/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*- * vim: set ts=8 sts=4 et sw=4 tw=99: * This Source Code Form is subject to the terms of the Mozilla Public * License, v. 2.0. If a copy of the MPL was not distributed with this * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ #ifndef jit_Bailouts_h #define jit_Bailouts_h #include "jstypes.h" #include "jit/JitFrameIterator.h" #include "jit/JitFrames.h" #include "vm/Stack.h" namespace js { namespace jit { // A "bailout" is a condition in which we need to recover an interpreter frame // from an IonFrame. Bailouts can happen for the following reasons: // (1) A deoptimization guard, for example, an add overflows or a type check // fails. // (2) A check or assumption held by the JIT is invalidated by the VM, and // JIT code must be thrown away. This includes the GC possibly deciding // to evict live JIT code, or a Type Inference reflow. // // Note that bailouts as described here do not include normal Ion frame // inspection, for example, if an exception must be built or the GC needs to // scan an Ion frame for gcthings. // // The second type of bailout needs a different name - "deoptimization" or // "deep bailout". Here we are concerned with eager (or maybe "shallow") // bailouts, that happen from JIT code. These happen from guards, like: // // cmp [obj + shape], 0x50M37TH1NG // jmp _bailout // // The bailout target needs to somehow translate the Ion frame (whose state // will differ at each program point) to an interpreter frame. This state is // captured into the IonScript's snapshot buffer, and for each bailout we know // which snapshot corresponds to its state. // // Roughly, the following needs to happen at the bailout target. // (1) Move snapshot ID into a known stack location (registers cannot be // mutated). // (2) Spill all registers to the stack. // (3) Call a Bailout() routine, whose argument is the stack pointer. // (4) Bailout() will find the IonScript on the stack, use the snapshot ID // to find the structure of the frame, and then use the stack and spilled // registers to perform frame conversion. // (5) Bailout() returns, and the JIT must immediately return to the // interpreter (all frames are converted at once). // // (2) and (3) are implemented by a trampoline held in the compartment. // Naively, we could implement (1) like: // // _bailout_ID_1: // push 1 // jmp _global_bailout_handler // _bailout_ID_2: // push 2 // jmp _global_bailout_handler // // This takes about 10 extra bytes per guard. On some platforms, we can reduce // this overhead to 4 bytes by creating a global jump table, shared again in // the compartment: // // call _global_bailout_handler // call _global_bailout_handler // call _global_bailout_handler // call _global_bailout_handler // ... // _global_bailout_handler: // // In the bailout handler, we can recompute which entry in the table was // selected by subtracting the return addressed pushed by the call, from the // start of the table, and then dividing by the size of a (call X) entry in the // table. This gives us a number in [0, TableSize), which we call a // "BailoutId". // // Then, we can provide a per-script mapping from BailoutIds to snapshots, // which takes only four bytes per entry. // // This strategy does not work as given, because the bailout handler has no way // to compute the location of an IonScript. Currently, we do not use frame // pointers. To account for this we segregate frames into a limited set of // "frame sizes", and create a table for each frame size. We also have the // option of not using bailout tables, for platforms or situations where the // 10 byte cost is more optimal than a bailout table. See JitFrames.h for more // detail. static const BailoutId INVALID_BAILOUT_ID = BailoutId(-1); // Keep this arbitrarily small for now, for testing. static const uint32_t BAILOUT_TABLE_SIZE = 16; // Bailout return codes. // N.B. the relative order of these values is hard-coded into ::GenerateBailoutThunk. static const uint32_t BAILOUT_RETURN_OK = 0; static const uint32_t BAILOUT_RETURN_FATAL_ERROR = 1; static const uint32_t BAILOUT_RETURN_OVERRECURSED = 2; // This address is a magic number made to cause crashes while indicating that we // are making an attempt to mark the stack during a bailout. static uint8_t * const FAKE_JIT_TOP_FOR_BAILOUT = reinterpret_cast<uint8_t*>(0xba1); // BailoutStack is an architecture specific pointer to the stack, given by the // bailout handler. class BailoutStack; class InvalidationBailoutStack; // Must be implemented by each architecture. // This structure is constructed before recovering the baseline frames for a // bailout. It records all information extracted from the stack, and which are // needed for the JitFrameIterator. class BailoutFrameInfo { MachineState machine_; uint8_t* framePointer_; size_t topFrameSize_; IonScript* topIonScript_; uint32_t snapshotOffset_; JitActivation* activation_; void attachOnJitActivation(const JitActivationIterator& activations); public: BailoutFrameInfo(const JitActivationIterator& activations, BailoutStack* sp); BailoutFrameInfo(const JitActivationIterator& activations, InvalidationBailoutStack* sp); BailoutFrameInfo(const JitActivationIterator& activations, const JitFrameIterator& frame); ~BailoutFrameInfo(); uint8_t* fp() const { return framePointer_; } SnapshotOffset snapshotOffset() const { return snapshotOffset_; } const MachineState* machineState() const { return &machine_; } size_t topFrameSize() const { return topFrameSize_; } IonScript* ionScript() const { return topIonScript_; } JitActivation* activation() const { return activation_; } }; MOZ_MUST_USE bool EnsureHasEnvironmentObjects(JSContext* cx, AbstractFramePtr fp); struct BaselineBailoutInfo; // Called from a bailout thunk. Returns a BAILOUT_* error code. uint32_t Bailout(BailoutStack* sp, BaselineBailoutInfo** info); // Called from the invalidation thunk. Returns a BAILOUT_* error code. uint32_t InvalidationBailout(InvalidationBailoutStack* sp, size_t* frameSizeOut, BaselineBailoutInfo** info); class ExceptionBailoutInfo { size_t frameNo_; jsbytecode* resumePC_; size_t numExprSlots_; public: ExceptionBailoutInfo(size_t frameNo, jsbytecode* resumePC, size_t numExprSlots) : frameNo_(frameNo), resumePC_(resumePC), numExprSlots_(numExprSlots) { } ExceptionBailoutInfo() : frameNo_(0), resumePC_(nullptr), numExprSlots_(0) { } bool catchingException() const { return !!resumePC_; } bool propagatingIonExceptionForDebugMode() const { return !resumePC_; } size_t frameNo() const { MOZ_ASSERT(catchingException()); return frameNo_; } jsbytecode* resumePC() const { MOZ_ASSERT(catchingException()); return resumePC_; } size_t numExprSlots() const { MOZ_ASSERT(catchingException()); return numExprSlots_; } }; // Called from the exception handler to enter a catch or finally block. // Returns a BAILOUT_* error code. uint32_t ExceptionHandlerBailout(JSContext* cx, const InlineFrameIterator& frame, ResumeFromException* rfe, const ExceptionBailoutInfo& excInfo, bool* overrecursed); uint32_t FinishBailoutToBaseline(BaselineBailoutInfo* bailoutInfo); void CheckFrequentBailouts(JSContext* cx, JSScript* script, BailoutKind bailoutKind); } // namespace jit } // namespace js #endif /* jit_Bailouts_h */