xref: /freebsd/contrib/llvm-project/llvm/lib/Target/WebAssembly/WebAssemblyLowerEmscriptenEHSjLj.cpp (revision 0fca6ea1d4eea4c934cfff25ac9ee8ad6fe95583)
1 //=== WebAssemblyLowerEmscriptenEHSjLj.cpp - Lower exceptions for Emscripten =//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 ///
9 /// \file
10 /// This file lowers exception-related instructions and setjmp/longjmp function
11 /// calls to use Emscripten's library functions. The pass uses JavaScript's try
12 /// and catch mechanism in case of Emscripten EH/SjLj and Wasm EH intrinsics in
13 /// case of Emscripten SjLJ.
14 ///
15 /// * Emscripten exception handling
16 /// This pass lowers invokes and landingpads into library functions in JS glue
17 /// code. Invokes are lowered into function wrappers called invoke wrappers that
18 /// exist in JS side, which wraps the original function call with JS try-catch.
19 /// If an exception occurred, cxa_throw() function in JS side sets some
20 /// variables (see below) so we can check whether an exception occurred from
21 /// wasm code and handle it appropriately.
22 ///
23 /// * Emscripten setjmp-longjmp handling
24 /// This pass lowers setjmp to a reasonably-performant approach for emscripten.
25 /// The idea is that each block with a setjmp is broken up into two parts: the
26 /// part containing setjmp and the part right after the setjmp. The latter part
27 /// is either reached from the setjmp, or later from a longjmp. To handle the
28 /// longjmp, all calls that might longjmp are also called using invoke wrappers
29 /// and thus JS / try-catch. JS longjmp() function also sets some variables so
30 /// we can check / whether a longjmp occurred from wasm code. Each block with a
31 /// function call that might longjmp is also split up after the longjmp call.
32 /// After the longjmp call, we check whether a longjmp occurred, and if it did,
33 /// which setjmp it corresponds to, and jump to the right post-setjmp block.
34 /// We assume setjmp-longjmp handling always run after EH handling, which means
35 /// we don't expect any exception-related instructions when SjLj runs.
36 /// FIXME Currently this scheme does not support indirect call of setjmp,
37 /// because of the limitation of the scheme itself. fastcomp does not support it
38 /// either.
39 ///
40 /// In detail, this pass does following things:
41 ///
42 /// 1) Assumes the existence of global variables: __THREW__, __threwValue
43 ///    __THREW__ and __threwValue are defined in compiler-rt in Emscripten.
44 ///    These variables are used for both exceptions and setjmp/longjmps.
45 ///    __THREW__ indicates whether an exception or a longjmp occurred or not. 0
46 ///    means nothing occurred, 1 means an exception occurred, and other numbers
47 ///    mean a longjmp occurred. In the case of longjmp, __THREW__ variable
48 ///    indicates the corresponding setjmp buffer the longjmp corresponds to.
49 ///    __threwValue is 0 for exceptions, and the argument to longjmp in case of
50 ///    longjmp.
51 ///
52 /// * Emscripten exception handling
53 ///
54 /// 2) We assume the existence of setThrew and setTempRet0/getTempRet0 functions
55 ///    at link time. setThrew exists in Emscripten's compiler-rt:
56 ///
57 ///    void setThrew(uintptr_t threw, int value) {
58 ///      if (__THREW__ == 0) {
59 ///        __THREW__ = threw;
60 ///        __threwValue = value;
61 ///      }
62 ///    }
63 //
64 ///    setTempRet0 is called from __cxa_find_matching_catch() in JS glue code.
65 ///    In exception handling, getTempRet0 indicates the type of an exception
66 ///    caught, and in setjmp/longjmp, it means the second argument to longjmp
67 ///    function.
68 ///
69 /// 3) Lower
70 ///      invoke @func(arg1, arg2) to label %invoke.cont unwind label %lpad
71 ///    into
72 ///      __THREW__ = 0;
73 ///      call @__invoke_SIG(func, arg1, arg2)
74 ///      %__THREW__.val = __THREW__;
75 ///      __THREW__ = 0;
76 ///      if (%__THREW__.val == 1)
77 ///        goto %lpad
78 ///      else
79 ///         goto %invoke.cont
80 ///    SIG is a mangled string generated based on the LLVM IR-level function
81 ///    signature. After LLVM IR types are lowered to the target wasm types,
82 ///    the names for these wrappers will change based on wasm types as well,
83 ///    as in invoke_vi (function takes an int and returns void). The bodies of
84 ///    these wrappers will be generated in JS glue code, and inside those
85 ///    wrappers we use JS try-catch to generate actual exception effects. It
86 ///    also calls the original callee function. An example wrapper in JS code
87 ///    would look like this:
88 ///      function invoke_vi(index,a1) {
89 ///        try {
90 ///          Module["dynCall_vi"](index,a1); // This calls original callee
91 ///        } catch(e) {
92 ///          if (typeof e !== 'number' && e !== 'longjmp') throw e;
93 ///          _setThrew(1, 0); // setThrew is called here
94 ///        }
95 ///      }
96 ///    If an exception is thrown, __THREW__ will be set to true in a wrapper,
97 ///    so we can jump to the right BB based on this value.
98 ///
99 /// 4) Lower
100 ///      %val = landingpad catch c1 catch c2 catch c3 ...
101 ///      ... use %val ...
102 ///    into
103 ///      %fmc = call @__cxa_find_matching_catch_N(c1, c2, c3, ...)
104 ///      %val = {%fmc, getTempRet0()}
105 ///      ... use %val ...
106 ///    Here N is a number calculated based on the number of clauses.
107 ///    setTempRet0 is called from __cxa_find_matching_catch() in JS glue code.
108 ///
109 /// 5) Lower
110 ///      resume {%a, %b}
111 ///    into
112 ///      call @__resumeException(%a)
113 ///    where __resumeException() is a function in JS glue code.
114 ///
115 /// 6) Lower
116 ///      call @llvm.eh.typeid.for(type) (intrinsic)
117 ///    into
118 ///      call @llvm_eh_typeid_for(type)
119 ///    llvm_eh_typeid_for function will be generated in JS glue code.
120 ///
121 /// * Emscripten setjmp / longjmp handling
122 ///
123 /// If there are calls to longjmp()
124 ///
125 /// 1) Lower
126 ///      longjmp(env, val)
127 ///    into
128 ///      emscripten_longjmp(env, val)
129 ///
130 /// If there are calls to setjmp()
131 ///
132 /// 2) In the function entry that calls setjmp, initialize
133 ///    functionInvocationId as follows:
134 ///
135 ///    functionInvocationId = alloca(4)
136 ///
137 ///    Note: the alloca size is not important as this pointer is
138 ///    merely used for pointer comparisions.
139 ///
140 /// 3) Lower
141 ///      setjmp(env)
142 ///    into
143 ///      __wasm_setjmp(env, label, functionInvocationId)
144 ///
145 ///    __wasm_setjmp records the necessary info (the label and
146 ///    functionInvocationId) to the "env".
147 ///    A BB with setjmp is split into two after setjmp call in order to
148 ///    make the post-setjmp BB the possible destination of longjmp BB.
149 ///
150 /// 4) Lower every call that might longjmp into
151 ///      __THREW__ = 0;
152 ///      call @__invoke_SIG(func, arg1, arg2)
153 ///      %__THREW__.val = __THREW__;
154 ///      __THREW__ = 0;
155 ///      %__threwValue.val = __threwValue;
156 ///      if (%__THREW__.val != 0 & %__threwValue.val != 0) {
157 ///        %label = __wasm_setjmp_test(%__THREW__.val, functionInvocationId);
158 ///        if (%label == 0)
159 ///          emscripten_longjmp(%__THREW__.val, %__threwValue.val);
160 ///        setTempRet0(%__threwValue.val);
161 ///      } else {
162 ///        %label = -1;
163 ///      }
164 ///      longjmp_result = getTempRet0();
165 ///      switch %label {
166 ///        label 1: goto post-setjmp BB 1
167 ///        label 2: goto post-setjmp BB 2
168 ///        ...
169 ///        default: goto splitted next BB
170 ///      }
171 ///
172 ///    __wasm_setjmp_test examines the jmp buf to see if it was for a matching
173 ///    setjmp call. After calling an invoke wrapper, if a longjmp occurred,
174 ///    __THREW__ will be the address of matching jmp_buf buffer and
175 ///    __threwValue be the second argument to longjmp.
176 ///    __wasm_setjmp_test returns a setjmp label, a unique ID to each setjmp
177 ///    callsite. Label 0 means this longjmp buffer does not correspond to one
178 ///    of the setjmp callsites in this function, so in this case we just chain
179 ///    the longjmp to the caller. Label -1 means no longjmp occurred.
180 ///    Otherwise we jump to the right post-setjmp BB based on the label.
181 ///
182 /// * Wasm setjmp / longjmp handling
183 /// This mode still uses some Emscripten library functions but not JavaScript's
184 /// try-catch mechanism. It instead uses Wasm exception handling intrinsics,
185 /// which will be lowered to exception handling instructions.
186 ///
187 /// If there are calls to longjmp()
188 ///
189 /// 1) Lower
190 ///      longjmp(env, val)
191 ///    into
192 ///      __wasm_longjmp(env, val)
193 ///
194 /// If there are calls to setjmp()
195 ///
196 /// 2) and 3): The same as 2) and 3) in Emscripten SjLj.
197 /// (functionInvocationId initialization + setjmp callsite transformation)
198 ///
199 /// 4) Create a catchpad with a wasm.catch() intrinsic, which returns the value
200 /// thrown by __wasm_longjmp function. In the runtime library, we have an
201 /// equivalent of the following struct:
202 ///
203 /// struct __WasmLongjmpArgs {
204 ///   void *env;
205 ///   int val;
206 /// };
207 ///
208 /// The thrown value here is a pointer to the struct. We use this struct to
209 /// transfer two values by throwing a single value. Wasm throw and catch
210 /// instructions are capable of throwing and catching multiple values, but
211 /// it also requires multivalue support that is currently not very reliable.
212 /// TODO Switch to throwing and catching two values without using the struct
213 ///
214 /// All longjmpable function calls will be converted to an invoke that will
215 /// unwind to this catchpad in case a longjmp occurs. Within the catchpad, we
216 /// test the thrown values using __wasm_setjmp_test function as we do for
217 /// Emscripten SjLj. The main difference is, in Emscripten SjLj, we need to
218 /// transform every longjmpable callsite into a sequence of code including
219 /// __wasm_setjmp_test() call; in Wasm SjLj we do the testing in only one
220 /// place, in this catchpad.
221 ///
222 /// After testing calling __wasm_setjmp_test(), if the longjmp does not
223 /// correspond to one of the setjmps within the current function, it rethrows
224 /// the longjmp by calling __wasm_longjmp(). If it corresponds to one of
225 /// setjmps in the function, we jump to the beginning of the function, which
226 /// contains a switch to each post-setjmp BB. Again, in Emscripten SjLj, this
227 /// switch is added for every longjmpable callsite; in Wasm SjLj we do this
228 /// only once at the top of the function. (after functionInvocationId
229 /// initialization)
230 ///
231 /// The below is the pseudocode for what we have described
232 ///
233 /// entry:
234 ///   Initialize functionInvocationId
235 ///
236 /// setjmp.dispatch:
237 ///    switch %label {
238 ///      label 1: goto post-setjmp BB 1
239 ///      label 2: goto post-setjmp BB 2
240 ///      ...
241 ///      default: goto splitted next BB
242 ///    }
243 /// ...
244 ///
245 /// bb:
246 ///   invoke void @foo() ;; foo is a longjmpable function
247 ///     to label %next unwind label %catch.dispatch.longjmp
248 /// ...
249 ///
250 /// catch.dispatch.longjmp:
251 ///   %0 = catchswitch within none [label %catch.longjmp] unwind to caller
252 ///
253 /// catch.longjmp:
254 ///   %longjmp.args = wasm.catch() ;; struct __WasmLongjmpArgs
255 ///   %env = load 'env' field from __WasmLongjmpArgs
256 ///   %val = load 'val' field from __WasmLongjmpArgs
257 ///   %label = __wasm_setjmp_test(%env, functionInvocationId);
258 ///   if (%label == 0)
259 ///     __wasm_longjmp(%env, %val)
260 ///   catchret to %setjmp.dispatch
261 ///
262 ///===----------------------------------------------------------------------===//
263 
264 #include "MCTargetDesc/WebAssemblyMCTargetDesc.h"
265 #include "WebAssembly.h"
266 #include "WebAssemblyTargetMachine.h"
267 #include "llvm/ADT/StringExtras.h"
268 #include "llvm/CodeGen/TargetPassConfig.h"
269 #include "llvm/CodeGen/WasmEHFuncInfo.h"
270 #include "llvm/IR/DebugInfoMetadata.h"
271 #include "llvm/IR/Dominators.h"
272 #include "llvm/IR/IRBuilder.h"
273 #include "llvm/IR/IntrinsicsWebAssembly.h"
274 #include "llvm/IR/Module.h"
275 #include "llvm/Support/CommandLine.h"
276 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
277 #include "llvm/Transforms/Utils/Local.h"
278 #include "llvm/Transforms/Utils/SSAUpdater.h"
279 #include "llvm/Transforms/Utils/SSAUpdaterBulk.h"
280 #include <set>
281 
282 using namespace llvm;
283 
284 #define DEBUG_TYPE "wasm-lower-em-ehsjlj"
285 
286 static cl::list<std::string>
287     EHAllowlist("emscripten-cxx-exceptions-allowed",
288                 cl::desc("The list of function names in which Emscripten-style "
289                          "exception handling is enabled (see emscripten "
290                          "EMSCRIPTEN_CATCHING_ALLOWED options)"),
291                 cl::CommaSeparated);
292 
293 namespace {
294 class WebAssemblyLowerEmscriptenEHSjLj final : public ModulePass {
295   bool EnableEmEH;     // Enable Emscripten exception handling
296   bool EnableEmSjLj;   // Enable Emscripten setjmp/longjmp handling
297   bool EnableWasmSjLj; // Enable Wasm setjmp/longjmp handling
298   bool DoSjLj;         // Whether we actually perform setjmp/longjmp handling
299 
300   GlobalVariable *ThrewGV = nullptr;      // __THREW__ (Emscripten)
301   GlobalVariable *ThrewValueGV = nullptr; // __threwValue (Emscripten)
302   Function *GetTempRet0F = nullptr;       // getTempRet0() (Emscripten)
303   Function *SetTempRet0F = nullptr;       // setTempRet0() (Emscripten)
304   Function *ResumeF = nullptr;            // __resumeException() (Emscripten)
305   Function *EHTypeIDF = nullptr;          // llvm.eh.typeid.for() (intrinsic)
306   Function *EmLongjmpF = nullptr;         // emscripten_longjmp() (Emscripten)
307   Function *WasmSetjmpF = nullptr;        // __wasm_setjmp() (Emscripten)
308   Function *WasmSetjmpTestF = nullptr;    // __wasm_setjmp_test() (Emscripten)
309   Function *WasmLongjmpF = nullptr;       // __wasm_longjmp() (Emscripten)
310   Function *CatchF = nullptr;             // wasm.catch() (intrinsic)
311 
312   // type of 'struct __WasmLongjmpArgs' defined in emscripten
313   Type *LongjmpArgsTy = nullptr;
314 
315   // __cxa_find_matching_catch_N functions.
316   // Indexed by the number of clauses in an original landingpad instruction.
317   DenseMap<int, Function *> FindMatchingCatches;
318   // Map of <function signature string, invoke_ wrappers>
319   StringMap<Function *> InvokeWrappers;
320   // Set of allowed function names for exception handling
321   std::set<std::string> EHAllowlistSet;
322   // Functions that contains calls to setjmp
323   SmallPtrSet<Function *, 8> SetjmpUsers;
324 
getPassName() const325   StringRef getPassName() const override {
326     return "WebAssembly Lower Emscripten Exceptions";
327   }
328 
329   using InstVector = SmallVectorImpl<Instruction *>;
330   bool runEHOnFunction(Function &F);
331   bool runSjLjOnFunction(Function &F);
332   void handleLongjmpableCallsForEmscriptenSjLj(
333       Function &F, Instruction *FunctionInvocationId,
334       SmallVectorImpl<PHINode *> &SetjmpRetPHIs);
335   void
336   handleLongjmpableCallsForWasmSjLj(Function &F,
337                                     Instruction *FunctionInvocationId,
338                                     SmallVectorImpl<PHINode *> &SetjmpRetPHIs);
339   Function *getFindMatchingCatch(Module &M, unsigned NumClauses);
340 
341   Value *wrapInvoke(CallBase *CI);
342   void wrapTestSetjmp(BasicBlock *BB, DebugLoc DL, Value *Threw,
343                       Value *FunctionInvocationId, Value *&Label,
344                       Value *&LongjmpResult, BasicBlock *&CallEmLongjmpBB,
345                       PHINode *&CallEmLongjmpBBThrewPHI,
346                       PHINode *&CallEmLongjmpBBThrewValuePHI,
347                       BasicBlock *&EndBB);
348   Function *getInvokeWrapper(CallBase *CI);
349 
areAllExceptionsAllowed() const350   bool areAllExceptionsAllowed() const { return EHAllowlistSet.empty(); }
supportsException(const Function * F) const351   bool supportsException(const Function *F) const {
352     return EnableEmEH && (areAllExceptionsAllowed() ||
353                           EHAllowlistSet.count(std::string(F->getName())));
354   }
355   void replaceLongjmpWith(Function *LongjmpF, Function *NewF);
356 
357   void rebuildSSA(Function &F);
358 
359 public:
360   static char ID;
361 
WebAssemblyLowerEmscriptenEHSjLj()362   WebAssemblyLowerEmscriptenEHSjLj()
363       : ModulePass(ID), EnableEmEH(WebAssembly::WasmEnableEmEH),
364         EnableEmSjLj(WebAssembly::WasmEnableEmSjLj),
365         EnableWasmSjLj(WebAssembly::WasmEnableSjLj) {
366     assert(!(EnableEmSjLj && EnableWasmSjLj) &&
367            "Two SjLj modes cannot be turned on at the same time");
368     assert(!(EnableEmEH && EnableWasmSjLj) &&
369            "Wasm SjLj should be only used with Wasm EH");
370     EHAllowlistSet.insert(EHAllowlist.begin(), EHAllowlist.end());
371   }
372   bool runOnModule(Module &M) override;
373 
getAnalysisUsage(AnalysisUsage & AU) const374   void getAnalysisUsage(AnalysisUsage &AU) const override {
375     AU.addRequired<DominatorTreeWrapperPass>();
376   }
377 };
378 } // End anonymous namespace
379 
380 char WebAssemblyLowerEmscriptenEHSjLj::ID = 0;
381 INITIALIZE_PASS(WebAssemblyLowerEmscriptenEHSjLj, DEBUG_TYPE,
382                 "WebAssembly Lower Emscripten Exceptions / Setjmp / Longjmp",
383                 false, false)
384 
createWebAssemblyLowerEmscriptenEHSjLj()385 ModulePass *llvm::createWebAssemblyLowerEmscriptenEHSjLj() {
386   return new WebAssemblyLowerEmscriptenEHSjLj();
387 }
388 
canThrow(const Value * V)389 static bool canThrow(const Value *V) {
390   if (const auto *F = dyn_cast<const Function>(V)) {
391     // Intrinsics cannot throw
392     if (F->isIntrinsic())
393       return false;
394     StringRef Name = F->getName();
395     // leave setjmp and longjmp (mostly) alone, we process them properly later
396     if (Name == "setjmp" || Name == "longjmp" || Name == "emscripten_longjmp")
397       return false;
398     return !F->doesNotThrow();
399   }
400   // not a function, so an indirect call - can throw, we can't tell
401   return true;
402 }
403 
404 // Get a thread-local global variable with the given name. If it doesn't exist
405 // declare it, which will generate an import and assume that it will exist at
406 // link time.
getGlobalVariable(Module & M,Type * Ty,WebAssemblyTargetMachine & TM,const char * Name)407 static GlobalVariable *getGlobalVariable(Module &M, Type *Ty,
408                                          WebAssemblyTargetMachine &TM,
409                                          const char *Name) {
410   auto *GV = dyn_cast<GlobalVariable>(M.getOrInsertGlobal(Name, Ty));
411   if (!GV)
412     report_fatal_error(Twine("unable to create global: ") + Name);
413 
414   // Variables created by this function are thread local. If the target does not
415   // support TLS, we depend on CoalesceFeaturesAndStripAtomics to downgrade it
416   // to non-thread-local ones, in which case we don't allow this object to be
417   // linked with other objects using shared memory.
418   GV->setThreadLocalMode(GlobalValue::GeneralDynamicTLSModel);
419   return GV;
420 }
421 
422 // Simple function name mangler.
423 // This function simply takes LLVM's string representation of parameter types
424 // and concatenate them with '_'. There are non-alphanumeric characters but llc
425 // is ok with it, and we need to postprocess these names after the lowering
426 // phase anyway.
getSignature(FunctionType * FTy)427 static std::string getSignature(FunctionType *FTy) {
428   std::string Sig;
429   raw_string_ostream OS(Sig);
430   OS << *FTy->getReturnType();
431   for (Type *ParamTy : FTy->params())
432     OS << "_" << *ParamTy;
433   if (FTy->isVarArg())
434     OS << "_...";
435   Sig = OS.str();
436   erase_if(Sig, isSpace);
437   // When s2wasm parses .s file, a comma means the end of an argument. So a
438   // mangled function name can contain any character but a comma.
439   std::replace(Sig.begin(), Sig.end(), ',', '.');
440   return Sig;
441 }
442 
getEmscriptenFunction(FunctionType * Ty,const Twine & Name,Module * M)443 static Function *getEmscriptenFunction(FunctionType *Ty, const Twine &Name,
444                                        Module *M) {
445   Function* F = Function::Create(Ty, GlobalValue::ExternalLinkage, Name, M);
446   // Tell the linker that this function is expected to be imported from the
447   // 'env' module.
448   if (!F->hasFnAttribute("wasm-import-module")) {
449     llvm::AttrBuilder B(M->getContext());
450     B.addAttribute("wasm-import-module", "env");
451     F->addFnAttrs(B);
452   }
453   if (!F->hasFnAttribute("wasm-import-name")) {
454     llvm::AttrBuilder B(M->getContext());
455     B.addAttribute("wasm-import-name", F->getName());
456     F->addFnAttrs(B);
457   }
458   return F;
459 }
460 
461 // Returns an integer type for the target architecture's address space.
462 // i32 for wasm32 and i64 for wasm64.
getAddrIntType(Module * M)463 static Type *getAddrIntType(Module *M) {
464   IRBuilder<> IRB(M->getContext());
465   return IRB.getIntNTy(M->getDataLayout().getPointerSizeInBits());
466 }
467 
468 // Returns an integer pointer type for the target architecture's address space.
469 // i32* for wasm32 and i64* for wasm64. With opaque pointers this is just a ptr
470 // in address space zero.
getAddrPtrType(Module * M)471 static Type *getAddrPtrType(Module *M) {
472   return PointerType::getUnqual(M->getContext());
473 }
474 
475 // Returns an integer whose type is the integer type for the target's address
476 // space. Returns (i32 C) for wasm32 and (i64 C) for wasm64, when C is the
477 // integer.
getAddrSizeInt(Module * M,uint64_t C)478 static Value *getAddrSizeInt(Module *M, uint64_t C) {
479   IRBuilder<> IRB(M->getContext());
480   return IRB.getIntN(M->getDataLayout().getPointerSizeInBits(), C);
481 }
482 
483 // Returns __cxa_find_matching_catch_N function, where N = NumClauses + 2.
484 // This is because a landingpad instruction contains two more arguments, a
485 // personality function and a cleanup bit, and __cxa_find_matching_catch_N
486 // functions are named after the number of arguments in the original landingpad
487 // instruction.
488 Function *
getFindMatchingCatch(Module & M,unsigned NumClauses)489 WebAssemblyLowerEmscriptenEHSjLj::getFindMatchingCatch(Module &M,
490                                                        unsigned NumClauses) {
491   if (FindMatchingCatches.count(NumClauses))
492     return FindMatchingCatches[NumClauses];
493   PointerType *Int8PtrTy = PointerType::getUnqual(M.getContext());
494   SmallVector<Type *, 16> Args(NumClauses, Int8PtrTy);
495   FunctionType *FTy = FunctionType::get(Int8PtrTy, Args, false);
496   Function *F = getEmscriptenFunction(
497       FTy, "__cxa_find_matching_catch_" + Twine(NumClauses + 2), &M);
498   FindMatchingCatches[NumClauses] = F;
499   return F;
500 }
501 
502 // Generate invoke wrapper seqence with preamble and postamble
503 // Preamble:
504 // __THREW__ = 0;
505 // Postamble:
506 // %__THREW__.val = __THREW__; __THREW__ = 0;
507 // Returns %__THREW__.val, which indicates whether an exception is thrown (or
508 // whether longjmp occurred), for future use.
wrapInvoke(CallBase * CI)509 Value *WebAssemblyLowerEmscriptenEHSjLj::wrapInvoke(CallBase *CI) {
510   Module *M = CI->getModule();
511   LLVMContext &C = M->getContext();
512 
513   IRBuilder<> IRB(C);
514   IRB.SetInsertPoint(CI);
515 
516   // Pre-invoke
517   // __THREW__ = 0;
518   IRB.CreateStore(getAddrSizeInt(M, 0), ThrewGV);
519 
520   // Invoke function wrapper in JavaScript
521   SmallVector<Value *, 16> Args;
522   // Put the pointer to the callee as first argument, so it can be called
523   // within the invoke wrapper later
524   Args.push_back(CI->getCalledOperand());
525   Args.append(CI->arg_begin(), CI->arg_end());
526   CallInst *NewCall = IRB.CreateCall(getInvokeWrapper(CI), Args);
527   NewCall->takeName(CI);
528   NewCall->setCallingConv(CallingConv::WASM_EmscriptenInvoke);
529   NewCall->setDebugLoc(CI->getDebugLoc());
530 
531   // Because we added the pointer to the callee as first argument, all
532   // argument attribute indices have to be incremented by one.
533   SmallVector<AttributeSet, 8> ArgAttributes;
534   const AttributeList &InvokeAL = CI->getAttributes();
535 
536   // No attributes for the callee pointer.
537   ArgAttributes.push_back(AttributeSet());
538   // Copy the argument attributes from the original
539   for (unsigned I = 0, E = CI->arg_size(); I < E; ++I)
540     ArgAttributes.push_back(InvokeAL.getParamAttrs(I));
541 
542   AttrBuilder FnAttrs(CI->getContext(), InvokeAL.getFnAttrs());
543   if (auto Args = FnAttrs.getAllocSizeArgs()) {
544     // The allocsize attribute (if any) referes to parameters by index and needs
545     // to be adjusted.
546     auto [SizeArg, NEltArg] = *Args;
547     SizeArg += 1;
548     if (NEltArg)
549       NEltArg = *NEltArg + 1;
550     FnAttrs.addAllocSizeAttr(SizeArg, NEltArg);
551   }
552   // In case the callee has 'noreturn' attribute, We need to remove it, because
553   // we expect invoke wrappers to return.
554   FnAttrs.removeAttribute(Attribute::NoReturn);
555 
556   // Reconstruct the AttributesList based on the vector we constructed.
557   AttributeList NewCallAL = AttributeList::get(
558       C, AttributeSet::get(C, FnAttrs), InvokeAL.getRetAttrs(), ArgAttributes);
559   NewCall->setAttributes(NewCallAL);
560 
561   CI->replaceAllUsesWith(NewCall);
562 
563   // Post-invoke
564   // %__THREW__.val = __THREW__; __THREW__ = 0;
565   Value *Threw =
566       IRB.CreateLoad(getAddrIntType(M), ThrewGV, ThrewGV->getName() + ".val");
567   IRB.CreateStore(getAddrSizeInt(M, 0), ThrewGV);
568   return Threw;
569 }
570 
571 // Get matching invoke wrapper based on callee signature
getInvokeWrapper(CallBase * CI)572 Function *WebAssemblyLowerEmscriptenEHSjLj::getInvokeWrapper(CallBase *CI) {
573   Module *M = CI->getModule();
574   SmallVector<Type *, 16> ArgTys;
575   FunctionType *CalleeFTy = CI->getFunctionType();
576 
577   std::string Sig = getSignature(CalleeFTy);
578   if (InvokeWrappers.contains(Sig))
579     return InvokeWrappers[Sig];
580 
581   // Put the pointer to the callee as first argument
582   ArgTys.push_back(PointerType::getUnqual(CalleeFTy));
583   // Add argument types
584   ArgTys.append(CalleeFTy->param_begin(), CalleeFTy->param_end());
585 
586   FunctionType *FTy = FunctionType::get(CalleeFTy->getReturnType(), ArgTys,
587                                         CalleeFTy->isVarArg());
588   Function *F = getEmscriptenFunction(FTy, "__invoke_" + Sig, M);
589   InvokeWrappers[Sig] = F;
590   return F;
591 }
592 
canLongjmp(const Value * Callee)593 static bool canLongjmp(const Value *Callee) {
594   if (auto *CalleeF = dyn_cast<Function>(Callee))
595     if (CalleeF->isIntrinsic())
596       return false;
597 
598   // Attempting to transform inline assembly will result in something like:
599   //     call void @__invoke_void(void ()* asm ...)
600   // which is invalid because inline assembly blocks do not have addresses
601   // and can't be passed by pointer. The result is a crash with illegal IR.
602   if (isa<InlineAsm>(Callee))
603     return false;
604   StringRef CalleeName = Callee->getName();
605 
606   // TODO Include more functions or consider checking with mangled prefixes
607 
608   // The reason we include malloc/free here is to exclude the malloc/free
609   // calls generated in setjmp prep / cleanup routines.
610   if (CalleeName == "setjmp" || CalleeName == "malloc" || CalleeName == "free")
611     return false;
612 
613   // There are functions in Emscripten's JS glue code or compiler-rt
614   if (CalleeName == "__resumeException" || CalleeName == "llvm_eh_typeid_for" ||
615       CalleeName == "__wasm_setjmp" || CalleeName == "__wasm_setjmp_test" ||
616       CalleeName == "getTempRet0" || CalleeName == "setTempRet0")
617     return false;
618 
619   // __cxa_find_matching_catch_N functions cannot longjmp
620   if (Callee->getName().starts_with("__cxa_find_matching_catch_"))
621     return false;
622 
623   // Exception-catching related functions
624   //
625   // We intentionally treat __cxa_end_catch longjmpable in Wasm SjLj even though
626   // it surely cannot longjmp, in order to maintain the unwind relationship from
627   // all existing catchpads (and calls within them) to catch.dispatch.longjmp.
628   //
629   // In Wasm EH + Wasm SjLj, we
630   // 1. Make all catchswitch and cleanuppad that unwind to caller unwind to
631   //    catch.dispatch.longjmp instead
632   // 2. Convert all longjmpable calls to invokes that unwind to
633   //    catch.dispatch.longjmp
634   // But catchswitch BBs are removed in isel, so if an EH catchswitch (generated
635   // from an exception)'s catchpad does not contain any calls that are converted
636   // into invokes unwinding to catch.dispatch.longjmp, this unwind relationship
637   // (EH catchswitch BB -> catch.dispatch.longjmp BB) is lost and
638   // catch.dispatch.longjmp BB can be placed before the EH catchswitch BB in
639   // CFGSort.
640   // int ret = setjmp(buf);
641   // try {
642   //   foo(); // longjmps
643   // } catch (...) {
644   // }
645   // Then in this code, if 'foo' longjmps, it first unwinds to 'catch (...)'
646   // catchswitch, and is not caught by that catchswitch because it is a longjmp,
647   // then it should next unwind to catch.dispatch.longjmp BB. But if this 'catch
648   // (...)' catchswitch -> catch.dispatch.longjmp unwind relationship is lost,
649   // it will not unwind to catch.dispatch.longjmp, producing an incorrect
650   // result.
651   //
652   // Every catchpad generated by Wasm C++ contains __cxa_end_catch, so we
653   // intentionally treat it as longjmpable to work around this problem. This is
654   // a hacky fix but an easy one.
655   //
656   // The comment block in findWasmUnwindDestinations() in
657   // SelectionDAGBuilder.cpp is addressing a similar problem.
658   if (CalleeName == "__cxa_end_catch")
659     return WebAssembly::WasmEnableSjLj;
660   if (CalleeName == "__cxa_begin_catch" ||
661       CalleeName == "__cxa_allocate_exception" || CalleeName == "__cxa_throw" ||
662       CalleeName == "__clang_call_terminate")
663     return false;
664 
665   // std::terminate, which is generated when another exception occurs while
666   // handling an exception, cannot longjmp.
667   if (CalleeName == "_ZSt9terminatev")
668     return false;
669 
670   // Otherwise we don't know
671   return true;
672 }
673 
isEmAsmCall(const Value * Callee)674 static bool isEmAsmCall(const Value *Callee) {
675   StringRef CalleeName = Callee->getName();
676   // This is an exhaustive list from Emscripten's <emscripten/em_asm.h>.
677   return CalleeName == "emscripten_asm_const_int" ||
678          CalleeName == "emscripten_asm_const_double" ||
679          CalleeName == "emscripten_asm_const_int_sync_on_main_thread" ||
680          CalleeName == "emscripten_asm_const_double_sync_on_main_thread" ||
681          CalleeName == "emscripten_asm_const_async_on_main_thread";
682 }
683 
684 // Generate __wasm_setjmp_test function call seqence with preamble and
685 // postamble. The code this generates is equivalent to the following
686 // JavaScript code:
687 // %__threwValue.val = __threwValue;
688 // if (%__THREW__.val != 0 & %__threwValue.val != 0) {
689 //   %label = __wasm_setjmp_test(%__THREW__.val, functionInvocationId);
690 //   if (%label == 0)
691 //     emscripten_longjmp(%__THREW__.val, %__threwValue.val);
692 //   setTempRet0(%__threwValue.val);
693 // } else {
694 //   %label = -1;
695 // }
696 // %longjmp_result = getTempRet0();
697 //
698 // As output parameters. returns %label, %longjmp_result, and the BB the last
699 // instruction (%longjmp_result = ...) is in.
wrapTestSetjmp(BasicBlock * BB,DebugLoc DL,Value * Threw,Value * FunctionInvocationId,Value * & Label,Value * & LongjmpResult,BasicBlock * & CallEmLongjmpBB,PHINode * & CallEmLongjmpBBThrewPHI,PHINode * & CallEmLongjmpBBThrewValuePHI,BasicBlock * & EndBB)700 void WebAssemblyLowerEmscriptenEHSjLj::wrapTestSetjmp(
701     BasicBlock *BB, DebugLoc DL, Value *Threw, Value *FunctionInvocationId,
702     Value *&Label, Value *&LongjmpResult, BasicBlock *&CallEmLongjmpBB,
703     PHINode *&CallEmLongjmpBBThrewPHI, PHINode *&CallEmLongjmpBBThrewValuePHI,
704     BasicBlock *&EndBB) {
705   Function *F = BB->getParent();
706   Module *M = F->getParent();
707   LLVMContext &C = M->getContext();
708   IRBuilder<> IRB(C);
709   IRB.SetCurrentDebugLocation(DL);
710 
711   // if (%__THREW__.val != 0 & %__threwValue.val != 0)
712   IRB.SetInsertPoint(BB);
713   BasicBlock *ThenBB1 = BasicBlock::Create(C, "if.then1", F);
714   BasicBlock *ElseBB1 = BasicBlock::Create(C, "if.else1", F);
715   BasicBlock *EndBB1 = BasicBlock::Create(C, "if.end", F);
716   Value *ThrewCmp = IRB.CreateICmpNE(Threw, getAddrSizeInt(M, 0));
717   Value *ThrewValue = IRB.CreateLoad(IRB.getInt32Ty(), ThrewValueGV,
718                                      ThrewValueGV->getName() + ".val");
719   Value *ThrewValueCmp = IRB.CreateICmpNE(ThrewValue, IRB.getInt32(0));
720   Value *Cmp1 = IRB.CreateAnd(ThrewCmp, ThrewValueCmp, "cmp1");
721   IRB.CreateCondBr(Cmp1, ThenBB1, ElseBB1);
722 
723   // Generate call.em.longjmp BB once and share it within the function
724   if (!CallEmLongjmpBB) {
725     // emscripten_longjmp(%__THREW__.val, %__threwValue.val);
726     CallEmLongjmpBB = BasicBlock::Create(C, "call.em.longjmp", F);
727     IRB.SetInsertPoint(CallEmLongjmpBB);
728     CallEmLongjmpBBThrewPHI = IRB.CreatePHI(getAddrIntType(M), 4, "threw.phi");
729     CallEmLongjmpBBThrewValuePHI =
730         IRB.CreatePHI(IRB.getInt32Ty(), 4, "threwvalue.phi");
731     CallEmLongjmpBBThrewPHI->addIncoming(Threw, ThenBB1);
732     CallEmLongjmpBBThrewValuePHI->addIncoming(ThrewValue, ThenBB1);
733     IRB.CreateCall(EmLongjmpF,
734                    {CallEmLongjmpBBThrewPHI, CallEmLongjmpBBThrewValuePHI});
735     IRB.CreateUnreachable();
736   } else {
737     CallEmLongjmpBBThrewPHI->addIncoming(Threw, ThenBB1);
738     CallEmLongjmpBBThrewValuePHI->addIncoming(ThrewValue, ThenBB1);
739   }
740 
741   // %label = __wasm_setjmp_test(%__THREW__.val, functionInvocationId);
742   // if (%label == 0)
743   IRB.SetInsertPoint(ThenBB1);
744   BasicBlock *EndBB2 = BasicBlock::Create(C, "if.end2", F);
745   Value *ThrewPtr =
746       IRB.CreateIntToPtr(Threw, getAddrPtrType(M), Threw->getName() + ".p");
747   Value *ThenLabel = IRB.CreateCall(WasmSetjmpTestF,
748                                     {ThrewPtr, FunctionInvocationId}, "label");
749   Value *Cmp2 = IRB.CreateICmpEQ(ThenLabel, IRB.getInt32(0));
750   IRB.CreateCondBr(Cmp2, CallEmLongjmpBB, EndBB2);
751 
752   // setTempRet0(%__threwValue.val);
753   IRB.SetInsertPoint(EndBB2);
754   IRB.CreateCall(SetTempRet0F, ThrewValue);
755   IRB.CreateBr(EndBB1);
756 
757   IRB.SetInsertPoint(ElseBB1);
758   IRB.CreateBr(EndBB1);
759 
760   // longjmp_result = getTempRet0();
761   IRB.SetInsertPoint(EndBB1);
762   PHINode *LabelPHI = IRB.CreatePHI(IRB.getInt32Ty(), 2, "label");
763   LabelPHI->addIncoming(ThenLabel, EndBB2);
764 
765   LabelPHI->addIncoming(IRB.getInt32(-1), ElseBB1);
766 
767   // Output parameter assignment
768   Label = LabelPHI;
769   EndBB = EndBB1;
770   LongjmpResult = IRB.CreateCall(GetTempRet0F, std::nullopt, "longjmp_result");
771 }
772 
rebuildSSA(Function & F)773 void WebAssemblyLowerEmscriptenEHSjLj::rebuildSSA(Function &F) {
774   DominatorTree &DT = getAnalysis<DominatorTreeWrapperPass>(F).getDomTree();
775   DT.recalculate(F); // CFG has been changed
776 
777   SSAUpdaterBulk SSA;
778   for (BasicBlock &BB : F) {
779     for (Instruction &I : BB) {
780       unsigned VarID = SSA.AddVariable(I.getName(), I.getType());
781       // If a value is defined by an invoke instruction, it is only available in
782       // its normal destination and not in its unwind destination.
783       if (auto *II = dyn_cast<InvokeInst>(&I))
784         SSA.AddAvailableValue(VarID, II->getNormalDest(), II);
785       else
786         SSA.AddAvailableValue(VarID, &BB, &I);
787       for (auto &U : I.uses()) {
788         auto *User = cast<Instruction>(U.getUser());
789         if (auto *UserPN = dyn_cast<PHINode>(User))
790           if (UserPN->getIncomingBlock(U) == &BB)
791             continue;
792         if (DT.dominates(&I, User))
793           continue;
794         SSA.AddUse(VarID, &U);
795       }
796     }
797   }
798   SSA.RewriteAllUses(&DT);
799 }
800 
801 // Replace uses of longjmp with a new longjmp function in Emscripten library.
802 // In Emscripten SjLj, the new function is
803 //   void emscripten_longjmp(uintptr_t, i32)
804 // In Wasm SjLj, the new function is
805 //   void __wasm_longjmp(i8*, i32)
806 // Because the original libc longjmp function takes (jmp_buf*, i32), we need a
807 // ptrtoint/bitcast instruction here to make the type match. jmp_buf* will
808 // eventually be lowered to i32/i64 in the wasm backend.
replaceLongjmpWith(Function * LongjmpF,Function * NewF)809 void WebAssemblyLowerEmscriptenEHSjLj::replaceLongjmpWith(Function *LongjmpF,
810                                                           Function *NewF) {
811   assert(NewF == EmLongjmpF || NewF == WasmLongjmpF);
812   Module *M = LongjmpF->getParent();
813   SmallVector<CallInst *, 8> ToErase;
814   LLVMContext &C = LongjmpF->getParent()->getContext();
815   IRBuilder<> IRB(C);
816 
817   // For calls to longjmp, replace it with emscripten_longjmp/__wasm_longjmp and
818   // cast its first argument (jmp_buf*) appropriately
819   for (User *U : LongjmpF->users()) {
820     auto *CI = dyn_cast<CallInst>(U);
821     if (CI && CI->getCalledFunction() == LongjmpF) {
822       IRB.SetInsertPoint(CI);
823       Value *Env = nullptr;
824       if (NewF == EmLongjmpF)
825         Env =
826             IRB.CreatePtrToInt(CI->getArgOperand(0), getAddrIntType(M), "env");
827       else // WasmLongjmpF
828         Env = IRB.CreateBitCast(CI->getArgOperand(0), IRB.getPtrTy(), "env");
829       IRB.CreateCall(NewF, {Env, CI->getArgOperand(1)});
830       ToErase.push_back(CI);
831     }
832   }
833   for (auto *I : ToErase)
834     I->eraseFromParent();
835 
836   // If we have any remaining uses of longjmp's function pointer, replace it
837   // with (void(*)(jmp_buf*, int))emscripten_longjmp / __wasm_longjmp.
838   if (!LongjmpF->uses().empty()) {
839     Value *NewLongjmp =
840         IRB.CreateBitCast(NewF, LongjmpF->getType(), "longjmp.cast");
841     LongjmpF->replaceAllUsesWith(NewLongjmp);
842   }
843 }
844 
containsLongjmpableCalls(const Function * F)845 static bool containsLongjmpableCalls(const Function *F) {
846   for (const auto &BB : *F)
847     for (const auto &I : BB)
848       if (const auto *CB = dyn_cast<CallBase>(&I))
849         if (canLongjmp(CB->getCalledOperand()))
850           return true;
851   return false;
852 }
853 
854 // When a function contains a setjmp call but not other calls that can longjmp,
855 // we don't do setjmp transformation for that setjmp. But we need to convert the
856 // setjmp calls into "i32 0" so they don't cause link time errors. setjmp always
857 // returns 0 when called directly.
nullifySetjmp(Function * F)858 static void nullifySetjmp(Function *F) {
859   Module &M = *F->getParent();
860   IRBuilder<> IRB(M.getContext());
861   Function *SetjmpF = M.getFunction("setjmp");
862   SmallVector<Instruction *, 1> ToErase;
863 
864   for (User *U : make_early_inc_range(SetjmpF->users())) {
865     auto *CB = cast<CallBase>(U);
866     BasicBlock *BB = CB->getParent();
867     if (BB->getParent() != F) // in other function
868       continue;
869     CallInst *CI = nullptr;
870     // setjmp cannot throw. So if it is an invoke, lower it to a call
871     if (auto *II = dyn_cast<InvokeInst>(CB))
872       CI = llvm::changeToCall(II);
873     else
874       CI = cast<CallInst>(CB);
875     ToErase.push_back(CI);
876     CI->replaceAllUsesWith(IRB.getInt32(0));
877   }
878   for (auto *I : ToErase)
879     I->eraseFromParent();
880 }
881 
runOnModule(Module & M)882 bool WebAssemblyLowerEmscriptenEHSjLj::runOnModule(Module &M) {
883   LLVM_DEBUG(dbgs() << "********** Lower Emscripten EH & SjLj **********\n");
884 
885   LLVMContext &C = M.getContext();
886   IRBuilder<> IRB(C);
887 
888   Function *SetjmpF = M.getFunction("setjmp");
889   Function *LongjmpF = M.getFunction("longjmp");
890 
891   // In some platforms _setjmp and _longjmp are used instead. Change these to
892   // use setjmp/longjmp instead, because we later detect these functions by
893   // their names.
894   Function *SetjmpF2 = M.getFunction("_setjmp");
895   Function *LongjmpF2 = M.getFunction("_longjmp");
896   if (SetjmpF2) {
897     if (SetjmpF) {
898       if (SetjmpF->getFunctionType() != SetjmpF2->getFunctionType())
899         report_fatal_error("setjmp and _setjmp have different function types");
900     } else {
901       SetjmpF = Function::Create(SetjmpF2->getFunctionType(),
902                                  GlobalValue::ExternalLinkage, "setjmp", M);
903     }
904     SetjmpF2->replaceAllUsesWith(SetjmpF);
905   }
906   if (LongjmpF2) {
907     if (LongjmpF) {
908       if (LongjmpF->getFunctionType() != LongjmpF2->getFunctionType())
909         report_fatal_error(
910             "longjmp and _longjmp have different function types");
911     } else {
912       LongjmpF = Function::Create(LongjmpF2->getFunctionType(),
913                                   GlobalValue::ExternalLinkage, "setjmp", M);
914     }
915     LongjmpF2->replaceAllUsesWith(LongjmpF);
916   }
917 
918   auto *TPC = getAnalysisIfAvailable<TargetPassConfig>();
919   assert(TPC && "Expected a TargetPassConfig");
920   auto &TM = TPC->getTM<WebAssemblyTargetMachine>();
921 
922   // Declare (or get) global variables __THREW__, __threwValue, and
923   // getTempRet0/setTempRet0 function which are used in common for both
924   // exception handling and setjmp/longjmp handling
925   ThrewGV = getGlobalVariable(M, getAddrIntType(&M), TM, "__THREW__");
926   ThrewValueGV = getGlobalVariable(M, IRB.getInt32Ty(), TM, "__threwValue");
927   GetTempRet0F = getEmscriptenFunction(
928       FunctionType::get(IRB.getInt32Ty(), false), "getTempRet0", &M);
929   SetTempRet0F = getEmscriptenFunction(
930       FunctionType::get(IRB.getVoidTy(), IRB.getInt32Ty(), false),
931       "setTempRet0", &M);
932   GetTempRet0F->setDoesNotThrow();
933   SetTempRet0F->setDoesNotThrow();
934 
935   bool Changed = false;
936 
937   // Function registration for exception handling
938   if (EnableEmEH) {
939     // Register __resumeException function
940     FunctionType *ResumeFTy =
941         FunctionType::get(IRB.getVoidTy(), IRB.getPtrTy(), false);
942     ResumeF = getEmscriptenFunction(ResumeFTy, "__resumeException", &M);
943     ResumeF->addFnAttr(Attribute::NoReturn);
944 
945     // Register llvm_eh_typeid_for function
946     FunctionType *EHTypeIDTy =
947         FunctionType::get(IRB.getInt32Ty(), IRB.getPtrTy(), false);
948     EHTypeIDF = getEmscriptenFunction(EHTypeIDTy, "llvm_eh_typeid_for", &M);
949   }
950 
951   // Functions that contains calls to setjmp but don't have other longjmpable
952   // calls within them.
953   SmallPtrSet<Function *, 4> SetjmpUsersToNullify;
954 
955   if ((EnableEmSjLj || EnableWasmSjLj) && SetjmpF) {
956     // Precompute setjmp users
957     for (User *U : SetjmpF->users()) {
958       if (auto *CB = dyn_cast<CallBase>(U)) {
959         auto *UserF = CB->getFunction();
960         // If a function that calls setjmp does not contain any other calls that
961         // can longjmp, we don't need to do any transformation on that function,
962         // so can ignore it
963         if (containsLongjmpableCalls(UserF))
964           SetjmpUsers.insert(UserF);
965         else
966           SetjmpUsersToNullify.insert(UserF);
967       } else {
968         std::string S;
969         raw_string_ostream SS(S);
970         SS << *U;
971         report_fatal_error(Twine("Indirect use of setjmp is not supported: ") +
972                            SS.str());
973       }
974     }
975   }
976 
977   bool SetjmpUsed = SetjmpF && !SetjmpUsers.empty();
978   bool LongjmpUsed = LongjmpF && !LongjmpF->use_empty();
979   DoSjLj = (EnableEmSjLj | EnableWasmSjLj) && (SetjmpUsed || LongjmpUsed);
980 
981   // Function registration and data pre-gathering for setjmp/longjmp handling
982   if (DoSjLj) {
983     assert(EnableEmSjLj || EnableWasmSjLj);
984     if (EnableEmSjLj) {
985       // Register emscripten_longjmp function
986       FunctionType *FTy = FunctionType::get(
987           IRB.getVoidTy(), {getAddrIntType(&M), IRB.getInt32Ty()}, false);
988       EmLongjmpF = getEmscriptenFunction(FTy, "emscripten_longjmp", &M);
989       EmLongjmpF->addFnAttr(Attribute::NoReturn);
990     } else { // EnableWasmSjLj
991       Type *Int8PtrTy = IRB.getPtrTy();
992       // Register __wasm_longjmp function, which calls __builtin_wasm_longjmp.
993       FunctionType *FTy = FunctionType::get(
994           IRB.getVoidTy(), {Int8PtrTy, IRB.getInt32Ty()}, false);
995       WasmLongjmpF = getEmscriptenFunction(FTy, "__wasm_longjmp", &M);
996       WasmLongjmpF->addFnAttr(Attribute::NoReturn);
997     }
998 
999     if (SetjmpF) {
1000       Type *Int8PtrTy = IRB.getPtrTy();
1001       Type *Int32PtrTy = IRB.getPtrTy();
1002       Type *Int32Ty = IRB.getInt32Ty();
1003 
1004       // Register __wasm_setjmp function
1005       FunctionType *SetjmpFTy = SetjmpF->getFunctionType();
1006       FunctionType *FTy = FunctionType::get(
1007           IRB.getVoidTy(), {SetjmpFTy->getParamType(0), Int32Ty, Int32PtrTy},
1008           false);
1009       WasmSetjmpF = getEmscriptenFunction(FTy, "__wasm_setjmp", &M);
1010 
1011       // Register __wasm_setjmp_test function
1012       FTy = FunctionType::get(Int32Ty, {Int32PtrTy, Int32PtrTy}, false);
1013       WasmSetjmpTestF = getEmscriptenFunction(FTy, "__wasm_setjmp_test", &M);
1014 
1015       // wasm.catch() will be lowered down to wasm 'catch' instruction in
1016       // instruction selection.
1017       CatchF = Intrinsic::getDeclaration(&M, Intrinsic::wasm_catch);
1018       // Type for struct __WasmLongjmpArgs
1019       LongjmpArgsTy = StructType::get(Int8PtrTy, // env
1020                                       Int32Ty    // val
1021       );
1022     }
1023   }
1024 
1025   // Exception handling transformation
1026   if (EnableEmEH) {
1027     for (Function &F : M) {
1028       if (F.isDeclaration())
1029         continue;
1030       Changed |= runEHOnFunction(F);
1031     }
1032   }
1033 
1034   // Setjmp/longjmp handling transformation
1035   if (DoSjLj) {
1036     Changed = true; // We have setjmp or longjmp somewhere
1037     if (LongjmpF)
1038       replaceLongjmpWith(LongjmpF, EnableEmSjLj ? EmLongjmpF : WasmLongjmpF);
1039     // Only traverse functions that uses setjmp in order not to insert
1040     // unnecessary prep / cleanup code in every function
1041     if (SetjmpF)
1042       for (Function *F : SetjmpUsers)
1043         runSjLjOnFunction(*F);
1044   }
1045 
1046   // Replace unnecessary setjmp calls with 0
1047   if ((EnableEmSjLj || EnableWasmSjLj) && !SetjmpUsersToNullify.empty()) {
1048     Changed = true;
1049     assert(SetjmpF);
1050     for (Function *F : SetjmpUsersToNullify)
1051       nullifySetjmp(F);
1052   }
1053 
1054   // Delete unused global variables and functions
1055   for (auto *V : {ThrewGV, ThrewValueGV})
1056     if (V && V->use_empty())
1057       V->eraseFromParent();
1058   for (auto *V : {GetTempRet0F, SetTempRet0F, ResumeF, EHTypeIDF, EmLongjmpF,
1059                   WasmSetjmpF, WasmSetjmpTestF, WasmLongjmpF, CatchF})
1060     if (V && V->use_empty())
1061       V->eraseFromParent();
1062 
1063   return Changed;
1064 }
1065 
runEHOnFunction(Function & F)1066 bool WebAssemblyLowerEmscriptenEHSjLj::runEHOnFunction(Function &F) {
1067   Module &M = *F.getParent();
1068   LLVMContext &C = F.getContext();
1069   IRBuilder<> IRB(C);
1070   bool Changed = false;
1071   SmallVector<Instruction *, 64> ToErase;
1072   SmallPtrSet<LandingPadInst *, 32> LandingPads;
1073 
1074   // rethrow.longjmp BB that will be shared within the function.
1075   BasicBlock *RethrowLongjmpBB = nullptr;
1076   // PHI node for the loaded value of __THREW__ global variable in
1077   // rethrow.longjmp BB
1078   PHINode *RethrowLongjmpBBThrewPHI = nullptr;
1079 
1080   for (BasicBlock &BB : F) {
1081     auto *II = dyn_cast<InvokeInst>(BB.getTerminator());
1082     if (!II)
1083       continue;
1084     Changed = true;
1085     LandingPads.insert(II->getLandingPadInst());
1086     IRB.SetInsertPoint(II);
1087 
1088     const Value *Callee = II->getCalledOperand();
1089     bool NeedInvoke = supportsException(&F) && canThrow(Callee);
1090     if (NeedInvoke) {
1091       // Wrap invoke with invoke wrapper and generate preamble/postamble
1092       Value *Threw = wrapInvoke(II);
1093       ToErase.push_back(II);
1094 
1095       // If setjmp/longjmp handling is enabled, the thrown value can be not an
1096       // exception but a longjmp. If the current function contains calls to
1097       // setjmp, it will be appropriately handled in runSjLjOnFunction. But even
1098       // if the function does not contain setjmp calls, we shouldn't silently
1099       // ignore longjmps; we should rethrow them so they can be correctly
1100       // handled in somewhere up the call chain where setjmp is. __THREW__'s
1101       // value is 0 when nothing happened, 1 when an exception is thrown, and
1102       // other values when longjmp is thrown.
1103       //
1104       // if (%__THREW__.val == 0 || %__THREW__.val == 1)
1105       //   goto %tail
1106       // else
1107       //   goto %longjmp.rethrow
1108       //
1109       // rethrow.longjmp: ;; This is longjmp. Rethrow it
1110       //   %__threwValue.val = __threwValue
1111       //   emscripten_longjmp(%__THREW__.val, %__threwValue.val);
1112       //
1113       // tail: ;; Nothing happened or an exception is thrown
1114       //   ... Continue exception handling ...
1115       if (DoSjLj && EnableEmSjLj && !SetjmpUsers.count(&F) &&
1116           canLongjmp(Callee)) {
1117         // Create longjmp.rethrow BB once and share it within the function
1118         if (!RethrowLongjmpBB) {
1119           RethrowLongjmpBB = BasicBlock::Create(C, "rethrow.longjmp", &F);
1120           IRB.SetInsertPoint(RethrowLongjmpBB);
1121           RethrowLongjmpBBThrewPHI =
1122               IRB.CreatePHI(getAddrIntType(&M), 4, "threw.phi");
1123           RethrowLongjmpBBThrewPHI->addIncoming(Threw, &BB);
1124           Value *ThrewValue = IRB.CreateLoad(IRB.getInt32Ty(), ThrewValueGV,
1125                                              ThrewValueGV->getName() + ".val");
1126           IRB.CreateCall(EmLongjmpF, {RethrowLongjmpBBThrewPHI, ThrewValue});
1127           IRB.CreateUnreachable();
1128         } else {
1129           RethrowLongjmpBBThrewPHI->addIncoming(Threw, &BB);
1130         }
1131 
1132         IRB.SetInsertPoint(II); // Restore the insert point back
1133         BasicBlock *Tail = BasicBlock::Create(C, "tail", &F);
1134         Value *CmpEqOne =
1135             IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 1), "cmp.eq.one");
1136         Value *CmpEqZero =
1137             IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 0), "cmp.eq.zero");
1138         Value *Or = IRB.CreateOr(CmpEqZero, CmpEqOne, "or");
1139         IRB.CreateCondBr(Or, Tail, RethrowLongjmpBB);
1140         IRB.SetInsertPoint(Tail);
1141         BB.replaceSuccessorsPhiUsesWith(&BB, Tail);
1142       }
1143 
1144       // Insert a branch based on __THREW__ variable
1145       Value *Cmp = IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 1), "cmp");
1146       IRB.CreateCondBr(Cmp, II->getUnwindDest(), II->getNormalDest());
1147 
1148     } else {
1149       // This can't throw, and we don't need this invoke, just replace it with a
1150       // call+branch
1151       changeToCall(II);
1152     }
1153   }
1154 
1155   // Process resume instructions
1156   for (BasicBlock &BB : F) {
1157     // Scan the body of the basic block for resumes
1158     for (Instruction &I : BB) {
1159       auto *RI = dyn_cast<ResumeInst>(&I);
1160       if (!RI)
1161         continue;
1162       Changed = true;
1163 
1164       // Split the input into legal values
1165       Value *Input = RI->getValue();
1166       IRB.SetInsertPoint(RI);
1167       Value *Low = IRB.CreateExtractValue(Input, 0, "low");
1168       // Create a call to __resumeException function
1169       IRB.CreateCall(ResumeF, {Low});
1170       // Add a terminator to the block
1171       IRB.CreateUnreachable();
1172       ToErase.push_back(RI);
1173     }
1174   }
1175 
1176   // Process llvm.eh.typeid.for intrinsics
1177   for (BasicBlock &BB : F) {
1178     for (Instruction &I : BB) {
1179       auto *CI = dyn_cast<CallInst>(&I);
1180       if (!CI)
1181         continue;
1182       const Function *Callee = CI->getCalledFunction();
1183       if (!Callee)
1184         continue;
1185       if (Callee->getIntrinsicID() != Intrinsic::eh_typeid_for)
1186         continue;
1187       Changed = true;
1188 
1189       IRB.SetInsertPoint(CI);
1190       CallInst *NewCI =
1191           IRB.CreateCall(EHTypeIDF, CI->getArgOperand(0), "typeid");
1192       CI->replaceAllUsesWith(NewCI);
1193       ToErase.push_back(CI);
1194     }
1195   }
1196 
1197   // Look for orphan landingpads, can occur in blocks with no predecessors
1198   for (BasicBlock &BB : F) {
1199     Instruction *I = BB.getFirstNonPHI();
1200     if (auto *LPI = dyn_cast<LandingPadInst>(I))
1201       LandingPads.insert(LPI);
1202   }
1203   Changed |= !LandingPads.empty();
1204 
1205   // Handle all the landingpad for this function together, as multiple invokes
1206   // may share a single lp
1207   for (LandingPadInst *LPI : LandingPads) {
1208     IRB.SetInsertPoint(LPI);
1209     SmallVector<Value *, 16> FMCArgs;
1210     for (unsigned I = 0, E = LPI->getNumClauses(); I < E; ++I) {
1211       Constant *Clause = LPI->getClause(I);
1212       // TODO Handle filters (= exception specifications).
1213       // https://github.com/llvm/llvm-project/issues/49740
1214       if (LPI->isCatch(I))
1215         FMCArgs.push_back(Clause);
1216     }
1217 
1218     // Create a call to __cxa_find_matching_catch_N function
1219     Function *FMCF = getFindMatchingCatch(M, FMCArgs.size());
1220     CallInst *FMCI = IRB.CreateCall(FMCF, FMCArgs, "fmc");
1221     Value *Poison = PoisonValue::get(LPI->getType());
1222     Value *Pair0 = IRB.CreateInsertValue(Poison, FMCI, 0, "pair0");
1223     Value *TempRet0 = IRB.CreateCall(GetTempRet0F, std::nullopt, "tempret0");
1224     Value *Pair1 = IRB.CreateInsertValue(Pair0, TempRet0, 1, "pair1");
1225 
1226     LPI->replaceAllUsesWith(Pair1);
1227     ToErase.push_back(LPI);
1228   }
1229 
1230   // Erase everything we no longer need in this function
1231   for (Instruction *I : ToErase)
1232     I->eraseFromParent();
1233 
1234   return Changed;
1235 }
1236 
1237 // This tries to get debug info from the instruction before which a new
1238 // instruction will be inserted, and if there's no debug info in that
1239 // instruction, tries to get the info instead from the previous instruction (if
1240 // any). If none of these has debug info and a DISubprogram is provided, it
1241 // creates a dummy debug info with the first line of the function, because IR
1242 // verifier requires all inlinable callsites should have debug info when both a
1243 // caller and callee have DISubprogram. If none of these conditions are met,
1244 // returns empty info.
getOrCreateDebugLoc(const Instruction * InsertBefore,DISubprogram * SP)1245 static DebugLoc getOrCreateDebugLoc(const Instruction *InsertBefore,
1246                                     DISubprogram *SP) {
1247   assert(InsertBefore);
1248   if (InsertBefore->getDebugLoc())
1249     return InsertBefore->getDebugLoc();
1250   const Instruction *Prev = InsertBefore->getPrevNode();
1251   if (Prev && Prev->getDebugLoc())
1252     return Prev->getDebugLoc();
1253   if (SP)
1254     return DILocation::get(SP->getContext(), SP->getLine(), 1, SP);
1255   return DebugLoc();
1256 }
1257 
runSjLjOnFunction(Function & F)1258 bool WebAssemblyLowerEmscriptenEHSjLj::runSjLjOnFunction(Function &F) {
1259   assert(EnableEmSjLj || EnableWasmSjLj);
1260   Module &M = *F.getParent();
1261   LLVMContext &C = F.getContext();
1262   IRBuilder<> IRB(C);
1263   SmallVector<Instruction *, 64> ToErase;
1264 
1265   // Setjmp preparation
1266 
1267   BasicBlock *Entry = &F.getEntryBlock();
1268   DebugLoc FirstDL = getOrCreateDebugLoc(&*Entry->begin(), F.getSubprogram());
1269   SplitBlock(Entry, &*Entry->getFirstInsertionPt());
1270 
1271   IRB.SetInsertPoint(Entry->getTerminator()->getIterator());
1272   // This alloca'ed pointer is used by the runtime to identify function
1273   // invocations. It's just for pointer comparisons. It will never be
1274   // dereferenced.
1275   Instruction *FunctionInvocationId =
1276       IRB.CreateAlloca(IRB.getInt32Ty(), nullptr, "functionInvocationId");
1277   FunctionInvocationId->setDebugLoc(FirstDL);
1278 
1279   // Setjmp transformation
1280   SmallVector<PHINode *, 4> SetjmpRetPHIs;
1281   Function *SetjmpF = M.getFunction("setjmp");
1282   for (auto *U : make_early_inc_range(SetjmpF->users())) {
1283     auto *CB = cast<CallBase>(U);
1284     BasicBlock *BB = CB->getParent();
1285     if (BB->getParent() != &F) // in other function
1286       continue;
1287     if (CB->getOperandBundle(LLVMContext::OB_funclet)) {
1288       std::string S;
1289       raw_string_ostream SS(S);
1290       SS << "In function " + F.getName() +
1291                 ": setjmp within a catch clause is not supported in Wasm EH:\n";
1292       SS << *CB;
1293       report_fatal_error(StringRef(SS.str()));
1294     }
1295 
1296     CallInst *CI = nullptr;
1297     // setjmp cannot throw. So if it is an invoke, lower it to a call
1298     if (auto *II = dyn_cast<InvokeInst>(CB))
1299       CI = llvm::changeToCall(II);
1300     else
1301       CI = cast<CallInst>(CB);
1302 
1303     // The tail is everything right after the call, and will be reached once
1304     // when setjmp is called, and later when longjmp returns to the setjmp
1305     BasicBlock *Tail = SplitBlock(BB, CI->getNextNode());
1306     // Add a phi to the tail, which will be the output of setjmp, which
1307     // indicates if this is the first call or a longjmp back. The phi directly
1308     // uses the right value based on where we arrive from
1309     IRB.SetInsertPoint(Tail, Tail->getFirstNonPHIIt());
1310     PHINode *SetjmpRet = IRB.CreatePHI(IRB.getInt32Ty(), 2, "setjmp.ret");
1311 
1312     // setjmp initial call returns 0
1313     SetjmpRet->addIncoming(IRB.getInt32(0), BB);
1314     // The proper output is now this, not the setjmp call itself
1315     CI->replaceAllUsesWith(SetjmpRet);
1316     // longjmp returns to the setjmp will add themselves to this phi
1317     SetjmpRetPHIs.push_back(SetjmpRet);
1318 
1319     // Fix call target
1320     // Our index in the function is our place in the array + 1 to avoid index
1321     // 0, because index 0 means the longjmp is not ours to handle.
1322     IRB.SetInsertPoint(CI);
1323     Value *Args[] = {CI->getArgOperand(0), IRB.getInt32(SetjmpRetPHIs.size()),
1324                      FunctionInvocationId};
1325     IRB.CreateCall(WasmSetjmpF, Args);
1326     ToErase.push_back(CI);
1327   }
1328 
1329   // Handle longjmpable calls.
1330   if (EnableEmSjLj)
1331     handleLongjmpableCallsForEmscriptenSjLj(F, FunctionInvocationId,
1332                                             SetjmpRetPHIs);
1333   else // EnableWasmSjLj
1334     handleLongjmpableCallsForWasmSjLj(F, FunctionInvocationId, SetjmpRetPHIs);
1335 
1336   // Erase everything we no longer need in this function
1337   for (Instruction *I : ToErase)
1338     I->eraseFromParent();
1339 
1340   // Finally, our modifications to the cfg can break dominance of SSA variables.
1341   // For example, in this code,
1342   // if (x()) { .. setjmp() .. }
1343   // if (y()) { .. longjmp() .. }
1344   // We must split the longjmp block, and it can jump into the block splitted
1345   // from setjmp one. But that means that when we split the setjmp block, it's
1346   // first part no longer dominates its second part - there is a theoretically
1347   // possible control flow path where x() is false, then y() is true and we
1348   // reach the second part of the setjmp block, without ever reaching the first
1349   // part. So, we rebuild SSA form here.
1350   rebuildSSA(F);
1351   return true;
1352 }
1353 
1354 // Update each call that can longjmp so it can return to the corresponding
1355 // setjmp. Refer to 4) of "Emscripten setjmp/longjmp handling" section in the
1356 // comments at top of the file for details.
handleLongjmpableCallsForEmscriptenSjLj(Function & F,Instruction * FunctionInvocationId,SmallVectorImpl<PHINode * > & SetjmpRetPHIs)1357 void WebAssemblyLowerEmscriptenEHSjLj::handleLongjmpableCallsForEmscriptenSjLj(
1358     Function &F, Instruction *FunctionInvocationId,
1359     SmallVectorImpl<PHINode *> &SetjmpRetPHIs) {
1360   Module &M = *F.getParent();
1361   LLVMContext &C = F.getContext();
1362   IRBuilder<> IRB(C);
1363   SmallVector<Instruction *, 64> ToErase;
1364 
1365   // call.em.longjmp BB that will be shared within the function.
1366   BasicBlock *CallEmLongjmpBB = nullptr;
1367   // PHI node for the loaded value of __THREW__ global variable in
1368   // call.em.longjmp BB
1369   PHINode *CallEmLongjmpBBThrewPHI = nullptr;
1370   // PHI node for the loaded value of __threwValue global variable in
1371   // call.em.longjmp BB
1372   PHINode *CallEmLongjmpBBThrewValuePHI = nullptr;
1373   // rethrow.exn BB that will be shared within the function.
1374   BasicBlock *RethrowExnBB = nullptr;
1375 
1376   // Because we are creating new BBs while processing and don't want to make
1377   // all these newly created BBs candidates again for longjmp processing, we
1378   // first make the vector of candidate BBs.
1379   std::vector<BasicBlock *> BBs;
1380   for (BasicBlock &BB : F)
1381     BBs.push_back(&BB);
1382 
1383   // BBs.size() will change within the loop, so we query it every time
1384   for (unsigned I = 0; I < BBs.size(); I++) {
1385     BasicBlock *BB = BBs[I];
1386     for (Instruction &I : *BB) {
1387       if (isa<InvokeInst>(&I)) {
1388         std::string S;
1389         raw_string_ostream SS(S);
1390         SS << "In function " << F.getName()
1391            << ": When using Wasm EH with Emscripten SjLj, there is a "
1392               "restriction that `setjmp` function call and exception cannot be "
1393               "used within the same function:\n";
1394         SS << I;
1395         report_fatal_error(StringRef(SS.str()));
1396       }
1397       auto *CI = dyn_cast<CallInst>(&I);
1398       if (!CI)
1399         continue;
1400 
1401       const Value *Callee = CI->getCalledOperand();
1402       if (!canLongjmp(Callee))
1403         continue;
1404       if (isEmAsmCall(Callee))
1405         report_fatal_error("Cannot use EM_ASM* alongside setjmp/longjmp in " +
1406                                F.getName() +
1407                                ". Please consider using EM_JS, or move the "
1408                                "EM_ASM into another function.",
1409                            false);
1410 
1411       Value *Threw = nullptr;
1412       BasicBlock *Tail;
1413       if (Callee->getName().starts_with("__invoke_")) {
1414         // If invoke wrapper has already been generated for this call in
1415         // previous EH phase, search for the load instruction
1416         // %__THREW__.val = __THREW__;
1417         // in postamble after the invoke wrapper call
1418         LoadInst *ThrewLI = nullptr;
1419         StoreInst *ThrewResetSI = nullptr;
1420         for (auto I = std::next(BasicBlock::iterator(CI)), IE = BB->end();
1421              I != IE; ++I) {
1422           if (auto *LI = dyn_cast<LoadInst>(I))
1423             if (auto *GV = dyn_cast<GlobalVariable>(LI->getPointerOperand()))
1424               if (GV == ThrewGV) {
1425                 Threw = ThrewLI = LI;
1426                 break;
1427               }
1428         }
1429         // Search for the store instruction after the load above
1430         // __THREW__ = 0;
1431         for (auto I = std::next(BasicBlock::iterator(ThrewLI)), IE = BB->end();
1432              I != IE; ++I) {
1433           if (auto *SI = dyn_cast<StoreInst>(I)) {
1434             if (auto *GV = dyn_cast<GlobalVariable>(SI->getPointerOperand())) {
1435               if (GV == ThrewGV &&
1436                   SI->getValueOperand() == getAddrSizeInt(&M, 0)) {
1437                 ThrewResetSI = SI;
1438                 break;
1439               }
1440             }
1441           }
1442         }
1443         assert(Threw && ThrewLI && "Cannot find __THREW__ load after invoke");
1444         assert(ThrewResetSI && "Cannot find __THREW__ store after invoke");
1445         Tail = SplitBlock(BB, ThrewResetSI->getNextNode());
1446 
1447       } else {
1448         // Wrap call with invoke wrapper and generate preamble/postamble
1449         Threw = wrapInvoke(CI);
1450         ToErase.push_back(CI);
1451         Tail = SplitBlock(BB, CI->getNextNode());
1452 
1453         // If exception handling is enabled, the thrown value can be not a
1454         // longjmp but an exception, in which case we shouldn't silently ignore
1455         // exceptions; we should rethrow them.
1456         // __THREW__'s value is 0 when nothing happened, 1 when an exception is
1457         // thrown, other values when longjmp is thrown.
1458         //
1459         // if (%__THREW__.val == 1)
1460         //   goto %eh.rethrow
1461         // else
1462         //   goto %normal
1463         //
1464         // eh.rethrow: ;; Rethrow exception
1465         //   %exn = call @__cxa_find_matching_catch_2() ;; Retrieve thrown ptr
1466         //   __resumeException(%exn)
1467         //
1468         // normal:
1469         //   <-- Insertion point. Will insert sjlj handling code from here
1470         //   goto %tail
1471         //
1472         // tail:
1473         //   ...
1474         if (supportsException(&F) && canThrow(Callee)) {
1475           // We will add a new conditional branch. So remove the branch created
1476           // when we split the BB
1477           ToErase.push_back(BB->getTerminator());
1478 
1479           // Generate rethrow.exn BB once and share it within the function
1480           if (!RethrowExnBB) {
1481             RethrowExnBB = BasicBlock::Create(C, "rethrow.exn", &F);
1482             IRB.SetInsertPoint(RethrowExnBB);
1483             CallInst *Exn =
1484                 IRB.CreateCall(getFindMatchingCatch(M, 0), {}, "exn");
1485             IRB.CreateCall(ResumeF, {Exn});
1486             IRB.CreateUnreachable();
1487           }
1488 
1489           IRB.SetInsertPoint(CI);
1490           BasicBlock *NormalBB = BasicBlock::Create(C, "normal", &F);
1491           Value *CmpEqOne =
1492               IRB.CreateICmpEQ(Threw, getAddrSizeInt(&M, 1), "cmp.eq.one");
1493           IRB.CreateCondBr(CmpEqOne, RethrowExnBB, NormalBB);
1494 
1495           IRB.SetInsertPoint(NormalBB);
1496           IRB.CreateBr(Tail);
1497           BB = NormalBB; // New insertion point to insert __wasm_setjmp_test()
1498         }
1499       }
1500 
1501       // We need to replace the terminator in Tail - SplitBlock makes BB go
1502       // straight to Tail, we need to check if a longjmp occurred, and go to the
1503       // right setjmp-tail if so
1504       ToErase.push_back(BB->getTerminator());
1505 
1506       // Generate a function call to __wasm_setjmp_test function and
1507       // preamble/postamble code to figure out (1) whether longjmp
1508       // occurred (2) if longjmp occurred, which setjmp it corresponds to
1509       Value *Label = nullptr;
1510       Value *LongjmpResult = nullptr;
1511       BasicBlock *EndBB = nullptr;
1512       wrapTestSetjmp(BB, CI->getDebugLoc(), Threw, FunctionInvocationId, Label,
1513                      LongjmpResult, CallEmLongjmpBB, CallEmLongjmpBBThrewPHI,
1514                      CallEmLongjmpBBThrewValuePHI, EndBB);
1515       assert(Label && LongjmpResult && EndBB);
1516 
1517       // Create switch instruction
1518       IRB.SetInsertPoint(EndBB);
1519       IRB.SetCurrentDebugLocation(EndBB->back().getDebugLoc());
1520       SwitchInst *SI = IRB.CreateSwitch(Label, Tail, SetjmpRetPHIs.size());
1521       // -1 means no longjmp happened, continue normally (will hit the default
1522       // switch case). 0 means a longjmp that is not ours to handle, needs a
1523       // rethrow. Otherwise the index is the same as the index in P+1 (to avoid
1524       // 0).
1525       for (unsigned I = 0; I < SetjmpRetPHIs.size(); I++) {
1526         SI->addCase(IRB.getInt32(I + 1), SetjmpRetPHIs[I]->getParent());
1527         SetjmpRetPHIs[I]->addIncoming(LongjmpResult, EndBB);
1528       }
1529 
1530       // We are splitting the block here, and must continue to find other calls
1531       // in the block - which is now split. so continue to traverse in the Tail
1532       BBs.push_back(Tail);
1533     }
1534   }
1535 
1536   for (Instruction *I : ToErase)
1537     I->eraseFromParent();
1538 }
1539 
getCleanupRetUnwindDest(const CleanupPadInst * CPI)1540 static BasicBlock *getCleanupRetUnwindDest(const CleanupPadInst *CPI) {
1541   for (const User *U : CPI->users())
1542     if (const auto *CRI = dyn_cast<CleanupReturnInst>(U))
1543       return CRI->getUnwindDest();
1544   return nullptr;
1545 }
1546 
1547 // Create a catchpad in which we catch a longjmp's env and val arguments, test
1548 // if the longjmp corresponds to one of setjmps in the current function, and if
1549 // so, jump to the setjmp dispatch BB from which we go to one of post-setjmp
1550 // BBs. Refer to 4) of "Wasm setjmp/longjmp handling" section in the comments at
1551 // top of the file for details.
handleLongjmpableCallsForWasmSjLj(Function & F,Instruction * FunctionInvocationId,SmallVectorImpl<PHINode * > & SetjmpRetPHIs)1552 void WebAssemblyLowerEmscriptenEHSjLj::handleLongjmpableCallsForWasmSjLj(
1553     Function &F, Instruction *FunctionInvocationId,
1554     SmallVectorImpl<PHINode *> &SetjmpRetPHIs) {
1555   Module &M = *F.getParent();
1556   LLVMContext &C = F.getContext();
1557   IRBuilder<> IRB(C);
1558 
1559   // A function with catchswitch/catchpad instruction should have a personality
1560   // function attached to it. Search for the wasm personality function, and if
1561   // it exists, use it, and if it doesn't, create a dummy personality function.
1562   // (SjLj is not going to call it anyway.)
1563   if (!F.hasPersonalityFn()) {
1564     StringRef PersName = getEHPersonalityName(EHPersonality::Wasm_CXX);
1565     FunctionType *PersType =
1566         FunctionType::get(IRB.getInt32Ty(), /* isVarArg */ true);
1567     Value *PersF = M.getOrInsertFunction(PersName, PersType).getCallee();
1568     F.setPersonalityFn(
1569         cast<Constant>(IRB.CreateBitCast(PersF, IRB.getPtrTy())));
1570   }
1571 
1572   // Use the entry BB's debugloc as a fallback
1573   BasicBlock *Entry = &F.getEntryBlock();
1574   DebugLoc FirstDL = getOrCreateDebugLoc(&*Entry->begin(), F.getSubprogram());
1575   IRB.SetCurrentDebugLocation(FirstDL);
1576 
1577   // Add setjmp.dispatch BB right after the entry block. Because we have
1578   // initialized functionInvocationId in the entry block and split the
1579   // rest into another BB, here 'OrigEntry' is the function's original entry
1580   // block before the transformation.
1581   //
1582   // entry:
1583   //   functionInvocationId initialization
1584   // setjmp.dispatch:
1585   //   switch will be inserted here later
1586   // entry.split: (OrigEntry)
1587   //   the original function starts here
1588   BasicBlock *OrigEntry = Entry->getNextNode();
1589   BasicBlock *SetjmpDispatchBB =
1590       BasicBlock::Create(C, "setjmp.dispatch", &F, OrigEntry);
1591   cast<BranchInst>(Entry->getTerminator())->setSuccessor(0, SetjmpDispatchBB);
1592 
1593   // Create catch.dispatch.longjmp BB and a catchswitch instruction
1594   BasicBlock *CatchDispatchLongjmpBB =
1595       BasicBlock::Create(C, "catch.dispatch.longjmp", &F);
1596   IRB.SetInsertPoint(CatchDispatchLongjmpBB);
1597   CatchSwitchInst *CatchSwitchLongjmp =
1598       IRB.CreateCatchSwitch(ConstantTokenNone::get(C), nullptr, 1);
1599 
1600   // Create catch.longjmp BB and a catchpad instruction
1601   BasicBlock *CatchLongjmpBB = BasicBlock::Create(C, "catch.longjmp", &F);
1602   CatchSwitchLongjmp->addHandler(CatchLongjmpBB);
1603   IRB.SetInsertPoint(CatchLongjmpBB);
1604   CatchPadInst *CatchPad = IRB.CreateCatchPad(CatchSwitchLongjmp, {});
1605 
1606   // Wasm throw and catch instructions can throw and catch multiple values, but
1607   // that requires multivalue support in the toolchain, which is currently not
1608   // very reliable. We instead throw and catch a pointer to a struct value of
1609   // type 'struct __WasmLongjmpArgs', which is defined in Emscripten.
1610   Instruction *LongjmpArgs =
1611       IRB.CreateCall(CatchF, {IRB.getInt32(WebAssembly::C_LONGJMP)}, "thrown");
1612   Value *EnvField =
1613       IRB.CreateConstGEP2_32(LongjmpArgsTy, LongjmpArgs, 0, 0, "env_gep");
1614   Value *ValField =
1615       IRB.CreateConstGEP2_32(LongjmpArgsTy, LongjmpArgs, 0, 1, "val_gep");
1616   // void *env = __wasm_longjmp_args.env;
1617   Instruction *Env = IRB.CreateLoad(IRB.getPtrTy(), EnvField, "env");
1618   // int val = __wasm_longjmp_args.val;
1619   Instruction *Val = IRB.CreateLoad(IRB.getInt32Ty(), ValField, "val");
1620 
1621   // %label = __wasm_setjmp_test(%env, functionInvocatinoId);
1622   // if (%label == 0)
1623   //   __wasm_longjmp(%env, %val)
1624   // catchret to %setjmp.dispatch
1625   BasicBlock *ThenBB = BasicBlock::Create(C, "if.then", &F);
1626   BasicBlock *EndBB = BasicBlock::Create(C, "if.end", &F);
1627   Value *EnvP = IRB.CreateBitCast(Env, getAddrPtrType(&M), "env.p");
1628   Value *Label = IRB.CreateCall(WasmSetjmpTestF, {EnvP, FunctionInvocationId},
1629                                 OperandBundleDef("funclet", CatchPad), "label");
1630   Value *Cmp = IRB.CreateICmpEQ(Label, IRB.getInt32(0));
1631   IRB.CreateCondBr(Cmp, ThenBB, EndBB);
1632 
1633   IRB.SetInsertPoint(ThenBB);
1634   CallInst *WasmLongjmpCI = IRB.CreateCall(
1635       WasmLongjmpF, {Env, Val}, OperandBundleDef("funclet", CatchPad));
1636   IRB.CreateUnreachable();
1637 
1638   IRB.SetInsertPoint(EndBB);
1639   // Jump to setjmp.dispatch block
1640   IRB.CreateCatchRet(CatchPad, SetjmpDispatchBB);
1641 
1642   // Go back to setjmp.dispatch BB
1643   // setjmp.dispatch:
1644   //   switch %label {
1645   //     label 1: goto post-setjmp BB 1
1646   //     label 2: goto post-setjmp BB 2
1647   //     ...
1648   //     default: goto splitted next BB
1649   //   }
1650   IRB.SetInsertPoint(SetjmpDispatchBB);
1651   PHINode *LabelPHI = IRB.CreatePHI(IRB.getInt32Ty(), 2, "label.phi");
1652   LabelPHI->addIncoming(Label, EndBB);
1653   LabelPHI->addIncoming(IRB.getInt32(-1), Entry);
1654   SwitchInst *SI = IRB.CreateSwitch(LabelPHI, OrigEntry, SetjmpRetPHIs.size());
1655   // -1 means no longjmp happened, continue normally (will hit the default
1656   // switch case). 0 means a longjmp that is not ours to handle, needs a
1657   // rethrow. Otherwise the index is the same as the index in P+1 (to avoid
1658   // 0).
1659   for (unsigned I = 0; I < SetjmpRetPHIs.size(); I++) {
1660     SI->addCase(IRB.getInt32(I + 1), SetjmpRetPHIs[I]->getParent());
1661     SetjmpRetPHIs[I]->addIncoming(Val, SetjmpDispatchBB);
1662   }
1663 
1664   // Convert all longjmpable call instructions to invokes that unwind to the
1665   // newly created catch.dispatch.longjmp BB.
1666   SmallVector<CallInst *, 64> LongjmpableCalls;
1667   for (auto *BB = &*F.begin(); BB; BB = BB->getNextNode()) {
1668     for (auto &I : *BB) {
1669       auto *CI = dyn_cast<CallInst>(&I);
1670       if (!CI)
1671         continue;
1672       const Value *Callee = CI->getCalledOperand();
1673       if (!canLongjmp(Callee))
1674         continue;
1675       if (isEmAsmCall(Callee))
1676         report_fatal_error("Cannot use EM_ASM* alongside setjmp/longjmp in " +
1677                                F.getName() +
1678                                ". Please consider using EM_JS, or move the "
1679                                "EM_ASM into another function.",
1680                            false);
1681       // This is __wasm_longjmp() call we inserted in this function, which
1682       // rethrows the longjmp when the longjmp does not correspond to one of
1683       // setjmps in this function. We should not convert this call to an invoke.
1684       if (CI == WasmLongjmpCI)
1685         continue;
1686       LongjmpableCalls.push_back(CI);
1687     }
1688   }
1689 
1690   for (auto *CI : LongjmpableCalls) {
1691     // Even if the callee function has attribute 'nounwind', which is true for
1692     // all C functions, it can longjmp, which means it can throw a Wasm
1693     // exception now.
1694     CI->removeFnAttr(Attribute::NoUnwind);
1695     if (Function *CalleeF = CI->getCalledFunction())
1696       CalleeF->removeFnAttr(Attribute::NoUnwind);
1697 
1698     // Change it to an invoke and make it unwind to the catch.dispatch.longjmp
1699     // BB. If the call is enclosed in another catchpad/cleanuppad scope, unwind
1700     // to its parent pad's unwind destination instead to preserve the scope
1701     // structure. It will eventually unwind to the catch.dispatch.longjmp.
1702     SmallVector<OperandBundleDef, 1> Bundles;
1703     BasicBlock *UnwindDest = nullptr;
1704     if (auto Bundle = CI->getOperandBundle(LLVMContext::OB_funclet)) {
1705       Instruction *FromPad = cast<Instruction>(Bundle->Inputs[0]);
1706       while (!UnwindDest) {
1707         if (auto *CPI = dyn_cast<CatchPadInst>(FromPad)) {
1708           UnwindDest = CPI->getCatchSwitch()->getUnwindDest();
1709           break;
1710         }
1711         if (auto *CPI = dyn_cast<CleanupPadInst>(FromPad)) {
1712           // getCleanupRetUnwindDest() can return nullptr when
1713           // 1. This cleanuppad's matching cleanupret uwninds to caller
1714           // 2. There is no matching cleanupret because it ends with
1715           //    unreachable.
1716           // In case of 2, we need to traverse the parent pad chain.
1717           UnwindDest = getCleanupRetUnwindDest(CPI);
1718           Value *ParentPad = CPI->getParentPad();
1719           if (isa<ConstantTokenNone>(ParentPad))
1720             break;
1721           FromPad = cast<Instruction>(ParentPad);
1722         }
1723       }
1724     }
1725     if (!UnwindDest)
1726       UnwindDest = CatchDispatchLongjmpBB;
1727     changeToInvokeAndSplitBasicBlock(CI, UnwindDest);
1728   }
1729 
1730   SmallVector<Instruction *, 16> ToErase;
1731   for (auto &BB : F) {
1732     if (auto *CSI = dyn_cast<CatchSwitchInst>(BB.getFirstNonPHI())) {
1733       if (CSI != CatchSwitchLongjmp && CSI->unwindsToCaller()) {
1734         IRB.SetInsertPoint(CSI);
1735         ToErase.push_back(CSI);
1736         auto *NewCSI = IRB.CreateCatchSwitch(CSI->getParentPad(),
1737                                              CatchDispatchLongjmpBB, 1);
1738         NewCSI->addHandler(*CSI->handler_begin());
1739         NewCSI->takeName(CSI);
1740         CSI->replaceAllUsesWith(NewCSI);
1741       }
1742     }
1743 
1744     if (auto *CRI = dyn_cast<CleanupReturnInst>(BB.getTerminator())) {
1745       if (CRI->unwindsToCaller()) {
1746         IRB.SetInsertPoint(CRI);
1747         ToErase.push_back(CRI);
1748         IRB.CreateCleanupRet(CRI->getCleanupPad(), CatchDispatchLongjmpBB);
1749       }
1750     }
1751   }
1752 
1753   for (Instruction *I : ToErase)
1754     I->eraseFromParent();
1755 }
1756