Matt BrownJul 12, 2025
One unambiguously good thing PHP project could would be to port the parser to Rust, which would unlock the potential for lightning-fast static analysis. Right now anyone venturing into a PHP-specific compiled language tooling has to also write and maintain their own parser, which is out of reach of basically everyone except JetBrains.
Show threadGina Peter BanyardJul 13, 2025

@mattbrowndev I mean, I don't really understand our YACC parser, but I think the main aversion is that we would require a new toolchain which is less "common" and doesn't support all architectures (because people smh use PHP on embedded devices)

But I think that would be neat, I know @pollita was at one point playing around with Rust to make a PHP parser.

Show threadSara GolemonJul 13, 2025

@Girgias @mattbrowndev

I did take a whack at this recently, but grmtools was immature and I couldn't find anything better.

I invite anyone who'd like to prove (a) that it's significantly faster to justify having an additional compile complexity, and (b) that it's doable at all.

Show threadMatt BrownJul 13, 2025
@pollita @Girgias yeah I don’t think there’s a speed boost to be had — it’s more about the potential speed improvements for tooling (e.g. my all-Rust tool can analyse Hack code 7x faster than similar tooling written in PHP). That speedup would only be important for codebases > 100KLOC though, and given the tools don’t exist it’s a purely theoretical improvement.
Show threadGina Peter BanyardJul 13, 2025

@mattbrowndev @pollita Mago which is a new SA tool written by @azjezz in Rust is incredibly speedy.

I think they plan to release the analyser as an individual crate.

Show threadMatt BrownJul 14, 2025
@Girgias @pollita @[email protected] though that gets into the other issue, that PHP static analysis is tricky due to magic methods, which traditionally (aka since we started creating SA tools) has been handled with custom PHP extensions performing dynamic reflection. A pure static analysis tool would not be a fit for how PHP is used at most places.
Show threadGina Peter BanyardJul 14, 2025
@mattbrowndev @pollita magic methods are truly the bane of existence 😔
Show threadMatt BrownJul 14, 2025
@Girgias @pollita could the runtime be made measurably faster in configurable switch turning off magic methods in php.ini?
Show threadGina Peter BanyardJul 14, 2025

@mattbrowndev @pollita the only problematic ones would be the get/set/isset/unset methods and possibly the trampoline ones with call/callStatic, or am I missing others?

However I don't think there would be a lot of performance improvements as our inference is quite bad regardless due to "only see one file at a time". I know the JIT helps with that as it has a better picture from what @nielsdos told me.

Show threadMatt BrownJul 14, 2025
@Girgias @pollita @nielsdos ah right the HHBC compilation that Hack does is great but would be a whole other piece of work
Show threadSara Golemon
@mattbrowndev @Girgias @nielsdos I mean... would there be value in just exposing the AST? Then you get PHP's native parser, and you just need to di your analysis walking that tree. There are at least two extensions which do this already.
Jul 14, 2025 at 1:56amWeb
Show threadMatt BrownJul 14, 2025
@pollita @Girgias @nielsdos php-src’s native parser doesn’t currently capture column information, only line number, which means its output can’t be used for things like language servers. PHP _could_ choose @ilutov’s idea of storing line and column in the same field while restricting max lines to ~1B per file: https://github.com/php/php-src/issues/11391#issuecomment-1580718857
Impl. `ReflectionFunctionAbstract::getStartColumn` (and getEndColumn) · Issue #11391 · php/php-src

Description Currently only line can be obtained by reflection. AFAK this limitation is comming from AST as only line and no column is stored to save memory. I cannot tell if storing file column is ...

GitHub
Show threadIlija ToviloJul 17, 2025
@pollita @mattbrowndev @Girgias @nielsdos Right, that's nikic/php-ast, effectively. The main downside being that it's not fault-tolerant (which I believe nikic/PHP-Parser is to a degree), and also not backwards compatible with older PHP syntax.