Multiplication operand order

Description

In reference to #3735, I'm struggling with a very similar problem. I'm working on a GL math extension and have encountered a roadblock with matrix multiplication.

As @weltling pointed out, the order is critical, and I can see that this commit https://github.com/php/php-src/commit/1165a9068cbf3c3c24a78b47e0effcf9b90ec5bc removed ZEND_MUL from one of the optimizer passes. I'm not 100% certain the swapping occurs in the optimizer as I ran into the swapped arguments also with the opcache turned off and opcache.optimization_level=0x00000000.

The extension utilizes the do_operation handler. Here is example code to explain myself better.

The problem only occurs when multiplying three or more objects in one expression.

<?php 
use GL\Math\Mat4;

$m1 = new Mat4(
  1,  2,  3,  4,
  5,  6,  7,  8,
  9,  10, 11, 12,
  13, 14, 15, 16
);
$m2 = new Mat4(
  16, 15, 14, 13, 
  12, 11, 10,  9, 
   8,  7,  6,  5, 
   4,  3,  2,  1
);
$m3 = new Mat4(
  0.16, 0.15, 0.14, 0.13, 
  0.12, 0.11, 0.10, 0.90, 
  0.80, 0.70, 0.60, 0.50, 
  0.40, 0.30, 0.20, 0.10
);


// works fine, correct order
var_dump($m1 * $m2); 

// incorrect result, order of execution is:
// logged: MUL(tmp_res, $m1 * $m2), MUL(returnval, $m3 * tmp_res)
// expected: MUL(tmp_res, $m1 * $m2), MUL(returnval, tmp_res * $m3)
var_dump($m1 * $m2 * $m3); 

// you can workaround using parenthesis
// logged: MUL(tmp_res, $m2 * $m3), MUL(returnval, $m1 * tmp_res)
var_dump($m1 * ($m2 * $m3)); 

// but for the expected result it should not matter where parenthesis are set and the order should be fixed.

I've tried to look for workarounds by somehow detecting when and if they have been swapped but have had no luck yet.

I gladly open a pull request if this requires some work in php-src itself, but I would kindly ask for some hints and direction on where this might happen.

// the operation handler implementation (striped down)
static int math_mat4_do_op_handler(zend_uchar opcode, zval *result, zval *op1, zval *op2)
{
    object_init_ex(result, math_mat4_ce);
    math_mat4_object *resobj = math_mat4_objectptr_from_zobj_p(Z_OBJ_P(result));

    if (
        Z_TYPE_P(op1) == IS_OBJECT && Z_OBJCE_P(op1) == math_mat4_ce &&
        Z_TYPE_P(op2) == IS_OBJECT && Z_OBJCE_P(op2) == math_mat4_ce    ) 
    {
        math_mat4_object *matobj1 = math_mat4_objectptr_from_zobj_p(Z_OBJ_P(op1));
        math_mat4_object *matobj2 = math_mat4_objectptr_from_zobj_p(Z_OBJ_P(op2));

        switch (opcode) {
        case ZEND_MUL:
            mat4x4_mul(resobj->data, matobj1->data, matobj2->data);
            return SUCCESS;
        default:
            return FAILURE;
        }
    }
    else {
        return FAILURE;
    }
}

Kind regards Mario

PHP Version

PHP 8.1.5

Operating System

MacOS 12.4

レポートに示されている do_operation ハンドラーとその ZEND_MUL パスから始め、OPcache を無効にした状態で連鎖した乗算がどのようにディスパッチされるかを追跡します。3 つのオブジェクトの乗算で左から右へのオペランド順序が維持され、括弧付きおよび括弧なしの式が期待される同等の結果を生成すれば完了です。