/*

* Copyright (C) 2008-2025 Apple Inc. All rights reserved.

* Copyright (C) 2008 Cameron Zwarich <cwzwarich@uwaterloo.ca>

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

*

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

* 3. Neither the name of Apple Inc. ("Apple") nor the names of

* its contributors may be used to endorse or promote products derived

* from this software without specific prior written permission.

*

* THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

* DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY

* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

* (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

* THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#include "CodeBlock.h"

#include "ArithProfile.h"

#include "BaselineJITCode.h"

#include "BasicBlockLocation.h"

#include "BytecodeDumper.h"

#include "BytecodeLivenessAnalysisInlines.h"

#include "BytecodeOperandsForCheckpoint.h"

#include "BytecodeStructs.h"

#include "CodeBlockInlines.h"

#include "CodeBlockSet.h"

#include "ControlFlowProfiler.h"

#include "DFGCapabilities.h"

#include "DFGCommon.h"

#include "DFGJITCode.h"

#include "EvalCodeBlock.h"

#include "FullCodeOrigin.h"

#include "FunctionCodeBlock.h"

#include "FunctionExecutableDump.h"

#include "GetPutInfo.h"

#include "InlineCallFrame.h"

#include "Instruction.h"

#include "InstructionStream.h"

#include "Integrity.h" // FIXME: rdar://149223818

#include "IsoCellSetInlines.h"

#include "JIT.h"

#include "JITMathIC.h"

#include "JITWorklist.h"

#include "JSCInlines.h"

#include "JSCJSValue.h"

#include "JSLexicalEnvironment.h"

#include "JSModuleEnvironment.h"

#include "JSSet.h"

#include "JSString.h"

#include "JSTemplateObjectDescriptor.h"

#include "LLIntData.h"

#include "LLIntEntrypoint.h"

#include "LLIntExceptions.h"

#include "LLIntPrototypeLoadAdaptiveStructureWatchpoint.h"

#include "MetadataTable.h"

#include "ModuleProgramCodeBlock.h"

#include "ObjectAllocationProfileInlines.h"

#include "PCToCodeOriginMap.h"

#include "ProfilerDatabase.h"

#include "ProgramCodeBlock.h"

#include "PropertyInlineCache.h"

#include "ReduceWhitespace.h"

#include "SlotVisitorInlines.h"

#include "SourceProvider.h"

#include "StackVisitor.h"

#include "TypeLocationCache.h"

#include "TypeProfiler.h"

#include "VMInlines.h"

#include <wtf/Forward.h>

#include <wtf/SimpleStats.h>

#include <wtf/StringPrintStream.h>

#include <wtf/text/UniquedStringImpl.h>

#if ENABLE(ASSEMBLER)

#include "RegisterAtOffsetList.h"

#endif

#if ENABLE(FTL_JIT)

#include "FTLJITCode.h"

#endif

WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN

namespace JSC {

DEFINE_ALLOCATOR_WITH_HEAP_IDENTIFIER(CodeBlockRareData);

const ClassInfo CodeBlock::s_info = {

"CodeBlock"_s, nullptr, nullptr, nullptr,

CREATE_METHOD_TABLE(CodeBlock)

};

CString CodeBlock::inferredName() const

{

switch (codeType()) {

case GlobalCode:

return "<global>"_span;

case EvalCode:

return "<eval>"_span;

case FunctionCode:

return jsCast<FunctionExecutable*>(ownerExecutable())->ecmaName().utf8();

case ModuleCode:

return "<module>"_span;

default:

CRASH();

return ""_span;

}

}

String CodeBlock::inferredNameWithHash() const

{

return makeString(inferredName(), "#"_s, hash());

}

bool CodeBlock::hasHash() const

{

return !!m_hash;

}

CodeBlockHash CodeBlock::hash() const

{

if (auto hash = m_hash)

return hash;

// Do not copy. It is not allowed from the concurrent compiler thread. But so long as this CodeBlock is alive, it is ensured that this reference is valid.

const auto& source = ownerExecutable()->source();

// Why do we need this guard? WebCore can replace underlying source with NetworkProcess cached data in the main thread.

// If we are reading source from the main thread, we cannot have conflict. But if we are reading the source from the compiler thread,

// it is possible that the main thread is now replacing it with the cached new content. SourceProviderBufferGuard allows us to keep

// the old one until this scope gets destroyed.

if (isCompilationThread() || Thread::mayBeGCThread()) {

if (!source.provider())

return { };

SourceProviderBufferGuard guard(source.provider());

auto startOffset = source.startOffset();

auto endOffset = source.endOffset();

auto hash = guard.provider()->codeBlockHashConcurrently(startOffset, endOffset, specializationKind());

WTF::storeStoreFence();

m_hash = hash;

return hash;

}

m_hash = CodeBlockHash(source, specializationKind());

return m_hash;

}

CString CodeBlock::sourceCodeForTools() const

{

if (codeType() != FunctionCode)

return ownerExecutable()->source().toUTF8();

FunctionExecutable* executable = jsCast<FunctionExecutable*>(ownerExecutable());

return executable->source().provider()->getRange(

executable->functionStart(),

executable->parametersStartOffset() + executable->source().length()).utf8();

}

CString CodeBlock::sourceCodeOnOneLine() const

{

return reduceWhitespace(sourceCodeForTools());

}

void CodeBlock::dumpAssumingJITType(PrintStream& out, JITType jitType) const

{

out.print(inferredNameWithHash());

out.print(":[", RawPointer(this), "->");

if (!!m_alternative)

out.print(RawPointer(alternative()), "->");

out.print(RawPointer(ownerExecutable()), ", ", jitType, codeType());

if (codeType() == FunctionCode)

out.print(specializationKind());

out.print(", ", instructionsSize());

if (this->jitType() == JITType::BaselineJIT && m_shouldAlwaysBeInlined)

out.print(" (ShouldAlwaysBeInlined)");

if (ownerExecutable()->neverInline())

out.print(" (NeverInline)");

if (ownerExecutable()->neverOptimize())

out.print(" (NeverOptimize)");

else if (ownerExecutable()->neverFTLOptimize())

out.print(" (NeverFTLOptimize)");

if (ownerExecutable()->didTryToEnterInLoop())

out.print(" (DidTryToEnterInLoop)");

if (ownerExecutable()->isInStrictContext())

out.print(" (StrictMode)");

if (m_didFailJITCompilation)

out.print(" (JITFail)");

if (this->jitType() == JITType::BaselineJIT && m_didFailFTLCompilation)

out.print(" (FTLFail)");

if (this->jitType() == JITType::BaselineJIT && m_hasBeenCompiledWithFTL)

out.print(" (HadFTLReplacement)");

out.print("]");

}

void CodeBlock::dump(PrintStream& out) const

{

dumpAssumingJITType(out, jitType());

}

void CodeBlock::dumpSimpleName(PrintStream& out) const

{

out.print(inferredNameWithHash());

}

void CodeBlock::dumpSource()

{

dumpSource(WTF::dataFile());

}

void CodeBlock::dumpSource(PrintStream& out)

{

ScriptExecutable* executable = ownerExecutable();

if (executable->isFunctionExecutable()) {

auto functionExecutable = static_cast<FunctionExecutable*>(executable);

StringView source = functionExecutable->source().provider()->getRange(

functionExecutable->parametersStartOffset(),

functionExecutable->functionEnd() + 1); // Type profiling end offset is the character before the '}'.

out.print("function ", inferredName(), source);

return;

}

out.print(executable->source().view());

}

void CodeBlock::dumpBytecode()

{

dumpBytecode(WTF::dataFile());

}

void CodeBlock::dumpBytecode(PrintStream& out)

{

ICStatusMap statusMap;

getICStatusMap(statusMap);

BytecodeGraph graph(this, this->instructions());

CodeBlockBytecodeDumper<CodeBlock>::dumpGraph(this, instructions(), graph, out, statusMap);

}

void CodeBlock::dumpBytecode(PrintStream& out, const JSInstructionStream::Ref& it, const ICStatusMap& statusMap)

{

BytecodeDumper<CodeBlock>::dumpBytecode(this, out, it, statusMap);

}

void CodeBlock::dumpBytecode(PrintStream& out, unsigned bytecodeOffset, const ICStatusMap& statusMap)

{

const auto it = instructions().at(bytecodeOffset);

dumpBytecode(out, it, statusMap);

}

namespace {

class PutToScopeFireDetail final : public FireDetail {

public:

PutToScopeFireDetail(CodeBlock* codeBlock, const Identifier& ident)

: m_codeBlock(codeBlock)

, m_ident(ident)

{

}

void dump(PrintStream& out) const final

{

out.print("Linking put_to_scope in ", FunctionExecutableDump(jsCast<FunctionExecutable*>(m_codeBlock->ownerExecutable())), " for ", m_ident);

}

private:

CodeBlock* const m_codeBlock;

const Identifier& m_ident;

};

} // anonymous namespace

CodeBlock::CodeBlock(VM& vm, Structure* structure, CopyParsedBlockTag, CodeBlock& other)

: JSCell(vm, structure)

, m_globalObject(other.m_globalObject)

, m_shouldAlwaysBeInlined(true)

#if ENABLE(JIT)

, m_capabilityLevelState(DFG::CapabilityLevelNotSet)

#endif

, m_didFailJITCompilation(false)

, m_didFailFTLCompilation(false)

, m_hasBeenCompiledWithFTL(false)

, m_isJettisoned(false)

, m_numCalleeLocals(other.m_numCalleeLocals)

, m_numVars(other.m_numVars)

, m_numberOfArgumentsToSkip(other.m_numberOfArgumentsToSkip)

, m_couldBeTainted(other.m_couldBeTainted)

, m_hasDebuggerStatement(false)

, m_steppingMode(SteppingModeDisabled)

, m_numBreakpoints(0)

, m_bytecodeCost(other.m_bytecodeCost)

, m_scopeRegister(other.m_scopeRegister)

, m_hash(other.m_hash)

, m_unlinkedCode(other.vm(), this, other.m_unlinkedCode.get())

, m_ownerExecutable(other.vm(), this, other.m_ownerExecutable.get())

, m_vm(other.m_vm)

, m_instructionsRawPointer(other.m_instructionsRawPointer)

, m_metadata(other.m_metadata)

, m_constantRegisters(other.m_constantRegisters)

, m_functionDecls(other.m_functionDecls)

, m_functionExprs(other.m_functionExprs)

, m_creationTime(ApproximateTime::now())

#if ASSERT_ENABLED

, m_magic(CODEBLOCK_MAGIC)

#endif

{

ASSERT(heap()->isDeferred());

ASSERT(m_scopeRegister.isLocal());

ASSERT(source().provider());

constexpr bool allocateArgumentValueProfiles = false;

setNumParameters(other.numParameters(), allocateArgumentValueProfiles);

ASSERT(m_couldBeTainted == (taintednessToTriState(source().provider()->sourceTaintedOrigin()) != TriState::False));

vm.heap.codeBlockSet().add(this);

checker().set(CrashChecker::This, checker().hash(this));

checker().set(CrashChecker::Metadata, checker().hash(this, m_metadata.get()));

}

void CodeBlock::finishCreation(VM& vm, CopyParsedBlockTag, CodeBlock& other)

{

Base::finishCreation(vm);

if (other.m_rareData) {

createRareDataIfNecessary();

m_rareData->m_exceptionHandlers = other.m_rareData->m_exceptionHandlers;

}

}

CodeBlock::CodeBlock(VM& vm, Structure* structure, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock, JSScope* scope)

: JSCell(vm, structure)

, m_globalObject(scope->globalObject(), WriteBarrierEarlyInit)

, m_shouldAlwaysBeInlined(true)

#if ENABLE(JIT)

, m_capabilityLevelState(DFG::CapabilityLevelNotSet)

#endif

, m_didFailJITCompilation(false)

, m_didFailFTLCompilation(false)

, m_hasBeenCompiledWithFTL(false)

, m_isJettisoned(false)

, m_numCalleeLocals(unlinkedCodeBlock->numCalleeLocals())

, m_numVars(unlinkedCodeBlock->numVars())

, m_hasDebuggerStatement(false)

, m_steppingMode(SteppingModeDisabled)

, m_numBreakpoints(0)

, m_scopeRegister(unlinkedCodeBlock->scopeRegister())

, m_unlinkedCode(unlinkedCodeBlock, WriteBarrierEarlyInit)

, m_ownerExecutable(ownerExecutable, WriteBarrierEarlyInit)

, m_vm(&vm)

, m_instructionsRawPointer(unlinkedCodeBlock->instructions().rawPointer())

, m_metadata(unlinkedCodeBlock->metadata().link())

, m_creationTime(ApproximateTime::now())

#if ASSERT_ENABLED

, m_magic(CODEBLOCK_MAGIC)

#endif

{

ASSERT(heap()->isDeferred());

ASSERT(m_scopeRegister.isLocal());

ASSERT(source().provider());

constexpr bool allocateArgumentValueProfiles = true;

setNumParameters(unlinkedCodeBlock->numParameters(), allocateArgumentValueProfiles);

m_couldBeTainted = source().provider()->couldBeTainted();

vm.heap.codeBlockSet().add(this);

checker().set(CrashChecker::This, checker().hash(this));

checker().set(CrashChecker::Metadata, checker().hash(this, m_metadata.get()));

}

// The main purpose of this function is to generate linked bytecode from unlinked bytecode. The process

// of linking is taking an abstract representation of bytecode and tying it to a GlobalObject and scope

// chain. For example, this process allows us to cache the depth of lexical environment reads that reach

// outside of this CodeBlock's compilation unit. It also allows us to generate particular constants that

// we can't generate during unlinked bytecode generation. This process is not allowed to generate control

// flow or introduce new locals. The reason for this is we rely on liveness analysis to be the same for

// all the CodeBlocks of an UnlinkedCodeBlock. We rely on this fact by caching the liveness analysis

// inside UnlinkedCodeBlock. Also, Baseline JIT code is shared between all CodeBlocks of an UnlinkedCodeBlock,

// so the bytecode must remain the same between CodeBlocks sharing an UnlinkedCodeBlock.

bool CodeBlock::finishCreation(VM& vm, ScriptExecutable* ownerExecutable, UnlinkedCodeBlock* unlinkedCodeBlock,

JSScope* scope)

{

Base::finishCreation(vm);

ASSERT(vm.heap.isDeferred());

auto throwScope = DECLARE_THROW_SCOPE(vm);

if (m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes() || m_unlinkedCode->wasCompiledWithControlFlowProfilerOpcodes())

vm.functionHasExecutedCache()->removeUnexecutedRange(ownerExecutable->sourceID(), ownerExecutable->typeProfilingStartOffset(), ownerExecutable->typeProfilingEndOffset());

ScriptExecutable* topLevelExecutable = ownerExecutable->topLevelExecutable();

// We wait to initialize template objects until the end of finishCreation beecause it can

// throw. We rely on linking to put the CodeBlock into a coherent state, so we can't throw

// until we're all done linking.

Vector<unsigned> templateObjectIndices = setConstantRegisters(unlinkedCodeBlock->constantRegisters(), unlinkedCodeBlock->constantsSourceCodeRepresentation());

// We already have the cloned symbol table for the module environment since we need to instantiate

// the module environments before linking the code block. We replace the stored symbol table with the already cloned one.

if (UnlinkedModuleProgramCodeBlock* unlinkedModuleProgramCodeBlock = jsDynamicCast<UnlinkedModuleProgramCodeBlock*>(unlinkedCodeBlock)) {

SymbolTable* clonedSymbolTable = jsCast<ModuleProgramExecutable*>(ownerExecutable)->moduleEnvironmentSymbolTable();

if (m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes()) {

ConcurrentJSLocker locker(clonedSymbolTable->m_lock);

clonedSymbolTable->prepareForTypeProfiling(locker);

}

replaceConstant(VirtualRegister(unlinkedModuleProgramCodeBlock->moduleEnvironmentSymbolTableConstantRegisterOffset()), clonedSymbolTable);

}

bool shouldUpdateFunctionHasExecutedCache = m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes() || m_unlinkedCode->wasCompiledWithControlFlowProfilerOpcodes();

m_functionDecls = FixedVector<WriteBarrier<FunctionExecutable>>(unlinkedCodeBlock->numberOfFunctionDecls());

for (size_t count = unlinkedCodeBlock->numberOfFunctionDecls(), i = 0; i < count; ++i) {

UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionDecl(i);

if (shouldUpdateFunctionHasExecutedCache)

vm.functionHasExecutedCache()->insertUnexecutedRange(ownerExecutable->sourceID(), unlinkedExecutable->unlinkedFunctionStart(), unlinkedExecutable->unlinkedFunctionEnd());

m_functionDecls[i].set(vm, this, unlinkedExecutable->link(vm, topLevelExecutable, ownerExecutable->source(), std::nullopt, NoIntrinsic, ownerExecutable->isInsideOrdinaryFunction()));

}

m_functionExprs = FixedVector<WriteBarrier<FunctionExecutable>>(unlinkedCodeBlock->numberOfFunctionExprs());

for (size_t count = unlinkedCodeBlock->numberOfFunctionExprs(), i = 0; i < count; ++i) {

UnlinkedFunctionExecutable* unlinkedExecutable = unlinkedCodeBlock->functionExpr(i);

if (shouldUpdateFunctionHasExecutedCache)

vm.functionHasExecutedCache()->insertUnexecutedRange(ownerExecutable->sourceID(), unlinkedExecutable->unlinkedFunctionStart(), unlinkedExecutable->unlinkedFunctionEnd());

m_functionExprs[i].set(vm, this, unlinkedExecutable->link(vm, topLevelExecutable, ownerExecutable->source(), std::nullopt, NoIntrinsic, ownerExecutable->isInsideOrdinaryFunction()));

}

if (unlinkedCodeBlock->numberOfExceptionHandlers()) {

createRareDataIfNecessary();

if (size_t count = unlinkedCodeBlock->numberOfExceptionHandlers()) {

m_rareData->m_exceptionHandlers.resizeToFit(count);

for (size_t i = 0; i < count; i++) {

const UnlinkedHandlerInfo& unlinkedHandler = unlinkedCodeBlock->exceptionHandler(i);

HandlerInfo& handler = m_rareData->m_exceptionHandlers[i];

#if ENABLE(JIT)

auto& instruction = *instructions().at(unlinkedHandler.target).ptr();

handler.initialize(unlinkedHandler, CodeLocationLabel<ExceptionHandlerPtrTag>(LLInt::handleCatch(instruction.width()).code()));

#else

handler.initialize(unlinkedHandler);

#endif

}

}

}

// Bookkeep the strongly referenced module environments.

UncheckedKeyHashSet<JSModuleEnvironment*> stronglyReferencedModuleEnvironments;

auto link_objectAllocationProfile = [&](const auto& /*instruction*/, auto bytecode, auto& metadata) {

metadata.m_objectAllocationProfile.initializeProfile(vm, m_globalObject.get(), this, m_globalObject->objectPrototype(), bytecode.m_inlineCapacity);

};

auto link_arrayAllocationProfile = [&](const auto& /*instruction*/, auto bytecode, auto& metadata) {

metadata.m_arrayAllocationProfile.initializeIndexingMode(bytecode.m_recommendedIndexingType);

};

auto link_callLinkInfo = [&](const auto& instruction, auto bytecode, auto& metadata) {

metadata.m_callLinkInfo.initialize(vm, this, CallLinkInfo::callTypeFor(decltype(bytecode)::opcodeID), CodeOrigin { instruction.index() });

};

#define LINK_FIELD(__field) \

WTF_LAZY_JOIN(link_, __field)(instruction, bytecode, metadata);

#define INITIALIZE_METADATA(__op) \

auto bytecode = instruction->as<__op>(); \

auto& metadata = bytecode.metadata(this); \

new (&metadata) __op::Metadata { bytecode }; \

#define LINK_IMPL(...) \

INITIALIZE_METADATA(WTF_LAZY_FIRST(__VA_ARGS__)) \

WTF_LAZY_HAS_REST(__VA_ARGS__)({ \

WTF_LAZY_FOR_EACH_TERM(LINK_FIELD, WTF_LAZY_REST_(__VA_ARGS__)) \

}) \

#define CASE(__op) case __op::opcodeID

#define LINK(...) \

CASE(WTF_LAZY_FIRST(__VA_ARGS__)): { \

LINK_IMPL(__VA_ARGS__) \

break; \

}

const auto& instructionStream = instructions();

for (const auto& instruction : instructionStream) {

OpcodeID opcodeID = instruction->opcodeID();

static_assert(OpcodeIDWidthBySize<JSOpcodeTraits, OpcodeSize::Wide32>::opcodeIDSize == 1);

m_bytecodeCost += opcodeLengths[opcodeID] + 1;

switch (opcodeID) {

LINK(OpGetByVal)

LINK(OpGetPrivateName)

LINK(OpTryGetById)

LINK(OpGetByIdDirect)

LINK(OpGetByValWithThis)

LINK(OpToThis)

LINK(OpGetById)

LINK(OpGetLength)

LINK(OpEnumeratorNext)

LINK(OpEnumeratorInByVal)

LINK(OpEnumeratorHasOwnProperty)

LINK(OpEnumeratorGetByVal)

LINK(OpInByVal)

LINK(OpPutByVal)

LINK(OpPutByValDirect)

LINK(OpEnumeratorPutByVal)

LINK(OpPutPrivateName)

LINK(OpSetPrivateBrand)

LINK(OpCheckPrivateBrand)

LINK(OpNewArray)

LINK(OpNewArrayWithSize)

LINK(OpNewArrayBuffer, arrayAllocationProfile)

LINK(OpNewObject, objectAllocationProfile)

LINK(OpPutById)

LINK(OpCreateThis)

LINK(OpCreatePromise)

LINK(OpCreateGenerator)

LINK(OpJneqPtr)

LINK(OpCatch)

LINK(OpProfileControlFlow)

LINK(OpCall, callLinkInfo)

LINK(OpTailCall, callLinkInfo)

LINK(OpCallDirectEval, callLinkInfo)

LINK(OpConstruct, callLinkInfo)

LINK(OpSuperConstruct, callLinkInfo)

LINK(OpIteratorOpen, callLinkInfo)

LINK(OpIteratorNext, callLinkInfo)

LINK(OpCallVarargs, callLinkInfo)

LINK(OpTailCallVarargs, callLinkInfo)

LINK(OpConstructVarargs, callLinkInfo)

LINK(OpSuperConstructVarargs, callLinkInfo)

LINK(OpCallIgnoreResult, callLinkInfo)

case op_new_array_with_species: {

INITIALIZE_METADATA(OpNewArrayWithSpecies)

break;

}

case op_resolve_scope: {

INITIALIZE_METADATA(OpResolveScope)

const Identifier& ident = identifier(bytecode.m_var);

RELEASE_ASSERT(bytecode.m_resolveType != ResolvedClosureVar);

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), bytecode.m_localScopeDepth, scope, ident, Get, bytecode.m_resolveType, InitializationMode::NotInitialization);

metadata.m_resolveType = op.type;

metadata.m_localScopeDepth = op.depth;

if (op.lexicalEnvironment) {

if (op.type == ModuleVar) {

// Keep the linked module environment strongly referenced.

if (stronglyReferencedModuleEnvironments.add(jsCast<JSModuleEnvironment*>(op.lexicalEnvironment)).isNewEntry)

addConstant(ConcurrentJSLocker(m_lock), op.lexicalEnvironment);

metadata.m_lexicalEnvironment.set(vm, this, op.lexicalEnvironment);

} else

metadata.m_symbolTable.set(vm, this, op.lexicalEnvironment->symbolTable());

} else if (JSScope* constantScope = JSScope::constantScopeForCodeBlock(op.type, this)) {

metadata.m_constantScope.set(vm, this, constantScope);

if (op.type == GlobalProperty || op.type == GlobalPropertyWithVarInjectionChecks)

metadata.m_globalLexicalBindingEpoch = m_globalObject->globalLexicalBindingEpoch();

} else

metadata.m_globalObject.clear();

break;

}

case op_get_from_scope: {

INITIALIZE_METADATA(OpGetFromScope)

metadata.m_watchpointSet = nullptr;

ASSERT(!isInitialization(bytecode.m_getPutInfo.initializationMode()));

if (bytecode.m_getPutInfo.resolveType() == ResolvedClosureVar) {

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), ClosureVar, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

break;

}

const Identifier& ident = identifier(bytecode.m_var);

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), bytecode.m_localScopeDepth, scope, ident, Get, bytecode.m_getPutInfo.resolveType(), InitializationMode::NotInitialization);

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), op.type, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

if (op.type == ModuleVar)

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), ClosureVar, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks || op.type == GlobalLexicalVar || op.type == GlobalLexicalVarWithVarInjectionChecks)

metadata.m_watchpointSet = op.watchpointSet;

else if (op.structure)

metadata.m_structureID.set(vm, this, op.structure);

metadata.m_operand = op.operand;

break;

}

case op_put_to_scope: {

INITIALIZE_METADATA(OpPutToScope)

if (bytecode.m_getPutInfo.resolveType() == ResolvedClosureVar) {

// Only do watching if the property we're putting to is not anonymous.

if (bytecode.m_var != UINT_MAX) {

SymbolTable* symbolTable = jsCast<SymbolTable*>(getConstant(bytecode.m_symbolTableOrScopeDepth.symbolTable()));

const Identifier& ident = identifier(bytecode.m_var);

ConcurrentJSLocker locker(symbolTable->m_lock);

auto iter = symbolTable->find(locker, ident.impl());

ASSERT(iter != symbolTable->end(locker));

if (bytecode.m_getPutInfo.initializationMode() == InitializationMode::ScopedArgumentInitialization) {

ASSERT(bytecode.m_value.isArgument());

unsigned argumentIndex = bytecode.m_value.toArgument() - 1;

symbolTable->prepareToWatchScopedArgument(iter->value, argumentIndex);

} else

iter->value.prepareToWatch();

metadata.m_watchpointSet = iter->value.watchpointSet();

} else

metadata.m_watchpointSet = nullptr;

break;

}

const Identifier& ident = identifier(bytecode.m_var);

metadata.m_watchpointSet = nullptr;

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), bytecode.m_symbolTableOrScopeDepth.scopeDepth(), scope, ident, Put, bytecode.m_getPutInfo.resolveType(), bytecode.m_getPutInfo.initializationMode());

metadata.m_getPutInfo = GetPutInfo(bytecode.m_getPutInfo.resolveMode(), op.type, bytecode.m_getPutInfo.initializationMode(), bytecode.m_getPutInfo.ecmaMode());

if (op.type == GlobalVar || op.type == GlobalVarWithVarInjectionChecks || op.type == GlobalLexicalVar || op.type == GlobalLexicalVarWithVarInjectionChecks)

metadata.m_watchpointSet = op.watchpointSet;

else if (op.type == ClosureVar || op.type == ClosureVarWithVarInjectionChecks) {

if (op.watchpointSet)

op.watchpointSet->invalidate(vm, PutToScopeFireDetail(this, ident));

} else if (op.structure)

metadata.m_structureID.set(vm, this, op.structure);

metadata.m_operand = op.operand;

break;

}

case op_profile_type: {

RELEASE_ASSERT(m_unlinkedCode->wasCompiledWithTypeProfilerOpcodes());

INITIALIZE_METADATA(OpProfileType)

size_t instructionOffset = instruction.offset() + instruction->size() - 1;

unsigned divotStart, divotEnd;

GlobalVariableID globalVariableID = 0;

RefPtr<TypeSet> globalTypeSet;

bool shouldAnalyze = m_unlinkedCode->typeProfilerExpressionInfoForBytecodeOffset(instructionOffset, divotStart, divotEnd);

SymbolTable* symbolTable = nullptr;

switch (bytecode.m_flag) {

case ProfileTypeBytecodeClosureVar: {

const Identifier& ident = identifier(bytecode.m_identifier);

unsigned localScopeDepth = bytecode.m_symbolTableOrScopeDepth.scopeDepth();

// Even though type profiling may be profiling either a Get or a Put, we can always claim a Get because

// we're abstractly "read"ing from a JSScope.

ResolveOp op = JSScope::abstractResolve(m_globalObject.get(), localScopeDepth, scope, ident, Get, bytecode.m_resolveType, InitializationMode::NotInitialization);

if (op.type == ClosureVar || op.type == ModuleVar)

symbolTable = op.lexicalEnvironment->symbolTable();

else if (op.type == GlobalVar)

symbolTable = m_globalObject.get()->symbolTable();

UniquedStringImpl* impl = (op.type == ModuleVar) ? op.importedName.get() : ident.impl();

if (symbolTable) {

ConcurrentJSLocker locker(symbolTable->m_lock);

// If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.

symbolTable->prepareForTypeProfiling(locker);

globalVariableID = symbolTable->uniqueIDForVariable(locker, impl, vm);

globalTypeSet = symbolTable->globalTypeSetForVariable(locker, impl, vm);

} else

globalVariableID = TypeProfilerNoGlobalIDExists;

break;

}

case ProfileTypeBytecodeLocallyResolved: {

SymbolTable* symbolTable = jsCast<SymbolTable*>(getConstant(bytecode.m_symbolTableOrScopeDepth.symbolTable()));

const Identifier& ident = identifier(bytecode.m_identifier);

ConcurrentJSLocker locker(symbolTable->m_lock);

// If our parent scope was created while profiling was disabled, it will not have prepared for profiling yet.

globalVariableID = symbolTable->uniqueIDForVariable(locker, ident.impl(), vm);

globalTypeSet = symbolTable->globalTypeSetForVariable(locker, ident.impl(), vm);

break;

}

case ProfileTypeBytecodeDoesNotHaveGlobalID:

case ProfileTypeBytecodeFunctionArgument: {

globalVariableID = TypeProfilerNoGlobalIDExists;

break;

}

case ProfileTypeBytecodeFunctionReturnStatement: {

RELEASE_ASSERT(ownerExecutable->isFunctionExecutable());

globalTypeSet = jsCast<FunctionExecutable*>(ownerExecutable)->returnStatementTypeSet();

globalVariableID = TypeProfilerReturnStatement;

if (!shouldAnalyze) {

// Because a return statement can be added implicitly to return undefined at the end of a function,

// and these nodes don't emit expression ranges because they aren't in the actual source text of

// the user's program, give the type profiler some range to identify these return statements.

// Currently, the text offset that is used as identification is "f" in the function keyword

// and is stored on TypeLocation's m_divotForFunctionOffsetIfReturnStatement member variable.

divotStart = divotEnd = ownerExecutable->typeProfilingStartOffset();

shouldAnalyze = true;

}

break;

}

}

std::pair<TypeLocation*, bool> locationPair = vm.typeProfiler()->typeLocationCache()->getTypeLocation(globalVariableID,

ownerExecutable->sourceID(), divotStart, divotEnd, WTF::move(globalTypeSet), &vm);

TypeLocation* location = locationPair.first;

bool isNewLocation = locationPair.second;

if (bytecode.m_flag == ProfileTypeBytecodeFunctionReturnStatement)

location->m_divotForFunctionOffsetIfReturnStatement = ownerExecutable->typeProfilingStartOffset();

if (shouldAnalyze && isNewLocation)

vm.typeProfiler()->insertNewLocation(location);

metadata.m_typeLocation = location;

break;

}

case op_debug: {

if (instruction->as<OpDebug>().m_debugHookType == DidReachDebuggerStatement)

m_hasDebuggerStatement = true;

break;

}

case op_create_rest: {

int numberOfArgumentsToSkip = instruction->as<OpCreateRest>().m_numParametersToSkip;

ASSERT_UNUSED(numberOfArgumentsToSkip, numberOfArgumentsToSkip >= 0);

// This is used when rematerializing the rest parameter during OSR exit in the FTL JIT.");

m_numberOfArgumentsToSkip = numberOfArgumentsToSkip;

break;

}

default:

break;

}

}

#undef CASE

#undef INITIALIZE_METADATA

#undef LINK_FIELD

#undef LINK

if (m_unlinkedCode->wasCompiledWithControlFlowProfilerOpcodes())

insertBasicBlockBoundariesForControlFlowProfiler();

if (Options::dumpGeneratedBytecodes())

dumpBytecode();

if (m_metadata)

vm.heap.reportExtraMemoryAllocated(this, m_metadata->sizeInBytesForGC());

initializeTemplateObjects(topLevelExecutable, templateObjectIndices);

RETURN_IF_EXCEPTION(throwScope, false);

return true;

}

#if ENABLE(JIT)

void CodeBlock::setBaselineJITData(std::unique_ptr<BaselineJITData>&& jitData)

{

ASSERT(!m_jitData);

WTF::storeStoreFence(); // m_jitData is accessed from concurrent GC threads.

m_jitData = jitData.release();

checker().set(CrashChecker::BaselineJITData, checker().hash(this, m_jitData));

auto* baselineJITData = std::bit_cast<BaselineJITData*>(m_jitData);

checker().set(CrashChecker::PropertyInlineCacheCount, checker().hash(this, baselineJITData->propertyInlineCaches().size()));

}

void CodeBlock::setupWithUnlinkedBaselineCode(Ref<BaselineJITCode> jitCode)

{

setJITCode(jitCode.copyRef());

{

const auto& jitCodeMap = this->jitCodeMap();

for (size_t i = 0; i < numberOfExceptionHandlers(); ++i) {

HandlerInfo& handler = exceptionHandler(i);

// FIXME: <rdar://problem/39433318>.

handler.nativeCode = jitCodeMap.find(BytecodeIndex(handler.target)).retagged<ExceptionHandlerPtrTag>();

}

}

{

ASSERT(!m_jitData);

auto baselineJITData = BaselineJITData::create(jitCode->m_unlinkedPropertyInlineCaches.size(), jitCode->m_constantPool.size(), this);

for (unsigned index = 0; index < jitCode->m_unlinkedPropertyInlineCaches.size(); ++index) {

BaselineUnlinkedPropertyInlineCache& unlinkedPropertyCache = jitCode->m_unlinkedPropertyInlineCaches[index];

auto& propertyCache = baselineJITData->propertyCache(index);

propertyCache.initializeFromUnlinkedPropertyInlineCache(vm(), this, unlinkedPropertyCache);

}

for (size_t i = 0; i < jitCode->m_constantPool.size(); ++i) {

auto entry = jitCode->m_constantPool.at(i);

switch (entry.type()) {

case JITConstantPool::Type::FunctionDecl: {

unsigned index = std::bit_cast<uintptr_t>(entry.pointer());

baselineJITData->trailingSpan()[i] = functionDecl(index);

break;

}

case JITConstantPool::Type::FunctionExpr: {

unsigned index = std::bit_cast<uintptr_t>(entry.pointer());

baselineJITData->trailingSpan()[i] = functionExpr(index);

break;

}

}

}

setBaselineJITData(WTF::move(baselineJITData));

// Set optimization thresholds only after instructions is initialized and JITData is initialized, since these

// rely on the instruction count (and are in theory permitted to also inspect the instruction stream to more accurate assess the cost of tier-up).

// And the data is stored in JITData.

optimizeAfterWarmUp();

}

switch (codeType()) {

case GlobalCode:

case ModuleCode:

case EvalCode:

m_shouldAlwaysBeInlined = false;

break;

case FunctionCode:

// We could have already set it to false because we detected an uninlineable call.

// Don't override that observation.

m_shouldAlwaysBeInlined &= canInline(capabilityLevel()) && DFG::mightInlineFunction(JITType::FTLJIT, this);

break;

}

if (jitCode->m_isShareable && !unlinkedCodeBlock()->m_unlinkedBaselineCode && Options::useBaselineJITCodeSharing())

unlinkedCodeBlock()->m_unlinkedBaselineCode = WTF::move(jitCode);

}

#endif // ENABLE(JIT)

CodeBlock::~CodeBlock()

{

auto& cc = checker();

if (cc.isEnabled) {

RELEASE_ASSERT(cc.get(CrashChecker::This) == cc.hash(this),

CrashChecker::This, cc.value(), cc.hash(this), this);

RELEASE_ASSERT(!cc.get(CrashChecker::Destructed),

CrashChecker::Destructed, cc.value(), cc.hash(this), this);

RELEASE_ASSERT(cc.get(CrashChecker::Metadata) == cc.hash(this, m_metadata.get()),

CrashChecker::Metadata, cc.value(), cc.hash(this, m_metadata.get()), this, m_metadata.get());

}

VM& vm = *m_vm;

if (JITCode::isBaselineCode(jitType())) {

#if ENABLE(JIT)

if (cc.isEnabled && m_jitData) {

RELEASE_ASSERT(cc.get(CrashChecker::BaselineJITData) == cc.hash(this, m_jitData),

CrashChecker::BaselineJITData, cc.value(), cc.hash(this, m_jitData), this, m_jitData);

auto propertyCacheCount = std::bit_cast<BaselineJITData*>(m_jitData)->propertyInlineCaches().size();

RELEASE_ASSERT(cc.get(CrashChecker::PropertyInlineCacheCount) == cc.hash(this, propertyCacheCount),

CrashChecker::PropertyInlineCacheCount, cc.value(),

cc.hash(this, propertyCacheCount), this, m_jitData, propertyCacheCount);

RELEASE_ASSERT(!cc.get(CrashChecker::DFGJITData),

CrashChecker::DFGJITData, cc.value(), cc.hash(this, m_jitData), this, m_jitData);

}

#endif

if (m_metadata) {

m_metadata->forEach<OpCatch>([&](auto& metadata) {

if (metadata.m_buffer)

ValueProfileAndVirtualRegisterBuffer::destroy(std::exchange(metadata.m_buffer, nullptr));

});

}

}

#if ENABLE(DFG_JIT)

// The JITCode (and its corresponding DFG::CommonData) may outlive the CodeBlock by

// a short amount of time after the CodeBlock is destructed. For example, the

// Interpreter::execute methods will ref JITCode before invoking it. This can

// result in the JITCode having a non-zero refCount when its owner CodeBlock is

// destructed.

//

// Hence, we cannot rely on DFG::CommonData destruction to clear these now invalid

// watchpoints in a timely manner. We'll ensure they are cleared here eagerly.

//

// We only need to do this for a DFG/FTL CodeBlock because only these will have a

// DFG:CommonData. Hence, the LLInt and Baseline will not have any of these watchpoints.

//

// Note also that the LLIntPrototypeLoadAdaptiveStructureWatchpoint is also related

// to the CodeBlock. However, its lifecycle is tied directly to the CodeBlock, and

// will be automatically cleared when the CodeBlock destructs.

if (JSC::JITCode::isOptimizingJIT(jitType()))

jitCode()->dfgCommon()->clearWatchpoints();

#endif

if (vm.m_perBytecodeProfiler) [[unlikely]]

vm.m_perBytecodeProfiler->notifyDestruction(this);

if (!vm.heap.isShuttingDown()) [[likely]] {

// FIXME: This check should really not be necessary, see https://webkit.org/b/272787

ASSERT(!m_metadata || m_metadata->unlinkedMetadata());

if (m_metadata && !m_metadata->isDestroyed()) {

auto unlinkedMetadata = m_metadata->unlinkedMetadata();

if (unlinkedMetadata->didOptimize() == TriState::Indeterminate)

unlinkedMetadata->setDidOptimize(TriState::False);

}

}

#if ENABLE(VERBOSE_VALUE_PROFILE)

dumpValueProfiles();

#endif

// We may be destroyed before any CodeBlocks that refer to us are destroyed.

// Consider that two CodeBlocks become unreachable at the same time. There

// is no guarantee about the order in which the CodeBlocks are destroyed.

// So, if we don't remove incoming calls, and get destroyed before the

// CodeBlock(s) that have calls into us, then the CallLinkInfo vector's

// destructor will try to remove nodes from our (no longer valid) linked list.

unlinkOrUpgradeIncomingCalls(vm, nullptr);

// Note that our outgoing calls will be removed from other CodeBlocks'

// m_incomingCalls linked lists through the execution of the ~CallLinkInfo

// destructors.

#if ENABLE(JIT)

if (cc.isEnabled && m_jitData) {

if (JSC::JITCode::isOptimizingJIT(jitType())) {

RELEASE_ASSERT(cc.get(CrashChecker::DFGJITData) == cc.hash(this, m_jitData),

CrashChecker::DFGJITData, cc.value(), cc.hash(this, m_jitData), this, m_jitData);

RELEASE_ASSERT(!cc.get(CrashChecker::BaselineJITData),

CrashChecker::BaselineJITData, cc.value(), cc.hash(this, m_jitData), this, m_jitData);

} else {

RELEASE_ASSERT(cc.get(CrashChecker::BaselineJITData) == cc.hash(this, m_jitData),

CrashChecker::BaselineJITData, cc.value(), cc.hash(this, m_jitData), this, m_jitData);

auto propertyCacheCount = std::bit_cast<BaselineJITData*>(m_jitData)->propertyInlineCaches().size();

RELEASE_ASSERT(cc.get(CrashChecker::PropertyInlineCacheCount) == cc.hash(this, propertyCacheCount),

CrashChecker::PropertyInlineCacheCount, cc.value(), cc.hash(this, propertyCacheCount), this, m_jitData, propertyCacheCount);

}

}

forEachPropertyInlineCache([&](PropertyInlineCache& propertyCache) {

propertyCache.aboutToDie();

propertyCache.deref();

return IterationStatus::Continue;

});

if (JSC::JITCode::isOptimizingJIT(jitType())) {

#if ENABLE(DFG_JIT)

if (auto* jitData = dfgJITData()) {

m_jitData = nullptr;

delete jitData;

}

#endif

} else {

if (auto* jitData = baselineJITData()) {

m_jitData = nullptr;

delete jitData;

}

}

#endif // ENABLE(JIT)

if (cc.isEnabled) {

if (!m_llintGetByIdWatchpointMap.isEmpty()) {

// Do some spot checks.

auto iterator = m_llintGetByIdWatchpointMap.begin();

FixedVector<LLIntPrototypeLoadAdaptiveStructureWatchpoint>& watchpoints = iterator.get()->value;

auto numberOfWatchpoints = watchpoints.size();

RELEASE_ASSERT(numberOfWatchpoints);

auto checkWatchpointLink = [&] (auto& watchpoint, unsigned index) {

if (!watchpoint.isOnList())

return;

auto* prev = watchpoint.prev();

auto* next = watchpoint.next();

if (!Integrity::isSanePointer(prev) || !Integrity::isSanePointer(next)) [[unlikely]] {

uintptr_t status = 0;

if (Integrity::isSanePointer(prev))

status |= 0x5;

if (Integrity::isSanePointer(next))

status |= 0xa << 4;

CrashChecker actual;

actual.set(CrashChecker::This, actual.hash(this));

actual.set(CrashChecker::Metadata, actual.hash(this, m_metadata.get()));

if (JITCode::isOptimizingJIT(jitType()))

status |= 0xc << 8; // We expect this path to never be taken because this path is only for LLint.

else if (JITCode::isBaselineCode(jitType()))

status |= 0xb << 8;

if (cc.get(CrashChecker::Destructed))

status |= 0xd << 12;

#if ENABLE(JIT)

status |= std::bit_cast<uintptr_t>(m_jitData) << 16;

#endif

RELEASE_ASSERT(Integrity::isSanePointer(prev) && Integrity::isSanePointer(next),

status, index, numberOfWatchpoints, prev, next, &watchpoints, cc.value());