连载《Chrome V8 原理讲解》第十一篇字节码调度 Dispatch机制-安全客

1 摘要

Dispatch（调度）负责字节码的调度，每条字节码执行完后由Dispatch负责调度下一条字节码执行，相当于寄存器EIP++、执行下一条字节码。Dispatch是V8维护的全局指令调度机制，它由调度表（dispatch table）、一个物理寄存器和调度函数Dispatch()组成，每条字节码处理程序（Bytecode handler）执行结束后不执行下一条字节码，而是执行函数Dispatch()，由它负责调用下一条字节码。本文讲解Dispatch机制的源码、数据结构和Dispatch()调度方法。

本文内容组织方式：讲解Dispatch机制具体实现（章节2）；Dispatch()调度下一条字节码的源码分析（章节3）。

2 Dispatch机制

字节码处理程序的地址存储在Dispatch table中，使用物理寄存器维护。Dispatch table是指针数组，数组元素是Code类型指针，指向一个字节码处理程序。

1.  class Code : public HeapObject {
2.   public:
3.    NEVER_READ_ONLY_SPACE
4.    using Flags = uint32_t;
5.  #define CODE_KIND_LIST(V)   \
6.    V(OPTIMIZED_FUNCTION)     \
7.    V(BYTECODE_HANDLER)       \
8.    V(STUB)                   \
9.    V(BUILTIN)                \
10.   V(REGEXP)                 \
11.    V(WASM_FUNCTION)          \
12.    V(WASM_TO_CAPI_FUNCTION)  \
13.    V(WASM_TO_JS_FUNCTION)    \
14.    V(JS_TO_WASM_FUNCTION)    \
15.    V(JS_TO_JS_FUNCTION)      \
16.    V(WASM_INTERPRETER_ENTRY) \
17.    V(C_WASM_ENTRY)
18.    enum Kind {
19.  #define DEFINE_CODE_KIND_ENUM(name) name,
20.      CODE_KIND_LIST(DEFINE_CODE_KIND_ENUM)
21.  #undef DEFINE_CODE_KIND_ENUM
22.          NUMBER_OF_KINDS
23.    };
24.    static const char* Kind2String(Kind kind);
25.  #ifdef ENABLE_DISASSEMBLER
26.    const char* GetName(Isolate* isolate) const;
27.    V8_EXPORT_PRIVATE void Disassemble(const char* name, std::ostream& os,
28.                                       Address current_pc = kNullAddress);
29.  #endif
30.  //.................省略很多代码....................
31.  //.................省略很多代码....................
32.  };

注意： 在Isolate中，还有另一个数据表，用于管理所有Builtin，表项也是Code类型。本文的Dispatch table数据表，只包含Code类型为BYTECODE_HANDLER的Builtin地址。
字节码调度由Builtin方法实现，其外层的入口函数为BuildWithMacroAssembler()，代码如下：

1.  Code BuildWithMacroAssembler(Isolate* isolate, int32_t builtin_index,
2.                               MacroAssemblerGenerator generator,
3.                               const char* s_name) {
4.    HandleScope scope(isolate);
5.    // Canonicalize handles, so that we can share constant pool entries pointing
6.    // to code targets without dereferencing their handles.
7.    CanonicalHandleScope canonical(isolate);
8.    constexpr int kBufferSize = 32 * KB;
9.    byte buffer[kBufferSize];
10.   MacroAssembler masm(isolate, BuiltinAssemblerOptions(isolate, builtin_index),
11.                        CodeObjectRequired::kYes,
12.                        ExternalAssemblerBuffer(buffer, kBufferSize));
13.    masm.set_builtin_index(builtin_index);
14.    DCHECK(!masm.has_frame());
15.    generator(&masm);
16.    int handler_table_offset = 0;
17.    // JSEntry builtins are a special case and need to generate a handler table.
18.    DCHECK_EQ(Builtins::KindOf(Builtins::kJSEntry), Builtins::ASM);
19.    DCHECK_EQ(Builtins::KindOf(Builtins::kJSConstructEntry), Builtins::ASM);
20.    DCHECK_EQ(Builtins::KindOf(Builtins::kJSRunMicrotasksEntry), Builtins::ASM);
21.    if (Builtins::IsJSEntryVariant(builtin_index)) {
22.      handler_table_offset = HandlerTable::EmitReturnTableStart(&masm);
23.      HandlerTable::EmitReturnEntry(
24.          &masm, 0, isolate->builtins()->js_entry_handler_offset());
25.    }
26.    //.....................................................
27.    //................省略很多.............................
28.  }

BuildWithMacroAssembler()的分析方法参见第九篇文章，直接给出它的重要参数：builtin_index值为65，是Builtin编号，generator为Generate_InterpreterEnterBytecodeDispatch，下面是源码：

1.  static void Generate_InterpreterEnterBytecode(MacroAssembler* masm) {
2.    // Set the return address to the correct point in the interpreter entry
3.    // trampoline.
4.    Label builtin_trampoline, trampoline_loaded;
5.    Smi interpreter_entry_return_pc_offset(
6.        masm->isolate()->heap()->interpreter_entry_return_pc_offset());
7.    DCHECK_NE(interpreter_entry_return_pc_offset, Smi::kZero);
8.    // If the SFI function_data is an InterpreterData, the function will have a
9.    // custom copy of the interpreter entry trampoline for profiling. If so,
10.   // get the custom trampoline, otherwise grab the entry address of the global
11.    // trampoline.
12.    __ movq(rbx, Operand(rbp, StandardFrameConstants::kFunctionOffset));
13.    __ LoadTaggedPointerField(
14.        rbx, FieldOperand(rbx, JSFunction::kSharedFunctionInfoOffset));
15.    __ LoadTaggedPointerField(
16.        rbx, FieldOperand(rbx, SharedFunctionInfo::kFunctionDataOffset));
17.    __ CmpObjectType(rbx, INTERPRETER_DATA_TYPE, kScratchRegister);
18.    __ j(not_equal, &builtin_trampoline, Label::kNear);
19.    __ movq(rbx,
20.            FieldOperand(rbx, InterpreterData::kInterpreterTrampolineOffset));
21.    __ addq(rbx, Immediate(Code::kHeaderSize - kHeapObjectTag));
22.    __ jmp(&trampoline_loaded, Label::kNear);
23.    __ bind(&builtin_trampoline);
24.    // TODO(jgruber): Replace this by a lookup in the builtin entry table.
25.    __ movq(rbx,
26.            __ ExternalReferenceAsOperand(
27.                ExternalReference::
28.                    address_of_interpreter_entry_trampoline_instruction_start(
29.                        masm->isolate()),
30.                kScratchRegister));
31.    __ bind(&trampoline_loaded);
32.    __ addq(rbx, Immediate(interpreter_entry_return_pc_offset.value()));
33.    __ Push(rbx);
34.    // Initialize dispatch table register.
35.    __ Move(
36.        kInterpreterDispatchTableRegister,
37.        ExternalReference::interpreter_dispatch_table_address(masm->isolate()));
38.    // Get the bytecode array pointer from the frame.
39.    __ movq(kInterpreterBytecodeArrayRegister,
40.            Operand(rbp, InterpreterFrameConstants::kBytecodeArrayFromFp));
41.    if (FLAG_debug_code) {
42.      // Check function data field is actually a BytecodeArray object.
43.      __ AssertNotSmi(kInterpreterBytecodeArrayRegister);
44.      __ CmpObjectType(kInterpreterBytecodeArrayRegister, BYTECODE_ARRAY_TYPE,
45.                       rbx);
46.      __ Assert(
47.          equal,
48.          AbortReason::kFunctionDataShouldBeBytecodeArrayOnInterpreterEntry);
49.    }
50.    // Get the target bytecode offset from the frame.
51.    __ movq(kInterpreterBytecodeOffsetRegister,
52.            Operand(rbp, InterpreterFrameConstants::kBytecodeOffsetFromFp));
53.    __ SmiUntag(kInterpreterBytecodeOffsetRegister,
54.                kInterpreterBytecodeOffsetRegister);
55.    // Dispatch to the target bytecode.
56.    __ movzxbq(r11, Operand(kInterpreterBytecodeArrayRegister,
57.                            kInterpreterBytecodeOffsetRegister, times_1, 0));
58.    __ movq(kJavaScriptCallCodeStartRegister,
59.            Operand(kInterpreterDispatchTableRegister, r11,
60.                    times_system_pointer_size, 0));
61.    __ jmp(kJavaScriptCallCodeStartRegister);
62.  }
63.  //================================分隔线=========================
64.  //================================分隔线=========================
65.  //================================分隔线=========================
66.  void Builtins::Generate_InterpreterEnterBytecodeDispatch(MacroAssembler* masm) {
67.    Generate_InterpreterEnterBytecode(masm);
68.  }

上述代码由两部分组成，Generate_InterpreterEnterBytecodeDispatch()是字节码调度程序的入口，Generate_InterpreterEnterBytecode()是调度的具体实现，下面给出几点重要概念：

（1） Generate_InterpreterEnterBytecodeDispatch()是Builtin方法。它的index为65号（V8版本不同，index可能略有不同）。

（2） V8使用物理寄存器保存Dispatch table地址，寄存器名字为kInterpreterDispatchTableRegister，在实际运行时映射到物理寄存器。使用物理寄存器可以避免指令调度时的入栈出栈，简化指令设计，提高效率。

下面解释代码的重要语句：

（1） 代码35行把dispatch table地址移动到kInterpreterDispatchTableRegister寄存器，ExternalReference::interpreter_dispatch_table_address(masm->isolate())负责从isolate中取出基址，interpreter_dispatch_table_address的源码如下：

1.  ExternalReference ExternalReference::interpreter_dispatch_table_address(
2.      Isolate* isolate) {
3.    return ExternalReference(isolate->interpreter()->dispatch_table_address());
4.  }
5.  //================================分隔线=========================
6.    interpreter::Interpreter* interpreter() const {
7.      return interpreter_;
8.    }
9.  //================================分隔线=========================
10.   Address dispatch_table_address() {
11.      return reinterpret_cast<Address>(&dispatch_table_[0]);
12.    }

上述代码，可以看到dispatch_table_是数组，基址是&dispatch_table_[0],它的位置是isolate->interpreter_->dispatch_table_。

（2） 代码39行从堆栈中获取bytecode array的基址。

（3） 代码51行获取目标bytecode的偏移量（offset）。

（4） 代码56、58行，计算目标bytecode地址，存入kJavaScriptCallCodeStartRegister。

（5） 代码61行，跳转到kJavaScriptCallCodeStartRegister，调度完毕，图1为函数调用堆栈。

3 Dispatch()方法

Dispatch()是字节码处理程序最后调用的方法，故称之为尾部调用（TailCall）方法，下面给出几条字节码处理程序源码：

1.  // StaGlobal <name_index> <slot>
2.  //
3.  // Store the value in the accumulator into the global with name in constant pool
4.  // entry <name_index> using FeedBackVector slot <slot>.
5.  IGNITION_HANDLER(StaGlobal, InterpreterAssembler) {
6.    TNode<Context> context = GetContext();
7.    // Store the global via the StoreGlobalIC.
8.    TNode<Name> name = CAST(LoadConstantPoolEntryAtOperandIndex(0));
9.    TNode<Object> value = GetAccumulator();
10.   TNode<IntPtrT> raw_slot = Signed(BytecodeOperandIdx(1));
11.    TNode<Smi> smi_slot = SmiTag(raw_slot);
12.    TNode<HeapObject> maybe_vector = LoadFeedbackVector();
13.    Label no_feedback(this, Label::kDeferred), end(this);
14.    GotoIf(IsUndefined(maybe_vector), &no_feedback);
15.    CallBuiltin(Builtins::kStoreGlobalIC, context, name, value, smi_slot,
16.                maybe_vector);
17.    Goto(&end);
18.    Bind(&no_feedback);
19.    CallRuntime(Runtime::kStoreGlobalICNoFeedback_Miss, context, value, name);
20.    Goto(&end);
21.    Bind(&end);
22.    Dispatch();
23.  }
24.  // LdaContextSlot <context> <slot_index> <depth>
25.  //
26.  // Load the object in |slot_index| of the context at |depth| in the context
27.  // chain starting at |context| into the accumulator.
28.  IGNITION_HANDLER(LdaContextSlot, InterpreterAssembler) {
29.    TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
30.    TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
31.    TNode<Uint32T> depth = BytecodeOperandUImm(2);
32.    TNode<Context> slot_context = GetContextAtDepth(context, depth);
33.    TNode<Object> result = LoadContextElement(slot_context, slot_index);
34.    SetAccumulator(result);
35.    Dispatch();
36.  }
37.  // LdaImmutableContextSlot <context> <slot_index> <depth>
38.  //
39.  // Load the object in |slot_index| of the context at |depth| in the context
40.  // chain starting at |context| into the accumulator.
41.  IGNITION_HANDLER(LdaImmutableContextSlot, InterpreterAssembler) {
42.    TNode<Context> context = CAST(LoadRegisterAtOperandIndex(0));
43.    TNode<IntPtrT> slot_index = Signed(BytecodeOperandIdx(1));
44.    TNode<Uint32T> depth = BytecodeOperandUImm(2);
45.    TNode<Context> slot_context = GetContextAtDepth(context, depth);
46.    TNode<Object> result = LoadContextElement(slot_context, slot_index);
47.    SetAccumulator(result);
48.    Dispatch();
49.  }

上述代码给出了三条字节码处理程序，它们的尾部都调用了Dispatch()方法。下面给出Dispatch()源码，并解释重要语句。

1.  void InterpreterAssembler::Dispatch() {
2.    Comment("========= Dispatch");
3.    DCHECK_IMPLIES(Bytecodes::MakesCallAlongCriticalPath(bytecode_), made_call_);
4.    TNode<IntPtrT> target_offset = Advance();
5.    TNode<WordT> target_bytecode = LoadBytecode(target_offset);
6.    if (Bytecodes::IsStarLookahead(bytecode_, operand_scale_)) {
7.      target_bytecode = StarDispatchLookahead(target_bytecode);
8.    }
9.    DispatchToBytecode(target_bytecode, BytecodeOffset());
10. }

第2行代码是注释功能，调试代码时很有用；第4行Advance()是获取目标字节码在bytecode array中的偏移量，请读者自行分析；第5行读取目标字节码；第9行进入DispatchToBytecode()，该方法又进入DispatchToBytecodeHandlerEntry()，代码如下：

void InterpreterAssembler::DispatchToBytecodeHandlerEntry(
    TNode<RawPtrT> handler_entry, TNode<IntPtrT> bytecode_offset) {
  // Propagate speculation poisoning.
  TNode<RawPtrT> poisoned_handler_entry =
      UncheckedCast<RawPtrT>(WordPoisonOnSpeculation(handler_entry));
  TailCallBytecodeDispatch(InterpreterDispatchDescriptor{},
                           poisoned_handler_entry, GetAccumulatorUnchecked(),
                           bytecode_offset, BytecodeArrayTaggedPointer(),
                           DispatchTablePointer());
}

该方法的参数1是目标字节码，它的作用是从dispatch table中索引对应的字节码处理程序；参数2是目标字节码的偏移量，它的作用是从bytecode array中读取操作数，下面进入TailCallBytecodeDispatch():

0.  template <class... TArgs>
1.  void CodeAssembler::TailCallBytecodeDispatch(
2.      const CallInterfaceDescriptor& descriptor, TNode<RawPtrT> target,
3.      TArgs... args) {
4.    DCHECK_EQ(descriptor.GetParameterCount(), sizeof...(args));
5.    auto call_descriptor = Linkage::GetBytecodeDispatchCallDescriptor(
6.        zone(), descriptor, descriptor.GetStackParameterCount());
7.    Node* nodes[] = {target, args...};
8.    CHECK_EQ(descriptor.GetParameterCount() + 1, arraysize(nodes));
9.    raw_assembler()->TailCallN(call_descriptor, arraysize(nodes), nodes);
10.  }

代码第5行建立目标字节码的call discriptor，见下面代码：

0.  CallDescriptor* Linkage::GetBytecodeDispatchCallDescriptor(
1.      Zone* zone, const CallInterfaceDescriptor& descriptor,
2.      int stack_parameter_count) {
3.    const int register_parameter_count = descriptor.GetRegisterParameterCount();
4.    const int parameter_count = register_parameter_count + stack_parameter_count;
5.    DCHECK_EQ(descriptor.GetReturnCount(), 1);
6.    LocationSignature::Builder locations(zone, 1, parameter_count);
7.    locations.AddReturn(regloc(kReturnRegister0, descriptor.GetReturnType(0)));
8.    for (int i = 0; i < parameter_count; i++) {
9.      if (i < register_parameter_count) {
10.        // The first parameters go in registers.
11.        Register reg = descriptor.GetRegisterParameter(i);
12.        MachineType type = descriptor.GetParameterType(i);
13.        locations.AddParam(regloc(reg, type));
14.      } else {
15.        int stack_slot = i - register_parameter_count - stack_parameter_count;
16.        locations.AddParam(LinkageLocation::ForCallerFrameSlot(
17.            stack_slot, MachineType::AnyTagged()));
18.      }
19.    }
20.    MachineType target_type = MachineType::Pointer();
21.    LinkageLocation target_loc = LinkageLocation::ForAnyRegister(target_type);
22.    const CallDescriptor::Flags kFlags =
23.        CallDescriptor::kCanUseRoots | CallDescriptor::kFixedTargetRegister;
24.    return new (zone) CallDescriptor(  // --
25.        CallDescriptor::kCallAddress,  // kind
26.        target_type,                   // target MachineType
27.        target_loc,                    // target location
28.        locations.Build(),             // location_sig
29.        stack_parameter_count,         // stack_parameter_count
30.        Operator::kNoProperties,       // properties
31.        kNoCalleeSaved,                // callee-saved registers
32.        kNoCalleeSaved,                // callee-saved fp
33.        kFlags,                        // flags
34.        descriptor.DebugName());
35.  }

这个函数的参数2是目标字节码，参数3是栈参数的数量，函数的作用是申请寄存器等资源、生成CallDescriptor。CallDescriptor描述了调用字节码时应该提供的参数类型、数量等，代码24行的注释给出了它的布局。

返回TailCallBytecodeDispatch()，第9行raw_assembler()->TailCallN()的第一个参数是CallDescriptor，源码下如:

1.  void RawMachineAssembler::TailCallN(CallDescriptor* call_descriptor,
2.                                      int input_count, Node* const* inputs) {
3.    // +1 is for target.
4.    DCHECK_EQ(input_count, call_descriptor->ParameterCount() + 1);
5.    Node* tail_call =
6.        MakeNode(common()->TailCall(call_descriptor), input_count, inputs);
7.    schedule()->AddTailCall(CurrentBlock(), tail_call);
8.    current_block_ = nullptr;
9.  }

第5行生成Node节点，第7行由AddTailCall()把节点加到当前基本块（Basic Block）的尾部，完成字节码调度，AddTailCall()源码请读者自行分析，图2给出了上述过程的调用堆栈。