v8 pipeline

发表于 | 分类于 | | 阅读次数:

总览

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
v8::internal::GeneratedCode
    -> RUNTIME_FUNCTION(Runtime_CompileOptimized_NotConcurrent)
        -> Compiler::CompileOptimized
            -> GetOptimizedCode
                -> GetOptimizedCodeNow
                    -> OptimizedCompilationJob::PrepareJob
                        -> PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl
                            -> PipelineImpl::CreateGraph()
                                -> BytecodeGraphBuilder::CreateGraph()
                                ...
                                  -> SetStart
                                    -> NewNodeUnchecked
                                      -> Node::New
                                ...
                                  -> env
                                  -> VisitBytecodes

Compiler::CompileOptimized(function, ConcurrencyMode::kNotConcurrent)

参数1是要compile的function，参数2是一个标志,应该是和线程相关，表示function不在“正在编译的函数的队列”里。

1
2
3
4
5
6
7
8
9
10
11
if (mode == ConcurrencyMode::kConcurrent) {
  if (GetOptimizedCodeLater(job.get(), isolate)) {
    job.release();  // The background recompile job owns this now.

    // Set the optimization marker and return a code object which checks it.
    function->SetOptimizationMarker(OptimizationMarker::kInOptimizationQueue);
    DCHECK(function->IsInterpreted() ||
           (!function->is_compiled() && function->shared()->IsInterpreted()));
    DCHECK(function->shared()->HasBytecodeArray());
    return BUILTIN_CODE(isolate, InterpreterEntryTrampoline);
  }

在这个函数中进行编译，这个函数首先检查function是否已经被编译过了。

1
if (function->IsOptimized()) return true;

然后进行编译优化，如果编译优化成功则以后在js中调用函数都执行编译后的code

1
2
3
4
if (!GetOptimizedCode(function, mode).ToHandle(&code)) {
    ...
// Install code on closure.
function->set_code(*code);

如果失败，则回到解释帧InterpreterEntryTrampoline执行

1
code = BUILTIN_CODE(isolate, InterpreterEntryTrampoline);

bool GetOptimizedCodeNow(OptimizedCompilationJob* job, Isolate* isolate)

1
2
3
if (job->PrepareJob(isolate) != CompilationJob::SUCCEEDED ||
    job->ExecuteJob() != CompilationJob::SUCCEEDED ||
    job->FinalizeJob(isolate) != CompilationJob::SUCCEEDED) {

CompilationJob::Status OptimizedCompilationJob::PrepareJob

v8里有非常多的status，很有意思。

1
2
3
4
5
6
7
8
9
10
DEFINE_BOOL(trace_opt, false, "trace lazy optimization")
...
...
if (FLAG_trace_opt && compilation_info()->IsOptimizing()) {
    OFStream os(stdout);
    os << "[compiling method " << Brief(*compilation_info()->closure())
       << " using " << compiler_name_;
    if (compilation_info()->is_osr()) os << " OSR";
    os << "]" << std::endl;
  }

这个函数就是调用

1
return UpdateState(PrepareJobImpl(isolate), State::kReadyToExecute);

PipelineCompilationJob::Status PipelineCompilationJob::PrepareJobImpl

前面根据一些标志位进行设置，包括下面这些等。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
// OptimizedCompilationInfo encapsulates the information needed to compile
// optimized code for a given function, and the results of the optimized
// compilation.
class V8_EXPORT_PRIVATE OptimizedCompilationInfo final {
 public:
  // Various configuration flags for a compilation, as well as some properties
  // of the compiled code produced by a compilation.
  enum Flag {
    kAccessorInliningEnabled = 1 << 0,
    kFunctionContextSpecializing = 1 << 1,
    kInliningEnabled = 1 << 2,
    kDisableFutureOptimization = 1 << 3,
    kSplittingEnabled = 1 << 4,
    kSourcePositionsEnabled = 1 << 5,
    kBailoutOnUninitialized = 1 << 6,
    kLoopPeelingEnabled = 1 << 7,
    kUntrustedCodeMitigations = 1 << 8,
    kSwitchJumpTableEnabled = 1 << 9,
    kCalledWithCodeStartRegister = 1 << 10,
    kPoisonRegisterArguments = 1 << 11,
    kAllocationFoldingEnabled = 1 << 12,
    kAnalyzeEnvironmentLiveness = 1 << 13,
    kTraceTurboJson = 1 << 14,
    kTraceTurboGraph = 1 << 15,
    kTraceTurboScheduled = 1 << 16,
  };
...
...
...
FLAG_always_opt
FLAG_turbo_loop_peeling
FLAG_turbo_inlining
FLAG_inline_accessors
FLAG_turbo_allocation_folding

然后开始创建Graph

1
2
3
4
if (!pipeline_.CreateGraph()) {
  if (isolate->has_pending_exception()) return FAILED;  // Stack overflowed.
  return AbortOptimization(BailoutReason::kGraphBuildingFailed);
}

PipelineImpl::CreateGraph()

检查trace标志位并做相应操作,主要是做记录。

1
2
if (info()->trace_turbo_json_enabled() ||
    info()->trace_turbo_graph_enabled()) {

通过添加修饰器来记录源码位置。

1
data->source_positions()->AddDecorator();

然后

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
  Run<GraphBuilderPhase>();
  RunPrintAndVerify("Initial untyped", true);

  // Perform function context specialization and inlining (if enabled).
  Run<InliningPhase>();
  RunPrintAndVerify("Inlined", true);

  // Remove dead->live edges from the graph.
  Run<EarlyGraphTrimmingPhase>();
  RunPrintAndVerify("Early trimmed", true);

  // Run the type-sensitive lowerings and optimizations on the graph.
  {
    // Determine the Typer operation flags.
    Typer::Flags flags = Typer::kNoFlags;
    if (is_sloppy(info()->shared_info()->language_mode()) &&
        info()->shared_info()->IsUserJavaScript()) {
      // Sloppy mode functions always have an Object for this.
      flags |= Typer::kThisIsReceiver;
    }
    if (IsClassConstructor(info()->shared_info()->kind())) {
      // Class constructors cannot be [[Call]]ed.
      flags |= Typer::kNewTargetIsReceiver;
    }

    // Type the graph and keep the Typer running on newly created nodes within
    // this scope; the Typer is automatically unlinked from the Graph once we
    // leave this scope below.
    Typer typer(isolate(), flags, data->graph());
    Run<TyperPhase>(&typer);
    RunPrintAndVerify("Typed");

    // Lower JSOperators where we can determine types.
    Run<TypedLoweringPhase>();
    RunPrintAndVerify("Lowered typed");
  }

  // Do some hacky things to prepare for the optimization phase.
  // (caching handles, etc.).
  Run<ConcurrentOptimizationPrepPhase>();

  data->EndPhaseKind();

  return true;
}

BytecodeGraphBuilder::CreateGraph()

设置图的基本结构。
{Start}的输出是形参（包括receiver）加上new target, arguments数目,context和closure

1
2
int actual_parameter_count = bytecode_array()->parameter_count() + 4;
graph()->SetStart(graph()->NewNode(common()->Start(actual_parameter_count)));

NewNode是用于创建新node的帮助函数。
common()返回CommonOperatorBuilder*的common_,差不多是一个op的集合了，然后从中选择Start

1
2
3
4
5
6
7
8
9
10
  CommonOperatorBuilder* common() const { return common_; }
  ...
    const Operator* Start(int value_output_count);
  ...
  const Operator* CommonOperatorBuilder::Start(int value_output_count) {
  return new (zone()) Operator(                                    // --
      IrOpcode::kStart, Operator::kFoldable | Operator::kNoThrow,  // opcode
      "Start",                                                     // name
      0, 0, 0, value_output_count, 1, 1);                          // counts
}

这个文件还是比较有用的，common-operator.cc，因为NewNode的opcode参数从这里初始化。
回到NewNode看一下

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
  // Factory template for nodes with static input counts.
  template <typename... Nodes>
  Node* NewNode(const Operator* op, Nodes*... nodes) {
    std::array<Node*, sizeof...(nodes)> nodes_arr{{nodes...}};
    return NewNode(op, nodes_arr.size(), nodes_arr.data());
  }
  ...
 Node* Graph::NewNode(const Operator* op, int input_count, Node* const* inputs,
                     bool incomplete) {
  Node* node = NewNodeUnchecked(op, input_count, inputs, incomplete);
  Verifier::VerifyNode(node);
  return node;
}
...
Node* Graph::NewNodeUnchecked(const Operator* op, int input_count,
                              Node* const* inputs, bool incomplete) {
  Node* const node =
      Node::New(zone(), NextNodeId(), op, input_count, inputs, incomplete);
  Decorate(node);
  return node;
}

最后是执行到了这里,于是我们来分析一下这个函数。

Node::New

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
Node* Node::New(Zone* zone, NodeId id, const Operator* op, int input_count,
                Node* const* inputs, bool has_extensible_inputs) {
  Node** input_ptr;
  Use* use_ptr;
  Node* node;
  bool is_inline;

  if (input_count > kMaxInlineCapacity) {
    // Allocate out-of-line inputs.
    int capacity =
        has_extensible_inputs ? input_count + kMaxInlineCapacity : input_count;
    OutOfLineInputs* outline = OutOfLineInputs::New(zone, capacity);

    // Allocate node.
    void* node_buffer = zone->New(sizeof(Node));
    node = new (node_buffer) Node(id, op, kOutlineMarker, 0);
    node->inputs_.outline_ = outline;

    outline->node_ = node;
    outline->count_ = input_count;

    input_ptr = outline->inputs_;
    use_ptr = reinterpret_cast<Use*>(outline);
    is_inline = false;
  } else {
    // Allocate node with inline inputs.
    int capacity = input_count;
    if (has_extensible_inputs) {
      const int max = kMaxInlineCapacity;
      capacity = std::min(input_count + 3, max);
    }

    size_t size = sizeof(Node) + capacity * (sizeof(Node*) + sizeof(Use));
    intptr_t raw_buffer = reinterpret_cast<intptr_t>(zone->New(size));
    void* node_buffer =
        reinterpret_cast<void*>(raw_buffer + capacity * sizeof(Use));

    node = new (node_buffer) Node(id, op, input_count, capacity);
    input_ptr = node->inputs_.inline_;
    use_ptr = reinterpret_cast<Use*>(node);
    is_inline = true;
  }

  // Initialize the input pointers and the uses.
  for (int current = 0; current < input_count; ++current) {
    Node* to = *inputs++;
    input_ptr[current] = to;
    Use* use = use_ptr - 1 - current;
    use->bit_field_ = Use::InputIndexField::encode(current) |
                      Use::InlineField::encode(is_inline);
    to->AppendUse(use);
  }
  node->Verify();
  return node;
}

首先定义了几个局部变量

1
2
3
4
Node** input_ptr;
Use* use_ptr;
Node* node;
bool is_inline;

然后判断input_count是否大于kMaxInineCapacity
注意这里的input_count来自这里的nodes_arr.size()，此处对于start的情况，NewNode(common()->Start(actual_parameter_count)));，可以看出这个结果是0。
这是个比较特殊的情况，后面我们再分析几个node的生成看一下这个逻辑。

1
2
3
4
Node* NewNode(const Operator* op, Nodes*... nodes) {
  std::array<Node*, sizeof...(nodes)> nodes_arr{{nodes...}};
  return NewNode(op, nodes_arr.size(), nodes_arr.data());
}

为什么这里有这样的一个比较呢？是因为v8对node的存储决定的
从注释里可以找到

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

//============================================================================
//== Memory layout ===========================================================
//============================================================================
// Saving space for big graphs is important. We use a memory layout trick to
// be able to map {Node} objects to {Use} objects and vice-versa in a
// space-efficient manner.
//
// {Use} links are laid out in memory directly before a {Node}, followed by
// direct pointers to input {Nodes}.
//
// inline case:
// |Use #N  |Use #N-1|...|Use #1  |Use #0  |Node xxxx |I#0|I#1|...|I#N-1|I#N|
//          ^                              ^                  ^
//          + Use                          + Node             + Input
//
// Since every {Use} instance records its {input_index}, pointer arithmetic
// can compute the {Node}.
//
// out-of-line case:
//     |Node xxxx |
//     ^       + outline ------------------+
//     +----------------------------------------+
//                                         |    |
//                                         v    | node
// |Use #N  |Use #N-1|...|Use #1  |Use #0  |OOL xxxxx |I#0|I#1|...|I#N-1|I#N|
//          ^                                                 ^
//          + Use                                             + Input
//
// Out-of-line storage of input lists is needed if appending an input to
// a node exceeds the maximum inline capacity.

如果是小于kMaxInineCapacity，则可以直接将inputs内联在node中。
这里的计算方法是，首先计算capacity，默认应该是等于input_count，如果有has_extensible_inputs，则在input_count + 3和kMaxInlineCapacity选取一个最小值。
这个has_extensible_inputs我还不是很懂，后面看看吧

1
2
3
4
5
int capacity = input_count;
    if (has_extensible_inputs) {
      const int max = kMaxInlineCapacity;
      capacity = std::min(input_count + 3, max);
    }

然后计算size大小，并为node和它的use/input分配内存。

1
2
3
4
size_t size = sizeof(Node) + capacity * (sizeof(Node*) + sizeof(Use));
intptr_t raw_buffer = reinterpret_cast<intptr_t>(zone->New(size));
void* node_buffer =
        reinterpret_cast<void*>(raw_buffer + capacity * sizeof(Use));

顺便说一下，一个Use大小是24字节，一个Node是40字节

计算好size之后进入这个函数，在这生成新的node。

1
2
3
4
5
6
7
8
9
10
Node::Node(NodeId id, const Operator* op, int inline_count, int inline_capacity)
    : op_(op),
      mark_(0),
      bit_field_(IdField::encode(id) | InlineCountField::encode(inline_count) |
                 InlineCapacityField::encode(inline_capacity)),
      first_use_(nullptr) {
  // Inputs must either be out of line or within the inline capacity.
  DCHECK_GE(kMaxInlineCapacity, inline_capacity);
  DCHECK(inline_count == kOutlineMarker || inline_count <= inline_capacity);
}

最后需要为这个node建立input/use关系,这里的逻辑就是，首先根据当前node的input_count数。
依次设置to为input节点。

1
2
for (int current = 0; current < input_count; ++current) {
  Node* to = *inputs++;

然后由于input_ptr指向node的inputs区域，在node的inputs区域记录它的input节点的地址。

1
2
3
input_ptr = node->inputs_.inline_;
...
input_ptr[current] = to;

通过这种方式就将节点的input关系建立好了。
然后需要考虑一下use关系，现在我们可以看到use_ptr指向的是当前node的地址。
通过use_ptr和{input_index}来计算出use，然后在use里记录当前{input_index}的值，于是我们可以通过这个值来做简单的算数计算来找到node。

1
2
3
Use* use = use_ptr - 1 - current;
use->bit_field_ = Use::InputIndexField::encode(current) |
                      Use::InlineField::encode(is_inline);

然后

1
2
3
4
5
6
7
8
9
10
11
to->AppendUse(use);
...
...
void Node::AppendUse(Use* use) {
  DCHECK(first_use_ == nullptr || first_use_->prev == nullptr);
  DCHECK_EQ(this, *use->input_ptr());
  use->next = first_use_;
  use->prev = nullptr;
  if (first_use_) first_use_->prev = use;
  first_use_ = use;
}

于是从当前节点的input节点到当前节点，这样的一个{input}->{node}的use关系就建立起来了。
注意first_use是Node结构的一个成员变量。

或许这么说还是有点难懂，其实就是假设有一个节点A，它有0，1，2，3这么几个input节点，0，1，2，3代表的也是input_index。
然后对于每一个它的input节点，都要从它的Use部分取一个分配给它的input，如图。

然后因为分配出去的Use里面有记录这个input节点对应的input index，于是很容易就可以计算出来Node的地址。
这样，一个{input}->{node}的{Use #index}的关系就建立好了，而且很容易就可以通过#index来进行算数运算，得到真正的{input}->{node}，这样的use关系。

之所以需要这么麻烦，可能也是为了让graph IR有SSA的性质……

Node::New结束之后，此时Start节点已经被构建好了，请记住Node::New做的事情，因为后面建立新的node也是通过这个函数来完成的。

BytecodeGraphBuilder::Environment

回到BytecodeGraphBuilder::CreateGraph()来看一下，在Start创建之后，初始化env并切换到它。
在看env的初始化之前，先看一个重要的class

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
// The abstract execution environment simulates the content of the interpreter
// register file. The environment performs SSA-renaming of all tracked nodes at
// split and merge points in the control flow.
class BytecodeGraphBuilder::Environment : public ZoneObject {
 public:
  Environment(BytecodeGraphBuilder* builder, int register_count,
              int parameter_count,
              interpreter::Register incoming_new_target_or_generator,
              Node* control_dependency);

  // Specifies whether environment binding methods should attach frame state
  // inputs to nodes representing the value being bound. This is done because
  // the {OutputFrameStateCombine} is closely related to the binding method.
  enum FrameStateAttachmentMode { kAttachFrameState, kDontAttachFrameState };

  int parameter_count() const { return parameter_count_; }
  int register_count() const { return register_count_; }

  Node* LookupAccumulator() const;
  Node* LookupRegister(interpreter::Register the_register) const;
  Node* LookupGeneratorState() const;

  void BindAccumulator(Node* node,
                       FrameStateAttachmentMode mode = kDontAttachFrameState);
  void BindRegister(interpreter::Register the_register, Node* node,
                    FrameStateAttachmentMode mode = kDontAttachFrameState);
  void BindRegistersToProjections(
      interpreter::Register first_reg, Node* node,
      FrameStateAttachmentMode mode = kDontAttachFrameState);
  void BindGeneratorState(Node* node);
  void RecordAfterState(Node* node,
                        FrameStateAttachmentMode mode = kDontAttachFrameState);

  // Effect dependency tracked by this environment.
  Node* GetEffectDependency() { return effect_dependency_; }
  void UpdateEffectDependency(Node* dependency) {
    effect_dependency_ = dependency;
  }

  // Preserve a checkpoint of the environment for the IR graph. Any
  // further mutation of the environment will not affect checkpoints.
  Node* Checkpoint(BailoutId bytecode_offset, OutputFrameStateCombine combine,
                   const BytecodeLivenessState* liveness);

  // Control dependency tracked by this environment.
  Node* GetControlDependency() const { return control_dependency_; }
  void UpdateControlDependency(Node* dependency) {
    control_dependency_ = dependency;
  }

  Node* Context() const { return context_; }
  void SetContext(Node* new_context) { context_ = new_context; }

  Environment* Copy();
  void Merge(Environment* other, const BytecodeLivenessState* liveness);

  void FillWithOsrValues();
  void PrepareForLoop(const BytecodeLoopAssignments& assignments,
                      const BytecodeLivenessState* liveness);
  void PrepareForLoopExit(Node* loop,
                          const BytecodeLoopAssignments& assignments,
                          const BytecodeLivenessState* liveness);

 private:
  explicit Environment(const Environment* copy);

  bool StateValuesRequireUpdate(Node** state_values, Node** values, int count);
  void UpdateStateValues(Node** state_values, Node** values, int count);
  Node* GetStateValuesFromCache(Node** values, int count,
                                const BitVector* liveness, int liveness_offset);

  int RegisterToValuesIndex(interpreter::Register the_register) const;

  Zone* zone() const { return builder_->local_zone(); }
  Graph* graph() const { return builder_->graph(); }
  CommonOperatorBuilder* common() const { return builder_->common(); }
  BytecodeGraphBuilder* builder() const { return builder_; }
  const NodeVector* values() const { return &values_; }
  NodeVector* values() { return &values_; }
  int register_base() const { return register_base_; }
  int accumulator_base() const { return accumulator_base_; }

  BytecodeGraphBuilder* builder_;
  int register_count_;
  int parameter_count_;
  Node* context_;
  Node* control_dependency_;
  Node* effect_dependency_;
  NodeVector values_;
  Node* parameters_state_values_;
  Node* generator_state_;
  int register_base_;
  int accumulator_base_;
};

从上面可知，values()返回一个NodeVector values_。
然后继续看env的初始化

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
  Environment env(this, bytecode_array()->register_count(),
                  bytecode_array()->parameter_count(),
                  bytecode_array()->incoming_new_target_or_generator_register(),
                  graph()->start());
  set_environment(&env);
  ...
  ...
  ...
  BytecodeGraphBuilder::Environment::Environment(
    BytecodeGraphBuilder* builder, int register_count, int parameter_count,
    interpreter::Register incoming_new_target_or_generator,
    Node* control_dependency)
    : builder_(builder),
      register_count_(register_count),
      parameter_count_(parameter_count),
      control_dependency_(control_dependency),
      effect_dependency_(control_dependency),
      values_(builder->local_zone()),
      parameters_state_values_(nullptr),
      generator_state_(nullptr) {
  // The layout of values_ is:
  //
  // [receiver] [parameters] [registers] [accumulator]
  //
  // parameter[0] is the receiver (this), parameters 1..N are the
  // parameters supplied to the method (arg0..argN-1). The accumulator
  // is stored separately.
  // Parameters including the receiver
....
}

注意这句话

1
2
parameter[0] is the receiver (this), parameters 1..N are the
Parameters including the receiver

首先创建parameter节点，Start作为parameter的input节点。

1
2
3
4
5
6
for (int i = 0; i < parameter_count; i++) {
  ...
  const Operator* op = common()->Parameter(i, debug_name);
  Node* parameter = builder->graph()->NewNode(op, graph()->start());
  values()->push_back(parameter);
}

然后向values_这个NodeVector的end之前，插入register_count个值为undefined_constant的Node节点。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
// Registers
  register_base_ = static_cast<int>(values()->size());
  Node* undefined_constant = builder->jsgraph()->UndefinedConstant();
  values()->insert(values()->end(), register_count, undefined_constant);
...
...
DEFINE_GETTER(UndefinedConstant, HeapConstant(factory()->undefined_value()))
...
...
// value	v8::internal::Handle<v8::internal::HeapObject>	
Node* JSGraph::HeapConstant(Handle<HeapObject> value) {
  Node** loc = cache_.FindHeapConstant(value);
  if (*loc == nullptr) {
    *loc = graph()->NewNode(common()->HeapConstant(value));
  }
  return *loc;
}
...
...
const Operator* CommonOperatorBuilder::HeapConstant(
    const Handle<HeapObject>& value) {
  return new (zone()) Operator1<Handle<HeapObject>>(  // --
      IrOpcode::kHeapConstant, Operator::kPure,       // opcode
      "HeapConstant",                                 // name
      0, 0, 0, 1, 0, 0,                               // counts
      value);                                         // parameter
}

先从cache中检查是否已经有HeapConstant,如果没有就新建再返回，如果有就直接返回cache里的。

然后再向value_的最后插入一个undefined_constant节点作为Accumulator。

1
2
3
// Accumulator
accumulator_base_ = static_cast<int>(values()->size());
values()->push_back(undefined_constant);

然后设置Context

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
  // Context
  int context_index = Linkage::GetJSCallContextParamIndex(parameter_count);
  const Operator* op = common()->Parameter(context_index, "%context");
  context_ = builder->graph()->NewNode(op, graph()->start());
  ...
  ...
  ...
    // A special {Parameter} index for JSCalls that represents the context.
  static int GetJSCallContextParamIndex(int parameter_count) {
    return parameter_count + 2;  // Parameter (arity + 2) is special.
  }
  ...
  ...
  const Operator* CommonOperatorBuilder::Parameter(int index,
                                                 const char* debug_name) {
  if (!debug_name) {
    switch (index) {
#define CACHED_PARAMETER(index) \
  case index:                   \
    return &cache_.kParameter##index##Operator;
      CACHED_PARAMETER_LIST(CACHED_PARAMETER)
#undef CACHED_PARAMETER
      default:
        break;
    }
  }
  // Uncached.
  return new (zone()) Operator1<ParameterInfo>(  // --
      IrOpcode::kParameter, Operator::kPure,     // opcode
      "Parameter",                               // name
      1, 0, 0, 1, 0, 0,                          // counts
      ParameterInfo(index, debug_name));         // parameter info
}

context也创建了一个parameter的node，用来做什么的我还没看懂，可能需要好好看看log或者compiler/linkage.h这个文件

VisitBytecodes

V8准备一个称为v8::internal::AstVisitor的基类，简称AstVisitor，从AST生成bytecode。
AstVisitor是一个使用Vistor模式的类。
在深度优先搜索AST时调用相应的回调函数。
生成的bytecode存放在bytecode数组当中，用Javascript来模拟这个结构，看起来像这样。


当然这个并不重要，回顾一下而已。

VisitBytecodes首先进行bytecode_analysis，在这里面进行包括liveness分析等。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
BytecodeAnalysis bytecode_analysis(bytecode_array(), local_zone(),
                                   analyze_environment_liveness());
bytecode_analysis.Analyze(osr_offset_);
set_bytecode_analysis(&bytecode_analysis);

interpreter::BytecodeArrayIterator iterator(bytecode_array());
set_bytecode_iterator(&iterator);
SourcePositionTableIterator source_position_iterator(
    handle(bytecode_array()->SourcePositionTable()));

if (analyze_environment_liveness() && FLAG_trace_environment_liveness) {
  OFStream of(stdout);

  bytecode_analysis.PrintLivenessTo(of);
}

如果想观察liveness过程，可以启用这个flag
DEFINE_BOOL(trace_environment_liveness, false, "trace liveness of local variable slots")

bytecode_array被设置迭代，然后通过VisitSingleBytecode一个个处理。

1
2
3
for (; !iterator.done(); iterator.Advance()) {
  VisitSingleBytecode(&source_position_iterator);
}

这个函数前面就是一些获取bytecode并偏移寻找下一个还有一些其他判断，主要的内容其实是这个大的switch case，对不同bytecode进行不同处理。

1
2
3
4
5
6
7
8
9
10
    switch (iterator.current_bytecode()) {
#define BYTECODE_CASE(name, ...)       \
  case interpreter::Bytecode::k##name: \
    Visit##name();                     \
    break;
      BYTECODE_LIST(BYTECODE_CASE)
#undef BYTECODE_CODE
    }
  }
}

BYTECODE_LIST在bytecode.h里，太长了就不列了。

VisitSingleBytecode里有很多分支，我捡一些写一下。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
[generated bytecode for function: foo]
Parameter count 2
Frame size 24
   80 E> 0x186d973a4f8a @    0 : a0                StackCheck
   97 S> 0x186d973a4f8b @    1 : 28 02 00 00       LdaNamedProperty a0, [0], [0]
         0x186d973a4f8f @    5 : 26 fb             Star r0
         0x186d973a4f91 @    7 : 0c 64             LdaSmi [100]
         0x186d973a4f93 @    9 : 26 f9             Star r2
   97 E> 0x186d973a4f95 @   11 : 57 fb 02 f9 02    CallProperty1 r0, a0, r2, [2]
  110 S> 0x186d973a4f9a @   16 : a4                Return
Constant pool (size = 1)
0x186d973a4f19: [FixedArray] in OldSpace
 - map: 0x186d90c023c1 <Map>
 - length: 1
           0: 0x186dc2812029 <String[7]: indexOf>
Handler Table (size = 0)
  • VisitStackCheck
    在为StackCheck构建node之前，如果没有一个能够支配（effect-dom)它的checkpoint节点，那么会先创建一个精确的checkpoint节点。
    于是在PrepareEagerCheckpoint调用Node* node = NewNode(common()->Checkpoint());
    即使我们在某种情况下跳过了checkpoint的创建，依然会染着Effect边为StackCheck寻找一个能够支配（effect-dom)它的Checkpoint。
    1
    V(Checkpoint, Operator::kKontrol, 0, 1, 1, 0, 1, 0)
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    35
    36
    37
    38
    39
    void BytecodeGraphBuilder::VisitStackCheck() {
      PrepareEagerCheckpoint();
      Node* node = NewNode(javascript()->StackCheck());
      environment()->RecordAfterState(node, Environment::kAttachFrameState);
    }
    ...
    ...
    void BytecodeGraphBuilder::PrepareEagerCheckpoint() {
      if (needs_eager_checkpoint()) {
        // Create an explicit checkpoint node for before the operation. This only
        // needs to happen if we aren't effect-dominated by a {Checkpoint} already.
        mark_as_needing_eager_checkpoint(false);
        Node* node = NewNode(common()->Checkpoint());
        DCHECK_EQ(1, OperatorProperties::GetFrameStateInputCount(node->op()));
        DCHECK_EQ(IrOpcode::kDead,
                  NodeProperties::GetFrameStateInput(node)->opcode());
        BailoutId bailout_id(bytecode_iterator().current_offset());

        const BytecodeLivenessState* liveness_before =
            bytecode_analysis()->GetInLivenessFor(
                bytecode_iterator().current_offset());

        Node* frame_state_before = environment()->Checkpoint(
            bailout_id, OutputFrameStateCombine::Ignore(), liveness_before);
        NodeProperties::ReplaceFrameStateInput(node, frame_state_before);
    #ifdef DEBUG
      } else {
        // In case we skipped checkpoint creation above, we must be able to find an
        // existing checkpoint that effect-dominates the nodes about to be created.
        // Starting a search from the current effect-dependency has to succeed.
        Node* effect = environment()->GetEffectDependency();
        while (effect->opcode() != IrOpcode::kCheckpoint) {
          DCHECK(effect->op()->HasProperty(Operator::kNoWrite));
          DCHECK_EQ(1, effect->op()->EffectInputCount());
          effect = NodeProperties::GetEffectInput(effect);
        }
      }
    #else
      }
  • VisitLdaNamedProperty
    1
    2
    3
    4
    5
    6
    7
    8
    9
    const Operator* JSOperatorBuilder::LoadNamed(Handle<Name> name,
                                                 const VectorSlotPair& feedback) {
      NamedAccess access(LanguageMode::kSloppy, name, feedback);
      return new (zone()) Operator1<NamedAccess>(           // --
          IrOpcode::kJSLoadNamed, Operator::kNoProperties,  // opcode
          "JSLoadNamed",                                    // name
          1, 1, 1, 1, 1, 2,                                 // counts
          access);                                          // parameter
    }
  • VisitStar
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
void BytecodeGraphBuilder::BuildCall(ConvertReceiverMode receiver_mode,
                                     Node* const* args, size_t arg_count,
                                     int slot_id) {
  DCHECK_EQ(interpreter::Bytecodes::GetReceiverMode(
                bytecode_iterator().current_bytecode()),
            receiver_mode);
  PrepareEagerCheckpoint();

  VectorSlotPair feedback = CreateVectorSlotPair(slot_id);

  CallFrequency frequency = ComputeCallFrequency(slot_id);
  const Operator* op =
      javascript()->Call(arg_count, frequency, feedback, receiver_mode,
                         GetSpeculationMode(slot_id));
  JSTypeHintLowering::LoweringResult lowering = TryBuildSimplifiedCall(
      op, args, static_cast<int>(arg_count), feedback.slot());
  if (lowering.IsExit()) return;

  Node* node = nullptr;
  if (lowering.IsSideEffectFree()) {
    node = lowering.value();
  } else {
    DCHECK(!lowering.Changed());
    node = ProcessCallArguments(op, args, static_cast<int>(arg_count));
  }
  environment()->BindAccumulator(node, Environment::kAttachFrameState);
}
...
...
const Operator* JSOperatorBuilder::Call(size_t arity, CallFrequency frequency,
                                        VectorSlotPair const& feedback,
                                        ConvertReceiverMode convert_mode,
                                        SpeculationMode speculation_mode) {
  DCHECK_IMPLIES(speculation_mode == SpeculationMode::kAllowSpeculation,
                 feedback.IsValid());
  CallParameters parameters(arity, frequency, feedback, convert_mode,
                            speculation_mode);
  return new (zone()) Operator1<CallParameters>(   // --
      IrOpcode::kJSCall, Operator::kNoProperties,  // opcode
      "JSCall",                                    // name
      parameters.arity(), 1, 1, 1, 1, 2,           // inputs/outputs
      parameters);                                 // parameter
}