jsilnet 0.0.0-stage → 0.2.0

package/src/il/instructions.js

@@ -0,0 +1,217 @@
+import { BinaryReader } from "../binary/reader.js";
+import { FormatError } from "../binary/errors.js";
+import { getOpcode } from "./opcodes.js";
+
+const operandReaders = {
+  none: () => undefined,
+  u1: (reader) => reader.u1(),
+  i1: (reader) => reader.i1(),
+  u2: (reader) => reader.u2(),
+  i4: (reader) => reader.i4(),
+  i8: (reader) => reader.u8(),
+  f4: (reader) => reader.f4(),
+  f8: (reader) => reader.f8(),
+  token: (reader) => reader.u4()
+};
+
+export function decodeInstructions(input, { baseOffset = 0, ilOffset = 0 } = {}) {
+  const bytes = input instanceof Uint8Array ? input : new Uint8Array(input);
+  const reader = new BinaryReader(bytes, { baseOffset, context: "CIL instructions" });
+  const instructions = [];
+  while (reader.remaining > 0) {
+    const start = reader.position;
+    const first = reader.u1();
+    const code = first === 0xfe ? 0xfe00 | reader.u1() : first;
+    const opcode = getOpcode(code);
+    if (!opcode) {
+      throw new FormatError(`Unknown CIL opcode 0x${code.toString(16)}`, {
+        offset: baseOffset + start,
+        context: "CIL instructions"
+      });
+    }
+    const operandOffset = baseOffset + reader.position;
+    let operand;
+    let patchOffsets = [];
+    if (opcode.operand === "branch1" || opcode.operand === "branch4") {
+      const displacement = opcode.operand === "branch1" ? reader.i1() : reader.i4();
+      operand = { kind: "branch", targetOffset: reader.position + displacement + ilOffset };
+      patchOffsets = [operandOffset];
+    } else if (opcode.operand === "switch") {
+      const count = reader.u4();
+      if (count > Math.floor(reader.remaining / 4)) {
+        throw new FormatError("Switch target count exceeds remaining method body", {
+          offset: baseOffset + start,
+          context: "CIL switch operand"
+        });
+      }
+      const offsetsStart = reader.position;
+      const displacements = Array.from({ length: count }, () => reader.i4());
+      const base = reader.position + ilOffset;
+      operand = {
+        kind: "switch",
+        targetOffsets: displacements.map((value) => base + value)
+      };
+      patchOffsets = displacements.map((_, index) => baseOffset + offsetsStart + index * 4);
+    } else {
+      const read = operandReaders[opcode.operand];
+      if (!read) throw new FormatError(`Unsupported operand kind ${opcode.operand}`, { offset: baseOffset + start });
+      const value = read(reader);
+      operand = value === undefined ? null : { kind: opcode.operand, value };
+      if (opcode.operand !== "none") patchOffsets = [operandOffset];
+    }
+    instructions.push({
+      opcode,
+      offset: start + ilOffset,
+      size: reader.position - start,
+      opcodeOffset: baseOffset + start,
+      opcodeSize: first === 0xfe ? 2 : 1,
+      operandOffset,
+      patchOffsets,
+      operand
+    });
+  }
+  const boundaries = new Set(instructions.map((instruction) => instruction.offset));
+  for (const instruction of instructions) {
+    const targets = instruction.operand?.kind === "branch"
+      ? [instruction.operand.targetOffset]
+      : instruction.operand?.kind === "switch"
+        ? instruction.operand.targetOffsets
+        : [];
+    for (const target of targets) {
+      if (!boundaries.has(target)) {
+        throw new FormatError(`Branch target IL_${target.toString(16)} is not an instruction boundary`, {
+          offset: instruction.operandOffset,
+          context: "CIL branch operand"
+        });
+      }
+    }
+  }
+  return instructions;
+}
+
+export function encodeOpcode(opcode) {
+  if (!opcode || !Number.isInteger(opcode.code) || opcode.code < 0 || opcode.code > 0xffff) {
+    throw new TypeError("Invalid CIL opcode");
+  }
+  return opcode.code > 0xff
+    ? Uint8Array.from([0xfe, opcode.code & 0xff])
+    : Uint8Array.from([opcode.code]);
+}
+
+export function getInstructionSize(opcode, operand) {
+  const opcodeSize = opcode.code > 0xff ? 2 : 1;
+  const operandSize = {
+    none: 0,
+    u1: 1,
+    i1: 1,
+    u2: 2,
+    i4: 4,
+    i8: 8,
+    f4: 4,
+    f8: 8,
+    token: 4,
+    branch1: 1,
+    branch4: 4,
+    switch: 4 + 4 * (operand?.targetOffsets?.length ?? 0)
+  }[opcode.operand];
+  if (operandSize === undefined) throw new FormatError(`Unsupported operand kind ${opcode.operand}`);
+  return opcodeSize + operandSize;
+}
+
+export function encodeInstruction(instruction) {
+  const opcodeBytes = encodeOpcode(instruction.opcode);
+  let operandBytes = new Uint8Array();
+  if (instruction.operand) {
+    const value = instruction.operand.kind === "branch"
+      ? instruction.operand.targetOffset
+      : instruction.operand.kind === "switch"
+        ? instruction.operand.targetOffsets
+        : instruction.operand.value;
+    operandBytes = encodeOperand(instruction, value);
+    if (instruction.operand.kind === "switch") {
+      const count = new Uint8Array(4);
+      new DataView(count.buffer).setUint32(0, instruction.operand.targetOffsets.length, true);
+      const combined = new Uint8Array(count.length + operandBytes.length);
+      combined.set(count);
+      combined.set(operandBytes, count.length);
+      operandBytes = combined;
+    }
+  }
+  if (opcodeBytes.length + operandBytes.length !== instruction.size) {
+    throw new FormatError("Encoded instruction size does not match the layout");
+  }
+  const result = new Uint8Array(instruction.size);
+  result.set(opcodeBytes);
+  result.set(operandBytes, opcodeBytes.length);
+  return result;
+}
+
+export function formatInstruction(instruction) {
+  const operand = instruction.operand;
+  if (!operand) return `${instruction.opcode.name}`;
+  if (operand.kind === "branch") return `${instruction.opcode.name} IL_${operand.targetOffset.toString(16).padStart(4, "0")}`;
+  if (operand.kind === "switch") {
+    return `${instruction.opcode.name} (${operand.targetOffsets.map((target) => `IL_${target.toString(16).padStart(4, "0")}`).join(", ")})`;
+  }
+  const value = typeof operand.value === "bigint" ? `${operand.value}n` : String(operand.value);
+  return `${instruction.opcode.name} ${value}`;
+}
+
+export function encodeOperand(instruction, value) {
+  const kind = instruction.operand?.kind;
+  const buffer = new ArrayBuffer(instruction.size);
+  const view = new DataView(buffer);
+  if (kind === "branch") {
+    const width = instruction.opcode.operand === "branch1" ? 1 : 4;
+    const displacement = value - (instruction.offset + instruction.size);
+    if (width === 1) {
+      if (!Number.isInteger(displacement) || displacement < -128 || displacement > 127) {
+        throw new RangeError("Branch target does not fit the existing short-branch operand");
+      }
+      view.setInt8(0, displacement);
+      return new Uint8Array(buffer, 0, 1);
+    }
+    if (!Number.isInteger(displacement) || displacement < -0x80000000 || displacement > 0x7fffffff) {
+      throw new RangeError("Branch target does not fit the existing branch operand");
+    }
+    view.setInt32(0, displacement, true);
+    return new Uint8Array(buffer, 0, 4);
+  }
+  if (kind === "switch") {
+    if (!Array.isArray(value) || value.length !== instruction.operand.targetOffsets.length) {
+      throw new RangeError("A fixed-size edit must preserve the switch target count");
+    }
+    const baseOffset = instruction.offset + instruction.size;
+    const result = new Uint8Array(value.length * 4);
+    const switchView = new DataView(result.buffer);
+    value.forEach((target, index) => {
+      const displacement = target - baseOffset;
+      if (!Number.isInteger(target) || displacement < -0x80000000 || displacement > 0x7fffffff) {
+        throw new RangeError("Switch target does not fit its 32-bit displacement");
+      }
+      switchView.setInt32(index * 4, displacement, true);
+    });
+    return result;
+  }
+  const operandInfo = {
+    u1: ["setUint8", 1], i1: ["setInt8", 1], u2: ["setUint16", 2], i4: ["setInt32", 4],
+    i8: ["setBigInt64", 8], f4: ["setFloat32", 4], f8: ["setFloat64", 8], token: ["setUint32", 4]
+  }[kind];
+  if (!operandInfo) throw new TypeError("Instruction does not have a patchable fixed-size operand");
+  const [setter, width] = operandInfo;
+  if (kind === "token" || kind === "u1" || kind === "u2") {
+    const max = width === 1 ? 0xff : width === 2 ? 0xffff : 0xffffffff;
+    if (!Number.isInteger(value) || value < 0 || value > max) throw new RangeError(`Value does not fit ${kind}`);
+  } else if (kind === "i1" && (!Number.isInteger(value) || value < -128 || value > 127)) {
+    throw new RangeError("Value does not fit i1");
+  } else if (kind === "i4" && (!Number.isInteger(value) || value < -0x80000000 || value > 0x7fffffff)) {
+    throw new RangeError("Value does not fit i4");
+  } else if (kind === "i8" && (typeof value !== "bigint" || value < -(1n << 63n) || value > (1n << 63n) - 1n)) {
+    throw new RangeError("Value does not fit i8");
+  } else if ((kind === "f4" || kind === "f8") && typeof value !== "number") {
+    throw new TypeError("Floating-point operands must be numbers");
+  }
+  const result = new Uint8Array(width);
+  new DataView(result.buffer)[setter](0, value, true);
+  return result;
+}

package/src/il/opcodes.js

@@ -0,0 +1,102 @@
+function descriptor(code, name, operand = "none", shortBranch = null, longBranch = null) {
+  return { code, name, operand, shortBranch, longBranch };
+}
+
+const opcodes = new Map();
+const add = (...args) => {
+  const entry = descriptor(...args);
+  opcodes.set(entry.code, entry);
+};
+
+add(0x00, "nop");
+add(0x01, "break");
+for (let i = 0; i < 4; i++) {
+  add(0x02 + i, `ldarg.${i}`);
+  add(0x06 + i, `ldloc.${i}`);
+  add(0x0a + i, `stloc.${i}`);
+}
+add(0x0e, "ldarg.s", "u1");
+add(0x0f, "ldarga.s", "u1");
+add(0x10, "starg.s", "u1");
+add(0x11, "ldloc.s", "u1");
+add(0x12, "ldloca.s", "u1");
+add(0x13, "stloc.s", "u1");
+add(0x14, "ldnull");
+add(0x15, "ldc.i4.m1");
+for (let i = 0; i <= 8; i++) add(0x16 + i, `ldc.i4.${i}`);
+add(0x1f, "ldc.i4.s", "i1");
+add(0x20, "ldc.i4", "i4");
+add(0x21, "ldc.i8", "i8");
+add(0x22, "ldc.r4", "f4");
+add(0x23, "ldc.r8", "f8");
+add(0x25, "dup");
+add(0x26, "pop");
+add(0x27, "jmp", "token");
+add(0x28, "call", "token");
+add(0x29, "calli", "token");
+add(0x2a, "ret");
+
+const branchNames = ["br", "brfalse", "brtrue", "beq", "bge", "bgt", "ble", "blt", "bne.un", "bge.un", "bgt.un", "ble.un", "blt.un"];
+for (let i = 0; i < branchNames.length; i++) {
+  add(0x2b + i, `${branchNames[i]}.s`, "branch1", null, 0x38 + i);
+  add(0x38 + i, branchNames[i], "branch4", 0x2b + i);
+}
+add(0x45, "switch", "switch");
+
+const simpleNames = [
+  "ldind.i1", "ldind.u1", "ldind.i2", "ldind.u2", "ldind.i4", "ldind.u4", "ldind.i8", "ldind.i",
+  "ldind.r4", "ldind.r8", "ldind.ref", "stind.ref", "stind.i1", "stind.i2", "stind.i4", "stind.i8",
+  "stind.r4", "stind.r8", "add", "sub", "mul", "div", "div.un", "rem", "rem.un", "and", "or", "xor",
+  "shl", "shr", "shr.un", "neg", "not", "conv.i1", "conv.i2", "conv.i4", "conv.i8", "conv.r4",
+  "conv.r8", "conv.u4", "conv.u8"
+];
+for (let i = 0; i < simpleNames.length; i++) add(0x46 + i, simpleNames[i]);
+
+[
+  [0x6f, "callvirt", "token"], [0x70, "cpobj", "token"], [0x71, "ldobj", "token"],
+  [0x72, "ldstr", "token"], [0x73, "newobj", "token"], [0x74, "castclass", "token"],
+  [0x75, "isinst", "token"], [0x76, "conv.r.un"], [0x79, "unbox", "token"],
+  [0x7a, "throw"], [0x7b, "ldfld", "token"], [0x7c, "ldflda", "token"],
+  [0x7d, "stfld", "token"], [0x7e, "ldsfld", "token"], [0x7f, "ldsflda", "token"],
+  [0x80, "stsfld", "token"], [0x81, "stobj", "token"], [0x8c, "box", "token"],
+  [0x8d, "newarr", "token"], [0x8e, "ldlen"], [0x8f, "ldelema", "token"],
+  [0xa3, "ldelem", "token"], [0xa4, "stelem", "token"], [0xa5, "unbox.any", "token"],
+  [0xc2, "refanyval", "token"], [0xc3, "ckfinite"], [0xc6, "mkrefany", "token"],
+  [0xd0, "ldtoken", "token"], [0xdc, "endfinally"], [0xdd, "leave", "branch4", 0xde],
+  [0xde, "leave.s", "branch1", null, 0xdd], [0xdf, "stind.i"], [0xe0, "conv.u"]
+].forEach((item) => add(...item));
+
+const conversionNames = [
+  "conv.ovf.i1.un", "conv.ovf.i2.un", "conv.ovf.i4.un", "conv.ovf.i8.un", "conv.ovf.u1.un",
+  "conv.ovf.u2.un", "conv.ovf.u4.un", "conv.ovf.u8.un", "conv.ovf.i.un", "conv.ovf.u.un"
+];
+for (let i = 0; i < conversionNames.length; i++) add(0x82 + i, conversionNames[i]);
+for (let i = 0; i < 11; i++) add(0x90 + i, `ldelem.${["i1", "u1", "i2", "u2", "i4", "u4", "i8", "i", "r4", "r8", "ref"][i]}`);
+for (let i = 0; i < 7; i++) add(0x9b + i, `stelem.${["i", "i1", "i2", "i4", "i8", "r4", "r8"][i]}`);
+add(0xa2, "stelem.ref");
+for (const [code, name] of [
+  [0xb3, "conv.ovf.i1"], [0xb4, "conv.ovf.u1"], [0xb5, "conv.ovf.i2"], [0xb6, "conv.ovf.u2"],
+  [0xb7, "conv.ovf.i4"], [0xb8, "conv.ovf.u4"], [0xb9, "conv.ovf.i8"], [0xba, "conv.ovf.u8"],
+  [0xd1, "conv.i"], [0xd2, "conv.ovf.i"],
+  [0xd3, "conv.ovf.u"], [0xd4, "add.ovf"], [0xd5, "add.ovf.un"], [0xd6, "mul.ovf"],
+  [0xd7, "mul.ovf.un"], [0xd8, "sub.ovf"], [0xd9, "sub.ovf.un"]
+]) add(code, name);
+
+for (const [code, name, operand] of [
+  [0xfe00, "arglist"], [0xfe01, "ceq"], [0xfe02, "cgt"], [0xfe03, "cgt.un"],
+  [0xfe04, "clt"], [0xfe05, "clt.un"], [0xfe06, "ldftn", "token"], [0xfe07, "ldvirtftn", "token"],
+  [0xfe09, "ldarg", "u2"], [0xfe0a, "ldarga", "u2"], [0xfe0b, "starg", "u2"],
+  [0xfe0c, "ldloc", "u2"], [0xfe0d, "ldloca", "u2"], [0xfe0e, "stloc", "u2"],
+  [0xfe0f, "localloc"], [0xfe11, "endfilter"], [0xfe12, "unaligned.", "u1"],
+  [0xfe13, "volatile."], [0xfe14, "tail."], [0xfe15, "initobj", "token"],
+  [0xfe16, "constrained.", "token"], [0xfe17, "cpblk"], [0xfe18, "initblk"],
+  [0xfe1a, "rethrow"], [0xfe1c, "sizeof", "token"], [0xfe1d, "refanytype"], [0xfe1e, "readonly."]
+]) add(code, name, operand ?? "none");
+
+export function getOpcode(code) {
+  return opcodes.get(code) ?? null;
+}
+
+export function listOpcodes() {
+  return [...opcodes.values()];
+}

package/src/il/rewrite.js

@@ -0,0 +1,331 @@
+import { FormatError } from "../binary/errors.js";
+import { encodeInstruction, encodeOperand, getInstructionSize } from "./instructions.js";
+import { getOpcode } from "./opcodes.js";
+
+function findInstruction(instructions, offset) {
+  const instruction = instructions.find((candidate) => candidate.offset === offset);
+  if (!instruction) throw new RangeError(`No instruction begins at IL_${offset.toString(16)}`);
+  return instruction;
+}
+
+function findBoundary(instructions, offset, codeSize, allowEnd = false) {
+  if (allowEnd && offset === codeSize) return null;
+  return findInstruction(instructions, offset);
+}
+
+function toClauseState(body, instructions) {
+  const clauses = [];
+  for (const section of body.sections) {
+    for (const clause of section.clauses) {
+      clauses.push({
+        ...clause,
+        tryStart: findBoundary(instructions, clause.tryOffset, body.codeSize),
+        tryEnd: findBoundary(instructions, clause.tryOffset + clause.tryLength, body.codeSize, true),
+        handlerStart: findBoundary(instructions, clause.handlerOffset, body.codeSize),
+        handlerEnd: findBoundary(instructions, clause.handlerOffset + clause.handlerLength, body.codeSize, true),
+        filterStart: (clause.flags & 1) !== 0
+          ? findBoundary(instructions, clause.classTokenOrFilterOffset, body.codeSize)
+          : null
+      });
+    }
+  }
+  return clauses;
+}
+
+function updateRegionOffsets(state) {
+  const end = (instruction) => instruction?.offset ?? state.body.codeSize;
+  for (const clause of state.clauses) {
+    clause.tryOffset = clause.tryStart.offset;
+    clause.tryLength = end(clause.tryEnd) - clause.tryOffset;
+    clause.handlerOffset = clause.handlerStart.offset;
+    clause.handlerLength = end(clause.handlerEnd) - clause.handlerOffset;
+    if (clause.filterStart) clause.classTokenOrFilterOffset = clause.filterStart.offset;
+  }
+  state.body.sections = state.clauses.length > 0
+    ? [{ clauses: state.clauses }]
+    : [];
+}
+
+export function createStructuralState(body) {
+  const instructions = body.instructions.map((instruction) => ({
+    ...instruction,
+    originalOffset: Object.hasOwn(instruction, "originalOffset")
+      ? instruction.originalOffset
+      : instruction.offset,
+    operand: instruction.operand
+      ? instruction.operand.kind === "switch"
+        ? { kind: "switch", targetOffsets: [...instruction.operand.targetOffsets] }
+        : { ...instruction.operand }
+      : null,
+    isNew: false
+  }));
+  const byOffset = new Map(instructions.map((instruction) => [instruction.offset, instruction]));
+  const branchTargets = new Map();
+  for (const instruction of instructions) {
+    if (instruction.operand?.kind === "branch") {
+      const target = byOffset.get(instruction.operand.targetOffset);
+      if (!target) throw new FormatError("Branch target cannot be represented during structural editing");
+      branchTargets.set(instruction, target);
+    } else if (instruction.operand?.kind === "switch") {
+      const targets = instruction.operand.targetOffsets.map((offset) => {
+        const target = byOffset.get(offset);
+        if (!target) throw new FormatError("Switch target cannot be represented during structural editing");
+        return target;
+      });
+      branchTargets.set(instruction, targets);
+    }
+  }
+  const state = {
+    body: { ...body, instructions },
+    instructions,
+    branchTargets,
+    clauses: toClauseState(body, instructions),
+    maxStack: body.maxStack
+  };
+  layoutStructuralState(state);
+  return state;
+}
+
+export function layoutStructuralState(state) {
+  const maxPasses = state.instructions.length + 1;
+  for (let pass = 0; pass < maxPasses; pass++) {
+    let offset = 0;
+    for (const instruction of state.instructions) {
+      instruction.offset = offset;
+      instruction.size = getInstructionSize(instruction.opcode, instruction.operand);
+      instruction.opcodeSize = instruction.opcode.code > 0xff ? 2 : 1;
+      offset += instruction.size;
+    }
+    state.body.codeSize = offset;
+
+    let promoted = false;
+    for (const instruction of state.instructions) {
+      if (instruction.operand?.kind !== "branch") continue;
+      const target = state.branchTargets.get(instruction);
+      if (!target) throw new FormatError("Branch instruction has no resolved target");
+      const displacement = target.offset - (instruction.offset + instruction.size);
+      if (instruction.opcode.operand === "branch1" && (displacement < -128 || displacement > 127)) {
+        if (instruction.opcode.longBranch === null || instruction.opcode.longBranch === undefined) {
+          throw new FormatError(`Short branch ${instruction.opcode.name} has no long form`);
+        }
+        instruction.opcode = getOpcode(instruction.opcode.longBranch);
+        promoted = true;
+      } else if (instruction.opcode.operand === "branch4" &&
+                 (displacement < -0x80000000 || displacement > 0x7fffffff)) {
+        throw new RangeError("Branch target exceeds the 32-bit displacement range");
+      }
+    }
+    if (!promoted) {
+      for (const instruction of state.instructions) {
+        if (instruction.operand?.kind === "branch") {
+          instruction.operand.targetOffset = state.branchTargets.get(instruction).offset;
+        } else if (instruction.operand?.kind === "switch") {
+          instruction.operand.targetOffsets = state.branchTargets.get(instruction).map((target) => target.offset);
+        }
+      }
+      updateRegionOffsets(state);
+      return state;
+    }
+  }
+  throw new FormatError("Branch layout did not converge");
+}
+
+function resolveTargets(state, opcode, value) {
+  if (opcode.operand === "branch1" || opcode.operand === "branch4") {
+    if (!Number.isInteger(value)) throw new TypeError("Branch operand must be an IL offset");
+    const target = state.instructions.find((instruction) => instruction.offset === value);
+    if (!target) throw new RangeError(`Branch target IL_${value.toString(16)} is not an instruction boundary`);
+    return { operand: { kind: "branch", targetOffset: value }, targets: target };
+  }
+  if (opcode.operand === "switch") {
+    if (!Array.isArray(value)) throw new TypeError("Switch operand must be an array of IL target offsets");
+    const targets = value.map((targetOffset) => {
+      const target = state.instructions.find((instruction) => instruction.offset === targetOffset);
+      if (!target) throw new RangeError(`Switch target IL_${targetOffset.toString(16)} is not an instruction boundary`);
+      return target;
+    });
+    return { operand: { kind: "switch", targetOffsets: [...value] }, targets };
+  }
+  if (opcode.operand === "none") {
+    if (value !== undefined) throw new TypeError(`${opcode.name} does not accept an operand`);
+    return { operand: null, targets: null };
+  }
+  return { operand: { kind: opcode.operand, value }, targets: null };
+}
+
+function makeInstruction(state, opcode, value) {
+  const { operand, targets } = resolveTargets(state, opcode, value);
+  const instruction = {
+    opcode,
+    operand,
+    offset: 0,
+    size: getInstructionSize(opcode, operand),
+    opcodeSize: opcode.code > 0xff ? 2 : 1,
+    opcodeOffset: null,
+    operandOffset: null,
+    patchOffsets: [],
+    originalOffset: null,
+    isNew: true
+  };
+  if (targets !== null) state.branchTargets.set(instruction, targets);
+  if (operand && operand.kind !== "branch" && operand.kind !== "switch") {
+    encodeOperand(instruction, operand.value);
+  }
+  return instruction;
+}
+
+function isExceptionBoundary(state, instruction, isEnd = false) {
+  if (isEnd && instruction === null) return state.clauses.some((clause) =>
+    clause.tryEnd === null || clause.handlerEnd === null
+  );
+  return state.clauses.some((clause) =>
+    clause.tryStart === instruction || clause.tryEnd === instruction ||
+    clause.handlerStart === instruction || clause.handlerEnd === instruction ||
+    clause.filterStart === instruction
+  );
+}
+
+export function insertInstruction(state, beforeOffset, opcode, value) {
+  const codeSize = state.body.codeSize;
+  let index;
+  let before;
+  if (beforeOffset === codeSize) {
+    index = state.instructions.length;
+    before = null;
+  } else {
+    before = findInstruction(state.instructions, beforeOffset);
+    index = state.instructions.indexOf(before);
+  }
+  if (isExceptionBoundary(state, before, before === null)) {
+    throw new FormatError("Insertions at exception-handler boundaries are ambiguous");
+  }
+  const instruction = makeInstruction(state, opcode, value);
+  state.instructions.splice(index, 0, instruction);
+  layoutStructuralState(state);
+  return instruction;
+}
+
+export function removeInstruction(state, offset) {
+  const instruction = findInstruction(state.instructions, offset);
+  if (isExceptionBoundary(state, instruction)) {
+    throw new FormatError("Cannot remove an exception-handler boundary instruction");
+  }
+  for (const targets of state.branchTargets.values()) {
+    if (Array.isArray(targets) ? targets.includes(instruction) : targets === instruction) {
+      throw new FormatError("Cannot remove an instruction targeted by a branch");
+    }
+  }
+  state.instructions.splice(state.instructions.indexOf(instruction), 1);
+  state.branchTargets.delete(instruction);
+  layoutStructuralState(state);
+  return instruction;
+}
+
+export function updateStructuralOperand(state, instruction, value) {
+  if (instruction.operand?.kind === "branch") {
+    const targets = resolveTargets(state, instruction.opcode, value);
+    state.branchTargets.set(instruction, targets.targets);
+    instruction.operand = targets.operand;
+  } else if (instruction.operand?.kind === "switch") {
+    const targets = resolveTargets(state, instruction.opcode, value);
+    state.branchTargets.set(instruction, targets.targets);
+    instruction.operand = targets.operand;
+  } else {
+    const operand = instruction.operand;
+    if (!operand) throw new TypeError("Instruction has no operand");
+    const candidate = { ...instruction, operand: { ...operand, value } };
+    encodeOperand(candidate, value);
+    instruction.operand = candidate.operand;
+  }
+  layoutStructuralState(state);
+}
+
+function appendU1(bytes, value) {
+  bytes.push(value & 0xff);
+}
+
+function appendU2(bytes, value) {
+  bytes.push(value & 0xff, (value >>> 8) & 0xff);
+}
+
+function appendU4(bytes, value) {
+  bytes.push(value & 0xff, (value >>> 8) & 0xff, (value >>> 16) & 0xff, (value >>> 24) & 0xff);
+}
+
+function alignBytes(bytes, alignment, rva = 0) {
+  while (((rva + bytes.length) & (alignment - 1)) !== 0) bytes.push(0);
+}
+
+function encodeExceptionSection(clauses, bodyBytes, methodRva) {
+  if (clauses.length === 0) return;
+  alignBytes(bodyBytes, 4, methodRva);
+  const small = clauses.length <= 20 && clauses.every((clause) =>
+    clause.flags <= 0xffff &&
+    clause.tryOffset <= 0xffff &&
+    clause.tryLength <= 0xff &&
+    clause.handlerOffset <= 0xffff &&
+    clause.handlerLength <= 0xff
+  );
+  const clauseSize = small ? 12 : 24;
+  const dataSize = 4 + clauses.length * clauseSize;
+  if (dataSize > 0xffffff) throw new RangeError("Exception-handler section exceeds the CLI size limit");
+  appendU1(bodyBytes, 0x01 | (small ? 0 : 0x40));
+  if (small) {
+    appendU1(bodyBytes, dataSize);
+    appendU2(bodyBytes, 0);
+    for (const clause of clauses) {
+      appendU2(bodyBytes, clause.flags);
+      appendU2(bodyBytes, clause.tryOffset);
+      appendU1(bodyBytes, clause.tryLength);
+      appendU2(bodyBytes, clause.handlerOffset);
+      appendU1(bodyBytes, clause.handlerLength);
+      appendU4(bodyBytes, clause.classTokenOrFilterOffset);
+    }
+  } else {
+    appendU1(bodyBytes, dataSize & 0xff);
+    appendU1(bodyBytes, (dataSize >>> 8) & 0xff);
+    appendU1(bodyBytes, (dataSize >>> 16) & 0xff);
+    for (const clause of clauses) {
+      appendU4(bodyBytes, clause.flags);
+      appendU4(bodyBytes, clause.tryOffset);
+      appendU4(bodyBytes, clause.tryLength);
+      appendU4(bodyBytes, clause.handlerOffset);
+      appendU4(bodyBytes, clause.handlerLength);
+      appendU4(bodyBytes, clause.classTokenOrFilterOffset);
+    }
+  }
+}
+
+export function encodeMethodBody(state, methodRva) {
+  layoutStructuralState(state);
+  const encodedInstructions = state.instructions.map(encodeInstruction);
+  const codeSize = encodedInstructions.reduce((size, instruction) => size + instruction.length, 0);
+  const code = new Uint8Array(codeSize);
+  let codeOffset = 0;
+  for (const instruction of encodedInstructions) {
+    code.set(instruction, codeOffset);
+    codeOffset += instruction.length;
+  }
+  const clauses = state.clauses;
+  const hasSections = clauses.length > 0;
+  const initLocals = (state.body.flags & 0x10) !== 0;
+  const localVarSigToken = state.body.localVarSigToken;
+  const maxStack = Math.max(state.maxStack, hasSections ? 1 : 0);
+  const unknownFlags = state.body.flags & ~(0x03 | 0x08 | 0x10);
+  const tiny = codeSize < 64 && maxStack <= 8 && localVarSigToken === 0 &&
+    !hasSections && !initLocals && unknownFlags === 0;
+  const output = [];
+  if (tiny) {
+    appendU1(output, (codeSize << 2) | 0x02);
+  } else {
+    if (codeSize > 0xffffffff || maxStack > 0xffff) throw new RangeError("Method body exceeds CLI header limits");
+    const flagsAndSize = 0x3003 | (hasSections ? 0x08 : 0) | (initLocals ? 0x10 : 0);
+    appendU2(output, flagsAndSize);
+    appendU2(output, maxStack);
+    appendU4(output, codeSize);
+    appendU4(output, localVarSigToken);
+  }
+  for (const byte of code) output.push(byte);
+  if (hasSections) encodeExceptionSection(clauses, output, methodRva);
+  return Uint8Array.from(output);
+}