//-------------------------------------------------------------------------------------------------------

// Copyright (C) Microsoft. All rights reserved.

// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.

//-------------------------------------------------------------------------------------------------------

#include "Backend.h"

#include "Library/ForInObjectEnumerator.h"

#pragma prefast(push)

#pragma prefast(disable:28652, "Prefast complains that the OR are causing the compiler to emit dynamic initializers and the variable to be allocated in read/write mem...")

static const IR::BailOutKind c_debuggerBailOutKindForCall =

IR::BailOutForceByFlag | IR::BailOutStackFrameBase | IR::BailOutBreakPointInFunction | IR::BailOutLocalValueChanged | IR::BailOutIgnoreException | IR::BailOutStep;

static const IR::BailOutKind c_debuggerBaseBailOutKindForHelper = IR::BailOutIgnoreException | IR::BailOutForceByFlag;

#pragma prefast(pop)

uint

IRBuilder::AddStatementBoundary(uint statementIndex, uint offset)

{

// Under debugger we use full stmt map, so that we know exactly start and end of each user stmt.

// We insert additional instrs in between statements, such as ProfiledLoopStart, for these bytecode reader acts as

// there is "unknown" stmt boundary with statementIndex == -1. Don't add stmt boundary for that as later

// it may cause issues, e.g. see WinBlue 218307.

if (!(statementIndex == Js::Constants::NoStatementIndex && this->m_func->IsJitInDebugMode()))

{

IR::PragmaInstr* pragmaInstr = IR::PragmaInstr::New(Js::OpCode::StatementBoundary, statementIndex, m_func);

this->AddInstr(pragmaInstr, offset);

}

#ifdef BAILOUT_INJECTION

if (!this->m_func->IsOOPJIT())

{

// Don't inject bailout if the function have trys

if (!this->m_func->GetTopFunc()->HasTry() && (statementIndex != Js::Constants::NoStatementIndex))

{

if (Js::Configuration::Global.flags.IsEnabled(Js::BailOutFlag) && !this->m_func->GetJITFunctionBody()->IsLibraryCode())

{

ULONG line;

LONG col;

// Since we're on a separate thread, don't allow the line cache to be allocated in the Recycler.

if (((Js::FunctionBody*)m_func->GetJITFunctionBody()->GetAddr())->GetLineCharOffset(this->m_jnReader.GetCurrentOffset(), &line, &col, false /*canAllocateLineCache*/))

{

line++;

if (Js::Configuration::Global.flags.BailOut.Contains(line, (uint32)col) || Js::Configuration::Global.flags.BailOut.Contains(line, (uint32)-1))

{

this->InjectBailOut(offset);

}

}

}

else if (Js::Configuration::Global.flags.IsEnabled(Js::BailOutAtEveryLineFlag))

{

this->InjectBailOut(offset);

}

}

}

#endif

return m_statementReader.MoveNextStatementBoundary();

}

// Add conditional bailout for breaking into interpreter debug thunk - for fast F12.

void

IRBuilder::InsertBailOutForDebugger(uint byteCodeOffset, IR::BailOutKind kind, IR::Instr* insertBeforeInstr /* default nullptr */)

{

Assert(m_func->IsJitInDebugMode());

Assert(byteCodeOffset != Js::Constants::NoByteCodeOffset);

BailOutInfo * bailOutInfo = JitAnew(m_func->m_alloc, BailOutInfo, byteCodeOffset, m_func);

IR::BailOutInstr * instr = IR::BailOutInstr::New(Js::OpCode::BailForDebugger, kind, bailOutInfo, bailOutInfo->bailOutFunc);

if (insertBeforeInstr)

{

InsertInstr(instr, insertBeforeInstr);

}

else

{

this->AddInstr(instr, m_lastInstr->GetByteCodeOffset());

}

}

bool

IRBuilder::DoBailOnNoProfile()

{

if (PHASE_OFF(Js::BailOnNoProfilePhase, this->m_func->GetTopFunc()))

{

return false;

}

Func *const topFunc = m_func->GetTopFunc();

if(topFunc->GetWorkItem()->GetProfiledIterations() == 0)

{

// The top function has not been profiled yet. Some switch must have been used to force jitting. This is not a

// real-world case, but for the purpose of testing the JIT, it's beneficial to generate code in unprofiled paths.

return false;

}

if (m_func->HasProfileInfo() && m_func->GetReadOnlyProfileInfo()->IsNoProfileBailoutsDisabled())

{

return false;

}

if (!m_func->DoGlobOpt())

{

return false;

}

#ifdef ENABLE_DEBUG_CONFIG_OPTIONS

if (this->m_func->GetTopFunc() != this->m_func && Js::Configuration::Global.flags.IsEnabled(Js::ForceJITLoopBodyFlag))

{

// No profile data for loop bodies with -force...

return false;

}

#endif

if (!this->m_func->HasProfileInfo())

{

return false;

}

return true;

}

void

IRBuilder::InsertBailOnNoProfile(uint offset)

{

Assert(DoBailOnNoProfile());

if (this->callTreeHasSomeProfileInfo)

{

return;

}

IR::Instr *startCall = nullptr;

int count = 0;

FOREACH_SLIST_ENTRY(IR::Instr *, argInstr, this->m_argStack)

{

if (argInstr->m_opcode == Js::OpCode::StartCall)

{

startCall = argInstr;

count++;

if (count > 1)

{

return;

}

}

} NEXT_SLIST_ENTRY;

AnalysisAssert(startCall);

if (startCall->m_prev->m_opcode != Js::OpCode::BailOnNoProfile)

{

InsertBailOnNoProfile(startCall);

}

}

void IRBuilder::InsertBailOnNoProfile(IR::Instr *const insertBeforeInstr)

{

Assert(DoBailOnNoProfile());

IR::Instr *const bailOnNoProfileInstr = IR::Instr::New(Js::OpCode::BailOnNoProfile, m_func);

InsertInstr(bailOnNoProfileInstr, insertBeforeInstr);

}

#ifdef BAILOUT_INJECTION

void

IRBuilder::InjectBailOut(uint offset)

{

if(m_func->IsSimpleJit())

{

return; // bailout injection is only applicable to full JIT

}

IR::IntConstOpnd * opnd = IR::IntConstOpnd::New(0, TyInt32, m_func);

uint bailOutOffset = offset;

if (bailOutOffset == Js::Constants::NoByteCodeOffset)

{

bailOutOffset = m_lastInstr->GetByteCodeOffset();

}

BailOutInfo * bailOutInfo = JitAnew(m_func->m_alloc, BailOutInfo, bailOutOffset, m_func);

IR::BailOutInstr * instr = IR::BailOutInstr::New(Js::OpCode::BailOnEqual, IR::BailOutInjected, bailOutInfo, bailOutInfo->bailOutFunc);

instr->SetSrc1(opnd);

instr->SetSrc2(opnd);

this->AddInstr(instr, offset);

}

void

IRBuilder::CheckBailOutInjection(Js::OpCode opcode)

{

// Detect these sequence and disable Bailout injection between them:

// LdStackArgPtr

// LdArgCnt

// ApplyArgs

// This assumes that LdStackArgPtr, LdArgCnt and ApplyArgs can

// only be emitted in these sequence. This will need to be modified if it changes.

//

// Also insert a single bailout before the beginning of a switch case block for all the case labels.

switch(opcode)

{

case Js::OpCode::LdStackArgPtr:

Assert(!seenLdStackArgPtr);

Assert(!expectApplyArg);

seenLdStackArgPtr = true;

break;

case Js::OpCode::LdArgCnt:

Assert(seenLdStackArgPtr);

Assert(!expectApplyArg);

expectApplyArg = true;

break;

case Js::OpCode::ApplyArgs:

Assert(seenLdStackArgPtr);

Assert(expectApplyArg);

seenLdStackArgPtr = false;

expectApplyArg = false;

break;

case Js::OpCode::BeginSwitch:

case Js::OpCode::ProfiledBeginSwitch:

Assert(!seenProfiledBeginSwitch);

seenProfiledBeginSwitch = true;

break;

case Js::OpCode::EndSwitch:

Assert(seenProfiledBeginSwitch);

seenProfiledBeginSwitch = false;

break;

default:

Assert(!seenLdStackArgPtr);

Assert(!expectApplyArg);

break;

}

}

#endif

bool

IRBuilder::IsLoopBody() const

{

return m_func->IsLoopBody();

}

bool

IRBuilder::IsLoopBodyInTry() const

{

return m_func->IsLoopBodyInTry();

}

bool

IRBuilder::IsLoopBodyReturnIPInstr(IR::Instr * instr) const

{

IR::Opnd * dst = instr->GetDst();

return (dst && dst->IsRegOpnd() && dst->AsRegOpnd()->m_sym == m_loopBodyRetIPSym);

}

bool

IRBuilder::IsLoopBodyOuterOffset(uint offset) const

{

if (!IsLoopBody())

{

return false;

}

return (offset >= m_func->m_workItem->GetLoopHeader()->endOffset || offset < m_func->m_workItem->GetLoopHeader()->startOffset);

}

uint

IRBuilder::GetLoopBodyExitInstrOffset() const

{

// End of loop body, start of StSlot and Ret instruction at endOffset + 1

return m_func->m_workItem->GetLoopHeader()->endOffset + 1;

}

Js::RegSlot

IRBuilder::GetEnvReg() const

{

return m_func->GetJITFunctionBody()->GetEnvReg();

}

Js::RegSlot

IRBuilder::GetEnvRegForInnerFrameDisplay() const

{

Js::RegSlot envReg = m_func->GetJITFunctionBody()->GetLocalFrameDisplayReg();

if (envReg == Js::Constants::NoRegister)

{

envReg = this->GetEnvReg();

}

return envReg;

}

void

IRBuilder::AddEnvOpndForInnerFrameDisplay(IR::Instr *instr, uint offset)

{

Js::RegSlot envReg = this->GetEnvRegForInnerFrameDisplay();

if (envReg != Js::Constants::NoRegister)

{

IR::RegOpnd *src2Opnd;

if (envReg == m_func->GetJITFunctionBody()->GetLocalFrameDisplayReg() &&

m_func->DoStackFrameDisplay() &&

m_func->IsTopFunc())

{

src2Opnd = IR::RegOpnd::New(TyVar, m_func);

this->AddInstr(

IR::Instr::New(

Js::OpCode::LdSlot, src2Opnd,

this->BuildFieldOpnd(Js::OpCode::LdSlot, m_func->GetLocalFrameDisplaySym()->m_id, 0, (Js::PropertyIdIndexType)-1, PropertyKindSlots),

m_func),

offset);

}

else

{

src2Opnd = this->BuildSrcOpnd(envReg);

}

instr->SetSrc2(src2Opnd);

}

}

bool

IRBuilder::DoSlotArrayCheck(IR::SymOpnd *fieldOpnd, bool doDynamicCheck)

{

if (PHASE_OFF(Js::ClosureRangeCheckPhase, m_func))

{

return true;

}

PropertySym *propertySym = fieldOpnd->m_sym->AsPropertySym();

IR::Instr *instrDef = propertySym->m_stackSym->m_instrDef;

IR::Opnd *allocOpnd = nullptr;

if (instrDef == nullptr)

{

if (doDynamicCheck)

{

return false;

}

Js::Throw::FatalInternalError();

}

switch(instrDef->m_opcode)

{

case Js::OpCode::NewScopeSlots:

case Js::OpCode::NewStackScopeSlots:

case Js::OpCode::NewScopeSlotsWithoutPropIds:

allocOpnd = instrDef->GetSrc1();

break;

case Js::OpCode::LdSlot:

case Js::OpCode::LdSlotArr:

if (doDynamicCheck)

{

return false;

}

// fall through

default:

Js::Throw::FatalInternalError();

}

uint32 allocCount = allocOpnd->AsIntConstOpnd()->AsUint32();

uint32 slotId = (uint32)propertySym->m_propertyId;

if (slotId >= allocCount)

{

Js::Throw::FatalInternalError();

}

return true;

}

///----------------------------------------------------------------------------

///

/// IRBuilder::Build

///

/// IRBuilder main entry point. Read the bytecode for this function and

/// generate IR.

///

///----------------------------------------------------------------------------

void

IRBuilder::Build()

{

m_funcAlloc = m_func->m_alloc;

NoRecoverMemoryJitArenaAllocator localAlloc(_u("BE-IRBuilder"), m_funcAlloc->GetPageAllocator(), Js::Throw::OutOfMemory);

m_tempAlloc = &localAlloc;

uint32 offset;

uint32 statementIndex = m_statementReader.GetStatementIndex();

m_argStack = JitAnew(m_tempAlloc, SList<IR::Instr *>, m_tempAlloc);

this->branchRelocList = JitAnew(m_tempAlloc, SList<BranchReloc *>, m_tempAlloc);

Func * topFunc = this->m_func->GetTopFunc();

if (topFunc->HasTry() &&

((!topFunc->IsLoopBody() && !PHASE_OFF(Js::OptimizeTryCatchPhase, topFunc)) ||

(topFunc->HasFinally() && !topFunc->IsLoopBody() && !PHASE_OFF(Js::OptimizeTryFinallyPhase, topFunc)) ||

(topFunc->IsSimpleJit() && topFunc->GetJITFunctionBody()->DoJITLoopBody()) || // should be relaxed as more bailouts are added in Simple Jit

topFunc->IsLoopBodyInTryFinally())) // We need accurate flow when we are full jitting loop bodies which have try finally

{

this->handlerOffsetStack = JitAnew(m_tempAlloc, SList<handlerStackElementType>, m_tempAlloc);

}

this->firstTemp = m_func->GetJITFunctionBody()->GetFirstTmpReg();

Js::RegSlot tempCount = m_func->GetJITFunctionBody()->GetTempCount();

if (tempCount > 0)

{

this->tempMap = AnewArrayZ(m_tempAlloc, SymID, tempCount);

this->fbvTempUsed = BVFixed::New<JitArenaAllocator>(tempCount, m_tempAlloc);

}

else

{

this->tempMap = nullptr;

this->fbvTempUsed = nullptr;

}

m_func->m_headInstr = IR::EntryInstr::New(Js::OpCode::FunctionEntry, m_func);

m_func->m_exitInstr = IR::ExitInstr::New(Js::OpCode::FunctionExit, m_func);

m_func->m_tailInstr = m_func->m_exitInstr;

m_func->m_headInstr->InsertAfter(m_func->m_tailInstr);

if (m_func->GetJITFunctionBody()->IsParamAndBodyScopeMerged() || this->IsLoopBody())

{

this->SetParamScopeDone();

}

if (m_func->GetJITFunctionBody()->GetLocalClosureReg() != Js::Constants::NoRegister)

{

m_func->InitLocalClosureSyms();

}

m_functionStartOffset = m_jnReader.GetCurrentOffset();

m_lastInstr = m_func->m_headInstr;

AssertMsg(sizeof(SymID) >= sizeof(Js::RegSlot), "sizeof(SymID) != sizeof(Js::RegSlot)!!");

// Skip the last EndOfBlock opcode

Assert(!OpCodeAttr::HasMultiSizeLayout(Js::OpCode::EndOfBlock));

uint32 lastOffset = m_func->GetJITFunctionBody()->GetByteCodeLength() - Js::OpCodeUtil::EncodedSize(Js::OpCode::EndOfBlock, Js::SmallLayout);

uint32 offsetToInstructionCount = lastOffset;

if (this->IsLoopBody())

{

// LdSlot needs to cover all the register, including the temps, because we might treat

// those as if they are local for the value of the with statement

this->m_ldSlots = BVFixed::New<JitArenaAllocator>(m_func->GetJITFunctionBody()->GetLocalsCount(), m_tempAlloc);

this->m_stSlots = BVFixed::New<JitArenaAllocator>(m_func->GetJITFunctionBody()->GetFirstTmpReg(), m_tempAlloc);

this->m_loopBodyRetIPSym = StackSym::New(TyMachReg, this->m_func);

#if DBG

if (m_func->GetJITFunctionBody()->GetTempCount() != 0)

{

this->m_usedAsTemp = BVFixed::New<JitArenaAllocator>(m_func->GetJITFunctionBody()->GetTempCount(), m_tempAlloc);

}

#endif

lastOffset = m_func->m_workItem->GetLoopHeader()->endOffset;

AssertOrFailFast(lastOffset < m_func->GetJITFunctionBody()->GetByteCodeLength());

// Ret is created at lastOffset + 1, so we need lastOffset + 2 entries

offsetToInstructionCount = lastOffset + 2;

// Compute the offset of the start of the locals array as a Var index.

size_t localsOffset = Js::InterpreterStackFrame::GetOffsetOfLocals();

Assert(localsOffset % sizeof(Js::Var) == 0);

this->m_loopBodyLocalsStartSlot = (Js::PropertyId)(localsOffset / sizeof(Js::Var));

}

m_offsetToInstructionCount = offsetToInstructionCount;

m_offsetToInstruction = JitAnewArrayZ(m_tempAlloc, IR::Instr *, offsetToInstructionCount);

#ifdef BYTECODE_BRANCH_ISLAND

longBranchMap = JitAnew(m_tempAlloc, LongBranchMap, m_tempAlloc);

#endif

m_switchBuilder.Init(m_func, m_tempAlloc, false);

this->LoadNativeCodeData();

this->BuildConstantLoads();

this->BuildGeneratorPreamble();

if (!this->IsLoopBody() && m_func->GetJITFunctionBody()->HasImplicitArgIns())

{

this->BuildImplicitArgIns();

}

if (!this->IsLoopBody() && m_func->GetJITFunctionBody()->HasRestParameter())

{

this->BuildArgInRest();

}

if (m_func->IsJitInDebugMode())

{

// This is first bailout in the function, the locals at stack have not initialized to undefined, so do not restore them.

this->InsertBailOutForDebugger(m_functionStartOffset, IR::BailOutForceByFlag | IR::BailOutBreakPointInFunction | IR::BailOutStep, nullptr);

}

#ifdef BAILOUT_INJECTION

// Start bailout inject after the constant and arg load. We don't bailout before that

IR::Instr * lastInstr = m_lastInstr;

#endif

offset = Js::Constants::NoByteCodeOffset;

if (!this->IsLoopBody())

{

IR::Instr *instr;

// Do the implicit operations LdEnv, NewScopeSlots, LdFrameDisplay, as indicated by function body attributes.

Js::RegSlot envReg = m_func->GetJITFunctionBody()->GetEnvReg();

if (envReg != Js::Constants::NoRegister && !this->RegIsConstant(envReg))

{

Js::OpCode newOpcode;

Js::RegSlot thisReg = m_func->GetJITFunctionBody()->GetThisRegForEventHandler();

IR::RegOpnd *srcOpnd = nullptr;

IR::RegOpnd *dstOpnd = nullptr;

if (thisReg != Js::Constants::NoRegister)

{

this->BuildArgIn0(offset, thisReg);

srcOpnd = BuildSrcOpnd(thisReg);

newOpcode = Js::OpCode::LdHandlerScope;

}

else

{

newOpcode = Js::OpCode::LdEnv;

}

dstOpnd = BuildDstOpnd(envReg);

instr = IR::Instr::New(newOpcode, dstOpnd, m_func);

if (srcOpnd)

{

instr->SetSrc1(srcOpnd);

}

if (dstOpnd->m_sym->m_isSingleDef)

{

dstOpnd->m_sym->m_isNotNumber = true;

}

this->AddInstr(instr, offset);

}

Js::RegSlot funcExprScopeReg = m_func->GetJITFunctionBody()->GetFuncExprScopeReg();

IR::RegOpnd *frameDisplayOpnd = nullptr;

if (funcExprScopeReg != Js::Constants::NoRegister)

{

IR::RegOpnd *funcExprScopeOpnd = BuildDstOpnd(funcExprScopeReg);

instr = IR::Instr::New(Js::OpCode::NewPseudoScope, funcExprScopeOpnd, m_func);

this->AddInstr(instr, offset);

}

Js::RegSlot closureReg = m_func->GetJITFunctionBody()->GetLocalClosureReg();

IR::RegOpnd *closureOpnd = nullptr;

if (closureReg != Js::Constants::NoRegister)

{

Assert(!this->RegIsConstant(closureReg));

if (m_func->DoStackScopeSlots())

{

closureOpnd = IR::RegOpnd::New(TyVar, m_func);

}

else

{

closureOpnd = this->BuildDstOpnd(closureReg);

}

if (m_func->GetJITFunctionBody()->HasScopeObject())

{

if (m_func->GetJITFunctionBody()->HasCachedScopePropIds())

{

this->BuildInitCachedScope(0, offset);

}

else

{

instr = IR::Instr::New(Js::OpCode::NewScopeObject, closureOpnd, m_func);

this->AddInstr(instr, offset);

}

}

else

{

Js::OpCode op =

m_func->DoStackScopeSlots() ? Js::OpCode::NewStackScopeSlots : Js::OpCode::NewScopeSlots;

uint size = m_func->GetJITFunctionBody()->IsParamAndBodyScopeMerged() ? m_func->GetJITFunctionBody()->GetScopeSlotArraySize() : m_func->GetJITFunctionBody()->GetParamScopeSlotArraySize();

IR::Opnd * srcOpnd = IR::IntConstOpnd::New(size + Js::ScopeSlots::FirstSlotIndex, TyUint32, m_func);

instr = IR::Instr::New(op, closureOpnd, srcOpnd, m_func);

this->AddInstr(instr, offset);

}

if (closureOpnd->m_sym->m_isSingleDef)

{

closureOpnd->m_sym->m_isNotNumber = true;

}

if (m_func->DoStackScopeSlots())

{

// Init the stack closure sym and use it to save the scope slot pointer.

this->AddInstr(

IR::Instr::New(

Js::OpCode::InitLocalClosure, this->BuildDstOpnd(m_func->GetLocalClosureSym()->m_id), m_func),

offset);

this->AddInstr(

IR::Instr::New(

Js::OpCode::StSlot,

this->BuildFieldOpnd(

Js::OpCode::StSlot, m_func->GetLocalClosureSym()->m_id, 0, (Js::PropertyIdIndexType)-1, PropertyKindSlots),

closureOpnd, m_func),

offset);

}

}

Js::RegSlot frameDisplayReg = m_func->GetJITFunctionBody()->GetLocalFrameDisplayReg();

if (frameDisplayReg != Js::Constants::NoRegister)

{

Assert(!this->RegIsConstant(frameDisplayReg));

Js::OpCode op = m_func->DoStackScopeSlots() ? Js::OpCode::NewStackFrameDisplay : Js::OpCode::LdFrameDisplay;

if (funcExprScopeReg != Js::Constants::NoRegister)

{

// Insert the function expression scope ahead of any enclosing scopes.

IR::RegOpnd * funcExprScopeOpnd = BuildSrcOpnd(funcExprScopeReg);

frameDisplayOpnd = closureReg != Js::Constants::NoRegister ? IR::RegOpnd::New(TyVar, m_func) : BuildDstOpnd(frameDisplayReg);

instr = IR::Instr::New(Js::OpCode::LdFrameDisplay, frameDisplayOpnd, funcExprScopeOpnd, m_func);

if (envReg != Js::Constants::NoRegister)

{

instr->SetSrc2(this->BuildSrcOpnd(envReg));

}

this->AddInstr(instr, (uint)-1);

}

if (closureReg != Js::Constants::NoRegister)

{

IR::RegOpnd *dstOpnd;

if (m_func->DoStackScopeSlots() && m_func->IsTopFunc())

{

dstOpnd = IR::RegOpnd::New(TyVar, m_func);

}

else

{

dstOpnd = this->BuildDstOpnd(frameDisplayReg);

}

instr = IR::Instr::New(op, dstOpnd, closureOpnd, m_func);

if (frameDisplayOpnd != nullptr)

{

// We're building on an intermediate LdFrameDisplay result.

instr->SetSrc2(frameDisplayOpnd);

}

else if (envReg != Js::Constants::NoRegister)

{

// We're building on the environment created by the enclosing function.

instr->SetSrc2(this->BuildSrcOpnd(envReg));

}

this->AddInstr(instr, offset);

if (dstOpnd->m_sym->m_isSingleDef)

{

dstOpnd->m_sym->m_isNotNumber = true;

}

if (m_func->DoStackFrameDisplay())

{

// Use the stack closure sym to save the frame display pointer.

this->AddInstr(

IR::Instr::New(

Js::OpCode::InitLocalClosure, this->BuildDstOpnd(m_func->GetLocalFrameDisplaySym()->m_id), m_func),

offset);

this->AddInstr(

IR::Instr::New(

Js::OpCode::StSlot,

this->BuildFieldOpnd(Js::OpCode::StSlot, m_func->GetLocalFrameDisplaySym()->m_id, 0, (Js::PropertyIdIndexType)-1, PropertyKindSlots),

dstOpnd, m_func),

offset);

}

}

}

}

offset = m_functionStartOffset;

if (m_statementReader.AtStatementBoundary(&m_jnReader))

{

statementIndex = this->AddStatementBoundary(statementIndex, offset);

}

// For label instr we can add bailout only after all labels were finalized. Put to list/add in the end.

JsUtil::BaseDictionary<IR::Instr*, int, JitArenaAllocator> ignoreExBranchInstrToOffsetMap(m_tempAlloc);

Js::LayoutSize layoutSize;

IR::Instr* lastProcessedInstrForJITLoopBody = m_func->m_headInstr;

for (Js::OpCode newOpcode = m_jnReader.ReadOp(layoutSize); (uint)m_jnReader.GetCurrentOffset() <= lastOffset; newOpcode = m_jnReader.ReadOp(layoutSize))

{

Assert(newOpcode != Js::OpCode::EndOfBlock);

#ifdef BAILOUT_INJECTION

if (!this->m_func->GetTopFunc()->HasTry()

#ifdef BYTECODE_BRANCH_ISLAND

&& newOpcode != Js::OpCode::BrLong // Don't inject bailout on BrLong as they are just redirecting to a different offset anyways

#endif

)

{

if (!this->m_func->IsOOPJIT())

{

if (!seenLdStackArgPtr && !seenProfiledBeginSwitch)

{

if (Js::Configuration::Global.flags.IsEnabled(Js::BailOutByteCodeFlag))

{

ThreadContext * threadContext = this->m_func->GetScriptContext()->GetThreadContext();

if (Js::Configuration::Global.flags.BailOutByteCode.Contains(threadContext->bailOutByteCodeLocationCount))

{

this->InjectBailOut(offset);

}

}

else if (Js::Configuration::Global.flags.IsEnabled(Js::BailOutAtEveryByteCodeFlag))

{

this->InjectBailOut(offset);

}

}

CheckBailOutInjection(newOpcode);

}

}

#endif

AssertOrFailFastMsg(Js::OpCodeUtil::IsValidByteCodeOpcode(newOpcode), "Error getting opcode from m_jnReader.Op()");

uint layoutAndSize = layoutSize * Js::OpLayoutType::Count + Js::OpCodeUtil::GetOpCodeLayout(newOpcode);

switch(layoutAndSize)

{

#define LAYOUT_TYPE(layout) \

case Js::OpLayoutType::layout: \

Assert(layoutSize == Js::SmallLayout); \

this->Build##layout(newOpcode, offset); \

break;

#define LAYOUT_TYPE_WMS(layout) \

case Js::SmallLayout * Js::OpLayoutType::Count + Js::OpLayoutType::layout: \

this->Build##layout<Js::SmallLayoutSizePolicy>(newOpcode, offset); \

break; \

case Js::MediumLayout * Js::OpLayoutType::Count + Js::OpLayoutType::layout: \

this->Build##layout<Js::MediumLayoutSizePolicy>(newOpcode, offset); \

break; \

case Js::LargeLayout * Js::OpLayoutType::Count + Js::OpLayoutType::layout: \

this->Build##layout<Js::LargeLayoutSizePolicy>(newOpcode, offset); \

break;

#include "ByteCode/LayoutTypes.h"

default:

AssertMsg(0, "Unimplemented layout");

break;

}

#ifdef BAILOUT_INJECTION

if (!this->m_func->IsOOPJIT())

{

if (!this->m_func->GetTopFunc()->HasTry() && Js::Configuration::Global.flags.IsEnabled(Js::BailOutByteCodeFlag))

{

ThreadContext * threadContext = this->m_func->GetScriptContext()->GetThreadContext();

if (lastInstr != m_lastInstr)

{

lastInstr = lastInstr->GetNextRealInstr();

if (lastInstr->HasBailOutInfo())

{

lastInstr = lastInstr->m_next;

}

lastInstr->bailOutByteCodeLocation = threadContext->bailOutByteCodeLocationCount;

lastInstr = m_lastInstr;

}

threadContext->bailOutByteCodeLocationCount++;

}

}

#endif

if (IsLoopBodyInTry() && lastProcessedInstrForJITLoopBody != m_lastInstr)

{

// traverse in backward so we get new/later value of given symId for storing instead of the earlier/stale

// symId value. m_stSlots is used to prevent multiple stores to the same symId.

FOREACH_INSTR_BACKWARD_EDITING_IN_RANGE(

instr,

instrPrev,

m_lastInstr,

lastProcessedInstrForJITLoopBody->m_next)

{

if (instr->GetDst() && instr->GetDst()->IsRegOpnd() && instr->GetDst()->GetStackSym()->HasByteCodeRegSlot())

{

StackSym * dstSym = instr->GetDst()->GetStackSym();

Js::RegSlot dstRegSlot = dstSym->GetByteCodeRegSlot();

if (!this->RegIsTemp(dstRegSlot) && !this->RegIsConstant(dstRegSlot))

{

SymID symId = dstSym->m_id;

if (this->m_stSlots->Test(symId))

{

// For jitted loop bodies that are in a try block, we consider any symbol that has a

// non-temp bytecode reg slot, to be write-through. Hence, generating StSlots at all

// defs for such symbols

IR::Instr * stSlot = this->GenerateLoopBodyStSlot(dstRegSlot);

AddInstr(stSlot, Js::Constants::NoByteCodeOffset);

this->m_stSlots->Clear(symId);

}

else

{

Assert(dstSym->m_isCatchObjectSym);

}

}

}

} NEXT_INSTR_BACKWARD_EDITING_IN_RANGE;

lastProcessedInstrForJITLoopBody = m_lastInstr;

}

offset = m_jnReader.GetCurrentOffset();

if (m_func->IsJitInDebugMode())

{

bool needBailoutForHelper = CONFIG_FLAG(EnableContinueAfterExceptionWrappersForHelpers) &&

(OpCodeAttr::NeedsPostOpDbgBailOut(newOpcode) ||

(m_lastInstr->m_opcode == Js::OpCode::CallHelper && m_lastInstr->GetSrc1() &&

HelperMethodAttributes::CanThrow(m_lastInstr->GetSrc1()->AsHelperCallOpnd()->m_fnHelper)));

if (needBailoutForHelper)

{

// Insert bailout after return from a helper call.

// For now use offset of next instr, when we get & ignore exception, we replace this with next statement offset.

if (m_lastInstr->IsBranchInstr())

{

// Debugger bailout on branches goes to different block which can become dead. Keep bailout with real instr.

// Can't convert to bailout at this time, can do that only after branches are finalized, remember for later.

ignoreExBranchInstrToOffsetMap.Add(m_lastInstr, offset);

}

else if (

m_lastInstr->m_opcode == Js::OpCode::Throw ||

m_lastInstr->m_opcode == Js::OpCode::RuntimeReferenceError ||

m_lastInstr->m_opcode == Js::OpCode::RuntimeTypeError)

{

uint32 lastInstrOffset = m_lastInstr->GetByteCodeOffset();

AssertOrFailFast(lastInstrOffset < m_offsetToInstructionCount);

#if DBG

__analysis_assume(lastInstrOffset < this->m_offsetToInstructionCount);

#endif

bool isLastInstrUpdateNeeded = m_offsetToInstruction[lastInstrOffset] == m_lastInstr;

BailOutInfo * bailOutInfo = JitAnew(this->m_func->m_alloc, BailOutInfo, offset, this->m_func);

m_lastInstr = m_lastInstr->ConvertToBailOutInstr(bailOutInfo, c_debuggerBaseBailOutKindForHelper, true);

if (isLastInstrUpdateNeeded)

{

m_offsetToInstruction[lastInstrOffset] = m_lastInstr;

}

}

else

{

IR::BailOutKind bailOutKind = c_debuggerBaseBailOutKindForHelper;

if (OpCodeAttr::HasImplicitCall(newOpcode) || OpCodeAttr::OpndHasImplicitCall(newOpcode))

{

// When we get out of e.g. valueOf called by a helper (e.g. Add_A) during stepping,

// we need to bail out to continue debugging calling function in interpreter,

// essentially this is similar to bail out on return from a method.

bailOutKind |= c_debuggerBailOutKindForCall;

}

this->InsertBailOutForDebugger(offset, bailOutKind);

}

}

}

while (m_statementReader.AtStatementBoundary(&m_jnReader))

{

statementIndex = this->AddStatementBoundary(statementIndex, offset);

}

}

if (Js::Constants::NoStatementIndex != statementIndex)

{

// If we are inside a user statement then create a trailing line pragma instruction

statementIndex = this->AddStatementBoundary(statementIndex, Js::Constants::NoByteCodeOffset);

}

if (IsLoopBody())

{

// Insert the LdSlot/StSlot and Ret

IR::Opnd * retOpnd = this->InsertLoopBodyReturnIPInstr(offset, offset);

// Restore and Ret are at the last offset + 1

GenerateLoopBodySlotAccesses(lastOffset + 1);

InsertDoneLoopBodyLoopCounter(lastOffset);

IR::Instr * retInstr = IR::Instr::New(Js::OpCode::Ret, m_func);

retInstr->SetSrc1(retOpnd);

this->AddInstr(retInstr, lastOffset + 1);

}

// Now fix up the targets for all the branches we've introduced.

InsertLabels();

Assert(!this->handlerOffsetStack || this->handlerOffsetStack->Empty());

// Insert bailout for ignore exception for labels, after all labels were finalized.

ignoreExBranchInstrToOffsetMap.Map([this](IR::Instr* instr, int byteCodeOffset) {

BailOutInfo * bailOutInfo = JitAnew(this->m_func->m_alloc, BailOutInfo, byteCodeOffset, this->m_func);

instr->ConvertToBailOutInstr(bailOutInfo, c_debuggerBaseBailOutKindForHelper, true);

});

// Now that we know whether the func is a leaf or not, decide whether we'll emit fast paths.

// Do this once and for all, per-func, since the source size on the ThreadContext will be

// changing while we JIT.

if (this->m_func->IsTopFunc())

{

this->m_func->SetDoFastPaths();

this->EmitClosureRangeChecks();

}

}

void

IRBuilder::EmitClosureRangeChecks()

{

// Emit closure range checks

if (m_func->slotArrayCheckTable)

{

// Local slot array checks, should only be necessary in jitted loop bodies.

FOREACH_HASHTABLE_ENTRY(uint32, bucket, m_func->slotArrayCheckTable)

{

uint32 slotId = bucket.element;

Assert(slotId != (uint32)-1 && slotId >= Js::ScopeSlots::FirstSlotIndex);

if (slotId > Js::ScopeSlots::FirstSlotIndex)

{

// Emit a SlotArrayCheck instruction, chained to the instruction (LdSlot) that defines the pointer.

StackSym *stackSym = m_func->m_symTable->FindStackSym(bucket.value);

Assert(stackSym && stackSym->m_instrDef);

IR::Instr *instrDef = stackSym->m_instrDef;

IR::Instr *insertInstr = instrDef->m_next;

IR::RegOpnd *dstOpnd = instrDef->UnlinkDst()->AsRegOpnd();

IR::Instr *instr = IR::Instr::New(Js::OpCode::SlotArrayCheck, dstOpnd, m_func);

dstOpnd = IR::RegOpnd::New(TyVar, m_func);

instrDef->SetDst(dstOpnd);

instr->SetSrc1(dstOpnd);

// Attach the slot ID to the check instruction.

IR::IntConstOpnd *slotIdOpnd = IR::IntConstOpnd::New(bucket.element, TyUint32, m_func);

instr->SetSrc2(slotIdOpnd);

insertInstr->InsertBefore(instr);

}

}

NEXT_HASHTABLE_ENTRY;

}

if (m_func->frameDisplayCheckTable)

{

// Frame display checks. Again, chain to the instruction (LdEnv/LdSlot).

FOREACH_HASHTABLE_ENTRY(FrameDisplayCheckRecord*, bucket, m_func->frameDisplayCheckTable)

{

StackSym *stackSym = m_func->m_symTable->FindStackSym(bucket.value);

Assert(stackSym && stackSym->m_instrDef);

IR::Instr *instrDef = stackSym->m_instrDef;

IR::Instr *insertInstr = instrDef->m_next;

IR::RegOpnd *dstOpnd = instrDef->UnlinkDst()->AsRegOpnd();

IR::Instr *instr = IR::Instr::New(Js::OpCode::FrameDisplayCheck, dstOpnd, m_func);

dstOpnd = IR::RegOpnd::New(TyVar, m_func);

instrDef->SetDst(dstOpnd);

instr->SetSrc1(dstOpnd);

// Attach the two-dimensional check info.

IR::AddrOpnd *recordOpnd = IR::AddrOpnd::New(bucket.element, IR::AddrOpndKindDynamicMisc, m_func, true);

instr->SetSrc2(recordOpnd);

insertInstr->InsertBefore(instr);

}

NEXT_HASHTABLE_ENTRY;

}

// If not a loop, but there are loops and trys, restore scope slot pointer and FD

if (!m_func->IsLoopBody() && m_func->HasTry() && m_func->GetJITFunctionBody()->GetByteCodeInLoopCount() != 0)

{

BVSparse<JitArenaAllocator> * bv = nullptr;

if (m_func->GetLocalClosureSym() && m_func->GetLocalClosureSym()->HasByteCodeRegSlot())

{

bv = JitAnew(m_func->m_alloc, BVSparse<JitArenaAllocator>, m_func->m_alloc);

bv->Set(m_func->GetLocalClosureSym()->m_id);

}

if (m_func->GetLocalFrameDisplaySym() && m_func->GetLocalFrameDisplaySym()->HasByteCodeRegSlot())

{

if (!bv)

{

bv = JitAnew(m_func->m_alloc, BVSparse<JitArenaAllocator>, m_func->m_alloc);

}

bv->Set(m_func->GetLocalFrameDisplaySym()->m_id);

}

if (bv)

{

FOREACH_INSTR_IN_FUNC_BACKWARD(instr, m_func)

{

if (instr->m_opcode == Js::OpCode::Ret)

{

IR::ByteCodeUsesInstr * byteCodeUse = IR::ByteCodeUsesInstr::New(instr);

byteCodeUse->SetBV(bv);

instr->InsertBefore(byteCodeUse);

break;

}

}

NEXT_INSTR_IN_FUNC_BACKWARD;

}

}

}