1 //===-- X86WinEHState - Insert EH state updates for win32 exceptions ------===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // All functions using an MSVC EH personality use an explicitly updated state
11 // number stored in an exception registration stack object. The registration
12 // object is linked into a thread-local chain of registrations stored at fs:00.
13 // This pass adds the registration object and EH state updates.
14 //
15 //===----------------------------------------------------------------------===//
16 
17 #include "X86.h"
18 #include "llvm/ADT/PostOrderIterator.h"
19 #include "llvm/Analysis/CFG.h"
20 #include "llvm/Analysis/EHPersonalities.h"
21 #include "llvm/CodeGen/MachineModuleInfo.h"
22 #include "llvm/CodeGen/WinEHFuncInfo.h"
23 #include "llvm/IR/CallSite.h"
24 #include "llvm/IR/Function.h"
25 #include "llvm/IR/IRBuilder.h"
26 #include "llvm/IR/Instructions.h"
27 #include "llvm/IR/IntrinsicInst.h"
28 #include "llvm/IR/Module.h"
29 #include "llvm/Pass.h"
30 #include "llvm/Support/Debug.h"
31 #include <deque>
32 
33 using namespace llvm;
34 
35 #define DEBUG_TYPE "winehstate"
36 
37 namespace llvm {
38 void initializeWinEHStatePassPass(PassRegistry &);
39 }
40 
41 namespace {
42 const int OverdefinedState = INT_MIN;
43 
44 class WinEHStatePass : public FunctionPass {
45 public:
46   static char ID; // Pass identification, replacement for typeid.
47 
48   WinEHStatePass() : FunctionPass(ID) {
49     initializeWinEHStatePassPass(*PassRegistry::getPassRegistry());
50   }
51 
52   bool runOnFunction(Function &Fn) override;
53 
54   bool doInitialization(Module &M) override;
55 
56   bool doFinalization(Module &M) override;
57 
58   void getAnalysisUsage(AnalysisUsage &AU) const override;
59 
60   StringRef getPassName() const override {
61     return "Windows 32-bit x86 EH state insertion";
62   }
63 
64 private:
65   void emitExceptionRegistrationRecord(Function *F);
66 
67   void linkExceptionRegistration(IRBuilder<> &Builder, Function *Handler);
68   void unlinkExceptionRegistration(IRBuilder<> &Builder);
69   void addStateStores(Function &F, WinEHFuncInfo &FuncInfo);
70   void insertStateNumberStore(Instruction *IP, int State);
71 
72   Value *emitEHLSDA(IRBuilder<> &Builder, Function *F);
73 
74   Function *generateLSDAInEAXThunk(Function *ParentFunc);
75 
76   bool isStateStoreNeeded(EHPersonality Personality, CallSite CS);
77   void rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F, CallSite CS,
78                              Value *State);
79   int getBaseStateForBB(DenseMap<BasicBlock *, ColorVector> &BlockColors,
80                         WinEHFuncInfo &FuncInfo, BasicBlock *BB);
81   int getStateForCallSite(DenseMap<BasicBlock *, ColorVector> &BlockColors,
82                           WinEHFuncInfo &FuncInfo, CallSite CS);
83 
84   // Module-level type getters.
85   Type *getEHLinkRegistrationType();
86   Type *getSEHRegistrationType();
87   Type *getCXXEHRegistrationType();
88 
89   // Per-module data.
90   Module *TheModule = nullptr;
91   StructType *EHLinkRegistrationTy = nullptr;
92   StructType *CXXEHRegistrationTy = nullptr;
93   StructType *SEHRegistrationTy = nullptr;
94   Constant *SetJmp3 = nullptr;
95   Constant *CxxLongjmpUnwind = nullptr;
96 
97   // Per-function state
98   EHPersonality Personality = EHPersonality::Unknown;
99   Function *PersonalityFn = nullptr;
100   bool UseStackGuard = false;
101   int ParentBaseState;
102   Constant *SehLongjmpUnwind = nullptr;
103   Constant *Cookie = nullptr;
104 
105   /// The stack allocation containing all EH data, including the link in the
106   /// fs:00 chain and the current state.
107   AllocaInst *RegNode = nullptr;
108 
109   // The allocation containing the EH security guard.
110   AllocaInst *EHGuardNode = nullptr;
111 
112   /// The index of the state field of RegNode.
113   int StateFieldIndex = ~0U;
114 
115   /// The linked list node subobject inside of RegNode.
116   Value *Link = nullptr;
117 };
118 }
119 
120 FunctionPass *llvm::createX86WinEHStatePass() { return new WinEHStatePass(); }
121 
122 char WinEHStatePass::ID = 0;
123 
124 INITIALIZE_PASS(WinEHStatePass, "x86-winehstate",
125                 "Insert stores for EH state numbers", false, false)
126 
127 bool WinEHStatePass::doInitialization(Module &M) {
128   TheModule = &M;
129   return false;
130 }
131 
132 bool WinEHStatePass::doFinalization(Module &M) {
133   assert(TheModule == &M);
134   TheModule = nullptr;
135   EHLinkRegistrationTy = nullptr;
136   CXXEHRegistrationTy = nullptr;
137   SEHRegistrationTy = nullptr;
138   SetJmp3 = nullptr;
139   CxxLongjmpUnwind = nullptr;
140   SehLongjmpUnwind = nullptr;
141   Cookie = nullptr;
142   return false;
143 }
144 
145 void WinEHStatePass::getAnalysisUsage(AnalysisUsage &AU) const {
146   // This pass should only insert a stack allocation, memory accesses, and
147   // localrecovers.
148   AU.setPreservesCFG();
149 }
150 
151 bool WinEHStatePass::runOnFunction(Function &F) {
152   // Don't insert state stores or exception handler thunks for
153   // available_externally functions. The handler needs to reference the LSDA,
154   // which will not be emitted in this case.
155   if (F.hasAvailableExternallyLinkage())
156     return false;
157 
158   // Check the personality. Do nothing if this personality doesn't use funclets.
159   if (!F.hasPersonalityFn())
160     return false;
161   PersonalityFn =
162       dyn_cast<Function>(F.getPersonalityFn()->stripPointerCasts());
163   if (!PersonalityFn)
164     return false;
165   Personality = classifyEHPersonality(PersonalityFn);
166   if (!isFuncletEHPersonality(Personality))
167     return false;
168 
169   // Skip this function if there are no EH pads and we aren't using IR-level
170   // outlining.
171   bool HasPads = false;
172   for (BasicBlock &BB : F) {
173     if (BB.isEHPad()) {
174       HasPads = true;
175       break;
176     }
177   }
178   if (!HasPads)
179     return false;
180 
181   Type *Int8PtrType = Type::getInt8PtrTy(TheModule->getContext());
182   SetJmp3 = TheModule->getOrInsertFunction(
183       "_setjmp3", FunctionType::get(
184                       Type::getInt32Ty(TheModule->getContext()),
185                       {Int8PtrType, Type::getInt32Ty(TheModule->getContext())},
186                       /*isVarArg=*/true));
187 
188   // Disable frame pointer elimination in this function.
189   // FIXME: Do the nested handlers need to keep the parent ebp in ebp, or can we
190   // use an arbitrary register?
191   F.addFnAttr("no-frame-pointer-elim", "true");
192 
193   emitExceptionRegistrationRecord(&F);
194 
195   // The state numbers calculated here in IR must agree with what we calculate
196   // later on for the MachineFunction. In particular, if an IR pass deletes an
197   // unreachable EH pad after this point before machine CFG construction, we
198   // will be in trouble. If this assumption is ever broken, we should turn the
199   // numbers into an immutable analysis pass.
200   WinEHFuncInfo FuncInfo;
201   addStateStores(F, FuncInfo);
202 
203   // Reset per-function state.
204   PersonalityFn = nullptr;
205   Personality = EHPersonality::Unknown;
206   UseStackGuard = false;
207   RegNode = nullptr;
208   EHGuardNode = nullptr;
209 
210   return true;
211 }
212 
213 /// Get the common EH registration subobject:
214 ///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
215 ///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
216 ///   struct EHRegistrationNode {
217 ///     EHRegistrationNode *Next;
218 ///     PEXCEPTION_ROUTINE Handler;
219 ///   };
220 Type *WinEHStatePass::getEHLinkRegistrationType() {
221   if (EHLinkRegistrationTy)
222     return EHLinkRegistrationTy;
223   LLVMContext &Context = TheModule->getContext();
224   EHLinkRegistrationTy = StructType::create(Context, "EHRegistrationNode");
225   Type *FieldTys[] = {
226       EHLinkRegistrationTy->getPointerTo(0), // EHRegistrationNode *Next
227       Type::getInt8PtrTy(Context) // EXCEPTION_DISPOSITION (*Handler)(...)
228   };
229   EHLinkRegistrationTy->setBody(FieldTys, false);
230   return EHLinkRegistrationTy;
231 }
232 
233 /// The __CxxFrameHandler3 registration node:
234 ///   struct CXXExceptionRegistration {
235 ///     void *SavedESP;
236 ///     EHRegistrationNode SubRecord;
237 ///     int32_t TryLevel;
238 ///   };
239 Type *WinEHStatePass::getCXXEHRegistrationType() {
240   if (CXXEHRegistrationTy)
241     return CXXEHRegistrationTy;
242   LLVMContext &Context = TheModule->getContext();
243   Type *FieldTys[] = {
244       Type::getInt8PtrTy(Context), // void *SavedESP
245       getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
246       Type::getInt32Ty(Context)    // int32_t TryLevel
247   };
248   CXXEHRegistrationTy =
249       StructType::create(FieldTys, "CXXExceptionRegistration");
250   return CXXEHRegistrationTy;
251 }
252 
253 /// The _except_handler3/4 registration node:
254 ///   struct EH4ExceptionRegistration {
255 ///     void *SavedESP;
256 ///     _EXCEPTION_POINTERS *ExceptionPointers;
257 ///     EHRegistrationNode SubRecord;
258 ///     int32_t EncodedScopeTable;
259 ///     int32_t TryLevel;
260 ///   };
261 Type *WinEHStatePass::getSEHRegistrationType() {
262   if (SEHRegistrationTy)
263     return SEHRegistrationTy;
264   LLVMContext &Context = TheModule->getContext();
265   Type *FieldTys[] = {
266       Type::getInt8PtrTy(Context), // void *SavedESP
267       Type::getInt8PtrTy(Context), // void *ExceptionPointers
268       getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
269       Type::getInt32Ty(Context),   // int32_t EncodedScopeTable
270       Type::getInt32Ty(Context)    // int32_t TryLevel
271   };
272   SEHRegistrationTy = StructType::create(FieldTys, "SEHExceptionRegistration");
273   return SEHRegistrationTy;
274 }
275 
276 // Emit an exception registration record. These are stack allocations with the
277 // common subobject of two pointers: the previous registration record (the old
278 // fs:00) and the personality function for the current frame. The data before
279 // and after that is personality function specific.
280 void WinEHStatePass::emitExceptionRegistrationRecord(Function *F) {
281   assert(Personality == EHPersonality::MSVC_CXX ||
282          Personality == EHPersonality::MSVC_X86SEH);
283 
284   // Struct type of RegNode. Used for GEPing.
285   Type *RegNodeTy;
286 
287   IRBuilder<> Builder(&F->getEntryBlock(), F->getEntryBlock().begin());
288   Type *Int8PtrType = Builder.getInt8PtrTy();
289   Type *Int32Ty = Builder.getInt32Ty();
290   Type *VoidTy = Builder.getVoidTy();
291 
292   if (Personality == EHPersonality::MSVC_CXX) {
293     RegNodeTy = getCXXEHRegistrationType();
294     RegNode = Builder.CreateAlloca(RegNodeTy);
295     // SavedESP = llvm.stacksave()
296     Value *SP = Builder.CreateCall(
297         Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
298     Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
299     // TryLevel = -1
300     StateFieldIndex = 2;
301     ParentBaseState = -1;
302     insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
303     // Handler = __ehhandler$F
304     Function *Trampoline = generateLSDAInEAXThunk(F);
305     Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 1);
306     linkExceptionRegistration(Builder, Trampoline);
307 
308     CxxLongjmpUnwind = TheModule->getOrInsertFunction(
309         "__CxxLongjmpUnwind",
310         FunctionType::get(VoidTy, Int8PtrType, /*isVarArg=*/false));
311     cast<Function>(CxxLongjmpUnwind->stripPointerCasts())
312         ->setCallingConv(CallingConv::X86_StdCall);
313   } else if (Personality == EHPersonality::MSVC_X86SEH) {
314     // If _except_handler4 is in use, some additional guard checks and prologue
315     // stuff is required.
316     StringRef PersonalityName = PersonalityFn->getName();
317     UseStackGuard = (PersonalityName == "_except_handler4");
318 
319     // Allocate local structures.
320     RegNodeTy = getSEHRegistrationType();
321     RegNode = Builder.CreateAlloca(RegNodeTy);
322     if (UseStackGuard)
323       EHGuardNode = Builder.CreateAlloca(Int32Ty);
324 
325     // SavedESP = llvm.stacksave()
326     Value *SP = Builder.CreateCall(
327         Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
328     Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
329     // TryLevel = -2 / -1
330     StateFieldIndex = 4;
331     ParentBaseState = UseStackGuard ? -2 : -1;
332     insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
333     // ScopeTable = llvm.x86.seh.lsda(F)
334     Value *LSDA = emitEHLSDA(Builder, F);
335     LSDA = Builder.CreatePtrToInt(LSDA, Int32Ty);
336     // If using _except_handler4, xor the address of the table with
337     // __security_cookie.
338     if (UseStackGuard) {
339       Cookie = TheModule->getOrInsertGlobal("__security_cookie", Int32Ty);
340       Value *Val = Builder.CreateLoad(Int32Ty, Cookie, "cookie");
341       LSDA = Builder.CreateXor(LSDA, Val);
342     }
343     Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 3));
344 
345     // If using _except_handler4, the EHGuard contains: FramePtr xor Cookie.
346     if (UseStackGuard) {
347       Value *Val = Builder.CreateLoad(Int32Ty, Cookie);
348       Value *FrameAddr = Builder.CreateCall(
349           Intrinsic::getDeclaration(TheModule, Intrinsic::frameaddress),
350           Builder.getInt32(0), "frameaddr");
351       Value *FrameAddrI32 = Builder.CreatePtrToInt(FrameAddr, Int32Ty);
352       FrameAddrI32 = Builder.CreateXor(FrameAddrI32, Val);
353       Builder.CreateStore(FrameAddrI32, EHGuardNode);
354     }
355 
356     // Register the exception handler.
357     Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 2);
358     linkExceptionRegistration(Builder, PersonalityFn);
359 
360     SehLongjmpUnwind = TheModule->getOrInsertFunction(
361         UseStackGuard ? "_seh_longjmp_unwind4" : "_seh_longjmp_unwind",
362         FunctionType::get(Type::getVoidTy(TheModule->getContext()), Int8PtrType,
363                           /*isVarArg=*/false));
364     cast<Function>(SehLongjmpUnwind->stripPointerCasts())
365         ->setCallingConv(CallingConv::X86_StdCall);
366   } else {
367     llvm_unreachable("unexpected personality function");
368   }
369 
370   // Insert an unlink before all returns.
371   for (BasicBlock &BB : *F) {
372     TerminatorInst *T = BB.getTerminator();
373     if (!isa<ReturnInst>(T))
374       continue;
375     Builder.SetInsertPoint(T);
376     unlinkExceptionRegistration(Builder);
377   }
378 }
379 
380 Value *WinEHStatePass::emitEHLSDA(IRBuilder<> &Builder, Function *F) {
381   Value *FI8 = Builder.CreateBitCast(F, Type::getInt8PtrTy(F->getContext()));
382   return Builder.CreateCall(
383       Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
384 }
385 
386 /// Generate a thunk that puts the LSDA of ParentFunc in EAX and then calls
387 /// PersonalityFn, forwarding the parameters passed to PEXCEPTION_ROUTINE:
388 ///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
389 ///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
390 /// We essentially want this code:
391 ///   movl $lsda, %eax
392 ///   jmpl ___CxxFrameHandler3
393 Function *WinEHStatePass::generateLSDAInEAXThunk(Function *ParentFunc) {
394   LLVMContext &Context = ParentFunc->getContext();
395   Type *Int32Ty = Type::getInt32Ty(Context);
396   Type *Int8PtrType = Type::getInt8PtrTy(Context);
397   Type *ArgTys[5] = {Int8PtrType, Int8PtrType, Int8PtrType, Int8PtrType,
398                      Int8PtrType};
399   FunctionType *TrampolineTy =
400       FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 4),
401                         /*isVarArg=*/false);
402   FunctionType *TargetFuncTy =
403       FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 5),
404                         /*isVarArg=*/false);
405   Function *Trampoline =
406       Function::Create(TrampolineTy, GlobalValue::InternalLinkage,
407                        Twine("__ehhandler$") + GlobalValue::dropLLVMManglingEscape(
408                                                    ParentFunc->getName()),
409                        TheModule);
410   if (auto *C = ParentFunc->getComdat())
411     Trampoline->setComdat(C);
412   BasicBlock *EntryBB = BasicBlock::Create(Context, "entry", Trampoline);
413   IRBuilder<> Builder(EntryBB);
414   Value *LSDA = emitEHLSDA(Builder, ParentFunc);
415   Value *CastPersonality =
416       Builder.CreateBitCast(PersonalityFn, TargetFuncTy->getPointerTo());
417   auto AI = Trampoline->arg_begin();
418   Value *Args[5] = {LSDA, &*AI++, &*AI++, &*AI++, &*AI++};
419   CallInst *Call = Builder.CreateCall(CastPersonality, Args);
420   // Can't use musttail due to prototype mismatch, but we can use tail.
421   Call->setTailCall(true);
422   // Set inreg so we pass it in EAX.
423   Call->addParamAttr(0, Attribute::InReg);
424   Builder.CreateRet(Call);
425   return Trampoline;
426 }
427 
428 void WinEHStatePass::linkExceptionRegistration(IRBuilder<> &Builder,
429                                                Function *Handler) {
430   // Emit the .safeseh directive for this function.
431   Handler->addFnAttr("safeseh");
432 
433   Type *LinkTy = getEHLinkRegistrationType();
434   // Handler = Handler
435   Value *HandlerI8 = Builder.CreateBitCast(Handler, Builder.getInt8PtrTy());
436   Builder.CreateStore(HandlerI8, Builder.CreateStructGEP(LinkTy, Link, 1));
437   // Next = [fs:00]
438   Constant *FSZero =
439       Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
440   Value *Next = Builder.CreateLoad(FSZero);
441   Builder.CreateStore(Next, Builder.CreateStructGEP(LinkTy, Link, 0));
442   // [fs:00] = Link
443   Builder.CreateStore(Link, FSZero);
444 }
445 
446 void WinEHStatePass::unlinkExceptionRegistration(IRBuilder<> &Builder) {
447   // Clone Link into the current BB for better address mode folding.
448   if (auto *GEP = dyn_cast<GetElementPtrInst>(Link)) {
449     GEP = cast<GetElementPtrInst>(GEP->clone());
450     Builder.Insert(GEP);
451     Link = GEP;
452   }
453   Type *LinkTy = getEHLinkRegistrationType();
454   // [fs:00] = Link->Next
455   Value *Next =
456       Builder.CreateLoad(Builder.CreateStructGEP(LinkTy, Link, 0));
457   Constant *FSZero =
458       Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
459   Builder.CreateStore(Next, FSZero);
460 }
461 
462 // Calls to setjmp(p) are lowered to _setjmp3(p, 0) by the frontend.
463 // The idea behind _setjmp3 is that it takes an optional number of personality
464 // specific parameters to indicate how to restore the personality-specific frame
465 // state when longjmp is initiated.  Typically, the current TryLevel is saved.
466 void WinEHStatePass::rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F,
467                                            CallSite CS, Value *State) {
468   // Don't rewrite calls with a weird number of arguments.
469   if (CS.getNumArgOperands() != 2)
470     return;
471 
472   Instruction *Inst = CS.getInstruction();
473 
474   SmallVector<OperandBundleDef, 1> OpBundles;
475   CS.getOperandBundlesAsDefs(OpBundles);
476 
477   SmallVector<Value *, 3> OptionalArgs;
478   if (Personality == EHPersonality::MSVC_CXX) {
479     OptionalArgs.push_back(CxxLongjmpUnwind);
480     OptionalArgs.push_back(State);
481     OptionalArgs.push_back(emitEHLSDA(Builder, &F));
482   } else if (Personality == EHPersonality::MSVC_X86SEH) {
483     OptionalArgs.push_back(SehLongjmpUnwind);
484     OptionalArgs.push_back(State);
485     if (UseStackGuard)
486       OptionalArgs.push_back(Cookie);
487   } else {
488     llvm_unreachable("unhandled personality!");
489   }
490 
491   SmallVector<Value *, 5> Args;
492   Args.push_back(
493       Builder.CreateBitCast(CS.getArgOperand(0), Builder.getInt8PtrTy()));
494   Args.push_back(Builder.getInt32(OptionalArgs.size()));
495   Args.append(OptionalArgs.begin(), OptionalArgs.end());
496 
497   CallSite NewCS;
498   if (CS.isCall()) {
499     auto *CI = cast<CallInst>(Inst);
500     CallInst *NewCI = Builder.CreateCall(SetJmp3, Args, OpBundles);
501     NewCI->setTailCallKind(CI->getTailCallKind());
502     NewCS = NewCI;
503   } else {
504     auto *II = cast<InvokeInst>(Inst);
505     NewCS = Builder.CreateInvoke(
506         SetJmp3, II->getNormalDest(), II->getUnwindDest(), Args, OpBundles);
507   }
508   NewCS.setCallingConv(CS.getCallingConv());
509   NewCS.setAttributes(CS.getAttributes());
510   NewCS->setDebugLoc(CS->getDebugLoc());
511 
512   Instruction *NewInst = NewCS.getInstruction();
513   NewInst->takeName(Inst);
514   Inst->replaceAllUsesWith(NewInst);
515   Inst->eraseFromParent();
516 }
517 
518 // Figure out what state we should assign calls in this block.
519 int WinEHStatePass::getBaseStateForBB(
520     DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
521     BasicBlock *BB) {
522   int BaseState = ParentBaseState;
523   auto &BBColors = BlockColors[BB];
524 
525   assert(BBColors.size() == 1 && "multi-color BB not removed by preparation");
526   BasicBlock *FuncletEntryBB = BBColors.front();
527   if (auto *FuncletPad =
528           dyn_cast<FuncletPadInst>(FuncletEntryBB->getFirstNonPHI())) {
529     auto BaseStateI = FuncInfo.FuncletBaseStateMap.find(FuncletPad);
530     if (BaseStateI != FuncInfo.FuncletBaseStateMap.end())
531       BaseState = BaseStateI->second;
532   }
533 
534   return BaseState;
535 }
536 
537 // Calculate the state a call-site is in.
538 int WinEHStatePass::getStateForCallSite(
539     DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
540     CallSite CS) {
541   if (auto *II = dyn_cast<InvokeInst>(CS.getInstruction())) {
542     // Look up the state number of the EH pad this unwinds to.
543     assert(FuncInfo.InvokeStateMap.count(II) && "invoke has no state!");
544     return FuncInfo.InvokeStateMap[II];
545   }
546   // Possibly throwing call instructions have no actions to take after
547   // an unwind. Ensure they are in the -1 state.
548   return getBaseStateForBB(BlockColors, FuncInfo, CS.getParent());
549 }
550 
551 // Calculate the intersection of all the FinalStates for a BasicBlock's
552 // predecessors.
553 static int getPredState(DenseMap<BasicBlock *, int> &FinalStates, Function &F,
554                         int ParentBaseState, BasicBlock *BB) {
555   // The entry block has no predecessors but we know that the prologue always
556   // sets us up with a fixed state.
557   if (&F.getEntryBlock() == BB)
558     return ParentBaseState;
559 
560   // This is an EH Pad, conservatively report this basic block as overdefined.
561   if (BB->isEHPad())
562     return OverdefinedState;
563 
564   int CommonState = OverdefinedState;
565   for (BasicBlock *PredBB : predecessors(BB)) {
566     // We didn't manage to get a state for one of these predecessors,
567     // conservatively report this basic block as overdefined.
568     auto PredEndState = FinalStates.find(PredBB);
569     if (PredEndState == FinalStates.end())
570       return OverdefinedState;
571 
572     // This code is reachable via exceptional control flow,
573     // conservatively report this basic block as overdefined.
574     if (isa<CatchReturnInst>(PredBB->getTerminator()))
575       return OverdefinedState;
576 
577     int PredState = PredEndState->second;
578     assert(PredState != OverdefinedState &&
579            "overdefined BBs shouldn't be in FinalStates");
580     if (CommonState == OverdefinedState)
581       CommonState = PredState;
582 
583     // At least two predecessors have different FinalStates,
584     // conservatively report this basic block as overdefined.
585     if (CommonState != PredState)
586       return OverdefinedState;
587   }
588 
589   return CommonState;
590 }
591 
592 // Calculate the intersection of all the InitialStates for a BasicBlock's
593 // successors.
594 static int getSuccState(DenseMap<BasicBlock *, int> &InitialStates, Function &F,
595                         int ParentBaseState, BasicBlock *BB) {
596   // This block rejoins normal control flow,
597   // conservatively report this basic block as overdefined.
598   if (isa<CatchReturnInst>(BB->getTerminator()))
599     return OverdefinedState;
600 
601   int CommonState = OverdefinedState;
602   for (BasicBlock *SuccBB : successors(BB)) {
603     // We didn't manage to get a state for one of these predecessors,
604     // conservatively report this basic block as overdefined.
605     auto SuccStartState = InitialStates.find(SuccBB);
606     if (SuccStartState == InitialStates.end())
607       return OverdefinedState;
608 
609     // This is an EH Pad, conservatively report this basic block as overdefined.
610     if (SuccBB->isEHPad())
611       return OverdefinedState;
612 
613     int SuccState = SuccStartState->second;
614     assert(SuccState != OverdefinedState &&
615            "overdefined BBs shouldn't be in FinalStates");
616     if (CommonState == OverdefinedState)
617       CommonState = SuccState;
618 
619     // At least two successors have different InitialStates,
620     // conservatively report this basic block as overdefined.
621     if (CommonState != SuccState)
622       return OverdefinedState;
623   }
624 
625   return CommonState;
626 }
627 
628 bool WinEHStatePass::isStateStoreNeeded(EHPersonality Personality,
629                                         CallSite CS) {
630   if (!CS)
631     return false;
632 
633   // If the function touches memory, it needs a state store.
634   if (isAsynchronousEHPersonality(Personality))
635     return !CS.doesNotAccessMemory();
636 
637   // If the function throws, it needs a state store.
638   return !CS.doesNotThrow();
639 }
640 
641 void WinEHStatePass::addStateStores(Function &F, WinEHFuncInfo &FuncInfo) {
642   // Mark the registration node. The backend needs to know which alloca it is so
643   // that it can recover the original frame pointer.
644   IRBuilder<> Builder(RegNode->getNextNode());
645   Value *RegNodeI8 = Builder.CreateBitCast(RegNode, Builder.getInt8PtrTy());
646   Builder.CreateCall(
647       Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehregnode),
648       {RegNodeI8});
649 
650   if (EHGuardNode) {
651     IRBuilder<> Builder(EHGuardNode->getNextNode());
652     Value *EHGuardNodeI8 =
653         Builder.CreateBitCast(EHGuardNode, Builder.getInt8PtrTy());
654     Builder.CreateCall(
655         Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehguard),
656         {EHGuardNodeI8});
657   }
658 
659   // Calculate state numbers.
660   if (isAsynchronousEHPersonality(Personality))
661     calculateSEHStateNumbers(&F, FuncInfo);
662   else
663     calculateWinCXXEHStateNumbers(&F, FuncInfo);
664 
665   // Iterate all the instructions and emit state number stores.
666   DenseMap<BasicBlock *, ColorVector> BlockColors = colorEHFunclets(F);
667   ReversePostOrderTraversal<Function *> RPOT(&F);
668 
669   // InitialStates yields the state of the first call-site for a BasicBlock.
670   DenseMap<BasicBlock *, int> InitialStates;
671   // FinalStates yields the state of the last call-site for a BasicBlock.
672   DenseMap<BasicBlock *, int> FinalStates;
673   // Worklist used to revisit BasicBlocks with indeterminate
674   // Initial/Final-States.
675   std::deque<BasicBlock *> Worklist;
676   // Fill in InitialStates and FinalStates for BasicBlocks with call-sites.
677   for (BasicBlock *BB : RPOT) {
678     int InitialState = OverdefinedState;
679     int FinalState;
680     if (&F.getEntryBlock() == BB)
681       InitialState = FinalState = ParentBaseState;
682     for (Instruction &I : *BB) {
683       CallSite CS(&I);
684       if (!isStateStoreNeeded(Personality, CS))
685         continue;
686 
687       int State = getStateForCallSite(BlockColors, FuncInfo, CS);
688       if (InitialState == OverdefinedState)
689         InitialState = State;
690       FinalState = State;
691     }
692     // No call-sites in this basic block? That's OK, we will come back to these
693     // in a later pass.
694     if (InitialState == OverdefinedState) {
695       Worklist.push_back(BB);
696       continue;
697     }
698     DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
699                  << " InitialState=" << InitialState << '\n');
700     DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
701                  << " FinalState=" << FinalState << '\n');
702     InitialStates.insert({BB, InitialState});
703     FinalStates.insert({BB, FinalState});
704   }
705 
706   // Try to fill-in InitialStates and FinalStates which have no call-sites.
707   while (!Worklist.empty()) {
708     BasicBlock *BB = Worklist.front();
709     Worklist.pop_front();
710     // This BasicBlock has already been figured out, nothing more we can do.
711     if (InitialStates.count(BB) != 0)
712       continue;
713 
714     int PredState = getPredState(FinalStates, F, ParentBaseState, BB);
715     if (PredState == OverdefinedState)
716       continue;
717 
718     // We successfully inferred this BasicBlock's state via it's predecessors;
719     // enqueue it's successors to see if we can infer their states.
720     InitialStates.insert({BB, PredState});
721     FinalStates.insert({BB, PredState});
722     for (BasicBlock *SuccBB : successors(BB))
723       Worklist.push_back(SuccBB);
724   }
725 
726   // Try to hoist stores from successors.
727   for (BasicBlock *BB : RPOT) {
728     int SuccState = getSuccState(InitialStates, F, ParentBaseState, BB);
729     if (SuccState == OverdefinedState)
730       continue;
731 
732     // Update our FinalState to reflect the common InitialState of our
733     // successors.
734     FinalStates.insert({BB, SuccState});
735   }
736 
737   // Finally, insert state stores before call-sites which transition us to a new
738   // state.
739   for (BasicBlock *BB : RPOT) {
740     auto &BBColors = BlockColors[BB];
741     BasicBlock *FuncletEntryBB = BBColors.front();
742     if (isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI()))
743       continue;
744 
745     int PrevState = getPredState(FinalStates, F, ParentBaseState, BB);
746     DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
747                  << " PrevState=" << PrevState << '\n');
748 
749     for (Instruction &I : *BB) {
750       CallSite CS(&I);
751       if (!isStateStoreNeeded(Personality, CS))
752         continue;
753 
754       int State = getStateForCallSite(BlockColors, FuncInfo, CS);
755       if (State != PrevState)
756         insertStateNumberStore(&I, State);
757       PrevState = State;
758     }
759 
760     // We might have hoisted a state store into this block, emit it now.
761     auto EndState = FinalStates.find(BB);
762     if (EndState != FinalStates.end())
763       if (EndState->second != PrevState)
764         insertStateNumberStore(BB->getTerminator(), EndState->second);
765   }
766 
767   SmallVector<CallSite, 1> SetJmp3CallSites;
768   for (BasicBlock *BB : RPOT) {
769     for (Instruction &I : *BB) {
770       CallSite CS(&I);
771       if (!CS)
772         continue;
773       if (CS.getCalledValue()->stripPointerCasts() !=
774           SetJmp3->stripPointerCasts())
775         continue;
776 
777       SetJmp3CallSites.push_back(CS);
778     }
779   }
780 
781   for (CallSite CS : SetJmp3CallSites) {
782     auto &BBColors = BlockColors[CS->getParent()];
783     BasicBlock *FuncletEntryBB = BBColors.front();
784     bool InCleanup = isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI());
785 
786     IRBuilder<> Builder(CS.getInstruction());
787     Value *State;
788     if (InCleanup) {
789       Value *StateField =
790           Builder.CreateStructGEP(nullptr, RegNode, StateFieldIndex);
791       State = Builder.CreateLoad(StateField);
792     } else {
793       State = Builder.getInt32(getStateForCallSite(BlockColors, FuncInfo, CS));
794     }
795     rewriteSetJmpCallSite(Builder, F, CS, State);
796   }
797 }
798 
799 void WinEHStatePass::insertStateNumberStore(Instruction *IP, int State) {
800   IRBuilder<> Builder(IP);
801   Value *StateField =
802       Builder.CreateStructGEP(nullptr, RegNode, StateFieldIndex);
803   Builder.CreateStore(Builder.getInt32(State), StateField);
804 }
805