElements)]
+		|	SET_ZVAL_LVAL res_addr, r0
+		|	SET_ZVAL_TYPE_INFO res_addr, IS_LONG
+		if (opline->op1_type & (IS_VAR|IS_TMP_VAR)) {
+			// Temporary expressions need to be freed.
+			// Anything containing objects or resources might throw when freed due to the destructors.
+			zend_bool gc = (op1_info & (MAY_BE_ARRAY_OF_OBJECT|MAY_BE_ARRAY_OF_ARRAY|MAY_BE_ARRAY_OF_RESOURCE|MAY_BE_ARRAY_OF_REF)) != 0;
+			|	ZVAL_PTR_DTOR op1_addr, op1_info, gc, 0, opline
+			if (gc) {
+				zend_jit_check_exception(Dst);
+			}
+		}
+	}
+	return 1;
+}
+
 static int zend_jit_in_array(dasm_State **Dst, const zend_op *opline, uint32_t op1_info, zend_jit_addr op1_addr,  zend_uchar smart_branch_opcode, uint32_t target_label, uint32_t target_label2, const void *exit_addr)
 {
 	HashTable *ht = Z_ARRVAL_P(RT_CONSTANT(opline, opline->op2));

ext/opcache/tests/jit/count_001.phpt

@@ -0,0 +1,38 @@
+--TEST--
+JIT COUNT: 001
+--INI--
+opcache.enable=1
+opcache.enable_cli=1
+opcache.file_update_protection=0
+opcache.jit_buffer_size=1M
+;opcache.jit_debug=1
+--SKIPIF--
+<?php require_once('skipif.inc'); ?>
+--FILE--
+<?php
+class C {
+    public static function create_array(int $i): array {
+        return array_fill(0, $i, new stdClass());
+    }
+
+    public static function foo() {
+        $x = [self::create_array(5)];
+        echo count(self::create_array(0)), "\n";
+        echo count(self::create_array(1)), "\n";
+        echo count($x[0]), "\n";
+        $a = [];
+        for ($i = 0; $i < 4; $i++) {
+            $a[] = $i;
+            echo count($a) . "\n";
+        }
+    }
+}
+C::foo();
+--EXPECT--
+0
+1
+5
+1
+2
+3
+4