php-cfg support variable variable names

currently php-cfg produces an error when it encounters a variable variable name bacause of line 63: assert($var->name instanceof Literal);

Jan 03 '25 12:01 eric-therond

@nikic can I improve something on this PR ?

Jan 15 '25 11:01 eric-therond

Hi @nikic Do you have time to look at this PR? variable variable name are common and today the printer throws a fatal error when it encounters one. This is a significant limitation for the printer and I would like to fix this behavior.

Mar 15 '25 13:03 eric-therond

I don't think that something like var: Var#10<Var#11<Var#12<Var#13<Var#14<Var#15<$a>>>>>> is a sensible representation for variable variables. We should be generating a separate operation the looks up a variable by name. The result won't be accurate either (varvars are not really compatible with the SSA form this library uses), but be somewhat more reasonable at least.

Mar 15 '25 21:03 nikic

thanks for your feedback I tried to implement that in the last commit

Mar 16 '25 17:03 eric-therond

One thing I am curious about. For analysis purposes, a var-var read could (should?) be modeled as a special-case PHI op with an input of all named variables at that point. A var-var write would need to be a special case PHI as well, but has an additional complication of also writing essentially every variable as well (so more specifically, a set of PHI nodes for each named variables in-scope at that point in time…)?

It would def increase the complexity, but would it make it more semantically correct from an analysis standpoint?

Mar 16 '25 21:03 ircmaxell

@ircmaxell Yes, that would be the semantically accurate modelling. I'm not sure modelling this in full accuracy (rather than just "don't crash" and "make it easy to detect") is going to be particularly useful though. In much the same way the current modelling of assignment is incorrect wrt references.

Mar 16 '25 21:03 nikic