1# This Source Code Form is subject to the terms of the Mozilla Public 2# License, v. 2.0. If a copy of the MPL was not distributed with this 3# file, You can obtain one at http://mozilla.org/MPL/2.0/. 4 5# [SMDOC] MIR Opcodes 6# ======================= 7# This file defines all MIR opcodes. It is parsed by GenerateMIRFiles.py 8# at build time to create MIROpsGenerated.h. Each opcode consists of a 9# name and a set of attributes that are described below. A few of the 10# attributes below allow setting the value to "custom", meaning the 11# method will be declared for the MIR op, but will need to be implemented 12# in C++ (typically done in MIR.cpp). Unless marked as required, attributes 13# are optional. 14# 15# name [required] 16# ==== 17# Opcode name. 18# Possible values: 19# - opcode string: used as the name for MIR opcode. 20# 21# gen_boilerplate 22# =============== 23# Used to decide to generate MIR boilerplate. 24# - true (default): auto generate boilerplate for this MIR opcode 25# - false: do not generate boilerplate for this MIR opcode 26# 27# operands 28# ======== 29# A list of operands for the MIR op class constructor. Each operand is a 30# MIR node. The operand kind is specified from the one of the kinds from 31# the MIRType enum in IonTypes.h. The specified types for the 32# operands will decide the type policy for the instruction. 33# 34# The naming of operands is how the NAMED_OPERANDS macro will define 35# its operands. 36# 37# For example: 38# object: Object 39# id: Value 40# value: Object 41# 42# Will result in an instruction having the type policy of: 43# MixPolicy<ObjectPolicy<0>, BoxPolicy<1>, ObjectPolicy<2>> 44# and a named operands definition that looks like the following: 45# NAMED_OPERANDS((0, object), (1, idValue), (2, value)) 46# 47# - attribute not specified (default): no code generated 48# - operand list: MIRTypes (See MIRType in jit/IonTypes.h) 49# 50# arguments 51# ========= 52# A list of non-MIR node arguments to the MIR op class constructor 53# that are passed along with the operands. The arguments require 54# both a name and a full type signature for each item in the list. 55# 56# For example: 57# templateObject: JSObject* 58# initialHeap: gc::InitialHeap 59# 60# For each argument a private variable declaration will be autogenerated 61# in the MIR op class, as well as simple accessor for that variable. If 62# the type of the variable is a GC pointer it will by automatically 63# wrapped by CompilerGCPointer. The above arguments list will result in 64# the following declarations and accessors: 65# 66# CompilerGCPointer<JSObject*> templateObject_; 67# gc::InitialHeap initialHeap_; 68# 69# JSObject* templateObject() const { return templateObject_; } 70# gc::InitialHeap initialHeap() const { return initialHeap_; } 71# 72# - attribute not specified (default): no code generated 73# - operand list: argument names and their full type signature 74# 75# type_policy 76# ============ 77# If this attribute is present, then the type policy for that opcode will be 78# NoTypePolicy. This is used for opcode that should have no type policy. 79# - attribute not specified (default): no code generated, type policy 80# is based off of operands 81# - none: defines the type policy as opcode's NoTypePolicy 82# 83# result_type 84# =========== 85# Defines the result type of the MIR opcode. 86# - attribute not specified (default): no code is generated 87# - MIRType string: Will add a call to setResultType to the opcode constructor. 88# This will set the MIR opcodes result type to whatever the 89# specified MIRType is (See MIRType in jit/IonTypes.h). 90# 91# guard 92# ===== 93# Set if the opcode is a guard instruction and is used for checks in optimizations 94# such as range analysis and value numbering. 95# - attribute not specified (default): no code generated 96# - true: adds setGuard to opcode constructor 97# 98# movable 99# ======= 100# Defines the movable MIR flag for movable instructions. This is used for knowing 101# if we can hoist an instruction. 102# - attribute not specified (default): no code generated 103# - true: adds setMovable call in opcode constructor 104# 105# folds_to 106# ======== 107# The foldsTo method is used for determining if an instruction can be folded into 108# simpler instruction or for constant folding, depending on its operands. 109# - attribute not specified (default): no code generated, no constants to fold 110# - custom: custom C++ implementation 111# 112# congruent_to 113# ============ 114# Used by ValueNumbering to determine if two values are congruent. 115# - attribute not specified (default): no code generated, congruentTo(foo) returns 116# false 117# - if_operands_equal: congruentTo(foo) will return congruentIfOperandsEqual(foo) 118# - custom: custom C++ implementation 119# 120# alias_set 121# ========= 122# Defines the getAliasSet function for a MIR op. The alias set is used for alias 123# analysis. The default alias set is Any. 124# - attribute not specified (default): no code generated, alias set is Any 125# - none: this is the most common case, this is will set the alias set to None. 126# - custom: custom C++ implementation in MIR.cpp 127# 128# possibly_calls 129# ============== 130# Defines if a opcode can possibly call. 131# - attribute not specified (default): no code generated, opcode does not call 132# - true: possiblyCalls returns true 133# - custom: custom C++ implementation 134# 135# compute_range 136# ============= 137# Computes and sets the range value for a MIR node, which is then used in range 138# analysis. 139# - attribute not specified (default): no code generated, range is not set for node 140# - custom: custom C++ implementation in RangeAnalysis.cpp 141# 142# can_recover 143# =========== 144# Indicates whether this instruction can be recovered on bailout. 145# Possible values: 146# - attribute not specified (default): no code generated, canRecoverOnBailout 147# returns false 148# - true: canRecoverOnBailout returns true 149# - custom: canRecoverOnBailout has a custom C++ implementation 150# If the value is either 'true' or 'custom', writeRecoverData has a custom C++ 151# implementation. 152# 153# clone 154# ===== 155# Allows cloning for that MIR op. 156# - attribute not specified (default): no code generated 157# - true: allows cloning 158# 159 160# TODO(no-TI): try to remove this instruction. 161- name: Start 162 163# Instruction marking on entrypoint for on-stack replacement. 164# OSR may occur at loop headers (at JSOp::LoopHead). 165# There is at most one MOsrEntry per MIRGraph. 166- name: OsrEntry 167 result_type: Pointer 168 169- name: Nop 170 alias_set: none 171 clone: true 172 173- name: LimitedTruncate 174 gen_boilerplate: false 175 176- name: Constant 177 gen_boilerplate: false 178 179- name: WasmNullConstant 180 gen_boilerplate: false 181 182- name: WasmFloatConstant 183 gen_boilerplate: false 184 185- name: Parameter 186 gen_boilerplate: false 187 188- name: Callee 189 result_type: Object 190 movable: true 191 congruent_to: if_operands_equal 192 alias_set: none 193 194- name: IsConstructing 195 result_type: Boolean 196 movable: true 197 congruent_to: if_operands_equal 198 alias_set: none 199 200- name: TableSwitch 201 gen_boilerplate: false 202 203- name: Goto 204 gen_boilerplate: false 205 206- name: Test 207 gen_boilerplate: false 208 209- name: Return 210 gen_boilerplate: false 211 212- name: Throw 213 operands: 214 ins: Value 215 alias_set: custom 216 possibly_calls: true 217 218- name: NewArray 219 gen_boilerplate: false 220 221- name: NewArrayDynamicLength 222 operands: 223 length: Int32 224 arguments: 225 templateObject: JSObject* 226 initialHeap: gc::InitialHeap 227 result_type: Object 228 # Need to throw if length is negative. 229 guard: true 230 # Throws if length is negative. 231 alias_set: custom 232 233- name: NewTypedArray 234 gen_boilerplate: false 235 236- name: NewTypedArrayDynamicLength 237 operands: 238 length: Int32 239 arguments: 240 templateObject: JSObject* 241 initialHeap: gc::InitialHeap 242 result_type: Object 243 guard: true 244 # Throws if length is negative. 245 alias_set: custom 246 247# Create a new TypedArray from an Array (or Array-like object) or a TypedArray. 248- name: NewTypedArrayFromArray 249 operands: 250 array: Object 251 arguments: 252 templateObject: JSObject* 253 initialHeap: gc::InitialHeap 254 result_type: Object 255 guard: true 256 possibly_calls: true 257 258# Create a new TypedArray from an ArrayBuffer (or SharedArrayBuffer). 259- name: NewTypedArrayFromArrayBuffer 260 operands: 261 arrayBuffer: Object 262 byteOffset: Value 263 length: Value 264 arguments: 265 templateObject: JSObject* 266 initialHeap: gc::InitialHeap 267 result_type: Object 268 guard: true 269 possibly_calls: true 270 271- name: NewObject 272 gen_boilerplate: false 273 274- name: NewPlainObject 275 gen_boilerplate: false 276 277- name: NewArrayObject 278 gen_boilerplate: false 279 280- name: NewIterator 281 gen_boilerplate: false 282 283- name: ObjectState 284 gen_boilerplate: false 285 286- name: ArrayState 287 gen_boilerplate: false 288 289# Setting __proto__ in an object literal. 290- name: MutateProto 291 operands: 292 object: Object 293 value: Value 294 result_type: None 295 possibly_calls: true 296 297- name: InitPropGetterSetter 298 operands: 299 object: Object 300 value: Object 301 arguments: 302 name: PropertyName* 303 304- name: InitElemGetterSetter 305 operands: 306 object: Object 307 id: Value 308 value: Object 309 310- name: Call 311 gen_boilerplate: false 312 313- name: ApplyArgs 314 gen_boilerplate: false 315 316- name: ApplyArgsObj 317 gen_boilerplate: false 318 319- name: ApplyArray 320 gen_boilerplate: false 321 322- name: ConstructArray 323 gen_boilerplate: false 324 325- name: Bail 326 gen_boilerplate: false 327 328- name: Unreachable 329 gen_boilerplate: false 330 331# This op serves as a way to force the encoding of a snapshot, even if there 332# is no resume point using it. This is useful to run MAssertRecoveredOnBailout 333# assertions. 334- name: EncodeSnapshot 335 guard: true 336 337- name: AssertRecoveredOnBailout 338 gen_boilerplate: false 339 340- name: AssertFloat32 341 gen_boilerplate: false 342 343- name: Compare 344 gen_boilerplate: false 345 346- name: SameValueDouble 347 operands: 348 left: Double 349 right: Double 350 result_type: Boolean 351 movable: true 352 congruent_to: if_operands_equal 353 alias_set: none 354 clone: true 355 356- name: SameValue 357 operands: 358 left: Value 359 right: Value 360 result_type: Boolean 361 movable: true 362 congruent_to: if_operands_equal 363 alias_set: none 364 clone: true 365 366- name: Box 367 gen_boilerplate: false 368 369- name: Unbox 370 gen_boilerplate: false 371 372- name: AssertRange 373 gen_boilerplate: false 374 375- name: AssertClass 376 gen_boilerplate: false 377 378- name: AssertShape 379 gen_boilerplate: false 380 381- name: CreateThisWithTemplate 382 gen_boilerplate: false 383 384# Caller-side allocation of |this| for |new|: 385# Constructs |this| when possible, else MagicValue(JS_IS_CONSTRUCTING). 386- name: CreateThis 387 operands: 388 callee: Object 389 newTarget: Object 390 result_type: Value 391 # Performs a property read from |newTarget| iff |newTarget| is a JSFunction 392 # with an own |.prototype| property. 393 alias_set: custom 394 possibly_calls: true 395 396- name: CreateArgumentsObject 397 gen_boilerplate: false 398 399- name: CreateInlinedArgumentsObject 400 gen_boilerplate: false 401 402- name: GetInlinedArgument 403 gen_boilerplate: false 404 405- name: GetArgumentsObjectArg 406 operands: 407 argsObject: Object 408 arguments: 409 argno: size_t 410 result_type: Value 411 congruent_to: custom 412 alias_set: custom 413 414- name: SetArgumentsObjectArg 415 operands: 416 argsObject: Object 417 value: Value 418 arguments: 419 argno: size_t 420 alias_set: custom 421 422# Load |arguments[index]| from a mapped or unmapped arguments object. Bails out 423# if any elements were overridden or deleted. Also bails out if the index is 424# out of bounds. 425- name: LoadArgumentsObjectArg 426 operands: 427 argsObject: Object 428 index: Int32 429 result_type: Value 430 guard: true 431 congruent_to: if_operands_equal 432 alias_set: custom 433 434# Load |arguments.length|. Bails out if the length has been overriden. 435- name: ArgumentsObjectLength 436 operands: 437 argsObject: Object 438 result_type: Int32 439 guard: true 440 movable: true 441 congruent_to: if_operands_equal 442 # Even though the "length" property is lazily resolved, it acts similar to 443 # a normal property load, so we can treat this operation like any other 444 # property read. 445 alias_set: custom 446 447# Guard that the given flags are not set on the arguments object. 448- name: GuardArgumentsObjectFlags 449 operands: 450 argsObject: Object 451 arguments: 452 flags: uint32_t 453 result_type: Object 454 movable: true 455 guard: true 456 congruent_to: custom 457 # The flags are packed with the length in a fixed private slot. 458 alias_set: custom 459 460# Given a MIRType::Value A and a MIRType::Object B: 461# If the Value may be safely unboxed to an Object, return Object(A). 462# Otherwise, return B. 463# Used to implement return behavior for inlined constructors. 464- name: ReturnFromCtor 465 operands: 466 value: Value 467 object: Object 468 result_type: Object 469 folds_to: custom 470 congruent_to: if_operands_equal 471 alias_set: none 472 473- name: ToDouble 474 gen_boilerplate: false 475 476- name: ToFloat32 477 gen_boilerplate: false 478 479# Converts a uint32 to a double (coming from wasm). 480- name: WasmUnsignedToDouble 481 operands: 482 def: Int32 483 type_policy: none 484 result_type: Double 485 movable: true 486 folds_to: custom 487 congruent_to: if_operands_equal 488 alias_set: none 489 490- name: WasmUnsignedToFloat32 491 gen_boilerplate: false 492 493- name: WrapInt64ToInt32 494 gen_boilerplate: false 495 496- name: ExtendInt32ToInt64 497 gen_boilerplate: false 498 499- name: WasmBuiltinTruncateToInt64 500 gen_boilerplate: false 501 502- name: WasmTruncateToInt64 503 gen_boilerplate: false 504 505- name: WasmTruncateToInt32 506 gen_boilerplate: false 507 508# Store a JS Value that can't be represented as an AnyRef pointer into an 509# object that holds the value (opaquely) as such a pointer. 510- name: WasmBoxValue 511 operands: 512 def: Value 513 result_type: RefOrNull 514 congruent_to: if_operands_equal 515 alias_set: none 516 517- name: WasmAnyRefFromJSObject 518 operands: 519 def: Object 520 type_policy: none 521 result_type: RefOrNull 522 congruent_to: if_operands_equal 523 alias_set: none 524 525- name: Int32ToIntPtr 526 gen_boilerplate: false 527 528- name: NonNegativeIntPtrToInt32 529 gen_boilerplate: false 530 531- name: IntPtrToDouble 532 gen_boilerplate: false 533 534- name: AdjustDataViewLength 535 gen_boilerplate: false 536 537- name: Int64ToFloatingPoint 538 gen_boilerplate: false 539 540- name: BuiltinInt64ToFloatingPoint 541 gen_boilerplate: false 542 543- name: ToNumberInt32 544 gen_boilerplate: false 545 546- name: ToIntegerInt32 547 gen_boilerplate: false 548 549- name: TruncateToInt32 550 gen_boilerplate: false 551 552- name: WasmBuiltinTruncateToInt32 553 gen_boilerplate: false 554 555- name: ToBigInt 556 gen_boilerplate: false 557 558- name: ToInt64 559 gen_boilerplate: false 560 561- name: TruncateBigIntToInt64 562 gen_boilerplate: false 563 564- name: Int64ToBigInt 565 gen_boilerplate: false 566 567- name: ToString 568 gen_boilerplate: false 569 570- name: BitNot 571 gen_boilerplate: false 572 573- name: TypeOf 574 gen_boilerplate: false 575 576- name: ToAsyncIter 577 operands: 578 iterator: Object 579 nextMethod: Value 580 result_type: Object 581 582- name: ToPropertyKeyCache 583 operands: 584 input: Value 585 result_type: Value 586 587- name: BitAnd 588 gen_boilerplate: false 589 590- name: BitOr 591 gen_boilerplate: false 592 593- name: BitXor 594 gen_boilerplate: false 595 596- name: Lsh 597 gen_boilerplate: false 598 599- name: Rsh 600 gen_boilerplate: false 601 602- name: Ursh 603 gen_boilerplate: false 604 605- name: SignExtendInt32 606 gen_boilerplate: false 607 608- name: SignExtendInt64 609 gen_boilerplate: false 610 611- name: MinMax 612 gen_boilerplate: false 613 614- name: MinMaxArray 615 gen_boilerplate: false 616 617- name: Abs 618 gen_boilerplate: false 619 620- name: Clz 621 gen_boilerplate: false 622 623- name: Ctz 624 gen_boilerplate: false 625 626- name: Popcnt 627 gen_boilerplate: false 628 629- name: Sqrt 630 gen_boilerplate: false 631 632- name: CopySign 633 gen_boilerplate: false 634 635# Inline implementation of atan2 (arctangent of y/x). 636- name: Atan2 637 operands: 638 y: Double 639 x: Double 640 result_type: Double 641 movable: true 642 congruent_to: if_operands_equal 643 alias_set: none 644 possibly_calls: true 645 can_recover: true 646 clone: true 647 648- name: Hypot 649 gen_boilerplate: false 650 651- name: Pow 652 gen_boilerplate: false 653 654- name: PowHalf 655 gen_boilerplate: false 656 657- name: Random 658 result_type: Double 659 alias_set: none 660 possibly_calls: true 661 compute_range: custom 662 can_recover: custom 663 clone: true 664 665- name: Sign 666 gen_boilerplate: false 667 668- name: MathFunction 669 gen_boilerplate: false 670 671- name: Add 672 gen_boilerplate: false 673 674- name: Sub 675 gen_boilerplate: false 676 677- name: Mul 678 gen_boilerplate: false 679 680- name: Div 681 gen_boilerplate: false 682 683- name: WasmBuiltinDivI64 684 gen_boilerplate: false 685 686- name: Mod 687 gen_boilerplate: false 688 689- name: WasmBuiltinModD 690 gen_boilerplate: false 691 692- name: WasmBuiltinModI64 693 gen_boilerplate: false 694 695- name: BigIntAdd 696 gen_boilerplate: false 697 698- name: BigIntSub 699 gen_boilerplate: false 700 701- name: BigIntMul 702 gen_boilerplate: false 703 704- name: BigIntDiv 705 gen_boilerplate: false 706 707- name: BigIntMod 708 gen_boilerplate: false 709 710- name: BigIntPow 711 gen_boilerplate: false 712 713- name: BigIntBitAnd 714 gen_boilerplate: false 715 716- name: BigIntBitOr 717 gen_boilerplate: false 718 719- name: BigIntBitXor 720 gen_boilerplate: false 721 722- name: BigIntLsh 723 gen_boilerplate: false 724 725- name: BigIntRsh 726 gen_boilerplate: false 727 728- name: BigIntIncrement 729 gen_boilerplate: false 730 731- name: BigIntDecrement 732 gen_boilerplate: false 733 734- name: BigIntNegate 735 gen_boilerplate: false 736 737- name: BigIntBitNot 738 gen_boilerplate: false 739 740- name: Concat 741 gen_boilerplate: false 742 743- name: CharCodeAt 744 operands: 745 string: String 746 index: Int32 747 result_type: Int32 748 movable: true 749 folds_to: custom 750 congruent_to: if_operands_equal 751 # Strings are immutable, so there is no implicit dependency. 752 alias_set: none 753 compute_range: custom 754 can_recover: true 755 clone: true 756 757- name: FromCharCode 758 operands: 759 code: Int32 760 result_type: String 761 movable: true 762 congruent_to: if_operands_equal 763 alias_set: none 764 can_recover: true 765 clone: true 766 767- name: FromCodePoint 768 operands: 769 codePoint: Int32 770 result_type: String 771 guard: true 772 movable: true 773 congruent_to: if_operands_equal 774 alias_set: none 775 clone: true 776 777- name: StringConvertCase 778 gen_boilerplate: false 779 780- name: StringSplit 781 operands: 782 string: String 783 separator: String 784 result_type: Object 785 possibly_calls: true 786 congruent_to: if_operands_equal 787 # Although this instruction returns a new array, we don't have to mark 788 # it as store instruction, see also MNewArray. 789 alias_set: none 790 can_recover: true 791 792- name: BoxNonStrictThis 793 operands: 794 def: Value 795 arguments: 796 globalThis: JSObject* 797 result_type: Object 798 folds_to: custom 799 possibly_calls: true 800 # This instruction can allocate a new object for wrapped primitives, but 801 # has no effect on existing objects. 802 alias_set: none 803 804- name: ImplicitThis 805 operands: 806 envChain: Object 807 arguments: 808 name: PropertyName* 809 result_type: Value 810 possibly_calls: true 811 812# Load an arrow function's |new.target| value. 813- name: ArrowNewTarget 814 operands: 815 callee: Object 816 result_type: Value 817 movable: true 818 congruent_to: if_operands_equal 819 # An arrow function's lexical |this| value is immutable. 820 alias_set: none 821 822- name: Phi 823 gen_boilerplate: false 824 825- name: Beta 826 gen_boilerplate: false 827 828- name: NaNToZero 829 gen_boilerplate: false 830 831- name: OsrValue 832 gen_boilerplate: false 833 834- name: OsrEnvironmentChain 835 gen_boilerplate: false 836 837- name: OsrArgumentsObject 838 gen_boilerplate: false 839 840- name: OsrReturnValue 841 gen_boilerplate: false 842 843- name: BinaryCache 844 gen_boilerplate: false 845 846- name: UnaryCache 847 operands: 848 input: Value 849 result_type: Value 850 851# Checks whether we need to fire the interrupt handler. 852- name: CheckOverRecursed 853 guard: true 854 alias_set: none 855 856 857# Check whether we need to fire the interrupt handler. 858- name: InterruptCheck 859 guard: true 860 alias_set: none 861 862- name: WasmInterruptCheck 863 gen_boilerplate: false 864 865- name: WasmTrap 866 gen_boilerplate: false 867 868- name: LexicalCheck 869 gen_boilerplate: false 870 871# Unconditionally throw an uninitialized let error. 872- name: ThrowRuntimeLexicalError 873 arguments: 874 errorNumber: unsigned 875 result_type: None 876 guard: true 877 alias_set: custom 878 879- name: ThrowMsg 880 gen_boilerplate: false 881 882# In the prologues of global and eval scripts, check for redeclarations and 883# initialize bindings. 884- name: GlobalDeclInstantiation 885 guard: true 886 887- name: RegExp 888 arguments: 889 source: RegExpObject* 890 hasShared: bool 891 result_type: Object 892 possibly_calls: true 893 alias_set: none 894 895- name: RegExpMatcher 896 operands: 897 regexp: Object 898 string: String 899 lastIndex: Int32 900 result_type: Value 901 possibly_calls: true 902 can_recover: true 903 904- name: RegExpSearcher 905 operands: 906 regexp: Object 907 string: String 908 lastIndex: Int32 909 result_type: Int32 910 possibly_calls: true 911 can_recover: true 912 913- name: RegExpTester 914 operands: 915 regexp: Object 916 string: String 917 lastIndex: Int32 918 result_type: Int32 919 possibly_calls: true 920 can_recover: true 921 922- name: RegExpPrototypeOptimizable 923 operands: 924 object: Object 925 result_type: Boolean 926 alias_set: none 927 928- name: RegExpInstanceOptimizable 929 operands: 930 object: Object 931 proto: Object 932 result_type: Boolean 933 alias_set: none 934 935- name: GetFirstDollarIndex 936 gen_boilerplate: false 937 938- name: StringReplace 939 gen_boilerplate: false 940 941- name: Substr 942 operands: 943 string: String 944 begin: Int32 945 length: Int32 946 result_type: String 947 congruent_to: if_operands_equal 948 alias_set: none 949 950- name: ModuleMetadata 951 arguments: 952 module: JSObject* 953 result_type: Object 954 955- name: DynamicImport 956 operands: 957 specifier: Value 958 result_type: Object 959 960- name: Lambda 961 gen_boilerplate: false 962 963- name: LambdaArrow 964 gen_boilerplate: false 965 966- name: FunctionWithProto 967 gen_boilerplate: false 968 969- name: SetFunName 970 operands: 971 fun: Object 972 name: Value 973 arguments: 974 prefixKind: uint8_t 975 result_type: None 976 possibly_calls: true 977 978# Returns obj->slots. 979- name: Slots 980 operands: 981 object: Object 982 result_type: Slots 983 movable: true 984 congruent_to: if_operands_equal 985 alias_set: custom 986 clone: true 987 988# Returns obj->elements. 989- name: Elements 990 operands: 991 object: Object 992 result_type: Elements 993 movable: true 994 congruent_to: if_operands_equal 995 alias_set: custom 996 clone: true 997 998# Load the initialized length from an elements header. 999- name: InitializedLength 1000 operands: 1001 elements: Elements 1002 type_policy: none 1003 result_type: Int32 1004 movable: true 1005 congruent_to: if_operands_equal 1006 alias_set: custom 1007 compute_range: custom 1008 clone: true 1009 1010- name: SetInitializedLength 1011 operands: 1012 elements: Elements 1013 index: Int32 1014 type_policy: none 1015 alias_set: custom 1016 clone: true 1017 1018# Load the array length from an elements header. 1019- name: ArrayLength 1020 operands: 1021 elements: Elements 1022 type_policy: none 1023 result_type: Int32 1024 movable: true 1025 congruent_to: if_operands_equal 1026 alias_set: custom 1027 compute_range: custom 1028 clone: true 1029 1030# Store to the length in an elements header. Note the input is an *index*, one 1031# less than the desired length. 1032- name: SetArrayLength 1033 operands: 1034 elements: Elements 1035 index: Int32 1036 type_policy: none 1037 alias_set: custom 1038 # By default no, unless built as a recovered instruction. 1039 can_recover: custom 1040 1041# Load the function length. Bails for functions with lazy scripts or a 1042# resolved "length" property. 1043- name: FunctionLength 1044 operands: 1045 function: Object 1046 result_type: Int32 1047 guard: true 1048 congruent_to: if_operands_equal 1049 # Even though the "length" property is lazily resolved, it acts similar to 1050 # a normal property load, so we can treat this operation like any other 1051 # property read. 1052 alias_set: custom 1053 1054# Load the function name. Bails for bound functions when the bound function 1055# name prefix isn't present or functions with a resolved "name" property. 1056- name: FunctionName 1057 operands: 1058 function: Object 1059 result_type: String 1060 guard: true 1061 congruent_to: if_operands_equal 1062 # Even though the "name" property is lazily resolved, it acts similar to 1063 # a normal property load, so we can treat this operation like any other 1064 # property read. 1065 alias_set: custom 1066 1067- name: GetNextEntryForIterator 1068 gen_boilerplate: false 1069 1070# Read the byte length of an array buffer as IntPtr. 1071- name: ArrayBufferByteLength 1072 operands: 1073 object: Object 1074 result_type: IntPtr 1075 movable: true 1076 congruent_to: if_operands_equal 1077 alias_set: custom 1078 1079# Read the length of an array buffer view. 1080- name: ArrayBufferViewLength 1081 operands: 1082 object: Object 1083 result_type: IntPtr 1084 movable: true 1085 congruent_to: if_operands_equal 1086 alias_set: custom 1087 compute_range: custom 1088 1089- name: ArrayBufferViewByteOffset 1090 operands: 1091 object: Object 1092 result_type: IntPtr 1093 movable: true 1094 congruent_to: if_operands_equal 1095 alias_set: custom 1096 compute_range: custom 1097 1098# Read the length of an array buffer view. 1099- name: ArrayBufferViewElements 1100 operands: 1101 object: Object 1102 result_type: Elements 1103 movable: true 1104 congruent_to: if_operands_equal 1105 alias_set: custom 1106 clone: true 1107 1108# Return the element size of a typed array. 1109- name: TypedArrayElementSize 1110 operands: 1111 object: Object 1112 result_type: Int32 1113 movable: true 1114 congruent_to: if_operands_equal 1115 # Class is immutable. See also MHasClass. 1116 alias_set: none 1117 compute_range: custom 1118 1119# Guard an ArrayBufferView has an attached ArrayBuffer. 1120- name: GuardHasAttachedArrayBuffer 1121 operands: 1122 object: Object 1123 result_type: Object 1124 guard: true 1125 movable: true 1126 congruent_to: if_operands_equal 1127 alias_set: custom 1128 1129- name: GuardNumberToIntPtrIndex 1130 gen_boilerplate: false 1131 1132- name: KeepAliveObject 1133 operands: 1134 object: Object 1135 result_type: None 1136 guard: true 1137 1138- name: Not 1139 gen_boilerplate: false 1140 1141- name: BoundsCheck 1142 gen_boilerplate: false 1143 1144- name: BoundsCheckLower 1145 gen_boilerplate: false 1146 1147- name: SpectreMaskIndex 1148 gen_boilerplate: false 1149 1150- name: LoadElement 1151 gen_boilerplate: false 1152 1153- name: LoadElementAndUnbox 1154 gen_boilerplate: false 1155 1156- name: LoadElementHole 1157 gen_boilerplate: false 1158 1159- name: StoreElement 1160 gen_boilerplate: false 1161 1162- name: StoreHoleValueElement 1163 gen_boilerplate: false 1164 1165- name: StoreElementHole 1166 gen_boilerplate: false 1167 1168- name: ArrayPopShift 1169 gen_boilerplate: false 1170 1171# Array.prototype.push on a dense array. Returns the new array length. 1172- name: ArrayPush 1173 operands: 1174 object: Object 1175 value: Value 1176 result_type: Int32 1177 alias_set: custom 1178 compute_range: custom 1179 clone: true 1180 1181# Array.prototype.slice on a dense array. 1182- name: ArraySlice 1183 operands: 1184 object: Object 1185 begin: Int32 1186 end: Int32 1187 arguments: 1188 templateObj: JSObject* 1189 initialHeap: gc::InitialHeap 1190 result_type: Object 1191 possibly_calls: true 1192 1193# MArrayJoin doesn't override |getAliasSet()|, because Array.prototype.join 1194# might coerce the elements of the Array to strings. This coercion might 1195# cause the evaluation of JavaScript code. 1196- name: ArrayJoin 1197 operands: 1198 array: Object 1199 sep: String 1200 result_type: String 1201 possibly_calls: true 1202 folds_to: custom 1203 # MArrayJoin doesn't override |getAliasSet()|, because Array.prototype.join 1204 # might coerce the elements of the Array to strings. This coercion might 1205 # cause the evaluation of JavaScript code. 1206 1207- name: LoadUnboxedScalar 1208 gen_boilerplate: false 1209 1210- name: LoadDataViewElement 1211 gen_boilerplate: false 1212 1213- name: LoadTypedArrayElementHole 1214 gen_boilerplate: false 1215 1216- name: StoreUnboxedScalar 1217 gen_boilerplate: false 1218 1219- name: StoreDataViewElement 1220 gen_boilerplate: false 1221 1222- name: StoreTypedArrayElementHole 1223 gen_boilerplate: false 1224 1225- name: EffectiveAddress 1226 gen_boilerplate: false 1227 1228- name: ClampToUint8 1229 gen_boilerplate: false 1230 1231- name: LoadFixedSlot 1232 gen_boilerplate: false 1233 1234- name: LoadFixedSlotAndUnbox 1235 gen_boilerplate: false 1236 1237- name: LoadDynamicSlotAndUnbox 1238 gen_boilerplate: false 1239 1240- name: StoreFixedSlot 1241 gen_boilerplate: false 1242 1243- name: GetPropertyCache 1244 gen_boilerplate: false 1245 1246- name: HomeObjectSuperBase 1247 operands: 1248 homeObject: Object 1249 result_type: Object 1250 # May throw if [[Prototype]] is null 1251 guard: true 1252 alias_set: custom 1253 1254- name: GetPropSuperCache 1255 gen_boilerplate: false 1256 1257- name: BindNameCache 1258 operands: 1259 envChain: Object 1260 result_type: Object 1261 1262- name: CallBindVar 1263 operands: 1264 environmentChain: Object 1265 result_type: Object 1266 movable: true 1267 congruent_to: custom 1268 alias_set: none 1269 1270- name: GuardShape 1271 operands: 1272 object: Object 1273 arguments: 1274 shape: Shape* 1275 result_type: Object 1276 guard: true 1277 movable: true 1278 congruent_to: custom 1279 folds_to: custom 1280 alias_set: custom 1281 1282- name: GuardProto 1283 gen_boilerplate: false 1284 1285- name: GuardNullProto 1286 gen_boilerplate: false 1287 1288# Guard the object is a native object. 1289- name: GuardIsNativeObject 1290 operands: 1291 object: Object 1292 result_type: Object 1293 guard: true 1294 movable: true 1295 congruent_to: if_operands_equal 1296 alias_set: none 1297 1298- name: GuardIsProxy 1299 operands: 1300 object: Object 1301 result_type: Object 1302 guard: true 1303 movable: true 1304 congruent_to: if_operands_equal 1305 alias_set: none 1306 1307- name: GuardIsNotDOMProxy 1308 operands: 1309 proxy: Object 1310 result_type: Object 1311 guard: true 1312 movable: true 1313 congruent_to: if_operands_equal 1314 alias_set: none 1315 1316- name: GuardIsNotProxy 1317 operands: 1318 object: Object 1319 result_type: Object 1320 guard: true 1321 movable: true 1322 congruent_to: if_operands_equal 1323 folds_to: custom 1324 alias_set: none 1325 1326- name: ProxyGet 1327 operands: 1328 proxy: Object 1329 arguments: 1330 id: jsid 1331 result_type: Value 1332 possibly_calls: true 1333 1334- name: ProxyGetByValue 1335 operands: 1336 proxy: Object 1337 idVal: Value 1338 result_type: Value 1339 possibly_calls: true 1340 1341- name: ProxyHasProp 1342 operands: 1343 proxy: Object 1344 idVal: Value 1345 arguments: 1346 hasOwn: bool 1347 result_type: Boolean 1348 possibly_calls: true 1349 1350- name: ProxySet 1351 operands: 1352 proxy: Object 1353 rhs: Value 1354 arguments: 1355 id: jsid 1356 strict: bool 1357 possibly_calls: true 1358 1359- name: ProxySetByValue 1360 operands: 1361 proxy: Object 1362 idVal: Value 1363 rhs: Value 1364 arguments: 1365 strict: bool 1366 possibly_calls: true 1367 1368- name: CallSetArrayLength 1369 operands: 1370 obj: Object 1371 rhs: Value 1372 arguments: 1373 strict: bool 1374 possibly_calls: true 1375 1376- name: MegamorphicLoadSlot 1377 operands: 1378 object: Object 1379 arguments: 1380 name: PropertyName* 1381 result_type: Value 1382 # Bails when non-native or accessor properties are encountered, so we can't 1383 # DCE this instruction. 1384 guard: true 1385 possibly_calls: true 1386 congruent_to: custom 1387 alias_set: custom 1388 1389- name: MegamorphicLoadSlotByValue 1390 operands: 1391 object: Object 1392 idVal: Value 1393 result_type: Value 1394 # Bails when non-native or accessor properties are encountered, so we can't 1395 # DCE this instruction. 1396 guard: true 1397 congruent_to: if_operands_equal 1398 alias_set: custom 1399 possibly_calls: true 1400 1401- name: MegamorphicStoreSlot 1402 operands: 1403 object: Object 1404 rhs: Value 1405 arguments: 1406 name: PropertyName* 1407 congruent_to: custom 1408 alias_set: custom 1409 possibly_calls: true 1410 1411- name: MegamorphicHasProp 1412 operands: 1413 object: Object 1414 idVal: Value 1415 arguments: 1416 hasOwn: bool 1417 result_type: Boolean 1418 # Bails when non-native or accessor properties are encountered, so we can't 1419 # DCE this instruction. 1420 guard: true 1421 congruent_to: custom 1422 alias_set: custom 1423 possibly_calls: true 1424 1425- name: GuardIsNotArrayBufferMaybeShared 1426 operands: 1427 object: Object 1428 result_type: Object 1429 guard: true 1430 movable: true 1431 congruent_to: if_operands_equal 1432 folds_to: custom 1433 alias_set: none 1434 1435- name: GuardIsTypedArray 1436 operands: 1437 object: Object 1438 result_type: Object 1439 guard: true 1440 movable: true 1441 congruent_to: if_operands_equal 1442 alias_set: none 1443 1444# Loads a specific JSObject* that was originally nursery-allocated. 1445# See also WarpObjectField. 1446- name: NurseryObject 1447 arguments: 1448 # Index in the Vector of objects stored in the WarpSnapshot. 1449 nurseryIndex: uint32_t 1450 result_type: Object 1451 movable: true 1452 congruent_to: custom 1453 alias_set: none 1454 1455- name: GuardValue 1456 gen_boilerplate: false 1457 1458- name: GuardNullOrUndefined 1459 operands: 1460 value: Value 1461 result_type: Value 1462 guard: true 1463 movable: true 1464 congruent_to: if_operands_equal 1465 folds_to: custom 1466 alias_set: none 1467 1468- name: GuardFunctionFlags 1469 gen_boilerplate: false 1470 1471- name: GuardFunctionIsNonBuiltinCtor 1472 operands: 1473 function: Object 1474 result_type: Object 1475 guard: true 1476 movable: true 1477 congruent_to: if_operands_equal 1478 alias_set: custom 1479 1480- name: GuardFunctionKind 1481 operands: 1482 function: Object 1483 arguments: 1484 expected: FunctionFlags::FunctionKind 1485 bailOnEquality: bool 1486 result_type: Object 1487 guard: true 1488 movable: true 1489 congruent_to: custom 1490 alias_set: custom 1491 1492- name: GuardFunctionScript 1493 operands: 1494 function: Object 1495 arguments: 1496 expected: BaseScript* 1497 nargs: uint16_t 1498 flags: FunctionFlags 1499 result_type: Object 1500 guard: true 1501 movable: true 1502 folds_to: custom 1503 congruent_to: custom 1504 # A JSFunction's BaseScript pointer is immutable. Relazification of 1505 # self-hosted functions is an exception to this, but we don't use this 1506 # guard for self-hosted functions. 1507 alias_set: custom 1508 1509- name: GuardObjectIdentity 1510 gen_boilerplate: false 1511 1512- name: GuardSpecificFunction 1513 gen_boilerplate: false 1514 1515- name: GuardSpecificAtom 1516 operands: 1517 str: String 1518 arguments: 1519 atom: JSAtom* 1520 result_type: String 1521 guard: true 1522 movable: true 1523 congruent_to: custom 1524 folds_to: custom 1525 alias_set: none 1526 1527- name: GuardSpecificSymbol 1528 gen_boilerplate: false 1529 1530- name: GuardStringToIndex 1531 operands: 1532 string: String 1533 result_type: Int32 1534 # Mark as guard because this instruction must not be eliminated. For 1535 # example, if the string is not an index the operation could change from a 1536 # typed array load to a getter call. 1537 guard: true 1538 movable: true 1539 congruent_to: if_operands_equal 1540 folds_to: custom 1541 alias_set: none 1542 1543- name: GuardStringToInt32 1544 operands: 1545 string: String 1546 result_type: Int32 1547 # Mark as guard to prevent the issue described in MGuardStringToIndex's 1548 # constructor. 1549 guard: true 1550 movable: true 1551 congruent_to: if_operands_equal 1552 folds_to: custom 1553 alias_set: none 1554 1555- name: GuardStringToDouble 1556 operands: 1557 string: String 1558 result_type: Double 1559 # Mark as guard to prevent the issue described in MGuardStringToIndex's 1560 # constructor. 1561 guard: true 1562 movable: true 1563 congruent_to: if_operands_equal 1564 folds_to: custom 1565 alias_set: none 1566 1567- name: GuardNoDenseElements 1568 operands: 1569 object: Object 1570 result_type: Object 1571 guard: true 1572 movable: true 1573 alias_set: custom 1574 1575- name: GuardTagNotEqual 1576 gen_boilerplate: false 1577 1578- name: LoadDynamicSlot 1579 gen_boilerplate: false 1580 1581# Inline call to access a function's environment (scope chain). 1582- name: FunctionEnvironment 1583 operands: 1584 function: Object 1585 result_type: Object 1586 movable: true 1587 folds_to: custom 1588 # A function's environment is fixed. 1589 alias_set: none 1590 1591- name: NewLexicalEnvironmentObject 1592 gen_boilerplate: false 1593 1594# Allocate a new ClassBodyEnvironmentObject. 1595- name: NewClassBodyEnvironmentObject 1596 operands: 1597 enclosing: Object 1598 arguments: 1599 scope: ClassBodyScope* 1600 result_type: Object 1601 possibly_calls: true 1602 alias_set: none 1603 1604# Allocate a new BlockLexicalEnvironmentObject from an existing one. 1605- name: CopyLexicalEnvironmentObject 1606 operands: 1607 env: Object 1608 arguments: 1609 copySlots: bool 1610 result_type: Object 1611 possibly_calls: true 1612 alias_set: custom 1613 1614- name: HomeObject 1615 operands: 1616 function: Object 1617 result_type: Object 1618 movable: true 1619 # A function's [[HomeObject]] is fixed. 1620 alias_set: none 1621 1622- name: AddAndStoreSlot 1623 gen_boilerplate: false 1624 1625- name: AllocateAndStoreSlot 1626 operands: 1627 object: Object 1628 value: Value 1629 arguments: 1630 slotOffset: uint32_t 1631 shape: Shape* 1632 numNewSlots: uint32_t 1633 possibly_calls: true 1634 alias_set: custom 1635 1636- name: StoreDynamicSlot 1637 gen_boilerplate: false 1638 1639- name: GetNameCache 1640 operands: 1641 envObj: Object 1642 result_type: Value 1643 1644- name: CallGetIntrinsicValue 1645 arguments: 1646 name: PropertyName* 1647 result_type: Value 1648 possibly_calls: true 1649 alias_set: none 1650 1651- name: DeleteProperty 1652 operands: 1653 value: Value 1654 arguments: 1655 name: PropertyName* 1656 strict: bool 1657 result_type: Boolean 1658 1659- name: DeleteElement 1660 operands: 1661 value: Value 1662 index: Value 1663 arguments: 1664 strict: bool 1665 result_type: Boolean 1666 1667- name: SetPropertyCache 1668 gen_boilerplate: false 1669 1670- name: CallSetElement 1671 gen_boilerplate: false 1672 1673- name: SetDOMProperty 1674 gen_boilerplate: false 1675 1676- name: GetDOMProperty 1677 gen_boilerplate: false 1678 1679- name: GetDOMMember 1680 gen_boilerplate: false 1681 1682# Load the private value expando from a DOM proxy. The target is stored in the 1683# proxy object's private slot. 1684# This is either an UndefinedValue (no expando), ObjectValue (the expando 1685# object), or PrivateValue(ExpandoAndGeneration*). 1686- name: LoadDOMExpandoValue 1687 operands: 1688 proxy: Object 1689 result_type: Value 1690 movable: true 1691 congruent_to: if_operands_equal 1692 alias_set: custom 1693 1694- name: LoadDOMExpandoValueGuardGeneration 1695 gen_boilerplate: false 1696 1697- name: LoadDOMExpandoValueIgnoreGeneration 1698 operands: 1699 proxy: Object 1700 result_type: Value 1701 movable: true 1702 congruent_to: if_operands_equal 1703 alias_set: custom 1704 1705# Takes an expando Value as input, then guards it's either UndefinedValue or 1706# an object with the expected shape. 1707- name: GuardDOMExpandoMissingOrGuardShape 1708 operands: 1709 expando: Value 1710 arguments: 1711 shape: Shape* 1712 result_type: Value 1713 guard: true 1714 movable: true 1715 congruent_to: custom 1716 alias_set: custom 1717 1718- name: StringLength 1719 operands: 1720 string: String 1721 result_type: Int32 1722 movable: true 1723 folds_to: custom 1724 congruent_to: if_operands_equal 1725 # The string |length| property is immutable, so there is no 1726 # implicit dependency. 1727 alias_set: none 1728 compute_range: custom 1729 can_recover: true 1730 clone: true 1731 1732- name: Floor 1733 gen_boilerplate: false 1734 1735- name: Ceil 1736 gen_boilerplate: false 1737 1738- name: Round 1739 gen_boilerplate: false 1740 1741- name: Trunc 1742 gen_boilerplate: false 1743 1744- name: NearbyInt 1745 gen_boilerplate: false 1746 1747- name: GetIteratorCache 1748 gen_boilerplate: false 1749 1750- name: OptimizeSpreadCallCache 1751 operands: 1752 value: Value 1753 result_type: Boolean 1754 1755- name: IteratorMore 1756 operands: 1757 iterator: Object 1758 result_type: Value 1759 1760- name: IsNoIter 1761 operands: 1762 def: Object 1763 result_type: Boolean 1764 type_policy: none 1765 movable : true 1766 alias_set: none 1767 1768- name: IteratorEnd 1769 operands: 1770 iterator: Object 1771 1772- name: InCache 1773 gen_boilerplate: false 1774 1775- name: InArray 1776 gen_boilerplate: false 1777 1778- name: GuardElementNotHole 1779 gen_boilerplate: false 1780 1781- name: CheckPrivateFieldCache 1782 gen_boilerplate: false 1783 1784- name: HasOwnCache 1785 gen_boilerplate: false 1786 1787- name: InstanceOf 1788 gen_boilerplate: false 1789 1790# Implementation for instanceof operator with unknown rhs. 1791- name: InstanceOfCache 1792 operands: 1793 obj: Value 1794 proto: Object 1795 result_type: Boolean 1796 1797- name: ArgumentsLength 1798 result_type: Int32 1799 movable: true 1800 congruent_to: if_operands_equal 1801 # Arguments |length| cannot be mutated by Ion Code. 1802 alias_set: none 1803 compute_range: custom 1804 can_recover: true 1805 1806# This MIR instruction is used to get an argument from the actual arguments. 1807- name: GetFrameArgument 1808 operands: 1809 index: Int32 1810 result_type: Value 1811 movable: true 1812 congruent_to: if_operands_equal 1813 # This instruction is never aliased, because ops like JSOp::SetArg don't 1814 # write to the argument frames. We create an arguments object in that case. 1815 alias_set: none 1816 1817- name: NewTarget 1818 result_type: Value 1819 movable: true 1820 congruent_to: if_operands_equal 1821 alias_set: none 1822 1823- name: Rest 1824 operands: 1825 numActuals: Int32 1826 arguments: 1827 numFormals: unsigned 1828 shape: Shape* 1829 result_type: Object 1830 possibly_calls: true 1831 alias_set: none 1832 1833- name: PostWriteBarrier 1834 gen_boilerplate: false 1835 1836- name: PostWriteElementBarrier 1837 gen_boilerplate: false 1838 1839- name: NewNamedLambdaObject 1840 arguments: 1841 templateObj: NamedLambdaObject* 1842 result_type: Object 1843 alias_set: none 1844 1845- name: NewCallObject 1846 gen_boilerplate: false 1847 1848- name: NewStringObject 1849 gen_boilerplate: false 1850 1851- name: IsCallable 1852 gen_boilerplate: false 1853 1854- name: IsConstructor 1855 operands: 1856 object: Object 1857 result_type: Boolean 1858 movable: true 1859 congruent_to: if_operands_equal 1860 alias_set: none 1861 1862- name: IsCrossRealmArrayConstructor 1863 operands: 1864 object: Object 1865 result_type: Boolean 1866 movable: true 1867 congruent_to: if_operands_equal 1868 alias_set: none 1869 1870- name: IsObject 1871 operands: 1872 object: Value 1873 result_type: Boolean 1874 movable: true 1875 folds_to: custom 1876 congruent_to: if_operands_equal 1877 alias_set: none 1878 1879- name: IsNullOrUndefined 1880 operands: 1881 value: Value 1882 result_type: Boolean 1883 movable: true 1884 folds_to: custom 1885 congruent_to: if_operands_equal 1886 alias_set: none 1887 1888- name: HasClass 1889 gen_boilerplate: false 1890 1891- name: GuardToClass 1892 gen_boilerplate: false 1893 1894- name: IsArray 1895 gen_boilerplate: false 1896 1897- name: IsTypedArray 1898 gen_boilerplate: false 1899 1900- name: ObjectClassToString 1901 operands: 1902 object: Object 1903 result_type: String 1904 guard: true 1905 movable: true 1906 congruent_to: if_operands_equal 1907 possibly_calls: true 1908 # Tests @@toStringTag is neither present on this object nor on any object 1909 # of the prototype chain. 1910 alias_set: custom 1911 1912- name: CheckReturn 1913 operands: 1914 returnValue: Value 1915 thisValue: Value 1916 result_type: Value 1917 guard: true 1918 alias_set: none 1919 1920- name: CheckThis 1921 operands: 1922 thisValue: Value 1923 result_type: Value 1924 guard: true 1925 folds_to: custom 1926 alias_set: none 1927 1928- name: AsyncResolve 1929 operands: 1930 generator: Object 1931 valueOrReason: Value 1932 arguments: 1933 resolveKind: AsyncFunctionResolveKind 1934 result_type: Object 1935 1936# Returns from this function to the previous caller; this looks like a regular 1937# Unary instruction and is used to lie to the MIR generator about suspending 1938# ops like Yield/Await, which are emitted like returns, but MIR-Build like 1939# regular instructions. 1940- name: GeneratorReturn 1941 operands: 1942 input: Value 1943 guard: true 1944 alias_set: none 1945 1946- name: AsyncAwait 1947 operands: 1948 value: Value 1949 generator: Object 1950 result_type: Object 1951 1952- name: CheckThisReinit 1953 operands: 1954 thisValue: Value 1955 result_type: Value 1956 guard: true 1957 folds_to: custom 1958 alias_set: none 1959 1960- name: Generator 1961 gen_boilerplate: false 1962 1963- name: CanSkipAwait 1964 operands: 1965 value: Value 1966 result_type: Boolean 1967 1968- name: MaybeExtractAwaitValue 1969 gen_boilerplate: false 1970 1971- name: IncrementWarmUpCounter 1972 arguments: 1973 script: JSScript* 1974 alias_set: none 1975 1976- name: AtomicIsLockFree 1977 gen_boilerplate: false 1978 1979- name: CompareExchangeTypedArrayElement 1980 gen_boilerplate: false 1981 1982- name: AtomicExchangeTypedArrayElement 1983 gen_boilerplate: false 1984 1985- name: AtomicTypedArrayElementBinop 1986 gen_boilerplate: false 1987 1988- name: Debugger 1989 gen_boilerplate: false 1990 1991- name: CheckIsObj 1992 operands: 1993 value: Value 1994 arguments: 1995 checkKind: uint8_t 1996 result_type: Object 1997 guard: true 1998 folds_to: custom 1999 alias_set: none 2000 2001- name: CheckObjCoercible 2002 operands: 2003 checkValue: Value 2004 result_type: Value 2005 guard: true 2006 folds_to: custom 2007 # Throws on null or undefined. 2008 alias_set: custom 2009 2010- name: CheckClassHeritage 2011 operands: 2012 heritage: Value 2013 result_type: Value 2014 guard: true 2015 2016- name: DebugCheckSelfHosted 2017 operands: 2018 checkValue: Value 2019 result_type: Value 2020 guard: true 2021 2022- name: FinishBoundFunctionInit 2023 operands: 2024 bound: Object 2025 target: Object 2026 argCount: Int32 2027 2028- name: IsPackedArray 2029 operands: 2030 object: Object 2031 result_type: Boolean 2032 movable: true 2033 alias_set: custom 2034 2035- name: GuardArrayIsPacked 2036 operands: 2037 array: Object 2038 result_type: Object 2039 guard: true 2040 movable: true 2041 congruent_to: if_operands_equal 2042 alias_set: custom 2043 2044- name: GetPrototypeOf 2045 operands: 2046 target: Object 2047 result_type: Value 2048 # May throw if target is a proxy. 2049 guard: true 2050 2051- name: ObjectWithProto 2052 operands: 2053 prototype: Value 2054 result_type: Object 2055 # May throw if prototype is neither an object nor null. 2056 guard: true 2057 possibly_calls: true 2058 2059- name: ObjectStaticProto 2060 gen_boilerplate: false 2061 2062- name: BuiltinObject 2063 arguments: 2064 builtinObjectKind: BuiltinObjectKind 2065 result_type: Object 2066 possibly_calls: true 2067 2068- name: SuperFunction 2069 operands: 2070 callee: Object 2071 result_type: Value 2072 alias_set: custom 2073 2074- name: InitHomeObject 2075 operands: 2076 function: Object 2077 homeObject: Value 2078 result_type: Object 2079 alias_set: custom 2080 2081# Return true if the object is definitely a TypedArray constructor, but not 2082# necessarily from the currently active realm. Return false if the object is 2083# not a TypedArray constructor or if it's a wrapper. 2084- name: IsTypedArrayConstructor 2085 operands: 2086 object: Object 2087 result_type: Boolean 2088 alias_set: none 2089 2090# Load the JSValueTag on all platforms except ARM64. See the comments in 2091# MacroAssembler-arm64.h for the |cmpTag(Register, ImmTag)| method for why 2092# ARM64 doesn't use the raw JSValueTag, but instead a modified tag value. That 2093# modified tag value can't be directly compared against JSValueTag constants. 2094- name: LoadValueTag 2095 operands: 2096 value: Value 2097 result_type: Int32 2098 movable: true 2099 congruent_to: if_operands_equal 2100 alias_set: none 2101 2102# Load the target object from a proxy wrapper. The target is stored in the 2103# proxy object's private slot. 2104- name: LoadWrapperTarget 2105 operands: 2106 object: Object 2107 result_type: Object 2108 movable: true 2109 congruent_to: if_operands_equal 2110 # Can't use |AliasSet::None| because the target changes on navigation. 2111 # TODO: Investigate using a narrower or a custom alias set. 2112 alias_set: custom 2113 2114# Guard the accessor shape is present on the object or its prototype chain. 2115- name: GuardHasGetterSetter 2116 operands: 2117 object: Object 2118 arguments: 2119 propId: jsid 2120 getterSetter: GetterSetter* 2121 result_type: Object 2122 guard: true 2123 movable: true 2124 possibly_calls: true 2125 congruent_to: custom 2126 alias_set: custom 2127 2128- name: GuardIsExtensible 2129 operands: 2130 object: Object 2131 result_type: Object 2132 guard: true 2133 movable: true 2134 congruent_to: if_operands_equal 2135 alias_set: custom 2136 2137- name: GuardInt32IsNonNegative 2138 operands: 2139 index: Int32 2140 result_type: Int32 2141 guard: true 2142 movable: true 2143 congruent_to: if_operands_equal 2144 folds_to: custom 2145 alias_set: none 2146 2147# Guard the input index is greater than the dense initialized length of an 2148# object. 2149- name: GuardIndexGreaterThanDenseInitLength 2150 operands: 2151 object: Object 2152 index: Int32 2153 result_type: Int32 2154 guard: true 2155 movable: true 2156 congruent_to: if_operands_equal 2157 alias_set: custom 2158 2159# Guard an array object's length can be updated successfully when adding an 2160# element at the input index. 2161- name: GuardIndexIsValidUpdateOrAdd 2162 operands: 2163 object: Object 2164 index: Int32 2165 result_type: Int32 2166 guard: true 2167 movable: true 2168 congruent_to: if_operands_equal 2169 alias_set: custom 2170 2171# Add or update a sparse element of an array object. It's allowed for the 2172# sparse element to be already present on the array. It may also be an accessor 2173# property, so this instruction is always marked as effectful. 2174- name: CallAddOrUpdateSparseElement 2175 operands: 2176 object: Object 2177 index: Int32 2178 value: Value 2179 arguments: 2180 strict: bool 2181 possibly_calls: true 2182 2183# Get a sparse element from an array object, possibly by calling an accessor 2184# property. 2185- name: CallGetSparseElement 2186 operands: 2187 object: Object 2188 index: Int32 2189 result_type: Value 2190 possibly_calls: true 2191 2192- name: CallNativeGetElement 2193 operands: 2194 object: Object 2195 index: Int32 2196 result_type: Value 2197 possibly_calls: true 2198 2199# Test if a native object has an own element (sparse or dense) at an index. 2200- name: CallObjectHasSparseElement 2201 operands: 2202 object: Object 2203 index: Int32 2204 result_type: Boolean 2205 guard: true 2206 congruent_to: if_operands_equal 2207 possibly_calls: true 2208 alias_set: custom 2209 2210- name: BigIntAsIntN 2211 operands: 2212 bits: Int32 2213 input: BigInt 2214 result_type: BigInt 2215 movable: true 2216 congruent_to: if_operands_equal 2217 possibly_calls: true 2218 alias_set: none 2219 can_recover: true 2220 clone: true 2221 2222- name: BigIntAsUintN 2223 operands: 2224 bits: Int32 2225 input: BigInt 2226 result_type: BigInt 2227 movable: true 2228 congruent_to: if_operands_equal 2229 possibly_calls: true 2230 alias_set: none 2231 can_recover: true 2232 clone: true 2233 2234- name: WasmNeg 2235 gen_boilerplate: false 2236 2237- name: WasmLoadTls 2238 gen_boilerplate: false 2239 2240- name: WasmHeapBase 2241 gen_boilerplate: false 2242 2243- name: WasmBoundsCheck 2244 gen_boilerplate: false 2245 2246- name: WasmExtendU32Index 2247 operands: 2248 input: Int32 2249 result_type: Int64 2250 movable: true 2251 congruent_to: if_operands_equal 2252 folds_to: custom 2253 type_policy: none 2254 alias_set: none 2255 2256- name: WasmWrapU32Index 2257 operands: 2258 input: Int64 2259 result_type: Int32 2260 movable: true 2261 congruent_to: if_operands_equal 2262 folds_to: custom 2263 type_policy: none 2264 alias_set: none 2265 2266- name: WasmAddOffset 2267 gen_boilerplate: false 2268 2269- name: WasmAlignmentCheck 2270 gen_boilerplate: false 2271 2272- name: WasmLoad 2273 gen_boilerplate: false 2274 2275- name: WasmStore 2276 gen_boilerplate: false 2277 2278- name: AsmJSLoadHeap 2279 gen_boilerplate: false 2280 2281- name: AsmJSStoreHeap 2282 gen_boilerplate: false 2283 2284- name: WasmFence 2285 guard: true 2286 alias_set: none 2287 clone: true 2288 2289- name: WasmCompareExchangeHeap 2290 gen_boilerplate: false 2291 2292- name: WasmAtomicExchangeHeap 2293 gen_boilerplate: false 2294 2295- name: WasmAtomicBinopHeap 2296 gen_boilerplate: false 2297 2298- name: WasmLoadGlobalVar 2299 gen_boilerplate: false 2300 2301- name: WasmLoadGlobalCell 2302 gen_boilerplate: false 2303 2304- name: WasmStoreGlobalVar 2305 gen_boilerplate: false 2306 2307- name: WasmStoreGlobalCell 2308 gen_boilerplate: false 2309 2310- name: WasmStoreStackResult 2311 gen_boilerplate: false 2312 2313- name: WasmDerivedPointer 2314 gen_boilerplate: false 2315 2316- name: WasmStoreRef 2317 gen_boilerplate: false 2318 2319- name: WasmParameter 2320 gen_boilerplate: false 2321 2322- name: WasmReturn 2323 gen_boilerplate: false 2324 2325- name: WasmReturnVoid 2326 gen_boilerplate: false 2327 2328- name: WasmStackArg 2329 gen_boilerplate: false 2330 2331- name: WasmRegisterResult 2332 gen_boilerplate: false 2333 2334- name: WasmFloatRegisterResult 2335 gen_boilerplate: false 2336 2337- name: WasmRegister64Result 2338 gen_boilerplate: false 2339 2340- name: WasmStackResultArea 2341 gen_boilerplate: false 2342 2343- name: WasmStackResult 2344 gen_boilerplate: false 2345 2346- name: WasmCall 2347 gen_boilerplate: false 2348 2349- name: WasmSelect 2350 gen_boilerplate: false 2351 2352- name: WasmReinterpret 2353 gen_boilerplate: false 2354 2355- name: Rotate 2356 gen_boilerplate: false 2357 2358- name: WasmBitselectSimd128 2359 gen_boilerplate: false 2360 2361- name: WasmBinarySimd128 2362 gen_boilerplate: false 2363 2364- name: WasmBinarySimd128WithConstant 2365 gen_boilerplate: false 2366 2367# (v128, i32) -> v128 effect-free shift operations. 2368- name: WasmShiftSimd128 2369 operands: 2370 lhs: Simd128 2371 rhs: Int32 2372 arguments: 2373 simdOp: wasm::SimdOp 2374 type_policy: none 2375 result_type: Simd128 2376 movable: true 2377 congruent_to: custom 2378 alias_set: none 2379 clone: true 2380 2381# (v128, v128, mask) -> v128 effect-free operation. 2382- name: WasmShuffleSimd128 2383 operands: 2384 lhs: Simd128 2385 rhs: Simd128 2386 arguments: 2387 control: SimdConstant 2388 type_policy: none 2389 result_type: Simd128 2390 movable: true 2391 congruent_to: custom 2392 alias_set: none 2393 clone: true 2394 2395- name: WasmReplaceLaneSimd128 2396 gen_boilerplate: false 2397 2398- name: WasmUnarySimd128 2399 operands: 2400 src: Simd128 2401 arguments: 2402 simdOp: wasm::SimdOp 2403 type_policy: none 2404 result_type: Simd128 2405 movable: true 2406 congruent_to: custom 2407 alias_set: none 2408 clone: true 2409 2410- name: WasmScalarToSimd128 2411 gen_boilerplate: false 2412 2413- name: WasmReduceSimd128 2414 gen_boilerplate: false 2415 2416- name: WasmLoadLaneSimd128 2417 gen_boilerplate: false 2418 2419- name: WasmStoreLaneSimd128 2420 gen_boilerplate: false 2421 2422- name: UnreachableResult 2423 gen_boilerplate: false 2424 2425- name: IonToWasmCall 2426 gen_boilerplate: false 2427