author Ryan VanderMeulen <ryanvm@gmail.com>
Tue, 20 Aug 2013 12:53:29 -0400
changeset 156154 1718a2f065c60705efc1a77e53b01017dbee6716
parent 156149 27cf1ae86abf6f3741f12d3e1e3f576f61901c11
child 157403 77280a2a30b4b84328a3717591e9650a60d0e76b
permissions -rw-r--r--
Backed out changeset ef139b6034a5 (bug 890722) for SM rootanalysis orange. CLOSED TREE

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 4 -*-
 * vim: set ts=8 sts=4 et sw=4 tw=99:
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef jit_IonFrameIterator_h
#define jit_IonFrameIterator_h

#ifdef JS_ION

#include "jsscript.h"
#include "jstypes.h"

#include "jit/IonCode.h"
#include "jit/SnapshotReader.h"

namespace js {
    class ActivationIterator;

namespace js {
namespace ion {

enum FrameType
    // A JS frame is analagous to a js::StackFrame, representing one scripted
    // functon activation. OptimizedJS frames are used by the optimizing compiler.

    // JS frame used by the baseline JIT.

    // Frame pushed for baseline JIT stubs that make non-tail calls, so that the
    // return address -> ICEntry mapping works.

    // The entry frame is the initial prologue block transitioning from the VM
    // into the Ion world.

    // A rectifier frame sits in between two JS frames, adapting argc != nargs
    // mismatches in calls.

    // An unwound JS frame is a JS frame signalling that its callee frame has been
    // turned into an exit frame (see EnsureExitFrame). Used by Ion bailouts and
    // Baseline exception unwinding.

    // Like Unwound_OptimizedJS, but the caller is a baseline stub frame.

    // An unwound rectifier frame is a rectifier frame signalling that its callee
    // frame has been turned into an exit frame (see EnsureExitFrame).

    // An exit frame is necessary for transitioning from a JS frame into C++.
    // From within C++, an exit frame is always the last frame in any
    // JitActivation.

    // An OSR frame is added when performing OSR from within a bailout. It
    // looks like a JS frame, but does not push scripted arguments, as OSR
    // reads arguments from a js::StackFrame.

class IonCommonFrameLayout;
class IonJSFrameLayout;
class IonExitFrameLayout;

class BaselineFrame;

class JitActivation;

class IonFrameIterator
    uint8_t *current_;
    FrameType type_;
    uint8_t *returnAddressToFp_;
    size_t frameSize_;

    mutable const SafepointIndex *cachedSafepointIndex_;
    const JitActivation *activation_;

    void dumpBaseline() const;

    IonFrameIterator(uint8_t *top)
      : current_(top),
    { }

    IonFrameIterator(const ActivationIterator &activations);
    IonFrameIterator(IonJSFrameLayout *fp);

    // Current frame information.
    FrameType type() const {
        return type_;
    uint8_t *fp() const {
        return current_;

    IonCommonFrameLayout *current() const {
        return (IonCommonFrameLayout *)current_;

    inline uint8_t *returnAddress() const;

    IonJSFrameLayout *jsFrame() const {
        return (IonJSFrameLayout *) fp();

    // Returns true iff this exit frame was created using EnsureExitFrame.
    inline bool isFakeExitFrame() const;

    inline IonExitFrameLayout *exitFrame() const;

    // Returns whether the JS frame has been invalidated and, if so,
    // places the invalidated Ion script in |ionScript|.
    bool checkInvalidation(IonScript **ionScript) const;
    bool checkInvalidation() const;

    bool isScripted() const {
        return type_ == IonFrame_BaselineJS || type_ == IonFrame_OptimizedJS;
    bool isBaselineJS() const {
        return type_ == IonFrame_BaselineJS;
    bool isOptimizedJS() const {
        return type_ == IonFrame_OptimizedJS;
    bool isBaselineStub() const {
        return type_ == IonFrame_BaselineStub;
    bool isNative() const;
    bool isOOLNativeGetter() const;
    bool isOOLPropertyOp() const;
    bool isOOLProxyGet() const;
    bool isDOMExit() const;
    bool isEntry() const {
        return type_ == IonFrame_Entry;
    bool isFunctionFrame() const;
    bool isParallelFunctionFrame() const;

    bool isConstructing() const;

    void *calleeToken() const;
    JSFunction *callee() const;
    JSFunction *maybeCallee() const;
    unsigned numActualArgs() const;
    JSScript *script() const;
    void baselineScriptAndPc(JSScript **scriptRes, jsbytecode **pcRes) const;
    Value *actualArgs() const;

    // Returns the return address of the frame above this one (that is, the
    // return address that returns back to the current frame).
    uint8_t *returnAddressToFp() const {
        return returnAddressToFp_;

    // Previous frame information extracted from the current frame.
    inline size_t prevFrameLocalSize() const;
    inline FrameType prevType() const;
    uint8_t *prevFp() const;

    // Returns the stack space used by the current frame, in bytes. This does
    // not include the size of its fixed header.
    size_t frameSize() const {
        JS_ASSERT(type_ != IonFrame_Exit);
        return frameSize_;

    // Functions used to iterate on frames. When prevType is IonFrame_Entry,
    // the current frame is the last frame.
    inline bool done() const {
        return type_ == IonFrame_Entry;
    IonFrameIterator &operator++();

    // Returns the IonScript associated with this JS frame.
    IonScript *ionScript() const;

    // Returns the Safepoint associated with this JS frame. Incurs a lookup
    // overhead.
    const SafepointIndex *safepoint() const;

    // Returns the OSI index associated with this JS frame. Incurs a lookup
    // overhead.
    const OsiIndex *osiIndex() const;

    uintptr_t *spillBase() const;
    MachineState machineState() const;

    template <class Op>
    void forEachCanonicalActualArg(Op op, unsigned start, unsigned count) const {

        unsigned nactual = numActualArgs();
        if (count == unsigned(-1))
            count = nactual - start;

        unsigned end = start + count;
        JS_ASSERT(start <= end && end <= nactual);

        Value *argv = actualArgs();
        for (unsigned i = start; i < end; i++)

    void dump() const;

    inline BaselineFrame *baselineFrame() const;

class IonJSFrameLayout;
class IonBailoutIterator;

// Reads frame information in snapshot-encoding order (that is, outermost frame
// to innermost frame).
class SnapshotIterator : public SnapshotReader
    IonJSFrameLayout *fp_;
    MachineState machine_;
    IonScript *ionScript_;

    bool hasLocation(const SnapshotReader::Location &loc);
    uintptr_t fromLocation(const SnapshotReader::Location &loc);
    static Value FromTypedPayload(JSValueType type, uintptr_t payload);

    Value slotValue(const Slot &slot);
    bool slotReadable(const Slot &slot);
    void warnUnreadableSlot();

    SnapshotIterator(IonScript *ionScript, SnapshotOffset snapshotOffset,
                     IonJSFrameLayout *fp, const MachineState &machine);
    SnapshotIterator(const IonFrameIterator &iter);
    SnapshotIterator(const IonBailoutIterator &iter);

    Value read() {
        return slotValue(readSlot());
    Value maybeRead(bool silentFailure = false) {
        Slot s = readSlot();
        if (slotReadable(s))
            return slotValue(s);
        if (!silentFailure)
        return UndefinedValue();

    template <class Op>
    void readFrameArgs(Op &op, const Value *argv, Value *scopeChain, Value *thisv,
                       unsigned start, unsigned formalEnd, unsigned iterEnd, JSScript *script)
        if (scopeChain)
            *scopeChain = read();

        // Skip slot for arguments object.
        if (script->argumentsHasVarBinding())

        if (thisv)
            *thisv = read();

        unsigned i = 0;
        if (formalEnd < start)
            i = start;

        for (; i < start; i++)
        for (; i < formalEnd && i < iterEnd; i++) {
            // We are not always able to read values from the snapshots, some values
            // such as non-gc things may still be live in registers and cause an
            // error while reading the machine state.
            Value v = maybeRead();
        if (iterEnd >= formalEnd) {
            for (; i < iterEnd; i++)

    Value maybeReadSlotByIndex(size_t index) {
        while (index--) {

        Value s = maybeRead(true);

        while (moreSlots())

        return s;

// Reads frame information in callstack order (that is, innermost frame to
// outermost frame).
template <AllowGC allowGC=CanGC>
class InlineFrameIteratorMaybeGC
    const IonFrameIterator *frame_;
    SnapshotIterator start_;
    SnapshotIterator si_;
    unsigned framesRead_;
    typename MaybeRooted<JSFunction*, allowGC>::RootType callee_;
    typename MaybeRooted<JSScript*, allowGC>::RootType script_;
    jsbytecode *pc_;
    uint32_t numActualArgs_;

    void findNextFrame();

    InlineFrameIteratorMaybeGC(JSContext *cx, const IonFrameIterator *iter)
      : callee_(cx),

    InlineFrameIteratorMaybeGC(JSRuntime *rt, const IonFrameIterator *iter)
      : callee_(rt),

    InlineFrameIteratorMaybeGC(JSContext *cx, const IonBailoutIterator *iter);

    InlineFrameIteratorMaybeGC(JSContext *cx, const InlineFrameIteratorMaybeGC *iter)
      : frame_(iter ? iter->frame_ : NULL),
        if (frame_) {
            start_ = SnapshotIterator(*frame_);
            // findNextFrame will iterate to the next frame and init. everything.
            // Therefore to settle on the same frame, we report one frame less readed.
            framesRead_ = iter->framesRead_ - 1;

    bool more() const {
        return frame_ && framesRead_ < start_.frameCount();
    JSFunction *callee() const {
        return callee_;
    JSFunction *maybeCallee() const {
        return callee_;

    unsigned numActualArgs() const {
        // The number of actual arguments of inline frames is recovered by the
        // iteration process. It is recovered from the bytecode because this
        // property still hold since the for inlined frames. This property does not
        // hold for the parent frame because it can have optimize a call to
        // js_fun_call or js_fun_apply.
        if (more())
            return numActualArgs_;

        return frame_->numActualArgs();

    template <class Op>
    void forEachCanonicalActualArg(JSContext *cx, Op op, unsigned start, unsigned count) const {
        unsigned nactual = numActualArgs();
        if (count == unsigned(-1))
            count = nactual - start;

        unsigned end = start + count;
        unsigned nformal = callee()->nargs;

        JS_ASSERT(start <= end && end <= nactual);

        if (more()) {
            // There is still a parent frame of this inlined frame.
            // The not overflown arguments are taken from the inlined frame,
            // because it will have the updated value when JSOP_SETARG is done.
            // All arguments (also the overflown) are the last pushed values in the parent frame.
            // To get the overflown arguments, we need to take them from there.

            // Get the non overflown arguments
            unsigned formal_end = (end < nformal) ? end : nformal;
            SnapshotIterator s(si_);
            s.readFrameArgs(op, NULL, NULL, NULL, start, nformal, formal_end, script());

            // The overflown arguments are not available in current frame.
            // They are the last pushed arguments in the parent frame of this inlined frame.
            InlineFrameIteratorMaybeGC it(cx, this);
            unsigned argsObjAdj = it.script()->argumentsHasVarBinding() ? 1 : 0;
            SnapshotIterator parent_s(it.snapshotIterator());

            // Skip over all slots untill we get to the last slots (= arguments slots of callee)
            // the +2 is for [this] and [scopechain], and maybe +1 for [argsObj]
            JS_ASSERT(parent_s.slots() >= nactual + 2 + argsObjAdj);
            unsigned skip = parent_s.slots() - nactual - 2 - argsObjAdj;
            for (unsigned j = 0; j < skip; j++)

            // Get the overflown arguments
            parent_s.readFrameArgs(op, NULL, NULL, NULL, nformal, nactual, end, it.script());
        } else {
            SnapshotIterator s(si_);
            Value *argv = frame_->actualArgs();
            s.readFrameArgs(op, argv, NULL, NULL, start, nformal, end, script());

    JSScript *script() const {
        return script_;
    jsbytecode *pc() const {
        return pc_;
    SnapshotIterator snapshotIterator() const {
        return si_;
    bool isFunctionFrame() const;
    bool isConstructing() const;

    JSObject *scopeChain() const {
        SnapshotIterator s(si_);

        // scopeChain
        Value v = s.read();
        if (v.isObject()) {
            JS_ASSERT_IF(script()->hasAnalysis(), script()->analysis()->usesScopeChain());
            return &v.toObject();

        return callee()->environment();

    JSObject *thisObject() const {
        // JS_ASSERT(isConstructing(...));
        SnapshotIterator s(si_);

        // scopeChain

        // Arguments object.
        if (script()->argumentsHasVarBinding())

        // In strict modes, |this| may not be an object and thus may not be
        // readable which can either segv in read or trigger the assertion.
        Value v = s.read();
        return &v.toObject();

    InlineFrameIteratorMaybeGC &operator++() {
        return *this;

    void dump() const;

    void resetOn(const IonFrameIterator *iter);

    const IonFrameIterator &frame() const {
        return *frame_;

    // Inline frame number, 0 for the outermost (non-inlined) frame.
    size_t frameNo() const {
        return start_.frameCount() - framesRead_;

    InlineFrameIteratorMaybeGC() MOZ_DELETE;
    InlineFrameIteratorMaybeGC(const InlineFrameIteratorMaybeGC &iter) MOZ_DELETE;
typedef InlineFrameIteratorMaybeGC<CanGC> InlineFrameIterator;
typedef InlineFrameIteratorMaybeGC<NoGC> InlineFrameIteratorNoGC;

} // namespace ion
} // namespace js

#endif // JS_ION

#endif /* jit_IonFrameIterator_h */