1 //=== WebAssemblyLowerEmscriptenEHSjLj.cpp - Lower exceptions for Emscripten =//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 ///
9 /// \file
10 /// This file lowers exception-related instructions and setjmp/longjmp function
11 /// calls to use Emscripten's library functions. The pass uses JavaScript's try
12 /// and catch mechanism in case of Emscripten EH/SjLj and Wasm EH intrinsics in
13 /// case of Emscripten SjLJ.
14 ///
15 /// * Emscripten exception handling
16 /// This pass lowers invokes and landingpads into library functions in JS glue
17 /// code. Invokes are lowered into function wrappers called invoke wrappers that
18 /// exist in JS side, which wraps the original function call with JS try-catch.
19 /// If an exception occurred, cxa_throw() function in JS side sets some
20 /// variables (see below) so we can check whether an exception occurred from
21 /// wasm code and handle it appropriately.
22 ///
23 /// * Emscripten setjmp-longjmp handling
24 /// This pass lowers setjmp to a reasonably-performant approach for emscripten.
25 /// The idea is that each block with a setjmp is broken up into two parts: the
26 /// part containing setjmp and the part right after the setjmp. The latter part
27 /// is either reached from the setjmp, or later from a longjmp. To handle the
28 /// longjmp, all calls that might longjmp are also called using invoke wrappers
29 /// and thus JS / try-catch. JS longjmp() function also sets some variables so
30 /// we can check / whether a longjmp occurred from wasm code. Each block with a
31 /// function call that might longjmp is also split up after the longjmp call.
32 /// After the longjmp call, we check whether a longjmp occurred, and if it did,
33 /// which setjmp it corresponds to, and jump to the right post-setjmp block.
34 /// We assume setjmp-longjmp handling always run after EH handling, which means
35 /// we don't expect any exception-related instructions when SjLj runs.
36 /// FIXME Currently this scheme does not support indirect call of setjmp,
37 /// because of the limitation of the scheme itself. fastcomp does not support it
38 /// either.
39 ///
40 /// In detail, this pass does following things:
41 ///
42 /// 1) Assumes the existence of global variables: __THREW__, __threwValue
43 /// __THREW__ and __threwValue are defined in compiler-rt in Emscripten.
44 /// These variables are used for both exceptions and setjmp/longjmps.
45 /// __THREW__ indicates whether an exception or a longjmp occurred or not. 0
46 /// means nothing occurred, 1 means an exception occurred, and other numbers
47 /// mean a longjmp occurred. In the case of longjmp, __THREW__ variable
48 /// indicates the corresponding setjmp buffer the longjmp corresponds to.
49 /// __threwValue is 0 for exceptions, and the argument to longjmp in case of
50 /// longjmp.
51 ///
52 /// * Emscripten exception handling
53 ///
54 /// 2) We assume the existence of setThrew and setTempRet0/getTempRet0 functions
55 /// at link time. setThrew exists in Emscripten's compiler-rt:
56 ///
57 /// void setThrew(uintptr_t threw, int value) {
58 /// if (__THREW__ == 0) {
59 /// __THREW__ = threw;
60 /// __threwValue = value;
61 /// }
62 /// }
63 //
64 /// setTempRet0 is called from __cxa_find_matching_catch() in JS glue code.
65 /// In exception handling, getTempRet0 indicates the type of an exception
66 /// caught, and in setjmp/longjmp, it means the second argument to longjmp
67 /// function.
68 ///
69 /// 3) Lower
70 /// invoke @func(arg1, arg2) to label %invoke.cont unwind label %lpad
71 /// into
72 /// __THREW__ = 0;
73 /// call @__invoke_SIG(func, arg1, arg2)
74 /// %__THREW__.val = __THREW__;
75 /// __THREW__ = 0;
76 /// if (%__THREW__.val == 1)
77 /// goto %lpad
78 /// else
79 /// goto %invoke.cont
80 /// SIG is a mangled string generated based on the LLVM IR-level function
81 /// signature. After LLVM IR types are lowered to the target wasm types,
82 /// the names for these wrappers will change based on wasm types as well,
83 /// as in invoke_vi (function takes an int and returns void). The bodies of
84 /// these wrappers will be generated in JS glue code, and inside those
85 /// wrappers we use JS try-catch to generate actual exception effects. It
86 /// also calls the original callee function. An example wrapper in JS code
87 /// would look like this:
88 /// function invoke_vi(index,a1) {
89 /// try {
90 /// Module["dynCall_vi"](index,a1); // This calls original callee
91 /// } catch(e) {
92 /// if (typeof e !== 'number' && e !== 'longjmp') throw e;
93 /// _setThrew(1, 0); // setThrew is called here
94 /// }
95 /// }
96 /// If an exception is thrown, __THREW__ will be set to true in a wrapper,
97 /// so we can jump to the right BB based on this value.
98 ///
99 /// 4) Lower
100 /// %val = landingpad catch c1 catch c2 catch c3 ...
101 /// ... use %val ...
102 /// into
103 /// %fmc = call @__cxa_find_matching_catch_N(c1, c2, c3, ...)
104 /// %val = {%fmc, getTempRet0()}
105 /// ... use %val ...
106 /// Here N is a number calculated based on the number of clauses.
107 /// setTempRet0 is called from __cxa_find_matching_catch() in JS glue code.
108 ///
109 /// 5) Lower
110 /// resume {%a, %b}
111 /// into
112 /// call @__resumeException(%a)
113 /// where __resumeException() is a function in JS glue code.
114 ///
115 /// 6) Lower
116 /// call @llvm.eh.typeid.for(type) (intrinsic)
117 /// into
118 /// call @llvm_eh_typeid_for(type)
119 /// llvm_eh_typeid_for function will be generated in JS glue code.
120 ///
121 /// * Emscripten setjmp / longjmp handling
122 ///
123 /// If there are calls to longjmp()
124 ///
125 /// 1) Lower
126 /// longjmp(env, val)
127 /// into
128 /// emscripten_longjmp(env, val)
129 ///
130 /// If there are calls to setjmp()
131 ///
132 /// 2) In the function entry that calls setjmp, initialize setjmpTable and
133 /// sejmpTableSize as follows:
134 /// setjmpTableSize = 4;
135 /// setjmpTable = (int *) malloc(40);
136 /// setjmpTable[0] = 0;
137 /// setjmpTable and setjmpTableSize are used to call saveSetjmp() function in
138 /// Emscripten compiler-rt.
139 ///
140 /// 3) Lower
141 /// setjmp(env)
142 /// into
143 /// setjmpTable = saveSetjmp(env, label, setjmpTable, setjmpTableSize);
144 /// setjmpTableSize = getTempRet0();
145 /// For each dynamic setjmp call, setjmpTable stores its ID (a number which
146 /// is incrementally assigned from 0) and its label (a unique number that
147 /// represents each callsite of setjmp). When we need more entries in
148 /// setjmpTable, it is reallocated in saveSetjmp() in Emscripten's
149 /// compiler-rt and it will return the new table address, and assign the new
150 /// table size in setTempRet0(). saveSetjmp also stores the setjmp's ID into
151 /// the buffer 'env'. A BB with setjmp is split into two after setjmp call in
152 /// order to make the post-setjmp BB the possible destination of longjmp BB.
153 ///
154 /// 4) Lower every call that might longjmp into
155 /// __THREW__ = 0;
156 /// call @__invoke_SIG(func, arg1, arg2)
157 /// %__THREW__.val = __THREW__;
158 /// __THREW__ = 0;
159 /// %__threwValue.val = __threwValue;
160 /// if (%__THREW__.val != 0 & %__threwValue.val != 0) {
161 /// %label = testSetjmp(mem[%__THREW__.val], setjmpTable,
162 /// setjmpTableSize);
163 /// if (%label == 0)
164 /// emscripten_longjmp(%__THREW__.val, %__threwValue.val);
165 /// setTempRet0(%__threwValue.val);
166 /// } else {
167 /// %label = -1;
168 /// }
169 /// longjmp_result = getTempRet0();
170 /// switch %label {
171 /// label 1: goto post-setjmp BB 1
172 /// label 2: goto post-setjmp BB 2
173 /// ...
174 /// default: goto splitted next BB
175 /// }
176 /// testSetjmp examines setjmpTable to see if there is a matching setjmp
177 /// call. After calling an invoke wrapper, if a longjmp occurred, __THREW__
178 /// will be the address of matching jmp_buf buffer and __threwValue be the
179 /// second argument to longjmp. mem[%__THREW__.val] is a setjmp ID that is
180 /// stored in saveSetjmp. testSetjmp returns a setjmp label, a unique ID to
181 /// each setjmp callsite. Label 0 means this longjmp buffer does not
182 /// correspond to one of the setjmp callsites in this function, so in this
183 /// case we just chain the longjmp to the caller. Label -1 means no longjmp
184 /// occurred. Otherwise we jump to the right post-setjmp BB based on the
185 /// label.
186 ///
187 /// * Wasm setjmp / longjmp handling
188 /// This mode still uses some Emscripten library functions but not JavaScript's
189 /// try-catch mechanism. It instead uses Wasm exception handling intrinsics,
190 /// which will be lowered to exception handling instructions.
191 ///
192 /// If there are calls to longjmp()
193 ///
194 /// 1) Lower
195 /// longjmp(env, val)
196 /// into
197 /// __wasm_longjmp(env, val)
198 ///
199 /// If there are calls to setjmp()
200 ///
201 /// 2) and 3): The same as 2) and 3) in Emscripten SjLj.
202 /// (setjmpTable/setjmpTableSize initialization + setjmp callsite
203 /// transformation)
204 ///
205 /// 4) Create a catchpad with a wasm.catch() intrinsic, which returns the value
206 /// thrown by __wasm_longjmp function. In Emscripten library, we have this
207 /// struct:
208 ///
209 /// struct __WasmLongjmpArgs {
210 /// void *env;
211 /// int val;
212 /// };
213 /// struct __WasmLongjmpArgs __wasm_longjmp_args;
214 ///
215 /// The thrown value here is a pointer to __wasm_longjmp_args struct object. We
216 /// use this struct to transfer two values by throwing a single value. Wasm
217 /// throw and catch instructions are capable of throwing and catching multiple
218 /// values, but it also requires multivalue support that is currently not very
219 /// reliable.
220 /// TODO Switch to throwing and catching two values without using the struct
221 ///
222 /// All longjmpable function calls will be converted to an invoke that will
223 /// unwind to this catchpad in case a longjmp occurs. Within the catchpad, we
224 /// test the thrown values using testSetjmp function as we do for Emscripten
225 /// SjLj. The main difference is, in Emscripten SjLj, we need to transform every
226 /// longjmpable callsite into a sequence of code including testSetjmp() call; in
227 /// Wasm SjLj we do the testing in only one place, in this catchpad.
228 ///
229 /// After testing calling testSetjmp(), if the longjmp does not correspond to
230 /// one of the setjmps within the current function, it rethrows the longjmp
231 /// by calling __wasm_longjmp(). If it corresponds to one of setjmps in the
232 /// function, we jump to the beginning of the function, which contains a switch
233 /// to each post-setjmp BB. Again, in Emscripten SjLj, this switch is added for
234 /// every longjmpable callsite; in Wasm SjLj we do this only once at the top of
235 /// the function. (after setjmpTable/setjmpTableSize initialization)
236 ///
237 /// The below is the pseudocode for what we have described
238 ///
239 /// entry:
240 /// Initialize setjmpTable and setjmpTableSize
241 ///
242 /// setjmp.dispatch:
243 /// switch %label {
244 /// label 1: goto post-setjmp BB 1
245 /// label 2: goto post-setjmp BB 2
246 /// ...
247 /// default: goto splitted next BB
248 /// }
249 /// ...
250 ///
251 /// bb:
252 /// invoke void @foo() ;; foo is a longjmpable function
253 /// to label %next unwind label %catch.dispatch.longjmp
254 /// ...
255 ///
256 /// catch.dispatch.longjmp:
257 /// %0 = catchswitch within none [label %catch.longjmp] unwind to caller
258 ///
259 /// catch.longjmp:
260 /// %longjmp.args = wasm.catch() ;; struct __WasmLongjmpArgs
261 /// %env = load 'env' field from __WasmLongjmpArgs
262 /// %val = load 'val' field from __WasmLongjmpArgs
263 /// %label = testSetjmp(mem[%env], setjmpTable, setjmpTableSize);
264 /// if (%label == 0)
265 /// __wasm_longjmp(%env, %val)
266 /// catchret to %setjmp.dispatch
267 ///
268 ///===----------------------------------------------------------------------===//
269
270 #include "MCTargetDesc/WebAssemblyMCTargetDesc.h"
271 #include "WebAssembly.h"
272 #include "WebAssemblyTargetMachine.h"
273 #include "llvm/ADT/StringExtras.h"
274 #include "llvm/CodeGen/TargetPassConfig.h"
275 #include "llvm/CodeGen/WasmEHFuncInfo.h"
276 #include "llvm/IR/DebugInfoMetadata.h"
277 #include "llvm/IR/Dominators.h"
278 #include "llvm/IR/IRBuilder.h"
279 #include "llvm/IR/IntrinsicsWebAssembly.h"
280 #include "llvm/Support/CommandLine.h"
281 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
282 #include "llvm/Transforms/Utils/Local.h"
283 #include "llvm/Transforms/Utils/SSAUpdater.h"
284 #include "llvm/Transforms/Utils/SSAUpdaterBulk.h"
285 #include <set>
286
287 using namespace llvm;
288
289 #define DEBUG_TYPE "wasm-lower-em-ehsjlj"
290
291 static cl::list<std::string>
292 EHAllowlist("emscripten-cxx-exceptions-allowed",
293 cl::desc("The list of function names in which Emscripten-style "
294 "exception handling is enabled (see emscripten "
295 "EMSCRIPTEN_CATCHING_ALLOWED options)"),
296 cl::CommaSeparated);
297
298 namespace {
299 class WebAssemblyLowerEmscriptenEHSjLj final : public ModulePass {
300 bool EnableEmEH; // Enable Emscripten exception handling
301 bool EnableEmSjLj; // Enable Emscripten setjmp/longjmp handling
302 bool EnableWasmSjLj; // Enable Wasm setjmp/longjmp handling
303 bool DoSjLj; // Whether we actually perform setjmp/longjmp handling
304
305 GlobalVariable *ThrewGV = nullptr; // __THREW__ (Emscripten)
306 GlobalVariable *ThrewValueGV = nullptr; // __threwValue (Emscripten)
307 Function *GetTempRet0F = nullptr; // getTempRet0() (Emscripten)
308 Function *SetTempRet0F = nullptr; // setTempRet0() (Emscripten)
309 Function *ResumeF = nullptr; // __resumeException() (Emscripten)
310 Function *EHTypeIDF = nullptr; // llvm.eh.typeid.for() (intrinsic)
311 Function *EmLongjmpF = nullptr; // emscripten_longjmp() (Emscripten)
312 Function *SaveSetjmpF = nullptr; // saveSetjmp() (Emscripten)
313 Function *TestSetjmpF = nullptr; // testSetjmp() (Emscripten)
314 Function *WasmLongjmpF = nullptr; // __wasm_longjmp() (Emscripten)
315 Function *CatchF = nullptr; // wasm.catch() (intrinsic)
316
317 // type of 'struct __WasmLongjmpArgs' defined in emscripten
318 Type *LongjmpArgsTy = nullptr;
319
320 // __cxa_find_matching_catch_N functions.
321 // Indexed by the number of clauses in an original landingpad instruction.
322 DenseMap<int, Function *> FindMatchingCatches;
323 // Map of <function signature string, invoke_ wrappers>
324 StringMap<Function *> InvokeWrappers;
325 // Set of allowed function names for exception handling
326 std::set<std::string> EHAllowlistSet;
327 // Functions that contains calls to setjmp
328 SmallPtrSet<Function *, 8> SetjmpUsers;
329
getPassName() const330 StringRef getPassName() const override {
331 return "WebAssembly Lower Emscripten Exceptions";
332 }
333
334 using InstVector = SmallVectorImpl<Instruction *>;
335 bool runEHOnFunction(Function &F);
336 bool runSjLjOnFunction(Function &F);
337 void handleLongjmpableCallsForEmscriptenSjLj(
338 Function &F, InstVector &SetjmpTableInsts,
339 InstVector &SetjmpTableSizeInsts,
340 SmallVectorImpl<PHINode *> &SetjmpRetPHIs);
341 void
342 handleLongjmpableCallsForWasmSjLj(Function &F, InstVector &SetjmpTableInsts,
343 InstVector &SetjmpTableSizeInsts,
344 SmallVectorImpl<PHINode *> &SetjmpRetPHIs);
345 Function *getFindMatchingCatch(Module &M, unsigned NumClauses);
346
347 Value *wrapInvoke(CallBase *CI);
348 void wrapTestSetjmp(BasicBlock *BB, DebugLoc DL, Value *Threw,
349 Value *SetjmpTable, Value *SetjmpTableSize, Value *&Label,
350 Value *&LongjmpResult, BasicBlock *&CallEmLongjmpBB,
351 PHINode *&CallEmLongjmpBBThrewPHI,
352 PHINode *&CallEmLongjmpBBThrewValuePHI,
353 BasicBlock *&EndBB);
354 Function *getInvokeWrapper(CallBase *CI);
355
areAllExceptionsAllowed() const356 bool areAllExceptionsAllowed() const { return EHAllowlistSet.empty(); }
supportsException(const Function * F) const357 bool supportsException(const Function *F) const {
358 return EnableEmEH && (areAllExceptionsAllowed() ||
359 EHAllowlistSet.count(std::string(F->getName())));
360 }
361 void replaceLongjmpWith(Function *LongjmpF, Function *NewF);
362
363 void rebuildSSA(Function &F);
364
365 public:
366 static char ID;
367
WebAssemblyLowerEmscriptenEHSjLj()368 WebAssemblyLowerEmscriptenEHSjLj()
369 : ModulePass(ID), EnableEmEH(WebAssembly::WasmEnableEmEH),
370 EnableEmSjLj(WebAssembly::WasmEnableEmSjLj),
371 EnableWasmSjLj(WebAssembly::WasmEnableSjLj) {
372 assert(!(EnableEmSjLj && EnableWasmSjLj) &&
373 "Two SjLj modes cannot be turned on at the same time");
374 assert(!(EnableEmEH && EnableWasmSjLj) &&
375 "Wasm SjLj should be only used with Wasm EH");
376 EHAllowlistSet.insert(EHAllowlist.begin(), EHAllowlist.end());
377 }
378 bool runOnModule(Module &M) override;
379
getAnalysisUsage(AnalysisUsage & AU) const380 void getAnalysisUsage(AnalysisUsage &AU) const override {
381 AU.addRequired<DominatorTreeWrapperPass>();
382 }
383 };
384 } // End anonymous namespace
385
386 char WebAssemblyLowerEmscriptenEHSjLj::ID = 0;
387 INITIALIZE_PASS(WebAssemblyLowerEmscriptenEHSjLj, DEBUG_TYPE,
388 "WebAssembly Lower Emscripten Exceptions / Setjmp / Longjmp",
389 false, false)
390
createWebAssemblyLowerEmscriptenEHSjLj()391 ModulePass *llvm::createWebAssemblyLowerEmscriptenEHSjLj() {
392 return new WebAssemblyLowerEmscriptenEHSjLj();
393 }
394
canThrow(const Value * V)395 static bool canThrow(const Value *V) {
396 if (const auto *F = dyn_cast<const Function>(V)) {
397 // Intrinsics cannot throw
398 if (F->isIntrinsic())
399 return false;
400 StringRef Name = F->getName();
401 // leave setjmp and longjmp (mostly) alone, we process them properly later
402 if (Name == "setjmp" || Name == "longjmp" || Name == "emscripten_longjmp")
403 return false;
404 return !F->doesNotThrow();
405 }
406 // not a function, so an indirect call - can throw, we can't tell
407 return true;
408 }
409
410 // Get a thread-local global variable with the given name. If it doesn't exist
411 // declare it, which will generate an import and assume that it will exist at
412 // link time.
getGlobalVariable(Module & M,Type * Ty,WebAssemblyTargetMachine & TM,const char * Name)413 static GlobalVariable *getGlobalVariable(Module &M, Type *Ty,
414 WebAssemblyTargetMachine &TM,
415 const char *Name) {
416 auto *GV = dyn_cast<GlobalVariable>(M.getOrInsertGlobal(Name, Ty));
417 if (!GV)
418 report_fatal_error(Twine("unable to create global: ") + Name);
419
420 // Variables created by this function are thread local. If the target does not
421 // support TLS, we depend on CoalesceFeaturesAndStripAtomics to downgrade it
422 // to non-thread-local ones, in which case we don't allow this object to be
423 // linked with other objects using shared memory.
424 GV->setThreadLocalMode(GlobalValue::GeneralDynamicTLSModel);
425 return GV;
426 }
427
428 // Simple function name mangler.
429 // This function simply takes LLVM's string representation of parameter types
430 // and concatenate them with '_'. There are non-alphanumeric characters but llc
431 // is ok with it, and we need to postprocess these names after the lowering
432 // phase anyway.
getSignature(FunctionType * FTy)433 static std::string getSignature(FunctionType *FTy) {
434 std::string Sig;
435 raw_string_ostream OS(Sig);
436 OS << *FTy->getReturnType();
437 for (Type *ParamTy : FTy->params())
438 OS << "_" << *ParamTy;
439 if (FTy->isVarArg())
440 OS << "_...";
441 Sig = OS.str();
442 erase_if(Sig, isSpace);
443 // When s2wasm parses .s file, a comma means the end of an argument. So a
444 // mangled function name can contain any character but a comma.
445 std::replace(Sig.begin(), Sig.end(), ',', '.');
446 return Sig;
447 }
448
getEmscriptenFunction(FunctionType * Ty,const Twine & Name,Module * M)449 static Function *getEmscriptenFunction(FunctionType *Ty, const Twine &Name,
450 Module *M) {
451 Function* F = Function::Create(Ty, GlobalValue::ExternalLinkage, Name, M);
452 // Tell the linker that this function is expected to be imported from the
453 // 'env' module.
454 if (!F->hasFnAttribute("wasm-import-module")) {
455 llvm::AttrBuilder B(M->getContext());
456 B.addAttribute("wasm-import-module", "env");
457 F->addFnAttrs(B);
458 }
459 if (!F->hasFnAttribute("wasm-import-name")) {
460 llvm::AttrBuilder B(M->getContext());
461 B.addAttribute("wasm-import-name", F->getName());
462 F->addFnAttrs(B);
463 }
464 return F;
465 }
466
467 // Returns an integer type for the target architecture's address space.
468 // i32 for wasm32 and i64 for wasm64.
getAddrIntType(Module * M)469 static Type *getAddrIntType(Module *M) {
470 IRBuilder<> IRB(M->getContext());
471 return IRB.getIntNTy(M->getDataLayout().getPointerSizeInBits());
472 }
473
474 // Returns an integer pointer type for the target architecture's address space.
475 // i32* for wasm32 and i64* for wasm64. With opaque pointers this is just a ptr
476 // in address space zero.
getAddrPtrType(Module * M)477 static Type *getAddrPtrType(Module *M) {
478 return PointerType::getUnqual(M->getContext());
479 }
480
481 // Returns an integer whose type is the integer type for the target's address
482 // space. Returns (i32 C) for wasm32 and (i64 C) for wasm64, when C is the
483 // integer.
getAddrSizeInt(Module * M,uint64_t C)484 static Value *getAddrSizeInt(Module *M, uint64_t C) {
485 IRBuilder<> IRB(M->getContext());
486 return IRB.getIntN(M->getDataLayout().getPointerSizeInBits(), C);
487 }
488
489 // Returns __cxa_find_matching_catch_N function, where N = NumClauses + 2.
490 // This is because a landingpad instruction contains two more arguments, a
491 // personality function and a cleanup bit, and __cxa_find_matching_catch_N
492 // functions are named after the number of arguments in the original landingpad
493 // instruction.
494 Function *
getFindMatchingCatch(Module & M,unsigned NumClauses)495 WebAssemblyLowerEmscriptenEHSjLj::getFindMatchingCatch(Module &M,
496 unsigned NumClauses) {
497 if (FindMatchingCatches.count(NumClauses))
498 return FindMatchingCatches[NumClauses];
499 PointerType *Int8PtrTy = PointerType::getUnqual(M.getContext());
500 SmallVector<Type *, 16> Args(NumClauses, Int8PtrTy);
501 FunctionType *FTy = FunctionType::get(Int8PtrTy, Args, false);
502 Function *F = getEmscriptenFunction(
503 FTy, "__cxa_find_matching_catch_" + Twine(NumClauses + 2), &M);
504 FindMatchingCatches[NumClauses] = F;
505 return F;
506 }
507
508 // Generate invoke wrapper seqence with preamble and postamble
509 // Preamble:
510 // __THREW__ = 0;
511 // Postamble:
512 // %__THREW__.val = __THREW__; __THREW__ = 0;
513 // Returns %__THREW__.val, which indicates whether an exception is thrown (or
514 // whether longjmp occurred), for future use.
wrapInvoke(CallBase * CI)515 Value *WebAssemblyLowerEmscriptenEHSjLj::wrapInvoke(CallBase *CI) {
516 Module *M = CI->getModule();
517 LLVMContext &C = M->getContext();
518
519 IRBuilder<> IRB(C);
520 IRB.SetInsertPoint(CI);
521
522 // Pre-invoke
523 // __THREW__ = 0;
524 IRB.CreateStore(getAddrSizeInt(M, 0), ThrewGV);
525
526 // Invoke function wrapper in JavaScript
527 SmallVector<Value *, 16> Args;
528 // Put the pointer to the callee as first argument, so it can be called
529 // within the invoke wrapper later
530 Args.push_back(CI->getCalledOperand());
531 Args.append(CI->arg_begin(), CI->arg_end());
532 CallInst *NewCall = IRB.CreateCall(getInvokeWrapper(CI), Args);
533 NewCall->takeName(CI);
534 NewCall->setCallingConv(CallingConv::WASM_EmscriptenInvoke);
535 NewCall->setDebugLoc(CI->getDebugLoc());
536
537 // Because we added the pointer to the callee as first argument, all
538 // argument attribute indices have to be incremented by one.
539 SmallVector<AttributeSet, 8> ArgAttributes;
540 const AttributeList &InvokeAL = CI->getAttributes();
541
542 // No attributes for the callee pointer.
543 ArgAttributes.push_back(AttributeSet());
544 // Copy the argument attributes from the original
545 for (unsigned I = 0, E = CI->arg_size(); I < E; ++I)
546 ArgAttributes.push_back(InvokeAL.getParamAttrs(I));
547
548 AttrBuilder FnAttrs(CI->getContext(), InvokeAL.getFnAttrs());
549 if (auto Args = FnAttrs.getAllocSizeArgs()) {
550 // The allocsize attribute (if any) referes to parameters by index and needs
551 // to be adjusted.
552 auto [SizeArg, NEltArg] = *Args;
553 SizeArg += 1;
554 if (NEltArg)
555 NEltArg = *NEltArg + 1;
556 FnAttrs.addAllocSizeAttr(SizeArg, NEltArg);
557 }
558 // In case the callee has 'noreturn' attribute, We need to remove it, because
559 // we expect invoke wrappers to return.
560 FnAttrs.removeAttribute(Attribute::NoReturn);
561
562 // Reconstruct the AttributesList based on the vector we constructed.
563 AttributeList NewCallAL = AttributeList::get(
564 C, AttributeSet::get(C, FnAttrs), InvokeAL.getRetAttrs(), ArgAttributes);
565 NewCall->setAttributes(NewCallAL);
566
567 CI->replaceAllUsesWith(NewCall);
568
569 // Post-invoke
570 // %__THREW__.val = __THREW__; __THREW__ = 0;
571 Value *Threw =
572 IRB.CreateLoad(getAddrIntType(M), ThrewGV, ThrewGV->getName() + ".val");
573 IRB.CreateStore(getAddrSizeInt(M, 0), ThrewGV);
574 return Threw;
575 }
576
577 // Get matching invoke wrapper based on callee signature
getInvokeWrapper(CallBase * CI)578 Function *WebAssemblyLowerEmscriptenEHSjLj::getInvokeWrapper(CallBase *CI) {
579 Module *M = CI->getModule();
580 SmallVector<Type *, 16> ArgTys;
581 FunctionType *CalleeFTy = CI->getFunctionType();
582
583 std::string Sig = getSignature(CalleeFTy);
584 if (InvokeWrappers.contains(Sig))
585 return InvokeWrappers[Sig];
586
587 // Put the pointer to the callee as first argument
588 ArgTys.push_back(PointerType::getUnqual(CalleeFTy));
589 // Add argument types
590 ArgTys.append(CalleeFTy->param_begin(), CalleeFTy->param_end());
591
592 FunctionType *FTy = FunctionType::get(CalleeFTy->getReturnType(), ArgTys,
593 CalleeFTy->isVarArg());
594 Function *F = getEmscriptenFunction(FTy, "__invoke_" + Sig, M);
595 InvokeWrappers[Sig] = F;
596 return F;
597 }
598
canLongjmp(const Value * Callee)599 static bool canLongjmp(const Value *Callee) {
600 if (auto *CalleeF = dyn_cast<Function>(Callee))
601 if (CalleeF->isIntrinsic())
602 return false;
603
604 // Attempting to transform inline assembly will result in something like:
605 // call void @__invoke_void(void ()* asm ...)
606 // which is invalid because inline assembly blocks do not have addresses
607 // and can't be passed by pointer. The result is a crash with illegal IR.
608 if (isa<InlineAsm>(Callee))
609 return false;
610 StringRef CalleeName = Callee->getName();
611
612 // TODO Include more functions or consider checking with mangled prefixes
613
614 // The reason we include malloc/free here is to exclude the malloc/free
615 // calls generated in setjmp prep / cleanup routines.
616 if (CalleeName == "setjmp" || CalleeName == "malloc" || CalleeName == "free")
617 return false;
618
619 // There are functions in Emscripten's JS glue code or compiler-rt
620 if (CalleeName == "__resumeException" || CalleeName == "llvm_eh_typeid_for" ||
621 CalleeName == "saveSetjmp" || CalleeName == "testSetjmp" ||
622 CalleeName == "getTempRet0" || CalleeName == "setTempRet0")
623 return false;
624
625 // __cxa_find_matching_catch_N functions cannot longjmp
626 if (Callee->getName().starts_with("__cxa_find_matching_catch_"))
627 return false;
628
629 // Exception-catching related functions
630 //
631 // We intentionally treat __cxa_end_catch longjmpable in Wasm SjLj even though
632 // it surely cannot longjmp, in order to maintain the unwind relationship from
633 // all existing catchpads (and calls within them) to catch.dispatch.longjmp.
634 //
635 // In Wasm EH + Wasm SjLj, we
636 // 1. Make all catchswitch and cleanuppad that unwind to caller unwind to
637 // catch.dispatch.longjmp instead
638 // 2. Convert all longjmpable calls to invokes that unwind to
639 // catch.dispatch.longjmp
640 // But catchswitch BBs are removed in isel, so if an EH catchswitch (generated
641 // from an exception)'s catchpad does not contain any calls that are converted
642 // into invokes unwinding to catch.dispatch.longjmp, this unwind relationship
643 // (EH catchswitch BB -> catch.dispatch.longjmp BB) is lost and
644 // catch.dispatch.longjmp BB can be placed before the EH catchswitch BB in
645 // CFGSort.
646 // int ret = setjmp(buf);
647 // try {
648 // foo(); // longjmps
649 // } catch (...) {
650 // }
651 // Then in this code, if 'foo' longjmps, it first unwinds to 'catch (...)'
652 // catchswitch, and is not caught by that catchswitch because it is a longjmp,
653 // then it should next unwind to catch.dispatch.longjmp BB. But if this 'catch
654 // (...)' catchswitch -> catch.dispatch.longjmp unwind relationship is lost,
655 // it will not unwind to catch.dispatch.longjmp, producing an incorrect
656 // result.
657 //
658 // Every catchpad generated by Wasm C++ contains __cxa_end_catch, so we
659 // intentionally treat it as longjmpable to work around this problem. This is
660 // a hacky fix but an easy one.
661 //
662 // The comment block in findWasmUnwindDestinations() in
663 // SelectionDAGBuilder.cpp is addressing a similar problem.
664 if (CalleeName == "__cxa_end_catch")
665 return WebAssembly::WasmEnableSjLj;
666 if (CalleeName == "__cxa_begin_catch" ||
667 CalleeName == "__cxa_allocate_exception" || CalleeName == "__cxa_throw" ||
668 CalleeName == "__clang_call_terminate")
669 return false;
670
671 // std::terminate, which is generated when another exception occurs while
672 // handling an exception, cannot longjmp.
673 if (CalleeName == "_ZSt9terminatev")
674 return false;
675
676 // Otherwise we don't know
677 return true;
678 }
679
isEmAsmCall(const Value * Callee)680 static bool isEmAsmCall(const Value *Callee) {
681 StringRef CalleeName = Callee->getName();
682 // This is an exhaustive list from Emscripten's <emscripten/em_asm.h>.
683 return CalleeName == "emscripten_asm_const_int" ||
684 CalleeName == "emscripten_asm_const_double" ||
685 CalleeName == "emscripten_asm_const_int_sync_on_main_thread" ||
686 CalleeName == "emscripten_asm_const_double_sync_on_main_thread" ||
687 CalleeName == "emscripten_asm_const_async_on_main_thread";
688 }
689
690 // Generate testSetjmp function call seqence with preamble and postamble.
691 // The code this generates is equivalent to the following JavaScript code:
692 // %__threwValue.val = __threwValue;
693 // if (%__THREW__.val != 0 & %__threwValue.val != 0) {
694 // %label = testSetjmp(mem[%__THREW__.val], setjmpTable, setjmpTableSize);
695 // if (%label == 0)
696 // emscripten_longjmp(%__THREW__.val, %__threwValue.val);
697 // setTempRet0(%__threwValue.val);
698 // } else {
699 // %label = -1;
700 // }
701 // %longjmp_result = getTempRet0();
702 //
703 // As output parameters. returns %label, %longjmp_result, and the BB the last
704 // instruction (%longjmp_result = ...) is in.
wrapTestSetjmp(BasicBlock * BB,DebugLoc DL,Value * Threw,Value * SetjmpTable,Value * SetjmpTableSize,Value * & Label,Value * & LongjmpResult,BasicBlock * & CallEmLongjmpBB,PHINode * & CallEmLongjmpBBThrewPHI,PHINode * & CallEmLongjmpBBThrewValuePHI,BasicBlock * & EndBB)705 void WebAssemblyLowerEmscriptenEHSjLj::wrapTestSetjmp(
706 BasicBlock *BB, DebugLoc DL, Value *Threw, Value *SetjmpTable,
707 Value *SetjmpTableSize, Value *&Label, Value *&LongjmpResult,
708 BasicBlock *&CallEmLongjmpBB, PHINode *&CallEmLongjmpBBThrewPHI,
709 PHINode *&CallEmLongjmpBBThrewValuePHI, BasicBlock *&EndBB) {
710 Function *F = BB->getParent();
711 Module *M = F->getParent();
712 LLVMContext &C = M->getContext();
713 IRBuilder<> IRB(C);
714 IRB.SetCurrentDebugLocation(DL);
715
716 // if (%__THREW__.val != 0 & %__threwValue.val != 0)
717 IRB.SetInsertPoint(BB);
718 BasicBlock *ThenBB1 = BasicBlock::Create(C, "if.then1", F);
719 BasicBlock *ElseBB1 = BasicBlock::Create(C, "if.else1", F);
720 BasicBlock *EndBB1 = BasicBlock::Create(C, "if.end", F);
721 Value *ThrewCmp = IRB.CreateICmpNE(Threw, getAddrSizeInt(M, 0));
722 Value *ThrewValue = IRB.CreateLoad(IRB.getInt32Ty(), ThrewValueGV,
723 ThrewValueGV->getName() + ".val");
724 Value *ThrewValueCmp = IRB.CreateICmpNE(ThrewValue, IRB.getInt32(0));
725 Value *Cmp1 = IRB.CreateAnd(ThrewCmp, ThrewValueCmp, "cmp1");
726 IRB.CreateCondBr(Cmp1, ThenBB1, ElseBB1);
727
728 // Generate call.em.longjmp BB once and share it within the function
729 if (!CallEmLongjmpBB) {
730 // emscripten_longjmp(%__THREW__.val, %__threwValue.val);
731 CallEmLongjmpBB = BasicBlock::Create(C, "call.em.longjmp", F);
732 IRB.SetInsertPoint(CallEmLongjmpBB);
733 CallEmLongjmpBBThrewPHI = IRB.CreatePHI(getAddrIntType(M), 4, "threw.phi");
734 CallEmLongjmpBBThrewValuePHI =
735 IRB.CreatePHI(IRB.getInt32Ty(), 4, "threwvalue.phi");
736 CallEmLongjmpBBThrewPHI->addIncoming(Threw, ThenBB1);
737 CallEmLongjmpBBThrewValuePHI->addIncoming(ThrewValue, ThenBB1);
738 IRB.CreateCall(EmLongjmpF,
739 {CallEmLongjmpBBThrewPHI, CallEmLongjmpBBThrewValuePHI});
740 IRB.CreateUnreachable();
741 } else {
742 CallEmLongjmpBBThrewPHI->addIncoming(Threw, ThenBB1);
743 CallEmLongjmpBBThrewValuePHI->addIncoming(ThrewValue, ThenBB1);
744 }
745
746 // %label = testSetjmp(mem[%__THREW__.val], setjmpTable, setjmpTableSize);
747 // if (%label == 0)
748 IRB.SetInsertPoint(ThenBB1);
749 BasicBlock *EndBB2 = BasicBlock::Create(C, "if.end2", F);
750 Value *ThrewPtr =
751 IRB.CreateIntToPtr(Threw, getAddrPtrType(M), Threw->getName() + ".p");
752 Value *LoadedThrew = IRB.CreateLoad(getAddrIntType(M), ThrewPtr,
753 ThrewPtr->getName() + ".loaded");
754 Value *ThenLabel = IRB.CreateCall(
755 TestSetjmpF, {LoadedThrew, SetjmpTable, SetjmpTableSize}, "label");
756 Value *Cmp2 = IRB.CreateICmpEQ(ThenLabel, IRB.getInt32(0));
757 IRB.CreateCondBr(Cmp2, CallEmLongjmpBB, EndBB2);
758
759 // setTempRet0(%__threwValue.val);
760 IRB.SetInsertPoint(EndBB2);
761 IRB.CreateCall(SetTempRet0F, ThrewValue);
762 IRB.CreateBr(EndBB1);
763
764 IRB.SetInsertPoint(ElseBB1);
765 IRB.CreateBr(EndBB1);
766
767 // longjmp_result = getTempRet0();
768 IRB.SetInsertPoint(EndBB1);
769 PHINode *LabelPHI = IRB.CreatePHI(IRB.getInt32Ty(), 2, "label");
770 LabelPHI->addIncoming(ThenLabel, EndBB2);
771
772 LabelPHI->addIncoming(IRB.getInt32(-1), ElseBB1);
773
774 // Output parameter assignment
775 Label = LabelPHI;
776 EndBB = EndBB1;
777 LongjmpResult = IRB.CreateCall(GetTempRet0F, std::nullopt, "longjmp_result");
778 }
779
rebuildSSA(Function & F)780 void WebAssemblyLowerEmscriptenEHSjLj::rebuildSSA(Function &F) {
781 DominatorTree &DT = getAnalysis<DominatorTreeWrapperPass>(F).getDomTree();
782 DT.recalculate(F); // CFG has been changed
783
784 SSAUpdaterBulk SSA;
785 for (BasicBlock &BB : F) {
786 for (Instruction &I : BB) {
787 unsigned VarID = SSA.AddVariable(I.getName(), I.getType());
788 // If a value is defined by an invoke instruction, it is only available in
789 // its normal destination and not in its unwind destination.
790 if (auto *II = dyn_cast<InvokeInst>(&I))
791 SSA.AddAvailableValue(VarID, II->getNormalDest(), II);
792 else
793 SSA.AddAvailableValue(VarID, &BB, &I);
794 for (auto &U : I.uses()) {
795 auto *User = cast<Instruction>(U.getUser());
796 if (auto *UserPN = dyn_cast<PHINode>(User))
797 if (UserPN->getIncomingBlock(U) == &BB)
798 continue;
799 if (DT.dominates(&I, User))
800 continue;
801 SSA.AddUse(VarID, &U);
802 }
803 }
804 }
805 SSA.RewriteAllUses(&DT);
806 }
807
808 // Replace uses of longjmp with a new longjmp function in Emscripten library.
809 // In Emscripten SjLj, the new function is
810 // void emscripten_longjmp(uintptr_t, i32)
811 // In Wasm SjLj, the new function is
812 // void __wasm_longjmp(i8*, i32)
813 // Because the original libc longjmp function takes (jmp_buf*, i32), we need a
814 // ptrtoint/bitcast instruction here to make the type match. jmp_buf* will
815 // eventually be lowered to i32/i64 in the wasm backend.
replaceLongjmpWith(Function * LongjmpF,Function * NewF)816 void WebAssemblyLowerEmscriptenEHSjLj::replaceLongjmpWith(Function *LongjmpF,
817 Function *NewF) {
818 assert(NewF == EmLongjmpF || NewF == WasmLongjmpF);
819 Module *M = LongjmpF->getParent();
820 SmallVector<CallInst *, 8> ToErase;
821 LLVMContext &C = LongjmpF->getParent()->getContext();
822 IRBuilder<> IRB(C);
823
824 // For calls to longjmp, replace it with emscripten_longjmp/__wasm_longjmp and
825 // cast its first argument (jmp_buf*) appropriately
826 for (User *U : LongjmpF->users()) {
827 auto *CI = dyn_cast<CallInst>(U);
828 if (CI && CI->getCalledFunction() == LongjmpF) {
829 IRB.SetInsertPoint(CI);
830 Value *Env = nullptr;
831 if (NewF == EmLongjmpF)
832 Env =
833 IRB.CreatePtrToInt(CI->getArgOperand(0), getAddrIntType(M), "env");
834 else // WasmLongjmpF
835 Env = IRB.CreateBitCast(CI->getArgOperand(0), IRB.getPtrTy(), "env");
836 IRB.CreateCall(NewF, {Env, CI->getArgOperand(1)});
837 ToErase.push_back(CI);
838 }
839 }
840 for (auto *I : ToErase)
841 I->eraseFromParent();
842
843 // If we have any remaining uses of longjmp's function pointer, replace it
844 // with (void(*)(jmp_buf*, int))emscripten_longjmp / __wasm_longjmp.
845 if (!LongjmpF->uses().empty()) {
846 Value *NewLongjmp =
847 IRB.CreateBitCast(NewF, LongjmpF->getType(), "longjmp.cast");
848 LongjmpF->replaceAllUsesWith(NewLongjmp);
849 }
850 }
851
containsLongjmpableCalls(const Function * F)852 static bool containsLongjmpableCalls(const Function *F) {
853 for (const auto &BB : *F)
854 for (const auto &I : BB)
855 if (const auto *CB = dyn_cast<CallBase>(&I))
856 if (canLongjmp(CB->getCalledOperand()))
857 return true;
858 return false;
859 }
860
861 // When a function contains a setjmp call but not other calls that can longjmp,
862 // we don't do setjmp transformation for that setjmp. But we need to convert the
863 // setjmp calls into "i32 0" so they don't cause link time errors. setjmp always
864 // returns 0 when called directly.
nullifySetjmp(Function * F)865 static void nullifySetjmp(Function *F) {
866 Module &M = *F->getParent();
867 IRBuilder<> IRB(M.getContext());
868 Function *SetjmpF = M.getFunction("setjmp");
869 SmallVector<Instruction *, 1> ToErase;
870
871 for (User *U : make_early_inc_range(SetjmpF->users())) {
872 auto *CB = cast<CallBase>(U);
873 BasicBlock *BB = CB->getParent();
874 if (BB->getParent() != F) // in other function
875 continue;
876 CallInst *CI = nullptr;
877 // setjmp cannot throw. So if it is an invoke, lower it to a call
878 if (auto *II = dyn_cast<InvokeInst>(CB))
879 CI = llvm::changeToCall(II);
880 else
881 CI = cast<CallInst>(CB);
882 ToErase.push_back(CI);
883 CI->replaceAllUsesWith(IRB.getInt32(0));
884 }
885 for (auto *I : ToErase)
886 I->eraseFromParent();
887 }
888
runOnModule(Module & M)889 bool WebAssemblyLowerEmscriptenEHSjLj::runOnModule(Module &M) {
890 LLVM_DEBUG(dbgs() << "********** Lower Emscripten EH & SjLj **********\n");
891
892 LLVMContext &C = M.getContext();
893 IRBuilder<> IRB(C);
894
895 Function *SetjmpF = M.getFunction("setjmp");
896 Function *LongjmpF = M.getFunction("longjmp");
897
898 // In some platforms _setjmp and _longjmp are used instead. Change these to
899 // use setjmp/longjmp instead, because we later detect these functions by
900 // their names.
901 Function *SetjmpF2 = M.getFunction("_setjmp");
902 Function *LongjmpF2 = M.getFunction("_longjmp");
903 if (SetjmpF2) {
904 if (SetjmpF) {
905 if (SetjmpF->getFunctionType() != SetjmpF2->getFunctionType())
906 report_fatal_error("setjmp and _setjmp have different function types");
907 } else {
908 SetjmpF = Function::Create(SetjmpF2->getFunctionType(),
909 GlobalValue::ExternalLinkage, "setjmp", M);
910 }
911 SetjmpF2->replaceAllUsesWith(SetjmpF);
912 }
913 if (LongjmpF2) {
914 if (LongjmpF) {
915 if (LongjmpF->getFunctionType() != LongjmpF2->getFunctionType())
916 report_fatal_error(
917 "longjmp and _longjmp have different function types");
918 } else {
919 LongjmpF = Function::Create(LongjmpF2->getFunctionType(),
920 GlobalValue::ExternalLinkage, "setjmp", M);
921 }
922 LongjmpF2->replaceAllUsesWith(LongjmpF);
923 }
924
925 auto *TPC = getAnalysisIfAvailable<TargetPassConfig>();
926 assert(TPC && "Expected a TargetPassConfig");
927 auto &TM = TPC->getTM<WebAssemblyTargetMachine>();
928
929 // Declare (or get) global variables __THREW__, __threwValue, and
930 // getTempRet0/setTempRet0 function which are used in common for both
931 // exception handling and setjmp/longjmp handling
932 ThrewGV = getGlobalVariable(M, getAddrIntType(&M), TM, "__THREW__");
933 ThrewValueGV = getGlobalVariable(M, IRB.getInt32Ty(), TM, "__threwValue");
934 GetTempRet0F = getEmscriptenFunction(
935 FunctionType::get(IRB.getInt32Ty(), false), "getTempRet0", &M);
936 SetTempRet0F = getEmscriptenFunction(
937 FunctionType::get(IRB.getVoidTy(), IRB.getInt32Ty(), false),
938 "setTempRet0", &M);
939 GetTempRet0F->setDoesNotThrow();
940 SetTempRet0F->setDoesNotThrow();
941
942 bool Changed = false;
943
944 // Function registration for exception handling
945 if (EnableEmEH) {
946 // Register __resumeException function
947 FunctionType *ResumeFTy =
948 FunctionType::get(IRB.getVoidTy(), IRB.getPtrTy(), false);
949 ResumeF = getEmscriptenFunction(ResumeFTy, "__resumeException", &M);
950 ResumeF->addFnAttr(Attribute::NoReturn);
951
952 // Register llvm_eh_typeid_for function
953 FunctionType *EHTypeIDTy =
954 FunctionType::get(IRB.getInt32Ty(), IRB.getPtrTy(), false);
955 EHTypeIDF = getEmscriptenFunction(EHTypeIDTy, "llvm_eh_typeid_for", &M);
956 }
957
958 // Functions that contains calls to setjmp but don't have other longjmpable
959 // calls within them.
960 SmallPtrSet<Function *, 4> SetjmpUsersToNullify;
961
962 if ((EnableEmSjLj || EnableWasmSjLj) && SetjmpF) {
963 // Precompute setjmp users
964 for (User *U : SetjmpF->users()) {
965 if (auto *CB = dyn_cast<CallBase>(U)) {
966 auto *UserF = CB->getFunction();
967 // If a function that calls setjmp does not contain any other calls that
968 // can longjmp, we don't need to do any transformation on that function,
969 // so can ignore it
970 if (containsLongjmpableCalls(UserF))
971 SetjmpUsers.insert(UserF);
972 else
973 SetjmpUsersToNullify.insert(UserF);
974 } else {
975 std::string S;
976 raw_string_ostream SS(S);
977 SS << *U;
978 report_fatal_error(Twine("Indirect use of setjmp is not supported: ") +
979 SS.str());
980 }
981 }
982 }
983
984 bool SetjmpUsed = SetjmpF && !SetjmpUsers.empty();
985 bool LongjmpUsed = LongjmpF && !LongjmpF->use_empty();
986 DoSjLj = (EnableEmSjLj | EnableWasmSjLj) && (SetjmpUsed || LongjmpUsed);
987
988 // Function registration and data pre-gathering for setjmp/longjmp handling
989 if (DoSjLj) {
990 assert(EnableEmSjLj || EnableWasmSjLj);
991 if (EnableEmSjLj) {
992 // Register emscripten_longjmp function
993 FunctionType *FTy = FunctionType::get(
994 IRB.getVoidTy(), {getAddrIntType(&M), IRB.getInt32Ty()}, false);
995 EmLongjmpF = getEmscriptenFunction(FTy, "emscripten_longjmp", &M);
996 EmLongjmpF->addFnAttr(Attribute::NoReturn);
997 } else { // EnableWasmSjLj
998 Type *Int8PtrTy = IRB.getPtrTy();
999 // Register __wasm_longjmp function, which calls __builtin_wasm_longjmp.
1000 FunctionType *FTy = FunctionType::get(
1001 IRB.getVoidTy(), {Int8PtrTy, IRB.getInt32Ty()}, false);
1002 WasmLongjmpF = getEmscriptenFunction(FTy, "__wasm_longjmp", &M);
1003 WasmLongjmpF->addFnAttr(Attribute::NoReturn);
1004 }
1005
1006 if (SetjmpF) {
1007 Type *Int8PtrTy = IRB.getPtrTy();
1008 Type *Int32PtrTy = IRB.getPtrTy();
1009 Type *Int32Ty = IRB.getInt32Ty();
1010 // Register saveSetjmp function
1011 FunctionType *SetjmpFTy = SetjmpF->getFunctionType();
1012 FunctionType *FTy = FunctionType::get(
1013 Int32PtrTy,
1014 {SetjmpFTy->getParamType(0), Int32Ty, Int32PtrTy, Int32Ty}, false);
1015 SaveSetjmpF = getEmscriptenFunction(FTy, "saveSetjmp", &M);
1016
1017 // Register testSetjmp function
1018 FTy = FunctionType::get(Int32Ty,
1019 {getAddrIntType(&M), Int32PtrTy, Int32Ty}, false);
1020 TestSetjmpF = getEmscriptenFunction(FTy, "testSetjmp", &M);
1021
1022 // wasm.catch() will be lowered down to wasm 'catch' instruction in
1023 // instruction selection.
1024 CatchF = Intrinsic::getDeclaration(&M, Intrinsic::wasm_catch);
1025 // Type for struct __WasmLongjmpArgs
1026 LongjmpArgsTy = StructType::get(Int8PtrTy, // env
1027 Int32Ty // val
1028 );
1029 }
1030 }
1031
1032 // Exception handling transformation
1033 if (EnableEmEH) {
1034 for (Function &F : M) {
1035 if (F.isDeclaration())
1036 continue;
1037 Changed |= runEHOnFunction(F);
1038 }
1039 }
1040
1041 // Setjmp/longjmp handling transformation
1042 if (DoSjLj) {
1043 Changed = true; // We have setjmp or longjmp somewhere
1044 if (LongjmpF)
1045 replaceLongjmpWith(LongjmpF, EnableEmSjLj ? EmLongjmpF : WasmLongjmpF);
1046 // Only traverse functions that uses setjmp in order not to insert
1047 // unnecessary prep / cleanup code in every function
1048 if (SetjmpF)
1049 for (Function *F : SetjmpUsers)
1050 runSjLjOnFunction(*F);
1051 }
1052
1053 // Replace unnecessary setjmp calls with 0
1054 if ((EnableEmSjLj || EnableWasmSjLj) && !SetjmpUsersToNullify.empty()) {
1055 Changed = true;
1056 assert(SetjmpF);
1057 for (Function *F : SetjmpUsersToNullify)
1058 nullifySetjmp(F);
1059 }
1060
1061 // Delete unused global variables and functions
1062 for (auto *V : {ThrewGV, ThrewValueGV})
1063 if (V && V->use_empty())
1064 V->eraseFromParent();
1065 for (auto *V : {GetTempRet0F, SetTempRet0F, ResumeF, EHTypeIDF, EmLongjmpF,
1066 SaveSetjmpF, TestSetjmpF, WasmLongjmpF, CatchF})
1067 if (V && V->use_empty())
1068 V->eraseFromParent();
1069
1070 return Changed;
1071 }
1072
runEHOnFunction(Function & F)1073 bool WebAssemblyLowerEmscriptenEHSjLj::runEHOnFunction(Function &F) {
1074 Module &M = *F.getParent();
1075 LLVMContext &C = F.getContext();
1076 IRBuilder<> IRB(C);
1077 bool Changed = false;
1078 SmallVector<Instruction *, 64> ToErase;
1079 SmallPtrSet<LandingPadInst *, 32> LandingPads;
1080
1081 // rethrow.longjmp BB that will be shared within the function.
1082 BasicBlock *RethrowLongjmpBB = nullptr;
1083 // PHI node for the loaded value of __THREW__ global variable in
1084 // rethrow.longjmp BB
1085 PHINode *RethrowLongjmpBBThrewPHI = nullptr;
1086
1087 for (BasicBlock &BB : F) {
1088 auto *II = dyn_cast<InvokeInst>(BB.getTerminator());
1089 if (!II)
1090 continue;
1091 Changed = true;
1092 LandingPads.insert(II->getLandingPadInst());
1093 IRB.SetInsertPoint(II);
1094
1095 const Value *Callee = II->getCalledOperand();
1096 bool NeedInvoke = supportsException(&F) && canThrow(Callee);
1097 if (NeedInvoke) {
1098 // Wrap invoke with invoke wrapper and generate preamble/postamble
1099 Value *Threw = wrapInvoke(II);
1100 ToErase.push_back(II);
1101
1102 // If setjmp/longjmp handling is enabled, the thrown value can be not an
1103 // exception but a longjmp. If the current function contains calls to
1104 // setjmp, it will be appropriately handled in runSjLjOnFunction. But even
1105 // if the function does not contain setjmp calls, we shouldn't silently
1106 // ignore longjmps; we should rethrow them so they can be correctly
1107 // handled in somewhere up the call chain where setjmp is. __THREW__'s
1108 // value is 0 when nothing happened, 1 when an exception is thrown, and
1109 // other values when longjmp is thrown.
1110 //
1111 // if (%__THREW__.val == 0 || %__THREW__.val == 1)
1112 // goto %tail
1113 // else
1114 // goto %longjmp.rethrow
1115 //
1116 // rethrow.longjmp: ;; This is longjmp. Rethrow it
1117 // %__threwValue.val = __threwValue
1118 // emscripten_longjmp(%__THREW__.val, %__threwValue.val);
1119 //
1120 // tail: ;; Nothing happened or an exception is thrown
1121 // ... Continue exception handling ...
1122 if (DoSjLj && EnableEmSjLj && !SetjmpUsers.count(&F) &&
1123 canLongjmp(Callee)) {
1124 // Create longjmp.rethrow BB once and share it within the function
1125 if (!RethrowLongjmpBB) {
1126 RethrowLongjmpBB = BasicBlock::Create(C, "rethrow.longjmp", &F);
1127 IRB.SetInsertPoint(RethrowLongjmpBB);
1128 RethrowLongjmpBBThrewPHI =
1129 IRB.CreatePHI(getAddrIntType(&M), 4, "threw.phi");
1130 RethrowLongjmpBBThrewPHI->addIncoming(Threw, &BB);
1131 Value *ThrewValue = IRB.CreateLoad(IRB.getInt32Ty(), ThrewValueGV,
1132 ThrewValueGV->getName() + ".val");
1133 IRB.CreateCall(EmLongjmpF, {RethrowLongjmpBBThrewPHI, ThrewValue});
1134 IRB.CreateUnreachable();
1135 } else {
1136 RethrowLongjmpBBThrewPHI->addIncoming(Threw, &BB);
1137 }
1138
1139 IRB.SetInsertPoint(II); // Restore the insert point back
1140 BasicBlock *Tail = BasicBlock::Create(C, "tail", &F);
1141 Value *CmpEqOne =
1142 IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 1), "cmp.eq.one");
1143 Value *CmpEqZero =
1144 IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 0), "cmp.eq.zero");
1145 Value *Or = IRB.CreateOr(CmpEqZero, CmpEqOne, "or");
1146 IRB.CreateCondBr(Or, Tail, RethrowLongjmpBB);
1147 IRB.SetInsertPoint(Tail);
1148 BB.replaceSuccessorsPhiUsesWith(&BB, Tail);
1149 }
1150
1151 // Insert a branch based on __THREW__ variable
1152 Value *Cmp = IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 1), "cmp");
1153 IRB.CreateCondBr(Cmp, II->getUnwindDest(), II->getNormalDest());
1154
1155 } else {
1156 // This can't throw, and we don't need this invoke, just replace it with a
1157 // call+branch
1158 changeToCall(II);
1159 }
1160 }
1161
1162 // Process resume instructions
1163 for (BasicBlock &BB : F) {
1164 // Scan the body of the basic block for resumes
1165 for (Instruction &I : BB) {
1166 auto *RI = dyn_cast<ResumeInst>(&I);
1167 if (!RI)
1168 continue;
1169 Changed = true;
1170
1171 // Split the input into legal values
1172 Value *Input = RI->getValue();
1173 IRB.SetInsertPoint(RI);
1174 Value *Low = IRB.CreateExtractValue(Input, 0, "low");
1175 // Create a call to __resumeException function
1176 IRB.CreateCall(ResumeF, {Low});
1177 // Add a terminator to the block
1178 IRB.CreateUnreachable();
1179 ToErase.push_back(RI);
1180 }
1181 }
1182
1183 // Process llvm.eh.typeid.for intrinsics
1184 for (BasicBlock &BB : F) {
1185 for (Instruction &I : BB) {
1186 auto *CI = dyn_cast<CallInst>(&I);
1187 if (!CI)
1188 continue;
1189 const Function *Callee = CI->getCalledFunction();
1190 if (!Callee)
1191 continue;
1192 if (Callee->getIntrinsicID() != Intrinsic::eh_typeid_for)
1193 continue;
1194 Changed = true;
1195
1196 IRB.SetInsertPoint(CI);
1197 CallInst *NewCI =
1198 IRB.CreateCall(EHTypeIDF, CI->getArgOperand(0), "typeid");
1199 CI->replaceAllUsesWith(NewCI);
1200 ToErase.push_back(CI);
1201 }
1202 }
1203
1204 // Look for orphan landingpads, can occur in blocks with no predecessors
1205 for (BasicBlock &BB : F) {
1206 Instruction *I = BB.getFirstNonPHI();
1207 if (auto *LPI = dyn_cast<LandingPadInst>(I))
1208 LandingPads.insert(LPI);
1209 }
1210 Changed |= !LandingPads.empty();
1211
1212 // Handle all the landingpad for this function together, as multiple invokes
1213 // may share a single lp
1214 for (LandingPadInst *LPI : LandingPads) {
1215 IRB.SetInsertPoint(LPI);
1216 SmallVector<Value *, 16> FMCArgs;
1217 for (unsigned I = 0, E = LPI->getNumClauses(); I < E; ++I) {
1218 Constant *Clause = LPI->getClause(I);
1219 // TODO Handle filters (= exception specifications).
1220 // https://github.com/llvm/llvm-project/issues/49740
1221 if (LPI->isCatch(I))
1222 FMCArgs.push_back(Clause);
1223 }
1224
1225 // Create a call to __cxa_find_matching_catch_N function
1226 Function *FMCF = getFindMatchingCatch(M, FMCArgs.size());
1227 CallInst *FMCI = IRB.CreateCall(FMCF, FMCArgs, "fmc");
1228 Value *Poison = PoisonValue::get(LPI->getType());
1229 Value *Pair0 = IRB.CreateInsertValue(Poison, FMCI, 0, "pair0");
1230 Value *TempRet0 = IRB.CreateCall(GetTempRet0F, std::nullopt, "tempret0");
1231 Value *Pair1 = IRB.CreateInsertValue(Pair0, TempRet0, 1, "pair1");
1232
1233 LPI->replaceAllUsesWith(Pair1);
1234 ToErase.push_back(LPI);
1235 }
1236
1237 // Erase everything we no longer need in this function
1238 for (Instruction *I : ToErase)
1239 I->eraseFromParent();
1240
1241 return Changed;
1242 }
1243
1244 // This tries to get debug info from the instruction before which a new
1245 // instruction will be inserted, and if there's no debug info in that
1246 // instruction, tries to get the info instead from the previous instruction (if
1247 // any). If none of these has debug info and a DISubprogram is provided, it
1248 // creates a dummy debug info with the first line of the function, because IR
1249 // verifier requires all inlinable callsites should have debug info when both a
1250 // caller and callee have DISubprogram. If none of these conditions are met,
1251 // returns empty info.
getOrCreateDebugLoc(const Instruction * InsertBefore,DISubprogram * SP)1252 static DebugLoc getOrCreateDebugLoc(const Instruction *InsertBefore,
1253 DISubprogram *SP) {
1254 assert(InsertBefore);
1255 if (InsertBefore->getDebugLoc())
1256 return InsertBefore->getDebugLoc();
1257 const Instruction *Prev = InsertBefore->getPrevNode();
1258 if (Prev && Prev->getDebugLoc())
1259 return Prev->getDebugLoc();
1260 if (SP)
1261 return DILocation::get(SP->getContext(), SP->getLine(), 1, SP);
1262 return DebugLoc();
1263 }
1264
runSjLjOnFunction(Function & F)1265 bool WebAssemblyLowerEmscriptenEHSjLj::runSjLjOnFunction(Function &F) {
1266 assert(EnableEmSjLj || EnableWasmSjLj);
1267 Module &M = *F.getParent();
1268 LLVMContext &C = F.getContext();
1269 IRBuilder<> IRB(C);
1270 SmallVector<Instruction *, 64> ToErase;
1271 // Vector of %setjmpTable values
1272 SmallVector<Instruction *, 4> SetjmpTableInsts;
1273 // Vector of %setjmpTableSize values
1274 SmallVector<Instruction *, 4> SetjmpTableSizeInsts;
1275
1276 // Setjmp preparation
1277
1278 // This instruction effectively means %setjmpTableSize = 4.
1279 // We create this as an instruction intentionally, and we don't want to fold
1280 // this instruction to a constant 4, because this value will be used in
1281 // SSAUpdater.AddAvailableValue(...) later.
1282 BasicBlock *Entry = &F.getEntryBlock();
1283 DebugLoc FirstDL = getOrCreateDebugLoc(&*Entry->begin(), F.getSubprogram());
1284 SplitBlock(Entry, &*Entry->getFirstInsertionPt());
1285
1286 BinaryOperator *SetjmpTableSize =
1287 BinaryOperator::Create(Instruction::Add, IRB.getInt32(4), IRB.getInt32(0),
1288 "setjmpTableSize", Entry->getTerminator());
1289 SetjmpTableSize->setDebugLoc(FirstDL);
1290 // setjmpTable = (int *) malloc(40);
1291 Type *IntPtrTy = getAddrIntType(&M);
1292 Constant *size = ConstantInt::get(IntPtrTy, 40);
1293 IRB.SetInsertPoint(SetjmpTableSize);
1294 auto *SetjmpTable = IRB.CreateMalloc(IntPtrTy, IRB.getInt32Ty(), size,
1295 nullptr, nullptr, "setjmpTable");
1296 SetjmpTable->setDebugLoc(FirstDL);
1297 // CallInst::CreateMalloc may return a bitcast instruction if the result types
1298 // mismatch. We need to set the debug loc for the original call too.
1299 auto *MallocCall = SetjmpTable->stripPointerCasts();
1300 if (auto *MallocCallI = dyn_cast<Instruction>(MallocCall)) {
1301 MallocCallI->setDebugLoc(FirstDL);
1302 }
1303 // setjmpTable[0] = 0;
1304 IRB.CreateStore(IRB.getInt32(0), SetjmpTable);
1305 SetjmpTableInsts.push_back(SetjmpTable);
1306 SetjmpTableSizeInsts.push_back(SetjmpTableSize);
1307
1308 // Setjmp transformation
1309 SmallVector<PHINode *, 4> SetjmpRetPHIs;
1310 Function *SetjmpF = M.getFunction("setjmp");
1311 for (auto *U : make_early_inc_range(SetjmpF->users())) {
1312 auto *CB = cast<CallBase>(U);
1313 BasicBlock *BB = CB->getParent();
1314 if (BB->getParent() != &F) // in other function
1315 continue;
1316 if (CB->getOperandBundle(LLVMContext::OB_funclet)) {
1317 std::string S;
1318 raw_string_ostream SS(S);
1319 SS << "In function " + F.getName() +
1320 ": setjmp within a catch clause is not supported in Wasm EH:\n";
1321 SS << *CB;
1322 report_fatal_error(StringRef(SS.str()));
1323 }
1324
1325 CallInst *CI = nullptr;
1326 // setjmp cannot throw. So if it is an invoke, lower it to a call
1327 if (auto *II = dyn_cast<InvokeInst>(CB))
1328 CI = llvm::changeToCall(II);
1329 else
1330 CI = cast<CallInst>(CB);
1331
1332 // The tail is everything right after the call, and will be reached once
1333 // when setjmp is called, and later when longjmp returns to the setjmp
1334 BasicBlock *Tail = SplitBlock(BB, CI->getNextNode());
1335 // Add a phi to the tail, which will be the output of setjmp, which
1336 // indicates if this is the first call or a longjmp back. The phi directly
1337 // uses the right value based on where we arrive from
1338 IRB.SetInsertPoint(Tail, Tail->getFirstNonPHIIt());
1339 PHINode *SetjmpRet = IRB.CreatePHI(IRB.getInt32Ty(), 2, "setjmp.ret");
1340
1341 // setjmp initial call returns 0
1342 SetjmpRet->addIncoming(IRB.getInt32(0), BB);
1343 // The proper output is now this, not the setjmp call itself
1344 CI->replaceAllUsesWith(SetjmpRet);
1345 // longjmp returns to the setjmp will add themselves to this phi
1346 SetjmpRetPHIs.push_back(SetjmpRet);
1347
1348 // Fix call target
1349 // Our index in the function is our place in the array + 1 to avoid index
1350 // 0, because index 0 means the longjmp is not ours to handle.
1351 IRB.SetInsertPoint(CI);
1352 Value *Args[] = {CI->getArgOperand(0), IRB.getInt32(SetjmpRetPHIs.size()),
1353 SetjmpTable, SetjmpTableSize};
1354 Instruction *NewSetjmpTable =
1355 IRB.CreateCall(SaveSetjmpF, Args, "setjmpTable");
1356 Instruction *NewSetjmpTableSize =
1357 IRB.CreateCall(GetTempRet0F, std::nullopt, "setjmpTableSize");
1358 SetjmpTableInsts.push_back(NewSetjmpTable);
1359 SetjmpTableSizeInsts.push_back(NewSetjmpTableSize);
1360 ToErase.push_back(CI);
1361 }
1362
1363 // Handle longjmpable calls.
1364 if (EnableEmSjLj)
1365 handleLongjmpableCallsForEmscriptenSjLj(
1366 F, SetjmpTableInsts, SetjmpTableSizeInsts, SetjmpRetPHIs);
1367 else // EnableWasmSjLj
1368 handleLongjmpableCallsForWasmSjLj(F, SetjmpTableInsts, SetjmpTableSizeInsts,
1369 SetjmpRetPHIs);
1370
1371 // Erase everything we no longer need in this function
1372 for (Instruction *I : ToErase)
1373 I->eraseFromParent();
1374
1375 // Free setjmpTable buffer before each return instruction + function-exiting
1376 // call
1377 SmallVector<Instruction *, 16> ExitingInsts;
1378 for (BasicBlock &BB : F) {
1379 Instruction *TI = BB.getTerminator();
1380 if (isa<ReturnInst>(TI))
1381 ExitingInsts.push_back(TI);
1382 // Any 'call' instruction with 'noreturn' attribute exits the function at
1383 // this point. If this throws but unwinds to another EH pad within this
1384 // function instead of exiting, this would have been an 'invoke', which
1385 // happens if we use Wasm EH or Wasm SjLJ.
1386 for (auto &I : BB) {
1387 if (auto *CI = dyn_cast<CallInst>(&I)) {
1388 bool IsNoReturn = CI->hasFnAttr(Attribute::NoReturn);
1389 if (Function *CalleeF = CI->getCalledFunction())
1390 IsNoReturn |= CalleeF->hasFnAttribute(Attribute::NoReturn);
1391 if (IsNoReturn)
1392 ExitingInsts.push_back(&I);
1393 }
1394 }
1395 }
1396 for (auto *I : ExitingInsts) {
1397 DebugLoc DL = getOrCreateDebugLoc(I, F.getSubprogram());
1398 // If this existing instruction is a call within a catchpad, we should add
1399 // it as "funclet" to the operand bundle of 'free' call
1400 SmallVector<OperandBundleDef, 1> Bundles;
1401 if (auto *CB = dyn_cast<CallBase>(I))
1402 if (auto Bundle = CB->getOperandBundle(LLVMContext::OB_funclet))
1403 Bundles.push_back(OperandBundleDef(*Bundle));
1404 IRB.SetInsertPoint(I);
1405 auto *Free = IRB.CreateFree(SetjmpTable, Bundles);
1406 Free->setDebugLoc(DL);
1407 }
1408
1409 // Every call to saveSetjmp can change setjmpTable and setjmpTableSize
1410 // (when buffer reallocation occurs)
1411 // entry:
1412 // setjmpTableSize = 4;
1413 // setjmpTable = (int *) malloc(40);
1414 // setjmpTable[0] = 0;
1415 // ...
1416 // somebb:
1417 // setjmpTable = saveSetjmp(env, label, setjmpTable, setjmpTableSize);
1418 // setjmpTableSize = getTempRet0();
1419 // So we need to make sure the SSA for these variables is valid so that every
1420 // saveSetjmp and testSetjmp calls have the correct arguments.
1421 SSAUpdater SetjmpTableSSA;
1422 SSAUpdater SetjmpTableSizeSSA;
1423 SetjmpTableSSA.Initialize(PointerType::get(C, 0), "setjmpTable");
1424 SetjmpTableSizeSSA.Initialize(Type::getInt32Ty(C), "setjmpTableSize");
1425 for (Instruction *I : SetjmpTableInsts)
1426 SetjmpTableSSA.AddAvailableValue(I->getParent(), I);
1427 for (Instruction *I : SetjmpTableSizeInsts)
1428 SetjmpTableSizeSSA.AddAvailableValue(I->getParent(), I);
1429
1430 for (auto &U : make_early_inc_range(SetjmpTable->uses()))
1431 if (auto *I = dyn_cast<Instruction>(U.getUser()))
1432 if (I->getParent() != Entry)
1433 SetjmpTableSSA.RewriteUse(U);
1434 for (auto &U : make_early_inc_range(SetjmpTableSize->uses()))
1435 if (auto *I = dyn_cast<Instruction>(U.getUser()))
1436 if (I->getParent() != Entry)
1437 SetjmpTableSizeSSA.RewriteUse(U);
1438
1439 // Finally, our modifications to the cfg can break dominance of SSA variables.
1440 // For example, in this code,
1441 // if (x()) { .. setjmp() .. }
1442 // if (y()) { .. longjmp() .. }
1443 // We must split the longjmp block, and it can jump into the block splitted
1444 // from setjmp one. But that means that when we split the setjmp block, it's
1445 // first part no longer dominates its second part - there is a theoretically
1446 // possible control flow path where x() is false, then y() is true and we
1447 // reach the second part of the setjmp block, without ever reaching the first
1448 // part. So, we rebuild SSA form here.
1449 rebuildSSA(F);
1450 return true;
1451 }
1452
1453 // Update each call that can longjmp so it can return to the corresponding
1454 // setjmp. Refer to 4) of "Emscripten setjmp/longjmp handling" section in the
1455 // comments at top of the file for details.
handleLongjmpableCallsForEmscriptenSjLj(Function & F,InstVector & SetjmpTableInsts,InstVector & SetjmpTableSizeInsts,SmallVectorImpl<PHINode * > & SetjmpRetPHIs)1456 void WebAssemblyLowerEmscriptenEHSjLj::handleLongjmpableCallsForEmscriptenSjLj(
1457 Function &F, InstVector &SetjmpTableInsts, InstVector &SetjmpTableSizeInsts,
1458 SmallVectorImpl<PHINode *> &SetjmpRetPHIs) {
1459 Module &M = *F.getParent();
1460 LLVMContext &C = F.getContext();
1461 IRBuilder<> IRB(C);
1462 SmallVector<Instruction *, 64> ToErase;
1463
1464 // We need to pass setjmpTable and setjmpTableSize to testSetjmp function.
1465 // These values are defined in the beginning of the function and also in each
1466 // setjmp callsite, but we don't know which values we should use at this
1467 // point. So here we arbitraily use the ones defined in the beginning of the
1468 // function, and SSAUpdater will later update them to the correct values.
1469 Instruction *SetjmpTable = *SetjmpTableInsts.begin();
1470 Instruction *SetjmpTableSize = *SetjmpTableSizeInsts.begin();
1471
1472 // call.em.longjmp BB that will be shared within the function.
1473 BasicBlock *CallEmLongjmpBB = nullptr;
1474 // PHI node for the loaded value of __THREW__ global variable in
1475 // call.em.longjmp BB
1476 PHINode *CallEmLongjmpBBThrewPHI = nullptr;
1477 // PHI node for the loaded value of __threwValue global variable in
1478 // call.em.longjmp BB
1479 PHINode *CallEmLongjmpBBThrewValuePHI = nullptr;
1480 // rethrow.exn BB that will be shared within the function.
1481 BasicBlock *RethrowExnBB = nullptr;
1482
1483 // Because we are creating new BBs while processing and don't want to make
1484 // all these newly created BBs candidates again for longjmp processing, we
1485 // first make the vector of candidate BBs.
1486 std::vector<BasicBlock *> BBs;
1487 for (BasicBlock &BB : F)
1488 BBs.push_back(&BB);
1489
1490 // BBs.size() will change within the loop, so we query it every time
1491 for (unsigned I = 0; I < BBs.size(); I++) {
1492 BasicBlock *BB = BBs[I];
1493 for (Instruction &I : *BB) {
1494 if (isa<InvokeInst>(&I)) {
1495 std::string S;
1496 raw_string_ostream SS(S);
1497 SS << "In function " << F.getName()
1498 << ": When using Wasm EH with Emscripten SjLj, there is a "
1499 "restriction that `setjmp` function call and exception cannot be "
1500 "used within the same function:\n";
1501 SS << I;
1502 report_fatal_error(StringRef(SS.str()));
1503 }
1504 auto *CI = dyn_cast<CallInst>(&I);
1505 if (!CI)
1506 continue;
1507
1508 const Value *Callee = CI->getCalledOperand();
1509 if (!canLongjmp(Callee))
1510 continue;
1511 if (isEmAsmCall(Callee))
1512 report_fatal_error("Cannot use EM_ASM* alongside setjmp/longjmp in " +
1513 F.getName() +
1514 ". Please consider using EM_JS, or move the "
1515 "EM_ASM into another function.",
1516 false);
1517
1518 Value *Threw = nullptr;
1519 BasicBlock *Tail;
1520 if (Callee->getName().starts_with("__invoke_")) {
1521 // If invoke wrapper has already been generated for this call in
1522 // previous EH phase, search for the load instruction
1523 // %__THREW__.val = __THREW__;
1524 // in postamble after the invoke wrapper call
1525 LoadInst *ThrewLI = nullptr;
1526 StoreInst *ThrewResetSI = nullptr;
1527 for (auto I = std::next(BasicBlock::iterator(CI)), IE = BB->end();
1528 I != IE; ++I) {
1529 if (auto *LI = dyn_cast<LoadInst>(I))
1530 if (auto *GV = dyn_cast<GlobalVariable>(LI->getPointerOperand()))
1531 if (GV == ThrewGV) {
1532 Threw = ThrewLI = LI;
1533 break;
1534 }
1535 }
1536 // Search for the store instruction after the load above
1537 // __THREW__ = 0;
1538 for (auto I = std::next(BasicBlock::iterator(ThrewLI)), IE = BB->end();
1539 I != IE; ++I) {
1540 if (auto *SI = dyn_cast<StoreInst>(I)) {
1541 if (auto *GV = dyn_cast<GlobalVariable>(SI->getPointerOperand())) {
1542 if (GV == ThrewGV &&
1543 SI->getValueOperand() == getAddrSizeInt(&M, 0)) {
1544 ThrewResetSI = SI;
1545 break;
1546 }
1547 }
1548 }
1549 }
1550 assert(Threw && ThrewLI && "Cannot find __THREW__ load after invoke");
1551 assert(ThrewResetSI && "Cannot find __THREW__ store after invoke");
1552 Tail = SplitBlock(BB, ThrewResetSI->getNextNode());
1553
1554 } else {
1555 // Wrap call with invoke wrapper and generate preamble/postamble
1556 Threw = wrapInvoke(CI);
1557 ToErase.push_back(CI);
1558 Tail = SplitBlock(BB, CI->getNextNode());
1559
1560 // If exception handling is enabled, the thrown value can be not a
1561 // longjmp but an exception, in which case we shouldn't silently ignore
1562 // exceptions; we should rethrow them.
1563 // __THREW__'s value is 0 when nothing happened, 1 when an exception is
1564 // thrown, other values when longjmp is thrown.
1565 //
1566 // if (%__THREW__.val == 1)
1567 // goto %eh.rethrow
1568 // else
1569 // goto %normal
1570 //
1571 // eh.rethrow: ;; Rethrow exception
1572 // %exn = call @__cxa_find_matching_catch_2() ;; Retrieve thrown ptr
1573 // __resumeException(%exn)
1574 //
1575 // normal:
1576 // <-- Insertion point. Will insert sjlj handling code from here
1577 // goto %tail
1578 //
1579 // tail:
1580 // ...
1581 if (supportsException(&F) && canThrow(Callee)) {
1582 // We will add a new conditional branch. So remove the branch created
1583 // when we split the BB
1584 ToErase.push_back(BB->getTerminator());
1585
1586 // Generate rethrow.exn BB once and share it within the function
1587 if (!RethrowExnBB) {
1588 RethrowExnBB = BasicBlock::Create(C, "rethrow.exn", &F);
1589 IRB.SetInsertPoint(RethrowExnBB);
1590 CallInst *Exn =
1591 IRB.CreateCall(getFindMatchingCatch(M, 0), {}, "exn");
1592 IRB.CreateCall(ResumeF, {Exn});
1593 IRB.CreateUnreachable();
1594 }
1595
1596 IRB.SetInsertPoint(CI);
1597 BasicBlock *NormalBB = BasicBlock::Create(C, "normal", &F);
1598 Value *CmpEqOne =
1599 IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 1), "cmp.eq.one");
1600 IRB.CreateCondBr(CmpEqOne, RethrowExnBB, NormalBB);
1601
1602 IRB.SetInsertPoint(NormalBB);
1603 IRB.CreateBr(Tail);
1604 BB = NormalBB; // New insertion point to insert testSetjmp()
1605 }
1606 }
1607
1608 // We need to replace the terminator in Tail - SplitBlock makes BB go
1609 // straight to Tail, we need to check if a longjmp occurred, and go to the
1610 // right setjmp-tail if so
1611 ToErase.push_back(BB->getTerminator());
1612
1613 // Generate a function call to testSetjmp function and preamble/postamble
1614 // code to figure out (1) whether longjmp occurred (2) if longjmp
1615 // occurred, which setjmp it corresponds to
1616 Value *Label = nullptr;
1617 Value *LongjmpResult = nullptr;
1618 BasicBlock *EndBB = nullptr;
1619 wrapTestSetjmp(BB, CI->getDebugLoc(), Threw, SetjmpTable, SetjmpTableSize,
1620 Label, LongjmpResult, CallEmLongjmpBB,
1621 CallEmLongjmpBBThrewPHI, CallEmLongjmpBBThrewValuePHI,
1622 EndBB);
1623 assert(Label && LongjmpResult && EndBB);
1624
1625 // Create switch instruction
1626 IRB.SetInsertPoint(EndBB);
1627 IRB.SetCurrentDebugLocation(EndBB->back().getDebugLoc());
1628 SwitchInst *SI = IRB.CreateSwitch(Label, Tail, SetjmpRetPHIs.size());
1629 // -1 means no longjmp happened, continue normally (will hit the default
1630 // switch case). 0 means a longjmp that is not ours to handle, needs a
1631 // rethrow. Otherwise the index is the same as the index in P+1 (to avoid
1632 // 0).
1633 for (unsigned I = 0; I < SetjmpRetPHIs.size(); I++) {
1634 SI->addCase(IRB.getInt32(I + 1), SetjmpRetPHIs[I]->getParent());
1635 SetjmpRetPHIs[I]->addIncoming(LongjmpResult, EndBB);
1636 }
1637
1638 // We are splitting the block here, and must continue to find other calls
1639 // in the block - which is now split. so continue to traverse in the Tail
1640 BBs.push_back(Tail);
1641 }
1642 }
1643
1644 for (Instruction *I : ToErase)
1645 I->eraseFromParent();
1646 }
1647
getCleanupRetUnwindDest(const CleanupPadInst * CPI)1648 static BasicBlock *getCleanupRetUnwindDest(const CleanupPadInst *CPI) {
1649 for (const User *U : CPI->users())
1650 if (const auto *CRI = dyn_cast<CleanupReturnInst>(U))
1651 return CRI->getUnwindDest();
1652 return nullptr;
1653 }
1654
1655 // Create a catchpad in which we catch a longjmp's env and val arguments, test
1656 // if the longjmp corresponds to one of setjmps in the current function, and if
1657 // so, jump to the setjmp dispatch BB from which we go to one of post-setjmp
1658 // BBs. Refer to 4) of "Wasm setjmp/longjmp handling" section in the comments at
1659 // top of the file for details.
handleLongjmpableCallsForWasmSjLj(Function & F,InstVector & SetjmpTableInsts,InstVector & SetjmpTableSizeInsts,SmallVectorImpl<PHINode * > & SetjmpRetPHIs)1660 void WebAssemblyLowerEmscriptenEHSjLj::handleLongjmpableCallsForWasmSjLj(
1661 Function &F, InstVector &SetjmpTableInsts, InstVector &SetjmpTableSizeInsts,
1662 SmallVectorImpl<PHINode *> &SetjmpRetPHIs) {
1663 Module &M = *F.getParent();
1664 LLVMContext &C = F.getContext();
1665 IRBuilder<> IRB(C);
1666
1667 // A function with catchswitch/catchpad instruction should have a personality
1668 // function attached to it. Search for the wasm personality function, and if
1669 // it exists, use it, and if it doesn't, create a dummy personality function.
1670 // (SjLj is not going to call it anyway.)
1671 if (!F.hasPersonalityFn()) {
1672 StringRef PersName = getEHPersonalityName(EHPersonality::Wasm_CXX);
1673 FunctionType *PersType =
1674 FunctionType::get(IRB.getInt32Ty(), /* isVarArg */ true);
1675 Value *PersF = M.getOrInsertFunction(PersName, PersType).getCallee();
1676 F.setPersonalityFn(
1677 cast<Constant>(IRB.CreateBitCast(PersF, IRB.getPtrTy())));
1678 }
1679
1680 // Use the entry BB's debugloc as a fallback
1681 BasicBlock *Entry = &F.getEntryBlock();
1682 DebugLoc FirstDL = getOrCreateDebugLoc(&*Entry->begin(), F.getSubprogram());
1683 IRB.SetCurrentDebugLocation(FirstDL);
1684
1685 // Arbitrarily use the ones defined in the beginning of the function.
1686 // SSAUpdater will later update them to the correct values.
1687 Instruction *SetjmpTable = *SetjmpTableInsts.begin();
1688 Instruction *SetjmpTableSize = *SetjmpTableSizeInsts.begin();
1689
1690 // Add setjmp.dispatch BB right after the entry block. Because we have
1691 // initialized setjmpTable/setjmpTableSize in the entry block and split the
1692 // rest into another BB, here 'OrigEntry' is the function's original entry
1693 // block before the transformation.
1694 //
1695 // entry:
1696 // setjmpTable / setjmpTableSize initialization
1697 // setjmp.dispatch:
1698 // switch will be inserted here later
1699 // entry.split: (OrigEntry)
1700 // the original function starts here
1701 BasicBlock *OrigEntry = Entry->getNextNode();
1702 BasicBlock *SetjmpDispatchBB =
1703 BasicBlock::Create(C, "setjmp.dispatch", &F, OrigEntry);
1704 cast<BranchInst>(Entry->getTerminator())->setSuccessor(0, SetjmpDispatchBB);
1705
1706 // Create catch.dispatch.longjmp BB and a catchswitch instruction
1707 BasicBlock *CatchDispatchLongjmpBB =
1708 BasicBlock::Create(C, "catch.dispatch.longjmp", &F);
1709 IRB.SetInsertPoint(CatchDispatchLongjmpBB);
1710 CatchSwitchInst *CatchSwitchLongjmp =
1711 IRB.CreateCatchSwitch(ConstantTokenNone::get(C), nullptr, 1);
1712
1713 // Create catch.longjmp BB and a catchpad instruction
1714 BasicBlock *CatchLongjmpBB = BasicBlock::Create(C, "catch.longjmp", &F);
1715 CatchSwitchLongjmp->addHandler(CatchLongjmpBB);
1716 IRB.SetInsertPoint(CatchLongjmpBB);
1717 CatchPadInst *CatchPad = IRB.CreateCatchPad(CatchSwitchLongjmp, {});
1718
1719 // Wasm throw and catch instructions can throw and catch multiple values, but
1720 // that requires multivalue support in the toolchain, which is currently not
1721 // very reliable. We instead throw and catch a pointer to a struct value of
1722 // type 'struct __WasmLongjmpArgs', which is defined in Emscripten.
1723 Instruction *LongjmpArgs =
1724 IRB.CreateCall(CatchF, {IRB.getInt32(WebAssembly::C_LONGJMP)}, "thrown");
1725 Value *EnvField =
1726 IRB.CreateConstGEP2_32(LongjmpArgsTy, LongjmpArgs, 0, 0, "env_gep");
1727 Value *ValField =
1728 IRB.CreateConstGEP2_32(LongjmpArgsTy, LongjmpArgs, 0, 1, "val_gep");
1729 // void *env = __wasm_longjmp_args.env;
1730 Instruction *Env = IRB.CreateLoad(IRB.getPtrTy(), EnvField, "env");
1731 // int val = __wasm_longjmp_args.val;
1732 Instruction *Val = IRB.CreateLoad(IRB.getInt32Ty(), ValField, "val");
1733
1734 // %label = testSetjmp(mem[%env], setjmpTable, setjmpTableSize);
1735 // if (%label == 0)
1736 // __wasm_longjmp(%env, %val)
1737 // catchret to %setjmp.dispatch
1738 BasicBlock *ThenBB = BasicBlock::Create(C, "if.then", &F);
1739 BasicBlock *EndBB = BasicBlock::Create(C, "if.end", &F);
1740 Value *EnvP = IRB.CreateBitCast(Env, getAddrPtrType(&M), "env.p");
1741 Value *SetjmpID = IRB.CreateLoad(getAddrIntType(&M), EnvP, "setjmp.id");
1742 Value *Label =
1743 IRB.CreateCall(TestSetjmpF, {SetjmpID, SetjmpTable, SetjmpTableSize},
1744 OperandBundleDef("funclet", CatchPad), "label");
1745 Value *Cmp = IRB.CreateICmpEQ(Label, IRB.getInt32(0));
1746 IRB.CreateCondBr(Cmp, ThenBB, EndBB);
1747
1748 IRB.SetInsertPoint(ThenBB);
1749 CallInst *WasmLongjmpCI = IRB.CreateCall(
1750 WasmLongjmpF, {Env, Val}, OperandBundleDef("funclet", CatchPad));
1751 IRB.CreateUnreachable();
1752
1753 IRB.SetInsertPoint(EndBB);
1754 // Jump to setjmp.dispatch block
1755 IRB.CreateCatchRet(CatchPad, SetjmpDispatchBB);
1756
1757 // Go back to setjmp.dispatch BB
1758 // setjmp.dispatch:
1759 // switch %label {
1760 // label 1: goto post-setjmp BB 1
1761 // label 2: goto post-setjmp BB 2
1762 // ...
1763 // default: goto splitted next BB
1764 // }
1765 IRB.SetInsertPoint(SetjmpDispatchBB);
1766 PHINode *LabelPHI = IRB.CreatePHI(IRB.getInt32Ty(), 2, "label.phi");
1767 LabelPHI->addIncoming(Label, EndBB);
1768 LabelPHI->addIncoming(IRB.getInt32(-1), Entry);
1769 SwitchInst *SI = IRB.CreateSwitch(LabelPHI, OrigEntry, SetjmpRetPHIs.size());
1770 // -1 means no longjmp happened, continue normally (will hit the default
1771 // switch case). 0 means a longjmp that is not ours to handle, needs a
1772 // rethrow. Otherwise the index is the same as the index in P+1 (to avoid
1773 // 0).
1774 for (unsigned I = 0; I < SetjmpRetPHIs.size(); I++) {
1775 SI->addCase(IRB.getInt32(I + 1), SetjmpRetPHIs[I]->getParent());
1776 SetjmpRetPHIs[I]->addIncoming(Val, SetjmpDispatchBB);
1777 }
1778
1779 // Convert all longjmpable call instructions to invokes that unwind to the
1780 // newly created catch.dispatch.longjmp BB.
1781 SmallVector<CallInst *, 64> LongjmpableCalls;
1782 for (auto *BB = &*F.begin(); BB; BB = BB->getNextNode()) {
1783 for (auto &I : *BB) {
1784 auto *CI = dyn_cast<CallInst>(&I);
1785 if (!CI)
1786 continue;
1787 const Value *Callee = CI->getCalledOperand();
1788 if (!canLongjmp(Callee))
1789 continue;
1790 if (isEmAsmCall(Callee))
1791 report_fatal_error("Cannot use EM_ASM* alongside setjmp/longjmp in " +
1792 F.getName() +
1793 ". Please consider using EM_JS, or move the "
1794 "EM_ASM into another function.",
1795 false);
1796 // This is __wasm_longjmp() call we inserted in this function, which
1797 // rethrows the longjmp when the longjmp does not correspond to one of
1798 // setjmps in this function. We should not convert this call to an invoke.
1799 if (CI == WasmLongjmpCI)
1800 continue;
1801 LongjmpableCalls.push_back(CI);
1802 }
1803 }
1804
1805 for (auto *CI : LongjmpableCalls) {
1806 // Even if the callee function has attribute 'nounwind', which is true for
1807 // all C functions, it can longjmp, which means it can throw a Wasm
1808 // exception now.
1809 CI->removeFnAttr(Attribute::NoUnwind);
1810 if (Function *CalleeF = CI->getCalledFunction())
1811 CalleeF->removeFnAttr(Attribute::NoUnwind);
1812
1813 // Change it to an invoke and make it unwind to the catch.dispatch.longjmp
1814 // BB. If the call is enclosed in another catchpad/cleanuppad scope, unwind
1815 // to its parent pad's unwind destination instead to preserve the scope
1816 // structure. It will eventually unwind to the catch.dispatch.longjmp.
1817 SmallVector<OperandBundleDef, 1> Bundles;
1818 BasicBlock *UnwindDest = nullptr;
1819 if (auto Bundle = CI->getOperandBundle(LLVMContext::OB_funclet)) {
1820 Instruction *FromPad = cast<Instruction>(Bundle->Inputs[0]);
1821 while (!UnwindDest) {
1822 if (auto *CPI = dyn_cast<CatchPadInst>(FromPad)) {
1823 UnwindDest = CPI->getCatchSwitch()->getUnwindDest();
1824 break;
1825 }
1826 if (auto *CPI = dyn_cast<CleanupPadInst>(FromPad)) {
1827 // getCleanupRetUnwindDest() can return nullptr when
1828 // 1. This cleanuppad's matching cleanupret uwninds to caller
1829 // 2. There is no matching cleanupret because it ends with
1830 // unreachable.
1831 // In case of 2, we need to traverse the parent pad chain.
1832 UnwindDest = getCleanupRetUnwindDest(CPI);
1833 Value *ParentPad = CPI->getParentPad();
1834 if (isa<ConstantTokenNone>(ParentPad))
1835 break;
1836 FromPad = cast<Instruction>(ParentPad);
1837 }
1838 }
1839 }
1840 if (!UnwindDest)
1841 UnwindDest = CatchDispatchLongjmpBB;
1842 changeToInvokeAndSplitBasicBlock(CI, UnwindDest);
1843 }
1844
1845 SmallVector<Instruction *, 16> ToErase;
1846 for (auto &BB : F) {
1847 if (auto *CSI = dyn_cast<CatchSwitchInst>(BB.getFirstNonPHI())) {
1848 if (CSI != CatchSwitchLongjmp && CSI->unwindsToCaller()) {
1849 IRB.SetInsertPoint(CSI);
1850 ToErase.push_back(CSI);
1851 auto *NewCSI = IRB.CreateCatchSwitch(CSI->getParentPad(),
1852 CatchDispatchLongjmpBB, 1);
1853 NewCSI->addHandler(*CSI->handler_begin());
1854 NewCSI->takeName(CSI);
1855 CSI->replaceAllUsesWith(NewCSI);
1856 }
1857 }
1858
1859 if (auto *CRI = dyn_cast<CleanupReturnInst>(BB.getTerminator())) {
1860 if (CRI->unwindsToCaller()) {
1861 IRB.SetInsertPoint(CRI);
1862 ToErase.push_back(CRI);
1863 IRB.CreateCleanupRet(CRI->getCleanupPad(), CatchDispatchLongjmpBB);
1864 }
1865 }
1866 }
1867
1868 for (Instruction *I : ToErase)
1869 I->eraseFromParent();
1870 }
1871