/*

* Copyright (C) 2008-2022 Apple Inc. All rights reserved.

*

* Redistribution and use in source and binary forms, with or without

* modification, are permitted provided that the following conditions

* are met:

* 1. Redistributions of source code must retain the above copyright

* notice, this list of conditions and the following disclaimer.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in the

* documentation and/or other materials provided with the distribution.

*

* THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

* EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR

* CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

* EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

* PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

* OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

*/

#include "config.h"

#if ENABLE(JIT)

#include "JIT.h"

#include "BaselineJITRegisters.h"

#include "CacheableIdentifierInlines.h"

#include "CodeBlock.h"

#include "DirectArguments.h"

#include "JITInlines.h"

#include "JITThunks.h"

#include "JSLexicalEnvironment.h"

#include "LinkBuffer.h"

#include "PrivateFieldPutKind.h"

#include "ProbeContext.h"

#include "PropertyInlineCache.h"

#include "SlowPathCall.h"

#include "ThunkGenerators.h"

#include <wtf/ScopedLambda.h>

#include <wtf/StringPrintStream.h>

namespace JSC {

void JIT::emit_op_get_by_val(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpGetByVal>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::GetByVal::baseJSR;

using BaselineJITRegisters::GetByVal::propertyJSR;

using BaselineJITRegisters::GetByVal::resultJSR;

using BaselineJITRegisters::GetByVal::propertyCacheGPR;

using BaselineJITRegisters::GetByVal::profileGPR;

using BaselineJITRegisters::GetByVal::scratch1GPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

materializePointerIntoMetadata(bytecode, OpGetByVal::Metadata::offsetOfArrayProfile(), profileGPR);

JITGetByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::GetByVal, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, profileGPR, propertyCacheGPR);

if (isOperandConstantInt(property))

propertyCache->propertyIsInt32 = true;

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitArrayProfilingSiteWithCellAndProfile(baseJSR.payloadGPR(), profileGPR, scratch1GPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_getByVals.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(dst, resultJSR);

}

template<typename OpcodeType>

void JIT::generateGetByValSlowCase(const OpcodeType&, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(hasAnySlowCases(iter));

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByValGenerator& gen = m_getByVals[m_getByValIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emitSlow_op_get_by_val(const JSInstruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

generateGetByValSlowCase(currentInstruction->as<OpGetByVal>(), iter);

}

void JIT::emit_op_get_private_name(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpGetPrivateName>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::GetByVal::baseJSR;

using BaselineJITRegisters::GetByVal::propertyJSR;

using BaselineJITRegisters::GetByVal::resultJSR;

using BaselineJITRegisters::GetByVal::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITGetByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::GetPrivateName,

RegisterSet::stubUnavailableRegisters(), baseJSR, propertyJSR, resultJSR, InvalidGPRReg, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_getByVals.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(dst, resultJSR);

}

void JIT::emitSlow_op_get_private_name(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(hasAnySlowCases(iter));

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByValGenerator& gen = m_getByVals[m_getByValIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_set_private_brand(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpSetPrivateBrand>();

VirtualRegister base = bytecode.m_base;

VirtualRegister brand = bytecode.m_brand;

using BaselineJITRegisters::PrivateBrand::baseJSR;

using BaselineJITRegisters::PrivateBrand::propertyJSR;

using BaselineJITRegisters::PrivateBrand::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(brand, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITPrivateBrandAccessGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::SetPrivateBrand, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_privateBrandAccesses.append(gen);

// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

}

void JIT::emitSlow_op_set_private_brand(const JSInstruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

UNUSED_PARAM(currentInstruction);

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPrivateBrandAccessGenerator& gen = m_privateBrandAccesses[m_privateBrandAccessIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_check_private_brand(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpCheckPrivateBrand>();

VirtualRegister base = bytecode.m_base;

VirtualRegister brand = bytecode.m_brand;

using BaselineJITRegisters::PrivateBrand::baseJSR;

using BaselineJITRegisters::PrivateBrand::propertyJSR;

using BaselineJITRegisters::PrivateBrand::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(brand, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITPrivateBrandAccessGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::CheckPrivateBrand, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_privateBrandAccesses.append(gen);

}

void JIT::emitSlow_op_check_private_brand(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPrivateBrandAccessGenerator& gen = m_privateBrandAccesses[m_privateBrandAccessIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

template<typename Op>

void JIT::emit_op_put_by_val(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<Op>();

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

VirtualRegister value = bytecode.m_value;

using BaselineJITRegisters::PutByVal::baseJSR;

using BaselineJITRegisters::PutByVal::propertyJSR;

using BaselineJITRegisters::PutByVal::valueJSR;

using BaselineJITRegisters::PutByVal::profileGPR; // Keep in mind that this can be a metadataTable register in ARMv7.

using BaselineJITRegisters::PutByVal::propertyCacheGPR;

using BaselineJITRegisters::PutByVal::scratch1GPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

emitGetVirtualRegister(value, valueJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

materializePointerIntoMetadata(bytecode, Op::Metadata::offsetOfArrayProfile(), profileGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitArrayProfilingSiteWithCellAndProfile(baseJSR.payloadGPR(), profileGPR, scratch1GPR);

ECMAMode ecmaMode = this->ecmaMode(bytecode);

bool isDirect = std::is_same_v<Op, OpPutByValDirect>;

JITPutByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex),

isDirect ? (ecmaMode.isStrict() ? AccessType::PutByValDirectStrict : AccessType::PutByValDirectSloppy) : (ecmaMode.isStrict() ? AccessType::PutByValStrict : AccessType::PutByValSloppy),

RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, valueJSR, profileGPR, propertyCacheGPR);

if (isOperandConstantInt(property))

propertyCache->propertyIsInt32 = true;

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

#if CPU(ARM_THUMB2)

// ARMv7 clobbers metadataTable register. Thus we need to restore them back here.

emitMaterializeMetadataAndConstantPoolRegisters();

#endif

addSlowCase();

m_putByVals.append(gen);

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

setFastPathResumePoint();

}

template void JIT::emit_op_put_by_val<OpPutByVal>(const JSInstruction*);

void JIT::emit_op_put_by_val_direct(const JSInstruction* currentInstruction)

{

emit_op_put_by_val<OpPutByValDirect>(currentInstruction);

}

template<typename OpcodeType>

void JIT::generatePutByValSlowCase(const OpcodeType&, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(hasAnySlowCases(iter));

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPutByValGenerator& gen = m_putByVals[m_putByValIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emitSlow_op_put_by_val(const JSInstruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

generatePutByValSlowCase(currentInstruction->as<OpPutByVal>(), iter);

}

void JIT::emitSlow_op_put_by_val_direct(const JSInstruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

generatePutByValSlowCase(currentInstruction->as<OpPutByValDirect>(), iter);

}

void JIT::emit_op_put_private_name(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpPutPrivateName>();

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

VirtualRegister value = bytecode.m_value;

using BaselineJITRegisters::PutByVal::baseJSR;

using BaselineJITRegisters::PutByVal::propertyJSR;

using BaselineJITRegisters::PutByVal::valueJSR;

using BaselineJITRegisters::PutByVal::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

emitGetVirtualRegister(value, valueJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITPutByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), bytecode.m_putKind.isDefine() ? AccessType::DefinePrivateNameByVal : AccessType::SetPrivateNameByVal, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, valueJSR, InvalidGPRReg, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_putByVals.append(gen);

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

}

void JIT::emitSlow_op_put_private_name(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPutByValGenerator& gen = m_putByVals[m_putByValIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_put_getter_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpPutGetterById>();

emitGetVirtualRegisterPayload(bytecode.m_base, regT0);

int32_t options = bytecode.m_attributes;

emitGetVirtualRegisterPayload(bytecode.m_accessor, regT1);

loadGlobalObject(regT2);

callOperation(operationPutGetterById, regT2, regT0, TrustedImmPtr(m_unlinkedCodeBlock->identifier(bytecode.m_property).impl()), options, regT1);

}

void JIT::emit_op_put_setter_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpPutSetterById>();

emitGetVirtualRegisterPayload(bytecode.m_base, regT0);

int32_t options = bytecode.m_attributes;

emitGetVirtualRegisterPayload(bytecode.m_accessor, regT1);

loadGlobalObject(regT2);

callOperation(operationPutSetterById, regT2, regT0, TrustedImmPtr(m_unlinkedCodeBlock->identifier(bytecode.m_property).impl()), options, regT1);

}

void JIT::emit_op_put_getter_setter_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpPutGetterSetterById>();

emitGetVirtualRegisterPayload(bytecode.m_base, regT0);

int32_t attribute = bytecode.m_attributes;

emitGetVirtualRegisterPayload(bytecode.m_getter, regT1);

emitGetVirtualRegisterPayload(bytecode.m_setter, regT2);

loadGlobalObject(regT3);

callOperation(operationPutGetterSetter, regT3, regT0, TrustedImmPtr(m_unlinkedCodeBlock->identifier(bytecode.m_property).impl()), attribute, regT1, regT2);

}

void JIT::emit_op_put_getter_by_val(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpPutGetterByVal>();

using SlowOperation = decltype(operationPutGetterByVal);

constexpr GPRReg globalObjectGPR = preferredArgumentGPR<SlowOperation, 0>();

constexpr GPRReg baseGPR = preferredArgumentGPR<SlowOperation, 1>();

constexpr JSValueRegs propertyJSR = preferredArgumentJSR<SlowOperation, 2>();

// Attributes in argument 3

constexpr GPRReg setterGPR = preferredArgumentGPR<SlowOperation, 4>();

emitGetVirtualRegisterPayload(bytecode.m_base, baseGPR);

emitGetVirtualRegister(bytecode.m_property, propertyJSR);

int32_t attributes = bytecode.m_attributes;

emitGetVirtualRegisterPayload(bytecode.m_accessor, setterGPR);

loadGlobalObject(globalObjectGPR);

callOperation(operationPutGetterByVal, globalObjectGPR, baseGPR, propertyJSR, attributes, setterGPR);

}

void JIT::emit_op_put_setter_by_val(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpPutSetterByVal>();

using SlowOperation = decltype(operationPutSetterByVal);

constexpr GPRReg globalObjectGPR = preferredArgumentGPR<SlowOperation, 0>();

constexpr GPRReg baseGPR = preferredArgumentGPR<SlowOperation, 1>();

constexpr JSValueRegs propertyJSR = preferredArgumentJSR<SlowOperation, 2>();

// Attributes in argument 3

constexpr GPRReg setterGPR = preferredArgumentGPR<SlowOperation, 4>();

emitGetVirtualRegisterPayload(bytecode.m_base, baseGPR);

emitGetVirtualRegister(bytecode.m_property, propertyJSR);

int32_t attributes = bytecode.m_attributes;

emitGetVirtualRegisterPayload(bytecode.m_accessor, setterGPR);

loadGlobalObject(globalObjectGPR);

callOperation(operationPutSetterByVal, globalObjectGPR, baseGPR, propertyJSR, attributes, setterGPR);

}

void JIT::emit_op_del_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpDelById>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

ECMAMode ecmaMode = bytecode.m_ecmaMode;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::DelById::baseJSR;

using BaselineJITRegisters::DelById::resultJSR;

using BaselineJITRegisters::DelById::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITDelByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), ecmaMode.isStrict() ? AccessType::DeleteByIdStrict : AccessType::DeleteByIdSloppy, RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident),

baseJSR, resultJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_delByIds.append(gen);

setFastPathResumePoint();

boxBoolean(resultJSR.payloadGPR(), resultJSR);

emitPutVirtualRegister(dst, resultJSR);

// IC can write new Structure without write-barrier if a base is cell.

// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

}

void JIT::emitSlow_op_del_by_id(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITDelByIdGenerator& gen = m_delByIds[m_delByIdIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_del_by_val(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpDelByVal>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::DelByVal::baseJSR;

using BaselineJITRegisters::DelByVal::propertyJSR;

using BaselineJITRegisters::DelByVal::resultJSR;

using BaselineJITRegisters::DelByVal::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitJumpSlowCaseIfNotJSCell(propertyJSR, property);

JITDelByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex),

bytecode.m_ecmaMode.isStrict() ? AccessType::DeleteByValStrict : AccessType::DeleteByValSloppy,

RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_delByVals.append(gen);

setFastPathResumePoint();

boxBoolean(resultJSR.payloadGPR(), resultJSR);

emitPutVirtualRegister(dst, resultJSR);

// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

}

void JIT::emitSlow_op_del_by_val(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITDelByValGenerator& gen = m_delByVals[m_delByValIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_try_get_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpTryGetById>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::GetById::baseJSR;

using BaselineJITRegisters::GetById::resultJSR;

using BaselineJITRegisters::GetById::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITGetByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), baseJSR, resultJSR, propertyCacheGPR, AccessType::TryGetById, CacheType::GetByIdPrototype);

gen.generateDataICFastPath(*this);

addSlowCase();

m_getByIds.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

}

void JIT::emitSlow_op_try_get_by_id(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_get_by_id_direct(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpGetByIdDirect>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::GetById::baseJSR;

using BaselineJITRegisters::GetById::resultJSR;

using BaselineJITRegisters::GetById::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITGetByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), baseJSR, resultJSR, propertyCacheGPR, AccessType::GetByIdDirect, CacheType::GetByIdSelf);

gen.generateDataICFastPath(*this);

addSlowCase();

m_getByIds.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

}

void JIT::emitSlow_op_get_by_id_direct(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_get_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpGetById>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

GetByIdModeMetadata modeMetadata = bytecode.metadata(m_profiledCodeBlock).m_modeMetadata;

CacheType cacheType = CacheType::GetByIdSelf;

if (modeMetadata.mode == GetByIdMode::ProtoLoad)

cacheType = CacheType::GetByIdPrototype;

using BaselineJITRegisters::GetById::baseJSR;

using BaselineJITRegisters::GetById::resultJSR;

using BaselineJITRegisters::GetById::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITGetByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), baseJSR, resultJSR, propertyCacheGPR, AccessType::GetById, cacheType);

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_getByIds.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

}

void JIT::emit_op_get_length(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpGetLength>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &vm().propertyNames->length;

using BaselineJITRegisters::GetById::baseJSR;

using BaselineJITRegisters::GetById::resultJSR;

using BaselineJITRegisters::GetById::propertyCacheGPR;

using BaselineJITRegisters::GetById::scratch1GPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

if (shouldEmitProfiling())

emitArrayProfilingSiteWithCell(bytecode, baseJSR.payloadGPR(), scratch1GPR);

JITGetByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromImmortalIdentifier(ident->impl()), baseJSR, resultJSR, propertyCacheGPR, AccessType::GetById, CacheType::ArrayLength);

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_getByIds.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

}

void JIT::emitSlow_op_get_by_id(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emitSlow_op_get_length(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_get_by_id_with_this(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpGetByIdWithThis>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

VirtualRegister thisVReg = bytecode.m_thisValue;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::GetByIdWithThis::baseJSR;

using BaselineJITRegisters::GetByIdWithThis::thisJSR;

using BaselineJITRegisters::GetByIdWithThis::resultJSR;

using BaselineJITRegisters::GetByIdWithThis::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

emitGetVirtualRegister(thisVReg, thisJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

emitJumpSlowCaseIfNotJSCell(thisJSR, thisVReg);

JITGetByIdWithThisGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), resultJSR, baseJSR, thisJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_getByIdsWithThis.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

}

void JIT::emitSlow_op_get_by_id_with_this(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdWithThisGenerator& gen = m_getByIdsWithThis[m_getByIdWithThisIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_put_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpPutById>();

VirtualRegister baseVReg = bytecode.m_base;

VirtualRegister valueVReg = bytecode.m_value;

bool direct = bytecode.m_flags.isDirect();

ECMAMode ecmaMode = this->ecmaMode(bytecode);

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

// In order to be able to patch both the Structure, and the object offset, we store one pointer,

// to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code

// such that the Structure & offset are always at the same distance from this.

using BaselineJITRegisters::PutById::baseJSR;

using BaselineJITRegisters::PutById::valueJSR;

using BaselineJITRegisters::PutById::propertyCacheGPR;

using BaselineJITRegisters::PutById::scratch1GPR;

emitGetVirtualRegister(baseVReg, baseJSR);

emitGetVirtualRegister(valueVReg, valueJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITPutByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident),

baseJSR, valueJSR, propertyCacheGPR, scratch1GPR, direct ? (ecmaMode.isStrict() ? AccessType::PutByIdDirectStrict : AccessType::PutByIdDirectSloppy) : (ecmaMode.isStrict() ? AccessType::PutByIdStrict : AccessType::PutByIdSloppy));

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_putByIds.append(gen);

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(baseVReg, ShouldFilterBase);

}

void JIT::emitSlow_op_put_by_id(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPutByIdGenerator& gen = m_putByIds[m_putByIdIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_in_by_id(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpInById>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::InById::baseJSR;

using BaselineJITRegisters::InById::resultJSR;

using BaselineJITRegisters::InById::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITInByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), baseJSR, resultJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_inByIds.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitPutVirtualRegister(resultVReg, resultJSR);

}

void JIT::emitSlow_op_in_by_id(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITInByIdGenerator& gen = m_inByIds[m_inByIdIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_in_by_val(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpInByVal>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::InByVal::baseJSR;

using BaselineJITRegisters::InByVal::propertyJSR;

using BaselineJITRegisters::InByVal::resultJSR;

using BaselineJITRegisters::InByVal::propertyCacheGPR;

using BaselineJITRegisters::InByVal::profileGPR;

using BaselineJITRegisters::InByVal::scratch1GPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

materializePointerIntoMetadata(bytecode, OpInByVal::Metadata::offsetOfArrayProfile(), profileGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitArrayProfilingSiteWithCellAndProfile(baseJSR.payloadGPR(), profileGPR, scratch1GPR);

JITInByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::InByVal, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, profileGPR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_inByVals.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitPutVirtualRegister(dst, resultJSR);

}

void JIT::emitSlow_op_in_by_val(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITInByValGenerator& gen = m_inByVals[m_inByValIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emitHasPrivate(VirtualRegister dst, VirtualRegister base, VirtualRegister propertyOrBrand, AccessType type)

{

using BaselineJITRegisters::InByVal::baseJSR;

using BaselineJITRegisters::InByVal::propertyJSR;

using BaselineJITRegisters::InByVal::resultJSR;

using BaselineJITRegisters::InByVal::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(propertyOrBrand, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITInByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), type, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, InvalidGPRReg, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_inByVals.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitPutVirtualRegister(dst, resultJSR);

}

void JIT::emitHasPrivateSlow(AccessType type, Vector<SlowCaseEntry>::iterator& iter)

{

ASSERT_UNUSED(type, type == AccessType::HasPrivateName || type == AccessType::HasPrivateBrand);

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITInByValGenerator& gen = m_inByVals[m_inByValIndex++];

linkAllSlowCases(iter);

gen.reportBaselineDataICSlowPathBegin(label());

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

}

void JIT::emit_op_has_private_name(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpHasPrivateName>();

emitHasPrivate(bytecode.m_dst, bytecode.m_base, bytecode.m_property, AccessType::HasPrivateName);

}

void JIT::emitSlow_op_has_private_name(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

emitHasPrivateSlow(AccessType::HasPrivateName, iter);

}

void JIT::emit_op_has_private_brand(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpHasPrivateBrand>();

emitHasPrivate(bytecode.m_dst, bytecode.m_base, bytecode.m_brand, AccessType::HasPrivateBrand);

}

void JIT::emitSlow_op_has_private_brand(const JSInstruction*, Vector<SlowCaseEntry>::iterator& iter)

{

emitHasPrivateSlow(AccessType::HasPrivateBrand, iter);

}

void JIT::emit_op_resolve_scope(const JSInstruction* currentInstruction)

{

auto bytecode = currentInstruction->as<OpResolveScope>();

ResolveType profiledResolveType = bytecode.metadata(m_profiledCodeBlock).m_resolveType;

VirtualRegister dst = bytecode.m_dst;

VirtualRegister scope = bytecode.m_scope;

uint32_t bytecodeOffset = m_bytecodeIndex.offset();

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

ASSERT(m_unlinkedCodeBlock->instructionAt(m_bytecodeIndex) == currentInstruction);

using BaselineJITRegisters::ResolveScope::scopeGPR;

using BaselineJITRegisters::ResolveScope::bytecodeOffsetGPR;

using BaselineJITRegisters::ResolveScope::scratch1GPR;

using BaselineJITRegisters::ResolveScope::metadataGPR;

using Metadata = OpResolveScope::Metadata;

// If we profile certain resolve types, we're guaranteed all linked code will have the same

// resolve type.

if (profiledResolveType == ModuleVar)

loadPtrFromMetadata(bytecode, Metadata::offsetOfLexicalEnvironment(), returnValueGPR);

else if (profiledResolveType == ClosureVar) {

emitGetVirtualRegisterPayload(scope, scopeGPR);

static_assert(scopeGPR == returnValueGPR);

unsigned localScopeDepth = bytecode.metadata(m_profiledCodeBlock).m_localScopeDepth;

if (localScopeDepth < 8) {

for (unsigned index = 0; index < localScopeDepth; ++index)

loadPtr(Address(returnValueGPR, JSScope::offsetOfNext()), returnValueGPR);

} else {

ASSERT(localScopeDepth >= 8);

load32FromMetadata(bytecode, Metadata::offsetOfLocalScopeDepth(), scratch1GPR);

auto loop = label();

loadPtr(Address(returnValueGPR, JSScope::offsetOfNext()), returnValueGPR);

branchSub32(NonZero, scratch1GPR, TrustedImm32(1), scratch1GPR).linkTo(loop, this);

}

} else {

// Inlined fast path for common types.

constexpr size_t metadataMinAlignment = 4;

static_assert(!(Metadata::offsetOfResolveType() % metadataMinAlignment));

static_assert(!(Metadata::offsetOfGlobalLexicalBindingEpoch() % metadataMinAlignment));

auto metadataAddress = computeBaseAddressForMetadata<4>(bytecode, metadataGPR);

auto resolveTypeAddress = metadataAddress.withOffset(Metadata::offsetOfResolveType());

auto globalLexicalBindingEpochAddress = metadataAddress.withOffset(Metadata::offsetOfGlobalLexicalBindingEpoch());

// FIXME: This code is weird when caching fails because it goes to a slow path that will check the exact same condition before falling into the C++ slow path.

// It's unclear if that makes a meaningful difference for perf but we should consider doing something smarter.

switch (profiledResolveType) {

case GlobalProperty: {

addSlowCase(branch32(NotEqual, resolveTypeAddress, TrustedImm32(profiledResolveType)));

loadGlobalObject(returnValueGPR);

load32(globalLexicalBindingEpochAddress, scratch1GPR);

addSlowCase(branch32(NotEqual, Address(returnValueGPR, JSGlobalObject::offsetOfGlobalLexicalBindingEpoch()), scratch1GPR));

break;

}

case GlobalVar: {

addSlowCase(branch32(NotEqual, resolveTypeAddress, TrustedImm32(profiledResolveType)));

loadGlobalObject(returnValueGPR);

break;

}

case GlobalLexicalVar: {

addSlowCase(branch32(NotEqual, resolveTypeAddress, TrustedImm32(profiledResolveType)));

loadGlobalObject(returnValueGPR);

loadPtr(Address(returnValueGPR, JSGlobalObject::offsetOfGlobalLexicalEnvironment()), returnValueGPR);

break;

}

default: {

if (metadataAddress.base != metadataGPR) {

// Materialize metadataGPR for the thunks if we didn't already.

uint32_t metadataOffset = m_profiledCodeBlock->metadataTable()->offsetInMetadataTable(bytecode);