root/lj_asm.c

/* [<][>][^][v][top][bottom][index][help] */

DEFINITIONS

This source file includes following definitions.
  1. asm_mclimit
  2. checkmclim
  3. ra_setkref
  4. ra_dstart
  5. ra_dflush
  6. ra_dprintf
  7. ra_setup
  8. ra_rematk
  9. ra_spill
  10. ra_releasetmp
  11. ra_restore
  12. ra_save
  13. ra_evict
  14. ra_pick
  15. ra_scratch
  16. ra_evictset
  17. ra_evictk
  18. ra_allock
  19. ra_allockreg
  20. ra_allocref
  21. ra_alloc1
  22. ra_rename
  23. ra_dest
  24. ra_destreg
  25. ra_left
  26. ra_leftov
  27. ra_destpair
  28. asm_snap_canremat
  29. asm_sunk_store
  30. asm_snap_alloc1
  31. asm_snap_alloc
  32. asm_snap_checkrename
  33. asm_snap_prep
  34. asm_collectargs
  35. asm_callx_flags
  36. asm_stack_adjust
  37. ir_khash
  38. asm_snew
  39. asm_tnew
  40. asm_tdup
  41. asm_gcstep
  42. asm_phi_break
  43. asm_phi_shuffle
  44. asm_phi_copyspill
  45. asm_phi_fixup
  46. asm_phi
  47. asm_loop
  48. asm_head_root
  49. asm_head_side
  50. asm_baseslot
  51. asm_tail_link
  52. asm_setup_regsp
  53. lj_asm_trace

   1 /*
   2 ** IR assembler (SSA IR -> machine code).
   3 ** Copyright (C) 2005-2017 Mike Pall. See Copyright Notice in luajit.h
   4 */
   5 
   6 #define lj_asm_c
   7 #define LUA_CORE
   8 
   9 #include "lj_obj.h"
  10 
  11 #if LJ_HASJIT
  12 
  13 #include "lj_gc.h"
  14 #include "lj_str.h"
  15 #include "lj_tab.h"
  16 #include "lj_frame.h"
  17 #if LJ_HASFFI
  18 #include "lj_ctype.h"
  19 #endif
  20 #include "lj_ir.h"
  21 #include "lj_jit.h"
  22 #include "lj_ircall.h"
  23 #include "lj_iropt.h"
  24 #include "lj_mcode.h"
  25 #include "lj_iropt.h"
  26 #include "lj_trace.h"
  27 #include "lj_snap.h"
  28 #include "lj_asm.h"
  29 #include "lj_dispatch.h"
  30 #include "lj_vm.h"
  31 #include "lj_target.h"
  32 
  33 #ifdef LUA_USE_ASSERT
  34 #include <stdio.h>
  35 #endif
  36 
  37 /* -- Assembler state and common macros ----------------------------------- */
  38 
  39 /* Assembler state. */
  40 typedef struct ASMState {
  41   RegCost cost[RID_MAX];  /* Reference and blended allocation cost for regs. */
  42 
  43   MCode *mcp;           /* Current MCode pointer (grows down). */
  44   MCode *mclim;         /* Lower limit for MCode memory + red zone. */
  45 #ifdef LUA_USE_ASSERT
  46   MCode *mcp_prev;      /* Red zone overflow check. */
  47 #endif
  48 
  49   IRIns *ir;            /* Copy of pointer to IR instructions/constants. */
  50   jit_State *J;         /* JIT compiler state. */
  51 
  52 #if LJ_TARGET_X86ORX64
  53   x86ModRM mrm;         /* Fused x86 address operand. */
  54 #endif
  55 
  56   RegSet freeset;       /* Set of free registers. */
  57   RegSet modset;        /* Set of registers modified inside the loop. */
  58   RegSet weakset;       /* Set of weakly referenced registers. */
  59   RegSet phiset;        /* Set of PHI registers. */
  60 
  61   uint32_t flags;       /* Copy of JIT compiler flags. */
  62   int loopinv;          /* Loop branch inversion (0:no, 1:yes, 2:yes+CC_P). */
  63 
  64   int32_t evenspill;    /* Next even spill slot. */
  65   int32_t oddspill;     /* Next odd spill slot (or 0). */
  66 
  67   IRRef curins;         /* Reference of current instruction. */
  68   IRRef stopins;        /* Stop assembly before hitting this instruction. */
  69   IRRef orignins;       /* Original T->nins. */
  70 
  71   IRRef snapref;        /* Current snapshot is active after this reference. */
  72   IRRef snaprename;     /* Rename highwater mark for snapshot check. */
  73   SnapNo snapno;        /* Current snapshot number. */
  74   SnapNo loopsnapno;    /* Loop snapshot number. */
  75 
  76   IRRef fuseref;        /* Fusion limit (loopref, 0 or FUSE_DISABLED). */
  77   IRRef sectref;        /* Section base reference (loopref or 0). */
  78   IRRef loopref;        /* Reference of LOOP instruction (or 0). */
  79 
  80   BCReg topslot;        /* Number of slots for stack check (unless 0). */
  81   int32_t gcsteps;      /* Accumulated number of GC steps (per section). */
  82 
  83   GCtrace *T;           /* Trace to assemble. */
  84   GCtrace *parent;      /* Parent trace (or NULL). */
  85 
  86   MCode *mcbot;         /* Bottom of reserved MCode. */
  87   MCode *mctop;         /* Top of generated MCode. */
  88   MCode *mcloop;        /* Pointer to loop MCode (or NULL). */
  89   MCode *invmcp;        /* Points to invertible loop branch (or NULL). */
  90   MCode *flagmcp;       /* Pending opportunity to merge flag setting ins. */
  91   MCode *realign;       /* Realign loop if not NULL. */
  92 
  93 #ifdef RID_NUM_KREF
  94   int32_t krefk[RID_NUM_KREF];
  95 #endif
  96   IRRef1 phireg[RID_MAX];  /* PHI register references. */
  97   uint16_t parentmap[LJ_MAX_JSLOTS];  /* Parent instruction to RegSP map. */
  98 } ASMState;
  99 
 100 #define IR(ref)                 (&as->ir[(ref)])
 101 
 102 #define ASMREF_TMP1             REF_TRUE        /* Temp. register. */
 103 #define ASMREF_TMP2             REF_FALSE       /* Temp. register. */
 104 #define ASMREF_L                REF_NIL         /* Stores register for L. */
 105 
 106 /* Check for variant to invariant references. */
 107 #define iscrossref(as, ref)     ((ref) < as->sectref)
 108 
 109 /* Inhibit memory op fusion from variant to invariant references. */
 110 #define FUSE_DISABLED           (~(IRRef)0)
 111 #define mayfuse(as, ref)        ((ref) > as->fuseref)
 112 #define neverfuse(as)           (as->fuseref == FUSE_DISABLED)
 113 #define canfuse(as, ir)         (!neverfuse(as) && !irt_isphi((ir)->t))
 114 #define opisfusableload(o) \
 115   ((o) == IR_ALOAD || (o) == IR_HLOAD || (o) == IR_ULOAD || \
 116    (o) == IR_FLOAD || (o) == IR_XLOAD || (o) == IR_SLOAD || (o) == IR_VLOAD)
 117 
 118 /* Sparse limit checks using a red zone before the actual limit. */
 119 #define MCLIM_REDZONE   64
 120 
 121 static LJ_NORET LJ_NOINLINE void asm_mclimit(ASMState *as)
 122 {
 123   lj_mcode_limiterr(as->J, (size_t)(as->mctop - as->mcp + 4*MCLIM_REDZONE));
 124 }
 125 
 126 static LJ_AINLINE void checkmclim(ASMState *as)
 127 {
 128 #ifdef LUA_USE_ASSERT
 129   if (as->mcp + MCLIM_REDZONE < as->mcp_prev) {
 130     IRIns *ir = IR(as->curins+1);
 131     fprintf(stderr, "RED ZONE OVERFLOW: %p IR %04d  %02d %04d %04d\n", as->mcp,
 132             as->curins+1-REF_BIAS, ir->o, ir->op1-REF_BIAS, ir->op2-REF_BIAS);
 133     lua_assert(0);
 134   }
 135 #endif
 136   if (LJ_UNLIKELY(as->mcp < as->mclim)) asm_mclimit(as);
 137 #ifdef LUA_USE_ASSERT
 138   as->mcp_prev = as->mcp;
 139 #endif
 140 }
 141 
 142 #ifdef RID_NUM_KREF
 143 #define ra_iskref(ref)          ((ref) < RID_NUM_KREF)
 144 #define ra_krefreg(ref)         ((Reg)(RID_MIN_KREF + (Reg)(ref)))
 145 #define ra_krefk(as, ref)       (as->krefk[(ref)])
 146 
 147 static LJ_AINLINE void ra_setkref(ASMState *as, Reg r, int32_t k)
 148 {
 149   IRRef ref = (IRRef)(r - RID_MIN_KREF);
 150   as->krefk[ref] = k;
 151   as->cost[r] = REGCOST(ref, ref);
 152 }
 153 
 154 #else
 155 #define ra_iskref(ref)          0
 156 #define ra_krefreg(ref)         RID_MIN_GPR
 157 #define ra_krefk(as, ref)       0
 158 #endif
 159 
 160 /* Arch-specific field offsets. */
 161 static const uint8_t field_ofs[IRFL__MAX+1] = {
 162 #define FLOFS(name, ofs)        (uint8_t)(ofs),
 163 IRFLDEF(FLOFS)
 164 #undef FLOFS
 165   0
 166 };
 167 
 168 /* -- Target-specific instruction emitter --------------------------------- */
 169 
 170 #if LJ_TARGET_X86ORX64
 171 #include "lj_emit_x86.h"
 172 #elif LJ_TARGET_ARM
 173 #include "lj_emit_arm.h"
 174 #elif LJ_TARGET_PPC
 175 #include "lj_emit_ppc.h"
 176 #elif LJ_TARGET_MIPS
 177 #include "lj_emit_mips.h"
 178 #else
 179 #error "Missing instruction emitter for target CPU"
 180 #endif
 181 
 182 /* -- Register allocator debugging ---------------------------------------- */
 183 
 184 /* #define LUAJIT_DEBUG_RA */
 185 
 186 #ifdef LUAJIT_DEBUG_RA
 187 
 188 #include <stdio.h>
 189 #include <stdarg.h>
 190 
 191 #define RIDNAME(name)   #name,
 192 static const char *const ra_regname[] = {
 193   GPRDEF(RIDNAME)
 194   FPRDEF(RIDNAME)
 195   VRIDDEF(RIDNAME)
 196   NULL
 197 };
 198 #undef RIDNAME
 199 
 200 static char ra_dbg_buf[65536];
 201 static char *ra_dbg_p;
 202 static char *ra_dbg_merge;
 203 static MCode *ra_dbg_mcp;
 204 
 205 static void ra_dstart(void)
 206 {
 207   ra_dbg_p = ra_dbg_buf;
 208   ra_dbg_merge = NULL;
 209   ra_dbg_mcp = NULL;
 210 }
 211 
 212 static void ra_dflush(void)
 213 {
 214   fwrite(ra_dbg_buf, 1, (size_t)(ra_dbg_p-ra_dbg_buf), stdout);
 215   ra_dstart();
 216 }
 217 
 218 static void ra_dprintf(ASMState *as, const char *fmt, ...)
 219 {
 220   char *p;
 221   va_list argp;
 222   va_start(argp, fmt);
 223   p = ra_dbg_mcp == as->mcp ? ra_dbg_merge : ra_dbg_p;
 224   ra_dbg_mcp = NULL;
 225   p += sprintf(p, "%08x  \e[36m%04d ", (uintptr_t)as->mcp, as->curins-REF_BIAS);
 226   for (;;) {
 227     const char *e = strchr(fmt, '$');
 228     if (e == NULL) break;
 229     memcpy(p, fmt, (size_t)(e-fmt));
 230     p += e-fmt;
 231     if (e[1] == 'r') {
 232       Reg r = va_arg(argp, Reg) & RID_MASK;
 233       if (r <= RID_MAX) {
 234         const char *q;
 235         for (q = ra_regname[r]; *q; q++)
 236           *p++ = *q >= 'A' && *q <= 'Z' ? *q + 0x20 : *q;
 237       } else {
 238         *p++ = '?';
 239         lua_assert(0);
 240       }
 241     } else if (e[1] == 'f' || e[1] == 'i') {
 242       IRRef ref;
 243       if (e[1] == 'f')
 244         ref = va_arg(argp, IRRef);
 245       else
 246         ref = va_arg(argp, IRIns *) - as->ir;
 247       if (ref >= REF_BIAS)
 248         p += sprintf(p, "%04d", ref - REF_BIAS);
 249       else
 250         p += sprintf(p, "K%03d", REF_BIAS - ref);
 251     } else if (e[1] == 's') {
 252       uint32_t slot = va_arg(argp, uint32_t);
 253       p += sprintf(p, "[sp+0x%x]", sps_scale(slot));
 254     } else if (e[1] == 'x') {
 255       p += sprintf(p, "%08x", va_arg(argp, int32_t));
 256     } else {
 257       lua_assert(0);
 258     }
 259     fmt = e+2;
 260   }
 261   va_end(argp);
 262   while (*fmt)
 263     *p++ = *fmt++;
 264   *p++ = '\e'; *p++ = '['; *p++ = 'm'; *p++ = '\n';
 265   if (p > ra_dbg_buf+sizeof(ra_dbg_buf)-256) {
 266     fwrite(ra_dbg_buf, 1, (size_t)(p-ra_dbg_buf), stdout);
 267     p = ra_dbg_buf;
 268   }
 269   ra_dbg_p = p;
 270 }
 271 
 272 #define RA_DBG_START()  ra_dstart()
 273 #define RA_DBG_FLUSH()  ra_dflush()
 274 #define RA_DBG_REF() \
 275   do { char *_p = ra_dbg_p; ra_dprintf(as, ""); \
 276        ra_dbg_merge = _p; ra_dbg_mcp = as->mcp; } while (0)
 277 #define RA_DBGX(x)      ra_dprintf x
 278 
 279 #else
 280 #define RA_DBG_START()  ((void)0)
 281 #define RA_DBG_FLUSH()  ((void)0)
 282 #define RA_DBG_REF()    ((void)0)
 283 #define RA_DBGX(x)      ((void)0)
 284 #endif
 285 
 286 /* -- Register allocator -------------------------------------------------- */
 287 
 288 #define ra_free(as, r)          rset_set(as->freeset, (r))
 289 #define ra_modified(as, r)      rset_set(as->modset, (r))
 290 #define ra_weak(as, r)          rset_set(as->weakset, (r))
 291 #define ra_noweak(as, r)        rset_clear(as->weakset, (r))
 292 
 293 #define ra_used(ir)             (ra_hasreg((ir)->r) || ra_hasspill((ir)->s))
 294 
 295 /* Setup register allocator. */
 296 static void ra_setup(ASMState *as)
 297 {
 298   Reg r;
 299   /* Initially all regs (except the stack pointer) are free for use. */
 300   as->freeset = RSET_INIT;
 301   as->modset = RSET_EMPTY;
 302   as->weakset = RSET_EMPTY;
 303   as->phiset = RSET_EMPTY;
 304   memset(as->phireg, 0, sizeof(as->phireg));
 305   for (r = RID_MIN_GPR; r < RID_MAX; r++)
 306     as->cost[r] = REGCOST(~0u, 0u);
 307 }
 308 
 309 /* Rematerialize constants. */
 310 static Reg ra_rematk(ASMState *as, IRRef ref)
 311 {
 312   IRIns *ir;
 313   Reg r;
 314   if (ra_iskref(ref)) {
 315     r = ra_krefreg(ref);
 316     lua_assert(!rset_test(as->freeset, r));
 317     ra_free(as, r);
 318     ra_modified(as, r);
 319     emit_loadi(as, r, ra_krefk(as, ref));
 320     return r;
 321   }
 322   ir = IR(ref);
 323   r = ir->r;
 324   lua_assert(ra_hasreg(r) && !ra_hasspill(ir->s));
 325   ra_free(as, r);
 326   ra_modified(as, r);
 327   ir->r = RID_INIT;  /* Do not keep any hint. */
 328   RA_DBGX((as, "remat     $i $r", ir, r));
 329 #if !LJ_SOFTFP
 330   if (ir->o == IR_KNUM) {
 331     emit_loadn(as, r, ir_knum(ir));
 332   } else
 333 #endif
 334   if (emit_canremat(REF_BASE) && ir->o == IR_BASE) {
 335     ra_sethint(ir->r, RID_BASE);  /* Restore BASE register hint. */
 336     emit_getgl(as, r, jit_base);
 337   } else if (emit_canremat(ASMREF_L) && ir->o == IR_KPRI) {
 338     lua_assert(irt_isnil(ir->t));  /* REF_NIL stores ASMREF_L register. */
 339     emit_getgl(as, r, jit_L);
 340 #if LJ_64
 341   } else if (ir->o == IR_KINT64) {
 342     emit_loadu64(as, r, ir_kint64(ir)->u64);
 343 #endif
 344   } else {
 345     lua_assert(ir->o == IR_KINT || ir->o == IR_KGC ||
 346                ir->o == IR_KPTR || ir->o == IR_KKPTR || ir->o == IR_KNULL);
 347     emit_loadi(as, r, ir->i);
 348   }
 349   return r;
 350 }
 351 
 352 /* Force a spill. Allocate a new spill slot if needed. */
 353 static int32_t ra_spill(ASMState *as, IRIns *ir)
 354 {
 355   int32_t slot = ir->s;
 356   lua_assert(ir >= as->ir + REF_TRUE);
 357   if (!ra_hasspill(slot)) {
 358     if (irt_is64(ir->t)) {
 359       slot = as->evenspill;
 360       as->evenspill += 2;
 361     } else if (as->oddspill) {
 362       slot = as->oddspill;
 363       as->oddspill = 0;
 364     } else {
 365       slot = as->evenspill;
 366       as->oddspill = slot+1;
 367       as->evenspill += 2;
 368     }
 369     if (as->evenspill > 256)
 370       lj_trace_err(as->J, LJ_TRERR_SPILLOV);
 371     ir->s = (uint8_t)slot;
 372   }
 373   return sps_scale(slot);
 374 }
 375 
 376 /* Release the temporarily allocated register in ASMREF_TMP1/ASMREF_TMP2. */
 377 static Reg ra_releasetmp(ASMState *as, IRRef ref)
 378 {
 379   IRIns *ir = IR(ref);
 380   Reg r = ir->r;
 381   lua_assert(ra_hasreg(r) && !ra_hasspill(ir->s));
 382   ra_free(as, r);
 383   ra_modified(as, r);
 384   ir->r = RID_INIT;
 385   return r;
 386 }
 387 
 388 /* Restore a register (marked as free). Rematerialize or force a spill. */
 389 static Reg ra_restore(ASMState *as, IRRef ref)
 390 {
 391   if (emit_canremat(ref)) {
 392     return ra_rematk(as, ref);
 393   } else {
 394     IRIns *ir = IR(ref);
 395     int32_t ofs = ra_spill(as, ir);  /* Force a spill slot. */
 396     Reg r = ir->r;
 397     lua_assert(ra_hasreg(r));
 398     ra_sethint(ir->r, r);  /* Keep hint. */
 399     ra_free(as, r);
 400     if (!rset_test(as->weakset, r)) {  /* Only restore non-weak references. */
 401       ra_modified(as, r);
 402       RA_DBGX((as, "restore   $i $r", ir, r));
 403       emit_spload(as, ir, r, ofs);
 404     }
 405     return r;
 406   }
 407 }
 408 
 409 /* Save a register to a spill slot. */
 410 static void ra_save(ASMState *as, IRIns *ir, Reg r)
 411 {
 412   RA_DBGX((as, "save      $i $r", ir, r));
 413   emit_spstore(as, ir, r, sps_scale(ir->s));
 414 }
 415 
 416 #define MINCOST(name) \
 417   if (rset_test(RSET_ALL, RID_##name) && \
 418       LJ_LIKELY(allow&RID2RSET(RID_##name)) && as->cost[RID_##name] < cost) \
 419     cost = as->cost[RID_##name];
 420 
 421 /* Evict the register with the lowest cost, forcing a restore. */
 422 static Reg ra_evict(ASMState *as, RegSet allow)
 423 {
 424   IRRef ref;
 425   RegCost cost = ~(RegCost)0;
 426   lua_assert(allow != RSET_EMPTY);
 427   if (RID_NUM_FPR == 0 || allow < RID2RSET(RID_MAX_GPR)) {
 428     GPRDEF(MINCOST)
 429   } else {
 430     FPRDEF(MINCOST)
 431   }
 432   ref = regcost_ref(cost);
 433   lua_assert(ra_iskref(ref) || (ref >= as->T->nk && ref < as->T->nins));
 434   /* Preferably pick any weak ref instead of a non-weak, non-const ref. */
 435   if (!irref_isk(ref) && (as->weakset & allow)) {
 436     IRIns *ir = IR(ref);
 437     if (!rset_test(as->weakset, ir->r))
 438       ref = regcost_ref(as->cost[rset_pickbot((as->weakset & allow))]);
 439   }
 440   return ra_restore(as, ref);
 441 }
 442 
 443 /* Pick any register (marked as free). Evict on-demand. */
 444 static Reg ra_pick(ASMState *as, RegSet allow)
 445 {
 446   RegSet pick = as->freeset & allow;
 447   if (!pick)
 448     return ra_evict(as, allow);
 449   else
 450     return rset_picktop(pick);
 451 }
 452 
 453 /* Get a scratch register (marked as free). */
 454 static Reg ra_scratch(ASMState *as, RegSet allow)
 455 {
 456   Reg r = ra_pick(as, allow);
 457   ra_modified(as, r);
 458   RA_DBGX((as, "scratch        $r", r));
 459   return r;
 460 }
 461 
 462 /* Evict all registers from a set (if not free). */
 463 static void ra_evictset(ASMState *as, RegSet drop)
 464 {
 465   RegSet work;
 466   as->modset |= drop;
 467 #if !LJ_SOFTFP
 468   work = (drop & ~as->freeset) & RSET_FPR;
 469   while (work) {
 470     Reg r = rset_pickbot(work);
 471     ra_restore(as, regcost_ref(as->cost[r]));
 472     rset_clear(work, r);
 473     checkmclim(as);
 474   }
 475 #endif
 476   work = (drop & ~as->freeset);
 477   while (work) {
 478     Reg r = rset_pickbot(work);
 479     ra_restore(as, regcost_ref(as->cost[r]));
 480     rset_clear(work, r);
 481     checkmclim(as);
 482   }
 483 }
 484 
 485 /* Evict (rematerialize) all registers allocated to constants. */
 486 static void ra_evictk(ASMState *as)
 487 {
 488   RegSet work;
 489 #if !LJ_SOFTFP
 490   work = ~as->freeset & RSET_FPR;
 491   while (work) {
 492     Reg r = rset_pickbot(work);
 493     IRRef ref = regcost_ref(as->cost[r]);
 494     if (emit_canremat(ref) && irref_isk(ref)) {
 495       ra_rematk(as, ref);
 496       checkmclim(as);
 497     }
 498     rset_clear(work, r);
 499   }
 500 #endif
 501   work = ~as->freeset & RSET_GPR;
 502   while (work) {
 503     Reg r = rset_pickbot(work);
 504     IRRef ref = regcost_ref(as->cost[r]);
 505     if (emit_canremat(ref) && irref_isk(ref)) {
 506       ra_rematk(as, ref);
 507       checkmclim(as);
 508     }
 509     rset_clear(work, r);
 510   }
 511 }
 512 
 513 #ifdef RID_NUM_KREF
 514 /* Allocate a register for a constant. */
 515 static Reg ra_allock(ASMState *as, int32_t k, RegSet allow)
 516 {
 517   /* First try to find a register which already holds the same constant. */
 518   RegSet pick, work = ~as->freeset & RSET_GPR;
 519   Reg r;
 520   while (work) {
 521     IRRef ref;
 522     r = rset_pickbot(work);
 523     ref = regcost_ref(as->cost[r]);
 524     if (ref < ASMREF_L &&
 525         k == (ra_iskref(ref) ? ra_krefk(as, ref) : IR(ref)->i))
 526       return r;
 527     rset_clear(work, r);
 528   }
 529   pick = as->freeset & allow;
 530   if (pick) {
 531     /* Constants should preferably get unmodified registers. */
 532     if ((pick & ~as->modset))
 533       pick &= ~as->modset;
 534     r = rset_pickbot(pick);  /* Reduce conflicts with inverse allocation. */
 535   } else {
 536     r = ra_evict(as, allow);
 537   }
 538   RA_DBGX((as, "allock    $x $r", k, r));
 539   ra_setkref(as, r, k);
 540   rset_clear(as->freeset, r);
 541   ra_noweak(as, r);
 542   return r;
 543 }
 544 
 545 /* Allocate a specific register for a constant. */
 546 static void ra_allockreg(ASMState *as, int32_t k, Reg r)
 547 {
 548   Reg kr = ra_allock(as, k, RID2RSET(r));
 549   if (kr != r) {
 550     IRIns irdummy;
 551     irdummy.t.irt = IRT_INT;
 552     ra_scratch(as, RID2RSET(r));
 553     emit_movrr(as, &irdummy, r, kr);
 554   }
 555 }
 556 #else
 557 #define ra_allockreg(as, k, r)          emit_loadi(as, (r), (k))
 558 #endif
 559 
 560 /* Allocate a register for ref from the allowed set of registers.
 561 ** Note: this function assumes the ref does NOT have a register yet!
 562 ** Picks an optimal register, sets the cost and marks the register as non-free.
 563 */
 564 static Reg ra_allocref(ASMState *as, IRRef ref, RegSet allow)
 565 {
 566   IRIns *ir = IR(ref);
 567   RegSet pick = as->freeset & allow;
 568   Reg r;
 569   lua_assert(ra_noreg(ir->r));
 570   if (pick) {
 571     /* First check register hint from propagation or PHI. */
 572     if (ra_hashint(ir->r)) {
 573       r = ra_gethint(ir->r);
 574       if (rset_test(pick, r))  /* Use hint register if possible. */
 575         goto found;
 576       /* Rematerialization is cheaper than missing a hint. */
 577       if (rset_test(allow, r) && emit_canremat(regcost_ref(as->cost[r]))) {
 578         ra_rematk(as, regcost_ref(as->cost[r]));
 579         goto found;
 580       }
 581       RA_DBGX((as, "hintmiss  $f $r", ref, r));
 582     }
 583     /* Invariants should preferably get unmodified registers. */
 584     if (ref < as->loopref && !irt_isphi(ir->t)) {
 585       if ((pick & ~as->modset))
 586         pick &= ~as->modset;
 587       r = rset_pickbot(pick);  /* Reduce conflicts with inverse allocation. */
 588     } else {
 589       /* We've got plenty of regs, so get callee-save regs if possible. */
 590       if (RID_NUM_GPR > 8 && (pick & ~RSET_SCRATCH))
 591         pick &= ~RSET_SCRATCH;
 592       r = rset_picktop(pick);
 593     }
 594   } else {
 595     r = ra_evict(as, allow);
 596   }
 597 found:
 598   RA_DBGX((as, "alloc     $f $r", ref, r));
 599   ir->r = (uint8_t)r;
 600   rset_clear(as->freeset, r);
 601   ra_noweak(as, r);
 602   as->cost[r] = REGCOST_REF_T(ref, irt_t(ir->t));
 603   return r;
 604 }
 605 
 606 /* Allocate a register on-demand. */
 607 static Reg ra_alloc1(ASMState *as, IRRef ref, RegSet allow)
 608 {
 609   Reg r = IR(ref)->r;
 610   /* Note: allow is ignored if the register is already allocated. */
 611   if (ra_noreg(r)) r = ra_allocref(as, ref, allow);
 612   ra_noweak(as, r);
 613   return r;
 614 }
 615 
 616 /* Rename register allocation and emit move. */
 617 static void ra_rename(ASMState *as, Reg down, Reg up)
 618 {
 619   IRRef ren, ref = regcost_ref(as->cost[up] = as->cost[down]);
 620   IRIns *ir = IR(ref);
 621   ir->r = (uint8_t)up;
 622   as->cost[down] = 0;
 623   lua_assert((down < RID_MAX_GPR) == (up < RID_MAX_GPR));
 624   lua_assert(!rset_test(as->freeset, down) && rset_test(as->freeset, up));
 625   ra_free(as, down);  /* 'down' is free ... */
 626   ra_modified(as, down);
 627   rset_clear(as->freeset, up);  /* ... and 'up' is now allocated. */
 628   ra_noweak(as, up);
 629   RA_DBGX((as, "rename    $f $r $r", regcost_ref(as->cost[up]), down, up));
 630   emit_movrr(as, ir, down, up);  /* Backwards codegen needs inverse move. */
 631   if (!ra_hasspill(IR(ref)->s)) {  /* Add the rename to the IR. */
 632     lj_ir_set(as->J, IRT(IR_RENAME, IRT_NIL), ref, as->snapno);
 633     ren = tref_ref(lj_ir_emit(as->J));
 634     as->ir = as->T->ir;  /* The IR may have been reallocated. */
 635     IR(ren)->r = (uint8_t)down;
 636     IR(ren)->s = SPS_NONE;
 637   }
 638 }
 639 
 640 /* Pick a destination register (marked as free).
 641 ** Caveat: allow is ignored if there's already a destination register.
 642 ** Use ra_destreg() to get a specific register.
 643 */
 644 static Reg ra_dest(ASMState *as, IRIns *ir, RegSet allow)
 645 {
 646   Reg dest = ir->r;
 647   if (ra_hasreg(dest)) {
 648     ra_free(as, dest);
 649     ra_modified(as, dest);
 650   } else {
 651     if (ra_hashint(dest) && rset_test((as->freeset&allow), ra_gethint(dest))) {
 652       dest = ra_gethint(dest);
 653       ra_modified(as, dest);
 654       RA_DBGX((as, "dest           $r", dest));
 655     } else {
 656       dest = ra_scratch(as, allow);
 657     }
 658     ir->r = dest;
 659   }
 660   if (LJ_UNLIKELY(ra_hasspill(ir->s))) ra_save(as, ir, dest);
 661   return dest;
 662 }
 663 
 664 /* Force a specific destination register (marked as free). */
 665 static void ra_destreg(ASMState *as, IRIns *ir, Reg r)
 666 {
 667   Reg dest = ra_dest(as, ir, RID2RSET(r));
 668   if (dest != r) {
 669     lua_assert(rset_test(as->freeset, r));
 670     ra_modified(as, r);
 671     emit_movrr(as, ir, dest, r);
 672   }
 673 }
 674 
 675 #if LJ_TARGET_X86ORX64
 676 /* Propagate dest register to left reference. Emit moves as needed.
 677 ** This is a required fixup step for all 2-operand machine instructions.
 678 */
 679 static void ra_left(ASMState *as, Reg dest, IRRef lref)
 680 {
 681   IRIns *ir = IR(lref);
 682   Reg left = ir->r;
 683   if (ra_noreg(left)) {
 684     if (irref_isk(lref)) {
 685       if (ir->o == IR_KNUM) {
 686         cTValue *tv = ir_knum(ir);
 687         /* FP remat needs a load except for +0. Still better than eviction. */
 688         if (tvispzero(tv) || !(as->freeset & RSET_FPR)) {
 689           emit_loadn(as, dest, tv);
 690           return;
 691         }
 692 #if LJ_64
 693       } else if (ir->o == IR_KINT64) {
 694         emit_loadu64(as, dest, ir_kint64(ir)->u64);
 695         return;
 696 #endif
 697       } else {
 698         lua_assert(ir->o == IR_KINT || ir->o == IR_KGC ||
 699                    ir->o == IR_KPTR || ir->o == IR_KKPTR || ir->o == IR_KNULL);
 700         emit_loadi(as, dest, ir->i);
 701         return;
 702       }
 703     }
 704     if (!ra_hashint(left) && !iscrossref(as, lref))
 705       ra_sethint(ir->r, dest);  /* Propagate register hint. */
 706     left = ra_allocref(as, lref, dest < RID_MAX_GPR ? RSET_GPR : RSET_FPR);
 707   }
 708   ra_noweak(as, left);
 709   /* Move needed for true 3-operand instruction: y=a+b ==> y=a; y+=b. */
 710   if (dest != left) {
 711     /* Use register renaming if dest is the PHI reg. */
 712     if (irt_isphi(ir->t) && as->phireg[dest] == lref) {
 713       ra_modified(as, left);
 714       ra_rename(as, left, dest);
 715     } else {
 716       emit_movrr(as, ir, dest, left);
 717     }
 718   }
 719 }
 720 #else
 721 /* Similar to ra_left, except we override any hints. */
 722 static void ra_leftov(ASMState *as, Reg dest, IRRef lref)
 723 {
 724   IRIns *ir = IR(lref);
 725   Reg left = ir->r;
 726   if (ra_noreg(left)) {
 727     ra_sethint(ir->r, dest);  /* Propagate register hint. */
 728     left = ra_allocref(as, lref,
 729                        (LJ_SOFTFP || dest < RID_MAX_GPR) ? RSET_GPR : RSET_FPR);
 730   }
 731   ra_noweak(as, left);
 732   if (dest != left) {
 733     /* Use register renaming if dest is the PHI reg. */
 734     if (irt_isphi(ir->t) && as->phireg[dest] == lref) {
 735       ra_modified(as, left);
 736       ra_rename(as, left, dest);
 737     } else {
 738       emit_movrr(as, ir, dest, left);
 739     }
 740   }
 741 }
 742 #endif
 743 
 744 #if !LJ_64
 745 /* Force a RID_RETLO/RID_RETHI destination register pair (marked as free). */
 746 static void ra_destpair(ASMState *as, IRIns *ir)
 747 {
 748   Reg destlo = ir->r, desthi = (ir+1)->r;
 749   /* First spill unrelated refs blocking the destination registers. */
 750   if (!rset_test(as->freeset, RID_RETLO) &&
 751       destlo != RID_RETLO && desthi != RID_RETLO)
 752     ra_restore(as, regcost_ref(as->cost[RID_RETLO]));
 753   if (!rset_test(as->freeset, RID_RETHI) &&
 754       destlo != RID_RETHI && desthi != RID_RETHI)
 755     ra_restore(as, regcost_ref(as->cost[RID_RETHI]));
 756   /* Next free the destination registers (if any). */
 757   if (ra_hasreg(destlo)) {
 758     ra_free(as, destlo);
 759     ra_modified(as, destlo);
 760   } else {
 761     destlo = RID_RETLO;
 762   }
 763   if (ra_hasreg(desthi)) {
 764     ra_free(as, desthi);
 765     ra_modified(as, desthi);
 766   } else {
 767     desthi = RID_RETHI;
 768   }
 769   /* Check for conflicts and shuffle the registers as needed. */
 770   if (destlo == RID_RETHI) {
 771     if (desthi == RID_RETLO) {
 772 #if LJ_TARGET_X86
 773       *--as->mcp = XI_XCHGa + RID_RETHI;
 774 #else
 775       emit_movrr(as, ir, RID_RETHI, RID_TMP);
 776       emit_movrr(as, ir, RID_RETLO, RID_RETHI);
 777       emit_movrr(as, ir, RID_TMP, RID_RETLO);
 778 #endif
 779     } else {
 780       emit_movrr(as, ir, RID_RETHI, RID_RETLO);
 781       if (desthi != RID_RETHI) emit_movrr(as, ir, desthi, RID_RETHI);
 782     }
 783   } else if (desthi == RID_RETLO) {
 784     emit_movrr(as, ir, RID_RETLO, RID_RETHI);
 785     if (destlo != RID_RETLO) emit_movrr(as, ir, destlo, RID_RETLO);
 786   } else {
 787     if (desthi != RID_RETHI) emit_movrr(as, ir, desthi, RID_RETHI);
 788     if (destlo != RID_RETLO) emit_movrr(as, ir, destlo, RID_RETLO);
 789   }
 790   /* Restore spill slots (if any). */
 791   if (ra_hasspill((ir+1)->s)) ra_save(as, ir+1, RID_RETHI);
 792   if (ra_hasspill(ir->s)) ra_save(as, ir, RID_RETLO);
 793 }
 794 #endif
 795 
 796 /* -- Snapshot handling --------- ----------------------------------------- */
 797 
 798 /* Can we rematerialize a KNUM instead of forcing a spill? */
 799 static int asm_snap_canremat(ASMState *as)
 800 {
 801   Reg r;
 802   for (r = RID_MIN_FPR; r < RID_MAX_FPR; r++)
 803     if (irref_isk(regcost_ref(as->cost[r])))
 804       return 1;
 805   return 0;
 806 }
 807 
 808 /* Check whether a sunk store corresponds to an allocation. */
 809 static int asm_sunk_store(ASMState *as, IRIns *ira, IRIns *irs)
 810 {
 811   if (irs->s == 255) {
 812     if (irs->o == IR_ASTORE || irs->o == IR_HSTORE ||
 813         irs->o == IR_FSTORE || irs->o == IR_XSTORE) {
 814       IRIns *irk = IR(irs->op1);
 815       if (irk->o == IR_AREF || irk->o == IR_HREFK)
 816         irk = IR(irk->op1);
 817       return (IR(irk->op1) == ira);
 818     }
 819     return 0;
 820   } else {
 821     return (ira + irs->s == irs);  /* Quick check. */
 822   }
 823 }
 824 
 825 /* Allocate register or spill slot for a ref that escapes to a snapshot. */
 826 static void asm_snap_alloc1(ASMState *as, IRRef ref)
 827 {
 828   IRIns *ir = IR(ref);
 829   if (!irref_isk(ref) && (!(ra_used(ir) || ir->r == RID_SUNK))) {
 830     if (ir->r == RID_SINK) {
 831       ir->r = RID_SUNK;
 832 #if LJ_HASFFI
 833       if (ir->o == IR_CNEWI) {  /* Allocate CNEWI value. */
 834         asm_snap_alloc1(as, ir->op2);
 835         if (LJ_32 && (ir+1)->o == IR_HIOP)
 836           asm_snap_alloc1(as, (ir+1)->op2);
 837       } else
 838 #endif
 839       {  /* Allocate stored values for TNEW, TDUP and CNEW. */
 840         IRIns *irs;
 841         lua_assert(ir->o == IR_TNEW || ir->o == IR_TDUP || ir->o == IR_CNEW);
 842         for (irs = IR(as->snapref-1); irs > ir; irs--)
 843           if (irs->r == RID_SINK && asm_sunk_store(as, ir, irs)) {
 844             lua_assert(irs->o == IR_ASTORE || irs->o == IR_HSTORE ||
 845                        irs->o == IR_FSTORE || irs->o == IR_XSTORE);
 846             asm_snap_alloc1(as, irs->op2);
 847             if (LJ_32 && (irs+1)->o == IR_HIOP)
 848               asm_snap_alloc1(as, (irs+1)->op2);
 849           }
 850       }
 851     } else {
 852       RegSet allow;
 853       if (ir->o == IR_CONV && ir->op2 == IRCONV_NUM_INT) {
 854         IRIns *irc;
 855         for (irc = IR(as->curins); irc > ir; irc--)
 856           if ((irc->op1 == ref || irc->op2 == ref) &&
 857               !(irc->r == RID_SINK || irc->r == RID_SUNK))
 858             goto nosink;  /* Don't sink conversion if result is used. */
 859         asm_snap_alloc1(as, ir->op1);
 860         return;
 861       }
 862     nosink:
 863       allow = (!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR;
 864       if ((as->freeset & allow) ||
 865                (allow == RSET_FPR && asm_snap_canremat(as))) {
 866         /* Get a weak register if we have a free one or can rematerialize. */
 867         Reg r = ra_allocref(as, ref, allow);  /* Allocate a register. */
 868         if (!irt_isphi(ir->t))
 869           ra_weak(as, r);  /* But mark it as weakly referenced. */
 870         checkmclim(as);
 871         RA_DBGX((as, "snapreg   $f $r", ref, ir->r));
 872       } else {
 873         ra_spill(as, ir);  /* Otherwise force a spill slot. */
 874         RA_DBGX((as, "snapspill $f $s", ref, ir->s));
 875       }
 876     }
 877   }
 878 }
 879 
 880 /* Allocate refs escaping to a snapshot. */
 881 static void asm_snap_alloc(ASMState *as)
 882 {
 883   SnapShot *snap = &as->T->snap[as->snapno];
 884   SnapEntry *map = &as->T->snapmap[snap->mapofs];
 885   MSize n, nent = snap->nent;
 886   for (n = 0; n < nent; n++) {
 887     SnapEntry sn = map[n];
 888     IRRef ref = snap_ref(sn);
 889     if (!irref_isk(ref)) {
 890       asm_snap_alloc1(as, ref);
 891       if (LJ_SOFTFP && (sn & SNAP_SOFTFPNUM)) {
 892         lua_assert(irt_type(IR(ref+1)->t) == IRT_SOFTFP);
 893         asm_snap_alloc1(as, ref+1);
 894       }
 895     }
 896   }
 897 }
 898 
 899 /* All guards for a snapshot use the same exitno. This is currently the
 900 ** same as the snapshot number. Since the exact origin of the exit cannot
 901 ** be determined, all guards for the same snapshot must exit with the same
 902 ** RegSP mapping.
 903 ** A renamed ref which has been used in a prior guard for the same snapshot
 904 ** would cause an inconsistency. The easy way out is to force a spill slot.
 905 */
 906 static int asm_snap_checkrename(ASMState *as, IRRef ren)
 907 {
 908   SnapShot *snap = &as->T->snap[as->snapno];
 909   SnapEntry *map = &as->T->snapmap[snap->mapofs];
 910   MSize n, nent = snap->nent;
 911   for (n = 0; n < nent; n++) {
 912     SnapEntry sn = map[n];
 913     IRRef ref = snap_ref(sn);
 914     if (ref == ren || (LJ_SOFTFP && (sn & SNAP_SOFTFPNUM) && ++ref == ren)) {
 915       IRIns *ir = IR(ref);
 916       ra_spill(as, ir);  /* Register renamed, so force a spill slot. */
 917       RA_DBGX((as, "snaprensp $f $s", ref, ir->s));
 918       return 1;  /* Found. */
 919     }
 920   }
 921   return 0;  /* Not found. */
 922 }
 923 
 924 /* Prepare snapshot for next guard instruction. */
 925 static void asm_snap_prep(ASMState *as)
 926 {
 927   if (as->curins < as->snapref) {
 928     do {
 929       if (as->snapno == 0) return;  /* Called by sunk stores before snap #0. */
 930       as->snapno--;
 931       as->snapref = as->T->snap[as->snapno].ref;
 932     } while (as->curins < as->snapref);
 933     asm_snap_alloc(as);
 934     as->snaprename = as->T->nins;
 935   } else {
 936     /* Process any renames above the highwater mark. */
 937     for (; as->snaprename < as->T->nins; as->snaprename++) {
 938       IRIns *ir = IR(as->snaprename);
 939       if (asm_snap_checkrename(as, ir->op1))
 940         ir->op2 = REF_BIAS-1;  /* Kill rename. */
 941     }
 942   }
 943 }
 944 
 945 /* -- Miscellaneous helpers ----------------------------------------------- */
 946 
 947 /* Collect arguments from CALL* and CARG instructions. */
 948 static void asm_collectargs(ASMState *as, IRIns *ir,
 949                             const CCallInfo *ci, IRRef *args)
 950 {
 951   uint32_t n = CCI_NARGS(ci);
 952   lua_assert(n <= CCI_NARGS_MAX*2);  /* Account for split args. */
 953   if ((ci->flags & CCI_L)) { *args++ = ASMREF_L; n--; }
 954   while (n-- > 1) {
 955     ir = IR(ir->op1);
 956     lua_assert(ir->o == IR_CARG);
 957     args[n] = ir->op2 == REF_NIL ? 0 : ir->op2;
 958   }
 959   args[0] = ir->op1 == REF_NIL ? 0 : ir->op1;
 960   lua_assert(IR(ir->op1)->o != IR_CARG);
 961 }
 962 
 963 /* Reconstruct CCallInfo flags for CALLX*. */
 964 static uint32_t asm_callx_flags(ASMState *as, IRIns *ir)
 965 {
 966   uint32_t nargs = 0;
 967   if (ir->op1 != REF_NIL) {  /* Count number of arguments first. */
 968     IRIns *ira = IR(ir->op1);
 969     nargs++;
 970     while (ira->o == IR_CARG) { nargs++; ira = IR(ira->op1); }
 971   }
 972 #if LJ_HASFFI
 973   if (IR(ir->op2)->o == IR_CARG) {  /* Copy calling convention info. */
 974     CTypeID id = (CTypeID)IR(IR(ir->op2)->op2)->i;
 975     CType *ct = ctype_get(ctype_ctsG(J2G(as->J)), id);
 976     nargs |= ((ct->info & CTF_VARARG) ? CCI_VARARG : 0);
 977 #if LJ_TARGET_X86
 978     nargs |= (ctype_cconv(ct->info) << CCI_CC_SHIFT);
 979 #endif
 980   }
 981 #endif
 982   return (nargs | (ir->t.irt << CCI_OTSHIFT));
 983 }
 984 
 985 /* Calculate stack adjustment. */
 986 static int32_t asm_stack_adjust(ASMState *as)
 987 {
 988   if (as->evenspill <= SPS_FIXED)
 989     return 0;
 990   return sps_scale(sps_align(as->evenspill));
 991 }
 992 
 993 /* Must match with hash*() in lj_tab.c. */
 994 static uint32_t ir_khash(IRIns *ir)
 995 {
 996   uint32_t lo, hi;
 997   if (irt_isstr(ir->t)) {
 998     return ir_kstr(ir)->hash;
 999   } else if (irt_isnum(ir->t)) {
1000     lo = ir_knum(ir)->u32.lo;
1001     hi = ir_knum(ir)->u32.hi << 1;
1002   } else if (irt_ispri(ir->t)) {
1003     lua_assert(!irt_isnil(ir->t));
1004     return irt_type(ir->t)-IRT_FALSE;
1005   } else {
1006     lua_assert(irt_isgcv(ir->t));
1007     lo = u32ptr(ir_kgc(ir));
1008     hi = lo + HASH_BIAS;
1009   }
1010   return hashrot(lo, hi);
1011 }
1012 
1013 /* -- Allocations --------------------------------------------------------- */
1014 
1015 static void asm_gencall(ASMState *as, const CCallInfo *ci, IRRef *args);
1016 static void asm_setupresult(ASMState *as, IRIns *ir, const CCallInfo *ci);
1017 
1018 static void asm_snew(ASMState *as, IRIns *ir)
1019 {
1020   const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_str_new];
1021   IRRef args[3];
1022   args[0] = ASMREF_L;  /* lua_State *L    */
1023   args[1] = ir->op1;   /* const char *str */
1024   args[2] = ir->op2;   /* size_t len      */
1025   as->gcsteps++;
1026   asm_setupresult(as, ir, ci);  /* GCstr * */
1027   asm_gencall(as, ci, args);
1028 }
1029 
1030 static void asm_tnew(ASMState *as, IRIns *ir)
1031 {
1032   const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_tab_new1];
1033   IRRef args[2];
1034   args[0] = ASMREF_L;     /* lua_State *L    */
1035   args[1] = ASMREF_TMP1;  /* uint32_t ahsize */
1036   as->gcsteps++;
1037   asm_setupresult(as, ir, ci);  /* GCtab * */
1038   asm_gencall(as, ci, args);
1039   ra_allockreg(as, ir->op1 | (ir->op2 << 24), ra_releasetmp(as, ASMREF_TMP1));
1040 }
1041 
1042 static void asm_tdup(ASMState *as, IRIns *ir)
1043 {
1044   const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_tab_dup];
1045   IRRef args[2];
1046   args[0] = ASMREF_L;  /* lua_State *L    */
1047   args[1] = ir->op1;   /* const GCtab *kt */
1048   as->gcsteps++;
1049   asm_setupresult(as, ir, ci);  /* GCtab * */
1050   asm_gencall(as, ci, args);
1051 }
1052 
1053 static void asm_gc_check(ASMState *as);
1054 
1055 /* Explicit GC step. */
1056 static void asm_gcstep(ASMState *as, IRIns *ir)
1057 {
1058   IRIns *ira;
1059   for (ira = IR(as->stopins+1); ira < ir; ira++)
1060     if ((ira->o == IR_TNEW || ira->o == IR_TDUP ||
1061          (LJ_HASFFI && (ira->o == IR_CNEW || ira->o == IR_CNEWI))) &&
1062         ra_used(ira))
1063       as->gcsteps++;
1064   if (as->gcsteps)
1065     asm_gc_check(as);
1066   as->gcsteps = 0x80000000;  /* Prevent implicit GC check further up. */
1067 }
1068 
1069 /* -- PHI and loop handling ----------------------------------------------- */
1070 
1071 /* Break a PHI cycle by renaming to a free register (evict if needed). */
1072 static void asm_phi_break(ASMState *as, RegSet blocked, RegSet blockedby,
1073                           RegSet allow)
1074 {
1075   RegSet candidates = blocked & allow;
1076   if (candidates) {  /* If this register file has candidates. */
1077     /* Note: the set for ra_pick cannot be empty, since each register file
1078     ** has some registers never allocated to PHIs.
1079     */
1080     Reg down, up = ra_pick(as, ~blocked & allow);  /* Get a free register. */
1081     if (candidates & ~blockedby)  /* Optimize shifts, else it's a cycle. */
1082       candidates = candidates & ~blockedby;
1083     down = rset_picktop(candidates);  /* Pick candidate PHI register. */
1084     ra_rename(as, down, up);  /* And rename it to the free register. */
1085   }
1086 }
1087 
1088 /* PHI register shuffling.
1089 **
1090 ** The allocator tries hard to preserve PHI register assignments across
1091 ** the loop body. Most of the time this loop does nothing, since there
1092 ** are no register mismatches.
1093 **
1094 ** If a register mismatch is detected and ...
1095 ** - the register is currently free: rename it.
1096 ** - the register is blocked by an invariant: restore/remat and rename it.
1097 ** - Otherwise the register is used by another PHI, so mark it as blocked.
1098 **
1099 ** The renames are order-sensitive, so just retry the loop if a register
1100 ** is marked as blocked, but has been freed in the meantime. A cycle is
1101 ** detected if all of the blocked registers are allocated. To break the
1102 ** cycle rename one of them to a free register and retry.
1103 **
1104 ** Note that PHI spill slots are kept in sync and don't need to be shuffled.
1105 */
1106 static void asm_phi_shuffle(ASMState *as)
1107 {
1108   RegSet work;
1109 
1110   /* Find and resolve PHI register mismatches. */
1111   for (;;) {
1112     RegSet blocked = RSET_EMPTY;
1113     RegSet blockedby = RSET_EMPTY;
1114     RegSet phiset = as->phiset;
1115     while (phiset) {  /* Check all left PHI operand registers. */
1116       Reg r = rset_pickbot(phiset);
1117       IRIns *irl = IR(as->phireg[r]);
1118       Reg left = irl->r;
1119       if (r != left) {  /* Mismatch? */
1120         if (!rset_test(as->freeset, r)) {  /* PHI register blocked? */
1121           IRRef ref = regcost_ref(as->cost[r]);
1122           /* Blocked by other PHI (w/reg)? */
1123           if (!ra_iskref(ref) && irt_ismarked(IR(ref)->t)) {
1124             rset_set(blocked, r);
1125             if (ra_hasreg(left))
1126               rset_set(blockedby, left);
1127             left = RID_NONE;
1128           } else {  /* Otherwise grab register from invariant. */
1129             ra_restore(as, ref);
1130             checkmclim(as);
1131           }
1132         }
1133         if (ra_hasreg(left)) {
1134           ra_rename(as, left, r);
1135           checkmclim(as);
1136         }
1137       }
1138       rset_clear(phiset, r);
1139     }
1140     if (!blocked) break;  /* Finished. */
1141     if (!(as->freeset & blocked)) {  /* Break cycles if none are free. */
1142       asm_phi_break(as, blocked, blockedby, RSET_GPR);
1143       if (!LJ_SOFTFP) asm_phi_break(as, blocked, blockedby, RSET_FPR);
1144       checkmclim(as);
1145     }  /* Else retry some more renames. */
1146   }
1147 
1148   /* Restore/remat invariants whose registers are modified inside the loop. */
1149 #if !LJ_SOFTFP
1150   work = as->modset & ~(as->freeset | as->phiset) & RSET_FPR;
1151   while (work) {
1152     Reg r = rset_pickbot(work);
1153     ra_restore(as, regcost_ref(as->cost[r]));
1154     rset_clear(work, r);
1155     checkmclim(as);
1156   }
1157 #endif
1158   work = as->modset & ~(as->freeset | as->phiset);
1159   while (work) {
1160     Reg r = rset_pickbot(work);
1161     ra_restore(as, regcost_ref(as->cost[r]));
1162     rset_clear(work, r);
1163     checkmclim(as);
1164   }
1165 
1166   /* Allocate and save all unsaved PHI regs and clear marks. */
1167   work = as->phiset;
1168   while (work) {
1169     Reg r = rset_picktop(work);
1170     IRRef lref = as->phireg[r];
1171     IRIns *ir = IR(lref);
1172     if (ra_hasspill(ir->s)) {  /* Left PHI gained a spill slot? */
1173       irt_clearmark(ir->t);  /* Handled here, so clear marker now. */
1174       ra_alloc1(as, lref, RID2RSET(r));
1175       ra_save(as, ir, r);  /* Save to spill slot inside the loop. */
1176       checkmclim(as);
1177     }
1178     rset_clear(work, r);
1179   }
1180 }
1181 
1182 /* Copy unsynced left/right PHI spill slots. Rarely needed. */
1183 static void asm_phi_copyspill(ASMState *as)
1184 {
1185   int need = 0;
1186   IRIns *ir;
1187   for (ir = IR(as->orignins-1); ir->o == IR_PHI; ir--)
1188     if (ra_hasspill(ir->s) && ra_hasspill(IR(ir->op1)->s))
1189       need |= irt_isfp(ir->t) ? 2 : 1;  /* Unsynced spill slot? */
1190   if ((need & 1)) {  /* Copy integer spill slots. */
1191 #if !LJ_TARGET_X86ORX64
1192     Reg r = RID_TMP;
1193 #else
1194     Reg r = RID_RET;
1195     if ((as->freeset & RSET_GPR))
1196       r = rset_pickbot((as->freeset & RSET_GPR));
1197     else
1198       emit_spload(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1199 #endif
1200     for (ir = IR(as->orignins-1); ir->o == IR_PHI; ir--) {
1201       if (ra_hasspill(ir->s)) {
1202         IRIns *irl = IR(ir->op1);
1203         if (ra_hasspill(irl->s) && !irt_isfp(ir->t)) {
1204           emit_spstore(as, irl, r, sps_scale(irl->s));
1205           emit_spload(as, ir, r, sps_scale(ir->s));
1206           checkmclim(as);
1207         }
1208       }
1209     }
1210 #if LJ_TARGET_X86ORX64
1211     if (!rset_test(as->freeset, r))
1212       emit_spstore(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1213 #endif
1214   }
1215 #if !LJ_SOFTFP
1216   if ((need & 2)) {  /* Copy FP spill slots. */
1217 #if LJ_TARGET_X86
1218     Reg r = RID_XMM0;
1219 #else
1220     Reg r = RID_FPRET;
1221 #endif
1222     if ((as->freeset & RSET_FPR))
1223       r = rset_pickbot((as->freeset & RSET_FPR));
1224     if (!rset_test(as->freeset, r))
1225       emit_spload(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1226     for (ir = IR(as->orignins-1); ir->o == IR_PHI; ir--) {
1227       if (ra_hasspill(ir->s)) {
1228         IRIns *irl = IR(ir->op1);
1229         if (ra_hasspill(irl->s) && irt_isfp(ir->t)) {
1230           emit_spstore(as, irl, r, sps_scale(irl->s));
1231           emit_spload(as, ir, r, sps_scale(ir->s));
1232           checkmclim(as);
1233         }
1234       }
1235     }
1236     if (!rset_test(as->freeset, r))
1237       emit_spstore(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1238   }
1239 #endif
1240 }
1241 
1242 /* Emit renames for left PHIs which are only spilled outside the loop. */
1243 static void asm_phi_fixup(ASMState *as)
1244 {
1245   RegSet work = as->phiset;
1246   while (work) {
1247     Reg r = rset_picktop(work);
1248     IRRef lref = as->phireg[r];
1249     IRIns *ir = IR(lref);
1250     if (irt_ismarked(ir->t)) {
1251       irt_clearmark(ir->t);
1252       /* Left PHI gained a spill slot before the loop? */
1253       if (ra_hasspill(ir->s)) {
1254         IRRef ren;
1255         lj_ir_set(as->J, IRT(IR_RENAME, IRT_NIL), lref, as->loopsnapno);
1256         ren = tref_ref(lj_ir_emit(as->J));
1257         as->ir = as->T->ir;  /* The IR may have been reallocated. */
1258         IR(ren)->r = (uint8_t)r;
1259         IR(ren)->s = SPS_NONE;
1260       }
1261     }
1262     rset_clear(work, r);
1263   }
1264 }
1265 
1266 /* Setup right PHI reference. */
1267 static void asm_phi(ASMState *as, IRIns *ir)
1268 {
1269   RegSet allow = ((!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR) &
1270                  ~as->phiset;
1271   RegSet afree = (as->freeset & allow);
1272   IRIns *irl = IR(ir->op1);
1273   IRIns *irr = IR(ir->op2);
1274   if (ir->r == RID_SINK)  /* Sink PHI. */
1275     return;
1276   /* Spill slot shuffling is not implemented yet (but rarely needed). */
1277   if (ra_hasspill(irl->s) || ra_hasspill(irr->s))
1278     lj_trace_err(as->J, LJ_TRERR_NYIPHI);
1279   /* Leave at least one register free for non-PHIs (and PHI cycle breaking). */
1280   if ((afree & (afree-1))) {  /* Two or more free registers? */
1281     Reg r;
1282     if (ra_noreg(irr->r)) {  /* Get a register for the right PHI. */
1283       r = ra_allocref(as, ir->op2, allow);
1284     } else {  /* Duplicate right PHI, need a copy (rare). */
1285       r = ra_scratch(as, allow);
1286       emit_movrr(as, irr, r, irr->r);
1287     }
1288     ir->r = (uint8_t)r;
1289     rset_set(as->phiset, r);
1290     as->phireg[r] = (IRRef1)ir->op1;
1291     irt_setmark(irl->t);  /* Marks left PHIs _with_ register. */
1292     if (ra_noreg(irl->r))
1293       ra_sethint(irl->r, r); /* Set register hint for left PHI. */
1294   } else {  /* Otherwise allocate a spill slot. */
1295     /* This is overly restrictive, but it triggers only on synthetic code. */
1296     if (ra_hasreg(irl->r) || ra_hasreg(irr->r))
1297       lj_trace_err(as->J, LJ_TRERR_NYIPHI);
1298     ra_spill(as, ir);
1299     irr->s = ir->s;  /* Set right PHI spill slot. Sync left slot later. */
1300   }
1301 }
1302 
1303 static void asm_loop_fixup(ASMState *as);
1304 
1305 /* Middle part of a loop. */
1306 static void asm_loop(ASMState *as)
1307 {
1308   MCode *mcspill;
1309   /* LOOP is a guard, so the snapno is up to date. */
1310   as->loopsnapno = as->snapno;
1311   if (as->gcsteps)
1312     asm_gc_check(as);
1313   /* LOOP marks the transition from the variant to the invariant part. */
1314   as->flagmcp = as->invmcp = NULL;
1315   as->sectref = 0;
1316   if (!neverfuse(as)) as->fuseref = 0;
1317   asm_phi_shuffle(as);
1318   mcspill = as->mcp;
1319   asm_phi_copyspill(as);
1320   asm_loop_fixup(as);
1321   as->mcloop = as->mcp;
1322   RA_DBGX((as, "===== LOOP ====="));
1323   if (!as->realign) RA_DBG_FLUSH();
1324   if (as->mcp != mcspill)
1325     emit_jmp(as, mcspill);
1326 }
1327 
1328 /* -- Target-specific assembler ------------------------------------------- */
1329 
1330 #if LJ_TARGET_X86ORX64
1331 #include "lj_asm_x86.h"
1332 #elif LJ_TARGET_ARM
1333 #include "lj_asm_arm.h"
1334 #elif LJ_TARGET_PPC
1335 #include "lj_asm_ppc.h"
1336 #elif LJ_TARGET_MIPS
1337 #include "lj_asm_mips.h"
1338 #else
1339 #error "Missing assembler for target CPU"
1340 #endif
1341 
1342 /* -- Head of trace ------------------------------------------------------- */
1343 
1344 /* Head of a root trace. */
1345 static void asm_head_root(ASMState *as)
1346 {
1347   int32_t spadj;
1348   asm_head_root_base(as);
1349   emit_setvmstate(as, (int32_t)as->T->traceno);
1350   spadj = asm_stack_adjust(as);
1351   as->T->spadjust = (uint16_t)spadj;
1352   emit_spsub(as, spadj);
1353   /* Root traces assume a checked stack for the starting proto. */
1354   as->T->topslot = gcref(as->T->startpt)->pt.framesize;
1355 }
1356 
1357 /* Head of a side trace.
1358 **
1359 ** The current simplistic algorithm requires that all slots inherited
1360 ** from the parent are live in a register between pass 2 and pass 3. This
1361 ** avoids the complexity of stack slot shuffling. But of course this may
1362 ** overflow the register set in some cases and cause the dreaded error:
1363 ** "NYI: register coalescing too complex". A refined algorithm is needed.
1364 */
1365 static void asm_head_side(ASMState *as)
1366 {
1367   IRRef1 sloadins[RID_MAX];
1368   RegSet allow = RSET_ALL;  /* Inverse of all coalesced registers. */
1369   RegSet live = RSET_EMPTY;  /* Live parent registers. */
1370   IRIns *irp = &as->parent->ir[REF_BASE];  /* Parent base. */
1371   int32_t spadj, spdelta;
1372   int pass2 = 0;
1373   int pass3 = 0;
1374   IRRef i;
1375 
1376   if (as->snapno && as->topslot > as->parent->topslot) {
1377     /* Force snap #0 alloc to prevent register overwrite in stack check. */
1378     as->snapno = 0;
1379     asm_snap_alloc(as);
1380   }
1381   allow = asm_head_side_base(as, irp, allow);
1382 
1383   /* Scan all parent SLOADs and collect register dependencies. */
1384   for (i = as->stopins; i > REF_BASE; i--) {
1385     IRIns *ir = IR(i);
1386     RegSP rs;
1387     lua_assert((ir->o == IR_SLOAD && (ir->op2 & IRSLOAD_PARENT)) ||
1388                (LJ_SOFTFP && ir->o == IR_HIOP) || ir->o == IR_PVAL);
1389     rs = as->parentmap[i - REF_FIRST];
1390     if (ra_hasreg(ir->r)) {
1391       rset_clear(allow, ir->r);
1392       if (ra_hasspill(ir->s)) {
1393         ra_save(as, ir, ir->r);
1394         checkmclim(as);
1395       }
1396     } else if (ra_hasspill(ir->s)) {
1397       irt_setmark(ir->t);
1398       pass2 = 1;
1399     }
1400     if (ir->r == rs) {  /* Coalesce matching registers right now. */
1401       ra_free(as, ir->r);
1402     } else if (ra_hasspill(regsp_spill(rs))) {
1403       if (ra_hasreg(ir->r))
1404         pass3 = 1;
1405     } else if (ra_used(ir)) {
1406       sloadins[rs] = (IRRef1)i;
1407       rset_set(live, rs);  /* Block live parent register. */
1408     }
1409   }
1410 
1411   /* Calculate stack frame adjustment. */
1412   spadj = asm_stack_adjust(as);
1413   spdelta = spadj - (int32_t)as->parent->spadjust;
1414   if (spdelta < 0) {  /* Don't shrink the stack frame. */
1415     spadj = (int32_t)as->parent->spadjust;
1416     spdelta = 0;
1417   }
1418   as->T->spadjust = (uint16_t)spadj;
1419 
1420   /* Reload spilled target registers. */
1421   if (pass2) {
1422     for (i = as->stopins; i > REF_BASE; i--) {
1423       IRIns *ir = IR(i);
1424       if (irt_ismarked(ir->t)) {
1425         RegSet mask;
1426         Reg r;
1427         RegSP rs;
1428         irt_clearmark(ir->t);
1429         rs = as->parentmap[i - REF_FIRST];
1430         if (!ra_hasspill(regsp_spill(rs)))
1431           ra_sethint(ir->r, rs);  /* Hint may be gone, set it again. */
1432         else if (sps_scale(regsp_spill(rs))+spdelta == sps_scale(ir->s))
1433           continue;  /* Same spill slot, do nothing. */
1434         mask = ((!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR) & allow;
1435         if (mask == RSET_EMPTY)
1436           lj_trace_err(as->J, LJ_TRERR_NYICOAL);
1437         r = ra_allocref(as, i, mask);
1438         ra_save(as, ir, r);
1439         rset_clear(allow, r);
1440         if (r == rs) {  /* Coalesce matching registers right now. */
1441           ra_free(as, r);
1442           rset_clear(live, r);
1443         } else if (ra_hasspill(regsp_spill(rs))) {
1444           pass3 = 1;
1445         }
1446         checkmclim(as);
1447       }
1448     }
1449   }
1450 
1451   /* Store trace number and adjust stack frame relative to the parent. */
1452   emit_setvmstate(as, (int32_t)as->T->traceno);
1453   emit_spsub(as, spdelta);
1454 
1455 #if !LJ_TARGET_X86ORX64
1456   /* Restore BASE register from parent spill slot. */
1457   if (ra_hasspill(irp->s))
1458     emit_spload(as, IR(REF_BASE), IR(REF_BASE)->r, sps_scale(irp->s));
1459 #endif
1460 
1461   /* Restore target registers from parent spill slots. */
1462   if (pass3) {
1463     RegSet work = ~as->freeset & RSET_ALL;
1464     while (work) {
1465       Reg r = rset_pickbot(work);
1466       IRRef ref = regcost_ref(as->cost[r]);
1467       RegSP rs = as->parentmap[ref - REF_FIRST];
1468       rset_clear(work, r);
1469       if (ra_hasspill(regsp_spill(rs))) {
1470         int32_t ofs = sps_scale(regsp_spill(rs));
1471         ra_free(as, r);
1472         emit_spload(as, IR(ref), r, ofs);
1473         checkmclim(as);
1474       }
1475     }
1476   }
1477 
1478   /* Shuffle registers to match up target regs with parent regs. */
1479   for (;;) {
1480     RegSet work;
1481 
1482     /* Repeatedly coalesce free live registers by moving to their target. */
1483     while ((work = as->freeset & live) != RSET_EMPTY) {
1484       Reg rp = rset_pickbot(work);
1485       IRIns *ir = IR(sloadins[rp]);
1486       rset_clear(live, rp);
1487       rset_clear(allow, rp);
1488       ra_free(as, ir->r);
1489       emit_movrr(as, ir, ir->r, rp);
1490       checkmclim(as);
1491     }
1492 
1493     /* We're done if no live registers remain. */
1494     if (live == RSET_EMPTY)
1495       break;
1496 
1497     /* Break cycles by renaming one target to a temp. register. */
1498     if (live & RSET_GPR) {
1499       RegSet tmpset = as->freeset & ~live & allow & RSET_GPR;
1500       if (tmpset == RSET_EMPTY)
1501         lj_trace_err(as->J, LJ_TRERR_NYICOAL);
1502       ra_rename(as, rset_pickbot(live & RSET_GPR), rset_pickbot(tmpset));
1503     }
1504     if (!LJ_SOFTFP && (live & RSET_FPR)) {
1505       RegSet tmpset = as->freeset & ~live & allow & RSET_FPR;
1506       if (tmpset == RSET_EMPTY)
1507         lj_trace_err(as->J, LJ_TRERR_NYICOAL);
1508       ra_rename(as, rset_pickbot(live & RSET_FPR), rset_pickbot(tmpset));
1509     }
1510     checkmclim(as);
1511     /* Continue with coalescing to fix up the broken cycle(s). */
1512   }
1513 
1514   /* Inherit top stack slot already checked by parent trace. */
1515   as->T->topslot = as->parent->topslot;
1516   if (as->topslot > as->T->topslot) {  /* Need to check for higher slot? */
1517 #ifdef EXITSTATE_CHECKEXIT
1518     /* Highest exit + 1 indicates stack check. */
1519     ExitNo exitno = as->T->nsnap;
1520 #else
1521     /* Reuse the parent exit in the context of the parent trace. */
1522     ExitNo exitno = as->J->exitno;
1523 #endif
1524     as->T->topslot = (uint8_t)as->topslot;  /* Remember for child traces. */
1525     asm_stack_check(as, as->topslot, irp, allow & RSET_GPR, exitno);
1526   }
1527 }
1528 
1529 /* -- Tail of trace ------------------------------------------------------- */
1530 
1531 /* Get base slot for a snapshot. */
1532 static BCReg asm_baseslot(ASMState *as, SnapShot *snap, int *gotframe)
1533 {
1534   SnapEntry *map = &as->T->snapmap[snap->mapofs];
1535   MSize n;
1536   for (n = snap->nent; n > 0; n--) {
1537     SnapEntry sn = map[n-1];
1538     if ((sn & SNAP_FRAME)) {
1539       *gotframe = 1;
1540       return snap_slot(sn);
1541     }
1542   }
1543   return 0;
1544 }
1545 
1546 /* Link to another trace. */
1547 static void asm_tail_link(ASMState *as)
1548 {
1549   SnapNo snapno = as->T->nsnap-1;  /* Last snapshot. */
1550   SnapShot *snap = &as->T->snap[snapno];
1551   int gotframe = 0;
1552   BCReg baseslot = asm_baseslot(as, snap, &gotframe);
1553 
1554   as->topslot = snap->topslot;
1555   checkmclim(as);
1556   ra_allocref(as, REF_BASE, RID2RSET(RID_BASE));
1557 
1558   if (as->T->link == 0) {
1559     /* Setup fixed registers for exit to interpreter. */
1560     const BCIns *pc = snap_pc(as->T->snapmap[snap->mapofs + snap->nent]);
1561     int32_t mres;
1562     if (bc_op(*pc) == BC_JLOOP) {  /* NYI: find a better way to do this. */
1563       BCIns *retpc = &traceref(as->J, bc_d(*pc))->startins;
1564       if (bc_isret(bc_op(*retpc)))
1565         pc = retpc;
1566     }
1567     ra_allockreg(as, i32ptr(J2GG(as->J)->dispatch), RID_DISPATCH);
1568     ra_allockreg(as, i32ptr(pc), RID_LPC);
1569     mres = (int32_t)(snap->nslots - baseslot);
1570     switch (bc_op(*pc)) {
1571     case BC_CALLM: case BC_CALLMT:
1572       mres -= (int32_t)(1 + bc_a(*pc) + bc_c(*pc)); break;
1573     case BC_RETM: mres -= (int32_t)(bc_a(*pc) + bc_d(*pc)); break;
1574     case BC_TSETM: mres -= (int32_t)bc_a(*pc); break;
1575     default: if (bc_op(*pc) < BC_FUNCF) mres = 0; break;
1576     }
1577     ra_allockreg(as, mres, RID_RET);  /* Return MULTRES or 0. */
1578   } else if (baseslot) {
1579     /* Save modified BASE for linking to trace with higher start frame. */
1580     emit_setgl(as, RID_BASE, jit_base);
1581   }
1582   emit_addptr(as, RID_BASE, 8*(int32_t)baseslot);
1583 
1584   /* Sync the interpreter state with the on-trace state. */
1585   asm_stack_restore(as, snap);
1586 
1587   /* Root traces that add frames need to check the stack at the end. */
1588   if (!as->parent && gotframe)
1589     asm_stack_check(as, as->topslot, NULL, as->freeset & RSET_GPR, snapno);
1590 }
1591 
1592 /* -- Trace setup --------------------------------------------------------- */
1593 
1594 /* Clear reg/sp for all instructions and add register hints. */
1595 static void asm_setup_regsp(ASMState *as)
1596 {
1597   GCtrace *T = as->T;
1598   int sink = T->sinktags;
1599   IRRef nins = T->nins;
1600   IRIns *ir, *lastir;
1601   int inloop;
1602 #if LJ_TARGET_ARM
1603   uint32_t rload = 0xa6402a64;
1604 #endif
1605 
1606   ra_setup(as);
1607 
1608   /* Clear reg/sp for constants. */
1609   for (ir = IR(T->nk), lastir = IR(REF_BASE); ir < lastir; ir++)
1610     ir->prev = REGSP_INIT;
1611 
1612   /* REF_BASE is used for implicit references to the BASE register. */
1613   lastir->prev = REGSP_HINT(RID_BASE);
1614 
1615   ir = IR(nins-1);
1616   if (ir->o == IR_RENAME) {
1617     do { ir--; nins--; } while (ir->o == IR_RENAME);
1618     T->nins = nins;  /* Remove any renames left over from ASM restart. */
1619   }
1620   as->snaprename = nins;
1621   as->snapref = nins;
1622   as->snapno = T->nsnap;
1623 
1624   as->stopins = REF_BASE;
1625   as->orignins = nins;
1626   as->curins = nins;
1627 
1628   /* Setup register hints for parent link instructions. */
1629   ir = IR(REF_FIRST);
1630   if (as->parent) {
1631     uint16_t *p;
1632     lastir = lj_snap_regspmap(as->parent, as->J->exitno, ir);
1633     if (lastir - ir > LJ_MAX_JSLOTS)
1634       lj_trace_err(as->J, LJ_TRERR_NYICOAL);
1635     as->stopins = (IRRef)((lastir-1) - as->ir);
1636     for (p = as->parentmap; ir < lastir; ir++) {
1637       RegSP rs = ir->prev;
1638       *p++ = (uint16_t)rs;  /* Copy original parent RegSP to parentmap. */
1639       if (!ra_hasspill(regsp_spill(rs)))
1640         ir->prev = (uint16_t)REGSP_HINT(regsp_reg(rs));
1641       else
1642         ir->prev = REGSP_INIT;
1643     }
1644   }
1645 
1646   inloop = 0;
1647   as->evenspill = SPS_FIRST;
1648   for (lastir = IR(nins); ir < lastir; ir++) {
1649     if (sink) {
1650       if (ir->r == RID_SINK)
1651         continue;
1652       if (ir->r == RID_SUNK) {  /* Revert after ASM restart. */
1653         ir->r = RID_SINK;
1654         continue;
1655       }
1656     }
1657     switch (ir->o) {
1658     case IR_LOOP:
1659       inloop = 1;
1660       break;
1661 #if LJ_TARGET_ARM
1662     case IR_SLOAD:
1663       if (!((ir->op2 & IRSLOAD_TYPECHECK) || (ir+1)->o == IR_HIOP))
1664         break;
1665       /* fallthrough */
1666     case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
1667       if (!LJ_SOFTFP && irt_isnum(ir->t)) break;
1668       ir->prev = (uint16_t)REGSP_HINT((rload & 15));
1669       rload = lj_ror(rload, 4);
1670       continue;
1671 #endif
1672     case IR_CALLXS: {
1673       CCallInfo ci;
1674       ci.flags = asm_callx_flags(as, ir);
1675       ir->prev = asm_setup_call_slots(as, ir, &ci);
1676       if (inloop)
1677         as->modset |= RSET_SCRATCH;
1678       continue;
1679       }
1680     case IR_CALLN: case IR_CALLL: case IR_CALLS: {
1681       const CCallInfo *ci = &lj_ir_callinfo[ir->op2];
1682       ir->prev = asm_setup_call_slots(as, ir, ci);
1683       if (inloop)
1684         as->modset |= (ci->flags & CCI_NOFPRCLOBBER) ?
1685                       (RSET_SCRATCH & ~RSET_FPR) : RSET_SCRATCH;
1686       continue;
1687       }
1688 #if LJ_SOFTFP || (LJ_32 && LJ_HASFFI)
1689     case IR_HIOP:
1690       switch ((ir-1)->o) {
1691 #if LJ_SOFTFP && LJ_TARGET_ARM
1692       case IR_SLOAD: case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
1693         if (ra_hashint((ir-1)->r)) {
1694           ir->prev = (ir-1)->prev + 1;
1695           continue;
1696         }
1697         break;
1698 #endif
1699 #if !LJ_SOFTFP && LJ_NEED_FP64
1700       case IR_CONV:
1701         if (irt_isfp((ir-1)->t)) {
1702           ir->prev = REGSP_HINT(RID_FPRET);
1703           continue;
1704         }
1705         /* fallthrough */
1706 #endif
1707       case IR_CALLN: case IR_CALLXS:
1708 #if LJ_SOFTFP
1709       case IR_MIN: case IR_MAX:
1710 #endif
1711         (ir-1)->prev = REGSP_HINT(RID_RETLO);
1712         ir->prev = REGSP_HINT(RID_RETHI);
1713         continue;
1714       default:
1715         break;
1716       }
1717       break;
1718 #endif
1719 #if LJ_SOFTFP
1720     case IR_MIN: case IR_MAX:
1721       if ((ir+1)->o != IR_HIOP) break;
1722       /* fallthrough */
1723 #endif
1724     /* C calls evict all scratch regs and return results in RID_RET. */
1725     case IR_SNEW: case IR_XSNEW: case IR_NEWREF:
1726       if (REGARG_NUMGPR < 3 && as->evenspill < 3)
1727         as->evenspill = 3;  /* lj_str_new and lj_tab_newkey need 3 args. */
1728     case IR_TNEW: case IR_TDUP: case IR_CNEW: case IR_CNEWI: case IR_TOSTR:
1729       ir->prev = REGSP_HINT(RID_RET);
1730       if (inloop)
1731         as->modset = RSET_SCRATCH;
1732       continue;
1733     case IR_STRTO: case IR_OBAR:
1734       if (inloop)
1735         as->modset = RSET_SCRATCH;
1736       break;
1737 #if !LJ_TARGET_X86ORX64 && !LJ_SOFTFP
1738     case IR_ATAN2: case IR_LDEXP:
1739 #endif
1740     case IR_POW:
1741       if (!LJ_SOFTFP && irt_isnum(ir->t)) {
1742 #if LJ_TARGET_X86ORX64
1743         ir->prev = REGSP_HINT(RID_XMM0);
1744         if (inloop)
1745           as->modset |= RSET_RANGE(RID_XMM0, RID_XMM1+1)|RID2RSET(RID_EAX);
1746 #else
1747         ir->prev = REGSP_HINT(RID_FPRET);
1748         if (inloop)
1749           as->modset |= RSET_SCRATCH;
1750 #endif
1751         continue;
1752       }
1753       /* fallthrough for integer POW */
1754     case IR_DIV: case IR_MOD:
1755       if (!irt_isnum(ir->t)) {
1756         ir->prev = REGSP_HINT(RID_RET);
1757         if (inloop)
1758           as->modset |= (RSET_SCRATCH & RSET_GPR);
1759         continue;
1760       }
1761       break;
1762     case IR_FPMATH:
1763 #if LJ_TARGET_X86ORX64
1764       if (ir->op2 == IRFPM_EXP2) {  /* May be joined to lj_vm_pow_sse. */
1765         ir->prev = REGSP_HINT(RID_XMM0);
1766 #if !LJ_64
1767         if (as->evenspill < 4)  /* Leave room for 16 byte scratch area. */
1768           as->evenspill = 4;
1769 #endif
1770         if (inloop)
1771           as->modset |= RSET_RANGE(RID_XMM0, RID_XMM2+1)|RID2RSET(RID_EAX);
1772         continue;
1773       } else if (ir->op2 <= IRFPM_TRUNC && !(as->flags & JIT_F_SSE4_1)) {
1774         ir->prev = REGSP_HINT(RID_XMM0);
1775         if (inloop)
1776           as->modset |= RSET_RANGE(RID_XMM0, RID_XMM3+1)|RID2RSET(RID_EAX);
1777         continue;
1778       }
1779       break;
1780 #else
1781       ir->prev = REGSP_HINT(RID_FPRET);
1782       if (inloop)
1783         as->modset |= RSET_SCRATCH;
1784       continue;
1785 #endif
1786 #if LJ_TARGET_X86ORX64
1787     /* Non-constant shift counts need to be in RID_ECX on x86/x64. */
1788     case IR_BSHL: case IR_BSHR: case IR_BSAR: case IR_BROL: case IR_BROR:
1789       if (!irref_isk(ir->op2) && !ra_hashint(IR(ir->op2)->r)) {
1790         IR(ir->op2)->r = REGSP_HINT(RID_ECX);
1791         if (inloop)
1792           rset_set(as->modset, RID_ECX);
1793       }
1794       break;
1795 #endif
1796     /* Do not propagate hints across type conversions or loads. */
1797     case IR_TOBIT:
1798     case IR_XLOAD:
1799 #if !LJ_TARGET_ARM
1800     case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
1801 #endif
1802       break;
1803     case IR_CONV:
1804       if (irt_isfp(ir->t) || (ir->op2 & IRCONV_SRCMASK) == IRT_NUM ||
1805           (ir->op2 & IRCONV_SRCMASK) == IRT_FLOAT)
1806         break;
1807       /* fallthrough */
1808     default:
1809       /* Propagate hints across likely 'op reg, imm' or 'op reg'. */
1810       if (irref_isk(ir->op2) && !irref_isk(ir->op1) &&
1811           ra_hashint(regsp_reg(IR(ir->op1)->prev))) {
1812         ir->prev = IR(ir->op1)->prev;
1813         continue;
1814       }
1815       break;
1816     }
1817     ir->prev = REGSP_INIT;
1818   }
1819   if ((as->evenspill & 1))
1820     as->oddspill = as->evenspill++;
1821   else
1822     as->oddspill = 0;
1823 }
1824 
1825 /* -- Assembler core ------------------------------------------------------ */
1826 
1827 /* Assemble a trace. */
1828 void lj_asm_trace(jit_State *J, GCtrace *T)
1829 {
1830   ASMState as_;
1831   ASMState *as = &as_;
1832   MCode *origtop;
1833 
1834   /* Ensure an initialized instruction beyond the last one for HIOP checks. */
1835   J->cur.nins = lj_ir_nextins(J);
1836   J->cur.ir[J->cur.nins].o = IR_NOP;
1837 
1838   /* Setup initial state. Copy some fields to reduce indirections. */
1839   as->J = J;
1840   as->T = T;
1841   as->ir = T->ir;
1842   as->flags = J->flags;
1843   as->loopref = J->loopref;
1844   as->realign = NULL;
1845   as->loopinv = 0;
1846   as->parent = J->parent ? traceref(J, J->parent) : NULL;
1847 
1848   /* Reserve MCode memory. */
1849   as->mctop = origtop = lj_mcode_reserve(J, &as->mcbot);
1850   as->mcp = as->mctop;
1851   as->mclim = as->mcbot + MCLIM_REDZONE;
1852   asm_setup_target(as);
1853 
1854   do {
1855     as->mcp = as->mctop;
1856 #ifdef LUA_USE_ASSERT
1857     as->mcp_prev = as->mcp;
1858 #endif
1859     as->curins = T->nins;
1860     RA_DBG_START();
1861     RA_DBGX((as, "===== STOP ====="));
1862 
1863     /* General trace setup. Emit tail of trace. */
1864     asm_tail_prep(as);
1865     as->mcloop = NULL;
1866     as->flagmcp = NULL;
1867     as->topslot = 0;
1868     as->gcsteps = 0;
1869     as->sectref = as->loopref;
1870     as->fuseref = (as->flags & JIT_F_OPT_FUSE) ? as->loopref : FUSE_DISABLED;
1871     asm_setup_regsp(as);
1872     if (!as->loopref)
1873       asm_tail_link(as);
1874 
1875     /* Assemble a trace in linear backwards order. */
1876     for (as->curins--; as->curins > as->stopins; as->curins--) {
1877       IRIns *ir = IR(as->curins);
1878       lua_assert(!(LJ_32 && irt_isint64(ir->t)));  /* Handled by SPLIT. */
1879       if (!ra_used(ir) && !ir_sideeff(ir) && (as->flags & JIT_F_OPT_DCE))
1880         continue;  /* Dead-code elimination can be soooo easy. */
1881       if (irt_isguard(ir->t))
1882         asm_snap_prep(as);
1883       RA_DBG_REF();
1884       checkmclim(as);
1885       asm_ir(as, ir);
1886     }
1887   } while (as->realign);  /* Retry in case the MCode needs to be realigned. */
1888 
1889   /* Emit head of trace. */
1890   RA_DBG_REF();
1891   checkmclim(as);
1892   if (as->gcsteps > 0) {
1893     as->curins = as->T->snap[0].ref;
1894     asm_snap_prep(as);  /* The GC check is a guard. */
1895     asm_gc_check(as);
1896   }
1897   ra_evictk(as);
1898   if (as->parent)
1899     asm_head_side(as);
1900   else
1901     asm_head_root(as);
1902   asm_phi_fixup(as);
1903 
1904   RA_DBGX((as, "===== START ===="));
1905   RA_DBG_FLUSH();
1906   if (as->freeset != RSET_ALL)
1907     lj_trace_err(as->J, LJ_TRERR_BADRA);  /* Ouch! Should never happen. */
1908 
1909   /* Set trace entry point before fixing up tail to allow link to self. */
1910   T->mcode = as->mcp;
1911   T->mcloop = as->mcloop ? (MSize)((char *)as->mcloop - (char *)as->mcp) : 0;
1912   if (!as->loopref)
1913     asm_tail_fixup(as, T->link);  /* Note: this may change as->mctop! */
1914   T->szmcode = (MSize)((char *)as->mctop - (char *)as->mcp);
1915   lj_mcode_sync(T->mcode, origtop);
1916 }
1917 
1918 #undef IR
1919 
1920 #endif

/* [<][>][^][v][top][bottom][index][help] */