1//===-- X86WinEHState - Insert EH state updates for win32 exceptions ------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// All functions using an MSVC EH personality use an explicitly updated state
10// number stored in an exception registration stack object. The registration
11// object is linked into a thread-local chain of registrations stored at fs:00.
12// This pass adds the registration object and EH state updates.
13//
14//===----------------------------------------------------------------------===//
15
16#include "X86.h"
17#include "llvm/ADT/PostOrderIterator.h"
18#include "llvm/Analysis/CFG.h"
19#include "llvm/Analysis/EHPersonalities.h"
20#include "llvm/CodeGen/MachineModuleInfo.h"
21#include "llvm/CodeGen/WinEHFuncInfo.h"
22#include "llvm/IR/CallSite.h"
23#include "llvm/IR/Function.h"
24#include "llvm/IR/IRBuilder.h"
25#include "llvm/IR/Instructions.h"
26#include "llvm/IR/Intrinsics.h"
27#include "llvm/IR/IntrinsicsX86.h"
28#include "llvm/IR/Module.h"
29#include "llvm/Pass.h"
30#include "llvm/Support/Debug.h"
31#include <deque>
32
33using namespace llvm;
34
35#define DEBUG_TYPE "winehstate"
36
37namespace {
38const int OverdefinedState = INT_MIN;
39
40class WinEHStatePass : public FunctionPass {
41public:
42  static char ID; // Pass identification, replacement for typeid.
43
44  WinEHStatePass() : FunctionPass(ID) { }
45
46  bool runOnFunction(Function &Fn) override;
47
48  bool doInitialization(Module &M) override;
49
50  bool doFinalization(Module &M) override;
51
52  void getAnalysisUsage(AnalysisUsage &AU) const override;
53
54  StringRef getPassName() const override {
55    return "Windows 32-bit x86 EH state insertion";
56  }
57
58private:
59  void emitExceptionRegistrationRecord(Function *F);
60
61  void linkExceptionRegistration(IRBuilder<> &Builder, Function *Handler);
62  void unlinkExceptionRegistration(IRBuilder<> &Builder);
63  void addStateStores(Function &F, WinEHFuncInfo &FuncInfo);
64  void insertStateNumberStore(Instruction *IP, int State);
65
66  Value *emitEHLSDA(IRBuilder<> &Builder, Function *F);
67
68  Function *generateLSDAInEAXThunk(Function *ParentFunc);
69
70  bool isStateStoreNeeded(EHPersonality Personality, CallSite CS);
71  void rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F, CallSite CS,
72                             Value *State);
73  int getBaseStateForBB(DenseMap<BasicBlock *, ColorVector> &BlockColors,
74                        WinEHFuncInfo &FuncInfo, BasicBlock *BB);
75  int getStateForCallSite(DenseMap<BasicBlock *, ColorVector> &BlockColors,
76                          WinEHFuncInfo &FuncInfo, CallSite CS);
77
78  // Module-level type getters.
79  Type *getEHLinkRegistrationType();
80  Type *getSEHRegistrationType();
81  Type *getCXXEHRegistrationType();
82
83  // Per-module data.
84  Module *TheModule = nullptr;
85  StructType *EHLinkRegistrationTy = nullptr;
86  StructType *CXXEHRegistrationTy = nullptr;
87  StructType *SEHRegistrationTy = nullptr;
88  FunctionCallee SetJmp3 = nullptr;
89  FunctionCallee CxxLongjmpUnwind = nullptr;
90
91  // Per-function state
92  EHPersonality Personality = EHPersonality::Unknown;
93  Function *PersonalityFn = nullptr;
94  bool UseStackGuard = false;
95  int ParentBaseState = 0;
96  FunctionCallee SehLongjmpUnwind = nullptr;
97  Constant *Cookie = nullptr;
98
99  /// The stack allocation containing all EH data, including the link in the
100  /// fs:00 chain and the current state.
101  AllocaInst *RegNode = nullptr;
102
103  // The allocation containing the EH security guard.
104  AllocaInst *EHGuardNode = nullptr;
105
106  /// The index of the state field of RegNode.
107  int StateFieldIndex = ~0U;
108
109  /// The linked list node subobject inside of RegNode.
110  Value *Link = nullptr;
111};
112}
113
114FunctionPass *llvm::createX86WinEHStatePass() { return new WinEHStatePass(); }
115
116char WinEHStatePass::ID = 0;
117
118INITIALIZE_PASS(WinEHStatePass, "x86-winehstate",
119                "Insert stores for EH state numbers", false, false)
120
121bool WinEHStatePass::doInitialization(Module &M) {
122  TheModule = &M;
123  return false;
124}
125
126bool WinEHStatePass::doFinalization(Module &M) {
127  assert(TheModule == &M);
128  TheModule = nullptr;
129  EHLinkRegistrationTy = nullptr;
130  CXXEHRegistrationTy = nullptr;
131  SEHRegistrationTy = nullptr;
132  SetJmp3 = nullptr;
133  CxxLongjmpUnwind = nullptr;
134  SehLongjmpUnwind = nullptr;
135  Cookie = nullptr;
136  return false;
137}
138
139void WinEHStatePass::getAnalysisUsage(AnalysisUsage &AU) const {
140  // This pass should only insert a stack allocation, memory accesses, and
141  // localrecovers.
142  AU.setPreservesCFG();
143}
144
145bool WinEHStatePass::runOnFunction(Function &F) {
146  // Don't insert state stores or exception handler thunks for
147  // available_externally functions. The handler needs to reference the LSDA,
148  // which will not be emitted in this case.
149  if (F.hasAvailableExternallyLinkage())
150    return false;
151
152  // Check the personality. Do nothing if this personality doesn't use funclets.
153  if (!F.hasPersonalityFn())
154    return false;
155  PersonalityFn =
156      dyn_cast<Function>(F.getPersonalityFn()->stripPointerCasts());
157  if (!PersonalityFn)
158    return false;
159  Personality = classifyEHPersonality(PersonalityFn);
160  if (!isFuncletEHPersonality(Personality))
161    return false;
162
163  // Skip this function if there are no EH pads and we aren't using IR-level
164  // outlining.
165  bool HasPads = false;
166  for (BasicBlock &BB : F) {
167    if (BB.isEHPad()) {
168      HasPads = true;
169      break;
170    }
171  }
172  if (!HasPads)
173    return false;
174
175  Type *Int8PtrType = Type::getInt8PtrTy(TheModule->getContext());
176  SetJmp3 = TheModule->getOrInsertFunction(
177      "_setjmp3", FunctionType::get(
178                      Type::getInt32Ty(TheModule->getContext()),
179                      {Int8PtrType, Type::getInt32Ty(TheModule->getContext())},
180                      /*isVarArg=*/true));
181
182  emitExceptionRegistrationRecord(&F);
183
184  // The state numbers calculated here in IR must agree with what we calculate
185  // later on for the MachineFunction. In particular, if an IR pass deletes an
186  // unreachable EH pad after this point before machine CFG construction, we
187  // will be in trouble. If this assumption is ever broken, we should turn the
188  // numbers into an immutable analysis pass.
189  WinEHFuncInfo FuncInfo;
190  addStateStores(F, FuncInfo);
191
192  // Reset per-function state.
193  PersonalityFn = nullptr;
194  Personality = EHPersonality::Unknown;
195  UseStackGuard = false;
196  RegNode = nullptr;
197  EHGuardNode = nullptr;
198
199  return true;
200}
201
202/// Get the common EH registration subobject:
203///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
204///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
205///   struct EHRegistrationNode {
206///     EHRegistrationNode *Next;
207///     PEXCEPTION_ROUTINE Handler;
208///   };
209Type *WinEHStatePass::getEHLinkRegistrationType() {
210  if (EHLinkRegistrationTy)
211    return EHLinkRegistrationTy;
212  LLVMContext &Context = TheModule->getContext();
213  EHLinkRegistrationTy = StructType::create(Context, "EHRegistrationNode");
214  Type *FieldTys[] = {
215      EHLinkRegistrationTy->getPointerTo(0), // EHRegistrationNode *Next
216      Type::getInt8PtrTy(Context) // EXCEPTION_DISPOSITION (*Handler)(...)
217  };
218  EHLinkRegistrationTy->setBody(FieldTys, false);
219  return EHLinkRegistrationTy;
220}
221
222/// The __CxxFrameHandler3 registration node:
223///   struct CXXExceptionRegistration {
224///     void *SavedESP;
225///     EHRegistrationNode SubRecord;
226///     int32_t TryLevel;
227///   };
228Type *WinEHStatePass::getCXXEHRegistrationType() {
229  if (CXXEHRegistrationTy)
230    return CXXEHRegistrationTy;
231  LLVMContext &Context = TheModule->getContext();
232  Type *FieldTys[] = {
233      Type::getInt8PtrTy(Context), // void *SavedESP
234      getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
235      Type::getInt32Ty(Context)    // int32_t TryLevel
236  };
237  CXXEHRegistrationTy =
238      StructType::create(FieldTys, "CXXExceptionRegistration");
239  return CXXEHRegistrationTy;
240}
241
242/// The _except_handler3/4 registration node:
243///   struct EH4ExceptionRegistration {
244///     void *SavedESP;
245///     _EXCEPTION_POINTERS *ExceptionPointers;
246///     EHRegistrationNode SubRecord;
247///     int32_t EncodedScopeTable;
248///     int32_t TryLevel;
249///   };
250Type *WinEHStatePass::getSEHRegistrationType() {
251  if (SEHRegistrationTy)
252    return SEHRegistrationTy;
253  LLVMContext &Context = TheModule->getContext();
254  Type *FieldTys[] = {
255      Type::getInt8PtrTy(Context), // void *SavedESP
256      Type::getInt8PtrTy(Context), // void *ExceptionPointers
257      getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
258      Type::getInt32Ty(Context),   // int32_t EncodedScopeTable
259      Type::getInt32Ty(Context)    // int32_t TryLevel
260  };
261  SEHRegistrationTy = StructType::create(FieldTys, "SEHExceptionRegistration");
262  return SEHRegistrationTy;
263}
264
265// Emit an exception registration record. These are stack allocations with the
266// common subobject of two pointers: the previous registration record (the old
267// fs:00) and the personality function for the current frame. The data before
268// and after that is personality function specific.
269void WinEHStatePass::emitExceptionRegistrationRecord(Function *F) {
270  assert(Personality == EHPersonality::MSVC_CXX ||
271         Personality == EHPersonality::MSVC_X86SEH);
272
273  // Struct type of RegNode. Used for GEPing.
274  Type *RegNodeTy;
275
276  IRBuilder<> Builder(&F->getEntryBlock(), F->getEntryBlock().begin());
277  Type *Int8PtrType = Builder.getInt8PtrTy();
278  Type *Int32Ty = Builder.getInt32Ty();
279  Type *VoidTy = Builder.getVoidTy();
280
281  if (Personality == EHPersonality::MSVC_CXX) {
282    RegNodeTy = getCXXEHRegistrationType();
283    RegNode = Builder.CreateAlloca(RegNodeTy);
284    // SavedESP = llvm.stacksave()
285    Value *SP = Builder.CreateCall(
286        Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
287    Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
288    // TryLevel = -1
289    StateFieldIndex = 2;
290    ParentBaseState = -1;
291    insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
292    // Handler = __ehhandler$F
293    Function *Trampoline = generateLSDAInEAXThunk(F);
294    Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 1);
295    linkExceptionRegistration(Builder, Trampoline);
296
297    CxxLongjmpUnwind = TheModule->getOrInsertFunction(
298        "__CxxLongjmpUnwind",
299        FunctionType::get(VoidTy, Int8PtrType, /*isVarArg=*/false));
300    cast<Function>(CxxLongjmpUnwind.getCallee()->stripPointerCasts())
301        ->setCallingConv(CallingConv::X86_StdCall);
302  } else if (Personality == EHPersonality::MSVC_X86SEH) {
303    // If _except_handler4 is in use, some additional guard checks and prologue
304    // stuff is required.
305    StringRef PersonalityName = PersonalityFn->getName();
306    UseStackGuard = (PersonalityName == "_except_handler4");
307
308    // Allocate local structures.
309    RegNodeTy = getSEHRegistrationType();
310    RegNode = Builder.CreateAlloca(RegNodeTy);
311    if (UseStackGuard)
312      EHGuardNode = Builder.CreateAlloca(Int32Ty);
313
314    // SavedESP = llvm.stacksave()
315    Value *SP = Builder.CreateCall(
316        Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
317    Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
318    // TryLevel = -2 / -1
319    StateFieldIndex = 4;
320    ParentBaseState = UseStackGuard ? -2 : -1;
321    insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
322    // ScopeTable = llvm.x86.seh.lsda(F)
323    Value *LSDA = emitEHLSDA(Builder, F);
324    LSDA = Builder.CreatePtrToInt(LSDA, Int32Ty);
325    // If using _except_handler4, xor the address of the table with
326    // __security_cookie.
327    if (UseStackGuard) {
328      Cookie = TheModule->getOrInsertGlobal("__security_cookie", Int32Ty);
329      Value *Val = Builder.CreateLoad(Int32Ty, Cookie, "cookie");
330      LSDA = Builder.CreateXor(LSDA, Val);
331    }
332    Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 3));
333
334    // If using _except_handler4, the EHGuard contains: FramePtr xor Cookie.
335    if (UseStackGuard) {
336      Value *Val = Builder.CreateLoad(Int32Ty, Cookie);
337      Value *FrameAddr = Builder.CreateCall(
338          Intrinsic::getDeclaration(
339              TheModule, Intrinsic::frameaddress,
340              Builder.getInt8PtrTy(
341                  TheModule->getDataLayout().getAllocaAddrSpace())),
342          Builder.getInt32(0), "frameaddr");
343      Value *FrameAddrI32 = Builder.CreatePtrToInt(FrameAddr, Int32Ty);
344      FrameAddrI32 = Builder.CreateXor(FrameAddrI32, Val);
345      Builder.CreateStore(FrameAddrI32, EHGuardNode);
346    }
347
348    // Register the exception handler.
349    Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 2);
350    linkExceptionRegistration(Builder, PersonalityFn);
351
352    SehLongjmpUnwind = TheModule->getOrInsertFunction(
353        UseStackGuard ? "_seh_longjmp_unwind4" : "_seh_longjmp_unwind",
354        FunctionType::get(Type::getVoidTy(TheModule->getContext()), Int8PtrType,
355                          /*isVarArg=*/false));
356    cast<Function>(SehLongjmpUnwind.getCallee()->stripPointerCasts())
357        ->setCallingConv(CallingConv::X86_StdCall);
358  } else {
359    llvm_unreachable("unexpected personality function");
360  }
361
362  // Insert an unlink before all returns.
363  for (BasicBlock &BB : *F) {
364    Instruction *T = BB.getTerminator();
365    if (!isa<ReturnInst>(T))
366      continue;
367    Builder.SetInsertPoint(T);
368    unlinkExceptionRegistration(Builder);
369  }
370}
371
372Value *WinEHStatePass::emitEHLSDA(IRBuilder<> &Builder, Function *F) {
373  Value *FI8 = Builder.CreateBitCast(F, Type::getInt8PtrTy(F->getContext()));
374  return Builder.CreateCall(
375      Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
376}
377
378/// Generate a thunk that puts the LSDA of ParentFunc in EAX and then calls
379/// PersonalityFn, forwarding the parameters passed to PEXCEPTION_ROUTINE:
380///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
381///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
382/// We essentially want this code:
383///   movl $lsda, %eax
384///   jmpl ___CxxFrameHandler3
385Function *WinEHStatePass::generateLSDAInEAXThunk(Function *ParentFunc) {
386  LLVMContext &Context = ParentFunc->getContext();
387  Type *Int32Ty = Type::getInt32Ty(Context);
388  Type *Int8PtrType = Type::getInt8PtrTy(Context);
389  Type *ArgTys[5] = {Int8PtrType, Int8PtrType, Int8PtrType, Int8PtrType,
390                     Int8PtrType};
391  FunctionType *TrampolineTy =
392      FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 4),
393                        /*isVarArg=*/false);
394  FunctionType *TargetFuncTy =
395      FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 5),
396                        /*isVarArg=*/false);
397  Function *Trampoline =
398      Function::Create(TrampolineTy, GlobalValue::InternalLinkage,
399                       Twine("__ehhandler$") + GlobalValue::dropLLVMManglingEscape(
400                                                   ParentFunc->getName()),
401                       TheModule);
402  if (auto *C = ParentFunc->getComdat())
403    Trampoline->setComdat(C);
404  BasicBlock *EntryBB = BasicBlock::Create(Context, "entry", Trampoline);
405  IRBuilder<> Builder(EntryBB);
406  Value *LSDA = emitEHLSDA(Builder, ParentFunc);
407  Value *CastPersonality =
408      Builder.CreateBitCast(PersonalityFn, TargetFuncTy->getPointerTo());
409  auto AI = Trampoline->arg_begin();
410  Value *Args[5] = {LSDA, &*AI++, &*AI++, &*AI++, &*AI++};
411  CallInst *Call = Builder.CreateCall(TargetFuncTy, CastPersonality, Args);
412  // Can't use musttail due to prototype mismatch, but we can use tail.
413  Call->setTailCall(true);
414  // Set inreg so we pass it in EAX.
415  Call->addParamAttr(0, Attribute::InReg);
416  Builder.CreateRet(Call);
417  return Trampoline;
418}
419
420void WinEHStatePass::linkExceptionRegistration(IRBuilder<> &Builder,
421                                               Function *Handler) {
422  // Emit the .safeseh directive for this function.
423  Handler->addFnAttr("safeseh");
424
425  Type *LinkTy = getEHLinkRegistrationType();
426  // Handler = Handler
427  Value *HandlerI8 = Builder.CreateBitCast(Handler, Builder.getInt8PtrTy());
428  Builder.CreateStore(HandlerI8, Builder.CreateStructGEP(LinkTy, Link, 1));
429  // Next = [fs:00]
430  Constant *FSZero =
431      Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
432  Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(), FSZero);
433  Builder.CreateStore(Next, Builder.CreateStructGEP(LinkTy, Link, 0));
434  // [fs:00] = Link
435  Builder.CreateStore(Link, FSZero);
436}
437
438void WinEHStatePass::unlinkExceptionRegistration(IRBuilder<> &Builder) {
439  // Clone Link into the current BB for better address mode folding.
440  if (auto *GEP = dyn_cast<GetElementPtrInst>(Link)) {
441    GEP = cast<GetElementPtrInst>(GEP->clone());
442    Builder.Insert(GEP);
443    Link = GEP;
444  }
445  Type *LinkTy = getEHLinkRegistrationType();
446  // [fs:00] = Link->Next
447  Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(),
448                                   Builder.CreateStructGEP(LinkTy, Link, 0));
449  Constant *FSZero =
450      Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
451  Builder.CreateStore(Next, FSZero);
452}
453
454// Calls to setjmp(p) are lowered to _setjmp3(p, 0) by the frontend.
455// The idea behind _setjmp3 is that it takes an optional number of personality
456// specific parameters to indicate how to restore the personality-specific frame
457// state when longjmp is initiated.  Typically, the current TryLevel is saved.
458void WinEHStatePass::rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F,
459                                           CallSite CS, Value *State) {
460  // Don't rewrite calls with a weird number of arguments.
461  if (CS.getNumArgOperands() != 2)
462    return;
463
464  Instruction *Inst = CS.getInstruction();
465
466  SmallVector<OperandBundleDef, 1> OpBundles;
467  CS.getOperandBundlesAsDefs(OpBundles);
468
469  SmallVector<Value *, 3> OptionalArgs;
470  if (Personality == EHPersonality::MSVC_CXX) {
471    OptionalArgs.push_back(CxxLongjmpUnwind.getCallee());
472    OptionalArgs.push_back(State);
473    OptionalArgs.push_back(emitEHLSDA(Builder, &F));
474  } else if (Personality == EHPersonality::MSVC_X86SEH) {
475    OptionalArgs.push_back(SehLongjmpUnwind.getCallee());
476    OptionalArgs.push_back(State);
477    if (UseStackGuard)
478      OptionalArgs.push_back(Cookie);
479  } else {
480    llvm_unreachable("unhandled personality!");
481  }
482
483  SmallVector<Value *, 5> Args;
484  Args.push_back(
485      Builder.CreateBitCast(CS.getArgOperand(0), Builder.getInt8PtrTy()));
486  Args.push_back(Builder.getInt32(OptionalArgs.size()));
487  Args.append(OptionalArgs.begin(), OptionalArgs.end());
488
489  CallSite NewCS;
490  if (CS.isCall()) {
491    auto *CI = cast<CallInst>(Inst);
492    CallInst *NewCI = Builder.CreateCall(SetJmp3, Args, OpBundles);
493    NewCI->setTailCallKind(CI->getTailCallKind());
494    NewCS = NewCI;
495  } else {
496    auto *II = cast<InvokeInst>(Inst);
497    NewCS = Builder.CreateInvoke(
498        SetJmp3, II->getNormalDest(), II->getUnwindDest(), Args, OpBundles);
499  }
500  NewCS.setCallingConv(CS.getCallingConv());
501  NewCS.setAttributes(CS.getAttributes());
502  NewCS->setDebugLoc(CS->getDebugLoc());
503
504  Instruction *NewInst = NewCS.getInstruction();
505  NewInst->takeName(Inst);
506  Inst->replaceAllUsesWith(NewInst);
507  Inst->eraseFromParent();
508}
509
510// Figure out what state we should assign calls in this block.
511int WinEHStatePass::getBaseStateForBB(
512    DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
513    BasicBlock *BB) {
514  int BaseState = ParentBaseState;
515  auto &BBColors = BlockColors[BB];
516
517  assert(BBColors.size() == 1 && "multi-color BB not removed by preparation");
518  BasicBlock *FuncletEntryBB = BBColors.front();
519  if (auto *FuncletPad =
520          dyn_cast<FuncletPadInst>(FuncletEntryBB->getFirstNonPHI())) {
521    auto BaseStateI = FuncInfo.FuncletBaseStateMap.find(FuncletPad);
522    if (BaseStateI != FuncInfo.FuncletBaseStateMap.end())
523      BaseState = BaseStateI->second;
524  }
525
526  return BaseState;
527}
528
529// Calculate the state a call-site is in.
530int WinEHStatePass::getStateForCallSite(
531    DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
532    CallSite CS) {
533  if (auto *II = dyn_cast<InvokeInst>(CS.getInstruction())) {
534    // Look up the state number of the EH pad this unwinds to.
535    assert(FuncInfo.InvokeStateMap.count(II) && "invoke has no state!");
536    return FuncInfo.InvokeStateMap[II];
537  }
538  // Possibly throwing call instructions have no actions to take after
539  // an unwind. Ensure they are in the -1 state.
540  return getBaseStateForBB(BlockColors, FuncInfo, CS.getParent());
541}
542
543// Calculate the intersection of all the FinalStates for a BasicBlock's
544// predecessors.
545static int getPredState(DenseMap<BasicBlock *, int> &FinalStates, Function &F,
546                        int ParentBaseState, BasicBlock *BB) {
547  // The entry block has no predecessors but we know that the prologue always
548  // sets us up with a fixed state.
549  if (&F.getEntryBlock() == BB)
550    return ParentBaseState;
551
552  // This is an EH Pad, conservatively report this basic block as overdefined.
553  if (BB->isEHPad())
554    return OverdefinedState;
555
556  int CommonState = OverdefinedState;
557  for (BasicBlock *PredBB : predecessors(BB)) {
558    // We didn't manage to get a state for one of these predecessors,
559    // conservatively report this basic block as overdefined.
560    auto PredEndState = FinalStates.find(PredBB);
561    if (PredEndState == FinalStates.end())
562      return OverdefinedState;
563
564    // This code is reachable via exceptional control flow,
565    // conservatively report this basic block as overdefined.
566    if (isa<CatchReturnInst>(PredBB->getTerminator()))
567      return OverdefinedState;
568
569    int PredState = PredEndState->second;
570    assert(PredState != OverdefinedState &&
571           "overdefined BBs shouldn't be in FinalStates");
572    if (CommonState == OverdefinedState)
573      CommonState = PredState;
574
575    // At least two predecessors have different FinalStates,
576    // conservatively report this basic block as overdefined.
577    if (CommonState != PredState)
578      return OverdefinedState;
579  }
580
581  return CommonState;
582}
583
584// Calculate the intersection of all the InitialStates for a BasicBlock's
585// successors.
586static int getSuccState(DenseMap<BasicBlock *, int> &InitialStates, Function &F,
587                        int ParentBaseState, BasicBlock *BB) {
588  // This block rejoins normal control flow,
589  // conservatively report this basic block as overdefined.
590  if (isa<CatchReturnInst>(BB->getTerminator()))
591    return OverdefinedState;
592
593  int CommonState = OverdefinedState;
594  for (BasicBlock *SuccBB : successors(BB)) {
595    // We didn't manage to get a state for one of these predecessors,
596    // conservatively report this basic block as overdefined.
597    auto SuccStartState = InitialStates.find(SuccBB);
598    if (SuccStartState == InitialStates.end())
599      return OverdefinedState;
600
601    // This is an EH Pad, conservatively report this basic block as overdefined.
602    if (SuccBB->isEHPad())
603      return OverdefinedState;
604
605    int SuccState = SuccStartState->second;
606    assert(SuccState != OverdefinedState &&
607           "overdefined BBs shouldn't be in FinalStates");
608    if (CommonState == OverdefinedState)
609      CommonState = SuccState;
610
611    // At least two successors have different InitialStates,
612    // conservatively report this basic block as overdefined.
613    if (CommonState != SuccState)
614      return OverdefinedState;
615  }
616
617  return CommonState;
618}
619
620bool WinEHStatePass::isStateStoreNeeded(EHPersonality Personality,
621                                        CallSite CS) {
622  if (!CS)
623    return false;
624
625  // If the function touches memory, it needs a state store.
626  if (isAsynchronousEHPersonality(Personality))
627    return !CS.doesNotAccessMemory();
628
629  // If the function throws, it needs a state store.
630  return !CS.doesNotThrow();
631}
632
633void WinEHStatePass::addStateStores(Function &F, WinEHFuncInfo &FuncInfo) {
634  // Mark the registration node. The backend needs to know which alloca it is so
635  // that it can recover the original frame pointer.
636  IRBuilder<> Builder(RegNode->getNextNode());
637  Value *RegNodeI8 = Builder.CreateBitCast(RegNode, Builder.getInt8PtrTy());
638  Builder.CreateCall(
639      Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehregnode),
640      {RegNodeI8});
641
642  if (EHGuardNode) {
643    IRBuilder<> Builder(EHGuardNode->getNextNode());
644    Value *EHGuardNodeI8 =
645        Builder.CreateBitCast(EHGuardNode, Builder.getInt8PtrTy());
646    Builder.CreateCall(
647        Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehguard),
648        {EHGuardNodeI8});
649  }
650
651  // Calculate state numbers.
652  if (isAsynchronousEHPersonality(Personality))
653    calculateSEHStateNumbers(&F, FuncInfo);
654  else
655    calculateWinCXXEHStateNumbers(&F, FuncInfo);
656
657  // Iterate all the instructions and emit state number stores.
658  DenseMap<BasicBlock *, ColorVector> BlockColors = colorEHFunclets(F);
659  ReversePostOrderTraversal<Function *> RPOT(&F);
660
661  // InitialStates yields the state of the first call-site for a BasicBlock.
662  DenseMap<BasicBlock *, int> InitialStates;
663  // FinalStates yields the state of the last call-site for a BasicBlock.
664  DenseMap<BasicBlock *, int> FinalStates;
665  // Worklist used to revisit BasicBlocks with indeterminate
666  // Initial/Final-States.
667  std::deque<BasicBlock *> Worklist;
668  // Fill in InitialStates and FinalStates for BasicBlocks with call-sites.
669  for (BasicBlock *BB : RPOT) {
670    int InitialState = OverdefinedState;
671    int FinalState;
672    if (&F.getEntryBlock() == BB)
673      InitialState = FinalState = ParentBaseState;
674    for (Instruction &I : *BB) {
675      CallSite CS(&I);
676      if (!isStateStoreNeeded(Personality, CS))
677        continue;
678
679      int State = getStateForCallSite(BlockColors, FuncInfo, CS);
680      if (InitialState == OverdefinedState)
681        InitialState = State;
682      FinalState = State;
683    }
684    // No call-sites in this basic block? That's OK, we will come back to these
685    // in a later pass.
686    if (InitialState == OverdefinedState) {
687      Worklist.push_back(BB);
688      continue;
689    }
690    LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
691                      << " InitialState=" << InitialState << '\n');
692    LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
693                      << " FinalState=" << FinalState << '\n');
694    InitialStates.insert({BB, InitialState});
695    FinalStates.insert({BB, FinalState});
696  }
697
698  // Try to fill-in InitialStates and FinalStates which have no call-sites.
699  while (!Worklist.empty()) {
700    BasicBlock *BB = Worklist.front();
701    Worklist.pop_front();
702    // This BasicBlock has already been figured out, nothing more we can do.
703    if (InitialStates.count(BB) != 0)
704      continue;
705
706    int PredState = getPredState(FinalStates, F, ParentBaseState, BB);
707    if (PredState == OverdefinedState)
708      continue;
709
710    // We successfully inferred this BasicBlock's state via it's predecessors;
711    // enqueue it's successors to see if we can infer their states.
712    InitialStates.insert({BB, PredState});
713    FinalStates.insert({BB, PredState});
714    for (BasicBlock *SuccBB : successors(BB))
715      Worklist.push_back(SuccBB);
716  }
717
718  // Try to hoist stores from successors.
719  for (BasicBlock *BB : RPOT) {
720    int SuccState = getSuccState(InitialStates, F, ParentBaseState, BB);
721    if (SuccState == OverdefinedState)
722      continue;
723
724    // Update our FinalState to reflect the common InitialState of our
725    // successors.
726    FinalStates.insert({BB, SuccState});
727  }
728
729  // Finally, insert state stores before call-sites which transition us to a new
730  // state.
731  for (BasicBlock *BB : RPOT) {
732    auto &BBColors = BlockColors[BB];
733    BasicBlock *FuncletEntryBB = BBColors.front();
734    if (isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI()))
735      continue;
736
737    int PrevState = getPredState(FinalStates, F, ParentBaseState, BB);
738    LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
739                      << " PrevState=" << PrevState << '\n');
740
741    for (Instruction &I : *BB) {
742      CallSite CS(&I);
743      if (!isStateStoreNeeded(Personality, CS))
744        continue;
745
746      int State = getStateForCallSite(BlockColors, FuncInfo, CS);
747      if (State != PrevState)
748        insertStateNumberStore(&I, State);
749      PrevState = State;
750    }
751
752    // We might have hoisted a state store into this block, emit it now.
753    auto EndState = FinalStates.find(BB);
754    if (EndState != FinalStates.end())
755      if (EndState->second != PrevState)
756        insertStateNumberStore(BB->getTerminator(), EndState->second);
757  }
758
759  SmallVector<CallSite, 1> SetJmp3CallSites;
760  for (BasicBlock *BB : RPOT) {
761    for (Instruction &I : *BB) {
762      CallSite CS(&I);
763      if (!CS)
764        continue;
765      if (CS.getCalledValue()->stripPointerCasts() !=
766          SetJmp3.getCallee()->stripPointerCasts())
767        continue;
768
769      SetJmp3CallSites.push_back(CS);
770    }
771  }
772
773  for (CallSite CS : SetJmp3CallSites) {
774    auto &BBColors = BlockColors[CS->getParent()];
775    BasicBlock *FuncletEntryBB = BBColors.front();
776    bool InCleanup = isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI());
777
778    IRBuilder<> Builder(CS.getInstruction());
779    Value *State;
780    if (InCleanup) {
781      Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
782                                                  RegNode, StateFieldIndex);
783      State = Builder.CreateLoad(Builder.getInt32Ty(), StateField);
784    } else {
785      State = Builder.getInt32(getStateForCallSite(BlockColors, FuncInfo, CS));
786    }
787    rewriteSetJmpCallSite(Builder, F, CS, State);
788  }
789}
790
791void WinEHStatePass::insertStateNumberStore(Instruction *IP, int State) {
792  IRBuilder<> Builder(IP);
793  Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
794                                              RegNode, StateFieldIndex);
795  Builder.CreateStore(Builder.getInt32(State), StateField);
796}
797