Csharp 为什么调试版本中的C#JIT汇编代码中的每个方法都有cmp+je

让我们来玩一个有趣的游戏"这在我的代码中做了什么？"

步骤1:在本地编译

我用csc /define:DEBUG; /debug+ /debug:portable(和其他选项)编译了这个结果.

我将阻塞调用添加到Console.ReadLine()，这样我们就不需要在调试器中设置断点了.

using System;

namespace JitHmm
{
    class Program
    {
        static void Main( string[] args )
        {
            C.M();
        }
    }

    public static class C
    {
        public static void M()
        {
            Console.WriteLine( "Foo" );
            _ = Console.ReadLine();
        }
    }
}

第二步:通过WinDbg+SOS启动程序:

• SOS是"Son of Strike"，WinDbg的.NET/CLR调试扩展.
• Documentation is available in the usual places.
• See also.

1. 当程序运行时，它将把"foo"输出到stdout，然后在Console.ReadLine()内等待.

2. 如果您告诉WinDbg中断，它将显示.NET主线程(apphost)在NtReadFile内等待(因为Console.ReadLine正在try 从标准输入读取).

3. 别忘了加载符号，所以WinDbg的反汇编窗口将显示call条指令的已解析函数名，而不是原始内存地址.

4. 打开堆栈跟踪窗口并向上移动到表示M()函数的帧-这将是紧靠在第一个System_Console帧之前的帧.

   • WinDbg似乎没有使用CLR符号在Stack窗口中显示C#方法名称，但如果您运行!DumpStack -EE，那么您将在主命令输出窗口的转储堆栈中看到C.M().

5. 导航到C.M()函数，反汇编窗口应该显示与Sharplab大致相同的内容:

   00007ffe`9a615eff 005548           add     byte ptr [rbp+48h], dl
   00007ffe`9a615f02 83ec30           sub     esp, 30h
   00007ffe`9a615f05 488d6c2430       lea     rbp, [rsp+30h]
   00007ffe`9a615f0a 33c0             xor     eax, eax
   00007ffe`9a615f0c 8945fc           mov     dword ptr [rbp-4], eax
   00007ffe`9a615f0f 488945f0         mov     qword ptr [rbp-10h], rax
   00007ffe`9a615f13 833d16cb090000   cmp     dword ptr [7FFE9A6B2A30h], 0
   00007ffe`9a615f1a 7405             je      00007FFE9A615F21
   00007ffe`9a615f1c e8cf26c85f       call    00007FFEFA2985F0
   00007ffe`9a615f21 90               nop     
   00007ffe`9a615f22 33c9             xor     ecx, ecx
   00007ffe`9a615f24 894dfc           mov     dword ptr [rbp-4], ecx
   00007ffe`9a615f27 488b0c258030701a mov     rcx, qword ptr [1A703080h]
   00007ffe`9a615f2f e8acffffff       call    00007FFE9A615EE0
   00007ffe`9a615f34 90               nop     
   00007ffe`9a615f35 e836ffffff       call    00007FFE9A615E70
   00007ffe`9a615f3a 488945f0         mov     qword ptr [rbp-10h], rax
   

6. 指示WinDbg加载符号，在短暂等待之后，您将看到反汇编窗口中的第call 00007FFEFA2985F0行变为call coreclr!JIT_DbgIsJustMyCode (7ffefa2985f0)行

7. 那么，JIT_DbgIsJustMyCode到底是什么呢？

8. 运行命令!u 00007ffe`9a615f13-它将打印00007ffe`9a615f13处的函数的带注释反汇编，这将向我显示以下内容:

   Normal JIT generated code
   JitHmm.C.M()
   ilAddr is 0000000000592064 pImport is 0000000002BFD460
   Begin 00007FFE9A615F00, size 46
   
   C:\git\_bollocks\JitHmm\Program.cs @ 16:
   00007ffe`9a615f00 55              push    rbp
   00007ffe`9a615f01 4883ec30        sub     rsp,30h
   00007ffe`9a615f05 488d6c2430      lea     rbp,[rsp+30h]
   00007ffe`9a615f0a 33c0            xor     eax,eax
   00007ffe`9a615f0c 8945fc          mov     dword ptr [rbp-4],eax
   00007ffe`9a615f0f 488945f0        mov     qword ptr [rbp-10h],rax
   >>> 00007ffe`9a615f13 833d16cb090000  cmp     dword ptr [00007ffe`9a6b2a30],0
   00007ffe`9a615f1a 7405            je      00007ffe`9a615f21
   00007ffe`9a615f1c e8cf26c85f      call    coreclr!GetCLRRuntimeHost+0x82700 (00007ffe`fa2985f0) (JitHelp: CORINFO_HELP_DBG_IS_JUST_MY_CODE)
   00007ffe`9a615f21 90              nop
   
   C:\git\_bollocks\JitHmm\Program.cs @ 17:
   00007ffe`9a615f22 33c9            xor     ecx,ecx
   00007ffe`9a615f24 894dfc          mov     dword ptr [rbp-4],ecx
   
   C:\git\_bollocks\JitHmm\Program.cs @ 19:
   00007ffe`9a615f27 488b0c258030701a mov     rcx,qword ptr [1A703080h] ("Foo")
   00007ffe`9a615f2f e8acffffff      call    00007ffe`9a615ee0
   00007ffe`9a615f34 90              nop
   
   C:\git\_bollocks\JitHmm\Program.cs @ 20:
   00007ffe`9a615f35 e836ffffff      call    00007ffe`9a615e70
   00007ffe`9a615f3a 488945f0        mov     qword ptr [rbp-10h],rax
   00007ffe`9a615f3e 90              nop
   
   C:\git\_bollocks\JitHmm\Program.cs @ 21:
   00007ffe`9a615f3f 90              nop
   00007ffe`9a615f40 488d6500        lea     rsp,[rbp]
   00007ffe`9a615f44 5d              pop     rbp
   00007ffe`9a615f45 c3              ret
   

9. 请注意第(JitHelp: CORINFO_HELP_DBG_IS_JUST_MY_CODE)部分-that's something we can search on .NET's main GitHub repo

10. ...它解析为CLR本身内置的这个实际函数:void JIT_DbgIsJustMyCode()

11. ...which is documented in debug/ee/debugger.h到well as coreclr/vm/jithelpers.cpp:

    // The jit injects probes in debuggable managed methods that look like:
    // if (*pFlag != 0) call JIT_DbgIsJustMyCode.
    // pFlag is unique per-method constant determined by GetJMCFlagAddr.
    // JIT_DbgIsJustMyCode will get the ip & fp and call OnMethodEnter.
    // pIP is an ip within the method, right after the prolog.
    

    // Callback for Just-My-Code probe
    // Probe looks like:
    //  if (*pFlag != 0) call JIT_DbgIsJustMyCode
    // So this is only called if the flag (obtained by GetJMCFlagAddr) is
    //  non-zero.
    

12. 因此，神秘的cmp和je指令对应于if(*pFlag != 0)发出的指令.

13. 实际的GetJMCFlagAddr功能不是由CLR提供的.

So, what does it do?个

它允许您的调试器在程序的执行点到达用户函数(而不是库函数)时得到通知，这就是Visual Studio中的"只是我的代码"调试器选项的工作方式.

虽然我不确定为什么他们这样做，而不是(例如)只使用PDB符号.