1/*
2 * Copyright (C) 2008-2019 Apple Inc. All rights reserved.
3 * Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 *
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
15 * its contributors may be used to endorse or promote products derived
16 * from this software without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
19 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
20 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
21 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
22 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
23 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
24 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
25 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
26 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
27 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
28 */
29
30#pragma once
31
32#include "ArrayProfile.h"
33#include "ByValInfo.h"
34#include "BytecodeConventions.h"
35#include "CallLinkInfo.h"
36#include "CodeBlockHash.h"
37#include "CodeOrigin.h"
38#include "CodeType.h"
39#include "CompilationResult.h"
40#include "ConcurrentJSLock.h"
41#include "DFGCommon.h"
42#include "DirectEvalCodeCache.h"
43#include "EvalExecutable.h"
44#include "ExecutionCounter.h"
45#include "ExpressionRangeInfo.h"
46#include "FunctionExecutable.h"
47#include "HandlerInfo.h"
48#include "ICStatusMap.h"
49#include "Instruction.h"
50#include "InstructionStream.h"
51#include "JITCode.h"
52#include "JITCodeMap.h"
53#include "JITMathICForwards.h"
54#include "JSCast.h"
55#include "JSGlobalObject.h"
56#include "JumpTable.h"
57#include "LLIntCallLinkInfo.h"
58#include "LazyOperandValueProfile.h"
59#include "MetadataTable.h"
60#include "ModuleProgramExecutable.h"
61#include "ObjectAllocationProfile.h"
62#include "Options.h"
63#include "Printer.h"
64#include "ProfilerJettisonReason.h"
65#include "ProgramExecutable.h"
66#include "PutPropertySlot.h"
67#include "ValueProfile.h"
68#include "VirtualRegister.h"
69#include "Watchpoint.h"
70#include <wtf/Bag.h>
71#include <wtf/FastMalloc.h>
72#include <wtf/RefCountedArray.h>
73#include <wtf/RefPtr.h>
74#include <wtf/SegmentedVector.h>
75#include <wtf/Vector.h>
76#include <wtf/text/WTFString.h>
77
78namespace JSC {
79
80#if ENABLE(DFG_JIT)
81namespace DFG {
82struct OSRExitState;
83} // namespace DFG
84#endif
85
86class BytecodeLivenessAnalysis;
87class CodeBlockSet;
88class ExecutableToCodeBlockEdge;
89class JSModuleEnvironment;
90class LLIntOffsetsExtractor;
91class LLIntPrototypeLoadAdaptiveStructureWatchpoint;
92class MetadataTable;
93class PCToCodeOriginMap;
94class RegisterAtOffsetList;
95class StructureStubInfo;
96
97enum class AccessType : int8_t;
98
99struct ArithProfile;
100struct OpCatch;
101
102enum ReoptimizationMode { DontCountReoptimization, CountReoptimization };
103
104class CodeBlock : public JSCell {
105 typedef JSCell Base;
106 friend class BytecodeLivenessAnalysis;
107 friend class JIT;
108 friend class LLIntOffsetsExtractor;
109
110public:
111
112 enum CopyParsedBlockTag { CopyParsedBlock };
113
114 static const unsigned StructureFlags = Base::StructureFlags | StructureIsImmortal;
115 static const bool needsDestruction = true;
116
117 template<typename, SubspaceAccess>
118 static void subspaceFor(VM&) { }
119
120 DECLARE_INFO;
121
122protected:
123 CodeBlock(VM*, Structure*, CopyParsedBlockTag, CodeBlock& other);
124 CodeBlock(VM*, Structure*, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*);
125
126 void finishCreation(VM&, CopyParsedBlockTag, CodeBlock& other);
127 bool finishCreation(VM&, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock*, JSScope*);
128
129 void finishCreationCommon(VM&);
130
131 WriteBarrier<JSGlobalObject> m_globalObject;
132
133public:
134 JS_EXPORT_PRIVATE ~CodeBlock();
135
136 UnlinkedCodeBlock* unlinkedCodeBlock() const { return m_unlinkedCode.get(); }
137
138 CString inferredName() const;
139 CodeBlockHash hash() const;
140 bool hasHash() const;
141 bool isSafeToComputeHash() const;
142 CString hashAsStringIfPossible() const;
143 CString sourceCodeForTools() const; // Not quite the actual source we parsed; this will do things like prefix the source for a function with a reified signature.
144 CString sourceCodeOnOneLine() const; // As sourceCodeForTools(), but replaces all whitespace runs with a single space.
145 void dumpAssumingJITType(PrintStream&, JITType) const;
146 JS_EXPORT_PRIVATE void dump(PrintStream&) const;
147
148 int numParameters() const { return m_numParameters; }
149 void setNumParameters(int newValue);
150
151 int numberOfArgumentsToSkip() const { return m_numberOfArgumentsToSkip; }
152
153 int numCalleeLocals() const { return m_numCalleeLocals; }
154
155 int numVars() const { return m_numVars; }
156
157 int* addressOfNumParameters() { return &m_numParameters; }
158 static ptrdiff_t offsetOfNumParameters() { return OBJECT_OFFSETOF(CodeBlock, m_numParameters); }
159
160 CodeBlock* alternative() const { return static_cast<CodeBlock*>(m_alternative.get()); }
161 void setAlternative(VM&, CodeBlock*);
162
163 template <typename Functor> void forEachRelatedCodeBlock(Functor&& functor)
164 {
165 Functor f(std::forward<Functor>(functor));
166 Vector<CodeBlock*, 4> codeBlocks;
167 codeBlocks.append(this);
168
169 while (!codeBlocks.isEmpty()) {
170 CodeBlock* currentCodeBlock = codeBlocks.takeLast();
171 f(currentCodeBlock);
172
173 if (CodeBlock* alternative = currentCodeBlock->alternative())
174 codeBlocks.append(alternative);
175 if (CodeBlock* osrEntryBlock = currentCodeBlock->specialOSREntryBlockOrNull())
176 codeBlocks.append(osrEntryBlock);
177 }
178 }
179
180 CodeSpecializationKind specializationKind() const
181 {
182 return specializationFromIsConstruct(isConstructor());
183 }
184
185 CodeBlock* alternativeForJettison();
186 JS_EXPORT_PRIVATE CodeBlock* baselineAlternative();
187
188 // FIXME: Get rid of this.
189 // https://bugs.webkit.org/show_bug.cgi?id=123677
190 CodeBlock* baselineVersion();
191
192 static size_t estimatedSize(JSCell*, VM&);
193 static void visitChildren(JSCell*, SlotVisitor&);
194 static void destroy(JSCell*);
195 void visitChildren(SlotVisitor&);
196 void finalizeUnconditionally(VM&);
197
198 void notifyLexicalBindingUpdate();
199
200 void dumpSource();
201 void dumpSource(PrintStream&);
202
203 void dumpBytecode();
204 void dumpBytecode(PrintStream&);
205 void dumpBytecode(PrintStream& out, const InstructionStream::Ref& it, const ICStatusMap& = ICStatusMap());
206 void dumpBytecode(PrintStream& out, unsigned bytecodeOffset, const ICStatusMap& = ICStatusMap());
207
208 void dumpExceptionHandlers(PrintStream&);
209 void printStructures(PrintStream&, const Instruction*);
210 void printStructure(PrintStream&, const char* name, const Instruction*, int operand);
211
212 void dumpMathICStats();
213
214 bool isStrictMode() const { return m_unlinkedCode->isStrictMode(); }
215 bool isConstructor() const { return m_unlinkedCode->isConstructor(); }
216 ECMAMode ecmaMode() const { return isStrictMode() ? StrictMode : NotStrictMode; }
217 CodeType codeType() const { return m_unlinkedCode->codeType(); }
218
219 JSParserScriptMode scriptMode() const { return m_unlinkedCode->scriptMode(); }
220
221 bool hasInstalledVMTrapBreakpoints() const;
222 bool installVMTrapBreakpoints();
223
224 inline bool isKnownNotImmediate(int index)
225 {
226 if (index == thisRegister().offset() && !isStrictMode())
227 return true;
228
229 if (isConstantRegisterIndex(index))
230 return getConstant(index).isCell();
231
232 return false;
233 }
234
235 ALWAYS_INLINE bool isTemporaryRegisterIndex(int index)
236 {
237 return index >= m_numVars;
238 }
239
240 HandlerInfo* handlerForBytecodeOffset(unsigned bytecodeOffset, RequiredHandler = RequiredHandler::AnyHandler);
241 HandlerInfo* handlerForIndex(unsigned, RequiredHandler = RequiredHandler::AnyHandler);
242 void removeExceptionHandlerForCallSite(CallSiteIndex);
243 unsigned lineNumberForBytecodeOffset(unsigned bytecodeOffset);
244 unsigned columnNumberForBytecodeOffset(unsigned bytecodeOffset);
245 void expressionRangeForBytecodeOffset(unsigned bytecodeOffset, int& divot,
246 int& startOffset, int& endOffset, unsigned& line, unsigned& column) const;
247
248 Optional<unsigned> bytecodeOffsetFromCallSiteIndex(CallSiteIndex);
249
250 void getICStatusMap(const ConcurrentJSLocker&, ICStatusMap& result);
251 void getICStatusMap(ICStatusMap& result);
252
253#if ENABLE(JIT)
254 struct JITData {
255 WTF_MAKE_STRUCT_FAST_ALLOCATED;
256
257 Bag<StructureStubInfo> m_stubInfos;
258 Bag<JITAddIC> m_addICs;
259 Bag<JITMulIC> m_mulICs;
260 Bag<JITNegIC> m_negICs;
261 Bag<JITSubIC> m_subICs;
262 Bag<ByValInfo> m_byValInfos;
263 Bag<CallLinkInfo> m_callLinkInfos;
264 SentinelLinkedList<CallLinkInfo, PackedRawSentinelNode<CallLinkInfo>> m_incomingCalls;
265 SentinelLinkedList<PolymorphicCallNode, PackedRawSentinelNode<PolymorphicCallNode>> m_incomingPolymorphicCalls;
266 SegmentedVector<RareCaseProfile, 8> m_rareCaseProfiles;
267 std::unique_ptr<PCToCodeOriginMap> m_pcToCodeOriginMap;
268 std::unique_ptr<RegisterAtOffsetList> m_calleeSaveRegisters;
269 JITCodeMap m_jitCodeMap;
270 };
271
272 JITData& ensureJITData(const ConcurrentJSLocker& locker)
273 {
274 if (LIKELY(m_jitData))
275 return *m_jitData;
276 return ensureJITDataSlow(locker);
277 }
278 JITData& ensureJITDataSlow(const ConcurrentJSLocker&);
279
280 JITAddIC* addJITAddIC(ArithProfile*);
281 JITMulIC* addJITMulIC(ArithProfile*);
282 JITNegIC* addJITNegIC(ArithProfile*);
283 JITSubIC* addJITSubIC(ArithProfile*);
284
285 template <typename Generator, typename = typename std::enable_if<std::is_same<Generator, JITAddGenerator>::value>::type>
286 JITAddIC* addMathIC(ArithProfile* profile) { return addJITAddIC(profile); }
287
288 template <typename Generator, typename = typename std::enable_if<std::is_same<Generator, JITMulGenerator>::value>::type>
289 JITMulIC* addMathIC(ArithProfile* profile) { return addJITMulIC(profile); }
290
291 template <typename Generator, typename = typename std::enable_if<std::is_same<Generator, JITNegGenerator>::value>::type>
292 JITNegIC* addMathIC(ArithProfile* profile) { return addJITNegIC(profile); }
293
294 template <typename Generator, typename = typename std::enable_if<std::is_same<Generator, JITSubGenerator>::value>::type>
295 JITSubIC* addMathIC(ArithProfile* profile) { return addJITSubIC(profile); }
296
297 StructureStubInfo* addStubInfo(AccessType);
298
299 // O(n) operation. Use getStubInfoMap() unless you really only intend to get one
300 // stub info.
301 StructureStubInfo* findStubInfo(CodeOrigin);
302
303 ByValInfo* addByValInfo();
304
305 CallLinkInfo* addCallLinkInfo();
306
307 // This is a slow function call used primarily for compiling OSR exits in the case
308 // that there had been inlining. Chances are if you want to use this, you're really
309 // looking for a CallLinkInfoMap to amortize the cost of calling this.
310 CallLinkInfo* getCallLinkInfoForBytecodeIndex(unsigned bytecodeIndex);
311
312 void setJITCodeMap(JITCodeMap&& jitCodeMap)
313 {
314 ConcurrentJSLocker locker(m_lock);
315 ensureJITData(locker).m_jitCodeMap = WTFMove(jitCodeMap);
316 }
317 const JITCodeMap& jitCodeMap()
318 {
319 ConcurrentJSLocker locker(m_lock);
320 return ensureJITData(locker).m_jitCodeMap;
321 }
322
323 void setPCToCodeOriginMap(std::unique_ptr<PCToCodeOriginMap>&&);
324 Optional<CodeOrigin> findPC(void* pc);
325
326 void setCalleeSaveRegisters(RegisterSet);
327 void setCalleeSaveRegisters(std::unique_ptr<RegisterAtOffsetList>);
328
329 RareCaseProfile* addRareCaseProfile(int bytecodeOffset);
330 RareCaseProfile* rareCaseProfileForBytecodeOffset(const ConcurrentJSLocker&, int bytecodeOffset);
331 unsigned rareCaseProfileCountForBytecodeOffset(const ConcurrentJSLocker&, int bytecodeOffset);
332
333 bool likelyToTakeSlowCase(int bytecodeOffset)
334 {
335 if (!hasBaselineJITProfiling())
336 return false;
337 ConcurrentJSLocker locker(m_lock);
338 unsigned value = rareCaseProfileCountForBytecodeOffset(locker, bytecodeOffset);
339 return value >= Options::likelyToTakeSlowCaseMinimumCount();
340 }
341
342 bool couldTakeSlowCase(int bytecodeOffset)
343 {
344 if (!hasBaselineJITProfiling())
345 return false;
346 ConcurrentJSLocker locker(m_lock);
347 unsigned value = rareCaseProfileCountForBytecodeOffset(locker, bytecodeOffset);
348 return value >= Options::couldTakeSlowCaseMinimumCount();
349 }
350
351 // We call this when we want to reattempt compiling something with the baseline JIT. Ideally
352 // the baseline JIT would not add data to CodeBlock, but instead it would put its data into
353 // a newly created JITCode, which could be thrown away if we bail on JIT compilation. Then we
354 // would be able to get rid of this silly function.
355 // FIXME: https://bugs.webkit.org/show_bug.cgi?id=159061
356 void resetJITData();
357#endif // ENABLE(JIT)
358
359 void unlinkIncomingCalls();
360
361#if ENABLE(JIT)
362 void linkIncomingCall(ExecState* callerFrame, CallLinkInfo*);
363 void linkIncomingPolymorphicCall(ExecState* callerFrame, PolymorphicCallNode*);
364#endif // ENABLE(JIT)
365
366 void linkIncomingCall(ExecState* callerFrame, LLIntCallLinkInfo*);
367
368 const Instruction* outOfLineJumpTarget(const Instruction* pc);
369 int outOfLineJumpOffset(const Instruction* pc);
370 int outOfLineJumpOffset(const InstructionStream::Ref& instruction)
371 {
372 return outOfLineJumpOffset(instruction.ptr());
373 }
374
375 inline unsigned bytecodeOffset(const Instruction* returnAddress)
376 {
377 const auto* instructionsBegin = instructions().at(0).ptr();
378 const auto* instructionsEnd = reinterpret_cast<const Instruction*>(reinterpret_cast<uintptr_t>(instructionsBegin) + instructions().size());
379 RELEASE_ASSERT(returnAddress >= instructionsBegin && returnAddress < instructionsEnd);
380 return returnAddress - instructionsBegin;
381 }
382
383 const InstructionStream& instructions() const { return m_unlinkedCode->instructions(); }
384
385 size_t predictedMachineCodeSize();
386
387 unsigned instructionsSize() const { return instructions().size(); }
388 unsigned bytecodeCost() const { return m_bytecodeCost; }
389
390 // Exactly equivalent to codeBlock->ownerExecutable()->newReplacementCodeBlockFor(codeBlock->specializationKind())
391 CodeBlock* newReplacement();
392
393 void setJITCode(Ref<JITCode>&& code)
394 {
395 ASSERT(heap()->isDeferred());
396 if (!code->isShared())
397 heap()->reportExtraMemoryAllocated(code->size());
398
399 ConcurrentJSLocker locker(m_lock);
400 WTF::storeStoreFence(); // This is probably not needed because the lock will also do something similar, but it's good to be paranoid.
401 m_jitCode = WTFMove(code);
402 }
403
404 RefPtr<JITCode> jitCode() { return m_jitCode; }
405 static ptrdiff_t jitCodeOffset() { return OBJECT_OFFSETOF(CodeBlock, m_jitCode); }
406 JITType jitType() const
407 {
408 JITCode* jitCode = m_jitCode.get();
409 WTF::loadLoadFence();
410 JITType result = JITCode::jitTypeFor(jitCode);
411 WTF::loadLoadFence(); // This probably isn't needed. Oh well, paranoia is good.
412 return result;
413 }
414
415 bool hasBaselineJITProfiling() const
416 {
417 return jitType() == JITType::BaselineJIT;
418 }
419
420#if ENABLE(JIT)
421 CodeBlock* replacement();
422
423 DFG::CapabilityLevel computeCapabilityLevel();
424 DFG::CapabilityLevel capabilityLevel();
425 DFG::CapabilityLevel capabilityLevelState() { return static_cast<DFG::CapabilityLevel>(m_capabilityLevelState); }
426
427 bool hasOptimizedReplacement(JITType typeToReplace);
428 bool hasOptimizedReplacement(); // the typeToReplace is my JITType
429#endif
430
431 void jettison(Profiler::JettisonReason, ReoptimizationMode = DontCountReoptimization, const FireDetail* = nullptr);
432
433 ScriptExecutable* ownerExecutable() const { return m_ownerExecutable.get(); }
434
435 ExecutableToCodeBlockEdge* ownerEdge() const { return m_ownerEdge.get(); }
436
437 VM* vm() const { return m_vm; }
438
439 VirtualRegister thisRegister() const { return m_unlinkedCode->thisRegister(); }
440
441 bool usesEval() const { return m_unlinkedCode->usesEval(); }
442
443 void setScopeRegister(VirtualRegister scopeRegister)
444 {
445 ASSERT(scopeRegister.isLocal() || !scopeRegister.isValid());
446 m_scopeRegister = scopeRegister;
447 }
448
449 VirtualRegister scopeRegister() const
450 {
451 return m_scopeRegister;
452 }
453
454 PutPropertySlot::Context putByIdContext() const
455 {
456 if (codeType() == EvalCode)
457 return PutPropertySlot::PutByIdEval;
458 return PutPropertySlot::PutById;
459 }
460
461 const SourceCode& source() const { return m_ownerExecutable->source(); }
462 unsigned sourceOffset() const { return m_ownerExecutable->source().startOffset(); }
463 unsigned firstLineColumnOffset() const { return m_ownerExecutable->startColumn(); }
464
465 size_t numberOfJumpTargets() const { return m_unlinkedCode->numberOfJumpTargets(); }
466 unsigned jumpTarget(int index) const { return m_unlinkedCode->jumpTarget(index); }
467
468 String nameForRegister(VirtualRegister);
469
470 unsigned numberOfArgumentValueProfiles()
471 {
472 ASSERT(m_numParameters >= 0);
473 ASSERT(m_argumentValueProfiles.size() == static_cast<unsigned>(m_numParameters) || !vm()->canUseJIT());
474 return m_argumentValueProfiles.size();
475 }
476
477 ValueProfile& valueProfileForArgument(unsigned argumentIndex)
478 {
479 ASSERT(vm()->canUseJIT()); // This is only called from the various JIT compilers or places that first check numberOfArgumentValueProfiles before calling this.
480 ValueProfile& result = m_argumentValueProfiles[argumentIndex];
481 ASSERT(result.m_bytecodeOffset == -1);
482 return result;
483 }
484
485 ValueProfile& valueProfileForBytecodeOffset(int bytecodeOffset);
486 SpeculatedType valueProfilePredictionForBytecodeOffset(const ConcurrentJSLocker&, int bytecodeOffset);
487
488 template<typename Functor> void forEachValueProfile(const Functor&);
489 template<typename Functor> void forEachArrayProfile(const Functor&);
490 template<typename Functor> void forEachArrayAllocationProfile(const Functor&);
491 template<typename Functor> void forEachObjectAllocationProfile(const Functor&);
492 template<typename Functor> void forEachLLIntCallLinkInfo(const Functor&);
493
494 ArithProfile* arithProfileForBytecodeOffset(InstructionStream::Offset bytecodeOffset);
495 ArithProfile* arithProfileForPC(const Instruction*);
496
497 bool couldTakeSpecialFastCase(InstructionStream::Offset bytecodeOffset);
498
499 ArrayProfile* getArrayProfile(const ConcurrentJSLocker&, unsigned bytecodeOffset);
500 ArrayProfile* getArrayProfile(unsigned bytecodeOffset);
501
502 // Exception handling support
503
504 size_t numberOfExceptionHandlers() const { return m_rareData ? m_rareData->m_exceptionHandlers.size() : 0; }
505 HandlerInfo& exceptionHandler(int index) { RELEASE_ASSERT(m_rareData); return m_rareData->m_exceptionHandlers[index]; }
506
507 bool hasExpressionInfo() { return m_unlinkedCode->hasExpressionInfo(); }
508
509#if ENABLE(DFG_JIT)
510 Vector<CodeOrigin, 0, UnsafeVectorOverflow>& codeOrigins();
511
512 // Having code origins implies that there has been some inlining.
513 bool hasCodeOrigins()
514 {
515 return JITCode::isOptimizingJIT(jitType());
516 }
517
518 bool canGetCodeOrigin(CallSiteIndex index)
519 {
520 if (!hasCodeOrigins())
521 return false;
522 return index.bits() < codeOrigins().size();
523 }
524
525 CodeOrigin codeOrigin(CallSiteIndex index)
526 {
527 return codeOrigins()[index.bits()];
528 }
529
530 CompressedLazyOperandValueProfileHolder& lazyOperandValueProfiles(const ConcurrentJSLocker&)
531 {
532 return m_lazyOperandValueProfiles;
533 }
534#endif // ENABLE(DFG_JIT)
535
536 // Constant Pool
537#if ENABLE(DFG_JIT)
538 size_t numberOfIdentifiers() const { return m_unlinkedCode->numberOfIdentifiers() + numberOfDFGIdentifiers(); }
539 size_t numberOfDFGIdentifiers() const;
540 const Identifier& identifier(int index) const;
541#else
542 size_t numberOfIdentifiers() const { return m_unlinkedCode->numberOfIdentifiers(); }
543 const Identifier& identifier(int index) const { return m_unlinkedCode->identifier(index); }
544#endif
545
546 Vector<WriteBarrier<Unknown>>& constants() { return m_constantRegisters; }
547 Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation() { return m_constantsSourceCodeRepresentation; }
548 unsigned addConstant(JSValue v)
549 {
550 unsigned result = m_constantRegisters.size();
551 m_constantRegisters.append(WriteBarrier<Unknown>());
552 m_constantRegisters.last().set(*m_vm, this, v);
553 m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
554 return result;
555 }
556
557 unsigned addConstantLazily()
558 {
559 unsigned result = m_constantRegisters.size();
560 m_constantRegisters.append(WriteBarrier<Unknown>());
561 m_constantsSourceCodeRepresentation.append(SourceCodeRepresentation::Other);
562 return result;
563 }
564
565 const Vector<WriteBarrier<Unknown>>& constantRegisters() { return m_constantRegisters; }
566 WriteBarrier<Unknown>& constantRegister(int index) { return m_constantRegisters[index - FirstConstantRegisterIndex]; }
567 static ALWAYS_INLINE bool isConstantRegisterIndex(int index) { return index >= FirstConstantRegisterIndex; }
568 ALWAYS_INLINE JSValue getConstant(int index) const { return m_constantRegisters[index - FirstConstantRegisterIndex].get(); }
569 ALWAYS_INLINE SourceCodeRepresentation constantSourceCodeRepresentation(int index) const { return m_constantsSourceCodeRepresentation[index - FirstConstantRegisterIndex]; }
570
571 FunctionExecutable* functionDecl(int index) { return m_functionDecls[index].get(); }
572 int numberOfFunctionDecls() { return m_functionDecls.size(); }
573 FunctionExecutable* functionExpr(int index) { return m_functionExprs[index].get(); }
574
575 const BitVector& bitVector(size_t i) { return m_unlinkedCode->bitVector(i); }
576
577 Heap* heap() const { return &m_vm->heap; }
578 JSGlobalObject* globalObject() { return m_globalObject.get(); }
579
580 JSGlobalObject* globalObjectFor(CodeOrigin);
581
582 BytecodeLivenessAnalysis& livenessAnalysis()
583 {
584 return m_unlinkedCode->livenessAnalysis(this);
585 }
586
587 void validate();
588
589 // Jump Tables
590
591 size_t numberOfSwitchJumpTables() const { return m_rareData ? m_rareData->m_switchJumpTables.size() : 0; }
592 SimpleJumpTable& addSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_switchJumpTables.append(SimpleJumpTable()); return m_rareData->m_switchJumpTables.last(); }
593 SimpleJumpTable& switchJumpTable(int tableIndex) { RELEASE_ASSERT(m_rareData); return m_rareData->m_switchJumpTables[tableIndex]; }
594 void clearSwitchJumpTables()
595 {
596 if (!m_rareData)
597 return;
598 m_rareData->m_switchJumpTables.clear();
599 }
600
601 size_t numberOfStringSwitchJumpTables() const { return m_rareData ? m_rareData->m_stringSwitchJumpTables.size() : 0; }
602 StringJumpTable& addStringSwitchJumpTable() { createRareDataIfNecessary(); m_rareData->m_stringSwitchJumpTables.append(StringJumpTable()); return m_rareData->m_stringSwitchJumpTables.last(); }
603 StringJumpTable& stringSwitchJumpTable(int tableIndex) { RELEASE_ASSERT(m_rareData); return m_rareData->m_stringSwitchJumpTables[tableIndex]; }
604
605 DirectEvalCodeCache& directEvalCodeCache() { createRareDataIfNecessary(); return m_rareData->m_directEvalCodeCache; }
606
607 enum ShrinkMode {
608 // Shrink prior to generating machine code that may point directly into vectors.
609 EarlyShrink,
610
611 // Shrink after generating machine code, and after possibly creating new vectors
612 // and appending to others. At this time it is not safe to shrink certain vectors
613 // because we would have generated machine code that references them directly.
614 LateShrink
615 };
616 void shrinkToFit(ShrinkMode);
617
618 // Functions for controlling when JITting kicks in, in a mixed mode
619 // execution world.
620
621 bool checkIfJITThresholdReached()
622 {
623 return m_llintExecuteCounter.checkIfThresholdCrossedAndSet(this);
624 }
625
626 void dontJITAnytimeSoon()
627 {
628 m_llintExecuteCounter.deferIndefinitely();
629 }
630
631 int32_t thresholdForJIT(int32_t threshold);
632 void jitAfterWarmUp();
633 void jitSoon();
634
635 const BaselineExecutionCounter& llintExecuteCounter() const
636 {
637 return m_llintExecuteCounter;
638 }
639
640 typedef HashMap<std::tuple<StructureID, unsigned>, Vector<LLIntPrototypeLoadAdaptiveStructureWatchpoint>> StructureWatchpointMap;
641 StructureWatchpointMap& llintGetByIdWatchpointMap() { return m_llintGetByIdWatchpointMap; }
642
643 // Functions for controlling when tiered compilation kicks in. This
644 // controls both when the optimizing compiler is invoked and when OSR
645 // entry happens. Two triggers exist: the loop trigger and the return
646 // trigger. In either case, when an addition to m_jitExecuteCounter
647 // causes it to become non-negative, the optimizing compiler is
648 // invoked. This includes a fast check to see if this CodeBlock has
649 // already been optimized (i.e. replacement() returns a CodeBlock
650 // that was optimized with a higher tier JIT than this one). In the
651 // case of the loop trigger, if the optimized compilation succeeds
652 // (or has already succeeded in the past) then OSR is attempted to
653 // redirect program flow into the optimized code.
654
655 // These functions are called from within the optimization triggers,
656 // and are used as a single point at which we define the heuristics
657 // for how much warm-up is mandated before the next optimization
658 // trigger files. All CodeBlocks start out with optimizeAfterWarmUp(),
659 // as this is called from the CodeBlock constructor.
660
661 // When we observe a lot of speculation failures, we trigger a
662 // reoptimization. But each time, we increase the optimization trigger
663 // to avoid thrashing.
664 JS_EXPORT_PRIVATE unsigned reoptimizationRetryCounter() const;
665 void countReoptimization();
666
667#if !ENABLE(C_LOOP)
668 const RegisterAtOffsetList* calleeSaveRegisters() const;
669
670 static unsigned numberOfLLIntBaselineCalleeSaveRegisters() { return RegisterSet::llintBaselineCalleeSaveRegisters().numberOfSetRegisters(); }
671 static size_t llintBaselineCalleeSaveSpaceAsVirtualRegisters();
672 size_t calleeSaveSpaceAsVirtualRegisters();
673#else
674 static unsigned numberOfLLIntBaselineCalleeSaveRegisters() { return 0; }
675 static size_t llintBaselineCalleeSaveSpaceAsVirtualRegisters() { return 1; };
676 size_t calleeSaveSpaceAsVirtualRegisters() { return 0; }
677#endif
678
679#if ENABLE(JIT)
680 unsigned numberOfDFGCompiles();
681
682 int32_t codeTypeThresholdMultiplier() const;
683
684 int32_t adjustedCounterValue(int32_t desiredThreshold);
685
686 int32_t* addressOfJITExecuteCounter()
687 {
688 return &m_jitExecuteCounter.m_counter;
689 }
690
691 static ptrdiff_t offsetOfJITExecuteCounter() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(BaselineExecutionCounter, m_counter); }
692 static ptrdiff_t offsetOfJITExecutionActiveThreshold() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(BaselineExecutionCounter, m_activeThreshold); }
693 static ptrdiff_t offsetOfJITExecutionTotalCount() { return OBJECT_OFFSETOF(CodeBlock, m_jitExecuteCounter) + OBJECT_OFFSETOF(BaselineExecutionCounter, m_totalCount); }
694
695 const BaselineExecutionCounter& jitExecuteCounter() const { return m_jitExecuteCounter; }
696
697 unsigned optimizationDelayCounter() const { return m_optimizationDelayCounter; }
698
699 // Check if the optimization threshold has been reached, and if not,
700 // adjust the heuristics accordingly. Returns true if the threshold has
701 // been reached.
702 bool checkIfOptimizationThresholdReached();
703
704 // Call this to force the next optimization trigger to fire. This is
705 // rarely wise, since optimization triggers are typically more
706 // expensive than executing baseline code.
707 void optimizeNextInvocation();
708
709 // Call this to prevent optimization from happening again. Note that
710 // optimization will still happen after roughly 2^29 invocations,
711 // so this is really meant to delay that as much as possible. This
712 // is called if optimization failed, and we expect it to fail in
713 // the future as well.
714 void dontOptimizeAnytimeSoon();
715
716 // Call this to reinitialize the counter to its starting state,
717 // forcing a warm-up to happen before the next optimization trigger
718 // fires. This is called in the CodeBlock constructor. It also
719 // makes sense to call this if an OSR exit occurred. Note that
720 // OSR exit code is code generated, so the value of the execute
721 // counter that this corresponds to is also available directly.
722 void optimizeAfterWarmUp();
723
724 // Call this to force an optimization trigger to fire only after
725 // a lot of warm-up.
726 void optimizeAfterLongWarmUp();
727
728 // Call this to cause an optimization trigger to fire soon, but
729 // not necessarily the next one. This makes sense if optimization
730 // succeeds. Successful optimization means that all calls are
731 // relinked to the optimized code, so this only affects call
732 // frames that are still executing this CodeBlock. The value here
733 // is tuned to strike a balance between the cost of OSR entry
734 // (which is too high to warrant making every loop back edge to
735 // trigger OSR immediately) and the cost of executing baseline
736 // code (which is high enough that we don't necessarily want to
737 // have a full warm-up). The intuition for calling this instead of
738 // optimizeNextInvocation() is for the case of recursive functions
739 // with loops. Consider that there may be N call frames of some
740 // recursive function, for a reasonably large value of N. The top
741 // one triggers optimization, and then returns, and then all of
742 // the others return. We don't want optimization to be triggered on
743 // each return, as that would be superfluous. It only makes sense
744 // to trigger optimization if one of those functions becomes hot
745 // in the baseline code.
746 void optimizeSoon();
747
748 void forceOptimizationSlowPathConcurrently();
749
750 void setOptimizationThresholdBasedOnCompilationResult(CompilationResult);
751
752 uint32_t osrExitCounter() const { return m_osrExitCounter; }
753
754 void countOSRExit() { m_osrExitCounter++; }
755
756 enum class OptimizeAction { None, ReoptimizeNow };
757#if ENABLE(DFG_JIT)
758 OptimizeAction updateOSRExitCounterAndCheckIfNeedToReoptimize(DFG::OSRExitState&);
759#endif
760
761 static ptrdiff_t offsetOfOSRExitCounter() { return OBJECT_OFFSETOF(CodeBlock, m_osrExitCounter); }
762
763 uint32_t adjustedExitCountThreshold(uint32_t desiredThreshold);
764 uint32_t exitCountThresholdForReoptimization();
765 uint32_t exitCountThresholdForReoptimizationFromLoop();
766 bool shouldReoptimizeNow();
767 bool shouldReoptimizeFromLoopNow();
768
769#else // No JIT
770 void optimizeAfterWarmUp() { }
771 unsigned numberOfDFGCompiles() { return 0; }
772#endif
773
774 bool shouldOptimizeNow();
775 void updateAllValueProfilePredictions();
776 void updateAllArrayPredictions();
777 void updateAllPredictions();
778
779 unsigned frameRegisterCount();
780 int stackPointerOffset();
781
782 bool hasOpDebugForLineAndColumn(unsigned line, unsigned column);
783
784 bool hasDebuggerRequests() const { return m_debuggerRequests; }
785 void* debuggerRequestsAddress() { return &m_debuggerRequests; }
786
787 void addBreakpoint(unsigned numBreakpoints);
788 void removeBreakpoint(unsigned numBreakpoints)
789 {
790 ASSERT(m_numBreakpoints >= numBreakpoints);
791 m_numBreakpoints -= numBreakpoints;
792 }
793
794 enum SteppingMode {
795 SteppingModeDisabled,
796 SteppingModeEnabled
797 };
798 void setSteppingMode(SteppingMode);
799
800 void clearDebuggerRequests()
801 {
802 m_steppingMode = SteppingModeDisabled;
803 m_numBreakpoints = 0;
804 }
805
806 bool wasCompiledWithDebuggingOpcodes() const { return m_unlinkedCode->wasCompiledWithDebuggingOpcodes(); }
807
808 // This is intentionally public; it's the responsibility of anyone doing any
809 // of the following to hold the lock:
810 //
811 // - Modifying any inline cache in this code block.
812 //
813 // - Quering any inline cache in this code block, from a thread other than
814 // the main thread.
815 //
816 // Additionally, it's only legal to modify the inline cache on the main
817 // thread. This means that the main thread can query the inline cache without
818 // locking. This is crucial since executing the inline cache is effectively
819 // "querying" it.
820 //
821 // Another exception to the rules is that the GC can do whatever it wants
822 // without holding any locks, because the GC is guaranteed to wait until any
823 // concurrent compilation threads finish what they're doing.
824 mutable ConcurrentJSLock m_lock;
825
826 bool m_shouldAlwaysBeInlined; // Not a bitfield because the JIT wants to store to it.
827
828#if ENABLE(JIT)
829 unsigned m_capabilityLevelState : 2; // DFG::CapabilityLevel
830#endif
831
832 bool m_allTransitionsHaveBeenMarked : 1; // Initialized and used on every GC.
833
834 bool m_didFailJITCompilation : 1;
835 bool m_didFailFTLCompilation : 1;
836 bool m_hasBeenCompiledWithFTL : 1;
837
838 // Internal methods for use by validation code. It would be private if it wasn't
839 // for the fact that we use it from anonymous namespaces.
840 void beginValidationDidFail();
841 NO_RETURN_DUE_TO_CRASH void endValidationDidFail();
842
843 struct RareData {
844 WTF_MAKE_FAST_ALLOCATED;
845 public:
846 Vector<HandlerInfo> m_exceptionHandlers;
847
848 // Jump Tables
849 Vector<SimpleJumpTable> m_switchJumpTables;
850 Vector<StringJumpTable> m_stringSwitchJumpTables;
851
852 Vector<std::unique_ptr<ValueProfileAndOperandBuffer>> m_catchProfiles;
853
854 DirectEvalCodeCache m_directEvalCodeCache;
855 };
856
857 void clearExceptionHandlers()
858 {
859 if (m_rareData)
860 m_rareData->m_exceptionHandlers.clear();
861 }
862
863 void appendExceptionHandler(const HandlerInfo& handler)
864 {
865 createRareDataIfNecessary(); // We may be handling the exception of an inlined call frame.
866 m_rareData->m_exceptionHandlers.append(handler);
867 }
868
869 CallSiteIndex newExceptionHandlingCallSiteIndex(CallSiteIndex originalCallSite);
870
871 void ensureCatchLivenessIsComputedForBytecodeOffset(InstructionStream::Offset bytecodeOffset);
872
873 bool hasTailCalls() const { return m_unlinkedCode->hasTailCalls(); }
874
875 template<typename Metadata>
876 Metadata& metadata(OpcodeID opcodeID, unsigned metadataID)
877 {
878 ASSERT(m_metadata);
879 return bitwise_cast<Metadata*>(m_metadata->get(opcodeID))[metadataID];
880 }
881
882 size_t metadataSizeInBytes()
883 {
884 return m_unlinkedCode->metadataSizeInBytes();
885 }
886
887protected:
888 void finalizeLLIntInlineCaches();
889#if ENABLE(JIT)
890 void finalizeBaselineJITInlineCaches();
891#endif
892#if ENABLE(DFG_JIT)
893 void tallyFrequentExitSites();
894#else
895 void tallyFrequentExitSites() { }
896#endif
897
898private:
899 friend class CodeBlockSet;
900 friend class ExecutableToCodeBlockEdge;
901
902 BytecodeLivenessAnalysis& livenessAnalysisSlow();
903
904 CodeBlock* specialOSREntryBlockOrNull();
905
906 void noticeIncomingCall(ExecState* callerFrame);
907
908 double optimizationThresholdScalingFactor();
909
910 void updateAllPredictionsAndCountLiveness(unsigned& numberOfLiveNonArgumentValueProfiles, unsigned& numberOfSamplesInProfiles);
911
912 void setConstantIdentifierSetRegisters(VM&, const Vector<ConstantIdentifierSetEntry>& constants);
913
914 void setConstantRegisters(const Vector<WriteBarrier<Unknown>>& constants, const Vector<SourceCodeRepresentation>& constantsSourceCodeRepresentation, ScriptExecutable* topLevelExecutable);
915
916 void replaceConstant(int index, JSValue value)
917 {
918 ASSERT(isConstantRegisterIndex(index) && static_cast<size_t>(index - FirstConstantRegisterIndex) < m_constantRegisters.size());
919 m_constantRegisters[index - FirstConstantRegisterIndex].set(*m_vm, this, value);
920 }
921
922 bool shouldVisitStrongly(const ConcurrentJSLocker&);
923 bool shouldJettisonDueToWeakReference(VM&);
924 bool shouldJettisonDueToOldAge(const ConcurrentJSLocker&);
925
926 void propagateTransitions(const ConcurrentJSLocker&, SlotVisitor&);
927 void determineLiveness(const ConcurrentJSLocker&, SlotVisitor&);
928
929 void stronglyVisitStrongReferences(const ConcurrentJSLocker&, SlotVisitor&);
930 void stronglyVisitWeakReferences(const ConcurrentJSLocker&, SlotVisitor&);
931 void visitOSRExitTargets(const ConcurrentJSLocker&, SlotVisitor&);
932
933 unsigned numberOfNonArgumentValueProfiles() { return m_numberOfNonArgumentValueProfiles; }
934 unsigned totalNumberOfValueProfiles() { return numberOfArgumentValueProfiles() + numberOfNonArgumentValueProfiles(); }
935 ValueProfile* tryGetValueProfileForBytecodeOffset(int bytecodeOffset);
936
937 Seconds timeSinceCreation()
938 {
939 return MonotonicTime::now() - m_creationTime;
940 }
941
942 void createRareDataIfNecessary()
943 {
944 if (!m_rareData) {
945 auto rareData = std::make_unique<RareData>();
946 WTF::storeStoreFence(); // m_catchProfiles can be touched from compiler threads.
947 m_rareData = WTFMove(rareData);
948 }
949 }
950
951 void insertBasicBlockBoundariesForControlFlowProfiler();
952 void ensureCatchLivenessIsComputedForBytecodeOffsetSlow(const OpCatch&, InstructionStream::Offset);
953
954 int m_numCalleeLocals;
955 int m_numVars;
956 int m_numParameters;
957 int m_numberOfArgumentsToSkip { 0 };
958 unsigned m_numberOfNonArgumentValueProfiles { 0 };
959 union {
960 unsigned m_debuggerRequests;
961 struct {
962 unsigned m_hasDebuggerStatement : 1;
963 unsigned m_steppingMode : 1;
964 unsigned m_numBreakpoints : 30;
965 };
966 };
967 unsigned m_bytecodeCost { 0 };
968 VirtualRegister m_scopeRegister;
969 mutable CodeBlockHash m_hash;
970
971 WriteBarrier<UnlinkedCodeBlock> m_unlinkedCode;
972 WriteBarrier<ScriptExecutable> m_ownerExecutable;
973 WriteBarrier<ExecutableToCodeBlockEdge> m_ownerEdge;
974 VM* m_vm;
975
976 const void* m_instructionsRawPointer { nullptr };
977 SentinelLinkedList<LLIntCallLinkInfo, BasicRawSentinelNode<LLIntCallLinkInfo>> m_incomingLLIntCalls;
978 StructureWatchpointMap m_llintGetByIdWatchpointMap;
979 RefPtr<JITCode> m_jitCode;
980#if ENABLE(JIT)
981 std::unique_ptr<JITData> m_jitData;
982#endif
983#if ENABLE(DFG_JIT)
984 // This is relevant to non-DFG code blocks that serve as the profiled code block
985 // for DFG code blocks.
986 CompressedLazyOperandValueProfileHolder m_lazyOperandValueProfiles;
987#endif
988 RefCountedArray<ValueProfile> m_argumentValueProfiles;
989
990 // Constant Pool
991 COMPILE_ASSERT(sizeof(Register) == sizeof(WriteBarrier<Unknown>), Register_must_be_same_size_as_WriteBarrier_Unknown);
992 // TODO: This could just be a pointer to m_unlinkedCodeBlock's data, but the DFG mutates
993 // it, so we're stuck with it for now.
994 Vector<WriteBarrier<Unknown>> m_constantRegisters;
995 Vector<SourceCodeRepresentation> m_constantsSourceCodeRepresentation;
996 RefCountedArray<WriteBarrier<FunctionExecutable>> m_functionDecls;
997 RefCountedArray<WriteBarrier<FunctionExecutable>> m_functionExprs;
998
999 WriteBarrier<CodeBlock> m_alternative;
1000
1001 BaselineExecutionCounter m_llintExecuteCounter;
1002
1003 BaselineExecutionCounter m_jitExecuteCounter;
1004 uint32_t m_osrExitCounter;
1005
1006 uint16_t m_optimizationDelayCounter;
1007 uint16_t m_reoptimizationRetryCounter;
1008
1009 RefPtr<MetadataTable> m_metadata;
1010
1011 MonotonicTime m_creationTime;
1012
1013 std::unique_ptr<RareData> m_rareData;
1014};
1015
1016inline Register& ExecState::r(int index)
1017{
1018 CodeBlock* codeBlock = this->codeBlock();
1019 if (codeBlock->isConstantRegisterIndex(index))
1020 return *reinterpret_cast<Register*>(&codeBlock->constantRegister(index));
1021 return this[index];
1022}
1023
1024inline Register& ExecState::r(VirtualRegister reg)
1025{
1026 return r(reg.offset());
1027}
1028
1029inline Register& ExecState::uncheckedR(int index)
1030{
1031 RELEASE_ASSERT(index < FirstConstantRegisterIndex);
1032 return this[index];
1033}
1034
1035inline Register& ExecState::uncheckedR(VirtualRegister reg)
1036{
1037 return uncheckedR(reg.offset());
1038}
1039
1040template <typename ExecutableType>
1041Exception* ScriptExecutable::prepareForExecution(VM& vm, JSFunction* function, JSScope* scope, CodeSpecializationKind kind, CodeBlock*& resultCodeBlock)
1042{
1043 if (hasJITCodeFor(kind)) {
1044 if (std::is_same<ExecutableType, EvalExecutable>::value)
1045 resultCodeBlock = jsCast<CodeBlock*>(jsCast<EvalExecutable*>(this)->codeBlock());
1046 else if (std::is_same<ExecutableType, ProgramExecutable>::value)
1047 resultCodeBlock = jsCast<CodeBlock*>(jsCast<ProgramExecutable*>(this)->codeBlock());
1048 else if (std::is_same<ExecutableType, ModuleProgramExecutable>::value)
1049 resultCodeBlock = jsCast<CodeBlock*>(jsCast<ModuleProgramExecutable*>(this)->codeBlock());
1050 else if (std::is_same<ExecutableType, FunctionExecutable>::value)
1051 resultCodeBlock = jsCast<CodeBlock*>(jsCast<FunctionExecutable*>(this)->codeBlockFor(kind));
1052 else
1053 RELEASE_ASSERT_NOT_REACHED();
1054 return nullptr;
1055 }
1056 return prepareForExecutionImpl(vm, function, scope, kind, resultCodeBlock);
1057}
1058
1059#define CODEBLOCK_LOG_EVENT(codeBlock, summary, details) \
1060 (codeBlock->vm()->logEvent(codeBlock, summary, [&] () { return toCString details; }))
1061
1062
1063void setPrinter(Printer::PrintRecord&, CodeBlock*);
1064
1065} // namespace JSC
1066
1067namespace WTF {
1068
1069JS_EXPORT_PRIVATE void printInternal(PrintStream&, JSC::CodeBlock*);
1070
1071} // namespace WTF
1072