1 # This Source Code Form is subject to the terms of the Mozilla Public
2 # License, v. 2.0. If a copy of the MPL was not distributed with this
3 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
5 # [SMDOC] CacheIR Opcodes
6 # =======================
7 # This file defines all CacheIR opcodes and their arguments.
9 # Each op has the following attributes:
13 # Opcode name. Convention is to use a name ending in *Result for ops that store
14 # to the IC's output register.
18 # If true, Baseline and Ion use the same CacheIRCompiler code for this op.
19 # If false, the op must be implemented in both BaselineCacheIRCompiler and
24 # Whether this op can be transpiled to MIR by WarpCacheIRTranspiler.
28 # Score of an individual CacheIR Opcode's contribution to the overall score for
29 # each stub. This score is based off of the cost of the masm calls made by the op's
30 # implementation. The higher the score the more costly the op is.
32 # How to decide the cost estimate for a CacheIROp:
33 # 0 points - Generates no code
34 # 1 point - 1-5 simple masm ops, no callVM or callWithABI
35 # 2 points - 5-20 masm ops, no callVM or callWithABI
36 # 3 points - 20+ masm ops, no callVM or callWithABI
37 # 4 points - callWithABI
39 # 6 points - more than one callWithABI or callVM
41 # In the case of the op not being shared, default to counting the Baseline
44 # If the cost estimate is different based off of what branch of a conditional
45 # is taken, assign the score of the branch with the highest cost.
48 # Currently, the scoring is tentative. It is in place to provide an
49 # estimate for the cost of each op. The scoring will be refined.
51 # custom_writer (optional)
52 # ========================
53 # If true, the generated CacheIRWriter method will be private and has a trailing
54 # '_'. This is useful for ops that need custom CacheIRWriter logic on top of the
59 # List of arguments encoded in the bytecode stream. There are three argument
62 # - Id (ObjId, ValId, ...): refers to either an IC input or a value defined by
63 # a previous CacheIR instruction. This is encoded as integer in the bytecode
66 # - Field (ObjectField, StringField, ...): specific value is stored in the stub
67 # data and the bytecode stream stores the offset of this field. This means the
68 # CacheIR is not specialized for particular values and code can be shared.
70 # - Immediate (BoolImm, Int32Imm, JSOpImm, ...): a value baked directly into
71 # the bytecode stream. This is useful for bits of state that need to be
72 # available to all CacheIR compilers/transpilers.
74 # If there's an argument named 'result', the generated CacheIRWriter method will
75 # return a new OperandId of this type.
91 - name: GuardIsNullOrUndefined
105 - name: GuardIsUndefined
112 - name: GuardIsNotUninitializedLexical
119 - name: GuardToBoolean
127 - name: GuardToString
135 - name: GuardToSymbol
143 - name: GuardToBigInt
151 - name: GuardIsNumber
167 - name: GuardToNonGCThing
174 # If the Value is a boolean, convert it to int32.
175 - name: GuardBooleanToInt32
183 - name: GuardToInt32Index
191 - name: Int32ToIntPtr
199 - name: GuardNumberToIntPtrIndex
208 - name: GuardToInt32ModUint32
216 - name: GuardToUint8Clamped
224 # Note: this doesn't accept doubles to avoid ambiguity about whether it includes
225 # int32 values. Use GuardIsNumber instead.
226 - name: GuardNonDoubleType
240 shape: WeakShapeField
242 - name: GuardMultipleShapes
257 proto: WeakObjectField
259 - name: GuardNullProto
266 # Guard per GuardClassKind.
273 kind: GuardClassKindImm
275 # Guard per GuardClassKind.
276 - name: GuardEitherClass
282 kind1: GuardClassKindImm
283 kind2: GuardClassKindImm
285 # Guard on a realm fuse.
291 fuseWord: RealmFuseIndexImm
293 # Guard on an arbitrary JSClass.
294 - name: GuardAnyClass
300 clasp: RawPointerField
302 - name: GuardGlobalGeneration
307 expected: RawInt32Field
308 generationAddr: RawPointerField
310 - name: HasClassResult
316 clasp: RawPointerField
318 - name: CallRegExpMatcherResult
328 - name: CallRegExpSearcherResult
338 - name: RegExpSearcherLastLimitResult
344 - name: RegExpHasCaptureGroupsResult
352 - name: RegExpBuiltinExecMatchResult
361 - name: RegExpBuiltinExecTestResult
370 - name: RegExpFlagResult
378 - name: CallSubstringKernelResult
387 - name: StringReplaceStringResult
394 replacement: StringId
396 - name: StringSplitStringResult
404 - name: RegExpPrototypeOptimizableResult
411 - name: RegExpInstanceOptimizableResult
419 - name: GetFirstDollarIndexResult
426 # Add a reference to a global in the compartment to keep it alive.
427 - name: GuardCompartment
434 compartment: RawPointerField
436 - name: GuardIsExtensible
443 - name: GuardIsNativeObject
457 - name: GuardIsNotProxy
464 - name: GuardIsNotArrayBufferMaybeShared
471 - name: GuardIsTypedArray
478 - name: GuardIsFixedLengthTypedArray
485 - name: GuardIsResizableTypedArray
492 - name: GuardHasProxyHandler
498 handler: RawPointerField
500 - name: GuardIsNotDOMProxy
507 - name: GuardSpecificObject
513 expected: WeakObjectField
515 - name: GuardObjectIdentity
523 - name: GuardSpecificFunction
530 expected: WeakObjectField
531 nargsAndFlags: RawInt32Field
533 - name: GuardFunctionScript
540 expected: WeakBaseScriptField
541 nargsAndFlags: RawInt32Field
543 - name: GuardSpecificAtom
551 - name: GuardSpecificSymbol
557 expected: SymbolField
559 - name: GuardSpecificInt32
567 - name: GuardNoDenseElements
574 - name: GuardStringToIndex
582 - name: GuardStringToInt32
590 - name: GuardStringToNumber
606 - name: BooleanToNumber
614 - name: GuardHasGetterSetter
621 getterSetter: WeakGetterSetterField
623 - name: GuardInt32IsNonNegative
630 - name: GuardIndexIsValidUpdateOrAdd
638 - name: GuardIndexIsNotDenseElement
646 - name: GuardTagNotEqual
654 - name: GuardXrayExpandoShapeAndDefaultProto
660 shapeWrapper: ObjectField
662 - name: GuardXrayNoExpando
669 # Guard obj[slot] == expected.
670 - name: GuardDynamicSlotIsSpecificObject
679 # Guard obj[slot] is not an object.
680 - name: GuardDynamicSlotIsNotObject
688 - name: GuardFixedSlotValue
694 offset: RawInt32Field
697 - name: GuardDynamicSlotValue
703 offset: RawInt32Field
706 - name: LoadScriptedProxyHandler
714 - name: IdToStringOrSymbol
722 - name: LoadFixedSlot
729 offset: RawInt32Field
731 - name: LoadDynamicSlot
740 - name: GuardNoAllocationMetadataBuilder
745 builderAddr: RawPointerField
747 - name: GuardFunctionHasJitEntry
754 - name: GuardFunctionHasNoJitEntry
761 - name: GuardFunctionIsNonBuiltinCtor
768 - name: GuardFunctionIsConstructor
775 - name: GuardNotClassConstructor
782 - name: GuardArrayIsPacked
789 - name: GuardArgumentsObjectFlags
805 # This is just LoadObject with extra information for the purpose of optimizing
806 # out shape guards if we're just storing to slots of the receiver object.
807 - name: LoadProtoObject
813 protoObj: ObjectField
824 - name: LoadEnclosingEnvironment
832 - name: LoadWrapperTarget
849 - name: LoadArgumentFixedSlot
858 - name: LoadArgumentDynamicSlot
868 - name: TruncateDoubleToUInt32
876 - name: DoubleToUint8Clamped
884 - name: MegamorphicLoadSlotResult
892 - name: MegamorphicLoadSlotByValueResult
900 - name: MegamorphicStoreSlot
910 - name: MegamorphicSetElement
920 - name: MegamorphicHasPropResult
929 # For the case where we have an object with a small number of properties,
930 # we can do better than a megamorphic hasprop if we just run through those
931 # IDs and check for atom pointer equality.
932 - name: SmallObjectVariableKeyHasOwnResult
937 # We don't actually need the object, because we only care about the shape,
938 # which was guarded before this
940 # We include the prop names to speed up and simplify the Baseline case,
941 # but only the shape is used from Ion to achieve an unrolled loop with
942 # comparisons to known atoms
943 propNames: ObjectField
946 - name: ObjectToIteratorResult
952 enumeratorsAddr: RawPointerField
954 - name: ValueToIteratorResult
961 # See CacheIR.cpp 'DOM proxies' comment.
962 - name: LoadDOMExpandoValue
970 - name: LoadDOMExpandoValueGuardGeneration
976 expandoAndGeneration: RawPointerField
977 generation: RawInt64Field
980 - name: LoadDOMExpandoValueIgnoreGeneration
988 - name: GuardDOMExpandoMissingOrGuardShape
996 - name: StoreFixedSlot
1002 offset: RawInt32Field
1005 - name: StoreDynamicSlot
1011 offset: RawInt32Field
1014 - name: AddAndStoreFixedSlot
1020 offset: RawInt32Field
1022 newShape: ShapeField
1024 - name: AddAndStoreDynamicSlot
1030 offset: RawInt32Field
1032 newShape: ShapeField
1034 - name: AllocateAndStoreDynamicSlot
1040 offset: RawInt32Field
1042 newShape: ShapeField
1043 numNewSlots: RawInt32Field
1045 - name: AddSlotAndCallAddPropHook
1052 newShape: ShapeField
1054 - name: StoreDenseElement
1063 - name: StoreDenseElementHole
1081 - name: ArrayJoinResult
1089 - name: ObjectKeysResult
1096 - name: PackedArrayPopResult
1103 - name: PackedArrayShiftResult
1110 - name: PackedArraySliceResult
1115 templateObject: ObjectField
1120 - name: ArgumentsSliceResult
1125 templateObject: ObjectField
1130 - name: IsArrayResult
1137 - name: StoreFixedSlotUndefinedResult
1142 offset: RawInt32Field
1145 - name: IsObjectResult
1152 - name: IsPackedArrayResult
1159 - name: IsCallableResult
1166 - name: IsConstructorResult
1173 - name: IsCrossRealmArrayConstructorResult
1180 - name: IsTypedArrayResult
1186 isPossiblyWrapped: BoolImm
1188 - name: IsTypedArrayConstructorResult
1195 - name: ArrayBufferViewByteOffsetInt32Result
1202 - name: ArrayBufferViewByteOffsetDoubleResult
1209 - name: ResizableTypedArrayByteOffsetMaybeOutOfBoundsInt32Result
1216 - name: ResizableTypedArrayByteOffsetMaybeOutOfBoundsDoubleResult
1223 - name: TypedArrayByteLengthInt32Result
1230 - name: TypedArrayByteLengthDoubleResult
1237 - name: ResizableTypedArrayByteLengthInt32Result
1244 - name: ResizableTypedArrayByteLengthDoubleResult
1251 - name: ResizableTypedArrayLengthInt32Result
1258 - name: ResizableTypedArrayLengthDoubleResult
1265 - name: TypedArrayElementSizeResult
1272 - name: ResizableDataViewByteLengthInt32Result
1279 - name: ResizableDataViewByteLengthDoubleResult
1286 - name: GrowableSharedArrayBufferByteLengthInt32Result
1293 - name: GrowableSharedArrayBufferByteLengthDoubleResult
1300 - name: GuardHasAttachedArrayBuffer
1307 - name: GuardResizableArrayBufferViewInBounds
1314 - name: GuardResizableArrayBufferViewInBoundsOrDetached
1321 - name: NewArrayIteratorResult
1326 templateObject: ObjectField
1328 - name: NewStringIteratorResult
1333 templateObject: ObjectField
1335 - name: NewRegExpStringIteratorResult
1340 templateObject: ObjectField
1342 - name: ObjectCreateResult
1347 templateObject: ObjectField
1349 - name: NewArrayFromLengthResult
1354 templateObject: ObjectField
1357 - name: NewTypedArrayFromLengthResult
1362 templateObject: ObjectField
1365 - name: NewTypedArrayFromArrayBufferResult
1370 templateObject: ObjectField
1375 - name: NewTypedArrayFromArrayResult
1380 templateObject: ObjectField
1383 - name: NewStringObjectResult
1388 templateObject: ObjectField
1391 - name: StringFromCharCodeResult
1398 - name: StringFromCodePointResult
1405 - name: StringIncludesResult
1413 - name: StringIndexOfResult
1421 - name: StringLastIndexOfResult
1429 - name: StringStartsWithResult
1437 - name: StringEndsWithResult
1445 - name: StringToLowerCaseResult
1452 - name: StringToUpperCaseResult
1459 - name: StringTrimResult
1466 - name: StringTrimStartResult
1473 - name: StringTrimEndResult
1480 - name: MathAbsInt32Result
1487 - name: MathAbsNumberResult
1494 - name: MathClz32Result
1501 - name: MathSignInt32Result
1508 - name: MathSignNumberResult
1515 - name: MathSignNumberToInt32Result
1522 - name: MathImulResult
1530 - name: MathSqrtNumberResult
1537 - name: MathFRoundNumberResult
1544 # Because Baseline stub code is shared by all realms in the Zone, this
1545 # instruction loads a pointer to the RNG from a stub field.
1546 - name: MathRandomResult
1551 rng: RawPointerField
1553 - name: MathHypot2NumberResult
1561 - name: MathHypot3NumberResult
1570 - name: MathHypot4NumberResult
1580 - name: MathAtan2NumberResult
1588 - name: MathFloorNumberResult
1595 - name: MathCeilNumberResult
1602 - name: MathTruncNumberResult
1609 - name: MathFloorToInt32Result
1616 - name: MathCeilToInt32Result
1623 - name: MathTruncToInt32Result
1629 - name: MathRoundToInt32Result
1646 - name: NumberMinMax
1656 - name: Int32MinMaxArrayResult
1664 - name: NumberMinMaxArrayResult
1672 - name: MathFunctionNumberResult
1678 fun: UnaryMathFunctionImm
1680 - name: NumberParseIntResult
1688 - name: DoubleParseIntResult
1695 - name: ObjectToStringResult
1702 - name: ReflectGetPrototypeOfResult
1709 - name: StoreTypedArrayElement
1715 elementType: ScalarTypeImm
1719 viewKind: ArrayBufferViewKindImm
1721 - name: AtomicsCompareExchangeResult
1730 elementType: ScalarTypeImm
1731 viewKind: ArrayBufferViewKindImm
1733 - name: AtomicsExchangeResult
1741 elementType: ScalarTypeImm
1742 viewKind: ArrayBufferViewKindImm
1744 - name: AtomicsAddResult
1752 elementType: ScalarTypeImm
1754 viewKind: ArrayBufferViewKindImm
1756 - name: AtomicsSubResult
1764 elementType: ScalarTypeImm
1766 viewKind: ArrayBufferViewKindImm
1768 - name: AtomicsAndResult
1776 elementType: ScalarTypeImm
1778 viewKind: ArrayBufferViewKindImm
1780 - name: AtomicsOrResult
1788 elementType: ScalarTypeImm
1790 viewKind: ArrayBufferViewKindImm
1792 - name: AtomicsXorResult
1800 elementType: ScalarTypeImm
1802 viewKind: ArrayBufferViewKindImm
1804 - name: AtomicsLoadResult
1811 elementType: ScalarTypeImm
1812 viewKind: ArrayBufferViewKindImm
1814 - name: AtomicsStoreResult
1822 elementType: ScalarTypeImm
1823 viewKind: ArrayBufferViewKindImm
1825 - name: AtomicsIsLockFreeResult
1832 - name: CallNativeSetter
1842 nargsAndFlags: RawInt32Field
1844 - name: CallScriptedSetter
1854 nargsAndFlags: RawInt32Field
1856 - name: CallInlinedSetter
1865 icScript: RawPointerField
1867 nargsAndFlags: RawInt32Field
1869 - name: CallDOMSetter
1875 jitInfo: RawPointerField
1878 - name: CallSetArrayLength
1897 - name: ProxySetByValue
1907 - name: CallAddOrUpdateSparseElementHelper
1917 - name: CallInt32ToString
1925 - name: CallNumberToString
1933 - name: Int32ToStringWithBaseResult
1941 - name: BooleanToString
1949 - name: CallScriptedFunction
1958 argcFixed: UInt32Imm
1960 - name: CallBoundScriptedFunction
1969 numBoundArgs: UInt32Imm
1971 - name: CallWasmFunction
1979 argcFixed: UInt32Imm
1980 funcExport: RawPointerField
1981 instance: ObjectField
1983 - name: GuardWasmArg
1989 type: WasmValTypeImm
1991 - name: CallNativeFunction
2000 argcFixed: UInt32Imm
2002 target: RawPointerField
2004 ignoresReturnValue: BoolImm
2007 - name: CallDOMFunction
2017 argcFixed: UInt32Imm
2019 target: RawPointerField
2022 - name: CallClassHook
2031 argcFixed: UInt32Imm
2032 target: RawPointerField
2034 - name: CallInlinedFunction
2042 icScript: RawPointerField
2044 argcFixed: UInt32Imm
2047 - name: CallScriptedProxyGetResult
2058 nargsAndFlags: UInt32Imm
2060 - name: CallScriptedProxyGetByValueResult
2071 nargsAndFlags: UInt32Imm
2074 # Meta ops generate no code, but contain data for the Warp Transpiler.
2075 - name: MetaScriptedThisShape
2081 thisShape: ShapeField
2083 - name: BindFunctionResult
2090 templateObject: ObjectField
2092 - name: SpecializedBindFunctionResult
2099 templateObject: ObjectField
2101 - name: LoadFixedSlotResult
2107 offset: RawInt32Field
2109 - name: LoadFixedSlotTypedResult
2115 offset: RawInt32Field
2118 - name: LoadDynamicSlotResult
2124 offset: RawInt32Field
2126 - name: LoadDenseElementResult
2134 - name: LoadDenseElementHoleResult
2142 - name: CallGetSparseElementResult
2150 - name: LoadDenseElementExistsResult
2158 - name: LoadTypedArrayElementExistsResult
2165 viewKind: ArrayBufferViewKindImm
2167 - name: LoadDenseElementHoleExistsResult
2175 - name: LoadTypedArrayElementResult
2182 elementType: ScalarTypeImm
2184 forceDoubleForUint32: BoolImm
2185 viewKind: ArrayBufferViewKindImm
2187 - name: LoadDataViewValueResult
2194 littleEndian: BooleanId
2195 elementType: ScalarTypeImm
2196 forceDoubleForUint32: BoolImm
2197 viewKind: ArrayBufferViewKindImm
2199 - name: StoreDataViewValueResult
2207 littleEndian: BooleanId
2208 elementType: ScalarTypeImm
2209 viewKind: ArrayBufferViewKindImm
2211 - name: LoadInt32ArrayLengthResult
2218 - name: LoadInt32ArrayLength
2226 - name: LoadArgumentsObjectArgResult
2234 - name: LoadArgumentsObjectArgHoleResult
2242 - name: LoadArgumentsObjectArgExistsResult
2250 - name: LoadArgumentsObjectLengthResult
2257 - name: LoadArgumentsObjectLength
2265 - name: LoadFunctionLengthResult
2272 - name: LoadFunctionNameResult
2279 - name: LoadBoundFunctionNumArgs
2287 - name: LoadBoundFunctionTarget
2295 - name: GuardBoundFunctionIsConstructor
2302 - name: LoadArrayBufferByteLengthInt32Result
2309 - name: LoadArrayBufferByteLengthDoubleResult
2316 - name: LoadArrayBufferViewLengthInt32Result
2323 - name: LoadArrayBufferViewLengthDoubleResult
2330 - name: LinearizeForCharAccess
2339 - name: LinearizeForCodePointAccess
2348 - name: ToRelativeStringIndex
2357 - name: LoadStringCharResult
2366 - name: LoadStringAtResult
2375 - name: LoadStringCharCodeResult
2384 - name: LoadStringCodePointResult
2393 - name: LoadStringLengthResult
2400 - name: FrameIsConstructingResult
2406 - name: LoadObjectResult
2413 - name: LoadStringResult
2420 - name: LoadSymbolResult
2427 - name: LoadInt32Result
2434 - name: LoadDoubleResult
2441 - name: LoadBigIntResult
2448 - name: CallScriptedGetterResult
2457 nargsAndFlags: RawInt32Field
2459 - name: CallInlinedGetterResult
2467 icScript: RawPointerField
2469 nargsAndFlags: RawInt32Field
2471 - name: CallNativeGetterResult
2480 nargsAndFlags: RawInt32Field
2482 - name: CallDOMGetterResult
2488 jitInfo: RawPointerField
2490 - name: ProxyGetResult
2498 - name: ProxyGetByValueResult
2506 - name: ProxyHasPropResult
2515 - name: CallObjectHasSparseElementResult
2523 - name: CallNativeGetElementResult
2531 - name: CallNativeGetElementSuperResult
2540 - name: GetNextMapSetEntryForIteratorResult
2549 - name: LoadUndefinedResult
2555 - name: LoadBooleanResult
2562 - name: LoadInt32Constant
2570 - name: LoadDoubleConstant
2578 - name: LoadBooleanConstant
2586 - name: LoadUndefined
2593 - name: LoadConstantString
2601 - name: LoadConstantStringResult
2608 - name: LoadInstanceOfObjectResult
2616 - name: LoadTypeOfObjectResult
2623 - name: DoubleAddResult
2631 - name: DoubleSubResult
2639 - name: DoubleMulResult
2647 - name: DoubleDivResult
2655 - name: DoubleModResult
2663 - name: DoublePowResult
2671 - name: Int32AddResult
2679 - name: Int32SubResult
2687 - name: Int32MulResult
2695 - name: Int32DivResult
2703 - name: Int32ModResult
2711 - name: Int32PowResult
2719 - name: BigIntAddResult
2727 - name: BigIntSubResult
2735 - name: BigIntMulResult
2743 - name: BigIntDivResult
2751 - name: BigIntModResult
2759 - name: BigIntPowResult
2767 - name: Int32BitOrResult
2775 - name: Int32BitXorResult
2783 - name: Int32BitAndResult
2791 - name: Int32LeftShiftResult
2799 - name: Int32RightShiftResult
2807 - name: Int32URightShiftResult
2814 forceDouble: BoolImm
2816 - name: Int32NotResult
2823 - name: BigIntBitOrResult
2831 - name: BigIntBitXorResult
2839 - name: BigIntBitAndResult
2847 - name: BigIntLeftShiftResult
2855 - name: BigIntRightShiftResult
2863 - name: BigIntNotResult
2870 - name: Int32NegationResult
2877 - name: DoubleNegationResult
2884 - name: BigIntNegationResult
2891 - name: Int32IncResult
2898 - name: Int32DecResult
2905 - name: DoubleIncResult
2912 - name: DoubleDecResult
2919 - name: BigIntIncResult
2926 - name: BigIntDecResult
2933 - name: LoadInt32TruthyResult
2940 - name: LoadDoubleTruthyResult
2947 - name: LoadStringTruthyResult
2954 - name: LoadObjectTruthyResult
2961 - name: LoadBigIntTruthyResult
2968 - name: LoadValueTruthyResult
2975 - name: LoadValueResult
2982 - name: LoadOperandResult
2989 - name: NewPlainObjectResult
2994 numFixedSlots: UInt32Imm
2995 numDynamicSlots: UInt32Imm
2996 allocKind: AllocKindImm
2998 site: AllocSiteField
3000 - name: NewArrayObjectResult
3005 arrayLength: UInt32Imm
3007 site: AllocSiteField
3009 - name: CallStringConcatResult
3017 - name: CallStringObjectConcatResult
3025 - name: CallIsSuspendedGeneratorResult
3032 - name: CompareStringResult
3041 - name: CompareObjectResult
3050 - name: CompareSymbolResult
3059 - name: CompareInt32Result
3068 - name: CompareDoubleResult
3077 - name: CompareBigIntResult
3086 - name: CompareBigIntInt32Result
3095 - name: CompareBigIntNumberResult
3104 - name: CompareBigIntStringResult
3113 - name: CompareNullUndefinedResult
3119 isUndefined: BoolImm
3122 - name: CompareDoubleSameValueResult
3130 - name: SameValueResult
3138 - name: IndirectTruncateInt32Result
3145 - name: BigIntAsIntNResult
3153 - name: BigIntAsUintNResult
3161 - name: SetHasResult
3169 - name: SetHasNonGCThingResult
3177 - name: SetHasStringResult
3185 - name: SetHasSymbolResult
3193 - name: SetHasBigIntResult
3201 - name: SetHasObjectResult
3209 - name: SetSizeResult
3216 - name: MapHasResult
3224 - name: MapHasNonGCThingResult
3232 - name: MapHasStringResult
3240 - name: MapHasSymbolResult
3248 - name: MapHasBigIntResult
3256 - name: MapHasObjectResult
3264 - name: MapGetResult
3272 - name: MapGetNonGCThingResult
3280 - name: MapGetStringResult
3288 - name: MapGetSymbolResult
3296 - name: MapGetBigIntResult
3304 - name: MapGetObjectResult
3312 - name: MapSizeResult
3319 - name: ArrayFromArgumentsObjectResult
3327 - name: CloseIterScriptedResult
3334 kind: CompletionKindImm
3335 targetNargs: UInt32Imm
3337 - name: CallPrintString
3342 str: StaticStringImm
3362 - name: AssertRecoveredOnBailoutResult
3368 mustBeRecovered: BoolImm
3370 - name: AssertPropertyLookup
3379 #ifdef FUZZING_JS_FUZZILLI
3380 - name: FuzzilliHashResult