[php-src] PR #23925: Avoid generating exception check in tracing JIT for uncoerced scalar typed property writes
| From: | ndossche | Date: | Sat, 26 Sep 2026 12:46:26 +0000 |
| Subject: | [php-src] PR #23925: Avoid generating exception check in tracing JIT for uncoerced scalar typed property writes | ||
| Groups: | php.git-pulls | ||
| Request: | Send a blank email to git-pulls+get-38829@lists.php.net to get a copy of this message | ||
Pull Request: https://github.com/php/php-src/pull/23925
Author: ndossche
Consider this PHP code, which we execute using tracing JIT:
```php
class Foo {
public int $test = 1;
}
function main() {
$foo = new Foo;
for ($i = 0; $i < 1000000; $i++) {
$foo->test = $i;
}
return $foo;
}
main();
```
The loop previously generated this code on x86-64:
```asm
.L1:
cmpq $0xf4240, %rbx
jge jit$$trace_exit_0
movq 0x50(%r14), %rax
leaq 0x28(%rax), %rdi
cmpl $0, 0x30(%rax)
je jit$$trace_exit_1
movq $0x41cd8cc0, (%r14)
leaq 0x60(%r14), %rdx
movq %rbx, (%rdx)
movl $0x41cd89e0, %esi
xorq %rcx, %rcx
movabsq $zend_jit_assign_to_typed_prop, %rax
callq *%rax
movabsq $EG(exception), %rax
movq (%rax), %rax
testq %rax, %rax
jne JIT$$exception_handler
leaq 1(%rbx), %rbx
movabsq $EG(vm_interrupt), %rax
movb (%rax), %al
testb %al, %al
je .L1
jmp jit$$trace_exit_2
```
Note the exception check after the
zend_jit_assign_to_typed_prop call. This is not
necessary because the property is known to hold a scalar. Extending zend_may_throw_ex
allows eliminating that check:
```asm
.L1:
cmpq $0xf4240, %rbx
jge jit$$trace_exit_0
movq 0x50(%r14), %rax
leaq 0x28(%rax), %rdi
cmpl $0, 0x30(%rax)
je jit$$trace_exit_1
movq $0x424d8cc0, (%r14)
leaq 0x60(%r14), %rdx
movq %rbx, (%rdx)
movl $0x424d89e0, %esi
xorq %rcx, %rcx
movabsq $zend_jit_assign_to_typed_prop, %rax
callq *%rax
leaq 1(%rbx), %rbx
movabsq $EG(vm_interrupt), %rax
movb (%rax), %al
testb %al, %al
je .L1
jmp jit$$trace_exit_2
```
This is a minor first step in optimizing the JIT frontend for property assignments. This mainly
reduces code bloat.