/*

* Copyright (C) 2008-2022 Apple Inc. All rights reserved.

* Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

*

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

* 3. Neither the name of Apple Inc. ("Apple") nor the names of

* its contributors may be used to endorse or promote products derived

* from this software without specific prior written permission.

*

* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY

* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "CodeBlock.h"

#include "ArithProfile.h"

#include "BasicBlockLocation.h"

#include "BytecodeDumper.h"

#include "BytecodeLivenessAnalysisInlines.h"

#include "BytecodeOperandsForCheckpoint.h"

#include "BytecodeStructs.h"

#include "CodeBlockInlines.h"

#include "CodeBlockSet.h"

#include "ControlFlowProfiler.h"

#include "DFGCapabilities.h"

#include "DFGCommon.h"

#include "DFGJITCode.h"

#include "EvalCodeBlock.h"

#include "FullCodeOrigin.h"

#include "FunctionCodeBlock.h"

#include "FunctionExecutableDump.h"

#include "GetPutInfo.h"

#include "InlineCallFrame.h"

#include "Instruction.h"

#include "InstructionStream.h"

#include "IsoCellSetInlines.h"

#include "JIT.h"

#include "JITMathIC.h"

#include "JITWorklist.h"

#include "JSCInlines.h"

#include "JSCJSValue.h"

#include "JSLexicalEnvironment.h"

#include "JSModuleEnvironment.h"

#include "JSSet.h"

#include "JSString.h"

#include "JSTemplateObjectDescriptor.h"

#include "LLIntData.h"

#include "LLIntEntrypoint.h"

#include "LLIntExceptions.h"

#include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"

#include "MetadataTable.h"

#include "ModuleProgramCodeBlock.h"

#include "ObjectAllocationProfileInlines.h"

#include "PCToCodeOriginMap.h"

#include "ProfilerDatabase.h"

#include "ProgramCodeBlock.h"

#include "ReduceWhitespace.h"

#include "SlotVisitorInlines.h"

#include "StackVisitor.h"

#include "StructureStubInfo.h"

#include "TypeLocationCache.h"

#include "TypeProfiler.h"

#include "VMInlines.h"

#include <wtf/Forward.h>

#include <wtf/SimpleStats.h>

#include <wtf/StringPrintStream.h>

#include <wtf/text/UniquedStringImpl.h>

#if ENABLE(ASSEMBLER)

#include "RegisterAtOffsetList.h"

#endif

#if ENABLE(FTL_JIT)

#include "FTLJITCode.h"

#endif

namespace JSC {

DEFINE_ALLOCATOR_WITH_HEAP_IDENTIFIER(CodeBlockRareData);

const ClassInfo CodeBlock::s_info = {

"CodeBlock"_s, nullptr, nullptr, nullptr,

CREATE_METHOD_TABLE(CodeBlock)

};

CString CodeBlock::inferredName() const

{

switch (codeType()) {

case GlobalCode:

return "<global>";

case EvalCode:

return "<eval>";

case FunctionCode:

return jsCast<FunctionExecutable*>(ownerExecutable())->ecmaName().utf8();

case ModuleCode:

return "<module>";

default:

CRASH();

return CString("", 0);

}

}

bool CodeBlock::hasHash() const

{

return !!m_hash;

}

bool CodeBlock::isSafeToComputeHash() const

{

return !isCompilationThread();

}

CodeBlockHash CodeBlock::hash() const

{

if (!m_hash) {

RELEASE_ASSERT(isSafeToComputeHash());

m_hash = CodeBlockHash(ownerExecutable()->source(), specializationKind());

}

return m_hash;

}

CString CodeBlock::sourceCodeForTools() const

{

if (codeType() != FunctionCode)

return ownerExecutable()->source().toUTF8();

SourceProvider* provider = source().provider();

FunctionExecutable* executable = jsCast<FunctionExecutable*>(ownerExecutable());

UnlinkedFunctionExecutable* unlinked = executable->unlinkedExecutable();

unsigned unlinkedStartOffset = unlinked->startOffset();

unsigned linkedStartOffset = executable->source().startOffset();

int delta = linkedStartOffset - unlinkedStartOffset;

unsigned rangeStart = delta + unlinked->unlinkedFunctionNameStart();

unsigned rangeEnd = delta + unlinked->startOffset() + unlinked->sourceLength();

return toCString(

"function ",

provider->source().substring(rangeStart, rangeEnd - rangeStart).utf8());

}

CString CodeBlock::sourceCodeOnOneLine() const

{

return reduceWhitespace(sourceCodeForTools());

}

CString CodeBlock::hashAsStringIfPossible() const

{

if (hasHash() || isSafeToComputeHash())

return toCString(hash());

return "<no-hash>";

}

void CodeBlock::dumpAssumingJITType(PrintStream& out, JITType jitType) const

{

out.print(inferredName(), "#", hashAsStringIfPossible());

out.print(":[", RawPointer(this), "->");

if (!!m_alternative)

out.print(RawPointer(alternative()), "->");

out.print(RawPointer(ownerExecutable()), ", ", jitType, codeType());

if (codeType() == FunctionCode)

out.print(specializationKind());

out.print(", ", instructionsSize());

if (this->jitType() == JITType::BaselineJIT && m_shouldAlwaysBeInlined)

out.print(" (ShouldAlwaysBeInlined)");

if (ownerExecutable()->neverInline())

out.print(" (NeverInline)");

if (ownerExecutable()->neverOptimize())

out.print(" (NeverOptimize)");

else if (ownerExecutable()->neverFTLOptimize())

out.print(" (NeverFTLOptimize)");

if (ownerExecutable()->didTryToEnterInLoop())

out.print(" (DidTryToEnterInLoop)");

if (ownerExecutable()->isInStrictContext())

out.print(" (StrictMode)");

if (m_didFailJITCompilation)

out.print(" (JITFail)");

if (this->jitType() == JITType::BaselineJIT && m_didFailFTLCompilation)

out.print(" (FTLFail)");

if (this->jitType() == JITType::BaselineJIT && m_hasBeenCompiledWithFTL)

out.print(" (HadFTLReplacement)");

out.print("]");

}

void CodeBlock::dump(PrintStream& out) const

{

dumpAssumingJITType(out, jitType());

}

void CodeBlock::dumpSource()

{

dumpSource(WTF::dataFile());

}

void CodeBlock::dumpSource(PrintStream& out)

{

ScriptExecutable* executable = ownerExecutable();

if (executable->isFunctionExecutable()) {

FunctionExecutable* functionExecutable = reinterpret_cast<FunctionExecutable*>(executable);

StringView source = functionExecutable->source().provider()->getRange(

functionExecutable->parametersStartOffset(),

functionExecutable->typeProfilingEndOffset(vm()) + 1); // Type profiling end offset is the character before the '}'.

out.print("function ", inferredName(), source);

return;

}

out.print(executable->source().view());

}

void CodeBlock::dumpBytecode()

{

dumpBytecode(WTF::dataFile());

}

void CodeBlock::dumpBytecode(PrintStream& out)

{

ICStatusMap statusMap;

getICStatusMap(statusMap);

BytecodeGraph graph(this, this->instructions());

CodeBlockBytecodeDumper<CodeBlock>::dumpGraph(this, instructions(), graph, out, statusMap);

}

void CodeBlock::dumpBytecode(PrintStream& out, const JSInstructionStream::Ref& it, const ICStatusMap& statusMap)

{

BytecodeDumper<CodeBlock>::dumpBytecode(this, out, it, statusMap);

}

void CodeBlock::dumpBytecode(PrintStream& out, unsigned bytecodeOffset, const ICStatusMap& statusMap)

{

const auto it = instructions().at(bytecodeOffset);

dumpBytecode(out, it, statusMap);

}

namespace {

class PutToScopeFireDetail final : public FireDetail {

public:

PutToScopeFireDetail(CodeBlock* codeBlock, const Identifier& ident)

: m_codeBlock(codeBlock)

, m_ident(ident)

{

}

void dump(PrintStream& out) const final

{

out.print("Linking put_to_scope in ", FunctionExecutableDump(jsCast<FunctionExecutable*>(m_codeBlock->ownerExecutable())), " for ", m_ident);

}

private:

CodeBlock* const m_codeBlock;

const Identifier& m_ident;

};

} // anonymous namespace

CodeBlock::CodeBlock(VM& vm, Structure* structure, CopyParsedBlockTag, CodeBlock& other)

: JSCell(vm, structure)

, m_globalObject(other.m_globalObject)

, m_shouldAlwaysBeInlined(true)

#if ENABLE(JIT)

, m_capabilityLevelState(DFG::CapabilityLevelNotSet)

#endif

, m_didFailJITCompilation(false)

, m_didFailFTLCompilation(false)

, m_hasBeenCompiledWithFTL(false)

, m_isJettisoned(false)

, m_numCalleeLocals(other.m_numCalleeLocals)

, m_numVars(other.m_numVars)

, m_numberOfArgumentsToSkip(other.m_numberOfArgumentsToSkip)

, m_hasDebuggerStatement(false)

, m_steppingMode(SteppingModeDisabled)

, m_numBreakpoints(0)

, m_bytecodeCost(other.m_bytecodeCost)

, m_scopeRegister(other.m_scopeRegister)

, m_hash(other.m_hash)

, m_unlinkedCode(other.vm(), this, other.m_unlinkedCode.get())

, m_ownerExecutable(other.vm(), this, other.m_ownerExecutable.get())

, m_vm(other.m_vm)

, m_instructionsRawPointer(other.m_instructionsRawPointer)

, m_constantRegisters(other.m_constantRegisters)

, m_functionDecls(other.m_functionDecls)

, m_functionExprs(other.m_functionExprs)

, m_metadata(other.m_metadata)

, m_creationTime(MonotonicTime::now())

{

ASSERT(heap()->isDeferred());

ASSERT(m_scopeRegister.isLocal());

ASSERT(source().provider());

constexpr bool allocateArgumentValueProfiles = false;

setNumParameters(other.numParameters(), allocateArgumentValueProfiles);

vm.heap.codeBlockSet().add(this);

}

void CodeBlock::finishCreation(VM& vm, CopyParsedBlockTag, CodeBlock& other)

{

Base::finishCreation(vm);

optimizeAfterWarmUp();

if (other.m_rareData) {

createRareDataIfNecessary();

m_rareData->m_exceptionHandlers = other.m_rareData->m_exceptionHandlers;

}

}

CodeBlock::CodeBlock(VM& vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope)

: JSCell(vm, structure)

, m_globalObject(vm, this, scope->globalObject())

, m_shouldAlwaysBeInlined(true)

#if ENABLE(JIT)

, m_capabilityLevelState(DFG::CapabilityLevelNotSet)

#endif

, m_didFailJITCompilation(false)

, m_didFailFTLCompilation(false)

, m_hasBeenCompiledWithFTL(false)

, m_isJettisoned(false)

, m_numCalleeLocals(unlinkedCodeBlock->numCalleeLocals())

, m_numVars(unlinkedCodeBlock->numVars())

, m_hasDebuggerStatement(false)

, m_steppingMode(SteppingModeDisabled)

, m_numBreakpoints(0)

, m_scopeRegister(unlinkedCodeBlock->scopeRegister())

, m_unlinkedCode(vm, this, unlinkedCodeBlock)

, m_ownerExecutable(vm, this, ownerExecutable)

, m_vm(&vm)

, m_instructionsRawPointer(unlinkedCodeBlock->instructions().rawPointer())

, m_metadata(unlinkedCodeBlock->metadata().link())

, m_creationTime(MonotonicTime::now())

{

ASSERT(heap()->isDeferred());

ASSERT(m_scopeRegister.isLocal());

ASSERT(source().provider());

constexpr bool allocateArgumentValueProfiles = true;

setNumParameters(unlinkedCodeBlock->numParameters(), allocateArgumentValueProfiles);

vm.heap.codeBlockSet().add(this);

}

// The main purpose of this function is to generate linked bytecode from unlinked bytecode. The process

// of linking is taking an abstract representation of bytecode and tying it to a GlobalObject and scope

// chain. For example, this process allows us to cache the depth of lexical environment reads that reach

// outside of this CodeBlock's compilation unit. It also allows us to generate particular constants that

// we can't generate during unlinked bytecode generation. This process is not allowed to generate control

// flow or introduce new locals. The reason for this is we rely on liveness analysis to be the same for

// all the CodeBlocks of an UnlinkedCodeBlock. We rely on this fact by caching the liveness analysis

// inside UnlinkedCodeBlock. Also, Baseline JIT code is shared between all CodeBlocks of an UnlinkedCodeBlock,

// so the bytecode must remain the same between CodeBlocks sharing an UnlinkedCodeBlock.

bool CodeBlock::finishCreation(VM& vm, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,

JSScope* scope)

{

Base::finishCreation(vm);

ASSERT(vm.heap.isDeferred());

auto throwScope = DECLARE_THROW_SCOPE(vm);

if (m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes() || m_unlinkedCode->wasCompiledWithControlFlowProfilerOpcodes())

vm.functionHasExecutedCache()->removeUnexecutedRange(ownerExecutable->sourceID(), ownerExecutable->typeProfilingStartOffset(vm), ownerExecutable->typeProfilingEndOffset(vm));

ScriptExecutable* topLevelExecutable = ownerExecutable->topLevelExecutable();

// We wait to initialize template objects until the end of finishCreation beecause it can

// throw. We rely on linking to put the CodeBlock into a coherent state, so we can't throw

// until we're all done linking.

Vector<unsigned> templateObjectIndices = setConstantRegisters(unlinkedCodeBlock->constantRegisters(), unlinkedCodeBlock->constantsSourceCodeRepresentation());

// We already have the cloned symbol table for the module environment since we need to instantiate

// the module environments before linking the code block. We replace the stored symbol table with the already cloned one.

if (UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock = jsDynamicCast<UnlinkedModuleProgramCodeBlock*>(unlinkedCodeBlock)) {

SymbolTable* clonedSymbolTable = jsCast<ModuleProgramExecutable*>(ownerExecutable)->moduleEnvironmentSymbolTable();

if (m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes()) {

ConcurrentJSLocker locker(clonedSymbolTable->m_lock);

clonedSymbolTable->prepareForTypeProfiling(locker);

}

replaceConstant(VirtualRegister(unlinkedModuleProgramCodeBlock->moduleEnvironmentSymbolTableConstantRegisterOffset()), clonedSymbolTable);

}

bool shouldUpdateFunctionHasExecutedCache = m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes() || m_unlinkedCode->wasCompiledWithControlFlowProfilerOpcodes();

m_functionDecls = FixedVector<WriteBarrier<FunctionExecutable>>(unlinkedCodeBlock->numberOfFunctionDecls());

for (size_t count = unlinkedCodeBlock->numberOfFunctionDecls(), i = 0; i < count; ++i) {

UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionDecl(i);

if (shouldUpdateFunctionHasExecutedCache)

vm.functionHasExecutedCache()->insertUnexecutedRange(ownerExecutable->sourceID(), unlinkedExecutable->typeProfilingStartOffset(), unlinkedExecutable->typeProfilingEndOffset());

m_functionDecls[i].set(vm, this, unlinkedExecutable->link(vm, topLevelExecutable, ownerExecutable->source(), std::nullopt, NoIntrinsic, ownerExecutable->isInsideOrdinaryFunction()));

}

m_functionExprs = FixedVector<WriteBarrier<FunctionExecutable>>(unlinkedCodeBlock->numberOfFunctionExprs());

for (size_t count = unlinkedCodeBlock->numberOfFunctionExprs(), i = 0; i < count; ++i) {

UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionExpr(i);

if (shouldUpdateFunctionHasExecutedCache)

vm.functionHasExecutedCache()->insertUnexecutedRange(ownerExecutable->sourceID(), unlinkedExecutable->typeProfilingStartOffset(), unlinkedExecutable->typeProfilingEndOffset());

m_functionExprs[i].set(vm, this, unlinkedExecutable->link(vm, topLevelExecutable, ownerExecutable->source(), std::nullopt, NoIntrinsic, ownerExecutable->isInsideOrdinaryFunction()));

}

if (unlinkedCodeBlock->numberOfExceptionHandlers()) {

createRareDataIfNecessary();

if (size_t count = unlinkedCodeBlock->numberOfExceptionHandlers()) {

m_rareData->m_exceptionHandlers.resizeToFit(count);

for (size_t i = 0; i < count; i++) {

const UnlinkedHandlerInfo& unlinkedHandler = unlinkedCodeBlock->exceptionHandler(i);

HandlerInfo& handler = m_rareData->m_exceptionHandlers[i];

#if ENABLE(JIT)

auto& instruction = *instructions().at(unlinkedHandler.target).ptr();

handler.initialize(unlinkedHandler, CodeLocationLabel<ExceptionHandlerPtrTag>(LLInt::handleCatch(instruction.width()).code()));

#else

handler.initialize(unlinkedHandler);

#endif

}

}

}

// Bookkeep the strongly referenced module environments.

HashSet<JSModuleEnvironment*> stronglyReferencedModuleEnvironments;

auto link_profile = [&](const auto& /*instruction*/, auto /*bytecode*/, auto& metadata) {

static_assert(std::is_same_v<ValueProfile, decltype(metadata.m_profile)>);

};

auto link_objectAllocationProfile = [&](const auto& /*instruction*/, auto bytecode, auto& metadata) {

metadata.m_objectAllocationProfile.initializeProfile(vm, m_globalObject.get(), this, m_globalObject->objectPrototype(), bytecode.m_inlineCapacity);

};

auto link_arrayAllocationProfile = [&](const auto& /*instruction*/, auto bytecode, auto& metadata) {

metadata.m_arrayAllocationProfile.initializeIndexingMode(bytecode.m_recommendedIndexingType);

};

auto link_callLinkInfo = [&](const auto& instruction, auto bytecode, auto& metadata) {

metadata.m_callLinkInfo.initialize(vm, CallLinkInfo::callTypeFor(decltype(bytecode)::opcodeID), instruction.index());

};

#define LINK_FIELD(__field) \

WTF_LAZY_JOIN(link_, __field)(instruction, bytecode, metadata);

#define INITIALIZE_METADATA(__op) \

auto bytecode = instruction->as<__op>(); \

auto& metadata = bytecode.metadata(this); \

new (&metadata) __op::Metadata { bytecode }; \

#define LINK_IMPL(...) \

INITIALIZE_METADATA(WTF_LAZY_FIRST(__VA_ARGS__)) \

WTF_LAZY_HAS_REST(__VA_ARGS__)({ \

WTF_LAZY_FOR_EACH_TERM(LINK_FIELD, WTF_LAZY_REST_(__VA_ARGS__)) \

}) \

#define CASE(__op) case __op::opcodeID

#define LINK(...) \

CASE(WTF_LAZY_FIRST(__VA_ARGS__)): { \

LINK_IMPL(__VA_ARGS__) \

break; \

}

const auto& instructionStream = instructions();

for (const auto& instruction : instructionStream) {

OpcodeID opcodeID = instruction->opcodeID();

static_assert(OpcodeIDWidthBySize<JSOpcodeTraits, OpcodeSize::Wide32>::opcodeIDSize == 1);

m_bytecodeCost += opcodeLengths[opcodeID] + 1;

switch (opcodeID) {

LINK(OpGetByVal, profile)

LINK(OpGetPrivateName, profile)

LINK(OpGetByIdWithThis, profile)

LINK(OpTryGetById, profile)

LINK(OpGetByIdDirect, profile)

LINK(OpGetByValWithThis, profile)

LINK(OpGetPrototypeOf, profile)

LINK(OpGetFromArguments, profile)

LINK(OpToNumber, profile)

LINK(OpToNumeric, profile)

LINK(OpToObject, profile)

LINK(OpGetArgument, profile)

LINK(OpGetInternalField, profile)

LINK(OpToThis, profile)

LINK(OpBitand, profile)

LINK(OpBitor, profile)

LINK(OpBitnot, profile)

LINK(OpBitxor, profile)

LINK(OpLshift, profile)

LINK(OpRshift, profile)

LINK(OpGetById, profile)

LINK(OpEnumeratorNext)

LINK(OpEnumeratorInByVal)

LINK(OpEnumeratorHasOwnProperty)

LINK(OpEnumeratorGetByVal, profile)

LINK(OpInByVal)

LINK(OpPutByVal)

LINK(OpPutByValDirect)

LINK(OpPutPrivateName)

LINK(OpSetPrivateBrand)

LINK(OpCheckPrivateBrand)

LINK(OpNewArray)

LINK(OpNewArrayWithSize)

LINK(OpNewArrayBuffer, arrayAllocationProfile)

LINK(OpNewObject, objectAllocationProfile)

LINK(OpPutById)

LINK(OpCreateThis)

LINK(OpCreatePromise)

LINK(OpCreateGenerator)

LINK(OpJneqPtr)

LINK(OpCatch)

LINK(OpProfileControlFlow)

LINK(OpCall, callLinkInfo, profile)

LINK(OpTailCall, callLinkInfo, profile)

LINK(OpCallDirectEval, callLinkInfo, profile)

LINK(OpConstruct, callLinkInfo, profile)

LINK(OpIteratorOpen, callLinkInfo)

LINK(OpIteratorNext, callLinkInfo)

LINK(OpCallVarargs, callLinkInfo, profile)

LINK(OpTailCallVarargs, callLinkInfo, profile)

LINK(OpTailCallForwardArguments, callLinkInfo, profile)

LINK(OpConstructVarargs, callLinkInfo, profile)

case op_new_array_with_species: {

INITIALIZE_METADATA(OpNewArrayWithSpecies)

link_profile(instruction, bytecode, metadata);

break;

}

case op_resolve_scope: {

INITIALIZE_METADATA(OpResolveScope)

const Identifier& ident = identifier(bytecode.m_var);

RELEASE_ASSERT(bytecode.m_resolveType != ResolvedClosureVar);

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), bytecode.m_localScopeDepth, scope, ident, Get, bytecode.m_resolveType, InitializationMode::NotInitialization);

metadata.m_resolveType = op.type;

metadata.m_localScopeDepth = op.depth;

if (op.lexicalEnvironment) {

if (op.type == ModuleVar) {

// Keep the linked module environment strongly referenced.

if (stronglyReferencedModuleEnvironments.add(jsCast<JSModuleEnvironment*>(op.lexicalEnvironment)).isNewEntry)

addConstant(ConcurrentJSLocker(m_lock), op.lexicalEnvironment);

metadata.m_lexicalEnvironment.set(vm, this, op.lexicalEnvironment);

} else

metadata.m_symbolTable.set(vm, this, op.lexicalEnvironment->symbolTable());

} else if (JSScope* constantScope = JSScope::constantScopeForCodeBlock(op.type, this)) {

metadata.m_constantScope.set(vm, this, constantScope);

if (op.type == GlobalProperty || op.type == GlobalPropertyWithVarInjectionChecks)

metadata.m_globalLexicalBindingEpoch = m_globalObject->globalLexicalBindingEpoch();

} else

metadata.m_globalObject.clear();

break;

}

case op_get_from_scope: {

INITIALIZE_METADATA(OpGetFromScope)

link_profile(instruction, bytecode, metadata);

metadata.m_watchpointSet = nullptr;

ASSERT(!isInitialization(bytecode.m_getPutInfo.initializationMode()));

if (bytecode.m_getPutInfo.resolveType() == ResolvedClosureVar) {

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), ClosureVar, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

break;

}

const Identifier& ident = identifier(bytecode.m_var);

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), bytecode.m_localScopeDepth, scope, ident, Get, bytecode.m_getPutInfo.resolveType(), InitializationMode::NotInitialization);

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), op.type, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

if (op.type == ModuleVar)

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), ClosureVar, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks || op.type == GlobalLexicalVar || op.type == GlobalLexicalVarWithVarInjectionChecks)

metadata.m_watchpointSet = op.watchpointSet;

else if (op.structure)

metadata.m_structure.set(vm, this, op.structure);

metadata.m_operand = op.operand;

break;

}

case op_put_to_scope: {

INITIALIZE_METADATA(OpPutToScope)

if (bytecode.m_getPutInfo.resolveType() == ResolvedClosureVar) {

// Only do watching if the property we're putting to is not anonymous.

if (bytecode.m_var != UINT_MAX) {

SymbolTable* symbolTable = jsCast<SymbolTable*>(getConstant(bytecode.m_symbolTableOrScopeDepth.symbolTable()));

const Identifier& ident = identifier(bytecode.m_var);

ConcurrentJSLocker locker(symbolTable->m_lock);

auto iter = symbolTable->find(locker, ident.impl());

ASSERT(iter != symbolTable->end(locker));

iter->value.prepareToWatch();

metadata.m_watchpointSet = iter->value.watchpointSet();

} else

metadata.m_watchpointSet = nullptr;

break;

}

const Identifier& ident = identifier(bytecode.m_var);

metadata.m_watchpointSet = nullptr;

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), bytecode.m_symbolTableOrScopeDepth.scopeDepth(), scope, ident, Put, bytecode.m_getPutInfo.resolveType(), bytecode.m_getPutInfo.initializationMode());

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), op.type, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks || op.type == GlobalLexicalVar || op.type == GlobalLexicalVarWithVarInjectionChecks)

metadata.m_watchpointSet = op.watchpointSet;

else if (op.type == ClosureVar || op.type == ClosureVarWithVarInjectionChecks) {

if (op.watchpointSet)

op.watchpointSet->invalidate(vm, PutToScopeFireDetail(this, ident));

} else if (op.structure)

metadata.m_structure.set(vm, this, op.structure);

metadata.m_operand = op.operand;

break;

}

case op_profile_type: {

RELEASE_ASSERT(m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes());

INITIALIZE_METADATA(OpProfileType)

size_t instructionOffset = instruction.offset() + instruction->size() - 1;

unsigned divotStart, divotEnd;

GlobalVariableID globalVariableID = 0;

RefPtr<TypeSet> globalTypeSet;

bool shouldAnalyze = m_unlinkedCode->typeProfilerExpressionInfoForBytecodeOffset(instructionOffset, divotStart, divotEnd);

SymbolTable* symbolTable = nullptr;

switch (bytecode.m_flag) {

case ProfileTypeBytecodeClosureVar: {

const Identifier& ident = identifier(bytecode.m_identifier);

unsigned localScopeDepth = bytecode.m_symbolTableOrScopeDepth.scopeDepth();

// Even though type profiling may be profiling either a Get or a Put, we can always claim a Get because

// we're abstractly "read"ing from a JSScope.

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), localScopeDepth, scope, ident, Get, bytecode.m_resolveType, InitializationMode::NotInitialization);

if (op.type == ClosureVar || op.type == ModuleVar)

symbolTable = op.lexicalEnvironment->symbolTable();

else if (op.type == GlobalVar)

symbolTable = m_globalObject.get()->symbolTable();

UniquedStringImpl* impl = (op.type == ModuleVar) ? op.importedName.get() : ident.impl();

if (symbolTable) {

ConcurrentJSLocker locker(symbolTable->m_lock);

// If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.

symbolTable->prepareForTypeProfiling(locker);

globalVariableID = symbolTable->uniqueIDForVariable(locker, impl, vm);

globalTypeSet = symbolTable->globalTypeSetForVariable(locker, impl, vm);

} else

globalVariableID = TypeProfilerNoGlobalIDExists;

break;

}

case ProfileTypeBytecodeLocallyResolved: {

SymbolTable* symbolTable = jsCast<SymbolTable*>(getConstant(bytecode.m_symbolTableOrScopeDepth.symbolTable()));

const Identifier& ident = identifier(bytecode.m_identifier);

ConcurrentJSLocker locker(symbolTable->m_lock);

// If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.

globalVariableID = symbolTable->uniqueIDForVariable(locker, ident.impl(), vm);

globalTypeSet = symbolTable->globalTypeSetForVariable(locker, ident.impl(), vm);

break;

}

case ProfileTypeBytecodeDoesNotHaveGlobalID:

case ProfileTypeBytecodeFunctionArgument: {

globalVariableID = TypeProfilerNoGlobalIDExists;

break;

}

case ProfileTypeBytecodeFunctionReturnStatement: {

RELEASE_ASSERT(ownerExecutable->isFunctionExecutable());

globalTypeSet = jsCast<FunctionExecutable*>(ownerExecutable)->returnStatementTypeSet();

globalVariableID = TypeProfilerReturnStatement;

if (!shouldAnalyze) {

// Because a return statement can be added implicitly to return undefined at the end of a function,

// and these nodes don't emit expression ranges because they aren't in the actual source text of

// the user's program, give the type profiler some range to identify these return statements.

// Currently, the text offset that is used as identification is "f" in the function keyword

// and is stored on TypeLocation's m_divotForFunctionOffsetIfReturnStatement member variable.

divotStart = divotEnd = ownerExecutable->typeProfilingStartOffset(vm);

shouldAnalyze = true;

}

break;

}

}

std::pair<TypeLocation*, bool> locationPair = vm.typeProfiler()->typeLocationCache()->getTypeLocation(globalVariableID,

ownerExecutable->sourceID(), divotStart, divotEnd, WTFMove(globalTypeSet), &vm);

TypeLocation* location = locationPair.first;

bool isNewLocation = locationPair.second;

if (bytecode.m_flag == ProfileTypeBytecodeFunctionReturnStatement)

location->m_divotForFunctionOffsetIfReturnStatement = ownerExecutable->typeProfilingStartOffset(vm);

if (shouldAnalyze && isNewLocation)

vm.typeProfiler()->insertNewLocation(location);

metadata.m_typeLocation = location;

break;

}

case op_debug: {

if (instruction->as<OpDebug>().m_debugHookType == DidReachDebuggerStatement)

m_hasDebuggerStatement = true;

break;

}

case op_create_rest: {

int numberOfArgumentsToSkip = instruction->as<OpCreateRest>().m_numParametersToSkip;

ASSERT_UNUSED(numberOfArgumentsToSkip, numberOfArgumentsToSkip >= 0);

// This is used when rematerializing the rest parameter during OSR exit in the FTL JIT.");

m_numberOfArgumentsToSkip = numberOfArgumentsToSkip;

break;

}

default:

break;

}

}

#undef CASE

#undef INITIALIZE_METADATA

#undef LINK_FIELD

#undef LINK

if (m_unlinkedCode->wasCompiledWithControlFlowProfilerOpcodes())

insertBasicBlockBoundariesForControlFlowProfiler();

// Set optimization thresholds only after instructions is initialized, since these

// rely on the instruction count (and are in theory permitted to also inspect the

// instruction stream to more accurate assess the cost of tier-up).

optimizeAfterWarmUp();

// If the concurrent thread will want the code block's hash, then compute it here

// synchronously.

if (Options::alwaysComputeHash())

hash();

if (Options::dumpGeneratedBytecodes())

dumpBytecode();

if (m_metadata)

vm.heap.reportExtraMemoryAllocated(m_metadata->sizeInBytes());

initializeTemplateObjects(topLevelExecutable, templateObjectIndices);

RETURN_IF_EXCEPTION(throwScope, false);

return true;

}

#if ENABLE(JIT)

void CodeBlock::setupWithUnlinkedBaselineCode(Ref<BaselineJITCode> jitCode)

{

setJITCode(jitCode.copyRef());

{

const auto& jitCodeMap = this->jitCodeMap();

for (size_t i = 0; i < numberOfExceptionHandlers(); ++i) {

HandlerInfo& handler = exceptionHandler(i);

// FIXME: <rdar://problem/39433318>.

handler.nativeCode = jitCodeMap.find(BytecodeIndex(handler.target)).retagged<ExceptionHandlerPtrTag>();

}

}

{

ConcurrentJSLocker locker(m_lock);

ASSERT(!m_jitData);

auto baselineJITData = BaselineJITData::create(jitCode->m_constantPool.size());

baselineJITData->m_stubInfos = FixedVector<StructureStubInfo>(jitCode->m_unlinkedStubInfos.size());

for (auto& unlinkedCallLinkInfo : jitCode->m_unlinkedCalls) {

CallLinkInfo* callLinkInfo = getCallLinkInfoForBytecodeIndex(locker, unlinkedCallLinkInfo.bytecodeIndex);

ASSERT(callLinkInfo);

static_cast<BaselineCallLinkInfo*>(callLinkInfo)->setCodeLocations(unlinkedCallLinkInfo.doneLocation);

}

for (size_t i = 0; i < jitCode->m_constantPool.size(); ++i) {

auto entry = jitCode->m_constantPool.at(i);

switch (entry.type()) {

case JITConstantPool::Type::GlobalObject:

baselineJITData->at(i) = m_globalObject.get();

break;

case JITConstantPool::Type::StructureStubInfo: {

unsigned index = bitwise_cast<uintptr_t>(entry.pointer());

BaselineUnlinkedStructureStubInfo& unlinkedStubInfo = jitCode->m_unlinkedStubInfos[index];

StructureStubInfo& stubInfo = baselineJITData->m_stubInfos[index];

stubInfo.initializeFromUnlinkedStructureStubInfo(unlinkedStubInfo);

baselineJITData->at(i) = &stubInfo;

break;

}

case JITConstantPool::Type::FunctionDecl: {

unsigned index = bitwise_cast<uintptr_t>(entry.pointer());

baselineJITData->at(i) = functionDecl(index);

break;

}

case JITConstantPool::Type::FunctionExpr: {

unsigned index = bitwise_cast<uintptr_t>(entry.pointer());

baselineJITData->at(i) = functionExpr(index);

break;

}

}

}

m_jitData = baselineJITData.release();

}

switch (codeType()) {

case GlobalCode:

case ModuleCode:

case EvalCode:

m_shouldAlwaysBeInlined = false;

break;

case FunctionCode:

// We could have already set it to false because we detected an uninlineable call.

// Don't override that observation.

m_shouldAlwaysBeInlined &= canInline(capabilityLevel()) && DFG::mightInlineFunction(this);

break;

}

if (jitCode->m_isShareable && !unlinkedCodeBlock()->m_unlinkedBaselineCode && Options::useBaselineJITCodeSharing())

unlinkedCodeBlock()->m_unlinkedBaselineCode = WTFMove(jitCode);

}

#endif // ENABLE(JIT)

CodeBlock::~CodeBlock()

{

VM& vm = *m_vm;

// We use unvalidatedGet because get() has a validation assertion that rejects access.

// This assertion is correct since destruction order of cells is not guaranteed, and member cells could already be destroyed.

// But for CodeBlock, we are ensuring the order: CodeBlock gets destroyed before UnlinkedCodeBlock gets destroyed.

// So, we can access member UnlinkedCodeBlock safely here. We bypass the assertion by using unvalidatedGet.

UnlinkedCodeBlock* unlinkedCodeBlock = m_unlinkedCode.unvalidatedGet();

if (JITCode::isBaselineCode(jitType())) {

if (m_metadata) {

m_metadata->forEach<OpCatch>([&](auto& metadata) {

if (metadata.m_buffer)

ValueProfileAndVirtualRegisterBuffer::destroy(std::exchange(metadata.m_buffer, nullptr));

});

}

}

#if ENABLE(DFG_JIT)

// The JITCode (and its corresponding DFG::CommonData) may outlive the CodeBlock by

// a short amount of time after the CodeBlock is destructed. For example, the

// Interpreter::execute methods will ref JITCode before invoking it. This can

// result in the JITCode having a non-zero refCount when its owner CodeBlock is

// destructed.

//

// Hence, we cannot rely on DFG::CommonData destruction to clear these now invalid

// watchpoints in a timely manner. We'll ensure they are cleared here eagerly.

//

// We only need to do this for a DFG/FTL CodeBlock because only these will have a

// DFG:CommonData. Hence, the LLInt and Baseline will not have any of these watchpoints.

//

// Note also that the LLIntPrototypeLoadAdaptiveStructureWatchpoint is also related

// to the CodeBlock. However, its lifecycle is tied directly to the CodeBlock, and

// will be automatically cleared when the CodeBlock destructs.

if (JITCode::isOptimizingJIT(jitType()))

jitCode()->dfgCommon()->clearWatchpoints();

#endif

vm.heap.codeBlockSet().remove(this);

if (UNLIKELY(vm.m_perBytecodeProfiler))

vm.m_perBytecodeProfiler->notifyDestruction(this);

if (!vm.heap.isShuttingDown() && unlinkedCodeBlock->didOptimize() == TriState::Indeterminate)

unlinkedCodeBlock->setDidOptimize(TriState::False);

#if ENABLE(VERBOSE_VALUE_PROFILE)

dumpValueProfiles();

#endif

// We may be destroyed before any CodeBlocks that refer to us are destroyed.

// Consider that two CodeBlocks become unreachable at the same time. There

// is no guarantee about the order in which the CodeBlocks are destroyed.

// So, if we don't remove incoming calls, and get destroyed before the

// CodeBlock(s) that have calls into us, then the CallLinkInfo vector's

// destructor will try to remove nodes from our (no longer valid) linked list.

unlinkIncomingCalls();

// Note that our outgoing calls will be removed from other CodeBlocks'

// m_incomingCalls linked lists through the execution of the ~CallLinkInfo

// destructors.

#if ENABLE(JIT)

forEachStructureStubInfo([&](StructureStubInfo& stubInfo) {

stubInfo.aboutToDie();

stubInfo.deref();

return IterationStatus::Continue;

});

if (JITCode::isOptimizingJIT(jitType())) {

#if ENABLE(DFG_JIT)

if (auto* jitData = dfgJITData())

delete jitData;

#endif

} else {

if (auto* jitData = baselineJITData())

delete jitData;

}

#endif // ENABLE(JIT)

}

bool CodeBlock::isConstantOwnedByUnlinkedCodeBlock(VirtualRegister reg) const

{

// This needs to correspond to what we do inside setConstantRegisters.

switch (unlinkedCodeBlock()->constantSourceCodeRepresentation(reg)) {

case SourceCodeRepresentation::Integer:

case SourceCodeRepresentation::Double:

return true;

case SourceCodeRepresentation::Other: {

JSValue value = unlinkedCodeBlock()->getConstant(reg);

if (!value || !value.isCell())

return true;

JSCell* cell = value.asCell();

if (cell->inherits<SymbolTable>() || cell->inherits<JSTemplateObjectDescriptor>())

return false;

return true;

}

case SourceCodeRepresentation::LinkTimeConstant:

return false;

default:

RELEASE_ASSERT_NOT_REACHED();

}

}

Vector<unsigned> CodeBlock::setConstantRegisters(const FixedVector<WriteBarrier<Unknown>>& constants, const FixedVector<SourceCodeRepresentation>& constantsSourceCodeRepresentation)

{

VM& vm = *m_vm;

JSGlobalObject* globalObject = m_globalObject.get();

Vector<unsigned> templateObjectIndices;

ASSERT(constants.size() == constantsSourceCodeRepresentation.size());

size_t count = constants.size();

{

ConcurrentJSLocker locker(m_lock);

m_constantRegisters.resizeToFit(count);

}

for (size_t i = 0; i < count; i++) {

JSValue constant = constants[i].get();

SourceCodeRepresentation representation = constantsSourceCodeRepresentation[i];

switch (representation) {

case SourceCodeRepresentation::LinkTimeConstant:

constant = globalObject->linkTimeConstant(static_cast<LinkTimeConstant>(constant.asInt32AsAnyInt()));

ASSERT(constant.isCell()); // Unlinked Baseline JIT requires this.

break;

case SourceCodeRepresentation::Other:

case SourceCodeRepresentation::Integer:

case SourceCodeRepresentation::Double:

if (!constant.isEmpty()) {

if (constant.isCell()) {

JSCell* cell = constant.asCell();

if (SymbolTable* symbolTable = jsDynamicCast<SymbolTable*>(cell)) {

if (m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes()) {

ConcurrentJSLocker locker(symbolTable->m_lock);

symbolTable->prepareForTypeProfiling(locker);

}

SymbolTable* clone = symbolTable->cloneScopePart(vm);

if (wasCompiledWithDebuggingOpcodes())

clone->setRareDataCodeBlock(this);

constant = clone;

} else if (jsDynamicCast<JSTemplateObjectDescriptor*>(cell))

templateObjectIndices.append(i);

}

}

break;

}

m_constantRegisters[i].set(vm, this, constant);

}

return templateObjectIndices;

}

void CodeBlock::initializeTemplateObjects(ScriptExecutable* topLevelExecutable, const Vector<unsigned>& templateObjectIndices)

{

auto scope = DECLARE_THROW_SCOPE(vm());

for (unsigned i : templateObjectIndices) {

auto* descriptor = jsCast<JSTemplateObjectDescriptor*>(m_constantRegisters[i].get());

auto* templateObject = topLevelExecutable->createTemplateObject(globalObject(), descriptor);

RETURN_IF_EXCEPTION(scope, void());