From 5d160796debb61041a809bf273333252291031f7 Mon Sep 17 00:00:00 2001
From: ndossche <7771979+ndossche@users.noreply.github.com>
Date: Sun, 27 Sep 2026 01:48:39 +0200
Subject: [PATCH] JIT: Make overflow add/sub cheaper

PHP code:
```php
<?php
function sum($n) {
    $s = 0;
    for ($i = 0; $i < $n; $i++) {
        $s += $i;
    }
    return $s;
}

var_dump(sum(10000000));
```

Old x86-64 code:
```asm
TRACE-1$sum$4:
	subq $0x30, %rsp
	movabsq $EG(jit_trace_num), %rax
	movl $1, (%rax)
	cmpb $4, 0x58(%r14)
	jne jit$$trace_exit_0
	cmpb $4, 0x68(%r14)
	jne jit$$trace_exit_1
	cmpb $4, 0x78(%r14)
	jne jit$$trace_exit_2
	movq 0x50(%r14), %rax
	movq 0x60(%r14), %rcx
	movq 0x70(%r14), %rdx
.L1:
	cmpq %rax, %rdx
	jge jit$$trace_exit_3
	movq %rdx, %rsi
	addq %rcx, %rsi
	jo jit$$trace_exit_4
	leaq 1(%rdx), %rdx
	movabsq $EG(vm_interrupt), %rcx
	movb (%rcx), %cl
	testb %cl, %cl
	jne jit$$trace_exit_5
	movq %rsi, %rcx
	jmp .L1
```

Note that this code uses an extra register and 2 extra moves (for %rcx)
to carry the result. This is because the trace exit wants the old
result. But we can avoid the extra register and extra moves if we simply
reconstruct the old value upon exit.
This patch implements that idea, which results in the following new code:

```asm
TRACE-1$sum$4:
	subq $0x30, %rsp
	movabsq $EG(jit_trace_num), %rax
	movl $1, (%rax)
	cmpb $4, 0x58(%r14)
	jne jit$$trace_exit_0
	cmpb $4, 0x68(%r14)
	jne jit$$trace_exit_1
	cmpb $4, 0x78(%r14)
	jne jit$$trace_exit_2
	movq 0x50(%r14), %rax
	movq 0x60(%r14), %rcx
	movq 0x70(%r14), %rdx
	jmp .L2
	; ... nops for alignment
.L1:
	leaq 1(%rdx), %rdx
	movabsq $EG(vm_interrupt), %rsi
	movb (%rsi), %sil
	testb %sil, %sil
	jne jit$$trace_exit_5
.L2:
	cmpq %rax, %rdx
	jge jit$$trace_exit_3
	addq %rdx, %rcx
	jno .L1
	subq %rdx, %rcx
	jmp jit$$trace_exit_4
```

Notice how the addition now no longer needs extra moves and how the
result is kept in %rcx all the time. The cold path under `jno` restores
the old value right before jumping to the trace exit.
---
 ext/opcache/jit/zend_jit_ir.c | 41 +++++++++++++++++++++++++++++++----
 1 file changed, 37 insertions(+), 4 deletions(-)

diff --git a/ext/opcache/jit/zend_jit_ir.c b/ext/opcache/jit/zend_jit_ir.c
index c7716eb96ff8..2da9978a00ce 100644
--- a/ext/opcache/jit/zend_jit_ir.c
+++ b/ext/opcache/jit/zend_jit_ir.c
@@ -5114,15 +5114,48 @@ static int zend_jit_math_long_long(zend_jit_ctx   *jit,
 					SET_STACK_REF(stack, EX_VAR_TO_NUM(opline->result.var), ir_CONST_DOUBLE((double)ZEND_LONG_MIN - 1.0));
 					exit_point = zend_jit_trace_get_exit_point(opline + 1, 0);
 					SET_STACK_INFO(stack, EX_VAR_TO_NUM(opline->result.var), old_res_info);
+				} else if ((op == IR_ADD_OV || op == IR_SUB_OV) && !same_ops && Z_MODE(op1_addr) == IS_REG) {
+					/* Undo the operation on the cold path for deoptimization,
+					 * instead of keeping op1 alive across it.
+					 * This allows reusing its register for the result. */
+					uint32_t op1_var = EX_VAR_TO_NUM(opline->op1.var);
+					ir_ref old_ref = STACK_REF(stack, op1_var);
+
+					ir_ref if_ov = ir_IF(ir_OVERFLOW(ref));
+					ir_IF_TRUE_cold(if_ov);
+
+					/* undo: opposite operation */
+					ir_ref old_op1;
+					if (op == IR_ADD_OV) {
+						old_op1 = ir_SUB_L(ref, op2);
+					} else {
+						old_op1 = ir_ADD_L(ref, op2);
+					}
+
+					SET_STACK_REF_EX(stack, op1_var, old_op1, STACK_FLAGS(stack, op1_var));
+
+					exit_point = zend_jit_trace_get_exit_point(opline, 0);
+					exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+					if (!exit_addr) {
+						return 0;
+					}
+					jit_SIDE_EXIT(jit, ir_CONST_ADDR(exit_addr));
+
+					/* After the snapshot is built. */
+					SET_STACK_REF_EX(stack, op1_var, old_ref, STACK_FLAGS(stack, op1_var));
+					ir_IF_FALSE(if_ov);
+					exit_point = -1;
 				} else {
 					exit_point = zend_jit_trace_get_exit_point(opline, 0);
 				}
 
-				exit_addr = zend_jit_trace_get_exit_addr(exit_point);
-				if (!exit_addr) {
-					return 0;
+				if (exit_point >= 0) {
+					exit_addr = zend_jit_trace_get_exit_addr(exit_point);
+					if (!exit_addr) {
+						return 0;
+					}
+					ir_GUARD_NOT(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));
 				}
-				ir_GUARD_NOT(ir_OVERFLOW(ref), ir_CONST_ADDR(exit_addr));
 				may_overflow = 0;
 			} else if ((res_info & MAY_BE_ANY) == MAY_BE_DOUBLE) {
 				int32_t exit_point = zend_jit_trace_get_exit_point(opline, 0);