Perf: cache function-body intervals in PropertyHooks (101x on lib/VM.php) (#23056)

[PurHur]

Second of the two quadratic scans identified in #23056.

Why

isInsideFunctionBody() decides whether $var = … is a local inside a method body or a hooked property declaration. findNextPropertyHookDecl probes every $var occurrence, and each probe walked backwards to byte 0 and took substr($body, 0, $i) on the way — O(vars × body) with an O(body) copy per probe.

It was 32% of the gen-0 rebuild profile once the php-cfg simplifier hotspot was removed (212 of 671 samples across isInsideFunctionBody / offsetInNonCodeContext / isPromotedConstructorParamVar).

What

The same remedy already applied to isOffsetInComment immediately beside it: scan the body once into sorted disjoint intervals, then binary search.

Measured on lib/VM.php:

probes	legacy	cached
3,000	0.78s	0.38s
19,778 (every $var in the file)	37.51s	0.37s

Legacy grows ~quadratically — 6.6× the probes costs 48× the time. Cached is flat: the one-time build dominates and lookups are O(log intervals).

The build is cheaper than the scan it replaces because braces are ~0.2× as common as $ probes (lib/VM.php 3538 vs 19778; lib/Compiler.php 10361 vs 51153), so the per-brace prefix work happens ~5× less often — and once per body rather than once per probe. I checked that ratio before writing it, because if braces outnumbered probes the "fix" would have been slower.

Correctness

This runs during source preprocessing, so a behaviour change alters how every file in the project parses. Speed is worthless if the answer moves, so it is verified by differential test rather than by inspection:

phpunit --filter PropertyHooksFunctionBodyCacheTest
OK (7 tests, 3916 assertions)

comparing cached against legacy at every $var offset across lib/VM.php, lib/Compiler.php, lib/JIT/Context.php, PropertyHooks.php and PackJitHelper.php; at every brace-adjacent offset (where an off-by-one would hide); and across class-body / method-body / nested-block / closure / return-type / by-ref / no-brace shapes.

Semantics are preserved exactly, including the subtle part: only the innermost enclosing brace counts, so a nested block inside a method reads as not inside a function body. The interval builder replicates the backward scan's boundary rule — the state established by the brace at p governs offsets [p+1, nextBracePos]. It is a raw byte scan like the original, so braces inside strings and comments confuse both equally; behaviour is preserved, not improved.

PHP_COMPILER_FUNCTION_BODY_SCAN_LEGACY=1 restores the old scan.

Not in scope

The other half of #23056 — PHPCFG_SIMPLIFIER_USECHAIN (~3× on bootstrap compiles) — needs codegen-equivalence validation before it can be switched on for compile, since replacement order is observable in phi operand types. That one is a bigger piece of work and is deliberately untouched here.

🤖 Generated with Claude Code

[PurHur]

Maintainer verify (2026-07-25): vendor/bin/phpunit --filter PropertyHooksFunctionBodyCacheTest → OK (7 tests, 3916 assertions). Differential cache vs legacy looks correct; legacy env gate retained. Merging.