Multiplication operand order

Description

In reference to #3735, I'm struggling with a very similar problem. I'm working on a GL math extension and have encountered a roadblock with matrix multiplication.

As @weltling pointed out, the order is critical, and I can see that this commit https://github.com/php/php-src/commit/1165a9068cbf3c3c24a78b47e0effcf9b90ec5bc removed ZEND_MUL from one of the optimizer passes. I'm not 100% certain the swapping occurs in the optimizer as I ran into the swapped arguments also with the opcache turned off and opcache.optimization_level=0x00000000.

The extension utilizes the do_operation handler. Here is example code to explain myself better.

The problem only occurs when multiplying three or more objects in one expression.

<?php 
use GL\Math\Mat4;

$m1 = new Mat4(
  1,  2,  3,  4,
  5,  6,  7,  8,
  9,  10, 11, 12,
  13, 14, 15, 16
);
$m2 = new Mat4(
  16, 15, 14, 13, 
  12, 11, 10,  9, 
   8,  7,  6,  5, 
   4,  3,  2,  1
);
$m3 = new Mat4(
  0.16, 0.15, 0.14, 0.13, 
  0.12, 0.11, 0.10, 0.90, 
  0.80, 0.70, 0.60, 0.50, 
  0.40, 0.30, 0.20, 0.10
);


// works fine, correct order
var_dump($m1 * $m2); 

// incorrect result, order of execution is:
// logged: MUL(tmp_res, $m1 * $m2), MUL(returnval, $m3 * tmp_res)
// expected: MUL(tmp_res, $m1 * $m2), MUL(returnval, tmp_res * $m3)
var_dump($m1 * $m2 * $m3); 

// you can workaround using parenthesis
// logged: MUL(tmp_res, $m2 * $m3), MUL(returnval, $m1 * tmp_res)
var_dump($m1 * ($m2 * $m3)); 

// but for the expected result it should not matter where parenthesis are set and the order should be fixed.

I've tried to look for workarounds by somehow detecting when and if they have been swapped but have had no luck yet.

I gladly open a pull request if this requires some work in php-src itself, but I would kindly ask for some hints and direction on where this might happen.

// the operation handler implementation (striped down)
static int math_mat4_do_op_handler(zend_uchar opcode, zval *result, zval *op1, zval *op2)
{
    object_init_ex(result, math_mat4_ce);
    math_mat4_object *resobj = math_mat4_objectptr_from_zobj_p(Z_OBJ_P(result));

    if (
        Z_TYPE_P(op1) == IS_OBJECT && Z_OBJCE_P(op1) == math_mat4_ce &&
        Z_TYPE_P(op2) == IS_OBJECT && Z_OBJCE_P(op2) == math_mat4_ce    ) 
    {
        math_mat4_object *matobj1 = math_mat4_objectptr_from_zobj_p(Z_OBJ_P(op1));
        math_mat4_object *matobj2 = math_mat4_objectptr_from_zobj_p(Z_OBJ_P(op2));

        switch (opcode) {
        case ZEND_MUL:
            mat4x4_mul(resobj->data, matobj1->data, matobj2->data);
            return SUCCESS;
        default:
            return FAILURE;
        }
    }
    else {
        return FAILURE;
    }
}

Kind regards Mario

PHP Version

PHP 8.1.5

Operating System

MacOS 12.4

从报告中展示的 do_operation 处理程序及其 ZEND_MUL 路径开始，然后跟踪在禁用 OPcache 的情况下链式乘法是如何分派的。完成标准是：三个对象的乘法保持从左到右的操作数顺序，并且带括号和不带括号的表达式产生预期的等效结果。