devbox
从前慢现在也慢
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

CoreCLR源码探索(八) JIT的工作原理(详解篇)

作者：从前慢现在也慢 | 2024-02-17 06:00:08

赞

踩

coreclr

在上一篇我们对CoreCLR中的JIT有了一个基础的了解,
这一篇我们将更详细分析JIT的实现.

JIT的实现代码主要在https://github.com/dotnet/coreclr/tree/master/src/jit下,
要对一个的函数的JIT过程进行详细分析, 最好的办法是查看JitDump.
查看JitDump需要自己编译一个Debug版本的CoreCLR, windows可以看这里, linux可以看这里,
编译完以后定义环境变量COMPlus_JitDump=Main, Main可以换成其他函数的名称, 然后使用该Debug版本的CoreCLR执行程序即可.

JitDump的例子可以看这里, 包含了Debug模式和Release模式的输出.

接下来我们来结合代码一步步的看JIT中的各个过程.
以下的代码基于CoreCLR 1.1.0和x86/x64分析, 新版本可能会有变化.
(为什么是1.1.0? 因为JIT部分我看了半年时间, 开始看的时候2.0还未出来)

JIT的触发

在上一篇中我提到了, 触发JIT编译会在第一次调用函数时, 会从桩(Stub)触发:

881857-20171028110034726-907990171.jpg

这就是JIT Stub实际的样子, 函数第一次调用前Fixup Precode的状态:

  1. Fixup Precode:
  2.  
  3. (lldb) di --frame --bytes
  4. -> 0x7fff7c21f5a8: e8 2b 6c fe ff     callq  0x7fff7c2061d8
  5.    0x7fff7c21f5ad: 5e                 popq   %rsi
  6.    0x7fff7c21f5ae: 19 05 e8 23 6c fe  sbbl   %eax, -0x193dc18(%rip)
  7.    0x7fff7c21f5b4: ff 5e a8           lcalll *-0x58(%rsi)
  8.    0x7fff7c21f5b7: 04 e8              addb   $-0x18, %al
  9.    0x7fff7c21f5b9: 1b 6c fe ff        sbbl   -0x1(%rsi,%rdi,8), %ebp
  10.    0x7fff7c21f5bd: 5e                 popq   %rsi
  11.    0x7fff7c21f5be: 00 03              addb   %al, (%rbx)
  12.    0x7fff7c21f5c0: e8 13 6c fe ff     callq  0x7fff7c2061d8
  13.    0x7fff7c21f5c5: 5e                 popq   %rsi
  14.    0x7fff7c21f5c6: b0 02              movb   $0x2, %al
  15. (lldb) di --frame --bytes 
  16. -> 0x7fff7c2061d8: e9 13 3f 9d 79                 jmp    0x7ffff5bda0f0            ; PrecodeFixupThunk
  17.    0x7fff7c2061dd: cc                             int3   
  18.    0x7fff7c2061de: cc                             int3   
  19.    0x7fff7c2061df: cc                             int3   
  20.    0x7fff7c2061e0: 49 ba 00 da d0 7b ff 7f 00 00  movabsq $0x7fff7bd0da00, %r10
  21.    0x7fff7c2061ea: 40 e9 e0 ff ff ff              jmp    0x7fff7c2061d0

这两段代码只有第一条指令是相关的, 注意callq后面的5e 19 05, 这些并不是汇编指令而是函数的信息, 下面会提到.
接下来跳转到Fixup Precode Chunk, 从这里开始的代码所有函数都会共用:

  1. Fixup Precode Chunk:
  2.  
  3. (lldb) di --frame --bytes
  4. -> 0x7ffff5bda0f0 <PrecodeFixupThunk>: 58              popq   %rax                         ; rax = 0x7fff7c21f5ad
  5.    0x7ffff5bda0f1 <PrecodeFixupThunk+1>: 4c 0f b6 50 02  movzbq 0x2(%rax), %r10            ; r10 = 0x05 (precode chunk index)
  6.    0x7ffff5bda0f6 <PrecodeFixupThunk+6>: 4c 0f b6 58 01  movzbq 0x1(%rax), %r11            ; r11 = 0x19 (methoddesc chunk index)
  7.    0x7ffff5bda0fb <PrecodeFixupThunk+11>: 4a 8b 44 d0 03  movq   0x3(%rax,%r10,8), %rax    ; rax = 0x7fff7bdd5040 (methoddesc chunk)
  8.    0x7ffff5bda100 <PrecodeFixupThunk+16>: 4e 8d 14 d8     leaq   (%rax,%r11,8), %r10       ; r10 = 0x7fff7bdd5108 (methoddesc)
  9.    0x7ffff5bda104 <PrecodeFixupThunk+20>: e9 37 ff ff ff  jmp    0x7ffff5bda040            ; ThePreStub

这段代码的源代码在vm\amd64\unixasmhelpers.S:

  1. LEAF_ENTRY PrecodeFixupThunk, _TEXT
  2.  
  3.         pop     rax         // Pop the return address. It points right after the call instruction in the precode.
  4.  
  5.         // Inline computation done by FixupPrecode::GetMethodDesc()
  6.         movzx   r10,byte ptr [rax+2]    // m_PrecodeChunkIndex
  7.         movzx   r11,byte ptr [rax+1]    // m_MethodDescChunkIndex
  8.         mov     rax,qword ptr [rax+r10*8+3]
  9.         lea     METHODDESC_REGISTER,[rax+r11*8]
  10.  
  11.         // Tail call to prestub
  12.         jmp C_FUNC(ThePreStub)
  13.  
  14. LEAF_END PrecodeFixupThunk, _TEXT

popq %rax后rax会指向刚才callq后面的地址, 再根据后面储存的索引值可以得到编译函数的MethodDesc, 接下来跳转到The PreStub:

  1. ThePreStub:
  2.  
  3. (lldb) di --frame --bytes
  4. -> 0x7ffff5bda040 <ThePreStub>: 55                       pushq  %rbp
  5.    0x7ffff5bda041 <ThePreStub+1>: 48 89 e5                 movq   %rsp, %rbp
  6.    0x7ffff5bda044 <ThePreStub+4>: 53                       pushq  %rbx
  7.    0x7ffff5bda045 <ThePreStub+5>: 41 57                    pushq  %r15
  8.    0x7ffff5bda047 <ThePreStub+7>: 41 56                    pushq  %r14
  9.    0x7ffff5bda049 <ThePreStub+9>: 41 55                    pushq  %r13
  10.    0x7ffff5bda04b <ThePreStub+11>: 41 54                    pushq  %r12
  11.    0x7ffff5bda04d <ThePreStub+13>: 41 51                    pushq  %r9
  12.    0x7ffff5bda04f <ThePreStub+15>: 41 50                    pushq  %r8
  13.    0x7ffff5bda051 <ThePreStub+17>: 51                       pushq  %rcx
  14.    0x7ffff5bda052 <ThePreStub+18>: 52                       pushq  %rdx
  15.    0x7ffff5bda053 <ThePreStub+19>: 56                       pushq  %rsi
  16.    0x7ffff5bda054 <ThePreStub+20>: 57                       pushq  %rdi
  17.    0x7ffff5bda055 <ThePreStub+21>: 48 8d a4 24 78 ff ff ff  leaq   -0x88(%rsp), %rsp         ; allocate transition block
  18.    0x7ffff5bda05d <ThePreStub+29>: 66 0f 7f 04 24           movdqa %xmm0, (%rsp)             ; fill transition block
  19.    0x7ffff5bda062 <ThePreStub+34>: 66 0f 7f 4c 24 10        movdqa %xmm1, 0x10(%rsp)         ; fill transition block
  20.    0x7ffff5bda068 <ThePreStub+40>: 66 0f 7f 54 24 20        movdqa %xmm2, 0x20(%rsp)         ; fill transition block
  21.    0x7ffff5bda06e <ThePreStub+46>: 66 0f 7f 5c 24 30        movdqa %xmm3, 0x30(%rsp)         ; fill transition block
  22.    0x7ffff5bda074 <ThePreStub+52>: 66 0f 7f 64 24 40        movdqa %xmm4, 0x40(%rsp)         ; fill transition block
  23.    0x7ffff5bda07a <ThePreStub+58>: 66 0f 7f 6c 24 50        movdqa %xmm5, 0x50(%rsp)         ; fill transition block
  24.    0x7ffff5bda080 <ThePreStub+64>: 66 0f 7f 74 24 60        movdqa %xmm6, 0x60(%rsp)         ; fill transition block
  25.    0x7ffff5bda086 <ThePreStub+70>: 66 0f 7f 7c 24 70        movdqa %xmm7, 0x70(%rsp)         ; fill transition block
  26.    0x7ffff5bda08c <ThePreStub+76>: 48 8d bc 24 88 00 00 00  leaq   0x88(%rsp), %rdi          ; arg 1 = transition block*
  27.    0x7ffff5bda094 <ThePreStub+84>: 4c 89 d6                 movq   %r10, %rsi                ; arg 2 = methoddesc
  28.    0x7ffff5bda097 <ThePreStub+87>: e8 44 7e 11 00           callq  0x7ffff5cf1ee0            ; PreStubWorker at prestub.cpp:958
  29.    0x7ffff5bda09c <ThePreStub+92>: 66 0f 6f 04 24           movdqa (%rsp), %xmm0
  30.    0x7ffff5bda0a1 <ThePreStub+97>: 66 0f 6f 4c 24 10        movdqa 0x10(%rsp), %xmm1
  31.    0x7ffff5bda0a7 <ThePreStub+103>: 66 0f 6f 54 24 20        movdqa 0x20(%rsp), %xmm2
  32.    0x7ffff5bda0ad <ThePreStub+109>: 66 0f 6f 5c 24 30        movdqa 0x30(%rsp), %xmm3
  33.    0x7ffff5bda0b3 <ThePreStub+115>: 66 0f 6f 64 24 40        movdqa 0x40(%rsp), %xmm4
  34.    0x7ffff5bda0b9 <ThePreStub+121>: 66 0f 6f 6c 24 50        movdqa 0x50(%rsp), %xmm5
  35.    0x7ffff5bda0bf <ThePreStub+127>: 66 0f 6f 74 24 60        movdqa 0x60(%rsp), %xmm6
  36.    0x7ffff5bda0c5 <ThePreStub+133>: 66 0f 6f 7c 24 70        movdqa 0x70(%rsp), %xmm7
  37.    0x7ffff5bda0cb <ThePreStub+139>: 48 8d a4 24 88 00 00 00  leaq   0x88(%rsp), %rsp
  38.    0x7ffff5bda0d3 <ThePreStub+147>: 5f                       popq   %rdi
  39.    0x7ffff5bda0d4 <ThePreStub+148>: 5e                       popq   %rsi
  40.    0x7ffff5bda0d5 <ThePreStub+149>: 5a                       popq   %rdx
  41.    0x7ffff5bda0d6 <ThePreStub+150>: 59                       popq   %rcx
  42.    0x7ffff5bda0d7 <ThePreStub+151>: 41 58                    popq   %r8
  43.    0x7ffff5bda0d9 <ThePreStub+153>: 41 59                    popq   %r9
  44.    0x7ffff5bda0db <ThePreStub+155>: 41 5c                    popq   %r12
  45.    0x7ffff5bda0dd <ThePreStub+157>: 41 5d                    popq   %r13
  46.    0x7ffff5bda0df <ThePreStub+159>: 41 5e                    popq   %r14
  47.    0x7ffff5bda0e1 <ThePreStub+161>: 41 5f                    popq   %r15
  48.    0x7ffff5bda0e3 <ThePreStub+163>: 5b                       popq   %rbx
  49.    0x7ffff5bda0e4 <ThePreStub+164>: 5d                       popq   %rbp
  50.    0x7ffff5bda0e5 <ThePreStub+165>: 48 ff e0                 jmpq   *%rax
  51.    %rax should be patched fixup precode = 0x7fff7c21f5a8
  52.    (%rsp) should be the return address before calling "Fixup Precode"

看上去相当长但做的事情很简单, 它的源代码在vm\amd64\theprestubamd64.S:

  1. NESTED_ENTRY ThePreStub, _TEXT, NoHandler
  2.         PROLOG_WITH_TRANSITION_BLOCK 0, 0, 0, 0, 0
  3.  
  4.         //
  5.         // call PreStubWorker
  6.         //
  7.         lea             rdi, [rsp + __PWTB_TransitionBlock]     // pTransitionBlock*
  8.         mov             rsi, METHODDESC_REGISTER
  9.         call            C_FUNC(PreStubWorker)
  10.  
  11.         EPILOG_WITH_TRANSITION_BLOCK_TAILCALL
  12.         TAILJMP_RAX
  13.  
  14. NESTED_END ThePreStub, _TEXT

它会备份寄存器到栈, 然后调用PreStubWorker这个函数, 调用完毕以后恢复栈上的寄存器,
再跳转到PreStubWorker的返回结果, 也就是打完补丁后的Fixup Precode的地址(0x7fff7c21f5a8).

PreStubWorker是C编写的函数, 它会调用JIT的编译函数, 然后对Fixup Precode打补丁.
打补丁时会读取前面的5e, 5e代表precode的类型是PRECODE_FIXUP, 打补丁的函数是FixupPrecode::SetTargetInterlocked.
打完补丁以后的Fixup Precode如下:

  1. Fixup Precode:
  2.  
  3. (lldb) di --bytes -s 0x7fff7c21f5a8
  4.    0x7fff7c21f5a8: e9 a3 87 3a 00     jmp    0x7fff7c5c7d50
  5.    0x7fff7c21f5ad: 5f                 popq   %rdi
  6.    0x7fff7c21f5ae: 19 05 e8 23 6c fe  sbbl   %eax, -0x193dc18(%rip)
  7.    0x7fff7c21f5b4: ff 5e a8           lcalll *-0x58(%rsi)
  8.    0x7fff7c21f5b7: 04 e8              addb   $-0x18, %al
  9.    0x7fff7c21f5b9: 1b 6c fe ff        sbbl   -0x1(%rsi,%rdi,8), %ebp
  10.    0x7fff7c21f5bd: 5e                 popq   %rsi
  11.    0x7fff7c21f5be: 00 03              addb   %al, (%rbx)
  12.    0x7fff7c21f5c0: e8 13 6c fe ff     callq  0x7fff7c2061d8
  13.    0x7fff7c21f5c5: 5e                 popq   %rsi
  14.    0x7fff7c21f5c6: b0 02              movb   $0x2, %al

下次再调用函数时就可以直接jmp到编译结果了.
JIT Stub的实现可以让运行时只编译实际会运行的函数, 这样可以大幅减少程序的启动时间, 第二次调用时的消耗(1个jmp)也非常的小.

注意调用虚方法时的流程跟上面的流程有一点不同, 虚方法的地址会保存在函数表中,
打补丁时会对函数表而不是Precode打补丁, 下次调用时函数表中指向的地址是编译后的地址, 有兴趣可以自己试试分析.

接下来我们看看PreStubWorker的内部处理.

JIT的入口点

PreStubWorker的源代码如下:

  1. extern "C" PCODE STDCALL PreStubWorker(TransitionBlock * pTransitionBlock, MethodDesc * pMD)
  2. {
  3.     PCODE pbRetVal = NULL;
  4.  
  5.     BEGIN_PRESERVE_LAST_ERROR;
  6.  
  7.     STATIC_CONTRACT_THROWS;
  8.     STATIC_CONTRACT_GC_TRIGGERS;
  9.     STATIC_CONTRACT_MODE_COOPERATIVE;
  10.     STATIC_CONTRACT_ENTRY_POINT;
  11.  
  12.     MAKE_CURRENT_THREAD_AVAILABLE();
  13.  
  14. #ifdef _DEBUG
  15.     Thread::ObjectRefFlush(CURRENT_THREAD);
  16. #endif
  17.  
  18.     FrameWithCookie<PrestubMethodFrame> frame(pTransitionBlock, pMD);
  19.     PrestubMethodFrame * pPFrame = &frame;
  20.  
  21.     pPFrame->Push(CURRENT_THREAD);
  22.  
  23.     INSTALL_MANAGED_EXCEPTION_DISPATCHER;
  24.     INSTALL_UNWIND_AND_CONTINUE_HANDLER;
  25.  
  26.     ETWOnStartup (PrestubWorker_V1,PrestubWorkerEnd_V1);
  27.  
  28.     _ASSERTE(!NingenEnabled() && "You cannot invoke managed code inside the ngen compilation process.");
  29.  
  30.     // Running the PreStubWorker on a method causes us to access its MethodTable
  31.     g_IBCLogger.LogMethodDescAccess(pMD);
  32.  
  33.     // Make sure the method table is restored, and method instantiation if present
  34.     pMD->CheckRestore();
  35.  
  36.     CONSISTENCY_CHECK(GetAppDomain()->CheckCanExecuteManagedCode(pMD));
  37.  
  38.     // Note this is redundant with the above check but we do it anyway for safety
  39.     //
  40.     // This has been disabled so we have a better chance of catching these.  Note that this check is
  41.     // NOT sufficient for domain neutral and ngen cases.
  42.     //
  43.     // pMD->EnsureActive();
  44.  
  45.     MethodTable *pDispatchingMT = NULL;
  46.  
  47.     if (pMD->IsVtableMethod())
  48.     {
  49.         OBJECTREF curobj = pPFrame->GetThis();
  50.  
  51.         if (curobj != NULL) // Check for virtual function called non-virtually on a NULL object
  52.         {
  53.             pDispatchingMT = curobj->GetTrueMethodTable();
  54.  
  55. #ifdef FEATURE_ICASTABLE
  56.             if (pDispatchingMT->IsICastable())
  57.             {
  58.                 MethodTable *pMDMT = pMD->GetMethodTable();
  59.                 TypeHandle objectType(pDispatchingMT);
  60.                 TypeHandle methodType(pMDMT);
  61.  
  62.                 GCStress<cfg_any>::MaybeTrigger();
  63.                 INDEBUG(curobj = NULL); // curobj is unprotected and CanCastTo() can trigger GC
  64.                 if (!objectType.CanCastTo(methodType)) 
  65.                 {
  66.                     // Apperantly ICastable magic was involved when we chose this method to be called
  67.                     // that's why we better stick to the MethodTable it belongs to, otherwise 
  68.                     // DoPrestub() will fail not being able to find implementation for pMD in pDispatchingMT.
  69.  
  70.                     pDispatchingMT = pMDMT;
  71.                 }
  72.             }
  73. #endif // FEATURE_ICASTABLE
  74.  
  75.             // For value types, the only virtual methods are interface implementations.
  76.             // Thus pDispatching == pMT because there
  77.             // is no inheritance in value types.  Note the BoxedEntryPointStubs are shared
  78.             // between all sharable generic instantiations, so the == test is on
  79.             // canonical method tables.
  80. #ifdef _DEBUG 
  81.             MethodTable *pMDMT = pMD->GetMethodTable(); // put this here to see what the MT is in debug mode
  82.             _ASSERTE(!pMD->GetMethodTable()->IsValueType() ||
  83.                      (pMD->IsUnboxingStub() && (pDispatchingMT->GetCanonicalMethodTable() == pMDMT->GetCanonicalMethodTable())));
  84. #endif // _DEBUG
  85.         }
  86.     }
  87.  
  88.     GCX_PREEMP_THREAD_EXISTS(CURRENT_THREAD);
  89.     pbRetVal = pMD->DoPrestub(pDispatchingMT);
  90.  
  91.     UNINSTALL_UNWIND_AND_CONTINUE_HANDLER;
  92.     UNINSTALL_MANAGED_EXCEPTION_DISPATCHER;
  93.  
  94.     {
  95.         HardwareExceptionHolder
  96.  
  97.         // Give debugger opportunity to stop here
  98.         ThePreStubPatch();
  99.     }
  100.  
  101.     pPFrame->Pop(CURRENT_THREAD);
  102.  
  103.     POSTCONDITION(pbRetVal != NULL);
  104.  
  105.     END_PRESERVE_LAST_ERROR;
  106.  
  107.     return pbRetVal;
  108. }

这个函数接收了两个参数,
第一个是TransitionBlock, 其实就是一个指向栈的指针, 里面保存了备份的寄存器,
第二个是MethodDesc, 是当前编译函数的信息, lldb中使用dumpmd pMD即可看到具体信息.

之后会调用MethodDesc::DoPrestub, 如果函数是虚方法则传入this对象类型的MethodTable.
MethodDesc::DoPrestub的源代码如下:

  1. PCODE MethodDesc::DoPrestub(MethodTable *pDispatchingMT)
  2. {
  3.     CONTRACT(PCODE)
  4.     {
  5.         STANDARD_VM_CHECK;
  6.         POSTCONDITION(RETVAL != NULL);
  7.     }
  8.     CONTRACT_END;
  9.  
  10.     Stub *pStub = NULL;
  11.     PCODE pCode = NULL;
  12.  
  13.     Thread *pThread = GetThread();
  14.  
  15.     MethodTable *pMT = GetMethodTable();
  16.  
  17.     // Running a prestub on a method causes us to access its MethodTable
  18.     g_IBCLogger.LogMethodDescAccess(this);
  19.  
  20.     // A secondary layer of defense against executing code in inspection-only assembly.
  21.     // This should already have been taken care of by not allowing inspection assemblies
  22.     // to be activated. However, this is a very inexpensive piece of insurance in the name
  23.     // of security.
  24.     if (IsIntrospectionOnly())
  25.     {
  26.         _ASSERTE(!"A ReflectionOnly assembly reached the prestub. This should not have happened.");
  27.         COMPlusThrow(kInvalidOperationException, IDS_EE_CODEEXECUTION_IN_INTROSPECTIVE_ASSEMBLY);
  28.     }
  29.  
  30.     if (ContainsGenericVariables())
  31.     {
  32.         COMPlusThrow(kInvalidOperationException, IDS_EE_CODEEXECUTION_CONTAINSGENERICVAR);
  33.     }
  34.  
  35.     /**************************   DEBUG CHECKS  *************************/
  36.     /*-----------------------------------------------------------------
  37.     // Halt if needed, GC stress, check the sharing count etc.
  38.     */
  39.  
  40. #ifdef _DEBUG 
  41.     static unsigned ctr = 0;
  42.     ctr++;
  43.  
  44.     if (g_pConfig->ShouldPrestubHalt(this))
  45.     {
  46.         _ASSERTE(!"PreStubHalt");
  47.     }
  48.  
  49.     LOG((LF_CLASSLOADER, LL_INFO10000, "In PreStubWorker for %s::%s\n",
  50.                 m_pszDebugClassName, m_pszDebugMethodName));
  51.  
  52.     // This is a nice place to test out having some fatal EE errors. We do this only in a checked build, and only
  53.     // under the InjectFatalError key.
  54.     if (g_pConfig->InjectFatalError() == 1)
  55.     {
  56.         EEPOLICY_HANDLE_FATAL_ERROR(COR_E_EXECUTIONENGINE);
  57.     }
  58.     else if (g_pConfig->InjectFatalError() == 2)
  59.     {
  60.         EEPOLICY_HANDLE_FATAL_ERROR(COR_E_STACKOVERFLOW);
  61.     }
  62.     else if (g_pConfig->InjectFatalError() == 3)
  63.     {
  64.         TestSEHGuardPageRestore();
  65.     }
  66.  
  67.     // Useful to test GC with the prestub on the call stack
  68.     if (g_pConfig->ShouldPrestubGC(this))
  69.     {
  70.         GCX_COOP();
  71.         GCHeap::GetGCHeap()->GarbageCollect(-1);
  72.     }
  73. #endif // _DEBUG
  74.  
  75.     STRESS_LOG1(LF_CLASSLOADER, LL_INFO10000, "Prestubworker: method %pM\n", this);
  76.  
  77.  
  78.     GCStress<cfg_any, EeconfigFastGcSPolicy, CoopGcModePolicy>::MaybeTrigger();
  79.  
  80.     // Are we in the prestub because of a rejit request?  If so, let the ReJitManager
  81.     // take it from here.
  82.     pCode = ReJitManager::DoReJitIfNecessary(this);
  83.     if (pCode != NULL)
  84.     {
  85.         // A ReJIT was performed, so nothing left for DoPrestub() to do. Return now.
  86.         // 
  87.         // The stable entrypoint will either be a pointer to the original JITted code
  88.         // (with a jmp at the top to jump to the newly-rejitted code) OR a pointer to any
  89.         // stub code that must be executed first (e.g., a remoting stub), which in turn
  90.         // will call the original JITted code (which then jmps to the newly-rejitted
  91.         // code).
  92.         RETURN GetStableEntryPoint();
  93.     }
  94.  
  95. #ifdef FEATURE_PREJIT 
  96.     // If this method is the root of a CER call graph and we've recorded this fact in the ngen image then we're in the prestub in
  97.     // order to trip any runtime level preparation needed for this graph (P/Invoke stub generation/library binding, generic
  98.     // dictionary prepopulation etc.).
  99.     GetModule()->RestoreCer(this);
  100. #endif // FEATURE_PREJIT
  101.  
  102. #ifdef FEATURE_COMINTEROP 
  103.     /**************************   INTEROP   *************************/
  104.     /*-----------------------------------------------------------------
  105.     // Some method descriptors are COMPLUS-to-COM call descriptors
  106.     // they are not your every day method descriptors, for example
  107.     // they don't have an IL or code.
  108.     */
  109.     if (IsComPlusCall() || IsGenericComPlusCall())
  110.     {
  111.         pCode = GetStubForInteropMethod(this);
  112.         
  113.         GetPrecode()->SetTargetInterlocked(pCode);
  114.  
  115.         RETURN GetStableEntryPoint();
  116.     }
  117. #endif // FEATURE_COMINTEROP
  118.  
  119.     // workaround: This is to handle a punted work item dealing with a skipped module constructor
  120.     //       due to appdomain unload. Basically shared code was JITted in domain A, and then
  121.     //       this caused a link to another shared module with a module CCTOR, which was skipped
  122.     //       or aborted in another appdomain we were trying to propagate the activation to.
  123.     //
  124.     //       Note that this is not a fix, but that it just minimizes the window in which the
  125.     //       issue can occur.
  126.     if (pThread->IsAbortRequested())
  127.     {
  128.         pThread->HandleThreadAbort();
  129.     }
  130.  
  131.     /**************************   CLASS CONSTRUCTOR   ********************/
  132.     // Make sure .cctor has been run
  133.  
  134.     if (IsClassConstructorTriggeredViaPrestub())
  135.     {
  136.         pMT->CheckRunClassInitThrowing();
  137.     }
  138.  
  139.     /**************************   BACKPATCHING   *************************/
  140.     // See if the addr of code has changed from the pre-stub
  141. #ifdef FEATURE_INTERPRETER
  142.     if (!IsReallyPointingToPrestub())
  143. #else
  144.     if (!IsPointingToPrestub())
  145. #endif
  146.     {
  147.         LOG((LF_CLASSLOADER, LL_INFO10000,
  148.                 "    In PreStubWorker, method already jitted, backpatching call point\n"));
  149.  
  150.         RETURN DoBackpatch(pMT, pDispatchingMT, TRUE);
  151.     }
  152.  
  153.     // record if remoting needs to intercept this call
  154.     BOOL  fRemotingIntercepted = IsRemotingInterceptedViaPrestub();
  155.  
  156.     BOOL  fReportCompilationFinished = FALSE;
  157.     
  158.     /**************************   CODE CREATION  *************************/
  159.     if (IsUnboxingStub())
  160.     {
  161.         pStub = MakeUnboxingStubWorker(this);
  162.     }
  163. #ifdef FEATURE_REMOTING
  164.     else if (pMT->IsInterface() && !IsStatic() && !IsFCall())
  165.     {
  166.         pCode = CRemotingServices::GetDispatchInterfaceHelper(this);
  167.         GetOrCreatePrecode();
  168.     }
  169. #endif // FEATURE_REMOTING
  170. #if defined(FEATURE_SHARE_GENERIC_CODE) 
  171.     else if (IsInstantiatingStub())
  172.     {
  173.         pStub = MakeInstantiatingStubWorker(this);
  174.     }
  175. #endif // defined(FEATURE_SHARE_GENERIC_CODE)
  176.     else if (IsIL() || IsNoMetadata())
  177.     {
  178.         // remember if we need to backpatch the MethodTable slot
  179.         BOOL  fBackpatch           = !fRemotingIntercepted
  180.                                     && !IsEnCMethod();
  181.  
  182. #ifdef FEATURE_PREJIT 
  183.         //
  184.         // See if we have any prejitted code to use.
  185.         //
  186.  
  187.         pCode = GetPreImplementedCode();
  188.  
  189. #ifdef PROFILING_SUPPORTED
  190.         if (pCode != NULL)
  191.         {
  192.             BOOL fShouldSearchCache = TRUE;
  193.  
  194.             {
  195.                 BEGIN_PIN_PROFILER(CORProfilerTrackCacheSearches());
  196.                 g_profControlBlock.pProfInterface->
  197.                     JITCachedFunctionSearchStarted((FunctionID) this,
  198.                                                    &fShouldSearchCache);
  199.                 END_PIN_PROFILER();
  200.             }
  201.  
  202.             if (!fShouldSearchCache)
  203.             {
  204. #ifdef FEATURE_INTERPRETER
  205.                 SetNativeCodeInterlocked(NULL, pCode, FALSE);
  206. #else
  207.                 SetNativeCodeInterlocked(NULL, pCode);
  208. #endif
  209.                 _ASSERTE(!IsPreImplemented());
  210.                 pCode = NULL;
  211.             }
  212.         }
  213. #endif // PROFILING_SUPPORTED
  214.  
  215.         if (pCode != NULL)
  216.         {
  217.             LOG((LF_ZAP, LL_INFO10000,
  218.                 "ZAP: Using code" FMT_ADDR "for %s.%s sig=\"%s\" (token %x).\n",
  219.                     DBG_ADDR(pCode),
  220.                     m_pszDebugClassName,
  221.                     m_pszDebugMethodName,
  222.                     m_pszDebugMethodSignature,
  223.                     GetMemberDef()));
  224.  
  225.             TADDR pFixupList = GetFixupList();
  226.             if (pFixupList != NULL)
  227.             {
  228.                 Module *pZapModule = GetZapModule();
  229.                 _ASSERTE(pZapModule != NULL);
  230.                 if (!pZapModule->FixupDelayList(pFixupList))
  231.                 {
  232.                     _ASSERTE(!"FixupDelayList failed");
  233.                     ThrowHR(COR_E_BADIMAGEFORMAT);
  234.                 }
  235.             }
  236.  
  237. #ifdef HAVE_GCCOVER
  238.             if (GCStress<cfg_instr_ngen>::IsEnabled())
  239.                 SetupGcCoverage(this, (BYTE*) pCode);
  240. #endif // HAVE_GCCOVER
  241.  
  242. #ifdef PROFILING_SUPPORTED 
  243.             /*
  244.                 * This notifies the profiler that a search to find a
  245.                 * cached jitted function has been made.
  246.                 */
  247.             {
  248.                 BEGIN_PIN_PROFILER(CORProfilerTrackCacheSearches());
  249.                 g_profControlBlock.pProfInterface->
  250.                     JITCachedFunctionSearchFinished((FunctionID) this, COR_PRF_CACHED_FUNCTION_FOUND);
  251.                 END_PIN_PROFILER();
  252.             }
  253. #endif // PROFILING_SUPPORTED
  254.         }
  255.  
  256.         //
  257.         // If not, try to jit it
  258.         //
  259.  
  260. #endif // FEATURE_PREJIT
  261.  
  262. #ifdef FEATURE_READYTORUN
  263.         if (pCode == NULL)
  264.         {
  265.             Module * pModule = GetModule();
  266.             if (pModule->IsReadyToRun())
  267.             {
  268.                 pCode = pModule->GetReadyToRunInfo()->GetEntryPoint(this);
  269.                 if (pCode != NULL)
  270.                     fReportCompilationFinished = TRUE;
  271.             }
  272.         }
  273. #endif // FEATURE_READYTORUN
  274.  
  275.         if (pCode == NULL)
  276.         {
  277.             NewHolder<COR_ILMETHOD_DECODER> pHeader(NULL);
  278.             // Get the information on the method
  279.             if (!IsNoMetadata())
  280.             {
  281.                 COR_ILMETHOD* ilHeader = GetILHeader(TRUE);
  282.                 if(ilHeader == NULL)
  283.                 {
  284. #ifdef FEATURE_COMINTEROP
  285.                     // Abstract methods can be called through WinRT derivation if the deriving type
  286.                     // is not implemented in managed code, and calls through the CCW to the abstract
  287.                     // method. Throw a sensible exception in that case.
  288.                     if (pMT->IsExportedToWinRT() && IsAbstract())
  289.                     {
  290.                         COMPlusThrowHR(E_NOTIMPL);
  291.                     }
  292. #endif // FEATURE_COMINTEROP
  293.  
  294.                     COMPlusThrowHR(COR_E_BADIMAGEFORMAT, BFA_BAD_IL);
  295.                 }
  296.  
  297.                 COR_ILMETHOD_DECODER::DecoderStatus status = COR_ILMETHOD_DECODER::FORMAT_ERROR;
  298.  
  299.                 {
  300.                     // Decoder ctor can AV on a malformed method header
  301.                     AVInRuntimeImplOkayHolder AVOkay;
  302.                     pHeader = new COR_ILMETHOD_DECODER(ilHeader, GetMDImport(), &status);
  303.                     if(pHeader == NULL)
  304.                         status = COR_ILMETHOD_DECODER::FORMAT_ERROR;
  305.                 }
  306.  
  307.                 if (status == COR_ILMETHOD_DECODER::VERIFICATION_ERROR &&
  308.                     Security::CanSkipVerification(GetModule()->GetDomainAssembly()))
  309.                 {
  310.                     status = COR_ILMETHOD_DECODER::SUCCESS;
  311.                 }
  312.  
  313.                 if (status != COR_ILMETHOD_DECODER::SUCCESS)
  314.                 {
  315.                     if (status == COR_ILMETHOD_DECODER::VERIFICATION_ERROR)
  316.                     {
  317.                         // Throw a verification HR
  318.                         COMPlusThrowHR(COR_E_VERIFICATION);
  319.                     }
  320.                     else
  321.                     {
  322.                         COMPlusThrowHR(COR_E_BADIMAGEFORMAT, BFA_BAD_IL);
  323.                     }
  324.                 }
  325.  
  326. #ifdef _VER_EE_VERIFICATION_ENABLED 
  327.                 static ConfigDWORD peVerify;
  328.  
  329.                 if (peVerify.val(CLRConfig::EXTERNAL_PEVerify))
  330.                     Verify(pHeader, TRUE, FALSE);   // Throws a VerifierException if verification fails
  331. #endif // _VER_EE_VERIFICATION_ENABLED
  332.             } // end if (!IsNoMetadata())
  333.  
  334.             // JIT it
  335.             LOG((LF_CLASSLOADER, LL_INFO1000000,
  336.                     "    In PreStubWorker, calling MakeJitWorker\n"));
  337.  
  338.             // Create the precode eagerly if it is going to be needed later.
  339.             if (!fBackpatch)
  340.             {
  341.                 GetOrCreatePrecode();
  342.             }
  343.  
  344.             // Mark the code as hot in case the method ends up in the native image
  345.             g_IBCLogger.LogMethodCodeAccess(this);
  346.  
  347.             pCode = MakeJitWorker(pHeader, 0, 0);
  348.  
  349. #ifdef FEATURE_INTERPRETER
  350.             if ((pCode != NULL) && !HasStableEntryPoint())
  351.             {
  352.                 // We don't yet have a stable entry point, so don't do backpatching yet.
  353.                 // But we do have to handle some extra cases that occur in backpatching.
  354.                 // (Perhaps I *should* get to the backpatching code, but in a mode where we know
  355.                 // we're not dealing with the stable entry point...)
  356.                 if (HasNativeCodeSlot())
  357.                 {
  358.                     // We called "SetNativeCodeInterlocked" in MakeJitWorker, which updated the native
  359.                     // code slot, but I think we also want to update the regular slot...
  360.                     PCODE tmpEntry = GetTemporaryEntryPoint();
  361.                     PCODE pFound = FastInterlockCompareExchangePointer(GetAddrOfSlot(), pCode, tmpEntry);
  362.                     // Doesn't matter if we failed -- if we did, it's because somebody else made progress.
  363.                     if (pFound != tmpEntry) pCode = pFound;
  364.                 }
  365.  
  366.                 // Now we handle the case of a FuncPtrPrecode.  
  367.                 FuncPtrStubs * pFuncPtrStubs = GetLoaderAllocator()->GetFuncPtrStubsNoCreate();
  368.                 if (pFuncPtrStubs != NULL)
  369.                 {
  370.                     Precode* pFuncPtrPrecode = pFuncPtrStubs->Lookup(this);
  371.                     if (pFuncPtrPrecode != NULL)
  372.                     {
  373.                         // If there is a funcptr precode to patch, attempt to patch it.  If we lose, that's OK,
  374.                         // somebody else made progress.
  375.                         pFuncPtrPrecode->SetTargetInterlocked(pCode);
  376.                     }
  377.                 }
  378.             }
  379. #endif // FEATURE_INTERPRETER
  380.         } // end if (pCode == NULL)
  381.     } // end else if (IsIL() || IsNoMetadata())
  382.     else if (IsNDirect())
  383.     {
  384.         if (!GetModule()->GetSecurityDescriptor()->CanCallUnmanagedCode())
  385.             Security::ThrowSecurityException(g_SecurityPermissionClassName, SPFLAGSUNMANAGEDCODE);
  386.  
  387.         pCode = GetStubForInteropMethod(this);
  388.         GetOrCreatePrecode();
  389.     }
  390.     else if (IsFCall())
  391.     {
  392.         // Get the fcall implementation
  393.         BOOL fSharedOrDynamicFCallImpl;
  394.         pCode = ECall::GetFCallImpl(this, &fSharedOrDynamicFCallImpl);
  395.  
  396.         if (fSharedOrDynamicFCallImpl)
  397.         {
  398.             // Fake ctors share one implementation that has to be wrapped by prestub
  399.             GetOrCreatePrecode();
  400.         }
  401.     }
  402.     else if (IsArray())
  403.     {
  404.         pStub = GenerateArrayOpStub((ArrayMethodDesc*)this);
  405.     }
  406.     else if (IsEEImpl())
  407.     {
  408.         _ASSERTE(GetMethodTable()->IsDelegate());
  409.         pCode = COMDelegate::GetInvokeMethodStub((EEImplMethodDesc*)this);
  410.         GetOrCreatePrecode();
  411.     }
  412.     else
  413.     {
  414.         // This is a method type we don't handle yet
  415.         _ASSERTE(!"Unknown Method Type");
  416.     }
  417.  
  418.     /**************************   POSTJIT *************************/
  419. #ifndef FEATURE_INTERPRETER
  420.     _ASSERTE(pCode == NULL || GetNativeCode() == NULL || pCode == GetNativeCode());
  421. #else // FEATURE_INTERPRETER
  422.     // Interpreter adds a new possiblity == someone else beat us to installing an intepreter stub.
  423.     _ASSERTE(pCode == NULL || GetNativeCode() == NULL || pCode == GetNativeCode()
  424.              || Interpreter::InterpretationStubToMethodInfo(pCode) == this);
  425. #endif // FEATURE_INTERPRETER
  426.  
  427.     // At this point we must have either a pointer to managed code or to a stub. All of the above code
  428.     // should have thrown an exception if it couldn't make a stub.
  429.     _ASSERTE((pStub != NULL) ^ (pCode != NULL));
  430.  
  431.     /**************************   SECURITY   *************************/
  432.  
  433.     // Lets check to see if we need declarative security on this stub, If we have
  434.     // security checks on this method or class then we need to add an intermediate
  435.     // stub that performs declarative checks prior to calling the real stub.
  436.     // record if security needs to intercept this call (also depends on whether we plan to use stubs for declarative security)
  437.  
  438. #if !defined( HAS_REMOTING_PRECODE) && defined (FEATURE_REMOTING)
  439.     /**************************   REMOTING   *************************/
  440.  
  441.     // check for MarshalByRef scenarios ... we need to intercept
  442.     // Non-virtual calls on MarshalByRef types
  443.     if (fRemotingIntercepted)
  444.     {
  445.         // let us setup a remoting stub to intercept all the calls
  446.         Stub *pRemotingStub = CRemotingServices::GetStubForNonVirtualMethod(this, 
  447.             (pStub != NULL) ? (LPVOID)pStub->GetEntryPoint() : (LPVOID)pCode, pStub);
  448.         
  449.         if (pRemotingStub != NULL)
  450.         {
  451.             pStub = pRemotingStub;
  452.             pCode = NULL;
  453.         }
  454.     }
  455. #endif // HAS_REMOTING_PRECODE
  456.  
  457.     _ASSERTE((pStub != NULL) ^ (pCode != NULL));
  458.  
  459. #if defined(_TARGET_X86_) || defined(_TARGET_AMD64_)
  460.     //
  461.     // We are seeing memory reordering race around fixups (see DDB 193514 and related bugs). We get into
  462.     // situation where the patched precode is visible by other threads, but the resolved fixups 
  463.     // are not. IT SHOULD NEVER HAPPEN according to our current understanding of x86/x64 memory model.
  464.     // (see email thread attached to the bug for details).
  465.     //
  466.     // We suspect that there may be bug in the hardware or that hardware may have shortcuts that may be 
  467.     // causing grief. We will try to avoid the race by executing an extra memory barrier.
  468.     //
  469.     MemoryBarrier();
  470. #endif
  471.  
  472.     if (pCode != NULL)
  473.     {
  474.         if (HasPrecode())
  475.             GetPrecode()->SetTargetInterlocked(pCode);
  476.         else
  477.         if (!HasStableEntryPoint())
  478.         {
  479.             // Is the result an interpreter stub?
  480. #ifdef FEATURE_INTERPRETER
  481.             if (Interpreter::InterpretationStubToMethodInfo(pCode) == this)
  482.             {
  483.                 SetEntryPointInterlocked(pCode);
  484.             }
  485.             else
  486. #endif // FEATURE_INTERPRETER
  487.             {
  488.                 SetStableEntryPointInterlocked(pCode);
  489.             }
  490.         }
  491.     }
  492.     else
  493.     {
  494.         if (!GetOrCreatePrecode()->SetTargetInterlocked(pStub->GetEntryPoint()))
  495.         {
  496.             pStub->DecRef();
  497.         }
  498.         else
  499.         if (pStub->HasExternalEntryPoint())
  500.         {
  501.             // If the Stub wraps code that is outside of the Stub allocation, then we
  502.             // need to free the Stub allocation now.
  503.             pStub->DecRef();
  504.         }
  505.     }
  506.  
  507. #ifdef FEATURE_INTERPRETER
  508.     _ASSERTE(!IsReallyPointingToPrestub());
  509. #else // FEATURE_INTERPRETER
  510.     _ASSERTE(!IsPointingToPrestub());
  511.     _ASSERTE(HasStableEntryPoint());
  512. #endif // FEATURE_INTERPRETER
  513.  
  514.     if (fReportCompilationFinished)
  515.         DACNotifyCompilationFinished(this);
  516.  
  517.     RETURN DoBackpatch(pMT, pDispatchingMT, FALSE);
  518. }

这个函数比较长, 我们只需要关注两个地方:

pCode = MakeJitWorker(pHeader, 0, 0);

MakeJitWorker会调用JIT编译函数, pCode是编译后的机器代码地址.

  1. if (HasPrecode())
  2.     GetPrecode()->SetTargetInterlocked(pCode);

SetTargetInterlocked会对Precode打补丁, 第二次调用函数时会直接跳转到编译结果.

MakeJitWorker的源代码如下:

  1. PCODE MethodDesc::MakeJitWorker(COR_ILMETHOD_DECODER* ILHeader, DWORD flags, DWORD flags2)
  2. {
  3.     STANDARD_VM_CONTRACT;
  4.  
  5.     BOOL fIsILStub = IsILStub();        // @TODO: understand the need for this special case
  6.  
  7.     LOG((LF_JIT, LL_INFO1000000,
  8.          "MakeJitWorker(" FMT_ADDR ", %s) for %s:%s\n",
  9.          DBG_ADDR(this),
  10.          fIsILStub               ? " TRUE" : "FALSE",
  11.          GetMethodTable()->GetDebugClassName(),
  12.          m_pszDebugMethodName));
  13.  
  14.     PCODE pCode = NULL;
  15.     ULONG sizeOfCode = 0;
  16. #ifdef FEATURE_INTERPRETER
  17.     PCODE pPreviousInterpStub = NULL;
  18.     BOOL fInterpreted = FALSE;
  19.     BOOL fStable = TRUE;  // True iff the new code address (to be stored in pCode), is a stable entry point.
  20. #endif
  21.  
  22. #ifdef FEATURE_MULTICOREJIT
  23.     MulticoreJitManager & mcJitManager = GetAppDomain()->GetMulticoreJitManager();
  24.  
  25.     bool fBackgroundThread = (flags & CORJIT_FLG_MCJIT_BACKGROUND) != 0;
  26. #endif
  27.  
  28.     {
  29.         // Enter the global lock which protects the list of all functions being JITd
  30.         ListLockHolder pJitLock (GetDomain()->GetJitLock());
  31.  
  32.         // It is possible that another thread stepped in before we entered the global lock for the first time.
  33.         pCode = GetNativeCode();
  34.         if (pCode != NULL)
  35.         {
  36. #ifdef FEATURE_INTERPRETER
  37.             if (Interpreter::InterpretationStubToMethodInfo(pCode) == this)
  38.             {
  39.                 pPreviousInterpStub = pCode;
  40.             }
  41.             else
  42. #endif // FEATURE_INTERPRETER
  43.             goto Done;
  44.         }
  45.  
  46.         const char *description = "jit lock";
  47.         INDEBUG(description = m_pszDebugMethodName;)
  48.         ListLockEntryHolder pEntry(ListLockEntry::Find(pJitLock, this, description));
  49.  
  50.         // We have an entry now, we can release the global lock
  51.         pJitLock.Release();
  52.  
  53.         // Take the entry lock
  54.         {
  55.             ListLockEntryLockHolder pEntryLock(pEntry, FALSE);
  56.  
  57.             if (pEntryLock.DeadlockAwareAcquire())
  58.             {
  59.                 if (pEntry->m_hrResultCode == S_FALSE)
  60.                 {
  61.                     // Nobody has jitted the method yet
  62.                 }
  63.                 else
  64.                 {
  65.                     // We came in to jit but someone beat us so return the
  66.                     // jitted method!
  67.  
  68.                     // We can just fall through because we will notice below that
  69.                     // the method has code.
  70.  
  71.                     // @todo: Note that we may have a failed HRESULT here -
  72.                     // we might want to return an early error rather than
  73.                     // repeatedly failing the jit.
  74.                 }
  75.             }
  76.             else
  77.             {
  78.                 // Taking this lock would cause a deadlock (presumably because we
  79.                 // are involved in a class constructor circular dependency.)  For
  80.                 // instance, another thread may be waiting to run the class constructor
  81.                 // that we are jitting, but is currently jitting this function.
  82.                 //
  83.                 // To remedy this, we want to go ahead and do the jitting anyway.
  84.                 // The other threads contending for the lock will then notice that
  85.                 // the jit finished while they were running class constructors, and abort their
  86.                 // current jit effort.
  87.                 //
  88.                 // We don't have to do anything special right here since we
  89.                 // can check HasNativeCode() to detect this case later.
  90.                 //
  91.                 // Note that at this point we don't have the lock, but that's OK because the
  92.                 // thread which does have the lock is blocked waiting for us.
  93.             }
  94.  
  95.             // It is possible that another thread stepped in before we entered the lock.
  96.             pCode = GetNativeCode();
  97. #ifdef FEATURE_INTERPRETER
  98.             if (pCode != NULL && (pCode != pPreviousInterpStub))
  99. #else
  100.             if (pCode != NULL)
  101. #endif // FEATURE_INTERPRETER
  102.             {
  103.                 goto Done;
  104.             }
  105.  
  106.             SString namespaceOrClassName, methodName, methodSignature;
  107.  
  108.             PCODE pOtherCode = NULL; // Need to move here due to 'goto GotNewCode'
  109.             
  110. #ifdef FEATURE_MULTICOREJIT
  111.  
  112.             bool fCompiledInBackground = false;
  113.  
  114.             // If not called from multi-core JIT thread, 
  115.             if (! fBackgroundThread)
  116.             {
  117.                 // Quick check before calling expensive out of line function on this method's domain has code JITted by background thread
  118.                 if (mcJitManager.GetMulticoreJitCodeStorage().GetRemainingMethodCount() > 0)
  119.                 {
  120.                     if (MulticoreJitManager::IsMethodSupported(this))
  121.                     {
  122.                         pCode = mcJitManager.RequestMethodCode(this); // Query multi-core JIT manager for compiled code
  123.  
  124.                         // Multicore JIT manager starts background thread to pre-compile methods, but it does not back-patch it/notify profiler/notify DAC,
  125.                         // Jumtp to GotNewCode to do so
  126.                         if (pCode != NULL)
  127.                         {
  128.                             fCompiledInBackground = true;
  129.                     
  130. #ifdef DEBUGGING_SUPPORTED
  131.                             // Notify the debugger of the jitted function
  132.                             if (g_pDebugInterface != NULL)
  133.                             {
  134.                                 g_pDebugInterface->JITComplete(this, pCode);
  135.                             }
  136. #endif
  137.  
  138.                             goto GotNewCode;
  139.                         }
  140.                     }
  141.                 }
  142.             }
  143. #endif
  144.  
  145.             if (fIsILStub)
  146.             {
  147.                 // we race with other threads to JIT the code for an IL stub and the
  148.                 // IL header is released once one of the threads completes.  As a result
  149.                 // we must be inside the lock to reliably get the IL header for the
  150.                 // stub.
  151.  
  152.                 ILStubResolver* pResolver = AsDynamicMethodDesc()->GetILStubResolver();
  153.                 ILHeader = pResolver->GetILHeader();
  154.             }
  155.  
  156. #ifdef MDA_SUPPORTED 
  157.             MdaJitCompilationStart* pProbe = MDA_GET_ASSISTANT(JitCompilationStart);
  158.             if (pProbe)
  159.                 pProbe->NowCompiling(this);
  160. #endif // MDA_SUPPORTED
  161.  
  162. #ifdef PROFILING_SUPPORTED 
  163.             // If profiling, need to give a chance for a tool to examine and modify
  164.             // the IL before it gets to the JIT.  This allows one to add probe calls for
  165.             // things like code coverage, performance, or whatever.
  166.             {
  167.                 BEGIN_PIN_PROFILER(CORProfilerTrackJITInfo());
  168.  
  169.                 // Multicore JIT should be disabled when CORProfilerTrackJITInfo is on
  170.                 // But there could be corner case in which profiler is attached when multicore background thread is calling MakeJitWorker
  171.                 // Disable this block when calling from multicore JIT background thread
  172.                 if (!IsNoMetadata()
  173. #ifdef FEATURE_MULTICOREJIT
  174.  
  175.                     && (! fBackgroundThread)
  176. #endif
  177.                     )
  178.                 {
  179.                     g_profControlBlock.pProfInterface->JITCompilationStarted((FunctionID) this, TRUE);
  180.                     // The profiler may have changed the code on the callback.  Need to
  181.                     // pick up the new code.  Note that you have to be fully trusted in
  182.                     // this mode and the code will not be verified.
  183.                     COR_ILMETHOD *pilHeader = GetILHeader(TRUE);
  184.                     new (ILHeader) COR_ILMETHOD_DECODER(pilHeader, GetMDImport(), NULL);
  185.                 }
  186.                 END_PIN_PROFILER();
  187.             }
  188. #endif // PROFILING_SUPPORTED
  189. #ifdef FEATURE_INTERPRETER
  190.             // We move the ETW event for start of JITting inward, after we make the decision
  191.             // to JIT rather than interpret.
  192. #else  // FEATURE_INTERPRETER
  193.             // Fire an ETW event to mark the beginning of JIT'ing
  194.             ETW::MethodLog::MethodJitting(this, &namespaceOrClassName, &methodName, &methodSignature);
  195. #endif  // FEATURE_INTERPRETER
  196.  
  197. #ifdef FEATURE_STACK_SAMPLING
  198. #ifdef FEATURE_MULTICOREJIT
  199.             if (!fBackgroundThread)
  200. #endif // FEATURE_MULTICOREJIT
  201.             {
  202.                 StackSampler::RecordJittingInfo(this, flags, flags2);
  203.             }
  204. #endif // FEATURE_STACK_SAMPLING
  205.  
  206.             EX_TRY
  207.             {
  208.                 pCode = UnsafeJitFunction(this, ILHeader, flags, flags2, &sizeOfCode);
  209.             }
  210.             EX_CATCH
  211.             {
  212.                 // If the current thread threw an exception, but a competing thread
  213.                 // somehow succeeded at JITting the same function (e.g., out of memory
  214.                 // encountered on current thread but not competing thread), then go ahead
  215.                 // and swallow this current thread's exception, since we somehow managed
  216.                 // to successfully JIT the code on the other thread.
  217.                 // 
  218.                 // Note that if a deadlock cycle is broken, that does not result in an
  219.                 // exception--the thread would just pass through the lock and JIT the
  220.                 // function in competition with the other thread (with the winner of the
  221.                 // race decided later on when we do SetNativeCodeInterlocked). This
  222.                 // try/catch is purely to deal with the (unusual) case where a competing
  223.                 // thread succeeded where we aborted.
  224.                 
  225.                 pOtherCode = GetNativeCode();
  226.                 
  227.                 if (pOtherCode == NULL)
  228.                 {
  229.                     pEntry->m_hrResultCode = E_FAIL;
  230.                     EX_RETHROW;
  231.                 }
  232.             }
  233.             EX_END_CATCH(RethrowTerminalExceptions)
  234.  
  235.             if (pOtherCode != NULL)
  236.             {
  237.                 // Somebody finished jitting recursively while we were jitting the method.
  238.                 // Just use their method & leak the one we finished. (Normally we hope
  239.                 // not to finish our JIT in this case, as we will abort early if we notice
  240.                 // a reentrant jit has occurred.  But we may not catch every place so we
  241.                 // do a definitive final check here.
  242.                 pCode = pOtherCode;
  243.                 goto Done;
  244.             }
  245.  
  246.             _ASSERTE(pCode != NULL);
  247.  
  248. #ifdef HAVE_GCCOVER
  249.             if (GCStress<cfg_instr_jit>::IsEnabled())
  250.             {
  251.                 SetupGcCoverage(this, (BYTE*) pCode);
  252.             }
  253. #endif // HAVE_GCCOVER
  254.  
  255. #ifdef FEATURE_INTERPRETER
  256.             // Determine whether the new code address is "stable"...= is not an interpreter stub.
  257.             fInterpreted = (Interpreter::InterpretationStubToMethodInfo(pCode) == this);
  258.             fStable = !fInterpreted;
  259. #endif // FEATURE_INTERPRETER
  260.  
  261. #ifdef FEATURE_MULTICOREJIT
  262.             
  263.             // If called from multi-core JIT background thread, store code under lock, delay patching until code is queried from application threads
  264.             if (fBackgroundThread)
  265.             {
  266.                 // Fire an ETW event to mark the end of JIT'ing
  267.                 ETW::MethodLog::MethodJitted(this, &namespaceOrClassName, &methodName, &methodSignature, pCode, 0 /* ReJITID */);
  268.  
  269. #ifdef FEATURE_PERFMAP
  270.                 // Save the JIT'd method information so that perf can resolve JIT'd call frames.
  271.                 PerfMap::LogJITCompiledMethod(this, pCode, sizeOfCode);
  272. #endif
  273.                 
  274.                 mcJitManager.GetMulticoreJitCodeStorage().StoreMethodCode(this, pCode);
  275.                 
  276.                 goto Done;
  277.             }
  278.  
  279. GotNewCode:
  280. #endif
  281.             // If this function had already been requested for rejit (before its original
  282.             // code was jitted), then give the rejit manager a chance to jump-stamp the
  283.             // code we just compiled so the first thread entering the function will jump
  284.             // to the prestub and trigger the rejit. Note that the PublishMethodHolder takes
  285.             // a lock to avoid a particular kind of rejit race. See
  286.             // code:ReJitManager::PublishMethodHolder::PublishMethodHolder#PublishCode for
  287.             // details on the rejit race.
  288.             // 
  289.             // Aside from rejit, performing a SetNativeCodeInterlocked at this point
  290.             // generally ensures that there is only one winning version of the native
  291.             // code. This also avoid races with profiler overriding ngened code (see
  292.             // matching SetNativeCodeInterlocked done after
  293.             // JITCachedFunctionSearchStarted)
  294. #ifdef FEATURE_INTERPRETER
  295.             PCODE pExpected = pPreviousInterpStub;
  296.             if (pExpected == NULL) pExpected = GetTemporaryEntryPoint();
  297. #endif
  298.             {
  299.                 ReJitPublishMethodHolder publishWorker(this, pCode);
  300.                 if (!SetNativeCodeInterlocked(pCode
  301. #ifdef FEATURE_INTERPRETER
  302.                     , pExpected, fStable
  303. #endif
  304.                     ))
  305.                 {
  306.                     // Another thread beat us to publishing its copy of the JITted code.
  307.                     pCode = GetNativeCode();
  308.                     goto Done;
  309.                 }
  310.             }
  311.  
  312. #ifdef FEATURE_INTERPRETER
  313.             // State for dynamic methods cannot be freed if the method was ever interpreted,
  314.             // since there is no way to ensure that it is not in use at the moment.
  315.             if (IsDynamicMethod() && !fInterpreted && (pPreviousInterpStub == NULL))
  316.             {
  317.                 AsDynamicMethodDesc()->GetResolver()->FreeCompileTimeState();
  318.             }
  319. #endif // FEATURE_INTERPRETER
  320.  
  321.             // We succeeded in jitting the code, and our jitted code is the one that's going to run now.
  322.             pEntry->m_hrResultCode = S_OK;
  323.  
  324.  #ifdef PROFILING_SUPPORTED 
  325.             // Notify the profiler that JIT completed.
  326.             // Must do this after the address has been set.
  327.             // @ToDo: Why must we set the address before notifying the profiler ??
  328.             //        Note that if IsInterceptedForDeclSecurity is set no one should access the jitted code address anyway.
  329.             {
  330.                 BEGIN_PIN_PROFILER(CORProfilerTrackJITInfo());
  331.                 if (!IsNoMetadata())
  332.                 {
  333.                     g_profControlBlock.pProfInterface->
  334.                         JITCompilationFinished((FunctionID) this,
  335.                                                 pEntry->m_hrResultCode, 
  336.                                                 TRUE);
  337.                 }
  338.                 END_PIN_PROFILER();
  339.             }
  340. #endif // PROFILING_SUPPORTED
  341.  
  342. #ifdef FEATURE_MULTICOREJIT
  343.             if (! fCompiledInBackground)
  344. #endif
  345. #ifdef FEATURE_INTERPRETER
  346.             // If we didn't JIT, but rather, created an interpreter stub (i.e., fStable is false), don't tell ETW that we did.
  347.             if (fStable)
  348. #endif // FEATURE_INTERPRETER
  349.             {
  350.                 // Fire an ETW event to mark the end of JIT'ing
  351.                 ETW::MethodLog::MethodJitted(this, &namespaceOrClassName, &methodName, &methodSignature, pCode, 0 /* ReJITID */);
  352.  
  353. #ifdef FEATURE_PERFMAP
  354.                 // Save the JIT'd method information so that perf can resolve JIT'd call frames.
  355.                 PerfMap::LogJITCompiledMethod(this, pCode, sizeOfCode);
  356. #endif
  357.             }
  358.  
  359.  
  360. #ifdef FEATURE_MULTICOREJIT
  361.  
  362.             // If not called from multi-core JIT thread, not got code from storage, quick check before calling out of line function
  363.             if (! fBackgroundThread && ! fCompiledInBackground && mcJitManager.IsRecorderActive())
  364.             {
  365.                 if (MulticoreJitManager::IsMethodSupported(this))
  366.                 {
  367.                     mcJitManager.RecordMethodJit(this); // Tell multi-core JIT manager to record method on successful JITting
  368.                 }
  369.             }
  370. #endif
  371.  
  372.             if (!fIsILStub)
  373.             {
  374.                 // The notification will only occur if someone has registered for this method.
  375.                 DACNotifyCompilationFinished(this);
  376.             }
  377.         }
  378.     }
  379.  
  380. Done:
  381.  
  382.     // We must have a code by now.
  383.     _ASSERTE(pCode != NULL);
  384.  
  385.     LOG((LF_CORDB, LL_EVERYTHING, "MethodDesc::MakeJitWorker finished. Stub is" FMT_ADDR "\n",
  386.          DBG_ADDR(pCode)));
  387.  
  388.     return pCode;
  389. }

这个函数是线程安全的JIT函数,
如果多个线程编译同一个函数, 其中一个线程会执行编译, 其他线程会等待编译完成.
每个AppDomain会有一个锁的集合, 一个正在编译的函数拥有一个ListLockEntry对象,
函数首先会对集合上锁, 获取或者创建函数对应的ListLockEntry, 然后释放对集合的锁,
这个时候所有线程对同一个函数都会获取到同一个ListLockEntry, 然后再对ListLockEntry上锁.
上锁后调用非线程安全的JIT函数:

pCode = UnsafeJitFunction(this, ILHeader, flags, flags2, &sizeOfCode)

接下来还有几层调用才会到JIT主函数, 我只简单说明他们的处理:

UnsafeJitFunction

这个函数会创建CEEJitInfo(JIT层给EE层反馈使用的类)的实例, 从函数信息中获取编译标志(是否以Debug模式编译),
调用CallCompileMethodWithSEHWrapper, 并且在相对地址溢出时禁止使用相对地址(fAllowRel32)然后重试编译.

CallCompileMethodWithSEHWrapper

这个函数会在try中调用invokeCompileMethod.

invokeCompileMethod

这个函数让当前线程进入Preemptive模式(GC可以不用挂起当前线程), 然后调用invokeCompileMethodHelper.

invokeCompileMethodHelper

这个函数一般情况下会调用jitMgr->m_jit->compileMethod.

CILJit::compileMethod

这个函数一般情况下会调用jitNativeCode.

jitNativeCode

创建和初始化Compiler的实例, 并调用pParam->pComp->compCompile(7参数版).
内联时也会从这个函数开始调用, 如果是内联则Compiler实例会在第一次创建后复用.
Compiler负责单个函数的整个JIT过程.

Compiler::compCompile(7参数版)

这个函数会对Compiler实例做出一些初始化处理, 然后调用Compiler::compCompileHelper.

compCompileHelper

这个函数会先创建本地变量表lvaTable和BasicBlock的链表,
必要时添加一个内部使用的block(BB01), 然后解析IL代码添加更多的block, 具体将在下面说明.
然后调用compCompile(3参数版).

compCompile(3参数版)

这就是JIT的主函数, 这个函数负责调用JIT各个阶段的工作, 具体将在下面说明.

创建本地变量表

compCompileHelper会调用lvaInitTypeRef,
lvaInitTypeRef会创建本地变量表, 源代码如下:

  1. void Compiler::lvaInitTypeRef()
  2. {
  3.  
  4.     /* x86 args look something like this:
  5.         [this ptr] [hidden return buffer] [declared arguments]* [generic context] [var arg cookie]
  7.        x64 is closer to the native ABI:
  8.         [this ptr] [hidden return buffer] [generic context] [var arg cookie] [declared arguments]*
  9.         (Note: prior to .NET Framework 4.5.1 for Windows 8.1 (but not .NET Framework 4.5.1 "downlevel"),
  10.         the "hidden return buffer" came before the "this ptr". Now, the "this ptr" comes first. This
  11.         is different from the C++ order, where the "hidden return buffer" always comes first.)
  13.        ARM and ARM64 are the same as the current x64 convention:
  14.         [this ptr] [hidden return buffer] [generic context] [var arg cookie] [declared arguments]*
  16.        Key difference:
  17.            The var arg cookie and generic context are swapped with respect to the user arguments
  18.     */
  19.  
  20.     /* Set compArgsCount and compLocalsCount */
  21.  
  22.     info.compArgsCount = info.compMethodInfo->args.numArgs;
  23.  
  24.     // Is there a 'this' pointer
  25.  
  26.     if (!info.compIsStatic)
  27.     {
  28.         info.compArgsCount++;
  29.     }
  30.     else
  31.     {
  32.         info.compThisArg = BAD_VAR_NUM;
  33.     }
  34.  
  35.     info.compILargsCount = info.compArgsCount;
  36.  
  37. #ifdef FEATURE_SIMD
  38.     if (featureSIMD && (info.compRetNativeType == TYP_STRUCT))
  39.     {
  40.         var_types structType = impNormStructType(info.compMethodInfo->args.retTypeClass);
  41.         info.compRetType     = structType;
  42.     }
  43. #endif // FEATURE_SIMD
  44.  
  45.     // Are we returning a struct using a return buffer argument?
  46.     //
  47.     const bool hasRetBuffArg = impMethodInfo_hasRetBuffArg(info.compMethodInfo);
  48.  
  49.     // Possibly change the compRetNativeType from TYP_STRUCT to a "primitive" type
  50.     // when we are returning a struct by value and it fits in one register
  51.     //
  52.     if (!hasRetBuffArg && varTypeIsStruct(info.compRetNativeType))
  53.     {
  54.         CORINFO_CLASS_HANDLE retClsHnd = info.compMethodInfo->args.retTypeClass;
  55.  
  56.         Compiler::structPassingKind howToReturnStruct;
  57.         var_types                   returnType = getReturnTypeForStruct(retClsHnd, &howToReturnStruct);
  58.  
  59.         if (howToReturnStruct == SPK_PrimitiveType)
  60.         {
  61.             assert(returnType != TYP_UNKNOWN);
  62.             assert(returnType != TYP_STRUCT);
  63.  
  64.             info.compRetNativeType = returnType;
  65.  
  66.             // ToDo: Refactor this common code sequence into its own method as it is used 4+ times
  67.             if ((returnType == TYP_LONG) && (compLongUsed == false))
  68.             {
  69.                 compLongUsed = true;
  70.             }
  71.             else if (((returnType == TYP_FLOAT) || (returnType == TYP_DOUBLE)) && (compFloatingPointUsed == false))
  72.             {
  73.                 compFloatingPointUsed = true;
  74.             }
  75.         }
  76.     }
  77.  
  78.     // Do we have a RetBuffArg?
  79.  
  80.     if (hasRetBuffArg)
  81.     {
  82.         info.compArgsCount++;
  83.     }
  84.     else
  85.     {
  86.         info.compRetBuffArg = BAD_VAR_NUM;
  87.     }
  88.  
  89.     /* There is a 'hidden' cookie pushed last when the
  90.        calling convention is varargs */
  91.  
  92.     if (info.compIsVarArgs)
  93.     {
  94.         info.compArgsCount++;
  95.     }
  96.  
  97.     // Is there an extra parameter used to pass instantiation info to
  98.     // shared generic methods and shared generic struct instance methods?
  99.     if (info.compMethodInfo->args.callConv & CORINFO_CALLCONV_PARAMTYPE)
  100.     {
  101.         info.compArgsCount++;
  102.     }
  103.     else
  104.     {
  105.         info.compTypeCtxtArg = BAD_VAR_NUM;
  106.     }
  107.  
  108.     lvaCount = info.compLocalsCount = info.compArgsCount + info.compMethodInfo->locals.numArgs;
  109.  
  110.     info.compILlocalsCount = info.compILargsCount + info.compMethodInfo->locals.numArgs;
  111.  
  112.     /* Now allocate the variable descriptor table */
  113.  
  114.     if (compIsForInlining())
  115.     {
  116.         lvaTable    = impInlineInfo->InlinerCompiler->lvaTable;
  117.         lvaCount    = impInlineInfo->InlinerCompiler->lvaCount;
  118.         lvaTableCnt = impInlineInfo->InlinerCompiler->lvaTableCnt;
  119.  
  120.         // No more stuff needs to be done.
  121.         return;
  122.     }
  123.  
  124.     lvaTableCnt = lvaCount * 2;
  125.  
  126.     if (lvaTableCnt < 16)
  127.     {
  128.         lvaTableCnt = 16;
  129.     }
  130.  
  131.     lvaTable         = (LclVarDsc*)compGetMemArray(lvaTableCnt, sizeof(*lvaTable), CMK_LvaTable);
  132.     size_t tableSize = lvaTableCnt * sizeof(*lvaTable);
  133.     memset(lvaTable, 0, tableSize);
  134.     for (unsigned i = 0; i < lvaTableCnt; i++)
  135.     {
  136.         new (&lvaTable[i], jitstd::placement_t()) LclVarDsc(this); // call the constructor.
  137.     }
  138.  
  139.     //-------------------------------------------------------------------------
  140.     // Count the arguments and initialize the respective lvaTable[] entries
  141.     //
  142.     // First the implicit arguments
  143.     //-------------------------------------------------------------------------
  144.  
  145.     InitVarDscInfo varDscInfo;
  146.     varDscInfo.Init(lvaTable, hasRetBuffArg);
  147.  
  148.     lvaInitArgs(&varDscInfo);
  149.  
  150.     //-------------------------------------------------------------------------
  151.     // Finally the local variables
  152.     //-------------------------------------------------------------------------
  153.  
  154.     unsigned                varNum    = varDscInfo.varNum;
  155.     LclVarDsc*              varDsc    = varDscInfo.varDsc;
  156.     CORINFO_ARG_LIST_HANDLE localsSig = info.compMethodInfo->locals.args;
  157.  
  158.     for (unsigned i = 0; i < info.compMethodInfo->locals.numArgs;
  159.          i++, varNum++, varDsc++, localsSig = info.compCompHnd->getArgNext(localsSig))
  160.     {
  161.         CORINFO_CLASS_HANDLE typeHnd;
  162.         CorInfoTypeWithMod   corInfoType =
  163.             info.compCompHnd->getArgType(&info.compMethodInfo->locals, localsSig, &typeHnd);
  164.         lvaInitVarDsc(varDsc, varNum, strip(corInfoType), typeHnd, localsSig, &info.compMethodInfo->locals);
  165.  
  166.         varDsc->lvPinned  = ((corInfoType & CORINFO_TYPE_MOD_PINNED) != 0);
  167.         varDsc->lvOnFrame = true; // The final home for this local variable might be our local stack frame
  168.     }
  169.  
  170.     if ( // If there already exist unsafe buffers, don't mark more structs as unsafe
  171.         // as that will cause them to be placed along with the real unsafe buffers,
  172.         // unnecessarily exposing them to overruns. This can affect GS tests which
  173.         // intentionally do buffer-overruns.
  174.         !getNeedsGSSecurityCookie() &&
  175.         // GS checks require the stack to be re-ordered, which can't be done with EnC
  176.         !opts.compDbgEnC && compStressCompile(STRESS_UNSAFE_BUFFER_CHECKS, 25))
  177.     {
  178.         setNeedsGSSecurityCookie();
  179.         compGSReorderStackLayout = true;
  180.  
  181.         for (unsigned i = 0; i < lvaCount; i++)
  182.         {
  183.             if ((lvaTable[i].lvType == TYP_STRUCT) && compStressCompile(STRESS_GENERIC_VARN, 60))
  184.             {
  185.                 lvaTable[i].lvIsUnsafeBuffer = true;
  186.             }
  187.         }
  188.     }
  189.  
  190.     if (getNeedsGSSecurityCookie())
  191.     {
  192.         // Ensure that there will be at least one stack variable since
  193.         // we require that the GSCookie does not have a 0 stack offset.
  194.         unsigned dummy         = lvaGrabTempWithImplicitUse(false DEBUGARG("GSCookie dummy"));
  195.         lvaTable[dummy].lvType = TYP_INT;
  196.     }
  197.  
  198. #ifdef DEBUG
  199.     if (verbose)
  200.     {
  201.         lvaTableDump(INITIAL_FRAME_LAYOUT);
  202.     }
  203. #endif
  204. }

初始的本地变量数量是info.compArgsCount + info.compMethodInfo->locals.numArgs, 也就是IL中的参数数量+IL中的本地变量数量.
因为后面可能会添加更多的临时变量, 本地变量表的储存采用了length+capacity的方式,
本地变量表的指针是lvaTable, 当前长度是lvaCount, 最大长度是lvaTableCnt.
本地变量表的开头部分会先保存IL中的参数变量, 随后才是IL中的本地变量,
例如有3个参数, 2个本地变量时, 本地变量表是[参数0, 参数1, 参数2, 变量0, 变量1, 空, 空, 空, ... ].

此外如果对当前函数的编译是为了内联, 本地变量表会使用调用端(callsite)的对象.

根据IL创建BasicBlock

在进入JIT的主函数之前, compCompileHelper会先解析IL并且根据指令创建BasicBlock.
在上一篇中也提到过,
BasicBlock是内部不包含跳转的逻辑块, 跳转指令原则只出现在block的最后, 同时跳转目标只能是block的开头.

创建BasicBlock的逻辑在函数fgFindBasicBlocks, 我们来看看它的源代码:

  1. /*****************************************************************************
  2.  *
  3.  *  Main entry point to discover the basic blocks for the current function.
  4.  */
  5.  
  6. void Compiler::fgFindBasicBlocks()
  7. {
  8. #ifdef DEBUG
  9.     if (verbose)
  10.     {
  11.         printf("*************** In fgFindBasicBlocks() for %s\n", info.compFullName);
  12.     }
  13. #endif
  14.  
  15.     /* Allocate the 'jump target' vector
  16.      *
  17.      *  We need one extra byte as we mark
  18.      *  jumpTarget[info.compILCodeSize] with JT_ADDR
  19.      *  when we need to add a dummy block
  20.      *  to record the end of a try or handler region.
  21.      */
  22.     BYTE* jumpTarget = new (this, CMK_Unknown) BYTE[info.compILCodeSize + 1];
  23.     memset(jumpTarget, JT_NONE, info.compILCodeSize + 1);
  24.     noway_assert(JT_NONE == 0);
  25.  
  26.     /* Walk the instrs to find all jump targets */
  27.  
  28.     fgFindJumpTargets(info.compCode, info.compILCodeSize, jumpTarget);
  29.     if (compDonotInline())
  30.     {
  31.         return;
  32.     }
  33.  
  34.     unsigned XTnum;
  35.  
  36.     /* Are there any exception handlers? */
  37.  
  38.     if (info.compXcptnsCount > 0)
  39.     {
  40.         noway_assert(!compIsForInlining());
  41.  
  42.         /* Check and mark all the exception handlers */
  43.  
  44.         for (XTnum = 0; XTnum < info.compXcptnsCount; XTnum++)
  45.         {
  46.             DWORD             tmpOffset;
  47.             CORINFO_EH_CLAUSE clause;
  48.             info.compCompHnd->getEHinfo(info.compMethodHnd, XTnum, &clause);
  49.             noway_assert(clause.HandlerLength != (unsigned)-1);
  50.  
  51.             if (clause.TryLength <= 0)
  52.             {
  53.                 BADCODE("try block length <=0");
  54.             }
  55.  
  56.             /* Mark the 'try' block extent and the handler itself */
  57.  
  58.             if (clause.TryOffset > info.compILCodeSize)
  59.             {
  60.                 BADCODE("try offset is > codesize");
  61.             }
  62.             if (jumpTarget[clause.TryOffset] == JT_NONE)
  63.             {
  64.                 jumpTarget[clause.TryOffset] = JT_ADDR;
  65.             }
  66.  
  67.             tmpOffset = clause.TryOffset + clause.TryLength;
  68.             if (tmpOffset > info.compILCodeSize)
  69.             {
  70.                 BADCODE("try end is > codesize");
  71.             }
  72.             if (jumpTarget[tmpOffset] == JT_NONE)
  73.             {
  74.                 jumpTarget[tmpOffset] = JT_ADDR;
  75.             }
  76.  
  77.             if (clause.HandlerOffset > info.compILCodeSize)
  78.             {
  79.                 BADCODE("handler offset > codesize");
  80.             }
  81.             if (jumpTarget[clause.HandlerOffset] == JT_NONE)
  82.             {
  83.                 jumpTarget[clause.HandlerOffset] = JT_ADDR;
  84.             }
  85.  
  86.             tmpOffset = clause.HandlerOffset + clause.HandlerLength;
  87.             if (tmpOffset > info.compILCodeSize)
  88.             {
  89.                 BADCODE("handler end > codesize");
  90.             }
  91.             if (jumpTarget[tmpOffset] == JT_NONE)
  92.             {
  93.                 jumpTarget[tmpOffset] = JT_ADDR;
  94.             }
  95.  
  96.             if (clause.Flags & CORINFO_EH_CLAUSE_FILTER)
  97.             {
  98.                 if (clause.FilterOffset > info.compILCodeSize)
  99.                 {
  100.                     BADCODE("filter offset > codesize");
  101.                 }
  102.                 if (jumpTarget[clause.FilterOffset] == JT_NONE)
  103.                 {
  104.                     jumpTarget[clause.FilterOffset] = JT_ADDR;
  105.                 }
  106.             }
  107.         }
  108.     }
  109.  
  110. #ifdef DEBUG
  111.     if (verbose)
  112.     {
  113.         bool anyJumpTargets = false;
  114.         printf("Jump targets:\n");
  115.         for (unsigned i = 0; i < info.compILCodeSize + 1; i++)
  116.         {
  117.             if (jumpTarget[i] == JT_NONE)
  118.             {
  119.                 continue;
  120.             }
  121.  
  122.             anyJumpTargets = true;
  123.             printf("  IL_%04x", i);
  124.  
  125.             if (jumpTarget[i] & JT_ADDR)
  126.             {
  127.                 printf(" addr");
  128.             }
  129.             if (jumpTarget[i] & JT_MULTI)
  130.             {
  131.                 printf(" multi");
  132.             }
  133.             printf("\n");
  134.         }
  135.         if (!anyJumpTargets)
  136.         {
  137.             printf("  none\n");
  138.         }
  139.     }
  140. #endif // DEBUG
  141.  
  142.     /* Now create the basic blocks */
  143.  
  144.     fgMakeBasicBlocks(info.compCode, info.compILCodeSize, jumpTarget);
  145.  
  146.     if (compIsForInlining())
  147.     {
  148.         if (compInlineResult->IsFailure())
  149.         {
  150.             return;
  151.         }
  152.  
  153.         bool hasReturnBlocks           = false;
  154.         bool hasMoreThanOneReturnBlock = false;
  155.  
  156.         for (BasicBlock* block = fgFirstBB; block != nullptr; block = block->bbNext)
  157.         {
  158.             if (block->bbJumpKind == BBJ_RETURN)
  159.             {
  160.                 if (hasReturnBlocks)
  161.                 {
  162.                     hasMoreThanOneReturnBlock = true;
  163.                     break;
  164.                 }
  165.  
  166.                 hasReturnBlocks = true;
  167.             }
  168.         }
  169.  
  170.         if (!hasReturnBlocks && !compInlineResult->UsesLegacyPolicy())
  171.         {
  172.             //
  173.             // Mark the call node as "no return". The inliner might ignore CALLEE_DOES_NOT_RETURN and
  174.             // fail inline for a different reasons. In that case we still want to make the "no return"
  175.             // information available to the caller as it can impact caller's code quality.
  176.             //
  177.  
  178.             impInlineInfo->iciCall->gtCallMoreFlags |= GTF_CALL_M_DOES_NOT_RETURN;
  179.         }
  180.  
  181.         compInlineResult->NoteBool(InlineObservation::CALLEE_DOES_NOT_RETURN, !hasReturnBlocks);
  182.  
  183.         if (compInlineResult->IsFailure())
  184.         {
  185.             return;
  186.         }
  187.  
  188.         noway_assert(info.compXcptnsCount == 0);
  189.         compHndBBtab = impInlineInfo->InlinerCompiler->compHndBBtab;
  190.         compHndBBtabAllocCount =
  191.             impInlineInfo->InlinerCompiler->compHndBBtabAllocCount; // we probably only use the table, not add to it.
  192.         compHndBBtabCount    = impInlineInfo->InlinerCompiler->compHndBBtabCount;
  193.         info.compXcptnsCount = impInlineInfo->InlinerCompiler->info.compXcptnsCount;
  194.  
  195.         if (info.compRetNativeType != TYP_VOID && hasMoreThanOneReturnBlock)
  196.         {
  197.             // The lifetime of this var might expand multiple BBs. So it is a long lifetime compiler temp.
  198.             lvaInlineeReturnSpillTemp = lvaGrabTemp(false DEBUGARG("Inline candidate multiple BBJ_RETURN spill temp"));
  199.             lvaTable[lvaInlineeReturnSpillTemp].lvType = info.compRetNativeType;
  200.         }
  201.         return;
  202.     }
  203.  
  204.     /* Mark all blocks within 'try' blocks as such */
  205.  
  206.     if (info.compXcptnsCount == 0)
  207.     {
  208.         return;
  209.     }
  210.  
  211.     if (info.compXcptnsCount > MAX_XCPTN_INDEX)
  212.     {
  213.         IMPL_LIMITATION("too many exception clauses");
  214.     }
  215.  
  216.     /* Allocate the exception handler table */
  217.  
  218.     fgAllocEHTable();
  219.  
  220.     /* Assume we don't need to sort the EH table (such that nested try/catch
  221.      * appear before their try or handler parent). The EH verifier will notice
  222.      * when we do need to sort it.
  223.      */
  224.  
  225.     fgNeedToSortEHTable = false;
  226.  
  227.     verInitEHTree(info.compXcptnsCount);
  228.     EHNodeDsc* initRoot = ehnNext; // remember the original root since
  229.                                    // it may get modified during insertion
  230.  
  231.     // Annotate BBs with exception handling information required for generating correct eh code
  232.     // as well as checking for correct IL
  233.  
  234.     EHblkDsc* HBtab;
  235.  
  236.     for (XTnum = 0, HBtab = compHndBBtab; XTnum < compHndBBtabCount; XTnum++, HBtab++)
  237.     {
  238.         CORINFO_EH_CLAUSE clause;
  239.         info.compCompHnd->getEHinfo(info.compMethodHnd, XTnum, &clause);
  240.         noway_assert(clause.HandlerLength != (unsigned)-1); // @DEPRECATED
  241.  
  242. #ifdef DEBUG
  243.         if (verbose)
  244.         {
  245.             dispIncomingEHClause(XTnum, clause);
  246.         }
  247. #endif // DEBUG
  248.  
  249.         IL_OFFSET tryBegOff    = clause.TryOffset;
  250.         IL_OFFSET tryEndOff    = tryBegOff + clause.TryLength;
  251.         IL_OFFSET filterBegOff = 0;
  252.         IL_OFFSET hndBegOff    = clause.HandlerOffset;
  253.         IL_OFFSET hndEndOff    = hndBegOff + clause.HandlerLength;
  254.  
  255.         if (clause.Flags & CORINFO_EH_CLAUSE_FILTER)
  256.         {
  257.             filterBegOff = clause.FilterOffset;
  258.         }
  259.  
  260.         if (tryEndOff > info.compILCodeSize)
  261.         {
  262.             BADCODE3("end of try block beyond end of method for try", " at offset %04X", tryBegOff);
  263.         }
  264.         if (hndEndOff > info.compILCodeSize)
  265.         {
  266.             BADCODE3("end of hnd block beyond end of method for try", " at offset %04X", tryBegOff);
  267.         }
  268.  
  269.         HBtab->ebdTryBegOffset    = tryBegOff;
  270.         HBtab->ebdTryEndOffset    = tryEndOff;
  271.         HBtab->ebdFilterBegOffset = filterBegOff;
  272.         HBtab->ebdHndBegOffset    = hndBegOff;
  273.         HBtab->ebdHndEndOffset    = hndEndOff;
  274.  
  275.         /* Convert the various addresses to basic blocks */
  276.  
  277.         BasicBlock* tryBegBB = fgLookupBB(tryBegOff);
  278.         BasicBlock* tryEndBB =
  279.             fgLookupBB(tryEndOff); // note: this can be NULL if the try region is at the end of the function
  280.         BasicBlock* hndBegBB = fgLookupBB(hndBegOff);
  281.         BasicBlock* hndEndBB = nullptr;
  282.         BasicBlock* filtBB   = nullptr;
  283.         BasicBlock* block;
  284.  
  285.         //
  286.         // Assert that the try/hnd beginning blocks are set up correctly
  287.         //
  288.         if (tryBegBB == nullptr)
  289.         {
  290.             BADCODE("Try Clause is invalid");
  291.         }
  292.  
  293.         if (hndBegBB == nullptr)
  294.         {
  295.             BADCODE("Handler Clause is invalid");
  296.         }
  297.  
  298.         tryBegBB->bbFlags |= BBF_HAS_LABEL;
  299.         hndBegBB->bbFlags |= BBF_HAS_LABEL | BBF_JMP_TARGET;
  300.  
  301. #if HANDLER_ENTRY_MUST_BE_IN_HOT_SECTION
  302.         // This will change the block weight from 0 to 1
  303.         // and clear the rarely run flag
  304.         hndBegBB->makeBlockHot();
  305. #else
  306.         hndBegBB->bbSetRunRarely();   // handler entry points are rarely executed
  307. #endif
  308.  
  309.         if (hndEndOff < info.compILCodeSize)
  310.         {
  311.             hndEndBB = fgLookupBB(hndEndOff);
  312.         }
  313.  
  314.         if (clause.Flags & CORINFO_EH_CLAUSE_FILTER)
  315.         {
  316.             filtBB = HBtab->ebdFilter = fgLookupBB(clause.FilterOffset);
  317.  
  318.             filtBB->bbCatchTyp = BBCT_FILTER;
  319.             filtBB->bbFlags |= BBF_HAS_LABEL | BBF_JMP_TARGET;
  320.  
  321.             hndBegBB->bbCatchTyp = BBCT_FILTER_HANDLER;
  322.  
  323. #if HANDLER_ENTRY_MUST_BE_IN_HOT_SECTION
  324.             // This will change the block weight from 0 to 1
  325.             // and clear the rarely run flag
  326.             filtBB->makeBlockHot();
  327. #else
  328.             filtBB->bbSetRunRarely(); // filter entry points are rarely executed
  329. #endif
  330.  
  331.             // Mark all BBs that belong to the filter with the XTnum of the corresponding handler
  332.             for (block = filtBB; /**/; block = block->bbNext)
  333.             {
  334.                 if (block == nullptr)
  335.                 {
  336.                     BADCODE3("Missing endfilter for filter", " at offset %04X", filtBB->bbCodeOffs);
  337.                     return;
  338.                 }
  339.  
  340.                 // Still inside the filter
  341.                 block->setHndIndex(XTnum);
  342.  
  343.                 if (block->bbJumpKind == BBJ_EHFILTERRET)
  344.                 {
  345.                     // Mark catch handler as successor.
  346.                     block->bbJumpDest = hndBegBB;
  347.                     assert(block->bbJumpDest->bbCatchTyp == BBCT_FILTER_HANDLER);
  348.                     break;
  349.                 }
  350.             }
  351.  
  352.             if (!block->bbNext || block->bbNext != hndBegBB)
  353.             {
  354.                 BADCODE3("Filter does not immediately precede handler for filter", " at offset %04X",
  355.                          filtBB->bbCodeOffs);
  356.             }
  357.         }
  358.         else
  359.         {
  360.             HBtab->ebdTyp = clause.ClassToken;
  361.  
  362.             /* Set bbCatchTyp as appropriate */
  363.  
  364.             if (clause.Flags & CORINFO_EH_CLAUSE_FINALLY)
  365.             {
  366.                 hndBegBB->bbCatchTyp = BBCT_FINALLY;
  367.             }
  368.             else
  369.             {
  370.                 if (clause.Flags & CORINFO_EH_CLAUSE_FAULT)
  371.                 {
  372.                     hndBegBB->bbCatchTyp = BBCT_FAULT;
  373.                 }
  374.                 else
  375.                 {
  376.                     hndBegBB->bbCatchTyp = clause.ClassToken;
  377.  
  378.                     // These values should be non-zero value that will
  379.                     // not collide with real tokens for bbCatchTyp
  380.                     if (clause.ClassToken == 0)
  381.                     {
  382.                         BADCODE("Exception catch type is Null");
  383.                     }
  384.  
  385.                     noway_assert(clause.ClassToken != BBCT_FAULT);
  386.                     noway_assert(clause.ClassToken != BBCT_FINALLY);
  387.                     noway_assert(clause.ClassToken != BBCT_FILTER);
  388.                     noway_assert(clause.ClassToken != BBCT_FILTER_HANDLER);
  389.                 }
  390.             }
  391.         }
  392.  
  393.         /* Mark the initial block and last blocks in the 'try' region */
  394.  
  395.         tryBegBB->bbFlags |= BBF_TRY_BEG | BBF_HAS_LABEL;
  396.  
  397.         /*  Prevent future optimizations of removing the first block   */
  398.         /*  of a TRY block and the first block of an exception handler */
  399.  
  400.         tryBegBB->bbFlags |= BBF_DONT_REMOVE;
  401.         hndBegBB->bbFlags |= BBF_DONT_REMOVE;
  402.         hndBegBB->bbRefs++; // The first block of a handler gets an extra, "artificial" reference count.
  403.  
  404.         if (clause.Flags & CORINFO_EH_CLAUSE_FILTER)
  405.         {
  406.             filtBB->bbFlags |= BBF_DONT_REMOVE;
  407.             filtBB->bbRefs++; // The first block of a filter gets an extra, "artificial" reference count.
  408.         }
  409.  
  410.         tryBegBB->bbFlags |= BBF_DONT_REMOVE;
  411.         hndBegBB->bbFlags |= BBF_DONT_REMOVE;
  412.  
  413.         //
  414.         // Store the info to the table of EH block handlers
  415.         //
  416.  
  417.         HBtab->ebdHandlerType = ToEHHandlerType(clause.Flags);
  418.  
  419.         HBtab->ebdTryBeg  = tryBegBB;
  420.         HBtab->ebdTryLast = (tryEndBB == nullptr) ? fgLastBB : tryEndBB->bbPrev;
  421.  
  422.         HBtab->ebdHndBeg  = hndBegBB;
  423.         HBtab->ebdHndLast = (hndEndBB == nullptr) ? fgLastBB : hndEndBB->bbPrev;
  424.  
  425.         //
  426.         // Assert that all of our try/hnd blocks are setup correctly.
  427.         //
  428.         if (HBtab->ebdTryLast == nullptr)
  429.         {
  430.             BADCODE("Try Clause is invalid");
  431.         }
  432.  
  433.         if (HBtab->ebdHndLast == nullptr)
  434.         {
  435.             BADCODE("Handler Clause is invalid");
  436.         }
  437.  
  438.         //
  439.         // Verify that it's legal
  440.         //
  441.  
  442.         verInsertEhNode(&clause, HBtab);
  443.  
  444.     } // end foreach handler table entry
  445.  
  446.     fgSortEHTable();
  447.  
  448.     // Next, set things related to nesting that depend on the sorting being complete.
  449.  
  450.     for (XTnum = 0, HBtab = compHndBBtab; XTnum < compHndBBtabCount; XTnum++, HBtab++)
  451.     {
  452.         /* Mark all blocks in the finally/fault or catch clause */
  453.  
  454.         BasicBlock* tryBegBB = HBtab->ebdTryBeg;
  455.         BasicBlock* hndBegBB = HBtab->ebdHndBeg;
  456.  
  457.         IL_OFFSET tryBegOff = HBtab->ebdTryBegOffset;
  458.         IL_OFFSET tryEndOff = HBtab->ebdTryEndOffset;
  459.  
  460.         IL_OFFSET hndBegOff = HBtab->ebdHndBegOffset;
  461.         IL_OFFSET hndEndOff = HBtab->ebdHndEndOffset;
  462.  
  463.         BasicBlock* block;
  464.  
  465.         for (block = hndBegBB; block && (block->bbCodeOffs < hndEndOff); block = block->bbNext)
  466.         {
  467.             if (!block->hasHndIndex())
  468.             {
  469.                 block->setHndIndex(XTnum);
  470.             }
  471.  
  472.             // All blocks in a catch handler or filter are rarely run, except the entry
  473.             if ((block != hndBegBB) && (hndBegBB->bbCatchTyp != BBCT_FINALLY))
  474.             {
  475.                 block->bbSetRunRarely();
  476.             }
  477.         }
  478.  
  479.         /* Mark all blocks within the covered range of the try */
  480.  
  481.         for (block = tryBegBB; block && (block->bbCodeOffs < tryEndOff); block = block->bbNext)
  482.         {
  483.             /* Mark this BB as belonging to a 'try' block */
  484.  
  485.             if (!block->hasTryIndex())
  486.             {
  487.                 block->setTryIndex(XTnum);
  488.             }
  489.  
  490. #ifdef DEBUG
  491.             /* Note: the BB can't span the 'try' block */
  492.  
  493.             if (!(block->bbFlags & BBF_INTERNAL))
  494.             {
  495.                 noway_assert(tryBegOff <= block->bbCodeOffs);
  496.                 noway_assert(tryEndOff >= block->bbCodeOffsEnd || tryEndOff == tryBegOff);
  497.             }
  498. #endif
  499.         }
  500.  
  501. /*  Init ebdHandlerNestingLevel of current clause, and bump up value for all
  502.  *  enclosed clauses (which have to be before it in the table).
  503.  *  Innermost try-finally blocks must precede outermost
  504.  *  try-finally blocks.
  505.  */
  506.  
  507. #if !FEATURE_EH_FUNCLETS
  508.         HBtab->ebdHandlerNestingLevel = 0;
  509. #endif // !FEATURE_EH_FUNCLETS
  510.  
  511.         HBtab->ebdEnclosingTryIndex = EHblkDsc::NO_ENCLOSING_INDEX;
  512.         HBtab->ebdEnclosingHndIndex = EHblkDsc::NO_ENCLOSING_INDEX;
  513.  
  514.         noway_assert(XTnum < compHndBBtabCount);
  515.         noway_assert(XTnum == ehGetIndex(HBtab));
  516.  
  517.         for (EHblkDsc* xtab = compHndBBtab; xtab < HBtab; xtab++)
  518.         {
  519. #if !FEATURE_EH_FUNCLETS
  520.             if (jitIsBetween(xtab->ebdHndBegOffs(), hndBegOff, hndEndOff))
  521.             {
  522.                 xtab->ebdHandlerNestingLevel++;
  523.             }
  524. #endif // !FEATURE_EH_FUNCLETS
  525.  
  526.             /* If we haven't recorded an enclosing try index for xtab then see
  527.              *  if this EH region should be recorded.  We check if the
  528.              *  first offset in the xtab lies within our region.  If so,
  529.              *  the last offset also must lie within the region, due to
  530.              *  nesting rules. verInsertEhNode(), below, will check for proper nesting.
  531.              */
  532.             if (xtab->ebdEnclosingTryIndex == EHblkDsc::NO_ENCLOSING_INDEX)
  533.             {
  534.                 bool begBetween = jitIsBetween(xtab->ebdTryBegOffs(), tryBegOff, tryEndOff);
  535.                 if (begBetween)
  536.                 {
  537.                     // Record the enclosing scope link
  538.                     xtab->ebdEnclosingTryIndex = (unsigned short)XTnum;
  539.                 }
  540.             }
  541.  
  542.             /* Do the same for the enclosing handler index.
  543.              */
  544.             if (xtab->ebdEnclosingHndIndex == EHblkDsc::NO_ENCLOSING_INDEX)
  545.             {
  546.                 bool begBetween = jitIsBetween(xtab->ebdTryBegOffs(), hndBegOff, hndEndOff);
  547.                 if (begBetween)
  548.                 {
  549.                     // Record the enclosing scope link
  550.                     xtab->ebdEnclosingHndIndex = (unsigned short)XTnum;
  551.                 }
  552.             }
  553.         }
  554.  
  555.     } // end foreach handler table entry
  556.  
  557. #if !FEATURE_EH_FUNCLETS
  558.  
  559.     EHblkDsc* HBtabEnd;
  560.     for (HBtab = compHndBBtab, HBtabEnd = compHndBBtab + compHndBBtabCount; HBtab < HBtabEnd; HBtab++)
  561.     {
  562.         if (ehMaxHndNestingCount <= HBtab->ebdHandlerNestingLevel)
  563.             ehMaxHndNestingCount = HBtab->ebdHandlerNestingLevel + 1;
  564.     }
  565.  
  566. #endif // !FEATURE_EH_FUNCLETS
  567.  
  568. #ifndef DEBUG
  569.     if (tiVerificationNeeded)
  570. #endif
  571.     {
  572.         // always run these checks for a debug build
  573.         verCheckNestingLevel(initRoot);
  574.     }
  575.  
  576. #ifndef DEBUG
  577.     // fgNormalizeEH assumes that this test has been passed.  And Ssa assumes that fgNormalizeEHTable
  578.     // has been run.  So do this unless we're in minOpts mode (and always in debug).
  579.     if (tiVerificationNeeded || !opts.MinOpts())
  580. #endif
  581.     {
  582.         fgCheckBasicBlockControlFlow();
  583.     }
  584.  
  585. #ifdef DEBUG
  586.     if (verbose)
  587.     {
  588.         JITDUMP("*************** After fgFindBasicBlocks() has created the EH table\n");
  589.         fgDispHandlerTab();
  590.     }
  591.  
  592.     // We can't verify the handler table until all the IL legality checks have been done (above), since bad IL
  593.     // (such as illegal nesting of regions) will trigger asserts here.
  594.     fgVerifyHandlerTab();
  595. #endif
  596.  
  597.     fgNormalizeEH();
  598. }

fgFindBasicBlocks首先创建了一个byte数组, 长度跟IL长度一样(也就是一个IL偏移值会对应一个byte),
然后调用fgFindJumpTargets查找跳转目标, 以这段IL为例:

  1. IL_0000  00                nop         
  2. IL_0001  16                ldc.i4.0    
  3. IL_0002  0a                stloc.0     
  4. IL_0003  2b 0d             br.s         13 (IL_0012)
  5. IL_0005  00                nop         
  6. IL_0006  06                ldloc.0     
  7. IL_0007  28 0c 00 00 0a    call         0xA00000C
  8. IL_000c  00                nop         
  9. IL_000d  00                nop         
  10. IL_000e  06                ldloc.0     
  11. IL_000f  17                ldc.i4.1    
  12. IL_0010  58                add         
  13. IL_0011  0a                stloc.0     
  14. IL_0012  06                ldloc.0     
  15. IL_0013  19                ldc.i4.3    
  16. IL_0014  fe 04             clt         
  17. IL_0016  0b                stloc.1     
  18. IL_0017  07                ldloc.1     
  19. IL_0018  2d eb             brtrue.s     -21 (IL_0005)
  20. IL_001a  2a                ret

这段IL可以找到两个跳转目标:

  1. Jump targets:
  2.   IL_0005
  3.   IL_0012

然后fgFindBasicBlocks会根据函数的例外信息找到更多的跳转目标, 例如try的开始和catch的开始都会被视为跳转目标.
注意fgFindJumpTargets在解析IL的后会判断是否值得内联, 内联相关的处理将在下面说明.

之后调用fgMakeBasicBlocks创建BasicBlock, fgMakeBasicBlocks在遇到跳转指令或者跳转目标时会开始一个新的block.
调用fgMakeBasicBlocks后, compiler中就有了BasicBlock的链表(从fgFirstBB开始), 每个节点对应IL中的一段范围.

在创建完BasicBlock后还会根据例外信息创建一个例外信息表compHndBBtab(也称EH表), 长度是compHndBBtabCount.
表中每条记录都有try开始的block, handler(catch, finally, fault)开始的block, 和外层的try序号(如果try嵌套了).

如下图所示:

881857-20171028110045851-188393709.jpg

JIT主函数

compCompileHelper把BasicBlock划分好以后, 就会调用3参数版的Compiler::compCompile, 这个函数就是JIT的主函数.

Compiler::compCompile的源代码如下:

  1. //*********************************************************************************************
  2. // #Phases
  3. //
  4. // This is the most interesting 'toplevel' function in the JIT.  It goes through the operations of
  5. // importing, morphing, optimizations and code generation.  This is called from the EE through the
  6. // code:CILJit::compileMethod function.
  7. //
  8. // For an overview of the structure of the JIT, see:
  9. //   https://github.com/dotnet/coreclr/blob/master/Documentation/botr/ryujit-overview.md
  10. //
  11. void Compiler::compCompile(void** methodCodePtr, ULONG* methodCodeSize, CORJIT_FLAGS* compileFlags)
  12. {
  13.     if (compIsForInlining())
  14.     {
  15.         // Notify root instance that an inline attempt is about to import IL
  16.         impInlineRoot()->m_inlineStrategy->NoteImport();
  17.     }
  18.  
  19.     hashBv::Init(this);
  20.  
  21.     VarSetOps::AssignAllowUninitRhs(this, compCurLife, VarSetOps::UninitVal());
  22.  
  23.     /* The temp holding the secret stub argument is used by fgImport() when importing the intrinsic. */
  24.  
  25.     if (info.compPublishStubParam)
  26.     {
  27.         assert(lvaStubArgumentVar == BAD_VAR_NUM);
  28.         lvaStubArgumentVar                  = lvaGrabTempWithImplicitUse(false DEBUGARG("stub argument"));
  29.         lvaTable[lvaStubArgumentVar].lvType = TYP_I_IMPL;
  30.     }
  31.  
  32.     EndPhase(PHASE_PRE_IMPORT);
  33.  
  34.     compFunctionTraceStart();
  35.  
  36.     /* Convert the instrs in each basic block to a tree based intermediate representation */
  37.  
  38.     fgImport();
  39.  
  40.     assert(!fgComputePredsDone);
  41.     if (fgCheapPredsValid)
  42.     {
  43.         // Remove cheap predecessors before inlining; allowing the cheap predecessor lists to be inserted
  44.         // with inlined blocks causes problems.
  45.         fgRemovePreds();
  46.     }
  47.  
  48.     if (compIsForInlining())
  49.     {
  50.         /* Quit inlining if fgImport() failed for any reason. */
  51.  
  52.         if (compDonotInline())
  53.         {
  54.             return;
  55.         }
  56.  
  57.         /* Filter out unimported BBs */
  58.  
  59.         fgRemoveEmptyBlocks();
  60.  
  61.         return;
  62.     }
  63.  
  64.     assert(!compDonotInline());
  65.  
  66.     EndPhase(PHASE_IMPORTATION);
  67.  
  68.     // Maybe the caller was not interested in generating code
  69.     if (compIsForImportOnly())
  70.     {
  71.         compFunctionTraceEnd(nullptr, 0, false);
  72.         return;
  73.     }
  74.  
  75. #if !FEATURE_EH
  76.     // If we aren't yet supporting EH in a compiler bring-up, remove as many EH handlers as possible, so
  77.     // we can pass tests that contain try/catch EH, but don't actually throw any exceptions.
  78.     fgRemoveEH();
  79. #endif // !FEATURE_EH
  80.  
  81.     if (compileFlags->corJitFlags & CORJIT_FLG_BBINSTR)
  82.     {
  83.         fgInstrumentMethod();
  84.     }
  85.  
  86.     // We could allow ESP frames. Just need to reserve space for
  87.     // pushing EBP if the method becomes an EBP-frame after an edit.
  88.     // Note that requiring a EBP Frame disallows double alignment.  Thus if we change this
  89.     // we either have to disallow double alignment for E&C some other way or handle it in EETwain.
  90.  
  91.     if (opts.compDbgEnC)
  92.     {
  93.         codeGen->setFramePointerRequired(true);
  94.  
  95.         // Since we need a slots for security near ebp, its not possible
  96.         // to do this after an Edit without shifting all the locals.
  97.         // So we just always reserve space for these slots in case an Edit adds them
  98.         opts.compNeedSecurityCheck = true;
  99.  
  100.         // We don't care about localloc right now. If we do support it,
  101.         // EECodeManager::FixContextForEnC() needs to handle it smartly
  102.         // in case the localloc was actually executed.
  103.         //
  104.         // compLocallocUsed            = true;
  105.     }
  106.  
  107.     EndPhase(PHASE_POST_IMPORT);
  108.  
  109.     /* Initialize the BlockSet epoch */
  110.  
  111.     NewBasicBlockEpoch();
  112.  
  113.     /* Massage the trees so that we can generate code out of them */
  114.  
  115.     fgMorph();
  116.     EndPhase(PHASE_MORPH);
  117.  
  118.     /* GS security checks for unsafe buffers */
  119.     if (getNeedsGSSecurityCookie())
  120.     {
  121. #ifdef DEBUG
  122.         if (verbose)
  123.         {
  124.             printf("\n*************** -GS checks for unsafe buffers \n");
  125.         }
  126. #endif
  127.  
  128.         gsGSChecksInitCookie();
  129.  
  130.         if (compGSReorderStackLayout)
  131.         {
  132.             gsCopyShadowParams();
  133.         }
  134.  
  135. #ifdef DEBUG
  136.         if (verbose)
  137.         {
  138.             fgDispBasicBlocks(true);
  139.             printf("\n");
  140.         }
  141. #endif
  142.     }
  143.     EndPhase(PHASE_GS_COOKIE);
  144.  
  145.     /* Compute bbNum, bbRefs and bbPreds */
  146.  
  147.     JITDUMP("\nRenumbering the basic blocks for fgComputePred\n");
  148.     fgRenumberBlocks();
  149.  
  150.     noway_assert(!fgComputePredsDone); // This is the first time full (not cheap) preds will be computed.
  151.     fgComputePreds();
  152.     EndPhase(PHASE_COMPUTE_PREDS);
  153.  
  154.     /* If we need to emit GC Poll calls, mark the blocks that need them now.  This is conservative and can
  155.      * be optimized later. */
  156.     fgMarkGCPollBlocks();
  157.     EndPhase(PHASE_MARK_GC_POLL_BLOCKS);
  158.  
  159.     /* From this point on the flowgraph information such as bbNum,
  160.      * bbRefs or bbPreds has to be kept updated */
  161.  
  162.     // Compute the edge weights (if we have profile data)
  163.     fgComputeEdgeWeights();
  164.     EndPhase(PHASE_COMPUTE_EDGE_WEIGHTS);
  165.  
  166. #if FEATURE_EH_FUNCLETS
  167.  
  168.     /* Create funclets from the EH handlers. */
  169.  
  170.     fgCreateFunclets();
  171.     EndPhase(PHASE_CREATE_FUNCLETS);
  172.  
  173. #endif // FEATURE_EH_FUNCLETS
  174.  
  175.     if (!opts.MinOpts() && !opts.compDbgCode)
  176.     {
  177.         optOptimizeLayout();
  178.         EndPhase(PHASE_OPTIMIZE_LAYOUT);
  179.  
  180.         // Compute reachability sets and dominators.
  181.         fgComputeReachability();
  182.     }
  183.  
  184.     // Transform each GT_ALLOCOBJ node into either an allocation helper call or
  185.     // local variable allocation on the stack.
  186.     ObjectAllocator objectAllocator(this);
  187.     objectAllocator.Run();
  188.  
  189.     if (!opts.MinOpts() && !opts.compDbgCode)
  190.     {
  191.         /*  Perform loop inversion (i.e. transform "while" loops into
  192.             "repeat" loops) and discover and classify natural loops
  193.             (e.g. mark iterative loops as such). Also marks loop blocks
  194.             and sets bbWeight to the loop nesting levels
  195.         */
  196.  
  197.         optOptimizeLoops();
  198.         EndPhase(PHASE_OPTIMIZE_LOOPS);
  199.  
  200.         // Clone loops with optimization opportunities, and
  201.         // choose the one based on dynamic condition evaluation.
  202.         optCloneLoops();
  203.         EndPhase(PHASE_CLONE_LOOPS);
  204.  
  205.         /* Unroll loops */
  206.         optUnrollLoops();
  207.         EndPhase(PHASE_UNROLL_LOOPS);
  208.     }
  209.  
  210. #ifdef DEBUG
  211.     fgDebugCheckLinks();
  212. #endif
  213.  
  214.     /* Create the variable table (and compute variable ref counts) */
  215.  
  216.     lvaMarkLocalVars();
  217.     EndPhase(PHASE_MARK_LOCAL_VARS);
  218.  
  219.     // IMPORTANT, after this point, every place where trees are modified or cloned
  220.     // the local variable reference counts must be updated
  221.     // You can test the value of the following variable to see if
  222.     // the local variable ref counts must be updated
  223.     //
  224.     assert(lvaLocalVarRefCounted == true);
  225.  
  226.     if (!opts.MinOpts() && !opts.compDbgCode)
  227.     {
  228.         /* Optimize boolean conditions */
  229.  
  230.         optOptimizeBools();
  231.         EndPhase(PHASE_OPTIMIZE_BOOLS);
  232.  
  233.         // optOptimizeBools() might have changed the number of blocks; the dominators/reachability might be bad.
  234.     }
  235.  
  236.     /* Figure out the order in which operators are to be evaluated */
  237.     fgFindOperOrder();
  238.     EndPhase(PHASE_FIND_OPER_ORDER);
  239.  
  240.     // Weave the tree lists. Anyone who modifies the tree shapes after
  241.     // this point is responsible for calling fgSetStmtSeq() to keep the
  242.     // nodes properly linked.
  243.     // This can create GC poll calls, and create new BasicBlocks (without updating dominators/reachability).
  244.     fgSetBlockOrder();
  245.     EndPhase(PHASE_SET_BLOCK_ORDER);
  246.  
  247.     // IMPORTANT, after this point, every place where tree topology changes must redo evaluation
  248.     // order (gtSetStmtInfo) and relink nodes (fgSetStmtSeq) if required.
  249.     CLANG_FORMAT_COMMENT_ANCHOR;
  250.  
  251. #ifdef DEBUG
  252.     // Now  we have determined the order of evaluation and the gtCosts for every node.
  253.     // If verbose, dump the full set of trees here before the optimization phases mutate them
  254.     //
  255.     if (verbose)
  256.     {
  257.         fgDispBasicBlocks(true); // 'true' will call fgDumpTrees() after dumping the BasicBlocks
  258.         printf("\n");
  259.     }
  260. #endif
  261.  
  262.     // At this point we know if we are fully interruptible or not
  263.     if (!opts.MinOpts() && !opts.compDbgCode)
  264.     {
  265.         bool doSsa           = true;
  266.         bool doEarlyProp     = true;
  267.         bool doValueNum      = true;
  268.         bool doLoopHoisting  = true;
  269.         bool doCopyProp      = true;
  270.         bool doAssertionProp = true;
  271.         bool doRangeAnalysis = true;
  272.  
  273. #ifdef DEBUG
  274.         doSsa           = (JitConfig.JitDoSsa() != 0);
  275.         doEarlyProp     = doSsa && (JitConfig.JitDoEarlyProp() != 0);
  276.         doValueNum      = doSsa && (JitConfig.JitDoValueNumber() != 0);
  277.         doLoopHoisting  = doValueNum && (JitConfig.JitDoLoopHoisting() != 0);
  278.         doCopyProp      = doValueNum && (JitConfig.JitDoCopyProp() != 0);
  279.         doAssertionProp = doValueNum && (JitConfig.JitDoAssertionProp() != 0);
  280.         doRangeAnalysis = doAssertionProp && (JitConfig.JitDoRangeAnalysis() != 0);
  281. #endif
  282.  
  283.         if (doSsa)
  284.         {
  285.             fgSsaBuild();
  286.             EndPhase(PHASE_BUILD_SSA);
  287.         }
  288.  
  289.         if (doEarlyProp)
  290.         {
  291.             /* Propagate array length and rewrite getType() method call */
  292.             optEarlyProp();
  293.             EndPhase(PHASE_EARLY_PROP);
  294.         }
  295.  
  296.         if (doValueNum)
  297.         {
  298.             fgValueNumber();
  299.             EndPhase(PHASE_VALUE_NUMBER);
  300.         }
  301.  
  302.         if (doLoopHoisting)
  303.         {
  304.             /* Hoist invariant code out of loops */
  305.             optHoistLoopCode();
  306.             EndPhase(PHASE_HOIST_LOOP_CODE);
  307.         }
  308.  
  309.         if (doCopyProp)
  310.         {
  311.             /* Perform VN based copy propagation */
  312.             optVnCopyProp();
  313.             EndPhase(PHASE_VN_COPY_PROP);
  314.         }
  315.  
  316. #if FEATURE_ANYCSE
  317.         /* Remove common sub-expressions */
  318.         optOptimizeCSEs();
  319. #endif // FEATURE_ANYCSE
  320.  
  321. #if ASSERTION_PROP
  322.         if (doAssertionProp)
  323.         {
  324.             /* Assertion propagation */
  325.             optAssertionPropMain();
  326.             EndPhase(PHASE_ASSERTION_PROP_MAIN);
  327.         }
  328.  
  329.         if (doRangeAnalysis)
  330.         {
  331.             /* Optimize array index range checks */
  332.             RangeCheck rc(this);
  333.             rc.OptimizeRangeChecks();
  334.             EndPhase(PHASE_OPTIMIZE_INDEX_CHECKS);
  335.         }
  336. #endif // ASSERTION_PROP
  337.  
  338.         /* update the flowgraph if we modified it during the optimization phase*/
  339.         if (fgModified)
  340.         {
  341.             fgUpdateFlowGraph();
  342.             EndPhase(PHASE_UPDATE_FLOW_GRAPH);
  343.  
  344.             // Recompute the edge weight if we have modified the flow graph
  345.             fgComputeEdgeWeights();
  346.             EndPhase(PHASE_COMPUTE_EDGE_WEIGHTS2);
  347.         }
  348.     }
  349.  
  350. #ifdef _TARGET_AMD64_
  351.     //  Check if we need to add the Quirk for the PPP backward compat issue
  352.     compQuirkForPPPflag = compQuirkForPPP();
  353. #endif
  354.  
  355.     fgDetermineFirstColdBlock();
  356.     EndPhase(PHASE_DETERMINE_FIRST_COLD_BLOCK);
  357.  
  358. #ifdef DEBUG
  359.     fgDebugCheckLinks(compStressCompile(STRESS_REMORPH_TREES, 50));
  360.  
  361.     // Stash the current estimate of the function's size if necessary.
  362.     if (verbose)
  363.     {
  364.         compSizeEstimate  = 0;
  365.         compCycleEstimate = 0;
  366.         for (BasicBlock* block = fgFirstBB; block != nullptr; block = block->bbNext)
  367.         {
  368.             for (GenTreeStmt* stmt = block->firstStmt(); stmt != nullptr; stmt = stmt->getNextStmt())
  369.             {
  370.                 compSizeEstimate += stmt->GetCostSz();
  371.                 compCycleEstimate += stmt->GetCostEx();
  372.             }
  373.         }
  374.     }
  375. #endif
  376.  
  377. #ifndef LEGACY_BACKEND
  378.     // rationalize trees
  379.     Rationalizer rat(this); // PHASE_RATIONALIZE
  380.     rat.Run();
  381. #endif // !LEGACY_BACKEND
  382.  
  383.     // Here we do "simple lowering".  When the RyuJIT backend works for all
  384.     // platforms, this will be part of the more general lowering phase.  For now, though, we do a separate
  385.     // pass of "final lowering."  We must do this before (final) liveness analysis, because this creates
  386.     // range check throw blocks, in which the liveness must be correct.
  387.     fgSimpleLowering();
  388.     EndPhase(PHASE_SIMPLE_LOWERING);
  389.  
  390. #ifdef LEGACY_BACKEND
  391.     /* Local variable liveness */
  392.     fgLocalVarLiveness();
  393.     EndPhase(PHASE_LCLVARLIVENESS);
  394. #endif // !LEGACY_BACKEND
  395.  
  396. #ifdef DEBUG
  397.     fgDebugCheckBBlist();
  398.     fgDebugCheckLinks();
  399. #endif
  400.  
  401.     /* Enable this to gather statistical data such as
  402.      * call and register argument info, flowgraph and loop info, etc. */
  403.  
  404.     compJitStats();
  405.  
  406. #ifdef _TARGET_ARM_
  407.     if (compLocallocUsed)
  408.     {
  409.         // We reserve REG_SAVED_LOCALLOC_SP to store SP on entry for stack unwinding
  410.         codeGen->regSet.rsMaskResvd |= RBM_SAVED_LOCALLOC_SP;
  411.     }
  412. #endif // _TARGET_ARM_
  413. #ifdef _TARGET_ARMARCH_
  414.     if (compRsvdRegCheck(PRE_REGALLOC_FRAME_LAYOUT))
  415.     {
  416.         // We reserve R10/IP1 in this case to hold the offsets in load/store instructions
  417.         codeGen->regSet.rsMaskResvd |= RBM_OPT_RSVD;
  418.         assert(REG_OPT_RSVD != REG_FP);
  419.     }
  420.  
  421. #ifdef DEBUG
  422.     //
  423.     // Display the pre-regalloc frame offsets that we have tentatively decided upon
  424.     //
  425.     if (verbose)
  426.         lvaTableDump();
  427. #endif
  428. #endif // _TARGET_ARMARCH_
  429.  
  430.     /* Assign registers to variables, etc. */
  431.     CLANG_FORMAT_COMMENT_ANCHOR;
  432.  
  433. #ifndef LEGACY_BACKEND
  434.     ///
  435.     // Dominator and reachability sets are no longer valid. They haven't been
  436.     // maintained up to here, and shouldn't be used (unless recomputed).
  437.     ///
  438.     fgDomsComputed = false;
  439.  
  440.     /* Create LSRA before Lowering, this way Lowering can initialize the TreeNode Map */
  441.     m_pLinearScan = getLinearScanAllocator(this);
  442.  
  443.     /* Lower */
  444.     Lowering lower(this, m_pLinearScan); // PHASE_LOWERING
  445.     lower.Run();
  446.  
  447.     assert(lvaSortAgain == false); // We should have re-run fgLocalVarLiveness() in lower.Run()
  448.     lvaTrackedFixed = true;        // We can not add any new tracked variables after this point.
  449.  
  450.     /* Now that lowering is completed we can proceed to perform register allocation */
  451.     m_pLinearScan->doLinearScan();
  452.     EndPhase(PHASE_LINEAR_SCAN);
  453.  
  454.     // Copied from rpPredictRegUse()
  455.     genFullPtrRegMap = (codeGen->genInterruptible || !codeGen->isFramePointerUsed());
  456. #else  // LEGACY_BACKEND
  457.  
  458.     lvaTrackedFixed = true; // We cannot add any new tracked variables after this point.
  459.     // For the classic JIT32 at this point lvaSortAgain can be set and raAssignVars() will call lvaSortOnly()
  460.  
  461.     // Now do "classic" register allocation.
  462.     raAssignVars();
  463.     EndPhase(PHASE_RA_ASSIGN_VARS);
  464. #endif // LEGACY_BACKEND
  465.  
  466. #ifdef DEBUG
  467.     fgDebugCheckLinks();
  468. #endif
  469.  
  470.     /* Generate code */
  471.  
  472.     codeGen->genGenerateCode(methodCodePtr, methodCodeSize);
  473.  
  474. #ifdef FEATURE_JIT_METHOD_PERF
  475.     if (pCompJitTimer)
  476.         pCompJitTimer->Terminate(this, CompTimeSummaryInfo::s_compTimeSummary);
  477. #endif
  478.  
  479.     RecordStateAtEndOfCompilation();
  480.  
  481. #ifdef FEATURE_TRACELOGGING
  482.     compJitTelemetry.NotifyEndOfCompilation();
  483. #endif
  484.  
  485. #if defined(DEBUG)
  486.     ++Compiler::jitTotalMethodCompiled;
  487. #endif // defined(DEBUG)
  488.  
  489.     compFunctionTraceEnd(*methodCodePtr, *methodCodeSize, false);
  490.  
  491. #if FUNC_INFO_LOGGING
  492.     if (compJitFuncInfoFile != nullptr)
  493.     {
  494.         assert(!compIsForInlining());
  495. #ifdef DEBUG // We only have access to info.compFullName in DEBUG builds.
  496.         fprintf(compJitFuncInfoFile, "%s\n", info.compFullName);
  497. #elif FEATURE_SIMD
  498.         fprintf(compJitFuncInfoFile, " %s\n", eeGetMethodFullName(info.compMethodHnd));
  499. #endif
  500.         fprintf(compJitFuncInfoFile, ""); // in our logic this causes a flush
  501.     }
  502. #endif // FUNC_INFO_LOGGING
  503. }

JIT主函数中包含了对各个阶段的调用, 例如EndPhase(PHASE_PRE_IMPORT)表示这个阶段的结束.

这里的阶段比微软列出的阶段要多出来一些:

881857-20171028110106930-46112063.png

接下来我们逐个分析这些阶段.

PHASE_PRE_IMPORT

这个阶段负责从IL导入HIR(GenTree)前的一些工作, 包含以下的代码:

  1. if (compIsForInlining())
  2. {
  3.     // Notify root instance that an inline attempt is about to import IL
  4.     impInlineRoot()->m_inlineStrategy->NoteImport();
  5. }
  6.  
  7. hashBv::Init(this);
  8.  
  9. VarSetOps::AssignAllowUninitRhs(this, compCurLife, VarSetOps::UninitVal());
  10.  
  11. /* The temp holding the secret stub argument is used by fgImport() when importing the intrinsic. */
  12.  
  13. if (info.compPublishStubParam)
  14. {
  15.     assert(lvaStubArgumentVar == BAD_VAR_NUM);
  16.     lvaStubArgumentVar                  = lvaGrabTempWithImplicitUse(false DEBUGARG("stub argument"));
  17.     lvaTable[lvaStubArgumentVar].lvType = TYP_I_IMPL;
  18. }
  19.  
  20. EndPhase(PHASE_PRE_IMPORT);

执行了import前的一些初始化工作,
hashBv::Init为Compiler创建一个bitvector的分配器(allocator),
VarSetOps::AssignAllowUninitRhs设置compCurLife的值为未初始化(这个变量会用于保存当前活动的本地变量集合),
compPublishStubParam选项开启时会添加一个额外的本地变量(这个变量会保存函数进入时的rax值).

PHASE_IMPORTATION

这个阶段负责从IL导入HIR(GenTree), 包含以下的代码:

  1. compFunctionTraceStart();
  2.  
  3. /* Convert the instrs in each basic block to a tree based intermediate representation */
  4.  
  5. fgImport();
  6.  
  7. assert(!fgComputePredsDone);
  8. if (fgCheapPredsValid)
  9. {
  10.     // Remove cheap predecessors before inlining; allowing the cheap predecessor lists to be inserted
  11.     // with inlined blocks causes problems.
  12.     fgRemovePreds();
  13. }
  14.  
  15. if (compIsForInlining())
  16. {
  17.     /* Quit inlining if fgImport() failed for any reason. */
  18.  
  19.     if (compDonotInline())
  20.     {
  21.         return;
  22.     }
  23.  
  24.     /* Filter out unimported BBs */
  25.  
  26.     fgRemoveEmptyBlocks();
  27.  
  28.     return;
  29. }
  30.  
  31. assert(!compDonotInline());
  32.  
  33. EndPhase(PHASE_IMPORTATION);

compFunctionTraceStart会打印一些除错信息.

fgImport会解析IL并添加GenTree节点, 因为此前已经创建了BasicBlock, 根据IL创建的GenTree会分别添加到对应的BasicBlock中.
BasicBlock + GenTree就是我们通常说的IR, IR有两种形式, 树形式的叫HIR(用于JIT前端), 列表形式的叫LIR(用于JIT后端), 这里构建的是HIR.

fgImport的源代码如下:

  1. void Compiler::fgImport()
  2. {
  3.     fgHasPostfix = false;
  4.  
  5.     impImport(fgFirstBB);
  6.  
  7.     if (!(opts.eeFlags & CORJIT_FLG_SKIP_VERIFICATION))
  8.     {
  9.         CorInfoMethodRuntimeFlags verFlag;
  10.         verFlag = tiIsVerifiableCode ? CORINFO_FLG_VERIFIABLE : CORINFO_FLG_UNVERIFIABLE;
  11.         info.compCompHnd->setMethodAttribs(info.compMethodHnd, verFlag);
  12.     }
  13. }

对第一个BasicBlock调用了impImport.

impImport的源代码如下:

  1. /*****************************************************************************
  2.  *
  3.  *  Convert the instrs ("import") into our internal format (trees). The
  4.  *  basic flowgraph has already been constructed and is passed in.
  5.  */
  6.  
  7. void Compiler::impImport(BasicBlock* method)
  8. {
  9. #ifdef DEBUG
  10.     if (verbose)
  11.     {
  12.         printf("*************** In impImport() for %s\n", info.compFullName);
  13.     }
  14. #endif
  15.  
  16.     /* Allocate the stack contents */
  17.  
  18.     if (info.compMaxStack <= sizeof(impSmallStack) / sizeof(impSmallStack[0]))
  19.     {
  20.         /* Use local variable, don't waste time allocating on the heap */
  21.  
  22.         impStkSize              = sizeof(impSmallStack) / sizeof(impSmallStack[0]);
  23.         verCurrentState.esStack = impSmallStack;
  24.     }
  25.     else
  26.     {
  27.         impStkSize              = info.compMaxStack;
  28.         verCurrentState.esStack = new (this, CMK_ImpStack) StackEntry[impStkSize];
  29.     }
  30.  
  31.     // initialize the entry state at start of method
  32.     verInitCurrentState();
  33.  
  34.     // Initialize stuff related to figuring "spill cliques" (see spec comment for impGetSpillTmpBase).
  35.     Compiler* inlineRoot = impInlineRoot();
  36.     if (this == inlineRoot) // These are only used on the root of the inlining tree.
  37.     {
  38.         // We have initialized these previously, but to size 0.  Make them larger.
  39.         impPendingBlockMembers.Init(getAllocator(), fgBBNumMax * 2);
  40.         impSpillCliquePredMembers.Init(getAllocator(), fgBBNumMax * 2);
  41.         impSpillCliqueSuccMembers.Init(getAllocator(), fgBBNumMax * 2);
  42.     }
  43.     inlineRoot->impPendingBlockMembers.Reset(fgBBNumMax * 2);
  44.     inlineRoot->impSpillCliquePredMembers.Reset(fgBBNumMax * 2);
  45.     inlineRoot->impSpillCliqueSuccMembers.Reset(fgBBNumMax * 2);
  46.     impBlockListNodeFreeList = nullptr;
  47.  
  48. #ifdef DEBUG
  49.     impLastILoffsStmt   = nullptr;
  50.     impNestedStackSpill = false;
  51. #endif
  52.     impBoxTemp = BAD_VAR_NUM;
  53.  
  54.     impPendingList = impPendingFree = nullptr;
  55.  
  56.     /* Add the entry-point to the worker-list */
  57.  
  58.     // Skip leading internal blocks. There can be one as a leading scratch BB, and more
  59.     // from EH normalization.
  60.     // NOTE: It might be possible to always just put fgFirstBB on the pending list, and let everything else just fall
  61.     // out.
  62.     for (; method->bbFlags & BBF_INTERNAL; method = method->bbNext)
  63.     {
  64.         // Treat these as imported.
  65.         assert(method->bbJumpKind == BBJ_NONE); // We assume all the leading ones are fallthrough.
  66.         JITDUMP("Marking leading BBF_INTERNAL block BB%02u as BBF_IMPORTED\n", method->bbNum);
  67.         method->bbFlags |= BBF_IMPORTED;
  68.     }
  69.  
  70.     impImportBlockPending(method);
  71.  
  72.     /* Import blocks in the worker-list until there are no more */
  73.  
  74.     while (impPendingList)
  75.     {
  76.         /* Remove the entry at the front of the list */
  77.  
  78.         PendingDsc* dsc = impPendingList;
  79.         impPendingList  = impPendingList->pdNext;
  80.         impSetPendingBlockMember(dsc->pdBB, 0);
  81.  
  82.         /* Restore the stack state */
  83.  
  84.         verCurrentState.thisInitialized = dsc->pdThisPtrInit;
  85.         verCurrentState.esStackDepth    = dsc->pdSavedStack.ssDepth;
  86.         if (verCurrentState.esStackDepth)
  87.         {
  88.             impRestoreStackState(&dsc->pdSavedStack);
  89.         }
  90.  
  91.         /* Add the entry to the free list for reuse */
  92.  
  93.         dsc->pdNext    = impPendingFree;
  94.         impPendingFree = dsc;
  95.  
  96.         /* Now import the block */
  97.  
  98.         if (dsc->pdBB->bbFlags & BBF_FAILED_VERIFICATION)
  99.         {
  100.  
  101. #ifdef _TARGET_64BIT_
  102.             // On AMD64, during verification we have to match JIT64 behavior since the VM is very tighly
  103.             // coupled with the JIT64 IL Verification logic.  Look inside verHandleVerificationFailure
  104.             // method for further explanation on why we raise this exception instead of making the jitted
  105.             // code throw the verification exception during execution.
  106.             if (tiVerificationNeeded && (opts.eeFlags & CORJIT_FLG_IMPORT_ONLY) != 0)
  107.             {
  108.                 BADCODE("Basic block marked as not verifiable");
  109.             }
  110.             else
  111. #endif // _TARGET_64BIT_
  112.             {
  113.                 verConvertBBToThrowVerificationException(dsc->pdBB DEBUGARG(true));
  114.                 impEndTreeList(dsc->pdBB);
  115.             }
  116.         }
  117.         else
  118.         {
  119.             impImportBlock(dsc->pdBB);
  120.  
  121.             if (compDonotInline())
  122.             {
  123.                 return;
  124.             }
  125.             if (compIsForImportOnly() && !tiVerificationNeeded)
  126.             {
  127.                 return;
  128.             }
  129.         }
  130.     }
  131.  
  132. #ifdef DEBUG
  133.     if (verbose && info.compXcptnsCount)
  134.     {
  135.         printf("\nAfter impImport() added block for try,catch,finally");
  136.         fgDispBasicBlocks();
  137.         printf("\n");
  138.     }
  139.  
  140.     // Used in impImportBlockPending() for STRESS_CHK_REIMPORT
  141.     for (BasicBlock* block = fgFirstBB; block; block = block->bbNext)
  142.     {
  143.         block->bbFlags &= ~BBF_VISITED;
  144.     }
  145. #endif
  146.  
  147.     assert(!compIsForInlining() || !tiVerificationNeeded);
  148. }

首先初始化运行堆栈(execution stack)verCurrentState.esStack, maxstack小于16时使用SmallStack, 否则new.
然后初始化记录"Spill Cliques"(Spill Temps的群体, 用于保存从运行堆栈spill出来的值的临时变量)所需的成员.
之后标记内部添加的(BBF_INTERNAL)BasicBlock为已导入(BBF_IMPORTED), 因为这些block并无对应的IL范围.
接下来会添加第一个非内部的BasicBlock到队列impPendingList, 然后一直处理这个队列直到它为空.
处理队列中的BasicBlock会调用函数impImportBlock(dsc->pdBB).

impImportBlock的源代码如下:

  1. //***************************************************************
  2. // Import the instructions for the given basic block.  Perform
  3. // verification, throwing an exception on failure.  Push any successor blocks that are enabled for the first
  4. // time, or whose verification pre-state is changed.
  5.  
  6. #ifdef _PREFAST_
  7. #pragma warning(push)
  8. #pragma warning(disable : 21000) // Suppress PREFast warning about overly large function
  9. #endif
  10. void Compiler::impImportBlock(BasicBlock* block)
  11. {
  12.     // BBF_INTERNAL blocks only exist during importation due to EH canonicalization. We need to
  13.     // handle them specially. In particular, there is no IL to import for them, but we do need
  14.     // to mark them as imported and put their successors on the pending import list.
  15.     if (block->bbFlags & BBF_INTERNAL)
  16.     {
  17.         JITDUMP("Marking BBF_INTERNAL block BB%02u as BBF_IMPORTED\n", block->bbNum);
  18.         block->bbFlags |= BBF_IMPORTED;
  19.  
  20.         for (unsigned i = 0; i < block->NumSucc(); i++)
  21.         {
  22.             impImportBlockPending(block->GetSucc(i));
  23.         }
  24.  
  25.         return;
  26.     }
  27.  
  28.     bool markImport;
  29.  
  30.     assert(block);
  31.  
  32.     /* Make the block globaly available */
  33.  
  34.     compCurBB = block;
  35.  
  36. #ifdef DEBUG
  37.     /* Initialize the debug variables */
  38.     impCurOpcName = "unknown";
  39.     impCurOpcOffs = block->bbCodeOffs;
  40. #endif
  41.  
  42.     /* Set the current stack state to the merged result */
  43.     verResetCurrentState(block, &verCurrentState);
  44.  
  45.     /* Now walk the code and import the IL into GenTrees */
  46.  
  47.     struct FilterVerificationExceptionsParam
  48.     {
  49.         Compiler*   pThis;
  50.         BasicBlock* block;
  51.     };
  52.     FilterVerificationExceptionsParam param;
  53.  
  54.     param.pThis = this;
  55.     param.block = block;
  56.  
  57.     PAL_TRY(FilterVerificationExceptionsParam*, pParam, &param)
  58.     {
  59.         /* @VERIFICATION : For now, the only state propagation from try
  60.            to it's handler is "thisInit" state (stack is empty at start of try).
  61.            In general, for state that we track in verification, we need to
  62.            model the possibility that an exception might happen at any IL
  63.            instruction, so we really need to merge all states that obtain
  64.            between IL instructions in a try block into the start states of
  65.            all handlers.
  67.            However we do not allow the 'this' pointer to be uninitialized when
  68.            entering most kinds try regions (only try/fault are allowed to have
  69.            an uninitialized this pointer on entry to the try)
  71.            Fortunately, the stack is thrown away when an exception
  72.            leads to a handler, so we don't have to worry about that.
  73.            We DO, however, have to worry about the "thisInit" state.
  74.            But only for the try/fault case.
  76.            The only allowed transition is from TIS_Uninit to TIS_Init.
  78.            So for a try/fault region for the fault handler block
  79.            we will merge the start state of the try begin
  80.            and the post-state of each block that is part of this try region
  81.         */
  82.  
  83.         // merge the start state of the try begin
  84.         //
  85.         if (pParam->block->bbFlags & BBF_TRY_BEG)
  86.         {
  87.             pParam->pThis->impVerifyEHBlock(pParam->block, true);
  88.         }
  89.  
  90.         pParam->pThis->impImportBlockCode(pParam->block);
  91.  
  92.         // As discussed above:
  93.         // merge the post-state of each block that is part of this try region
  94.         //
  95.         if (pParam->block->hasTryIndex())
  96.         {
  97.             pParam->pThis->impVerifyEHBlock(pParam->block, false);
  98.         }
  99.     }
  100.     PAL_EXCEPT_FILTER(FilterVerificationExceptions)
  101.     {
  102.         verHandleVerificationFailure(block DEBUGARG(false));
  103.     }
  104.     PAL_ENDTRY
  105.  
  106.     if (compDonotInline())
  107.     {
  108.         return;
  109.     }
  110.  
  111.     assert(!compDonotInline());
  112.  
  113.     markImport = false;
  114.  
  115. SPILLSTACK:
  116.  
  117.     unsigned    baseTmp             = NO_BASE_TMP; // input temps assigned to successor blocks
  118.     bool        reimportSpillClique = false;
  119.     BasicBlock* tgtBlock            = nullptr;
  120.  
  121.     /* If the stack is non-empty, we might have to spill its contents */
  122.  
  123.     if (verCurrentState.esStackDepth != 0)
  124.     {
  125.         impBoxTemp = BAD_VAR_NUM; // if a box temp is used in a block that leaves something
  126.                                   // on the stack, its lifetime is hard to determine, simply
  127.                                   // don't reuse such temps.
  128.  
  129.         GenTreePtr addStmt = nullptr;
  130.  
  131.         /* Do the successors of 'block' have any other predecessors ?
  132.            We do not want to do some of the optimizations related to multiRef
  133.            if we can reimport blocks */
  134.  
  135.         unsigned multRef = impCanReimport ? unsigned(~0) : 0;
  136.  
  137.         switch (block->bbJumpKind)
  138.         {
  139.             case BBJ_COND:
  140.  
  141.                 /* Temporarily remove the 'jtrue' from the end of the tree list */
  142.  
  143.                 assert(impTreeLast);
  144.                 assert(impTreeLast->gtOper == GT_STMT);
  145.                 assert(impTreeLast->gtStmt.gtStmtExpr->gtOper == GT_JTRUE);
  146.  
  147.                 addStmt     = impTreeLast;
  148.                 impTreeLast = impTreeLast->gtPrev;
  149.  
  150.                 /* Note if the next block has more than one ancestor */
  151.  
  152.                 multRef |= block->bbNext->bbRefs;
  153.  
  154.                 /* Does the next block have temps assigned? */
  155.  
  156.                 baseTmp  = block->bbNext->bbStkTempsIn;
  157.                 tgtBlock = block->bbNext;
  158.  
  159.                 if (baseTmp != NO_BASE_TMP)
  160.                 {
  161.                     break;
  162.                 }
  163.  
  164.                 /* Try the target of the jump then */
  165.  
  166.                 multRef |= block->bbJumpDest->bbRefs;
  167.                 baseTmp  = block->bbJumpDest->bbStkTempsIn;
  168.                 tgtBlock = block->bbJumpDest;
  169.                 break;
  170.  
  171.             case BBJ_ALWAYS:
  172.                 multRef |= block->bbJumpDest->bbRefs;
  173.                 baseTmp  = block->bbJumpDest->bbStkTempsIn;
  174.                 tgtBlock = block->bbJumpDest;
  175.                 break;
  176.  
  177.             case BBJ_NONE:
  178.                 multRef |= block->bbNext->bbRefs;
  179.                 baseTmp  = block->bbNext->bbStkTempsIn;
  180.                 tgtBlock = block->bbNext;
  181.                 break;
  182.  
  183.             case BBJ_SWITCH:
  184.  
  185.                 BasicBlock** jmpTab;
  186.                 unsigned     jmpCnt;
  187.  
  188.                 /* Temporarily remove the GT_SWITCH from the end of the tree list */
  189.  
  190.                 assert(impTreeLast);
  191.                 assert(impTreeLast->gtOper == GT_STMT);
  192.                 assert(impTreeLast->gtStmt.gtStmtExpr->gtOper == GT_SWITCH);
  193.  
  194.                 addStmt     = impTreeLast;
  195.                 impTreeLast = impTreeLast->gtPrev;
  196.  
  197.                 jmpCnt = block->bbJumpSwt->bbsCount;
  198.                 jmpTab = block->bbJumpSwt->bbsDstTab;
  199.  
  200.                 do
  201.                 {
  202.                     tgtBlock = (*jmpTab);
  203.  
  204.                     multRef |= tgtBlock->bbRefs;
  205.  
  206.                     // Thanks to spill cliques, we should have assigned all or none
  207.                     assert((baseTmp == NO_BASE_TMP) || (baseTmp == tgtBlock->bbStkTempsIn));
  208.                     baseTmp = tgtBlock->bbStkTempsIn;
  209.                     if (multRef > 1)
  210.                     {
  211.                         break;
  212.                     }
  213.                 } while (++jmpTab, --jmpCnt);
  214.  
  215.                 break;
  216.  
  217.             case BBJ_CALLFINALLY:
  218.             case BBJ_EHCATCHRET:
  219.             case BBJ_RETURN:
  220.             case BBJ_EHFINALLYRET:
  221.             case BBJ_EHFILTERRET:
  222.             case BBJ_THROW:
  223.                 NO_WAY("can't have 'unreached' end of BB with non-empty stack");
  224.                 break;
  225.  
  226.             default:
  227.                 noway_assert(!"Unexpected bbJumpKind");
  228.                 break;
  229.         }
  230.  
  231.         assert(multRef >= 1);
  232.  
  233.         /* Do we have a base temp number? */
  234.  
  235.         bool newTemps = (baseTmp == NO_BASE_TMP);
  236.  
  237.         if (newTemps)
  238.         {
  239.             /* Grab enough temps for the whole stack */
  240.             baseTmp = impGetSpillTmpBase(block);
  241.         }
  242.  
  243.         /* Spill all stack entries into temps */
  244.         unsigned level, tempNum;
  245.  
  246.         JITDUMP("\nSpilling stack entries into temps\n");
  247.         for (level = 0, tempNum = baseTmp; level < verCurrentState.esStackDepth; level++, tempNum++)
  248.         {
  249.             GenTreePtr tree = verCurrentState.esStack[level].val;
  250.  
  251.             /* VC generates code where it pushes a byref from one branch, and an int (ldc.i4 0) from
  252.                the other. This should merge to a byref in unverifiable code.
  253.                However, if the branch which leaves the TYP_I_IMPL on the stack is imported first, the
  254.                successor would be imported assuming there was a TYP_I_IMPL on
  255.                the stack. Thus the value would not get GC-tracked. Hence,
  256.                change the temp to TYP_BYREF and reimport the successors.
  257.                Note: We should only allow this in unverifiable code.
  258.             */
  259.             if (tree->gtType == TYP_BYREF && lvaTable[tempNum].lvType == TYP_I_IMPL && !verNeedsVerification())
  260.             {
  261.                 lvaTable[tempNum].lvType = TYP_BYREF;
  262.                 impReimportMarkSuccessors(block);
  263.                 markImport = true;
  264.             }
  265.  
  266. #ifdef _TARGET_64BIT_
  267.             if (genActualType(tree->gtType) == TYP_I_IMPL && lvaTable[tempNum].lvType == TYP_INT)
  268.             {
  269.                 if (tiVerificationNeeded && tgtBlock->bbEntryState != nullptr &&
  270.                     (tgtBlock->bbFlags & BBF_FAILED_VERIFICATION) == 0)
  271.                 {
  272.                     // Merge the current state into the entry state of block;
  273.                     // the call to verMergeEntryStates must have changed
  274.                     // the entry state of the block by merging the int local var
  275.                     // and the native-int stack entry.
  276.                     bool changed = false;
  277.                     if (verMergeEntryStates(tgtBlock, &changed))
  278.                     {
  279.                         impRetypeEntryStateTemps(tgtBlock);
  280.                         impReimportBlockPending(tgtBlock);
  281.                         assert(changed);
  282.                     }
  283.                     else
  284.                     {
  285.                         tgtBlock->bbFlags |= BBF_FAILED_VERIFICATION;
  286.                         break;
  287.                     }
  288.                 }
  289.  
  290.                 // Some other block in the spill clique set this to "int", but now we have "native int".
  291.                 // Change the type and go back to re-import any blocks that used the wrong type.
  292.                 lvaTable[tempNum].lvType = TYP_I_IMPL;
  293.                 reimportSpillClique      = true;
  294.             }
  295.             else if (genActualType(tree->gtType) == TYP_INT && lvaTable[tempNum].lvType == TYP_I_IMPL)
  296.             {
  297.                 // Spill clique has decided this should be "native int", but this block only pushes an "int".
  298.                 // Insert a sign-extension to "native int" so we match the clique.
  299.                 verCurrentState.esStack[level].val = gtNewCastNode(TYP_I_IMPL, tree, TYP_I_IMPL);
  300.             }
  301.  
  302.             // Consider the case where one branch left a 'byref' on the stack and the other leaves
  303.             // an 'int'. On 32-bit, this is allowed (in non-verifiable code) since they are the same
  304.             // size. JIT64 managed to make this work on 64-bit. For compatibility, we support JIT64
  305.             // behavior instead of asserting and then generating bad code (where we save/restore the
  306.             // low 32 bits of a byref pointer to an 'int' sized local). If the 'int' side has been
  307.             // imported already, we need to change the type of the local and reimport the spill clique.
  308.             // If the 'byref' side has imported, we insert a cast from int to 'native int' to match
  309.             // the 'byref' size.
  310.             if (!tiVerificationNeeded)
  311.             {
  312.                 if (genActualType(tree->gtType) == TYP_BYREF && lvaTable[tempNum].lvType == TYP_INT)
  313.                 {
  314.                     // Some other block in the spill clique set this to "int", but now we have "byref".
  315.                     // Change the type and go back to re-import any blocks that used the wrong type.
  316.                     lvaTable[tempNum].lvType = TYP_BYREF;
  317.                     reimportSpillClique      = true;
  318.                 }
  319.                 else if (genActualType(tree->gtType) == TYP_INT && lvaTable[tempNum].lvType == TYP_BYREF)
  320.                 {
  321.                     // Spill clique has decided this should be "byref", but this block only pushes an "int".
  322.                     // Insert a sign-extension to "native int" so we match the clique size.
  323.                     verCurrentState.esStack[level].val = gtNewCastNode(TYP_I_IMPL, tree, TYP_I_IMPL);
  324.                 }
  325.             }
  326. #endif // _TARGET_64BIT_
  327.  
  328. #if FEATURE_X87_DOUBLES
  329.             // X87 stack doesn't differentiate between float/double
  330.             // so promoting is no big deal.
  331.             // For everybody else keep it as float until we have a collision and then promote
  332.             // Just like for x64's TYP_INT<->TYP_I_IMPL
  333.  
  334.             if (multRef > 1 && tree->gtType == TYP_FLOAT)
  335.             {
  336.                 verCurrentState.esStack[level].val = gtNewCastNode(TYP_DOUBLE, tree, TYP_DOUBLE);
  337.             }
  338.  
  339. #else // !FEATURE_X87_DOUBLES
  340.  
  341.             if (tree->gtType == TYP_DOUBLE && lvaTable[tempNum].lvType == TYP_FLOAT)
  342.             {
  343.                 // Some other block in the spill clique set this to "float", but now we have "double".
  344.                 // Change the type and go back to re-import any blocks that used the wrong type.
  345.                 lvaTable[tempNum].lvType = TYP_DOUBLE;
  346.                 reimportSpillClique      = true;
  347.             }
  348.             else if (tree->gtType == TYP_FLOAT && lvaTable[tempNum].lvType == TYP_DOUBLE)
  349.             {
  350.                 // Spill clique has decided this should be "double", but this block only pushes a "float".
  351.                 // Insert a cast to "double" so we match the clique.
  352.                 verCurrentState.esStack[level].val = gtNewCastNode(TYP_DOUBLE, tree, TYP_DOUBLE);
  353.             }
  354.  
  355. #endif // FEATURE_X87_DOUBLES
  356.  
  357.             /* If addStmt has a reference to tempNum (can only happen if we
  358.                are spilling to the temps already used by a previous block),
  359.                we need to spill addStmt */
  360.  
  361.             if (addStmt && !newTemps && gtHasRef(addStmt->gtStmt.gtStmtExpr, tempNum, false))
  362.             {
  363.                 GenTreePtr addTree = addStmt->gtStmt.gtStmtExpr;
  364.  
  365.                 if (addTree->gtOper == GT_JTRUE)
  366.                 {
  367.                     GenTreePtr relOp = addTree->gtOp.gtOp1;
  368.                     assert(relOp->OperIsCompare());
  369.  
  370.                     var_types type = genActualType(relOp->gtOp.gtOp1->TypeGet());
  371.  
  372.                     if (gtHasRef(relOp->gtOp.gtOp1, tempNum, false))
  373.                     {
  374.                         unsigned temp = lvaGrabTemp(true DEBUGARG("spill addStmt JTRUE ref Op1"));
  375.                         impAssignTempGen(temp, relOp->gtOp.gtOp1, level);
  376.                         type              = genActualType(lvaTable[temp].TypeGet());
  377.                         relOp->gtOp.gtOp1 = gtNewLclvNode(temp, type);
  378.                     }
  379.  
  380.                     if (gtHasRef(relOp->gtOp.gtOp2, tempNum, false))
  381.                     {
  382.                         unsigned temp = lvaGrabTemp(true DEBUGARG("spill addStmt JTRUE ref Op2"));
  383.                         impAssignTempGen(temp, relOp->gtOp.gtOp2, level);
  384.                         type              = genActualType(lvaTable[temp].TypeGet());
  385.                         relOp->gtOp.gtOp2 = gtNewLclvNode(temp, type);
  386.                     }
  387.                 }
  388.                 else
  389.                 {
  390.                     assert(addTree->gtOper == GT_SWITCH && genActualType(addTree->gtOp.gtOp1->gtType) == TYP_I_IMPL);
  391.  
  392.                     unsigned temp = lvaGrabTemp(true DEBUGARG("spill addStmt SWITCH"));
  393.                     impAssignTempGen(temp, addTree->gtOp.gtOp1, level);
  394.                     addTree->gtOp.gtOp1 = gtNewLclvNode(temp, TYP_I_IMPL);
  395.                 }
  396.             }
  397.  
  398.             /* Spill the stack entry, and replace with the temp */
  399.  
  400.             if (!impSpillStackEntry(level, tempNum
  401. #ifdef DEBUG
  402.                                     ,
  403.                                     true, "Spill Stack Entry"
  404. #endif
  405.                                     ))
  406.             {
  407.                 if (markImport)
  408.                 {
  409.                     BADCODE("bad stack state");
  410.                 }
  411.  
  412.                 // Oops. Something went wrong when spilling. Bad code.
  413.                 verHandleVerificationFailure(block DEBUGARG(true));
  414.  
  415.                 goto SPILLSTACK;
  416.             }
  417.         }
  418.  
  419.         /* Put back the 'jtrue'/'switch' if we removed it earlier */
  420.  
  421.         if (addStmt)
  422.         {
  423.             impAppendStmt(addStmt, (unsigned)CHECK_SPILL_NONE);
  424.         }
  425.     }
  426.  
  427.     // Some of the append/spill logic works on compCurBB
  428.  
  429.     assert(compCurBB == block);
  430.  
  431.     /* Save the tree list in the block */
  432.     impEndTreeList(block);
  433.  
  434.     // impEndTreeList sets BBF_IMPORTED on the block
  435.     // We do *NOT* want to set it later than this because
  436.     // impReimportSpillClique might clear it if this block is both a
  437.     // predecessor and successor in the current spill clique
  438.     assert(block->bbFlags & BBF_IMPORTED);
  439.  
  440.     // If we had a int/native int, or float/double collision, we need to re-import
  441.     if (reimportSpillClique)
  442.     {
  443.         // This will re-import all the successors of block (as well as each of their predecessors)
  444.         impReimportSpillClique(block);
  445.  
  446.         // For blocks that haven't been imported yet, we still need to mark them as pending import.
  447.         for (unsigned i = 0; i < block->NumSucc(); i++)
  448.         {
  449.             BasicBlock* succ = block->GetSucc(i);
  450.             if ((succ->bbFlags & BBF_IMPORTED) == 0)
  451.             {
  452.                 impImportBlockPending(succ);
  453.             }
  454.         }
  455.     }
  456.     else // the normal case
  457.     {
  458.         // otherwise just import the successors of block
  459.  
  460.         /* Does this block jump to any other blocks? */
  461.         for (unsigned i = 0; i < block->NumSucc(); i++)
  462.         {
  463.             impImportBlockPending(block->GetSucc(i));
  464.         }
  465.     }
  466. }
  467. #ifdef _PREFAST_
  468. #pragma warning(pop)
  469. #endif

这个函数首先会调用impImportBlockCode, impImportBlockCode负责根据IL生成GenTree的主要处理.
导入block后, 如果运行堆栈不为空(跳转后的指令需要跳转前push进去的参数), 需要把运行堆栈中的值spill到临时变量.
block结束后spill的临时变量的索引开始值会保存在bbStkTempsOut, block开始时需要读取的临时变量的索引开始值保存在bbStkTempsIn.
因为运行堆栈中的值基本上不会跨越BasicBlock(从C#编译出来的IL), 就不详细分析这里的逻辑了.
接下来看impImportBlockCode.

impImportBlockCode的源代码如下:
这个函数有5000多行, 这里我只截取一部分.

  1. #ifdef _PREFAST_
  2. #pragma warning(push)
  3. #pragma warning(disable : 21000) // Suppress PREFast warning about overly large function
  4. #endif
  5. /*****************************************************************************
  6.  *  Import the instr for the given basic block
  7.  */
  8. void Compiler::impImportBlockCode(BasicBlock* block)
  9. {
  10. #define _impResolveToken(kind) impResolveToken(codeAddr, &resolvedToken, kind)
  11.  
  12. #ifdef DEBUG
  13.  
  14.     if (verbose)
  15.     {
  16.         printf("\nImporting BB%02u (PC=%03u) of '%s'", block->bbNum, block->bbCodeOffs, info.compFullName);
  17.     }
  18. #endif
  19.  
  20.     unsigned  nxtStmtIndex = impInitBlockLineInfo();
  21.     IL_OFFSET nxtStmtOffs;
  22.  
  23.     GenTreePtr                   arrayNodeFrom, arrayNodeTo, arrayNodeToIndex;
  24.     bool                         expandInline;
  25.     CorInfoHelpFunc              helper;
  26.     CorInfoIsAccessAllowedResult accessAllowedResult;
  27.     CORINFO_HELPER_DESC          calloutHelper;
  28.     const BYTE*                  lastLoadToken = nullptr;
  29.  
  30.     // reject cyclic constraints
  31.     if (tiVerificationNeeded)
  32.     {
  33.         Verify(!info.hasCircularClassConstraints, "Method parent has circular class type parameter constraints.");
  34.         Verify(!info.hasCircularMethodConstraints, "Method has circular method type parameter constraints.");
  35.     }
  36.  
  37.     /* Get the tree list started */
  38.  
  39.     impBeginTreeList();
  40.  
  41.     /* Walk the opcodes that comprise the basic block */
  42.  
  43.     const BYTE* codeAddr = info.compCode + block->bbCodeOffs;
  44.     const BYTE* codeEndp = info.compCode + block->bbCodeOffsEnd;
  45.  
  46.     IL_OFFSET opcodeOffs    = block->bbCodeOffs;
  47.     IL_OFFSET lastSpillOffs = opcodeOffs;
  48.  
  49.     signed jmpDist;
  50.  
  51.     /* remember the start of the delegate creation sequence (used for verification) */
  52.     const BYTE* delegateCreateStart = nullptr;
  53.  
  54.     int  prefixFlags = 0;
  55.     bool explicitTailCall, constraintCall, readonlyCall;
  56.  
  57.     bool     insertLdloc = false; // set by CEE_DUP and cleared by following store
  58.     typeInfo tiRetVal;
  59.  
  60.     unsigned numArgs = info.compArgsCount;
  61.  
  62.     /* Now process all the opcodes in the block */
  63.  
  64.     var_types callTyp    = TYP_COUNT;
  65.     OPCODE    prevOpcode = CEE_ILLEGAL;
  66.  
  67.     if (block->bbCatchTyp)
  68.     {
  69.         if (info.compStmtOffsetsImplicit & ICorDebugInfo::CALL_SITE_BOUNDARIES)
  70.         {
  71.             impCurStmtOffsSet(block->bbCodeOffs);
  72.         }
  73.  
  74.         // We will spill the GT_CATCH_ARG and the input of the BB_QMARK block
  75.         // to a temp. This is a trade off for code simplicity
  76.         impSpillSpecialSideEff();
  77.     }
  78.  
  79.     while (codeAddr < codeEndp)
  80.     {
  81.         bool                   usingReadyToRunHelper = false;
  82.         CORINFO_RESOLVED_TOKEN resolvedToken;
  83.         CORINFO_RESOLVED_TOKEN constrainedResolvedToken;
  84.         CORINFO_CALL_INFO      callInfo;
  85.         CORINFO_FIELD_INFO     fieldInfo;
  86.  
  87.         tiRetVal = typeInfo(); // Default type info
  88.  
  89.         //---------------------------------------------------------------------
  90.  
  91.         /* We need to restrict the max tree depth as many of the Compiler
  92.            functions are recursive. We do this by spilling the stack */
  93.  
  94.         if (verCurrentState.esStackDepth)
  95.         {
  96.             /* Has it been a while since we last saw a non-empty stack (which
  97.                guarantees that the tree depth isnt accumulating. */
  98.  
  99.             if ((opcodeOffs - lastSpillOffs) > 200)
  100.             {
  101.                 impSpillStackEnsure();
  102.                 lastSpillOffs = opcodeOffs;
  103.             }
  104.         }
  105.         else
  106.         {
  107.             lastSpillOffs   = opcodeOffs;
  108.             impBoxTempInUse = false; // nothing on the stack, box temp OK to use again
  109.         }
  110.  
  111.         /* Compute the current instr offset */
  112.  
  113.         opcodeOffs = (IL_OFFSET)(codeAddr - info.compCode);
  114.  
  115. #if defined(DEBUGGING_SUPPORT) || defined(DEBUG)
  116.  
  117. #ifndef DEBUG
  118.         if (opts.compDbgInfo)
  119. #endif
  120.         {
  121.             if (!compIsForInlining())
  122.             {
  123.                 nxtStmtOffs =
  124.                     (nxtStmtIndex < info.compStmtOffsetsCount) ? info.compStmtOffsets[nxtStmtIndex] : BAD_IL_OFFSET;
  125.  
  126.                 /* Have we reached the next stmt boundary ? */
  127.  
  128.                 if (nxtStmtOffs != BAD_IL_OFFSET && opcodeOffs >= nxtStmtOffs)
  129.                 {
  130.                     assert(nxtStmtOffs == info.compStmtOffsets[nxtStmtIndex]);
  131.  
  132.                     if (verCurrentState.esStackDepth != 0 && opts.compDbgCode)
  133.                     {
  134.                         /* We need to provide accurate IP-mapping at this point.
  135.                            So spill anything on the stack so that it will form
  136.                            gtStmts with the correct stmt offset noted */
  137.  
  138.                         impSpillStackEnsure(true);
  139.                     }
  140.  
  141.                     // Has impCurStmtOffs been reported in any tree?
  142.  
  143.                     if (impCurStmtOffs != BAD_IL_OFFSET && opts.compDbgCode)
  144.                     {
  145.                         GenTreePtr placeHolder = new (this, GT_NO_OP) GenTree(GT_NO_OP, TYP_VOID);
  146.                         impAppendTree(placeHolder, (unsigned)CHECK_SPILL_NONE, impCurStmtOffs);
  147.  
  148.                         assert(impCurStmtOffs == BAD_IL_OFFSET);
  149.                     }
  150.  
  151.                     if (impCurStmtOffs == BAD_IL_OFFSET)
  152.                     {
  153.                         /* Make sure that nxtStmtIndex is in sync with opcodeOffs.
  154.                            If opcodeOffs has gone past nxtStmtIndex, catch up */
  155.  
  156.                         while ((nxtStmtIndex + 1) < info.compStmtOffsetsCount &&
  157.                                info.compStmtOffsets[nxtStmtIndex + 1] <= opcodeOffs)
  158.                         {
  159.                             nxtStmtIndex++;
  160.                         }
  161.  
  162.                         /* Go to the new stmt */
  163.  
  164.                         impCurStmtOffsSet(info.compStmtOffsets[nxtStmtIndex]);
  165.  
  166.                         /* Update the stmt boundary index */
  167.  
  168.                         nxtStmtIndex++;
  169.                         assert(nxtStmtIndex <= info.compStmtOffsetsCount);
  170.  
  171.                         /* Are there any more line# entries after this one? */
  172.  
  173.                         if (nxtStmtIndex < info.compStmtOffsetsCount)
  174.                         {
  175.                             /* Remember where the next line# starts */
  176.  
  177.                             nxtStmtOffs = info.compStmtOffsets[nxtStmtIndex];
  178.                         }
  179.                         else
  180.                         {
  181.                             /* No more line# entries */
  182.  
  183.                             nxtStmtOffs = BAD_IL_OFFSET;
  184.                         }
  185.                     }
  186.                 }
  187.                 else if ((info.compStmtOffsetsImplicit & ICorDebugInfo::STACK_EMPTY_BOUNDARIES) &&
  188.                          (verCurrentState.esStackDepth == 0))
  189.                 {
  190.                     /* At stack-empty locations, we have already added the tree to
  191.                        the stmt list with the last offset. We just need to update
  192.                        impCurStmtOffs
  193.                      */
  194.  
  195.                     impCurStmtOffsSet(opcodeOffs);
  196.                 }
  197.                 else if ((info.compStmtOffsetsImplicit & ICorDebugInfo::CALL_SITE_BOUNDARIES) &&
  198.                          impOpcodeIsCallSiteBoundary(prevOpcode))
  199.                 {
  200.                     /* Make sure we have a type cached */
  201.                     assert(callTyp != TYP_COUNT);
  202.  
  203.                     if (callTyp == TYP_VOID)
  204.                     {
  205.                         impCurStmtOffsSet(opcodeOffs);
  206.                     }
  207.                     else if (opts.compDbgCode)
  208.                     {
  209.                         impSpillStackEnsure(true);
  210.                         impCurStmtOffsSet(opcodeOffs);
  211.                     }
  212.                 }
  213.                 else if ((info.compStmtOffsetsImplicit & ICorDebugInfo::NOP_BOUNDARIES) && (prevOpcode == CEE_NOP))
  214.                 {
  215.                     if (opts.compDbgCode)
  216.                     {
  217.                         impSpillStackEnsure(true);
  218.                     }
  219.  
  220.                     impCurStmtOffsSet(opcodeOffs);
  221.                 }
  222.  
  223.                 assert(impCurStmtOffs == BAD_IL_OFFSET || nxtStmtOffs == BAD_IL_OFFSET ||
  224.                        jitGetILoffs(impCurStmtOffs) <= nxtStmtOffs);
  225.             }
  226.         }
  227.  
  228. #endif // defined(DEBUGGING_SUPPORT) || defined(DEBUG)
  229.  
  230.         CORINFO_CLASS_HANDLE clsHnd       = DUMMY_INIT(NULL);
  231.         CORINFO_CLASS_HANDLE ldelemClsHnd = DUMMY_INIT(NULL);
  232.         CORINFO_CLASS_HANDLE stelemClsHnd = DUMMY_INIT(NULL);
  233.  
  234.         var_types       lclTyp, ovflType = TYP_UNKNOWN;
  235.         GenTreePtr      op1           = DUMMY_INIT(NULL);
  236.         GenTreePtr      op2           = DUMMY_INIT(NULL);
  237.         GenTreeArgList* args          = nullptr; // What good do these "DUMMY_INIT"s do?
  238.         GenTreePtr      newObjThisPtr = DUMMY_INIT(NULL);
  239.         bool            uns           = DUMMY_INIT(false);
  240.  
  241.         /* Get the next opcode and the size of its parameters */
  242.  
  243.         OPCODE opcode = (OPCODE)getU1LittleEndian(codeAddr);
  244.         codeAddr += sizeof(__int8);
  245.  
  246. #ifdef DEBUG
  247.         impCurOpcOffs = (IL_OFFSET)(codeAddr - info.compCode - 1);
  248.         JITDUMP("\n    [%2u] %3u (0x%03x) ", verCurrentState.esStackDepth, impCurOpcOffs, impCurOpcOffs);
  249. #endif
  250.  
  251.     DECODE_OPCODE:
  252.  
  253.         // Return if any previous code has caused inline to fail.
  254.         if (compDonotInline())
  255.         {
  256.             return;
  257.         }
  258.  
  259.         /* Get the size of additional parameters */
  260.  
  261.         signed int sz = opcodeSizes[opcode];
  262.  
  263. #ifdef DEBUG
  264.         clsHnd  = NO_CLASS_HANDLE;
  265.         lclTyp  = TYP_COUNT;
  266.         callTyp = TYP_COUNT;
  267.  
  268.         impCurOpcOffs = (IL_OFFSET)(codeAddr - info.compCode - 1);
  269.         impCurOpcName = opcodeNames[opcode];
  270.  
  271.         if (verbose && (opcode != CEE_PREFIX1))
  272.         {
  273.             printf("%s", impCurOpcName);
  274.         }
  275.  
  276.         /* Use assertImp() to display the opcode */
  277.  
  278.         op1 = op2 = nullptr;
  279. #endif
  280.  
  281.         /* See what kind of an opcode we have, then */
  282.  
  283.         unsigned mflags   = 0;
  284.         unsigned clsFlags = 0;
  285.  
  286.         switch (opcode)
  287.         {
  288.             unsigned  lclNum;
  289.             var_types type;
  290.  
  291.             GenTreePtr op3;
  292.             genTreeOps oper;
  293.             unsigned   size;
  294.  
  295.             int val;
  296.  
  297.             CORINFO_SIG_INFO     sig;
  298.             unsigned             flags;
  299.             IL_OFFSET            jmpAddr;
  300.             bool                 ovfl, unordered, callNode;
  301.             bool                 ldstruct;
  302.             CORINFO_CLASS_HANDLE tokenType;
  303.  
  304.             union {
  305.                 int     intVal;
  306.                 float   fltVal;
  307.                 __int64 lngVal;
  308.                 double  dblVal;
  309.             } cval;
  310.  
  311.             case CEE_PREFIX1:
  312.                 opcode = (OPCODE)(getU1LittleEndian(codeAddr) + 256);
  313.                 codeAddr += sizeof(__int8);
  314.                 opcodeOffs = (IL_OFFSET)(codeAddr - info.compCode);
  315.                 goto DECODE_OPCODE;
  316.  
  317.             SPILL_APPEND:
  318.  
  319.                 /* Append 'op1' to the list of statements */
  320.                 impAppendTree(op1, (unsigned)CHECK_SPILL_ALL, impCurStmtOffs);
  321.                 goto DONE_APPEND;
  322.  
  323.             APPEND:
  324.  
  325.                 /* Append 'op1' to the list of statements */
  326.  
  327.                 impAppendTree(op1, (unsigned)CHECK_SPILL_NONE, impCurStmtOffs);
  328.                 goto DONE_APPEND;
  329.  
  330.             DONE_APPEND:
  331.  
  332. #ifdef DEBUG
  333.                 // Remember at which BC offset the tree was finished
  334.                 impNoteLastILoffs();
  335. #endif
  336.                 break;
  337.  
  338.             case CEE_LDNULL:
  339.                 impPushNullObjRefOnStack();
  340.                 break;
  341.  
  342.             case CEE_LDC_I4_M1:
  343.             case CEE_LDC_I4_0:
  344.             case CEE_LDC_I4_1:
  345.             case CEE_LDC_I4_2:
  346.             case CEE_LDC_I4_3:
  347.             case CEE_LDC_I4_4:
  348.             case CEE_LDC_I4_5:
  349.             case CEE_LDC_I4_6:
  350.             case CEE_LDC_I4_7:
  351.             case CEE_LDC_I4_8:
  352.                 cval.intVal = (opcode - CEE_LDC_I4_0);
  353.                 assert(-1 <= cval.intVal && cval.intVal <= 8);
  354.                 goto PUSH_I4CON;
  355.  
  356.             case CEE_LDC_I4_S:
  357.                 cval.intVal = getI1LittleEndian(codeAddr);
  358.                 goto PUSH_I4CON;
  359.             case CEE_LDC_I4:
  360.                 cval.intVal = getI4LittleEndian(codeAddr);
  361.                 goto PUSH_I4CON;
  362.             PUSH_I4CON:
  363.                 JITDUMP(" %d", cval.intVal);
  364.                 impPushOnStack(gtNewIconNode(cval.intVal), typeInfo(TI_INT));
  365.                 break;
  366.  
  367.             case CEE_LDC_I8:
  368.                 cval.lngVal = getI8LittleEndian(codeAddr);
  369.                 JITDUMP(" 0x%016llx", cval.lngVal);
  370.                 impPushOnStack(gtNewLconNode(cval.lngVal), typeInfo(TI_LONG));
  371.                 break;
  372.  
  373.             case CEE_LDC_R8:
  374.                 cval.dblVal = getR8LittleEndian(codeAddr);
  375.                 JITDUMP(" %#.17g", cval.dblVal);
  376.                 impPushOnStack(gtNewDconNode(cval.dblVal), typeInfo(TI_DOUBLE));
  377.                 break;
  378.  
  379.             case CEE_LDC_R4:
  380.                 cval.dblVal = getR4LittleEndian(codeAddr);
  381.                 JITDUMP(" %#.17g", cval.dblVal);
  382.                 {
  383.                     GenTreePtr cnsOp = gtNewDconNode(cval.dblVal);
  384. #if !FEATURE_X87_DOUBLES
  385.                     // X87 stack doesn't differentiate between float/double
  386.                     // so R4 is treated as R8, but everybody else does
  387.                     cnsOp->gtType = TYP_FLOAT;
  388. #endif // FEATURE_X87_DOUBLES
  389.                     impPushOnStack(cnsOp, typeInfo(TI_DOUBLE));
  390.                 }
  391.                 break;
  392.  
  393.             case CEE_LDSTR:
  394.  
  395.                 if (compIsForInlining())
  396.                 {
  397.                     if (impInlineInfo->inlineCandidateInfo->dwRestrictions & INLINE_NO_CALLEE_LDSTR)
  398.                     {
  399.                         compInlineResult->NoteFatal(InlineObservation::CALLSITE_HAS_LDSTR_RESTRICTION);
  400.                         return;
  401.                     }
  402.                 }
  403.  
  404.                 val = getU4LittleEndian(codeAddr);
  405.                 JITDUMP(" %08X", val);
  406.                 if (tiVerificationNeeded)
  407.                 {
  408.                     Verify(info.compCompHnd->isValidStringRef(info.compScopeHnd, val), "bad string");
  409.                     tiRetVal = typeInfo(TI_REF, impGetStringClass());
  410.                 }
  411.                 impPushOnStack(gtNewSconNode(val, info.compScopeHnd), tiRetVal);
  412.  
  413.                 break;
  414.  
  415.             case CEE_LDARG:
  416.                 lclNum = getU2LittleEndian(codeAddr);
  417.                 JITDUMP(" %u", lclNum);
  418.                 impLoadArg(lclNum, opcodeOffs + sz + 1);
  419.                 break;
  420.  
  421.             case CEE_LDARG_S:
  422.                 lclNum = getU1LittleEndian(codeAddr);
  423.                 JITDUMP(" %u", lclNum);
  424.                 impLoadArg(lclNum, opcodeOffs + sz + 1);
  425.                 break;
  426.  
  427.             case CEE_LDARG_0:
  428.             case CEE_LDARG_1:
  429.             case CEE_LDARG_2:
  430.             case CEE_LDARG_3:
  431.                 lclNum = (opcode - CEE_LDARG_0);
  432.                 assert(lclNum >= 0 && lclNum < 4);
  433.                 impLoadArg(lclNum, opcodeOffs + sz + 1);
  434.                 break;
  435.  
  436.             case CEE_LDLOC:
  437.                 lclNum = getU2LittleEndian(codeAddr);
  438.                 JITDUMP(" %u", lclNum);
  439.                 impLoadLoc(lclNum, opcodeOffs + sz + 1);
  440.                 break;
  441.  
  442.             case CEE_LDLOC_S:
  443.                 lclNum = getU1LittleEndian(codeAddr);
  444.                 JITDUMP(" %u", lclNum);
  445.                 impLoadLoc(lclNum, opcodeOffs + sz + 1);
  446.                 break;
  447.  
  448.             case CEE_LDLOC_0:
  449.             case CEE_LDLOC_1:
  450.             case CEE_LDLOC_2:
  451.             case CEE_LDLOC_3:
  452.                 lclNum = (opcode - CEE_LDLOC_0);
  453.                 assert(lclNum >= 0 && lclNum < 4);
  454.                 impLoadLoc(lclNum, opcodeOffs + sz + 1);
  455.                 break;
  456.  
  457.             case CEE_STARG:
  458.                 lclNum = getU2LittleEndian(codeAddr);
  459.                 goto STARG;
  460.  
  461.             case CEE_STARG_S:
  462.                 lclNum = getU1LittleEndian(codeAddr);
  463.             STARG:
  464.                 JITDUMP(" %u", lclNum);
  465.  
  466.                 if (tiVerificationNeeded)
  467.                 {
  468.                     Verify(lclNum < info.compILargsCount, "bad arg num");
  469.                 }
  470.  
  471.                 if (compIsForInlining())
  472.                 {
  473.                     op1 = impInlineFetchArg(lclNum, impInlineInfo->inlArgInfo, impInlineInfo->lclVarInfo);
  474.                     noway_assert(op1->gtOper == GT_LCL_VAR);
  475.                     lclNum = op1->AsLclVar()->gtLclNum;
  476.  
  477.                     goto VAR_ST_VALID;
  478.                 }
  479.  
  480.                 lclNum = compMapILargNum(lclNum); // account for possible hidden param
  481.                 assertImp(lclNum < numArgs);
  482.  
  483.                 if (lclNum == info.compThisArg)
  484.                 {
  485.                     lclNum = lvaArg0Var;
  486.                 }
  487.                 lvaTable[lclNum].lvArgWrite = 1;
  488.  
  489.                 if (tiVerificationNeeded)
  490.                 {
  491.                     typeInfo& tiLclVar = lvaTable[lclNum].lvVerTypeInfo;
  492.                     Verify(tiCompatibleWith(impStackTop().seTypeInfo, NormaliseForStack(tiLclVar), true),
  493.                            "type mismatch");
  494.  
  495.                     if (verTrackObjCtorInitState && (verCurrentState.thisInitialized != TIS_Init))
  496.                     {
  497.                         Verify(!tiLclVar.IsThisPtr(), "storing to uninit this ptr");
  498.                     }
  499.                 }
  500.  
  501.                 goto VAR_ST;
  502.  
  503.             case CEE_STLOC:
  504.                 lclNum = getU2LittleEndian(codeAddr);
  505.                 JITDUMP(" %u", lclNum);
  506.                 goto LOC_ST;
  507.  
  508.             case CEE_STLOC_S:
  509.                 lclNum = getU1LittleEndian(codeAddr);
  510.                 JITDUMP(" %u", lclNum);
  511.                 goto LOC_ST;
  512.  
  513.             case CEE_STLOC_0:
  514.             case CEE_STLOC_1:
  515.             case CEE_STLOC_2:
  516.             case CEE_STLOC_3:
  517.                 lclNum = (opcode - CEE_STLOC_0);
  518.                 assert(lclNum >= 0 && lclNum < 4);
  519.  
  520.             LOC_ST:
  521.                 if (tiVerificationNeeded)
  522.                 {
  523.                     Verify(lclNum < info.compMethodInfo->locals.numArgs, "bad local num");
  524.                     Verify(tiCompatibleWith(impStackTop().seTypeInfo,
  525.                                             NormaliseForStack(lvaTable[lclNum + numArgs].lvVerTypeInfo), true),
  526.                            "type mismatch");
  527.                 }
  528.  
  529.                 if (compIsForInlining())
  530.                 {
  531.                     lclTyp = impInlineInfo->lclVarInfo[lclNum + impInlineInfo->argCnt].lclTypeInfo;
  532.  
  533.                     /* Have we allocated a temp for this local? */
  534.  
  535.                     lclNum = impInlineFetchLocal(lclNum DEBUGARG("Inline stloc first use temp"));
  536.  
  537.                     goto _PopValue;
  538.                 }
  539.  
  540.                 lclNum += numArgs;
  541.  
  542.             VAR_ST:
  543.  
  544.                 if (lclNum >= info.compLocalsCount && lclNum != lvaArg0Var)
  545.                 {
  546.                     assert(!tiVerificationNeeded); // We should have thrown the VerificationException before.
  547.                     BADCODE("Bad IL");
  548.                 }
  549.  
  550.             VAR_ST_VALID:
  551.  
  552.                 /* if it is a struct assignment, make certain we don't overflow the buffer */
  553.                 assert(lclTyp != TYP_STRUCT || lvaLclSize(lclNum) >= info.compCompHnd->getClassSize(clsHnd));
  554.  
  555.                 if (lvaTable[lclNum].lvNormalizeOnLoad())
  556.                 {
  557.                     lclTyp = lvaGetRealType(lclNum);
  558.                 }
  559.                 else
  560.                 {
  561.                     lclTyp = lvaGetActualType(lclNum);
  562.                 }
  563.  
  564.             _PopValue:
  565.                 /* Pop the value being assigned */
  566.  
  567.                 {
  568.                     StackEntry se = impPopStack(clsHnd);
  569.                     op1           = se.val;
  570.                     tiRetVal      = se.seTypeInfo;
  571.                 }
  572.  
  573. #ifdef FEATURE_SIMD
  574.                 if (varTypeIsSIMD(lclTyp) && (lclTyp != op1->TypeGet()))
  575.                 {
  576.                     assert(op1->TypeGet() == TYP_STRUCT);
  577.                     op1->gtType = lclTyp;
  578.                 }
  579. #endif // FEATURE_SIMD
  580.  
  581.                 op1 = impImplicitIorI4Cast(op1, lclTyp);
  582.  
  583. #ifdef _TARGET_64BIT_
  584.                 // Downcast the TYP_I_IMPL into a 32-bit Int for x86 JIT compatiblity
  585.                 if (varTypeIsI(op1->TypeGet()) && (genActualType(lclTyp) == TYP_INT))
  586.                 {
  587.                     assert(!tiVerificationNeeded); // We should have thrown the VerificationException before.
  588.                     op1 = gtNewCastNode(TYP_INT, op1, TYP_INT);
  589.                 }
  590. #endif // _TARGET_64BIT_
  591.  
  592.                 // We had better assign it a value of the correct type
  593.                 assertImp(
  594.                     genActualType(lclTyp) == genActualType(op1->gtType) ||
  595.                     genActualType(lclTyp) == TYP_I_IMPL && op1->IsVarAddr() ||
  596.                     (genActualType(lclTyp) == TYP_I_IMPL && (op1->gtType == TYP_BYREF || op1->gtType == TYP_REF)) ||
  597.                     (genActualType(op1->gtType) == TYP_I_IMPL && lclTyp == TYP_BYREF) ||
  598.                     (varTypeIsFloating(lclTyp) && varTypeIsFloating(op1->TypeGet())) ||
  599.                     ((genActualType(lclTyp) == TYP_BYREF) && genActualType(op1->TypeGet()) == TYP_REF));
  600.  
  601.                 /* If op1 is "&var" then its type is the transient "*" and it can
  602.                    be used either as TYP_BYREF or TYP_I_IMPL */
  603.  
  604.                 if (op1->IsVarAddr())
  605.                 {
  606.                     assertImp(genActualType(lclTyp) == TYP_I_IMPL || lclTyp == TYP_BYREF);
  607.  
  608.                     /* When "&var" is created, we assume it is a byref. If it is
  609.                        being assigned to a TYP_I_IMPL var, change the type to
  610.                        prevent unnecessary GC info */
  611.  
  612.                     if (genActualType(lclTyp) == TYP_I_IMPL)
  613.                     {
  614.                         op1->gtType = TYP_I_IMPL;
  615.                     }
  616.                 }
  617.  
  618.                 /* Filter out simple assignments to itself */
  619.  
  620.                 if (op1->gtOper == GT_LCL_VAR && lclNum == op1->gtLclVarCommon.gtLclNum)
  621.                 {
  622.                     if (insertLdloc)
  623.                     {
  624.                         // This is a sequence of (ldloc, dup, stloc).  Can simplify
  625.                         // to (ldloc, stloc).  Goto LDVAR to reconstruct the ldloc node.
  626.                         CLANG_FORMAT_COMMENT_ANCHOR;
  627.  
  628. #ifdef DEBUG
  629.                         if (tiVerificationNeeded)
  630.                         {
  631.                             assert(
  632.                                 typeInfo::AreEquivalent(tiRetVal, NormaliseForStack(lvaTable[lclNum].lvVerTypeInfo)));
  633.                         }
  634. #endif
  635.  
  636.                         op1         = nullptr;
  637.                         insertLdloc = false;
  638.  
  639.                         impLoadVar(lclNum, opcodeOffs + sz + 1);
  640.                         break;
  641.                     }
  642.                     else if (opts.compDbgCode)
  643.                     {
  644.                         op1 = gtNewNothingNode();
  645.                         goto SPILL_APPEND;
  646.                     }
  647.                     else
  648.                     {
  649.                         break;
  650.                     }
  651.                 }
  652.  
  653.                 /* Create the assignment node */
  654.  
  655.                 op2 = gtNewLclvNode(lclNum, lclTyp, opcodeOffs + sz + 1);
  656.  
  657.                 /* If the local is aliased, we need to spill calls and
  658.                    indirections from the stack. */
  659.  
  660.                 if ((lvaTable[lclNum].lvAddrExposed || lvaTable[lclNum].lvHasLdAddrOp) &&
  661.                     verCurrentState.esStackDepth > 0)
  662.                 {
  663.                     impSpillSideEffects(false, (unsigned)CHECK_SPILL_ALL DEBUGARG("Local could be aliased"));
  664.                 }
  665.  
  666.                 /* Spill any refs to the local from the stack */
  667.  
  668.                 impSpillLclRefs(lclNum);
  669.  
  670. #if !FEATURE_X87_DOUBLES
  671.                 // We can generate an assignment to a TYP_FLOAT from a TYP_DOUBLE
  672.                 // We insert a cast to the dest 'op2' type
  673.                 //
  674.                 if ((op1->TypeGet() != op2->TypeGet()) && varTypeIsFloating(op1->gtType) &&
  675.                     varTypeIsFloating(op2->gtType))
  676.                 {
  677.                     op1 = gtNewCastNode(op2->TypeGet(), op1, op2->TypeGet());
  678.                 }
  679. #endif // !FEATURE_X87_DOUBLES
  680.  
  681.                 if (varTypeIsStruct(lclTyp))
  682.                 {
  683.                     op1 = impAssignStruct(op2, op1, clsHnd, (unsigned)CHECK_SPILL_ALL);
  684.                 }
  685.                 else
  686.                 {
  687.                     // The code generator generates GC tracking information
  688.                     // based on the RHS of the assignment.  Later the LHS (which is
  689.                     // is a BYREF) gets used and the emitter checks that that variable
  690.                     // is being tracked.  It is not (since the RHS was an int and did
  691.                     // not need tracking).  To keep this assert happy, we change the RHS
  692.                     if (lclTyp == TYP_BYREF && !varTypeIsGC(op1->gtType))
  693.                     {
  694.                         op1->gtType = TYP_BYREF;
  695.                     }
  696.                     op1 = gtNewAssignNode(op2, op1);
  697.                 }
  698.  
  699.                 /* If insertLdloc is true, then we need to insert a ldloc following the
  700.                    stloc.  This is done when converting a (dup, stloc) sequence into
  701.                    a (stloc, ldloc) sequence. */
  702.  
  703.                 if (insertLdloc)
  704.                 {
  705.                     // From SPILL_APPEND
  706.                     impAppendTree(op1, (unsigned)CHECK_SPILL_ALL, impCurStmtOffs);
  707.  
  708. #ifdef DEBUG
  709.                     // From DONE_APPEND
  710.                     impNoteLastILoffs();
  711. #endif
  712.                     op1         = nullptr;
  713.                     insertLdloc = false;
  714.  
  715.                     impLoadVar(lclNum, opcodeOffs + sz + 1, tiRetVal);
  716.                     break;
  717.                 }
  718.  
  719.                 goto SPILL_APPEND;
  720.  
  721.             // 省略了一堆case...
  722.  
  723.             case CEE_NOP:
  724.                 if (opts.compDbgCode)
  725.                 {
  726.                     op1 = new (this, GT_NO_OP) GenTree(GT_NO_OP, TYP_VOID);
  727.                     goto SPILL_APPEND;
  728.                 }
  729.                 break;
  730.  
  731.             /******************************** NYI *******************************/
  732.  
  733.             case 0xCC:
  734.                 OutputDebugStringA("CLR: Invalid x86 breakpoint in IL stream\n");
  735.  
  736.             case CEE_ILLEGAL:
  737.             case CEE_MACRO_END:
  738.  
  739.             default:
  740.                 BADCODE3("unknown opcode", ": %02X", (int)opcode);
  741.         }
  742.  
  743.         codeAddr += sz;
  744.         prevOpcode = opcode;
  745.  
  746.         prefixFlags = 0;
  747.         assert(!insertLdloc || opcode == CEE_DUP);
  748.     }
  749.  
  750.     assert(!insertLdloc);
  751.  
  752.     return;
  753. #undef _impResolveToken
  754. }
  755. #ifdef _PREFAST_
  756. #pragma warning(pop)
  757. #endif

首先codeAddr和codeEndp是block对应的IL的开始和结束地址, opcode是当前地址对应的byte,
以ldloc.0为例, 这个指令的二进制是06, 06是opcode CEE_LDLOC_0,
以ldc.i4.s 100为例, 这个指令的二进制是1f 64, 1f是opcode CEE_LDC_I4_S, 64是参数也就是100的16进制.
这个函数会用一个循环来解析属于当前block的IL范围内的IL指令, 因为IL指令有很多, 我只能挑几个典型的来解释.

IL指令ldc.i4.s会向运行堆栈推入一个常量int, 常量的范围在1 byte以内, 解析的代码如下:

  1. case CEE_LDC_I4_S:
  2.     cval.intVal = getI1LittleEndian(codeAddr);
  3.     goto PUSH_I4CON;
  4. case CEE_LDC_I4:
  5.     cval.intVal = getI4LittleEndian(codeAddr);
  6.     goto PUSH_I4CON;
  7. PUSH_I4CON:
  8.     JITDUMP(" %d", cval.intVal);
  9.     impPushOnStack(gtNewIconNode(cval.intVal), typeInfo(TI_INT));
  10.     break;

我们可以看到它会读取指令后的1 byte(无s的指令会读取4 byte), 然后调用impPushOnStack(gtNewIconNode(cval.intVal), typeInfo(TI_INT)).
gtNewIconNode函数(Icon是int constant的缩写)会创建一个GT_CNS_INT类型的GenTree, 表示int常量的节点.
创建节点后会把这个节点推到运行堆栈里, impPushOnStack的源代码如下:

  1. /*****************************************************************************
  2.  *
  3.  *  Pushes the given tree on the stack.
  4.  */
  5.  
  6. void Compiler::impPushOnStack(GenTreePtr tree, typeInfo ti)
  7. {
  8.     /* Check for overflow. If inlining, we may be using a bigger stack */
  9.  
  10.     if ((verCurrentState.esStackDepth >= info.compMaxStack) &&
  11.         (verCurrentState.esStackDepth >= impStkSize || ((compCurBB->bbFlags & BBF_IMPORTED) == 0)))
  12.     {
  13.         BADCODE("stack overflow");
  14.     }
  15.  
  16. #ifdef DEBUG
  17.     // If we are pushing a struct, make certain we know the precise type!
  18.     if (tree->TypeGet() == TYP_STRUCT)
  19.     {
  20.         assert(ti.IsType(TI_STRUCT));
  21.         CORINFO_CLASS_HANDLE clsHnd = ti.GetClassHandle();
  22.         assert(clsHnd != NO_CLASS_HANDLE);
  23.     }
  24.  
  25.     if (tiVerificationNeeded && !ti.IsDead())
  26.     {
  27.         assert(typeInfo::AreEquivalent(NormaliseForStack(ti), ti)); // types are normalized
  28.  
  29.         // The ti type is consistent with the tree type.
  30.         //
  31.  
  32.         // On 64-bit systems, nodes whose "proper" type is "native int" get labeled TYP_LONG.
  33.         // In the verification type system, we always transform "native int" to "TI_INT".
  34.         // Ideally, we would keep track of which nodes labeled "TYP_LONG" are really "native int", but
  35.         // attempts to do that have proved too difficult.  Instead, we'll assume that in checks like this,
  36.         // when there's a mismatch, it's because of this reason -- the typeInfo::AreEquivalentModuloNativeInt
  37.         // method used in the last disjunct allows exactly this mismatch.
  38.         assert(ti.IsDead() || ti.IsByRef() && (tree->TypeGet() == TYP_I_IMPL || tree->TypeGet() == TYP_BYREF) ||
  39.                ti.IsUnboxedGenericTypeVar() && tree->TypeGet() == TYP_REF ||
  40.                ti.IsObjRef() && tree->TypeGet() == TYP_REF || ti.IsMethod() && tree->TypeGet() == TYP_I_IMPL ||
  41.                ti.IsType(TI_STRUCT) && tree->TypeGet() != TYP_REF ||
  42.                typeInfo::AreEquivalentModuloNativeInt(NormaliseForStack(ti),
  43.                                                       NormaliseForStack(typeInfo(tree->TypeGet()))));
  44.  
  45.         // If it is a struct type, make certain we normalized the primitive types
  46.         assert(!ti.IsType(TI_STRUCT) ||
  47.                info.compCompHnd->getTypeForPrimitiveValueClass(ti.GetClassHandle()) == CORINFO_TYPE_UNDEF);
  48.     }
  49.  
  50. #if VERBOSE_VERIFY
  51.     if (VERBOSE && tiVerificationNeeded)
  52.     {
  53.         printf("\n");
  54.         printf(TI_DUMP_PADDING);
  55.         printf("About to push to stack: ");
  56.         ti.Dump();
  57.     }
  58. #endif // VERBOSE_VERIFY
  59.  
  60. #endif // DEBUG
  61.  
  62.     verCurrentState.esStack[verCurrentState.esStackDepth].seTypeInfo = ti;
  63.     verCurrentState.esStack[verCurrentState.esStackDepth++].val      = tree;
  64.  
  65.     if ((tree->gtType == TYP_LONG) && (compLongUsed == false))
  66.     {
  67.         compLongUsed = true;
  68.     }
  69.     else if (((tree->gtType == TYP_FLOAT) || (tree->gtType == TYP_DOUBLE)) && (compFloatingPointUsed == false))
  70.     {
  71.         compFloatingPointUsed = true;
  72.     }
  73. }

impPushOnStack会把GenTree节点添加到运行堆栈verCurrentState.esStack, 包含类型信息和刚才建立的GT_CNS_INT节点.

假设ldc.i4.s 100后面的指令是stloc.0, 表示给本地变量0赋值100, 那么后面的stloc.0指令需要使用前面的值,
我们来看看CEE_STLOC_0是怎么处理的:

  1. case CEE_STLOC_0:
  2. case CEE_STLOC_1:
  3. case CEE_STLOC_2:
  4. case CEE_STLOC_3:
  5.     lclNum = (opcode - CEE_STLOC_0);
  6.     assert(lclNum >= 0 && lclNum < 4);
  7.  
  8. LOC_ST:
  9.     if (tiVerificationNeeded)
  10.     {
  11.         Verify(lclNum < info.compMethodInfo->locals.numArgs, "bad local num");
  12.         Verify(tiCompatibleWith(impStackTop().seTypeInfo,
  13.                                 NormaliseForStack(lvaTable[lclNum + numArgs].lvVerTypeInfo), true),
  14.                "type mismatch");
  15.     }
  16.  
  17.     if (compIsForInlining())
  18.     {
  19.         lclTyp = impInlineInfo->lclVarInfo[lclNum + impInlineInfo->argCnt].lclTypeInfo;
  20.  
  21.         /* Have we allocated a temp for this local? */
  22.  
  23.         lclNum = impInlineFetchLocal(lclNum DEBUGARG("Inline stloc first use temp"));
  24.  
  25.         goto _PopValue;
  26.     }
  27.  
  28.     lclNum += numArgs;
  29.  
  30. VAR_ST:
  31.  
  32.     if (lclNum >= info.compLocalsCount && lclNum != lvaArg0Var)
  33.     {
  34.         assert(!tiVerificationNeeded); // We should have thrown the VerificationException before.
  35.         BADCODE("Bad IL");
  36.     }
  37.  
  38. VAR_ST_VALID:
  39.  
  40.     /* if it is a struct assignment, make certain we don't overflow the buffer */
  41.     assert(lclTyp != TYP_STRUCT || lvaLclSize(lclNum) >= info.compCompHnd->getClassSize(clsHnd));
  42.  
  43.     if (lvaTable[lclNum].lvNormalizeOnLoad())
  44.     {
  45.         lclTyp = lvaGetRealType(lclNum);
  46.     }
  47.     else
  48.     {
  49.         lclTyp = lvaGetActualType(lclNum);
  50.     }
  51.  
  52. _PopValue:
  53.     /* Pop the value being assigned */
  54.  
  55.     {
  56.         StackEntry se = impPopStack(clsHnd);
  57.         op1           = se.val;
  58.         tiRetVal      = se.seTypeInfo;
  59.     }
  60.  
  61. #ifdef FEATURE_SIMD
  62.     if (varTypeIsSIMD(lclTyp) && (lclTyp != op1->TypeGet()))
  63.     {
  64.         assert(op1->TypeGet() == TYP_STRUCT);
  65.         op1->gtType = lclTyp;
  66.     }
  67. #endif // FEATURE_SIMD
  68.  
  69.     op1 = impImplicitIorI4Cast(op1, lclTyp);
  70.  
  71. #ifdef _TARGET_64BIT_
  72.     // Downcast the TYP_I_IMPL into a 32-bit Int for x86 JIT compatiblity
  73.     if (varTypeIsI(op1->TypeGet()) && (genActualType(lclTyp) == TYP_INT))
  74.     {
  75.         assert(!tiVerificationNeeded); // We should have thrown the VerificationException before.
  76.         op1 = gtNewCastNode(TYP_INT, op1, TYP_INT);
  77.     }
  78. #endif // _TARGET_64BIT_
  79.  
  80.     // We had better assign it a value of the correct type
  81.     assertImp(
  82.         genActualType(lclTyp) == genActualType(op1->gtType) ||
  83.         genActualType(lclTyp) == TYP_I_IMPL && op1->IsVarAddr() ||
  84.         (genActualType(lclTyp) == TYP_I_IMPL && (op1->gtType == TYP_BYREF || op1->gtType == TYP_REF)) ||
  85.         (genActualType(op1->gtType) == TYP_I_IMPL && lclTyp == TYP_BYREF) ||
  86.         (varTypeIsFloating(lclTyp) && varTypeIsFloating(op1->TypeGet())) ||
  87.         ((genActualType(lclTyp) == TYP_BYREF) && genActualType(op1->TypeGet()) == TYP_REF));
  88.  
  89.     /* If op1 is "&var" then its type is the transient "*" and it can
  90.        be used either as TYP_BYREF or TYP_I_IMPL */
  91.  
  92.     if (op1->IsVarAddr())
  93.     {
  94.         assertImp(genActualType(lclTyp) == TYP_I_IMPL || lclTyp == TYP_BYREF);
  95.  
  96.         /* When "&var" is created, we assume it is a byref. If it is
  97.            being assigned to a TYP_I_IMPL var, change the type to
  98.            prevent unnecessary GC info */
  99.  
  100.         if (genActualType(lclTyp) == TYP_I_IMPL)
  101.         {
  102.             op1->gtType = TYP_I_IMPL;
  103.         }
  104.     }
  105.  
  106.     /* Filter out simple assignments to itself */
  107.  
  108.     if (op1->gtOper == GT_LCL_VAR && lclNum == op1->gtLclVarCommon.gtLclNum)
  109.     {
  110.         if (insertLdloc)
  111.         {
  112.             // This is a sequence of (ldloc, dup, stloc).  Can simplify
  113.             // to (ldloc, stloc).  Goto LDVAR to reconstruct the ldloc node.
  114.             CLANG_FORMAT_COMMENT_ANCHOR;
  115.  
  116. #ifdef DEBUG
  117.             if (tiVerificationNeeded)
  118.             {
  119.                 assert(
  120.                     typeInfo::AreEquivalent(tiRetVal, NormaliseForStack(lvaTable[lclNum].lvVerTypeInfo)));
  121.             }
  122. #endif
  123.  
  124.             op1         = nullptr;
  125.             insertLdloc = false;
  126.  
  127.             impLoadVar(lclNum, opcodeOffs + sz + 1);
  128.             break;
  129.         }
  130.         else if (opts.compDbgCode)
  131.         {
  132.             op1 = gtNewNothingNode();
  133.             goto SPILL_APPEND;
  134.         }
  135.         else
  136.         {
  137.             break;
  138.         }
  139.     }
  140.  
  141.     /* Create the assignment node */
  142.  
  143.     op2 = gtNewLclvNode(lclNum, lclTyp, opcodeOffs + sz + 1);
  144.  
  145.     /* If the local is aliased, we need to spill calls and
  146.        indirections from the stack. */
  147.  
  148.     if ((lvaTable[lclNum].lvAddrExposed || lvaTable[lclNum].lvHasLdAddrOp) &&
  149.         verCurrentState.esStackDepth > 0)
  150.     {
  151.         impSpillSideEffects(false, (unsigned)CHECK_SPILL_ALL DEBUGARG("Local could be aliased"));
  152.     }
  153.  
  154.     /* Spill any refs to the local from the stack */
  155.  
  156.     impSpillLclRefs(lclNum);
  157.  
  158. #if !FEATURE_X87_DOUBLES
  159.     // We can generate an assignment to a TYP_FLOAT from a TYP_DOUBLE
  160.     // We insert a cast to the dest 'op2' type
  161.     //
  162.     if ((op1->TypeGet() != op2->TypeGet()) && varTypeIsFloating(op1->gtType) &&
  163.         varTypeIsFloating(op2->gtType))
  164.     {
  165.         op1 = gtNewCastNode(op2->TypeGet(), op1, op2->TypeGet());
  166.     }
  167. #endif // !FEATURE_X87_DOUBLES
  168.  
  169.     if (varTypeIsStruct(lclTyp))
  170.     {
  171.         op1 = impAssignStruct(op2, op1, clsHnd, (unsigned)CHECK_SPILL_ALL);
  172.     }
  173.     else
  174.     {
  175.         // The code generator generates GC tracking information
  176.         // based on the RHS of the assignment.  Later the LHS (which is
  177.         // is a BYREF) gets used and the emitter checks that that variable
  178.         // is being tracked.  It is not (since the RHS was an int and did
  179.         // not need tracking).  To keep this assert happy, we change the RHS
  180.         if (lclTyp == TYP_BYREF && !varTypeIsGC(op1->gtType))
  181.         {
  182.             op1->gtType = TYP_BYREF;
  183.         }
  184.         op1 = gtNewAssignNode(op2, op1);
  185.     }
  186.  
  187.     /* If insertLdloc is true, then we need to insert a ldloc following the
  188.        stloc.  This is done when converting a (dup, stloc) sequence into
  189.        a (stloc, ldloc) sequence. */
  190.  
  191.     if (insertLdloc)
  192.     {
  193.         // From SPILL_APPEND
  194.         impAppendTree(op1, (unsigned)CHECK_SPILL_ALL, impCurStmtOffs);
  195.  
  196. #ifdef DEBUG
  197.         // From DONE_APPEND
  198.         impNoteLastILoffs();
  199. #endif
  200.         op1         = nullptr;
  201.         insertLdloc = false;
  202.  
  203.         impLoadVar(lclNum, opcodeOffs + sz + 1, tiRetVal);
  204.         break;
  205.     }
  206.  
  207.     goto SPILL_APPEND;
  208.  
  209. SPILL_APPEND:
  210.  
  211.     /* Append 'op1' to the list of statements */
  212.     impAppendTree(op1, (unsigned)CHECK_SPILL_ALL, impCurStmtOffs);
  213.     goto DONE_APPEND;
  214.  
  215. DONE_APPEND:
  216.  
  217. #ifdef DEBUG
  218.     // Remember at which BC offset the tree was finished
  219.     impNoteLastILoffs();
  220. #endif
  221.     break;

处理CEE_STLOC_0的代码有点长, 请耐心看:
首先0~3的指令会共用处理, stloc.0是0a, stloc.1是0b, stloc.2是0c, stloc.3是0d.
得到保存的本地变量序号后还要知道它在本地变量表lvaTable中的索引值是多少, 因为本地变量表开头存的是参数, 所以这里的索引值是lclNum += numArgs.
然后创建赋值(GT_ASG)的节点, 赋值的节点有两个参数, 第一个是lclVar 0, 第二个是const 100(类型一致所以不需要cast), 如下:

  1.    /--*  const     int    100
  2. \--*  =         int
  3.    \--*  lclVar    int    V01

现在我们创建了一颗GenTree树, 这个树是一个单独的语句, 我们可以把这个语句添加到BasicBlock中,
添加到BasicBlock使用的代码是impAppendTree(op1, (unsigned)CHECK_SPILL_ALL, impCurStmtOffs):

  1. /*****************************************************************************
  2.  *
  3.  *  Append the given expression tree to the current block's tree list.
  4.  *  Return the newly created statement.
  5.  */
  6.  
  7. GenTreePtr Compiler::impAppendTree(GenTreePtr tree, unsigned chkLevel, IL_OFFSETX offset)
  8. {
  9.     assert(tree);
  10.  
  11.     /* Allocate an 'expression statement' node */
  12.  
  13.     GenTreePtr expr = gtNewStmt(tree, offset);
  14.  
  15.     /* Append the statement to the current block's stmt list */
  16.  
  17.     impAppendStmt(expr, chkLevel);
  18.  
  19.     return expr;
  20. }
  21.  
  22. /*****************************************************************************
  23.  *
  24.  *  Append the given GT_STMT node to the current block's tree list.
  25.  *  [0..chkLevel) is the portion of the stack which we will check for
  26.  *    interference with stmt and spill if needed.
  27.  */
  28.  
  29. inline void Compiler::impAppendStmt(GenTreePtr stmt, unsigned chkLevel)
  30. {
  31.     assert(stmt->gtOper == GT_STMT);
  32.     noway_assert(impTreeLast != nullptr);
  33.  
  34.     /* If the statement being appended has any side-effects, check the stack
  35.        to see if anything needs to be spilled to preserve correct ordering. */
  36.  
  37.     GenTreePtr expr  = stmt->gtStmt.gtStmtExpr;
  38.     unsigned   flags = expr->gtFlags & GTF_GLOB_EFFECT;
  39.  
  40.     // Assignment to (unaliased) locals don't count as a side-effect as
  41.     // we handle them specially using impSpillLclRefs(). Temp locals should
  42.     // be fine too.
  43.     // TODO-1stClassStructs: The check below should apply equally to struct assignments,
  44.     // but previously the block ops were always being marked GTF_GLOB_REF, even if
  45.     // the operands could not be global refs.
  46.  
  47.     if ((expr->gtOper == GT_ASG) && (expr->gtOp.gtOp1->gtOper == GT_LCL_VAR) &&
  48.         !(expr->gtOp.gtOp1->gtFlags & GTF_GLOB_REF) && !gtHasLocalsWithAddrOp(expr->gtOp.gtOp2) &&
  49.         !varTypeIsStruct(expr->gtOp.gtOp1))
  50.     {
  51.         unsigned op2Flags = expr->gtOp.gtOp2->gtFlags & GTF_GLOB_EFFECT;
  52.         assert(flags == (op2Flags | GTF_ASG));
  53.         flags = op2Flags;
  54.     }
  55.  
  56.     if (chkLevel == (unsigned)CHECK_SPILL_ALL)
  57.     {
  58.         chkLevel = verCurrentState.esStackDepth;
  59.     }
  60.  
  61.     if (chkLevel && chkLevel != (unsigned)CHECK_SPILL_NONE)
  62.     {
  63.         assert(chkLevel <= verCurrentState.esStackDepth);
  64.  
  65.         if (flags)
  66.         {
  67.             // If there is a call, we have to spill global refs
  68.             bool spillGlobEffects = (flags & GTF_CALL) ? true : false;
  69.  
  70.             if (expr->gtOper == GT_ASG)
  71.             {
  72.                 GenTree* lhs = expr->gtGetOp1();
  73.                 // If we are assigning to a global ref, we have to spill global refs on stack.
  74.                 // TODO-1stClassStructs: Previously, spillGlobEffects was set to true for
  75.                 // GT_INITBLK and GT_COPYBLK, but this is overly conservative, and should be
  76.                 // revisited. (Note that it was NOT set to true for GT_COPYOBJ.)
  77.                 if (!expr->OperIsBlkOp())
  78.                 {
  79.                     // If we are assigning to a global ref, we have to spill global refs on stack
  80.                     if ((lhs->gtFlags & GTF_GLOB_REF) != 0)
  81.                     {
  82.                         spillGlobEffects = true;
  83.                     }
  84.                 }
  85.                 else if ((lhs->OperIsBlk() && !lhs->AsBlk()->HasGCPtr()) ||
  86.                          ((lhs->OperGet() == GT_LCL_VAR) &&
  87.                           (lvaTable[lhs->AsLclVarCommon()->gtLclNum].lvStructGcCount == 0)))
  88.                 {
  89.                     spillGlobEffects = true;
  90.                 }
  91.             }
  92.  
  93.             impSpillSideEffects(spillGlobEffects, chkLevel DEBUGARG("impAppendStmt"));
  94.         }
  95.         else
  96.         {
  97.             impSpillSpecialSideEff();
  98.         }
  99.     }
  100.  
  101.     impAppendStmtCheck(stmt, chkLevel);
  102.  
  103.     /* Point 'prev' at the previous node, so that we can walk backwards */
  104.  
  105.     stmt->gtPrev = impTreeLast;
  106.  
  107.     /* Append the expression statement to the list */
  108.  
  109.     impTreeLast->gtNext = stmt;
  110.     impTreeLast         = stmt;
  111.  
  112. #ifdef FEATURE_SIMD
  113.     impMarkContiguousSIMDFieldAssignments(stmt);
  114. #endif
  115.  
  116. #ifdef DEBUGGING_SUPPORT
  117.  
  118.     /* Once we set impCurStmtOffs in an appended tree, we are ready to
  119.        report the following offsets. So reset impCurStmtOffs */
  120.  
  121.     if (impTreeLast->gtStmt.gtStmtILoffsx == impCurStmtOffs)
  122.     {
  123.         impCurStmtOffsSet(BAD_IL_OFFSET);
  124.     }
  125.  
  126. #endif
  127.  
  128. #ifdef DEBUG
  129.     if (impLastILoffsStmt == nullptr)
  130.     {
  131.         impLastILoffsStmt = stmt;
  132.     }
  133.  
  134.     if (verbose)
  135.     {
  136.         printf("\n\n");
  137.         gtDispTree(stmt);
  138.     }
  139. #endif
  140. }

这段代码会添加一个GT_STMT节点到当前的impTreeLast链表中, 这个链表后面会在impEndTreeList分配给block->bbTreeList.
GT_STMT节点的内容如下:

  1. *  stmtExpr  void
  2. |  /--*  const     int    100
  3. \--*  =         int
  4.    \--*  lclVar    int    V01

可以看到是把原来的分配节点GT_ASG放到了GT_STMT的下面.
微软提供了一张Compiler, BasicBlock, GenTree的结构图(HIR版):

881857-20171028110118680-735116901.png

这里给出了最简单的两个指令ldc.i4.s和stloc.0的解析例子, 有兴趣可以自己分析更多类型的指令.
现在我们可以知道运行堆栈在JIT中用于关联各个指令, 让它们构建成一棵GenTree树, 实际生成的代码将不会有运行堆栈这个概念.

在处理完当前block后, 会添加block的后继blocksuccessors到队列impPendingList中:

  1. for (unsigned i = 0; i < block->NumSucc(); i++)
  2. {
  3.     impImportBlockPending(block->GetSucc(i));
  4. }

处理完所有block后, 每个BasicBlock中就有了语句(GT_STMT)的链表, 每条语句下面都会有一个GenTree树.

fgImport的例子如下:

881857-20171028110132289-576127936.jpg

PHASE_POST_IMPORT

这个阶段负责从IL导入HIR(GenTree)后的一些工作, 包含以下的代码:

  1. // Maybe the caller was not interested in generating code
  2. if (compIsForImportOnly())
  3. {
  4.     compFunctionTraceEnd(nullptr, 0, false);
  5.     return;
  6. }
  7.  
  8. #if !FEATURE_EH
  9. // If we aren't yet supporting EH in a compiler bring-up, remove as many EH handlers as possible, so
  10. // we can pass tests that contain try/catch EH, but don't actually throw any exceptions.
  11. fgRemoveEH();
  12. #endif // !FEATURE_EH
  13.  
  14. if (compileFlags->corJitFlags & CORJIT_FLG_BBINSTR)
  15. {
  16.     fgInstrumentMethod();
  17. }
  18.  
  19. // We could allow ESP frames. Just need to reserve space for
  20. // pushing EBP if the method becomes an EBP-frame after an edit.
  21. // Note that requiring a EBP Frame disallows double alignment.  Thus if we change this
  22. // we either have to disallow double alignment for E&C some other way or handle it in EETwain.
  23.  
  24. if (opts.compDbgEnC)
  25. {
  26.     codeGen->setFramePointerRequired(true);
  27.  
  28.     // Since we need a slots for security near ebp, its not possible
  29.     // to do this after an Edit without shifting all the locals.
  30.     // So we just always reserve space for these slots in case an Edit adds them
  31.     opts.compNeedSecurityCheck = true;
  32.  
  33.     // We don't care about localloc right now. If we do support it,
  34.     // EECodeManager::FixContextForEnC() needs to handle it smartly
  35.     // in case the localloc was actually executed.
  36.     //
  37.     // compLocallocUsed            = true;
  38. }
  39.  
  40. EndPhase(PHASE_POST_IMPORT);

这个阶段负责import之后的一些零碎的处理.
如果只需要检查函数的IL是否合法, 那么编译时会带CORJIT_FLG_IMPORT_ONLY, 在经过import阶段后就不需要再继续了.
fgInstrumentMethod用于插入profiler需要的语句, 这里不详细分析.
opts.compDbgEnC启用时代表编译IL程序集时用的是Debug配置, 这里会标记需要使用frame pointer和需要安全检查.
(x64允许函数不使用rbp寄存器保存进入函数前堆栈地址, 这样可以多出一个空余的寄存器以生成更高效的代码, 但是会让debug更困难)

PHASE_MORPH

因为import阶段只是简单的把IL转换成HIR, 转换出来的HIR还需要进行加工.
这个阶段负责了HIR的加工, 包含以下的代码:

  1. /* Initialize the BlockSet epoch */
  2.  
  3. NewBasicBlockEpoch();
  4.  
  5. /* Massage the trees so that we can generate code out of them */
  6.  
  7. fgMorph();
  8. EndPhase(PHASE_MORPH);

NewBasicBlockEpoch更新了当前BasicBlock集合的epoch(fgCurBBEpoch), 这个值用于标识当前BasicBlock集合的版本.

fgMorph包含了这个阶段主要的处理, 源代码如下:

  1. /*****************************************************************************
  2.  *
  3.  *  Transform all basic blocks for codegen.
  4.  */
  5.  
  6. void Compiler::fgMorph()
  7. {
  8.     noway_assert(!compIsForInlining()); // Inlinee's compiler should never reach here.
  9.  
  10.     fgOutgoingArgTemps = nullptr;
  11.  
  12. #ifdef DEBUG
  13.     if (verbose)
  14.     {
  15.         printf("*************** In fgMorph()\n");
  16.     }
  17.     if (verboseTrees)
  18.     {
  19.         fgDispBasicBlocks(true);
  20.     }
  21. #endif // DEBUG
  22.  
  23.     // Insert call to class constructor as the first basic block if
  24.     // we were asked to do so.
  25.     if (info.compCompHnd->initClass(nullptr /* field */, info.compMethodHnd /* method */,
  26.                                     impTokenLookupContextHandle /* context */) &
  27.         CORINFO_INITCLASS_USE_HELPER)
  28.     {
  29.         fgEnsureFirstBBisScratch();
  30.         fgInsertStmtAtBeg(fgFirstBB, fgInitThisClass());
  31.     }
  32.  
  33. #ifdef DEBUG
  34.     if (opts.compGcChecks)
  35.     {
  36.         for (unsigned i = 0; i < info.compArgsCount; i++)
  37.         {
  38.             if (lvaTable[i].TypeGet() == TYP_REF)
  39.             {
  40.                 // confirm that the argument is a GC pointer (for debugging (GC stress))
  41.                 GenTreePtr      op   = gtNewLclvNode(i, TYP_REF);
  42.                 GenTreeArgList* args = gtNewArgList(op);
  43.                 op                   = gtNewHelperCallNode(CORINFO_HELP_CHECK_OBJ, TYP_VOID, 0, args);
  44.  
  45.                 fgEnsureFirstBBisScratch();
  46.                 fgInsertStmtAtEnd(fgFirstBB, op);
  47.             }
  48.         }
  49.     }
  50.  
  51.     if (opts.compStackCheckOnRet)
  52.     {
  53.         lvaReturnEspCheck                  = lvaGrabTempWithImplicitUse(false DEBUGARG("ReturnEspCheck"));
  54.         lvaTable[lvaReturnEspCheck].lvType = TYP_INT;
  55.     }
  56.  
  57.     if (opts.compStackCheckOnCall)
  58.     {
  59.         lvaCallEspCheck                  = lvaGrabTempWithImplicitUse(false DEBUGARG("CallEspCheck"));
  60.         lvaTable[lvaCallEspCheck].lvType = TYP_INT;
  61.     }
  62. #endif // DEBUG
  63.  
  64.     /* Filter out unimported BBs */
  65.  
  66.     fgRemoveEmptyBlocks();
  67.  
  68.     /* Add any internal blocks/trees we may need */
  69.  
  70.     fgAddInternal();
  71.  
  72. #if OPT_BOOL_OPS
  73.     fgMultipleNots = false;
  74. #endif
  75.  
  76. #ifdef DEBUG
  77.     /* Inliner could add basic blocks. Check that the flowgraph data is up-to-date */
  78.     fgDebugCheckBBlist(false, false);
  79. #endif // DEBUG
  80.  
  81.     /* Inline */
  82.     fgInline();
  83. #if 0
  84.     JITDUMP("trees after inlining\n");
  85.     DBEXEC(VERBOSE, fgDispBasicBlocks(true));
  86. #endif
  87.  
  88.     RecordStateAtEndOfInlining(); // Record "start" values for post-inlining cycles and elapsed time.
  89.  
  90. #ifdef DEBUG
  91.     /* Inliner could add basic blocks. Check that the flowgraph data is up-to-date */
  92.     fgDebugCheckBBlist(false, false);
  93. #endif // DEBUG
  94.  
  95.     /* For x64 and ARM64 we need to mark irregular parameters early so that they don't get promoted */
  96.     fgMarkImplicitByRefArgs();
  97.  
  98.     /* Promote struct locals if necessary */
  99.     fgPromoteStructs();
  100.  
  101.     /* Now it is the time to figure out what locals have address-taken. */
  102.     fgMarkAddressExposedLocals();
  103.  
  104. #ifdef DEBUG
  105.     /* Now that locals have address-taken marked, we can safely apply stress. */
  106.     lvaStressLclFld();
  107.     fgStress64RsltMul();
  108. #endif // DEBUG
  109.  
  110.     /* Morph the trees in all the blocks of the method */
  111.  
  112.     fgMorphBlocks();
  113.  
  114. #if 0
  115.     JITDUMP("trees after fgMorphBlocks\n");
  116.     DBEXEC(VERBOSE, fgDispBasicBlocks(true));
  117. #endif
  118.  
  119.     /* Decide the kind of code we want to generate */
  120.  
  121.     fgSetOptions();
  122.  
  123.     fgExpandQmarkNodes();
  124.  
  125. #ifdef DEBUG
  126.     compCurBB = nullptr;
  127. #endif // DEBUG
  128. }

函数中的处理如下:

fgInsertStmtAtBeg(fgFirstBB, fgInitThisClass());
如果类型需要动态初始化(泛型并且有静态构造函数), 在第一个block插入调用JIT_ClassInitDynamicClass的代码

fgRemoveEmptyBlocks
枚举所有未import(也就是说这个block中的代码无法到达)的block,
如果有则更新block的序号和epoch.

fgAddInternal:
添加内部的BasicBlock和GenTree.
首先如果函数不是静态的, 且this变量需要传出地址(ref)或者修改, 则需要一个内部的本地变量(lvaArg0Var)储存this的值.
如果函数需要安全检查(compNeedSecurityCheck), 则添加一个临时变量(lvaSecurityObject).
如果当前平台不是x86(32位), 则为同步方法生成代码, 进入时调用JIT_MonEnterWorker, 退出时调用JIT_MonExitWorker.
判断是否要只生成一个return block(例如包含pinvoke的函数, 调用了非托管代码的函数, 或者同步函数),
如果需要只生成一个return block, 则添加一个合并用的BasicBlock和储存返回值用的本地变量, 这里还不会把其他return block重定向到新block.
如果函数有调用非托管函数, 则添加一个临时变量(lvaInlinedPInvokeFrameVar).
如果启用了JustMyCode, 则添加if (*pFlag != 0) { JIT_DbgIsJustMyCode() }到第一个block, 注意这里的节点是QMARK(?:).
如果tiRuntimeCalloutNeeded成立则添加verificationRuntimeCheck(MethodHnd)到第一个block.

fgInline
这个函数负责内联函数中的call,
虽然在微软的文档和我前一篇文章都把inline当作一个单独的阶段, 但在coreclr内部inline是属于PHASE_MORPH的.
首先会创建一个根内联上下文(rootContext), 然后把它分配到当前的所有语句(stmt)节点中, 内联上下文用于标记语句来源于哪里和组织一个树结构.
然后枚举所有语句(stmt), 判断是否call并且是内联候选(GTF_CALL_INLINE_CANDIDATE), 如果是则尝试内联(fgMorphCallInline).

前面的PHASE_IMPORTATION在导入call时会判断是否内联候选(impMarkInlineCandidate), 判断的条件包含:
注意以下条件不一定正确, 可能会根据clr的版本或者运行环境(设置的内联策略)不同而不同.

  • 未开启优化时不内联
  • 函数是尾调用则不内联
  • 函数的gtFlags & GTF_CALL_VIRT_KIND_MASK不等于GTF_CALL_NONVIRT时不内联
  • 函数是helper call时不内联
  • 函数是indirect call时不内联
  • 环境设置了COMPlus_AggressiveInlining时, 设置 CORINFO_FLG_FORCEINLINE
  • 未设置CORINFO_FLG_FORCEINLINE且函数在catch或者filter中时不内联
  • 之前尝试内联失败, 标记了CORINFO_FLG_DONT_INLINE时不内联
  • 同步函数(CORINFO_FLG_SYNCH)不内联
  • 函数需要安全检查(CORINFO_FLG_SECURITYCHECK)则不内联
  • 如果函数有例外处理器则不内联
  • 函数无内容(大小=0)则不内联
  • 函数参数是vararg时不内联
  • methodInfo中的本地变量数量大于MAX_INL_LCLS(32)时不内联
  • methodInfo中的参数数量大于MAX_INL_LCLS时不内联
  • 判断IL代码大小
    • 如果codesize <= CALLEE_IL_CODE_SIZE(16)则标记CALLEE_BELOW_ALWAYS_INLINE_SIZE
    • 如果force inline则标记CALLEE_IS_FORCE_INLINE(例如标记了MethodImpl属性)
    • 如果codesize <= DEFAULT_MAX_INLINE_SIZE(100)则标记CALLEE_IS_DISCRETIONARY_INLINE, 后面根据利益判断
    • 标记CALLEE_TOO_MUCH_IL, 表示代码过长不内联
  • 尝试初始化函数所在的class
    • 如果函数属于generic definition, 则不能内联
    • 如果类型需要在访问任何字段前初始化(IsBeforeFieldInit), 则不能内联
    • 如果未满足其他early out条件, 尝试了初始化class, 且失败了则不能内联
  • 其他判断
    • Boundary method的定义:
      • 会创建StackCrawlMark查找它的caller的函数
      • 调用满足以上条件的函数的函数 (标记为IsMdRequireSecObject)
      • 调用虚方法的函数 (虚方法可能满足以上的条件)
    • 调用Boundary method的函数不内联
    • 如果caller和callee的grant set或refuse set不一致则不内联
    • 判断是否跨程序集
      • 同一程序集的则判断可内联
      • 不同程序集时, 要求以下任意一项成立
        • caller是full trust, refused set为空
        • appdomain的IsHomogenous成立, 且caller和callee的refused set都为空
      • 如果callee和caller所在的module不一样, 且callee的string pool基于module
        • 则标记dwRestrictions |= INLINE_NO_CALLEE_LDSTR (callee中不能有ldstr)

以上条件都满足了就会标记call为内联候选, 并实际尝试内联(fgMorphCallInline), 尝试内联的步骤如下:

  • 检测是否相互内联(a inline b, b inline a), 如果是则标记内联失败
  • 通过内联上下文检测内联层数是否过多, 超过DEFAULT_MAX_INLINE_DEPTH(20)则标记内联失败
  • 针对callee调用jitNativeCode, 导入的BasicBlock和GenTree会在InlineeCompiler中
    • 针对inline函数的利益分析(DetermineProfitability)将会在这里进行(fgFindJumpTargets), 如果判断不值得内联则会返回失败
    • DetermineProfitability的算法:
      • m_CalleeNativeSizeEstimate = DetermineNativeSizeEstimate() // 使用statemachine估算的机器代码大小
      • m_CallsiteNativeSizeEstimate = DetermineCallsiteNativeSizeEstimate(methodInfo) // 估算调用此函数的指令花费的机器代码大小
      • m_Multiplier = DetermineMultiplier() // 系数, 值越大越容易内联, 详见DetermineMultiplier
      • threshold = (int)(m_CallsiteNativeSizeEstimate * m_Multiplier) // 阈值
      • 如果 m_CalleeNativeSizeEstimate > threshold 则设置不内联, 也就是callee的机器代码越大则越不容易内联, 系数越大则越容易内联
    • 内联最多处理到PHASE_IMPORTATION, 可以参考上面compCompile函数的代码

如果编译callee成功, 并且是否内联的判断也通过则可以把callee中的HIR嵌入到caller的HIR中:

  • 如果InlineeCompiler中只有一个BasicBlock, 把该BasicBlock中的所有stmt插入到原stmt后面, 标记原来的stmt为空
  • 如果InlineeCompiler中有多个BasicBlock
    • 按原stmt的位置分割所在的BasicBlock到topBlock和bottomBlock
    • 插入callee的BasicBlock到topBlock和bottomBlock 之间
    • 标记原stmt为空, 原stmt还在topBlock中
  • 原stmt下的call会被替换为inline后的返回表达式

如果编译callee失败, 或者是否内联的判断不通过, 则需要恢复被修改的状态:

  • 清理新创建的本地变量, 恢复原有的本地变量数量(lvaCount)
  • 如果调用结果不是void
    • 把stmt中的expr设为空, 原来的stmt仍会被retExpr引用, 后面会替换回来
  • 取消原expr(call)的内联候选标记(GTF_CALL_INLINE_CANDIDATE)

到最后会再一次的遍历函数中引用了返回结果(retExpr)的树, 如果内联成功则替换节点到lclVar或者lclFld.

fgMarkImplicitByRefArgs

标记本地变量非标准大小的结构体为BY_REF, 标记后结构体将不能被promote.
结构体的promote简单的来说就是把结构体中的字段当作一个单独的本地变量,
例如struct X { int a; int b; int c },
如果有本地变量X x, 则可以替换这个变量为三个本地变量int a; int b; int c;.
在x86下非标准大小是3, 5, 6, 7, >8, arm64下是>16.

fgPromoteStructs

提升struct中的变量作为本地变量.
首先遍历本地变量中的struct变量, 判断是否应该提升, 依据包括(可能根据环境不同而不同):

  • 如果本地变量总计有512个以上则不提升
  • 如果变量在SIMD指令中使用则不提升
  • 如果变量是HFA(homogeneous floating-point aggregate)类型则不提升
  • 如果struct大小比sizeof(double) * 4更大则不提升
  • 如果struct有4个以上的字段则不提升
  • 如果struct有字段地址是重叠的(例如union)则不提升
  • 如果struct有自定义layout并且是HFA类型则不提升
  • 如果struct包含非primitive类型的字段则不提升
  • 如果struct包含有特殊对齐的字段(fldOffset % fldSize) != 0)则不提升

如果判断应该提升, 则会添加struct的所有成员到本地变量表(lvaTable)中,
原来的struct变量仍然会保留, 新添加的本地变量的lvParentLcl会指向原来的struct变量.

fgMarkAddressExposedLocals

标记所有地址被导出(通过ref传给了其他函数, 或者设到了全局变量)的本地变量, 这些本地变量将不能优化到寄存器中.
同时遍历GenTree, 如果节点类型是GT_FIELD并且对应的struct变量已经promoted, 则修改节点为lclVar.

fgMorphBlocks

这个函数也是个大头, 里面包含了各种对GenTree的变形处理, 因为处理相当多这里我只列出几个.
更多的处理可以参考我的JIT笔记.

断言创建(optAssertionGen)

根据一些GenTree模式可以创建断言(Assertion), 例如a = 1后可以断言a的值是1, b.abc()后可以断言b不等于null(已经检查过一次null).
断言可以用于优化代码, 例如归并节点, 减少null检查和减少边界检查.

断言传播(optAssertionProp)

根据创建的断言可以进行优化, 例如确定本地变量等于常量时修改为该常量, 确定对象不为null时标记不需要null检查等.
在PHASE_MORPH阶段optAssertionProp只能做一些简单的优化,
后面创建了SSA和VN以后的PHASE_ASSERTION_PROP_MAIN阶段会再次调用这个函数进行更多优化.

转换部分cpu不支持的操作到函数调用

例如在32位上对long(64bit)做除法时, 因为cpu不支持, 需要转换为jit helper call.

添加隐式抛出例外的BasicBlock

如果代码中需要检查数值是否溢出或者数组是否越界访问, 则需要添加一个抛出例外的BasicBlock.
同一种类型的例外只会添加一个BasicBlock.
注意针对null的检查不会添加BasicBlock, null检查的实现机制是硬件异常, 详见之前的文章.

转换到效率更高的等价模式

一些模式, 例如x+产量1==常量2可以转换为x==常量2-常量1=>x==常量3, 转换后可以减少计算的步骤.
其他会转换的模式还包括:

  • x >= y == 0 => x < y
  • x >= 1 => x > 0 (x是int)
  • x < 1 => x <= 0 (x是int)
  • (x+常量1)+(y+常量2) => (x+y)+常量3
  • x + 0 => x
  • 等等

fgSetOptions

这个函数用于设置CodeGen(生成机器代码的模块)使用的选项, 包括:

  • genInterruptible: 是否生成完全可中断的代码, 用于debugger
  • setFramePointerRequired: 是否要求保存frame pointer(rbp)
  • setFramePointerRequiredEH: EH表有内容时要求frame pointer, 变量跟上面一样
  • setFramePointerRequiredGCInfo: 如果参数太多, 要安全检查或者有动态长度参数则要求frame pointer, 同上

fgExpandQmarkNodes

这个函数用于分解QMark节点， QMark其实就是三元表达式, 例如x?123:321.
本来这样的判断会分为三个BasicBlock, 但前面为了方便就使用了QMark节点而不去修改BasicBlock.
这个函数会查找树中的QMark节点, 转换为jTrue和添加BasicBlock.

如果函数中有unsafe buffer, 则会添加一个内部变量(GS Cookie)来检测是否发生栈溢出.
这个阶段负责了添加内部变量和添加设置内部变量的值的语句, 包含以下的代码:

  1. /* GS security checks for unsafe buffers */
  2. if (getNeedsGSSecurityCookie())
  3. {
  4. #ifdef DEBUG
  5.     if (verbose)
  6.     {
  7.         printf("\n*************** -GS checks for unsafe buffers \n");
  8.     }
  9. #endif
  10.  
  11.     gsGSChecksInitCookie();
  12.  
  13.     if (compGSReorderStackLayout)
  14.     {
  15.         gsCopyShadowParams();
  16.     }
  17.  
  18. #ifdef DEBUG
  19.     if (verbose)
  20.     {
  21.         fgDispBasicBlocks(true);
  22.         printf("\n");
  23.     }
  24. #endif
  25. }
  26. EndPhase(PHASE_GS_COOKIE);

gsGSChecksInitCookie函数添加了一个新的本地变量(GS Cookie), 它的值是一个magic number, 在linux上它的值会是程序启动时的GetTickCount().
后面CodeGen会在函数返回前检查GS Cookie的值, 如果和预设的magic number不一致则调用CORINFO_HELP_FAIL_FAST函数.

PHASE_COMPUTE_PREDS

因为前面的morph阶段可能会添加新的BasicBlock(内联或者QMark),
这个阶段会重新分配BasicBlock的序号并且计算preds(前继block), 包含以下的代码:

  1. /* Compute bbNum, bbRefs and bbPreds */
  2.  
  3. JITDUMP("\nRenumbering the basic blocks for fgComputePred\n");
  4. fgRenumberBlocks();
  5.  
  6. noway_assert(!fgComputePredsDone); // This is the first time full (not cheap) preds will be computed.
  7. fgComputePreds();
  8. EndPhase(PHASE_COMPUTE_PREDS);

fgRenumberBlocks函数对block的序号进行重排, 序号从1开始递增.
fgComputePreds函数会重新计算各个block的preds(前继block), 关于preds可以参考前一篇文章中对Flowgraph Analysis的说明.

fgComputePreds的算法如下:

  • 枚举 BasicBlock
    • block->bbRefs = 0
  • 调用 fgRemovePreds, 删除所有 BasicBlock 的 bbPreds
  • 设置第一个 BasicBlock 的 fgFirstBB->bbRefs = 1
  • 枚举 BasicBlock
    • 如果类型是 BBJ_LEAVE, BBJ_COND, BBJ_ALWAYS, BBJ_EHCATCHRET
      • 调用 fgAddRefPred(block->bbJumpDest, block, nullptr, true)
    • 如果类型是 BBJ_NONE
      • 调用 fgAddRefPred(block->bbNext, block, nullptr, true)
    • 如果类型是 BBJ_EHFILTERRET
      • 调用 fgAddRefPred(block->bbJumpDest, block, nullptr, true)
    • 如果类型是 BBJ_EHFINALLYRET
      • 查找调用 finally funclet 的 block, 如果找到则 (调用完以后返回到bcall->bbNext)
      • fgAddRefPred(bcall->bbNext, block, nullptr, true)
    • 如果类型是 BBJ_THROW, BBJ_RETURN
      • 不做处理
    • 如果类型是 BBJ_SWITCH
      • 设置所有跳转目标的 fgAddRefPred(*jumpTab, block, nullptr, true)

PHASE_MARK_GC_POLL_BLOCKS

这个阶段判断哪些block需要检查是否正在运行gc, 包含以下的代码:

  1. /* If we need to emit GC Poll calls, mark the blocks that need them now.  This is conservative and can
  2.  * be optimized later. */
  3. fgMarkGCPollBlocks();
  4. EndPhase(PHASE_MARK_GC_POLL_BLOCKS);

fgMarkGCPollBlocks函数会枚举BasicBlock,
如果block会向前跳转(例如循环), 或者block是返回block, 则标记block->bbFlags |= BBF_NEEDS_GCPOLL.
标记了BBF_NEEDS_GCPOLL的block会在后面插入调用CORINFO_HELP_POLL_GC函数的代码, 用于在运行gc时暂停当前的线程.

PHASE_COMPUTE_EDGE_WEIGHTS

这个阶段会计算block和block edge的权重(weight), 包含以下的代码:

  1. /* From this point on the flowgraph information such as bbNum,
  2.  * bbRefs or bbPreds has to be kept updated */
  3.  
  4. // Compute the edge weights (if we have profile data)
  5. fgComputeEdgeWeights();
  6. EndPhase(PHASE_COMPUTE_EDGE_WEIGHTS);

block的权重(BasicBlock::bbWeight)用于表示block中的代码是否容易被运行, 权重值默认为1, 越高代表block越容易被运行.
edge是一个表示block之间的跳转的术语, edge weight越大表示两个block之间的跳转越容易发生,
edge weight保存在BasicBlock::bbPreds链表的元素(类型是flowList)中, 分别有两个值flEdgeWeightMin和flEdgeWeightMax.
edge weight的计算非常复杂, 具体请看fgAddRefPred和fgComputeEdgeWeights函数.
对于较少运行block会标记BBF_RUN_RARELY,
这个标记会在后面用于分析哪些block是热(hot)的, 哪些block是冷(cold)的, cold block有可能会排到后面并使用不同的heap块.

PHASE_CREATE_FUNCLETS

这个阶段会为例外处理器(例如catch和finally)创建小函数(funclet), 包含以下的代码:

  1. #if FEATURE_EH_FUNCLETS
  2.  
  3. /* Create funclets from the EH handlers. */
  4.  
  5. fgCreateFunclets();
  6. EndPhase(PHASE_CREATE_FUNCLETS);
  7.  
  8. #endif // FEATURE_EH_FUNCLETS

小函数(funclet)是x64(64位)上调用例外处理器的方式, x86(32位)上不会采用这种方式.
例如代码是:

  1. int x = GetX();
  2. try {
  3.     Console.WriteLine(x);
  4.     throw new Exception("abc");
  5. } catch (Exception ex) {
  6.     Console.WriteLine(ex);
  7.     Console.WriteLine(x);
  8. }

在x64上会生成以下的汇编代码:

  1. 生成的主函数
  2. 00007FFF0FEC0480 55                   push        rbp // 备份原rbp
  3. 00007FFF0FEC0481 56                   push        rsi // 备份原rsi
  4. 00007FFF0FEC0482 48 83 EC 38          sub         rsp,38h // 预留本地变量空间, 大小0x38
  5. 00007FFF0FEC0486 48 8D 6C 24 40       lea         rbp,[rsp+40h] // rbp等于push rbp之前rsp的地址(0x38+0x8)
  6. 00007FFF0FEC048B 48 89 65 E0          mov         qword ptr [rbp-20h],rsp // 保存预留本地变量后的rsp, 到本地变量[rbp-0x20], 也就是PSPSym
  7. 00007FFF0FEC048F E8 24 FC FF FF       call        00007FFF0FEC00B8 // 调用GetX()
  8. 00007FFF0FEC0494 89 45 F4             mov         dword ptr [rbp-0Ch],eax // 返回结果存本地变量[rbp-0x0c], 也就是x
  9.    185:             try {
  10.    186:                 Console.WriteLine(x);
  11. 00007FFF0FEC0497 8B 4D F4             mov         ecx,dword ptr [rbp-0Ch] // x => 第一个参数
  12. 00007FFF0FEC049A E8 B9 FE FF FF       call        00007FFF0FEC0358 // 调用Console.WriteLine
  13.    187:                 throw new Exception("abc");
  14. 00007FFF0FEC049F 48 B9 B8 58 6C 6E FF 7F 00 00 mov         rcx,7FFF6E6C58B8h // Exception的MethodTable => 第一个参数
  15. 00007FFF0FEC04A9 E8 A2 35 B1 5F       call        00007FFF6F9D3A50 // 调用CORINFO_HELP_NEWFAST(JIT_New, 或汇编版本)
  16. 00007FFF0FEC04AE 48 8B F0             mov         rsi,rax // 例外对象存rsi
  17. 00007FFF0FEC04B1 B9 12 02 00 00       mov         ecx,212h // rid => 第一个参数
  18. 00007FFF0FEC04B6 48 BA 78 4D D6 0F FF 7F 00 00 mov         rdx,7FFF0FD64D78h // module handle => 第二个参数
  19. 00007FFF0FEC04C0 E8 6B 20 AF 5F       call        00007FFF6F9B2530 // 调用CORINFO_HELP_STRCNS(JIT_StrCns), 用于lazy load字符串常量对象
  20. 00007FFF0FEC04C5 48 8B D0             mov         rdx,rax // 常量字符串对象 => 第二个参数
  21. 00007FFF0FEC04C8 48 8B CE             mov         rcx,rsi // 例外对象 => 第一个参数
  22. 00007FFF0FEC04CB E8 20 07 43 5E       call        00007FFF6E2F0BF0 // 调用System.Exception:.ctor
  23. 00007FFF0FEC04D0 48 8B CE             mov         rcx,rsi // 例外对象 => 第一个参数
  24. 00007FFF0FEC04D3 E8 48 FC A0 5F       call        00007FFF6F8D0120 // 调用CORINFO_HELP_THROW(IL_Throw)
  25. 00007FFF0FEC04D8 CC                   int         3 // unreachable
  26. 00007FFF0FEC04D9 48 8D 65 F8          lea         rsp,[rbp-8] // 恢复到备份rbp和rsi后的地址
  27. 00007FFF0FEC04DD 5E                   pop         rsi // 恢复rsi
  28. 00007FFF0FEC04DE 5D                   pop         rbp // 恢复rbp
  29. 00007FFF0FEC04DF C3                   ret
  30. 生成的funclet
  31. 00007FFF0FEC04E0 55                   push        rbp // 备份rbp
  32. 00007FFF0FEC04E1 56                   push        rsi // 备份rsi
  33. 00007FFF0FEC04E2 48 83 EC 28          sub         rsp,28h // 本地的rsp预留0x28(PSP slot 0x8 + Outgoing arg space 0x20(如果funclet会调用其他函数))
  34. 00007FFF0FEC04E6 48 8B 69 20          mov         rbp,qword ptr [rcx+20h] // rcx是InitialSP(预留本地变量后的rsp)
  35.                                                                         // 原函数的rbp跟rsp差40, 所以[InitialSP+20h]等于[rbp-20h], 也就是PSPSym
  36.                                                                         // 这个例子中因为只有一层, PSPSym里面保存的值跟传入的rcx一样(InitialSP)
  37. 00007FFF0FEC04EA 48 89 6C 24 20       mov         qword ptr [rsp+20h],rbp // 复制PSPSym到funclet自己的frame
  38. 00007FFF0FEC04EF 48 8D 6D 40          lea         rbp,[rbp+40h] // 原函数的rbp跟rsp差40, 计算得出原函数的rbp
  39.    188:             } catch (Exception ex) {
  40.    189:                 Console.WriteLine(ex);
  41. 00007FFF0FEC04F3 48 8B CA             mov         rcx,rdx // rdx例外对象, 移动到第一个参数
  42. 00007FFF0FEC04F6 E8 7D FE FF FF       call        00007FFF0FEC0378 // 调用Console.WriteLine
  43.    190:                 Console.WriteLine(x);
  44. 00007FFF0FEC04FB 8B 4D F4             mov         ecx,dword ptr [rbp-0Ch] // [rbp-0xc]就是变量x, 移动到第一个参数
  45. 00007FFF0FEC04FE E8 55 FE FF FF       call        00007FFF0FEC0358 // 调用Console.WriteLine
  46. 00007FFF0FEC0503 48 8D 05 CF FF FF FF lea         rax,[7FFF0FEC04D9h] // 恢复执行的地址
  47. 00007FFF0FEC050A 48 83 C4 28          add         rsp,28h // 释放本地的rsp预留的空间
  48. 00007FFF0FEC050E 5E                   pop         rsi // 恢复rsi
  49. 00007FFF0FEC050F 5D                   pop         rbp // 恢复rbp
  50. 00007FFF0FEC0510 C3                   ret

我们可以看到在x64上实质上会为例外处理器单独生成一个小函数(00007FFF0FEC04E0~00007FFF0FEC0510),
发生例外时将会调用这个小函数进行处理, 处理完返回主函数.

fgCreateFunclets负责创建funclet, 源代码如下:

  1. /*****************************************************************************
  2.  *
  3.  *  Function to create funclets out of all EH catch/finally/fault blocks.
  4.  *  We only move filter and handler blocks, not try blocks.
  5.  */
  6.  
  7. void Compiler::fgCreateFunclets()
  8. {
  9.     assert(!fgFuncletsCreated);
  10.  
  11. #ifdef DEBUG
  12.     if (verbose)
  13.     {
  14.         printf("*************** In fgCreateFunclets()\n");
  15.     }
  16. #endif
  17.  
  18.     fgCreateFuncletPrologBlocks();
  19.  
  20.     unsigned           XTnum;
  21.     EHblkDsc*          HBtab;
  22.     const unsigned int funcCnt = ehFuncletCount() + 1;
  23.  
  24.     if (!FitsIn<unsigned short>(funcCnt))
  25.     {
  26.         IMPL_LIMITATION("Too many funclets");
  27.     }
  28.  
  29.     FuncInfoDsc* funcInfo = new (this, CMK_BasicBlock) FuncInfoDsc[funcCnt];
  30.  
  31.     unsigned short funcIdx;
  32.  
  33.     // Setup the root FuncInfoDsc and prepare to start associating
  34.     // FuncInfoDsc's with their corresponding EH region
  35.     memset((void*)funcInfo, 0, funcCnt * sizeof(FuncInfoDsc));
  36.     assert(funcInfo[0].funKind == FUNC_ROOT);
  37.     funcIdx = 1;
  38.  
  39.     // Because we iterate from the top to the bottom of the compHndBBtab array, we are iterating
  40.     // from most nested (innermost) to least nested (outermost) EH region. It would be reasonable
  41.     // to iterate in the opposite order, but the order of funclets shouldn't matter.
  42.     //
  43.     // We move every handler region to the end of the function: each handler will become a funclet.
  44.     //
  45.     // Note that fgRelocateEHRange() can add new entries to the EH table. However, they will always
  46.     // be added *after* the current index, so our iteration here is not invalidated.
  47.     // It *can* invalidate the compHndBBtab pointer itself, though, if it gets reallocated!
  48.  
  49.     for (XTnum = 0; XTnum < compHndBBtabCount; XTnum++)
  50.     {
  51.         HBtab = ehGetDsc(XTnum); // must re-compute this every loop, since fgRelocateEHRange changes the table
  52.         if (HBtab->HasFilter())
  53.         {
  54.             assert(funcIdx < funcCnt);
  55.             funcInfo[funcIdx].funKind    = FUNC_FILTER;
  56.             funcInfo[funcIdx].funEHIndex = (unsigned short)XTnum;
  57.             funcIdx++;
  58.         }
  59.         assert(funcIdx < funcCnt);
  60.         funcInfo[funcIdx].funKind    = FUNC_HANDLER;
  61.         funcInfo[funcIdx].funEHIndex = (unsigned short)XTnum;
  62.         HBtab->ebdFuncIndex          = funcIdx;
  63.         funcIdx++;
  64.         fgRelocateEHRange(XTnum, FG_RELOCATE_HANDLER);
  65.     }
  66.  
  67.     // We better have populated all of them by now
  68.     assert(funcIdx == funcCnt);
  69.  
  70.     // Publish
  71.     compCurrFuncIdx   = 0;
  72.     compFuncInfos     = funcInfo;
  73.     compFuncInfoCount = (unsigned short)funcCnt;
  74.  
  75.     fgFuncletsCreated = true;
  76.  
  77. #if DEBUG
  78.     if (verbose)
  79.     {
  80.         JITDUMP("\nAfter fgCreateFunclets()");
  81.         fgDispBasicBlocks();
  82.         fgDispHandlerTab();
  83.     }
  84.  
  85.     fgVerifyHandlerTab();
  86.     fgDebugCheckBBlist();
  87. #endif // DEBUG
  88. }

首先fgCreateFuncletPrologBlocks函数枚举EH表,
如果handler对应的第一个block可能从handler中的其他block跳转(第一个block在循环中),
那么这个block可能会运行多次, funclet的prolog代码将不能插入到这个block, 遇到这种情况需要在handler的第一个block前插入一个新的block.
然后分配一个保存函数信息的数组保存到compFuncInfos, 第0个元素是主函数, 后面的元素都是funclet.
最后枚举EH表, 填充compFuncInfos中的元素, 并且调用fgRelocateEHRange函数.

fgRelocateEHRange函数把handler范围内的block移动到BasicBlock列表的最后面, CodeGen生成代码时也会遵从这个布局, 把funclet生成在主函数的后面.
例如移动前的block是这样的:

  1. -------------------------------------------------------------------------------------------------------------------------------------
  2. BBnum         descAddr ref try hnd preds           weight   [IL range]      [jump]      [EH region]         [flags]
  3. -------------------------------------------------------------------------------------------------------------------------------------
  4. BB01 [000000000137BC60]  1                              1   [000..006)                                     i label target gcsafe 
  5. BB02 [000000000137BD70]  1  0    BB01                   0   [006..017)        (throw ) T0      try { }     keep i try rare label gcsafe newobj 
  6. BB03 [000000000137BE80]  0     0                        1   [017..024)-> BB04 ( cret )    H0   catch { }   keep i label target gcsafe 
  7. BB04 [000000000137BF90]  1       BB03                   1   [024..025)        (return)                     i label target 
  8. -------------------------------------------------------------------------------------------------------------------------------------

移动后就会变成这样:

  1. -------------------------------------------------------------------------------------------------------------------------------------
  2. BBnum         descAddr ref try hnd preds           weight   [IL range]      [jump]      [EH region]         [flags]
  3. -------------------------------------------------------------------------------------------------------------------------------------
  4. BB01 [000000000137BC60]  1                              1   [000..006)                                     i label target gcsafe 
  5. BB02 [000000000137BD70]  1  0    BB01                   0   [006..017)        (throw ) T0      try { }     keep i try rare label gcsafe newobj 
  6. BB04 [000000000137BF90]  1       BB03                   1   [024..025)        (return)                     i label target 
  7. +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ funclets follow
  8. BB03 [000000000137BE80]  0     0                        1   [017..024)-> BB04 ( cret )    H0 F catch { }   keep i label target gcsafe flet 
  9. -------------------------------------------------------------------------------------------------------------------------------------

PHASE_OPTIMIZE_LAYOUT

这个阶段会优化BasicBlock的布局(顺序), 包含以下的代码:

  1. if (!opts.MinOpts() && !opts.compDbgCode)
  2. {
  3.     optOptimizeLayout();
  4.     EndPhase(PHASE_OPTIMIZE_LAYOUT);
  5.  
  6.     // Compute reachability sets and dominators.
  7.     fgComputeReachability();
  8. }

optOptimizeLayout的源代码如下:

  1. /*****************************************************************************
  2.  *
  3.  *  Optimize the BasicBlock layout of the method
  4.  */
  5.  
  6. void Compiler::optOptimizeLayout()
  7. {
  8.     noway_assert(!opts.MinOpts() && !opts.compDbgCode);
  9.  
  10. #ifdef DEBUG
  11.     if (verbose)
  12.     {
  13.         printf("*************** In optOptimizeLayout()\n");
  14.         fgDispHandlerTab();
  15.     }
  16.  
  17.     /* Check that the flowgraph data (bbNum, bbRefs, bbPreds) is up-to-date */
  18.     fgDebugCheckBBlist();
  19. #endif
  20.  
  21.     noway_assert(fgModified == false);
  22.  
  23.     for (BasicBlock* block = fgFirstBB; block; block = block->bbNext)
  24.     {
  25.         /* Make sure the appropriate fields are initialized */
  26.  
  27.         if (block->bbWeight == BB_ZERO_WEIGHT)
  28.         {
  29.             /* Zero weighted block can't have a LOOP_HEAD flag */
  30.             noway_assert(block->isLoopHead() == false);
  31.             continue;
  32.         }
  33.  
  34.         assert(block->bbLoopNum == 0);
  35.  
  36.         if (compCodeOpt() != SMALL_CODE)
  37.         {
  38.             /* Optimize "while(cond){}" loops to "cond; do{}while(cond);" */
  39.  
  40.             fgOptWhileLoop(block);
  41.         }
  42.     }
  43.  
  44.     if (fgModified)
  45.     {
  46.         // Recompute the edge weight if we have modified the flow graph in fgOptWhileLoop
  47.         fgComputeEdgeWeights();
  48.     }
  49.  
  50.     fgUpdateFlowGraph(true);
  51.     fgReorderBlocks();
  52.     fgUpdateFlowGraph();
  53. }

fgOptWhileLoop函数会优化while结构, 如里面的注释,
优化前的结构如下:

  1.         jmp test
  2. loop:
  3.         ...
  4.         ...
  5. test:
  6.         cond
  7.         jtrue   loop

优化后的结构如下, 加了一个事前的检测:

  1.         cond
  2.         jfalse done
  3.         // else fall-through
  4. loop:
  5.         ...
  6.         ...
  7. test:
  8.         cond
  9.         jtrue   loop
  10. done:

如果fgOptWhileLoop有更新则调用fgComputeEdgeWeights重新计算权重.

fgUpdateFlowGraph函数会删除空block, 无法到达的block和多余的跳转.
如果传给fgUpdateFlowGraph的参数doTailDuplication是true还会执行以下的优化:
优化前的代码:

  1. block:
  2.     jmp target
  3. target:
  4.     cond
  5.     jtrue succ
  6. fallthrough:
  7.     ...
  8. succ:
  9.     ...

优化后的代码:
优化后target可能会变得多余, 所以下面还会执行一次参数是false的fgUpdateFlowGraph来删除它.

  1. block:
  2.     cond
  3.     jtrue succ
  4. new:
  5.     jmp fallthrough
  6. target:
  7.     cond
  8.     jtrue succ
  9. fallthrough:
  10.     ...
  11. succ:
  12.     ...

fgReorderBlocks函数根据之前计算的权重(bbWeight)把比较少运行的block排到后面, 到后面这些block可能会变成cold code并且与hot code分开写入.

fgComputeReachability

这个函数负责计算可以到达block的block集合和DOM树, 没有标记所属的阶段, 包含以下的代码:

  1. // Compute reachability sets and dominators.
  2. fgComputeReachability();

fgComputeReachability的源代码如下:

  1. /*****************************************************************************
  2.  *
  3.  *  Function called to compute the dominator and reachable sets.
  4.  *
  5.  *  Assumes the predecessor lists are computed and correct.
  6.  */
  7.  
  8. void Compiler::fgComputeReachability()
  9. {
  10. #ifdef DEBUG
  11.     if (verbose)
  12.     {
  13.         printf("*************** In fgComputeReachability\n");
  14.     }
  15.  
  16.     fgVerifyHandlerTab();
  17.  
  18.     // Make sure that the predecessor lists are accurate
  19.     assert(fgComputePredsDone);
  20.     fgDebugCheckBBlist();
  21. #endif // DEBUG
  22.  
  23.     /* Create a list of all BBJ_RETURN blocks. The head of the list is 'fgReturnBlocks'. */
  24.     fgReturnBlocks = nullptr;
  25.  
  26.     for (BasicBlock* block = fgFirstBB; block != nullptr; block = block->bbNext)
  27.     {
  28.         // If this is a BBJ_RETURN block, add it to our list of all BBJ_RETURN blocks. This list is only
  29.         // used to find return blocks.
  30.         if (block->bbJumpKind == BBJ_RETURN)
  31.         {
  32.             fgReturnBlocks = new (this, CMK_Reachability) BasicBlockList(block, fgReturnBlocks);
  33.         }
  34.     }
  35.  
  36.     // Compute reachability and then delete blocks determined to be unreachable. If we delete blocks, we
  37.     // need to loop, as that might have caused more blocks to become unreachable. This can happen in the
  38.     // case where a call to a finally is unreachable and deleted (maybe the call to the finally is
  39.     // preceded by a throw or an infinite loop), making the blocks following the finally unreachable.
  40.     // However, all EH entry blocks are considered global entry blocks, causing the blocks following the
  41.     // call to the finally to stay rooted, until a second round of reachability is done.
  42.     // The dominator algorithm expects that all blocks can be reached from the fgEnterBlks set.
  43.     unsigned passNum = 1;
  44.     bool     changed;
  45.     do
  46.     {
  47.         // Just to be paranoid, avoid infinite loops; fall back to minopts.
  48.         if (passNum > 10)
  49.         {
  50.             noway_assert(!"Too many unreachable block removal loops");
  51.         }
  52.  
  53.         /* Walk the flow graph, reassign block numbers to keep them in ascending order */
  54.         JITDUMP("\nRenumbering the basic blocks for fgComputeReachability pass #%u\n", passNum);
  55.         passNum++;
  56.         fgRenumberBlocks();
  57.  
  58.         //
  59.         // Compute fgEnterBlks
  60.         //
  61.  
  62.         fgComputeEnterBlocksSet();
  63.  
  64.         //
  65.         // Compute bbReach
  66.         //
  67.  
  68.         fgComputeReachabilitySets();
  69.  
  70.         //
  71.         // Use reachability information to delete unreachable blocks.
  72.         // Also, determine if the flow graph has loops and set 'fgHasLoops' accordingly.
  73.         // Set the BBF_LOOP_HEAD flag on the block target of backwards branches.
  74.         //
  75.  
  76.         changed = fgRemoveUnreachableBlocks();
  77.  
  78.     } while (changed);
  79.  
  80. #ifdef DEBUG
  81.     if (verbose)
  82.     {
  83.         printf("\nAfter computing reachability:\n");
  84.         fgDispBasicBlocks(verboseTrees);
  85.         printf("\n");
  86.     }
  87.  
  88.     fgVerifyHandlerTab();
  89.     fgDebugCheckBBlist(true);
  90. #endif // DEBUG
  91.  
  92.     //
  93.     // Now, compute the dominators
  94.     //
  95.  
  96.     fgComputeDoms();
  97. }

首先这个函数会把所有返回的block添加到fgReturnBlocks链表,
然后调用fgRenumberBlocks重新给block分配序号(下面的处理要求block的序号是整理过的),
然后调用fgComputeEnterBlocksSet把进入函数或者funclet的block(fgFirstBB和各个例外处理器的第一个block)加到fgEnterBlks集合中.
然后调用fgComputeReachabilitySets计算哪些block可以到达block(block自身和所有preds的bbReach的union)并保存到BasicBlock::bbReach.
然后调用fgRemoveUnreachableBlocks把不可从函数入口(fgEnterBlks)到达的block(fgEnterBlks | bbReach为空)删除.
最后调用fgComputeDoms计算DOM树.

关于DOM(dominator)树请参考前一篇文章中对Flowgraph Analysis的介绍,
一句话来说如果进入Block B必须经过Block A, 则称A是B的Dominator, 最近的Dominator会保存在BasicBlock::bbIDom中.
CoreCLR中计算DOM树的算法跟这篇论文中的算法一样.

PHASE_ALLOCATE_OBJECTS

这个阶段负责把GT_ALLOCOBJ节点转换为GT_CALL节点, 包含以下的代码:

  1. // Transform each GT_ALLOCOBJ node into either an allocation helper call or
  2. // local variable allocation on the stack.
  3. ObjectAllocator objectAllocator(this);
  4. objectAllocator.Run();

在之前分析new的文章中提到过,
ObjectAllocator::Run会把allocobj节点转换为具体的jit helper call.
转换为call以后就和普通的函数调用一样了, 参数接收MethodTable的指针, 返回新创建的对象(构造函数未调用, 字段值全是0).

PHASE_OPTIMIZE_LOOPS

这个阶段负责识别和标记函数中的循环, 包含以下的代码:

  1. optOptimizeLoops();
  2. EndPhase(PHASE_OPTIMIZE_LOOPS);

optOptimizeLoops的处理如下:

首先调用optSetBlockWeights, 根据DOM树设置不能到达return block的block的权重(bbWeight) /= 2.
然后调用optFindNaturalLoops, 根据DOM树识别出循环并保存循环的信息到optLoopTable.

一个循环包含以下的组成部分(来源于optFindNaturalLoops的注释):

  1. /* We will use the following terminology:
  2.  * HEAD    - the basic block that flows into the loop ENTRY block (Currently MUST be lexically before entry).
  3.              Not part of the looping of the loop.
  4.  * FIRST   - the lexically first basic block (in bbNext order) within this loop.  (May be part of a nested loop,
  5.  *           but not the outer loop. ???)
  6.  * TOP     - the target of the backward edge from BOTTOM. In most cases FIRST and TOP are the same.
  7.  * BOTTOM  - the lexically last block in the loop (i.e. the block from which we jump to the top)
  8.  * EXIT    - the loop exit or the block right after the bottom
  9.  * ENTRY   - the entry in the loop (not necessarly the TOP), but there must be only one entry
  10.  *
  11.  * We (currently) require the body of a loop to be a contiguous (in bbNext order) sequence of basic blocks.
  12.         |
  13.         v
  14.       head
  15.         |
  16.         |    top/beg <--+
  17.         |       |       |
  18.         |      ...      |
  19.         |       |       |
  20.         |       v       |
  21.         +---> entry     |
  22.                 |       |
  23.                ...      |
  24.                 |       |
  25.                 v       |
  26.          +-- exit/tail  |
  27.          |      |       |
  28.          |     ...      |
  29.          |      |       |
  30.          |      v       |
  31.          |    bottom ---+
  32.          |
  33.          +------+
  34.                 |
  35.                 v
  36.  */

最后枚举循环中(top~bottom)的block并调用optMarkLoopBlocks.
optMarkLoopBlocks会增加循环中的block的权重(bbWeight),
对于backedge block(block的preds是比它更后的block, 例如循环的第一个block)的dominator, 权重会乘以BB_LOOP_WEIGHT(8), 否则乘以BB_LOOP_WEIGHT/2(4).

PHASE_CLONE_LOOPS

这个阶段用于执行复制循环的优化, 包含以下的代码:

  1. // Clone loops with optimization opportunities, and
  2. // choose the one based on dynamic condition evaluation.
  3. optCloneLoops();
  4. EndPhase(PHASE_CLONE_LOOPS);

上一个阶段PHASE_OPTIMIZE_LOOPS找出了函数中的循环信息,
optCloneLoops会判断哪些循环可以执行复制循环的优化并执行.
复制循环的优化具体如下(来源于optCloneLoop的注释):

  1. // We're going to make
  2.  
  3. // Head --> Entry
  4. // First
  5. // Top
  6. // Entry
  7. // Bottom  ?-> Top
  8. // X
  9. //
  10. //   become
  11. //
  12. // Head ?-> Entry2
  13. // Head2--> Entry    (Optional; if Entry == Top == First, let Head fall through to F/T/E)
  14. // First
  15. // Top
  16. // Entry
  17. // Bottom  ?-> Top
  18. // X2--> X
  19. // First2
  20. // Top2
  21. // Entry2
  22. // Bottom2 ?-> Top2
  23. // X

更具体的例子:

  1. for (var x = 0; x < a.Length; ++x) {
  2.     b[x] = a[x];
  3. }

(optCloneLoop)[https://github.com/dotnet/coreclr/blob/v1.1.0/src/jit/optimizer.cpp#L4420]前:

  1. if (x < a.Length) {
  2.     do {
  3.         var tmp = a[x];
  4.         b[x] = tmp;
  5.         x = x + 1;
  6.     } while (x < a.Length);
  7. }

(optCloneLoop)[https://github.com/dotnet/coreclr/blob/v1.1.0/src/jit/optimizer.cpp#L4420]后:

  1. if (x < a.Length) {
  2.     if ((a != null && b != null) && (a.Length <= b.Length)) {
  3.         do {
  4.             var tmp = a[x]; // no bounds check
  5.             b[x] = tmp; // no bounds check
  6.             x = x + 1;
  7.         } while (x < a.Length);
  8.     } else {
  9.         do {
  10.             var tmp = a[x];
  11.             b[x] = tmp;
  12.             x = x + 1;
  13.         } while (x < a.Length);
  14.     }
  15. }

这个优化的目的是在确保不会越界的情况(运行时)下, 可以省略掉循环中的边界检查.

PHASE_UNROLL_LOOPS

这个阶段用于执行展开循环的优化, 包含以下的代码:

  1. /* Unroll loops */
  2. optUnrollLoops();
  3. EndPhase(PHASE_UNROLL_LOOPS);

optUnrollLoops会尝试展开循环, 展开循环的条件有:

  • 循环次数在编译时可以确定
  • 当前编译模式不是debug, 也不需要小代码优化
  • 循环中代码体积不超过UNROLL_LIMIT_SZ(值参考代码)
  • 循环次数不超过ITER_LIMIT(值参考代码)

满足时将会把循环体按次数进行复制, 例如for (var x = 0; x < 3; ++x) { abc(); }会优化成abc(); abc(); abc();.

PHASE_MARK_LOCAL_VARS

这个阶段会更新本地变量表lvaTable中的信息, 包含以下的代码:

  1. /* Create the variable table (and compute variable ref counts) */
  2.  
  3. lvaMarkLocalVars();
  4. EndPhase(PHASE_MARK_LOCAL_VARS);

lvaMarkLocalVars的处理如下:

  • 调用lvaAllocOutgoingArgSpace
    • 添加本地变量lvaOutgoingArgSpaceVar
    • 在x86上通过栈传递参数的时候会使用push, 在其他平台上可以直接复制值到这个变量完成栈参数的传递
    • 参考这个文档中对FEATURE_FIXED_OUT_ARGS的说明
  • 如果平台是x86(需要ShadowSP slots)
    • 添加本地变量lvaShadowSPslotsVar
    • 因为x86不会生成funclet, 例外处理机制需要使用额外的变量
    • 参考这个文档中对ShadowSP slots的说明
  • 如果平台不是x86(需要使用funclet)
    • 添加本地变量lvaPSPSym
    • PSPSym的全称是Previous Stack Pointer Symbol, 是一个指针大小的值, 保存上一个函数的堆栈地址
    • 调用eh funclet的时候恢复rsp到main function的rsp值, funclet就可以访问到原来的本地变量
    • 参考这个文档中对PSPSym的说明
    • 还可以参考上面funclet的例子中的汇编代码
  • 如果使用了localloc(stackalloc)
    • 添加本地变量lvaLocAllocSPvar
    • 用于保存修改后的rsp地址(genLclHeap)
  • 如果当前是除错模式则给各个本地变量分配序号
    • varDsc->lvSlotNum = lclNum (从0开始递增)
  • 枚举BasicBlock, 调用lvaMarkLocalVars
    • 枚举block中的树更新本地变量的引用计数
  • 如果本地变量用于储存来源于寄存器的引用参数, 则添加两次引用次数
  • 如果lvaKeepAliveAndReportThis成立(例如同步函数需要unlock this)
    • 并且如果该函数中无其他部分使用this, 则设置this的引用计数为1
  • 如果lvaReportParamTypeArg成立
    • 并且如果该函数中无其他部分使用这个变量, 则设置这个变量的引用计数为1
    • paramTypeArg(Generic Context)的作用是调用时传入MethodDesc
    • 例如new A<string>().Generic<int>(123)时会传入Generic<int>对应的MethodDesc
  • 调用lvaSortByRefCount
    • 判断各个本地变量是否可以跟踪(lvTracked), 和是否可以存到寄存器(lvDoNotEnregister)
    • 生成小代码时按lvRefCnt, 否则按lvRefCntWtd从大到小排序本地变量
    • 排序后生成新的lvaCurEpoch

PHASE_OPTIMIZE_BOOLS

这个阶段用于合并相邻的两个根据条件跳转的BasicBlock, 包含以下的代码:

  1. /* Optimize boolean conditions */
  2.  
  3. optOptimizeBools();
  4. EndPhase(PHASE_OPTIMIZE_BOOLS);
  5.  
  6. // optOptimizeBools() might have changed the number of blocks; the dominators/reachability might be bad.

optOptimizeBools会做以下的优化:

如果block的结构如下, 且B2中只有单条指令:

  1. B1: brtrue(t1, BX)
  2. B2: brtrue(t2, BX)
  3. B3

则转换为以下的结构:

  1. B1: brtrue(t1|t2, BX)
  2. B3:

如果block的结构如下, 且B2中只有单条指令:

  1. B1: brtrue(t1, B3)
  2. B2: brtrue(t2, BX)
  3. B3:
  4. ...
  5. BX:

则转换为以下的结构:

  1. B1: brtrue((!t1)&&t2, BX)
  2. B3:
  3. ...
  4. BX:

PHASE_FIND_OPER_ORDER

这个阶段用于判断各个节点(GenTree)的评价顺序并设置它们的运行和体积成本, 包含以下的代码:

  1. /* Figure out the order in which operators are to be evaluated */
  2. fgFindOperOrder();
  3. EndPhase(PHASE_FIND_OPER_ORDER);

fgFindOperOrder对每个BasicBlock中的语句调用gtSetStmtInfo.
gtSetStmtInfo针对GenTree递归调用gtSetEvalOrder.
gtSetEvalOrder函数会设置GenTree的运行成本(gtCostEx)和体积成本(gtCostSz),
且如果一个满足交换律的二元运算符的第二个参数成本比第一个参数高时, 标记这个运算需要先评价第二个参数.
运行成本(gtCostEx)和体积成本(gtCostSz)在后面用于判断是否值得执行CSE优化.

PHASE_SET_BLOCK_ORDER

这个阶段用于按各个节点(GenTree)的评价顺序把它们连成一个链表(LIR格式), 包含以下的代码:

  1. // Weave the tree lists. Anyone who modifies the tree shapes after
  2. // this point is responsible for calling fgSetStmtSeq() to keep the
  3. // nodes properly linked.
  4. // This can create GC poll calls, and create new BasicBlocks (without updating dominators/reachability).
  5. fgSetBlockOrder();
  6. EndPhase(PHASE_SET_BLOCK_ORDER);
  7.  
  8. // IMPORTANT, after this point, every place where tree topology changes must redo evaluation
  9. // order (gtSetStmtInfo) and relink nodes (fgSetStmtSeq) if required.
  10. CLANG_FORMAT_COMMENT_ANCHOR;

fgSetBlockOrder会做以下的事情:

  • 判断是否要生成可中断的代码(例如有循环时需要生成), 如果要则设置genInterruptible = true
  • 调用fgCreateGCPolls
    • 枚举BasicBlock, 如果block标记为BBF_NEEDS_GCPOLL则插入调用CORINFO_HELP_POLL_GC(JIT_PollGC)的代码
    • JIT_PollGC会在运行GC时暂停当前的线程
  • 枚举BasicBlock, 调用fgSetBlockOrder
    • 枚举block中的语句, 调用fgSetStmtSeq
      • 对于语句中的节点(GenTree)递归调用fgSetTreeSeqHelper
        • 例如 a + b 会分别对 a, b, + 这3个节点调用fgSetTreeSeqFinish
        • fgSetTreeSeqFinish调用时会增加fgTreeSeqNum, 并且添加节点到链表fgTreeSeqLst
        • 全部完成后链表fgTreeSeqLst保存了所有GenTree节点, 这就是LIR的结构, 但正式使用LIR还要再经过几个阶段

PHASE_BUILD_SSA

这个阶段负责对访问本地变量的GenTree标记SSA版本, 包含以下的代码:

  1. if (doSsa)
  2. {
  3.     fgSsaBuild();
  4.     EndPhase(PHASE_BUILD_SSA);
  5. }

fgSsaBuild会给访问本地变量的节点(例如lclvar)分配SSA版本,
访问的形式有USE(读取了变量), DEF(写入了变量), USEASG(读取然后写入了变量, 例如+=),
变量的值写入一次SSA版本会加1, 同时读取的节点也会标记读取的是哪个版本的值, SSA版本保存在节点的GenTreeLclVarCommon::_gtSsaNum成员中.
如果读取的值来源于不同的block, 需要在运行时确定则在block的开头添加phi节点.
前一篇文章介绍了标记SSA的例子, 如下:

881857-20171028110140836-1221432801.jpg

fgSsaBuild的具体算法比较复杂, 请参考我的JIT笔记中的信息或者源代码.

PHASE_EARLY_PROP

这个阶段会根据SSA追踪本地变量并做出简单的优化, 包含以下的代码:

  1. if (doEarlyProp)
  2. {
  3.     /* Propagate array length and rewrite getType() method call */
  4.     optEarlyProp();
  5.     EndPhase(PHASE_EARLY_PROP);
  6. }

optEarlyProp的处理如下:

  • 枚举BasicBlock和BasicBlock中的语句
    • 按执行顺序枚举语句中的tree, 调用optEarlyPropRewriteTree
      • 对于GT_ARR_LENGTH节点(获取数组长度的节点), 基于SSA跟踪数组的来源, 如果跟踪到new 数组[常量], 则把该节点替换为常量
      • 对于使用GT_INDIR获取MethodTable(vtable)的节点, 基于SSA追踪对象的来源, 和上面一样找到则把节点替换为常量
      • 对于获取对象成员并且需要检查null的节点, 如果成员的offset不超过一定值则可以去除nullcheck(因为一定会发生页错误), 在之前的文章中有提到过这个机制
      • 如果节点有修改则调用gtSetStmtInfo重新计算运行和体积成本
      • 如果节点有修改则调用fgSetStmtSeq更新GenTree的链表

PHASE_VALUE_NUMBER

这个阶段会为GenTree分配VN(Value Number), 包含以下的代码:

  1. if (doValueNum)
  2. {
  3.     fgValueNumber();
  4.     EndPhase(PHASE_VALUE_NUMBER);
  5. }

前面的SSA是针对访问本地变量的节点(GenTree)分配一个唯一的版本号, 版本号一致则值一致,
这里的VN则是针对所有节点(GenTree)分配一个唯一的标识, 标识相同则值相同.

fgValueNumber会调用fgValueNumberBlock和fgValueNumberTree标记各个节点的VN.
VN有两种类型, Liberal假定其他线程只有在同步点才会修改heap中的内容, Conservative假定其他线程在任意两次访问之间都有可能修改heap中的内容.
VN会从ValueNumStore中分配, ValueNumStore包含以下类型的VN集合:

  • m_intCnsMap: int常量的VN集合
  • m_longCnsMap: long常量的VN集合
  • m_handleMap: field或者class handle的VN集合
  • m_floatCnsMap: float常量的VN集合
  • m_doubleCnsMap: double常量的VN集合
  • m_byrefCnsMap: byref常量的VN集合
  • m_VNFunc0Map: 带0个参数的操作符的VN集合
  • m_VNFunc1Map: 带1个参数的操作符(unary)的VN集合, 例如-x
  • m_VNFunc2Map: 带2个参数的操作符(binary)的VN集合, 例如a + b
  • m_VNFunc3Map: 带3个参数的操作符的VN集合

例如a = 1; b = GetNum(); c = a + b; d = a + b;,
a的VN是常量1, 储存在m_intCnsMap中,
b的VN因为无法确定值, 会调用VNForExpr分配一个新的VN,
c的VN是a+b的组合, 储存在m_VNFunc2Map中,
d的VN是a+b的组合, 因为之前已经生成过, 会从m_VNFunc2Map获取一个现有的VN,
这时我们可以确定c和d的值是相同的.

生成VN的具体算法请参考我的JIT笔记或者源代码.

PHASE_HOIST_LOOP_CODE

这个阶段会把循环中和循环无关的表达式提到循环外面, 包含以下的代码:

  1. if (doLoopHoisting)
  2. {
  3.     /* Hoist invariant code out of loops */
  4.     optHoistLoopCode();
  5.     EndPhase(PHASE_HOIST_LOOP_CODE);
  6. }

optHoistLoopCode会枚举循环中的表达式,
获取表达式的VN, 并调用optVNIsLoopInvariant判断表达式的值是否和循环无关,
如果和循环无关, 并且表达式无副作用, 并且表达式的节点拥有足够的成本(gtCostEx)则把表达式提到循环外面.

例如优化前的代码:

  1. var a = SomeFunction();
  2. for (var x = 0; x < 3; ++x) {
  3.     Console.WriteLine(a * 3);
  4. }

优化后可以把a * 3提到外面:

  1. var a = SomeFunction();
  2. var tmp = a * 3;
  3. for (var x = 0; x < 3; ++x) {
  4.     Console.WriteLine(tmp);
  5. }

判断表达式的值和循环无关的依据有:

  • 如果VN是phi, 则phi的来源需要在循环外部(例如上面如果是x * 3则来源是循环内部)
  • 如果表达式访问了heap上的变量(class的成员)则不能判断无关
  • 表达式中访问的本地变量的SSA版本的定义需要在循环外部(例如上面的a的定义在循环外部)

PHASE_VN_COPY_PROP

这个阶段会替换具有相同VN的本地变量, 包含以下的代码:

  1. if (doCopyProp)
  2. {
  3.     /* Perform VN based copy propagation */
  4.     optVnCopyProp();
  5.     EndPhase(PHASE_VN_COPY_PROP);
  6. }

optVnCopyProp会枚举所有读取(USE)本地变量的节点,
调用optCopyProp, 查找当前是否有VN相同并存活的其他变量, 如果有则替换读取的变量到该变量.

例如优化前的代码:

  1. var a = GetNum();
  2. var b = a;
  3. var c = b + 123;

优化后可以把b替换为a:

  1. var a = GetNum();
  2. var b = a;
  3. var c = a + 123;

后面如果b的引用计数为0则我们可以安全的删掉变量b.
这项优化可以减少多余的变量复制.

PHASE_OPTIMIZE_VALNUM_CSES

这个阶段会替换具有相同VN的表达式, 俗称CSE优化, 包含以下的代码:

  1. #if FEATURE_ANYCSE
  2. /* Remove common sub-expressions */
  3. optOptimizeCSEs();
  4. #endif // FEATURE_ANYCSE

optOptimizeCSEs会枚举所有节点,
调用optIsCSEcandidate判断是否应该对节点进行CSE优化, 判断依据包括表达式的成本(小代码时gtCostSz否则gtCostEx),
如果判断通过则调用optValnumCSE_Index, 对于拥有相同VN的节点,
第一次仅仅添加节点到optCSEhash索引中,
第二次因为节点已经在optCSEhash索引中, 会给该索引中的元素分配一个新的csdIndex(自增值), 然后设置节点的gtCSEnum等于csdIndex,
第三次之后节点已经在optCSEhash索引中, 也已经分配过csdIndex, 后面的节点的gtCSEnum都会指向同一个csdIndex.
完成后如果optCSEhash中有任意的元素有csdIndex, 则调用以下的函数执行CSE优化:

例如优化前的代码:

  1. var a = SomeFunction();
  2. var b = (a + 5) * a;
  3. var c = (a + 5) + a;

优化后可以把a + 5提取出来:

  1. var a = SomeFunction();
  2. var tmp = a + 5;
  3. var b = tmp * a;
  4. var c = tmp + a;

这项优化可以减少重复的计算, 但会增加本地变量的数量.

PHASE_ASSERTION_PROP_MAIN

这个阶段会根据SSA和VN再次传播断言, 包含以下的代码:

  1. if (doAssertionProp)
  2. {
  3.     /* Assertion propagation */
  4.     optAssertionPropMain();
  5.     EndPhase(PHASE_ASSERTION_PROP_MAIN);
  6. }

optAssertionPropMain包含以下的处理:

  • 遍历节点调用optVNAssertionPropCurStmtVisitor
    • 调用optVnNonNullPropCurStmt
      • 针对call节点, 如果可以通过VN确定this不为null, 则标记可以省略null检查
      • 针对indir(deref)节点, 如果可以通过VN确定变量不为null, 则标记可以省略null检查
    • 调用optVNConstantPropCurStmt
      • 如果节点的VN是常量, 替换节点到该常量
  • 再次调用optAssertionGen根据当前的状态创建断言
  • 调用optComputeAssertionGen按跳转条件创建断言
    • 例如 if (a > 3) { /* block a */ } else { /* block b */ }, 可以断言block a中a > 3和block b中a <= 3
  • 再次调用[optAssertionProp]按传播后的断言优化节点
    • optAssertionProp_LclVar
      • 如果确定本地变量等于常量，修改为该常量
      • 如果确定本地变量等于另一本地变量，修改为另一本地变量
    • optAssertionProp_Ind
      • 如果indir(deref)左边的节点是lclVar, 并且该节点确定不为null, 则标记可以省略null检查
    • optAssertionProp_BndsChk
      • 如果数组的位置是常量并且确定不会溢出, 则标记不需要检查边界
    • optAssertionProp_Comma
      • 如果前面标记了不需要检查边界, 则删除边界检查(comma bound_check, expr) => (expr)
    • optAssertionProp_Cast
      • 如果是小范围类型转换为大范围类型, 则标记不会溢出
      • 如果是大范围类型转换为小范围类型, 且确定不会溢出则去除cast
    • optAssertionProp_Call
      • 如果可以确定this不为null, 则标记可以省略null检查
    • optAssertionProp_RelOp
      • 替换等于或者不等于的表达式, 例如x == const, x的值确定是可以替换成true或false

PHASE_OPTIMIZE_INDEX_CHECKS

这个阶段会根据VN和断言删除多余的数组边界检查, 包含以下的代码:

  1. if (doRangeAnalysis)
  2. {
  3.     /* Optimize array index range checks */
  4.     RangeCheck rc(this);
  5.     rc.OptimizeRangeChecks();
  6.     EndPhase(PHASE_OPTIMIZE_INDEX_CHECKS);
  7. }

OptimizeRangeChecks会枚举检查边界的节点(COMMA且左参数是ARR_BOUNDS_CHECK)并调用OptimizeRangeCheck,
如果可以通过VN确定访问的序号小于数组长度, 则可以去掉边界检查(COMMA左边只留副作用),

PHASE_UPDATE_FLOW_GRAPH

如果优化过程中做出了修改, 这个阶段会再次调用fgUpdateFlowGraph删除空block, 无法到达的block和多余的跳转:

  1. /* update the flowgraph if we modified it during the optimization phase*/
  2. if (fgModified)
  3. {
  4.     fgUpdateFlowGraph();
  5.     EndPhase(PHASE_UPDATE_FLOW_GRAPH);
  6.     
  7.     ...
  8. }

PHASE_COMPUTE_EDGE_WEIGHTS2

如果优化过程中做出了修改, 这个阶段会再次调用fgComputeEdgeWeights计算block和block edge的权重(weight):
从阶段的名字也可以看出来这个阶段的处理跟前面的PHASE_COMPUTE_EDGE_WEIGHTS阶段一样.

  1. /* update the flowgraph if we modified it during the optimization phase*/
  2. if (fgModified)
  3. {
  4.     ...
  5.     
  6.     // Recompute the edge weight if we have modified the flow graph
  7.     fgComputeEdgeWeights();
  8.     EndPhase(PHASE_COMPUTE_EDGE_WEIGHTS2);
  9. }

PHASE_DETERMINE_FIRST_COLD_BLOCK

这个阶段负责标记第一个冷(cold)的BasicBlock, 包含以下的代码:

  1. fgDetermineFirstColdBlock();
  2. EndPhase(PHASE_DETERMINE_FIRST_COLD_BLOCK);

因为前面的fgReorderBlocks已经把权重较小的block排到链表的后面,
fgDetermineFirstColdBlock会查找BasicBlock链表的最后连续标记了BBF_RUN_RARELY的部分,
设置第一个标记的block到fgFirstColdBlock, 然后标记这些block为BBF_COLD, 如果找不到则fgFirstColdBlock会等于null.

CodeGen会根据fgFirstColdBlock把代码分为两部分, 热(hot)的部分和冷(cold)的部分分别写入到不同的位置.

PHASE_RATIONALIZE

这个阶段是JIT后端的第一个阶段, 解决LIR中需要上下文判断的节点并正式开始使用LIR, 包含以下的代码:

  1. #ifndef LEGACY_BACKEND
  2. // rationalize trees
  3. Rationalizer rat(this); // PHASE_RATIONALIZE
  4. rat.Run();
  5. #endif // !LEGACY_BACKEND

Rationalizer::Run包含以下的处理:

  • 枚举BasicBlock中的语句(stmt)
    • 如果当前的平台不支持GT_INTRINSIC节点的操作(例如abs, round, sqrt)则替换为helper call
    • 设置上一个语句的最后一个节点的下一个节点是下一个语句的第一个节点
    • 设置下一个语句的第一个节点的上一个节点是上一个语句的最后一个节点
  • 标记BasicBlock的第一个节点和最后一个节点
  • 标记BasicBlock的格式已经是LIR(BBF_IS_LIR)
  • 枚举BasicBlock中的语句(stmt)
    • 把语句节点(GT_STMT)转换为IL偏移值节点(GT_IL_OFFSET), 用于标记哪些节点属于哪行IL语句
    • 针对语句中的节点调用Rationalizer::RewriteNode
      • 把修改变量的GT_LCL_VAR, GT_LCL_FLD, GT_REG_VAR, GT_PHI_ARG节点转换为GT_STORE_LCL_VAR, GT_STORE_LCL_FLD
      • 把修改地址值的GT_IND节点转换为GT_STOREIND
      • 把修改类字段的GT_CLS_VAR节点转换为GT_CLS_VAR_ADDR+GT_STOREIND
      • 把修改块值的GT_BLK, GT_OBJ, GT_DYN_BLK节点转换为GT_STORE_BLK, GT_STORE_OBJ, GT_STORE_DYN_BLK
      • 删除GT_BOX节点(因为已经转换为call)
      • 对于GT_ADDR节点
        • 如果目标是本地变量则修改节点为GT_LCL_VAR_ADDR或者GT_LCL_FLD_ADDR
        • 如果目标是类字段则修改节点为GT_CLS_VAR_ADDR
        • 如果对象是indir则可以同时删除indir和addr(&*someVar => someVar)
      • 对于GT_NOP节点, 如果有参数则替换为参数并删除
      • 对于GT_COMMA节点
        • 如果第一个参数无副作用, 则删除第一个参数的所有节点
        • 如果第二个参数无副作用且值未被使用, 则删除第二个参数的所有节点
        • 删除GT_COMMA节点(第一个和第二个参数已经按顺序连接起来)
      • 删除GT_ARGPLACE节点(后面会添加GT_PUTARG_REG或GT_PUTARG_STK节点)
      • 把读取类字段的GT_CLS_VAR节点转换为GT_CLS_VAR_ADDR+GT_IND
      • 确保当前cpu支持GT_INTRINSIC节点对应的操作(例如abs, round, sqrt)
  • 设置正式开始使用LIR Compiler::compRationalIRForm = true

PHASE_SIMPLE_LOWERING

这个阶段会做一些简单的Lowering(使LIR更接近机器代码)工作, 包含以下的代码:

  1. // Here we do "simple lowering".  When the RyuJIT backend works for all
  2. // platforms, this will be part of the more general lowering phase.  For now, though, we do a separate
  3. // pass of "final lowering."  We must do this before (final) liveness analysis, because this creates
  4. // range check throw blocks, in which the liveness must be correct.
  5. fgSimpleLowering();
  6. EndPhase(PHASE_SIMPLE_LOWERING);

fgSimpleLowering包含以下的处理:

  • 按LIR顺序枚举节点
    • 如果节点是GT_ARR_LENGTH, 转换为GT_IND(arr + ArrLenOffset)
      • 例如数组对象在x64下0~8是指向MethodTable的指针, 8~12是数组长度, 则转换为indir(lclVar +(ref) const 8)
    • 如果节点是GT_ARR_BOUNDS_CHECK
      • 确保抛出IndexOutOfRangeException的BasicBlock存在, 不存在则添加

PHASE_LCLVARLIVENESS

这个阶段会设置各个BasicBlock进入和离开时存活的变量集合, 包含以下的代码:
这个阶段仅在使用旧的JIT后端(JIT32)时会启用, 也就是一般的CoreCLR不会执行这个阶段.

  1. #ifdef LEGACY_BACKEND
  2. /* Local variable liveness */
  3. fgLocalVarLiveness();
  4. EndPhase(PHASE_LCLVARLIVENESS);
  5. #endif // !LEGACY_BACKEND

fgLocalVarLiveness会设置BasicBlock的以下成员:

  • bbVarUse 使用过的本地变量集合
  • bbVarDef 修改过的本地变量集合
  • bbVarTmp 临时变量
  • bbLiveIn 进入block时存活的变量集合
  • bbLiveOut 离开block后存活的变量集合
  • bbHeapUse 是否使用过全局heap
  • bbHeapDef 是否修改过全局heap
  • bbHeapLiveIn 进入blob时全局heap是否存活
  • bbHeapLiveOut 离开blob后全局heap是否存活
  • bbHeapHavoc 是否会让全局heap进入未知的状态

PHASE_LOWERING

这个阶段会做主要的Lowering(使LIR更接近机器代码)工作, 确定各个节点需要的寄存器数量, 包含以下的代码:

  1. ///
  2. // Dominator and reachability sets are no longer valid. They haven't been
  3. // maintained up to here, and shouldn't be used (unless recomputed).
  4. ///
  5. fgDomsComputed = false;
  6.  
  7. /* Create LSRA before Lowering, this way Lowering can initialize the TreeNode Map */
  8. m_pLinearScan = getLinearScanAllocator(this);
  9.  
  10. /* Lower */
  11. Lowering lower(this, m_pLinearScan); // PHASE_LOWERING
  12. lower.Run();

Lowering::Run包含以下的处理:

  • 按LIR顺序枚举节点
    • 如果是x86(32位)则分解long节点到两个int节点(loResult => hiResult => long)
    • GT_IND: 判断是否可以替换为LEA节点(可以使用CPU中的LEA指令)
      • 例如*(((v07 << 2) + v01) + 16)可以替换为*(lea(v01 + v07*4 + 16))
    • GT_STOREIND: 判断是否可以替换为LEA节点, 同上
    • GT_ADD: 判断是否可以替换为LEA节点, 同上
    • GT_UDIV: 判断是否可以替换到RSZ节点
      • 例如16/2可以替换为16>>1
    • GT_UMOD: 判断是否可以替换到AND节点
      • 例如17/2可以替换为17&(2-1)
    • GT_DIV, GT_MOD:
      • 如果divisor是int.MinValue或者long.MinValue, 转换到EQ(只有自己除自己可以得到1)
      • 如果divisor是power of 2
        • 转换DIV到RSH, 例如16/-2转换到-(16>>1)
        • 转换MOD, 例如31%8转换到31-8*(31/8)转换到31-((31>>3)<<3)转换到31-(31& ~(8-1))
    • GT_SWITCH
      • 替换switch下的节点到一个本地变量
        • 例如switch v01 - 100替换到tmp = v01 - 100; switch tmp
      • 添加判断并跳到default case的节点
        • 例如if (tmp > jumpTableLength - 2) { goto jumpTable[jumpTableLength - 1]; }
      • 创建一个新的BasicBlock, 把原来的BBJ_SWITCH转移到这个block
        • 转移后的结构:
          • 原block (BBJ_COND, 条件成立时跳转到default case)
          • 新block (包含转移后的switch)
          • 剩余的block
      • 如果剩余的跳转目标都是同一个block, 可以省略掉switch, 直接跳过去
      • 否则如果跳转个数小于minSwitchTabJumpCnt则转换switch到多个jtrue(if ... else if ... else)
      • 否则转换switch到GT_SWITCH_TABLE节点(后面会生成一个包含偏移值的索引表, 按索引来跳转)
    • GT_CALL
      • 针对参数添加GT_PUTARG_REG或者GT_PUTARG_STK节点
      • 如果是调用委托则转换到具体的取值+调用
        • 例如把call originalThis转换到call indir(lea(originalThis+24)) with indir(lea(originalThis+8))
        • indir(lea(originalThis+24))是函数的地址
        • indir(lea(originalThis+8))是真正的this, 会替换掉原有的this式
      • 否则如果是GTF_CALL_VIRT_STUB则替换到call ind(函数地址的地址)
      • 否则如果是GTF_CALL_VIRT_VTABLE则替换到call ind(vtable中函数的地址)
        • 例如ind(lea(ind(lea(ind(lea(this+0))+72))+32))
      • 否则如果是GTF_CALL_NONVIRT
        • 如果是helper call则获取具体的函数地址(例如JIT_New的函数地址)
        • 如果函数地址已知则生成call addr
        • 如果函数地址的地址已知则生成call ind(addr)
        • 如果函数地址的地址的地址已知则生成call ind(ind(addr))
    • GT_JMP, GT_RETURN
      • 如果调用了非托管函数则在前面插入PME(pinvoke method epilog)
    • GT_CAST
      • 转换GT_CAST(small, float/double)到GT_CAST(GT_CAST(small, int), float/double)
      • 转换GT_CAST(float/double, small)到GT_CAST(GT_CAST(float/double, int), small)
    • GT_ARR_ELEM: 转换到获取元素地址并且IND的节点(例如IND(LEA))
    • GT_STORE_BLK, GT_STORE_OBJ, GT_STORE_DYN_BLK: 判断计算地址的节点是否可以替换为LEA节点, 同上
  • 按LIR顺序枚举节点
    • 计算节点需要的寄存器数量
    • 设置哪些节点是contained(contained节点是其他节点的指令的一部分)

可以参考上一篇文章关于Lowering的例子:

881857-20171028110148461-1101877151.jpg

PHASE_LINEAR_SCAN

这个阶段负责给各个节点分配寄存器, 使用的是LSRA算法, 包含以下的代码:

  1. assert(lvaSortAgain == false); // We should have re-run fgLocalVarLiveness() in lower.Run()
  2. lvaTrackedFixed = true;        // We can not add any new tracked variables after this point.
  3.  
  4. /* Now that lowering is completed we can proceed to perform register allocation */
  5. m_pLinearScan->doLinearScan();
  6. EndPhase(PHASE_LINEAR_SCAN);

LSRA算法可以看这一篇论文中的说明, 但CoreCLR中使用的算法和论文中的算法不完全一样.
LSRA算法要求根据LIR生成以下数据:

Interval

Interval表示同一个变量(本地L, 内部T, 其他I)对应的使用期间, 包含多个RefPosition,
本地变量的Interval会在一开始创建好, 其他(临时)的Interval会在需要使用寄存器(例如call返回值)时使用,
Interval有激活(activate)和未激活(inactive)状态, 未激活状态代表在当前位置该变量不会被使用(不占用寄存器).

LocationInfo

LocationInfo表示代码位置, 在构建时会对LIR中的GenTree分配位置, 位置总会+2.

RefPosition

RefPosition有以下的类型:

  • Def: 记录写入变量的位置, 有对应的Interval
  • Use: 记录读取变量的位置, 有对应的Interval
  • Kill: 记录寄存器值会被覆盖的位置, 常见于call时标记caller save registers被覆盖
  • BB: 记录BasicBlock的位置
  • FixedReg: 记录当前位置使用了固定的寄存器
  • ExpUse: 记录离开当前block时存活且进入后继block时也存活的变量(exposed use)
  • ParamDef: 记录函数开头传入(定义)的参数变量
  • DummyDef: 记录函数开头未定义的参数变量
  • ZeroInit: 记录函数开头需要0初始化的变量
  • KillGCRefs: 记录需要确保当前寄存器中无GC引用(对象或者struct的指针)的位置

可以参考上一篇文章中说明LSRA的图片:

881857-20171028110156070-945571268.jpg

LinearScan::doLinearScan包含以下的处理:

  • 调用setFrameType设置当前是否应该使用Frame Pointer
    • 使用Frame Pointer表示需要使用rbp保存进入函数时的rsp值, 需要清除所有节点的寄存器候选中的rbp
  • 调用initMaxSpill初始化用于记录spill层数的数组
    • 数组maxSpill有两个元素, 一个记录int的最大spill层数, 另一个记录float的最大spill层数
  • 调用buildIntervals构建LSRA算法需要的数据结构
    • 构建Interval, RefPosition, LocationInfo
  • 调用initVarRegMaps设置进入和离开block时变量使用的寄存器
    • 枚举BasicBlock
      • 设置inVarToRegMaps[blockIndex] = new regNumber[跟踪的变量数量]
      • 设置outVarToRegMaps[blockIndex] = new regNumber[跟踪的变量数量]
      • 枚举跟踪的变量数量
        • 设置inVarToRegMaps[blockIndex][regMapIndex] = REG_STK(默认通过栈传递)
        • 设置outVarToRegMap[blockIndex][regMapIndex] = REG_STK(默认通过栈传递)
    • 因为JIT需要确保如果变量在寄存器中, 离开block时变量所在的寄存器和进入后继block时变量所在的寄存器一致
  • 调用allocateRegisters分配寄存器
    • 这个函数包含了LSRA算法的主要处理, 以下是简化过的流程, 完整的请看我的JIT笔记
    • 建立一个寄存器索引physRegs[寄存器数量], 索引寄存器 => (上次使用寄存器的RefPosition, 是否正在使用)
    • 枚举Interval, 如果是传入的函数参数则设置isActive = true
    • 枚举RefPosition
      • 如果RefPosition是读取(Use)
        • 如果当前无正在分配的寄存器则标记为reload(把值从栈reload到寄存器)
      • 如果RefPosition要求使用固定的寄存器(例如Kill)
        • 让寄存器对应的Interval让出寄存器并设置为inactive
      • 如果RefPosition是最后一次读取(Use)
        • 标记下一轮处理Interval让出寄存器并设置为inactive
      • 如果RefPosition是读取(Use)或者写入(Def)且未分配寄存器
        • 调用tryAllocateFreeReg分配一个寄存器(论文中的First Pass)
        • 如果分配失败则调用allocateBusyReg再次尝试分配一个寄存器(论文中的Second Pass)
          • 必要时会让原来的寄存器对应的Interval让出寄存器(把值从寄存器spill到栈, 然后变为inactive)
        • 分配成功时Interval变为active
    • (如果一个变量对应的Interval从未让出过寄存器(spill), 则这个变量可以一直使用寄存器保存而不需要访问栈)
    • (反过来说如果一个Interval让出过寄存器(spill), 且该Interval不是本地变量, 则需要增加一个内部临时变量)
  • 调用resolveRegisters解决block之间寄存器的差异
    • 上面的分配是线性的, 并未考虑到flowgraph, 这个函数会确保离开block时变量所在的寄存器和进入后继block时变量所在的寄存器一致
    • 根据之前分配的结果给节点(GenTree)设置使用的寄存器
    • 如果需要重新从栈读取值则插入GT_RELOAD节点
    • 设置进入block时变量所在的寄存器索引inVarToRegMaps
    • 设置离开block时变量所在的寄存器索引outVarToRegMap
    • 调用resolveEdges
      • 如果block的后继block有多个前继block, 例如(A => B, C => B), 则需要在A中解决
        • 如果block结束时变量的寄存器跟后继block的寄存器一致, 则无需resolution
        • 如果block结束时变量的寄存器跟后继block的寄存器不一致, 但所有后继block的寄存器都相同
          • 在block结束前插入GT_COPY节点, 复制来源寄存器到目标寄存器(或者来源寄存器到堆栈到目标寄存器)
        • 如果block结束时变量的寄存器跟后继block的寄存器不一致, 且不是所有后继block的寄存器都相同
          • 在block和后继block之间插入一个新block, 新block中插入GT_COPY节点用于复制到目标寄存器
      • 如果block只有一个前继block, 例如(A => B), 则可以在B中解决
        • 对于不一致的寄存器在block开头插入GT_COPY节点
    • 对于从未spill过的本地变量, 设置它可以不放在栈上(lvRegister = true, lvOnFrame = false)
    • 对于非本地变量的spill, 根据maxSpill[int]和maxSpill[float]调用tmpPreAllocateTemps创建指定数量的内部临时变量

经过这个阶段后, LIR中需要寄存器的节点都会得到明确的寄存器, 读取或者写入本地变量的节点也会明确目标是栈还是某个寄存器.

PHASE_RA_ASSIGN_VARS

因为旧的JIT后端不支持LSRA, 这个阶段负责给旧的JIT后端(JIT32)分配寄存器, 包含以下的代码:

  1. lvaTrackedFixed = true; // We cannot add any new tracked variables after this point.
  2. // For the classic JIT32 at this point lvaSortAgain can be set and raAssignVars() will call lvaSortOnly()
  3.  
  4. // Now do "classic" register allocation.
  5. raAssignVars();
  6. EndPhase(PHASE_RA_ASSIGN_VARS);

因为一般的CoreCLR不会执行这个阶段, 这里就不详细分析了.

PHASE_GENERATE_CODE

从这个阶段开始就属于CodeGen了, CodeGen的入口如下:

  1. /* Generate code */
  2.  
  3. codeGen->genGenerateCode(methodCodePtr, methodCodeSize);

genGenerateCode包含了三个阶段:

  • PHASE_GENERATE_CODE: 负责根据LIR生成汇编指令
  • PHASE_EMIT_CODE: 根据汇编指令写入可执行的机器代码
  • PHASE_EMIT_GCEH: 写入函数的附加信息(函数头, GC信息, 例外信息等)

CodeGen会使用以下的数据类型:

  • instrDesc: 汇编指令的数据, 一个instrDesc实例对应一条汇编指令
  • insGroup: 汇编指令的组, 一个insGroup包含一个或多个instrDesc, 跳转指令的目标只能是IG的第一条指令

以下是上一篇文章中的图片说明:

881857-20171028110203555-1584196634.jpg

PHASE_GENERATE_CODE阶段包含了以下的处理:

  • 调用lvaAssignFrameOffsets给各个本地变量分配栈偏移值
    • 会分两步计算
      • 第一步设置一个虚拟的初始偏移值0, 然后以这个0为基准设置各个变量的偏移值, 参数为正数本地变量为负数
      • 第二步根据是否使用frame pointer调整各个偏移值
    • 计算完毕后会设置compLclFrameSize, 代表进入函数时需要分配的大小(例如sub rsp, 0x80)
  • 调用emitBegFN预留函数的prolog所使用的IG
    • LIR只包含了函数体, 函数的prolog需要一个单独的IG保存
  • 调用genCodeForBBlist处理BasicBlock
    • 如果block是小函数(funclet)的第一个block, 则预留小函数的prolog所使用的IG
    • 以LIR顺序枚举block中的节点, 调用genCodeForTreeNode根据节点添加汇编指令
      • GT_CNS_INT: 如果常量的值是0, 生成xor targetReg, targetReg, 否则生成mov, targetReg, imm
      • GT_NEG: 如果来源寄存器跟目标寄存器不一致则生成mov targetReg, sourceReg, 然后生成neg targetReg
      • GT_LCL_VAR: 如果本地变量已经在寄存器则可以不处理, 否则生成从栈读取到寄存器的指令, 例如mov targetReg, [rbp-offset]
      • GT_STORE_LCL_VAR: 如果本地变量已经在相同的寄存器则不处理, 如果在不同的寄存器则添加复制寄存器的指令, 否则生成从寄存器保存到栈的指令
      • 更多的类型可以参考我的JIT笔记
    • 判断block的跳转类型
      • BBJ_ALWAYS: 添加jmp指令
      • BBJ_RETURN: 预留函数的epilog使用的IG
      • BBJ_THROW: 添加int 3指令(这个指令不会被执行)
      • BBJ_CALLFINALLY: 添加mov rcx, pspsym; call finally-funclet; jmp finally-return;的指令
      • BBJ_EHCATCHRET: 移动block的目标地址(返回地址)到rax, 然后预留小函数的epilog使用的IG
      • BBJ_EHFINALLYRET, BBJ_EHFILTERRET: 预留小函数的epilog使用的IG
  • 调用genGeneratePrologsAndEpilogs添加prolog和epilog中的指令
    • 调用genFnProlog生成主函数的prolog
      • 如果需要使用Frame Pointer, 则添加push rbp; mov rbp, rsp
      • push修改过的Callee Saved Register
      • 添加分配栈空间的指令, 例如sub rsp, size, 并添加确认栈空间的虚拟内存(所有页)可访问的指令
      • 添加清零栈空间的指令(本地变量的初始值是0)
      • 如果使用了小函数(funclet), 则添加mov [lvaPSPSym], rsp
      • 如果使用了Generic Context参数则添加保存它到本地变量的指令
      • 如果使用了GS Cookie则添加设置GS Cookie值的指令
    • 调用emitGeneratePrologEpilog生成主函数的epilog和小函数的prolog和epilog
      • 枚举之前预留的IG列表
        • IGPT_PROLOG: 上面已经生成过, 这里可以跳过
        • IGPT_EPILOG: 调用genFnEpilog生成主函数的epilog
          • pop之前prolog里面push过的Callee Saved Register
          • 如果使用Frame Pointer且是x86, 则添加mov esp, ebp; pop ebp;
          • 如果使用Frame Pointer且是x64, 则添加add rsp, size; pop rbp或者lea rsp, [rsp+size]; pop rbp;
          • 如果不使用Frame Pointer, 则添加add rsp, size或者lea rsp, [rsp+size]
          • 如果是tail call则添加call addr, 如果是fast tail call则添加jmp rax, 否则添加ret
        • IGPT_FUNCLET_PROLOG:
          • 添加push rbp
          • push修改过的Callee Saved Register
          • 添加分配栈空间的指令, 例如sub rsp, size
          • 添加继承PSPSym并恢复主函数rbp的指令, 例如mov rbp, [rcx+20h]; mov [rsp+20h], rbp; lea rbp,[rbp+40h];
        • IGPT_FUNCLET_EPILOG:
          • 添加释放栈空间的指令, 例如add rsp, size
          • pop之前prolog里面push过的Callee Saved Register
          • 添加pop rbp
          • 添加ret

PHASE_EMIT_CODE

上一个阶段生成了汇编指令, 但这些指令是通过instrDesc保存在insGroup的数据结构, 并不是可执行的机器代码.
这个阶段负责根据instrDesc列表写入实际可执行的机器代码.

以下是上一篇文章中的图片说明:

881857-20171028110210773-1401314447.jpg

生成的结构如下, 包含函数代码, 函数头和真函数头:

881857-20171028110218117-790239182.jpg

这个阶段的主要处理在emitEndCodeGen函数中, 包含以下的处理:

  • 调用CEEJitInfo::allocMem分配保存可执行机器代码的内存
    • 调用EEJitManager::allocCode
      • 调用EEJitManager::allocCodeRaw
        • 获取CodeHeap(chunk)的列表, 如果空间不足则调用EEJitManager::NewCodeHeap分配一个新的chunk
        • 如果是动态函数, 这里会分配"函数头+函数代码+真函数头"的大小并返回指向"函数代码"的指针
        • 如果不是动态函数, 这里会分配"函数头+函数代码"的大小并返回函数代码的指针
      • 如果不是动态函数, 调用pMD->GetLoaderAllocator()->GetLowFrequencyHeap()->AllocMem分配真函数头
        • 这里分配的区域只有PAGE_READWRITE, 不可被执行
      • 设置"函数头"中的指针指向"真函数头"
      • 调用NibbleMapSet设置Nibble Map, 用于定位函数的开始地址
        • Nibble Map在函数所在chunk(HeapList)的pHdrMap成员中, 是一个DWORD的数组, 一个DWORD包含8个Nibble格式如下
        • [ [ NIBBLE(4bit), NIBBLE, ...(8个) ], [ NIBBLE, NIBBLE, ...(8个) ], ... ]
        • 例如函数的开始地址是0x7fff7ce80078, 所在chunk(HeapList)的基础地址是0x7fff7ce80000, 则偏移值是120
        • Nibble的值是((120 % 32) / 4) + 1 = 7
        • Nibble存放在第120 / 32 / 8 = 0个DWORD中的第120 / 32 = 3个Nibble
        • 也就是DWORD的值会&= 0xfff0ffff然后|= 0x00070000
        • Nibble Map会可以根据当前PC查找函数的开始地址和对应的函数头, 对于调试和GC都是必要的信息
  • 枚举IG(insGroup)列表
    • 记录IG开始时有哪些GC引用(对象或者struct的指针)在栈和寄存器上, 添加到gcInfo的列表中
    • 枚举IG中的指令(instrDesc)
      • 调用emitIssue1Instr编码指令
        • 调用emitOutputInstr(x86/x64版本)
          • 判断指令的类型并写入指令, 指令的类型有
            • 无参数的指令, 例如nop
            • 带一个常量的指令, 例如jge, loop, ret
            • 带跳转目标(label)的指令, 例如jmp
            • 带函数或者函数指针的指令, 例如call
            • 带单个寄存器的指令, 例如inc, dec
            • 带两个寄存器的指令, 例如mov
            • 第一个参数是寄存器, 第二个参数是内存的指令, 例如mov
            • 更多的处理可以参考我的JIT笔记
      • 写入指令的同时会更新gcInfo的列表
        • 例如从函数地址+x开始寄存器rax中包含GC引用, 从函数地址+x1开始寄存器rax不包含GC引用等

这个阶段完成了对函数中机器代码的写入, 接下来就是最后一个阶段.

PHASE_EMIT_GCEH

这个阶段负责写入函数相关的信息, 也就是上面"真函数头"中的信息.
"真函数头"的类型是_hpRealCodeHdr, 包含以下的信息:

  • phdrDebugInfo: PC到IL offset的索引
  • phdrJitEHInfo: EH Clause的数组
  • phdrJitGCInfo: GC扫描栈和寄存器使用的信息
  • phdrMDesc: 函数的MethodDesc
  • nUnwindInfos: unwindInfos的数量
  • unindInfos: unwind信息(栈回滚信息)

DebugInfo

phdrDebugInfo是一个DWORD的数组, 格式是Nibble Stream, 以4 bit为单位保存数字.
例如 0xa9 0xa0 0x03 代表 80, 19 两个数字:

  1. 0xa9 = 0b1010'1001 (最高位的1代表还需要继续读取下一个nibble)
  2. 0xa0 = 0b1010'0000 (最高位的0表示当前数字已结束)
  3. 0x03 = 0b0000'0011
  4. 001 010 000 => 80
  5. 010 011 => 19

数字列表的结构是:

  • header, 包含两个数字, 第一个是offset mapping编码后的长度(bytes), 第二个是native vars编码后的长度(bytes)
  • offset mapping
    • offset mapping 的数量
    • native offset, 写入与前一条记录的偏移值
    • il offset
    • source 标记(flags), 有SOURCE_TYPE_INVALID, SEQUENCE_POINT, STACK_EMPTY等
  • native vars (内部变量所在的scope的信息)
    • native vars 的数量
    • startOffset scope的开始偏移值
    • endOffset scope的结束偏移值, 写入距离start的delta
    • var number 变量的序号
    • var type (reg还是stack)
    • 后面的信息根据var type而定, 具体参考DoNativeVarInfo

IDE可以根据DebugInfo知道下断点的时候应该把断点设在哪个内存地址, 步过的时候应该在哪个内存地址停下来等.

EHInfo

phdrJitEHInfo是指向CorILMethod_Sect_FatFormat结构体的指针, 包含了EH Clause的数量和EE_ILEXCEPTION_CLAUSE的数组.

使用以下的C#代码:

  1. var x = GetString();
  2. try {
  3.     Console.WriteLine(x);
  4.     throw new Exception("abc");
  5. } catch (Exception ex) {
  6.     Console.WriteLine(ex);
  7.     Console.WriteLine(x);
  8. }

可以生成以下的汇编代码:

  1. IN0016: 000000 push     rbp
  2. IN0017: 000001 push     rbx
  3. IN0018: 000002 sub      rsp, 24
  4. IN0019: 000006 lea      rbp, [rsp+20H]
  5. IN001a: 00000B mov      qword ptr [V06 rbp-20H], rsp
  6. G_M21556_IG02:        ; offs=00000FH, size=0009H, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, byref
  7. IN0001: 00000F call     ConsoleApplication.Program:GetString():ref
  8. IN0002: 000014 mov      gword ptr [V01 rbp-10H], rax
  9. G_M21556_IG03:        ; offs=000018H, size=0043H, gcVars=0000000000000001 {V01}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, gcvars, byref
  10. IN0003: 000018 mov      rdi, gword ptr [V01 rbp-10H]
  11. IN0004: 00001C call     System.Console:WriteLine(ref)
  12. IN0005: 000021 mov      rdi, 0x7F78892D3CE8
  13. IN0006: 00002B call     CORINFO_HELP_NEWSFAST
  14. IN0007: 000030 mov      rbx, rax
  15. IN0008: 000033 mov      edi, 1
  16. IN0009: 000038 mov      rsi, 0x7F78881BCE70
  17. IN000a: 000042 call     CORINFO_HELP_STRCNS
  18. IN000b: 000047 mov      rsi, rax
  19. IN000c: 00004A mov      rdi, rbx
  20. IN000d: 00004D call     System.Exception:.ctor(ref):this
  21. IN000e: 000052 mov      rdi, rbx
  22. IN000f: 000055 call     CORINFO_HELP_THROW
  23. IN0010: 00005A int3     
  24. G_M21556_IG04:        ; offs=00005BH, size=0007H, gcVars=0000000000000000 {}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, gcvars, byref, epilog, nogc
  25. IN001b: 00005B lea      rsp, [rbp-08H]
  26. IN001c: 00005F pop      rbx
  27. IN001d: 000060 pop      rbp
  28. IN001e: 000061 ret      
  29. G_M21556_IG05:        ; func=01, offs=000062H, size=000EH, gcrefRegs=00000040 {rsi}, byrefRegs=00000000 {}, byref, funclet prolog, nogc
  30. IN001f: 000062 push     rbp
  31. IN0020: 000063 push     rbx
  32. IN0021: 000064 push     rax
  33. IN0022: 000065 mov      rbp, qword ptr [rdi]
  34. IN0023: 000068 mov      qword ptr [rsp], rbp
  35. IN0024: 00006C lea      rbp, [rbp+20H]
  36. G_M21556_IG06:        ; offs=000070H, size=0018H, gcVars=0000000000000001 {V01}, gcrefRegs=00000040 {rsi}, byrefRegs=00000000 {}, gcvars, byref, isz
  37. IN0011: 000070 mov      rdi, rsi
  38. IN0012: 000073 call     System.Console:WriteLine(ref)
  39. IN0013: 000078 mov      rdi, gword ptr [V01 rbp-10H]
  40. IN0014: 00007C call     System.Console:WriteLine(ref)
  41. IN0015: 000081 lea      rax, G_M21556_IG04
  42. G_M21556_IG07:        ; offs=000088H, size=0007H, funclet epilog, nogc, emitadd
  43. IN0025: 000088 add      rsp, 8
  44. IN0026: 00008C pop      rbx
  45. IN0027: 00008D pop      rbp
  46. IN0028: 00008E ret

用lldb来分析这个函数的EHInfo可以得到:

  1. (lldb) p *codePtr
  2. (void *) $1 = 0x00007fff7ceef920
  3. (lldb) p *(CodeHeader*)(0x00007fff7ceef920-8)
  4. (CodeHeader) $2 = {
  5.   pRealCodeHeader = 0x00007fff7cf35c78
  6. }
  7. (lldb) p *(_hpRealCodeHdr*)(0x00007fff7cf35c78)
  8. (_hpRealCodeHdr) $3 = {
  9.   phdrDebugInfo = 0x0000000000000000
  10.   phdrJitEHInfo = 0x00007fff7cf35ce0
  11.   phdrJitGCInfo = 0x0000000000000000
  12.   phdrMDesc = 0x00007fff7baf9200
  13.   nUnwindInfos = 2
  14.   unwindInfos = {}
  15. }
  16. (lldb) me re -s8 -c20 -fx 0x00007fff7cf35ce0-8
  17. 0x7fff7cf35cd8: 0x0000000000000001 0x0000000000002040
  18. 0x7fff7cf35ce8: 0x0000001800000000 0x000000620000005b
  19. 0x7fff7cf35cf8: 0x000000000000008f 0x000000000100000e
  20. 0x7fff7cf35d08: 0x0000000000000030 0x0000000000000001
  21. 0x7fff7cf35d18: 0x00007ffff628f550 0x0000000000000b4a
  22. 0x7fff7cf35d28: 0x0000000000000000 0x0000000000000000
  23. 0x7fff7cf35d38: 0x0000000000000000 0x0000000000000000
  24. 0x7fff7cf35d48: 0x0000000000000000 0x0000000000000000
  25. 0x7fff7cf35d58: 0x0000000000000000 0x0000000000000000
  26. 0x7fff7cf35d68: 0x0000000000000000 0x0000000000000000
  27.  
  28. 0x0000000000000001:
  29. phdrJitEHInfo - sizeof(size_t) is num clauses, here is 1
  30.  
  31. 0x0000000000002040:
  32. memeber from base class IMAGE_COR_ILMETHOD_SECT_FAT
  33. Kind = 0x40 = CorILMethod_Sect_FatFormat
  34. DataSize = 0x20 = 32 = 1 * sizeof(EE_ILEXCEPTION_CLAUSE)
  35.  
  36. (lldb) p ((EE_ILEXCEPTION_CLAUSE*)(0x00007fff7cf35ce0+8))[0]
  37. (EE_ILEXCEPTION_CLAUSE) $29 = {
  38.   Flags = COR_ILEXCEPTION_CLAUSE_NONE
  39.   TryStartPC = 24
  40.   TryEndPC = 91
  41.   HandlerStartPC = 98
  42.   HandlerEndPC = 143
  43.    = (TypeHandle = 0x000000000100000e, ClassToken = 16777230, FilterOffset = 16777230)
  44. }
  45.  
  46. (lldb) sos Token2EE * 0x000000000100000e
  47. Module:      00007fff7bc04000
  48. Assembly:    System.Private.CoreLib.ni.dll
  49. <invalid module token>
  50. --------------------------------------
  51. Module:      00007fff7baf6e70
  52. Assembly:    coreapp_jit.dll
  53. Token:       000000000100000E
  54. MethodTable: 00007fff7cc0dce8
  55. EEClass:     00007fff7bcb9400
  56. Name:         mdToken: 0100000e (/home/ubuntu/git/coreapp_jitnew/bin/Release/netcoreapp1.1/ubuntu.16.04-x64/publish/coreapp_jit.dll)
  57.  
  58. (lldb) dumpmt 00007fff7cc0dce8
  59. EEClass:         00007FFF7BCB9400
  60. Module:          00007FFF7BC04000
  61. Name:            System.Exception
  62. mdToken:         0000000002000249
  63. File:            /home/ubuntu/git/coreapp_jitnew/bin/Release/netcoreapp1.1/ubuntu.16.04-x64/publish/System.Private.CoreLib.ni.dll
  64. BaseSize:        0x98
  65. ComponentSize:   0x0
  66. Slots in VTable: 51
  67. Number of IFaces in IFaceMap: 2

可以看到EE_ILEXCEPTION_CLAUSE包含了try开始和结束的PC地址, handler开始和结束的PC地址, 和指向捕捉例外类型(或者filter函数)的指针.
CLR可以根据EHInfo知道例外抛出时应该调用哪个catch和finally.

GCInfo

phdrJitGCInfo是一个bit数组, 它的编码非常复杂, 这里我给出一个实际解析GCInfo的例子.

C#代码和汇编代码和上面的EHInfo一样, 使用LLDB分析可以得到:

  1. (lldb) p *codePtr
  2. (void *) $1 = 0x00007fff7cee3920
  3. (lldb) p *(CodeHeader*)(0x00007fff7cee3920-8)
  4. (CodeHeader) $2 = {
  5.   pRealCodeHeader = 0x00007fff7cf29c78
  6. }
  7. (lldb) p *(_hpRealCodeHdr*)(0x00007fff7cf29c78)
  8. (_hpRealCodeHdr) $3 = {
  9.   phdrDebugInfo = 0x0000000000000000
  10.   phdrJitEHInfo = 0x00007fff7cf29ce0
  11.   phdrJitGCInfo = 0x00007fff7cf29d28 "\x91\x81G"
  12.   phdrMDesc = 0x00007fff7baed200
  13.   nUnwindInfos = 2
  14.   unwindInfos = {}
  15. }
  16. (lldb) me re -s8 -c20 -fx 0x00007fff7cf29d28
  17. 0x7fff7cf29d28: 0x1963d80000478191 0x171f412003325ca8
  18. 0x7fff7cf29d38: 0xee92864c5ffe0280 0x1c5c1c1f09bea536
  19. 0x7fff7cf29d48: 0xed8a93e5c6872932 0x00000000000000c4
  20. 0x7fff7cf29d58: 0x000000000000002a 0x0000000000000001
  21. 0x7fff7cf29d68: 0x00007ffff628f550 0x0000000000000b2e
  22. 0x7fff7cf29d78: 0x0000000000000000 0x0000000000000000
  23. 0x7fff7cf29d88: 0x0000000000000000 0x0000000000000000
  24. 0x7fff7cf29d98: 0x0000000000000000 0x0000000000000000
  25. 0x7fff7cf29da8: 0x0000000000000000 0x0000000000000000
  26. 0x7fff7cf29db8: 0x0000000000000000 0x0000000000000000

对bit数组的解析如下:

  1. 10001001
  2. 1: use fat encoding
  3. 0: no var arg
  4. 0: no security object
  5. 0: no gc cookie
  6. 1: have pspsym stack slot
  7. 0 0: no generic context parameter
  8. 1: have stack base register
  9.  
  10. 1000000
  11. 1: wants report only leaf
  12. 0: no edit and continue preserved area
  13. 0: no reverse pinvoke frame
  14. 0 0 0 0: return kind is RT_Scalar
  15.  
  16. 1'11100010
  17. 0 10001111: code length is 143
  19. 0000000
  20. 0 000000: pspsym stack slot is 0
  22. 0'0000000
  23. 0 000: stack base register is rbp (rbp is 5, normalize function will ^5 so it's 0)
  24. 0 000: size of stack outgoing and scratch area is 0
  26. 0'000110
  27. 0 00: 0 call sites
  28. 1 0 0 1: 2 interruptible ranges
  29.  
  30. 11'11000
  31. 0 001111: interruptible range 1 begins from 15
  33. 110'10011000'000
  34. 1 001011 0 000001: interruptible range 1 finished at 91 (15 + 75 + 1)
  36. 10101'00
  37. 0 010101: interruptible range 2 begins from 112 (91 + 21)
  38.  
  39. 111010'01001100
  40. 0 010111: interruptible range 2 finished at 136 (112 + 23 + 1)
  41. 1: have register slots
  42. 1 00 0 01: 4 register slots
  44. 110000
  45. 1: have stack slots
  46. 0 01: 1 tracked stack slots
  47. 0 0: 0 untracked stack slots
  49. 00'0000010
  50. 0 000: register slot 1 is rax(0)
  51. 00: register slot 1 flag is GC_SLOT_IS_REGISTER(8 & 0b11 = 0)
  52. 0 10: register slot 2 is rbx(3) (0 + 2 + 1)
  53.  
  54. 0'10000
  55. 0 10: register slot 3 is rsi(6) (3 + 2 + 1)
  56. 0 00: register slot 4 is rdi(7) (6 + 0 + 1)
  58. 010'11111000
  59. 01: stack slot 1 base on GC_FRAMEREG_REL(2)
  60. 0 111110: stack slot 1 offset is -16 (-16 / 8 = -2)
  61. 00: stack slot 1 flag is GC_SLOT_BASE(0)
  62.  
  63. 111 01000
  64. 111: num bits per pointer is 7
  65.  
  66. 00000001
  67. 0 0000001: chunk 0's bit offset is 0 (1-1)
  69. 01000000: chunk 1's bit offset is 63 (64-1)
  70.  
  71. 011111
  72. 011111: chunk 0 could be live slot list, simple format, all could live
  73.  
  74. 11'111
  75. 11111: chunk 0 final state, all slot lives
  77. 1 1010'00
  78. 1 000101: transition of register slot 1(rax) at 0x14 (20 = 15 + 5), becomes live
  79.  
  80. 110010'01100001
  81. 1 001001: transition of register slot 1(rax) at 0x18 (24 = 15 + 9), becomes dead
  82. 1 100001: transition of register slot 1(rax) at 0x30 (48 = 15 + 33), becomes live
  84. 01001001
  85. 0: terminator, no more transition of register slot 1(rax) in this chunk
  86. 1 100100: transition of register slot 2(rbx) at 0x33 (51 = 15 + 36), becomes live
  88. 01110111
  89. 0: terminator, no more transition of register slot 2(rbx) in this chunk
  90. 1 111110: transition of register slot 3(rsi) at 0x4d (77 = 15 + 62), becomes live
  92. 01101100
  93. 0: terminator, no more transition of register slot 3(rsi) in this chunk
  94. 1 001101: transition of register slot 4(rdi) at 0x1c (28 = 15 + 13), becomes live
  96. 1010010
  97. 1 010010: transition of register slot 4(rdi) at 0x21 (33 = 15 + 18), becomes dead
  99. 1'0111110
  100. 1 111110: transition of register slot 4(rdi) at 0x4d (77 = 15 + 62), becomes live
  101. 0: terminator, no more transition of register slot 4(rdi) in this chunk
  102.  
  103. 1'1001000
  104. 1 001001: transition of stack slot 1(rbp-16) at 0x18 (24 = 15 + 9), becomes live
  105. 0: terminator, no more transition of stack slot 1(rbp-16) in this chunk
  107. 0'11111
  108. 0 11111: chunk 1 could be live slot list, simple format, all could live
  109.  
  110. 000'00
  111. 00000: chunk 1 final state, all slot dead
  113. 111000'00
  114. 1 000011: transition of register slot 1(rax) at 0x52 (15 + 64 + 3), becomes dead
  115. 0: terminator, no more transition of register slot 1(rax) in this chunk
  116.  
  117. 111010'00
  118. 1: 001011: transition of register slot 2(rbx) at 0x5a (15 + 64 + 11), becomes dead
  119. 0: terminator, no more transition of register slot 2(rbx) in this chunk
  121. 111000'01001100
  122. 1 000011: transition of register slot 3(rsi) at 0x52 (15 + 64 + 3), becomes dead
  123. 1 001100: transition of register slot 3(rsi) at 0x70 (0x70 + (64+12 - (0x5b-0xf))), becomes live
  124.  
  125. 10010100
  126. 1 010100: transition of register slot 3(rsi) at 0x78 (0x70 + (64+20 - (0x5b-0xf))), becomes dead
  127. 0: terminator, no more transition of register slot 3(rsi) in this chunk
  128.  
  129. 1110000
  130. 1: 000011: transition of register slot 4(rdi) at 0x52 (15 + 64 + 3), becomes dead
  131.  
  132. 1'011000
  133. 1 000110: transition of register slot 4(rdi) at 0x55 (15 + 64 + 6), becomes live
  135. 11'10100
  136. 1 001011: transition of register slot 4(rdi) at 0x5a (15 + 64 + 11), becomes dead
  137.  
  138. 111'1100
  139. 1: 001111: transition of register slot 4(rdi) at 0x73 (0x70 + (64+15 - (0x5b-0xf))), becomes live
  141. 1001'010
  142. 1 010100: transition of register slot 4(rdi) at 0x78 (0x70 + (64+20 - (0x5b-0xf))), becomes dead
  143.  
  144. 10001'10
  145. 1 011000: transition of register slot 4(rdi) at 0x7c (0x70 + (64+24 - (0x5b-0xf))), becomes live
  147. 110111'00
  148. 1 011101: transition of register slot 4(rdi) at 0x81 (0x70 + (64+29 - (0x5b-0xf))), becomes dead
  149. 0: terminator, no more transition of register slot 4(rdi) in this chunk
  150.  
  151. 100011'00
  152. 1 011000: transition of stack slot 1(rbp-16) at 0x7c (0x70 + (64+24 - (0x5b-0xf))), becomes dead
  153. 0: terminator, no more transition of stack slot 1(rbp-16) in this chunk

CLR在执行GC的时候, 会停止线程并得到当前停止的PC地址,
然后根据PC地址和Nibble Map获取到函数头,
再根据函数头中的GCInfo就可以获取到当前执行函数中有哪些栈地址和寄存器包含了根对象.

因为GCInfo记录了函数运行过程(可中断的部分)中的所有GC引用的位置和生命周期,
CoreCLR中需要使用这样复杂的编码来减少它的大小.

UnwindInfo

unwindInfos是一个长度为nUnwindInfos的数组, 类型是RUNTIME_FUNCTION.
nUnwindInfos的值等于主函数 + 小函数(funclet)的数量.
RUNTIME_FUNCTION中又保存了指向UNWIND_INFO的偏移值, UNWIND_INFO保存了函数对栈指针的操作.

这里我也给出一个实际分析的例子, 使用以下的C#代码:

  1. var x = GetString();
  2. try {
  3.     Console.WriteLine(x);
  4.     throw new Exception("abc");
  5. } catch (Exception ex) {
  6.     Console.WriteLine(ex);
  7.     Console.WriteLine(x);
  8. } finally {
  9.     Console.WriteLine("finally");
  10. }

可以生成以下的汇编代码:

  1. G_M21556_IG01:        ; func=00, offs=000000H, size=000FH, gcVars=0000000000000000 {}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, gcvars, byref, nogc <-- Prolog IG
  2.  
  3. IN001e: 000000 push     rbp
  4. IN001f: 000001 push     rbx
  5. IN0020: 000002 sub      rsp, 24
  6. IN0021: 000006 lea      rbp, [rsp+20H]
  7. IN0022: 00000B mov      qword ptr [V06 rbp-20H], rsp
  8.  
  9. G_M21556_IG02:        ; offs=00000FH, size=0009H, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, byref
  10.  
  11. IN0001: 00000F call     ConsoleApplication.Program:GetString():ref
  12. IN0002: 000014 mov      gword ptr [V01 rbp-10H], rax
  13.  
  14. G_M21556_IG03:        ; offs=000018H, size=0043H, gcVars=0000000000000001 {V01}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, gcvars, byref
  15.  
  16. IN0003: 000018 mov      rdi, gword ptr [V01 rbp-10H]
  17. IN0004: 00001C call     System.Console:WriteLine(ref)
  18. IN0005: 000021 mov      rdi, 0x7F94DDF9CCE8
  19. IN0006: 00002B call     CORINFO_HELP_NEWSFAST
  20. IN0007: 000030 mov      rbx, rax
  21. IN0008: 000033 mov      edi, 1
  22. IN0009: 000038 mov      rsi, 0x7F94DCE85E70
  23. IN000a: 000042 call     CORINFO_HELP_STRCNS
  24. IN000b: 000047 mov      rsi, rax
  25. IN000c: 00004A mov      rdi, rbx
  26. IN000d: 00004D call     System.Exception:.ctor(ref):this
  27. IN000e: 000052 mov      rdi, rbx
  28. IN000f: 000055 call     CORINFO_HELP_THROW
  29. IN0010: 00005A int3     
  30.  
  31. G_M21556_IG04:        ; offs=00005BH, size=0001H, gcVars=0000000000000000 {}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, gcvars, byref
  32.  
  33. IN0011: 00005B nop      
  34.  
  35. G_M21556_IG05:        ; offs=00005CH, size=0008H, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, byref
  36.  
  37. IN0012: 00005C mov      rdi, rsp
  38. IN0013: 00005F call     G_M21556_IG11
  39.  
  40. G_M21556_IG06:        ; offs=000064H, size=0001H, nogc, emitadd
  41.  
  42. IN0014: 000064 nop      
  43.  
  44. G_M21556_IG07:        ; offs=000065H, size=0007H, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, byref, epilog, nogc
  45.  
  46. IN0023: 000065 lea      rsp, [rbp-08H]
  47. IN0024: 000069 pop      rbx
  48. IN0025: 00006A pop      rbp
  49. IN0026: 00006B ret      
  50.  
  51. G_M21556_IG08:        ; func=01, offs=00006CH, size=000EH, gcVars=0000000000000001 {V01}, gcrefRegs=00000040 {rsi}, byrefRegs=00000000 {}, gcvars, byref, funclet prolog, nogc
  52.  
  53. IN0027: 00006C push     rbp
  54. IN0028: 00006D push     rbx
  55. IN0029: 00006E push     rax
  56. IN002a: 00006F mov      rbp, qword ptr [rdi]
  57. IN002b: 000072 mov      qword ptr [rsp], rbp
  58. IN002c: 000076 lea      rbp, [rbp+20H]
  59.  
  60. G_M21556_IG09:        ; offs=00007AH, size=0018H, gcVars=0000000000000001 {V01}, gcrefRegs=00000040 {rsi}, byrefRegs=00000000 {}, gcvars, byref, isz
  61.  
  62. IN0015: 00007A mov      rdi, rsi
  63. IN0016: 00007D call     System.Console:WriteLine(ref)
  64. IN0017: 000082 mov      rdi, gword ptr [V01 rbp-10H]
  65. IN0018: 000086 call     System.Console:WriteLine(ref)
  66. IN0019: 00008B lea      rax, G_M21556_IG04
  67.  
  68. G_M21556_IG10:        ; offs=000092H, size=0007H, funclet epilog, nogc, emitadd
  69.  
  70. IN002d: 000092 add      rsp, 8
  71. IN002e: 000096 pop      rbx
  72. IN002f: 000097 pop      rbp
  73. IN0030: 000098 ret      
  74.  
  75. G_M21556_IG11:        ; func=02, offs=000099H, size=000EH, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, byref, funclet prolog, nogc
  76.  
  77. IN0031: 000099 push     rbp
  78. IN0032: 00009A push     rbx
  79. IN0033: 00009B push     rax
  80. IN0034: 00009C mov      rbp, qword ptr [rdi]
  81. IN0035: 00009F mov      qword ptr [rsp], rbp
  82. IN0036: 0000A3 lea      rbp, [rbp+20H]
  83.  
  84. G_M21556_IG12:        ; offs=0000A7H, size=0013H, gcVars=0000000000000000 {}, gcrefRegs=00000000 {}, byrefRegs=00000000 {}, gcvars, byref
  85.  
  86. IN001a: 0000A7 mov      rdi, 0x7F94C8001068
  87. IN001b: 0000B1 mov      rdi, gword ptr [rdi]
  88. IN001c: 0000B4 call     System.Console:WriteLine(ref)
  89. IN001d: 0000B9 nop      
  90.  
  91. G_M21556_IG13:        ; offs=0000BAH, size=0007H, funclet epilog, nogc, emitadd
  92.  
  93. IN0037: 0000BA add      rsp, 8
  94. IN0038: 0000BE pop      rbx
  95. IN0039: 0000BF pop      rbp
  96. IN003a: 0000C0 ret

使用LLDB分析可以得到:

  1. (lldb) p *codePtr
  2. (void *) $0 = 0x00007fff7ceee920
  3. (lldb) p *(CodeHeader*)(0x00007fff7ceee920-8)
  4. (CodeHeader) $1 = {
  5.   pRealCodeHeader = 0x00007fff7cf34c78
  6. }
  7. (lldb) p *(_hpRealCodeHdr*)(0x00007fff7cf34c78)
  8. (_hpRealCodeHdr) $2 = {
  9.   phdrDebugInfo = 0x0000000000000000
  10.   phdrJitEHInfo = 0x0000000000000000
  11.   phdrJitGCInfo = 0x0000000000000000
  12.   phdrMDesc = 0x00007fff7baf8200
  13.   nUnwindInfos = 3
  14.   unwindInfos = {}
  15. }
  16. (lldb) p ((_hpRealCodeHdr*)(0x00007fff7cf34c78))->unwindInfos[0]
  17. (RUNTIME_FUNCTION) $3 = (BeginAddress = 2304, EndAddress = 2412, UnwindData = 2500)
  18. (lldb) p ((_hpRealCodeHdr*)(0x00007fff7cf34c78))->unwindInfos[1]
  19. (RUNTIME_FUNCTION) $4 = (BeginAddress = 2412, EndAddress = 2457, UnwindData = 2516)
  20. (lldb) p ((_hpRealCodeHdr*)(0x00007fff7cf34c78))->unwindInfos[2]
  21. (RUNTIME_FUNCTION) $5 = (BeginAddress = 2457, EndAddress = 2497, UnwindData = 2532)
  22.  
  23. first unwind info:
  24. (lldb) p (void*)(((CEEJitInfo*)compiler->info.compCompHnd)->m_moduleBase + 2304) 
  25. (void *) $13 = 0x00007fff7ceee920
  26. (lldb) p (void*)(((CEEJitInfo*)compiler->info.compCompHnd)->m_moduleBase + 2412) 
  27. (void *) $14 = 0x00007fff7ceee98c
  28. # range is [0, 0x6c)
  29. (lldb) p *(UNWIND_INFO*)(((CEEJitInfo*)compiler->info.compCompHnd)->m_moduleBase + 2500)
  30. (UNWIND_INFO) $16 = {
  31.   Version = '\x01'
  32.   Flags = '\x03'
  33.   SizeOfProlog = '\x06'
  34.   CountOfUnwindCodes = '\x03'
  35.   FrameRegister = '\0'
  36.   FrameOffset = '\0'
  37.   UnwindCode = {
  38.     [0] = {
  39.        = (CodeOffset = '\x06', UnwindOp = '\x02', OpInfo = '\x02')
  40.       EpilogueCode = (OffsetLow = '\x06', UnwindOp = '\x02', OffsetHigh = '\x02')
  41.       FrameOffset = 8710
  42.     }
  43.   }
  44. }
  45. (lldb) p ((UNWIND_INFO*)(((CEEJitInfo*)compiler->info.compCompHnd)->m_moduleBase + 2500))->UnwindCode[0]
  46. (UNWIND_CODE) $17 = {
  47.    = (CodeOffset = '\x06', UnwindOp = '\x02', OpInfo = '\x02')
  48.   EpilogueCode = (OffsetLow = '\x06', UnwindOp = '\x02', OffsetHigh = '\x02')
  49.   FrameOffset = 8710
  50. }
  51. (lldb) p ((UNWIND_INFO*)(((CEEJitInfo*)compiler->info.compCompHnd)->m_moduleBase + 2500))->UnwindCode[1]
  52. (UNWIND_CODE) $18 = {
  53.    = (CodeOffset = '\x02', UnwindOp = '\0', OpInfo = '\x03')
  54.   EpilogueCode = (OffsetLow = '\x02', UnwindOp = '\0', OffsetHigh = '\x03')
  55.   FrameOffset = 12290
  56. }
  57. (lldb) p ((UNWIND_INFO*)(((CEEJitInfo*)compiler->info.compCompHnd)->m_moduleBase + 2500))->UnwindCode[2]
  58. (UNWIND_CODE) $19 = {
  59.    = (CodeOffset = '\x01', UnwindOp = '\0', OpInfo = '\x05')
  60.   EpilogueCode = (OffsetLow = '\x01', UnwindOp = '\0', OffsetHigh = '\x05')
  61.   FrameOffset = 20481
  62. }

上面的UNWIND_CODE可能有点难懂, 可以结合COMPlus_JitDump输出的信息分析:

  1. Unwind Info:
  2.   >> Start offset   : 0x000000 (not in unwind data)
  3.   >>   End offset   : 0x00006c (not in unwind data)
  4.   Version           : 1
  5.   Flags             : 0x00
  6.   SizeOfProlog      : 0x06
  7.   CountOfUnwindCodes: 3
  8.   FrameRegister     : none (0)
  9.   FrameOffset       : N/A (no FrameRegister) (Value=0)
  10.   UnwindCodes       :
  11.     CodeOffset: 0x06 UnwindOp: UWOP_ALLOC_SMALL (2)     OpInfo: 2 * 8 + 8 = 24 = 0x18
  12.     CodeOffset: 0x02 UnwindOp: UWOP_PUSH_NONVOL (0)     OpInfo: rbx (3)
  13.     CodeOffset: 0x01 UnwindOp: UWOP_PUSH_NONVOL (0)     OpInfo: rbp (5)
  14. allocUnwindInfo(pHotCode=0x00007F94DE27E920, pColdCode=0x0000000000000000, startOffset=0x0, endOffset=0x6c, unwindSize=0xa, pUnwindBlock=0x0000000002029516, funKind=0 (main function))
  15. Unwind Info:
  16.   >> Start offset   : 0x00006c (not in unwind data)
  17.   >>   End offset   : 0x000099 (not in unwind data)
  18.   Version           : 1
  19.   Flags             : 0x00
  20.   SizeOfProlog      : 0x03
  21.   CountOfUnwindCodes: 3
  22.   FrameRegister     : none (0)
  23.   FrameOffset       : N/A (no FrameRegister) (Value=0)
  24.   UnwindCodes       :
  25.     CodeOffset: 0x03 UnwindOp: UWOP_ALLOC_SMALL (2)     OpInfo: 0 * 8 + 8 = 8 = 0x08
  26.     CodeOffset: 0x02 UnwindOp: UWOP_PUSH_NONVOL (0)     OpInfo: rbx (3)
  27.     CodeOffset: 0x01 UnwindOp: UWOP_PUSH_NONVOL (0)     OpInfo: rbp (5)
  28. allocUnwindInfo(pHotCode=0x00007F94DE27E920, pColdCode=0x0000000000000000, startOffset=0x6c, endOffset=0x99, unwindSize=0xa, pUnwindBlock=0x0000000002029756, funKind=1 (handler))
  29. Unwind Info:
  30.   >> Start offset   : 0x000099 (not in unwind data)
  31.   >>   End offset   : 0x0000c1 (not in unwind data)
  32.   Version           : 1
  33.   Flags             : 0x00
  34.   SizeOfProlog      : 0x03
  35.   CountOfUnwindCodes: 3
  36.   FrameRegister     : none (0)
  37.   FrameOffset       : N/A (no FrameRegister) (Value=0)
  38.   UnwindCodes       :
  39.     CodeOffset: 0x03 UnwindOp: UWOP_ALLOC_SMALL (2)     OpInfo: 0 * 8 + 8 = 8 = 0x08
  40.     CodeOffset: 0x02 UnwindOp: UWOP_PUSH_NONVOL (0)     OpInfo: rbx (3)
  41.     CodeOffset: 0x01 UnwindOp: UWOP_PUSH_NONVOL (0)     OpInfo: rbp (5)

以第一个RUNTIME_FUNCTION(主函数)为例, 它包含了3个UnwindCode, 分别记录了

  1. push rbp
  2. push rbx
  3. sub rsp, 24

CLR查找调用链的时候, 例如A => B => C需要知道C的调用者,
可以根据当前PC获取当前Frame的顶部 => 获取Return Address => 根据Return Address获取上一个Frame的顶部 => 循环得到所有调用者.
这个流程也叫Stack Walking(或Stack Crawling).

GC查找根对象时也需要根据Unwind信息查找调用链中的所有函数.

参考链接

https://github.com/dotnet/coreclr/blob/master/Documentation/botr/ryujit-tutorial.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/botr/ryujit-overview.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/botr/porting-ryujit.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/building/viewing-jit-dumps.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/project-docs/clr-configuration-knobs.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/building/debugging-instructions.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/botr/clr-abi.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/design-docs/finally-optimizations.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/design-docs/jit-call-morphing.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/botr/type-system.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/botr/type-loader.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/botr/method-descriptor.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/botr/virtual-stub-dispatch.md
https://github.com/dotnet/coreclr/blob/release/1.1.0/Documentation/design-docs/jit-call-morphing.md
https://msdn.microsoft.com/en-us/library/system.reflection.emit.opcodes(v=vs.110).aspx
https://www.microsoft.com/en-us/research/wp-content/uploads/2001/01/designandimplementationofgenerics.pdf
https://www.cs.rice.edu/~keith/EMBED/dom.pdf
https://www.usenix.org/legacy/events/vee05/full_papers/p132-wimmer.pdf
http://aakinshin.net/ru/blog/dotnet/typehandle/
https://en.wikipedia.org/wiki/List_of_CIL_instructions
http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.arn0008c/index.html
http://wiki.osdev.org/X86-64_Instruction_Encoding
https://github.com/dotnet/coreclr/issues/12383
https://github.com/dotnet/coreclr/issues/14414
http://ref.x86asm.net/
https://www.onlinedisassembler.com/odaweb/

写在最后

这篇文章对CoreCLR中JIT的整个流程做出了更详细的分析,
但因为JIT中的代码实在太多, 我无法像分析GC的时候一样把代码全部贴出来, 有很多细节也无法顾及.
如果你对某个点有疑问, 可以试着参考我的JIT笔记, 也欢迎在文章下面留言你的问题.

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/从前慢现在也慢/article/detail/100704
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号