1. Compiler Construction Code Generation Activation Records
TODO:
ensure consistency in displaying the values of instrumentation predicates for concrete heaps

2. LIR vs. assembly LIR Assembly #Registers Unlimited Limited
Function calls
Implicit
Runtime stack
Instruction set
Abstract
Concrete

3. Function calls Conceptually
Supply new environment (frame) with temporary memory for local variables
Pass parameters to new environment
Transfer flow of control (call/return)
Return information from new environment (ret. value)

4. Activation records New environment = activation record (a.k.a. frame)
Activation record = data of current function / method call
User data
Local variables
Parameters
Return values
Register contents
Administration data
Code addresses

5. Runtime stack Stack of activation records
Call = push new activation record
Return = pop activation record
Only one “active” activation record: top of stack

6. Runtime stack … Stack grows downwards (towards smaller addresses)
Current
frame …
Previous frame SP FP
Stack grows downwards (towards smaller addresses)
SP: stack pointer
top of current frame
FP: frame pointer
base of current frame
Sometimes called BP (base pointer)

7. X86 runtime stack Instruction Usage push, pusha,…
Push on runtime stack
pop, popa,…
Pop from runtime stack
call
Transfer control to called routine
ret
Transfer control back to caller
Register
Usage
ESP
Stack pointer
EBP
Base pointer
X86 stack registers
pusha: Push all general-purpose registers onto stack.
pushad: Push all double-word (32-bit) registers onto stack.
X86 stack and call/ret instructions

8. Call sequences
The processor does not save the content of registers on procedure calls
So who will?
Caller saves and restores registers
Caller’s responsibility
Callee saves and restores registers
Callee’s responsability
Calling conventions describe the interface of called code:
The order in which atomic (scalar) parameters, or individual parts of a complex parameter, are allocated
How parameters are passed (pushed on the stack, placed in registers, or a mix of both)
Which registers may be used by the callee without first being saved (i.e. pushed)
How the task of setting up for and restoring the stack after a function call is divided between the caller and the callee

9. … … Call sequences call return caller callee caller FP SP SP SP SP SP
Push caller-save registers
Push actual parameters (in reverse order) FP … …
caller
Caller push code SP
push return address
Jump to call address
Reg 1 …
Reg n
call SP
Push current base-pointer
bp = sp
Push local variables
Push callee-save registers
Callee push code
(prologue)
Param n …
param1
callee SP
Return address
Callee pop code
(epilogue)
Pop callee-save registers
Pop callee activation record
Pop old base-pointer SP
Previous fp SP
Local 1
Local 2 …
Local n
return FP
pop return address
Jump to address
Caller pop code SP
caller
Pop parameters Pop caller-save registers

10. Call sequences – Foo(42,21) caller callee caller call return push %ecx
call _foo
Push caller-save registers
Push actual parameters (in reverse order)
caller
push return address
Jump to call address
call
push %ebp
mov %esp, %ebp
sub %8, %esp
push %ebx
Push current base-pointer
bp = sp
Push local variables (callee variables)
Push callee-save registers
callee
pop %ebx
mov %ebp, %esp
pop %ebp
ret
Pop callee-save registers
Pop callee activation record
Pop old base-pointer
Registers EAX, ECX, and EDX are caller-saved, and the rest are callee-saved. ECX is a general register.
return
pop return address
Jump to address
add $8, %esp
pop %ecx
caller
Pop parameters Pop caller-save registers

11. “To Callee-save or to Caller-save?”
Callee-saved registers need only be saved when callee modifies their value
Some conventions exist (cdecl)
%eax, %ecx, %edx – caller save
%ebx, %esi, %edi – callee save
%esp – stack pointer
%ebp – frame pointer
Use %eax for return value
cdecl (which stands for C declaration) is a calling convention that originates from the C programming language and is used by many C compilers for the x86 architecture.[1] In cdecl, subroutine arguments are passed on the stack. Integer values and memory addresses are returned in the EAX register, floating point values—in the ST0 x87 register. Registers EAX, ECX, and EDX are caller-saved, and the rest are callee-saved.

12. Accessing stack variables… …
Use offset from EBP
Stack grows downwards
Above EBP = parameters
Below EBP = locals
Examples
%ebp + 4 = return address
%ebp + 8 = first parameter
%ebp – 4 = first local
Param n …
param1
FP+8
Return address FP
Previous fp
Local 1
Local 2 …
Local n-1
Local n
FP-4 SP

13. main calling method bar
int bar(int x) {
int y; … }
static void main(string[] args) {
int z; Foo a = new Foo();
z = a.bar(31);

14. main calling method bar
int bar(Foo this, int x) {
int y; … }
static void main(string[] args) {
int z; Foo a = new Foo();
z = a.bar(a,31); … …
implicit parameter
main’s
frame
EBP+12 31
EBP+8
this ≈ a
Return address
implicit argument
EBP
Previous fp
bar’s
frame y
ESP,
EBP-4
Examples
%ebp + 4 = return address
%ebp + 8 = first parameter
Always this in virtual function calls
%ebp = old %ebp (pushed by callee)
%ebp – 4 = first local

15. x86 assembly AT&T syntax and Intel syntax We’ll be using AT&T syntax
Work with GNU Assembler (GAS)
GAS instructions generally have the form mnemonic source, destination. For instance, the following mov instruction:
movb $0x05, %al
will move the value 5 into the register al.

16. IA-32 Eight 32-bit general-purpose registers EFLAGS register
EAX, EBX, ECX, EDX, ESI, EDI
EBP – stack frame (base) pointer
ESP – stack pointer
EFLAGS register
info on results of arithmetic operations
EIP (instruction pointer) register
Machine-instructions
add, sub, inc, dec, neg, mul, …
generally suffixed with the letters "b", "s", "w", "l", "q" or "t" to determine what size operand is being manipulated.
S-Sign, Z-Zero, C-Carry, P-Parity, O-Overflow

17. Immediate and register operands
Value specified in the instruction itself
Preceded by $
Example: add $4,%esp
Register
Register name is used
Preceded by %
Example: mov %esp,%ebp

18. Memory and base displacement operands
Memory operands
Obtain value at given address
Example: mov (%eax), %eax
Base displacement
Obtain value at computed address
Syntax: disp(base,index,scale)
offset = base + (index * scale) + displacement
Example: mov $42, 2(%eax)
%eax + 2
Example: mov $42, (%eax,%ecx,4)
%eax + %ecx*4
Addressing mode Example Meaning
Register Add R4,R3 R4 <- R4+R3
Immediate Add R4,#3 R4 <- R4+3
Displacement Add R4,100(R1) R4 <- R4+Mem[100+R1]
Register indirect Add R4,(R1) R4 <- R4+Mem[R1]
Indexed / Base Add R3,(R1+R2) R3 <- R3+Mem[R1+R2]
Direct or absolute Add R1,(1001) R1 <- R1+Mem[1001]
Memory indirect Add R1 <- R1+Mem[Mem[R3]]
Auto-increment Add R1,(R2)+ R1 <- R1+Mem[R2]; R2 mR2+d
Auto-decrement Add R1,–(R2) R2 <- R2–d; R1 <- R1+Mem[R2]
Scaled Add R1,100(R2)[R3] R1 <- R1+Mem[100+R2+R3*d]

19. Accessing Variables: Illustration… …
Use offset from base pointer
Above BP = parameters
Below BP = locals (+ LIR reg.s)
Examples:
%eax = %ebp + 8
(%eax) = the value 572
8(%ebp) = the value 572
param n …
572
%eax,BP+8
Return address BP
Previous bp
local 1 …
local n
BP-4 SP

20. Base displacement addressing4 4 4 4 4 4 4 4 7 2 4 5 6 7 1
Array base reference
(%ecx,%ebx,4)
mov (%ecx,%ebx,4), %eax
%ecx = base
%ebx = 3
offset = base + (index * scale) + displacement
offset = %ecx + (3*4) + 0 = %ecx + 12

21. Instruction examples Translate a=p+q into
mov 8(%ebp),%ecx (load p) add 12(%ebp),%ecx (arithmetic p + q) mov %ecx,-4(%ebp) (store a)

22. Instruction examples Array access: a[i]=1 Jumps:
mov -4(%ebp),%ebx (load a) mov -8(%ebp),%ecx (load i) mov $1,(%ebx,%ecx,4) (store into the heap)
Jumps:
Unconditional: jmp label2
Conditional: cmp $0, %ecx jne cmpFailLabel