lib/Target/X86/X86WinEHState.cpp

   1 //===-- X86WinEHState - Insert EH state updates for win32 exceptions ------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // All functions using an MSVC EH personality use an explicitly updated state
  10 // number stored in an exception registration stack object. The registration
  11 // object is linked into a thread-local chain of registrations stored at fs:00.
  12 // This pass adds the registration object and EH state updates.
  13 //
  14 //===----------------------------------------------------------------------===//
  15
  16 #include "X86.h"
  17 #include "llvm/ADT/PostOrderIterator.h"
  18 #include "llvm/Analysis/CFG.h"
  19 #include "llvm/Analysis/EHPersonalities.h"
  20 #include "llvm/CodeGen/MachineModuleInfo.h"
  21 #include "llvm/CodeGen/WinEHFuncInfo.h"
  22 #include "llvm/IR/CallSite.h"
  23 #include "llvm/IR/Function.h"
  24 #include "llvm/IR/IRBuilder.h"
  25 #include "llvm/IR/Instructions.h"
  26 #include "llvm/IR/IntrinsicInst.h"
  27 #include "llvm/IR/Module.h"
  28 #include "llvm/Pass.h"
  29 #include "llvm/Support/Debug.h"
  30 #include <deque>
  31
  32 using namespace llvm;
  33
  34 #define DEBUG_TYPE "winehstate"
  35
  36 namespace {
  37 const int OverdefinedState = INT_MIN;
  38
  39 class WinEHStatePass : public FunctionPass {
  40 public:
  41   static char ID; // Pass identification, replacement for typeid.
  42
  43   WinEHStatePass() : FunctionPass(ID) { }
  44
  45   bool runOnFunction(Function &Fn) override;
  46
  47   bool doInitialization(Module &M) override;
  48
  49   bool doFinalization(Module &M) override;
  50
  51   void getAnalysisUsage(AnalysisUsage &AU) const override;
  52
  53   StringRef getPassName() const override {
  54     return "Windows 32-bit x86 EH state insertion";
  55   }
  56
  57 private:
  58   void emitExceptionRegistrationRecord(Function *F);
  59
  60   void linkExceptionRegistration(IRBuilder<> &Builder, Function *Handler);
  61   void unlinkExceptionRegistration(IRBuilder<> &Builder);
  62   void addStateStores(Function &F, WinEHFuncInfo &FuncInfo);
  63   void insertStateNumberStore(Instruction *IP, int State);
  64
  65   Value *emitEHLSDA(IRBuilder<> &Builder, Function *F);
  66
  67   Function *generateLSDAInEAXThunk(Function *ParentFunc);
  68
  69   bool isStateStoreNeeded(EHPersonality Personality, CallSite CS);
  70   void rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F, CallSite CS,
  71                              Value *State);
  72   int getBaseStateForBB(DenseMap<BasicBlock *, ColorVector> &BlockColors,
  73                         WinEHFuncInfo &FuncInfo, BasicBlock *BB);
  74   int getStateForCallSite(DenseMap<BasicBlock *, ColorVector> &BlockColors,
  75                           WinEHFuncInfo &FuncInfo, CallSite CS);
  76
  77   // Module-level type getters.
  78   Type *getEHLinkRegistrationType();
  79   Type *getSEHRegistrationType();
  80   Type *getCXXEHRegistrationType();
  81
  82   // Per-module data.
  83   Module *TheModule = nullptr;
  84   StructType *EHLinkRegistrationTy = nullptr;
  85   StructType *CXXEHRegistrationTy = nullptr;
  86   StructType *SEHRegistrationTy = nullptr;
  87   FunctionCallee SetJmp3 = nullptr;
  88   FunctionCallee CxxLongjmpUnwind = nullptr;
  89
  90   // Per-function state
  91   EHPersonality Personality = EHPersonality::Unknown;
  92   Function *PersonalityFn = nullptr;
  93   bool UseStackGuard = false;
  94   int ParentBaseState;
  95   FunctionCallee SehLongjmpUnwind = nullptr;
  96   Constant *Cookie = nullptr;
  97
  98   /// The stack allocation containing all EH data, including the link in the
  99   /// fs:00 chain and the current state.
 100   AllocaInst *RegNode = nullptr;
 101
 102   // The allocation containing the EH security guard.
 103   AllocaInst *EHGuardNode = nullptr;
 104
 105   /// The index of the state field of RegNode.
 106   int StateFieldIndex = ~0U;
 107
 108   /// The linked list node subobject inside of RegNode.
 109   Value *Link = nullptr;
 110 };
 111 }
 112
 113 FunctionPass *llvm::createX86WinEHStatePass() { return new WinEHStatePass(); }
 114
 115 char WinEHStatePass::ID = 0;
 116
 117 INITIALIZE_PASS(WinEHStatePass, "x86-winehstate",
 118                 "Insert stores for EH state numbers", false, false)
 119
 120 bool WinEHStatePass::doInitialization(Module &M) {
 121   TheModule = &M;
 122   return false;
 123 }
 124
 125 bool WinEHStatePass::doFinalization(Module &M) {
 126   assert(TheModule == &M);
 127   TheModule = nullptr;
 128   EHLinkRegistrationTy = nullptr;
 129   CXXEHRegistrationTy = nullptr;
 130   SEHRegistrationTy = nullptr;
 131   SetJmp3 = nullptr;
 132   CxxLongjmpUnwind = nullptr;
 133   SehLongjmpUnwind = nullptr;
 134   Cookie = nullptr;
 135   return false;
 136 }
 137
 138 void WinEHStatePass::getAnalysisUsage(AnalysisUsage &AU) const {
 139   // This pass should only insert a stack allocation, memory accesses, and
 140   // localrecovers.
 141   AU.setPreservesCFG();
 142 }
 143
 144 bool WinEHStatePass::runOnFunction(Function &F) {
 145   // Don't insert state stores or exception handler thunks for
 146   // available_externally functions. The handler needs to reference the LSDA,
 147   // which will not be emitted in this case.
 148   if (F.hasAvailableExternallyLinkage())
 149     return false;
 150
 151   // Check the personality. Do nothing if this personality doesn't use funclets.
 152   if (!F.hasPersonalityFn())
 153     return false;
 154   PersonalityFn =
 155       dyn_cast<Function>(F.getPersonalityFn()->stripPointerCasts());
 156   if (!PersonalityFn)
 157     return false;
 158   Personality = classifyEHPersonality(PersonalityFn);
 159   if (!isFuncletEHPersonality(Personality))
 160     return false;
 161
 162   // Skip this function if there are no EH pads and we aren't using IR-level
 163   // outlining.
 164   bool HasPads = false;
 165   for (BasicBlock &BB : F) {
 166     if (BB.isEHPad()) {
 167       HasPads = true;
 168       break;
 169     }
 170   }
 171   if (!HasPads)
 172     return false;
 173
 174   Type *Int8PtrType = Type::getInt8PtrTy(TheModule->getContext());
 175   SetJmp3 = TheModule->getOrInsertFunction(
 176       "_setjmp3", FunctionType::get(
 177                       Type::getInt32Ty(TheModule->getContext()),
 178                       {Int8PtrType, Type::getInt32Ty(TheModule->getContext())},
 179                       /*isVarArg=*/true));
 180
 181   // Disable frame pointer elimination in this function.
 182   // FIXME: Do the nested handlers need to keep the parent ebp in ebp, or can we
 183   // use an arbitrary register?
 184   F.addFnAttr("no-frame-pointer-elim", "true");
 185
 186   emitExceptionRegistrationRecord(&F);
 187
 188   // The state numbers calculated here in IR must agree with what we calculate
 189   // later on for the MachineFunction. In particular, if an IR pass deletes an
 190   // unreachable EH pad after this point before machine CFG construction, we
 191   // will be in trouble. If this assumption is ever broken, we should turn the
 192   // numbers into an immutable analysis pass.
 193   WinEHFuncInfo FuncInfo;
 194   addStateStores(F, FuncInfo);
 195
 196   // Reset per-function state.
 197   PersonalityFn = nullptr;
 198   Personality = EHPersonality::Unknown;
 199   UseStackGuard = false;
 200   RegNode = nullptr;
 201   EHGuardNode = nullptr;
 202
 203   return true;
 204 }
 205
 206 /// Get the common EH registration subobject:
 207 ///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
 208 ///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
 209 ///   struct EHRegistrationNode {
 210 ///     EHRegistrationNode *Next;
 211 ///     PEXCEPTION_ROUTINE Handler;
 212 ///   };
 213 Type *WinEHStatePass::getEHLinkRegistrationType() {
 214   if (EHLinkRegistrationTy)
 215     return EHLinkRegistrationTy;
 216   LLVMContext &Context = TheModule->getContext();
 217   EHLinkRegistrationTy = StructType::create(Context, "EHRegistrationNode");
 218   Type *FieldTys[] = {
 219       EHLinkRegistrationTy->getPointerTo(0), // EHRegistrationNode *Next
 220       Type::getInt8PtrTy(Context) // EXCEPTION_DISPOSITION (*Handler)(...)
 221   };
 222   EHLinkRegistrationTy->setBody(FieldTys, false);
 223   return EHLinkRegistrationTy;
 224 }
 225
 226 /// The __CxxFrameHandler3 registration node:
 227 ///   struct CXXExceptionRegistration {
 228 ///     void *SavedESP;
 229 ///     EHRegistrationNode SubRecord;
 230 ///     int32_t TryLevel;
 231 ///   };
 232 Type *WinEHStatePass::getCXXEHRegistrationType() {
 233   if (CXXEHRegistrationTy)
 234     return CXXEHRegistrationTy;
 235   LLVMContext &Context = TheModule->getContext();
 236   Type *FieldTys[] = {
 237       Type::getInt8PtrTy(Context), // void *SavedESP
 238       getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
 239       Type::getInt32Ty(Context)    // int32_t TryLevel
 240   };
 241   CXXEHRegistrationTy =
 242       StructType::create(FieldTys, "CXXExceptionRegistration");
 243   return CXXEHRegistrationTy;
 244 }
 245
 246 /// The _except_handler3/4 registration node:
 247 ///   struct EH4ExceptionRegistration {
 248 ///     void *SavedESP;
 249 ///     _EXCEPTION_POINTERS *ExceptionPointers;
 250 ///     EHRegistrationNode SubRecord;
 251 ///     int32_t EncodedScopeTable;
 252 ///     int32_t TryLevel;
 253 ///   };
 254 Type *WinEHStatePass::getSEHRegistrationType() {
 255   if (SEHRegistrationTy)
 256     return SEHRegistrationTy;
 257   LLVMContext &Context = TheModule->getContext();
 258   Type *FieldTys[] = {
 259       Type::getInt8PtrTy(Context), // void *SavedESP
 260       Type::getInt8PtrTy(Context), // void *ExceptionPointers
 261       getEHLinkRegistrationType(), // EHRegistrationNode SubRecord
 262       Type::getInt32Ty(Context),   // int32_t EncodedScopeTable
 263       Type::getInt32Ty(Context)    // int32_t TryLevel
 264   };
 265   SEHRegistrationTy = StructType::create(FieldTys, "SEHExceptionRegistration");
 266   return SEHRegistrationTy;
 267 }
 268
 269 // Emit an exception registration record. These are stack allocations with the
 270 // common subobject of two pointers: the previous registration record (the old
 271 // fs:00) and the personality function for the current frame. The data before
 272 // and after that is personality function specific.
 273 void WinEHStatePass::emitExceptionRegistrationRecord(Function *F) {
 274   assert(Personality == EHPersonality::MSVC_CXX ||
 275          Personality == EHPersonality::MSVC_X86SEH);
 276
 277   // Struct type of RegNode. Used for GEPing.
 278   Type *RegNodeTy;
 279
 280   IRBuilder<> Builder(&F->getEntryBlock(), F->getEntryBlock().begin());
 281   Type *Int8PtrType = Builder.getInt8PtrTy();
 282   Type *Int32Ty = Builder.getInt32Ty();
 283   Type *VoidTy = Builder.getVoidTy();
 284
 285   if (Personality == EHPersonality::MSVC_CXX) {
 286     RegNodeTy = getCXXEHRegistrationType();
 287     RegNode = Builder.CreateAlloca(RegNodeTy);
 288     // SavedESP = llvm.stacksave()
 289     Value *SP = Builder.CreateCall(
 290         Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
 291     Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
 292     // TryLevel = -1
 293     StateFieldIndex = 2;
 294     ParentBaseState = -1;
 295     insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
 296     // Handler = __ehhandler$F
 297     Function *Trampoline = generateLSDAInEAXThunk(F);
 298     Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 1);
 299     linkExceptionRegistration(Builder, Trampoline);
 300
 301     CxxLongjmpUnwind = TheModule->getOrInsertFunction(
 302         "__CxxLongjmpUnwind",
 303         FunctionType::get(VoidTy, Int8PtrType, /*isVarArg=*/false));
 304     cast<Function>(CxxLongjmpUnwind.getCallee()->stripPointerCasts())
 305         ->setCallingConv(CallingConv::X86_StdCall);
 306   } else if (Personality == EHPersonality::MSVC_X86SEH) {
 307     // If _except_handler4 is in use, some additional guard checks and prologue
 308     // stuff is required.
 309     StringRef PersonalityName = PersonalityFn->getName();
 310     UseStackGuard = (PersonalityName == "_except_handler4");
 311
 312     // Allocate local structures.
 313     RegNodeTy = getSEHRegistrationType();
 314     RegNode = Builder.CreateAlloca(RegNodeTy);
 315     if (UseStackGuard)
 316       EHGuardNode = Builder.CreateAlloca(Int32Ty);
 317
 318     // SavedESP = llvm.stacksave()
 319     Value *SP = Builder.CreateCall(
 320         Intrinsic::getDeclaration(TheModule, Intrinsic::stacksave), {});
 321     Builder.CreateStore(SP, Builder.CreateStructGEP(RegNodeTy, RegNode, 0));
 322     // TryLevel = -2 / -1
 323     StateFieldIndex = 4;
 324     ParentBaseState = UseStackGuard ? -2 : -1;
 325     insertStateNumberStore(&*Builder.GetInsertPoint(), ParentBaseState);
 326     // ScopeTable = llvm.x86.seh.lsda(F)
 327     Value *LSDA = emitEHLSDA(Builder, F);
 328     LSDA = Builder.CreatePtrToInt(LSDA, Int32Ty);
 329     // If using _except_handler4, xor the address of the table with
 330     // __security_cookie.
 331     if (UseStackGuard) {
 332       Cookie = TheModule->getOrInsertGlobal("__security_cookie", Int32Ty);
 333       Value *Val = Builder.CreateLoad(Int32Ty, Cookie, "cookie");
 334       LSDA = Builder.CreateXor(LSDA, Val);
 335     }
 336     Builder.CreateStore(LSDA, Builder.CreateStructGEP(RegNodeTy, RegNode, 3));
 337
 338     // If using _except_handler4, the EHGuard contains: FramePtr xor Cookie.
 339     if (UseStackGuard) {
 340       Value *Val = Builder.CreateLoad(Int32Ty, Cookie);
 341       Value *FrameAddr = Builder.CreateCall(
 342           Intrinsic::getDeclaration(TheModule, Intrinsic::frameaddress),
 343           Builder.getInt32(0), "frameaddr");
 344       Value *FrameAddrI32 = Builder.CreatePtrToInt(FrameAddr, Int32Ty);
 345       FrameAddrI32 = Builder.CreateXor(FrameAddrI32, Val);
 346       Builder.CreateStore(FrameAddrI32, EHGuardNode);
 347     }
 348
 349     // Register the exception handler.
 350     Link = Builder.CreateStructGEP(RegNodeTy, RegNode, 2);
 351     linkExceptionRegistration(Builder, PersonalityFn);
 352
 353     SehLongjmpUnwind = TheModule->getOrInsertFunction(
 354         UseStackGuard ? "_seh_longjmp_unwind4" : "_seh_longjmp_unwind",
 355         FunctionType::get(Type::getVoidTy(TheModule->getContext()), Int8PtrType,
 356                           /*isVarArg=*/false));
 357     cast<Function>(SehLongjmpUnwind.getCallee()->stripPointerCasts())
 358         ->setCallingConv(CallingConv::X86_StdCall);
 359   } else {
 360     llvm_unreachable("unexpected personality function");
 361   }
 362
 363   // Insert an unlink before all returns.
 364   for (BasicBlock &BB : *F) {
 365     Instruction *T = BB.getTerminator();
 366     if (!isa<ReturnInst>(T))
 367       continue;
 368     Builder.SetInsertPoint(T);
 369     unlinkExceptionRegistration(Builder);
 370   }
 371 }
 372
 373 Value *WinEHStatePass::emitEHLSDA(IRBuilder<> &Builder, Function *F) {
 374   Value *FI8 = Builder.CreateBitCast(F, Type::getInt8PtrTy(F->getContext()));
 375   return Builder.CreateCall(
 376       Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_lsda), FI8);
 377 }
 378
 379 /// Generate a thunk that puts the LSDA of ParentFunc in EAX and then calls
 380 /// PersonalityFn, forwarding the parameters passed to PEXCEPTION_ROUTINE:
 381 ///   typedef _EXCEPTION_DISPOSITION (*PEXCEPTION_ROUTINE)(
 382 ///       _EXCEPTION_RECORD *, void *, _CONTEXT *, void *);
 383 /// We essentially want this code:
 384 ///   movl $lsda, %eax
 385 ///   jmpl ___CxxFrameHandler3
 386 Function *WinEHStatePass::generateLSDAInEAXThunk(Function *ParentFunc) {
 387   LLVMContext &Context = ParentFunc->getContext();
 388   Type *Int32Ty = Type::getInt32Ty(Context);
 389   Type *Int8PtrType = Type::getInt8PtrTy(Context);
 390   Type *ArgTys[5] = {Int8PtrType, Int8PtrType, Int8PtrType, Int8PtrType,
 391                      Int8PtrType};
 392   FunctionType *TrampolineTy =
 393       FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 4),
 394                         /*isVarArg=*/false);
 395   FunctionType *TargetFuncTy =
 396       FunctionType::get(Int32Ty, makeArrayRef(&ArgTys[0], 5),
 397                         /*isVarArg=*/false);
 398   Function *Trampoline =
 399       Function::Create(TrampolineTy, GlobalValue::InternalLinkage,
 400                        Twine("__ehhandler$") + GlobalValue::dropLLVMManglingEscape(
 401                                                    ParentFunc->getName()),
 402                        TheModule);
 403   if (auto *C = ParentFunc->getComdat())
 404     Trampoline->setComdat(C);
 405   BasicBlock *EntryBB = BasicBlock::Create(Context, "entry", Trampoline);
 406   IRBuilder<> Builder(EntryBB);
 407   Value *LSDA = emitEHLSDA(Builder, ParentFunc);
 408   Value *CastPersonality =
 409       Builder.CreateBitCast(PersonalityFn, TargetFuncTy->getPointerTo());
 410   auto AI = Trampoline->arg_begin();
 411   Value *Args[5] = {LSDA, &*AI++, &*AI++, &*AI++, &*AI++};
 412   CallInst *Call = Builder.CreateCall(TargetFuncTy, CastPersonality, Args);
 413   // Can't use musttail due to prototype mismatch, but we can use tail.
 414   Call->setTailCall(true);
 415   // Set inreg so we pass it in EAX.
 416   Call->addParamAttr(0, Attribute::InReg);
 417   Builder.CreateRet(Call);
 418   return Trampoline;
 419 }
 420
 421 void WinEHStatePass::linkExceptionRegistration(IRBuilder<> &Builder,
 422                                                Function *Handler) {
 423   // Emit the .safeseh directive for this function.
 424   Handler->addFnAttr("safeseh");
 425
 426   Type *LinkTy = getEHLinkRegistrationType();
 427   // Handler = Handler
 428   Value *HandlerI8 = Builder.CreateBitCast(Handler, Builder.getInt8PtrTy());
 429   Builder.CreateStore(HandlerI8, Builder.CreateStructGEP(LinkTy, Link, 1));
 430   // Next = [fs:00]
 431   Constant *FSZero =
 432       Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
 433   Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(), FSZero);
 434   Builder.CreateStore(Next, Builder.CreateStructGEP(LinkTy, Link, 0));
 435   // [fs:00] = Link
 436   Builder.CreateStore(Link, FSZero);
 437 }
 438
 439 void WinEHStatePass::unlinkExceptionRegistration(IRBuilder<> &Builder) {
 440   // Clone Link into the current BB for better address mode folding.
 441   if (auto *GEP = dyn_cast<GetElementPtrInst>(Link)) {
 442     GEP = cast<GetElementPtrInst>(GEP->clone());
 443     Builder.Insert(GEP);
 444     Link = GEP;
 445   }
 446   Type *LinkTy = getEHLinkRegistrationType();
 447   // [fs:00] = Link->Next
 448   Value *Next = Builder.CreateLoad(LinkTy->getPointerTo(),
 449                                    Builder.CreateStructGEP(LinkTy, Link, 0));
 450   Constant *FSZero =
 451       Constant::getNullValue(LinkTy->getPointerTo()->getPointerTo(257));
 452   Builder.CreateStore(Next, FSZero);
 453 }
 454
 455 // Calls to setjmp(p) are lowered to _setjmp3(p, 0) by the frontend.
 456 // The idea behind _setjmp3 is that it takes an optional number of personality
 457 // specific parameters to indicate how to restore the personality-specific frame
 458 // state when longjmp is initiated.  Typically, the current TryLevel is saved.
 459 void WinEHStatePass::rewriteSetJmpCallSite(IRBuilder<> &Builder, Function &F,
 460                                            CallSite CS, Value *State) {
 461   // Don't rewrite calls with a weird number of arguments.
 462   if (CS.getNumArgOperands() != 2)
 463     return;
 464
 465   Instruction *Inst = CS.getInstruction();
 466
 467   SmallVector<OperandBundleDef, 1> OpBundles;
 468   CS.getOperandBundlesAsDefs(OpBundles);
 469
 470   SmallVector<Value *, 3> OptionalArgs;
 471   if (Personality == EHPersonality::MSVC_CXX) {
 472     OptionalArgs.push_back(CxxLongjmpUnwind.getCallee());
 473     OptionalArgs.push_back(State);
 474     OptionalArgs.push_back(emitEHLSDA(Builder, &F));
 475   } else if (Personality == EHPersonality::MSVC_X86SEH) {
 476     OptionalArgs.push_back(SehLongjmpUnwind.getCallee());
 477     OptionalArgs.push_back(State);
 478     if (UseStackGuard)
 479       OptionalArgs.push_back(Cookie);
 480   } else {
 481     llvm_unreachable("unhandled personality!");
 482   }
 483
 484   SmallVector<Value *, 5> Args;
 485   Args.push_back(
 486       Builder.CreateBitCast(CS.getArgOperand(0), Builder.getInt8PtrTy()));
 487   Args.push_back(Builder.getInt32(OptionalArgs.size()));
 488   Args.append(OptionalArgs.begin(), OptionalArgs.end());
 489
 490   CallSite NewCS;
 491   if (CS.isCall()) {
 492     auto *CI = cast<CallInst>(Inst);
 493     CallInst *NewCI = Builder.CreateCall(SetJmp3, Args, OpBundles);
 494     NewCI->setTailCallKind(CI->getTailCallKind());
 495     NewCS = NewCI;
 496   } else {
 497     auto *II = cast<InvokeInst>(Inst);
 498     NewCS = Builder.CreateInvoke(
 499         SetJmp3, II->getNormalDest(), II->getUnwindDest(), Args, OpBundles);
 500   }
 501   NewCS.setCallingConv(CS.getCallingConv());
 502   NewCS.setAttributes(CS.getAttributes());
 503   NewCS->setDebugLoc(CS->getDebugLoc());
 504
 505   Instruction *NewInst = NewCS.getInstruction();
 506   NewInst->takeName(Inst);
 507   Inst->replaceAllUsesWith(NewInst);
 508   Inst->eraseFromParent();
 509 }
 510
 511 // Figure out what state we should assign calls in this block.
 512 int WinEHStatePass::getBaseStateForBB(
 513     DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
 514     BasicBlock *BB) {
 515   int BaseState = ParentBaseState;
 516   auto &BBColors = BlockColors[BB];
 517
 518   assert(BBColors.size() == 1 && "multi-color BB not removed by preparation");
 519   BasicBlock *FuncletEntryBB = BBColors.front();
 520   if (auto *FuncletPad =
 521           dyn_cast<FuncletPadInst>(FuncletEntryBB->getFirstNonPHI())) {
 522     auto BaseStateI = FuncInfo.FuncletBaseStateMap.find(FuncletPad);
 523     if (BaseStateI != FuncInfo.FuncletBaseStateMap.end())
 524       BaseState = BaseStateI->second;
 525   }
 526
 527   return BaseState;
 528 }
 529
 530 // Calculate the state a call-site is in.
 531 int WinEHStatePass::getStateForCallSite(
 532     DenseMap<BasicBlock *, ColorVector> &BlockColors, WinEHFuncInfo &FuncInfo,
 533     CallSite CS) {
 534   if (auto *II = dyn_cast<InvokeInst>(CS.getInstruction())) {
 535     // Look up the state number of the EH pad this unwinds to.
 536     assert(FuncInfo.InvokeStateMap.count(II) && "invoke has no state!");
 537     return FuncInfo.InvokeStateMap[II];
 538   }
 539   // Possibly throwing call instructions have no actions to take after
 540   // an unwind. Ensure they are in the -1 state.
 541   return getBaseStateForBB(BlockColors, FuncInfo, CS.getParent());
 542 }
 543
 544 // Calculate the intersection of all the FinalStates for a BasicBlock's
 545 // predecessors.
 546 static int getPredState(DenseMap<BasicBlock *, int> &FinalStates, Function &F,
 547                         int ParentBaseState, BasicBlock *BB) {
 548   // The entry block has no predecessors but we know that the prologue always
 549   // sets us up with a fixed state.
 550   if (&F.getEntryBlock() == BB)
 551     return ParentBaseState;
 552
 553   // This is an EH Pad, conservatively report this basic block as overdefined.
 554   if (BB->isEHPad())
 555     return OverdefinedState;
 556
 557   int CommonState = OverdefinedState;
 558   for (BasicBlock *PredBB : predecessors(BB)) {
 559     // We didn't manage to get a state for one of these predecessors,
 560     // conservatively report this basic block as overdefined.
 561     auto PredEndState = FinalStates.find(PredBB);
 562     if (PredEndState == FinalStates.end())
 563       return OverdefinedState;
 564
 565     // This code is reachable via exceptional control flow,
 566     // conservatively report this basic block as overdefined.
 567     if (isa<CatchReturnInst>(PredBB->getTerminator()))
 568       return OverdefinedState;
 569
 570     int PredState = PredEndState->second;
 571     assert(PredState != OverdefinedState &&
 572            "overdefined BBs shouldn't be in FinalStates");
 573     if (CommonState == OverdefinedState)
 574       CommonState = PredState;
 575
 576     // At least two predecessors have different FinalStates,
 577     // conservatively report this basic block as overdefined.
 578     if (CommonState != PredState)
 579       return OverdefinedState;
 580   }
 581
 582   return CommonState;
 583 }
 584
 585 // Calculate the intersection of all the InitialStates for a BasicBlock's
 586 // successors.
 587 static int getSuccState(DenseMap<BasicBlock *, int> &InitialStates, Function &F,
 588                         int ParentBaseState, BasicBlock *BB) {
 589   // This block rejoins normal control flow,
 590   // conservatively report this basic block as overdefined.
 591   if (isa<CatchReturnInst>(BB->getTerminator()))
 592     return OverdefinedState;
 593
 594   int CommonState = OverdefinedState;
 595   for (BasicBlock *SuccBB : successors(BB)) {
 596     // We didn't manage to get a state for one of these predecessors,
 597     // conservatively report this basic block as overdefined.
 598     auto SuccStartState = InitialStates.find(SuccBB);
 599     if (SuccStartState == InitialStates.end())
 600       return OverdefinedState;
 601
 602     // This is an EH Pad, conservatively report this basic block as overdefined.
 603     if (SuccBB->isEHPad())
 604       return OverdefinedState;
 605
 606     int SuccState = SuccStartState->second;
 607     assert(SuccState != OverdefinedState &&
 608            "overdefined BBs shouldn't be in FinalStates");
 609     if (CommonState == OverdefinedState)
 610       CommonState = SuccState;
 611
 612     // At least two successors have different InitialStates,
 613     // conservatively report this basic block as overdefined.
 614     if (CommonState != SuccState)
 615       return OverdefinedState;
 616   }
 617
 618   return CommonState;
 619 }
 620
 621 bool WinEHStatePass::isStateStoreNeeded(EHPersonality Personality,
 622                                         CallSite CS) {
 623   if (!CS)
 624     return false;
 625
 626   // If the function touches memory, it needs a state store.
 627   if (isAsynchronousEHPersonality(Personality))
 628     return !CS.doesNotAccessMemory();
 629
 630   // If the function throws, it needs a state store.
 631   return !CS.doesNotThrow();
 632 }
 633
 634 void WinEHStatePass::addStateStores(Function &F, WinEHFuncInfo &FuncInfo) {
 635   // Mark the registration node. The backend needs to know which alloca it is so
 636   // that it can recover the original frame pointer.
 637   IRBuilder<> Builder(RegNode->getNextNode());
 638   Value *RegNodeI8 = Builder.CreateBitCast(RegNode, Builder.getInt8PtrTy());
 639   Builder.CreateCall(
 640       Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehregnode),
 641       {RegNodeI8});
 642
 643   if (EHGuardNode) {
 644     IRBuilder<> Builder(EHGuardNode->getNextNode());
 645     Value *EHGuardNodeI8 =
 646         Builder.CreateBitCast(EHGuardNode, Builder.getInt8PtrTy());
 647     Builder.CreateCall(
 648         Intrinsic::getDeclaration(TheModule, Intrinsic::x86_seh_ehguard),
 649         {EHGuardNodeI8});
 650   }
 651
 652   // Calculate state numbers.
 653   if (isAsynchronousEHPersonality(Personality))
 654     calculateSEHStateNumbers(&F, FuncInfo);
 655   else
 656     calculateWinCXXEHStateNumbers(&F, FuncInfo);
 657
 658   // Iterate all the instructions and emit state number stores.
 659   DenseMap<BasicBlock *, ColorVector> BlockColors = colorEHFunclets(F);
 660   ReversePostOrderTraversal<Function *> RPOT(&F);
 661
 662   // InitialStates yields the state of the first call-site for a BasicBlock.
 663   DenseMap<BasicBlock *, int> InitialStates;
 664   // FinalStates yields the state of the last call-site for a BasicBlock.
 665   DenseMap<BasicBlock *, int> FinalStates;
 666   // Worklist used to revisit BasicBlocks with indeterminate
 667   // Initial/Final-States.
 668   std::deque<BasicBlock *> Worklist;
 669   // Fill in InitialStates and FinalStates for BasicBlocks with call-sites.
 670   for (BasicBlock *BB : RPOT) {
 671     int InitialState = OverdefinedState;
 672     int FinalState;
 673     if (&F.getEntryBlock() == BB)
 674       InitialState = FinalState = ParentBaseState;
 675     for (Instruction &I : *BB) {
 676       CallSite CS(&I);
 677       if (!isStateStoreNeeded(Personality, CS))
 678         continue;
 679
 680       int State = getStateForCallSite(BlockColors, FuncInfo, CS);
 681       if (InitialState == OverdefinedState)
 682         InitialState = State;
 683       FinalState = State;
 684     }
 685     // No call-sites in this basic block? That's OK, we will come back to these
 686     // in a later pass.
 687     if (InitialState == OverdefinedState) {
 688       Worklist.push_back(BB);
 689       continue;
 690     }
 691     LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
 692                       << " InitialState=" << InitialState << '\n');
 693     LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
 694                       << " FinalState=" << FinalState << '\n');
 695     InitialStates.insert({BB, InitialState});
 696     FinalStates.insert({BB, FinalState});
 697   }
 698
 699   // Try to fill-in InitialStates and FinalStates which have no call-sites.
 700   while (!Worklist.empty()) {
 701     BasicBlock *BB = Worklist.front();
 702     Worklist.pop_front();
 703     // This BasicBlock has already been figured out, nothing more we can do.
 704     if (InitialStates.count(BB) != 0)
 705       continue;
 706
 707     int PredState = getPredState(FinalStates, F, ParentBaseState, BB);
 708     if (PredState == OverdefinedState)
 709       continue;
 710
 711     // We successfully inferred this BasicBlock's state via it's predecessors;
 712     // enqueue it's successors to see if we can infer their states.
 713     InitialStates.insert({BB, PredState});
 714     FinalStates.insert({BB, PredState});
 715     for (BasicBlock *SuccBB : successors(BB))
 716       Worklist.push_back(SuccBB);
 717   }
 718
 719   // Try to hoist stores from successors.
 720   for (BasicBlock *BB : RPOT) {
 721     int SuccState = getSuccState(InitialStates, F, ParentBaseState, BB);
 722     if (SuccState == OverdefinedState)
 723       continue;
 724
 725     // Update our FinalState to reflect the common InitialState of our
 726     // successors.
 727     FinalStates.insert({BB, SuccState});
 728   }
 729
 730   // Finally, insert state stores before call-sites which transition us to a new
 731   // state.
 732   for (BasicBlock *BB : RPOT) {
 733     auto &BBColors = BlockColors[BB];
 734     BasicBlock *FuncletEntryBB = BBColors.front();
 735     if (isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI()))
 736       continue;
 737
 738     int PrevState = getPredState(FinalStates, F, ParentBaseState, BB);
 739     LLVM_DEBUG(dbgs() << "X86WinEHState: " << BB->getName()
 740                       << " PrevState=" << PrevState << '\n');
 741
 742     for (Instruction &I : *BB) {
 743       CallSite CS(&I);
 744       if (!isStateStoreNeeded(Personality, CS))
 745         continue;
 746
 747       int State = getStateForCallSite(BlockColors, FuncInfo, CS);
 748       if (State != PrevState)
 749         insertStateNumberStore(&I, State);
 750       PrevState = State;
 751     }
 752
 753     // We might have hoisted a state store into this block, emit it now.
 754     auto EndState = FinalStates.find(BB);
 755     if (EndState != FinalStates.end())
 756       if (EndState->second != PrevState)
 757         insertStateNumberStore(BB->getTerminator(), EndState->second);
 758   }
 759
 760   SmallVector<CallSite, 1> SetJmp3CallSites;
 761   for (BasicBlock *BB : RPOT) {
 762     for (Instruction &I : *BB) {
 763       CallSite CS(&I);
 764       if (!CS)
 765         continue;
 766       if (CS.getCalledValue()->stripPointerCasts() !=
 767           SetJmp3.getCallee()->stripPointerCasts())
 768         continue;
 769
 770       SetJmp3CallSites.push_back(CS);
 771     }
 772   }
 773
 774   for (CallSite CS : SetJmp3CallSites) {
 775     auto &BBColors = BlockColors[CS->getParent()];
 776     BasicBlock *FuncletEntryBB = BBColors.front();
 777     bool InCleanup = isa<CleanupPadInst>(FuncletEntryBB->getFirstNonPHI());
 778
 779     IRBuilder<> Builder(CS.getInstruction());
 780     Value *State;
 781     if (InCleanup) {
 782       Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
 783                                                   RegNode, StateFieldIndex);
 784       State = Builder.CreateLoad(Builder.getInt32Ty(), StateField);
 785     } else {
 786       State = Builder.getInt32(getStateForCallSite(BlockColors, FuncInfo, CS));
 787     }
 788     rewriteSetJmpCallSite(Builder, F, CS, State);
 789   }
 790 }
 791
 792 void WinEHStatePass::insertStateNumberStore(Instruction *IP, int State) {
 793   IRBuilder<> Builder(IP);
 794   Value *StateField = Builder.CreateStructGEP(RegNode->getAllocatedType(),
 795                                               RegNode, StateFieldIndex);
 796   Builder.CreateStore(Builder.getInt32(State), StateField);
 797 }