1# This Source Code Form is subject to the terms of the Mozilla Public
2# License, v. 2.0. If a copy of the MPL was not distributed with this
3# file, You can obtain one at http://mozilla.org/MPL/2.0/.
4
5# [SMDOC] MIR Opcodes
6# =======================
7# This file defines all MIR opcodes. It is parsed by GenerateMIRFiles.py
8# at build time to create MIROpsGenerated.h. Each opcode consists of a
9# name and a set of attributes that are described below. A few of the
10# attributes below allow setting the value to "custom", meaning the
11# method will be declared for the MIR op, but will need to be implemented
12# in C++ (typically done in MIR.cpp). Unless marked as required, attributes
13# are optional.
14#
15# name [required]
16# ====
17# Opcode name.
18# Possible values:
19#   - opcode string: used as the name for MIR opcode.
20#
21# gen_boilerplate
22# ===============
23# Used to decide to generate MIR boilerplate.
24#   - true (default): auto generate boilerplate for this MIR opcode
25#   - false: do not generate boilerplate for this MIR opcode
26#
27# operands
28# ========
29# A list of operands for the MIR op class constructor. Each operand is a
30# MIR node. The operand kind is specified from the one of the kinds from
31# the MIRType enum in IonTypes.h. The specified types for the
32# operands will decide the type policy for the instruction.
33#
34# The naming of operands is how the NAMED_OPERANDS macro will define
35# its operands.
36#
37# For example:
38#   object: Object
39#   id: Value
40#   value: Object
41#
42# Will result in an instruction having the type policy of:
43#   MixPolicy<ObjectPolicy<0>, BoxPolicy<1>, ObjectPolicy<2>>
44# and a named operands definition that looks like the following:
45#   NAMED_OPERANDS((0, object), (1, idValue), (2, value))
46#
47#   - attribute not specified (default): no code generated
48#   - operand list: MIRTypes (See MIRType in jit/IonTypes.h)
49#
50# arguments
51# =========
52# A list of non-MIR node arguments to the MIR op class constructor
53# that are passed along with the operands. The arguments require
54# both a name and a full type signature for each item in the list.
55#
56# For example:
57#   templateObject: JSObject*
58#   initialHeap: gc::InitialHeap
59#
60# For each argument a private variable declaration will be autogenerated
61# in the MIR op class, as well as simple accessor for that variable. If
62# the type of the variable is a GC pointer it will by automatically
63# wrapped by CompilerGCPointer. The above arguments list will result in
64# the following declarations and accessors:
65#
66#   CompilerGCPointer<JSObject*> templateObject_;
67#   gc::InitialHeap initialHeap_;
68#
69#   JSObject* templateObject() const { return templateObject_; }
70#   gc::InitialHeap initialHeap() const { return initialHeap_; }
71#
72#   - attribute not specified (default): no code generated
73#   - operand list: argument names and their full type signature
74#
75# type_policy
76# ============
77# If this attribute is present, then the type policy for that opcode will be
78# NoTypePolicy. This is used for opcode that should have no type policy.
79#   - attribute not specified (default): no code generated, type policy
80#     is based off of operands
81#   - none: defines the type policy as opcode's NoTypePolicy
82#
83# result_type
84# ===========
85# Defines the result type of the MIR opcode.
86#   - attribute not specified (default): no code is generated
87#   - MIRType string: Will add a call to setResultType to the opcode constructor.
88#                   This will set the MIR opcodes result type to whatever the
89#                   specified MIRType is (See MIRType in jit/IonTypes.h).
90#
91# guard
92# =====
93# Set if the opcode is a guard instruction and is used for checks in optimizations
94# such as range analysis and value numbering.
95#   - attribute not specified (default): no code generated
96#   - true: adds setGuard to opcode constructor
97#
98# movable
99# =======
100# Defines the movable MIR flag for movable instructions. This is used for knowing
101# if we can hoist an instruction.
102#   - attribute not specified (default): no code generated
103#   - true: adds setMovable call in opcode constructor
104#
105# folds_to
106# ========
107# The foldsTo method is used for determining if an instruction can be folded into
108# simpler instruction or for constant folding, depending on its operands.
109#   - attribute not specified (default): no code generated, no constants to fold
110#   - custom: custom C++ implementation
111#
112# congruent_to
113# ============
114# Used by ValueNumbering to determine if two values are congruent.
115#   - attribute not specified (default): no code generated, congruentTo(foo) returns
116#     false
117#   - if_operands_equal: congruentTo(foo) will return congruentIfOperandsEqual(foo)
118#   - custom: custom C++ implementation
119#
120# alias_set
121# =========
122# Defines the getAliasSet function for a MIR op. The alias set is used for alias
123# analysis. The default alias set is Any.
124#   - attribute not specified (default): no code generated, alias set is Any
125#   - none: this is the most common case, this is will set the alias set to None.
126#   - custom: custom C++ implementation in MIR.cpp
127#
128# possibly_calls
129# ==============
130# Defines if a opcode can possibly call.
131#   - attribute not specified (default): no code generated, opcode does not call
132#   - true: possiblyCalls returns true
133#   - custom: custom C++ implementation
134#
135# compute_range
136# =============
137# Computes and sets the range value for a MIR node, which is then used in range
138# analysis.
139#   - attribute not specified (default): no code generated, range is not set for node
140#   - custom: custom C++ implementation in RangeAnalysis.cpp
141#
142# can_recover
143# ===========
144# Indicates whether this instruction can be recovered on bailout.
145# Possible values:
146#   - attribute not specified (default): no code generated, canRecoverOnBailout
147#     returns false
148#   - true: canRecoverOnBailout returns true
149#   - custom: canRecoverOnBailout has a custom C++ implementation
150# If the value is either 'true' or 'custom', writeRecoverData has a custom C++
151# implementation.
152#
153# clone
154# =====
155# Allows cloning for that MIR op.
156#   - attribute not specified (default): no code generated
157#   - true: allows cloning
158#
159
160# TODO(no-TI): try to remove this instruction.
161- name: Start
162
163# Instruction marking on entrypoint for on-stack replacement.
164# OSR may occur at loop headers (at JSOp::LoopHead).
165# There is at most one MOsrEntry per MIRGraph.
166- name: OsrEntry
167  result_type: Pointer
168
169- name: Nop
170  alias_set: none
171  clone: true
172
173- name: LimitedTruncate
174  gen_boilerplate: false
175
176- name: Constant
177  gen_boilerplate: false
178
179- name: WasmNullConstant
180  gen_boilerplate: false
181
182- name: WasmFloatConstant
183  gen_boilerplate: false
184
185- name: Parameter
186  gen_boilerplate: false
187
188- name: Callee
189  result_type: Object
190  movable: true
191  congruent_to: if_operands_equal
192  alias_set: none
193
194- name: IsConstructing
195  result_type: Boolean
196  movable: true
197  congruent_to: if_operands_equal
198  alias_set: none
199
200- name: TableSwitch
201  gen_boilerplate: false
202
203- name: Goto
204  gen_boilerplate: false
205
206- name: Test
207  gen_boilerplate: false
208
209- name: Return
210  gen_boilerplate: false
211
212- name: Throw
213  operands:
214    ins: Value
215  alias_set: custom
216  possibly_calls: true
217
218- name: NewArray
219  gen_boilerplate: false
220
221- name: NewArrayDynamicLength
222  operands:
223    length: Int32
224  arguments:
225    templateObject: JSObject*
226    initialHeap: gc::InitialHeap
227  result_type: Object
228  # Need to throw if length is negative.
229  guard: true
230  # Throws if length is negative.
231  alias_set: custom
232
233- name: NewTypedArray
234  gen_boilerplate: false
235
236- name: NewTypedArrayDynamicLength
237  operands:
238    length: Int32
239  arguments:
240    templateObject: JSObject*
241    initialHeap: gc::InitialHeap
242  result_type: Object
243  guard: true
244  # Throws if length is negative.
245  alias_set: custom
246
247# Create a new TypedArray from an Array (or Array-like object) or a TypedArray.
248- name: NewTypedArrayFromArray
249  operands:
250    array: Object
251  arguments:
252    templateObject: JSObject*
253    initialHeap: gc::InitialHeap
254  result_type: Object
255  guard: true
256  possibly_calls: true
257
258# Create a new TypedArray from an ArrayBuffer (or SharedArrayBuffer).
259- name: NewTypedArrayFromArrayBuffer
260  operands:
261    arrayBuffer: Object
262    byteOffset: Value
263    length: Value
264  arguments:
265    templateObject: JSObject*
266    initialHeap: gc::InitialHeap
267  result_type: Object
268  guard: true
269  possibly_calls: true
270
271- name: NewObject
272  gen_boilerplate: false
273
274- name: NewPlainObject
275  gen_boilerplate: false
276
277- name: NewArrayObject
278  gen_boilerplate: false
279
280- name: NewIterator
281  gen_boilerplate: false
282
283- name: ObjectState
284  gen_boilerplate: false
285
286- name: ArrayState
287  gen_boilerplate: false
288
289# Setting __proto__ in an object literal.
290- name: MutateProto
291  operands:
292    object: Object
293    value: Value
294  result_type: None
295  possibly_calls: true
296
297- name: InitPropGetterSetter
298  operands:
299    object: Object
300    value: Object
301  arguments:
302    name: PropertyName*
303
304- name: InitElemGetterSetter
305  operands:
306    object: Object
307    id: Value
308    value: Object
309
310- name: Call
311  gen_boilerplate: false
312
313- name: ApplyArgs
314  gen_boilerplate: false
315
316- name: ApplyArgsObj
317  gen_boilerplate: false
318
319- name: ApplyArray
320  gen_boilerplate: false
321
322- name: ConstructArray
323  gen_boilerplate: false
324
325- name: Bail
326  gen_boilerplate: false
327
328- name: Unreachable
329  gen_boilerplate: false
330
331# This op serves as a way to force the encoding of a snapshot, even if there
332# is no resume point using it.  This is useful to run MAssertRecoveredOnBailout
333# assertions.
334- name: EncodeSnapshot
335  guard: true
336
337- name: AssertRecoveredOnBailout
338  gen_boilerplate: false
339
340- name: AssertFloat32
341  gen_boilerplate: false
342
343- name: Compare
344  gen_boilerplate: false
345
346- name: SameValueDouble
347  operands:
348    left: Double
349    right: Double
350  result_type: Boolean
351  movable: true
352  congruent_to: if_operands_equal
353  alias_set: none
354  clone: true
355
356- name: SameValue
357  operands:
358    left: Value
359    right: Value
360  result_type: Boolean
361  movable: true
362  congruent_to: if_operands_equal
363  alias_set: none
364  clone: true
365
366- name: Box
367  gen_boilerplate: false
368
369- name: Unbox
370  gen_boilerplate: false
371
372- name: AssertRange
373  gen_boilerplate: false
374
375- name: AssertClass
376  gen_boilerplate: false
377
378- name: AssertShape
379  gen_boilerplate: false
380
381- name: CreateThisWithTemplate
382  gen_boilerplate: false
383
384# Caller-side allocation of |this| for |new|:
385# Constructs |this| when possible, else MagicValue(JS_IS_CONSTRUCTING).
386- name: CreateThis
387  operands:
388    callee: Object
389    newTarget: Object
390  result_type: Value
391  # Performs a property read from |newTarget| iff |newTarget| is a JSFunction
392  # with an own |.prototype| property.
393  alias_set: custom
394  possibly_calls: true
395
396- name: CreateArgumentsObject
397  gen_boilerplate: false
398
399- name: CreateInlinedArgumentsObject
400  gen_boilerplate: false
401
402- name: GetInlinedArgument
403  gen_boilerplate: false
404
405- name: GetArgumentsObjectArg
406  operands:
407    argsObject: Object
408  arguments:
409    argno: size_t
410  result_type: Value
411  congruent_to: custom
412  alias_set: custom
413
414- name: SetArgumentsObjectArg
415  operands:
416    argsObject: Object
417    value: Value
418  arguments:
419    argno: size_t
420  alias_set: custom
421
422# Load |arguments[index]| from a mapped or unmapped arguments object. Bails out
423# if any elements were overridden or deleted. Also bails out if the index is
424# out of bounds.
425- name: LoadArgumentsObjectArg
426  operands:
427    argsObject: Object
428    index: Int32
429  result_type: Value
430  guard: true
431  congruent_to: if_operands_equal
432  alias_set: custom
433
434# Load |arguments.length|. Bails out if the length has been overriden.
435- name: ArgumentsObjectLength
436  operands:
437    argsObject: Object
438  result_type: Int32
439  guard: true
440  movable: true
441  congruent_to: if_operands_equal
442  # Even though the "length" property is lazily resolved, it acts similar to
443  # a normal property load, so we can treat this operation like any other
444  # property read.
445  alias_set: custom
446
447# Guard that the given flags are not set on the arguments object.
448- name: GuardArgumentsObjectFlags
449  operands:
450    argsObject: Object
451  arguments:
452    flags: uint32_t
453  result_type: Object
454  movable: true
455  guard: true
456  congruent_to: custom
457  # The flags are packed with the length in a fixed private slot.
458  alias_set: custom
459
460# Given a MIRType::Value A and a MIRType::Object B:
461# If the Value may be safely unboxed to an Object, return Object(A).
462# Otherwise, return B.
463# Used to implement return behavior for inlined constructors.
464- name: ReturnFromCtor
465  operands:
466    value: Value
467    object: Object
468  result_type: Object
469  folds_to: custom
470  congruent_to: if_operands_equal
471  alias_set: none
472
473- name: ToDouble
474  gen_boilerplate: false
475
476- name: ToFloat32
477  gen_boilerplate: false
478
479# Converts a uint32 to a double (coming from wasm).
480- name: WasmUnsignedToDouble
481  operands:
482    def: Int32
483  type_policy: none
484  result_type: Double
485  movable: true
486  folds_to: custom
487  congruent_to: if_operands_equal
488  alias_set: none
489
490- name: WasmUnsignedToFloat32
491  gen_boilerplate: false
492
493- name: WrapInt64ToInt32
494  gen_boilerplate: false
495
496- name: ExtendInt32ToInt64
497  gen_boilerplate: false
498
499- name: WasmBuiltinTruncateToInt64
500  gen_boilerplate: false
501
502- name: WasmTruncateToInt64
503  gen_boilerplate: false
504
505- name: WasmTruncateToInt32
506  gen_boilerplate: false
507
508# Store a JS Value that can't be represented as an AnyRef pointer into an
509# object that holds the value (opaquely) as such a pointer.
510- name: WasmBoxValue
511  operands:
512    def: Value
513  result_type: RefOrNull
514  congruent_to: if_operands_equal
515  alias_set: none
516
517- name: WasmAnyRefFromJSObject
518  operands:
519    def: Object
520  type_policy: none
521  result_type: RefOrNull
522  congruent_to: if_operands_equal
523  alias_set: none
524
525- name: Int32ToIntPtr
526  gen_boilerplate: false
527
528- name: NonNegativeIntPtrToInt32
529  gen_boilerplate: false
530
531- name: IntPtrToDouble
532  gen_boilerplate: false
533
534- name: AdjustDataViewLength
535  gen_boilerplate: false
536
537- name: Int64ToFloatingPoint
538  gen_boilerplate: false
539
540- name: BuiltinInt64ToFloatingPoint
541  gen_boilerplate: false
542
543- name: ToNumberInt32
544  gen_boilerplate: false
545
546- name: ToIntegerInt32
547  gen_boilerplate: false
548
549- name: TruncateToInt32
550  gen_boilerplate: false
551
552- name: WasmBuiltinTruncateToInt32
553  gen_boilerplate: false
554
555- name: ToBigInt
556  gen_boilerplate: false
557
558- name: ToInt64
559  gen_boilerplate: false
560
561- name: TruncateBigIntToInt64
562  gen_boilerplate: false
563
564- name: Int64ToBigInt
565  gen_boilerplate: false
566
567- name: ToString
568  gen_boilerplate: false
569
570- name: BitNot
571  gen_boilerplate: false
572
573- name: TypeOf
574  gen_boilerplate: false
575
576- name: ToAsyncIter
577  operands:
578    iterator: Object
579    nextMethod: Value
580  result_type: Object
581
582- name: ToPropertyKeyCache
583  operands:
584    input: Value
585  result_type: Value
586
587- name: BitAnd
588  gen_boilerplate: false
589
590- name: BitOr
591  gen_boilerplate: false
592
593- name: BitXor
594  gen_boilerplate: false
595
596- name: Lsh
597  gen_boilerplate: false
598
599- name: Rsh
600  gen_boilerplate: false
601
602- name: Ursh
603  gen_boilerplate: false
604
605- name: SignExtendInt32
606  gen_boilerplate: false
607
608- name: SignExtendInt64
609  gen_boilerplate: false
610
611- name: MinMax
612  gen_boilerplate: false
613
614- name: MinMaxArray
615  gen_boilerplate: false
616
617- name: Abs
618  gen_boilerplate: false
619
620- name: Clz
621  gen_boilerplate: false
622
623- name: Ctz
624  gen_boilerplate: false
625
626- name: Popcnt
627  gen_boilerplate: false
628
629- name: Sqrt
630  gen_boilerplate: false
631
632- name: CopySign
633  gen_boilerplate: false
634
635# Inline implementation of atan2 (arctangent of y/x).
636- name: Atan2
637  operands:
638    y: Double
639    x: Double
640  result_type: Double
641  movable: true
642  congruent_to: if_operands_equal
643  alias_set: none
644  possibly_calls: true
645  can_recover: true
646  clone: true
647
648- name: Hypot
649  gen_boilerplate: false
650
651- name: Pow
652  gen_boilerplate: false
653
654- name: PowHalf
655  gen_boilerplate: false
656
657- name: Random
658  result_type: Double
659  alias_set: none
660  possibly_calls: true
661  compute_range: custom
662  can_recover: custom
663  clone: true
664
665- name: Sign
666  gen_boilerplate: false
667
668- name: MathFunction
669  gen_boilerplate: false
670
671- name: Add
672  gen_boilerplate: false
673
674- name: Sub
675  gen_boilerplate: false
676
677- name: Mul
678  gen_boilerplate: false
679
680- name: Div
681  gen_boilerplate: false
682
683- name: WasmBuiltinDivI64
684  gen_boilerplate: false
685
686- name: Mod
687  gen_boilerplate: false
688
689- name: WasmBuiltinModD
690  gen_boilerplate: false
691
692- name: WasmBuiltinModI64
693  gen_boilerplate: false
694
695- name: BigIntAdd
696  gen_boilerplate: false
697
698- name: BigIntSub
699  gen_boilerplate: false
700
701- name: BigIntMul
702  gen_boilerplate: false
703
704- name: BigIntDiv
705  gen_boilerplate: false
706
707- name: BigIntMod
708  gen_boilerplate: false
709
710- name: BigIntPow
711  gen_boilerplate: false
712
713- name: BigIntBitAnd
714  gen_boilerplate: false
715
716- name: BigIntBitOr
717  gen_boilerplate: false
718
719- name: BigIntBitXor
720  gen_boilerplate: false
721
722- name: BigIntLsh
723  gen_boilerplate: false
724
725- name: BigIntRsh
726  gen_boilerplate: false
727
728- name: BigIntIncrement
729  gen_boilerplate: false
730
731- name: BigIntDecrement
732  gen_boilerplate: false
733
734- name: BigIntNegate
735  gen_boilerplate: false
736
737- name: BigIntBitNot
738  gen_boilerplate: false
739
740- name: Concat
741  gen_boilerplate: false
742
743- name: CharCodeAt
744  operands:
745    string: String
746    index: Int32
747  result_type: Int32
748  movable: true
749  folds_to: custom
750  congruent_to: if_operands_equal
751  # Strings are immutable, so there is no implicit dependency.
752  alias_set: none
753  compute_range: custom
754  can_recover: true
755  clone: true
756
757- name: FromCharCode
758  operands:
759    code: Int32
760  result_type: String
761  movable: true
762  congruent_to: if_operands_equal
763  alias_set: none
764  can_recover: true
765  clone: true
766
767- name: FromCodePoint
768  operands:
769    codePoint: Int32
770  result_type: String
771  guard: true
772  movable: true
773  congruent_to: if_operands_equal
774  alias_set: none
775  clone: true
776
777- name: StringConvertCase
778  gen_boilerplate: false
779
780- name: StringSplit
781  operands:
782    string: String
783    separator: String
784  result_type: Object
785  possibly_calls: true
786  congruent_to: if_operands_equal
787  # Although this instruction returns a new array, we don't have to mark
788  # it as store instruction, see also MNewArray.
789  alias_set: none
790  can_recover: true
791
792- name: BoxNonStrictThis
793  operands:
794    def: Value
795  arguments:
796    globalThis: JSObject*
797  result_type: Object
798  folds_to: custom
799  possibly_calls: true
800  # This instruction can allocate a new object for wrapped primitives, but
801  # has no effect on existing objects.
802  alias_set: none
803
804- name: ImplicitThis
805  operands:
806    envChain: Object
807  arguments:
808    name: PropertyName*
809  result_type: Value
810  possibly_calls: true
811
812# Load an arrow function's |new.target| value.
813- name: ArrowNewTarget
814  operands:
815    callee: Object
816  result_type: Value
817  movable: true
818  congruent_to: if_operands_equal
819  # An arrow function's lexical |this| value is immutable.
820  alias_set: none
821
822- name: Phi
823  gen_boilerplate: false
824
825- name: Beta
826  gen_boilerplate: false
827
828- name: NaNToZero
829  gen_boilerplate: false
830
831- name: OsrValue
832  gen_boilerplate: false
833
834- name: OsrEnvironmentChain
835  gen_boilerplate: false
836
837- name: OsrArgumentsObject
838  gen_boilerplate: false
839
840- name: OsrReturnValue
841  gen_boilerplate: false
842
843- name: BinaryCache
844  gen_boilerplate: false
845
846- name: UnaryCache
847  operands:
848    input: Value
849  result_type: Value
850
851# Checks whether we need to fire the interrupt handler.
852- name: CheckOverRecursed
853  guard: true
854  alias_set: none
855
856
857# Check whether we need to fire the interrupt handler.
858- name: InterruptCheck
859  guard: true
860  alias_set: none
861
862- name: WasmInterruptCheck
863  gen_boilerplate: false
864
865- name: WasmTrap
866  gen_boilerplate: false
867
868- name: LexicalCheck
869  gen_boilerplate: false
870
871# Unconditionally throw an uninitialized let error.
872- name: ThrowRuntimeLexicalError
873  arguments:
874    errorNumber: unsigned
875  result_type: None
876  guard: true
877  alias_set: custom
878
879- name: ThrowMsg
880  gen_boilerplate: false
881
882# In the prologues of global and eval scripts, check for redeclarations and
883# initialize bindings.
884- name: GlobalDeclInstantiation
885  guard: true
886
887- name: RegExp
888  arguments:
889    source: RegExpObject*
890    hasShared: bool
891  result_type: Object
892  possibly_calls: true
893  alias_set: none
894
895- name: RegExpMatcher
896  operands:
897    regexp: Object
898    string: String
899    lastIndex: Int32
900  result_type: Value
901  possibly_calls: true
902  can_recover: true
903
904- name: RegExpSearcher
905  operands:
906    regexp: Object
907    string: String
908    lastIndex: Int32
909  result_type: Int32
910  possibly_calls: true
911  can_recover: true
912
913- name: RegExpTester
914  operands:
915    regexp: Object
916    string: String
917    lastIndex: Int32
918  result_type: Int32
919  possibly_calls: true
920  can_recover: true
921
922- name: RegExpPrototypeOptimizable
923  operands:
924    object: Object
925  result_type: Boolean
926  alias_set: none
927
928- name: RegExpInstanceOptimizable
929  operands:
930    object: Object
931    proto: Object
932  result_type: Boolean
933  alias_set: none
934
935- name: GetFirstDollarIndex
936  gen_boilerplate: false
937
938- name: StringReplace
939  gen_boilerplate: false
940
941- name: Substr
942  operands:
943    string: String
944    begin: Int32
945    length: Int32
946  result_type: String
947  congruent_to: if_operands_equal
948  alias_set: none
949
950- name: ModuleMetadata
951  arguments:
952    module: JSObject*
953  result_type: Object
954
955- name: DynamicImport
956  operands:
957    specifier: Value
958  result_type: Object
959
960- name: Lambda
961  gen_boilerplate: false
962
963- name: LambdaArrow
964  gen_boilerplate: false
965
966- name: FunctionWithProto
967  gen_boilerplate: false
968
969- name: SetFunName
970  operands:
971    fun: Object
972    name: Value
973  arguments:
974    prefixKind: uint8_t
975  result_type: None
976  possibly_calls: true
977
978# Returns obj->slots.
979- name: Slots
980  operands:
981    object: Object
982  result_type: Slots
983  movable: true
984  congruent_to: if_operands_equal
985  alias_set: custom
986  clone: true
987
988# Returns obj->elements.
989- name: Elements
990  operands:
991    object: Object
992  result_type: Elements
993  movable: true
994  congruent_to: if_operands_equal
995  alias_set: custom
996  clone: true
997
998# Load the initialized length from an elements header.
999- name: InitializedLength
1000  operands:
1001    elements: Elements
1002  type_policy: none
1003  result_type: Int32
1004  movable: true
1005  congruent_to: if_operands_equal
1006  alias_set: custom
1007  compute_range: custom
1008  clone: true
1009
1010- name: SetInitializedLength
1011  operands:
1012    elements: Elements
1013    index: Int32
1014  type_policy: none
1015  alias_set: custom
1016  clone: true
1017
1018# Load the array length from an elements header.
1019- name: ArrayLength
1020  operands:
1021    elements: Elements
1022  type_policy: none
1023  result_type: Int32
1024  movable: true
1025  congruent_to: if_operands_equal
1026  alias_set: custom
1027  compute_range: custom
1028  clone: true
1029
1030# Store to the length in an elements header. Note the input is an *index*, one
1031# less than the desired length.
1032- name: SetArrayLength
1033  operands:
1034    elements: Elements
1035    index: Int32
1036  type_policy: none
1037  alias_set: custom
1038  # By default no, unless built as a recovered instruction.
1039  can_recover: custom
1040
1041# Load the function length. Bails for functions with lazy scripts or a
1042# resolved "length" property.
1043- name: FunctionLength
1044  operands:
1045    function: Object
1046  result_type: Int32
1047  guard: true
1048  congruent_to: if_operands_equal
1049  # Even though the "length" property is lazily resolved, it acts similar to
1050  # a normal property load, so we can treat this operation like any other
1051  # property read.
1052  alias_set: custom
1053
1054# Load the function name. Bails for bound functions when the bound function
1055# name prefix isn't present or functions with a resolved "name" property.
1056- name: FunctionName
1057  operands:
1058    function: Object
1059  result_type: String
1060  guard: true
1061  congruent_to: if_operands_equal
1062  # Even though the "name" property is lazily resolved, it acts similar to
1063  # a normal property load, so we can treat this operation like any other
1064  # property read.
1065  alias_set: custom
1066
1067- name: GetNextEntryForIterator
1068  gen_boilerplate: false
1069
1070# Read the byte length of an array buffer as IntPtr.
1071- name: ArrayBufferByteLength
1072  operands:
1073    object: Object
1074  result_type: IntPtr
1075  movable: true
1076  congruent_to: if_operands_equal
1077  alias_set: custom
1078
1079# Read the length of an array buffer view.
1080- name: ArrayBufferViewLength
1081  operands:
1082    object: Object
1083  result_type: IntPtr
1084  movable: true
1085  congruent_to: if_operands_equal
1086  alias_set: custom
1087  compute_range: custom
1088
1089- name: ArrayBufferViewByteOffset
1090  operands:
1091    object: Object
1092  result_type: IntPtr
1093  movable: true
1094  congruent_to: if_operands_equal
1095  alias_set: custom
1096  compute_range: custom
1097
1098# Read the length of an array buffer view.
1099- name: ArrayBufferViewElements
1100  operands:
1101    object: Object
1102  result_type: Elements
1103  movable: true
1104  congruent_to: if_operands_equal
1105  alias_set: custom
1106  clone: true
1107
1108# Return the element size of a typed array.
1109- name: TypedArrayElementSize
1110  operands:
1111    object: Object
1112  result_type: Int32
1113  movable: true
1114  congruent_to: if_operands_equal
1115  # Class is immutable. See also MHasClass.
1116  alias_set: none
1117  compute_range: custom
1118
1119# Guard an ArrayBufferView has an attached ArrayBuffer.
1120- name: GuardHasAttachedArrayBuffer
1121  operands:
1122    object: Object
1123  result_type: Object
1124  guard: true
1125  movable: true
1126  congruent_to: if_operands_equal
1127  alias_set: custom
1128
1129- name: GuardNumberToIntPtrIndex
1130  gen_boilerplate: false
1131
1132- name: KeepAliveObject
1133  operands:
1134    object: Object
1135  result_type: None
1136  guard: true
1137
1138- name: Not
1139  gen_boilerplate: false
1140
1141- name: BoundsCheck
1142  gen_boilerplate: false
1143
1144- name: BoundsCheckLower
1145  gen_boilerplate: false
1146
1147- name: SpectreMaskIndex
1148  gen_boilerplate: false
1149
1150- name: LoadElement
1151  gen_boilerplate: false
1152
1153- name: LoadElementAndUnbox
1154  gen_boilerplate: false
1155
1156- name: LoadElementHole
1157  gen_boilerplate: false
1158
1159- name: StoreElement
1160  gen_boilerplate: false
1161
1162- name: StoreHoleValueElement
1163  gen_boilerplate: false
1164
1165- name: StoreElementHole
1166  gen_boilerplate: false
1167
1168- name: ArrayPopShift
1169  gen_boilerplate: false
1170
1171# Array.prototype.push on a dense array. Returns the new array length.
1172- name: ArrayPush
1173  operands:
1174    object: Object
1175    value: Value
1176  result_type: Int32
1177  alias_set: custom
1178  compute_range: custom
1179  clone: true
1180
1181# Array.prototype.slice on a dense array.
1182- name: ArraySlice
1183  operands:
1184    object: Object
1185    begin: Int32
1186    end: Int32
1187  arguments:
1188    templateObj: JSObject*
1189    initialHeap: gc::InitialHeap
1190  result_type: Object
1191  possibly_calls: true
1192
1193# MArrayJoin doesn't override |getAliasSet()|, because Array.prototype.join
1194# might coerce the elements of the Array to strings. This coercion might
1195# cause the evaluation of JavaScript code.
1196- name: ArrayJoin
1197  operands:
1198    array: Object
1199    sep: String
1200  result_type: String
1201  possibly_calls: true
1202  folds_to: custom
1203  # MArrayJoin doesn't override |getAliasSet()|, because Array.prototype.join
1204  # might coerce the elements of the Array to strings. This coercion might
1205  # cause the evaluation of JavaScript code.
1206
1207- name: LoadUnboxedScalar
1208  gen_boilerplate: false
1209
1210- name: LoadDataViewElement
1211  gen_boilerplate: false
1212
1213- name: LoadTypedArrayElementHole
1214  gen_boilerplate: false
1215
1216- name: StoreUnboxedScalar
1217  gen_boilerplate: false
1218
1219- name: StoreDataViewElement
1220  gen_boilerplate: false
1221
1222- name: StoreTypedArrayElementHole
1223  gen_boilerplate: false
1224
1225- name: EffectiveAddress
1226  gen_boilerplate: false
1227
1228- name: ClampToUint8
1229  gen_boilerplate: false
1230
1231- name: LoadFixedSlot
1232  gen_boilerplate: false
1233
1234- name: LoadFixedSlotAndUnbox
1235  gen_boilerplate: false
1236
1237- name: LoadDynamicSlotAndUnbox
1238  gen_boilerplate: false
1239
1240- name: StoreFixedSlot
1241  gen_boilerplate: false
1242
1243- name: GetPropertyCache
1244  gen_boilerplate: false
1245
1246- name: HomeObjectSuperBase
1247  operands:
1248    homeObject: Object
1249  result_type: Object
1250  # May throw if [[Prototype]] is null
1251  guard: true
1252  alias_set: custom
1253
1254- name: GetPropSuperCache
1255  gen_boilerplate: false
1256
1257- name: BindNameCache
1258  operands:
1259    envChain: Object
1260  result_type: Object
1261
1262- name: CallBindVar
1263  operands:
1264    environmentChain: Object
1265  result_type: Object
1266  movable: true
1267  congruent_to: custom
1268  alias_set: none
1269
1270- name: GuardShape
1271  operands:
1272    object: Object
1273  arguments:
1274    shape: Shape*
1275  result_type: Object
1276  guard: true
1277  movable: true
1278  congruent_to: custom
1279  folds_to: custom
1280  alias_set: custom
1281
1282- name: GuardProto
1283  gen_boilerplate: false
1284
1285- name: GuardNullProto
1286  gen_boilerplate: false
1287
1288# Guard the object is a native object.
1289- name: GuardIsNativeObject
1290  operands:
1291    object: Object
1292  result_type: Object
1293  guard: true
1294  movable: true
1295  congruent_to: if_operands_equal
1296  alias_set: none
1297
1298- name: GuardIsProxy
1299  operands:
1300    object: Object
1301  result_type: Object
1302  guard: true
1303  movable: true
1304  congruent_to: if_operands_equal
1305  alias_set: none
1306
1307- name: GuardIsNotDOMProxy
1308  operands:
1309    proxy: Object
1310  result_type: Object
1311  guard: true
1312  movable: true
1313  congruent_to: if_operands_equal
1314  alias_set: none
1315
1316- name: GuardIsNotProxy
1317  operands:
1318    object: Object
1319  result_type: Object
1320  guard: true
1321  movable: true
1322  congruent_to: if_operands_equal
1323  folds_to: custom
1324  alias_set: none
1325
1326- name: ProxyGet
1327  operands:
1328    proxy: Object
1329  arguments:
1330    id: jsid
1331  result_type: Value
1332  possibly_calls: true
1333
1334- name: ProxyGetByValue
1335  operands:
1336    proxy: Object
1337    idVal: Value
1338  result_type: Value
1339  possibly_calls: true
1340
1341- name: ProxyHasProp
1342  operands:
1343    proxy: Object
1344    idVal: Value
1345  arguments:
1346    hasOwn: bool
1347  result_type: Boolean
1348  possibly_calls: true
1349
1350- name: ProxySet
1351  operands:
1352    proxy: Object
1353    rhs: Value
1354  arguments:
1355    id: jsid
1356    strict: bool
1357  possibly_calls: true
1358
1359- name: ProxySetByValue
1360  operands:
1361    proxy: Object
1362    idVal: Value
1363    rhs: Value
1364  arguments:
1365    strict: bool
1366  possibly_calls: true
1367
1368- name: CallSetArrayLength
1369  operands:
1370    obj: Object
1371    rhs: Value
1372  arguments:
1373    strict: bool
1374  possibly_calls: true
1375
1376- name: MegamorphicLoadSlot
1377  operands:
1378    object: Object
1379  arguments:
1380    name: PropertyName*
1381  result_type: Value
1382  # Bails when non-native or accessor properties are encountered, so we can't
1383  # DCE this instruction.
1384  guard: true
1385  possibly_calls: true
1386  congruent_to: custom
1387  alias_set: custom
1388
1389- name: MegamorphicLoadSlotByValue
1390  operands:
1391    object: Object
1392    idVal: Value
1393  result_type: Value
1394  # Bails when non-native or accessor properties are encountered, so we can't
1395  # DCE this instruction.
1396  guard: true
1397  congruent_to: if_operands_equal
1398  alias_set: custom
1399  possibly_calls: true
1400
1401- name: MegamorphicStoreSlot
1402  operands:
1403    object: Object
1404    rhs: Value
1405  arguments:
1406    name: PropertyName*
1407  congruent_to: custom
1408  alias_set: custom
1409  possibly_calls: true
1410
1411- name: MegamorphicHasProp
1412  operands:
1413    object: Object
1414    idVal: Value
1415  arguments:
1416    hasOwn: bool
1417  result_type: Boolean
1418  # Bails when non-native or accessor properties are encountered, so we can't
1419  # DCE this instruction.
1420  guard: true
1421  congruent_to: custom
1422  alias_set: custom
1423  possibly_calls: true
1424
1425- name: GuardIsNotArrayBufferMaybeShared
1426  operands:
1427    object: Object
1428  result_type: Object
1429  guard: true
1430  movable: true
1431  congruent_to: if_operands_equal
1432  folds_to: custom
1433  alias_set: none
1434
1435- name: GuardIsTypedArray
1436  operands:
1437    object: Object
1438  result_type: Object
1439  guard: true
1440  movable: true
1441  congruent_to: if_operands_equal
1442  alias_set: none
1443
1444# Loads a specific JSObject* that was originally nursery-allocated.
1445# See also WarpObjectField.
1446- name: NurseryObject
1447  arguments:
1448    # Index in the Vector of objects stored in the WarpSnapshot.
1449    nurseryIndex: uint32_t
1450  result_type: Object
1451  movable: true
1452  congruent_to: custom
1453  alias_set: none
1454
1455- name: GuardValue
1456  gen_boilerplate: false
1457
1458- name: GuardNullOrUndefined
1459  operands:
1460    value: Value
1461  result_type: Value
1462  guard: true
1463  movable: true
1464  congruent_to: if_operands_equal
1465  folds_to: custom
1466  alias_set: none
1467
1468- name: GuardFunctionFlags
1469  gen_boilerplate: false
1470
1471- name: GuardFunctionIsNonBuiltinCtor
1472  operands:
1473    function: Object
1474  result_type: Object
1475  guard: true
1476  movable: true
1477  congruent_to: if_operands_equal
1478  alias_set: custom
1479
1480- name: GuardFunctionKind
1481  operands:
1482    function: Object
1483  arguments:
1484    expected: FunctionFlags::FunctionKind
1485    bailOnEquality: bool
1486  result_type: Object
1487  guard: true
1488  movable: true
1489  congruent_to: custom
1490  alias_set: custom
1491
1492- name: GuardFunctionScript
1493  operands:
1494    function: Object
1495  arguments:
1496    expected: BaseScript*
1497    nargs: uint16_t
1498    flags: FunctionFlags
1499  result_type: Object
1500  guard: true
1501  movable: true
1502  folds_to: custom
1503  congruent_to: custom
1504  # A JSFunction's BaseScript pointer is immutable. Relazification of
1505  # self-hosted functions is an exception to this, but we don't use this
1506  # guard for self-hosted functions.
1507  alias_set: custom
1508
1509- name: GuardObjectIdentity
1510  gen_boilerplate: false
1511
1512- name: GuardSpecificFunction
1513  gen_boilerplate: false
1514
1515- name: GuardSpecificAtom
1516  operands:
1517    str: String
1518  arguments:
1519    atom: JSAtom*
1520  result_type: String
1521  guard: true
1522  movable: true
1523  congruent_to: custom
1524  folds_to: custom
1525  alias_set: none
1526
1527- name: GuardSpecificSymbol
1528  gen_boilerplate: false
1529
1530- name: GuardStringToIndex
1531  operands:
1532    string: String
1533  result_type: Int32
1534  # Mark as guard because this instruction must not be eliminated. For
1535  # example, if the string is not an index the operation could change from a
1536  # typed array load to a getter call.
1537  guard: true
1538  movable: true
1539  congruent_to: if_operands_equal
1540  folds_to: custom
1541  alias_set: none
1542
1543- name: GuardStringToInt32
1544  operands:
1545    string: String
1546  result_type: Int32
1547  # Mark as guard to prevent the issue described in MGuardStringToIndex's
1548  # constructor.
1549  guard: true
1550  movable: true
1551  congruent_to: if_operands_equal
1552  folds_to: custom
1553  alias_set: none
1554
1555- name: GuardStringToDouble
1556  operands:
1557    string: String
1558  result_type: Double
1559  # Mark as guard to prevent the issue described in MGuardStringToIndex's
1560  # constructor.
1561  guard: true
1562  movable: true
1563  congruent_to: if_operands_equal
1564  folds_to: custom
1565  alias_set: none
1566
1567- name: GuardNoDenseElements
1568  operands:
1569    object: Object
1570  result_type: Object
1571  guard: true
1572  movable: true
1573  alias_set: custom
1574
1575- name: GuardTagNotEqual
1576  gen_boilerplate: false
1577
1578- name: LoadDynamicSlot
1579  gen_boilerplate: false
1580
1581# Inline call to access a function's environment (scope chain).
1582- name: FunctionEnvironment
1583  operands:
1584    function: Object
1585  result_type: Object
1586  movable: true
1587  folds_to: custom
1588  # A function's environment is fixed.
1589  alias_set: none
1590
1591- name: NewLexicalEnvironmentObject
1592  gen_boilerplate: false
1593
1594# Allocate a new ClassBodyEnvironmentObject.
1595- name: NewClassBodyEnvironmentObject
1596  operands:
1597    enclosing: Object
1598  arguments:
1599    scope: ClassBodyScope*
1600  result_type: Object
1601  possibly_calls: true
1602  alias_set: none
1603
1604# Allocate a new BlockLexicalEnvironmentObject from an existing one.
1605- name: CopyLexicalEnvironmentObject
1606  operands:
1607    env: Object
1608  arguments:
1609    copySlots: bool
1610  result_type: Object
1611  possibly_calls: true
1612  alias_set: custom
1613
1614- name: HomeObject
1615  operands:
1616    function: Object
1617  result_type: Object
1618  movable: true
1619  # A function's [[HomeObject]] is fixed.
1620  alias_set: none
1621
1622- name: AddAndStoreSlot
1623  gen_boilerplate: false
1624
1625- name: AllocateAndStoreSlot
1626  operands:
1627    object: Object
1628    value: Value
1629  arguments:
1630    slotOffset: uint32_t
1631    shape: Shape*
1632    numNewSlots: uint32_t
1633  possibly_calls: true
1634  alias_set: custom
1635
1636- name: StoreDynamicSlot
1637  gen_boilerplate: false
1638
1639- name: GetNameCache
1640  operands:
1641    envObj: Object
1642  result_type: Value
1643
1644- name: CallGetIntrinsicValue
1645  arguments:
1646    name: PropertyName*
1647  result_type: Value
1648  possibly_calls: true
1649  alias_set: none
1650
1651- name: DeleteProperty
1652  operands:
1653    value: Value
1654  arguments:
1655    name: PropertyName*
1656    strict: bool
1657  result_type: Boolean
1658
1659- name: DeleteElement
1660  operands:
1661    value: Value
1662    index: Value
1663  arguments:
1664    strict: bool
1665  result_type: Boolean
1666
1667- name: SetPropertyCache
1668  gen_boilerplate: false
1669
1670- name: CallSetElement
1671  gen_boilerplate: false
1672
1673- name: SetDOMProperty
1674  gen_boilerplate: false
1675
1676- name: GetDOMProperty
1677  gen_boilerplate: false
1678
1679- name: GetDOMMember
1680  gen_boilerplate: false
1681
1682# Load the private value expando from a DOM proxy. The target is stored in the
1683# proxy object's private slot.
1684# This is either an UndefinedValue (no expando), ObjectValue (the expando
1685# object), or PrivateValue(ExpandoAndGeneration*).
1686- name: LoadDOMExpandoValue
1687  operands:
1688    proxy: Object
1689  result_type: Value
1690  movable: true
1691  congruent_to: if_operands_equal
1692  alias_set: custom
1693
1694- name: LoadDOMExpandoValueGuardGeneration
1695  gen_boilerplate: false
1696
1697- name: LoadDOMExpandoValueIgnoreGeneration
1698  operands:
1699    proxy: Object
1700  result_type: Value
1701  movable: true
1702  congruent_to: if_operands_equal
1703  alias_set: custom
1704
1705# Takes an expando Value as input, then guards it's either UndefinedValue or
1706# an object with the expected shape.
1707- name: GuardDOMExpandoMissingOrGuardShape
1708  operands:
1709    expando: Value
1710  arguments:
1711    shape: Shape*
1712  result_type: Value
1713  guard: true
1714  movable: true
1715  congruent_to: custom
1716  alias_set: custom
1717
1718- name: StringLength
1719  operands:
1720    string: String
1721  result_type: Int32
1722  movable: true
1723  folds_to: custom
1724  congruent_to: if_operands_equal
1725  # The string |length| property is immutable, so there is no
1726  # implicit dependency.
1727  alias_set: none
1728  compute_range: custom
1729  can_recover: true
1730  clone: true
1731
1732- name: Floor
1733  gen_boilerplate: false
1734
1735- name: Ceil
1736  gen_boilerplate: false
1737
1738- name: Round
1739  gen_boilerplate: false
1740
1741- name: Trunc
1742  gen_boilerplate: false
1743
1744- name: NearbyInt
1745  gen_boilerplate: false
1746
1747- name: GetIteratorCache
1748  gen_boilerplate: false
1749
1750- name: OptimizeSpreadCallCache
1751  operands:
1752    value: Value
1753  result_type: Boolean
1754
1755- name: IteratorMore
1756  operands:
1757    iterator: Object
1758  result_type: Value
1759
1760- name: IsNoIter
1761  operands:
1762    def: Object
1763  result_type: Boolean
1764  type_policy: none
1765  movable : true
1766  alias_set: none
1767
1768- name: IteratorEnd
1769  operands:
1770    iterator: Object
1771
1772- name: InCache
1773  gen_boilerplate: false
1774
1775- name: InArray
1776  gen_boilerplate: false
1777
1778- name: GuardElementNotHole
1779  gen_boilerplate: false
1780
1781- name: CheckPrivateFieldCache
1782  gen_boilerplate: false
1783
1784- name: HasOwnCache
1785  gen_boilerplate: false
1786
1787- name: InstanceOf
1788  gen_boilerplate: false
1789
1790# Implementation for instanceof operator with unknown rhs.
1791- name: InstanceOfCache
1792  operands:
1793    obj: Value
1794    proto: Object
1795  result_type: Boolean
1796
1797- name: ArgumentsLength
1798  result_type: Int32
1799  movable: true
1800  congruent_to: if_operands_equal
1801  # Arguments |length| cannot be mutated by Ion Code.
1802  alias_set: none
1803  compute_range: custom
1804  can_recover: true
1805
1806# This MIR instruction is used to get an argument from the actual arguments.
1807- name: GetFrameArgument
1808  operands:
1809    index: Int32
1810  result_type: Value
1811  movable: true
1812  congruent_to: if_operands_equal
1813  # This instruction is never aliased, because ops like JSOp::SetArg don't
1814  # write to the argument frames. We create an arguments object in that case.
1815  alias_set: none
1816
1817- name: NewTarget
1818  result_type: Value
1819  movable: true
1820  congruent_to: if_operands_equal
1821  alias_set: none
1822
1823- name: Rest
1824  operands:
1825    numActuals: Int32
1826  arguments:
1827    numFormals: unsigned
1828    shape: Shape*
1829  result_type: Object
1830  possibly_calls: true
1831  alias_set: none
1832
1833- name: PostWriteBarrier
1834  gen_boilerplate: false
1835
1836- name: PostWriteElementBarrier
1837  gen_boilerplate: false
1838
1839- name: NewNamedLambdaObject
1840  arguments:
1841    templateObj: NamedLambdaObject*
1842  result_type: Object
1843  alias_set: none
1844
1845- name: NewCallObject
1846  gen_boilerplate: false
1847
1848- name: NewStringObject
1849  gen_boilerplate: false
1850
1851- name: IsCallable
1852  gen_boilerplate: false
1853
1854- name: IsConstructor
1855  operands:
1856    object: Object
1857  result_type: Boolean
1858  movable: true
1859  congruent_to: if_operands_equal
1860  alias_set: none
1861
1862- name: IsCrossRealmArrayConstructor
1863  operands:
1864    object: Object
1865  result_type: Boolean
1866  movable: true
1867  congruent_to: if_operands_equal
1868  alias_set: none
1869
1870- name: IsObject
1871  operands:
1872    object: Value
1873  result_type: Boolean
1874  movable: true
1875  folds_to: custom
1876  congruent_to: if_operands_equal
1877  alias_set: none
1878
1879- name: IsNullOrUndefined
1880  operands:
1881    value: Value
1882  result_type: Boolean
1883  movable: true
1884  folds_to: custom
1885  congruent_to: if_operands_equal
1886  alias_set: none
1887
1888- name: HasClass
1889  gen_boilerplate: false
1890
1891- name: GuardToClass
1892  gen_boilerplate: false
1893
1894- name: IsArray
1895  gen_boilerplate: false
1896
1897- name: IsTypedArray
1898  gen_boilerplate: false
1899
1900- name: ObjectClassToString
1901  operands:
1902    object: Object
1903  result_type: String
1904  guard: true
1905  movable: true
1906  congruent_to: if_operands_equal
1907  possibly_calls: true
1908  # Tests @@toStringTag is neither present on this object nor on any object
1909  # of the prototype chain.
1910  alias_set: custom
1911
1912- name: CheckReturn
1913  operands:
1914    returnValue: Value
1915    thisValue: Value
1916  result_type: Value
1917  guard: true
1918  alias_set: none
1919
1920- name: CheckThis
1921  operands:
1922    thisValue: Value
1923  result_type: Value
1924  guard: true
1925  folds_to: custom
1926  alias_set: none
1927
1928- name: AsyncResolve
1929  operands:
1930    generator: Object
1931    valueOrReason: Value
1932  arguments:
1933    resolveKind: AsyncFunctionResolveKind
1934  result_type: Object
1935
1936# Returns from this function to the previous caller; this looks like a regular
1937# Unary instruction and is used to lie to the MIR generator about suspending
1938# ops like Yield/Await, which are emitted like returns, but MIR-Build like
1939# regular instructions.
1940- name: GeneratorReturn
1941  operands:
1942    input: Value
1943  guard: true
1944  alias_set: none
1945
1946- name: AsyncAwait
1947  operands:
1948    value: Value
1949    generator: Object
1950  result_type: Object
1951
1952- name: CheckThisReinit
1953  operands:
1954    thisValue: Value
1955  result_type: Value
1956  guard: true
1957  folds_to: custom
1958  alias_set: none
1959
1960- name: Generator
1961  gen_boilerplate: false
1962
1963- name: CanSkipAwait
1964  operands:
1965    value: Value
1966  result_type: Boolean
1967
1968- name: MaybeExtractAwaitValue
1969  gen_boilerplate: false
1970
1971- name: IncrementWarmUpCounter
1972  arguments:
1973    script: JSScript*
1974  alias_set: none
1975
1976- name: AtomicIsLockFree
1977  gen_boilerplate: false
1978
1979- name: CompareExchangeTypedArrayElement
1980  gen_boilerplate: false
1981
1982- name: AtomicExchangeTypedArrayElement
1983  gen_boilerplate: false
1984
1985- name: AtomicTypedArrayElementBinop
1986  gen_boilerplate: false
1987
1988- name: Debugger
1989  gen_boilerplate: false
1990
1991- name: CheckIsObj
1992  operands:
1993    value: Value
1994  arguments:
1995    checkKind: uint8_t
1996  result_type: Object
1997  guard: true
1998  folds_to: custom
1999  alias_set: none
2000
2001- name: CheckObjCoercible
2002  operands:
2003    checkValue: Value
2004  result_type: Value
2005  guard: true
2006  folds_to: custom
2007  # Throws on null or undefined.
2008  alias_set: custom
2009
2010- name: CheckClassHeritage
2011  operands:
2012    heritage: Value
2013  result_type: Value
2014  guard: true
2015
2016- name: DebugCheckSelfHosted
2017  operands:
2018    checkValue: Value
2019  result_type: Value
2020  guard: true
2021
2022- name: FinishBoundFunctionInit
2023  operands:
2024    bound: Object
2025    target: Object
2026    argCount: Int32
2027
2028- name: IsPackedArray
2029  operands:
2030    object: Object
2031  result_type: Boolean
2032  movable: true
2033  alias_set: custom
2034
2035- name: GuardArrayIsPacked
2036  operands:
2037    array: Object
2038  result_type: Object
2039  guard: true
2040  movable: true
2041  congruent_to: if_operands_equal
2042  alias_set: custom
2043
2044- name: GetPrototypeOf
2045  operands:
2046    target: Object
2047  result_type: Value
2048  # May throw if target is a proxy.
2049  guard: true
2050
2051- name: ObjectWithProto
2052  operands:
2053    prototype: Value
2054  result_type: Object
2055  # May throw if prototype is neither an object nor null.
2056  guard: true
2057  possibly_calls: true
2058
2059- name: ObjectStaticProto
2060  gen_boilerplate: false
2061
2062- name: BuiltinObject
2063  arguments:
2064    builtinObjectKind: BuiltinObjectKind
2065  result_type: Object
2066  possibly_calls: true
2067
2068- name: SuperFunction
2069  operands:
2070    callee: Object
2071  result_type: Value
2072  alias_set: custom
2073
2074- name: InitHomeObject
2075  operands:
2076    function: Object
2077    homeObject: Value
2078  result_type: Object
2079  alias_set: custom
2080
2081# Return true if the object is definitely a TypedArray constructor, but not
2082# necessarily from the currently active realm. Return false if the object is
2083# not a TypedArray constructor or if it's a wrapper.
2084- name: IsTypedArrayConstructor
2085  operands:
2086    object: Object
2087  result_type: Boolean
2088  alias_set: none
2089
2090# Load the JSValueTag on all platforms except ARM64. See the comments in
2091# MacroAssembler-arm64.h for the |cmpTag(Register, ImmTag)| method for why
2092# ARM64 doesn't use the raw JSValueTag, but instead a modified tag value. That
2093# modified tag value can't be directly compared against JSValueTag constants.
2094- name: LoadValueTag
2095  operands:
2096    value: Value
2097  result_type: Int32
2098  movable: true
2099  congruent_to: if_operands_equal
2100  alias_set: none
2101
2102# Load the target object from a proxy wrapper. The target is stored in the
2103# proxy object's private slot.
2104- name: LoadWrapperTarget
2105  operands:
2106    object: Object
2107  result_type: Object
2108  movable: true
2109  congruent_to: if_operands_equal
2110  # Can't use |AliasSet::None| because the target changes on navigation.
2111  # TODO: Investigate using a narrower or a custom alias set.
2112  alias_set: custom
2113
2114# Guard the accessor shape is present on the object or its prototype chain.
2115- name: GuardHasGetterSetter
2116  operands:
2117    object: Object
2118  arguments:
2119    propId: jsid
2120    getterSetter: GetterSetter*
2121  result_type: Object
2122  guard: true
2123  movable: true
2124  possibly_calls: true
2125  congruent_to: custom
2126  alias_set: custom
2127
2128- name: GuardIsExtensible
2129  operands:
2130    object: Object
2131  result_type: Object
2132  guard: true
2133  movable: true
2134  congruent_to: if_operands_equal
2135  alias_set: custom
2136
2137- name: GuardInt32IsNonNegative
2138  operands:
2139    index: Int32
2140  result_type: Int32
2141  guard: true
2142  movable: true
2143  congruent_to: if_operands_equal
2144  folds_to: custom
2145  alias_set: none
2146
2147# Guard the input index is greater than the dense initialized length of an
2148# object.
2149- name: GuardIndexGreaterThanDenseInitLength
2150  operands:
2151    object: Object
2152    index: Int32
2153  result_type: Int32
2154  guard: true
2155  movable: true
2156  congruent_to: if_operands_equal
2157  alias_set: custom
2158
2159# Guard an array object's length can be updated successfully when adding an
2160# element at the input index.
2161- name: GuardIndexIsValidUpdateOrAdd
2162  operands:
2163    object: Object
2164    index: Int32
2165  result_type: Int32
2166  guard: true
2167  movable: true
2168  congruent_to: if_operands_equal
2169  alias_set: custom
2170
2171# Add or update a sparse element of an array object. It's allowed for the
2172# sparse element to be already present on the array. It may also be an accessor
2173# property, so this instruction is always marked as effectful.
2174- name: CallAddOrUpdateSparseElement
2175  operands:
2176    object: Object
2177    index: Int32
2178    value: Value
2179  arguments:
2180    strict: bool
2181  possibly_calls: true
2182
2183# Get a sparse element from an array object, possibly by calling an accessor
2184# property.
2185- name: CallGetSparseElement
2186  operands:
2187    object: Object
2188    index: Int32
2189  result_type: Value
2190  possibly_calls: true
2191
2192- name: CallNativeGetElement
2193  operands:
2194    object: Object
2195    index: Int32
2196  result_type: Value
2197  possibly_calls: true
2198
2199# Test if a native object has an own element (sparse or dense) at an index.
2200- name: CallObjectHasSparseElement
2201  operands:
2202    object: Object
2203    index: Int32
2204  result_type: Boolean
2205  guard: true
2206  congruent_to: if_operands_equal
2207  possibly_calls: true
2208  alias_set: custom
2209
2210- name: BigIntAsIntN
2211  operands:
2212    bits: Int32
2213    input: BigInt
2214  result_type: BigInt
2215  movable: true
2216  congruent_to: if_operands_equal
2217  possibly_calls: true
2218  alias_set: none
2219  can_recover: true
2220  clone: true
2221
2222- name: BigIntAsUintN
2223  operands:
2224    bits: Int32
2225    input: BigInt
2226  result_type: BigInt
2227  movable: true
2228  congruent_to: if_operands_equal
2229  possibly_calls: true
2230  alias_set: none
2231  can_recover: true
2232  clone: true
2233
2234- name: WasmNeg
2235  gen_boilerplate: false
2236
2237- name: WasmLoadTls
2238  gen_boilerplate: false
2239
2240- name: WasmHeapBase
2241  gen_boilerplate: false
2242
2243- name: WasmBoundsCheck
2244  gen_boilerplate: false
2245
2246- name: WasmExtendU32Index
2247  operands:
2248    input: Int32
2249  result_type: Int64
2250  movable: true
2251  congruent_to: if_operands_equal
2252  folds_to: custom
2253  type_policy: none
2254  alias_set: none
2255
2256- name: WasmWrapU32Index
2257  operands:
2258    input: Int64
2259  result_type: Int32
2260  movable: true
2261  congruent_to: if_operands_equal
2262  folds_to: custom
2263  type_policy: none
2264  alias_set: none
2265
2266- name: WasmAddOffset
2267  gen_boilerplate: false
2268
2269- name: WasmAlignmentCheck
2270  gen_boilerplate: false
2271
2272- name: WasmLoad
2273  gen_boilerplate: false
2274
2275- name: WasmStore
2276  gen_boilerplate: false
2277
2278- name: AsmJSLoadHeap
2279  gen_boilerplate: false
2280
2281- name: AsmJSStoreHeap
2282  gen_boilerplate: false
2283
2284- name: WasmFence
2285  guard: true
2286  alias_set: none
2287  clone: true
2288
2289- name: WasmCompareExchangeHeap
2290  gen_boilerplate: false
2291
2292- name: WasmAtomicExchangeHeap
2293  gen_boilerplate: false
2294
2295- name: WasmAtomicBinopHeap
2296  gen_boilerplate: false
2297
2298- name: WasmLoadGlobalVar
2299  gen_boilerplate: false
2300
2301- name: WasmLoadGlobalCell
2302  gen_boilerplate: false
2303
2304- name: WasmStoreGlobalVar
2305  gen_boilerplate: false
2306
2307- name: WasmStoreGlobalCell
2308  gen_boilerplate: false
2309
2310- name: WasmStoreStackResult
2311  gen_boilerplate: false
2312
2313- name: WasmDerivedPointer
2314  gen_boilerplate: false
2315
2316- name: WasmStoreRef
2317  gen_boilerplate: false
2318
2319- name: WasmParameter
2320  gen_boilerplate: false
2321
2322- name: WasmReturn
2323  gen_boilerplate: false
2324
2325- name: WasmReturnVoid
2326  gen_boilerplate: false
2327
2328- name: WasmStackArg
2329  gen_boilerplate: false
2330
2331- name: WasmRegisterResult
2332  gen_boilerplate: false
2333
2334- name: WasmFloatRegisterResult
2335  gen_boilerplate: false
2336
2337- name: WasmRegister64Result
2338  gen_boilerplate: false
2339
2340- name: WasmStackResultArea
2341  gen_boilerplate: false
2342
2343- name: WasmStackResult
2344  gen_boilerplate: false
2345
2346- name: WasmCall
2347  gen_boilerplate: false
2348
2349- name: WasmSelect
2350  gen_boilerplate: false
2351
2352- name: WasmReinterpret
2353  gen_boilerplate: false
2354
2355- name: Rotate
2356  gen_boilerplate: false
2357
2358- name: WasmBitselectSimd128
2359  gen_boilerplate: false
2360
2361- name: WasmBinarySimd128
2362  gen_boilerplate: false
2363
2364- name: WasmBinarySimd128WithConstant
2365  gen_boilerplate: false
2366
2367# (v128, i32) -> v128 effect-free shift operations.
2368- name: WasmShiftSimd128
2369  operands:
2370    lhs: Simd128
2371    rhs: Int32
2372  arguments:
2373    simdOp: wasm::SimdOp
2374  type_policy: none
2375  result_type: Simd128
2376  movable: true
2377  congruent_to: custom
2378  alias_set: none
2379  clone: true
2380
2381# (v128, v128, mask) -> v128 effect-free operation.
2382- name: WasmShuffleSimd128
2383  operands:
2384    lhs: Simd128
2385    rhs: Simd128
2386  arguments:
2387    control: SimdConstant
2388  type_policy: none
2389  result_type: Simd128
2390  movable: true
2391  congruent_to: custom
2392  alias_set: none
2393  clone: true
2394
2395- name: WasmReplaceLaneSimd128
2396  gen_boilerplate: false
2397
2398- name: WasmUnarySimd128
2399  operands:
2400    src: Simd128
2401  arguments:
2402    simdOp: wasm::SimdOp
2403  type_policy: none
2404  result_type: Simd128
2405  movable: true
2406  congruent_to: custom
2407  alias_set: none
2408  clone: true
2409
2410- name: WasmScalarToSimd128
2411  gen_boilerplate: false
2412
2413- name: WasmReduceSimd128
2414  gen_boilerplate: false
2415
2416- name: WasmLoadLaneSimd128
2417  gen_boilerplate: false
2418
2419- name: WasmStoreLaneSimd128
2420  gen_boilerplate: false
2421
2422- name: UnreachableResult
2423  gen_boilerplate: false
2424
2425- name: IonToWasmCall
2426  gen_boilerplate: false
2427