luna - luajit/src/lj_asm

   1/*
   2** x86/x64 IR assembler (SSA IR -> machine code).
   3** Copyright (C) 2005-2026 Mike Pall. See Copyright Notice in luajit.h
   4*/
   5
   6/* -- Guard handling ------------------------------------------------------ */
   7
   8/* Generate an exit stub group at the bottom of the reserved MCode memory. */
   9static MCode *asm_exitstub_gen(ASMState *as, ExitNo group)
  10{
  11  ExitNo i, groupofs = (group*EXITSTUBS_PER_GROUP) & 0xff;
  12  MCode *target = (MCode *)(void *)lj_vm_exit_handler;
  13  MCode *mxp = as->mcbot;
  14  MCode *mxpstart = mxp;
  15  if (mxp + ((2+2)*EXITSTUBS_PER_GROUP +
  16	     (LJ_GC64 ? 0 : 8) +
  17	     (LJ_64 ? 6 : 5)) >= as->mctop)
  18    asm_mclimit(as);
  19  /* Push low byte of exitno for each exit stub. */
  20  *mxp++ = XI_PUSHi8; *mxp++ = (MCode)groupofs;
  21  for (i = 1; i < EXITSTUBS_PER_GROUP; i++) {
  22    *mxp++ = XI_JMPs; *mxp++ = (MCode)((2+2)*(EXITSTUBS_PER_GROUP - i) - 2);
  23    *mxp++ = XI_PUSHi8; *mxp++ = (MCode)(groupofs + i);
  24  }
  25  /* Push the high byte of the exitno for each exit stub group. */
  26  *mxp++ = XI_PUSHi8; *mxp++ = (MCode)((group*EXITSTUBS_PER_GROUP)>>8);
  27#if !LJ_GC64
  28  /* Store DISPATCH at original stack slot 0. Account for the two push ops. */
  29  *mxp++ = XI_MOVmi;
  30  *mxp++ = MODRM(XM_OFS8, 0, RID_ESP);
  31  *mxp++ = MODRM(XM_SCALE1, RID_ESP, RID_ESP);
  32  *mxp++ = 2*sizeof(void *);
  33  *(int32_t *)mxp = ptr2addr(J2GG(as->J)->dispatch); mxp += 4;
  34#endif
  35  /* Jump to exit handler which fills in the ExitState. */
  36  if (jmprel_ok(mxp + 5, target)) {  /* Direct jump. */
  37    *mxp++ = XI_JMP; mxp += 4;
  38    *((int32_t *)(mxp-4)) = jmprel(as->J, mxp, target);
  39  } else { /* RIP-relative indirect jump. */
  40    *mxp++ = XI_GROUP5; *mxp++ = XM_OFS0 + (XOg_JMP<<3) + RID_EBP; mxp += 4;
  41    *((int32_t *)(mxp-4)) = (int32_t)((group ? as->J->exitstubgroup[0] : mxpstart) - 8 - mxp);
  42  }
  43  /* Commit the code for this group (even if assembly fails later on). */
  44  lj_mcode_commitbot(as->J, mxp);
  45  as->mcbot = mxp;
  46  as->mclim = as->mcbot + MCLIM_REDZONE;
  47  return mxpstart;
  48}
  49
  50/* Setup all needed exit stubs. */
  51static void asm_exitstub_setup(ASMState *as, ExitNo nexits)
  52{
  53  ExitNo i;
  54  if (nexits >= EXITSTUBS_PER_GROUP*LJ_MAX_EXITSTUBGR)
  55    lj_trace_err(as->J, LJ_TRERR_SNAPOV);
  56#if LJ_64
  57  if (as->J->exitstubgroup[0] == NULL) {
  58    /* Store the two potentially out-of-range targets below group 0. */
  59    MCode *mxp = as->mcbot;
  60    while ((uintptr_t)mxp & 7) *mxp++ = XI_INT3;
  61    *((void **)mxp) = (void *)lj_vm_exit_interp; mxp += 8;
  62    *((void **)mxp) = (void *)lj_vm_exit_handler; mxp += 8;
  63    as->mcbot = mxp;  /* Don't bother to commit, done in asm_exitstub_gen. */
  64  }
  65#endif
  66  for (i = 0; i < (nexits+EXITSTUBS_PER_GROUP-1)/EXITSTUBS_PER_GROUP; i++)
  67    if (as->J->exitstubgroup[i] == NULL)
  68      as->J->exitstubgroup[i] = asm_exitstub_gen(as, i);
  69}
  70
  71/* Emit conditional branch to exit for guard.
  72** It's important to emit this *after* all registers have been allocated,
  73** because rematerializations may invalidate the flags.
  74*/
  75static void asm_guardcc(ASMState *as, int cc)
  76{
  77  MCode *target = exitstub_addr(as->J, as->snapno);
  78  MCode *p = as->mcp;
  79  if (LJ_UNLIKELY(p == as->invmcp)) {
  80    as->loopinv = 1;
  81    *(int32_t *)(p+1) = jmprel(as->J, p+5, target);
  82    target = p;
  83    cc ^= 1;
  84    if (as->realign) {
  85      if (LJ_GC64 && LJ_UNLIKELY(as->mrm.base == RID_RIP))
  86	as->mrm.ofs += 2;  /* Fixup RIP offset for pending fused load. */
  87      emit_sjcc(as, cc, target);
  88      return;
  89    }
  90  }
  91  if (LJ_GC64 && LJ_UNLIKELY(as->mrm.base == RID_RIP))
  92    as->mrm.ofs += 6;  /* Fixup RIP offset for pending fused load. */
  93  emit_jcc(as, cc, target);
  94}
  95
  96/* -- Memory operand fusion ----------------------------------------------- */
  97
  98/* Limit linear search to this distance. Avoids O(n^2) behavior. */
  99#define CONFLICT_SEARCH_LIM	31
 100
 101/* Check if a reference is a signed 32 bit constant. */
 102static int asm_isk32(ASMState *as, IRRef ref, int32_t *k)
 103{
 104  if (irref_isk(ref)) {
 105    IRIns *ir = IR(ref);
 106#if LJ_GC64
 107    if (ir->o == IR_KNULL || !irt_is64(ir->t)) {
 108      *k = ir->i;
 109      return 1;
 110    } else if (checki32((int64_t)ir_k64(ir)->u64)) {
 111      *k = (int32_t)ir_k64(ir)->u64;
 112      return 1;
 113    }
 114#else
 115    if (ir->o != IR_KINT64) {
 116      *k = ir->i;
 117      return 1;
 118    } else if (checki32((int64_t)ir_kint64(ir)->u64)) {
 119      *k = (int32_t)ir_kint64(ir)->u64;
 120      return 1;
 121    }
 122#endif
 123  }
 124  return 0;
 125}
 126
 127/* Check if there's no conflicting instruction between curins and ref.
 128** Also avoid fusing loads if there are multiple references.
 129*/
 130static int noconflict(ASMState *as, IRRef ref, IROp conflict, int check)
 131{
 132  IRIns *ir = as->ir;
 133  IRRef i = as->curins;
 134  if (i > ref + CONFLICT_SEARCH_LIM)
 135    return 0;  /* Give up, ref is too far away. */
 136  while (--i > ref) {
 137    if (ir[i].o == conflict)
 138      return 0;  /* Conflict found. */
 139    else if ((check & 1) && (ir[i].o == IR_NEWREF || ir[i].o == IR_CALLS))
 140      return 0;
 141    else if ((check & 2) && (ir[i].op1 == ref || ir[i].op2 == ref))
 142      return 0;
 143  }
 144  return 1;  /* Ok, no conflict. */
 145}
 146
 147/* Fuse array base into memory operand. */
 148static IRRef asm_fuseabase(ASMState *as, IRRef ref)
 149{
 150  IRIns *irb = IR(ref);
 151  as->mrm.ofs = 0;
 152  if (irb->o == IR_FLOAD) {
 153    IRIns *ira = IR(irb->op1);
 154    lj_assertA(irb->op2 == IRFL_TAB_ARRAY, "expected FLOAD TAB_ARRAY");
 155    /* We can avoid the FLOAD of t->array for colocated arrays. */
 156    if (ira->o == IR_TNEW && ira->op1 <= LJ_MAX_COLOSIZE &&
 157	!neverfuse(as) && noconflict(as, irb->op1, IR_NEWREF, 0)) {
 158      as->mrm.ofs = (int32_t)sizeof(GCtab);  /* Ofs to colocated array. */
 159      return irb->op1;  /* Table obj. */
 160    }
 161  } else if (irb->o == IR_ADD && irref_isk(irb->op2)) {
 162    /* Fuse base offset (vararg load). */
 163    IRIns *irk = IR(irb->op2);
 164    as->mrm.ofs = irk->o == IR_KINT ? irk->i : (int32_t)ir_kint64(irk)->u64;
 165    return irb->op1;
 166  }
 167  return ref;  /* Otherwise use the given array base. */
 168}
 169
 170/* Fuse array reference into memory operand. */
 171static void asm_fusearef(ASMState *as, IRIns *ir, RegSet allow)
 172{
 173  IRIns *irx;
 174  lj_assertA(ir->o == IR_AREF, "expected AREF");
 175  as->mrm.base = (uint8_t)ra_alloc1(as, asm_fuseabase(as, ir->op1), allow);
 176  irx = IR(ir->op2);
 177  if (irref_isk(ir->op2)) {
 178    as->mrm.ofs += 8*irx->i;
 179    as->mrm.idx = RID_NONE;
 180  } else {
 181    rset_clear(allow, as->mrm.base);
 182    as->mrm.scale = XM_SCALE8;
 183    /* Fuse a constant ADD (e.g. t[i+1]) into the offset.
 184    ** Doesn't help much without ABCelim, but reduces register pressure.
 185    */
 186    if (!LJ_64 &&  /* Has bad effects with negative index on x64. */
 187	mayfuse(as, ir->op2) && ra_noreg(irx->r) &&
 188	irx->o == IR_ADD && irref_isk(irx->op2)) {
 189      as->mrm.ofs += 8*IR(irx->op2)->i;
 190      as->mrm.idx = (uint8_t)ra_alloc1(as, irx->op1, allow);
 191    } else {
 192      as->mrm.idx = (uint8_t)ra_alloc1(as, ir->op2, allow);
 193    }
 194  }
 195}
 196
 197/* Fuse array/hash/upvalue reference into memory operand.
 198** Caveat: this may allocate GPRs for the base/idx registers. Be sure to
 199** pass the final allow mask, excluding any GPRs used for other inputs.
 200** In particular: 2-operand GPR instructions need to call ra_dest() first!
 201*/
 202static void asm_fuseahuref(ASMState *as, IRRef ref, RegSet allow)
 203{
 204  IRIns *ir = IR(ref);
 205  if (ra_noreg(ir->r)) {
 206    switch ((IROp)ir->o) {
 207    case IR_AREF:
 208      if (mayfuse(as, ref)) {
 209	asm_fusearef(as, ir, allow);
 210	return;
 211      }
 212      break;
 213    case IR_HREFK:
 214      if (mayfuse(as, ref)) {
 215	as->mrm.base = (uint8_t)ra_alloc1(as, ir->op1, allow);
 216	as->mrm.ofs = (int32_t)(IR(ir->op2)->op2 * sizeof(Node));
 217	as->mrm.idx = RID_NONE;
 218	return;
 219      }
 220      break;
 221    case IR_UREFC:
 222      if (irref_isk(ir->op1)) {
 223	GCfunc *fn = ir_kfunc(IR(ir->op1));
 224	GCupval *uv = &gcref(fn->l.uvptr[(ir->op2 >> 8)])->uv;
 225#if LJ_GC64
 226	int64_t ofs = dispofs(as, &uv->tv);
 227	if (checki32(ofs) && checki32(ofs+4)) {
 228	  as->mrm.ofs = (int32_t)ofs;
 229	  as->mrm.base = RID_DISPATCH;
 230	  as->mrm.idx = RID_NONE;
 231	  return;
 232	}
 233#else
 234	as->mrm.ofs = ptr2addr(&uv->tv);
 235	as->mrm.base = as->mrm.idx = RID_NONE;
 236	return;
 237#endif
 238      }
 239      break;
 240    case IR_TMPREF:
 241#if LJ_GC64
 242      as->mrm.ofs = (int32_t)dispofs(as, &J2G(as->J)->tmptv);
 243      as->mrm.base = RID_DISPATCH;
 244      as->mrm.idx = RID_NONE;
 245#else
 246      as->mrm.ofs = igcptr(&J2G(as->J)->tmptv);
 247      as->mrm.base = as->mrm.idx = RID_NONE;
 248#endif
 249      return;
 250    default:
 251      break;
 252    }
 253  }
 254  as->mrm.base = (uint8_t)ra_alloc1(as, ref, allow);
 255  as->mrm.ofs = 0;
 256  as->mrm.idx = RID_NONE;
 257}
 258
 259/* Fuse FLOAD/FREF reference into memory operand. */
 260static void asm_fusefref(ASMState *as, IRIns *ir, RegSet allow)
 261{
 262  lj_assertA(ir->o == IR_FLOAD || ir->o == IR_FREF,
 263	     "bad IR op %d", ir->o);
 264  as->mrm.idx = RID_NONE;
 265  if (ir->op1 == REF_NIL) {  /* FLOAD from GG_State with offset. */
 266#if LJ_GC64
 267    as->mrm.ofs = (int32_t)(ir->op2 << 2) - GG_OFS(dispatch);
 268    as->mrm.base = RID_DISPATCH;
 269#else
 270    as->mrm.ofs = (int32_t)(ir->op2 << 2) + ptr2addr(J2GG(as->J));
 271    as->mrm.base = RID_NONE;
 272#endif
 273    return;
 274  }
 275  as->mrm.ofs = field_ofs[ir->op2];
 276  if (irref_isk(ir->op1)) {
 277    IRIns *op1 = IR(ir->op1);
 278#if LJ_GC64
 279    if (ir->op1 == REF_NIL) {
 280      as->mrm.ofs -= GG_OFS(dispatch);
 281      as->mrm.base = RID_DISPATCH;
 282      return;
 283    } else if (op1->o == IR_KPTR || op1->o == IR_KKPTR) {
 284      intptr_t ofs = dispofs(as, ir_kptr(op1));
 285      if (checki32(as->mrm.ofs + ofs)) {
 286	as->mrm.ofs += (int32_t)ofs;
 287	as->mrm.base = RID_DISPATCH;
 288	return;
 289      }
 290    }
 291#else
 292    as->mrm.ofs += op1->i;
 293    as->mrm.base = RID_NONE;
 294    return;
 295#endif
 296  }
 297  as->mrm.base = (uint8_t)ra_alloc1(as, ir->op1, allow);
 298}
 299
 300/* Fuse string reference into memory operand. */
 301static void asm_fusestrref(ASMState *as, IRIns *ir, RegSet allow)
 302{
 303  IRIns *irr;
 304  lj_assertA(ir->o == IR_STRREF, "bad IR op %d", ir->o);
 305  as->mrm.base = as->mrm.idx = RID_NONE;
 306  as->mrm.scale = XM_SCALE1;
 307  as->mrm.ofs = sizeof(GCstr);
 308  if (!LJ_GC64 && irref_isk(ir->op1)) {
 309    as->mrm.ofs += IR(ir->op1)->i;
 310  } else {
 311    Reg r = ra_alloc1(as, ir->op1, allow);
 312    rset_clear(allow, r);
 313    as->mrm.base = (uint8_t)r;
 314  }
 315  irr = IR(ir->op2);
 316  if (irref_isk(ir->op2)) {
 317    as->mrm.ofs += irr->i;
 318  } else {
 319    Reg r;
 320    /* Fuse a constant add into the offset, e.g. string.sub(s, i+10). */
 321    if (!LJ_64 &&  /* Has bad effects with negative index on x64. */
 322	mayfuse(as, ir->op2) && irr->o == IR_ADD && irref_isk(irr->op2)) {
 323      as->mrm.ofs += IR(irr->op2)->i;
 324      r = ra_alloc1(as, irr->op1, allow);
 325    } else {
 326      r = ra_alloc1(as, ir->op2, allow);
 327    }
 328    if (as->mrm.base == RID_NONE)
 329      as->mrm.base = (uint8_t)r;
 330    else
 331      as->mrm.idx = (uint8_t)r;
 332  }
 333}
 334
 335static void asm_fusexref(ASMState *as, IRRef ref, RegSet allow)
 336{
 337  IRIns *ir = IR(ref);
 338  as->mrm.idx = RID_NONE;
 339  if (ir->o == IR_KPTR || ir->o == IR_KKPTR) {
 340#if LJ_GC64
 341    intptr_t ofs = dispofs(as, ir_kptr(ir));
 342    if (checki32(ofs)) {
 343      as->mrm.ofs = (int32_t)ofs;
 344      as->mrm.base = RID_DISPATCH;
 345      return;
 346    }
 347  } if (0) {
 348#else
 349    as->mrm.ofs = ir->i;
 350    as->mrm.base = RID_NONE;
 351  } else if (ir->o == IR_STRREF) {
 352    asm_fusestrref(as, ir, allow);
 353#endif
 354  } else {
 355    as->mrm.ofs = 0;
 356    if (canfuse(as, ir) && ir->o == IR_ADD && ra_noreg(ir->r)) {
 357      /* Gather (base+idx*sz)+ofs as emitted by cdata ptr/array indexing. */
 358      IRIns *irx;
 359      IRRef idx;
 360      Reg r;
 361      if (asm_isk32(as, ir->op2, &as->mrm.ofs)) {  /* Recognize x+ofs. */
 362	ref = ir->op1;
 363	ir = IR(ref);
 364	if (!(ir->o == IR_ADD && canfuse(as, ir) && ra_noreg(ir->r)))
 365	  goto noadd;
 366      }
 367      as->mrm.scale = XM_SCALE1;
 368      idx = ir->op1;
 369      ref = ir->op2;
 370      irx = IR(idx);
 371      if (!(irx->o == IR_BSHL || irx->o == IR_ADD)) {  /* Try other operand. */
 372	idx = ir->op2;
 373	ref = ir->op1;
 374	irx = IR(idx);
 375      }
 376      if (canfuse(as, irx) && ra_noreg(irx->r)) {
 377	if (irx->o == IR_BSHL && irref_isk(irx->op2) && IR(irx->op2)->i <= 3) {
 378	  /* Recognize idx<<b with b = 0-3, corresponding to sz = (1),2,4,8. */
 379	  idx = irx->op1;
 380	  as->mrm.scale = (uint8_t)(IR(irx->op2)->i << 6);
 381	} else if (irx->o == IR_ADD && irx->op1 == irx->op2) {
 382	  /* FOLD does idx*2 ==> idx<<1 ==> idx+idx. */
 383	  idx = irx->op1;
 384	  as->mrm.scale = XM_SCALE2;
 385	}
 386      }
 387      r = ra_alloc1(as, idx, allow);
 388      rset_clear(allow, r);
 389      as->mrm.idx = (uint8_t)r;
 390    }
 391  noadd:
 392    as->mrm.base = (uint8_t)ra_alloc1(as, ref, allow);
 393  }
 394}
 395
 396/* Fuse load of 64 bit IR constant into memory operand. */
 397static Reg asm_fuseloadk64(ASMState *as, IRIns *ir)
 398{
 399  const uint64_t *k = &ir_k64(ir)->u64;
 400  if (!LJ_GC64 || checki32((intptr_t)k)) {
 401    as->mrm.ofs = ptr2addr(k);
 402    as->mrm.base = RID_NONE;
 403#if LJ_GC64
 404  } else if (checki32(dispofs(as, k))) {
 405    as->mrm.ofs = (int32_t)dispofs(as, k);
 406    as->mrm.base = RID_DISPATCH;
 407  } else if (checki32(mcpofs(as, k)) && checki32(mcpofs(as, k+1)) &&
 408	     checki32(mctopofs(as, k)) && checki32(mctopofs(as, k+1))) {
 409    as->mrm.ofs = (int32_t)mcpofs(as, k);
 410    as->mrm.base = RID_RIP;
 411  } else {  /* Intern 64 bit constant at bottom of mcode. */
 412    if (ir->i) {
 413      lj_assertA(*k == *(uint64_t*)(as->mctop - ir->i),
 414		 "bad interned 64 bit constant");
 415    } else {
 416      while ((uintptr_t)as->mcbot & 7) *as->mcbot++ = XI_INT3;
 417      *(uint64_t *)as->mcbot = *k;
 418      ir->i = (int32_t)(as->mctop - as->mcbot);
 419      as->mcbot += 8;
 420      as->mclim = as->mcbot + MCLIM_REDZONE;
 421      lj_mcode_commitbot(as->J, as->mcbot);
 422    }
 423    as->mrm.ofs = (int32_t)mcpofs(as, as->mctop - ir->i);
 424    as->mrm.base = RID_RIP;
 425#endif
 426  }
 427  as->mrm.idx = RID_NONE;
 428  return RID_MRM;
 429}
 430
 431/* Fuse load into memory operand.
 432**
 433** Important caveat: this may emit RIP-relative loads! So don't place any
 434** code emitters between this function and the use of its result.
 435** The only permitted exception is asm_guardcc().
 436*/
 437static Reg asm_fuseload(ASMState *as, IRRef ref, RegSet allow)
 438{
 439  IRIns *ir = IR(ref);
 440  if (ra_hasreg(ir->r)) {
 441    if (allow != RSET_EMPTY) {  /* Fast path. */
 442      ra_noweak(as, ir->r);
 443      return ir->r;
 444    }
 445  fusespill:
 446    /* Force a spill if only memory operands are allowed (asm_x87load). */
 447    as->mrm.base = RID_ESP;
 448    as->mrm.ofs = ra_spill(as, ir);
 449    as->mrm.idx = RID_NONE;
 450    return RID_MRM;
 451  }
 452  if (ir->o == IR_KNUM) {
 453    RegSet avail = as->freeset & ~as->modset & RSET_FPR;
 454    lj_assertA(allow != RSET_EMPTY, "no register allowed");
 455    if (!(avail & (avail-1)))  /* Fuse if less than two regs available. */
 456      return asm_fuseloadk64(as, ir);
 457  } else if (ref == REF_BASE || ir->o == IR_KINT64) {
 458    RegSet avail = as->freeset & ~as->modset & RSET_GPR;
 459    lj_assertA(allow != RSET_EMPTY, "no register allowed");
 460    if (!(avail & (avail-1))) {  /* Fuse if less than two regs available. */
 461      if (ref == REF_BASE) {
 462#if LJ_GC64
 463	as->mrm.ofs = (int32_t)dispofs(as, &J2G(as->J)->jit_base);
 464	as->mrm.base = RID_DISPATCH;
 465#else
 466	as->mrm.ofs = ptr2addr(&J2G(as->J)->jit_base);
 467	as->mrm.base = RID_NONE;
 468#endif
 469	as->mrm.idx = RID_NONE;
 470	return RID_MRM;
 471      } else {
 472	return asm_fuseloadk64(as, ir);
 473      }
 474    }
 475  } else if (mayfuse(as, ref)) {
 476    RegSet xallow = (allow & RSET_GPR) ? allow : RSET_GPR;
 477    if (ir->o == IR_SLOAD) {
 478      if (!(ir->op2 & (IRSLOAD_PARENT|IRSLOAD_CONVERT)) &&
 479	  noconflict(as, ref, IR_RETF, 2) &&
 480	  !(LJ_GC64 && irt_isaddr(ir->t))) {
 481	as->mrm.base = (uint8_t)ra_alloc1(as, REF_BASE, xallow);
 482	as->mrm.ofs = 8*((int32_t)ir->op1-1-LJ_FR2) +
 483		      (!LJ_FR2 && (ir->op2 & IRSLOAD_FRAME) ? 4 : 0);
 484	as->mrm.idx = RID_NONE;
 485	return RID_MRM;
 486      }
 487    } else if (ir->o == IR_FLOAD) {
 488      /* Generic fusion is only ok for 32 bit operand (but see asm_comp). */
 489      if ((irt_isint(ir->t) || irt_isu32(ir->t) || irt_isaddr(ir->t)) &&
 490	  noconflict(as, ref, IR_FSTORE, 2)) {
 491	asm_fusefref(as, ir, xallow);
 492	return RID_MRM;
 493      }
 494    } else if (ir->o == IR_ALOAD || ir->o == IR_HLOAD || ir->o == IR_ULOAD) {
 495      if (noconflict(as, ref, ir->o + IRDELTA_L2S, 2+(ir->o != IR_ULOAD)) &&
 496	  !(LJ_GC64 && irt_isaddr(ir->t))) {
 497	asm_fuseahuref(as, ir->op1, xallow);
 498	return RID_MRM;
 499      }
 500    } else if (ir->o == IR_XLOAD) {
 501      /* Generic fusion is not ok for 8/16 bit operands (but see asm_comp).
 502      ** Fusing unaligned memory operands is ok on x86 (except for SIMD types).
 503      */
 504      if ((!irt_typerange(ir->t, IRT_I8, IRT_U16)) &&
 505	  noconflict(as, ref, IR_XSTORE, 2)) {
 506	asm_fusexref(as, ir->op1, xallow);
 507	return RID_MRM;
 508      }
 509    } else if (ir->o == IR_VLOAD && IR(ir->op1)->o == IR_AREF &&
 510	       !(LJ_GC64 && irt_isaddr(ir->t))) {
 511      asm_fuseahuref(as, ir->op1, xallow);
 512      as->mrm.ofs += 8 * ir->op2;
 513      return RID_MRM;
 514    }
 515  }
 516  if (ir->o == IR_FLOAD && ir->op1 == REF_NIL) {
 517    asm_fusefref(as, ir, RSET_EMPTY);
 518    return RID_MRM;
 519  }
 520  if (!(as->freeset & allow) && !emit_canremat(ref) &&
 521      (allow == RSET_EMPTY || ra_hasspill(ir->s) || iscrossref(as, ref)))
 522    goto fusespill;
 523  return ra_allocref(as, ref, allow);
 524}
 525
 526#if LJ_64
 527/* Don't fuse a 32 bit load into a 64 bit operation. */
 528static Reg asm_fuseloadm(ASMState *as, IRRef ref, RegSet allow, int is64)
 529{
 530  if (is64 && !irt_is64(IR(ref)->t))
 531    return ra_alloc1(as, ref, allow);
 532  return asm_fuseload(as, ref, allow);
 533}
 534#else
 535#define asm_fuseloadm(as, ref, allow, is64)  asm_fuseload(as, (ref), (allow))
 536#endif
 537
 538/* -- Calls --------------------------------------------------------------- */
 539
 540/* Count the required number of stack slots for a call. */
 541static int asm_count_call_slots(ASMState *as, const CCallInfo *ci, IRRef *args)
 542{
 543  uint32_t i, nargs = CCI_XNARGS(ci);
 544  int nslots = 0;
 545#if LJ_64
 546  if (LJ_ABI_WIN) {
 547    nslots = (int)(nargs*2);  /* Only matters for more than four args. */
 548  } else {
 549    int ngpr = REGARG_NUMGPR, nfpr = REGARG_NUMFPR;
 550    for (i = 0; i < nargs; i++)
 551      if (args[i] && irt_isfp(IR(args[i])->t)) {
 552	if (nfpr > 0) nfpr--; else nslots += 2;
 553      } else {
 554	if (ngpr > 0) ngpr--; else nslots += 2;
 555      }
 556  }
 557#else
 558  int ngpr = 0;
 559  if ((ci->flags & CCI_CC_MASK) == CCI_CC_FASTCALL)
 560    ngpr = 2;
 561  else if ((ci->flags & CCI_CC_MASK) == CCI_CC_THISCALL)
 562    ngpr = 1;
 563  for (i = 0; i < nargs; i++)
 564    if (args[i] && irt_isfp(IR(args[i])->t)) {
 565      nslots += irt_isnum(IR(args[i])->t) ? 2 : 1;
 566    } else {
 567      if (ngpr > 0) ngpr--; else nslots++;
 568    }
 569#endif
 570  return nslots;
 571}
 572
 573/* Generate a call to a C function. */
 574static void asm_gencall(ASMState *as, const CCallInfo *ci, IRRef *args)
 575{
 576  uint32_t n, nargs = CCI_XNARGS(ci);
 577  int32_t ofs = STACKARG_OFS;
 578#if LJ_64
 579  uint32_t gprs = REGARG_GPRS;
 580  Reg fpr = REGARG_FIRSTFPR;
 581#if !LJ_ABI_WIN
 582  MCode *patchnfpr = NULL;
 583#endif
 584#else
 585  uint32_t gprs = 0;
 586  if ((ci->flags & CCI_CC_MASK) != CCI_CC_CDECL) {
 587    if ((ci->flags & CCI_CC_MASK) == CCI_CC_THISCALL)
 588      gprs = (REGARG_GPRS & 31);
 589    else if ((ci->flags & CCI_CC_MASK) == CCI_CC_FASTCALL)
 590      gprs = REGARG_GPRS;
 591  }
 592#endif
 593  if ((void *)ci->func)
 594    emit_call(as, ci->func);
 595#if LJ_64
 596  if ((ci->flags & CCI_VARARG)) {  /* Special handling for vararg calls. */
 597#if LJ_ABI_WIN
 598    for (n = 0; n < 4 && n < nargs; n++) {
 599      IRIns *ir = IR(args[n]);
 600      if (irt_isfp(ir->t))  /* Duplicate FPRs in GPRs. */
 601	emit_rr(as, XO_MOVDto, (irt_isnum(ir->t) ? REX_64 : 0) | (fpr+n),
 602		((gprs >> (n*5)) & 31));  /* Either MOVD or MOVQ. */
 603    }
 604#else
 605    patchnfpr = --as->mcp;  /* Indicate number of used FPRs in register al. */
 606    *--as->mcp = XI_MOVrib | RID_EAX;
 607#endif
 608  }
 609#endif
 610  for (n = 0; n < nargs; n++) {  /* Setup args. */
 611    IRRef ref = args[n];
 612    IRIns *ir = IR(ref);
 613    Reg r;
 614#if LJ_64 && LJ_ABI_WIN
 615    /* Windows/x64 argument registers are strictly positional. */
 616    r = irt_isfp(ir->t) ? (fpr <= REGARG_LASTFPR ? fpr : 0) : (gprs & 31);
 617    fpr++; gprs >>= 5;
 618#elif LJ_64
 619    /* POSIX/x64 argument registers are used in order of appearance. */
 620    if (irt_isfp(ir->t)) {
 621      r = fpr <= REGARG_LASTFPR ? fpr++ : 0;
 622    } else {
 623      r = gprs & 31; gprs >>= 5;
 624    }
 625#else
 626    if (ref && irt_isfp(ir->t)) {
 627      r = 0;
 628    } else {
 629      r = gprs & 31; gprs >>= 5;
 630      if (!ref) continue;
 631    }
 632#endif
 633    if (r) {  /* Argument is in a register. */
 634      if (r < RID_MAX_GPR && ref < ASMREF_TMP1) {
 635#if LJ_64
 636	if (LJ_GC64 ? !(ir->o == IR_KINT || ir->o == IR_KNULL) : ir->o == IR_KINT64)
 637	  emit_loadu64(as, r, ir_k64(ir)->u64);
 638	else
 639#endif
 640	  emit_loadi(as, r, ir->i);
 641      } else {
 642	/* Must have been evicted. */
 643	lj_assertA(rset_test(as->freeset, r), "reg %d not free", r);
 644	if (ra_hasreg(ir->r)) {
 645	  ra_noweak(as, ir->r);
 646	  emit_movrr(as, ir, r, ir->r);
 647	} else {
 648	  ra_allocref(as, ref, RID2RSET(r));
 649	}
 650      }
 651    } else if (irt_isfp(ir->t)) {  /* FP argument is on stack. */
 652      lj_assertA(!(irt_isfloat(ir->t) && irref_isk(ref)),
 653		 "unexpected float constant");
 654      if (LJ_32 && (ofs & 4) && irref_isk(ref)) {
 655	/* Split stores for unaligned FP consts. */
 656	emit_movmroi(as, RID_ESP, ofs, (int32_t)ir_knum(ir)->u32.lo);
 657	emit_movmroi(as, RID_ESP, ofs+4, (int32_t)ir_knum(ir)->u32.hi);
 658      } else {
 659	r = ra_alloc1(as, ref, RSET_FPR);
 660	emit_rmro(as, irt_isnum(ir->t) ? XO_MOVSDto : XO_MOVSSto,
 661		  r, RID_ESP, ofs);
 662      }
 663      ofs += (LJ_32 && irt_isfloat(ir->t)) ? 4 : 8;
 664    } else {  /* Non-FP argument is on stack. */
 665      if (LJ_32 && ref < ASMREF_TMP1) {
 666	emit_movmroi(as, RID_ESP, ofs, ir->i);
 667      } else {
 668	r = ra_alloc1(as, ref, RSET_GPR);
 669	emit_movtomro(as, REX_64 + r, RID_ESP, ofs);
 670      }
 671      ofs += sizeof(intptr_t);
 672    }
 673    checkmclim(as);
 674  }
 675#if LJ_64 && !LJ_ABI_WIN
 676  if (patchnfpr) *patchnfpr = fpr - REGARG_FIRSTFPR;
 677#endif
 678}
 679
 680/* Setup result reg/sp for call. Evict scratch regs. */
 681static void asm_setupresult(ASMState *as, IRIns *ir, const CCallInfo *ci)
 682{
 683  RegSet drop = RSET_SCRATCH;
 684  int hiop = ((ir+1)->o == IR_HIOP && !irt_isnil((ir+1)->t));
 685  if ((ci->flags & CCI_NOFPRCLOBBER))
 686    drop &= ~RSET_FPR;
 687  if (ra_hasreg(ir->r))
 688    rset_clear(drop, ir->r);  /* Dest reg handled below. */
 689  if (hiop && ra_hasreg((ir+1)->r))
 690    rset_clear(drop, (ir+1)->r);  /* Dest reg handled below. */
 691  ra_evictset(as, drop);  /* Evictions must be performed first. */
 692  if (ra_used(ir)) {
 693    if (irt_isfp(ir->t)) {
 694      int32_t ofs = sps_scale(ir->s);  /* Use spill slot or temp slots. */
 695#if LJ_64
 696      if ((ci->flags & CCI_CASTU64)) {
 697	Reg dest = ir->r;
 698	if (ra_hasreg(dest)) {
 699	  ra_free(as, dest);
 700	  ra_modified(as, dest);
 701	  emit_rr(as, XO_MOVD, dest|REX_64, RID_RET);  /* Really MOVQ. */
 702	}
 703	if (ofs) emit_movtomro(as, RID_RET|REX_64, RID_ESP, ofs);
 704      } else {
 705	ra_destreg(as, ir, RID_FPRET);
 706      }
 707#else
 708      /* Number result is in x87 st0 for x86 calling convention. */
 709      Reg dest = ir->r;
 710      if (ra_hasreg(dest)) {
 711	ra_free(as, dest);
 712	ra_modified(as, dest);
 713	emit_rmro(as, irt_isnum(ir->t) ? XO_MOVSD : XO_MOVSS,
 714		  dest, RID_ESP, ofs);
 715      }
 716      if ((ci->flags & CCI_CASTU64)) {
 717	emit_movtomro(as, RID_RETLO, RID_ESP, ofs);
 718	emit_movtomro(as, RID_RETHI, RID_ESP, ofs+4);
 719      } else {
 720	emit_rmro(as, irt_isnum(ir->t) ? XO_FSTPq : XO_FSTPd,
 721		  irt_isnum(ir->t) ? XOg_FSTPq : XOg_FSTPd, RID_ESP, ofs);
 722      }
 723#endif
 724    } else if (hiop) {
 725      ra_destpair(as, ir);
 726    } else {
 727      lj_assertA(!irt_ispri(ir->t), "PRI dest");
 728      ra_destreg(as, ir, RID_RET);
 729    }
 730  } else if (LJ_32 && irt_isfp(ir->t) && !(ci->flags & CCI_CASTU64)) {
 731    emit_x87op(as, XI_FPOP);  /* Pop unused result from x87 st0. */
 732  }
 733}
 734
 735/* Return a constant function pointer or NULL for indirect calls. */
 736static void *asm_callx_func(ASMState *as, IRIns *irf, IRRef func)
 737{
 738#if LJ_32
 739  UNUSED(as);
 740  if (irref_isk(func))
 741    return (void *)irf->i;
 742#else
 743  if (irref_isk(func)) {
 744    MCode *p;
 745    if (irf->o == IR_KINT64)
 746      p = (MCode *)(void *)ir_k64(irf)->u64;
 747    else
 748      p = (MCode *)(void *)(uintptr_t)(uint32_t)irf->i;
 749    if (jmprel_ok(p, as->mcp))
 750      return p;  /* Call target is still in +-2GB range. */
 751    /* Avoid the indirect case of emit_call(). Try to hoist func addr. */
 752  }
 753#endif
 754  return NULL;
 755}
 756
 757static void asm_callx(ASMState *as, IRIns *ir)
 758{
 759  IRRef args[CCI_NARGS_MAX*2];
 760  CCallInfo ci;
 761  IRRef func;
 762  IRIns *irf;
 763  int32_t spadj = 0;
 764  ci.flags = asm_callx_flags(as, ir);
 765  asm_collectargs(as, ir, &ci, args);
 766  asm_setupresult(as, ir, &ci);
 767#if LJ_32
 768  /* Have to readjust stack after non-cdecl calls due to callee cleanup. */
 769  if ((ci.flags & CCI_CC_MASK) != CCI_CC_CDECL)
 770    spadj = 4 * asm_count_call_slots(as, &ci, args);
 771#endif
 772  func = ir->op2; irf = IR(func);
 773  if (irf->o == IR_CARG) { func = irf->op1; irf = IR(func); }
 774  ci.func = (ASMFunction)asm_callx_func(as, irf, func);
 775  if (!(void *)ci.func) {
 776    /* Use a (hoistable) non-scratch register for indirect calls. */
 777    RegSet allow = (RSET_GPR & ~RSET_SCRATCH);
 778    Reg r = ra_alloc1(as, func, allow);
 779    if (LJ_32) emit_spsub(as, spadj);  /* Above code may cause restores! */
 780    emit_rr(as, XO_GROUP5, XOg_CALL, r);
 781  } else if (LJ_32) {
 782    emit_spsub(as, spadj);
 783  }
 784  asm_gencall(as, &ci, args);
 785}
 786
 787/* -- Returns ------------------------------------------------------------- */
 788
 789/* Return to lower frame. Guard that it goes to the right spot. */
 790static void asm_retf(ASMState *as, IRIns *ir)
 791{
 792  Reg base = ra_alloc1(as, REF_BASE, RSET_GPR);
 793#if LJ_FR2
 794  Reg rpc = ra_scratch(as, rset_exclude(RSET_GPR, base));
 795#endif
 796  void *pc = ir_kptr(IR(ir->op2));
 797  int32_t delta = 1+LJ_FR2+bc_a(*((const BCIns *)pc - 1));
 798  as->topslot -= (BCReg)delta;
 799  if ((int32_t)as->topslot < 0) as->topslot = 0;
 800  irt_setmark(IR(REF_BASE)->t);  /* Children must not coalesce with BASE reg. */
 801  emit_setgl(as, base, jit_base);
 802  emit_addptr(as, base, -8*delta);
 803  asm_guardcc(as, CC_NE);
 804#if LJ_FR2
 805  emit_rmro(as, XO_CMP, rpc|REX_GC64, base, -8);
 806  emit_loadu64(as, rpc, u64ptr(pc));
 807#else
 808  emit_gmroi(as, XG_ARITHi(XOg_CMP), base, -4, ptr2addr(pc));
 809#endif
 810}
 811
 812/* -- Buffer operations --------------------------------------------------- */
 813
 814#if LJ_HASBUFFER
 815static void asm_bufhdr_write(ASMState *as, Reg sb)
 816{
 817  Reg tmp = ra_scratch(as, rset_exclude(RSET_GPR, sb));
 818  IRIns irgc;
 819  irgc.ot = IRT(0, IRT_PGC);  /* GC type. */
 820  emit_storeofs(as, &irgc, tmp, sb, offsetof(SBuf, L));
 821  emit_opgl(as, XO_ARITH(XOg_OR), tmp|REX_GC64, cur_L);
 822  emit_gri(as, XG_ARITHi(XOg_AND), tmp, SBUF_MASK_FLAG);
 823  emit_loadofs(as, &irgc, tmp, sb, offsetof(SBuf, L));
 824}
 825#endif
 826
 827/* -- Type conversions ---------------------------------------------------- */
 828
 829static void asm_tointg(ASMState *as, IRIns *ir, Reg left)
 830{
 831  Reg tmp = ra_scratch(as, rset_exclude(RSET_FPR, left));
 832  Reg dest = ra_dest(as, ir, RSET_GPR);
 833  asm_guardcc(as, CC_P);
 834  asm_guardcc(as, CC_NE);
 835  emit_rr(as, XO_UCOMISD, left, tmp);
 836  emit_rr(as, XO_CVTSI2SD, tmp, dest);
 837  emit_rr(as, XO_XORPS, tmp, tmp);  /* Avoid partial register stall. */
 838  checkmclim(as);
 839  emit_rr(as, XO_CVTTSD2SI, dest, left);
 840  /* Can't fuse since left is needed twice. */
 841}
 842
 843static void asm_tobit(ASMState *as, IRIns *ir)
 844{
 845  Reg dest = ra_dest(as, ir, RSET_GPR);
 846  Reg tmp = ra_noreg(IR(ir->op1)->r) ?
 847	      ra_alloc1(as, ir->op1, RSET_FPR) :
 848	      ra_scratch(as, RSET_FPR);
 849  Reg right;
 850  emit_rr(as, XO_MOVDto, tmp, dest);
 851  right = asm_fuseload(as, ir->op2, rset_exclude(RSET_FPR, tmp));
 852  emit_mrm(as, XO_ADDSD, tmp, right);
 853  ra_left(as, tmp, ir->op1);
 854}
 855
 856static void asm_conv(ASMState *as, IRIns *ir)
 857{
 858  IRType st = (IRType)(ir->op2 & IRCONV_SRCMASK);
 859  int st64 = (st == IRT_I64 || st == IRT_U64 || (LJ_64 && st == IRT_P64));
 860  int stfp = (st == IRT_NUM || st == IRT_FLOAT);
 861  IRRef lref = ir->op1;
 862  lj_assertA(irt_type(ir->t) != st, "inconsistent types for CONV");
 863  lj_assertA(!(LJ_32 && (irt_isint64(ir->t) || st64)),
 864	     "IR %04d has unsplit 64 bit type",
 865	     (int)(ir - as->ir) - REF_BIAS);
 866  if (irt_isfp(ir->t)) {
 867    Reg dest = ra_dest(as, ir, RSET_FPR);
 868    if (stfp) {  /* FP to FP conversion. */
 869      Reg left = asm_fuseload(as, lref, RSET_FPR);
 870      emit_mrm(as, st == IRT_NUM ? XO_CVTSD2SS : XO_CVTSS2SD, dest, left);
 871      if (left == dest) return;  /* Avoid the XO_XORPS. */
 872    } else if (LJ_32 && st == IRT_U32) {  /* U32 to FP conversion on x86. */
 873      /* number = (2^52+2^51 .. u32) - (2^52+2^51) */
 874      cTValue *k = &as->J->k64[LJ_K64_TOBIT];
 875      Reg bias = ra_scratch(as, rset_exclude(RSET_FPR, dest));
 876      if (irt_isfloat(ir->t))
 877	emit_rr(as, XO_CVTSD2SS, dest, dest);
 878      emit_rr(as, XO_SUBSD, dest, bias);  /* Subtract 2^52+2^51 bias. */
 879      emit_rr(as, XO_XORPS, dest, bias);  /* Merge bias and integer. */
 880      emit_rma(as, XO_MOVSD, bias, k);
 881      checkmclim(as);
 882      emit_mrm(as, XO_MOVD, dest, asm_fuseload(as, lref, RSET_GPR));
 883      return;
 884    } else {  /* Integer to FP conversion. */
 885      Reg left = (LJ_64 && (st == IRT_U32 || st == IRT_U64)) ?
 886		 ra_alloc1(as, lref, RSET_GPR) :
 887		 asm_fuseloadm(as, lref, RSET_GPR, st64);
 888      if (LJ_64 && st == IRT_U64) {
 889	MCLabel l_end = emit_label(as);
 890	cTValue *k = &as->J->k64[LJ_K64_2P64];
 891	emit_rma(as, XO_ADDSD, dest, k);  /* Add 2^64 to compensate. */
 892	emit_sjcc(as, CC_NS, l_end);
 893	emit_rr(as, XO_TEST, left|REX_64, left);  /* Check if u64 >= 2^63. */
 894      }
 895      emit_mrm(as, irt_isnum(ir->t) ? XO_CVTSI2SD : XO_CVTSI2SS,
 896	       dest|((LJ_64 && (st64 || st == IRT_U32)) ? REX_64 : 0), left);
 897    }
 898    emit_rr(as, XO_XORPS, dest, dest);  /* Avoid partial register stall. */
 899  } else if (stfp) {  /* FP to integer conversion. */
 900    if (irt_isguard(ir->t)) {
 901      /* Checked conversions are only supported from number to int. */
 902      lj_assertA(irt_isint(ir->t) && st == IRT_NUM,
 903		 "bad type for checked CONV");
 904      asm_tointg(as, ir, ra_alloc1(as, lref, RSET_FPR));
 905    } else {
 906      Reg dest = ra_dest(as, ir, RSET_GPR);
 907      x86Op op = st == IRT_NUM ? XO_CVTTSD2SI : XO_CVTTSS2SI;
 908      lj_assertA(!irt_isu32(ir->t), "bad CONV u32.fp emitted");
 909#if LJ_64
 910      if (irt_isu64(ir->t)) {
 911	/* For the indefinite result -2^63, add -2^64 and convert again. */
 912	Reg tmp = ra_noreg(IR(lref)->r) ? ra_alloc1(as, lref, RSET_FPR) :
 913					  ra_scratch(as, RSET_FPR);
 914	MCLabel l_end = emit_label(as);
 915	emit_rr(as, op, dest|REX_64, tmp);
 916	if (st == IRT_NUM)
 917	  emit_rma(as, XO_ADDSD, tmp, &as->J->k64[LJ_K64_M2P64]);
 918	else
 919	  emit_rma(as, XO_ADDSS, tmp, &as->J->k32[LJ_K32_M2P64]);
 920	emit_sjcc(as, CC_NO, l_end);
 921	emit_gmrmi(as, XG_ARITHi(XOg_CMP), dest|REX_64, 1);
 922	emit_rr(as, op, dest|REX_64, tmp);
 923	ra_left(as, tmp, lref);
 924
 925      } else
 926#endif
 927      {
 928	emit_mrm(as, op,
 929		 dest|((LJ_64 && irt_is64(ir->t)) ? REX_64 : 0),
 930		 asm_fuseload(as, lref, RSET_FPR));
 931      }
 932    }
 933  } else if (st >= IRT_I8 && st <= IRT_U16) {  /* Extend to 32 bit integer. */
 934    Reg left, dest = ra_dest(as, ir, RSET_GPR);
 935    RegSet allow = RSET_GPR;
 936    x86Op op;
 937    lj_assertA(irt_isint(ir->t) || irt_isu32(ir->t), "bad type for CONV EXT");
 938    if (st == IRT_I8) {
 939      op = XO_MOVSXb; allow = RSET_GPR8; dest |= FORCE_REX;
 940    } else if (st == IRT_U8) {
 941      op = XO_MOVZXb; allow = RSET_GPR8; dest |= FORCE_REX;
 942    } else if (st == IRT_I16) {
 943      op = XO_MOVSXw;
 944    } else {
 945      op = XO_MOVZXw;
 946    }
 947    left = asm_fuseload(as, lref, allow);
 948    /* Add extra MOV if source is already in wrong register. */
 949    if (!LJ_64 && left != RID_MRM && !rset_test(allow, left)) {
 950      Reg tmp = ra_scratch(as, allow);
 951      emit_rr(as, op, dest, tmp);
 952      emit_rr(as, XO_MOV, tmp, left);
 953    } else {
 954      emit_mrm(as, op, dest, left);
 955    }
 956  } else {  /* 32/64 bit integer conversions. */
 957    if (LJ_32) {  /* Only need to handle 32/32 bit no-op (cast) on x86. */
 958      Reg dest = ra_dest(as, ir, RSET_GPR);
 959      ra_left(as, dest, lref);  /* Do nothing, but may need to move regs. */
 960    } else if (irt_is64(ir->t)) {
 961      Reg dest = ra_dest(as, ir, RSET_GPR);
 962      if (st64 || !(ir->op2 & IRCONV_SEXT)) {
 963	/* 64/64 bit no-op (cast) or 32 to 64 bit zero extension. */
 964	ra_left(as, dest, lref);  /* Do nothing, but may need to move regs. */
 965      } else {  /* 32 to 64 bit sign extension. */
 966	Reg left = asm_fuseload(as, lref, RSET_GPR);
 967	emit_mrm(as, XO_MOVSXd, dest|REX_64, left);
 968      }
 969    } else {
 970      Reg dest = ra_dest(as, ir, RSET_GPR);
 971      if (st64 && !(ir->op2 & IRCONV_NONE)) {
 972	Reg left = asm_fuseload(as, lref, RSET_GPR);
 973	/* This is either a 32 bit reg/reg mov which zeroes the hiword
 974	** or a load of the loword from a 64 bit address.
 975	*/
 976	emit_mrm(as, XO_MOV, dest, left);
 977      } else {  /* 32/32 bit no-op (cast). */
 978	ra_left(as, dest, lref);  /* Do nothing, but may need to move regs. */
 979      }
 980    }
 981  }
 982}
 983
 984#if LJ_32 && LJ_HASFFI
 985/* No SSE conversions to/from 64 bit on x86, so resort to ugly x87 code. */
 986
 987/* 64 bit integer to FP conversion in 32 bit mode. */
 988static void asm_conv_fp_int64(ASMState *as, IRIns *ir)
 989{
 990  Reg hi = ra_alloc1(as, ir->op1, RSET_GPR);
 991  Reg lo = ra_alloc1(as, (ir-1)->op1, rset_exclude(RSET_GPR, hi));
 992  int32_t ofs = sps_scale(ir->s);  /* Use spill slot or temp slots. */
 993  Reg dest = ir->r;
 994  if (ra_hasreg(dest)) {
 995    ra_free(as, dest);
 996    ra_modified(as, dest);
 997    emit_rmro(as, irt_isnum(ir->t) ? XO_MOVSD : XO_MOVSS, dest, RID_ESP, ofs);
 998  }
 999  emit_rmro(as, irt_isnum(ir->t) ? XO_FSTPq : XO_FSTPd,
1000	    irt_isnum(ir->t) ? XOg_FSTPq : XOg_FSTPd, RID_ESP, ofs);
1001  if (((ir-1)->op2 & IRCONV_SRCMASK) == IRT_U64) {
1002    /* For inputs in [2^63,2^64-1] add 2^64 to compensate. */
1003    MCLabel l_end = emit_label(as);
1004    emit_rma(as, XO_FADDq, XOg_FADDq, &as->J->k64[LJ_K64_2P64]);
1005    emit_sjcc(as, CC_NS, l_end);
1006    emit_rr(as, XO_TEST, hi, hi);  /* Check if u64 >= 2^63. */
1007  } else {
1008    lj_assertA(((ir-1)->op2 & IRCONV_SRCMASK) == IRT_I64, "bad type for CONV");
1009  }
1010  emit_rmro(as, XO_FILDq, XOg_FILDq, RID_ESP, 0);
1011  /* NYI: Avoid narrow-to-wide store-to-load forwarding stall. */
1012  emit_rmro(as, XO_MOVto, hi, RID_ESP, 4);
1013  emit_rmro(as, XO_MOVto, lo, RID_ESP, 0);
1014}
1015
1016/* FP to 64 bit integer conversion in 32 bit mode. */
1017static void asm_conv_int64_fp(ASMState *as, IRIns *ir)
1018{
1019  IRType st = (IRType)((ir-1)->op2 & IRCONV_SRCMASK);
1020  IRType dt = (((ir-1)->op2 & IRCONV_DSTMASK) >> IRCONV_DSH);
1021  Reg lo, hi;
1022  int usehi = ra_used(ir);
1023  lj_assertA(st == IRT_NUM || st == IRT_FLOAT, "bad type for CONV");
1024  lj_assertA(dt == IRT_I64 || dt == IRT_U64, "bad type for CONV");
1025  hi = ra_dest(as, ir, RSET_GPR);
1026  lo = ra_dest(as, ir-1, rset_exclude(RSET_GPR, hi));
1027  if (ra_used(ir-1)) emit_rmro(as, XO_MOV, lo, RID_ESP, 0);
1028  /* NYI: Avoid wide-to-narrow store-to-load forwarding stall. */
1029  if (!(as->flags & JIT_F_SSE3)) {  /* Set FPU rounding mode to default. */
1030    emit_rmro(as, XO_FLDCW, XOg_FLDCW, RID_ESP, 4);
1031    emit_rmro(as, XO_MOVto, lo, RID_ESP, 4);
1032    emit_gri(as, XG_ARITHi(XOg_AND), lo, 0xf3ff);
1033  }
1034  if (dt == IRT_U64) {
1035    /* For the indefinite result -2^63, add -2^64 and convert again. */
1036    MCLabel l_pop, l_end = emit_label(as);
1037    emit_x87op(as, XI_FPOP);
1038    l_pop = emit_label(as);
1039    emit_sjmp(as, l_end);
1040    if (usehi) emit_rmro(as, XO_MOV, hi, RID_ESP, 4);
1041    if ((as->flags & JIT_F_SSE3))
1042      emit_rmro(as, XO_FISTTPq, XOg_FISTTPq, RID_ESP, 0);
1043    else
1044      emit_rmro(as, XO_FISTPq, XOg_FISTPq, RID_ESP, 0);
1045    emit_rma(as, XO_FADDd, XOg_FADDd, &as->J->k32[LJ_K32_M2P64]);
1046    emit_sjcc(as, CC_NE, l_pop);
1047    emit_gmroi(as, XG_ARITHi(XOg_CMP), RID_ESP, 0, 0);
1048    emit_sjcc(as, CC_NO, l_pop);
1049    emit_gmrmi(as, XG_ARITHi(XOg_CMP), hi, 1);
1050    usehi = 1;
1051  }
1052  if (usehi) emit_rmro(as, XO_MOV, hi, RID_ESP, 4);
1053  if ((as->flags & JIT_F_SSE3)) {  /* Truncation is easy with SSE3. */
1054    emit_rmro(as, XO_FISTTPq, XOg_FISTTPq, RID_ESP, 0);
1055  } else {  /* Otherwise set FPU rounding mode to truncate before the store. */
1056    emit_rmro(as, XO_FISTPq, XOg_FISTPq, RID_ESP, 0);
1057    emit_rmro(as, XO_FLDCW, XOg_FLDCW, RID_ESP, 0);
1058    emit_rmro(as, XO_MOVtow, lo, RID_ESP, 0);
1059    emit_rmro(as, XO_ARITHw(XOg_OR), lo, RID_ESP, 0);
1060    emit_loadi(as, lo, 0xc00);
1061    emit_rmro(as, XO_FNSTCW, XOg_FNSTCW, RID_ESP, 0);
1062  }
1063  if (dt == IRT_U64)
1064    emit_x87op(as, XI_FDUP);
1065  emit_mrm(as, st == IRT_NUM ? XO_FLDq : XO_FLDd,
1066	   st == IRT_NUM ? XOg_FLDq: XOg_FLDd,
1067	   asm_fuseload(as, ir->op1, RSET_EMPTY));
1068}
1069
1070static void asm_conv64(ASMState *as, IRIns *ir)
1071{
1072  if (irt_isfp(ir->t))
1073    asm_conv_fp_int64(as, ir);
1074  else
1075    asm_conv_int64_fp(as, ir);
1076}
1077#endif
1078
1079static void asm_strto(ASMState *as, IRIns *ir)
1080{
1081  /* Force a spill slot for the destination register (if any). */
1082  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_strscan_num];
1083  IRRef args[2];
1084  RegSet drop = RSET_SCRATCH;
1085  if ((drop & RSET_FPR) != RSET_FPR && ra_hasreg(ir->r))
1086    rset_set(drop, ir->r);  /* WIN64 doesn't spill all FPRs. */
1087  ra_evictset(as, drop);
1088  asm_guardcc(as, CC_E);
1089  emit_rr(as, XO_TEST, RID_RET, RID_RET);  /* Test return status. */
1090  args[0] = ir->op1;      /* GCstr *str */
1091  args[1] = ASMREF_TMP1;  /* TValue *n  */
1092  asm_gencall(as, ci, args);
1093  /* Store the result to the spill slot or temp slots. */
1094  emit_rmro(as, XO_LEA, ra_releasetmp(as, ASMREF_TMP1)|REX_64,
1095	    RID_ESP, sps_scale(ir->s));
1096}
1097
1098/* -- Memory references --------------------------------------------------- */
1099
1100/* Get pointer to TValue. */
1101static void asm_tvptr(ASMState *as, Reg dest, IRRef ref, MSize mode)
1102{
1103  if ((mode & IRTMPREF_IN1)) {
1104    IRIns *ir = IR(ref);
1105    if (irt_isnum(ir->t)) {
1106      if (irref_isk(ref) && !(mode & IRTMPREF_OUT1)) {
1107	/* Use the number constant itself as a TValue. */
1108	emit_loada(as, dest, ir_knum(ir));
1109	return;
1110      }
1111      emit_rmro(as, XO_MOVSDto, ra_alloc1(as, ref, RSET_FPR), dest, 0);
1112    } else {
1113#if LJ_GC64
1114      if (irref_isk(ref)) {
1115	TValue k;
1116	lj_ir_kvalue(as->J->L, &k, ir);
1117	emit_movmroi(as, dest, 4, k.u32.hi);
1118	emit_movmroi(as, dest, 0, k.u32.lo);
1119      } else {
1120	/* TODO: 64 bit store + 32 bit load-modify-store is suboptimal. */
1121	Reg src = ra_alloc1(as, ref, rset_exclude(RSET_GPR, dest));
1122	if (irt_is64(ir->t)) {
1123	  emit_u32(as, irt_toitype(ir->t) << 15);
1124	  emit_rmro(as, XO_ARITHi, XOg_OR, dest, 4);
1125	} else {
1126	  emit_movmroi(as, dest, 4, (irt_toitype(ir->t) << 15));
1127	}
1128	emit_movtomro(as, REX_64IR(ir, src), dest, 0);
1129      }
1130#else
1131      if (!irref_isk(ref)) {
1132	Reg src = ra_alloc1(as, ref, rset_exclude(RSET_GPR, dest));
1133	emit_movtomro(as, REX_64IR(ir, src), dest, 0);
1134      } else if (!irt_ispri(ir->t)) {
1135	emit_movmroi(as, dest, 0, ir->i);
1136      }
1137      if (!(LJ_64 && irt_islightud(ir->t)))
1138	emit_movmroi(as, dest, 4, irt_toitype(ir->t));
1139#endif
1140    }
1141  }
1142  emit_loada(as, dest, &J2G(as->J)->tmptv); /* g->tmptv holds the TValue(s). */
1143}
1144
1145static void asm_aref(ASMState *as, IRIns *ir)
1146{
1147  Reg dest = ra_dest(as, ir, RSET_GPR);
1148  asm_fusearef(as, ir, RSET_GPR);
1149  if (!(as->mrm.idx == RID_NONE && as->mrm.ofs == 0))
1150    emit_mrm(as, XO_LEA, dest|REX_GC64, RID_MRM);
1151  else if (as->mrm.base != dest)
1152    emit_rr(as, XO_MOV, dest|REX_GC64, as->mrm.base);
1153}
1154
1155/* Inlined hash lookup. Specialized for key type and for const keys.
1156** The equivalent C code is:
1157**   Node *n = hashkey(t, key);
1158**   do {
1159**     if (lj_obj_equal(&n->key, key)) return &n->val;
1160**   } while ((n = nextnode(n)));
1161**   return niltv(L);
1162*/
1163static void asm_href(ASMState *as, IRIns *ir, IROp merge)
1164{
1165  RegSet allow = RSET_GPR;
1166  int destused = ra_used(ir);
1167  Reg dest = ra_dest(as, ir, allow);
1168  Reg tab = ra_alloc1(as, ir->op1, rset_clear(allow, dest));
1169  Reg key = RID_NONE, tmp = RID_NONE;
1170  IRIns *irkey = IR(ir->op2);
1171  int isk = irref_isk(ir->op2);
1172  IRType1 kt = irkey->t;
1173  uint32_t khash;
1174  MCLabel l_end, l_loop, l_next;
1175
1176  if (!isk) {
1177    rset_clear(allow, tab);
1178    key = ra_alloc1(as, ir->op2, irt_isnum(kt) ? RSET_FPR : allow);
1179    if (LJ_GC64 || !irt_isstr(kt))
1180      tmp = ra_scratch(as, rset_exclude(allow, key));
1181  }
1182
1183  /* Key not found in chain: jump to exit (if merged) or load niltv. */
1184  l_end = emit_label(as);
1185  if (merge == IR_NE)
1186    asm_guardcc(as, CC_E);  /* XI_JMP is not found by lj_asm_patchexit. */
1187  else if (destused)
1188    emit_loada(as, dest, niltvg(J2G(as->J)));
1189
1190  /* Follow hash chain until the end. */
1191  l_loop = emit_sjcc_label(as, CC_NZ);
1192  emit_rr(as, XO_TEST, dest|REX_GC64, dest);
1193  emit_rmro(as, XO_MOV, dest|REX_GC64, dest, offsetof(Node, next));
1194  l_next = emit_label(as);
1195
1196  /* Type and value comparison. */
1197  if (merge == IR_EQ)
1198    asm_guardcc(as, CC_E);
1199  else
1200    emit_sjcc(as, CC_E, l_end);
1201  checkmclim(as);
1202  if (irt_isnum(kt)) {
1203    if (isk) {
1204      /* Assumes -0.0 is already canonicalized to +0.0. */
1205      emit_gmroi(as, XG_ARITHi(XOg_CMP), dest, offsetof(Node, key.u32.lo),
1206		 (int32_t)ir_knum(irkey)->u32.lo);
1207      emit_sjcc(as, CC_NE, l_next);
1208      emit_gmroi(as, XG_ARITHi(XOg_CMP), dest, offsetof(Node, key.u32.hi),
1209		 (int32_t)ir_knum(irkey)->u32.hi);
1210    } else {
1211      emit_sjcc(as, CC_P, l_next);
1212      emit_rmro(as, XO_UCOMISD, key, dest, offsetof(Node, key.n));
1213      emit_sjcc(as, CC_AE, l_next);
1214      /* The type check avoids NaN penalties and complaints from Valgrind. */
1215#if LJ_64 && !LJ_GC64
1216      emit_u32(as, LJ_TISNUM);
1217      emit_rmro(as, XO_ARITHi, XOg_CMP, dest, offsetof(Node, key.it));
1218#else
1219      emit_i8(as, LJ_TISNUM);
1220      emit_rmro(as, XO_ARITHi8, XOg_CMP, dest, offsetof(Node, key.it));
1221#endif
1222    }
1223#if LJ_64 && !LJ_GC64
1224  } else if (irt_islightud(kt)) {
1225    emit_rmro(as, XO_CMP, key|REX_64, dest, offsetof(Node, key.u64));
1226#endif
1227#if LJ_GC64
1228  } else if (irt_isaddr(kt)) {
1229    if (isk) {
1230      TValue k;
1231      k.u64 = ((uint64_t)irt_toitype(irkey->t) << 47) | irkey[1].tv.u64;
1232      emit_gmroi(as, XG_ARITHi(XOg_CMP), dest, offsetof(Node, key.u32.lo),
1233		 k.u32.lo);
1234      emit_sjcc(as, CC_NE, l_next);
1235      emit_gmroi(as, XG_ARITHi(XOg_CMP), dest, offsetof(Node, key.u32.hi),
1236		 k.u32.hi);
1237    } else {
1238      emit_rmro(as, XO_CMP, tmp|REX_64, dest, offsetof(Node, key.u64));
1239    }
1240  } else {
1241    lj_assertA(irt_ispri(kt) && !irt_isnil(kt), "bad HREF key type");
1242    emit_u32(as, (irt_toitype(kt)<<15)|0x7fff);
1243    emit_rmro(as, XO_ARITHi, XOg_CMP, dest, offsetof(Node, key.it));
1244#else
1245  } else {
1246    if (!irt_ispri(kt)) {
1247      lj_assertA(irt_isaddr(kt), "bad HREF key type");
1248      if (isk)
1249	emit_gmroi(as, XG_ARITHi(XOg_CMP), dest, offsetof(Node, key.gcr),
1250		   ptr2addr(ir_kgc(irkey)));
1251      else
1252	emit_rmro(as, XO_CMP, key, dest, offsetof(Node, key.gcr));
1253      emit_sjcc(as, CC_NE, l_next);
1254    }
1255    lj_assertA(!irt_isnil(kt), "bad HREF key type");
1256    emit_i8(as, irt_toitype(kt));
1257    emit_rmro(as, XO_ARITHi8, XOg_CMP, dest, offsetof(Node, key.it));
1258#endif
1259  }
1260  emit_sfixup(as, l_loop);
1261#if LJ_GC64
1262  if (!isk && irt_isaddr(kt)) {
1263    emit_rr(as, XO_OR, tmp|REX_64, key);
1264    emit_loadu64(as, tmp, (uint64_t)irt_toitype(kt) << 47);
1265  }
1266#endif
1267
1268  /* Load main position relative to tab->node into dest. */
1269  khash = isk ? ir_khash(as, irkey) : 1;
1270  if (khash == 0) {
1271    emit_rmro(as, XO_MOV, dest|REX_GC64, tab, offsetof(GCtab, node));
1272  } else {
1273    emit_rmro(as, XO_ARITH(XOg_ADD), dest|REX_GC64, tab, offsetof(GCtab,node));
1274    emit_shifti(as, XOg_SHL, dest, 3);
1275    emit_rmrxo(as, XO_LEA, dest, dest, dest, XM_SCALE2, 0);
1276    if (isk) {
1277      emit_gri(as, XG_ARITHi(XOg_AND), dest, (int32_t)khash);
1278      emit_rmro(as, XO_MOV, dest, tab, offsetof(GCtab, hmask));
1279    } else if (irt_isstr(kt)) {
1280      emit_rmro(as, XO_ARITH(XOg_AND), dest, key, offsetof(GCstr, sid));
1281      emit_rmro(as, XO_MOV, dest, tab, offsetof(GCtab, hmask));
1282    } else {  /* Must match with hashrot() in lj_tab.c. */
1283      emit_rmro(as, XO_ARITH(XOg_AND), dest, tab, offsetof(GCtab, hmask));
1284      emit_rr(as, XO_ARITH(XOg_SUB), dest, tmp);
1285      emit_shifti(as, XOg_ROL, tmp, HASH_ROT3);
1286      emit_rr(as, XO_ARITH(XOg_XOR), dest, tmp);
1287      checkmclim(as);
1288      emit_shifti(as, XOg_ROL, dest, HASH_ROT2);
1289      emit_rr(as, XO_ARITH(XOg_SUB), tmp, dest);
1290      emit_shifti(as, XOg_ROL, dest, HASH_ROT1);
1291      emit_rr(as, XO_ARITH(XOg_XOR), tmp, dest);
1292      if (irt_isnum(kt)) {
1293	emit_rr(as, XO_ARITH(XOg_ADD), dest, dest);
1294#if LJ_64
1295	emit_shifti(as, XOg_SHR|REX_64, dest, 32);
1296	emit_rr(as, XO_MOV, tmp, dest);
1297	emit_rr(as, XO_MOVDto, key|REX_64, dest);
1298#else
1299	emit_rmro(as, XO_MOV, dest, RID_ESP, ra_spill(as, irkey)+4);
1300	emit_rr(as, XO_MOVDto, key, tmp);
1301#endif
1302      } else {
1303	emit_rr(as, XO_MOV, tmp, key);
1304#if LJ_GC64
1305	emit_gri(as, XG_ARITHi(XOg_XOR), dest, irt_toitype(kt) << 15);
1306	if ((as->flags & JIT_F_BMI2)) {
1307	  emit_i8(as, 32);
1308	  emit_mrm(as, XV_RORX|VEX_64, dest, key);
1309	} else {
1310	  emit_shifti(as, XOg_SHR|REX_64, dest, 32);
1311	  emit_rr(as, XO_MOV, dest|REX_64, key|REX_64);
1312	}
1313#else
1314	emit_rmro(as, XO_LEA, dest, key, HASH_BIAS);
1315#endif
1316      }
1317    }
1318  }
1319}
1320
1321static void asm_hrefk(ASMState *as, IRIns *ir)
1322{
1323  IRIns *kslot = IR(ir->op2);
1324  IRIns *irkey = IR(kslot->op1);
1325  int32_t ofs = (int32_t)(kslot->op2 * sizeof(Node));
1326  Reg dest = ra_used(ir) ? ra_dest(as, ir, RSET_GPR) : RID_NONE;
1327  Reg node = ra_alloc1(as, ir->op1, RSET_GPR);
1328#if !LJ_64
1329  MCLabel l_exit;
1330#endif
1331  lj_assertA(ofs % sizeof(Node) == 0, "unaligned HREFK slot");
1332  if (ra_hasreg(dest)) {
1333    if (ofs != 0) {
1334      if (dest == node)
1335	emit_gri(as, XG_ARITHi(XOg_ADD), dest|REX_GC64, ofs);
1336      else
1337	emit_rmro(as, XO_LEA, dest|REX_GC64, node, ofs);
1338    } else if (dest != node) {
1339      emit_rr(as, XO_MOV, dest|REX_GC64, node);
1340    }
1341  }
1342  asm_guardcc(as, CC_NE);
1343#if LJ_64
1344  if (!irt_ispri(irkey->t)) {
1345    Reg key = ra_scratch(as, rset_exclude(RSET_GPR, node));
1346    emit_rmro(as, XO_CMP, key|REX_64, node,
1347	       ofs + (int32_t)offsetof(Node, key.u64));
1348    lj_assertA(irt_isnum(irkey->t) || irt_isgcv(irkey->t),
1349	       "bad HREFK key type");
1350    /* Assumes -0.0 is already canonicalized to +0.0. */
1351    emit_loadu64(as, key, irt_isnum(irkey->t) ? ir_knum(irkey)->u64 :
1352#if LJ_GC64
1353			  ((uint64_t)irt_toitype(irkey->t) << 47) |
1354			  (uint64_t)ir_kgc(irkey));
1355#else
1356			  ((uint64_t)irt_toitype(irkey->t) << 32) |
1357			  (uint64_t)(uint32_t)ptr2addr(ir_kgc(irkey)));
1358#endif
1359  } else {
1360    lj_assertA(!irt_isnil(irkey->t), "bad HREFK key type");
1361#if LJ_GC64
1362    emit_i32(as, (irt_toitype(irkey->t)<<15)|0x7fff);
1363    emit_rmro(as, XO_ARITHi, XOg_CMP, node,
1364	      ofs + (int32_t)offsetof(Node, key.it));
1365#else
1366    emit_i8(as, irt_toitype(irkey->t));
1367    emit_rmro(as, XO_ARITHi8, XOg_CMP, node,
1368	      ofs + (int32_t)offsetof(Node, key.it));
1369#endif
1370  }
1371#else
1372  l_exit = emit_label(as);
1373  if (irt_isnum(irkey->t)) {
1374    /* Assumes -0.0 is already canonicalized to +0.0. */
1375    emit_gmroi(as, XG_ARITHi(XOg_CMP), node,
1376	       ofs + (int32_t)offsetof(Node, key.u32.lo),
1377	       (int32_t)ir_knum(irkey)->u32.lo);
1378    emit_sjcc(as, CC_NE, l_exit);
1379    emit_gmroi(as, XG_ARITHi(XOg_CMP), node,
1380	       ofs + (int32_t)offsetof(Node, key.u32.hi),
1381	       (int32_t)ir_knum(irkey)->u32.hi);
1382  } else {
1383    if (!irt_ispri(irkey->t)) {
1384      lj_assertA(irt_isgcv(irkey->t), "bad HREFK key type");
1385      emit_gmroi(as, XG_ARITHi(XOg_CMP), node,
1386		 ofs + (int32_t)offsetof(Node, key.gcr),
1387		 ptr2addr(ir_kgc(irkey)));
1388      emit_sjcc(as, CC_NE, l_exit);
1389    }
1390    lj_assertA(!irt_isnil(irkey->t), "bad HREFK key type");
1391    emit_i8(as, irt_toitype(irkey->t));
1392    emit_rmro(as, XO_ARITHi8, XOg_CMP, node,
1393	      ofs + (int32_t)offsetof(Node, key.it));
1394  }
1395#endif
1396}
1397
1398static void asm_uref(ASMState *as, IRIns *ir)
1399{
1400  Reg dest = ra_dest(as, ir, RSET_GPR);
1401  int guarded = (irt_t(ir->t) & (IRT_GUARD|IRT_TYPE)) == (IRT_GUARD|IRT_PGC);
1402  if (irref_isk(ir->op1) && !guarded) {
1403    GCfunc *fn = ir_kfunc(IR(ir->op1));
1404    MRef *v = &gcref(fn->l.uvptr[(ir->op2 >> 8)])->uv.v;
1405    emit_rma(as, XO_MOV, dest|REX_GC64, v);
1406  } else {
1407    Reg uv = ra_scratch(as, RSET_GPR);
1408    if (ir->o == IR_UREFC)
1409      emit_rmro(as, XO_LEA, dest|REX_GC64, uv, offsetof(GCupval, tv));
1410    else
1411      emit_rmro(as, XO_MOV, dest|REX_GC64, uv, offsetof(GCupval, v));
1412    if (guarded) {
1413      asm_guardcc(as, ir->o == IR_UREFC ? CC_E : CC_NE);
1414      emit_i8(as, 0);
1415      emit_rmro(as, XO_ARITHib, XOg_CMP, uv, offsetof(GCupval, closed));
1416    }
1417    if (irref_isk(ir->op1)) {
1418      GCfunc *fn = ir_kfunc(IR(ir->op1));
1419      GCobj *o = gcref(fn->l.uvptr[(ir->op2 >> 8)]);
1420      emit_loada(as, uv, o);
1421    } else {
1422      emit_rmro(as, XO_MOV, uv|REX_GC64, ra_alloc1(as, ir->op1, RSET_GPR),
1423	        (int32_t)offsetof(GCfuncL, uvptr) +
1424	        (int32_t)sizeof(MRef) * (int32_t)(ir->op2 >> 8));
1425    }
1426  }
1427}
1428
1429static void asm_fref(ASMState *as, IRIns *ir)
1430{
1431  Reg dest = ra_dest(as, ir, RSET_GPR);
1432  asm_fusefref(as, ir, RSET_GPR);
1433  emit_mrm(as, XO_LEA, dest, RID_MRM);
1434}
1435
1436static void asm_strref(ASMState *as, IRIns *ir)
1437{
1438  Reg dest = ra_dest(as, ir, RSET_GPR);
1439  asm_fusestrref(as, ir, RSET_GPR);
1440  if (as->mrm.base == RID_NONE)
1441    emit_loadi(as, dest, as->mrm.ofs);
1442  else if (as->mrm.base == dest && as->mrm.idx == RID_NONE)
1443    emit_gri(as, XG_ARITHi(XOg_ADD), dest|REX_GC64, as->mrm.ofs);
1444  else
1445    emit_mrm(as, XO_LEA, dest|REX_GC64, RID_MRM);
1446}
1447
1448/* -- Loads and stores ---------------------------------------------------- */
1449
1450static void asm_fxload(ASMState *as, IRIns *ir)
1451{
1452  Reg dest = ra_dest(as, ir, irt_isfp(ir->t) ? RSET_FPR : RSET_GPR);
1453  x86Op xo;
1454  if (ir->o == IR_FLOAD)
1455    asm_fusefref(as, ir, RSET_GPR);
1456  else
1457    asm_fusexref(as, ir->op1, RSET_GPR);
1458  /* ir->op2 is ignored -- unaligned loads are ok on x86. */
1459  switch (irt_type(ir->t)) {
1460  case IRT_I8: xo = XO_MOVSXb; break;
1461  case IRT_U8: xo = XO_MOVZXb; break;
1462  case IRT_I16: xo = XO_MOVSXw; break;
1463  case IRT_U16: xo = XO_MOVZXw; break;
1464  case IRT_NUM: xo = XO_MOVSD; break;
1465  case IRT_FLOAT: xo = XO_MOVSS; break;
1466  default:
1467    if (LJ_64 && irt_is64(ir->t))
1468      dest |= REX_64;
1469    else
1470      lj_assertA(irt_isint(ir->t) || irt_isu32(ir->t) || irt_isaddr(ir->t),
1471		 "unsplit 64 bit load");
1472    xo = XO_MOV;
1473    break;
1474  }
1475  emit_mrm(as, xo, dest, RID_MRM);
1476}
1477
1478#define asm_fload(as, ir)	asm_fxload(as, ir)
1479#define asm_xload(as, ir)	asm_fxload(as, ir)
1480
1481static void asm_fxstore(ASMState *as, IRIns *ir)
1482{
1483  RegSet allow = RSET_GPR;
1484  Reg src = RID_NONE, osrc = RID_NONE;
1485  int32_t k = 0;
1486  if (ir->r == RID_SINK)
1487    return;
1488  /* The IRT_I16/IRT_U16 stores should never be simplified for constant
1489  ** values since mov word [mem], imm16 has a length-changing prefix.
1490  */
1491  if (irt_isi16(ir->t) || irt_isu16(ir->t) || irt_isfp(ir->t) ||
1492      !asm_isk32(as, ir->op2, &k)) {
1493    RegSet allow8 = irt_isfp(ir->t) ? RSET_FPR :
1494		    (irt_isi8(ir->t) || irt_isu8(ir->t)) ? RSET_GPR8 : RSET_GPR;
1495    src = osrc = ra_alloc1(as, ir->op2, allow8);
1496    if (!LJ_64 && !rset_test(allow8, src)) {  /* Already in wrong register. */
1497      rset_clear(allow, osrc);
1498      src = ra_scratch(as, allow8);
1499    }
1500    rset_clear(allow, src);
1501  }
1502  if (ir->o == IR_FSTORE) {
1503    asm_fusefref(as, IR(ir->op1), allow);
1504  } else {
1505    asm_fusexref(as, ir->op1, allow);
1506    if (LJ_32 && ir->o == IR_HIOP) as->mrm.ofs += 4;
1507  }
1508  if (ra_hasreg(src)) {
1509    x86Op xo;
1510    switch (irt_type(ir->t)) {
1511    case IRT_I8: case IRT_U8: xo = XO_MOVtob; src |= FORCE_REX; break;
1512    case IRT_I16: case IRT_U16: xo = XO_MOVtow; break;
1513    case IRT_NUM: xo = XO_MOVSDto; break;
1514    case IRT_FLOAT: xo = XO_MOVSSto; break;
1515#if LJ_64 && !LJ_GC64
1516    case IRT_LIGHTUD:
1517      /* NYI: mask 64 bit lightuserdata. */
1518      lj_assertA(0, "store of lightuserdata");
1519#endif
1520    default:
1521      if (LJ_64 && irt_is64(ir->t))
1522	src |= REX_64;
1523      else
1524	lj_assertA(irt_isint(ir->t) || irt_isu32(ir->t) || irt_isaddr(ir->t),
1525		   "unsplit 64 bit store");
1526      xo = XO_MOVto;
1527      break;
1528    }
1529    emit_mrm(as, xo, src, RID_MRM);
1530    if (!LJ_64 && src != osrc) {
1531      ra_noweak(as, osrc);
1532      emit_rr(as, XO_MOV, src, osrc);
1533    }
1534  } else {
1535    if (irt_isi8(ir->t) || irt_isu8(ir->t)) {
1536      emit_i8(as, k);
1537      emit_mrm(as, XO_MOVmib, 0, RID_MRM);
1538    } else {
1539      lj_assertA(irt_is64(ir->t) || irt_isint(ir->t) || irt_isu32(ir->t) ||
1540		 irt_isaddr(ir->t), "bad store type");
1541      emit_i32(as, k);
1542      emit_mrm(as, XO_MOVmi, REX_64IR(ir, 0), RID_MRM);
1543    }
1544  }
1545}
1546
1547#define asm_fstore(as, ir)	asm_fxstore(as, ir)
1548#define asm_xstore(as, ir)	asm_fxstore(as, ir)
1549
1550#if LJ_64 && !LJ_GC64
1551static Reg asm_load_lightud64(ASMState *as, IRIns *ir, int typecheck)
1552{
1553  if (ra_used(ir) || typecheck) {
1554    Reg dest = ra_dest(as, ir, RSET_GPR);
1555    if (typecheck) {
1556      Reg tmp = ra_scratch(as, rset_exclude(RSET_GPR, dest));
1557      asm_guardcc(as, CC_NE);
1558      emit_i8(as, -2);
1559      emit_rr(as, XO_ARITHi8, XOg_CMP, tmp);
1560      emit_shifti(as, XOg_SAR|REX_64, tmp, 47);
1561      emit_rr(as, XO_MOV, tmp|REX_64, dest);
1562    }
1563    return dest;
1564  } else {
1565    return RID_NONE;
1566  }
1567}
1568#endif
1569
1570static void asm_ahuvload(ASMState *as, IRIns *ir)
1571{
1572#if LJ_GC64
1573  Reg tmp = RID_NONE;
1574#endif
1575  lj_assertA(irt_isnum(ir->t) || irt_ispri(ir->t) || irt_isaddr(ir->t) ||
1576	     (LJ_DUALNUM && irt_isint(ir->t)),
1577	     "bad load type %d", irt_type(ir->t));
1578#if LJ_64 && !LJ_GC64
1579  if (irt_islightud(ir->t)) {
1580    Reg dest = asm_load_lightud64(as, ir, 1);
1581    if (ra_hasreg(dest)) {
1582      checkmclim(as);
1583      asm_fuseahuref(as, ir->op1, RSET_GPR);
1584      if (ir->o == IR_VLOAD) as->mrm.ofs += 8 * ir->op2;
1585      emit_mrm(as, XO_MOV, dest|REX_64, RID_MRM);
1586    }
1587    return;
1588  } else
1589#endif
1590  if (ra_used(ir)) {
1591    RegSet allow = irt_isnum(ir->t) ? RSET_FPR : RSET_GPR;
1592    Reg dest = ra_dest(as, ir, allow);
1593    asm_fuseahuref(as, ir->op1, RSET_GPR);
1594    if (ir->o == IR_VLOAD) as->mrm.ofs += 8 * ir->op2;
1595#if LJ_GC64
1596    if (irt_isaddr(ir->t)) {
1597      emit_shifti(as, XOg_SHR|REX_64, dest, 17);
1598      asm_guardcc(as, CC_NE);
1599      emit_i8(as, irt_toitype(ir->t));
1600      emit_rr(as, XO_ARITHi8, XOg_CMP, dest);
1601      emit_i8(as, XI_O16);
1602      if ((as->flags & JIT_F_BMI2)) {
1603	emit_i8(as, 47);
1604	emit_mrm(as, XV_RORX|VEX_64, dest, RID_MRM);
1605      } else {
1606	emit_shifti(as, XOg_ROR|REX_64, dest, 47);
1607	emit_mrm(as, XO_MOV, dest|REX_64, RID_MRM);
1608      }
1609      return;
1610    } else
1611#endif
1612    emit_mrm(as, dest < RID_MAX_GPR ? XO_MOV : XO_MOVSD, dest, RID_MRM);
1613  } else {
1614    RegSet gpr = RSET_GPR;
1615#if LJ_GC64
1616    if (irt_isaddr(ir->t)) {
1617      tmp = ra_scratch(as, RSET_GPR);
1618      gpr = rset_exclude(gpr, tmp);
1619    }
1620#endif
1621    asm_fuseahuref(as, ir->op1, gpr);
1622    if (ir->o == IR_VLOAD) as->mrm.ofs += 8 * ir->op2;
1623  }
1624  /* Always do the type check, even if the load result is unused. */
1625  as->mrm.ofs += 4;
1626  asm_guardcc(as, irt_isnum(ir->t) ? CC_AE : CC_NE);
1627  if (LJ_64 && irt_type(ir->t) >= IRT_NUM) {
1628    lj_assertA(irt_isinteger(ir->t) || irt_isnum(ir->t),
1629	       "bad load type %d", irt_type(ir->t));
1630    checkmclim(as);
1631#if LJ_GC64
1632    emit_u32(as, LJ_TISNUM << 15);
1633#else
1634    emit_u32(as, LJ_TISNUM);
1635#endif
1636    emit_mrm(as, XO_ARITHi, XOg_CMP, RID_MRM);
1637#if LJ_GC64
1638  } else if (irt_isaddr(ir->t)) {
1639    as->mrm.ofs -= 4;
1640    emit_i8(as, irt_toitype(ir->t));
1641    emit_mrm(as, XO_ARITHi8, XOg_CMP, tmp);
1642    emit_shifti(as, XOg_SAR|REX_64, tmp, 47);
1643    emit_mrm(as, XO_MOV, tmp|REX_64, RID_MRM);
1644  } else if (irt_isnil(ir->t)) {
1645    as->mrm.ofs -= 4;
1646    emit_i8(as, -1);
1647    emit_mrm(as, XO_ARITHi8, XOg_CMP|REX_64, RID_MRM);
1648  } else {
1649    emit_u32(as, (irt_toitype(ir->t) << 15) | 0x7fff);
1650    emit_mrm(as, XO_ARITHi, XOg_CMP, RID_MRM);
1651#else
1652  } else {
1653    emit_i8(as, irt_toitype(ir->t));
1654    emit_mrm(as, XO_ARITHi8, XOg_CMP, RID_MRM);
1655#endif
1656  }
1657}
1658
1659static void asm_ahustore(ASMState *as, IRIns *ir)
1660{
1661  if (ir->r == RID_SINK)
1662    return;
1663  if (irt_isnum(ir->t)) {
1664    Reg src = ra_alloc1(as, ir->op2, RSET_FPR);
1665    asm_fuseahuref(as, ir->op1, RSET_GPR);
1666    emit_mrm(as, XO_MOVSDto, src, RID_MRM);
1667#if LJ_64 && !LJ_GC64
1668  } else if (irt_islightud(ir->t)) {
1669    Reg src = ra_alloc1(as, ir->op2, RSET_GPR);
1670    asm_fuseahuref(as, ir->op1, rset_exclude(RSET_GPR, src));
1671    emit_mrm(as, XO_MOVto, src|REX_64, RID_MRM);
1672#endif
1673#if LJ_GC64
1674  } else if (irref_isk(ir->op2)) {
1675    TValue k;
1676    lj_ir_kvalue(as->J->L, &k, IR(ir->op2));
1677    asm_fuseahuref(as, ir->op1, RSET_GPR);
1678    if (tvisnil(&k)) {
1679      emit_i32(as, -1);
1680      emit_mrm(as, XO_MOVmi, REX_64, RID_MRM);
1681    } else {
1682      emit_u32(as, k.u32.lo);
1683      emit_mrm(as, XO_MOVmi, 0, RID_MRM);
1684      as->mrm.ofs += 4;
1685      emit_u32(as, k.u32.hi);
1686      emit_mrm(as, XO_MOVmi, 0, RID_MRM);
1687    }
1688#endif
1689  } else {
1690    IRIns *irr = IR(ir->op2);
1691    RegSet allow = RSET_GPR;
1692    Reg src = RID_NONE;
1693    if (!irref_isk(ir->op2)) {
1694      src = ra_alloc1(as, ir->op2, allow);
1695      rset_clear(allow, src);
1696    }
1697    asm_fuseahuref(as, ir->op1, allow);
1698    if (ra_hasreg(src)) {
1699#if LJ_GC64
1700      if (!(LJ_DUALNUM && irt_isinteger(ir->t))) {
1701	/* TODO: 64 bit store + 32 bit load-modify-store is suboptimal. */
1702	as->mrm.ofs += 4;
1703	emit_u32(as, irt_toitype(ir->t) << 15);
1704	emit_mrm(as, XO_ARITHi, XOg_OR, RID_MRM);
1705	as->mrm.ofs -= 4;
1706	emit_mrm(as, XO_MOVto, src|REX_64, RID_MRM);
1707	return;
1708      }
1709#endif
1710      emit_mrm(as, XO_MOVto, src, RID_MRM);
1711    } else if (!irt_ispri(irr->t)) {
1712      lj_assertA(irt_isaddr(ir->t) || (LJ_DUALNUM && irt_isinteger(ir->t)),
1713		 "bad store type");
1714      emit_i32(as, irr->i);
1715      emit_mrm(as, XO_MOVmi, 0, RID_MRM);
1716    }
1717    as->mrm.ofs += 4;
1718#if LJ_GC64
1719    lj_assertA(LJ_DUALNUM && irt_isinteger(ir->t), "bad store type");
1720    emit_i32(as, LJ_TNUMX << 15);
1721#else
1722    emit_i32(as, (int32_t)irt_toitype(ir->t));
1723#endif
1724    emit_mrm(as, XO_MOVmi, 0, RID_MRM);
1725  }
1726}
1727
1728static void asm_sload(ASMState *as, IRIns *ir)
1729{
1730  int32_t ofs = 8*((int32_t)ir->op1-1-LJ_FR2) +
1731		(!LJ_FR2 && (ir->op2 & IRSLOAD_FRAME) ? 4 : 0);
1732  IRType1 t = ir->t;
1733  Reg base;
1734  lj_assertA(!(ir->op2 & IRSLOAD_PARENT),
1735	     "bad parent SLOAD"); /* Handled by asm_head_side(). */
1736  lj_assertA(irt_isguard(t) || !(ir->op2 & IRSLOAD_TYPECHECK),
1737	     "inconsistent SLOAD variant");
1738  lj_assertA(LJ_DUALNUM ||
1739	     !irt_isint(t) ||
1740	     (ir->op2 & (IRSLOAD_CONVERT|IRSLOAD_FRAME|IRSLOAD_KEYINDEX)),
1741	     "bad SLOAD type");
1742  if ((ir->op2 & IRSLOAD_CONVERT) && irt_isguard(t) && irt_isint(t)) {
1743    Reg left = ra_scratch(as, RSET_FPR);
1744    asm_tointg(as, ir, left);  /* Frees dest reg. Do this before base alloc. */
1745    base = ra_alloc1(as, REF_BASE, RSET_GPR);
1746    emit_rmro(as, XO_MOVSD, left, base, ofs);
1747    t.irt = IRT_NUM;  /* Continue with a regular number type check. */
1748#if LJ_64 && !LJ_GC64
1749  } else if (irt_islightud(t)) {
1750    Reg dest = asm_load_lightud64(as, ir, (ir->op2 & IRSLOAD_TYPECHECK));
1751    if (ra_hasreg(dest)) {
1752      base = ra_alloc1(as, REF_BASE, RSET_GPR);
1753      emit_rmro(as, XO_MOV, dest|REX_64, base, ofs);
1754    }
1755    return;
1756#endif
1757  } else if (ra_used(ir)) {
1758    RegSet allow = irt_isnum(t) ? RSET_FPR : RSET_GPR;
1759    Reg dest = ra_dest(as, ir, allow);
1760    base = ra_alloc1(as, REF_BASE, RSET_GPR);
1761    lj_assertA(irt_isnum(t) || irt_isint(t) || irt_isaddr(t),
1762	       "bad SLOAD type %d", irt_type(t));
1763    if ((ir->op2 & IRSLOAD_CONVERT)) {
1764      t.irt = irt_isint(t) ? IRT_NUM : IRT_INT;  /* Check for original type. */
1765      emit_rmro(as, irt_isint(t) ? XO_CVTSI2SD : XO_CVTTSD2SI, dest, base, ofs);
1766    } else {
1767#if LJ_GC64
1768      if (irt_isaddr(t)) {
1769	/* LJ_GC64 type check + tag removal without BMI2 and with BMI2:
1770	**
1771	**  mov r64, [addr]    rorx r64, [addr], 47
1772	**  ror r64, 47
1773	**  cmp r16, itype     cmp r16, itype
1774	**  jne ->exit         jne ->exit
1775	**  shr r64, 16        shr r64, 16
1776	*/
1777	emit_shifti(as, XOg_SHR|REX_64, dest, 17);
1778	if ((ir->op2 & IRSLOAD_TYPECHECK)) {
1779	  asm_guardcc(as, CC_NE);
1780	  emit_i8(as, irt_toitype(t));
1781	  emit_rr(as, XO_ARITHi8, XOg_CMP, dest);
1782	  emit_i8(as, XI_O16);
1783	}
1784	if ((as->flags & JIT_F_BMI2)) {
1785	  emit_i8(as, 47);
1786	  emit_rmro(as, XV_RORX|VEX_64, dest, base, ofs);
1787	} else {
1788	  if ((ir->op2 & IRSLOAD_TYPECHECK))
1789	    emit_shifti(as, XOg_ROR|REX_64, dest, 47);
1790	  else
1791	    emit_shifti(as, XOg_SHL|REX_64, dest, 17);
1792	  emit_rmro(as, XO_MOV, dest|REX_64, base, ofs);
1793	}
1794	return;
1795      } else
1796#endif
1797      emit_rmro(as, irt_isnum(t) ? XO_MOVSD : XO_MOV, dest, base, ofs);
1798    }
1799  } else {
1800    if (!(ir->op2 & IRSLOAD_TYPECHECK))
1801      return;  /* No type check: avoid base alloc. */
1802    base = ra_alloc1(as, REF_BASE, RSET_GPR);
1803  }
1804  if ((ir->op2 & IRSLOAD_TYPECHECK)) {
1805    /* Need type check, even if the load result is unused. */
1806    asm_guardcc(as, irt_isnum(t) ? CC_AE : CC_NE);
1807    if ((LJ_64 && irt_type(t) >= IRT_NUM) || (ir->op2 & IRSLOAD_KEYINDEX)) {
1808      lj_assertA(irt_isinteger(t) || irt_isnum(t),
1809		 "bad SLOAD type %d", irt_type(t));
1810      emit_u32(as, (ir->op2 & IRSLOAD_KEYINDEX) ? LJ_KEYINDEX :
1811		   LJ_GC64 ? (LJ_TISNUM << 15) : LJ_TISNUM);
1812      emit_rmro(as, XO_ARITHi, XOg_CMP, base, ofs+4);
1813#if LJ_GC64
1814    } else if (irt_isnil(t)) {
1815      /* LJ_GC64 type check for nil:
1816      **
1817      **   cmp qword [addr], -1
1818      **   jne ->exit
1819      */
1820      emit_i8(as, -1);
1821      emit_rmro(as, XO_ARITHi8, XOg_CMP|REX_64, base, ofs);
1822    } else if (irt_ispri(t)) {
1823      emit_u32(as, (irt_toitype(t) << 15) | 0x7fff);
1824      emit_rmro(as, XO_ARITHi, XOg_CMP, base, ofs+4);
1825    } else {
1826      /* LJ_GC64 type check only:
1827      **
1828      **   mov r64, [addr]
1829      **   sar r64, 47
1830      **   cmp r32, itype
1831      **   jne ->exit
1832      */
1833      Reg tmp = ra_scratch(as, rset_exclude(RSET_GPR, base));
1834      emit_i8(as, irt_toitype(t));
1835      emit_rr(as, XO_ARITHi8, XOg_CMP, tmp);
1836      emit_shifti(as, XOg_SAR|REX_64, tmp, 47);
1837      emit_rmro(as, XO_MOV, tmp|REX_64, base, ofs);
1838#else
1839    } else {
1840      emit_i8(as, irt_toitype(t));
1841      emit_rmro(as, XO_ARITHi8, XOg_CMP, base, ofs+4);
1842#endif
1843    }
1844  }
1845}
1846
1847/* -- Allocations --------------------------------------------------------- */
1848
1849#if LJ_HASFFI
1850static void asm_cnew(ASMState *as, IRIns *ir)
1851{
1852  CTState *cts = ctype_ctsG(J2G(as->J));
1853  CTypeID id = (CTypeID)IR(ir->op1)->i;
1854  CTSize sz;
1855  CTInfo info = lj_ctype_info(cts, id, &sz);
1856  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_mem_newgco];
1857  IRRef args[4];
1858  lj_assertA(sz != CTSIZE_INVALID || (ir->o == IR_CNEW && ir->op2 != REF_NIL),
1859	     "bad CNEW/CNEWI operands");
1860
1861  as->gcsteps++;
1862  asm_setupresult(as, ir, ci);  /* GCcdata * */
1863
1864  /* Initialize immutable cdata object. */
1865  if (ir->o == IR_CNEWI) {
1866    RegSet allow = (RSET_GPR & ~RSET_SCRATCH);
1867#if LJ_64
1868    Reg r64 = sz == 8 ? REX_64 : 0;
1869    if (irref_isk(ir->op2)) {
1870      IRIns *irk = IR(ir->op2);
1871      uint64_t k = (irk->o == IR_KINT64 ||
1872		    (LJ_GC64 && (irk->o == IR_KPTR || irk->o == IR_KKPTR))) ?
1873		   ir_k64(irk)->u64 : (uint64_t)(uint32_t)irk->i;
1874      if (sz == 4 || checki32((int64_t)k)) {
1875	emit_i32(as, (int32_t)k);
1876	emit_rmro(as, XO_MOVmi, r64, RID_RET, sizeof(GCcdata));
1877      } else {
1878	emit_movtomro(as, RID_ECX + r64, RID_RET, sizeof(GCcdata));
1879	emit_loadu64(as, RID_ECX, k);
1880      }
1881    } else {
1882      Reg r = ra_alloc1(as, ir->op2, allow);
1883      emit_movtomro(as, r + r64, RID_RET, sizeof(GCcdata));
1884    }
1885#else
1886    int32_t ofs = sizeof(GCcdata);
1887    if (sz == 8) {
1888      ofs += 4; ir++;
1889      lj_assertA(ir->o == IR_HIOP, "missing CNEWI HIOP");
1890    }
1891    do {
1892      if (irref_isk(ir->op2)) {
1893	emit_movmroi(as, RID_RET, ofs, IR(ir->op2)->i);
1894      } else {
1895	Reg r = ra_alloc1(as, ir->op2, allow);
1896	emit_movtomro(as, r, RID_RET, ofs);
1897	rset_clear(allow, r);
1898      }
1899      if (ofs == sizeof(GCcdata)) break;
1900      ofs -= 4; ir--;
1901    } while (1);
1902#endif
1903    lj_assertA(sz == 4 || sz == 8, "bad CNEWI size %d", sz);
1904  } else if (ir->op2 != REF_NIL) {  /* Create VLA/VLS/aligned cdata. */
1905    ci = &lj_ir_callinfo[IRCALL_lj_cdata_newv];
1906    args[0] = ASMREF_L;     /* lua_State *L */
1907    args[1] = ir->op1;      /* CTypeID id   */
1908    args[2] = ir->op2;      /* CTSize sz    */
1909    args[3] = ASMREF_TMP1;  /* CTSize align */
1910    asm_gencall(as, ci, args);
1911    emit_loadi(as, ra_releasetmp(as, ASMREF_TMP1), (int32_t)ctype_align(info));
1912    return;
1913  }
1914
1915  /* Combine initialization of marked, gct and ctypeid. */
1916  emit_movtomro(as, RID_ECX, RID_RET, offsetof(GCcdata, marked));
1917  emit_gri(as, XG_ARITHi(XOg_OR), RID_ECX,
1918	   (int32_t)((~LJ_TCDATA<<8)+(id<<16)));
1919  emit_gri(as, XG_ARITHi(XOg_AND), RID_ECX, LJ_GC_WHITES);
1920  emit_opgl(as, XO_MOVZXb, RID_ECX, gc.currentwhite);
1921
1922  args[0] = ASMREF_L;     /* lua_State *L */
1923  args[1] = ASMREF_TMP1;  /* MSize size   */
1924  asm_gencall(as, ci, args);
1925  emit_loadi(as, ra_releasetmp(as, ASMREF_TMP1), (int32_t)(sz+sizeof(GCcdata)));
1926}
1927#endif
1928
1929/* -- Write barriers ------------------------------------------------------ */
1930
1931static void asm_tbar(ASMState *as, IRIns *ir)
1932{
1933  Reg tab = ra_alloc1(as, ir->op1, RSET_GPR);
1934  Reg tmp = ra_scratch(as, rset_exclude(RSET_GPR, tab));
1935  MCLabel l_end = emit_label(as);
1936  emit_movtomro(as, tmp|REX_GC64, tab, offsetof(GCtab, gclist));
1937  emit_setgl(as, tab, gc.grayagain);
1938  emit_getgl(as, tmp, gc.grayagain);
1939  emit_i8(as, ~LJ_GC_BLACK);
1940  emit_rmro(as, XO_ARITHib, XOg_AND, tab, offsetof(GCtab, marked));
1941  emit_sjcc(as, CC_Z, l_end);
1942  emit_i8(as, LJ_GC_BLACK);
1943  emit_rmro(as, XO_GROUP3b, XOg_TEST, tab, offsetof(GCtab, marked));
1944}
1945
1946static void asm_obar(ASMState *as, IRIns *ir)
1947{
1948  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_gc_barrieruv];
1949  IRRef args[2];
1950  MCLabel l_end;
1951  Reg obj;
1952  /* No need for other object barriers (yet). */
1953  lj_assertA(IR(ir->op1)->o == IR_UREFC, "bad OBAR type");
1954  ra_evictset(as, RSET_SCRATCH);
1955  l_end = emit_label(as);
1956  args[0] = ASMREF_TMP1;  /* global_State *g */
1957  args[1] = ir->op1;      /* TValue *tv      */
1958  asm_gencall(as, ci, args);
1959  emit_loada(as, ra_releasetmp(as, ASMREF_TMP1), J2G(as->J));
1960  obj = IR(ir->op1)->r;
1961  emit_sjcc(as, CC_Z, l_end);
1962  emit_i8(as, LJ_GC_WHITES);
1963  if (irref_isk(ir->op2)) {
1964    GCobj *vp = ir_kgc(IR(ir->op2));
1965    emit_rma(as, XO_GROUP3b, XOg_TEST, &vp->gch.marked);
1966  } else {
1967    Reg val = ra_alloc1(as, ir->op2, rset_exclude(RSET_SCRATCH&RSET_GPR, obj));
1968    emit_rmro(as, XO_GROUP3b, XOg_TEST, val, (int32_t)offsetof(GChead, marked));
1969  }
1970  emit_sjcc(as, CC_Z, l_end);
1971  emit_i8(as, LJ_GC_BLACK);
1972  emit_rmro(as, XO_GROUP3b, XOg_TEST, obj,
1973	    (int32_t)offsetof(GCupval, marked)-(int32_t)offsetof(GCupval, tv));
1974}
1975
1976/* -- FP/int arithmetic and logic operations ------------------------------ */
1977
1978/* Load reference onto x87 stack. Force a spill to memory if needed. */
1979static void asm_x87load(ASMState *as, IRRef ref)
1980{
1981  IRIns *ir = IR(ref);
1982  if (ir->o == IR_KNUM) {
1983    cTValue *tv = ir_knum(ir);
1984    if (tvispzero(tv))  /* Use fldz only for +0. */
1985      emit_x87op(as, XI_FLDZ);
1986    else if (tvispone(tv))
1987      emit_x87op(as, XI_FLD1);
1988    else
1989      emit_rma(as, XO_FLDq, XOg_FLDq, tv);
1990  } else if (ir->o == IR_CONV && ir->op2 == IRCONV_NUM_INT && !ra_used(ir) &&
1991	     !irref_isk(ir->op1) && mayfuse(as, ir->op1)) {
1992    IRIns *iri = IR(ir->op1);
1993    emit_rmro(as, XO_FILDd, XOg_FILDd, RID_ESP, ra_spill(as, iri));
1994  } else {
1995    emit_mrm(as, XO_FLDq, XOg_FLDq, asm_fuseload(as, ref, RSET_EMPTY));
1996  }
1997}
1998
1999static void asm_fpmath(ASMState *as, IRIns *ir)
2000{
2001  IRFPMathOp fpm = (IRFPMathOp)ir->op2;
2002  if (fpm == IRFPM_SQRT) {
2003    Reg dest = ra_dest(as, ir, RSET_FPR);
2004    Reg left = asm_fuseload(as, ir->op1, RSET_FPR);
2005    emit_mrm(as, XO_SQRTSD, dest, left);
2006  } else if (fpm <= IRFPM_TRUNC) {
2007    if (as->flags & JIT_F_SSE4_1) {  /* SSE4.1 has a rounding instruction. */
2008      Reg dest = ra_dest(as, ir, RSET_FPR);
2009      Reg left = asm_fuseload(as, ir->op1, RSET_FPR);
2010      /* ROUNDSD has a 4-byte opcode which doesn't fit in x86Op.
2011      ** Let's pretend it's a 3-byte opcode, and compensate afterwards.
2012      ** This is atrocious, but the alternatives are much worse.
2013      */
2014      /* Round down/up/trunc == 1001/1010/1011. */
2015      emit_i8(as, 0x09 + fpm);
2016      emit_mrm(as, XO_ROUNDSD, dest, left);
2017      if (LJ_64 && as->mcp[1] != (MCode)(XO_ROUNDSD >> 16)) {
2018	as->mcp[0] = as->mcp[1]; as->mcp[1] = 0x0f;  /* Swap 0F and REX. */
2019      }
2020      *--as->mcp = 0x66;  /* 1st byte of ROUNDSD opcode. */
2021    } else {  /* Call helper functions for SSE2 variant. */
2022      /* The modified regs must match with the *.dasc implementation. */
2023      RegSet drop = RSET_RANGE(RID_XMM0, RID_XMM3+1)|RID2RSET(RID_EAX);
2024      if (ra_hasreg(ir->r))
2025	rset_clear(drop, ir->r);  /* Dest reg handled below. */
2026      ra_evictset(as, drop);
2027      ra_destreg(as, ir, RID_XMM0);
2028      emit_call(as, fpm == IRFPM_FLOOR ? lj_vm_floor_sse :
2029		    fpm == IRFPM_CEIL ? lj_vm_ceil_sse : lj_vm_trunc_sse);
2030      ra_left(as, RID_XMM0, ir->op1);
2031    }
2032  } else {
2033    asm_callid(as, ir, IRCALL_lj_vm_floor + fpm);
2034  }
2035}
2036
2037static void asm_ldexp(ASMState *as, IRIns *ir)
2038{
2039  int32_t ofs = sps_scale(ir->s);  /* Use spill slot or temp slots. */
2040  Reg dest = ir->r;
2041  if (ra_hasreg(dest)) {
2042    ra_free(as, dest);
2043    ra_modified(as, dest);
2044    emit_rmro(as, XO_MOVSD, dest, RID_ESP, ofs);
2045  }
2046  emit_rmro(as, XO_FSTPq, XOg_FSTPq, RID_ESP, ofs);
2047  emit_x87op(as, XI_FPOP1);
2048  emit_x87op(as, XI_FSCALE);
2049  asm_x87load(as, ir->op1);
2050  asm_x87load(as, ir->op2);
2051}
2052
2053static int asm_swapops(ASMState *as, IRIns *ir)
2054{
2055  IRIns *irl = IR(ir->op1);
2056  IRIns *irr = IR(ir->op2);
2057  lj_assertA(ra_noreg(irr->r), "bad usage");
2058  if (!irm_iscomm(lj_ir_mode[ir->o]))
2059    return 0;  /* Can't swap non-commutative operations. */
2060  if (irref_isk(ir->op2))
2061    return 0;  /* Don't swap constants to the left. */
2062  if (ra_hasreg(irl->r))
2063    return 1;  /* Swap if left already has a register. */
2064  if (ra_samehint(ir->r, irr->r))
2065    return 1;  /* Swap if dest and right have matching hints. */
2066  if (as->curins > as->loopref) {  /* In variant part? */
2067    if (ir->op2 < as->loopref && !irt_isphi(irr->t))
2068      return 0;  /* Keep invariants on the right. */
2069    if (ir->op1 < as->loopref && !irt_isphi(irl->t))
2070      return 1;  /* Swap invariants to the right. */
2071  }
2072  if (opisfusableload(irl->o))
2073    return 1;  /* Swap fusable loads to the right. */
2074  return 0;  /* Otherwise don't swap. */
2075}
2076
2077static void asm_fparith(ASMState *as, IRIns *ir, x86Op xo)
2078{
2079  IRRef lref = ir->op1;
2080  IRRef rref = ir->op2;
2081  RegSet allow = RSET_FPR;
2082  Reg dest;
2083  Reg right = IR(rref)->r;
2084  if (ra_hasreg(right)) {
2085    rset_clear(allow, right);
2086    ra_noweak(as, right);
2087  }
2088  dest = ra_dest(as, ir, allow);
2089  if (lref == rref) {
2090    right = dest;
2091  } else if (ra_noreg(right)) {
2092    if (asm_swapops(as, ir)) {
2093      IRRef tmp = lref; lref = rref; rref = tmp;
2094    }
2095    right = asm_fuseload(as, rref, rset_clear(allow, dest));
2096  }
2097  emit_mrm(as, xo, dest, right);
2098  ra_left(as, dest, lref);
2099}
2100
2101static void asm_intarith(ASMState *as, IRIns *ir, x86Arith xa)
2102{
2103  IRRef lref = ir->op1;
2104  IRRef rref = ir->op2;
2105  RegSet allow = RSET_GPR;
2106  Reg dest, right;
2107  int32_t k = 0;
2108  if (as->flagmcp == as->mcp && xa != XOg_X_IMUL) {
2109    /* Drop test r,r instruction. */
2110    MCode *p = as->mcp + ((LJ_64 && *as->mcp < XI_TESTb) ? 3 : 2);
2111    MCode *q = p[0] == 0x0f ? p+1 : p;
2112    if ((*q & 15) < 14) {
2113      if ((*q & 15) >= 12) *q -= 4;  /* L <->S, NL <-> NS */
2114      as->flagmcp = NULL;
2115      as->mcp = p;
2116    }  /* else: cannot transform LE/NLE to cc without use of OF. */
2117  }
2118  right = IR(rref)->r;
2119  if (ra_hasreg(right)) {
2120    rset_clear(allow, right);
2121    ra_noweak(as, right);
2122  }
2123  dest = ra_dest(as, ir, allow);
2124  if (lref == rref) {
2125    right = dest;
2126  } else if (ra_noreg(right) && !asm_isk32(as, rref, &k)) {
2127    if (asm_swapops(as, ir)) {
2128      IRRef tmp = lref; lref = rref; rref = tmp;
2129    }
2130    right = asm_fuseloadm(as, rref, rset_clear(allow, dest), irt_is64(ir->t));
2131  }
2132  if (irt_isguard(ir->t))  /* For IR_ADDOV etc. */
2133    asm_guardcc(as, CC_O);
2134  if (xa != XOg_X_IMUL) {
2135    if (ra_hasreg(right))
2136      emit_mrm(as, XO_ARITH(xa), REX_64IR(ir, dest), right);
2137    else
2138      emit_gri(as, XG_ARITHi(xa), REX_64IR(ir, dest), k);
2139  } else if (ra_hasreg(right)) {  /* IMUL r, mrm. */
2140    emit_mrm(as, XO_IMUL, REX_64IR(ir, dest), right);
2141  } else {  /* IMUL r, r, k. */
2142    /* NYI: use lea/shl/add/sub (FOLD only does 2^k) depending on CPU. */
2143    Reg left = asm_fuseloadm(as, lref, RSET_GPR, irt_is64(ir->t));
2144    x86Op xo;
2145    if (checki8(k)) { emit_i8(as, k); xo = XO_IMULi8;
2146    } else { emit_i32(as, k); xo = XO_IMULi; }
2147    emit_mrm(as, xo, REX_64IR(ir, dest), left);
2148    return;
2149  }
2150  ra_left(as, dest, lref);
2151}
2152
2153/* LEA is really a 4-operand ADD with an independent destination register,
2154** up to two source registers and an immediate. One register can be scaled
2155** by 1, 2, 4 or 8. This can be used to avoid moves or to fuse several
2156** instructions.
2157**
2158** Currently only a few common cases are supported:
2159** - 3-operand ADD:    y = a+b; y = a+k   with a and b already allocated
2160** - Left ADD fusion:  y = (a+b)+k; y = (a+k)+b
2161** - Right ADD fusion: y = a+(b+k)
2162** The ommited variants have already been reduced by FOLD.
2163**
2164** There are more fusion opportunities, like gathering shifts or joining
2165** common references. But these are probably not worth the trouble, since
2166** array indexing is not decomposed and already makes use of all fields
2167** of the ModRM operand.
2168*/
2169static int asm_lea(ASMState *as, IRIns *ir)
2170{
2171  IRIns *irl = IR(ir->op1);
2172  IRIns *irr = IR(ir->op2);
2173  RegSet allow = RSET_GPR;
2174  Reg dest;
2175  as->mrm.base = as->mrm.idx = RID_NONE;
2176  as->mrm.scale = XM_SCALE1;
2177  as->mrm.ofs = 0;
2178  if (ra_hasreg(irl->r)) {
2179    rset_clear(allow, irl->r);
2180    ra_noweak(as, irl->r);
2181    as->mrm.base = irl->r;
2182    if (irref_isk(ir->op2) || ra_hasreg(irr->r)) {
2183      /* The PHI renaming logic does a better job in some cases. */
2184      if (ra_hasreg(ir->r) &&
2185	  ((irt_isphi(irl->t) && as->phireg[ir->r] == ir->op1) ||
2186	   (irt_isphi(irr->t) && as->phireg[ir->r] == ir->op2)))
2187	return 0;
2188      if (irref_isk(ir->op2)) {
2189	as->mrm.ofs = irr->i;
2190      } else {
2191	rset_clear(allow, irr->r);
2192	ra_noweak(as, irr->r);
2193	as->mrm.idx = irr->r;
2194      }
2195    } else if (irr->o == IR_ADD && mayfuse(as, ir->op2) &&
2196	       irref_isk(irr->op2)) {
2197      Reg idx = ra_alloc1(as, irr->op1, allow);
2198      rset_clear(allow, idx);
2199      as->mrm.idx = (uint8_t)idx;
2200      as->mrm.ofs = IR(irr->op2)->i;
2201    } else {
2202      return 0;
2203    }
2204  } else if (ir->op1 != ir->op2 && irl->o == IR_ADD && mayfuse(as, ir->op1) &&
2205	     (irref_isk(ir->op2) || irref_isk(irl->op2))) {
2206    Reg idx, base = ra_alloc1(as, irl->op1, allow);
2207    rset_clear(allow, base);
2208    as->mrm.base = (uint8_t)base;
2209    if (irref_isk(ir->op2)) {
2210      as->mrm.ofs = irr->i;
2211      idx = ra_alloc1(as, irl->op2, allow);
2212    } else {
2213      as->mrm.ofs = IR(irl->op2)->i;
2214      idx = ra_alloc1(as, ir->op2, allow);
2215    }
2216    rset_clear(allow, idx);
2217    as->mrm.idx = (uint8_t)idx;
2218  } else {
2219    return 0;
2220  }
2221  dest = ra_dest(as, ir, allow);
2222  emit_mrm(as, XO_LEA, dest, RID_MRM);
2223  return 1;  /* Success. */
2224}
2225
2226static void asm_add(ASMState *as, IRIns *ir)
2227{
2228  if (irt_isnum(ir->t))
2229    asm_fparith(as, ir, XO_ADDSD);
2230  else if (as->flagmcp == as->mcp || irt_is64(ir->t) || !asm_lea(as, ir))
2231    asm_intarith(as, ir, XOg_ADD);
2232}
2233
2234static void asm_sub(ASMState *as, IRIns *ir)
2235{
2236  if (irt_isnum(ir->t))
2237    asm_fparith(as, ir, XO_SUBSD);
2238  else  /* Note: no need for LEA trick here. i-k is encoded as i+(-k). */
2239    asm_intarith(as, ir, XOg_SUB);
2240}
2241
2242static void asm_mul(ASMState *as, IRIns *ir)
2243{
2244  if (irt_isnum(ir->t))
2245    asm_fparith(as, ir, XO_MULSD);
2246  else
2247    asm_intarith(as, ir, XOg_X_IMUL);
2248}
2249
2250#define asm_fpdiv(as, ir)	asm_fparith(as, ir, XO_DIVSD)
2251
2252static void asm_neg_not(ASMState *as, IRIns *ir, x86Group3 xg)
2253{
2254  Reg dest = ra_dest(as, ir, RSET_GPR);
2255  emit_rr(as, XO_GROUP3, REX_64IR(ir, xg), dest);
2256  ra_left(as, dest, ir->op1);
2257}
2258
2259static void asm_neg(ASMState *as, IRIns *ir)
2260{
2261  if (irt_isnum(ir->t))
2262    asm_fparith(as, ir, XO_XORPS);
2263  else
2264    asm_neg_not(as, ir, XOg_NEG);
2265}
2266
2267#define asm_abs(as, ir)		asm_fparith(as, ir, XO_ANDPS)
2268
2269static void asm_intmin_max(ASMState *as, IRIns *ir, int cc)
2270{
2271  Reg right, dest = ra_dest(as, ir, RSET_GPR);
2272  IRRef lref = ir->op1, rref = ir->op2;
2273  if (irref_isk(rref)) { lref = rref; rref = ir->op1; }
2274  right = ra_alloc1(as, rref, rset_exclude(RSET_GPR, dest));
2275  emit_rr(as, XO_CMOV + (cc<<24), REX_64IR(ir, dest), right);
2276  emit_rr(as, XO_CMP, REX_64IR(ir, dest), right);
2277  ra_left(as, dest, lref);
2278}
2279
2280static void asm_min(ASMState *as, IRIns *ir)
2281{
2282  if (irt_isnum(ir->t))
2283    asm_fparith(as, ir, XO_MINSD);
2284  else
2285    asm_intmin_max(as, ir, CC_G);
2286}
2287
2288static void asm_max(ASMState *as, IRIns *ir)
2289{
2290  if (irt_isnum(ir->t))
2291    asm_fparith(as, ir, XO_MAXSD);
2292  else
2293    asm_intmin_max(as, ir, CC_L);
2294}
2295
2296/* Note: don't use LEA for overflow-checking arithmetic! */
2297#define asm_addov(as, ir)	asm_intarith(as, ir, XOg_ADD)
2298#define asm_subov(as, ir)	asm_intarith(as, ir, XOg_SUB)
2299#define asm_mulov(as, ir)	asm_intarith(as, ir, XOg_X_IMUL)
2300
2301#define asm_bnot(as, ir)	asm_neg_not(as, ir, XOg_NOT)
2302
2303static void asm_bswap(ASMState *as, IRIns *ir)
2304{
2305  Reg dest = ra_dest(as, ir, RSET_GPR);
2306  as->mcp = emit_op(XO_BSWAP + ((dest&7) << 24),
2307		    REX_64IR(ir, 0), dest, 0, as->mcp, 1);
2308  ra_left(as, dest, ir->op1);
2309}
2310
2311#define asm_band(as, ir)	asm_intarith(as, ir, XOg_AND)
2312#define asm_bor(as, ir)		asm_intarith(as, ir, XOg_OR)
2313#define asm_bxor(as, ir)	asm_intarith(as, ir, XOg_XOR)
2314
2315static void asm_bitshift(ASMState *as, IRIns *ir, x86Shift xs, x86Op xv)
2316{
2317  IRRef rref = ir->op2;
2318  IRIns *irr = IR(rref);
2319  Reg dest;
2320  if (irref_isk(rref)) {  /* Constant shifts. */
2321    int shift;
2322    dest = ra_dest(as, ir, RSET_GPR);
2323    shift = irr->i & (irt_is64(ir->t) ? 63 : 31);
2324    if (!xv && shift && (as->flags & JIT_F_BMI2)) {
2325      Reg left = asm_fuseloadm(as, ir->op1, RSET_GPR, irt_is64(ir->t));
2326      if (left != dest) {  /* BMI2 rotate right by constant. */
2327	emit_i8(as, xs == XOg_ROL ? -shift : shift);
2328	emit_mrm(as, VEX_64IR(ir, XV_RORX), dest, left);
2329	return;
2330      }
2331    }
2332    switch (shift) {
2333    case 0: break;
2334    case 1: emit_rr(as, XO_SHIFT1, REX_64IR(ir, xs), dest); break;
2335    default: emit_shifti(as, REX_64IR(ir, xs), dest, shift); break;
2336    }
2337  } else if ((as->flags & JIT_F_BMI2) && xv) {	/* BMI2 variable shifts. */
2338    Reg left, right;
2339    dest = ra_dest(as, ir, RSET_GPR);
2340    right = ra_alloc1(as, rref, RSET_GPR);
2341    left = asm_fuseloadm(as, ir->op1, rset_exclude(RSET_GPR, right),
2342			 irt_is64(ir->t));
2343    emit_mrm(as, VEX_64IR(ir, xv) ^ (right << 19), dest, left);
2344    return;
2345  } else {  /* Variable shifts implicitly use register cl (i.e. ecx). */
2346    Reg right;
2347    dest = ra_dest(as, ir, rset_exclude(RSET_GPR, RID_ECX));
2348    if (dest == RID_ECX) {
2349      dest = ra_scratch(as, rset_exclude(RSET_GPR, RID_ECX));
2350      emit_rr(as, XO_MOV, REX_64IR(ir, RID_ECX), dest);
2351    }
2352    right = irr->r;
2353    if (ra_noreg(right))
2354      right = ra_allocref(as, rref, RID2RSET(RID_ECX));
2355    else if (right != RID_ECX)
2356      ra_scratch(as, RID2RSET(RID_ECX));
2357    emit_rr(as, XO_SHIFTcl, REX_64IR(ir, xs), dest);
2358    ra_noweak(as, right);
2359    if (right != RID_ECX)
2360      emit_rr(as, XO_MOV, RID_ECX, right);
2361  }
2362  ra_left(as, dest, ir->op1);
2363  /*
2364  ** Note: avoid using the flags resulting from a shift or rotate!
2365  ** All of them cause a partial flag stall, except for r,1 shifts
2366  ** (but not rotates). And a shift count of 0 leaves the flags unmodified.
2367  */
2368}
2369
2370#define asm_bshl(as, ir)	asm_bitshift(as, ir, XOg_SHL, XV_SHLX)
2371#define asm_bshr(as, ir)	asm_bitshift(as, ir, XOg_SHR, XV_SHRX)
2372#define asm_bsar(as, ir)	asm_bitshift(as, ir, XOg_SAR, XV_SARX)
2373#define asm_brol(as, ir)	asm_bitshift(as, ir, XOg_ROL, 0)
2374#define asm_bror(as, ir)	asm_bitshift(as, ir, XOg_ROR, 0)
2375
2376/* -- Comparisons --------------------------------------------------------- */
2377
2378/* Virtual flags for unordered FP comparisons. */
2379#define VCC_U	0x1000		/* Unordered. */
2380#define VCC_P	0x2000		/* Needs extra CC_P branch. */
2381#define VCC_S	0x4000		/* Swap avoids CC_P branch. */
2382#define VCC_PS	(VCC_P|VCC_S)
2383
2384/* Map of comparisons to flags. ORDER IR. */
2385#define COMPFLAGS(ci, cin, cu, cf)	((ci)+((cu)<<4)+((cin)<<8)+(cf))
2386static const uint16_t asm_compmap[IR_ABC+1] = {
2387  /*                 signed non-eq unsigned flags */
2388  /* LT  */ COMPFLAGS(CC_GE, CC_G,  CC_AE, VCC_PS),
2389  /* GE  */ COMPFLAGS(CC_L,  CC_L,  CC_B,  0),
2390  /* LE  */ COMPFLAGS(CC_G,  CC_G,  CC_A,  VCC_PS),
2391  /* GT  */ COMPFLAGS(CC_LE, CC_L,  CC_BE, 0),
2392  /* ULT */ COMPFLAGS(CC_AE, CC_A,  CC_AE, VCC_U),
2393  /* UGE */ COMPFLAGS(CC_B,  CC_B,  CC_B,  VCC_U|VCC_PS),
2394  /* ULE */ COMPFLAGS(CC_A,  CC_A,  CC_A,  VCC_U),
2395  /* UGT */ COMPFLAGS(CC_BE, CC_B,  CC_BE, VCC_U|VCC_PS),
2396  /* EQ  */ COMPFLAGS(CC_NE, CC_NE, CC_NE, VCC_P),
2397  /* NE  */ COMPFLAGS(CC_E,  CC_E,  CC_E,  VCC_U|VCC_P),
2398  /* ABC */ COMPFLAGS(CC_BE, CC_B,  CC_BE, VCC_U|VCC_PS)  /* Same as UGT. */
2399};
2400
2401/* FP and integer comparisons. */
2402static void asm_comp(ASMState *as, IRIns *ir)
2403{
2404  uint32_t cc = asm_compmap[ir->o];
2405  if (irt_isnum(ir->t)) {
2406    IRRef lref = ir->op1;
2407    IRRef rref = ir->op2;
2408    Reg left, right;
2409    MCLabel l_around;
2410    /*
2411    ** An extra CC_P branch is required to preserve ordered/unordered
2412    ** semantics for FP comparisons. This can be avoided by swapping
2413    ** the operands and inverting the condition (except for EQ and UNE).
2414    ** So always try to swap if possible.
2415    **
2416    ** Another option would be to swap operands to achieve better memory
2417    ** operand fusion. But it's unlikely that this outweighs the cost
2418    ** of the extra branches.
2419    */
2420    if (cc & VCC_S) {  /* Swap? */
2421      IRRef tmp = lref; lref = rref; rref = tmp;
2422      cc ^= (VCC_PS|(5<<4));  /* A <-> B, AE <-> BE, PS <-> none */
2423    }
2424    left = ra_alloc1(as, lref, RSET_FPR);
2425    l_around = emit_label(as);
2426    asm_guardcc(as, cc >> 4);
2427    if (cc & VCC_P) {  /* Extra CC_P branch required? */
2428      if (!(cc & VCC_U)) {
2429	asm_guardcc(as, CC_P);  /* Branch to exit for ordered comparisons. */
2430      } else if (l_around != as->invmcp) {
2431	emit_sjcc(as, CC_P, l_around);  /* Branch around for unordered. */
2432      } else {
2433	/* Patched to mcloop by asm_loop_fixup. */
2434	as->loopinv = 2;
2435	if (as->realign)
2436	  emit_sjcc(as, CC_P, as->mcp);
2437	else
2438	  emit_jcc(as, CC_P, as->mcp);
2439      }
2440    }
2441    right = asm_fuseload(as, rref, rset_exclude(RSET_FPR, left));
2442    emit_mrm(as, XO_UCOMISD, left, right);
2443  } else {
2444    IRRef lref = ir->op1, rref = ir->op2;
2445    IROp leftop = (IROp)(IR(lref)->o);
2446    Reg r64 = REX_64IR(ir, 0);
2447    int32_t imm = 0;
2448    lj_assertA(irt_is64(ir->t) || irt_isint(ir->t) ||
2449	       irt_isu32(ir->t) || irt_isaddr(ir->t) || irt_isu8(ir->t),
2450	       "bad comparison data type %d", irt_type(ir->t));
2451    /* Swap constants (only for ABC) and fusable loads to the right. */
2452    if (irref_isk(lref) || (!irref_isk(rref) && opisfusableload(leftop))) {
2453      if ((cc & 0xc) == 0xc) cc ^= 0x53;  /* L <-> G, LE <-> GE */
2454      else if ((cc & 0xa) == 0x2) cc ^= 0x55;  /* A <-> B, AE <-> BE */
2455      lref = ir->op2; rref = ir->op1;
2456    }
2457    if (asm_isk32(as, rref, &imm)) {
2458      IRIns *irl = IR(lref);
2459      /* Check wether we can use test ins. Not for unsigned, since CF=0. */
2460      int usetest = (imm == 0 && (cc & 0xa) != 0x2);
2461      if (usetest && irl->o == IR_BAND && irl+1 == ir && !ra_used(irl)) {
2462	/* Combine comp(BAND(ref, r/imm), 0) into test mrm, r/imm. */
2463	Reg right, left = RID_NONE;
2464	RegSet allow = RSET_GPR;
2465	if (!asm_isk32(as, irl->op2, &imm)) {
2466	  left = ra_alloc1(as, irl->op2, allow);
2467	  rset_clear(allow, left);
2468	} else {  /* Try to Fuse IRT_I8/IRT_U8 loads, too. See below. */
2469	  IRIns *irll = IR(irl->op1);
2470	  if (opisfusableload((IROp)irll->o) &&
2471	      (irt_isi8(irll->t) || irt_isu8(irll->t))) {
2472	    IRType1 origt = irll->t;  /* Temporarily flip types. */
2473	    irll->t.irt = (irll->t.irt & ~IRT_TYPE) | IRT_INT;
2474	    as->curins--;  /* Skip to BAND to avoid failing in noconflict(). */
2475	    right = asm_fuseload(as, irl->op1, RSET_GPR);
2476	    as->curins++;
2477	    irll->t = origt;
2478	    if (right != RID_MRM) goto test_nofuse;
2479	    /* Fusion succeeded, emit test byte mrm, imm8. */
2480	    asm_guardcc(as, cc);
2481	    emit_i8(as, (imm & 0xff));
2482	    emit_mrm(as, XO_GROUP3b, XOg_TEST, RID_MRM);
2483	    return;
2484	  }
2485	}
2486	as->curins--;  /* Skip to BAND to avoid failing in noconflict(). */
2487	right = asm_fuseloadm(as, irl->op1, allow, r64);
2488	as->curins++;  /* Undo the above. */
2489      test_nofuse:
2490	asm_guardcc(as, cc);
2491	if (ra_noreg(left)) {
2492	  emit_i32(as, imm);
2493	  emit_mrm(as, XO_GROUP3, r64 + XOg_TEST, right);
2494	} else {
2495	  emit_mrm(as, XO_TEST, r64 + left, right);
2496	}
2497      } else {
2498	Reg left;
2499	if (opisfusableload((IROp)irl->o) &&
2500	    ((irt_isu8(irl->t) && checku8(imm)) ||
2501	     ((irt_isi8(irl->t) || irt_isi16(irl->t)) && checki8(imm)) ||
2502	     (irt_isu16(irl->t) && checku16(imm) && checki8((int16_t)imm)))) {
2503	  /* Only the IRT_INT case is fused by asm_fuseload.
2504	  ** The IRT_I8/IRT_U8 loads and some IRT_I16/IRT_U16 loads
2505	  ** are handled here.
2506	  ** Note that cmp word [mem], imm16 should not be generated,
2507	  ** since it has a length-changing prefix. Compares of a word
2508	  ** against a sign-extended imm8 are ok, however.
2509	  */
2510	  IRType1 origt = irl->t;  /* Temporarily flip types. */
2511	  irl->t.irt = (irl->t.irt & ~IRT_TYPE) | IRT_INT;
2512	  left = asm_fuseload(as, lref, RSET_GPR);
2513	  irl->t = origt;
2514	  if (left == RID_MRM) {  /* Fusion succeeded? */
2515	    if (irt_isu8(irl->t) || irt_isu16(irl->t))
2516	      cc >>= 4;  /* Need unsigned compare. */
2517	    asm_guardcc(as, cc);
2518	    emit_i8(as, imm);
2519	    emit_mrm(as, (irt_isi8(origt) || irt_isu8(origt)) ?
2520			 XO_ARITHib : XO_ARITHiw8, r64 + XOg_CMP, RID_MRM);
2521	    return;
2522	  }  /* Otherwise handle register case as usual. */
2523	} else {
2524	  left = asm_fuseloadm(as, lref,
2525			       irt_isu8(ir->t) ? RSET_GPR8 : RSET_GPR, r64);
2526	}
2527	asm_guardcc(as, cc);
2528	if (usetest && left != RID_MRM) {
2529	  /* Use test r,r instead of cmp r,0. */
2530	  x86Op xo = XO_TEST;
2531	  if (irt_isu8(ir->t)) {
2532	    lj_assertA(ir->o == IR_EQ || ir->o == IR_NE, "bad usage");
2533	    xo = XO_TESTb;
2534	    if (!rset_test(RSET_RANGE(RID_EAX, RID_EBX+1), left)) {
2535	      if (LJ_64) {
2536		left |= FORCE_REX;
2537	      } else {
2538		emit_i32(as, 0xff);
2539		emit_mrm(as, XO_GROUP3, XOg_TEST, left);
2540		return;
2541	      }
2542	    }
2543	  }
2544	  emit_rr(as, xo, r64 + left, left);
2545	  if (irl+1 == ir)  /* Referencing previous ins? */
2546	    as->flagmcp = as->mcp;  /* Set flag to drop test r,r if possible. */
2547	} else {
2548	  emit_gmrmi(as, XG_ARITHi(XOg_CMP), r64 + left, imm);
2549	}
2550      }
2551    } else {
2552      Reg left = ra_alloc1(as, lref, RSET_GPR);
2553      Reg right = asm_fuseloadm(as, rref, rset_exclude(RSET_GPR, left), r64);
2554      asm_guardcc(as, cc);
2555      emit_mrm(as, XO_CMP, r64 + left, right);
2556    }
2557  }
2558}
2559
2560#define asm_equal(as, ir)	asm_comp(as, ir)
2561
2562#if LJ_32 && LJ_HASFFI
2563/* 64 bit integer comparisons in 32 bit mode. */
2564static void asm_comp_int64(ASMState *as, IRIns *ir)
2565{
2566  uint32_t cc = asm_compmap[(ir-1)->o];
2567  RegSet allow = RSET_GPR;
2568  Reg lefthi = RID_NONE, leftlo = RID_NONE;
2569  Reg righthi = RID_NONE, rightlo = RID_NONE;
2570  MCLabel l_around;
2571  x86ModRM mrm;
2572
2573  as->curins--;  /* Skip loword ins. Avoids failing in noconflict(), too. */
2574
2575  /* Allocate/fuse hiword operands. */
2576  if (irref_isk(ir->op2)) {
2577    lefthi = asm_fuseload(as, ir->op1, allow);
2578  } else {
2579    lefthi = ra_alloc1(as, ir->op1, allow);
2580    rset_clear(allow, lefthi);
2581    righthi = asm_fuseload(as, ir->op2, allow);
2582    if (righthi == RID_MRM) {
2583      if (as->mrm.base != RID_NONE) rset_clear(allow, as->mrm.base);
2584      if (as->mrm.idx != RID_NONE) rset_clear(allow, as->mrm.idx);
2585    } else {
2586      rset_clear(allow, righthi);
2587    }
2588  }
2589  mrm = as->mrm;  /* Save state for hiword instruction. */
2590
2591  /* Allocate/fuse loword operands. */
2592  if (irref_isk((ir-1)->op2)) {
2593    leftlo = asm_fuseload(as, (ir-1)->op1, allow);
2594  } else {
2595    leftlo = ra_alloc1(as, (ir-1)->op1, allow);
2596    rset_clear(allow, leftlo);
2597    rightlo = asm_fuseload(as, (ir-1)->op2, allow);
2598  }
2599
2600  /* All register allocations must be performed _before_ this point. */
2601  l_around = emit_label(as);
2602  as->invmcp = as->flagmcp = NULL;  /* Cannot use these optimizations. */
2603
2604  /* Loword comparison and branch. */
2605  asm_guardcc(as, cc >> 4);  /* Always use unsigned compare for loword. */
2606  if (ra_noreg(rightlo)) {
2607    int32_t imm = IR((ir-1)->op2)->i;
2608    if (imm == 0 && ((cc >> 4) & 0xa) != 0x2 && leftlo != RID_MRM)
2609      emit_rr(as, XO_TEST, leftlo, leftlo);
2610    else
2611      emit_gmrmi(as, XG_ARITHi(XOg_CMP), leftlo, imm);
2612  } else {
2613    emit_mrm(as, XO_CMP, leftlo, rightlo);
2614  }
2615
2616  /* Hiword comparison and branches. */
2617  if ((cc & 15) != CC_NE)
2618    emit_sjcc(as, CC_NE, l_around);  /* Hiword unequal: skip loword compare. */
2619  if ((cc & 15) != CC_E)
2620    asm_guardcc(as, cc >> 8);  /* Hiword compare without equality check. */
2621  as->mrm = mrm;  /* Restore state. */
2622  if (ra_noreg(righthi)) {
2623    int32_t imm = IR(ir->op2)->i;
2624    if (imm == 0 && (cc & 0xa) != 0x2 && lefthi != RID_MRM)
2625      emit_rr(as, XO_TEST, lefthi, lefthi);
2626    else
2627      emit_gmrmi(as, XG_ARITHi(XOg_CMP), lefthi, imm);
2628  } else {
2629    emit_mrm(as, XO_CMP, lefthi, righthi);
2630  }
2631}
2632#endif
2633
2634/* -- Split register ops -------------------------------------------------- */
2635
2636/* Hiword op of a split 32/32 or 64/64 bit op. Previous op is the loword op. */
2637static void asm_hiop(ASMState *as, IRIns *ir)
2638{
2639  /* HIOP is marked as a store because it needs its own DCE logic. */
2640  int uselo = ra_used(ir-1), usehi = ra_used(ir);  /* Loword/hiword used? */
2641  if (LJ_UNLIKELY(!(as->flags & JIT_F_OPT_DCE))) uselo = usehi = 1;
2642#if LJ_32 && LJ_HASFFI
2643  if ((ir-1)->o == IR_CONV) {  /* Conversions to/from 64 bit. */
2644    as->curins--;  /* Always skip the CONV. */
2645    if (usehi || uselo)
2646      asm_conv64(as, ir);
2647    return;
2648  } else if ((ir-1)->o <= IR_NE) {  /* 64 bit integer comparisons. ORDER IR. */
2649    asm_comp_int64(as, ir);
2650    return;
2651  } else if ((ir-1)->o == IR_XSTORE) {
2652    if ((ir-1)->r != RID_SINK)
2653      asm_fxstore(as, ir);
2654    return;
2655  }
2656#endif
2657  if (!usehi) return;  /* Skip unused hiword op for all remaining ops. */
2658  switch ((ir-1)->o) {
2659#if LJ_32 && LJ_HASFFI
2660  case IR_ADD:
2661    as->flagmcp = NULL;
2662    as->curins--;
2663    asm_intarith(as, ir, XOg_ADC);
2664    asm_intarith(as, ir-1, XOg_ADD);
2665    break;
2666  case IR_SUB:
2667    as->flagmcp = NULL;
2668    as->curins--;
2669    asm_intarith(as, ir, XOg_SBB);
2670    asm_intarith(as, ir-1, XOg_SUB);
2671    break;
2672  case IR_NEG: {
2673    Reg dest = ra_dest(as, ir, RSET_GPR);
2674    emit_rr(as, XO_GROUP3, XOg_NEG, dest);
2675    emit_i8(as, 0);
2676    emit_rr(as, XO_ARITHi8, XOg_ADC, dest);
2677    ra_left(as, dest, ir->op1);
2678    as->curins--;
2679    asm_neg_not(as, ir-1, XOg_NEG);
2680    break;
2681    }
2682  case IR_CNEWI:
2683    /* Nothing to do here. Handled by CNEWI itself. */
2684    break;
2685#endif
2686  case IR_CALLN: case IR_CALLL: case IR_CALLS: case IR_CALLXS:
2687    if (!uselo)
2688      ra_allocref(as, ir->op1, RID2RSET(RID_RETLO));  /* Mark lo op as used. */
2689    break;
2690  default: lj_assertA(0, "bad HIOP for op %d", (ir-1)->o); break;
2691  }
2692}
2693
2694/* -- Profiling ----------------------------------------------------------- */
2695
2696static void asm_prof(ASMState *as, IRIns *ir)
2697{
2698  UNUSED(ir);
2699  asm_guardcc(as, CC_NE);
2700  emit_i8(as, HOOK_PROFILE);
2701  emit_rma(as, XO_GROUP3b, XOg_TEST, &J2G(as->J)->hookmask);
2702}
2703
2704/* -- Stack handling ------------------------------------------------------ */
2705
2706/* Check Lua stack size for overflow. Use exit handler as fallback. */
2707static void asm_stack_check(ASMState *as, BCReg topslot,
2708			    IRIns *irp, RegSet allow, ExitNo exitno)
2709{
2710  /* Try to get an unused temp. register, otherwise spill/restore eax. */
2711  Reg pbase = irp ? irp->r : RID_BASE;
2712  Reg r = allow ? rset_pickbot(allow) : RID_EAX;
2713  emit_jcc(as, CC_B, exitstub_addr(as->J, exitno));
2714  if (allow == RSET_EMPTY)  /* Restore temp. register. */
2715    emit_rmro(as, XO_MOV, r|REX_64, RID_ESP, 0);
2716  else
2717    ra_modified(as, r);
2718  emit_gri(as, XG_ARITHi(XOg_CMP), r|REX_GC64, (int32_t)(8*topslot));
2719  if (ra_hasreg(pbase) && pbase != r)
2720    emit_rr(as, XO_ARITH(XOg_SUB), r|REX_GC64, pbase);
2721  else
2722#if LJ_GC64
2723    emit_rmro(as, XO_ARITH(XOg_SUB), r|REX_64, RID_DISPATCH,
2724	      (int32_t)dispofs(as, &J2G(as->J)->jit_base));
2725#else
2726    emit_rmro(as, XO_ARITH(XOg_SUB), r, RID_NONE,
2727	      ptr2addr(&J2G(as->J)->jit_base));
2728#endif
2729  emit_rmro(as, XO_MOV, r|REX_GC64, r, offsetof(lua_State, maxstack));
2730  emit_getgl(as, r, cur_L);
2731  if (allow == RSET_EMPTY)  /* Spill temp. register. */
2732    emit_rmro(as, XO_MOVto, r|REX_64, RID_ESP, 0);
2733}
2734
2735/* Restore Lua stack from on-trace state. */
2736static void asm_stack_restore(ASMState *as, SnapShot *snap)
2737{
2738  SnapEntry *map = &as->T->snapmap[snap->mapofs];
2739#if !LJ_FR2 || defined(LUA_USE_ASSERT)
2740  SnapEntry *flinks = &as->T->snapmap[snap_nextofs(as->T, snap)-1-LJ_FR2];
2741#endif
2742  MSize n, nent = snap->nent;
2743  /* Store the value of all modified slots to the Lua stack. */
2744  for (n = 0; n < nent; n++) {
2745    SnapEntry sn = map[n];
2746    BCReg s = snap_slot(sn);
2747    int32_t ofs = 8*((int32_t)s-1-LJ_FR2);
2748    IRRef ref = snap_ref(sn);
2749    IRIns *ir = IR(ref);
2750    if ((sn & SNAP_NORESTORE))
2751      continue;
2752    if ((sn & SNAP_KEYINDEX)) {
2753      emit_movmroi(as, RID_BASE, ofs+4, LJ_KEYINDEX);
2754      if (irref_isk(ref)) {
2755	emit_movmroi(as, RID_BASE, ofs, ir->i);
2756      } else {
2757	Reg src = ra_alloc1(as, ref, rset_exclude(RSET_GPR, RID_BASE));
2758	emit_movtomro(as, src, RID_BASE, ofs);
2759      }
2760    } else if (irt_isnum(ir->t)) {
2761      Reg src = ra_alloc1(as, ref, RSET_FPR);
2762      emit_rmro(as, XO_MOVSDto, src, RID_BASE, ofs);
2763    } else {
2764      lj_assertA(irt_ispri(ir->t) || irt_isaddr(ir->t) ||
2765		 (LJ_DUALNUM && irt_isinteger(ir->t)),
2766		 "restore of IR type %d", irt_type(ir->t));
2767      if (!irref_isk(ref)) {
2768	Reg src = ra_alloc1(as, ref, rset_exclude(RSET_GPR, RID_BASE));
2769#if LJ_GC64
2770	if (irt_is64(ir->t)) {
2771	  /* TODO: 64 bit store + 32 bit load-modify-store is suboptimal. */
2772	  emit_u32(as, irt_toitype(ir->t) << 15);
2773	  emit_rmro(as, XO_ARITHi, XOg_OR, RID_BASE, ofs+4);
2774	} else if (LJ_DUALNUM && irt_isinteger(ir->t)) {
2775	  emit_movmroi(as, RID_BASE, ofs+4, LJ_TISNUM << 15);
2776	} else {
2777	  emit_movmroi(as, RID_BASE, ofs+4, (irt_toitype(ir->t)<<15)|0x7fff);
2778	}
2779#endif
2780	emit_movtomro(as, REX_64IR(ir, src), RID_BASE, ofs);
2781#if LJ_GC64
2782      } else {
2783	TValue k;
2784	lj_ir_kvalue(as->J->L, &k, ir);
2785	if (tvisnil(&k)) {
2786	  emit_i32(as, -1);
2787	  emit_rmro(as, XO_MOVmi, REX_64, RID_BASE, ofs);
2788	} else {
2789	  emit_movmroi(as, RID_BASE, ofs+4, k.u32.hi);
2790	  emit_movmroi(as, RID_BASE, ofs, k.u32.lo);
2791	}
2792#else
2793      } else if (!irt_ispri(ir->t)) {
2794	emit_movmroi(as, RID_BASE, ofs, ir->i);
2795#endif
2796      }
2797      if ((sn & (SNAP_CONT|SNAP_FRAME))) {
2798#if !LJ_FR2
2799	if (s != 0)  /* Do not overwrite link to previous frame. */
2800	  emit_movmroi(as, RID_BASE, ofs+4, (int32_t)(*flinks--));
2801#endif
2802#if !LJ_GC64
2803      } else {
2804	if (!(LJ_64 && irt_islightud(ir->t)))
2805	  emit_movmroi(as, RID_BASE, ofs+4, irt_toitype(ir->t));
2806#endif
2807      }
2808    }
2809    checkmclim(as);
2810  }
2811  lj_assertA(map + nent == flinks, "inconsistent frames in snapshot");
2812}
2813
2814/* -- GC handling --------------------------------------------------------- */
2815
2816/* Check GC threshold and do one or more GC steps. */
2817static void asm_gc_check(ASMState *as)
2818{
2819  const CCallInfo *ci = &lj_ir_callinfo[IRCALL_lj_gc_step_jit];
2820  IRRef args[2];
2821  MCLabel l_end;
2822  Reg tmp;
2823  ra_evictset(as, RSET_SCRATCH);
2824  l_end = emit_label(as);
2825  /* Exit trace if in GCSatomic or GCSfinalize. Avoids syncing GC objects. */
2826  asm_guardcc(as, CC_NE);  /* Assumes asm_snap_prep() already done. */
2827  emit_rr(as, XO_TEST, RID_RET, RID_RET);
2828  args[0] = ASMREF_TMP1;  /* global_State *g */
2829  args[1] = ASMREF_TMP2;  /* MSize steps     */
2830  /* Insert nop to simplify GC exit recognition in lj_asm_patchexit. */
2831  if (!jmprel_ok(as->mcp, (MCode *)(void *)ci->func)) *--as->mcp = XI_NOP;
2832  asm_gencall(as, ci, args);
2833  tmp = ra_releasetmp(as, ASMREF_TMP1);
2834#if LJ_GC64
2835  emit_rmro(as, XO_LEA, tmp|REX_64, RID_DISPATCH, GG_DISP2G);
2836#else
2837  emit_loada(as, tmp, J2G(as->J));
2838#endif
2839  emit_loadi(as, ra_releasetmp(as, ASMREF_TMP2), as->gcsteps);
2840  /* Jump around GC step if GC total < GC threshold. */
2841  emit_sjcc(as, CC_B, l_end);
2842  emit_opgl(as, XO_ARITH(XOg_CMP), tmp|REX_GC64, gc.threshold);
2843  emit_getgl(as, tmp, gc.total);
2844  as->gcsteps = 0;
2845  checkmclim(as);
2846}
2847
2848/* -- Loop handling ------------------------------------------------------- */
2849
2850/* Fixup the loop branch. */
2851static void asm_loop_fixup(ASMState *as)
2852{
2853  MCode *p = as->mctop;
2854  MCode *target = as->mcp;
2855  if (as->realign) {  /* Realigned loops use short jumps. */
2856    as->realign = NULL;  /* Stop another retry. */
2857    lj_assertA(((intptr_t)target & 15) == 0, "loop realign failed");
2858    if (as->loopinv) {  /* Inverted loop branch? */
2859      p -= 5;
2860      p[0] = XI_JMP;
2861      lj_assertA(target - p >= -128, "loop realign failed");
2862      p[-1] = (MCode)(target - p);  /* Patch sjcc. */
2863      if (as->loopinv == 2)
2864	p[-3] = (MCode)(target - p + 2);  /* Patch opt. short jp. */
2865    } else {
2866      lj_assertA(target - p >= -128, "loop realign failed");
2867      p[-1] = (MCode)(int8_t)(target - p);  /* Patch short jmp. */
2868      p[-2] = XI_JMPs;
2869    }
2870  } else {
2871    MCode *newloop;
2872    p[-5] = XI_JMP;
2873    if (as->loopinv) {  /* Inverted loop branch? */
2874      /* asm_guardcc already inverted the jcc and patched the jmp. */
2875      p -= 5;
2876      newloop = target+4;
2877      *(int32_t *)(p-4) = (int32_t)(target - p);  /* Patch jcc. */
2878      if (as->loopinv == 2) {
2879	*(int32_t *)(p-10) = (int32_t)(target - p + 6);  /* Patch opt. jp. */
2880	newloop = target+8;
2881      }
2882    } else {  /* Otherwise just patch jmp. */
2883      *(int32_t *)(p-4) = (int32_t)(target - p);
2884      newloop = target+3;
2885    }
2886    /* Realign small loops and shorten the loop branch. */
2887    if (newloop >= p - 128) {
2888      as->realign = newloop;  /* Force a retry and remember alignment. */
2889      as->curins = as->stopins;  /* Abort asm_trace now. */
2890      as->T->nins = as->orignins;  /* Remove any added renames. */
2891    }
2892  }
2893}
2894
2895/* Fixup the tail of the loop. */
2896static void asm_loop_tail_fixup(ASMState *as)
2897{
2898  UNUSED(as);  /* Nothing to do. */
2899}
2900
2901/* -- Head of trace ------------------------------------------------------- */
2902
2903/* Coalesce BASE register for a root trace. */
2904static void asm_head_root_base(ASMState *as)
2905{
2906  IRIns *ir = IR(REF_BASE);
2907  Reg r = ir->r;
2908  if (ra_hasreg(r)) {
2909    ra_free(as, r);
2910    if (rset_test(as->modset, r) || irt_ismarked(ir->t))
2911      ir->r = RID_INIT;  /* No inheritance for modified BASE register. */
2912    if (r != RID_BASE)
2913      emit_rr(as, XO_MOV, r|REX_GC64, RID_BASE);
2914  }
2915}
2916
2917/* Coalesce or reload BASE register for a side trace. */
2918static Reg asm_head_side_base(ASMState *as, IRIns *irp)
2919{
2920  IRIns *ir = IR(REF_BASE);
2921  Reg r = ir->r;
2922  if (ra_hasreg(r)) {
2923    ra_free(as, r);
2924    if (rset_test(as->modset, r) || irt_ismarked(ir->t))
2925      ir->r = RID_INIT;  /* No inheritance for modified BASE register. */
2926    if (irp->r == r) {
2927      return r;  /* Same BASE register already coalesced. */
2928    } else if (ra_hasreg(irp->r) && rset_test(as->freeset, irp->r)) {
2929      /* Move from coalesced parent reg. */
2930      emit_rr(as, XO_MOV, r|REX_GC64, irp->r);
2931      return irp->r;
2932    } else {
2933      emit_getgl(as, r, jit_base);  /* Otherwise reload BASE. */
2934    }
2935  }
2936  return RID_NONE;
2937}
2938
2939/* -- Tail of trace ------------------------------------------------------- */
2940
2941/* Fixup the tail code. */
2942static void asm_tail_fixup(ASMState *as, TraceNo lnk)
2943{
2944  /* Note: don't use as->mcp swap + emit_*: emit_op overwrites more bytes. */
2945  MCode *mcp = as->mctail;
2946  MCode *target;
2947  int32_t spadj = as->T->spadjust;
2948  if (spadj) {  /* Emit stack adjustment. */
2949    if (LJ_64) *mcp++ = 0x48;
2950    if (checki8(spadj)) {
2951      *mcp++ = XI_ARITHi8;
2952      *mcp++ = MODRM(XM_REG, XOg_ADD, RID_ESP);
2953      *mcp++ = (MCode)spadj;
2954    } else {
2955      *mcp++ = XI_ARITHi;
2956      *mcp++ = MODRM(XM_REG, XOg_ADD, RID_ESP);
2957      *(int32_t *)mcp = spadj; mcp += 4;
2958    }
2959  }
2960  /* Emit exit branch. */
2961  target = lnk ? traceref(as->J, lnk)->mcode : (MCode *)(void *)lj_vm_exit_interp;
2962  if (lnk || jmprel_ok(mcp + 5, target)) {  /* Direct jump. */
2963    *mcp++ = XI_JMP; mcp += 4;
2964    *(int32_t *)(mcp-4) = jmprel(as->J, mcp, target);
2965  } else {  /* RIP-relative indirect jump. */
2966    *mcp++ = XI_GROUP5; *mcp++ = XM_OFS0 + (XOg_JMP<<3) + RID_EBP; mcp += 4;
2967    *((int32_t *)(mcp-4)) = (int32_t)(as->J->exitstubgroup[0] - 16 - mcp);
2968  }
2969  /* Drop unused mcode tail. Fill with NOPs to make the prefetcher happy. */
2970  while (as->mctop > mcp) *--as->mctop = XI_NOP;
2971}
2972
2973/* Prepare tail of code. */
2974static void asm_tail_prep(ASMState *as, TraceNo lnk)
2975{
2976  MCode *p = as->mctop;
2977  /* Realign and leave room for backwards loop branch or exit branch. */
2978  if (as->realign) {
2979    int i = ((int)(intptr_t)as->realign) & 15;
2980    /* Fill unused mcode tail with NOPs to make the prefetcher happy. */
2981    while (i-- > 0)
2982      *--p = XI_NOP;
2983    as->mctop = p;
2984    p -= (as->loopinv ? 5 : 2);  /* Space for short/near jmp. */
2985  } else {
2986    p -= (LJ_64 && !lnk) ? 6 : 5;  /* Space for exit branch. */
2987  }
2988  if (as->loopref) {
2989    as->invmcp = as->mcp = p;
2990  } else {
2991    /* Leave room for ESP adjustment: add esp, imm */
2992    p -= LJ_64 ? 7 : 6;
2993    as->mcp = p;
2994    as->invmcp = NULL;
2995  }
2996  as->mctail = p;
2997}
2998
2999/* -- Trace setup --------------------------------------------------------- */
3000
3001/* Ensure there are enough stack slots for call arguments. */
3002static Reg asm_setup_call_slots(ASMState *as, IRIns *ir, const CCallInfo *ci)
3003{
3004  IRRef args[CCI_NARGS_MAX*2];
3005  int nslots;
3006  asm_collectargs(as, ir, ci, args);
3007  nslots = asm_count_call_slots(as, ci, args);
3008  if (nslots > as->evenspill)  /* Leave room for args in stack slots. */
3009    as->evenspill = nslots;
3010#if LJ_64
3011  return irt_isfp(ir->t) ? REGSP_HINT(RID_FPRET) : REGSP_HINT(RID_RET);
3012#else
3013  return irt_isfp(ir->t) ? REGSP_INIT : REGSP_HINT(RID_RET);
3014#endif
3015}
3016
3017/* Target-specific setup. */
3018static void asm_setup_target(ASMState *as)
3019{
3020  asm_exitstub_setup(as, as->T->nsnap);
3021  as->mrm.base = 0;
3022}
3023
3024/* -- Trace patching ------------------------------------------------------ */
3025
3026static const uint8_t map_op1[256] = {
30270x92,0x92,0x92,0x92,0x52,0x45,0x51,0x51,0x92,0x92,0x92,0x92,0x52,0x45,0x51,0x20,
30280x92,0x92,0x92,0x92,0x52,0x45,0x51,0x51,0x92,0x92,0x92,0x92,0x52,0x45,0x51,0x51,
30290x92,0x92,0x92,0x92,0x52,0x45,0x10,0x51,0x92,0x92,0x92,0x92,0x52,0x45,0x10,0x51,
30300x92,0x92,0x92,0x92,0x52,0x45,0x10,0x51,0x92,0x92,0x92,0x92,0x52,0x45,0x10,0x51,
3031#if LJ_64
30320x10,0x10,0x10,0x10,0x10,0x10,0x10,0x10,0x14,0x14,0x14,0x14,0x14,0x14,0x14,0x14,
3033#else
30340x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,
3035#endif
30360x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,
30370x51,0x51,0x92,0x92,0x10,0x10,0x12,0x11,0x45,0x86,0x52,0x93,0x51,0x51,0x51,0x51,
30380x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,
30390x93,0x86,0x93,0x93,0x92,0x92,0x92,0x92,0x92,0x92,0x92,0x92,0x92,0x92,0x92,0x92,
30400x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x51,0x47,0x51,0x51,0x51,0x51,0x51,
3041#if LJ_64
30420x59,0x59,0x59,0x59,0x51,0x51,0x51,0x51,0x52,0x45,0x51,0x51,0x51,0x51,0x51,0x51,
3043#else
30440x55,0x55,0x55,0x55,0x51,0x51,0x51,0x51,0x52,0x45,0x51,0x51,0x51,0x51,0x51,0x51,
3045#endif
30460x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x05,0x05,0x05,0x05,0x05,0x05,0x05,0x05,
30470x93,0x93,0x53,0x51,0x70,0x71,0x93,0x86,0x54,0x51,0x53,0x51,0x51,0x52,0x51,0x51,
30480x92,0x92,0x92,0x92,0x52,0x52,0x51,0x51,0x92,0x92,0x92,0x92,0x92,0x92,0x92,0x92,
30490x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x45,0x45,0x47,0x52,0x51,0x51,0x51,0x51,
30500x10,0x51,0x10,0x10,0x51,0x51,0x63,0x66,0x51,0x51,0x51,0x51,0x51,0x51,0x92,0x92
3051};
3052
3053static const uint8_t map_op2[256] = {
30540x93,0x93,0x93,0x93,0x52,0x52,0x52,0x52,0x52,0x52,0x51,0x52,0x51,0x93,0x52,0x94,
30550x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30560x53,0x53,0x53,0x53,0x53,0x53,0x53,0x53,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30570x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x34,0x51,0x35,0x51,0x51,0x51,0x51,0x51,
30580x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30590x53,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30600x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30610x94,0x54,0x54,0x54,0x93,0x93,0x93,0x52,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30620x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,0x46,
30630x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30640x52,0x52,0x52,0x93,0x94,0x93,0x51,0x51,0x52,0x52,0x52,0x93,0x94,0x93,0x93,0x93,
30650x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x94,0x93,0x93,0x93,0x93,0x93,
30660x93,0x93,0x94,0x93,0x94,0x94,0x94,0x93,0x52,0x52,0x52,0x52,0x52,0x52,0x52,0x52,
30670x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30680x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,
30690x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x93,0x52
3070};
3071
3072static uint32_t asm_x86_inslen(const uint8_t* p)
3073{
3074  uint32_t result = 0;
3075  uint32_t prefixes = 0;
3076  uint32_t x = map_op1[*p];
3077  for (;;) {
3078    switch (x >> 4) {
3079    case 0: return result + x + (prefixes & 4);
3080    case 1: prefixes |= x; x = map_op1[*++p]; result++; break;
3081    case 2: x = map_op2[*++p]; break;
3082    case 3: p++; goto mrm;
3083    case 4: result -= (prefixes & 2);  /* fallthrough */
3084    case 5: return result + (x & 15);
3085    case 6:  /* Group 3. */
3086      if (p[1] & 0x38) x = 2;
3087      else if ((prefixes & 2) && (x == 0x66)) x = 4;
3088      goto mrm;
3089    case 7: /* VEX c4/c5. */
3090      if (LJ_32 && p[1] < 0xc0) {
3091	x = 2;
3092	goto mrm;
3093      }
3094      if (x == 0x70) {
3095	x = *++p & 0x1f;
3096	result++;
3097	if (x >= 2) {
3098	  p += 2;
3099	  result += 2;
3100	  goto mrm;
3101	}
3102      }
3103      p++;
3104      result++;
3105      x = map_op2[*++p];
3106      break;
3107    case 8: result -= (prefixes & 2);  /* fallthrough */
3108    case 9: mrm:  /* ModR/M and possibly SIB. */
3109      result += (x & 15);
3110      x = *++p;
3111      switch (x >> 6) {
3112      case 0: if ((x & 7) == 5) return result + 4; break;
3113      case 1: result++; break;
3114      case 2: result += 4; break;
3115      case 3: return result;
3116      }
3117      if ((x & 7) == 4) {
3118	result++;
3119	if (x < 0x40 && (p[1] & 7) == 5) result += 4;
3120      }
3121      return result;
3122    }
3123  }
3124}
3125
3126/* Patch exit jumps of existing machine code to a new target. */
3127void lj_asm_patchexit(jit_State *J, GCtrace *T, ExitNo exitno, MCode *target)
3128{
3129  MCode *p = T->mcode;
3130  MCode *mcarea = lj_mcode_patch(J, p, 0);
3131  MSize len = T->szmcode;
3132  MCode *px = exitstub_addr(J, exitno) - 6;
3133  MCode *pe = p+len-6;
3134  MCode *pgc = NULL;
3135#if LJ_GC64
3136  uint32_t statei = (uint32_t)(GG_OFS(g.vmstate) - GG_OFS(dispatch));
3137#else
3138  uint32_t statei = u32ptr(&J2G(J)->vmstate);
3139#endif
3140  if (len > 5 && p[len-5] == XI_JMP && p+len-6 + *(int32_t *)(p+len-4) == px)
3141    *(int32_t *)(p+len-4) = jmprel(J, p+len, target);
3142  /* Do not patch parent exit for a stack check. Skip beyond vmstate update. */
3143  for (; p < pe; p += asm_x86_inslen(p)) {
3144    intptr_t ofs = LJ_GC64 ? (p[0] & 0xf0) == 0x40 : LJ_64;
3145    if (*(uint32_t *)(p+2+ofs) == statei && p[ofs+LJ_GC64-LJ_64] == XI_MOVmi)
3146      break;
3147  }
3148  lj_assertJ(p < pe, "instruction length decoder failed");
3149  for (; p < pe; p += asm_x86_inslen(p)) {
3150    if ((*(uint16_t *)p & 0xf0ff) == 0x800f && p + *(int32_t *)(p+2) == px &&
3151	p != pgc) {
3152      *(int32_t *)(p+2) = jmprel(J, p+6, target);
3153    } else if (*p == XI_CALL &&
3154	      (void *)(p+5+*(int32_t *)(p+1)) == (void *)lj_gc_step_jit) {
3155      pgc = p+7;  /* Do not patch GC check exit. */
3156    } else if (LJ_64 && *p == 0xff &&
3157			 p[1] == MODRM(XM_REG, XOg_CALL, RID_RET) &&
3158			 p[2] == XI_NOP) {
3159      pgc = p+5;  /* Do not patch GC check exit. */
3160    }
3161  }
3162  lj_mcode_sync(T->mcode, T->mcode + T->szmcode);
3163  lj_mcode_patch(J, mcarea, 1);
3164}
3165