luna - luajit/src/lj

   1/*
   2** IR assembler (SSA IR -> machine code).
   3** Copyright (C) 2005-2026 Mike Pall. See Copyright Notice in luajit.h
   4*/
   5
   6#define lj_asm_c
   7#define LUA_CORE
   8
   9#include "lj_obj.h"
  10
  11#if LJ_HASJIT
  12
  13#include "lj_gc.h"
  14#include "lj_buf.h"
  15#include "lj_str.h"
  16#include "lj_tab.h"
  17#include "lj_frame.h"
  18#if LJ_HASFFI
  19#include "lj_ctype.h"
  20#endif
  21#include "lj_ir.h"
  22#include "lj_jit.h"
  23#include "lj_ircall.h"
  24#include "lj_iropt.h"
  25#include "lj_mcode.h"
  26#include "lj_trace.h"
  27#include "lj_snap.h"
  28#include "lj_asm.h"
  29#include "lj_dispatch.h"
  30#include "lj_vm.h"
  31#include "lj_target.h"
  32#include "lj_prng.h"
  33
  34#ifdef LUA_USE_ASSERT
  35#include <stdio.h>
  36#endif
  37
  38/* -- Assembler state and common macros ----------------------------------- */
  39
  40/* Assembler state. */
  41typedef struct ASMState {
  42  RegCost cost[RID_MAX];  /* Reference and blended allocation cost for regs. */
  43
  44  MCode *mcp;		/* Current MCode pointer (grows down). */
  45  MCode *mclim;		/* Lower limit for MCode memory + red zone. */
  46#ifdef LUA_USE_ASSERT
  47  MCode *mcp_prev;	/* Red zone overflow check. */
  48#endif
  49
  50  IRIns *ir;		/* Copy of pointer to IR instructions/constants. */
  51  jit_State *J;		/* JIT compiler state. */
  52
  53#if LJ_TARGET_X86ORX64
  54  x86ModRM mrm;		/* Fused x86 address operand. */
  55#endif
  56
  57  RegSet freeset;	/* Set of free registers. */
  58  RegSet modset;	/* Set of registers modified inside the loop. */
  59  RegSet weakset;	/* Set of weakly referenced registers. */
  60  RegSet phiset;	/* Set of PHI registers. */
  61
  62  uint32_t flags;	/* Copy of JIT compiler flags. */
  63  int loopinv;		/* Loop branch inversion (0:no, 1:yes, 2:yes+CC_P). */
  64
  65  int32_t evenspill;	/* Next even spill slot. */
  66  int32_t oddspill;	/* Next odd spill slot (or 0). */
  67
  68  IRRef curins;		/* Reference of current instruction. */
  69  IRRef stopins;	/* Stop assembly before hitting this instruction. */
  70  IRRef orignins;	/* Original T->nins. */
  71
  72  IRRef snapref;	/* Current snapshot is active after this reference. */
  73  IRRef snaprename;	/* Rename highwater mark for snapshot check. */
  74  SnapNo snapno;	/* Current snapshot number. */
  75  SnapNo loopsnapno;	/* Loop snapshot number. */
  76  int snapalloc;	/* Current snapshot needs allocation. */
  77  BloomFilter snapfilt1, snapfilt2;	/* Filled with snapshot refs. */
  78
  79  IRRef fuseref;	/* Fusion limit (loopref, 0 or FUSE_DISABLED). */
  80  IRRef sectref;	/* Section base reference (loopref or 0). */
  81  IRRef loopref;	/* Reference of LOOP instruction (or 0). */
  82
  83  BCReg topslot;	/* Number of slots for stack check (unless 0). */
  84  int32_t gcsteps;	/* Accumulated number of GC steps (per section). */
  85
  86  GCtrace *T;		/* Trace to assemble. */
  87  GCtrace *parent;	/* Parent trace (or NULL). */
  88
  89  MCode *mcbot;		/* Bottom of reserved MCode. */
  90  MCode *mctop;		/* Top of generated MCode. */
  91  MCode *mctoporig;	/* Original top of generated MCode. */
  92  MCode *mcloop;	/* Pointer to loop MCode (or NULL). */
  93  MCode *invmcp;	/* Points to invertible loop branch (or NULL). */
  94  MCode *flagmcp;	/* Pending opportunity to merge flag setting ins. */
  95  MCode *realign;	/* Realign loop if not NULL. */
  96  MCode *mctail;	/* Tail of trace before stack adjust + jmp. */
  97#if LJ_TARGET_PPC || LJ_TARGET_ARM64
  98  MCode *mcexit;	/* Pointer to exit stubs. */
  99#endif
 100
 101#ifdef LUAJIT_RANDOM_RA
 102  /* Randomize register allocation. OK for fuzz testing, not for production. */
 103  uint64_t prngbits;
 104  PRNGState prngstate;
 105#endif
 106
 107#ifdef RID_NUM_KREF
 108  intptr_t krefk[RID_NUM_KREF];
 109#endif
 110  IRRef1 phireg[RID_MAX];  /* PHI register references. */
 111  uint16_t parentmap[LJ_MAX_JSLOTS];  /* Parent instruction to RegSP map. */
 112} ASMState;
 113
 114#ifdef LUA_USE_ASSERT
 115#define lj_assertA(c, ...)	lj_assertG_(J2G(as->J), (c), __VA_ARGS__)
 116#else
 117#define lj_assertA(c, ...)	((void)as)
 118#endif
 119
 120#define IR(ref)			(&as->ir[(ref)])
 121
 122#define ASMREF_TMP1		REF_TRUE	/* Temp. register. */
 123#define ASMREF_TMP2		REF_FALSE	/* Temp. register. */
 124#define ASMREF_L		REF_NIL		/* Stores register for L. */
 125
 126/* Check for variant to invariant references. */
 127#define iscrossref(as, ref)	((ref) < as->sectref)
 128
 129/* Inhibit memory op fusion from variant to invariant references. */
 130#define FUSE_DISABLED		(~(IRRef)0)
 131#define mayfuse(as, ref)	((ref) > as->fuseref)
 132#define neverfuse(as)		(as->fuseref == FUSE_DISABLED)
 133#define canfuse(as, ir)		(!neverfuse(as) && !irt_isphi((ir)->t))
 134#define opisfusableload(o) \
 135  ((o) == IR_ALOAD || (o) == IR_HLOAD || (o) == IR_ULOAD || \
 136   (o) == IR_FLOAD || (o) == IR_XLOAD || (o) == IR_SLOAD || (o) == IR_VLOAD)
 137
 138/* Sparse limit checks using a red zone before the actual limit. */
 139#define MCLIM_REDZONE	64
 140
 141static LJ_NORET LJ_NOINLINE void asm_mclimit(ASMState *as)
 142{
 143  lj_mcode_limiterr(as->J, (size_t)(as->mctop - as->mcp + 4*MCLIM_REDZONE));
 144}
 145
 146static LJ_AINLINE void checkmclim(ASMState *as)
 147{
 148#ifdef LUA_USE_ASSERT
 149  if (as->mcp + MCLIM_REDZONE < as->mcp_prev) {
 150    IRIns *ir = IR(as->curins+1);
 151    lj_assertA(0, "red zone overflow: %p IR %04d  %02d %04d %04d\n", as->mcp,
 152      as->curins+1-REF_BIAS, ir->o, ir->op1-REF_BIAS, ir->op2-REF_BIAS);
 153  }
 154#endif
 155  if (LJ_UNLIKELY(as->mcp < as->mclim)) asm_mclimit(as);
 156#ifdef LUA_USE_ASSERT
 157  as->mcp_prev = as->mcp;
 158#endif
 159}
 160
 161#ifdef RID_NUM_KREF
 162#define ra_iskref(ref)		((ref) < RID_NUM_KREF)
 163#define ra_krefreg(ref)		((Reg)(RID_MIN_KREF + (Reg)(ref)))
 164#define ra_krefk(as, ref)	(as->krefk[(ref)])
 165
 166static LJ_AINLINE void ra_setkref(ASMState *as, Reg r, intptr_t k)
 167{
 168  IRRef ref = (IRRef)(r - RID_MIN_KREF);
 169  as->krefk[ref] = k;
 170  as->cost[r] = REGCOST(ref, ref);
 171}
 172
 173#else
 174#define ra_iskref(ref)		0
 175#define ra_krefreg(ref)		RID_MIN_GPR
 176#define ra_krefk(as, ref)	0
 177#endif
 178
 179/* Arch-specific field offsets. */
 180static const uint8_t field_ofs[IRFL__MAX+1] = {
 181#define FLOFS(name, ofs)	(uint8_t)(ofs),
 182IRFLDEF(FLOFS)
 183#undef FLOFS
 184  0
 185};
 186
 187#ifdef LUAJIT_RANDOM_RA
 188/* Return a fixed number of random bits from the local PRNG state. */
 189static uint32_t ra_random_bits(ASMState *as, uint32_t nbits) {
 190  uint64_t b = as->prngbits;
 191  uint32_t res = (1u << nbits) - 1u;
 192  if (b <= res) b = lj_prng_u64(&as->prngstate) | (1ull << 63);
 193  res &= (uint32_t)b;
 194  as->prngbits = b >> nbits;
 195  return res;
 196}
 197
 198/* Pick a random register from a register set. */
 199static Reg rset_pickrandom(ASMState *as, RegSet rs)
 200{
 201  Reg r = rset_pickbot_(rs);
 202  rs >>= r;
 203  if (rs > 1) {  /* More than one bit set? */
 204    while (1) {
 205      /* We need to sample max. the GPR or FPR half of the set. */
 206      uint32_t d = ra_random_bits(as, RSET_BITS-1);
 207      if ((rs >> d) & 1) {
 208	r += d;
 209	break;
 210      }
 211    }
 212  }
 213  return r;
 214}
 215#define rset_picktop(rs)	rset_pickrandom(as, rs)
 216#define rset_pickbot(rs)	rset_pickrandom(as, rs)
 217#else
 218#define rset_picktop(rs)	rset_picktop_(rs)
 219#define rset_pickbot(rs)	rset_pickbot_(rs)
 220#endif
 221
 222/* -- Target-specific instruction emitter --------------------------------- */
 223
 224#if LJ_TARGET_X86ORX64
 225#include "lj_emit_x86.h"
 226#elif LJ_TARGET_ARM
 227#include "lj_emit_arm.h"
 228#elif LJ_TARGET_ARM64
 229#include "lj_emit_arm64.h"
 230#elif LJ_TARGET_PPC
 231#include "lj_emit_ppc.h"
 232#elif LJ_TARGET_MIPS
 233#include "lj_emit_mips.h"
 234#else
 235#error "Missing instruction emitter for target CPU"
 236#endif
 237
 238/* Generic load/store of register from/to stack slot. */
 239#define emit_spload(as, ir, r, ofs) \
 240  emit_loadofs(as, ir, (r), RID_SP, (ofs))
 241#define emit_spstore(as, ir, r, ofs) \
 242  emit_storeofs(as, ir, (r), RID_SP, (ofs))
 243
 244/* -- Register allocator debugging ---------------------------------------- */
 245
 246/* #define LUAJIT_DEBUG_RA */
 247
 248#ifdef LUAJIT_DEBUG_RA
 249
 250#include <stdio.h>
 251#include <stdarg.h>
 252
 253#define RIDNAME(name)	#name,
 254static const char *const ra_regname[] = {
 255  GPRDEF(RIDNAME)
 256  FPRDEF(RIDNAME)
 257  VRIDDEF(RIDNAME)
 258  NULL
 259};
 260#undef RIDNAME
 261
 262static char ra_dbg_buf[65536];
 263static char *ra_dbg_p;
 264static char *ra_dbg_merge;
 265static MCode *ra_dbg_mcp;
 266
 267static void ra_dstart(void)
 268{
 269  ra_dbg_p = ra_dbg_buf;
 270  ra_dbg_merge = NULL;
 271  ra_dbg_mcp = NULL;
 272}
 273
 274static void ra_dflush(void)
 275{
 276  fwrite(ra_dbg_buf, 1, (size_t)(ra_dbg_p-ra_dbg_buf), stdout);
 277  ra_dstart();
 278}
 279
 280static void ra_dprintf(ASMState *as, const char *fmt, ...)
 281{
 282  char *p;
 283  va_list argp;
 284  va_start(argp, fmt);
 285  p = ra_dbg_mcp == as->mcp ? ra_dbg_merge : ra_dbg_p;
 286  ra_dbg_mcp = NULL;
 287  p += sprintf(p, "%08x  \e[36m%04d ", (uintptr_t)as->mcp, as->curins-REF_BIAS);
 288  for (;;) {
 289    const char *e = strchr(fmt, '$');
 290    if (e == NULL) break;
 291    memcpy(p, fmt, (size_t)(e-fmt));
 292    p += e-fmt;
 293    if (e[1] == 'r') {
 294      Reg r = va_arg(argp, Reg) & RID_MASK;
 295      if (r <= RID_MAX) {
 296	const char *q;
 297	for (q = ra_regname[r]; *q; q++)
 298	  *p++ = *q >= 'A' && *q <= 'Z' ? *q + 0x20 : *q;
 299      } else {
 300	*p++ = '?';
 301	lj_assertA(0, "bad register %d for debug format \"%s\"", r, fmt);
 302      }
 303    } else if (e[1] == 'f' || e[1] == 'i') {
 304      IRRef ref;
 305      if (e[1] == 'f')
 306	ref = va_arg(argp, IRRef);
 307      else
 308	ref = va_arg(argp, IRIns *) - as->ir;
 309      if (ref >= REF_BIAS)
 310	p += sprintf(p, "%04d", ref - REF_BIAS);
 311      else
 312	p += sprintf(p, "K%03d", REF_BIAS - ref);
 313    } else if (e[1] == 's') {
 314      uint32_t slot = va_arg(argp, uint32_t);
 315      p += sprintf(p, "[sp+0x%x]", sps_scale(slot));
 316    } else if (e[1] == 'x') {
 317      p += sprintf(p, "%08x", va_arg(argp, int32_t));
 318    } else {
 319      lj_assertA(0, "bad debug format code");
 320    }
 321    fmt = e+2;
 322  }
 323  va_end(argp);
 324  while (*fmt)
 325    *p++ = *fmt++;
 326  *p++ = '\e'; *p++ = '['; *p++ = 'm'; *p++ = '\n';
 327  if (p > ra_dbg_buf+sizeof(ra_dbg_buf)-256) {
 328    fwrite(ra_dbg_buf, 1, (size_t)(p-ra_dbg_buf), stdout);
 329    p = ra_dbg_buf;
 330  }
 331  ra_dbg_p = p;
 332}
 333
 334#define RA_DBG_START()	ra_dstart()
 335#define RA_DBG_FLUSH()	ra_dflush()
 336#define RA_DBG_REF() \
 337  do { char *_p = ra_dbg_p; ra_dprintf(as, ""); \
 338       ra_dbg_merge = _p; ra_dbg_mcp = as->mcp; } while (0)
 339#define RA_DBGX(x)	ra_dprintf x
 340
 341#else
 342#define RA_DBG_START()	((void)0)
 343#define RA_DBG_FLUSH()	((void)0)
 344#define RA_DBG_REF()	((void)0)
 345#define RA_DBGX(x)	((void)0)
 346#endif
 347
 348/* -- Register allocator -------------------------------------------------- */
 349
 350#define ra_free(as, r)		rset_set(as->freeset, (r))
 351#define ra_modified(as, r)	rset_set(as->modset, (r))
 352#define ra_weak(as, r)		rset_set(as->weakset, (r))
 353#define ra_noweak(as, r)	rset_clear(as->weakset, (r))
 354
 355#define ra_used(ir)		(ra_hasreg((ir)->r) || ra_hasspill((ir)->s))
 356
 357/* Setup register allocator. */
 358static void ra_setup(ASMState *as)
 359{
 360  Reg r;
 361  /* Initially all regs (except the stack pointer) are free for use. */
 362  as->freeset = RSET_INIT;
 363  as->modset = RSET_EMPTY;
 364  as->weakset = RSET_EMPTY;
 365  as->phiset = RSET_EMPTY;
 366  memset(as->phireg, 0, sizeof(as->phireg));
 367  for (r = RID_MIN_GPR; r < RID_MAX; r++)
 368    as->cost[r] = REGCOST(~0u, 0u);
 369}
 370
 371/* Rematerialize constants. */
 372static Reg ra_rematk(ASMState *as, IRRef ref)
 373{
 374  IRIns *ir;
 375  Reg r;
 376  if (ra_iskref(ref)) {
 377    r = ra_krefreg(ref);
 378    lj_assertA(!rset_test(as->freeset, r), "rematk of free reg %d", r);
 379    ra_free(as, r);
 380    ra_modified(as, r);
 381#if LJ_64
 382    emit_loadu64(as, r, ra_krefk(as, ref));
 383#else
 384    emit_loadi(as, r, ra_krefk(as, ref));
 385#endif
 386    return r;
 387  }
 388  ir = IR(ref);
 389  r = ir->r;
 390  lj_assertA(ra_hasreg(r), "rematk of K%03d has no reg", REF_BIAS - ref);
 391  lj_assertA(!ra_hasspill(ir->s),
 392	     "rematk of K%03d has spill slot [%x]", REF_BIAS - ref, ir->s);
 393  ra_free(as, r);
 394  ra_modified(as, r);
 395  ir->r = RID_INIT;  /* Do not keep any hint. */
 396  RA_DBGX((as, "remat     $i $r", ir, r));
 397#if !LJ_SOFTFP32
 398  if (ir->o == IR_KNUM) {
 399    emit_loadk64(as, r, ir);
 400  } else
 401#endif
 402  if (emit_canremat(REF_BASE) && ir->o == IR_BASE) {
 403    ra_sethint(ir->r, RID_BASE);  /* Restore BASE register hint. */
 404    emit_getgl(as, r, jit_base);
 405  } else if (emit_canremat(ASMREF_L) && ir->o == IR_KPRI) {
 406    /* REF_NIL stores ASMREF_L register. */
 407    lj_assertA(irt_isnil(ir->t), "rematk of bad ASMREF_L");
 408    emit_getgl(as, r, cur_L);
 409#if LJ_64
 410  } else if (ir->o == IR_KINT64) {
 411    emit_loadu64(as, r, ir_kint64(ir)->u64);
 412#if LJ_GC64
 413  } else if (ir->o == IR_KGC) {
 414    emit_loadu64(as, r, (uintptr_t)ir_kgc(ir));
 415  } else if (ir->o == IR_KPTR || ir->o == IR_KKPTR) {
 416    emit_loadu64(as, r, (uintptr_t)ir_kptr(ir));
 417#endif
 418#endif
 419  } else {
 420    lj_assertA(ir->o == IR_KINT || ir->o == IR_KGC ||
 421	       ir->o == IR_KPTR || ir->o == IR_KKPTR || ir->o == IR_KNULL,
 422	       "rematk of bad IR op %d", ir->o);
 423    emit_loadi(as, r, ir->i);
 424  }
 425  return r;
 426}
 427
 428/* Force a spill. Allocate a new spill slot if needed. */
 429static int32_t ra_spill(ASMState *as, IRIns *ir)
 430{
 431  int32_t slot = ir->s;
 432  lj_assertA(ir >= as->ir + REF_TRUE,
 433	     "spill of K%03d", REF_BIAS - (int)(ir - as->ir));
 434  if (!ra_hasspill(slot)) {
 435    if (irt_is64(ir->t)) {
 436      slot = as->evenspill;
 437      as->evenspill += 2;
 438    } else if (as->oddspill) {
 439      slot = as->oddspill;
 440      as->oddspill = 0;
 441    } else {
 442      slot = as->evenspill;
 443      as->oddspill = slot+1;
 444      as->evenspill += 2;
 445    }
 446    if (as->evenspill > 256)
 447      lj_trace_err(as->J, LJ_TRERR_SPILLOV);
 448    ir->s = (uint8_t)slot;
 449  }
 450  return sps_scale(slot);
 451}
 452
 453/* Release the temporarily allocated register in ASMREF_TMP1/ASMREF_TMP2. */
 454static Reg ra_releasetmp(ASMState *as, IRRef ref)
 455{
 456  IRIns *ir = IR(ref);
 457  Reg r = ir->r;
 458  lj_assertA(ra_hasreg(r), "release of TMP%d has no reg", ref-ASMREF_TMP1+1);
 459  lj_assertA(!ra_hasspill(ir->s),
 460	     "release of TMP%d has spill slot [%x]", ref-ASMREF_TMP1+1, ir->s);
 461  ra_free(as, r);
 462  ra_modified(as, r);
 463  ir->r = RID_INIT;
 464  return r;
 465}
 466
 467/* Restore a register (marked as free). Rematerialize or force a spill. */
 468static Reg ra_restore(ASMState *as, IRRef ref)
 469{
 470  if (emit_canremat(ref)) {
 471    return ra_rematk(as, ref);
 472  } else {
 473    IRIns *ir = IR(ref);
 474    int32_t ofs = ra_spill(as, ir);  /* Force a spill slot. */
 475    Reg r = ir->r;
 476    lj_assertA(ra_hasreg(r), "restore of IR %04d has no reg", ref - REF_BIAS);
 477    ra_sethint(ir->r, r);  /* Keep hint. */
 478    ra_free(as, r);
 479    if (!rset_test(as->weakset, r)) {  /* Only restore non-weak references. */
 480      ra_modified(as, r);
 481      RA_DBGX((as, "restore   $i $r", ir, r));
 482      emit_spload(as, ir, r, ofs);
 483    }
 484    return r;
 485  }
 486}
 487
 488/* Save a register to a spill slot. */
 489static void ra_save(ASMState *as, IRIns *ir, Reg r)
 490{
 491  RA_DBGX((as, "save      $i $r", ir, r));
 492  emit_spstore(as, ir, r, sps_scale(ir->s));
 493}
 494
 495#define MINCOST(name) \
 496  if (rset_test(RSET_ALL, RID_##name) && \
 497      LJ_LIKELY(allow&RID2RSET(RID_##name)) && as->cost[RID_##name] < cost) \
 498    cost = as->cost[RID_##name];
 499
 500/* Evict the register with the lowest cost, forcing a restore. */
 501static Reg ra_evict(ASMState *as, RegSet allow)
 502{
 503  IRRef ref;
 504  RegCost cost = ~(RegCost)0;
 505  lj_assertA(allow != RSET_EMPTY, "evict from empty set");
 506  if (RID_NUM_FPR == 0 || allow < RID2RSET(RID_MAX_GPR)) {
 507    GPRDEF(MINCOST)
 508  } else {
 509    FPRDEF(MINCOST)
 510  }
 511  ref = regcost_ref(cost);
 512  lj_assertA(ra_iskref(ref) || (ref >= as->T->nk && ref < as->T->nins),
 513	     "evict of out-of-range IR %04d", ref - REF_BIAS);
 514  /* Preferably pick any weak ref instead of a non-weak, non-const ref. */
 515  if (!irref_isk(ref) && (as->weakset & allow)) {
 516    IRIns *ir = IR(ref);
 517    if (!rset_test(as->weakset, ir->r))
 518      ref = regcost_ref(as->cost[rset_pickbot((as->weakset & allow))]);
 519  }
 520  return ra_restore(as, ref);
 521}
 522
 523/* Pick any register (marked as free). Evict on-demand. */
 524static Reg ra_pick(ASMState *as, RegSet allow)
 525{
 526  RegSet pick = as->freeset & allow;
 527  if (!pick)
 528    return ra_evict(as, allow);
 529  else
 530    return rset_picktop(pick);
 531}
 532
 533/* Get a scratch register (marked as free). */
 534static Reg ra_scratch(ASMState *as, RegSet allow)
 535{
 536  Reg r = ra_pick(as, allow);
 537  ra_modified(as, r);
 538  RA_DBGX((as, "scratch        $r", r));
 539  return r;
 540}
 541
 542/* Evict all registers from a set (if not free). */
 543static void ra_evictset(ASMState *as, RegSet drop)
 544{
 545  RegSet work;
 546  as->modset |= drop;
 547#if !LJ_SOFTFP
 548  work = (drop & ~as->freeset) & RSET_FPR;
 549  while (work) {
 550    Reg r = rset_pickbot(work);
 551    ra_restore(as, regcost_ref(as->cost[r]));
 552    rset_clear(work, r);
 553    checkmclim(as);
 554  }
 555#endif
 556  work = (drop & ~as->freeset);
 557  while (work) {
 558    Reg r = rset_pickbot(work);
 559    ra_restore(as, regcost_ref(as->cost[r]));
 560    rset_clear(work, r);
 561    checkmclim(as);
 562  }
 563}
 564
 565/* Evict (rematerialize) all registers allocated to constants. */
 566static void ra_evictk(ASMState *as)
 567{
 568  RegSet work;
 569#if !LJ_SOFTFP
 570  work = ~as->freeset & RSET_FPR;
 571  while (work) {
 572    Reg r = rset_pickbot(work);
 573    IRRef ref = regcost_ref(as->cost[r]);
 574    if (emit_canremat(ref) && irref_isk(ref)) {
 575      ra_rematk(as, ref);
 576      checkmclim(as);
 577    }
 578    rset_clear(work, r);
 579  }
 580#endif
 581  work = ~as->freeset & RSET_GPR;
 582  while (work) {
 583    Reg r = rset_pickbot(work);
 584    IRRef ref = regcost_ref(as->cost[r]);
 585    if (emit_canremat(ref) && irref_isk(ref)) {
 586      ra_rematk(as, ref);
 587      checkmclim(as);
 588    }
 589    rset_clear(work, r);
 590  }
 591}
 592
 593#ifdef RID_NUM_KREF
 594/* Allocate a register for a constant. */
 595static Reg ra_allock(ASMState *as, intptr_t k, RegSet allow)
 596{
 597  /* First try to find a register which already holds the same constant. */
 598  RegSet pick, work = ~as->freeset & RSET_GPR;
 599  Reg r;
 600  while (work) {
 601    IRRef ref;
 602    r = rset_pickbot(work);
 603    ref = regcost_ref(as->cost[r]);
 604#if LJ_64
 605    if (ref < ASMREF_L) {
 606      if (ra_iskref(ref)) {
 607	if (k == ra_krefk(as, ref))
 608	  return r;
 609      } else {
 610	IRIns *ir = IR(ref);
 611	if ((ir->o == IR_KINT64 && k == (int64_t)ir_kint64(ir)->u64) ||
 612#if LJ_GC64
 613#if LJ_TARGET_ARM64
 614	    (ir->o == IR_KINT && (uint64_t)k == (uint32_t)ir->i) ||
 615#else
 616	    (ir->o == IR_KINT && k == ir->i) ||
 617#endif
 618	    (ir->o == IR_KGC && k == (intptr_t)ir_kgc(ir)) ||
 619	    ((ir->o == IR_KPTR || ir->o == IR_KKPTR) &&
 620	     k == (intptr_t)ir_kptr(ir))
 621#else
 622	    (ir->o != IR_KINT64 && k == ir->i)
 623#endif
 624	   )
 625	  return r;
 626      }
 627    }
 628#else
 629    if (ref < ASMREF_L &&
 630	k == (ra_iskref(ref) ? ra_krefk(as, ref) : IR(ref)->i))
 631      return r;
 632#endif
 633    rset_clear(work, r);
 634  }
 635  pick = as->freeset & allow;
 636  if (pick) {
 637    /* Constants should preferably get unmodified registers. */
 638    if ((pick & ~as->modset))
 639      pick &= ~as->modset;
 640    r = rset_pickbot(pick);  /* Reduce conflicts with inverse allocation. */
 641  } else {
 642    r = ra_evict(as, allow);
 643  }
 644  RA_DBGX((as, "allock    $x $r", k, r));
 645  ra_setkref(as, r, k);
 646  rset_clear(as->freeset, r);
 647  ra_noweak(as, r);
 648  return r;
 649}
 650
 651/* Allocate a specific register for a constant. */
 652static void ra_allockreg(ASMState *as, intptr_t k, Reg r)
 653{
 654  Reg kr = ra_allock(as, k, RID2RSET(r));
 655  if (kr != r) {
 656    IRIns irdummy;
 657    irdummy.t.irt = IRT_INT;
 658    ra_scratch(as, RID2RSET(r));
 659    emit_movrr(as, &irdummy, r, kr);
 660  }
 661}
 662#else
 663#define ra_allockreg(as, k, r)		emit_loadi(as, (r), (k))
 664#endif
 665
 666/* Allocate a register for ref from the allowed set of registers.
 667** Note: this function assumes the ref does NOT have a register yet!
 668** Picks an optimal register, sets the cost and marks the register as non-free.
 669*/
 670static Reg ra_allocref(ASMState *as, IRRef ref, RegSet allow)
 671{
 672  IRIns *ir = IR(ref);
 673  RegSet pick = as->freeset & allow;
 674  Reg r;
 675  lj_assertA(ra_noreg(ir->r),
 676	     "IR %04d already has reg %d", ref - REF_BIAS, ir->r);
 677  if (pick) {
 678    /* First check register hint from propagation or PHI. */
 679    if (ra_hashint(ir->r)) {
 680      r = ra_gethint(ir->r);
 681      if (rset_test(pick, r))  /* Use hint register if possible. */
 682	goto found;
 683      /* Rematerialization is cheaper than missing a hint. */
 684      if (rset_test(allow, r) && emit_canremat(regcost_ref(as->cost[r]))) {
 685	ra_rematk(as, regcost_ref(as->cost[r]));
 686	goto found;
 687      }
 688      RA_DBGX((as, "hintmiss  $f $r", ref, r));
 689    }
 690    /* Invariants should preferably get unmodified registers. */
 691    if (ref < as->loopref && !irt_isphi(ir->t)) {
 692      if ((pick & ~as->modset))
 693	pick &= ~as->modset;
 694      r = rset_pickbot(pick);  /* Reduce conflicts with inverse allocation. */
 695    } else {
 696      /* We've got plenty of regs, so get callee-save regs if possible. */
 697      if (RID_NUM_GPR > 8 && (pick & ~RSET_SCRATCH))
 698	pick &= ~RSET_SCRATCH;
 699      r = rset_picktop(pick);
 700    }
 701  } else {
 702    r = ra_evict(as, allow);
 703  }
 704found:
 705  RA_DBGX((as, "alloc     $f $r", ref, r));
 706  ir->r = (uint8_t)r;
 707  rset_clear(as->freeset, r);
 708  ra_noweak(as, r);
 709  as->cost[r] = REGCOST_REF_T(ref, irt_t(ir->t));
 710  return r;
 711}
 712
 713/* Allocate a register on-demand. */
 714static Reg ra_alloc1(ASMState *as, IRRef ref, RegSet allow)
 715{
 716  Reg r = IR(ref)->r;
 717  /* Note: allow is ignored if the register is already allocated. */
 718  if (ra_noreg(r)) r = ra_allocref(as, ref, allow);
 719  ra_noweak(as, r);
 720  return r;
 721}
 722
 723/* Add a register rename to the IR. */
 724static void ra_addrename(ASMState *as, Reg down, IRRef ref, SnapNo snapno)
 725{
 726  IRRef ren;
 727  lj_ir_set(as->J, IRT(IR_RENAME, IRT_NIL), ref, snapno);
 728  ren = tref_ref(lj_ir_emit(as->J));
 729  as->J->cur.ir[ren].r = (uint8_t)down;
 730  as->J->cur.ir[ren].s = SPS_NONE;
 731}
 732
 733/* Rename register allocation and emit move. */
 734static void ra_rename(ASMState *as, Reg down, Reg up)
 735{
 736  IRRef ref = regcost_ref(as->cost[up] = as->cost[down]);
 737  IRIns *ir = IR(ref);
 738  ir->r = (uint8_t)up;
 739  as->cost[down] = 0;
 740  lj_assertA((down < RID_MAX_GPR) == (up < RID_MAX_GPR),
 741	     "rename between GPR/FPR %d and %d", down, up);
 742  lj_assertA(!rset_test(as->freeset, down), "rename from free reg %d", down);
 743  lj_assertA(rset_test(as->freeset, up), "rename to non-free reg %d", up);
 744  ra_free(as, down);  /* 'down' is free ... */
 745  ra_modified(as, down);
 746  rset_clear(as->freeset, up);  /* ... and 'up' is now allocated. */
 747  ra_noweak(as, up);
 748  RA_DBGX((as, "rename    $f $r $r", regcost_ref(as->cost[up]), down, up));
 749  emit_movrr(as, ir, down, up);  /* Backwards codegen needs inverse move. */
 750  if (!ra_hasspill(IR(ref)->s)) {  /* Add the rename to the IR. */
 751    /*
 752    ** The rename is effective at the subsequent (already emitted) exit
 753    ** branch. This is for the current snapshot (as->snapno). Except if we
 754    ** haven't yet allocated any refs for the snapshot (as->snapalloc == 1),
 755    ** then it belongs to the next snapshot.
 756    ** See also the discussion at asm_snap_checkrename().
 757    */
 758    ra_addrename(as, down, ref, as->snapno + as->snapalloc);
 759  }
 760}
 761
 762/* Pick a destination register (marked as free).
 763** Caveat: allow is ignored if there's already a destination register.
 764** Use ra_destreg() to get a specific register.
 765*/
 766static Reg ra_dest(ASMState *as, IRIns *ir, RegSet allow)
 767{
 768  Reg dest = ir->r;
 769  if (ra_hasreg(dest)) {
 770    ra_free(as, dest);
 771    ra_modified(as, dest);
 772  } else {
 773    if (ra_hashint(dest) && rset_test((as->freeset&allow), ra_gethint(dest))) {
 774      dest = ra_gethint(dest);
 775      ra_modified(as, dest);
 776      RA_DBGX((as, "dest           $r", dest));
 777    } else {
 778      dest = ra_scratch(as, allow);
 779    }
 780    ir->r = dest;
 781  }
 782  if (LJ_UNLIKELY(ra_hasspill(ir->s))) ra_save(as, ir, dest);
 783  return dest;
 784}
 785
 786/* Force a specific destination register (marked as free). */
 787static void ra_destreg(ASMState *as, IRIns *ir, Reg r)
 788{
 789  Reg dest = ra_dest(as, ir, RID2RSET(r));
 790  if (dest != r) {
 791    lj_assertA(rset_test(as->freeset, r), "dest reg %d is not free", r);
 792    ra_modified(as, r);
 793    emit_movrr(as, ir, dest, r);
 794  }
 795}
 796
 797#if LJ_TARGET_X86ORX64
 798/* Propagate dest register to left reference. Emit moves as needed.
 799** This is a required fixup step for all 2-operand machine instructions.
 800*/
 801static void ra_left(ASMState *as, Reg dest, IRRef lref)
 802{
 803  IRIns *ir = IR(lref);
 804  Reg left = ir->r;
 805  if (ra_noreg(left)) {
 806    if (irref_isk(lref)) {
 807      if (ir->o == IR_KNUM) {
 808	/* FP remat needs a load except for +0. Still better than eviction. */
 809	if (tvispzero(ir_knum(ir)) || !(as->freeset & RSET_FPR)) {
 810	  emit_loadk64(as, dest, ir);
 811	  return;
 812	}
 813#if LJ_64
 814      } else if (ir->o == IR_KINT64) {
 815	emit_loadk64(as, dest, ir);
 816	return;
 817#if LJ_GC64
 818      } else if (ir->o == IR_KGC || ir->o == IR_KPTR || ir->o == IR_KKPTR) {
 819	emit_loadk64(as, dest, ir);
 820	return;
 821#endif
 822#endif
 823      } else if (ir->o != IR_KPRI) {
 824	lj_assertA(ir->o == IR_KINT || ir->o == IR_KGC ||
 825		   ir->o == IR_KPTR || ir->o == IR_KKPTR || ir->o == IR_KNULL,
 826		   "K%03d has bad IR op %d", REF_BIAS - lref, ir->o);
 827	emit_loadi(as, dest, ir->i);
 828	return;
 829      }
 830    }
 831    if (!ra_hashint(left) && !iscrossref(as, lref))
 832      ra_sethint(ir->r, dest);  /* Propagate register hint. */
 833    left = ra_allocref(as, lref, dest < RID_MAX_GPR ? RSET_GPR : RSET_FPR);
 834  }
 835  ra_noweak(as, left);
 836  /* Move needed for true 3-operand instruction: y=a+b ==> y=a; y+=b. */
 837  if (dest != left) {
 838    /* Use register renaming if dest is the PHI reg. */
 839    if (irt_isphi(ir->t) && as->phireg[dest] == lref) {
 840      ra_modified(as, left);
 841      ra_rename(as, left, dest);
 842    } else {
 843      emit_movrr(as, ir, dest, left);
 844    }
 845  }
 846}
 847#else
 848/* Similar to ra_left, except we override any hints. */
 849static void ra_leftov(ASMState *as, Reg dest, IRRef lref)
 850{
 851  IRIns *ir = IR(lref);
 852  Reg left = ir->r;
 853  if (ra_noreg(left)) {
 854    ra_sethint(ir->r, dest);  /* Propagate register hint. */
 855    left = ra_allocref(as, lref,
 856		       (LJ_SOFTFP || dest < RID_MAX_GPR) ? RSET_GPR : RSET_FPR);
 857  }
 858  ra_noweak(as, left);
 859  if (dest != left) {
 860    /* Use register renaming if dest is the PHI reg. */
 861    if (irt_isphi(ir->t) && as->phireg[dest] == lref) {
 862      ra_modified(as, left);
 863      ra_rename(as, left, dest);
 864    } else {
 865      emit_movrr(as, ir, dest, left);
 866    }
 867  }
 868}
 869#endif
 870
 871/* Force a RID_RETLO/RID_RETHI destination register pair (marked as free). */
 872static void ra_destpair(ASMState *as, IRIns *ir)
 873{
 874  Reg destlo = ir->r, desthi = (ir+1)->r;
 875  IRIns *irx = (LJ_64 && !irt_is64(ir->t)) ? ir+1 : ir;
 876  /* First spill unrelated refs blocking the destination registers. */
 877  if (!rset_test(as->freeset, RID_RETLO) &&
 878      destlo != RID_RETLO && desthi != RID_RETLO)
 879    ra_restore(as, regcost_ref(as->cost[RID_RETLO]));
 880  if (!rset_test(as->freeset, RID_RETHI) &&
 881      destlo != RID_RETHI && desthi != RID_RETHI)
 882    ra_restore(as, regcost_ref(as->cost[RID_RETHI]));
 883  /* Next free the destination registers (if any). */
 884  if (ra_hasreg(destlo)) {
 885    ra_free(as, destlo);
 886    ra_modified(as, destlo);
 887  } else {
 888    destlo = RID_RETLO;
 889  }
 890  if (ra_hasreg(desthi)) {
 891    ra_free(as, desthi);
 892    ra_modified(as, desthi);
 893  } else {
 894    desthi = RID_RETHI;
 895  }
 896  /* Check for conflicts and shuffle the registers as needed. */
 897  if (destlo == RID_RETHI) {
 898    if (desthi == RID_RETLO) {
 899#if LJ_TARGET_X86ORX64
 900      *--as->mcp = XI_XCHGa + RID_RETHI;
 901      if (LJ_64 && irt_is64(irx->t)) *--as->mcp = 0x48;
 902#else
 903      emit_movrr(as, irx, RID_RETHI, RID_TMP);
 904      emit_movrr(as, irx, RID_RETLO, RID_RETHI);
 905      emit_movrr(as, irx, RID_TMP, RID_RETLO);
 906#endif
 907    } else {
 908      emit_movrr(as, irx, RID_RETHI, RID_RETLO);
 909      if (desthi != RID_RETHI) emit_movrr(as, irx, desthi, RID_RETHI);
 910    }
 911  } else if (desthi == RID_RETLO) {
 912    emit_movrr(as, irx, RID_RETLO, RID_RETHI);
 913    if (destlo != RID_RETLO) emit_movrr(as, irx, destlo, RID_RETLO);
 914  } else {
 915    if (desthi != RID_RETHI) emit_movrr(as, irx, desthi, RID_RETHI);
 916    if (destlo != RID_RETLO) emit_movrr(as, irx, destlo, RID_RETLO);
 917  }
 918  /* Restore spill slots (if any). */
 919  if (ra_hasspill((ir+1)->s)) ra_save(as, ir+1, RID_RETHI);
 920  if (ra_hasspill(ir->s)) ra_save(as, ir, RID_RETLO);
 921}
 922
 923/* -- Snapshot handling --------- ----------------------------------------- */
 924
 925/* Can we rematerialize a KNUM instead of forcing a spill? */
 926static int asm_snap_canremat(ASMState *as)
 927{
 928  Reg r;
 929  for (r = RID_MIN_FPR; r < RID_MAX_FPR; r++)
 930    if (irref_isk(regcost_ref(as->cost[r])))
 931      return 1;
 932  return 0;
 933}
 934
 935/* Check whether a sunk store corresponds to an allocation. */
 936static int asm_sunk_store(ASMState *as, IRIns *ira, IRIns *irs)
 937{
 938  if (irs->s == 255) {
 939    if (irs->o == IR_ASTORE || irs->o == IR_HSTORE ||
 940	irs->o == IR_FSTORE || irs->o == IR_XSTORE) {
 941      IRIns *irk = IR(irs->op1);
 942      if (irk->o == IR_AREF || irk->o == IR_HREFK)
 943	irk = IR(irk->op1);
 944      return (IR(irk->op1) == ira);
 945    }
 946    return 0;
 947  } else {
 948    return (ira + irs->s == irs);  /* Quick check. */
 949  }
 950}
 951
 952/* Allocate register or spill slot for a ref that escapes to a snapshot. */
 953static void asm_snap_alloc1(ASMState *as, IRRef ref)
 954{
 955  IRIns *ir = IR(ref);
 956  if (!irref_isk(ref)) {
 957    bloomset(as->snapfilt1, ref);
 958    bloomset(as->snapfilt2, hashrot(ref, ref + HASH_BIAS));
 959    if (ra_used(ir)) return;
 960    if (ir->r == RID_SINK || ir->r == RID_SUNK) {
 961      ir->r = RID_SUNK;
 962#if LJ_HASFFI
 963      if (ir->o == IR_CNEWI) {  /* Allocate CNEWI value. */
 964	asm_snap_alloc1(as, ir->op2);
 965	if (LJ_32 && (ir+1)->o == IR_HIOP)
 966	  asm_snap_alloc1(as, (ir+1)->op2);
 967      } else
 968#endif
 969      {  /* Allocate stored values for TNEW, TDUP and CNEW. */
 970	IRIns *irs;
 971	lj_assertA(ir->o == IR_TNEW || ir->o == IR_TDUP || ir->o == IR_CNEW,
 972		   "sink of IR %04d has bad op %d", ref - REF_BIAS, ir->o);
 973	for (irs = IR(as->snapref-1); irs > ir; irs--)
 974	  if (irs->r == RID_SINK && asm_sunk_store(as, ir, irs)) {
 975	    lj_assertA(irs->o == IR_ASTORE || irs->o == IR_HSTORE ||
 976		       irs->o == IR_FSTORE || irs->o == IR_XSTORE,
 977		       "sunk store IR %04d has bad op %d",
 978		       (int)(irs - as->ir) - REF_BIAS, irs->o);
 979	    asm_snap_alloc1(as, irs->op2);
 980	    if (LJ_32 && (irs+1)->o == IR_HIOP)
 981	      asm_snap_alloc1(as, (irs+1)->op2);
 982	  }
 983      }
 984    } else {
 985      RegSet allow;
 986      if (ir->o == IR_CONV && ir->op2 == IRCONV_NUM_INT) {
 987	IRIns *irc;
 988	for (irc = IR(as->curins); irc > ir; irc--)
 989	  if ((irc->op1 == ref || irc->op2 == ref) &&
 990	      !(irc->r == RID_SINK || irc->r == RID_SUNK))
 991	    goto nosink;  /* Don't sink conversion if result is used. */
 992	asm_snap_alloc1(as, ir->op1);
 993	return;
 994      }
 995    nosink:
 996      allow = (!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR;
 997      if ((as->freeset & allow) ||
 998	       (allow == RSET_FPR && asm_snap_canremat(as))) {
 999	/* Get a weak register if we have a free one or can rematerialize. */
1000	Reg r = ra_allocref(as, ref, allow);  /* Allocate a register. */
1001	if (!irt_isphi(ir->t))
1002	  ra_weak(as, r);  /* But mark it as weakly referenced. */
1003	checkmclim(as);
1004	RA_DBGX((as, "snapreg   $f $r", ref, ir->r));
1005      } else {
1006	ra_spill(as, ir);  /* Otherwise force a spill slot. */
1007	RA_DBGX((as, "snapspill $f $s", ref, ir->s));
1008      }
1009    }
1010  }
1011}
1012
1013/* Allocate refs escaping to a snapshot. */
1014static void asm_snap_alloc(ASMState *as, int snapno)
1015{
1016  SnapShot *snap = &as->T->snap[snapno];
1017  SnapEntry *map = &as->T->snapmap[snap->mapofs];
1018  MSize n, nent = snap->nent;
1019  as->snapfilt1 = as->snapfilt2 = 0;
1020  for (n = 0; n < nent; n++) {
1021    SnapEntry sn = map[n];
1022    IRRef ref = snap_ref(sn);
1023    if (!irref_isk(ref)) {
1024      asm_snap_alloc1(as, ref);
1025      if (LJ_SOFTFP && (sn & SNAP_SOFTFPNUM)) {
1026	lj_assertA(irt_type(IR(ref+1)->t) == IRT_SOFTFP,
1027		   "snap %d[%d] points to bad SOFTFP IR %04d",
1028		   snapno, n, ref - REF_BIAS);
1029	asm_snap_alloc1(as, ref+1);
1030      }
1031    }
1032  }
1033}
1034
1035/* All guards for a snapshot use the same exitno. This is currently the
1036** same as the snapshot number. Since the exact origin of the exit cannot
1037** be determined, all guards for the same snapshot must exit with the same
1038** RegSP mapping.
1039** A renamed ref which has been used in a prior guard for the same snapshot
1040** would cause an inconsistency. The easy way out is to force a spill slot.
1041*/
1042static int asm_snap_checkrename(ASMState *as, IRRef ren)
1043{
1044  if (bloomtest(as->snapfilt1, ren) &&
1045      bloomtest(as->snapfilt2, hashrot(ren, ren + HASH_BIAS))) {
1046    IRIns *ir = IR(ren);
1047    ra_spill(as, ir);  /* Register renamed, so force a spill slot. */
1048    RA_DBGX((as, "snaprensp $f $s", ren, ir->s));
1049    return 1;  /* Found. */
1050  }
1051  return 0;  /* Not found. */
1052}
1053
1054/* Prepare snapshot for next guard or throwing instruction. */
1055static void asm_snap_prep(ASMState *as)
1056{
1057  if (as->snapalloc) {
1058    /* Alloc on first invocation for each snapshot. */
1059    as->snapalloc = 0;
1060    asm_snap_alloc(as, as->snapno);
1061    as->snaprename = as->T->nins;
1062  } else {
1063    /* Check any renames above the highwater mark. */
1064    for (; as->snaprename < as->T->nins; as->snaprename++) {
1065      IRIns *ir = &as->T->ir[as->snaprename];
1066      if (asm_snap_checkrename(as, ir->op1))
1067	ir->op2 = REF_BIAS-1;  /* Kill rename. */
1068    }
1069  }
1070}
1071
1072/* Move to previous snapshot when we cross the current snapshot ref. */
1073static void asm_snap_prev(ASMState *as)
1074{
1075  if (as->curins < as->snapref) {
1076    uintptr_t ofs = (uintptr_t)(as->mctoporig - as->mcp);
1077    if (ofs >= 0x10000) lj_trace_err(as->J, LJ_TRERR_MCODEOV);
1078    do {
1079      if (as->snapno == 0) return;
1080      as->snapno--;
1081      as->snapref = as->T->snap[as->snapno].ref;
1082      as->T->snap[as->snapno].mcofs = (uint16_t)ofs;  /* Remember mcode ofs. */
1083    } while (as->curins < as->snapref);  /* May have no ins inbetween. */
1084    as->snapalloc = 1;
1085  }
1086}
1087
1088/* Fixup snapshot mcode offsetst. */
1089static void asm_snap_fixup_mcofs(ASMState *as)
1090{
1091  uint32_t sz = (uint32_t)(as->mctoporig - as->mcp);
1092  SnapShot *snap = as->T->snap;
1093  SnapNo i;
1094  for (i = as->T->nsnap-1; i > 0; i--) {
1095    /* Compute offset from mcode start and store in correct snapshot. */
1096    snap[i].mcofs = (uint16_t)(sz - snap[i-1].mcofs);
1097  }
1098  snap[0].mcofs = 0;
1099}
1100
1101/* -- Miscellaneous helpers ----------------------------------------------- */
1102
1103/* Calculate stack adjustment. */
1104static int32_t asm_stack_adjust(ASMState *as)
1105{
1106  if (as->evenspill <= SPS_FIXED)
1107    return 0;
1108  return sps_scale(sps_align(as->evenspill));
1109}
1110
1111/* Must match with hash*() in lj_tab.c. */
1112static uint32_t ir_khash(ASMState *as, IRIns *ir)
1113{
1114  uint32_t lo, hi;
1115  UNUSED(as);
1116  if (irt_isstr(ir->t)) {
1117    return ir_kstr(ir)->sid;
1118  } else if (irt_isnum(ir->t)) {
1119    lo = ir_knum(ir)->u32.lo;
1120    hi = ir_knum(ir)->u32.hi << 1;
1121  } else if (irt_ispri(ir->t)) {
1122    lj_assertA(!irt_isnil(ir->t), "hash of nil key");
1123    return irt_type(ir->t)-IRT_FALSE;
1124  } else {
1125    lj_assertA(irt_isgcv(ir->t), "hash of bad IR type %d", irt_type(ir->t));
1126    lo = u32ptr(ir_kgc(ir));
1127#if LJ_GC64
1128    hi = (uint32_t)(u64ptr(ir_kgc(ir)) >> 32) | (irt_toitype(ir->t) << 15);
1129#else
1130    hi = lo + HASH_BIAS;
1131#endif
1132  }
1133  return hashrot(lo, hi);
1134}
1135
1136/* -- Allocations --------------------------------------------------------- */
1137
1138static void asm_gencall(ASMState *as, const CCallInfo *ci, IRRef *args);
1139static void asm_setupresult(ASMState *as, IRIns *ir, const CCallInfo *ci);
1140
1141static void asm_snew(ASMState *as, IRIns *ir)
1142{
1143  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_str_new];
1144  IRRef args[3];
1145  asm_snap_prep(as);
1146  args[0] = ASMREF_L;  /* lua_State *L    */
1147  args[1] = ir->op1;   /* const char *str */
1148  args[2] = ir->op2;   /* size_t len      */
1149  as->gcsteps++;
1150  asm_setupresult(as, ir, ci);  /* GCstr * */
1151  asm_gencall(as, ci, args);
1152}
1153
1154static void asm_tnew(ASMState *as, IRIns *ir)
1155{
1156  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_tab_new1];
1157  IRRef args[2];
1158  asm_snap_prep(as);
1159  args[0] = ASMREF_L;     /* lua_State *L    */
1160  args[1] = ASMREF_TMP1;  /* uint32_t ahsize */
1161  as->gcsteps++;
1162  asm_setupresult(as, ir, ci);  /* GCtab * */
1163  asm_gencall(as, ci, args);
1164  ra_allockreg(as, ir->op1 | (ir->op2 << 24), ra_releasetmp(as, ASMREF_TMP1));
1165}
1166
1167static void asm_tdup(ASMState *as, IRIns *ir)
1168{
1169  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_tab_dup];
1170  IRRef args[2];
1171  asm_snap_prep(as);
1172  args[0] = ASMREF_L;  /* lua_State *L    */
1173  args[1] = ir->op1;   /* const GCtab *kt */
1174  as->gcsteps++;
1175  asm_setupresult(as, ir, ci);  /* GCtab * */
1176  asm_gencall(as, ci, args);
1177}
1178
1179static void asm_gc_check(ASMState *as);
1180
1181/* Explicit GC step. */
1182static void asm_gcstep(ASMState *as, IRIns *ir)
1183{
1184  IRIns *ira;
1185  for (ira = IR(as->stopins+1); ira < ir; ira++)
1186    if ((ira->o == IR_TNEW || ira->o == IR_TDUP ||
1187	 (LJ_HASFFI && (ira->o == IR_CNEW || ira->o == IR_CNEWI))) &&
1188	ra_used(ira))
1189      as->gcsteps++;
1190  if (as->gcsteps)
1191    asm_gc_check(as);
1192  as->gcsteps = 0x80000000;  /* Prevent implicit GC check further up. */
1193}
1194
1195/* -- Buffer operations --------------------------------------------------- */
1196
1197static void asm_tvptr(ASMState *as, Reg dest, IRRef ref, MSize mode);
1198#if LJ_HASBUFFER
1199static void asm_bufhdr_write(ASMState *as, Reg sb);
1200#endif
1201
1202static void asm_bufhdr(ASMState *as, IRIns *ir)
1203{
1204  Reg sb = ra_dest(as, ir, RSET_GPR);
1205  switch (ir->op2) {
1206  case IRBUFHDR_RESET: {
1207    Reg tmp = ra_scratch(as, rset_exclude(RSET_GPR, sb));
1208    IRIns irbp;
1209    irbp.ot = IRT(0, IRT_PTR);  /* Buffer data pointer type. */
1210    emit_storeofs(as, &irbp, tmp, sb, offsetof(SBuf, w));
1211    emit_loadofs(as, &irbp, tmp, sb, offsetof(SBuf, b));
1212    break;
1213    }
1214  case IRBUFHDR_APPEND: {
1215    /* Rematerialize const buffer pointer instead of likely spill. */
1216    IRIns *irp = IR(ir->op1);
1217    if (!(ra_hasreg(irp->r) || irp == ir-1 ||
1218	  (irp == ir-2 && !ra_used(ir-1)))) {
1219      while (!(irp->o == IR_BUFHDR && irp->op2 == IRBUFHDR_RESET))
1220	irp = IR(irp->op1);
1221      if (irref_isk(irp->op1)) {
1222	ra_weak(as, ra_allocref(as, ir->op1, RSET_GPR));
1223	ir = irp;
1224      }
1225    }
1226    break;
1227    }
1228#if LJ_HASBUFFER
1229  case IRBUFHDR_WRITE:
1230    asm_bufhdr_write(as, sb);
1231    break;
1232#endif
1233  default: lj_assertA(0, "bad BUFHDR op2 %d", ir->op2); break;
1234  }
1235#if LJ_TARGET_X86ORX64
1236  ra_left(as, sb, ir->op1);
1237#else
1238  ra_leftov(as, sb, ir->op1);
1239#endif
1240}
1241
1242static void asm_bufput(ASMState *as, IRIns *ir)
1243{
1244  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_buf_putstr];
1245  IRRef args[3];
1246  IRIns *irs;
1247  int kchar = -129;
1248  args[0] = ir->op1;  /* SBuf * */
1249  args[1] = ir->op2;  /* GCstr * */
1250  irs = IR(ir->op2);
1251  lj_assertA(irt_isstr(irs->t),
1252	     "BUFPUT of non-string IR %04d", ir->op2 - REF_BIAS);
1253  if (irs->o == IR_KGC) {
1254    GCstr *s = ir_kstr(irs);
1255    if (s->len == 1) {  /* Optimize put of single-char string constant. */
1256      kchar = (int8_t)strdata(s)[0];  /* Signed! */
1257      args[1] = ASMREF_TMP1;  /* int, truncated to char */
1258      ci = &lj_ir_callinfo[IRCALL_lj_buf_putchar];
1259    }
1260  } else if (mayfuse(as, ir->op2) && ra_noreg(irs->r)) {
1261    if (irs->o == IR_TOSTR) {  /* Fuse number to string conversions. */
1262      if (irs->op2 == IRTOSTR_NUM) {
1263	args[1] = ASMREF_TMP1;  /* TValue * */
1264	ci = &lj_ir_callinfo[IRCALL_lj_strfmt_putnum];
1265      } else {
1266	lj_assertA(irt_isinteger(IR(irs->op1)->t),
1267		   "TOSTR of non-numeric IR %04d", irs->op1);
1268	args[1] = irs->op1;  /* int */
1269	if (irs->op2 == IRTOSTR_INT)
1270	  ci = &lj_ir_callinfo[IRCALL_lj_strfmt_putint];
1271	else
1272	  ci = &lj_ir_callinfo[IRCALL_lj_buf_putchar];
1273      }
1274    } else if (irs->o == IR_SNEW) {  /* Fuse string allocation. */
1275      args[1] = irs->op1;  /* const void * */
1276      args[2] = irs->op2;  /* MSize */
1277      ci = &lj_ir_callinfo[IRCALL_lj_buf_putmem];
1278    }
1279  }
1280  asm_setupresult(as, ir, ci);  /* SBuf * */
1281  asm_gencall(as, ci, args);
1282  if (args[1] == ASMREF_TMP1) {
1283    Reg tmp = ra_releasetmp(as, ASMREF_TMP1);
1284    if (kchar == -129)
1285      asm_tvptr(as, tmp, irs->op1, IRTMPREF_IN1);
1286    else
1287      ra_allockreg(as, kchar, tmp);
1288  }
1289}
1290
1291static void asm_bufstr(ASMState *as, IRIns *ir)
1292{
1293  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_buf_tostr];
1294  IRRef args[1];
1295  args[0] = ir->op1;  /* SBuf *sb */
1296  as->gcsteps++;
1297  asm_setupresult(as, ir, ci);  /* GCstr * */
1298  asm_gencall(as, ci, args);
1299}
1300
1301/* -- Type conversions ---------------------------------------------------- */
1302
1303static void asm_tostr(ASMState *as, IRIns *ir)
1304{
1305  const CCallInfo *ci;
1306  IRRef args[2];
1307  asm_snap_prep(as);
1308  args[0] = ASMREF_L;
1309  as->gcsteps++;
1310  if (ir->op2 == IRTOSTR_NUM) {
1311    args[1] = ASMREF_TMP1;  /* cTValue * */
1312    ci = &lj_ir_callinfo[IRCALL_lj_strfmt_num];
1313  } else {
1314    args[1] = ir->op1;  /* int32_t k */
1315    if (ir->op2 == IRTOSTR_INT)
1316      ci = &lj_ir_callinfo[IRCALL_lj_strfmt_int];
1317    else
1318      ci = &lj_ir_callinfo[IRCALL_lj_strfmt_char];
1319  }
1320  asm_setupresult(as, ir, ci);  /* GCstr * */
1321  asm_gencall(as, ci, args);
1322  if (ir->op2 == IRTOSTR_NUM)
1323    asm_tvptr(as, ra_releasetmp(as, ASMREF_TMP1), ir->op1, IRTMPREF_IN1);
1324}
1325
1326#if LJ_32 && LJ_HASFFI && !LJ_SOFTFP && !LJ_TARGET_X86
1327static void asm_conv64(ASMState *as, IRIns *ir)
1328{
1329  IRType st = (IRType)((ir-1)->op2 & IRCONV_SRCMASK);
1330  IRType dt = (((ir-1)->op2 & IRCONV_DSTMASK) >> IRCONV_DSH);
1331  IRCallID id;
1332  const CCallInfo *ci;
1333#if LJ_TARGET_ARM && !LJ_ABI_SOFTFP
1334  CCallInfo cim;
1335#endif
1336  IRRef args[2];
1337  lj_assertA((ir-1)->o == IR_CONV && ir->o == IR_HIOP,
1338	     "not a CONV/HIOP pair at IR %04d", (int)(ir - as->ir) - REF_BIAS);
1339  args[LJ_BE] = (ir-1)->op1;
1340  args[LJ_LE] = ir->op1;
1341  lj_assertA(st != IRT_FLOAT, "bad CONV *64.float emitted");
1342  if (st == IRT_NUM) {
1343    id = IRCALL_lj_vm_num2u64;
1344    ir--;
1345    ci = &lj_ir_callinfo[id];
1346  } else {
1347    id = IRCALL_fp64_l2d + ((dt == IRT_FLOAT) ? 2 : 0) + (st - IRT_I64);
1348#if LJ_TARGET_ARM && !LJ_ABI_SOFTFP
1349    cim = lj_ir_callinfo[id];
1350    cim.flags |= CCI_VARARG;  /* These calls don't use the hard-float ABI! */
1351    ci = &cim;
1352#else
1353    ci = &lj_ir_callinfo[id];
1354#endif
1355  }
1356  asm_setupresult(as, ir, ci);
1357  asm_gencall(as, ci, args);
1358}
1359#endif
1360
1361/* -- Memory references --------------------------------------------------- */
1362
1363static void asm_newref(ASMState *as, IRIns *ir)
1364{
1365  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_tab_newkey];
1366  IRRef args[3];
1367  if (ir->r == RID_SINK)
1368    return;
1369  asm_snap_prep(as);
1370  args[0] = ASMREF_L;     /* lua_State *L */
1371  args[1] = ir->op1;      /* GCtab *t     */
1372  args[2] = ASMREF_TMP1;  /* cTValue *key */
1373  asm_setupresult(as, ir, ci);  /* TValue * */
1374  asm_gencall(as, ci, args);
1375  asm_tvptr(as, ra_releasetmp(as, ASMREF_TMP1), ir->op2, IRTMPREF_IN1);
1376}
1377
1378static void asm_tmpref(ASMState *as, IRIns *ir)
1379{
1380  Reg r = ra_dest(as, ir, RSET_GPR);
1381  asm_tvptr(as, r, ir->op1, ir->op2);
1382}
1383
1384static void asm_lref(ASMState *as, IRIns *ir)
1385{
1386  Reg r = ra_dest(as, ir, RSET_GPR);
1387#if LJ_TARGET_X86ORX64
1388  ra_left(as, r, ASMREF_L);
1389#else
1390  ra_leftov(as, r, ASMREF_L);
1391#endif
1392}
1393
1394/* -- Calls --------------------------------------------------------------- */
1395
1396/* Collect arguments from CALL* and CARG instructions. */
1397static void asm_collectargs(ASMState *as, IRIns *ir,
1398			    const CCallInfo *ci, IRRef *args)
1399{
1400  uint32_t n = CCI_XNARGS(ci);
1401  /* Account for split args. */
1402  lj_assertA(n <= CCI_NARGS_MAX*2, "too many args %d to collect", n);
1403  if ((ci->flags & CCI_L)) { *args++ = ASMREF_L; n--; }
1404  while (n-- > 1) {
1405    ir = IR(ir->op1);
1406    lj_assertA(ir->o == IR_CARG, "malformed CALL arg tree");
1407    args[n] = ir->op2 == REF_NIL ? 0 : ir->op2;
1408  }
1409  args[0] = ir->op1 == REF_NIL ? 0 : ir->op1;
1410  lj_assertA(IR(ir->op1)->o != IR_CARG, "malformed CALL arg tree");
1411}
1412
1413/* Reconstruct CCallInfo flags for CALLX*. */
1414static uint32_t asm_callx_flags(ASMState *as, IRIns *ir)
1415{
1416  uint32_t nargs = 0;
1417  if (ir->op1 != REF_NIL) {  /* Count number of arguments first. */
1418    IRIns *ira = IR(ir->op1);
1419    nargs++;
1420    while (ira->o == IR_CARG) { nargs++; ira = IR(ira->op1); }
1421  }
1422#if LJ_HASFFI
1423  if (IR(ir->op2)->o == IR_CARG) {  /* Copy calling convention info. */
1424    CTypeID id = (CTypeID)IR(IR(ir->op2)->op2)->i;
1425    CType *ct = ctype_get(ctype_ctsG(J2G(as->J)), id);
1426    nargs |= ((ct->info & CTF_VARARG) ? CCI_VARARG : 0);
1427#if LJ_TARGET_X86
1428    nargs |= (ctype_cconv(ct->info) << CCI_CC_SHIFT);
1429#endif
1430  }
1431#endif
1432  return (nargs | (ir->t.irt << CCI_OTSHIFT));
1433}
1434
1435static void asm_callid(ASMState *as, IRIns *ir, IRCallID id)
1436{
1437  const CCallInfo *ci = &lj_ir_callinfo[id];
1438  IRRef args[2];
1439  args[0] = ir->op1;
1440  args[1] = ir->op2;
1441  asm_setupresult(as, ir, ci);
1442  asm_gencall(as, ci, args);
1443}
1444
1445static void asm_call(ASMState *as, IRIns *ir)
1446{
1447  IRRef args[CCI_NARGS_MAX];
1448  const CCallInfo *ci = &lj_ir_callinfo[ir->op2];
1449  asm_collectargs(as, ir, ci, args);
1450  asm_setupresult(as, ir, ci);
1451  asm_gencall(as, ci, args);
1452}
1453
1454/* -- PHI and loop handling ----------------------------------------------- */
1455
1456/* Break a PHI cycle by renaming to a free register (evict if needed). */
1457static void asm_phi_break(ASMState *as, RegSet blocked, RegSet blockedby,
1458			  RegSet allow)
1459{
1460  RegSet candidates = blocked & allow;
1461  if (candidates) {  /* If this register file has candidates. */
1462    /* Note: the set for ra_pick cannot be empty, since each register file
1463    ** has some registers never allocated to PHIs.
1464    */
1465    Reg down, up = ra_pick(as, ~blocked & allow);  /* Get a free register. */
1466    if (candidates & ~blockedby)  /* Optimize shifts, else it's a cycle. */
1467      candidates = candidates & ~blockedby;
1468    down = rset_picktop(candidates);  /* Pick candidate PHI register. */
1469    ra_rename(as, down, up);  /* And rename it to the free register. */
1470  }
1471}
1472
1473/* PHI register shuffling.
1474**
1475** The allocator tries hard to preserve PHI register assignments across
1476** the loop body. Most of the time this loop does nothing, since there
1477** are no register mismatches.
1478**
1479** If a register mismatch is detected and ...
1480** - the register is currently free: rename it.
1481** - the register is blocked by an invariant: restore/remat and rename it.
1482** - Otherwise the register is used by another PHI, so mark it as blocked.
1483**
1484** The renames are order-sensitive, so just retry the loop if a register
1485** is marked as blocked, but has been freed in the meantime. A cycle is
1486** detected if all of the blocked registers are allocated. To break the
1487** cycle rename one of them to a free register and retry.
1488**
1489** Note that PHI spill slots are kept in sync and don't need to be shuffled.
1490*/
1491static void asm_phi_shuffle(ASMState *as)
1492{
1493  RegSet work;
1494
1495  /* Find and resolve PHI register mismatches. */
1496  for (;;) {
1497    RegSet blocked = RSET_EMPTY;
1498    RegSet blockedby = RSET_EMPTY;
1499    RegSet phiset = as->phiset;
1500    while (phiset) {  /* Check all left PHI operand registers. */
1501      Reg r = rset_pickbot(phiset);
1502      IRIns *irl = IR(as->phireg[r]);
1503      Reg left = irl->r;
1504      if (r != left) {  /* Mismatch? */
1505	if (!rset_test(as->freeset, r)) {  /* PHI register blocked? */
1506	  IRRef ref = regcost_ref(as->cost[r]);
1507	  /* Blocked by other PHI (w/reg)? */
1508	  if (!ra_iskref(ref) && irt_ismarked(IR(ref)->t)) {
1509	    rset_set(blocked, r);
1510	    if (ra_hasreg(left))
1511	      rset_set(blockedby, left);
1512	    left = RID_NONE;
1513	  } else {  /* Otherwise grab register from invariant. */
1514	    ra_restore(as, ref);
1515	    checkmclim(as);
1516	  }
1517	}
1518	if (ra_hasreg(left)) {
1519	  ra_rename(as, left, r);
1520	  checkmclim(as);
1521	}
1522      }
1523      rset_clear(phiset, r);
1524    }
1525    if (!blocked) break;  /* Finished. */
1526    if (!(as->freeset & blocked)) {  /* Break cycles if none are free. */
1527      asm_phi_break(as, blocked, blockedby, RSET_GPR);
1528      if (!LJ_SOFTFP) asm_phi_break(as, blocked, blockedby, RSET_FPR);
1529      checkmclim(as);
1530    }  /* Else retry some more renames. */
1531  }
1532
1533  /* Restore/remat invariants whose registers are modified inside the loop. */
1534#if !LJ_SOFTFP
1535  work = as->modset & ~(as->freeset | as->phiset) & RSET_FPR;
1536  while (work) {
1537    Reg r = rset_pickbot(work);
1538    ra_restore(as, regcost_ref(as->cost[r]));
1539    rset_clear(work, r);
1540    checkmclim(as);
1541  }
1542#endif
1543  work = as->modset & ~(as->freeset | as->phiset);
1544  while (work) {
1545    Reg r = rset_pickbot(work);
1546    ra_restore(as, regcost_ref(as->cost[r]));
1547    rset_clear(work, r);
1548    checkmclim(as);
1549  }
1550
1551  /* Allocate and save all unsaved PHI regs and clear marks. */
1552  work = as->phiset;
1553  while (work) {
1554    Reg r = rset_picktop(work);
1555    IRRef lref = as->phireg[r];
1556    IRIns *ir = IR(lref);
1557    if (ra_hasspill(ir->s)) {  /* Left PHI gained a spill slot? */
1558      irt_clearmark(ir->t);  /* Handled here, so clear marker now. */
1559      ra_alloc1(as, lref, RID2RSET(r));
1560      ra_save(as, ir, r);  /* Save to spill slot inside the loop. */
1561      checkmclim(as);
1562    }
1563    rset_clear(work, r);
1564  }
1565}
1566
1567/* Copy unsynced left/right PHI spill slots. Rarely needed. */
1568static void asm_phi_copyspill(ASMState *as)
1569{
1570  int need = 0;
1571  IRIns *ir;
1572  for (ir = IR(as->orignins-1); ir->o == IR_PHI; ir--)
1573    if (ra_hasspill(ir->s) && ra_hasspill(IR(ir->op1)->s))
1574      need |= irt_isfp(ir->t) ? 2 : 1;  /* Unsynced spill slot? */
1575  if ((need & 1)) {  /* Copy integer spill slots. */
1576#if !LJ_TARGET_X86ORX64
1577    Reg r = RID_TMP;
1578#else
1579    Reg r = RID_RET;
1580    if ((as->freeset & RSET_GPR))
1581      r = rset_pickbot((as->freeset & RSET_GPR));
1582    else
1583      emit_spload(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1584#endif
1585    for (ir = IR(as->orignins-1); ir->o == IR_PHI; ir--) {
1586      if (ra_hasspill(ir->s)) {
1587	IRIns *irl = IR(ir->op1);
1588	if (ra_hasspill(irl->s) && !irt_isfp(ir->t)) {
1589	  emit_spstore(as, irl, r, sps_scale(irl->s));
1590	  emit_spload(as, ir, r, sps_scale(ir->s));
1591	  checkmclim(as);
1592	}
1593      }
1594    }
1595#if LJ_TARGET_X86ORX64
1596    if (!rset_test(as->freeset, r))
1597      emit_spstore(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1598#endif
1599  }
1600#if !LJ_SOFTFP
1601  if ((need & 2)) {  /* Copy FP spill slots. */
1602#if LJ_TARGET_X86
1603    Reg r = RID_XMM0;
1604#else
1605    Reg r = RID_FPRET;
1606#endif
1607    if ((as->freeset & RSET_FPR))
1608      r = rset_pickbot((as->freeset & RSET_FPR));
1609    if (!rset_test(as->freeset, r))
1610      emit_spload(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1611    for (ir = IR(as->orignins-1); ir->o == IR_PHI; ir--) {
1612      if (ra_hasspill(ir->s)) {
1613	IRIns *irl = IR(ir->op1);
1614	if (ra_hasspill(irl->s) && irt_isfp(ir->t)) {
1615	  emit_spstore(as, irl, r, sps_scale(irl->s));
1616	  emit_spload(as, ir, r, sps_scale(ir->s));
1617	  checkmclim(as);
1618	}
1619      }
1620    }
1621    if (!rset_test(as->freeset, r))
1622      emit_spstore(as, IR(regcost_ref(as->cost[r])), r, SPOFS_TMP);
1623  }
1624#endif
1625}
1626
1627/* Emit renames for left PHIs which are only spilled outside the loop. */
1628static void asm_phi_fixup(ASMState *as)
1629{
1630  RegSet work = as->phiset;
1631  while (work) {
1632    Reg r = rset_picktop(work);
1633    IRRef lref = as->phireg[r];
1634    IRIns *ir = IR(lref);
1635    if (irt_ismarked(ir->t)) {
1636      irt_clearmark(ir->t);
1637      /* Left PHI gained a spill slot before the loop? */
1638      if (ra_hasspill(ir->s)) {
1639	ra_addrename(as, r, lref, as->loopsnapno);
1640      }
1641    }
1642    rset_clear(work, r);
1643  }
1644}
1645
1646/* Setup right PHI reference. */
1647static void asm_phi(ASMState *as, IRIns *ir)
1648{
1649  RegSet allow = ((!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR) &
1650		 ~as->phiset;
1651  RegSet afree = (as->freeset & allow);
1652  IRIns *irl = IR(ir->op1);
1653  IRIns *irr = IR(ir->op2);
1654  if (ir->r == RID_SINK)  /* Sink PHI. */
1655    return;
1656  /* Spill slot shuffling is not implemented yet (but rarely needed). */
1657  if (ra_hasspill(irl->s) || ra_hasspill(irr->s))
1658    lj_trace_err(as->J, LJ_TRERR_NYIPHI);
1659  /* Leave at least one register free for non-PHIs (and PHI cycle breaking). */
1660  if ((afree & (afree-1))) {  /* Two or more free registers? */
1661    Reg r;
1662    if (ra_noreg(irr->r)) {  /* Get a register for the right PHI. */
1663      r = ra_allocref(as, ir->op2, allow);
1664    } else {  /* Duplicate right PHI, need a copy (rare). */
1665      r = ra_scratch(as, allow);
1666      emit_movrr(as, irr, r, irr->r);
1667    }
1668    ir->r = (uint8_t)r;
1669    rset_set(as->phiset, r);
1670    as->phireg[r] = (IRRef1)ir->op1;
1671    irt_setmark(irl->t);  /* Marks left PHIs _with_ register. */
1672    if (ra_noreg(irl->r))
1673      ra_sethint(irl->r, r); /* Set register hint for left PHI. */
1674  } else {  /* Otherwise allocate a spill slot. */
1675    /* This is overly restrictive, but it triggers only on synthetic code. */
1676    if (ra_hasreg(irl->r) || ra_hasreg(irr->r))
1677      lj_trace_err(as->J, LJ_TRERR_NYIPHI);
1678    ra_spill(as, ir);
1679    irr->s = ir->s;  /* Set right PHI spill slot. Sync left slot later. */
1680  }
1681}
1682
1683static void asm_loop_fixup(ASMState *as);
1684
1685/* Middle part of a loop. */
1686static void asm_loop(ASMState *as)
1687{
1688  MCode *mcspill;
1689  /* LOOP is a guard, so the snapno is up to date. */
1690  as->loopsnapno = as->snapno;
1691  if (as->gcsteps)
1692    asm_gc_check(as);
1693  /* LOOP marks the transition from the variant to the invariant part. */
1694  as->flagmcp = as->invmcp = NULL;
1695  as->sectref = 0;
1696  if (!neverfuse(as)) as->fuseref = 0;
1697  asm_phi_shuffle(as);
1698  mcspill = as->mcp;
1699  asm_phi_copyspill(as);
1700  asm_loop_fixup(as);
1701  as->mcloop = as->mcp;
1702  RA_DBGX((as, "===== LOOP ====="));
1703  if (!as->realign) RA_DBG_FLUSH();
1704  if (as->mcp != mcspill)
1705    emit_jmp(as, mcspill);
1706}
1707
1708/* -- Target-specific assembler ------------------------------------------- */
1709
1710#if LJ_TARGET_X86ORX64
1711#include "lj_asm_x86.h"
1712#elif LJ_TARGET_ARM
1713#include "lj_asm_arm.h"
1714#elif LJ_TARGET_ARM64
1715#include "lj_asm_arm64.h"
1716#elif LJ_TARGET_PPC
1717#include "lj_asm_ppc.h"
1718#elif LJ_TARGET_MIPS
1719#include "lj_asm_mips.h"
1720#else
1721#error "Missing assembler for target CPU"
1722#endif
1723
1724/* -- Common instruction helpers ------------------------------------------ */
1725
1726#if !LJ_SOFTFP32
1727#if !LJ_TARGET_X86ORX64
1728#define asm_ldexp(as, ir)	asm_callid(as, ir, IRCALL_ldexp)
1729#endif
1730
1731static void asm_pow(ASMState *as, IRIns *ir)
1732{
1733#if LJ_64 && LJ_HASFFI
1734  if (!irt_isnum(ir->t))
1735    asm_callid(as, ir, irt_isi64(ir->t) ? IRCALL_lj_carith_powi64 :
1736					  IRCALL_lj_carith_powu64);
1737  else
1738#endif
1739  asm_callid(as, ir, IRCALL_pow);
1740}
1741
1742static void asm_div(ASMState *as, IRIns *ir)
1743{
1744#if LJ_64 && LJ_HASFFI
1745  if (!irt_isnum(ir->t))
1746    asm_callid(as, ir, irt_isi64(ir->t) ? IRCALL_lj_carith_divi64 :
1747					  IRCALL_lj_carith_divu64);
1748  else
1749#endif
1750    asm_fpdiv(as, ir);
1751}
1752#endif
1753
1754static void asm_mod(ASMState *as, IRIns *ir)
1755{
1756#if LJ_64 && LJ_HASFFI
1757  if (!irt_isint(ir->t))
1758    asm_callid(as, ir, irt_isi64(ir->t) ? IRCALL_lj_carith_modi64 :
1759					  IRCALL_lj_carith_modu64);
1760  else
1761#endif
1762    asm_callid(as, ir, IRCALL_lj_vm_modi);
1763}
1764
1765static void asm_fuseequal(ASMState *as, IRIns *ir)
1766{
1767  /* Fuse HREF + EQ/NE. */
1768  if ((ir-1)->o == IR_HREF && ir->op1 == as->curins-1) {
1769    as->curins--;
1770    asm_href(as, ir-1, (IROp)ir->o);
1771  } else {
1772    asm_equal(as, ir);
1773  }
1774}
1775
1776static void asm_alen(ASMState *as, IRIns *ir)
1777{
1778  asm_callid(as, ir, ir->op2 == REF_NIL ? IRCALL_lj_tab_len :
1779					  IRCALL_lj_tab_len_hint);
1780}
1781
1782/* -- Instruction dispatch ------------------------------------------------ */
1783
1784/* Assemble a single instruction. */
1785static void asm_ir(ASMState *as, IRIns *ir)
1786{
1787  switch ((IROp)ir->o) {
1788  /* Miscellaneous ops. */
1789  case IR_LOOP: asm_loop(as); break;
1790  case IR_NOP: case IR_XBAR:
1791    lj_assertA(!ra_used(ir),
1792	       "IR %04d not unused", (int)(ir - as->ir) - REF_BIAS);
1793    break;
1794  case IR_USE:
1795    ra_alloc1(as, ir->op1, irt_isfp(ir->t) ? RSET_FPR : RSET_GPR); break;
1796  case IR_PHI: asm_phi(as, ir); break;
1797  case IR_HIOP: asm_hiop(as, ir); break;
1798  case IR_GCSTEP: asm_gcstep(as, ir); break;
1799  case IR_PROF: asm_prof(as, ir); break;
1800
1801  /* Guarded assertions. */
1802  case IR_LT: case IR_GE: case IR_LE: case IR_GT:
1803  case IR_ULT: case IR_UGE: case IR_ULE: case IR_UGT:
1804  case IR_ABC:
1805    asm_comp(as, ir);
1806    break;
1807  case IR_EQ: case IR_NE: asm_fuseequal(as, ir); break;
1808
1809  case IR_RETF: asm_retf(as, ir); break;
1810
1811  /* Bit ops. */
1812  case IR_BNOT: asm_bnot(as, ir); break;
1813  case IR_BSWAP: asm_bswap(as, ir); break;
1814  case IR_BAND: asm_band(as, ir); break;
1815  case IR_BOR: asm_bor(as, ir); break;
1816  case IR_BXOR: asm_bxor(as, ir); break;
1817  case IR_BSHL: asm_bshl(as, ir); break;
1818  case IR_BSHR: asm_bshr(as, ir); break;
1819  case IR_BSAR: asm_bsar(as, ir); break;
1820  case IR_BROL: asm_brol(as, ir); break;
1821  case IR_BROR: asm_bror(as, ir); break;
1822
1823  /* Arithmetic ops. */
1824  case IR_ADD: asm_add(as, ir); break;
1825  case IR_SUB: asm_sub(as, ir); break;
1826  case IR_MUL: asm_mul(as, ir); break;
1827  case IR_MOD: asm_mod(as, ir); break;
1828  case IR_NEG: asm_neg(as, ir); break;
1829#if LJ_SOFTFP32
1830  case IR_DIV: case IR_POW: case IR_ABS:
1831  case IR_LDEXP: case IR_FPMATH: case IR_TOBIT:
1832    /* Unused for LJ_SOFTFP32. */
1833    lj_assertA(0, "IR %04d with unused op %d",
1834		  (int)(ir - as->ir) - REF_BIAS, ir->o);
1835    break;
1836#else
1837  case IR_DIV: asm_div(as, ir); break;
1838  case IR_POW: asm_pow(as, ir); break;
1839  case IR_ABS: asm_abs(as, ir); break;
1840  case IR_LDEXP: asm_ldexp(as, ir); break;
1841  case IR_FPMATH: asm_fpmath(as, ir); break;
1842  case IR_TOBIT: asm_tobit(as, ir); break;
1843#endif
1844  case IR_MIN: asm_min(as, ir); break;
1845  case IR_MAX: asm_max(as, ir); break;
1846
1847  /* Overflow-checking arithmetic ops. */
1848  case IR_ADDOV: asm_addov(as, ir); break;
1849  case IR_SUBOV: asm_subov(as, ir); break;
1850  case IR_MULOV: asm_mulov(as, ir); break;
1851
1852  /* Memory references. */
1853  case IR_AREF: asm_aref(as, ir); break;
1854  case IR_HREF: asm_href(as, ir, 0); break;
1855  case IR_HREFK: asm_hrefk(as, ir); break;
1856  case IR_NEWREF: asm_newref(as, ir); break;
1857  case IR_UREFO: case IR_UREFC: asm_uref(as, ir); break;
1858  case IR_FREF: asm_fref(as, ir); break;
1859  case IR_TMPREF: asm_tmpref(as, ir); break;
1860  case IR_STRREF: asm_strref(as, ir); break;
1861  case IR_LREF: asm_lref(as, ir); break;
1862
1863  /* Loads and stores. */
1864  case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
1865    asm_ahuvload(as, ir);
1866    break;
1867  case IR_FLOAD: asm_fload(as, ir); break;
1868  case IR_XLOAD: asm_xload(as, ir); break;
1869  case IR_SLOAD: asm_sload(as, ir); break;
1870  case IR_ALEN: asm_alen(as, ir); break;
1871
1872  case IR_ASTORE: case IR_HSTORE: case IR_USTORE: asm_ahustore(as, ir); break;
1873  case IR_FSTORE: asm_fstore(as, ir); break;
1874  case IR_XSTORE: asm_xstore(as, ir); break;
1875
1876  /* Allocations. */
1877  case IR_SNEW: case IR_XSNEW: asm_snew(as, ir); break;
1878  case IR_TNEW: asm_tnew(as, ir); break;
1879  case IR_TDUP: asm_tdup(as, ir); break;
1880  case IR_CNEW: case IR_CNEWI:
1881#if LJ_HASFFI
1882    asm_cnew(as, ir);
1883#else
1884    lj_assertA(0, "IR %04d with unused op %d",
1885		  (int)(ir - as->ir) - REF_BIAS, ir->o);
1886#endif
1887    break;
1888
1889  /* Buffer operations. */
1890  case IR_BUFHDR: asm_bufhdr(as, ir); break;
1891  case IR_BUFPUT: asm_bufput(as, ir); break;
1892  case IR_BUFSTR: asm_bufstr(as, ir); break;
1893
1894  /* Write barriers. */
1895  case IR_TBAR: asm_tbar(as, ir); break;
1896  case IR_OBAR: asm_obar(as, ir); break;
1897
1898  /* Type conversions. */
1899  case IR_CONV: asm_conv(as, ir); break;
1900  case IR_TOSTR: asm_tostr(as, ir); break;
1901  case IR_STRTO: asm_strto(as, ir); break;
1902
1903  /* Calls. */
1904  case IR_CALLA:
1905    as->gcsteps++;
1906    /* fallthrough */
1907  case IR_CALLN: case IR_CALLL: case IR_CALLS: asm_call(as, ir); break;
1908  case IR_CALLXS: asm_callx(as, ir); break;
1909  case IR_CARG: break;
1910
1911  default:
1912    setintV(&as->J->errinfo, ir->o);
1913    lj_trace_err_info(as->J, LJ_TRERR_NYIIR);
1914    break;
1915  }
1916}
1917
1918/* -- Head of trace ------------------------------------------------------- */
1919
1920/* Head of a root trace. */
1921static void asm_head_root(ASMState *as)
1922{
1923  int32_t spadj;
1924  asm_head_root_base(as);
1925  emit_setvmstate(as, (int32_t)as->T->traceno);
1926  spadj = asm_stack_adjust(as);
1927  as->T->spadjust = (uint16_t)spadj;
1928  emit_spsub(as, spadj);
1929  /* Root traces assume a checked stack for the starting proto. */
1930  as->T->topslot = gcref(as->T->startpt)->pt.framesize;
1931}
1932
1933/* Head of a side trace.
1934**
1935** The current simplistic algorithm requires that all slots inherited
1936** from the parent are live in a register between pass 2 and pass 3. This
1937** avoids the complexity of stack slot shuffling. But of course this may
1938** overflow the register set in some cases and cause the dreaded error:
1939** "NYI: register coalescing too complex". A refined algorithm is needed.
1940*/
1941static void asm_head_side(ASMState *as)
1942{
1943  IRRef1 sloadins[RID_MAX];
1944  RegSet allow = RSET_ALL;  /* Inverse of all coalesced registers. */
1945  RegSet live = RSET_EMPTY;  /* Live parent registers. */
1946  RegSet pallow = RSET_GPR;  /* Registers needed by the parent stack check. */
1947  Reg pbase;
1948  IRIns *irp = &as->parent->ir[REF_BASE];  /* Parent base. */
1949  int32_t spadj, spdelta;
1950  int pass2 = 0;
1951  int pass3 = 0;
1952  IRRef i;
1953
1954  if (as->snapno && as->topslot > as->parent->topslot) {
1955    /* Force snap #0 alloc to prevent register overwrite in stack check. */
1956    asm_snap_alloc(as, 0);
1957  }
1958  pbase = asm_head_side_base(as, irp);
1959  if (pbase != RID_NONE) {
1960    rset_clear(allow, pbase);
1961    rset_clear(pallow, pbase);
1962  }
1963
1964  /* Scan all parent SLOADs and collect register dependencies. */
1965  for (i = as->stopins; i > REF_BASE; i--) {
1966    IRIns *ir = IR(i);
1967    RegSP rs;
1968    lj_assertA((ir->o == IR_SLOAD && (ir->op2 & IRSLOAD_PARENT)) ||
1969	       (LJ_SOFTFP && ir->o == IR_HIOP) || ir->o == IR_PVAL,
1970	       "IR %04d has bad parent op %d",
1971	       (int)(ir - as->ir) - REF_BIAS, ir->o);
1972    rs = as->parentmap[i - REF_FIRST];
1973    if (ra_hasreg(ir->r)) {
1974      rset_clear(allow, ir->r);
1975      if (ra_hasspill(ir->s)) {
1976	ra_save(as, ir, ir->r);
1977	checkmclim(as);
1978      }
1979    } else if (ra_hasspill(ir->s)) {
1980      irt_setmark(ir->t);
1981      pass2 = 1;
1982    }
1983    if (ir->r == rs) {  /* Coalesce matching registers right now. */
1984      ra_free(as, ir->r);
1985    } else if (ra_hasspill(regsp_spill(rs))) {
1986      if (ra_hasreg(ir->r))
1987	pass3 = 1;
1988    } else if (ra_used(ir)) {
1989      sloadins[rs] = (IRRef1)i;
1990      rset_set(live, rs);  /* Block live parent register. */
1991    }
1992    if (!ra_hasspill(regsp_spill(rs))) rset_clear(pallow, regsp_reg(rs));
1993  }
1994
1995  /* Calculate stack frame adjustment. */
1996  spadj = asm_stack_adjust(as);
1997  spdelta = spadj - (int32_t)as->parent->spadjust;
1998  if (spdelta < 0) {  /* Don't shrink the stack frame. */
1999    spadj = (int32_t)as->parent->spadjust;
2000    spdelta = 0;
2001  }
2002  as->T->spadjust = (uint16_t)spadj;
2003
2004  /* Reload spilled target registers. */
2005  if (pass2) {
2006    for (i = as->stopins; i > REF_BASE; i--) {
2007      IRIns *ir = IR(i);
2008      if (irt_ismarked(ir->t)) {
2009	RegSet mask;
2010	Reg r;
2011	RegSP rs;
2012	irt_clearmark(ir->t);
2013	rs = as->parentmap[i - REF_FIRST];
2014	if (!ra_hasspill(regsp_spill(rs)))
2015	  ra_sethint(ir->r, rs);  /* Hint may be gone, set it again. */
2016	else if (sps_scale(regsp_spill(rs))+spdelta == sps_scale(ir->s))
2017	  continue;  /* Same spill slot, do nothing. */
2018	mask = ((!LJ_SOFTFP && irt_isfp(ir->t)) ? RSET_FPR : RSET_GPR) & allow;
2019	if (mask == RSET_EMPTY)
2020	  lj_trace_err(as->J, LJ_TRERR_NYICOAL);
2021	r = ra_allocref(as, i, mask);
2022	ra_save(as, ir, r);
2023	rset_clear(allow, r);
2024	if (r == rs) {  /* Coalesce matching registers right now. */
2025	  ra_free(as, r);
2026	  rset_clear(live, r);
2027	} else if (ra_hasspill(regsp_spill(rs))) {
2028	  pass3 = 1;
2029	}
2030	checkmclim(as);
2031      }
2032    }
2033  }
2034
2035  /* Store trace number and adjust stack frame relative to the parent. */
2036  emit_setvmstate(as, (int32_t)as->T->traceno);
2037  emit_spsub(as, spdelta);
2038
2039#if !LJ_TARGET_X86ORX64
2040  /* Restore BASE register from parent spill slot. */
2041  if (ra_hasspill(irp->s))
2042    emit_spload(as, IR(REF_BASE), IR(REF_BASE)->r, sps_scale(irp->s));
2043#endif
2044
2045  /* Restore target registers from parent spill slots. */
2046  if (pass3) {
2047    RegSet work = ~as->freeset & RSET_ALL;
2048    while (work) {
2049      Reg r = rset_pickbot(work);
2050      IRRef ref = regcost_ref(as->cost[r]);
2051      RegSP rs = as->parentmap[ref - REF_FIRST];
2052      rset_clear(work, r);
2053      if (ra_hasspill(regsp_spill(rs))) {
2054	int32_t ofs = sps_scale(regsp_spill(rs));
2055	ra_free(as, r);
2056	emit_spload(as, IR(ref), r, ofs);
2057	checkmclim(as);
2058      }
2059    }
2060  }
2061
2062  /* Shuffle registers to match up target regs with parent regs. */
2063  for (;;) {
2064    RegSet work;
2065
2066    /* Repeatedly coalesce free live registers by moving to their target. */
2067    while ((work = as->freeset & live) != RSET_EMPTY) {
2068      Reg rp = rset_pickbot(work);
2069      IRIns *ir = IR(sloadins[rp]);
2070      rset_clear(live, rp);
2071      rset_clear(allow, rp);
2072      ra_free(as, ir->r);
2073      emit_movrr(as, ir, ir->r, rp);
2074      checkmclim(as);
2075    }
2076
2077    /* We're done if no live registers remain. */
2078    if (live == RSET_EMPTY)
2079      break;
2080
2081    /* Break cycles by renaming one target to a temp. register. */
2082    if (live & RSET_GPR) {
2083      RegSet tmpset = as->freeset & ~live & allow & RSET_GPR;
2084      if (tmpset == RSET_EMPTY)
2085	lj_trace_err(as->J, LJ_TRERR_NYICOAL);
2086      ra_rename(as, rset_pickbot(live & RSET_GPR), rset_pickbot(tmpset));
2087    }
2088    if (!LJ_SOFTFP && (live & RSET_FPR)) {
2089      RegSet tmpset = as->freeset & ~live & allow & RSET_FPR;
2090      if (tmpset == RSET_EMPTY)
2091	lj_trace_err(as->J, LJ_TRERR_NYICOAL);
2092      ra_rename(as, rset_pickbot(live & RSET_FPR), rset_pickbot(tmpset));
2093    }
2094    checkmclim(as);
2095    /* Continue with coalescing to fix up the broken cycle(s). */
2096  }
2097
2098  /* Inherit top stack slot already checked by parent trace. */
2099  as->T->topslot = as->parent->topslot;
2100  if (as->topslot > as->T->topslot) {  /* Need to check for higher slot? */
2101#ifdef EXITSTATE_CHECKEXIT
2102    /* Highest exit + 1 indicates stack check. */
2103    ExitNo exitno = as->T->nsnap;
2104#else
2105    /* Reuse the parent exit in the context of the parent trace. */
2106    ExitNo exitno = as->J->exitno;
2107#endif
2108    as->T->topslot = (uint8_t)as->topslot;  /* Remember for child traces. */
2109    asm_stack_check(as, as->topslot, irp, pallow, exitno);
2110  }
2111}
2112
2113/* -- Tail of trace ------------------------------------------------------- */
2114
2115/* Get base slot for a snapshot. */
2116static BCReg asm_baseslot(ASMState *as, SnapShot *snap, int *gotframe)
2117{
2118  SnapEntry *map = &as->T->snapmap[snap->mapofs];
2119  MSize n;
2120  for (n = snap->nent; n > 0; n--) {
2121    SnapEntry sn = map[n-1];
2122    if ((sn & SNAP_FRAME)) {
2123      *gotframe = 1;
2124      return snap_slot(sn) - LJ_FR2;
2125    }
2126  }
2127  return 0;
2128}
2129
2130/* Link to another trace. */
2131static void asm_tail_link(ASMState *as)
2132{
2133  SnapNo snapno = as->T->nsnap-1;  /* Last snapshot. */
2134  SnapShot *snap = &as->T->snap[snapno];
2135  int gotframe = 0;
2136  BCReg baseslot = asm_baseslot(as, snap, &gotframe);
2137
2138  as->topslot = snap->topslot;
2139  checkmclim(as);
2140  ra_allocref(as, REF_BASE, RID2RSET(RID_BASE));
2141
2142  if (as->T->link == 0) {
2143    /* Setup fixed registers for exit to interpreter. */
2144    const BCIns *pc = snap_pc(&as->T->snapmap[snap->mapofs + snap->nent]);
2145    int32_t mres;
2146    if (bc_op(*pc) == BC_JLOOP) {  /* NYI: find a better way to do this. */
2147      BCIns *retpc = &traceref(as->J, bc_d(*pc))->startins;
2148      if (bc_isret(bc_op(*retpc)))
2149	pc = retpc;
2150    }
2151#if LJ_GC64
2152    emit_loadu64(as, RID_LPC, u64ptr(pc));
2153#else
2154    ra_allockreg(as, i32ptr(J2GG(as->J)->dispatch), RID_DISPATCH);
2155    ra_allockreg(as, i32ptr(pc), RID_LPC);
2156#endif
2157    mres = (int32_t)(snap->nslots - baseslot - LJ_FR2);
2158    switch (bc_op(*pc)) {
2159    case BC_CALLM: case BC_CALLMT:
2160      mres -= (int32_t)(1 + LJ_FR2 + bc_a(*pc) + bc_c(*pc)); break;
2161    case BC_RETM: mres -= (int32_t)(bc_a(*pc) + bc_d(*pc)); break;
2162    case BC_TSETM: mres -= (int32_t)bc_a(*pc); break;
2163    default: if (bc_op(*pc) < BC_FUNCF) mres = 0; break;
2164    }
2165    ra_allockreg(as, mres, RID_RET);  /* Return MULTRES or 0. */
2166  } else if (baseslot) {
2167    /* Save modified BASE for linking to trace with higher start frame. */
2168    emit_setgl(as, RID_BASE, jit_base);
2169  }
2170  emit_addptr(as, RID_BASE, 8*(int32_t)baseslot);
2171
2172  if (as->J->ktrace) {  /* Patch ktrace slot with the final GCtrace pointer. */
2173    setgcref(IR(as->J->ktrace)[LJ_GC64].gcr, obj2gco(as->J->curfinal));
2174    IR(as->J->ktrace)->o = IR_KGC;
2175  }
2176
2177  /* Sync the interpreter state with the on-trace state. */
2178  asm_stack_restore(as, snap);
2179
2180  /* Root traces that add frames need to check the stack at the end. */
2181  if (!as->parent && gotframe)
2182    asm_stack_check(as, as->topslot, NULL, as->freeset & RSET_GPR, snapno);
2183}
2184
2185/* -- Trace setup --------------------------------------------------------- */
2186
2187/* Clear reg/sp for all instructions and add register hints. */
2188static void asm_setup_regsp(ASMState *as)
2189{
2190  GCtrace *T = as->T;
2191  int sink = T->sinktags;
2192  IRRef nins = T->nins;
2193  IRIns *ir, *lastir;
2194  int inloop;
2195#if LJ_TARGET_ARM
2196  uint32_t rload = 0xa6402a64;
2197#endif
2198
2199  ra_setup(as);
2200#if LJ_TARGET_ARM64
2201  ra_setkref(as, RID_GL, (intptr_t)J2G(as->J));
2202#endif
2203
2204  /* Clear reg/sp for constants. */
2205  for (ir = IR(T->nk), lastir = IR(REF_BASE); ir < lastir; ir++) {
2206    ir->prev = REGSP_INIT;
2207    if (irt_is64(ir->t) && ir->o != IR_KNULL) {
2208#if LJ_GC64
2209      /* The false-positive of irt_is64() for ASMREF_L (REF_NIL) is OK here. */
2210      ir->i = 0;  /* Will become non-zero only for RIP-relative addresses. */
2211#else
2212      /* Make life easier for backends by putting address of constant in i. */
2213      ir->i = (int32_t)(intptr_t)(ir+1);
2214#endif
2215      ir++;
2216    }
2217  }
2218
2219  /* REF_BASE is used for implicit references to the BASE register. */
2220  lastir->prev = REGSP_HINT(RID_BASE);
2221
2222  as->snaprename = nins;
2223  as->snapref = nins;
2224  as->snapno = T->nsnap;
2225  as->snapalloc = 0;
2226
2227  as->stopins = REF_BASE;
2228  as->orignins = nins;
2229  as->curins = nins;
2230
2231  /* Setup register hints for parent link instructions. */
2232  ir = IR(REF_FIRST);
2233  if (as->parent) {
2234    uint16_t *p;
2235    lastir = lj_snap_regspmap(as->J, as->parent, as->J->exitno, ir);
2236    if (lastir - ir > LJ_MAX_JSLOTS)
2237      lj_trace_err(as->J, LJ_TRERR_NYICOAL);
2238    as->stopins = (IRRef)((lastir-1) - as->ir);
2239    for (p = as->parentmap; ir < lastir; ir++) {
2240      RegSP rs = ir->prev;
2241      *p++ = (uint16_t)rs;  /* Copy original parent RegSP to parentmap. */
2242      if (!ra_hasspill(regsp_spill(rs)))
2243	ir->prev = (uint16_t)REGSP_HINT(regsp_reg(rs));
2244      else
2245	ir->prev = REGSP_INIT;
2246    }
2247  }
2248
2249  inloop = 0;
2250  as->evenspill = SPS_FIRST;
2251  for (lastir = IR(nins); ir < lastir; ir++) {
2252    if (sink) {
2253      if (ir->r == RID_SINK)
2254	continue;
2255      if (ir->r == RID_SUNK) {  /* Revert after ASM restart. */
2256	ir->r = RID_SINK;
2257	continue;
2258      }
2259    }
2260    switch (ir->o) {
2261    case IR_LOOP:
2262      inloop = 1;
2263      break;
2264#if LJ_TARGET_ARM
2265    case IR_SLOAD:
2266      if (!((ir->op2 & IRSLOAD_TYPECHECK) || (ir+1)->o == IR_HIOP))
2267	break;
2268      /* fallthrough */
2269    case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
2270      if (!LJ_SOFTFP && irt_isnum(ir->t)) break;
2271      ir->prev = (uint16_t)REGSP_HINT((rload & 15));
2272      rload = lj_ror(rload, 4);
2273      continue;
2274    case IR_TMPREF:
2275      if ((ir->op2 & IRTMPREF_OUT2) && as->evenspill < 4)
2276	as->evenspill = 4;  /* TMPREF OUT2 needs two TValues on the stack. */
2277      break;
2278#endif
2279    case IR_CALLXS: {
2280      CCallInfo ci;
2281      ci.flags = asm_callx_flags(as, ir);
2282      ir->prev = asm_setup_call_slots(as, ir, &ci);
2283      if (inloop)
2284	as->modset |= RSET_SCRATCH;
2285      continue;
2286      }
2287    case IR_CALLL:
2288      /* lj_vm_next needs two TValues on the stack. */
2289#if LJ_TARGET_X64 && LJ_ABI_WIN
2290      if (ir->op2 == IRCALL_lj_vm_next && as->evenspill < SPS_FIRST + 4)
2291	as->evenspill = SPS_FIRST + 4;
2292#else
2293      if (SPS_FIRST < 4 && ir->op2 == IRCALL_lj_vm_next && as->evenspill < 4)
2294	as->evenspill = 4;
2295#endif
2296      /* fallthrough */
2297    case IR_CALLN: case IR_CALLA: case IR_CALLS: {
2298      const CCallInfo *ci = &lj_ir_callinfo[ir->op2];
2299      ir->prev = asm_setup_call_slots(as, ir, ci);
2300      if (inloop)
2301	as->modset |= (ci->flags & CCI_NOFPRCLOBBER) ?
2302		      (RSET_SCRATCH & ~RSET_FPR) : RSET_SCRATCH;
2303      continue;
2304      }
2305    case IR_HIOP:
2306      switch ((ir-1)->o) {
2307#if LJ_SOFTFP && LJ_TARGET_ARM
2308      case IR_SLOAD: case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
2309	if (ra_hashint((ir-1)->r)) {
2310	  ir->prev = (ir-1)->prev + 1;
2311	  continue;
2312	}
2313	break;
2314#endif
2315#if !LJ_SOFTFP && LJ_NEED_FP64 && LJ_32 && LJ_HASFFI
2316      case IR_CONV:
2317	if (irt_isfp((ir-1)->t)) {
2318	  ir->prev = REGSP_HINT(RID_FPRET);
2319	  continue;
2320	}
2321#endif
2322      /* fallthrough */
2323      case IR_CALLN: case IR_CALLL: case IR_CALLS: case IR_CALLXS:
2324#if LJ_SOFTFP
2325      case IR_MIN: case IR_MAX:
2326#endif
2327	(ir-1)->prev = REGSP_HINT(RID_RETLO);
2328	ir->prev = REGSP_HINT(RID_RETHI);
2329	continue;
2330      default:
2331	break;
2332      }
2333      break;
2334#if LJ_SOFTFP
2335    case IR_MIN: case IR_MAX:
2336      if ((ir+1)->o != IR_HIOP) break;
2337#endif
2338    /* fallthrough */
2339    /* C calls evict all scratch regs and return results in RID_RET. */
2340    case IR_SNEW: case IR_XSNEW: case IR_NEWREF: case IR_BUFPUT:
2341      if (REGARG_NUMGPR < 3 && as->evenspill < 3)
2342	as->evenspill = 3;  /* lj_str_new and lj_tab_newkey need 3 args. */
2343#if LJ_TARGET_X86 && LJ_HASFFI
2344      if (0) {
2345    case IR_CNEW:
2346	if (ir->op2 != REF_NIL && as->evenspill < 4)
2347	  as->evenspill = 4;  /* lj_cdata_newv needs 4 args. */
2348      }
2349      /* fallthrough */
2350#else
2351      /* fallthrough */
2352    case IR_CNEW:
2353#endif
2354      /* fallthrough */
2355    case IR_TNEW: case IR_TDUP: case IR_CNEWI: case IR_TOSTR:
2356    case IR_BUFSTR:
2357      ir->prev = REGSP_HINT(RID_RET);
2358      if (inloop)
2359	as->modset = RSET_SCRATCH;
2360      continue;
2361    case IR_STRTO: case IR_OBAR:
2362      if (inloop)
2363	as->modset = RSET_SCRATCH;
2364      break;
2365#if !LJ_SOFTFP
2366#if !LJ_TARGET_X86ORX64
2367    case IR_LDEXP:
2368#endif
2369#endif
2370      /* fallthrough */
2371    case IR_POW:
2372      if (!LJ_SOFTFP && irt_isnum(ir->t)) {
2373	if (inloop)
2374	  as->modset |= RSET_SCRATCH;
2375#if LJ_TARGET_X86
2376	if (irt_isnum(IR(ir->op2)->t)) {
2377	  if (as->evenspill < 4)  /* Leave room to call pow(). */
2378	    as->evenspill = 4;
2379	}
2380	break;
2381#else
2382	ir->prev = REGSP_HINT(RID_FPRET);
2383	continue;
2384#endif
2385      }
2386      /* fallthrough */ /* for integer POW */
2387    case IR_DIV: case IR_MOD:
2388      if ((LJ_64 && LJ_SOFTFP) || !irt_isnum(ir->t)) {
2389	ir->prev = REGSP_HINT(RID_RET);
2390	if (inloop)
2391	  as->modset |= (RSET_SCRATCH & RSET_GPR);
2392	continue;
2393      }
2394      break;
2395#if LJ_64 && LJ_SOFTFP
2396    case IR_ADD: case IR_SUB: case IR_MUL:
2397      if (irt_isnum(ir->t)) {
2398	ir->prev = REGSP_HINT(RID_RET);
2399	if (inloop)
2400	  as->modset |= (RSET_SCRATCH & RSET_GPR);
2401	continue;
2402      }
2403      break;
2404#endif
2405    case IR_FPMATH:
2406#if LJ_TARGET_X86ORX64
2407      if (ir->op2 <= IRFPM_TRUNC) {
2408	if (!(as->flags & JIT_F_SSE4_1)) {
2409	  ir->prev = REGSP_HINT(RID_XMM0);
2410	  if (inloop)
2411	    as->modset |= RSET_RANGE(RID_XMM0, RID_XMM3+1)|RID2RSET(RID_EAX);
2412	  continue;
2413	}
2414	break;
2415      }
2416#endif
2417      if (inloop)
2418	as->modset |= RSET_SCRATCH;
2419#if LJ_TARGET_X86
2420      break;
2421#else
2422      ir->prev = REGSP_HINT(RID_FPRET);
2423      continue;
2424#endif
2425#if LJ_TARGET_X86ORX64
2426    /* Non-constant shift counts need to be in RID_ECX on x86/x64. */
2427    case IR_BSHL: case IR_BSHR: case IR_BSAR:
2428      if ((as->flags & JIT_F_BMI2))  /* Except if BMI2 is available. */
2429	break;
2430      /* fallthrough */
2431    case IR_BROL: case IR_BROR:
2432      if (!irref_isk(ir->op2) && !ra_hashint(IR(ir->op2)->r)) {
2433	IR(ir->op2)->r = REGSP_HINT(RID_ECX);
2434	if (inloop)
2435	  rset_set(as->modset, RID_ECX);
2436      }
2437      break;
2438#endif
2439    /* Do not propagate hints across type conversions or loads. */
2440    case IR_TOBIT:
2441    case IR_XLOAD:
2442#if !LJ_TARGET_ARM
2443    case IR_ALOAD: case IR_HLOAD: case IR_ULOAD: case IR_VLOAD:
2444#endif
2445      break;
2446    case IR_CONV:
2447      if (irt_isfp(ir->t) || (ir->op2 & IRCONV_SRCMASK) == IRT_NUM ||
2448	  (ir->op2 & IRCONV_SRCMASK) == IRT_FLOAT)
2449	break;
2450      /* fallthrough */
2451    default:
2452      /* Propagate hints across likely 'op reg, imm' or 'op reg'. */
2453      if (irref_isk(ir->op2) && !irref_isk(ir->op1) &&
2454	  ra_hashint(regsp_reg(IR(ir->op1)->prev))) {
2455	ir->prev = IR(ir->op1)->prev;
2456	continue;
2457      }
2458      break;
2459    }
2460    ir->prev = REGSP_INIT;
2461  }
2462  if ((as->evenspill & 1))
2463    as->oddspill = as->evenspill++;
2464  else
2465    as->oddspill = 0;
2466}
2467
2468/* -- Assembler core ------------------------------------------------------ */
2469
2470/* Assemble a trace. */
2471void lj_asm_trace(jit_State *J, GCtrace *T)
2472{
2473  ASMState as_;
2474  ASMState *as = &as_;
2475
2476  /* Remove nops/renames left over from ASM restart due to LJ_TRERR_MCODELM. */
2477  {
2478    IRRef nins = T->nins;
2479    IRIns *ir = &T->ir[nins-1];
2480    if (ir->o == IR_NOP || ir->o == IR_RENAME) {
2481      do { ir--; nins--; } while (ir->o == IR_NOP || ir->o == IR_RENAME);
2482      T->nins = nins;
2483    }
2484  }
2485
2486  /* Ensure an initialized instruction beyond the last one for HIOP checks. */
2487  /* This also allows one RENAME to be added without reallocating curfinal. */
2488  as->orignins = lj_ir_nextins(J);
2489  lj_ir_nop(&J->cur.ir[as->orignins]);
2490
2491  /* Setup initial state. Copy some fields to reduce indirections. */
2492  as->J = J;
2493  as->T = T;
2494  J->curfinal = lj_trace_alloc(J->L, T);  /* This copies the IR, too. */
2495  as->flags = J->flags;
2496  as->loopref = J->loopref;
2497  as->realign = NULL;
2498  as->loopinv = 0;
2499  as->parent = J->parent ? traceref(J, J->parent) : NULL;
2500#ifdef LUAJIT_RANDOM_RA
2501  (void)lj_prng_u64(&J2G(J)->prng);  /* Ensure PRNG step between traces. */
2502#endif
2503
2504  /* Reserve MCode memory. */
2505  as->mctop = as->mctoporig = lj_mcode_reserve(J, &as->mcbot);
2506  as->mcp = as->mctop;
2507  as->mclim = as->mcbot + MCLIM_REDZONE;
2508  asm_setup_target(as);
2509
2510  /*
2511  ** This is a loop, because the MCode may have to be (re-)assembled
2512  ** multiple times:
2513  **
2514  ** 1. as->realign is set (and the assembly aborted), if the arch-specific
2515  **    backend wants the MCode to be aligned differently.
2516  **
2517  **    This is currently only the case on x86/x64, where small loops get
2518  **    an aligned loop body plus a short branch. Not much effort is wasted,
2519  **    because the abort happens very quickly and only once.
2520  **
2521  ** 2. The IR is immovable, since the MCode embeds pointers to various
2522  **    constants inside the IR. But RENAMEs may need to be added to the IR
2523  **    during assembly, which might grow and reallocate the IR. We check
2524  **    at the end if the IR (in J->cur.ir) has actually grown, resize the
2525  **    copy (in J->curfinal.ir) and try again.
2526  **
2527  **    95% of all traces have zero RENAMEs, 3% have one RENAME, 1.5% have
2528  **    2 RENAMEs and only 0.5% have more than that. That's why we opt to
2529  **    always have one spare slot in the IR (see above), which means we
2530  **    have to redo the assembly for only ~2% of all traces.
2531  **
2532  **    Very, very rarely, this needs to be done repeatedly, since the
2533  **    location of constants inside the IR (actually, reachability from
2534  **    a global pointer) may affect register allocation and thus the
2535  **    number of RENAMEs.
2536  */
2537  for (;;) {
2538    as->mcp = as->mctop;
2539#ifdef LUA_USE_ASSERT
2540    as->mcp_prev = as->mcp;
2541#endif
2542    as->ir = J->curfinal->ir;  /* Use the copied IR. */
2543    as->curins = J->cur.nins = as->orignins;
2544#ifdef LUAJIT_RANDOM_RA
2545    as->prngstate = J2G(J)->prng;  /* Must (re)start from identical state. */
2546    as->prngbits = 0;
2547#endif
2548
2549    RA_DBG_START();
2550    RA_DBGX((as, "===== STOP ====="));
2551
2552    /* General trace setup. Emit tail of trace. */
2553    asm_tail_prep(as, T->link);
2554    as->mcloop = NULL;
2555    as->flagmcp = NULL;
2556    as->topslot = 0;
2557    as->gcsteps = 0;
2558    as->sectref = as->loopref;
2559    as->fuseref = (as->flags & JIT_F_OPT_FUSE) ? as->loopref : FUSE_DISABLED;
2560    asm_setup_regsp(as);
2561    if (!as->loopref)
2562      asm_tail_link(as);
2563
2564    /* Assemble a trace in linear backwards order. */
2565    for (as->curins--; as->curins > as->stopins; as->curins--) {
2566      IRIns *ir = IR(as->curins);
2567      /* 64 bit types handled by SPLIT for 32 bit archs. */
2568      lj_assertA(!(LJ_32 && irt_isint64(ir->t)),
2569		 "IR %04d has unsplit 64 bit type",
2570		 (int)(ir - as->ir) - REF_BIAS);
2571      asm_snap_prev(as);
2572      if (!ra_used(ir) && !ir_sideeff(ir) && (as->flags & JIT_F_OPT_DCE))
2573	continue;  /* Dead-code elimination can be soooo easy. */
2574      if (irt_isguard(ir->t))
2575	asm_snap_prep(as);
2576      RA_DBG_REF();
2577      checkmclim(as);
2578      asm_ir(as, ir);
2579    }
2580
2581    if (as->realign && J->curfinal->nins >= T->nins)
2582      continue;  /* Retry in case only the MCode needs to be realigned. */
2583
2584    /* Emit head of trace. */
2585    RA_DBG_REF();
2586    checkmclim(as);
2587    if (as->gcsteps > 0) {
2588      as->curins = as->T->snap[0].ref;
2589      asm_snap_prep(as);  /* The GC check is a guard. */
2590      asm_gc_check(as);
2591      as->curins = as->stopins;
2592    }
2593    ra_evictk(as);
2594    if (as->parent)
2595      asm_head_side(as);
2596    else
2597      asm_head_root(as);
2598#if LJ_ABI_BRANCH_TRACK
2599    emit_branch_track(as);
2600#endif
2601    asm_phi_fixup(as);
2602
2603    if (J->curfinal->nins >= T->nins) {  /* IR didn't grow? */
2604      lj_assertA(J->curfinal->nk == T->nk, "unexpected IR constant growth");
2605      memcpy(J->curfinal->ir + as->orignins, T->ir + as->orignins,
2606	     (T->nins - as->orignins) * sizeof(IRIns));  /* Copy RENAMEs. */
2607      T->nins = J->curfinal->nins;
2608      /* Fill mcofs of any unprocessed snapshots. */
2609      as->curins = REF_FIRST;
2610      asm_snap_prev(as);
2611      break;  /* Done. */
2612    }
2613
2614    /* Otherwise try again with a bigger IR. */
2615    lj_trace_free(J2G(J), J->curfinal);
2616    J->curfinal = NULL;  /* In case lj_trace_alloc() OOMs. */
2617    J->curfinal = lj_trace_alloc(J->L, T);
2618    as->realign = NULL;
2619  }
2620
2621  RA_DBGX((as, "===== START ===="));
2622  RA_DBG_FLUSH();
2623  if (as->freeset != RSET_ALL)
2624    lj_trace_err(as->J, LJ_TRERR_BADRA);  /* Ouch! Should never happen. */
2625
2626  /* Set trace entry point before fixing up tail to allow link to self. */
2627  T->mcode = as->mcp;
2628  T->mcloop = as->mcloop ? (MSize)((char *)as->mcloop - (char *)as->mcp) : 0;
2629  if (as->loopref)
2630    asm_loop_tail_fixup(as);
2631  else
2632    asm_tail_fixup(as, T->link);  /* Note: this may change as->mctop! */
2633  T->szmcode = (MSize)((char *)as->mctop - (char *)as->mcp);
2634  asm_snap_fixup_mcofs(as);
2635#if LJ_TARGET_MCODE_FIXUP
2636  asm_mcode_fixup(T->mcode, T->szmcode);
2637#endif
2638  lj_mcode_sync(T->mcode, as->mctoporig);
2639}
2640
2641#undef IR
2642
2643#endif