| blob | c2a339881fe5788773f5b15332630dc3b8b4f325 |
1 /* -*- Mode: C; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
2 * vim: set ts=8 sw=2 et tw=0 ft=c:
3 *
4 * This Source Code Form is subject to the terms of the Mozilla Public
5 * License, v. 2.0. If a copy of the MPL was not distributed with this
6 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
8 #ifndef vm_Opcodes_h
9 #define vm_Opcodes_h
11 #include <stddef.h>
12 #include <stdint.h>
16 // clang-format off
17 /*
18 * [SMDOC] Bytecode Definitions
19 *
20 * SpiderMonkey bytecode instructions.
21 *
22 * To use this header, define a macro of the form:
23 *
24 * #define MACRO(op, op_snake, token, length, nuses, ndefs, format) ...
25 *
26 * Then `FOR_EACH_OPCODE(MACRO)` invokes `MACRO` for every opcode.
27 *
28 * Field Description
29 * ----- -----------
30 * op UpperCamelCase form of opcode id
31 * op_snake snake_case form of opcode id
32 * token Pretty-printer string, or null if ugly
33 * length Number of bytes including any immediate operands
34 * nuses Number of stack slots consumed by bytecode, -1 if variadic
35 * ndefs Number of stack slots produced by bytecode
36 * format JOF_ flags describing instruction operand layout, etc.
37 *
38 * For more about `format`, see the comments on the `JOF_` constants defined in
39 * BytecodeUtil.h.
40 *
41 *
42 * [SMDOC] Bytecode Invariants
43 *
44 * Creating scripts that do not follow the rules can lead to undefined
45 * behavior. Bytecode has many consumers, not just the interpreter: JITs,
46 * analyses, the debugger. That's why the rules below apply even to code that
47 * can't be reached in ordinary execution (such as code after an infinite loop
48 * or inside an `if (false)` block).
49 *
50 * The `code()` of a script must be a packed (not aligned) sequence of valid
51 * instructions from start to end. Each instruction has a single byte opcode
52 * followed by a number of operand bytes based on the opcode.
53 *
54 * ## Jump instructions
55 *
56 * Operands named `offset`, `forwardOffset`, or `defaultOffset` are jump
57 * offsets, the distance in bytes from the start of the current instruction to
58 * the start of another instruction in the same script. Operands named
59 * `forwardOffset` or `defaultOffset` must be positive.
60 *
61 * Forward jumps must jump to a `JSOp::JumpTarget` instruction. Backward jumps,
62 * indicated by negative offsets, must jump to a `JSOp::LoopHead` instruction.
63 * Jump offsets can't be zero.
64 *
65 * Needless to say, scripts must not contain overlapping instruction sequences
66 * (in the sense of <https://en.wikipedia.org/wiki/Overlapping_gene>).
67 *
68 * A script's `trynotes` and `scopeNotes` impose further constraints. Each try
69 * note and each scope note marks a region of the bytecode where some invariant
70 * holds, or some cleanup behavior is needed--that there's a for-in iterator in
71 * a particular stack slot, for instance, which must be closed on error. All
72 * paths into the span must establish that invariant. In practice, this means
73 * other code never jumps into the span: the only way in is to execute the
74 * bytecode instruction that sets up the invariant (in our example,
75 * `JSOp::Iter`).
76 *
77 * If a script's `trynotes` (see "Try Notes" in JSScript.h) contain a
78 * `JSTRY_CATCH` or `JSTRY_FINALLY` span, there must be a `JSOp::Try`
79 * instruction immediately before the span and a `JSOp::JumpTarget immediately
80 * after it. Instructions must not jump to this `JSOp::JumpTarget`. (The VM puts
81 * us there on exception.) Furthermore, the instruction sequence immediately
82 * following a `JSTRY_CATCH` span must read `JumpTarget; Exception` or, in
83 * non-function scripts, `JumpTarget; Undefined; SetRval; Exception`. (These
84 * instructions run with an exception pending; other instructions aren't
85 * designed to handle that.)
86 *
87 * Unreachable instructions are allowed, but they have to follow all the rules.
88 *
89 * Control must not reach the end of a script. (Currently, the last instruction
90 * is always JSOp::RetRval.)
91 *
92 * ## Other operands
93 *
94 * Operands named `nameIndex` or `atomIndex` (which appear on instructions that
95 * have `JOF_ATOM` in the `format` field) must be valid indexes into
96 * `script->atoms()`.
97 *
98 * Operands named `argc` (`JOF_ARGC`) are argument counts for call
99 * instructions. `argc` must be small enough that the instruction's nuses is <=
100 * the current stack depth (see "Stack depth" below).
101 *
102 * Operands named `argno` (`JOF_QARG`) refer to an argument of the current
103 * function. `argno` must be in the range `0..script->function()->nargs()`.
104 * Instructions with these operands must appear only in function scripts.
105 *
106 * Operands named `localno` (`JOF_LOCAL`) refer to a local variable stored in
107 * the stack frame. `localno` must be in the range `0..script->nfixed()`.
108 *
109 * Operands named `resumeIndex` (`JOF_RESUMEINDEX`) refer to a resume point in
110 * the current script. `resumeIndex` must be a valid index into
111 * `script->resumeOffsets()`.
112 *
113 * Operands named `hops` and `slot` (`JOF_ENVCOORD`) refer a slot in an
114 * `EnvironmentObject`. At run time, they must point to a fixed slot in an
115 * object on the current environment chain. See `EnvironmentCoordinates`.
116 *
117 * Operands with the following names must be valid indexes into
118 * `script->gcthings()`, and the pointer in the vector must point to the right
119 * type of thing:
120 *
121 * - `objectIndex` (`JOF_OBJECT`): `PlainObject*` or `ArrayObject*`
122 * - `baseobjIndex` (`JOF_OBJECT`): `PlainObject*`
123 * - `funcIndex` (`JOF_OBJECT`): `JSFunction*`
124 * - `regexpIndex` (`JOF_REGEXP`): `RegExpObject*`
125 * - `shapeIndex` (`JOF_SHAPE`): `Shape*`
126 * - `scopeIndex` (`JOF_SCOPE`): `Scope*`
127 * - `lexicalScopeIndex` (`JOF_SCOPE`): `LexicalScope*`
128 * - `classBodyScopeIndex` (`JOF_SCOPE`): `ClassBodyScope*`
129 * - `withScopeIndex` (`JOF_SCOPE`): `WithScope*`
130 * - `bigIntIndex` (`JOF_BIGINT`): `BigInt*`
131 *
132 * Operands named `icIndex` (`JOF_ICINDEX`) must be exactly the number of
133 * preceding instructions in the script that have the JOF_IC flag.
134 * (Rationale: Each JOF_IC instruction has a unique entry in
135 * `script->jitScript()->icEntries()`. At run time, in the bytecode
136 * interpreter, we have to find that entry. We could store the IC index as an
137 * operand to each JOF_IC instruction, but it's more memory-efficient to use a
138 * counter and reset the counter to `icIndex` after each jump.)
139 *
140 * ## Stack depth
141 *
142 * Each instruction has a compile-time stack depth, the number of values on the
143 * interpreter stack just before executing the instruction. It isn't explicitly
144 * present in the bytecode itself, but (for reachable instructions, anyway)
145 * it's a function of the bytecode.
146 *
147 * - The first instruction has stack depth 0.
148 *
149 * - Each successor of an instruction X has a stack depth equal to
150 *
151 * X's stack depth - `js::StackUses(X)` + `js::StackDefs(X)`
152 *
153 * except for `JSOp::Case` (below).
154 *
155 * X's "successors" are: the next instruction in the script, if
156 * `js::FlowsIntoNext(op)` is true for X's opcode; one or more
157 * `JSOp::JumpTarget`s elsewhere, if X is a forward jump or
158 * `JSOp::TableSwitch`; and/or a `JSOp::LoopHead` if it's a backward jump.
159 *
160 * - `JSOp::Case` is a special case because its stack behavior is eccentric.
161 * The formula above is correct for the next instruction. The jump target
162 * has a stack depth that is 1 less.
163 *
164 * - The `JSOp::JumpTarget` instruction immediately following a `JSTRY_CATCH`
165 * or `JSTRY_FINALLY` span has the same stack depth as the `JSOp::Try`
166 * instruction that precedes the span.
167 *
168 * Every instruction covered by the `JSTRY_CATCH` or `JSTRY_FINALLY` span
169 * must have a stack depth >= that value, so that error recovery is
170 * guaranteed to find enough values on the stack to resume there.
171 *
172 * - `script->nslots() - script->nfixed()` must be >= the maximum stack
173 * depth of any instruction in `script`. (The stack frame must be big
174 * enough to run the code.)
175 *
176 * `BytecodeParser::parse()` computes stack depths for every reachable
177 * instruction in a script.
178 *
179 * ## Scopes and environments
180 *
181 * As with stack depth, each instruction has a static scope, which is a
182 * compile-time characterization of the eventual run-time environment chain
183 * when that instruction executes. Just as every instruction has a stack budget
184 * (nuses/ndefs), every instruction either pushes a scope, pops a scope, or
185 * neither. The same successor relation applies as above.
186 *
187 * Every scope used in a script is stored in the `JSScript::gcthings()` vector.
188 * They can be accessed using `getScope(index)` if you know what `index` to
189 * pass.
190 *
191 * The scope of every instruction (that's reachable via the successor relation)
192 * is given in two independent ways: by the bytecode itself and by the scope
193 * notes. The two sources must agree.
194 *
195 * ## Further rules
196 *
197 * All reachable instructions must be reachable without taking any backward
198 * edges.
199 *
200 * Instructions with the `JOF_CHECKSLOPPY` flag must not be used in strict mode
201 * code. `JOF_CHECKSTRICT` instructions must not be used in nonstrict code.
202 *
203 * Many instructions have their own additional rules. These are documented on
204 * the various opcodes below (look for the word "must").
205 */
206 // clang-format on
208 // clang-format off
209 /*
210 * SpiderMonkey bytecode categorization (as used in generated documentation):
211 *
212 * [Index]
213 * [Constants]
214 * [Compound primitives]
215 * Record literals
216 * Tuple literals
217 * [Expressions]
218 * Unary operators
219 * Binary operators
220 * Conversions
221 * Other expressions
222 * [Objects]
223 * Creating objects
224 * Defining properties
225 * Accessing properties
226 * Super
227 * Enumeration
228 * Iteration
229 * SetPrototype
230 * Array literals
231 * RegExp literals
232 * Built-in objects
233 * [Functions]
234 * Creating functions
235 * Creating constructors
236 * Calls
237 * Generators and async functions
238 * [Control flow]
239 * Jump targets
240 * Jumps
241 * Return
242 * Exceptions
243 * [Variables and scopes]
244 * Initialization
245 * Looking up bindings
246 * Getting binding values
247 * Setting binding values
248 * Entering and leaving environments
249 * Creating and deleting bindings
250 * Function environment setup
251 * [Stack operations]
252 * [Other]
253 */
254 // clang-format on
256 // clang-format off
257 #define FOR_EACH_OPCODE(MACRO) \
258 /*
259 * Push `undefined`.
260 *
261 * Category: Constants
262 * Operands:
263 * Stack: => undefined
266 /*
267 * Push `null`.
268 *
269 * Category: Constants
270 * Operands:
271 * Stack: => null
274 /*
275 * Push a boolean constant.
276 *
277 * Category: Constants
278 * Operands:
279 * Stack: => true/false
283 /*
284 * Push the `int32_t` immediate operand as an `Int32Value`.
285 *
286 * `JSOp::Zero`, `JSOp::One`, `JSOp::Int8`, `JSOp::Uint16`, and `JSOp::Uint24`
287 * are all compact encodings for `JSOp::Int32`.
288 *
289 * Category: Constants
290 * Operands: int32_t val
291 * Stack: => val
293 MACRO(Int32, int32, NULL, 5, 0, 1, JOF_INT32) \
294 /*
295 * Push the number `0`.
296 *
297 * Category: Constants
298 * Operands:
299 * Stack: => 0
302 /*
303 * Push the number `1`.
304 *
305 * Category: Constants
306 * Operands:
307 * Stack: => 1
310 /*
311 * Push the `int8_t` immediate operand as an `Int32Value`.
312 *
313 * Category: Constants
314 * Operands: int8_t val
315 * Stack: => val
317 MACRO(Int8, int8, NULL, 2, 0, 1, JOF_INT8) \
318 /*
319 * Push the `uint16_t` immediate operand as an `Int32Value`.
320 *
321 * Category: Constants
322 * Operands: uint16_t val
323 * Stack: => val
325 MACRO(Uint16, uint16, NULL, 3, 0, 1, JOF_UINT16) \
326 /*
327 * Push the `uint24_t` immediate operand as an `Int32Value`.
328 *
329 * Category: Constants
330 * Operands: uint24_t val
331 * Stack: => val
333 MACRO(Uint24, uint24, NULL, 4, 0, 1, JOF_UINT24) \
334 /*
335 * Push the 64-bit floating-point immediate operand as a `DoubleValue`.
336 *
337 * If the operand is a NaN, it must be the canonical NaN (see
338 * `JS::detail::CanonicalizeNaN`).
339 *
340 * Category: Constants
341 * Operands: double val
342 * Stack: => val
344 MACRO(Double, double_, NULL, 9, 0, 1, JOF_DOUBLE) \
345 /*
346 * Push the BigInt constant `script->getBigInt(bigIntIndex)`.
347 *
348 * Category: Constants
349 * Operands: uint32_t bigIntIndex
350 * Stack: => bigint
352 MACRO(BigInt, big_int, NULL, 5, 0, 1, JOF_BIGINT) \
353 /*
354 * Push the string constant `script->getAtom(atomIndex)`.
355 *
356 * Category: Constants
357 * Operands: uint32_t atomIndex
358 * Stack: => string
360 MACRO(String, string, NULL, 5, 0, 1, JOF_STRING) \
361 /*
362 * Push a well-known symbol.
363 *
364 * `symbol` must be in range for `JS::SymbolCode`.
365 *
366 * Category: Constants
367 * Operands: uint8_t symbol (the JS::SymbolCode of the symbol to use)
368 * Stack: => symbol
370 MACRO(Symbol, symbol, NULL, 2, 0, 1, JOF_UINT8) \
371 /*
372 * Pop the top value on the stack, discard it, and push `undefined`.
373 *
374 * Implements: [The `void` operator][1], step 3.
375 *
376 * [1]: https://tc39.es/ecma262/#sec-void-operator
377 *
378 * Category: Expressions
379 * Type: Unary operators
380 * Operands:
381 * Stack: val => undefined
383 MACRO(Void, void_, NULL, 1, 1, 1, JOF_BYTE) \
384 /*
385 * [The `typeof` operator][1].
386 *
387 * Infallible. The result is always a string that depends on the [type][2]
388 * of `val`.
389 *
390 * `JSOp::Typeof` and `JSOp::TypeofExpr` are the same except
391 * that--amazingly--`JSOp::Typeof` affects the behavior of an immediately
392 * *preceding* `JSOp::GetName` or `JSOp::GetGName` instruction! This is how
393 * we implement [`typeof`][1] step 2, making `typeof nonExistingVariable`
394 * return `"undefined"` instead of throwing a ReferenceError.
395 *
396 * In a global scope:
397 *
398 * - `typeof x` compiles to `GetGName "x"; Typeof`.
399 * - `typeof (0, x)` compiles to `GetGName "x"; TypeofExpr`.
400 *
401 * Emitting the same bytecode for these two expressions would be a bug.
402 * Per spec, the latter throws a ReferenceError if `x` doesn't exist.
403 *
404 * [1]: https://tc39.es/ecma262/#sec-typeof-operator
405 * [2]: https://tc39.es/ecma262/#sec-ecmascript-language-types
406 *
407 * Category: Expressions
408 * Type: Unary operators
409 * Operands:
410 * Stack: val => (typeof val)
412 MACRO(Typeof, typeof_, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
413 MACRO(TypeofExpr, typeof_expr, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
414 /*
415 * [The unary `+` operator][1].
416 *
417 * `+val` doesn't do any actual math. It just calls [ToNumber][2](val).
418 *
419 * The conversion can call `.toString()`/`.valueOf()` methods and can
420 * throw. The result on success is always a Number. (Per spec, unary `-`
421 * supports BigInts, but unary `+` does not.)
422 *
423 * [1]: https://tc39.es/ecma262/#sec-unary-plus-operator
424 * [2]: https://tc39.es/ecma262/#sec-tonumber
425 *
426 * Category: Expressions
427 * Type: Unary operators
428 * Operands:
429 * Stack: val => (+val)
432 /*
433 * [The unary `-` operator][1].
434 *
435 * Convert `val` to a numeric value, then push `-val`. The conversion can
436 * call `.toString()`/`.valueOf()` methods and can throw. The result on
437 * success is always numeric.
438 *
439 * [1]: https://tc39.es/ecma262/#sec-unary-minus-operator
440 *
441 * Category: Expressions
442 * Type: Unary operators
443 * Operands:
444 * Stack: val => (-val)
447 /*
448 * [The bitwise NOT operator][1] (`~`).
449 *
450 * `val` is converted to an integer, then bitwise negated. The conversion
451 * can call `.toString()`/`.valueOf()` methods and can throw. The result on
452 * success is always an Int32 or BigInt value.
453 *
454 * [1]: https://tc39.es/ecma262/#sec-bitwise-not-operator
455 *
456 * Category: Expressions
457 * Type: Unary operators
458 * Operands:
459 * Stack: val => (~val)
462 /*
463 * [The logical NOT operator][1] (`!`).
464 *
465 * `val` is first converted with [ToBoolean][2], then logically
466 * negated. The result is always a boolean value. This does not call
467 * user-defined methods and can't throw.
468 *
469 * [1]: https://tc39.es/ecma262/#sec-logical-not-operator
470 * [2]: https://tc39.es/ecma262/#sec-toboolean
471 *
472 * Category: Expressions
473 * Type: Unary operators
474 * Operands:
475 * Stack: val => (!val)
478 /*
479 * [Binary bitwise operations][1] (`|`, `^`, `&`).
480 *
481 * The arguments are converted to integers first. The conversion can call
482 * `.toString()`/`.valueOf()` methods and can throw. The result on success
483 * is always an Int32 or BigInt Value.
484 *
485 * [1]: https://tc39.es/ecma262/#sec-binary-bitwise-operators
486 *
487 * Category: Expressions
488 * Type: Binary operators
489 * Operands:
490 * Stack: lval, rval => (lval OP rval)
495 /*
496 * Loose equality operators (`==` and `!=`).
497 *
498 * Pop two values, compare them, and push the boolean result. The
499 * comparison may perform conversions that call `.toString()`/`.valueOf()`
500 * methods and can throw.
501 *
502 * Implements: [Abstract Equality Comparison][1].
503 *
504 * [1]: https://tc39.es/ecma262/#sec-abstract-equality-comparison
505 *
506 * Category: Expressions
507 * Type: Binary operators
508 * Operands:
509 * Stack: lval, rval => (lval OP rval)
513 /*
514 * Strict equality operators (`===` and `!==`).
515 *
516 * Pop two values, check whether they're equal, and push the boolean
517 * result. This does not call user-defined methods and can't throw
518 * (except possibly due to OOM while flattening a string).
519 *
520 * Implements: [Strict Equality Comparison][1].
521 *
522 * [1]: https://tc39.es/ecma262/#sec-strict-equality-comparison
523 *
524 * Category: Expressions
525 * Type: Binary operators
526 * Operands:
527 * Stack: lval, rval => (lval OP rval)
531 /*
532 * Relative operators (`<`, `>`, `<=`, `>=`).
533 *
534 * Pop two values, compare them, and push the boolean result. The
535 * comparison may perform conversions that call `.toString()`/`.valueOf()`
536 * methods and can throw.
537 *
538 * Implements: [Relational Operators: Evaluation][1].
539 *
540 * [1]: https://tc39.es/ecma262/#sec-relational-operators-runtime-semantics-evaluation
541 *
542 * Category: Expressions
543 * Type: Binary operators
544 * Operands:
545 * Stack: lval, rval => (lval OP rval)
551 /*
552 * [The `instanceof` operator][1].
553 *
554 * This throws a `TypeError` if `target` is not an object. It calls
555 * `target[Symbol.hasInstance](value)` if the method exists. On success,
556 * the result is always a boolean value.
557 *
558 * [1]: https://tc39.es/ecma262/#sec-instanceofoperator
559 *
560 * Category: Expressions
561 * Type: Binary operators
562 * Operands:
563 * Stack: value, target => (value instanceof target)
566 /*
567 * [The `in` operator][1].
568 *
569 * Push `true` if `obj` has a property with the key `id`. Otherwise push `false`.
570 *
571 * This throws a `TypeError` if `obj` is not an object. This can fire
572 * proxy hooks and can throw. On success, the result is always a boolean
573 * value.
574 *
575 * [1]: https://tc39.es/ecma262/#sec-relational-operators-runtime-semantics-evaluation
576 *
577 * Category: Expressions
578 * Type: Binary operators
579 * Operands:
580 * Stack: id, obj => (id in obj)
583 /*
584 * [Bitwise shift operators][1] (`<<`, `>>`, `>>>`).
585 *
586 * Pop two values, convert them to integers, perform a bitwise shift, and
587 * push the result.
588 *
589 * Conversion can call `.toString()`/`.valueOf()` methods and can throw.
590 * The result on success is always an Int32 or BigInt Value.
591 *
592 * [1]: https://tc39.es/ecma262/#sec-bitwise-shift-operators
593 *
594 * Category: Expressions
595 * Type: Binary operators
596 * Operands:
597 * Stack: lval, rval => (lval OP rval)
602 /*
603 * [The binary `+` operator][1].
604 *
605 * Pop two values, convert them to primitive values, add them, and push the
606 * result. If both values are numeric, add them; if either is a
607 * string, do string concatenation instead.
608 *
609 * The conversion can call `.toString()`/`.valueOf()` methods and can throw.
610 *
611 * [1]: https://tc39.es/ecma262/#sec-addition-operator-plus-runtime-semantics-evaluation
612 *
613 * Category: Expressions
614 * Type: Binary operators
615 * Operands:
616 * Stack: lval, rval => (lval + rval)
619 /*
620 * [The binary `-` operator][1].
621 *
622 * Pop two values, convert them to numeric values, subtract the top value
623 * from the other one, and push the result.
624 *
625 * The conversion can call `.toString()`/`.valueOf()` methods and can
626 * throw. On success, the result is always numeric.
627 *
628 * [1]: https://tc39.es/ecma262/#sec-subtraction-operator-minus-runtime-semantics-evaluation
629 *
630 * Category: Expressions
631 * Type: Binary operators
632 * Operands:
633 * Stack: lval, rval => (lval - rval)
636 /*
637 * Add or subtract 1.
638 *
639 * `val` must already be a numeric value, such as the result of
640 * `JSOp::ToNumeric`.
641 *
642 * Implements: [The `++` and `--` operators][1], step 3 of each algorithm.
643 *
644 * [1]: https://tc39.es/ecma262/#sec-postfix-increment-operator
645 *
646 * Category: Expressions
647 * Type: Binary operators
648 * Operands:
649 * Stack: val => (val +/- 1)
651 MACRO(Inc, inc, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
652 MACRO(Dec, dec, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
653 /*
654 * [The multiplicative operators][1] (`*`, `/`, `%`).
655 *
656 * Pop two values, convert them to numeric values, do math, and push the
657 * result.
658 *
659 * The conversion can call `.toString()`/`.valueOf()` methods and can
660 * throw. On success, the result is always numeric.
661 *
662 * [1]: https://tc39.es/ecma262/#sec-multiplicative-operators-runtime-semantics-evaluation
663 *
664 * Category: Expressions
665 * Type: Binary operators
666 * Operands:
667 * Stack: lval, rval => (lval OP rval)
672 /*
673 * [The exponentiation operator][1] (`**`).
674 *
675 * Pop two values, convert them to numeric values, do exponentiation, and
676 * push the result. The top value is the exponent.
677 *
678 * The conversion can call `.toString()`/`.valueOf()` methods and can
679 * throw. This throws a RangeError if both values are BigInts and the
680 * exponent is negative.
681 *
682 * [1]: https://tc39.es/ecma262/#sec-exp-operator
683 *
684 * Category: Expressions
685 * Type: Binary operators
686 * Operands:
687 * Stack: lval, rval => (lval ** rval)
690 /*
691 * No-op instruction for bytecode decompiler to hint that the previous
692 * binary operator is compound assignment.
693 *
694 * Category: Expressions
695 * Type: Other expressions
696 * Operands:
697 * Stack:
699 MACRO(NopIsAssignOp, nop_is_assign_op, NULL, 1, 0, 0, JOF_BYTE) \
700 /*
701 * Convert a value to a property key.
702 *
703 * Implements: [ToPropertyKey][1], except that if the result would be the
704 * string representation of some integer in the range 0..2^31, we push the
705 * corresponding Int32 value instead. This is because the spec insists that
706 * array indices are strings, whereas for us they are integers.
707 *
708 * This is used for code like `++obj[index]`, which must do both a
709 * `JSOp::GetElem` and a `JSOp::SetElem` with the same property key. Both
710 * instructions would convert `index` to a property key for us, but the
711 * spec says to convert it only once.
712 *
713 * The conversion can call `.toString()`/`.valueOf()` methods and can
714 * throw.
715 *
716 * [1]: https://tc39.es/ecma262/#sec-topropertykey
717 *
718 * Category: Expressions
719 * Type: Conversions
720 * Operands:
721 * Stack: propertyNameValue => propertyKey
723 MACRO(ToPropertyKey, to_property_key, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
724 /*
725 * Convert a value to a numeric value (a Number or BigInt).
726 *
727 * Implements: [ToNumeric][1](val).
728 *
729 * Note: This is used to implement [`++` and `--`][2]. Surprisingly, it's
730 * not possible to get the right behavior using `JSOp::Add` and `JSOp::Sub`
731 * alone. For one thing, `JSOp::Add` sometimes does string concatenation,
732 * while `++` always does numeric addition. More fundamentally, the result
733 * of evaluating `x--` is ToNumeric(old value of `x`), a value that the
734 * sequence `GetLocal "x"; One; Sub; SetLocal "x"` does not give us.
735 *
736 * [1]: https://tc39.es/ecma262/#sec-tonumeric
737 * [2]: https://tc39.es/ecma262/#sec-postfix-increment-operator
738 *
739 * Category: Expressions
740 * Type: Conversions
741 * Operands:
742 * Stack: val => ToNumeric(val)
744 MACRO(ToNumeric, to_numeric, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
745 /*
746 * Convert a value to a string.
747 *
748 * Implements: [ToString][1](val).
749 *
750 * Note: This is used in code for template literals, like `${x}${y}`. Each
751 * substituted value must be converted using ToString. `JSOp::Add` by itself
752 * would do a slightly wrong kind of conversion (hint="number" rather than
753 * hint="string").
754 *
755 * [1]: https://tc39.es/ecma262/#sec-tostring
756 *
757 * Category: Expressions
758 * Type: Conversions
759 * Stack: val => ToString(val)
761 MACRO(ToString, to_string, NULL, 1, 1, 1, JOF_BYTE) \
762 /*
763 * Test whether the value on top of the stack is `NullValue` or
764 * `UndefinedValue` and push the boolean result.
765 *
766 * Category: Expressions
767 * Type: Other expressions
768 * Operands:
769 * Stack: val => val, IsNullOrUndefined(val)
771 MACRO(IsNullOrUndefined, is_null_or_undefined, NULL, 1, 1, 2, JOF_BYTE) \
772 /*
773 * Push the global `this` value. Not to be confused with the `globalThis`
774 * property on the global.
775 *
776 * This must be used only in scopes where `this` refers to the global
777 * `this`.
778 *
779 * Category: Expressions
780 * Type: Other expressions
781 * Operands:
782 * Stack: => this
784 MACRO(GlobalThis, global_this, NULL, 1, 0, 1, JOF_BYTE) \
785 /*
786 * Push the global `this` value for non-syntactic scope. Not to be confused
787 * with the `globalThis` property on the global.
788 *
789 * This must be used only in scopes where `this` refers to the global
790 * `this`.
791 *
792 * Category: Expressions
793 * Type: Other expressions
794 * Operands:
795 * Stack: => this
797 MACRO(NonSyntacticGlobalThis, non_syntactic_global_this, NULL, 1, 0, 1, JOF_BYTE) \
798 /*
799 * Push the value of `new.target`.
800 *
801 * The result is a constructor or `undefined`.
802 *
803 * This must be used only in non-arrow function scripts.
804 *
805 * Implements: [GetNewTarget][1].
806 *
807 * [1]: https://tc39.es/ecma262/#sec-getnewtarget
808 *
809 * Category: Expressions
810 * Type: Other expressions
811 * Operands:
812 * Stack: => new.target
814 MACRO(NewTarget, new_target, NULL, 1, 0, 1, JOF_BYTE) \
815 /*
816 * Dynamic import of the module specified by the string value on the top of
817 * the stack.
818 *
819 * Implements: [Import Calls][1].
820 *
821 * [1]: https://tc39.es/ecma262/#sec-import-calls
822 *
823 * Category: Expressions
824 * Type: Other expressions
825 * Operands:
826 * Stack: moduleId, options => promise
828 MACRO(DynamicImport, dynamic_import, NULL, 1, 2, 1, JOF_BYTE) \
829 /*
830 * Push the `import.meta` object.
831 *
832 * This must be used only in module code.
833 *
834 * Category: Expressions
835 * Type: Other expressions
836 * Operands:
837 * Stack: => import.meta
839 MACRO(ImportMeta, import_meta, NULL, 1, 0, 1, JOF_BYTE) \
840 /*
841 * Create and push a new object with no properties.
842 *
843 * Category: Objects
844 * Type: Creating objects
845 * Operands:
846 * Stack: => obj
848 MACRO(NewInit, new_init, NULL, 1, 0, 1, JOF_BYTE|JOF_IC) \
849 /*
850 * Create and push a new object of a predetermined shape.
851 *
852 * The new object has the shape `script->getShape(shapeIndex)`.
853 * Subsequent `InitProp` instructions must fill in all slots of the new
854 * object before it is used in any other way.
855 *
856 * Category: Objects
857 * Type: Creating objects
858 * Operands: uint32_t shapeIndex
859 * Stack: => obj
861 MACRO(NewObject, new_object, NULL, 5, 0, 1, JOF_SHAPE|JOF_IC) \
862 /*
863 * Push a preconstructed object.
864 *
865 * Going one step further than `JSOp::NewObject`, this instruction doesn't
866 * just reuse the shape--it actually pushes the preconstructed object
867 * `script->getObject(objectIndex)` right onto the stack. The object must
868 * be a singleton `PlainObject` or `ArrayObject`.
869 *
870 * The spec requires that an *ObjectLiteral* or *ArrayLiteral* creates a
871 * new object every time it's evaluated, so this instruction must not be
872 * used anywhere it might be executed more than once.
873 *
874 * This may only be used in non-function run-once scripts. Care also must
875 * be taken to not emit in loops or other constructs where it could run
876 * more than once.
877 *
878 * Category: Objects
879 * Type: Creating objects
880 * Operands: uint32_t objectIndex
881 * Stack: => obj
883 MACRO(Object, object, NULL, 5, 0, 1, JOF_OBJECT) \
884 /*
885 * Create and push a new ordinary object with the provided [[Prototype]].
886 *
887 * This is used to create the `.prototype` object for derived classes.
888 *
889 * Category: Objects
890 * Type: Creating objects
891 * Operands:
892 * Stack: proto => obj
894 MACRO(ObjWithProto, obj_with_proto, NULL, 1, 1, 1, JOF_BYTE) \
895 /*
896 * Define a data property on an object.
897 *
898 * `obj` must be an object.
899 *
900 * Implements: [CreateDataPropertyOrThrow][1] as used in
901 * [PropertyDefinitionEvaluation][2] of regular and shorthand
902 * *PropertyDefinition*s.
903 *
904 * [1]: https://tc39.es/ecma262/#sec-createdatapropertyorthrow
905 * [2]: https://tc39.es/ecma262/#sec-object-initializer-runtime-semantics-propertydefinitionevaluation
906 *
907 * Category: Objects
908 * Type: Defining properties
909 * Operands: uint32_t nameIndex
910 * Stack: obj, val => obj
912 MACRO(InitProp, init_prop, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPINIT|JOF_IC) \
913 /*
914 * Like `JSOp::InitProp`, but define a non-enumerable property.
915 *
916 * This is used to define class methods.
917 *
918 * Implements: [PropertyDefinitionEvaluation][1] for methods, steps 3 and
919 * 4, when *enumerable* is false.
920 *
921 * [1]: https://tc39.es/ecma262/#sec-method-definitions-runtime-semantics-propertydefinitionevaluation
922 *
923 * Category: Objects
924 * Type: Defining properties
925 * Operands: uint32_t nameIndex
926 * Stack: obj, val => obj
928 MACRO(InitHiddenProp, init_hidden_prop, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPINIT|JOF_IC) \
929 /*
930 * Like `JSOp::InitProp`, but define a non-enumerable, non-writable,
931 * non-configurable property.
932 *
933 * This is used to define the `.prototype` property on classes.
934 *
935 * Implements: [MakeConstructor][1], step 8, when *writablePrototype* is
936 * false.
937 *
938 * [1]: https://tc39.es/ecma262/#sec-makeconstructor
939 *
940 * Category: Objects
941 * Type: Defining properties
942 * Operands: uint32_t nameIndex
943 * Stack: obj, val => obj
945 MACRO(InitLockedProp, init_locked_prop, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPINIT|JOF_IC) \
946 /*
947 * Define a data property on `obj` with property key `id` and value `val`.
948 *
949 * `obj` must be an object.
950 *
951 * Implements: [CreateDataPropertyOrThrow][1]. This instruction is used for
952 * object literals like `{0: val}` and `{[id]: val}`, and methods like
953 * `*[Symbol.iterator]() {}`.
954 *
955 * `JSOp::InitHiddenElem` is the same but defines a non-enumerable property,
956 * for class methods.
957 * `JSOp::InitLockedElem` is the same but defines a non-enumerable, non-writable, non-configurable property,
958 * for private class methods.
959 *
960 * [1]: https://tc39.es/ecma262/#sec-createdatapropertyorthrow
961 *
962 * Category: Objects
963 * Type: Defining properties
964 * Operands:
965 * Stack: obj, id, val => obj
967 MACRO(InitElem, init_elem, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPINIT|JOF_IC) \
968 MACRO(InitHiddenElem, init_hidden_elem, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPINIT|JOF_IC) \
969 MACRO(InitLockedElem, init_locked_elem, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPINIT|JOF_IC) \
970 /*
971 * Define an accessor property on `obj` with the given `getter`.
972 * `nameIndex` gives the property name.
973 *
974 * `obj` must be an object and `getter` must be a function.
975 *
976 * `JSOp::InitHiddenPropGetter` is the same but defines a non-enumerable
977 * property, for getters in classes.
978 *
979 * Category: Objects
980 * Type: Defining properties
981 * Operands: uint32_t nameIndex
982 * Stack: obj, getter => obj
984 MACRO(InitPropGetter, init_prop_getter, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPINIT) \
985 MACRO(InitHiddenPropGetter, init_hidden_prop_getter, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPINIT) \
986 /*
987 * Define an accessor property on `obj` with property key `id` and the given `getter`.
988 *
989 * This is used to implement getters like `get [id]() {}` or `get 0() {}`.
990 *
991 * `obj` must be an object and `getter` must be a function.
992 *
993 * `JSOp::InitHiddenElemGetter` is the same but defines a non-enumerable
994 * property, for getters in classes.
995 *
996 * Category: Objects
997 * Type: Defining properties
998 * Operands:
999 * Stack: obj, id, getter => obj
1001 MACRO(InitElemGetter, init_elem_getter, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPINIT) \
1002 MACRO(InitHiddenElemGetter, init_hidden_elem_getter, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPINIT) \
1003 /*
1004 * Define an accessor property on `obj` with the given `setter`.
1005 *
1006 * This is used to implement ordinary setters like `set foo(v) {}`.
1007 *
1008 * `obj` must be an object and `setter` must be a function.
1009 *
1010 * `JSOp::InitHiddenPropSetter` is the same but defines a non-enumerable
1011 * property, for setters in classes.
1012 *
1013 * Category: Objects
1014 * Type: Defining properties
1015 * Operands: uint32_t nameIndex
1016 * Stack: obj, setter => obj
1018 MACRO(InitPropSetter, init_prop_setter, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPINIT) \
1019 MACRO(InitHiddenPropSetter, init_hidden_prop_setter, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPINIT) \
1020 /*
1021 * Define an accesssor property on `obj` with property key `id` and the
1022 * given `setter`.
1023 *
1024 * This is used to implement setters with computed property keys or numeric
1025 * keys.
1026 *
1027 * `JSOp::InitHiddenElemSetter` is the same but defines a non-enumerable
1028 * property, for setters in classes.
1029 *
1030 * Category: Objects
1031 * Type: Defining properties
1032 * Operands:
1033 * Stack: obj, id, setter => obj
1035 MACRO(InitElemSetter, init_elem_setter, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPINIT) \
1036 MACRO(InitHiddenElemSetter, init_hidden_elem_setter, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPINIT) \
1037 /*
1038 * Get the value of the property `obj.name`. This can call getters and
1039 * proxy traps.
1040 *
1041 * Implements: [GetV][1], [GetValue][2] step 5.
1042 *
1043 * [1]: https://tc39.es/ecma262/#sec-getv
1044 * [2]: https://tc39.es/ecma262/#sec-getvalue
1045 *
1046 * Category: Objects
1047 * Type: Accessing properties
1048 * Operands: uint32_t nameIndex
1049 * Stack: obj => obj[name]
1051 MACRO(GetProp, get_prop, NULL, 5, 1, 1, JOF_ATOM|JOF_PROP|JOF_IC) \
1052 /*
1053 * Get the value of the property `obj[key]`.
1054 *
1055 * Implements: [GetV][1], [GetValue][2] step 5.
1056 *
1057 * [1]: https://tc39.es/ecma262/#sec-getv
1058 * [2]: https://tc39.es/ecma262/#sec-getvalue
1059 *
1060 * Category: Objects
1061 * Type: Accessing properties
1062 * Operands:
1063 * Stack: obj, key => obj[key]
1065 MACRO(GetElem, get_elem, NULL, 1, 2, 1, JOF_BYTE|JOF_ELEM|JOF_IC) \
1066 /*
1067 * Non-strict assignment to a property, `obj.name = val`.
1068 *
1069 * This throws a TypeError if `obj` is null or undefined. If it's a
1070 * primitive value, the property is set on ToObject(`obj`), typically with
1071 * no effect.
1072 *
1073 * Implements: [PutValue][1] step 6 for non-strict code.
1074 *
1075 * [1]: https://tc39.es/ecma262/#sec-putvalue
1076 *
1077 * Category: Objects
1078 * Type: Accessing properties
1079 * Operands: uint32_t nameIndex
1080 * Stack: obj, val => val
1082 MACRO(SetProp, set_prop, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPSET|JOF_CHECKSLOPPY|JOF_IC) \
1083 /*
1084 * Like `JSOp::SetProp`, but for strict mode code. Throw a TypeError if
1085 * `obj[key]` exists but is non-writable, if it's an accessor property with
1086 * no setter, or if `obj` is a primitive value.
1087 *
1088 * Category: Objects
1089 * Type: Accessing properties
1090 * Operands: uint32_t nameIndex
1091 * Stack: obj, val => val
1093 MACRO(StrictSetProp, strict_set_prop, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_PROPSET|JOF_CHECKSTRICT|JOF_IC) \
1094 /*
1095 * Non-strict assignment to a property, `obj[key] = val`.
1096 *
1097 * Implements: [PutValue][1] step 6 for non-strict code.
1098 *
1099 * [1]: https://tc39.es/ecma262/#sec-putvalue
1100 *
1101 * Category: Objects
1102 * Type: Accessing properties
1103 * Operands:
1104 * Stack: obj, key, val => val
1106 MACRO(SetElem, set_elem, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPSET|JOF_CHECKSLOPPY|JOF_IC) \
1107 /*
1108 * Like `JSOp::SetElem`, but for strict mode code. Throw a TypeError if
1109 * `obj[key]` exists but is non-writable, if it's an accessor property with
1110 * no setter, or if `obj` is a primitive value.
1111 *
1112 * Category: Objects
1113 * Type: Accessing properties
1114 * Operands:
1115 * Stack: obj, key, val => val
1117 MACRO(StrictSetElem, strict_set_elem, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_PROPSET|JOF_CHECKSTRICT|JOF_IC) \
1118 /*
1119 * Delete a property from `obj`. Push true on success, false if the
1120 * property existed but could not be deleted. This implements `delete
1121 * obj.name` in non-strict code.
1122 *
1123 * Throws if `obj` is null or undefined. Can call proxy traps.
1124 *
1125 * Implements: [`delete obj.propname`][1] step 5 in non-strict code.
1126 *
1127 * [1]: https://tc39.es/ecma262/#sec-delete-operator-runtime-semantics-evaluation
1128 *
1129 * Category: Objects
1130 * Type: Accessing properties
1131 * Operands: uint32_t nameIndex
1132 * Stack: obj => succeeded
1134 MACRO(DelProp, del_prop, NULL, 5, 1, 1, JOF_ATOM|JOF_PROP|JOF_CHECKSLOPPY) \
1135 /*
1136 * Like `JSOp::DelProp`, but for strict mode code. Push `true` on success,
1137 * else throw a TypeError.
1138 *
1139 * Category: Objects
1140 * Type: Accessing properties
1141 * Operands: uint32_t nameIndex
1142 * Stack: obj => succeeded
1144 MACRO(StrictDelProp, strict_del_prop, NULL, 5, 1, 1, JOF_ATOM|JOF_PROP|JOF_CHECKSTRICT) \
1145 /*
1146 * Delete the property `obj[key]` and push `true` on success, `false`
1147 * if the property existed but could not be deleted.
1148 *
1149 * This throws if `obj` is null or undefined. Can call proxy traps.
1150 *
1151 * Implements: [`delete obj[key]`][1] step 5 in non-strict code.
1152 *
1153 * [1]: https://tc39.es/ecma262/#sec-delete-operator-runtime-semantics-evaluation
1154 *
1155 * Category: Objects
1156 * Type: Accessing properties
1157 * Operands:
1158 * Stack: obj, key => succeeded
1160 MACRO(DelElem, del_elem, NULL, 1, 2, 1, JOF_BYTE|JOF_ELEM|JOF_CHECKSLOPPY) \
1161 /*
1162 * Like `JSOp::DelElem, but for strict mode code. Push `true` on success,
1163 * else throw a TypeError.
1164 *
1165 * Category: Objects
1166 * Type: Accessing properties
1167 * Operands:
1168 * Stack: obj, key => succeeded
1170 MACRO(StrictDelElem, strict_del_elem, NULL, 1, 2, 1, JOF_BYTE|JOF_ELEM|JOF_CHECKSTRICT) \
1171 /*
1172 * Push true if `obj` has an own property `id`.
1173 *
1174 * Note that `obj` is the top value, like `JSOp::In`.
1175 *
1176 * This opcode is not used for normal JS. Self-hosted code uses it by
1177 * calling the intrinsic `hasOwn(id, obj)`. For example,
1178 * `Object.prototype.hasOwnProperty` is implemented this way (see
1179 * js/src/builtin/Object.js).
1180 *
1181 * Category: Objects
1182 * Type: Accessing properties
1183 * Operands:
1184 * Stack: id, obj => (obj.hasOwnProperty(id))
1186 MACRO(HasOwn, has_own, NULL, 1, 2, 1, JOF_BYTE|JOF_IC) \
1187 /*
1188 * Push a bool representing the presence of private field id on obj.
1189 * May throw, depending on the ThrowCondition.
1190 *
1191 * Two arguments:
1192 * - throwCondition: One of the ThrowConditions defined in
1193 * ThrowMsgKind.h. Determines why (or if) this op will throw.
1194 * - msgKind: One of the ThrowMsgKinds defined in ThrowMsgKind.h, which
1195 * maps to one of the messages in js.msg. Note: It's not possible to
1196 * pass arguments to the message at the moment.
1197 *
1198 * Category: Objects
1199 * Type: Accessing properties
1200 * Operands: ThrowCondition throwCondition, ThrowMsgKind msgKind
1201 * Stack: obj, key => obj, key, (obj.hasOwnProperty(id))
1203 MACRO(CheckPrivateField, check_private_field, NULL, 3, 2, 3, JOF_TWO_UINT8|JOF_CHECKSTRICT|JOF_IC) \
1204 /*
1205 * Push a new private name.
1206 *
1207 * Category: Objects
1208 * Type: Accessing properties
1209 * Operands: uint32_t nameIndex
1210 * Stack: => private_name
1212 MACRO(NewPrivateName, new_private_name, NULL, 5, 0, 1, JOF_ATOM) \
1213 /*
1214 * Push the SuperBase of the method `callee`. The SuperBase is
1215 * `callee.[[HomeObject]].[[GetPrototypeOf]]()`, the object where `super`
1216 * property lookups should begin.
1217 *
1218 * `callee` must be a function that has a HomeObject that's an object,
1219 * typically produced by `JSOp::Callee` or `JSOp::EnvCallee`.
1220 *
1221 * Implements: [GetSuperBase][1], except that instead of the environment,
1222 * the argument supplies the callee.
1223 *
1224 * [1]: https://tc39.es/ecma262/#sec-getsuperbase
1225 *
1226 * Category: Objects
1227 * Type: Super
1228 * Operands:
1229 * Stack: callee => superBase
1231 MACRO(SuperBase, super_base, NULL, 1, 1, 1, JOF_BYTE) \
1232 /*
1233 * Get the value of `receiver.name`, starting the property search at `obj`.
1234 * In spec terms, `obj.[[Get]](name, receiver)`.
1235 *
1236 * Implements: [GetValue][1] for references created by [`super.name`][2].
1237 * The `receiver` is `this` and `obj` is the SuperBase of the enclosing
1238 * method.
1239 *
1240 * [1]: https://tc39.es/ecma262/#sec-getvalue
1241 * [2]: https://tc39.es/ecma262/#sec-super-keyword-runtime-semantics-evaluation
1242 *
1243 * Category: Objects
1244 * Type: Super
1245 * Operands: uint32_t nameIndex
1246 * Stack: receiver, obj => super.name
1248 MACRO(GetPropSuper, get_prop_super, NULL, 5, 2, 1, JOF_ATOM|JOF_PROP|JOF_IC) \
1249 /*
1250 * Get the value of `receiver[key]`, starting the property search at `obj`.
1251 * In spec terms, `obj.[[Get]](key, receiver)`.
1252 *
1253 * Implements: [GetValue][1] for references created by [`super[key]`][2]
1254 * (where the `receiver` is `this` and `obj` is the SuperBase of the enclosing
1255 * method); [`Reflect.get(obj, key, receiver)`][3].
1256 *
1257 * [1]: https://tc39.es/ecma262/#sec-getvalue
1258 * [2]: https://tc39.es/ecma262/#sec-super-keyword-runtime-semantics-evaluation
1259 * [3]: https://tc39.es/ecma262/#sec-reflect.get
1260 *
1261 * Category: Objects
1262 * Type: Super
1263 * Operands:
1264 * Stack: receiver, key, obj => super[key]
1266 MACRO(GetElemSuper, get_elem_super, NULL, 1, 3, 1, JOF_BYTE|JOF_ELEM|JOF_IC) \
1267 /*
1268 * Assign `val` to `receiver.name`, starting the search for an existing
1269 * property at `obj`. In spec terms, `obj.[[Set]](name, val, receiver)`.
1270 *
1271 * Implements: [PutValue][1] for references created by [`super.name`][2] in
1272 * non-strict code. The `receiver` is `this` and `obj` is the SuperBase of
1273 * the enclosing method.
1274 *
1275 * [1]: https://tc39.es/ecma262/#sec-putvalue
1276 * [2]: https://tc39.es/ecma262/#sec-super-keyword-runtime-semantics-evaluation
1277 *
1278 * Category: Objects
1279 * Type: Super
1280 * Operands: uint32_t nameIndex
1281 * Stack: receiver, obj, val => val
1283 MACRO(SetPropSuper, set_prop_super, NULL, 5, 3, 1, JOF_ATOM|JOF_PROP|JOF_PROPSET|JOF_CHECKSLOPPY) \
1284 /*
1285 * Like `JSOp::SetPropSuper`, but for strict mode code.
1286 *
1287 * Category: Objects
1288 * Type: Super
1289 * Operands: uint32_t nameIndex
1290 * Stack: receiver, obj, val => val
1292 MACRO(StrictSetPropSuper, strict_set_prop_super, NULL, 5, 3, 1, JOF_ATOM|JOF_PROP|JOF_PROPSET|JOF_CHECKSTRICT) \
1293 /*
1294 * Assign `val` to `receiver[key]`, strating the search for an existing
1295 * property at `obj`. In spec terms, `obj.[[Set]](key, val, receiver)`.
1296 *
1297 * Implements: [PutValue][1] for references created by [`super[key]`][2] in
1298 * non-strict code. The `receiver` is `this` and `obj` is the SuperBase of
1299 * the enclosing method.
1300 *
1301 * [1]: https://tc39.es/ecma262/#sec-putvalue
1302 * [2]: https://tc39.es/ecma262/#sec-super-keyword-runtime-semantics-evaluation
1303 *
1304 * Category: Objects
1305 * Type: Super
1306 * Operands:
1307 * Stack: receiver, key, obj, val => val
1309 MACRO(SetElemSuper, set_elem_super, NULL, 1, 4, 1, JOF_BYTE|JOF_ELEM|JOF_PROPSET|JOF_CHECKSLOPPY) \
1310 /*
1311 * Like `JSOp::SetElemSuper`, but for strict mode code.
1312 *
1313 * Category: Objects
1314 * Type: Super
1315 * Operands:
1316 * Stack: receiver, key, obj, val => val
1318 MACRO(StrictSetElemSuper, strict_set_elem_super, NULL, 1, 4, 1, JOF_BYTE|JOF_ELEM|JOF_PROPSET|JOF_CHECKSTRICT) \
1319 /*
1320 * Set up a for-in loop by pushing a `PropertyIteratorObject` over the
1321 * enumerable properties of `val`.
1322 *
1323 * Implements: [ForIn/OfHeadEvaluation][1] step 6,
1324 * [EnumerateObjectProperties][1]. (The spec refers to an "Iterator object"
1325 * with a `next` method, but notes that it "is never directly accessible"
1326 * to scripts. The object we use for this has no public methods.)
1327 *
1328 * If `val` is null or undefined, this pushes an empty iterator.
1329 *
1330 * The `iter` object pushed by this instruction must not be used or removed
1331 * from the stack except by `JSOp::MoreIter` and `JSOp::EndIter`, or by error
1332 * handling.
1333 *
1334 * The script's `JSScript::trynotes()` must mark the body of the `for-in`
1335 * loop, i.e. exactly those instructions that begin executing with `iter`
1336 * on the stack, starting with the next instruction (always
1337 * `JSOp::LoopHead`). Code must not jump into or out of this region: control
1338 * can enter only by executing `JSOp::Iter` and can exit only by executing a
1339 * `JSOp::EndIter` or by exception unwinding. (A `JSOp::EndIter` is always
1340 * emitted at the end of the loop, and extra copies are emitted on "exit
1341 * slides", where a `break`, `continue`, or `return` statement exits the
1342 * loop.)
1343 *
1344 * Typically a single try note entry marks the contiguous chunk of bytecode
1345 * from the instruction after `JSOp::Iter` to `JSOp::EndIter` (inclusive);
1346 * but if that range contains any instructions on exit slides, after a
1347 * `JSOp::EndIter`, then those must be correctly noted as *outside* the
1348 * loop.
1349 *
1350 * [1]: https://tc39.es/ecma262/#sec-runtime-semantics-forin-div-ofheadevaluation-tdznames-expr-iterationkind
1351 * [2]: https://tc39.es/ecma262/#sec-enumerate-object-properties
1352 *
1353 * Category: Objects
1354 * Type: Enumeration
1355 * Operands:
1356 * Stack: val => iter
1358 MACRO(Iter, iter, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
1359 /*
1360 * Get the next property name for a for-in loop.
1361 *
1362 * `iter` must be a `PropertyIteratorObject` produced by `JSOp::Iter`. This
1363 * pushes the property name for the next loop iteration, or
1364 * `MagicValue(JS_NO_ITER_VALUE)` if there are no more enumerable
1365 * properties to iterate over. The magic value must be used only by
1366 * `JSOp::IsNoIter` and `JSOp::EndIter`.
1367 *
1368 * Category: Objects
1369 * Type: Enumeration
1370 * Operands:
1371 * Stack: iter => iter, name
1373 MACRO(MoreIter, more_iter, NULL, 1, 1, 2, JOF_BYTE) \
1374 /*
1375 * Test whether the value on top of the stack is
1376 * `MagicValue(JS_NO_ITER_VALUE)` and push the boolean result.
1377 *
1378 * Category: Objects
1379 * Type: Enumeration
1380 * Operands:
1381 * Stack: val => val, done
1383 MACRO(IsNoIter, is_no_iter, NULL, 1, 1, 2, JOF_BYTE) \
1384 /*
1385 * Exit a for-in loop, closing the iterator.
1386 *
1387 * `iter` must be a `PropertyIteratorObject` pushed by `JSOp::Iter`.
1388 *
1389 * Category: Objects
1390 * Type: Enumeration
1391 * Operands:
1392 * Stack: iter, iterval =>
1394 MACRO(EndIter, end_iter, NULL, 1, 2, 0, JOF_BYTE) \
1395 /*
1396 * If the iterator object on top of the stack has a `return` method,
1397 * call that method. If the method exists but does not return an object,
1398 * and `kind` is not `CompletionKind::Throw`, throw a TypeError. (If
1399 * `kind` is `Throw`, the error we are already throwing takes precedence.)
1400 *
1401 * `iter` must be an object conforming to the [Iterator][1] interface.
1402 *
1403 * Implements: [IteratorClose][2]
1404 *
1405 * [1]: https://tc39.es/ecma262/#sec-iterator-interface
1406 * [2]: https://tc39.es/ecma262/#sec-iteratorclose
1407 * Category: Objects
1408 * Type: Iteration
1409 * Operands: CompletionKind kind
1410 * Stack: iter =>
1412 MACRO(CloseIter, close_iter, NULL, 2, 1, 0, JOF_UINT8|JOF_IC) \
1413 /*
1414 * If we can optimize iteration for `iterable`, meaning that it is a packed
1415 * array and nothing important has been tampered with, then we replace it
1416 * with `true`, otherwise we replace it with `false`. This is similar in
1417 * operation to OptimizeSpreadCall.
1418 *
1419 * Category: Objects
1420 * Type: Iteration
1421 * Operands:
1422 * Stack: iterable => is_optimizable
1424 MACRO(OptimizeGetIterator, optimize_get_iterator, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
1425 /*
1426 * Check that the top value on the stack is an object, and throw a
1427 * TypeError if not. `kind` is used only to generate an appropriate error
1428 * message.
1429 *
1430 * Implements: [GetIterator][1] step 5, [IteratorNext][2] step 3. Both
1431 * operations call a JS method which scripts can define however they want,
1432 * so they check afterwards that the method returned an object.
1433 *
1434 * [1]: https://tc39.es/ecma262/#sec-getiterator
1435 * [2]: https://tc39.es/ecma262/#sec-iteratornext
1436 *
1437 * Category: Objects
1438 * Type: Iteration
1439 * Operands: CheckIsObjectKind kind
1440 * Stack: result => result
1442 MACRO(CheckIsObj, check_is_obj, NULL, 2, 1, 1, JOF_UINT8) \
1443 /*
1444 * Throw a TypeError if `val` is `null` or `undefined`.
1445 *
1446 * Implements: [RequireObjectCoercible][1]. But most instructions that
1447 * require an object will perform this check for us, so of the dozens of
1448 * calls to RequireObjectCoercible in the spec, we need this instruction
1449 * only for [destructuring assignment][2] and [initialization][3].
1450 *
1451 * [1]: https://tc39.es/ecma262/#sec-requireobjectcoercible
1452 * [2]: https://tc39.es/ecma262/#sec-runtime-semantics-destructuringassignmentevaluation
1453 * [3]: https://tc39.es/ecma262/#sec-destructuring-binding-patterns-runtime-semantics-bindinginitialization
1454 *
1455 * Category: Objects
1456 * Type: Iteration
1457 * Operands:
1458 * Stack: val => val
1460 MACRO(CheckObjCoercible, check_obj_coercible, NULL, 1, 1, 1, JOF_BYTE) \
1461 /*
1462 * Create and push an async iterator wrapping the sync iterator `iter`.
1463 * `next` should be `iter`'s `.next` method.
1464 *
1465 * Implements: [CreateAsyncToSyncIterator][1]. The spec says this operation
1466 * takes one argument, but that argument is a Record with two relevant
1467 * fields, `[[Iterator]]` and `[[NextMethod]]`.
1468 *
1469 * Used for `for await` loops.
1470 *
1471 * [1]: https://tc39.es/ecma262/#sec-createasyncfromsynciterator
1472 *
1473 * Category: Objects
1474 * Type: Iteration
1475 * Operands:
1476 * Stack: iter, next => asynciter
1478 MACRO(ToAsyncIter, to_async_iter, NULL, 1, 2, 1, JOF_BYTE) \
1479 /*
1480 * Set the prototype of `obj`.
1481 *
1482 * `obj` must be an object.
1483 *
1484 * Implements: [B.3.1 __proto__ Property Names in Object Initializers][1], step 7.a.
1485 *
1486 * [1]: https://tc39.es/ecma262/#sec-__proto__-property-names-in-object-initializers
1487 *
1488 * Category: Objects
1489 * Type: SetPrototype
1490 * Operands:
1491 * Stack: obj, protoVal => obj
1493 MACRO(MutateProto, mutate_proto, NULL, 1, 2, 1, JOF_BYTE) \
1494 /*
1495 * Create and push a new Array object with the given `length`,
1496 * preallocating enough memory to hold that many elements.
1497 *
1498 * Category: Objects
1499 * Type: Array literals
1500 * Operands: uint32_t length
1501 * Stack: => array
1503 MACRO(NewArray, new_array, NULL, 5, 0, 1, JOF_UINT32|JOF_IC) \
1504 /*
1505 * Initialize an array element `array[index]` with value `val`.
1506 *
1507 * `val` may be `MagicValue(JS_ELEMENTS_HOLE)` pushed by `JSOp::Hole`.
1508 *
1509 * This never calls setters or proxy traps.
1510 *
1511 * `array` must be an Array object created by `JSOp::NewArray` with length >
1512 * `index`, and never used except by `JSOp::InitElemArray`.
1513 *
1514 * Implements: [ArrayAccumulation][1], the third algorithm, step 4, in the
1515 * common case where *nextIndex* is known.
1516 *
1517 * [1]: https://tc39.es/ecma262/#sec-runtime-semantics-arrayaccumulation
1518 *
1519 * Category: Objects
1520 * Type: Array literals
1521 * Operands: uint32_t index
1522 * Stack: array, val => array
1524 MACRO(InitElemArray, init_elem_array, NULL, 5, 2, 1, JOF_UINT32|JOF_ELEM|JOF_PROPINIT) \
1525 /*
1526 * Initialize an array element `array[index++]` with value `val`.
1527 *
1528 * `val` may be `MagicValue(JS_ELEMENTS_HOLE)` pushed by `JSOp::Hole`. If it
1529 * is, no element is defined, but the array length and the stack value
1530 * `index` are still incremented.
1531 *
1532 * This never calls setters or proxy traps.
1533 *
1534 * `array` must be an Array object created by `JSOp::NewArray` and never used
1535 * except by `JSOp::InitElemArray` and `JSOp::InitElemInc`.
1536 *
1537 * `index` must be an integer, `0 <= index <= INT32_MAX`. If `index` is
1538 * `INT32_MAX`, this throws a RangeError. Unlike `InitElemArray`, it is not
1539 * necessary that the `array` length > `index`.
1540 *
1541 * This instruction is used when an array literal contains a
1542 * *SpreadElement*. In `[a, ...b, c]`, `InitElemArray 0` is used to put
1543 * `a` into the array, but `InitElemInc` is used for the elements of `b`
1544 * and for `c`.
1545 *
1546 * Implements: Several steps in [ArrayAccumulation][1] that call
1547 * CreateDataProperty, set the array length, and/or increment *nextIndex*.
1548 *
1549 * [1]: https://tc39.es/ecma262/#sec-runtime-semantics-arrayaccumulation
1550 *
1551 * Category: Objects
1552 * Type: Array literals
1553 * Operands:
1554 * Stack: array, index, val => array, (index + 1)
1556 MACRO(InitElemInc, init_elem_inc, NULL, 1, 3, 2, JOF_BYTE|JOF_ELEM|JOF_PROPINIT|JOF_IC) \
1557 /*
1558 * Push `MagicValue(JS_ELEMENTS_HOLE)`, representing an *Elision* in an
1559 * array literal (like the missing property 0 in the array `[, 1]`).
1560 *
1561 * This magic value must be used only by `JSOp::InitElemArray` or
1562 * `JSOp::InitElemInc`.
1563 *
1564 * Category: Objects
1565 * Type: Array literals
1566 * Operands:
1567 * Stack: => hole
1569 MACRO(Hole, hole, NULL, 1, 0, 1, JOF_BYTE) \
1570 /*
1571 * Clone and push a new RegExp object.
1572 *
1573 * Implements: [Evaluation for *RegularExpressionLiteral*][1].
1574 *
1575 * [1]: https://tc39.es/ecma262/#sec-regular-expression-literals-runtime-semantics-evaluation
1576 *
1577 * Category: Objects
1578 * Type: RegExp literals
1579 * Operands: uint32_t regexpIndex
1580 * Stack: => regexp
1582 MACRO(RegExp, reg_exp, NULL, 5, 0, 1, JOF_REGEXP) \
1583 /*
1584 * Initialize a new record, preallocating `length` memory slots. `length` can still grow
1585 * if needed, for example when using the spread operator.
1586 *
1587 * Implements: [RecordLiteral Evaluation][1] step 1.
1588 *
1589 * [1]: https://tc39.es/proposal-record-tuple/#sec-record-initializer-runtime-semantics-evaluation
1590 *
1591 * Category: Compound primitives
1592 * Type: Record literals
1593 * Operands: uint32_t length
1594 * Stack: => rval
1596 IF_RECORD_TUPLE(MACRO(InitRecord, init_record, NULL, 5, 0, 1, JOF_UINT32)) \
1597 /*
1598 * Add the last element in the stack to the preceding tuple.
1599 *
1600 * Implements: [AddPropertyIntoRecordEntriesList][1].
1601 *
1602 * [1]: https://tc39.es/proposal-record-tuple/#sec-addpropertyintorecordentrieslist
1603 *
1604 * Category: Compound primitives
1605 * Type: Record literals
1606 * Operands:
1607 * Stack: record, key, value => record
1609 IF_RECORD_TUPLE(MACRO(AddRecordProperty, add_record_property, NULL, 1, 3, 1, JOF_BYTE)) \
1610 /*
1611 * Add the last element in the stack to the preceding tuple.
1612 *
1613 * Implements: [RecordPropertyDefinitionEvaluation][1] for
1614 * RecordPropertyDefinition : ... AssignmentExpression
1615 *
1616 * [1]: https://tc39.es/proposal-record-tuple/#sec-addpropertyintorecordentrieslist
1617 *
1618 * Category: Compound primitives
1619 * Type: Record literals
1620 * Operands:
1621 * Stack: record, value => record
1623 IF_RECORD_TUPLE(MACRO(AddRecordSpread, add_record_spread, NULL, 1, 2, 1, JOF_BYTE)) \
1624 /*
1625 * Mark a record as "initialized", going from "write-only" mode to
1626 * "read-only" mode.
1627 *
1628 * Category: Compound primitives
1629 * Type: Record literals
1630 * Operands:
1631 * Stack: record => record
1633 IF_RECORD_TUPLE(MACRO(FinishRecord, finish_record, NULL, 1, 1, 1, JOF_BYTE)) \
1634 /*
1635 * Initialize a new tuple, preallocating `length` memory slots. `length` can still grow
1636 * if needed, for example when using the spread operator.
1637 *
1638 * Implements: [TupleLiteral Evaluation][1] step 1.
1639 *
1640 * [1]: https://tc39.es/proposal-record-tuple/#sec-tuple-initializer-runtime-semantics-evaluation
1641 *
1642 * Category: Compound primitives
1643 * Type: Tuple literals
1644 * Operands: uint32_t length
1645 * Stack: => rval
1647 IF_RECORD_TUPLE(MACRO(InitTuple, init_tuple, NULL, 5, 0, 1, JOF_UINT32)) \
1648 /*
1649 * Add the last element in the stack to the preceding tuple.
1650 *
1651 * Implements: [AddValueToTupleSequenceList][1].
1652 *
1653 * [1]: https://tc39.es/proposal-record-tuple/#sec-addvaluetotuplesequencelist
1654 *
1655 * Category: Compound primitives
1656 * Type: Tuple literals
1657 * Operands:
1658 * Stack: tuple, element => tuple
1660 IF_RECORD_TUPLE(MACRO(AddTupleElement, add_tuple_element, NULL, 1, 2, 1, JOF_BYTE)) \
1661 /*
1662 * Mark a tuple as "initialized", going from "write-only" mode to
1663 * "read-only" mode.
1664 *
1665 * Category: Compound primitives
1666 * Type: Tuple literals
1667 * Operands:
1668 * Stack: tuple => tuple
1670 IF_RECORD_TUPLE(MACRO(FinishTuple, finish_tuple, NULL, 1, 1, 1, JOF_BYTE)) \
1671 /*
1672 * Push a new function object.
1673 *
1674 * The new function inherits the current environment chain.
1675 *
1676 * Used to create most JS functions. Notable exceptions are derived or
1677 * default class constructors.
1678 *
1679 * Implements: [InstantiateFunctionObject][1], [Evaluation for
1680 * *FunctionExpression*][2], and so on.
1681 *
1682 * [1]: https://tc39.es/ecma262/#sec-function-definitions-runtime-semantics-instantiatefunctionobject
1683 * [2]: https://tc39.es/ecma262/#sec-function-definitions-runtime-semantics-evaluation
1684 *
1685 * Category: Functions
1686 * Type: Creating functions
1687 * Operands: uint32_t funcIndex
1688 * Stack: => fn
1690 MACRO(Lambda, lambda, NULL, 5, 0, 1, JOF_OBJECT|JOF_USES_ENV) \
1691 /*
1692 * Set the name of a function.
1693 *
1694 * `fun` must be a function object. `name` must be a string, Int32 value,
1695 * or symbol (like the result of `JSOp::ToId`).
1696 *
1697 * Implements: [SetFunctionName][1], used e.g. to name methods with
1698 * computed property names.
1699 *
1700 * [1]: https://tc39.es/ecma262/#sec-setfunctionname
1701 *
1702 * Category: Functions
1703 * Type: Creating functions
1704 * Operands: FunctionPrefixKind prefixKind
1705 * Stack: fun, name => fun
1707 MACRO(SetFunName, set_fun_name, NULL, 2, 2, 1, JOF_UINT8) \
1708 /*
1709 * Initialize the home object for functions with super bindings.
1710 *
1711 * `fun` must be a method, getter, or setter, so that it has a
1712 * [[HomeObject]] slot. `homeObject` must be a plain object or (for static
1713 * methods) a constructor.
1714 *
1715 * Category: Functions
1716 * Type: Creating functions
1717 * Operands:
1718 * Stack: fun, homeObject => fun
1720 MACRO(InitHomeObject, init_home_object, NULL, 1, 2, 1, JOF_BYTE) \
1721 /*
1722 * Throw a TypeError if `baseClass` isn't either `null` or a constructor.
1723 *
1724 * Implements: [ClassDefinitionEvaluation][1] step 6.f.
1725 *
1726 * [1]: https://tc39.es/ecma262/#sec-runtime-semantics-classdefinitionevaluation
1727 *
1728 * Category: Functions
1729 * Type: Creating constructors
1730 * Operands:
1731 * Stack: baseClass => baseClass
1733 MACRO(CheckClassHeritage, check_class_heritage, NULL, 1, 1, 1, JOF_BYTE) \
1734 /*
1735 * Like `JSOp::Lambda`, but using `proto` as the new function's
1736 * `[[Prototype]]` (or `%FunctionPrototype%` if `proto` is `null`).
1737 *
1738 * `proto` must be either a constructor or `null`. We use
1739 * `JSOp::CheckClassHeritage` to check.
1740 *
1741 * This is used to create the constructor for a derived class.
1742 *
1743 * Implements: [ClassDefinitionEvaluation][1] steps 6.e.ii, 6.g.iii, and
1744 * 12 for derived classes.
1745 *
1746 * [1]: https://tc39.es/ecma262/#sec-runtime-semantics-classdefinitionevaluation
1747 *
1748 * Category: Functions
1749 * Type: Creating constructors
1750 * Operands: uint32_t funcIndex
1751 * Stack: proto => obj
1753 MACRO(FunWithProto, fun_with_proto, NULL, 5, 1, 1, JOF_OBJECT|JOF_USES_ENV) \
1754 /*
1755 * Pushes the current global's %BuiltinObject%.
1756 *
1757 * `kind` must be a valid `BuiltinObjectKind` (and must not be
1758 * `BuiltinObjectKind::None`).
1759 *
1760 * Category: Objects
1761 * Type: Built-in objects
1762 * Operands: uint8_t kind
1763 * Stack: => %BuiltinObject%
1765 MACRO(BuiltinObject, builtin_object, NULL, 2, 0, 1, JOF_UINT8) \
1766 /*
1767 * Invoke `callee` with `this` and `args`, and push the return value. Throw
1768 * a TypeError if `callee` isn't a function.
1769 *
1770 * `JSOp::CallContent` is for `callContentFunction` in self-hosted JS, and
1771 * this is for handling it differently in debugger's `onNativeCall` hook.
1772 * `onNativeCall` hook disables all JITs, and `JSOp::CallContent` is
1773 * treated exactly the same as `JSOP::Call` in JIT.
1774 *
1775 * `JSOp::CallIter` is used for implicit calls to @@iterator methods, to
1776 * ensure error messages are formatted with `JSMSG_NOT_ITERABLE` ("x is not
1777 * iterable") rather than `JSMSG_NOT_FUNCTION` ("x[Symbol.iterator] is not
1778 * a function"). The `argc` operand must be 0 for this variation.
1779 *
1780 * `JSOp::CallContentIter` is `JSOp::CallContent` variant of
1781 * `JSOp::CallIter`.
1782 *
1783 * `JSOp::CallIgnoresRv` hints to the VM that the return value is ignored.
1784 * This allows alternate faster implementations to be used that avoid
1785 * unnecesary allocations.
1786 *
1787 * Implements: [EvaluateCall][1] steps 4, 5, and 7.
1788 *
1789 * [1]: https://tc39.es/ecma262/#sec-evaluatecall
1790 *
1791 * Category: Functions
1792 * Type: Calls
1793 * Operands: uint16_t argc
1794 * Stack: callee, this, args[0], ..., args[argc-1] => rval
1796 MACRO(Call, call, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_IC) \
1797 MACRO(CallContent, call_content, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_IC) \
1798 MACRO(CallIter, call_iter, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_IC) \
1799 MACRO(CallContentIter, call_content_iter, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_IC) \
1800 MACRO(CallIgnoresRv, call_ignores_rv, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_IC) \
1801 /*
1802 * Like `JSOp::Call`, but the arguments are provided in an array rather than
1803 * a span of stack slots. Used to implement spread-call syntax:
1804 * `f(...args)`.
1805 *
1806 * `args` must be an Array object containing the actual arguments. The
1807 * array must be packed (dense and free of holes; see IsPackedArray).
1808 * This can be ensured by creating the array with `JSOp::NewArray` and
1809 * populating it using `JSOp::InitElemArray`.
1810 *
1811 * Category: Functions
1812 * Type: Calls
1813 * Operands:
1814 * Stack: callee, this, args => rval
1816 MACRO(SpreadCall, spread_call, NULL, 1, 3, 1, JOF_BYTE|JOF_INVOKE|JOF_SPREAD|JOF_IC) \
1817 /*
1818 * Push an array object that can be passed directly as the `args` argument
1819 * to `JSOp::SpreadCall`. If the operation can't be optimized, push
1820 * `undefined` instead.
1821 *
1822 * This instruction and the branch around the iterator loop are emitted
1823 * only when `iterable` is the sole argument in a call, as in `f(...arr)`.
1824 *
1825 * See `js::OptimizeSpreadCall`.
1826 *
1827 * Category: Functions
1828 * Type: Calls
1829 * Operands:
1830 * Stack: iterable => array_or_undefined
1832 MACRO(OptimizeSpreadCall, optimize_spread_call, NULL, 1, 1, 1, JOF_BYTE|JOF_IC) \
1833 /*
1834 * Perform a direct eval in the current environment if `callee` is the
1835 * builtin `eval` function, otherwise follow same behaviour as `JSOp::Call`.
1836 *
1837 * All direct evals use one of the JSOp::*Eval instructions here and these
1838 * opcodes are only used when the syntactic conditions for a direct eval
1839 * are met. If the builtin `eval` function is called though other means, it
1840 * becomes an indirect eval.
1841 *
1842 * Direct eval causes all bindings in *enclosing* non-global scopes to be
1843 * marked "aliased". The optimization that puts bindings in stack slots has
1844 * to prove that the bindings won't need to be captured by closures or
1845 * accessed using `JSOp::{Get,Bind,Set,Del}Name` instructions. Direct eval
1846 * makes that analysis impossible.
1847 *
1848 * The instruction immediately following any `JSOp::*Eval` instruction must
1849 * be `JSOp::Lineno`.
1850 *
1851 * Implements: [Function Call Evaluation][1], steps 5-7 and 9, when the
1852 * syntactic critera for direct eval in step 6 are all met.
1853 *
1854 * [1]: https://tc39.es/ecma262/#sec-function-calls-runtime-semantics-evaluation
1855 *
1856 * Category: Functions
1857 * Type: Calls
1858 * Operands: uint16_t argc
1859 * Stack: callee, this, args[0], ..., args[argc-1] => rval
1861 MACRO(Eval, eval, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_CHECKSLOPPY|JOF_IC) \
1862 /*
1863 * Spread-call variant of `JSOp::Eval`.
1864 *
1865 * See `JSOp::SpreadCall` for restrictions on `args`.
1866 *
1867 * Category: Functions
1868 * Type: Calls
1869 * Operands:
1870 * Stack: callee, this, args => rval
1872 MACRO(SpreadEval, spread_eval, NULL, 1, 3, 1, JOF_BYTE|JOF_INVOKE|JOF_SPREAD|JOF_CHECKSLOPPY|JOF_IC) \
1873 /*
1874 * Like `JSOp::Eval`, but for strict mode code.
1875 *
1876 * Category: Functions
1877 * Type: Calls
1878 * Operands: uint16_t argc
1879 * Stack: evalFn, this, args[0], ..., args[argc-1] => rval
1881 MACRO(StrictEval, strict_eval, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_CHECKSTRICT|JOF_IC) \
1882 /*
1883 * Spread-call variant of `JSOp::StrictEval`.
1884 *
1885 * See `JSOp::SpreadCall` for restrictions on `args`.
1886 *
1887 * Category: Functions
1888 * Type: Calls
1889 * Operands:
1890 * Stack: callee, this, args => rval
1892 MACRO(StrictSpreadEval, strict_spread_eval, NULL, 1, 3, 1, JOF_BYTE|JOF_INVOKE|JOF_SPREAD|JOF_CHECKSTRICT|JOF_IC) \
1893 /*
1894 * Push the implicit `this` value for an unqualified function call, like
1895 * `foo()`. `nameIndex` gives the name of the function we're calling.
1896 *
1897 * The result is always `undefined` except when the name refers to a `with`
1898 * binding. For example, in `with (date) { getFullYear(); }`, the
1899 * implicit `this` passed to `getFullYear` is `date`, not `undefined`.
1900 *
1901 * This walks the run-time environment chain looking for the environment
1902 * record that contains the function. If the function call definitely
1903 * refers to a local binding, use `JSOp::Undefined`.
1904 *
1905 * Implements: [EvaluateCall][1] step 1.b. But not entirely correctly.
1906 * See [bug 1166408][2].
1907 *
1908 * [1]: https://tc39.es/ecma262/#sec-evaluatecall
1909 * [2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1166408
1910 *
1911 * Category: Functions
1912 * Type: Calls
1913 * Operands: uint32_t nameIndex
1914 * Stack: => this
1917 /*
1918 * Push the call site object for a tagged template call.
1919 *
1920 * `script->getObject(objectIndex)` is the call site object.
1921 *
1922 * The call site object will already have the `.raw` property defined on it
1923 * and will be frozen.
1924 *
1925 * Category: Functions
1926 * Type: Calls
1927 * Operands: uint32_t objectIndex
1928 * Stack: => callSiteObj
1930 MACRO(CallSiteObj, call_site_obj, NULL, 5, 0, 1, JOF_OBJECT) \
1931 /*
1932 * Push `MagicValue(JS_IS_CONSTRUCTING)`.
1933 *
1934 * This magic value is a required argument to the `JSOp::New` and
1935 * `JSOp::SuperCall` instructions and must not be used any other way.
1936 *
1937 * Category: Functions
1938 * Type: Calls
1939 * Operands:
1940 * Stack: => JS_IS_CONSTRUCTING
1942 MACRO(IsConstructing, is_constructing, NULL, 1, 0, 1, JOF_BYTE) \
1943 /*
1944 * Invoke `callee` as a constructor with `args` and `newTarget`, and push
1945 * the return value. Throw a TypeError if `callee` isn't a constructor.
1946 *
1947 * `isConstructing` must be the value pushed by `JSOp::IsConstructing`.
1948 *
1949 * `JSOp::SuperCall` behaves exactly like `JSOp::New`, but is used for
1950 * *SuperCall* expressions, to allow JITs to distinguish them from `new`
1951 * expressions.
1952 *
1953 * `JSOp::NewContent` is for `constructContentFunction` in self-hosted JS.
1954 * See the comment for `JSOp::CallContent` for more details.
1955 *
1956 * Implements: [EvaluateConstruct][1] steps 7 and 8.
1957 *
1958 * [1]: https://tc39.es/ecma262/#sec-evaluatenew
1959 *
1960 * Category: Functions
1961 * Type: Calls
1962 * Operands: uint16_t argc
1963 * Stack: callee, isConstructing, args[0], ..., args[argc-1], newTarget => rval
1965 MACRO(New, new_, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_CONSTRUCT|JOF_IC) \
1966 MACRO(NewContent, new_content, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_CONSTRUCT|JOF_IC) \
1967 MACRO(SuperCall, super_call, NULL, 3, -1, 1, JOF_ARGC|JOF_INVOKE|JOF_CONSTRUCT|JOF_IC) \
1968 /*
1969 * Spread-call variant of `JSOp::New`.
1970 *
1971 * Invokes `callee` as a constructor with `args` and `newTarget`, and
1972 * pushes the return value onto the stack.
1973 *
1974 * `isConstructing` must be the value pushed by `JSOp::IsConstructing`.
1975 * See `JSOp::SpreadCall` for restrictions on `args`.
1976 *
1977 * `JSOp::SpreadSuperCall` behaves exactly like `JSOp::SpreadNew`, but is
1978 * used for *SuperCall* expressions.
1979 *
1980 * Category: Functions
1981 * Type: Calls
1982 * Operands:
1983 * Stack: callee, isConstructing, args, newTarget => rval
1985 MACRO(SpreadNew, spread_new, NULL, 1, 4, 1, JOF_BYTE|JOF_INVOKE|JOF_CONSTRUCT|JOF_SPREAD|JOF_IC) \
1986 MACRO(SpreadSuperCall, spread_super_call, NULL, 1, 4, 1, JOF_BYTE|JOF_INVOKE|JOF_CONSTRUCT|JOF_SPREAD|JOF_IC) \
1987 /*
1988 * Push the prototype of `callee` in preparation for calling `super()`.
1989 *
1990 * `callee` must be a derived class constructor.
1991 *
1992 * Implements: [GetSuperConstructor][1], steps 4-7.
1993 *
1994 * [1]: https://tc39.es/ecma262/#sec-getsuperconstructor
1995 *
1996 * Category: Functions
1997 * Type: Calls
1998 * Operands:
1999 * Stack: callee => superFun
2001 MACRO(SuperFun, super_fun, NULL, 1, 1, 1, JOF_BYTE) \
2002 /*
2003 * Throw a ReferenceError if `thisval` is not
2004 * `MagicValue(JS_UNINITIALIZED_LEXICAL)`. Used in derived class
2005 * constructors to prohibit calling `super` more than once.
2006 *
2007 * Implements: [BindThisValue][1], step 3.
2008 *
2009 * [1]: https://tc39.es/ecma262/#sec-bindthisvalue
2010 *
2011 * Category: Functions
2012 * Type: Calls
2013 * Operands:
2014 * Stack: thisval => thisval
2016 MACRO(CheckThisReinit, check_this_reinit, NULL, 1, 1, 1, JOF_BYTE) \
2017 /*
2018 * Create and push a generator object for the current frame.
2019 *
2020 * This instruction must appear only in scripts for generators, async
2021 * functions, and async generators. There must not already be a generator
2022 * object for the current frame (that is, this instruction must execute at
2023 * most once per generator or async call).
2024 *
2025 * Category: Functions
2026 * Type: Generators and async functions
2027 * Operands:
2028 * Stack: => gen
2030 MACRO(Generator, generator, NULL, 1, 0, 1, JOF_BYTE|JOF_USES_ENV) \
2031 /*
2032 * Suspend the current generator and return to the caller.
2033 *
2034 * When a generator is called, its script starts running, like any other JS
2035 * function, because [FunctionDeclarationInstantation][1] and other
2036 * [generator object setup][2] are implemented mostly in bytecode. However,
2037 * the *FunctionBody* of the generator is not supposed to start running
2038 * until the first `.next()` call, so after setup the script suspends
2039 * itself: the "initial yield".
2040 *
2041 * Later, when resuming execution, `rval`, `gen` and `resumeKind` will
2042 * receive the values passed in by `JSOp::Resume`. `resumeKind` is the
2043 * `GeneratorResumeKind` stored as an Int32 value.
2044 *
2045 * This instruction must appear only in scripts for generators and async
2046 * generators. `gen` must be the generator object for the current frame. It
2047 * must not have been previously suspended. The resume point indicated by
2048 * `resumeIndex` must be the next instruction in the script, which must be
2049 * `AfterYield`.
2050 *
2051 * Implements: [GeneratorStart][3], steps 4-7.
2052 *
2053 * [1]: https://tc39.es/ecma262/#sec-functiondeclarationinstantiation
2054 * [2]: https://tc39.es/ecma262/#sec-generator-function-definitions-runtime-semantics-evaluatebody
2055 * [3]: https://tc39.es/ecma262/#sec-generatorstart
2056 *
2057 * Category: Functions
2058 * Type: Generators and async functions
2059 * Operands: uint24_t resumeIndex
2060 * Stack: gen => rval, gen, resumeKind
2062 MACRO(InitialYield, initial_yield, NULL, 4, 1, 3, JOF_RESUMEINDEX) \
2063 /*
2064 * Bytecode emitted after `yield` expressions. This is useful for the
2065 * Debugger and `AbstractGeneratorObject::isAfterYieldOrAwait`. It's
2066 * treated as jump target op so that the Baseline Interpreter can
2067 * efficiently restore the frame's interpreterICEntry when resuming a
2068 * generator.
2069 *
2070 * The preceding instruction in the script must be `Yield`, `InitialYield`,
2071 * or `Await`.
2072 *
2073 * Category: Functions
2074 * Type: Generators and async functions
2075 * Operands: uint32_t icIndex
2076 * Stack: =>
2078 MACRO(AfterYield, after_yield, NULL, 5, 0, 0, JOF_ICINDEX) \
2079 /*
2080 * Suspend and close the current generator, async function, or async
2081 * generator.
2082 *
2083 * `gen` must be the generator object for the current frame.
2084 *
2085 * If the current function is a non-async generator, then the value in the
2086 * frame's return value slot is returned to the caller. It should be an
2087 * object of the form `{value: returnValue, done: true}`.
2088 *
2089 * If the current function is an async function or async generator, the
2090 * frame's return value slot must contain the current frame's result
2091 * promise, which must already be resolved or rejected.
2092 *
2093 * Category: Functions
2094 * Type: Generators and async functions
2095 * Operands:
2096 * Stack: gen =>
2098 MACRO(FinalYieldRval, final_yield_rval, NULL, 1, 1, 0, JOF_BYTE) \
2099 /*
2100 * Suspend execution of the current generator or async generator, returning
2101 * `rval1`.
2102 *
2103 * For non-async generators, `rval1` should be an object of the form
2104 * `{value: valueToYield, done: true}`. For async generators, `rval1`
2105 * should be the value to yield, and the caller is responsible for creating
2106 * the iterator result object (under `js::AsyncGeneratorYield`).
2107 *
2108 * This instruction must appear only in scripts for generators and async
2109 * generators. `gen` must be the generator object for the current stack
2110 * frame. The resume point indicated by `resumeIndex` must be the next
2111 * instruction in the script, which must be `AfterYield`.
2112 *
2113 * When resuming execution, `rval2`, `gen` and `resumeKind` receive the
2114 * values passed in by `JSOp::Resume`.
2115 *
2116 * Implements: [GeneratorYield][1] and [AsyncGeneratorYield][2].
2117 *
2118 * [1]: https://tc39.es/ecma262/#sec-generatoryield
2119 * [2]: https://tc39.es/ecma262/#sec-asyncgeneratoryield
2120 *
2121 * Category: Functions
2122 * Type: Generators and async functions
2123 * Operands: uint24_t resumeIndex
2124 * Stack: rval1, gen => rval2, gen, resumeKind
2126 MACRO(Yield, yield, NULL, 4, 2, 3, JOF_RESUMEINDEX) \
2127 /*
2128 * Pushes a boolean indicating whether the top of the stack is
2129 * `MagicValue(JS_GENERATOR_CLOSING)`.
2130 *
2131 * Category: Functions
2132 * Type: Generators and async functions
2133 * Operands:
2134 * Stack: val => val, res
2136 MACRO(IsGenClosing, is_gen_closing, NULL, 1, 1, 2, JOF_BYTE) \
2137 /*
2138 * Arrange for this async function to resume asynchronously when `value`
2139 * becomes resolved.
2140 *
2141 * This is the last thing an async function does before suspending for an
2142 * `await` expression. It coerces the awaited `value` to a promise and
2143 * effectively calls `.then()` on it, passing handler functions that will
2144 * resume this async function call later. See `js::AsyncFunctionAwait`.
2145 *
2146 * This instruction must appear only in non-generator async function
2147 * scripts. `gen` must be the internal generator object for the current
2148 * frame. After this instruction, the script should suspend itself with
2149 * `Await` (rather than exiting any other way).
2150 *
2151 * The result `promise` is the async function's result promise,
2152 * `gen->as<AsyncFunctionGeneratorObject>().promise()`.
2153 *
2154 * Implements: [Await][1], steps 2-9.
2155 *
2156 * [1]: https://tc39.github.io/ecma262/#await
2157 *
2158 * Category: Functions
2159 * Type: Generators and async functions
2160 * Operands:
2161 * Stack: value, gen => promise
2163 MACRO(AsyncAwait, async_await, NULL, 1, 2, 1, JOF_BYTE) \
2164 /*
2165 * Resolve or reject the current async function's result promise with
2166 * 'valueOrReason'.
2167 *
2168 * This instruction must appear only in non-generator async function
2169 * scripts. `gen` must be the internal generator object for the current
2170 * frame. This instruction must run at most once per async function call,
2171 * as resolving/rejecting an already resolved/rejected promise is not
2172 * permitted.
2173 *
2174 * The result `promise` is the async function's result promise,
2175 * `gen->as<AsyncFunctionGeneratorObject>().promise()`.
2176 *
2177 * Implements: [AsyncFunctionStart][1], step 4.d.i. and 4.e.i.
2178 *
2179 * [1]: https://tc39.es/ecma262/#sec-async-functions-abstract-operations-async-function-start
2180 *
2181 * Category: Functions
2182 * Type: Generators and async functions
2183 * Operands: AsyncFunctionResolveKind fulfillOrReject
2184 * Stack: valueOrReason, gen => promise
2186 MACRO(AsyncResolve, async_resolve, NULL, 2, 2, 1, JOF_UINT8) \
2187 /*
2188 * Suspend the current frame for an `await` expression.
2189 *
2190 * This instruction must appear only in scripts for async functions and
2191 * async generators. `gen` must be the internal generator object for the
2192 * current frame.
2193 *
2194 * This returns `promise` to the caller. Later, when this async call is
2195 * resumed, `resolved`, `gen` and `resumeKind` receive the values passed in
2196 * by `JSOp::Resume`, and execution continues at the next instruction,
2197 * which must be `AfterYield`.
2198 *
2199 * This instruction is used in two subtly different ways.
2200 *
2201 * 1. In async functions:
2202 *
2203 * ... # valueToAwait
2204 * GetAliasedVar ".generator" # valueToAwait gen
2205 * AsyncAwait # resultPromise
2206 * GetAliasedVar ".generator" # resultPromise gen
2207 * Await # resolved gen resumeKind
2208 * AfterYield
2209 *
2210 * `AsyncAwait` arranges for this frame to be resumed later and pushes
2211 * its result promise. `Await` then suspends the frame and removes it
2212 * from the stack, returning the result promise to the caller. (If this
2213 * async call hasn't awaited before, the caller may be user code.
2214 * Otherwise, the caller is self-hosted code using `resumeGenerator`.)
2215 *
2216 * 2. In async generators:
2217 *
2218 * ... # valueToAwait
2219 * GetAliasedVar ".generator" # valueToAwait gen
2220 * Await # resolved gen resumeKind
2221 * AfterYield
2222 *
2223 * `AsyncAwait` is not used, so (1) the value returned to the caller by
2224 * `Await` is `valueToAwait`, not `resultPromise`; and (2) the caller
2225 * is responsible for doing the async-generator equivalent of
2226 * `AsyncAwait` (namely, `js::AsyncGeneratorAwait`, called from
2227 * `js::AsyncGeneratorResume` after `js::CallSelfHostedFunction`
2228 * returns).
2229 *
2230 * Implements: [Await][1], steps 10-12.
2231 *
2232 * [1]: https://tc39.es/ecma262/#await
2233 *
2234 * Category: Functions
2235 * Type: Generators and async functions
2236 * Operands: uint24_t resumeIndex
2237 * Stack: promise, gen => resolved, gen, resumeKind
2239 MACRO(Await, await, NULL, 4, 2, 3, JOF_RESUMEINDEX) \
2240 /*
2241 * Test if the re-entry to the microtask loop may be skipped.
2242 *
2243 * This is part of an optimization for `await` expressions. Programs very
2244 * often await values that aren't promises, or promises that are already
2245 * resolved. We can then sometimes skip suspending the current frame and
2246 * returning to the microtask loop. If the circumstances permit the
2247 * optimization, `CanSkipAwait` pushes true if the optimization is allowed,
2248 * and false otherwise.
2249 *
2250 * Category: Functions
2251 * Type: Generators and async functions
2252 * Operands:
2253 * Stack: value => value, can_skip
2255 MACRO(CanSkipAwait, can_skip_await, NULL, 1, 1, 2, JOF_BYTE) \
2256 /*
2257 * Potentially extract an awaited value, if the await is skippable
2258 *
2259 * If re-entering the microtask loop is skippable (as checked by CanSkipAwait)
2260 * if can_skip is true, `MaybeExtractAwaitValue` replaces `value` with the result of the
2261 * `await` expression (unwrapping the resolved promise, if any). Otherwise, value remains
2262 * as is.
2263 *
2264 * In both cases, can_skip remains the same.
2265 *
2266 * Category: Functions
2267 * Type: Generators and async functions
2268 * Operands:
2269 * Stack: value, can_skip => value_or_resolved, can_skip
2271 MACRO(MaybeExtractAwaitValue, maybe_extract_await_value, NULL, 1, 2, 2, JOF_BYTE) \
2272 /*
2273 * Pushes one of the GeneratorResumeKind values as Int32Value.
2274 *
2275 * Category: Functions
2276 * Type: Generators and async functions
2277 * Operands: GeneratorResumeKind resumeKind (encoded as uint8_t)
2278 * Stack: => resumeKind
2280 MACRO(ResumeKind, resume_kind, NULL, 2, 0, 1, JOF_UINT8) \
2281 /*
2282 * Handle Throw and Return resumption.
2283 *
2284 * `gen` must be the generator object for the current frame. `resumeKind`
2285 * must be a `GeneratorResumeKind` stored as an `Int32` value. If it is
2286 * `Next`, continue to the next instruction. If `resumeKind` is `Throw` or
2287 * `Return`, these completions are handled by throwing an exception. See
2288 * `GeneratorThrowOrReturn`.
2289 *
2290 * Category: Functions
2291 * Type: Generators and async functions
2292 * Operands:
2293 * Stack: rval, gen, resumeKind => rval
2295 MACRO(CheckResumeKind, check_resume_kind, NULL, 1, 3, 1, JOF_BYTE) \
2296 /*
2297 * Resume execution of a generator, async function, or async generator.
2298 *
2299 * This behaves something like a call instruction. It pushes a stack frame
2300 * (the one saved when `gen` was suspended, rather than a fresh one) and
2301 * runs instructions in it. Once `gen` returns or yields, its return value
2302 * is pushed to this frame's stack and execution continues in this script.
2303 *
2304 * This instruction is emitted only for the `resumeGenerator` self-hosting
2305 * intrinsic. It is used in the implementation of
2306 * `%GeneratorPrototype%.next`, `.throw`, and `.return`.
2307 *
2308 * `gen` must be a suspended generator object. `resumeKind` must be in
2309 * range for `GeneratorResumeKind`.
2310 *
2311 * Category: Functions
2312 * Type: Generators and async functions
2313 * Operands:
2314 * Stack: gen, val, resumeKind => rval
2316 MACRO(Resume, resume, NULL, 1, 3, 1, JOF_BYTE|JOF_INVOKE) \
2317 /*
2318 * No-op instruction marking the target of a jump instruction.
2319 *
2320 * This instruction and a few others (see `js::BytecodeIsJumpTarget`) are
2321 * jump target instructions. The Baseline Interpreter uses these
2322 * instructions to sync the frame's `interpreterICEntry` after a jump. Ion
2323 * uses them to find block boundaries when translating bytecode to MIR.
2324 *
2325 * Category: Control flow
2326 * Type: Jump targets
2327 * Operands: uint32_t icIndex
2328 * Stack: =>
2330 MACRO(JumpTarget, jump_target, NULL, 5, 0, 0, JOF_ICINDEX) \
2331 /*
2332 * Marks the target of the backwards jump for some loop.
2333 *
2334 * This is a jump target instruction (see `JSOp::JumpTarget`). Additionally,
2335 * it checks for interrupts and handles JIT tiering.
2336 *
2337 * The `depthHint` operand is a loop depth hint for Ion. It starts at 1 and
2338 * deeply nested loops all have the same value.
2339 *
2340 * For the convenience of the JITs, scripts must not start with this
2341 * instruction. See bug 1602390.
2342 *
2343 * Category: Control flow
2344 * Type: Jump targets
2345 * Operands: uint32_t icIndex, uint8_t depthHint
2346 * Stack: =>
2348 MACRO(LoopHead, loop_head, NULL, 6, 0, 0, JOF_LOOPHEAD) \
2349 /*
2350 * Jump to a 32-bit offset from the current bytecode.
2351 *
2352 * See "Jump instructions" above for details.
2353 *
2354 * Category: Control flow
2355 * Type: Jumps
2356 * Operands: int32_t offset
2357 * Stack: =>
2359 MACRO(Goto, goto_, NULL, 5, 0, 0, JOF_JUMP) \
2360 /*
2361 * If ToBoolean(`cond`) is false, jumps to a 32-bit offset from the current
2362 * instruction.
2363 *
2364 * Category: Control flow
2365 * Type: Jumps
2366 * Operands: int32_t forwardOffset
2367 * Stack: cond =>
2369 MACRO(JumpIfFalse, jump_if_false, NULL, 5, 1, 0, JOF_JUMP|JOF_IC) \
2370 /*
2371 * If ToBoolean(`cond`) is true, jump to a 32-bit offset from the current
2372 * instruction.
2373 *
2374 * `offset` may be positive or negative. This is the instruction used at the
2375 * end of a do-while loop to jump back to the top.
2376 *
2377 * Category: Control flow
2378 * Type: Jumps
2379 * Operands: int32_t offset
2380 * Stack: cond =>
2382 MACRO(JumpIfTrue, jump_if_true, NULL, 5, 1, 0, JOF_JUMP|JOF_IC) \
2383 /*
2384 * Short-circuit for logical AND.
2385 *
2386 * If ToBoolean(`cond`) is false, jump to a 32-bit offset from the current
2387 * instruction. The value remains on the stack.
2388 *
2389 * Category: Control flow
2390 * Type: Jumps
2391 * Operands: int32_t forwardOffset
2392 * Stack: cond => cond
2394 MACRO(And, and_, NULL, 5, 1, 1, JOF_JUMP|JOF_IC) \
2395 /*
2396 * Short-circuit for logical OR.
2397 *
2398 * If ToBoolean(`cond`) is true, jump to a 32-bit offset from the current
2399 * instruction. The value remains on the stack.
2400 *
2401 * Category: Control flow
2402 * Type: Jumps
2403 * Operands: int32_t forwardOffset
2404 * Stack: cond => cond
2406 MACRO(Or, or_, NULL, 5, 1, 1, JOF_JUMP|JOF_IC) \
2407 /*
2408 * Short-circuiting for nullish coalescing.
2409 *
2410 * If `val` is not null or undefined, jump to a 32-bit offset from the
2411 * current instruction.
2412 *
2413 * Category: Control flow
2414 * Type: Jumps
2415 * Operands: int32_t forwardOffset
2416 * Stack: val => val
2418 MACRO(Coalesce, coalesce, NULL, 5, 1, 1, JOF_JUMP) \
2419 /*
2420 * Like `JSOp::JumpIfTrue`, but if the branch is taken, pop and discard an
2421 * additional stack value.
2422 *
2423 * This is used to implement `switch` statements when the
2424 * `JSOp::TableSwitch` optimization is not possible. The switch statement
2425 *
2426 * switch (expr) {
2427 * case A: stmt1;
2428 * case B: stmt2;
2429 * }
2430 *
2431 * compiles to this bytecode:
2432 *
2433 * # dispatch code - evaluate expr, check it against each `case`,
2434 * # jump to the right place in the body or to the end.
2435 * <expr>
2436 * Dup; <A>; StrictEq; Case L1; JumpTarget
2437 * Dup; <B>; StrictEq; Case L2; JumpTarget
2438 * Default LE
2439 *
2440 * # body code
2441 * L1: JumpTarget; <stmt1>
2442 * L2: JumpTarget; <stmt2>
2443 * LE: JumpTarget
2444 *
2445 * This opcode is weird: it's the only one whose ndefs varies depending on
2446 * which way a conditional branch goes. We could implement switch
2447 * statements using `JSOp::JumpIfTrue` and `JSOp::Pop`, but that would also
2448 * be awkward--putting the `JSOp::Pop` inside the `switch` body would
2449 * complicate fallthrough.
2450 *
2451 * Category: Control flow
2452 * Type: Jumps
2453 * Operands: int32_t forwardOffset
2454 * Stack: val, cond => val (if !cond)
2456 MACRO(Case, case_, NULL, 5, 2, 1, JOF_JUMP) \
2457 /*
2458 * Like `JSOp::Goto`, but pop and discard an additional stack value.
2459 *
2460 * This appears after all cases for a non-optimized `switch` statement. If
2461 * there's a `default:` label, it jumps to that point in the body;
2462 * otherwise it jumps to the next statement.
2463 *
2464 * Category: Control flow
2465 * Type: Jumps
2466 * Operands: int32_t forwardOffset
2467 * Stack: lval =>
2469 MACRO(Default, default_, NULL, 5, 1, 0, JOF_JUMP) \
2470 /*
2471 * Optimized switch-statement dispatch, used when all `case` labels are
2472 * small integer constants.
2473 *
2474 * If `low <= i <= high`, jump to the instruction at the offset given by
2475 * `script->resumeOffsets()[firstResumeIndex + i - low]`, in bytes from the
2476 * start of the current script's bytecode. Otherwise, jump to the
2477 * instruction at `defaultOffset` from the current instruction. All of
2478 * these offsets must be in range for the current script and must point to
2479 * `JSOp::JumpTarget` instructions.
2480 *
2481 * The following inequalities must hold: `low <= high` and
2482 * `firstResumeIndex + high - low < resumeOffsets().size()`.
2483 *
2484 * Category: Control flow
2485 * Type: Jumps
2486 * Operands: int32_t defaultOffset, int32_t low, int32_t high,
2487 * uint24_t firstResumeIndex
2488 * Stack: i =>
2490 MACRO(TableSwitch, table_switch, NULL, 16, 1, 0, JOF_TABLESWITCH) \
2491 /*
2492 * Return `rval`.
2493 *
2494 * This must not be used in derived class constructors. Instead use
2495 * `JSOp::SetRval`, `JSOp::CheckReturn`, and `JSOp::RetRval`.
2496 *
2497 * Category: Control flow
2498 * Type: Return
2499 * Operands:
2500 * Stack: rval =>
2502 MACRO(Return, return_, NULL, 1, 1, 0, JOF_BYTE) \
2503 /*
2504 * Push the current stack frame's `returnValue`. If no `JSOp::SetRval`
2505 * instruction has been executed in this stack frame, this is `undefined`.
2506 *
2507 * Every stack frame has a `returnValue` slot, used by top-level scripts,
2508 * generators, async functions, and derived class constructors. Plain
2509 * functions usually use `JSOp::Return` instead.
2510 *
2511 * Category: Control flow
2512 * Type: Return
2513 * Operands:
2514 * Stack: => rval
2516 MACRO(GetRval, get_rval, NULL, 1, 0, 1, JOF_BYTE) \
2517 /*
2518 * Store `rval` in the current stack frame's `returnValue` slot.
2519 *
2520 * This instruction must not be used in a toplevel script compiled with the
2521 * `noScriptRval` option.
2522 *
2523 * Category: Control flow
2524 * Type: Return
2525 * Operands:
2526 * Stack: rval =>
2528 MACRO(SetRval, set_rval, NULL, 1, 1, 0, JOF_BYTE) \
2529 /*
2530 * Stop execution and return the current stack frame's `returnValue`. If no
2531 * `JSOp::SetRval` instruction has been executed in this stack frame, this
2532 * is `undefined`.
2533 *
2534 * Also emitted at end of every script so consumers don't need to worry
2535 * about running off the end.
2536 *
2537 * If the current script is a derived class constructor, `returnValue` must
2538 * be an object. The script can use `JSOp::CheckReturn` to ensure this.
2539 *
2540 * Category: Control flow
2541 * Type: Return
2542 * Operands:
2543 * Stack: =>
2545 MACRO(RetRval, ret_rval, NULL, 1, 0, 0, JOF_BYTE) \
2546 /*
2547 * Check the return value in a derived class constructor.
2548 *
2549 * - If the current stack frame's `returnValue` is an object, push
2550 * `returnValue` onto the stack.
2551 *
2552 * - Otherwise, if the `returnValue` is undefined and `thisval` is an
2553 * object, push `thisval` onto the stack.
2554 *
2555 * - Otherwise, throw a TypeError.
2556 *
2557 * This is exactly what has to happen when a derived class constructor
2558 * returns. `thisval` should be the current value of `this`, or
2559 * `MagicValue(JS_UNINITIALIZED_LEXICAL)` if `this` is uninitialized.
2560 *
2561 * Implements: [The [[Construct]] internal method of JS functions][1],
2562 * steps 13 and 15.
2563 *
2564 * [1]: https://tc39.es/ecma262/#sec-ecmascript-function-objects-construct-argumentslist-newtarget
2565 *
2566 * Category: Control flow
2567 * Type: Return
2568 * Operands:
2569 * Stack: thisval => rval
2571 MACRO(CheckReturn, check_return, NULL, 1, 1, 1, JOF_BYTE) \
2572 /*
2573 * Throw `exc`. (ノಠ益ಠ)ノ彡┴──┴
2574 *
2575 * This sets the pending exception to `exc` and jumps to error-handling
2576 * code. If we're in a `try` block, error handling adjusts the stack and
2577 * environment chain and resumes execution at the top of the `catch` or
2578 * `finally` block. Otherwise it starts unwinding the stack.
2579 *
2580 * Implements: [*ThrowStatement* Evaluation][1], step 3.
2581 *
2582 * This is also used in for-of loops. If the body of the loop throws an
2583 * exception, we catch it, close the iterator, then use `JSOp::Throw` to
2584 * rethrow.
2585 *
2586 * [1]: https://tc39.es/ecma262/#sec-throw-statement-runtime-semantics-evaluation
2587 *
2588 * Category: Control flow
2589 * Type: Exceptions
2590 * Operands:
2591 * Stack: exc =>
2593 MACRO(Throw, throw_, NULL, 1, 1, 0, JOF_BYTE) \
2594 /*
2595 * Create and throw an Error object.
2596 *
2597 * Sometimes we know at emit time that an operation always throws. For
2598 * example, `delete super.prop;` is allowed in methods, but always throws a
2599 * ReferenceError.
2600 *
2601 * `msgNumber` determines the `.message` and [[Prototype]] of the new Error
2602 * object. It must be an error number in js/public/friend/ErrorNumbers.msg.
2603 * The number of arguments in the error message must be 0.
2604 *
2605 * Category: Control flow
2606 * Type: Exceptions
2607 * Operands: ThrowMsgKind msgNumber
2608 * Stack: =>
2610 MACRO(ThrowMsg, throw_msg, NULL, 2, 0, 0, JOF_UINT8) \
2611 /*
2612 * Throws a runtime TypeError for invalid assignment to a `const` binding.
2613 *
2614 * Category: Control flow
2615 * Type: Exceptions
2616 * Operands: uint32_t nameIndex
2617 * Stack:
2619 MACRO(ThrowSetConst, throw_set_const, NULL, 5, 0, 0, JOF_ATOM|JOF_NAME) \
2620 /*
2621 * No-op instruction that marks the top of the bytecode for a
2622 * *TryStatement*.
2623 *
2624 * Location information for catch/finally blocks is stored in a side table,
2625 * `script->trynotes()`.
2626 *
2627 * Category: Control flow
2628 * Type: Exceptions
2629 * Operands:
2630 * Stack: =>
2632 MACRO(Try, try_, NULL, 1, 0, 0, JOF_BYTE) \
2633 /*
2634 * No-op instruction used by the exception unwinder to determine the
2635 * correct environment to unwind to when performing IteratorClose due to
2636 * destructuring.
2637 *
2638 * This instruction must appear immediately before each
2639 * `JSTRY_DESTRUCTURING` span in a script's try notes.
2640 *
2641 * Category: Control flow
2642 * Type: Exceptions
2643 * Operands:
2644 * Stack: =>
2646 MACRO(TryDestructuring, try_destructuring, NULL, 1, 0, 0, JOF_BYTE) \
2647 /*
2648 * Push and clear the pending exception. ┬──┬◡ﾉ(° -°ﾉ)
2649 *
2650 * This must be used only in the fixed sequence of instructions following a
2651 * `JSTRY_CATCH` span (see "Bytecode Invariants" above), as that's the only
2652 * way instructions would run with an exception pending.
2653 *
2654 * Used to implement catch-blocks, including the implicit ones generated as
2655 * part of for-of iteration.
2656 *
2657 * Category: Control flow
2658 * Type: Exceptions
2659 * Operands:
2660 * Stack: => exception
2662 MACRO(Exception, exception, NULL, 1, 0, 1, JOF_BYTE) \
2663 /*
2664 * No-op instruction that marks the start of a `finally` block.
2665 *
2666 * Category: Control flow
2667 * Type: Exceptions
2668 * Operands:
2669 * Stack: =>
2671 MACRO(Finally, finally, NULL, 1, 0, 0, JOF_BYTE) \
2672 /*
2673 * Push `MagicValue(JS_UNINITIALIZED_LEXICAL)`, a magic value used to mark
2674 * a binding as uninitialized.
2675 *
2676 * This magic value must be used only by `JSOp::InitLexical`.
2677 *
2678 * Category: Variables and scopes
2679 * Type: Initialization
2680 * Operands:
2681 * Stack: => uninitialized
2683 MACRO(Uninitialized, uninitialized, NULL, 1, 0, 1, JOF_BYTE) \
2684 /*
2685 * Initialize an optimized local lexical binding; or mark it as
2686 * uninitialized.
2687 *
2688 * This stores the value `v` in the fixed slot `localno` in the current
2689 * stack frame. If `v` is the magic value produced by `JSOp::Uninitialized`,
2690 * this marks the binding as uninitialized. Otherwise this initializes the
2691 * binding with value `v`.
2692 *
2693 * Implements: [CreateMutableBinding][1] step 3, substep "record that it is
2694 * uninitialized", and [InitializeBinding][2], for optimized locals. (Note:
2695 * this is how `const` bindings are initialized.)
2696 *
2697 * [1]: https://tc39.es/ecma262/#sec-declarative-environment-records-createmutablebinding-n-d
2698 * [2]: https://tc39.es/ecma262/#sec-declarative-environment-records-initializebinding-n-v
2699 *
2700 * Category: Variables and scopes
2701 * Type: Initialization
2702 * Operands: uint24_t localno
2703 * Stack: v => v
2705 MACRO(InitLexical, init_lexical, NULL, 4, 1, 1, JOF_LOCAL|JOF_NAME) \
2706 /*
2707 * Initialize a global lexical binding.
2708 *
2709 * The binding must already have been created by
2710 * `GlobalOrEvalDeclInstantiation` and must be uninitialized.
2711 *
2712 * Like `JSOp::InitLexical` but for global lexicals. Unlike `InitLexical`
2713 * this can't be used to mark a binding as uninitialized.
2714 *
2715 * Category: Variables and scopes
2716 * Type: Initialization
2717 * Operands: uint32_t nameIndex
2718 * Stack: val => val
2720 MACRO(InitGLexical, init_g_lexical, NULL, 5, 1, 1, JOF_ATOM|JOF_NAME|JOF_PROPINIT|JOF_GNAME|JOF_IC) \
2721 /*
2722 * Initialize an aliased lexical binding; or mark it as uninitialized.
2723 *
2724 * Like `JSOp::InitLexical` but for aliased bindings.
2725 *
2726 * Note: There is no even-less-optimized `InitName` instruction because JS
2727 * doesn't need it. We always know statically which binding we're
2728 * initializing.
2729 *
2730 * `hops` is usually 0, but in `function f(a=eval("var b;")) { }`, the
2731 * argument `a` is initialized from inside a nested scope, so `hops == 1`.
2732 *
2733 * Category: Variables and scopes
2734 * Type: Initialization
2735 * Operands: uint8_t hops, uint24_t slot
2736 * Stack: v => v
2738 MACRO(InitAliasedLexical, init_aliased_lexical, NULL, 5, 1, 1, JOF_ENVCOORD|JOF_NAME|JOF_PROPINIT) \
2739 /*
2740 * Throw a ReferenceError if the value on top of the stack is uninitialized.
2741 *
2742 * Typically used after `JSOp::GetLocal` with the same `localno`.
2743 *
2744 * Implements: [GetBindingValue][1] step 3 and [SetMutableBinding][2] step
2745 * 4 for declarative Environment Records.
2746 *
2747 * [1]: https://tc39.es/ecma262/#sec-declarative-environment-records-getbindingvalue-n-s
2748 * [2]: https://tc39.es/ecma262/#sec-declarative-environment-records-setmutablebinding-n-v-s
2749 *
2750 * Category: Variables and scopes
2751 * Type: Initialization
2752 * Operands: uint24_t localno
2753 * Stack: v => v
2755 MACRO(CheckLexical, check_lexical, NULL, 4, 1, 1, JOF_LOCAL|JOF_NAME) \
2756 /*
2757 * Like `JSOp::CheckLexical` but for aliased bindings.
2758 *
2759 * Typically used after `JSOp::GetAliasedVar` with the same hops/slot.
2760 *
2761 * Note: There are no `CheckName` or `CheckGName` instructions because
2762 * they're unnecessary. `JSOp::{Get,Set}{Name,GName}` all check for
2763 * uninitialized lexicals and throw if needed.
2764 *
2765 * Category: Variables and scopes
2766 * Type: Initialization
2767 * Operands: uint8_t hops, uint24_t slot
2768 * Stack: v => v
2770 MACRO(CheckAliasedLexical, check_aliased_lexical, NULL, 5, 1, 1, JOF_ENVCOORD|JOF_NAME) \
2771 /*
2772 * Throw a ReferenceError if the value on top of the stack is
2773 * `MagicValue(JS_UNINITIALIZED_LEXICAL)`. Used in derived class
2774 * constructors to check `this` (which needs to be initialized before use,
2775 * by calling `super()`).
2776 *
2777 * Implements: [GetThisBinding][1] step 3.
2778 *
2779 * [1]: https://tc39.es/ecma262/#sec-function-environment-records-getthisbinding
2780 *
2781 * Category: Variables and scopes
2782 * Type: Initialization
2783 * Operands:
2784 * Stack: this => this
2786 MACRO(CheckThis, check_this, NULL, 1, 1, 1, JOF_BYTE) \
2787 /*
2788 * Look up a name on the global lexical environment's chain and push the
2789 * environment which contains a binding for that name. If no such binding
2790 * exists, push the global lexical environment.
2791 *
2792 * Category: Variables and scopes
2793 * Type: Looking up bindings
2794 * Operands: uint32_t nameIndex
2795 * Stack: => global
2797 MACRO(BindGName, bind_g_name, NULL, 5, 0, 1, JOF_ATOM|JOF_NAME|JOF_GNAME|JOF_IC) \
2798 /*
2799 * Look up a name on the environment chain and push the environment which
2800 * contains a binding for that name. If no such binding exists, push the
2801 * global lexical environment.
2802 *
2803 * Category: Variables and scopes
2804 * Type: Looking up bindings
2805 * Operands: uint32_t nameIndex
2806 * Stack: => env
2808 MACRO(BindName, bind_name, NULL, 5, 0, 1, JOF_ATOM|JOF_NAME|JOF_IC|JOF_USES_ENV) \
2809 /*
2810 * Find a binding on the environment chain and push its value.
2811 *
2812 * If the binding is an uninitialized lexical, throw a ReferenceError. If
2813 * no such binding exists, throw a ReferenceError unless the next
2814 * instruction is `JSOp::Typeof`, in which case push `undefined`.
2815 *
2816 * Implements: [ResolveBinding][1] followed by [GetValue][2]
2817 * (adjusted hackily for `typeof`).
2818 *
2819 * This is the fallback `Get` instruction that handles all unoptimized
2820 * cases. Optimized instructions follow.
2821 *
2822 * [1]: https://tc39.es/ecma262/#sec-resolvebinding
2823 * [2]: https://tc39.es/ecma262/#sec-getvalue
2824 *
2825 * Category: Variables and scopes
2826 * Type: Getting binding values
2827 * Operands: uint32_t nameIndex
2828 * Stack: => val
2830 MACRO(GetName, get_name, NULL, 5, 0, 1, JOF_ATOM|JOF_NAME|JOF_IC|JOF_USES_ENV) \
2831 /*
2832 * Find a global binding and push its value.
2833 *
2834 * This searches the global lexical environment and, failing that, the
2835 * global object. (Unlike most declarative environments, the global lexical
2836 * environment can gain more bindings after compilation, possibly shadowing
2837 * global object properties.)
2838 *
2839 * This is an optimized version of `JSOp::GetName` that skips all local
2840 * scopes, for use when the name doesn't refer to any local binding.
2841 * `NonSyntacticVariablesObject`s break this optimization, so if the
2842 * current script has a non-syntactic global scope, use `JSOp::GetName`
2843 * instead.
2844 *
2845 * Like `JSOp::GetName`, this throws a ReferenceError if no such binding is
2846 * found (unless the next instruction is `JSOp::Typeof`) or if the binding
2847 * is an uninitialized lexical.
2848 *
2849 * Category: Variables and scopes
2850 * Type: Getting binding values
2851 * Operands: uint32_t nameIndex
2852 * Stack: => val
2854 MACRO(GetGName, get_g_name, NULL, 5, 0, 1, JOF_ATOM|JOF_NAME|JOF_GNAME|JOF_IC) \
2855 /*
2856 * Push the value of an argument that is stored in the stack frame
2857 * or in an `ArgumentsObject`.
2858 *
2859 * Category: Variables and scopes
2860 * Type: Getting binding values
2861 * Operands: uint16_t argno
2862 * Stack: => arguments[argno]
2864 MACRO(GetArg, get_arg, NULL, 3, 0, 1, JOF_QARG|JOF_NAME) \
2865 /*
2866 * Push the value of an argument that is stored in the stack frame. Like
2867 * `JSOp::GetArg`, but ignores the frame's `ArgumentsObject` and doesn't
2868 * assert the argument is unaliased.
2869 *
2870 * Category: Variables and scopes
2871 * Type: Getting binding values
2872 * Operands: uint16_t argno
2873 * Stack: => arguments[argno]
2875 MACRO(GetFrameArg, get_frame_arg, NULL, 3, 0, 1, JOF_QARG|JOF_NAME) \
2876 /*
2877 * Push the value of an optimized local variable.
2878 *
2879 * If the variable is an uninitialized lexical, push
2880 * `MagicValue(JS_UNINIITALIZED_LEXICAL)`.
2881 *
2882 * Category: Variables and scopes
2883 * Type: Getting binding values
2884 * Operands: uint24_t localno
2885 * Stack: => val
2887 MACRO(GetLocal, get_local, NULL, 4, 0, 1, JOF_LOCAL|JOF_NAME) \
2888 /*
2889 * Push the number of actual arguments as Int32Value.
2890 *
2891 * This is emitted for the ArgumentsLength() intrinsic in self-hosted code.
2892 *
2893 * Category: Variables and scopes
2894 * Type: Getting binding values
2895 * Operands:
2896 * Stack: => arguments.length
2898 MACRO(ArgumentsLength, arguments_length, NULL, 1, 0, 1, JOF_BYTE) \
2899 /*
2900 * Push the value of an argument that is stored in the stack frame. The
2901 * value on top of the stack must be an Int32Value storing the index. The
2902 * index must be less than the number of actual arguments.
2903 *
2904 * This is emitted for the GetArgument(i) intrinsic in self-hosted code.
2905 *
2906 * Category: Variables and scopes
2907 * Type: Getting binding values
2908 * Operands:
2909 * Stack: index => arguments[index]
2911 MACRO(GetActualArg, get_actual_arg, NULL, 1, 1, 1, JOF_BYTE) \
2912 /*
2913 * Push the value of an aliased binding.
2914 *
2915 * Local bindings that aren't closed over or dynamically accessed are
2916 * stored in stack slots. Global and `with` bindings are object properties.
2917 * All other bindings are called "aliased" and stored in
2918 * `EnvironmentObject`s.
2919 *
2920 * Where possible, `Aliased` instructions are used to access aliased
2921 * bindings. (There's no difference in meaning between `AliasedVar` and
2922 * `AliasedLexical`.) Each of these instructions has operands `hops` and
2923 * `slot` that encode an [`EnvironmentCoordinate`][1], directions to the
2924 * binding from the current environment object.
2925 *
2926 * `Aliased` instructions can't be used when there's a dynamic scope (due
2927 * to non-strict `eval` or `with`) that might shadow the aliased binding.
2928 *
2929 * [1]: https://searchfox.org/mozilla-central/search?q=symbol:T_js%3A%3AEnvironmentCoordinate
2930 *
2931 * Category: Variables and scopes
2932 * Type: Getting binding values
2933 * Operands: uint8_t hops, uint24_t slot
2934 * Stack: => aliasedVar
2936 MACRO(GetAliasedVar, get_aliased_var, NULL, 5, 0, 1, JOF_ENVCOORD|JOF_NAME|JOF_USES_ENV) \
2937 /*
2938 * Push the value of an aliased binding, which may have to bypass a DebugEnvironmentProxy
2939 * on the environment chain.
2940 *
2941 * Category: Variables and scopes
2942 * Type: Getting binding values
2943 * Operands: uint8_t hops, uint24_t slot
2944 * Stack: => aliasedVar
2946 MACRO(GetAliasedDebugVar, get_aliased_debug_var, NULL, 5, 0, 1, JOF_DEBUGCOORD|JOF_NAME) \
2947 /*
2948 * Get the value of a module import by name and pushes it onto the stack.
2949 *
2950 * Category: Variables and scopes
2951 * Type: Getting binding values
2952 * Operands: uint32_t nameIndex
2953 * Stack: => val
2955 MACRO(GetImport, get_import, NULL, 5, 0, 1, JOF_ATOM|JOF_NAME) \
2956 /*
2957 * Get the value of a binding from the environment `env`. If the name is
2958 * not bound in `env`, throw a ReferenceError.
2959 *
2960 * `env` must be an environment currently on the environment chain, pushed
2961 * by `JSOp::BindName` or `JSOp::BindVar`.
2962 *
2963 * Note: `JSOp::BindName` and `JSOp::GetBoundName` are the two halves of the
2964 * `JSOp::GetName` operation: finding and reading a variable. This
2965 * decomposed version is needed to implement the compound assignment and
2966 * increment/decrement operators, which get and then set a variable. The
2967 * spec says the variable lookup is done only once. If we did the lookup
2968 * twice, there would be observable bugs, thanks to dynamic scoping. We
2969 * could set the wrong variable or call proxy traps incorrectly.
2970 *
2971 * Implements: [GetValue][1] steps 4 and 6.
2972 *
2973 * [1]: https://tc39.es/ecma262/#sec-getvalue
2974 *
2975 * Category: Variables and scopes
2976 * Type: Getting binding values
2977 * Operands: uint32_t nameIndex
2978 * Stack: env => v
2980 MACRO(GetBoundName, get_bound_name, NULL, 5, 1, 1, JOF_ATOM|JOF_NAME|JOF_IC) \
2981 /*
2982 * Push the value of an intrinsic onto the stack.
2983 *
2984 * Non-standard. Intrinsics are slots in the intrinsics holder object (see
2985 * `GlobalObject::getIntrinsicsHolder`), which is used in lieu of global
2986 * bindings in self-hosting code.
2987 *
2988 * Category: Variables and scopes
2989 * Type: Getting binding values
2990 * Operands: uint32_t nameIndex
2991 * Stack: => intrinsic[name]
2993 MACRO(GetIntrinsic, get_intrinsic, NULL, 5, 0, 1, JOF_ATOM|JOF_NAME|JOF_IC) \
2994 /*
2995 * Pushes the currently executing function onto the stack.
2996 *
2997 * The current script must be a function script.
2998 *
2999 * Used to implement `super`. This is also used sometimes as a minor
3000 * optimization when a named function expression refers to itself by name:
3001 *
3002 * f = function fac(n) { ... fac(n - 1) ... };
3003 *
3004 * This lets us optimize away a lexical environment that contains only the
3005 * binding for `fac`, unless it's otherwise observable (via `with`, `eval`,
3006 * or a nested closure).
3007 *
3008 * Category: Variables and scopes
3009 * Type: Getting binding values
3010 * Operands:
3011 * Stack: => callee
3013 MACRO(Callee, callee, NULL, 1, 0, 1, JOF_BYTE) \
3014 /*
3015 * Load the callee stored in a CallObject on the environment chain. The
3016 * `numHops` operand is the number of environment objects to skip on the
3017 * environment chain. The environment chain element indicated by `numHops`
3018 * must be a CallObject.
3019 *
3020 * Category: Variables and scopes
3021 * Type: Getting binding values
3022 * Operands: uint8_t numHops
3023 * Stack: => callee
3025 MACRO(EnvCallee, env_callee, NULL, 2, 0, 1, JOF_UINT8) \
3026 /*
3027 * Assign `val` to the binding in `env` with the name given by `nameIndex`.
3028 * Throw a ReferenceError if the binding is an uninitialized lexical.
3029 * This can call setters and/or proxy traps.
3030 *
3031 * `env` must be an environment currently on the environment chain,
3032 * pushed by `JSOp::BindName` or `JSOp::BindVar`.
3033 *
3034 * This is the fallback `Set` instruction that handles all unoptimized
3035 * cases. Optimized instructions follow.
3036 *
3037 * Implements: [PutValue][1] steps 5 and 7 for unoptimized bindings.
3038 *
3039 * Note: `JSOp::BindName` and `JSOp::SetName` are the two halves of simple
3040 * assignment: finding and setting a variable. They are two separate
3041 * instructions because, per spec, the "finding" part happens before
3042 * evaluating the right-hand side of the assignment, and the "setting" part
3043 * after. Optimized cases don't need a `Bind` instruction because the
3044 * "finding" is done statically.
3045 *
3046 * [1]: https://tc39.es/ecma262/#sec-putvalue
3047 *
3048 * Category: Variables and scopes
3049 * Type: Setting binding values
3050 * Operands: uint32_t nameIndex
3051 * Stack: env, val => val
3053 MACRO(SetName, set_name, NULL, 5, 2, 1, JOF_ATOM|JOF_NAME|JOF_PROPSET|JOF_CHECKSLOPPY|JOF_IC|JOF_USES_ENV) \
3054 /*
3055 * Like `JSOp::SetName`, but throw a TypeError if there is no binding for
3056 * the specified name in `env`, or if the binding is immutable (a `const`
3057 * or read-only property).
3058 *
3059 * Implements: [PutValue][1] steps 5 and 7 for strict mode code.
3060 *
3061 * [1]: https://tc39.es/ecma262/#sec-putvalue
3062 *
3063 * Category: Variables and scopes
3064 * Type: Setting binding values
3065 * Operands: uint32_t nameIndex
3066 * Stack: env, val => val
3068 MACRO(StrictSetName, strict_set_name, NULL, 5, 2, 1, JOF_ATOM|JOF_NAME|JOF_PROPSET|JOF_CHECKSTRICT|JOF_IC|JOF_USES_ENV) \
3069 /*
3070 * Like `JSOp::SetName`, but for assigning to globals. `env` must be an
3071 * environment pushed by `JSOp::BindGName`.
3072 *
3073 * Category: Variables and scopes
3074 * Type: Setting binding values
3075 * Operands: uint32_t nameIndex
3076 * Stack: env, val => val
3078 MACRO(SetGName, set_g_name, NULL, 5, 2, 1, JOF_ATOM|JOF_NAME|JOF_PROPSET|JOF_GNAME|JOF_CHECKSLOPPY|JOF_IC) \
3079 /*
3080 * Like `JSOp::StrictSetGName`, but for assigning to globals. `env` must be
3081 * an environment pushed by `JSOp::BindGName`.
3082 *
3083 * Category: Variables and scopes
3084 * Type: Setting binding values
3085 * Operands: uint32_t nameIndex
3086 * Stack: env, val => val
3088 MACRO(StrictSetGName, strict_set_g_name, NULL, 5, 2, 1, JOF_ATOM|JOF_NAME|JOF_PROPSET|JOF_GNAME|JOF_CHECKSTRICT|JOF_IC) \
3089 /*
3090 * Assign `val` to an argument binding that's stored in the stack frame or
3091 * in an `ArgumentsObject`.
3092 *
3093 * Category: Variables and scopes
3094 * Type: Setting binding values
3095 * Operands: uint16_t argno
3096 * Stack: val => val
3098 MACRO(SetArg, set_arg, NULL, 3, 1, 1, JOF_QARG|JOF_NAME) \
3099 /*
3100 * Assign to an optimized local binding.
3101 *
3102 * Category: Variables and scopes
3103 * Type: Setting binding values
3104 * Operands: uint24_t localno
3105 * Stack: v => v
3107 MACRO(SetLocal, set_local, NULL, 4, 1, 1, JOF_LOCAL|JOF_NAME) \
3108 /*
3109 * Assign to an aliased binding.
3110 *
3111 * Implements: [SetMutableBinding for declarative Environment Records][1],
3112 * in certain cases where it's known that the binding exists, is mutable,
3113 * and has been initialized.
3114 *
3115 * [1]: https://tc39.es/ecma262/#sec-declarative-environment-records-setmutablebinding-n-v-s
3116 *
3117 * Category: Variables and scopes
3118 * Type: Setting binding values
3119 * Operands: uint8_t hops, uint24_t slot
3120 * Stack: val => val
3122 MACRO(SetAliasedVar, set_aliased_var, NULL, 5, 1, 1, JOF_ENVCOORD|JOF_NAME|JOF_PROPSET|JOF_USES_ENV) \
3123 /*
3124 * Assign to an intrinsic.
3125 *
3126 * Nonstandard. Intrinsics are used in lieu of global bindings in self-
3127 * hosted code. The value is actually stored in the intrinsics holder
3128 * object, `GlobalObject::getIntrinsicsHolder`. (Self-hosted code doesn't
3129 * have many global `var`s, but it has many `function`s.)
3130 *
3131 * Category: Variables and scopes
3132 * Type: Setting binding values
3133 * Operands: uint32_t nameIndex
3134 * Stack: val => val
3136 MACRO(SetIntrinsic, set_intrinsic, NULL, 5, 1, 1, JOF_ATOM|JOF_NAME) \
3137 /*
3138 * Push a lexical environment onto the environment chain.
3139 *
3140 * The `LexicalScope` indicated by `lexicalScopeIndex` determines the shape
3141 * of the new `BlockLexicalEnvironmentObject`. All bindings in the new
3142 * environment are marked as uninitialized.
3143 *
3144 * Implements: [Evaluation of *Block*][1], steps 1-4.
3145 *
3146 * #### Fine print for environment chain instructions
3147 *
3148 * The following rules for `JSOp::{Push,Pop}LexicalEnv` also apply to
3149 * `JSOp::PushClassBodyEnv`, `JSOp::PushVarEnv`, and
3150 * `JSOp::{Enter,Leave}With`.
3151 *
3152 * Each `JSOp::PopLexicalEnv` instruction matches a particular
3153 * `JSOp::PushLexicalEnv` instruction in the same script and must have the
3154 * same scope and stack depth as the instruction immediately after that
3155 * `PushLexicalEnv`.
3156 *
3157 * `JSOp::PushLexicalEnv` enters a scope that extends to some set of
3158 * instructions in the script. Code must not jump into or out of this
3159 * region: control can enter only by executing `PushLexicalEnv` and can
3160 * exit only by executing a `PopLexicalEnv` or by exception unwinding. (A
3161 * `JSOp::PopLexicalEnv` is always emitted at the end of the block, and
3162 * extra copies are emitted on "exit slides", where a `break`, `continue`,
3163 * or `return` statement exits the scope.)
3164 *
3165 * The script's `JSScript::scopeNotes()` must identify exactly which
3166 * instructions begin executing in this scope. Typically this means a
3167 * single entry marking the contiguous chunk of bytecode from the
3168 * instruction after `JSOp::PushLexicalEnv` to `JSOp::PopLexicalEnv`
3169 * (inclusive); but if that range contains any instructions on exit slides,
3170 * after a `JSOp::PopLexicalEnv`, then those must be correctly noted as
3171 * *outside* the scope.
3172 *
3173 * [1]: https://tc39.es/ecma262/#sec-block-runtime-semantics-evaluation
3174 *
3175 * Category: Variables and scopes
3176 * Type: Entering and leaving environments
3177 * Operands: uint32_t lexicalScopeIndex
3178 * Stack: =>
3180 MACRO(PushLexicalEnv, push_lexical_env, NULL, 5, 0, 0, JOF_SCOPE|JOF_USES_ENV) \
3181 /*
3182 * Pop a lexical or class-body environment from the environment chain.
3183 *
3184 * See `JSOp::PushLexicalEnv` for the fine print.
3185 *
3186 * Category: Variables and scopes
3187 * Type: Entering and leaving environments
3188 * Operands:
3189 * Stack: =>
3191 MACRO(PopLexicalEnv, pop_lexical_env, NULL, 1, 0, 0, JOF_BYTE|JOF_USES_ENV) \
3192 /*
3193 * No-op instruction that indicates leaving an optimized lexical scope.
3194 *
3195 * If all bindings in a lexical scope are optimized into stack slots, then
3196 * the runtime environment objects for that scope are optimized away. No
3197 * `JSOp::{Push,Pop}LexicalEnv` instructions are emitted. However, the
3198 * debugger still needs to be notified when control exits a scope; that's
3199 * what this instruction does.
3200 *
3201 * The last instruction in a lexical or class-body scope, as indicated by
3202 * scope notes, must be either this instruction (if the scope is optimized)
3203 * or `JSOp::PopLexicalEnv` (if not).
3204 *
3205 * Category: Variables and scopes
3206 * Type: Entering and leaving environments
3207 * Operands:
3208 * Stack: =>
3210 MACRO(DebugLeaveLexicalEnv, debug_leave_lexical_env, NULL, 1, 0, 0, JOF_BYTE) \
3211 /*
3212 * Replace the current block on the environment chain with a fresh block
3213 * with uninitialized bindings. This implements the behavior of inducing a
3214 * fresh lexical environment for every iteration of a for-in/of loop whose
3215 * loop-head declares lexical variables that may be captured.
3216 *
3217 * The current environment must be a BlockLexicalEnvironmentObject.
3218 *
3219 * Category: Variables and scopes
3220 * Type: Entering and leaving environments
3221 * Operands: uint32_t lexicalScopeIndex
3222 * Stack: =>
3224 MACRO(RecreateLexicalEnv, recreate_lexical_env, NULL, 5, 0, 0, JOF_SCOPE) \
3225 /*
3226 * Like `JSOp::RecreateLexicalEnv`, but the values of all the bindings are
3227 * copied from the old block to the new one. This is used for C-style
3228 * `for(let ...; ...; ...)` loops.
3229 *
3230 * Category: Variables and scopes
3231 * Type: Entering and leaving environments
3232 * Operands: uint32_t lexicalScopeIndex
3233 * Stack: =>
3235 MACRO(FreshenLexicalEnv, freshen_lexical_env, NULL, 5, 0, 0, JOF_SCOPE) \
3236 /*
3237 * Push a ClassBody environment onto the environment chain.
3238 *
3239 * Like `JSOp::PushLexicalEnv`, but pushes a `ClassBodyEnvironmentObject`
3240 * rather than a `BlockLexicalEnvironmentObject`. `JSOp::PopLexicalEnv` is
3241 * used to pop class-body environments as well as lexical environments.
3242 *
3243 * See `JSOp::PushLexicalEnv` for the fine print.
3244 *
3245 * Category: Variables and scopes
3246 * Type: Entering and leaving environments
3247 * Operands: uint32_t lexicalScopeIndex
3248 * Stack: =>
3250 MACRO(PushClassBodyEnv, push_class_body_env, NULL, 5, 0, 0, JOF_SCOPE) \
3251 /*
3252 * Push a var environment onto the environment chain.
3253 *
3254 * Like `JSOp::PushLexicalEnv`, but pushes a `VarEnvironmentObject` rather
3255 * than a `BlockLexicalEnvironmentObject`. The difference is that
3256 * non-strict direct `eval` can add bindings to a var environment; see
3257 * `VarScope` in Scope.h.
3258 *
3259 * See `JSOp::PushLexicalEnv` for the fine print.
3260 *
3261 * There is no corresponding `JSOp::PopVarEnv` operation, because a
3262 * `VarEnvironmentObject` is never popped from the environment chain.
3263 *
3264 * Implements: Places in the spec where the VariableEnvironment is set:
3265 *
3266 * - The bit in [PerformEval][1] where, in strict direct eval, the new
3267 * eval scope is taken as *varEnv* and becomes "*runningContext*'s
3268 * VariableEnvironment".
3269 *
3270 * - The weird scoping rules for functions with default parameter
3271 * expressions, as specified in [FunctionDeclarationInstantiation][2]
3272 * step 28 ("NOTE: A separate Environment Record is needed...").
3273 *
3274 * Note: The spec also pushes a new VariableEnvironment on entry to every
3275 * function, but the VM takes care of that as part of pushing the stack
3276 * frame, before the function script starts to run, so `JSOp::PushVarEnv` is
3277 * not needed.
3278 *
3279 * [1]: https://tc39.es/ecma262/#sec-performeval
3280 * [2]: https://tc39.es/ecma262/#sec-functiondeclarationinstantiation
3281 *
3282 * Category: Variables and scopes
3283 * Type: Entering and leaving environments
3284 * Operands: uint32_t scopeIndex
3285 * Stack: =>
3287 MACRO(PushVarEnv, push_var_env, NULL, 5, 0, 0, JOF_SCOPE|JOF_USES_ENV) \
3288 /*
3289 * Push a `WithEnvironmentObject` wrapping ToObject(`val`) to the
3290 * environment chain.
3291 *
3292 * Implements: [Evaluation of `with` statements][1], steps 2-6.
3293 *
3294 * Operations that may need to consult a WithEnvironment can't be correctly
3295 * implemented using optimized instructions like `JSOp::GetLocal`. A script
3296 * must use the deoptimized `JSOp::GetName`, `BindName`, `SetName`, and
3297 * `DelName` instead. Since those instructions don't work correctly with
3298 * optimized locals and arguments, all bindings in scopes enclosing a
3299 * `with` statement are marked as "aliased" and deoptimized too.
3300 *
3301 * See `JSOp::PushLexicalEnv` for the fine print.
3302 *
3303 * [1]: https://tc39.es/ecma262/#sec-with-statement-runtime-semantics-evaluation
3304 *
3305 * Category: Variables and scopes
3306 * Type: Entering and leaving environments
3307 * Operands: uint32_t staticWithIndex
3308 * Stack: val =>
3310 MACRO(EnterWith, enter_with, NULL, 5, 1, 0, JOF_SCOPE) \
3311 /*
3312 * Pop a `WithEnvironmentObject` from the environment chain.
3313 *
3314 * See `JSOp::PushLexicalEnv` for the fine print.
3315 *
3316 * Implements: [Evaluation of `with` statements][1], step 8.
3317 *
3318 * [1]: https://tc39.es/ecma262/#sec-with-statement-runtime-semantics-evaluation
3319 *
3320 * Category: Variables and scopes
3321 * Type: Entering and leaving environments
3322 * Operands:
3323 * Stack: =>
3325 MACRO(LeaveWith, leave_with, NULL, 1, 0, 0, JOF_BYTE) \
3326 /*
3327 * Push the current VariableEnvironment (the environment on the environment
3328 * chain designated to receive new variables).
3329 *
3330 * Implements: [Annex B.3.3.1, changes to FunctionDeclarationInstantiation
3331 * for block-level functions][1], step 1.a.ii.3.a, and similar steps in
3332 * other Annex B.3.3 algorithms, when setting the function's second binding
3333 * can't be optimized.
3334 *
3335 * [1]: https://tc39.es/ecma262/#sec-web-compat-functiondeclarationinstantiation
3336 *
3337 * Category: Variables and scopes
3338 * Type: Creating and deleting bindings
3339 * Operands:
3340 * Stack: => env
3342 MACRO(BindVar, bind_var, NULL, 1, 0, 1, JOF_BYTE|JOF_USES_ENV) \
3343 /*
3344 * Check for conflicting bindings and then initialize them in global or
3345 * sloppy eval scripts. This is required for global scripts with any
3346 * top-level bindings, or any sloppy-eval scripts with any non-lexical
3347 * top-level bindings.
3348 *
3349 * Implements: [GlobalDeclarationInstantiation][1] and
3350 * [EvalDeclarationInstantiation][2] (except step 12).
3351 *
3352 * The `lastFun` argument is a GCThingIndex of the last hoisted top-level
3353 * function that is part of top-level script initialization. The gcthings
3354 * from index `0` thru `lastFun` contain only scopes and hoisted functions.
3355 *
3356 * [1]: https://tc39.es/ecma262/#sec-globaldeclarationinstantiation
3357 * [2]: https://tc39.es/ecma262/#sec-evaldeclarationinstantiation
3358 *
3359 * Category: Variables and scopes
3360 * Type: Creating and deleting bindings
3361 * Operands: uint32_t lastFun
3362 * Stack: =>
3364 MACRO(GlobalOrEvalDeclInstantiation, global_or_eval_decl_instantiation, NULL, 5, 0, 0, JOF_GCTHING|JOF_USES_ENV) \
3365 /*
3366 * Look up a variable on the environment chain and delete it. Push `true`
3367 * on success (if a binding was deleted, or if no such binding existed in
3368 * the first place), `false` otherwise (most kinds of bindings can't be
3369 * deleted).
3370 *
3371 * Implements: [`delete` *Identifier*][1], which [is a SyntaxError][2] in
3372 * strict mode code.
3373 *
3374 * [1]: https://tc39.es/ecma262/#sec-delete-operator-runtime-semantics-evaluation
3375 * [2]: https://tc39.es/ecma262/#sec-delete-operator-static-semantics-early-errors
3376 *
3377 * Category: Variables and scopes
3378 * Type: Creating and deleting bindings
3379 * Operands: uint32_t nameIndex
3380 * Stack: => succeeded
3382 MACRO(DelName, del_name, NULL, 5, 0, 1, JOF_ATOM|JOF_NAME|JOF_CHECKSLOPPY|JOF_USES_ENV) \
3383 /*
3384 * Create and push the `arguments` object for the current function activation.
3385 *
3386 * When it exists, `arguments` is stored in an ordinary local variable.
3387 * `JSOp::Arguments` is used in function preludes, to populate that variable
3388 * before the function body runs, *not* each time `arguments` appears in a
3389 * function.
3390 *
3391 * If a function clearly doesn't use `arguments`, we optimize it away when
3392 * emitting bytecode. The function's script won't use `JSOp::Arguments` at
3393 * all.
3394 *
3395 * The current script must be a function script. This instruction must
3396 * execute at most once per function activation.
3397 *
3398 * Category: Variables and scopes
3399 * Type: Function environment setup
3400 * Operands:
3401 * Stack: => arguments
3403 MACRO(Arguments, arguments, NULL, 1, 0, 1, JOF_BYTE|JOF_USES_ENV) \
3404 /*
3405 * Create and push the rest parameter array for current function call.
3406 *
3407 * This must appear only in a script for a function that has a rest
3408 * parameter.
3409 *
3410 * Category: Variables and scopes
3411 * Type: Function environment setup
3412 * Operands:
3413 * Stack: => rest
3415 MACRO(Rest, rest, NULL, 1, 0, 1, JOF_BYTE|JOF_IC) \
3416 /*
3417 * Determines the `this` value for current function frame and pushes it
3418 * onto the stack.
3419 *
3420 * In functions, `this` is stored in a local variable. This instruction is
3421 * used in the function prologue to get the value to initialize that
3422 * variable. (This doesn't apply to arrow functions, becauses they don't
3423 * have a `this` binding; also, `this` is optimized away if it's unused.)
3424 *
3425 * Functions that have a `this` binding have a local variable named
3426 * `".this"`, which is initialized using this instruction in the function
3427 * prologue.
3428 *
3429 * In non-strict functions, `this` is always an object. Undefined/null
3430 * `this` is converted into the global `this` value. Other primitive values
3431 * are boxed. See `js::BoxNonStrictThis`.
3432 *
3433 * Category: Variables and scopes
3434 * Type: Function environment setup
3435 * Operands:
3436 * Stack: => this
3438 MACRO(FunctionThis, function_this, NULL, 1, 0, 1, JOF_BYTE) \
3439 /*
3440 * Pop the top value from the stack and discard it.
3441 *
3442 * Category: Stack operations
3443 * Operands:
3444 * Stack: v =>
3446 MACRO(Pop, pop, NULL, 1, 1, 0, JOF_BYTE) \
3447 /*
3448 * Pop the top `n` values from the stack. `n` must be <= the current stack
3449 * depth.
3450 *
3451 * Category: Stack operations
3452 * Operands: uint16_t n
3453 * Stack: v[n-1], ..., v[1], v[0] =>
3455 MACRO(PopN, pop_n, NULL, 3, -1, 0, JOF_UINT16) \
3456 /*
3457 * Push a copy of the top value on the stack.
3458 *
3459 * Category: Stack operations
3460 * Operands:
3461 * Stack: v => v, v
3463 MACRO(Dup, dup, NULL, 1, 1, 2, JOF_BYTE) \
3464 /*
3465 * Duplicate the top two values on the stack.
3466 *
3467 * Category: Stack operations
3468 * Operands:
3469 * Stack: v1, v2 => v1, v2, v1, v2
3471 MACRO(Dup2, dup2, NULL, 1, 2, 4, JOF_BYTE) \
3472 /*
3473 * Push a copy of the nth value from the top of the stack.
3474 *
3475 * `n` must be less than the current stack depth.
3476 *
3477 * Category: Stack operations
3478 * Operands: uint24_t n
3479 * Stack: v[n], v[n-1], ..., v[1], v[0] =>
3480 * v[n], v[n-1], ..., v[1], v[0], v[n]
3482 MACRO(DupAt, dup_at, NULL, 4, 0, 1, JOF_UINT24) \
3483 /*
3484 * Swap the top two values on the stack.
3485 *
3486 * Category: Stack operations
3487 * Operands:
3488 * Stack: v1, v2 => v2, v1
3490 MACRO(Swap, swap, NULL, 1, 2, 2, JOF_BYTE) \
3491 /*
3492 * Pick the nth element from the stack and move it to the top of the stack.
3493 *
3494 * Category: Stack operations
3495 * Operands: uint8_t n
3496 * Stack: v[n], v[n-1], ..., v[1], v[0] => v[n-1], ..., v[1], v[0], v[n]
3498 MACRO(Pick, pick, NULL, 2, 0, 0, JOF_UINT8) \
3499 /*
3500 * Move the top of the stack value under the `n`th element of the stack.
3501 * `n` must not be 0.
3502 *
3503 * Category: Stack operations
3504 * Operands: uint8_t n
3505 * Stack: v[n], v[n-1], ..., v[1], v[0] => v[0], v[n], v[n-1], ..., v[1]
3507 MACRO(Unpick, unpick, NULL, 2, 0, 0, JOF_UINT8) \
3508 /*
3509 * Do nothing. This is used when we need distinct bytecode locations for
3510 * various mechanisms.
3511 *
3512 * Category: Other
3513 * Operands:
3514 * Stack: =>
3516 MACRO(Nop, nop, NULL, 1, 0, 0, JOF_BYTE) \
3517 /*
3518 * No-op instruction emitted immediately after `JSOp::*Eval` so that direct
3519 * eval does not have to do slow pc-to-line mapping.
3520 *
3521 * The `lineno` operand should agree with this script's source notes about
3522 * the line number of the preceding `*Eval` instruction.
3523 *
3524 * Category: Other
3525 * Operands: uint32_t lineno
3526 * Stack: =>
3528 MACRO(Lineno, lineno, NULL, 5, 0, 0, JOF_UINT32) \
3529 /*
3530 * No-op instruction to hint that the top stack value is uninteresting.
3531 *
3532 * This affects only debug output and some error messages.
3533 * In array destructuring, we emit bytecode that is roughly equivalent to
3534 * `result.done ? undefined : result.value`.
3535 * `NopDestructuring` is emitted after the `undefined`, so that the
3536 * expression decompiler and disassembler know to casually ignore the
3537 * possibility of `undefined`, and render the result of the conditional
3538 * expression simply as "`result.value`".
3539 *
3540 * Category: Other
3541 * Operands:
3542 * Stack: =>
3544 MACRO(NopDestructuring, nop_destructuring, NULL, 1, 0, 0, JOF_BYTE) \
3545 /*
3546 * No-op instruction only emitted in some self-hosted functions. Not
3547 * handled by the JITs or Baseline Interpreter so the script always runs in
3548 * the C++ interpreter.
3549 *
3550 * Category: Other
3551 * Operands:
3552 * Stack: =>
3554 MACRO(ForceInterpreter, force_interpreter, NULL, 1, 0, 0, JOF_BYTE) \
3555 /*
3556 * Examine the top stack value, asserting that it's either a self-hosted
3557 * function or a self-hosted intrinsic. This does nothing in a non-debug
3558 * build.
3559 *
3560 * Category: Other
3561 * Operands:
3562 * Stack: checkVal => checkVal
3564 MACRO(DebugCheckSelfHosted, debug_check_self_hosted, NULL, 1, 1, 1, JOF_BYTE) \
3565 /*
3566 * Break in the debugger, if one is attached. Otherwise this is a no-op.
3567 *
3568 * The [`Debugger` API][1] offers a way to hook into this instruction.
3569 *
3570 * Implements: [Evaluation for *DebuggerStatement*][2].
3571 *
3572 * [1]: https://developer.mozilla.org/en-US/docs/Tools/Debugger-API/Debugger
3573 * [2]: https://tc39.es/ecma262/#sec-debugger-statement-runtime-semantics-evaluation
3574 *
3575 * Category: Other
3576 * Operands:
3577 * Stack: =>
3579 MACRO(Debugger, debugger, NULL, 1, 0, 0, JOF_BYTE)
3581 // clang-format on
3583 /*
3584 * In certain circumstances it may be useful to "pad out" the opcode space to
3585 * a power of two. Use this macro to do so.
3586 */
3587 #define FOR_EACH_TRAILING_UNUSED_OPCODE(MACRO) \
3595 MACRO(239) \
3596 MACRO(240) \
3597 MACRO(241) \
3598 MACRO(242) \
3599 MACRO(243) \
3600 MACRO(244) \
3601 MACRO(245) \
3602 MACRO(246) \
3603 MACRO(247) \
3604 MACRO(248) \
3605 MACRO(249) \
3606 MACRO(250) \
3607 MACRO(251) \
3608 MACRO(252) \
3609 MACRO(253) \
3610 MACRO(254) \
3611 MACRO(255)
3615 // Sanity check that opcode values and trailing unused opcodes completely cover
3616 // the [0, 256) range. Avert your eyes! You don't want to know how the
3617 // sausage gets made.
3619 // clang-format off
3620 #define PLUS_ONE(...) \
3621 + 1
3623 #undef PLUS_ONE
3625 #define TRAILING_VALUE_AND_VALUE_PLUS_ONE(val) \
3626 val) && (val + 1 ==
3630 "trailing unused opcode values monotonically increase "
3632 #undef TRAILING_VALUE_AND_VALUE_PLUS_ONE
3633 // clang-format on
3635 // Define JSOpLength_* constants for all ops.
3636 #define DEFINE_LENGTH_CONSTANT(op, op_snake, image, len, ...) \
3637 constexpr size_t JSOpLength_##op = len;
3639 #undef DEFINE_LENGTH_CONSTANT
3643 /*
3644 * JS operation bytecodes.
3645 */
3647 #define ENUMERATE_OPCODE(op, ...) op,
3649 #undef ENUMERATE_OPCODE
3650 };