//-------------------------------------------------------------------------------------------------------

// Copyright (C) Microsoft. All rights reserved.

// Licensed under the MIT license. See LICENSE.txt file in the project root for full license information.

//-------------------------------------------------------------------------------------------------------

#include "BackEnd.h"

#pragma prefast(push)

#pragma prefast(disable:28652, "Prefast complains that the OR are causing the compiler to emit dynamic initializers and the variable to be allocated in read/write mem...")

static const IR::BailOutKind c_debuggerBailOutKindForCall =

IR::BailOutForceByFlag | IR::BailOutStackFrameBase | IR::BailOutBreakPointInFunction | IR::BailOutLocalValueChanged | IR::BailOutIgnoreException;

static const IR::BailOutKind c_debuggerBaseBailOutKindForHelper = IR::BailOutIgnoreException | IR::BailOutForceByFlag;

#pragma prefast(pop)

uint

IRBuilder::AddStatementBoundary(uint statementIndex, uint offset)

{

// Under debugger we use full stmt map, so that we know exactly start and end of each user stmt.

// We insert additional instrs in between statements, such as ProfiledLoopStart, for these bytecode reader acts as

// there is "unknown" stmt boundary with statementIndex == -1. Don't add stmt boundary for that as later

// it may cause issues, e.g. see WinBlue 218307.

if (!(statementIndex == Js::Constants::NoStatementIndex && this->m_func->IsJitInDebugMode()))

{

IR::PragmaInstr* pragmaInstr = IR::PragmaInstr::New(Js::OpCode::StatementBoundary, statementIndex, m_func);

this->AddInstr(pragmaInstr, offset);

}

#ifdef BAILOUT_INJECTION

// Don't inject bailout if the function have trys

if (!this->m_func->GetTopFunc()->HasTry() && (statementIndex != Js::Constants::NoStatementIndex))

{

if (Js::Configuration::Global.flags.IsEnabled(Js::BailOutFlag) && !this->m_func->GetJnFunction()->GetUtf8SourceInfo()->GetIsLibraryCode())

{

ULONG line;

LONG col;

// Since we're on a separate thread, don't allow the line cache to be allocated in the Recycler.

if (this->m_func->GetJnFunction()->GetLineCharOffset(this->m_jnReader.GetCurrentOffset(), &line, &col, false /*canAllocateLineCache*/))

{

line++;

if (Js::Configuration::Global.flags.BailOut.Contains(line, (uint32)col) || Js::Configuration::Global.flags.BailOut.Contains(line, (uint32)-1))

{

this->InjectBailOut(offset);

}

}

} else if(Js::Configuration::Global.flags.IsEnabled(Js::BailOutAtEveryLineFlag)) {

this->InjectBailOut(offset);

}

}

#endif

return m_statementReader.MoveNextStatementBoundary();

}

// Add conditional bailout for breaking into interpreter debug thunk - for fast F12.

void

IRBuilder::InsertBailOutForDebugger(uint byteCodeOffset, IR::BailOutKind kind, IR::Instr* insertBeforeInstr /* default nullptr */)

{

Assert(m_func->IsJitInDebugMode());

Assert(byteCodeOffset != Js::Constants::NoByteCodeOffset);

BailOutInfo * bailOutInfo = JitAnew(m_func->m_alloc, BailOutInfo, byteCodeOffset, m_func);

IR::BailOutInstr * instr = IR::BailOutInstr::New(Js::OpCode::BailForDebugger, kind, bailOutInfo, bailOutInfo->bailOutFunc);

if (insertBeforeInstr)

{

instr->SetByteCodeOffset(byteCodeOffset);

uint32 offset = insertBeforeInstr->GetByteCodeOffset();

if (m_offsetToInstruction[offset] == insertBeforeInstr)

{

m_offsetToInstruction[offset] = instr;

}

insertBeforeInstr->InsertBefore(instr);

}

else

{

this->AddInstr(instr, m_lastInstr->GetByteCodeOffset());

}

}

bool

IRBuilder::DoBailOnNoProfile()

{

if (PHASE_OFF(Js::BailOnNoProfilePhase, this->m_func->GetTopFunc()))

{

return false;

}

Func *const topFunc = m_func->GetTopFunc();

if(topFunc->m_jitTimeData->GetProfiledIterations() == 0)

{

// The top function has not been profiled yet. Some switch must have been used to force jitting. This is not a

// real-world case, but for the purpose of testing the JIT, it's beneficial to generate code in unprofiled paths.

return false;

}

if (this->m_func->GetProfileInfo()->IsNoProfileBailoutsDisabled())

{

return false;

}

if (!m_func->DoGlobOpt() || m_func->GetTopFunc()->HasTry())

{

return false;

}

#ifdef ENABLE_DEBUG_CONFIG_OPTIONS

if (this->m_func->GetTopFunc() != this->m_func && Js::Configuration::Global.flags.IsEnabled(Js::ForceJITLoopBodyFlag))

{

// No profile data for loop bodies with -force...

return false;

}

#endif

if (!this->m_func->HasProfileInfo())

{

return false;

}

return true;

}

void

IRBuilder::InsertBailOnNoProfile(uint offset)

{

Assert(DoBailOnNoProfile());

if (this->callTreeHasSomeProfileInfo)

{

return;

}

IR::Instr *startCall = nullptr;

int count = 0;

FOREACH_SLIST_ENTRY(IR::Instr *, argInstr, this->m_argStack)

{

if (argInstr->m_opcode == Js::OpCode::StartCall)

{

startCall = argInstr;

count++;

if (count > 1)

{

return;

}

}

} NEXT_SLIST_ENTRY;

AnalysisAssert(startCall);

if (startCall->m_prev->m_opcode != Js::OpCode::BailOnNoProfile)

{

InsertBailOnNoProfile(startCall);

}

}

void IRBuilder::InsertBailOnNoProfile(IR::Instr *const insertBeforeInstr)

{

Assert(DoBailOnNoProfile());

IR::Instr *const bailOnNoProfileInstr = IR::Instr::New(Js::OpCode::BailOnNoProfile, m_func);

bailOnNoProfileInstr->SetByteCodeOffset(insertBeforeInstr);

uint32 offset = insertBeforeInstr->GetByteCodeOffset();

if (m_offsetToInstruction[offset] == insertBeforeInstr)

{

m_offsetToInstruction[offset] = bailOnNoProfileInstr;

}

insertBeforeInstr->InsertBefore(bailOnNoProfileInstr);

}

#ifdef BAILOUT_INJECTION

void

IRBuilder::InjectBailOut(uint offset)

{

if(m_func->IsSimpleJit())

{

return; // bailout injection is only applicable to full JIT

}

IR::IntConstOpnd * opnd = IR::IntConstOpnd::New(0, TyInt32, m_func);

uint bailOutOffset = offset;

if (bailOutOffset == Js::Constants::NoByteCodeOffset)

{

bailOutOffset = m_lastInstr->GetByteCodeOffset();

}

BailOutInfo * bailOutInfo = JitAnew(m_func->m_alloc, BailOutInfo, bailOutOffset, m_func);

IR::BailOutInstr * instr = IR::BailOutInstr::New(Js::OpCode::BailOnEqual, IR::BailOutInjected, bailOutInfo, bailOutInfo->bailOutFunc);

instr->SetSrc1(opnd);

instr->SetSrc2(opnd);

this->AddInstr(instr, offset);

}

void

IRBuilder::CheckBailOutInjection(Js::OpCode opcode)

{

// Detect these sequence and disable Bailout injection between them:

// LdStackArgPtr

// LdArgCnt

// ApplyArgs

// This assumes that LdStackArgPtr, LdArgCnt and ApplyArgs can

// only be emitted in these sequence. This will need to be modified if it changes.

//

// Also insert a single bailout before the beginning of a switch case block for all the case labels.

switch(opcode)

{

case Js::OpCode::LdStackArgPtr:

Assert(!seenLdStackArgPtr);

Assert(!expectApplyArg);

seenLdStackArgPtr = true;

break;

case Js::OpCode::LdArgCnt:

Assert(seenLdStackArgPtr);

Assert(!expectApplyArg);

expectApplyArg = true;

break;

case Js::OpCode::ApplyArgs:

Assert(seenLdStackArgPtr);

Assert(expectApplyArg);

seenLdStackArgPtr = false;

expectApplyArg = false;

break;

case Js::OpCode::BeginSwitch:

case Js::OpCode::ProfiledBeginSwitch:

Assert(!seenProfiledBeginSwitch);

seenProfiledBeginSwitch = true;

break;

case Js::OpCode::EndSwitch:

Assert(seenProfiledBeginSwitch);

seenProfiledBeginSwitch = false;

break;

default:

Assert(!seenLdStackArgPtr);

Assert(!expectApplyArg);

break;

}

}

#endif

bool

IRBuilder::IsLoopBody() const

{

return m_func->IsLoopBody();

}

bool

IRBuilder::IsLoopBodyInTry() const

{

return m_func->IsLoopBodyInTry();

}

bool

IRBuilder::IsLoopBodyReturnIPInstr(IR::Instr * instr) const

{

IR::Opnd * dst = instr->GetDst();

return (dst && dst->IsRegOpnd() && dst->AsRegOpnd()->m_sym == m_loopBodyRetIPSym);

}

bool

IRBuilder::IsLoopBodyOuterOffset(uint offset) const

{

if (!IsLoopBody())

{

return false;

}

JsLoopBodyCodeGen* loopBodyCodeGen = (JsLoopBodyCodeGen*)m_func->m_workItem;

return (offset >= loopBodyCodeGen->loopHeader->endOffset || offset < loopBodyCodeGen->loopHeader->startOffset);

}

uint

IRBuilder::GetLoopBodyExitInstrOffset() const

{

// End of loop body, start of StSlot and Ret instruction at endOffset + 1

return ((JsLoopBodyCodeGen*)m_func->m_workItem)->loopHeader->endOffset + 1;

}

Js::RegSlot

IRBuilder::GetEnvReg() const

{

return this->m_func->GetJnFunction()->GetEnvReg();

}

Js::RegSlot

IRBuilder::GetEnvRegForInnerFrameDisplay() const

{

Js::RegSlot envReg = this->m_func->GetJnFunction()->GetLocalFrameDisplayReg();

if (envReg == Js::Constants::NoRegister)

{

envReg = this->GetEnvReg();

}

return envReg;

}

void

IRBuilder::AddEnvOpndForInnerFrameDisplay(IR::Instr *instr, uint offset)

{

Js::RegSlot envReg = this->GetEnvRegForInnerFrameDisplay();

if (envReg != Js::Constants::NoRegister)

{

IR::RegOpnd *src2Opnd;

if (envReg == this->m_functionBody->GetLocalFrameDisplayReg() &&

this->m_functionBody->DoStackFrameDisplay() &&

m_func->IsTopFunc())

{

src2Opnd = IR::RegOpnd::New(TyVar, m_func);

this->AddInstr(

IR::Instr::New(

Js::OpCode::LdSlot, src2Opnd,

this->BuildFieldOpnd(Js::OpCode::LdSlot, m_func->GetLocalFrameDisplaySym()->m_id, 0, (Js::PropertyIdIndexType)-1, PropertyKindSlots),

m_func),

offset);

}

else

{

src2Opnd = this->BuildSrcOpnd(envReg);

}

instr->SetSrc2(src2Opnd);

}

}

bool

IRBuilder::DoSlotArrayCheck(IR::SymOpnd *fieldOpnd, bool doDynamicCheck)

{

if (PHASE_OFF(Js::ClosureRangeCheckPhase, m_func))

{

return true;

}

PropertySym *propertySym = fieldOpnd->m_sym->AsPropertySym();

IR::Instr *instrDef = propertySym->m_stackSym->m_instrDef;

IR::Opnd *allocOpnd = nullptr;

if (instrDef == nullptr)

{

if (doDynamicCheck)

{

return false;

}

Js::Throw::FatalInternalError();

}

switch(instrDef->m_opcode)

{

case Js::OpCode::NewScopeSlots:

case Js::OpCode::NewStackScopeSlots:

case Js::OpCode::NewScopeSlotsWithoutPropIds:

allocOpnd = instrDef->GetSrc1();

break;

case Js::OpCode::LdSlot:

case Js::OpCode::LdSlotArr:

if (doDynamicCheck)

{

return false;

}

// fall through

default:

Js::Throw::FatalInternalError();

}

uint32 allocCount = allocOpnd->AsIntConstOpnd()->AsUint32();

uint32 slotId = (uint32)propertySym->m_propertyId;

if (slotId >= allocCount)

{

Js::Throw::FatalInternalError();

}

return true;

}

///----------------------------------------------------------------------------

///

/// IRBuilder::Build

///

/// IRBuilder main entry point. Read the bytecode for this function and

/// generate IR.

///

///----------------------------------------------------------------------------

void

IRBuilder::Build()

{

m_funcAlloc = m_func->m_alloc;

NoRecoverMemoryJitArenaAllocator localAlloc(L"BE-IRBuilder", m_funcAlloc->GetPageAllocator(), Js::Throw::OutOfMemory);

m_tempAlloc = &localAlloc;

uint32 offset;

uint32 statementIndex = m_statementReader.GetStatementIndex();

m_argStack = JitAnew(m_tempAlloc, SList<IR::Instr *>, m_tempAlloc);

this->branchRelocList = JitAnew(m_tempAlloc, SList<BranchReloc *>, m_tempAlloc);

Func * topFunc = this->m_func->GetTopFunc();

if (topFunc->HasTry() &&

((!topFunc->HasFinally() && !topFunc->IsLoopBody() && !PHASE_OFF(Js::OptimizeTryCatchPhase, topFunc)) ||

(topFunc->IsSimpleJit() && topFunc->GetJnFunction()->DoJITLoopBody()))) // should be relaxed as more bailouts are added in Simple Jit

{

this->catchOffsetStack = JitAnew(m_tempAlloc, SList<uint>, m_tempAlloc);

}

// Set up for renaming of temp registers to allow us to identify distinct lifetimes.

Js::FunctionBody *funcBody = m_functionBody;

this->firstTemp = funcBody->GetFirstTmpReg();

Js::RegSlot tempCount = funcBody->GetTempCount();

if (tempCount > 0)

{

this->tempMap = (SymID*)m_tempAlloc->AllocZero(sizeof(SymID) * tempCount);

this->fbvTempUsed = BVFixed::New<JitArenaAllocator>(tempCount, m_tempAlloc);

}

else

{

this->tempMap = nullptr;

this->fbvTempUsed = nullptr;

}

m_func->m_headInstr = IR::EntryInstr::New(Js::OpCode::FunctionEntry, m_func);

m_func->m_exitInstr = IR::ExitInstr::New(Js::OpCode::FunctionExit, m_func);

m_func->m_tailInstr = m_func->m_exitInstr;

m_func->m_headInstr->InsertAfter(m_func->m_tailInstr);

m_func->m_isLeaf = true; // until proven otherwise

if (this->m_func->GetJnFunction()->GetLocalClosureReg() != Js::Constants::NoRegister)

{

m_func->InitLocalClosureSyms();

}

m_functionStartOffset = m_jnReader.GetCurrentOffset();

m_lastInstr = m_func->m_headInstr;

AssertMsg(sizeof(SymID) >= sizeof(Js::RegSlot), "sizeof(SymID) != sizeof(Js::RegSlot)!!");

offset = m_functionStartOffset;

// Skip the last EndOfBlock opcode

Assert(!OpCodeAttr::HasMultiSizeLayout(Js::OpCode::EndOfBlock));

uint32 lastOffset = m_functionBody->GetByteCode()->GetLength() - Js::OpCodeUtil::EncodedSize(Js::OpCode::EndOfBlock, Js::SmallLayout);

uint32 offsetToInstructionCount = lastOffset;

if (this->IsLoopBody())

{

// LdSlot needs to cover all the register, including the temps, because we might treat

// those as if they are local for the value of the with statement

this->m_ldSlots = BVFixed::New<JitArenaAllocator>(funcBody->GetLocalsCount(), m_tempAlloc);

this->m_stSlots = BVFixed::New<JitArenaAllocator>(funcBody->GetFirstTmpReg(), m_tempAlloc);

this->m_loopBodyRetIPSym = StackSym::New(TyInt32, this->m_func);

#if DBG

if (funcBody->GetTempCount() != 0)

{

this->m_usedAsTemp = BVFixed::New<JitArenaAllocator>(funcBody->GetTempCount(), m_tempAlloc);

}

#endif

JsLoopBodyCodeGen* loopBodyCodeGen = (JsLoopBodyCodeGen*)m_func->m_workItem;

lastOffset = loopBodyCodeGen->loopHeader->endOffset;

// Ret is created at lastOffset + 1, so we need lastOffset + 2 entries

offsetToInstructionCount = lastOffset + 2;

// Compute the offset of the start of the locals array as a Var index.

size_t localsOffset = Js::InterpreterStackFrame::GetOffsetOfLocals();

Assert(localsOffset % sizeof(Js::Var) == 0);

this->m_loopBodyLocalsStartSlot = (Js::PropertyId)(localsOffset / sizeof(Js::Var));

}

#if DBG

m_offsetToInstructionCount = offsetToInstructionCount;

#endif

m_offsetToInstruction = JitAnewArrayZ(m_tempAlloc, IR::Instr *, offsetToInstructionCount);

#ifdef BYTECODE_BRANCH_ISLAND

longBranchMap = JitAnew(m_tempAlloc, LongBranchMap, m_tempAlloc);

#endif

m_switchBuilder.Init(m_func, m_tempAlloc, false);

this->BuildConstantLoads();

this->BuildGeneratorPreamble();

if (!this->IsLoopBody() && funcBody->GetHasImplicitArgIns())

{

this->BuildImplicitArgIns();

}

if (!this->IsLoopBody() && funcBody->GetHasRestParameter())

{

this->BuildArgInRest();

}

if (m_func->IsJitInDebugMode())

{

// This is first bailout in the function, the locals at stack have not initialized to undefined, so do not restore them.

this->InsertBailOutForDebugger(offset, IR::BailOutForceByFlag | IR::BailOutBreakPointInFunction | IR::BailOutStep, nullptr);

}

#ifdef BAILOUT_INJECTION

// Start bailout inject after the constant and arg load. We don't bailout before that

IR::Instr * lastInstr = m_lastInstr;

#endif

if (m_statementReader.AtStatementBoundary(&m_jnReader))

{

statementIndex = this->AddStatementBoundary(statementIndex, offset);

}

if (!this->IsLoopBody())

{

IR::Instr *instr;

// Do the implicit operations LdEnv, NewScopeSlots, LdFrameDisplay, as indicated by function body attributes.

Js::RegSlot envReg = funcBody->GetEnvReg();

if (envReg != Js::Constants::NoRegister && !this->RegIsConstant(envReg))

{

Js::OpCode newOpcode;

Js::RegSlot thisReg = funcBody->GetThisRegForEventHandler();

IR::RegOpnd *srcOpnd = nullptr;

IR::RegOpnd *dstOpnd = nullptr;

if (thisReg != Js::Constants::NoRegister)

{

this->BuildArgIn0(offset, thisReg);

srcOpnd = BuildSrcOpnd(thisReg);

newOpcode = Js::OpCode::LdHandlerScope;

}

else

{

newOpcode = Js::OpCode::LdEnv;

}

dstOpnd = BuildDstOpnd(envReg);

instr = IR::Instr::New(newOpcode, dstOpnd, m_func);

if (srcOpnd)

{

instr->SetSrc1(srcOpnd);

}

if (dstOpnd->m_sym->m_isSingleDef)

{

dstOpnd->m_sym->m_isNotInt = true;

}

this->AddInstr(instr, offset);

}

Js::RegSlot frameDisplayReg = funcBody->GetLocalFrameDisplayReg();

Js::RegSlot funcExprScopeReg = funcBody->GetFuncExprScopeReg();

IR::RegOpnd *frameDisplayOpnd = nullptr;

if (funcExprScopeReg != Js::Constants::NoRegister)

{

IR::RegOpnd *funcExprScopeOpnd = BuildDstOpnd(funcExprScopeReg);

instr = IR::Instr::New(Js::OpCode::NewPseudoScope, funcExprScopeOpnd, m_func);

this->AddInstr(instr, (uint)-1);

frameDisplayOpnd = BuildDstOpnd(frameDisplayReg);

instr = IR::Instr::New(Js::OpCode::LdFrameDisplay, frameDisplayOpnd, funcExprScopeOpnd, m_func);

if (envReg != Js::Constants::NoRegister)

{

instr->SetSrc2(BuildSrcOpnd(envReg));

}

this->AddInstr(instr, (uint)-1);

}

Js::RegSlot closureReg = funcBody->GetLocalClosureReg();

IR::RegOpnd *closureOpnd = nullptr;

if (closureReg != Js::Constants::NoRegister)

{

Assert(!this->RegIsConstant(closureReg));

if (m_func->DoStackScopeSlots())

{

closureOpnd = IR::RegOpnd::New(TyVar, m_func);

}

else

{

closureOpnd = this->BuildDstOpnd(closureReg);

}

if (funcBody->HasScopeObject())

{

if (funcBody->HasCachedScopePropIds())

{

this->BuildInitCachedScope(0, offset);

}

else

{

instr = IR::Instr::New(Js::OpCode::NewScopeObject, closureOpnd, m_func);

this->AddInstr(instr, offset);

}

}

else

{

Js::OpCode op =

m_func->DoStackScopeSlots() ? Js::OpCode::NewStackScopeSlots : Js::OpCode::NewScopeSlots;

IR::Opnd * srcOpnd = IR::IntConstOpnd::New(

m_func->GetJnFunction()->scopeSlotArraySize + Js::ScopeSlots::FirstSlotIndex, TyUint32, m_func);

instr = IR::Instr::New(op, closureOpnd, srcOpnd, m_func);

this->AddInstr(instr, offset);

}

if (closureOpnd->m_sym->m_isSingleDef)

{

closureOpnd->m_sym->m_isNotInt = true;

}

if (m_func->DoStackScopeSlots())

{

// Init the stack closure sym and use it to save the scope slot pointer.

this->AddInstr(

IR::Instr::New(

Js::OpCode::InitLocalClosure, this->BuildDstOpnd(m_func->GetLocalClosureSym()->m_id), m_func),

(uint32)-1);

this->AddInstr(

IR::Instr::New(

Js::OpCode::StSlot,

this->BuildFieldOpnd(

Js::OpCode::StSlot, m_func->GetLocalClosureSym()->m_id, 0, (Js::PropertyIdIndexType)-1, PropertyKindSlots),

closureOpnd, m_func),

(uint32)-1);

}

}

if (frameDisplayReg != Js::Constants::NoRegister && closureReg != Js::Constants::NoRegister)

{

Assert(!this->RegIsConstant(frameDisplayReg));

Js::OpCode op = m_func->DoStackScopeSlots() ? Js::OpCode::NewStackFrameDisplay : Js::OpCode::LdFrameDisplay;

IR::RegOpnd *dstOpnd;

if (m_func->DoStackScopeSlots() && m_func->IsTopFunc())

{

dstOpnd = IR::RegOpnd::New(TyVar, m_func);

}

else

{

dstOpnd = this->BuildDstOpnd(frameDisplayReg);

}

IR::Instr *instr = IR::Instr::New(op, dstOpnd, closureOpnd, m_func);

if (frameDisplayOpnd != nullptr)

{

instr->SetSrc2(frameDisplayOpnd);

}

else if (envReg != Js::Constants::NoRegister)

{

instr->SetSrc2(this->BuildSrcOpnd(envReg));

}

this->AddInstr(instr, offset);

if (dstOpnd->m_sym->m_isSingleDef)

{

dstOpnd->m_sym->m_isNotInt = true;

}

if (m_func->DoStackFrameDisplay())

{

// Use the stack closure sym to save the frame display pointer.

this->AddInstr(

IR::Instr::New(

Js::OpCode::InitLocalClosure, this->BuildDstOpnd(m_func->GetLocalFrameDisplaySym()->m_id), m_func),

(uint32)-1);

this->AddInstr(

IR::Instr::New(

Js::OpCode::StSlot,

this->BuildFieldOpnd(Js::OpCode::StSlot, m_func->GetLocalFrameDisplaySym()->m_id, 0, (Js::PropertyIdIndexType)-1, PropertyKindSlots),

dstOpnd, m_func),

(uint32)-1);

}

}

}

// For label instr we can add bailout only after all labels were finalized. Put to list/add in the end.

JsUtil::BaseDictionary<IR::Instr*, int, JitArenaAllocator> ignoreExBranchInstrToOffsetMap(m_tempAlloc);

Js::LayoutSize layoutSize;

for (Js::OpCode newOpcode = m_jnReader.ReadOp(layoutSize); (uint)m_jnReader.GetCurrentOffset() <= lastOffset; newOpcode = m_jnReader.ReadOp(layoutSize))

{

Assert(newOpcode != Js::OpCode::EndOfBlock);

#ifdef BAILOUT_INJECTION

if (!this->m_func->GetTopFunc()->HasTry()

#ifdef BYTECODE_BRANCH_ISLAND

&& newOpcode != Js::OpCode::BrLong // Don't inject bailout on BrLong as they are just redirecting to a different offset anyways

#endif

)

{

if (!seenLdStackArgPtr && !seenProfiledBeginSwitch)

{

if(Js::Configuration::Global.flags.IsEnabled(Js::BailOutByteCodeFlag))

{

ThreadContext * threadContext = this->m_func->GetScriptContext()->GetThreadContext();

if (Js::Configuration::Global.flags.BailOutByteCode.Contains(threadContext->bailOutByteCodeLocationCount))

{

this->InjectBailOut(offset);

}

}

else if(Js::Configuration::Global.flags.IsEnabled(Js::BailOutAtEveryByteCodeFlag))

{

this->InjectBailOut(offset);

}

}

CheckBailOutInjection(newOpcode);

}

#endif

AssertMsg(Js::OpCodeUtil::IsValidByteCodeOpcode(newOpcode), "Error getting opcode from m_jnReader.Op()");

uint layoutAndSize = layoutSize * Js::OpLayoutType::Count + Js::OpCodeUtil::GetOpCodeLayout(newOpcode);

switch(layoutAndSize)

{

#define LAYOUT_TYPE(layout) \

case Js::OpLayoutType::layout: \

Assert(layoutSize == Js::SmallLayout); \

this->Build##layout(newOpcode, offset); \

break;

#define LAYOUT_TYPE_WMS(layout) \

case Js::SmallLayout * Js::OpLayoutType::Count + Js::OpLayoutType::layout: \

this->Build##layout<Js::SmallLayoutSizePolicy>(newOpcode, offset); \

break; \

case Js::MediumLayout * Js::OpLayoutType::Count + Js::OpLayoutType::layout: \

this->Build##layout<Js::MediumLayoutSizePolicy>(newOpcode, offset); \

break; \

case Js::LargeLayout * Js::OpLayoutType::Count + Js::OpLayoutType::layout: \

this->Build##layout<Js::LargeLayoutSizePolicy>(newOpcode, offset); \

break;

#include "ByteCode\LayoutTypes.h"

default:

AssertMsg(0, "Unimplemented layout");

break;

}

#ifdef BAILOUT_INJECTION

if (!this->m_func->GetTopFunc()->HasTry() && Js::Configuration::Global.flags.IsEnabled(Js::BailOutByteCodeFlag))

{

ThreadContext * threadContext = this->m_func->GetScriptContext()->GetThreadContext();

if (lastInstr != m_lastInstr)

{

lastInstr = lastInstr->GetNextRealInstr();

if (lastInstr->HasBailOutInfo())

{

lastInstr = lastInstr->m_next;

}

lastInstr->bailOutByteCodeLocation = threadContext->bailOutByteCodeLocationCount;

lastInstr = m_lastInstr;

}

threadContext->bailOutByteCodeLocationCount++;

}

#endif

if (IsLoopBodyInTry() && m_lastInstr->GetDst() && m_lastInstr->GetDst()->IsRegOpnd() && m_lastInstr->GetDst()->GetStackSym()->HasByteCodeRegSlot())

{

StackSym * dstSym = m_lastInstr->GetDst()->GetStackSym();

Js::RegSlot dstRegSlot = dstSym->GetByteCodeRegSlot();

if (!this->RegIsTemp(dstRegSlot) && !this->RegIsConstant(dstRegSlot))

{

SymID symId = dstSym->m_id;

if (this->m_stSlots->Test(symId))

{

// For jitted loop bodies that are in a try block, we consider any symbol that has a

// non-temp bytecode reg slot, to be write-through. Hence, generating StSlots at all

// defs for such symbols

IR::Instr * stSlot = this->GenerateLoopBodyStSlot(dstRegSlot);

m_lastInstr->InsertAfter(stSlot);

m_lastInstr = stSlot;

this->m_stSlots->Clear(symId);

}

else

{

Assert(dstSym->m_isCatchObjectSym);

}

}

}

offset = m_jnReader.GetCurrentOffset();

if (m_func->IsJitInDebugMode())

{

bool needBailoutForHelper = CONFIG_FLAG(EnableContinueAfterExceptionWrappersForHelpers) &&

(OpCodeAttr::NeedsPostOpDbgBailOut(newOpcode) ||

m_lastInstr->m_opcode == Js::OpCode::CallHelper && m_lastInstr->GetSrc1() &&

HelperMethodAttributes::CanThrow(m_lastInstr->GetSrc1()->AsHelperCallOpnd()->m_fnHelper));

if (needBailoutForHelper)

{

// Insert bailout after return from a helper call.

// For now use offset of next instr, when we get & ignore exception, we replace this with next statement offset.

if (m_lastInstr->IsBranchInstr())

{

// Debugger bailout on branches goes to different block which can become dead. Keep bailout with real instr.

// Can't convert to bailout at this time, can do that only after branches are finalized, remember for later.

ignoreExBranchInstrToOffsetMap.Add(m_lastInstr, offset);

}

else if (

m_lastInstr->m_opcode == Js::OpCode::Throw ||

m_lastInstr->m_opcode == Js::OpCode::RuntimeReferenceError ||

m_lastInstr->m_opcode == Js::OpCode::RuntimeTypeError)

{

uint32 lastInstrOffset = m_lastInstr->GetByteCodeOffset();

Assert(lastInstrOffset < m_offsetToInstructionCount);

#if DBG

__analysis_assume(lastInstrOffset < this->m_offsetToInstructionCount);

#endif

bool isLastInstrUpdateNeeded = m_offsetToInstruction[lastInstrOffset] == m_lastInstr;

BailOutInfo * bailOutInfo = JitAnew(this->m_func->m_alloc, BailOutInfo, offset, this->m_func);

m_lastInstr = m_lastInstr->ConvertToBailOutInstr(bailOutInfo, c_debuggerBaseBailOutKindForHelper, true);

if (isLastInstrUpdateNeeded)

{

m_offsetToInstruction[lastInstrOffset] = m_lastInstr;

}

}

else

{

IR::BailOutKind bailOutKind = c_debuggerBaseBailOutKindForHelper;

if (OpCodeAttr::HasImplicitCall(newOpcode) || OpCodeAttr::CallsValueOf(newOpcode))

{

// When we get out of e.g. valueOf called by a helper (e.g. Add_A) during stepping,

// we need to bail out to continue debugging calling function in interpreter,

// essentially this is similar to bail out on return from a method.

bailOutKind |= c_debuggerBailOutKindForCall;

}

this->InsertBailOutForDebugger(offset, bailOutKind);

}

}

}

while (m_statementReader.AtStatementBoundary(&m_jnReader))

{

statementIndex = this->AddStatementBoundary(statementIndex, offset);

}

}

if (Js::Constants::NoStatementIndex != statementIndex)

{

// If we are inside a user statement then create a trailing line pragma instruction

statementIndex = this->AddStatementBoundary(statementIndex, Js::Constants::NoByteCodeOffset);

}

if (IsLoopBody())

{

// Insert the LdSlot/StSlot and Ret

IR::Opnd * retOpnd = this->InsertLoopBodyReturnIPInstr(offset, offset);

// Restore and Ret are at the last offset + 1

GenerateLoopBodySlotAccesses(lastOffset + 1);

InsertDoneLoopBodyLoopCounter(lastOffset);

IR::Instr * retInstr = IR::Instr::New(Js::OpCode::Ret, m_func);

retInstr->SetSrc1(retOpnd);

this->AddInstr(retInstr, lastOffset + 1);

}

// Now fix up the targets for all the branches we've introduced.

InsertLabels();

Assert(!this->catchOffsetStack || this->catchOffsetStack->Empty());

// Insert bailout for ignore exception for labels, after all labels were finalized.

ignoreExBranchInstrToOffsetMap.Map([this](IR::Instr* instr, int byteCodeOffset) {

BailOutInfo * bailOutInfo = JitAnew(this->m_func->m_alloc, BailOutInfo, byteCodeOffset, this->m_func);

instr->ConvertToBailOutInstr(bailOutInfo, c_debuggerBaseBailOutKindForHelper, true);

});

// Now that we know whether the func is a leaf or not, decide whether we'll emit fast paths.

// Do this once and for all, per-func, since the source size on the ThreadContext will be

// changing while we JIT.

if (this->m_func->IsTopFunc())

{

this->m_func->SetDoFastPaths();

this->EmitClosureRangeChecks();

}

}

void

IRBuilder::EmitClosureRangeChecks()

{

// Emit closure range checks

if (m_func->slotArrayCheckTable)

{

// Local slot array checks, should only be necessary in jitted loop bodies.

FOREACH_HASHTABLE_ENTRY(uint32, bucket, m_func->slotArrayCheckTable)

{

uint32 slotId = bucket.element;

Assert(slotId != (uint32)-1 && slotId >= Js::ScopeSlots::FirstSlotIndex);

if (slotId > Js::ScopeSlots::FirstSlotIndex)

{

// Emit a SlotArrayCheck instruction, chained to the instruction (LdSlot) that defines the pointer.

StackSym *stackSym = m_func->m_symTable->FindStackSym(bucket.value);

Assert(stackSym && stackSym->m_instrDef);

IR::Instr *instrDef = stackSym->m_instrDef;

IR::Instr *insertInstr = instrDef->m_next;

IR::RegOpnd *dstOpnd = instrDef->UnlinkDst()->AsRegOpnd();

IR::Instr *instr = IR::Instr::New(Js::OpCode::SlotArrayCheck, dstOpnd, m_func);

dstOpnd = IR::RegOpnd::New(TyVar, m_func);

instrDef->SetDst(dstOpnd);

instr->SetSrc1(dstOpnd);

// Attach the slot ID to the check instruction.

IR::IntConstOpnd *slotIdOpnd = IR::IntConstOpnd::New(bucket.element, TyUint32, m_func);

instr->SetSrc2(slotIdOpnd);

insertInstr->InsertBefore(instr);

}

}

NEXT_HASHTABLE_ENTRY;

}

if (m_func->frameDisplayCheckTable)

{

// Frame display checks. Again, chain to the instruction (LdEnv/LdSlot).

FOREACH_HASHTABLE_ENTRY(FrameDisplayCheckRecord*, bucket, m_func->frameDisplayCheckTable)

{

StackSym *stackSym = m_func->m_symTable->FindStackSym(bucket.value);

Assert(stackSym && stackSym->m_instrDef);

IR::Instr *instrDef = stackSym->m_instrDef;

IR::Instr *insertInstr = instrDef->m_next;

IR::RegOpnd *dstOpnd = instrDef->UnlinkDst()->AsRegOpnd();

IR::Instr *instr = IR::Instr::New(Js::OpCode::FrameDisplayCheck, dstOpnd, m_func);

dstOpnd = IR::RegOpnd::New(TyVar, m_func);

instrDef->SetDst(dstOpnd);

instr->SetSrc1(dstOpnd);

// Attach the two-dimensional check info.

IR::AddrOpnd *recordOpnd = IR::AddrOpnd::New(bucket.element, IR::AddrOpndKindDynamicMisc, m_func, true);

instr->SetSrc2(recordOpnd);

insertInstr->InsertBefore(instr);

}

NEXT_HASHTABLE_ENTRY;

}

// If not a loop, but there are loops and trys, restore scope slot pointer and FD

if (!m_func->IsLoopBody() && m_func->HasTry() && m_func->GetJnFunction()->GetByteCodeInLoopCount() != 0)

{

BVSparse<JitArenaAllocator> * bv = nullptr;

if (m_func->GetLocalClosureSym() && m_func->GetLocalClosureSym()->HasByteCodeRegSlot())

{

bv = JitAnew(m_func->m_alloc, BVSparse<JitArenaAllocator>, m_func->m_alloc);

bv->Set(m_func->GetLocalClosureSym()->m_id);

}

if (m_func->GetLocalFrameDisplaySym() && m_func->GetLocalFrameDisplaySym()->HasByteCodeRegSlot())

{

if (!bv)

{

bv = JitAnew(m_func->m_alloc, BVSparse<JitArenaAllocator>, m_func->m_alloc);

}

bv->Set(m_func->GetLocalFrameDisplaySym()->m_id);

}

if (bv)

{

IR::ByteCodeUsesInstr * byteCodeUse = IR::ByteCodeUsesInstr::New(m_func);

byteCodeUse->byteCodeUpwardExposedUsed = bv;

FOREACH_INSTR_IN_FUNC_BACKWARD(instr, m_func)

{

if (instr->m_opcode == Js::OpCode::Ret)

{

instr->InsertBefore(byteCodeUse);

break;

}

}

NEXT_INSTR_IN_FUNC_BACKWARD;

}

}

}

///----------------------------------------------------------------------------

///

/// IRBuilder::InsertLabels

///

/// Insert label instructions at the offsets recorded in the branch reloc list.

///

///----------------------------------------------------------------------------

void

IRBuilder::InsertLabels()

{

AssertMsg(this->branchRelocList, "Malformed branch reloc list");

SList<BranchReloc *>::Iterator iter(this->branchRelocList);

while (iter.Next())

{

IR::LabelInstr * labelInstr;

BranchReloc * reloc = iter.Data();

IR::BranchInstr * branchInstr = reloc->GetBranchInstr();

uint offset = reloc->GetOffset();

uint const branchOffset = reloc->GetBranchOffset();

Assert(!IsLoopBody() || offset <= GetLoopBodyExitInstrOffset());

if(branchInstr->m_opcode == Js::OpCode::MultiBr)

{

IR::MultiBranchInstr * multiBranchInstr = branchInstr->AsBranchInstr()->AsMultiBrInstr();