Add VM::setDebuggerTrapCallback for runtime debugger activation

Source/JavaScriptCore/debugger/Debugger.cpp

@@ -239,8 +239,22 @@
 
     globalObject->setDebugger(nullptr);
 
-    if (m_globalObjects.isEmpty())
+    if (m_globalObjects.isEmpty()) {
         clearParsedData();
+#if USE(BUN_JSC_ADDITIONS)
+        // A pause started from a VM trap can be stepped out of into code that has no
+        // debug opcodes, so the step never completes and the frontend may disconnect
+        // (detaching us) while it is still armed. Nothing above runs in that case because
+        // we are not paused, so drop the stale state here: clearDebuggerRequests() has
+        // already reset the per-CodeBlock stepping flags, and a later attach() followed
+        // by setSteppingMode(SteppingModeEnabled) must not be a no-op.
+        m_currentCallFrame = nullptr;
+        resetImmediatePauseState();
+        resetEventualPauseState();
+        resetAsyncPauseState();
+        m_steppingMode = SteppingModeDisabled;
+#endif
+    }
 }
 
 bool Debugger::isAttached(JSGlobalObject* globalObject)
@@ -969,11 +983,33 @@
     m_doneProcessingDebuggerEvents = true;
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+// breakProgram() can be entered from a VM trap while the paused frame is running code that
+// was compiled before the debugger attached. Such a frame has no op_debug sites, so the
+// atStatement / returnEvent hooks that complete a step-next/over/out targeted at it never
+// run: the step would silently act as "continue" while leaving m_pauseOnCallFrame pointing at
+// a frame that is going away. Pausing at the next opportunity instead (the behaviour of
+// step-into) completes as soon as any code with debug opcodes runs and leaves nothing armed.
+bool Debugger::currentCallFrameCanCompleteStep() const
+{
+    if (!m_currentCallFrame || m_currentCallFrame->isNativeCalleeFrame())
+        return true;
+    CodeBlock* codeBlock = m_currentCallFrame->codeBlock();
+    return !codeBlock || codeBlock->wasCompiledWithDebuggingOpcodes();
+}
+#endif
+
 void Debugger::stepNextExpression()
 {
     if (!m_isPaused)
         return;
 
+#if USE(BUN_JSC_ADDITIONS)
+    if (!currentCallFrameCanCompleteStep()) {
+        stepIntoStatement();
+        return;
+    }
+#endif
     m_pauseOnCallFrame = m_currentCallFrame;
     m_pauseOnStepNext = true;
     setSteppingMode(SteppingModeEnabled);
@@ -995,6 +1031,12 @@
     if (!m_isPaused)
         return;
 
+#if USE(BUN_JSC_ADDITIONS)
+    if (!currentCallFrameCanCompleteStep()) {
+        stepIntoStatement();
+        return;
+    }
+#endif
     m_pauseOnCallFrame = m_currentCallFrame;
     setSteppingMode(SteppingModeEnabled);
     m_doneProcessingDebuggerEvents = true;
@@ -1005,6 +1047,12 @@
     if (!m_isPaused)
         return;
 
+#if USE(BUN_JSC_ADDITIONS)
+    if (!currentCallFrameCanCompleteStep()) {
+        stepIntoStatement();
+        return;
+    }
+#endif
     EntryFrame* topEntryFrame = m_vm.topEntryFrame;
     m_pauseOnCallFrame = m_currentCallFrame ? m_currentCallFrame->callerFrame(topEntryFrame) : nullptr;
     m_pauseOnStepOut = true;

Source/JavaScriptCore/debugger/Debugger.h

@@ -315,6 +315,9 @@ class Debugger : public DoublyLinkedListNode<Debugger> {
     void resetImmediatePauseState();
     void NODELETE resetEventualPauseState();
     void resetAsyncPauseState();
+#if USE(BUN_JSC_ADDITIONS)
+    bool currentCallFrameCanCompleteStep() const;
+#endif
 
     enum SteppingMode {
         SteppingModeDisabled,

Source/JavaScriptCore/debugger/DebuggerCallFrame.cpp

@@ -150,11 +150,21 @@ DebuggerScope* DebuggerCallFrame::scope(VM& vm)
 
     if (!m_scope) {
         JSScope* scope;
+#if !USE(BUN_JSC_ADDITIONS)
         CodeBlock* codeBlock = m_validMachineFrame->isNativeCalleeFrame() ? nullptr : m_validMachineFrame->codeBlock();
+#endif
         if (isTailDeleted())
             scope = m_shadowChickenFrame.scope;
+#if USE(BUN_JSC_ADDITIONS)
+        // A pause entered through a VM trap can sit on frames whose scope register is not live
+        // (see CallFrame::scopeIfScopeRegisterIsLive); the callee's scope is the answer there,
+        // as it is for any frame of code compiled without debugging opcodes.
+        else if (JSScope* liveScope = m_validMachineFrame->scopeIfScopeRegisterIsLive())
+            scope = liveScope;
+#else
         else if (codeBlock && codeBlock->scopeRegister().isValid())
             scope = m_validMachineFrame->scope(codeBlock->scopeRegister().offset());
+#endif
         else if (JSCallee* callee = dynamicDowncast<JSCallee>(m_validMachineFrame->jsCallee()))
             scope = callee->scope();
         else

Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp

@@ -7436,7 +7436,21 @@
 
 void ByteCodeParser::handleCheckTraps()
 {
+#if USE(BUN_JSC_ADDITIONS)
+    if (Options::usePollingTraps() || m_graph.m_plan.isUnlinked()) {
+        addToGraph(CheckTraps);
+        // With polling traps the debugger trap callback (VMTraps::handleDebuggerBreak) runs
+        // arbitrary JS from inside this frame and jettisons the code blocks on the stack before
+        // returning; this is where the frame then leaves, instead of carrying on with whatever
+        // it had hoisted above the loop.
+        if (!m_graph.m_plan.isUnlinked())
+            addToGraph(InvalidationPoint);
+        return;
+    }
+    addToGraph(InvalidationPoint);
+#else
     addToGraph((Options::usePollingTraps() || m_graph.m_plan.isUnlinked()) ? CheckTraps : InvalidationPoint);
+#endif
 }
 
 void ByteCodeParser::emitPutById(

Source/JavaScriptCore/inspector/JSGlobalObjectInspectorController.cpp

@@ -149,9 +149,6 @@ void JSGlobalObjectInspectorController::connectFrontend(FrontendChannel& fronten
 
 void JSGlobalObjectInspectorController::disconnectFrontend(FrontendChannel& frontendChannel)
 {
-    // FIXME: change this to notify agents which frontend has disconnected (by id).
-    m_agents.willDestroyFrontendAndBackend(DisconnectReason::InspectorDestroyed);
-
     m_frontendRouter->disconnectFrontend(frontendChannel);
 
     m_isAutomaticInspection = false;
@@ -161,6 +158,9 @@ void JSGlobalObjectInspectorController::disconnectFrontend(FrontendChannel& fron
     if (!disconnectedLastFrontend)
         return;
 
+    // FIXME: change this to notify agents which frontend has disconnected (by id).
+    m_agents.willDestroyFrontendAndBackend(DisconnectReason::InspectorDestroyed);
+
 #if ENABLE(INSPECTOR_ALTERNATE_DISPATCHERS)
     if (m_augmentingClient)
         m_augmentingClient->inspectorDisconnected();

Source/JavaScriptCore/interpreter/CallFrame.cpp

@@ -158,6 +158,25 @@ CodeOrigin CallFrame::codeOrigin() const
     return CodeOrigin(callSiteIndex().bytecodeIndex());
 }
 
+#if USE(BUN_JSC_ADDITIONS)
+JSScope* CallFrame::scopeIfScopeRegisterIsLive() const
+{
+    // BytecodeUseDef keeps the scope register live only in code compiled with debugging
+    // opcodes, and only after op_enter. Outside of that the slot holds whatever happened to
+    // be there: the DFG does not allocate it, a baseline frame reached by OSR exit from such
+    // code has a dead value in it, and a VM trap serviced in the prologue sees a frame whose
+    // locals have not been written at all. Between op_enter and op_get_scope it is undefined.
+    if (isNativeCalleeFrame())
+        return nullptr;
+    CodeBlock* codeBlock = this->codeBlock();
+    if (!codeBlock || !codeBlock->wasCompiledWithDebuggingOpcodes() || !codeBlock->scopeRegister().isValid())
+        return nullptr;
+    if (!bytecodeIndex().offset())
+        return nullptr;
+    return dynamicDowncast<JSScope>(registers()[codeBlock->scopeRegister().offset()].jsValue());
+}
+#endif
+
 Register* CallFrame::topOfFrameInternal()
 {
     CodeBlock* codeBlock = this->codeBlock();

Source/JavaScriptCore/interpreter/CallFrame.h

@@ -269,6 +269,12 @@ using JSInstruction = BaseInstruction<JSOpcodeTraits>;
         // CodeOrigin(BytecodeIndex(0)) if we're in native code.
         JS_EXPORT_PRIVATE CodeOrigin codeOrigin() const;
 
+#if USE(BUN_JSC_ADDITIONS)
+        // The scope held in this frame's scope register, or null whenever that slot cannot be
+        // trusted; callers then fall back to the callee's scope. See CallFrame.cpp.
+        JSScope* scopeIfScopeRegisterIsLive() const;
+#endif
+
         inline Register* topOfFrame();
 
         const JSInstruction* NODELETE currentVPC() const; // This only makes sense in the LLInt and baseline.

Source/JavaScriptCore/interpreter/ShadowChicken.cpp

@@ -334,13 +334,21 @@ void ShadowChicken::update(VM& vm, CallFrame* callFrame)
             bool isTailDeleted = false;
             JSScope* scope = nullptr;
             CodeBlock* codeBlock = callFrame->isNativeCalleeFrame() ? nullptr : callFrame->codeBlock();
+#if USE(BUN_JSC_ADDITIONS)
+            // Same rule as DebuggerCallFrame::scope(): this walk can now also happen from a
+            // debugger pause entered through a VM trap, so the slot is only read when it is live.
+            if (JSScope* liveScope = callFrame->scopeIfScopeRegisterIsLive())
+                scope = liveScope;
+            else if (foundFrame) {
+#else
             JSValue scopeValue = callFrame->bytecodeIndex() && codeBlock && codeBlock->scopeRegister().isValid()
                 ? callFrame->registers()[codeBlock->scopeRegister().offset()].jsValue()
                 : jsUndefined();
             if (!scopeValue.isUndefined() && codeBlock->wasCompiledWithDebuggingOpcodes()) {
                 scope = uncheckedDowncast<JSScope>(scopeValue.asCell());
                 RELEASE_ASSERT(scope->inherits<JSScope>());
             } else if (foundFrame) {
+#endif
                 scope = m_log[indexInLog].scope;
                 if (scope)
                     RELEASE_ASSERT(scope->inherits<JSScope>());

Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

@@ -560,7 +560,14 @@ UGPRPair SYSV_ABI llint_check_stack_and_vm_traps(CallFrame* callFrame, const JSI
 #endif
     }
 
-    if (vm.traps().handleTrapsIfNeeded()) {
+#if USE(BUN_JSC_ADDITIONS)
+    // This frame is at bytecode 0 with op_enter still to run, so it cannot be paused on; the
+    // debugger trap callback (VM::setDebuggerTrapCallback) waits for the next op_check_traps.
+    bool handledTraps = vm.traps().handleTrapsIfNeeded(VMTraps::NonDebuggerAsyncEvents);
+#else
+    bool handledTraps = vm.traps().handleTrapsIfNeeded();
+#endif
+    if (handledTraps) {
         if (vm.hasPendingTerminationException()) {
             throwScope.release();
             callFrame->convertToZombieFrame(vm, codeBlock);

Source/JavaScriptCore/runtime/VM.h

@@ -1103,6 +1103,30 @@ class VM : public ThreadSafeRefCountedWithSuppressingSaferCPPChecking<VM> {
     JS_EXPORT_PRIVATE bool hasExceptionsAfterHandlingTraps();
 
     CONCURRENT_SAFE void notifyNeedDebuggerBreak() { traps().fireTrap(VMTraps::NeedDebuggerBreak); }
+#if USE(BUN_JSC_ADDITIONS)
+    // Lets an embedder service NeedDebuggerBreak itself, e.g. to attach a debugger to a program
+    // that is already running and enter Debugger::breakProgram() from code that was compiled
+    // without op_debug sites. VMTraps::handleDebuggerBreak() calls it on the owning thread with
+    // the API lock held, with no exception pending, and it must return the same way; it may
+    // run JS and pause. It is never nested: a NeedDebuggerBreak fired while it runs is taken
+    // again once it returns. Termination requested meanwhile is deferred and re-fired after it.
+    //
+    // Where it runs: op_check_traps (loop headers, every tier), or wherever the embedder calls
+    // traps().handleTrapsIfNeeded(VMTraps::NeedDebuggerBreak) itself. The LLInt and IPInt
+    // function prologues deliberately do not service this bit, because they run before the
+    // callee's frame is initialised. Nothing else retires the bit either: an embedder that
+    // keeps the API lock while idle has to make that call from its idle loop, otherwise the
+    // signal sender keeps interrupting the thread until some loop happens to run.
+    //
+    // What it buys: pausing and evaluating in code that was already running. Breakpoints,
+    // `debugger` statements and stepping only take effect in code compiled after the debugger
+    // attached (CodeGenerationMode::Debugger), i.e. once the currently running code has been
+    // re-entered after the VM went idle; Debugger degrades steps out of such frames to a pause
+    // at the next opportunity.
+    using DebuggerTrapCallback = void (*)(VM&);
+    CONCURRENT_SAFE void setDebuggerTrapCallback(DebuggerTrapCallback cb) { m_debuggerTrapCallback.store(cb, std::memory_order_release); }
+    DebuggerTrapCallback debuggerTrapCallback() const { return m_debuggerTrapCallback.load(std::memory_order_acquire); }
+#endif
     CONCURRENT_SAFE void notifyNeedShellTimeoutCheck() { traps().fireTrap(VMTraps::NeedShellTimeoutCheck); }
     CONCURRENT_SAFE void notifyNeedTermination() { traps().fireTrap(VMTraps::NeedTermination); }
     CONCURRENT_SAFE void notifyNeedWatchdogCheck() { traps().fireTrap(VMTraps::NeedWatchdogCheck); }
@@ -1360,6 +1384,9 @@ class VM : public ThreadSafeRefCountedWithSuppressingSaferCPPChecking<VM> {
     const Ref<Waiter> m_syncWaiter;
 
     std::atomic<int64_t> m_numberOfActiveJITPlans { 0 };
+#if USE(BUN_JSC_ADDITIONS)
+    std::atomic<DebuggerTrapCallback> m_debuggerTrapCallback { nullptr };
+#endif
 
     Vector<Function<void()>> m_didPopListeners;