1 # This Source Code Form is subject to the terms of the Mozilla Public
2 # License, v. 2.0. If a copy of the MPL was not distributed with this
3 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
6 # =======================
7 # This file defines all MIR opcodes. It is parsed by GenerateMIRFiles.py
8 # at build time to create MIROpsGenerated.h. Each opcode consists of a
9 # name and a set of attributes that are described below. A few of the
10 # attributes below allow setting the value to "custom", meaning the
11 # method will be declared for the MIR op, but will need to be implemented
12 # in C++ (typically done in MIR.cpp). Unless marked as required, attributes
19 # - opcode string: used as the name for MIR opcode.
23 # Used to decide to generate MIR boilerplate.
24 # - true (default): auto generate boilerplate for this MIR opcode
25 # - false: do not generate boilerplate for this MIR opcode
29 # A list of operands for the MIR op class constructor. Each operand is a
30 # MIR node. The operand kind is specified from the one of the kinds from
31 # the MIRType enum in IonTypes.h. The specified types for the
32 # operands will decide the type policy for the instruction.
34 # The naming of operands is how the NAMED_OPERANDS macro will define
42 # Will result in an instruction having the type policy of:
43 # MixPolicy<ObjectPolicy<0>, BoxPolicy<1>, ObjectPolicy<2>>
44 # and a named operands definition that looks like the following:
45 # NAMED_OPERANDS((0, object), (1, idValue), (2, value))
47 # - attribute not specified (default): no code generated
48 # - operand list: MIRTypes (See MIRType in jit/IonTypes.h)
52 # A list of non-MIR node arguments to the MIR op class constructor
53 # that are passed along with the operands. The arguments require
54 # both a name and a full type signature for each item in the list.
57 # templateObject: JSObject*
58 # initialHeap: gc::Heap
60 # For each argument a private variable declaration will be autogenerated
61 # in the MIR op class, as well as simple accessor for that variable. If
62 # the type of the variable is a GC pointer it will by automatically
63 # wrapped by CompilerGCPointer. The above arguments list will result in
64 # the following declarations and accessors:
66 # CompilerGCPointer<JSObject*> templateObject_;
67 # gc::Heap initialHeap_;
69 # JSObject* templateObject() const { return templateObject_; }
70 # gc::Heap initialHeap() const { return initialHeap_; }
72 # - attribute not specified (default): no code generated
73 # - operand list: argument names and their full type signature
77 # If this attribute is present, then the type policy for that opcode will be
78 # NoTypePolicy. This is used for opcode that should have no type policy.
79 # - attribute not specified (default): no code generated, type policy
80 # is based off of operands
81 # - none: defines the type policy as opcode's NoTypePolicy
85 # Defines the result type of the MIR opcode.
86 # - attribute not specified (default): no code is generated
87 # - MIRType string: Will add a call to setResultType to the opcode constructor.
88 # This will set the MIR opcodes result type to whatever the
89 # specified MIRType is (See MIRType in jit/IonTypes.h).
93 # Set if the opcode is a guard instruction and is used for checks in optimizations
94 # such as range analysis and value numbering.
95 # - attribute not specified (default): no code generated
96 # - true: adds setGuard to opcode constructor
100 # Defines the movable MIR flag for movable instructions. This is used for knowing
101 # whether we can hoist an instruction.
102 # - attribute not specified (default): no code generated
103 # - true: adds setMovable call in opcode constructor
107 # The foldsTo method is used for determining if an instruction can be folded into
108 # simpler instruction or for constant folding, depending on its operands.
109 # - attribute not specified (default): no code generated, no constants to fold
110 # - custom: custom C++ implementation
114 # Used by ValueNumbering to determine if two values are congruent.
115 # - attribute not specified (default): no code generated, congruentTo(foo) returns
117 # - if_operands_equal: congruentTo(foo) will return congruentIfOperandsEqual(foo)
118 # - custom: custom C++ implementation
122 # Defines the getAliasSet function for a MIR op. The alias set is used for alias
123 # analysis. The default alias set is Any.
124 # - attribute not specified (default): no code generated, alias set is Any
125 # - none: this is the most common case, this is will set the alias set to None.
126 # - custom: custom C++ implementation in MIR.cpp
130 # Defines if a opcode can possibly call.
131 # - attribute not specified (default): no code generated, opcode does not call
132 # - true: possiblyCalls returns true
133 # - custom: custom C++ implementation
137 # Computes and sets the range value for a MIR node, which is then used in range
139 # - attribute not specified (default): no code generated, range is not set for node
140 # - custom: custom C++ implementation in RangeAnalysis.cpp
144 # Indicates whether this instruction can be recovered on bailout.
146 # - attribute not specified (default): no code generated, canRecoverOnBailout
148 # - true: canRecoverOnBailout returns true
149 # - custom: canRecoverOnBailout has a custom C++ implementation
150 # If the value is either 'true' or 'custom', writeRecoverData has a custom C++
155 # Allows cloning for that MIR op.
156 # - attribute not specified (default): no code generated
157 # - true: allows cloning
159 # can_consume_float32
160 # ===================
161 # Indicates whether this instruction's operands can have MIRType::Float32.
163 # - attribute not specified (default): no code generated
164 # - true: canConsumeFloat32 returns true
167 # TODO(no-TI): try to remove this instruction.
170 # Instruction marking on entrypoint for on-stack replacement.
171 # OSR may occur at loop headers (at JSOp::LoopHead).
172 # There is at most one MOsrEntry per MIRGraph.
180 - name: LimitedTruncate
181 gen_boilerplate: false
184 gen_boilerplate: false
186 - name: WasmNullConstant
187 gen_boilerplate: false
189 - name: WasmFloatConstant
190 gen_boilerplate: false
193 gen_boilerplate: false
198 congruent_to: if_operands_equal
201 - name: IsConstructing
204 congruent_to: if_operands_equal
208 gen_boilerplate: false
211 gen_boilerplate: false
214 gen_boilerplate: false
217 gen_boilerplate: false
225 - name: ThrowWithStack
233 gen_boilerplate: false
235 - name: NewArrayDynamicLength
239 templateObject: JSObject*
240 initialHeap: gc::Heap
242 # Need to throw if length is negative.
244 # Throws if length is negative.
247 - name: NewTypedArray
248 gen_boilerplate: false
250 - name: NewTypedArrayDynamicLength
254 templateObject: JSObject*
255 initialHeap: gc::Heap
258 # Throws if length is negative.
261 # Create a new TypedArray from an Array (or Array-like object) or a TypedArray.
262 - name: NewTypedArrayFromArray
266 templateObject: JSObject*
267 initialHeap: gc::Heap
272 # Create a new TypedArray from an ArrayBuffer (or SharedArrayBuffer).
273 - name: NewTypedArrayFromArrayBuffer
279 templateObject: JSObject*
280 initialHeap: gc::Heap
286 gen_boilerplate: false
288 - name: NewPlainObject
289 gen_boilerplate: false
291 - name: NewArrayObject
292 gen_boilerplate: false
295 gen_boilerplate: false
298 gen_boilerplate: false
301 gen_boilerplate: false
304 gen_boilerplate: false
306 - name: NewBoundFunction
308 templateObj: JSObject*
312 - name: BoundFunctionNumArgs
317 congruent_to: if_operands_equal
318 # A bound function's state is immutable, so there is no
319 # implicit dependency.
322 - name: GuardBoundFunctionIsConstructor
328 congruent_to: if_operands_equal
329 # The is-constructor flag is immutable for a bound function.
332 # Setting __proto__ in an object literal.
340 - name: InitPropGetterSetter
347 - name: InitElemGetterSetter
354 gen_boilerplate: false
356 - name: CallClassHook
357 gen_boilerplate: false
360 gen_boilerplate: false
363 gen_boilerplate: false
366 gen_boilerplate: false
368 - name: ConstructArgs
369 gen_boilerplate: false
371 - name: ConstructArray
372 gen_boilerplate: false
375 gen_boilerplate: false
378 gen_boilerplate: false
380 # This op serves as a way to force the encoding of a snapshot, even if there
381 # is no resume point using it. This is useful to run MAssertRecoveredOnBailout
383 - name: EncodeSnapshot
386 - name: AssertRecoveredOnBailout
387 gen_boilerplate: false
389 - name: AssertFloat32
390 gen_boilerplate: false
393 gen_boilerplate: false
395 - name: SameValueDouble
401 congruent_to: if_operands_equal
411 congruent_to: if_operands_equal
416 gen_boilerplate: false
419 gen_boilerplate: false
422 gen_boilerplate: false
425 gen_boilerplate: false
428 gen_boilerplate: false
430 # Caller-side allocation of |this| for |new|:
431 # Constructs |this| when possible, else MagicValue(JS_IS_CONSTRUCTING).
437 # Performs a property read from |newTarget| iff |newTarget| is a JSFunction
438 # with an own |.prototype| property.
442 - name: CreateArgumentsObject
443 gen_boilerplate: false
445 - name: CreateInlinedArgumentsObject
446 gen_boilerplate: false
448 - name: GetInlinedArgument
449 gen_boilerplate: false
451 - name: GetInlinedArgumentHole
452 gen_boilerplate: false
454 - name: GetArgumentsObjectArg
463 - name: SetArgumentsObjectArg
471 # Load |arguments[index]| from a mapped or unmapped arguments object. Bails out
472 # when any elements were overridden or deleted. Also bails out if the index is
474 - name: LoadArgumentsObjectArg
480 congruent_to: if_operands_equal
483 # Load |arguments[index]| from a mapped or unmapped arguments object. Bails out
484 # when any elements were overridden or deleted. Returns undefined if the index is
486 - name: LoadArgumentsObjectArgHole
492 congruent_to: if_operands_equal
495 - name: InArgumentsObjectArg
501 congruent_to: if_operands_equal
504 # Load |arguments.length|. Bails out if the length has been overriden.
505 - name: ArgumentsObjectLength
511 congruent_to: if_operands_equal
512 # Even though the "length" property is lazily resolved, it acts similar to
513 # a normal property load, so we can treat this operation like any other
517 # Create an array from an arguments object.
518 - name: ArrayFromArgumentsObject
526 # Guard that the given flags are not set on the arguments object.
527 - name: GuardArgumentsObjectFlags
536 # The flags are packed with the length in a fixed private slot.
539 - name: LoadScriptedProxyHandler
544 congruent_to: if_operands_equal
548 - name: CheckScriptedProxyGetResult
557 - name: IdToStringOrSymbol
561 congruent_to: if_operands_equal
565 # Given a MIRType::Value A and a MIRType::Object B:
566 # If the Value may be safely unboxed to an Object, return Object(A).
567 # Otherwise, return B.
568 # Used to implement return behavior for inlined constructors.
569 - name: ReturnFromCtor
575 congruent_to: if_operands_equal
579 gen_boilerplate: false
582 gen_boilerplate: false
584 # Converts a uint32 to a double (coming from wasm).
585 - name: WasmUnsignedToDouble
592 congruent_to: if_operands_equal
595 - name: WasmUnsignedToFloat32
596 gen_boilerplate: false
598 - name: WrapInt64ToInt32
599 gen_boilerplate: false
601 - name: ExtendInt32ToInt64
602 gen_boilerplate: false
604 - name: WasmBuiltinTruncateToInt64
605 gen_boilerplate: false
607 - name: WasmTruncateToInt64
608 gen_boilerplate: false
610 - name: WasmTruncateToInt32
611 gen_boilerplate: false
613 - name: WasmAnyRefFromJSValue
616 result_type: WasmAnyRef
617 congruent_to: if_operands_equal
620 - name: WasmAnyRefFromJSObject
624 result_type: WasmAnyRef
625 congruent_to: if_operands_equal
628 - name: WasmAnyRefFromJSString
632 result_type: WasmAnyRef
633 congruent_to: if_operands_equal
636 - name: WasmNewI31Ref
640 result_type: WasmAnyRef
642 congruent_to: if_operands_equal
645 - name: WasmI31RefGet
649 wideningOp: wasm::FieldWideningOp
653 congruent_to: if_operands_equal
656 - name: Int32ToIntPtr
657 gen_boilerplate: false
659 - name: NonNegativeIntPtrToInt32
660 gen_boilerplate: false
662 - name: IntPtrToDouble
663 gen_boilerplate: false
665 - name: AdjustDataViewLength
666 gen_boilerplate: false
668 - name: Int64ToFloatingPoint
669 gen_boilerplate: false
671 - name: BuiltinInt64ToFloatingPoint
672 gen_boilerplate: false
674 - name: ToNumberInt32
675 gen_boilerplate: false
677 - name: BooleanToInt32
682 compute_range: custom
684 congruent_to: if_operands_equal
687 - name: TruncateToInt32
688 gen_boilerplate: false
690 - name: WasmBuiltinTruncateToInt32
691 gen_boilerplate: false
694 gen_boilerplate: false
697 gen_boilerplate: false
699 - name: TruncateBigIntToInt64
700 gen_boilerplate: false
702 - name: Int64ToBigInt
703 gen_boilerplate: false
706 gen_boilerplate: false
709 gen_boilerplate: false
712 gen_boilerplate: false
720 congruent_to: if_operands_equal
725 gen_boilerplate: false
733 - name: ToPropertyKeyCache
739 gen_boilerplate: false
742 gen_boilerplate: false
745 gen_boilerplate: false
748 gen_boilerplate: false
751 gen_boilerplate: false
754 gen_boilerplate: false
756 - name: SignExtendInt32
757 gen_boilerplate: false
759 - name: SignExtendInt64
760 gen_boilerplate: false
763 gen_boilerplate: false
766 gen_boilerplate: false
769 gen_boilerplate: false
772 gen_boilerplate: false
775 gen_boilerplate: false
778 gen_boilerplate: false
781 gen_boilerplate: false
784 gen_boilerplate: false
786 # Inline implementation of atan2 (arctangent of y/x).
793 congruent_to: if_operands_equal
800 gen_boilerplate: false
803 gen_boilerplate: false
806 gen_boilerplate: false
812 compute_range: custom
817 gen_boilerplate: false
820 gen_boilerplate: false
823 gen_boilerplate: false
826 gen_boilerplate: false
829 gen_boilerplate: false
832 gen_boilerplate: false
834 - name: WasmBuiltinDivI64
835 gen_boilerplate: false
838 gen_boilerplate: false
840 - name: WasmBuiltinModD
841 gen_boilerplate: false
843 - name: WasmBuiltinModI64
844 gen_boilerplate: false
847 gen_boilerplate: false
850 gen_boilerplate: false
853 gen_boilerplate: false
856 gen_boilerplate: false
859 gen_boilerplate: false
862 gen_boilerplate: false
865 gen_boilerplate: false
868 gen_boilerplate: false
871 gen_boilerplate: false
874 gen_boilerplate: false
877 gen_boilerplate: false
879 - name: BigIntIncrement
880 gen_boilerplate: false
882 - name: BigIntDecrement
883 gen_boilerplate: false
886 gen_boilerplate: false
889 gen_boilerplate: false
891 - name: Int32ToStringWithBase
902 - name: NumberParseInt
908 congruent_to: if_operands_equal
912 - name: DoubleParseInt
917 congruent_to: if_operands_equal
921 gen_boilerplate: false
923 - name: LinearizeString
928 congruent_to: if_operands_equal
929 # Strings are immutable, so there is no implicit dependency.
932 - name: LinearizeForCharAccess
938 congruent_to: if_operands_equal
939 # Strings are immutable, so there is no implicit dependency.
942 - name: LinearizeForCodePointAccess
948 congruent_to: if_operands_equal
949 # Strings are immutable, so there is no implicit dependency.
952 - name: ToRelativeStringIndex
959 congruent_to: if_operands_equal
969 congruent_to: if_operands_equal
970 # Strings are immutable, so there is no implicit dependency.
972 compute_range: custom
976 # Similar to CharCodeAt, but returns a negative value on out-of-bounds access.
977 - name: CharCodeAtOrNegative
983 congruent_to: if_operands_equal
984 # Strings are immutable, so there is no implicit dependency.
994 congruent_to: if_operands_equal
995 # Strings are immutable, so there is no implicit dependency.
997 compute_range: custom
1000 # Similar to CodePointAt, but returns a negative value on out-of-bounds access.
1001 - name: CodePointAtOrNegative
1007 congruent_to: if_operands_equal
1008 # Strings are immutable, so there is no implicit dependency.
1011 # Return the input if non-negative, otherwise return NaN.
1012 - name: NegativeToNaN
1017 congruent_to: if_operands_equal
1020 # Return the input if non-negative, otherwise return undefined.
1021 - name: NegativeToUndefined
1026 congruent_to: if_operands_equal
1029 - name: FromCharCode
1034 congruent_to: if_operands_equal
1039 # Similar to FromCharCode, but returns the empty string if the input is negative.
1040 - name: FromCharCodeEmptyIfNegative
1045 congruent_to: if_operands_equal
1050 # Similar to FromCharCode, but returns the |undefined| if the input is negative.
1051 - name: FromCharCodeUndefinedIfNegative
1056 congruent_to: if_operands_equal
1059 - name: FromCodePoint
1065 congruent_to: if_operands_equal
1069 - name: StringIncludes
1072 searchString: String
1073 result_type: Boolean
1075 congruent_to: if_operands_equal
1077 possibly_calls: true
1079 - name: StringIndexOf
1082 searchString: String
1085 congruent_to: if_operands_equal
1087 possibly_calls: true
1089 - name: StringLastIndexOf
1092 searchString: String
1095 congruent_to: if_operands_equal
1097 possibly_calls: true
1099 - name: StringStartsWith
1102 searchString: String
1103 result_type: Boolean
1105 congruent_to: if_operands_equal
1107 possibly_calls: true
1109 - name: StringEndsWith
1112 searchString: String
1113 result_type: Boolean
1115 congruent_to: if_operands_equal
1117 possibly_calls: true
1119 - name: StringConvertCase
1120 gen_boilerplate: false
1122 - name: CharCodeConvertCase
1123 gen_boilerplate: false
1125 - name: StringTrimStartIndex
1130 congruent_to: if_operands_equal
1133 - name: StringTrimEndIndex
1139 congruent_to: if_operands_equal
1147 possibly_calls: true
1148 # Although this instruction returns a new array, we don't have to mark
1149 # it as store instruction, see also MNewArray.
1153 - name: BoxNonStrictThis
1157 globalThis: JSObject*
1160 possibly_calls: true
1161 # This instruction can allocate a new object for wrapped primitives, but
1162 # has no effect on existing objects.
1165 - name: ImplicitThis
1171 possibly_calls: true
1174 gen_boilerplate: false
1177 gen_boilerplate: false
1180 gen_boilerplate: false
1183 gen_boilerplate: false
1185 - name: OsrEnvironmentChain
1186 gen_boilerplate: false
1188 - name: OsrArgumentsObject
1189 gen_boilerplate: false
1191 - name: OsrReturnValue
1192 gen_boilerplate: false
1195 gen_boilerplate: false
1202 # Checks whether we need to fire the interrupt handler.
1203 - name: CheckOverRecursed
1208 # Check whether we need to fire the interrupt handler.
1209 - name: InterruptCheck
1213 - name: WasmInterruptCheck
1214 gen_boilerplate: false
1217 gen_boilerplate: false
1219 # Trap if the given ref is null
1220 - name: WasmTrapIfNull
1225 bytecodeOffset: wasm::BytecodeOffset
1230 - name: LexicalCheck
1231 gen_boilerplate: false
1233 # Unconditionally throw an uninitialized let error.
1234 - name: ThrowRuntimeLexicalError
1236 errorNumber: unsigned
1242 gen_boilerplate: false
1244 # In the prologues of global and eval scripts, check for redeclarations and
1245 # initialize bindings.
1246 - name: GlobalDeclInstantiation
1251 source: RegExpObject*
1254 possibly_calls: true
1257 - name: RegExpMatcher
1263 possibly_calls: true
1266 # Note: this instruction writes to cx->regExpSearcherLastLimit.
1267 # See also MRegExpSearcherLastLimit.
1268 - name: RegExpSearcher
1274 possibly_calls: true
1277 # This instruction loads cx->regExpSearcherLastLimit. We don't have a
1278 # specialized alias set for this so just use the default alias set similar to
1279 # the MRegExpSearcher instruction that precedes it.
1280 - name: RegExpSearcherLastLimit
1284 - name: RegExpExecMatch
1289 possibly_calls: true
1292 - name: RegExpExecTest
1296 result_type: Boolean
1297 possibly_calls: true
1300 - name: RegExpHasCaptureGroups
1304 result_type: Boolean
1305 possibly_calls: true
1307 - name: RegExpPrototypeOptimizable
1310 result_type: Boolean
1313 - name: RegExpInstanceOptimizable
1317 result_type: Boolean
1320 - name: GetFirstDollarIndex
1321 gen_boilerplate: false
1323 - name: StringReplace
1324 gen_boilerplate: false
1333 congruent_to: if_operands_equal
1337 - name: ModuleMetadata
1342 - name: DynamicImport
1349 gen_boilerplate: false
1351 - name: FunctionWithProto
1352 gen_boilerplate: false
1361 possibly_calls: true
1363 # Returns obj->slots.
1369 congruent_to: if_operands_equal
1374 # Returns obj->elements.
1378 result_type: Elements
1380 congruent_to: if_operands_equal
1384 # Load the initialized length from an elements header.
1385 - name: InitializedLength
1391 congruent_to: if_operands_equal
1393 compute_range: custom
1396 - name: SetInitializedLength
1404 # Load the array length from an elements header.
1411 congruent_to: if_operands_equal
1414 compute_range: custom
1417 # Store to the length in an elements header. Note the input is an *index*, one
1418 # less than the desired length.
1419 - name: SetArrayLength
1426 # Load the function length. Bails for functions with lazy scripts or a
1427 # resolved "length" property.
1428 - name: FunctionLength
1433 congruent_to: if_operands_equal
1434 # Even though the "length" property is lazily resolved, it acts similar to
1435 # a normal property load, so we can treat this operation like any other
1439 # Load the function name. Bails for bound functions when the bound function
1440 # name prefix isn't present or functions with a resolved "name" property.
1441 - name: FunctionName
1446 congruent_to: if_operands_equal
1447 # Even though the "name" property is lazily resolved, it acts similar to
1448 # a normal property load, so we can treat this operation like any other
1452 - name: GetNextEntryForIterator
1453 gen_boilerplate: false
1455 # Read the byte length of an array buffer as IntPtr.
1456 - name: ArrayBufferByteLength
1461 congruent_to: if_operands_equal
1464 # Read the length of an array buffer view.
1465 - name: ArrayBufferViewLength
1470 congruent_to: if_operands_equal
1472 compute_range: custom
1474 - name: ArrayBufferViewByteOffset
1479 congruent_to: if_operands_equal
1481 compute_range: custom
1483 # Read the length of an array buffer view.
1484 - name: ArrayBufferViewElements
1487 result_type: Elements
1489 congruent_to: if_operands_equal
1493 # Implements the TypedArrayByteOffset intrinsic for resizable typed arrays,
1494 # which calls TypedArrayObject::byteOffsetMaybeOutOfBounds().
1495 - name: ResizableTypedArrayByteOffsetMaybeOutOfBounds
1500 congruent_to: if_operands_equal
1502 compute_range: custom
1504 # Read the length of a resizable typed array.
1505 - name: ResizableTypedArrayLength
1509 requiresMemoryBarrier: MemoryBarrierRequirement
1511 # Not removable or movable when a barrier is needed.
1514 congruent_to: custom
1516 compute_range: custom
1518 # Read the byteLength of a resizable dataview.
1519 - name: ResizableDataViewByteLength
1523 requiresMemoryBarrier: MemoryBarrierRequirement
1525 # Not removable or movable when a barrier is needed.
1528 congruent_to: custom
1530 compute_range: custom
1532 # Read the byte length of a growable shared array buffer as IntPtr.
1533 - name: GrowableSharedArrayBufferByteLength
1541 # Return the element size of a typed array.
1542 - name: TypedArrayElementSize
1547 congruent_to: if_operands_equal
1548 # Class is immutable. See also MHasClass.
1550 compute_range: custom
1552 # Guard an ArrayBufferView has an attached ArrayBuffer.
1553 - name: GuardHasAttachedArrayBuffer
1559 congruent_to: if_operands_equal
1562 # Guard a resizable typed array is in-bounds.
1563 - name: GuardResizableArrayBufferViewInBounds
1569 congruent_to: if_operands_equal
1572 # Guard a resizable typed array is in-bounds or detached.
1573 - name: GuardResizableArrayBufferViewInBoundsOrDetached
1579 congruent_to: if_operands_equal
1582 - name: GuardNumberToIntPtrIndex
1583 gen_boilerplate: false
1585 - name: KeepAliveObject
1591 - name: DebugEnterGCUnsafeRegion
1596 - name: DebugLeaveGCUnsafeRegion
1602 gen_boilerplate: false
1605 gen_boilerplate: false
1607 - name: BoundsCheckLower
1608 gen_boilerplate: false
1610 - name: SpectreMaskIndex
1611 gen_boilerplate: false
1614 gen_boilerplate: false
1616 - name: LoadElementAndUnbox
1617 gen_boilerplate: false
1619 - name: LoadElementHole
1620 gen_boilerplate: false
1622 - name: StoreElement
1623 gen_boilerplate: false
1625 - name: StoreHoleValueElement
1626 gen_boilerplate: false
1628 - name: StoreElementHole
1629 gen_boilerplate: false
1631 - name: ArrayPopShift
1632 gen_boilerplate: false
1634 # Array.prototype.push on a dense array. Returns the new array length.
1641 compute_range: custom
1644 # Array.prototype.slice on a dense array.
1651 templateObj: JSObject*
1652 initialHeap: gc::Heap
1654 possibly_calls: true
1656 # Array.prototype.slice on an arguments object.
1657 - name: ArgumentsSlice
1663 templateObj: JSObject*
1664 initialHeap: gc::Heap
1666 possibly_calls: true
1668 # Array.prototype.slice on an arguments object.
1669 - name: FrameArgumentsSlice
1674 templateObj: JSObject*
1675 initialHeap: gc::Heap
1678 possibly_calls: true
1680 # Array.prototype.slice on an inlined arguments object.
1681 - name: InlineArgumentsSlice
1682 gen_boilerplate: false
1684 - name: NormalizeSliceTerm
1690 congruent_to: if_operands_equal
1694 # MArrayJoin doesn't override |getAliasSet()|, because Array.prototype.join
1695 # might coerce the elements of the Array to strings. This coercion might
1696 # cause the evaluation of JavaScript code.
1702 possibly_calls: true
1704 # MArrayJoin doesn't override |getAliasSet()|, because Array.prototype.join
1705 # might coerce the elements of the Array to strings. This coercion might
1706 # cause the evaluation of JavaScript code.
1708 # Object.prototype.keys. Used to elide it when possible.
1714 # We can recover Object.keys on bailout as long as the object is not escaped
1715 # or that the object is not mutated by any aliased calls in-between the
1716 # instruction and the recovered location, as the recovered keys array might be
1720 # Used to fold Object.keys(obj).length into a single operation.
1722 # This should not be used with a Proxy, as proxies can have a user-defined
1723 # `ownKeys` function which can have arbitrary outputs.
1725 # This MIR node is created by folding an MObjectKeys with an MArrayLength, as
1726 # part of MArrayLength::foldsTo.
1727 - name: ObjectKeysLength
1732 congruent_to: if_operands_equal
1736 - name: LoadUnboxedScalar
1737 gen_boilerplate: false
1739 - name: LoadDataViewElement
1740 gen_boilerplate: false
1742 - name: LoadTypedArrayElementHole
1743 gen_boilerplate: false
1745 - name: StoreUnboxedScalar
1746 gen_boilerplate: false
1748 - name: StoreDataViewElement
1749 gen_boilerplate: false
1751 - name: StoreTypedArrayElementHole
1752 gen_boilerplate: false
1754 - name: EffectiveAddress
1755 gen_boilerplate: false
1757 - name: ClampToUint8
1758 gen_boilerplate: false
1760 - name: LoadFixedSlot
1761 gen_boilerplate: false
1763 - name: LoadFixedSlotAndUnbox
1764 gen_boilerplate: false
1766 - name: LoadDynamicSlotAndUnbox
1767 gen_boilerplate: false
1769 - name: StoreFixedSlot
1770 gen_boilerplate: false
1772 - name: GetPropertyCache
1773 gen_boilerplate: false
1775 - name: HomeObjectSuperBase
1780 congruent_to: if_operands_equal
1783 - name: GetPropSuperCache
1784 gen_boilerplate: false
1786 - name: BindNameCache
1793 environmentChain: Object
1796 congruent_to: custom
1807 congruent_to: custom
1813 fuseIndex: RealmFuses::FuseIndex
1817 congruent_to: custom
1820 - name: GuardMultipleShapes
1827 congruent_to: if_operands_equal
1831 gen_boilerplate: false
1833 - name: GuardNullProto
1834 gen_boilerplate: false
1836 # Guard the object is a native object.
1837 - name: GuardIsNativeObject
1843 congruent_to: if_operands_equal
1846 - name: GuardGlobalGeneration
1849 generationAddr: const void*
1854 congruent_to: custom
1856 - name: GuardIsProxy
1862 congruent_to: if_operands_equal
1865 - name: GuardIsNotDOMProxy
1871 congruent_to: if_operands_equal
1874 - name: GuardIsNotProxy
1880 congruent_to: if_operands_equal
1890 possibly_calls: true
1892 - name: ProxyGetByValue
1897 possibly_calls: true
1899 - name: ProxyHasProp
1905 result_type: Boolean
1906 possibly_calls: true
1915 possibly_calls: true
1917 - name: ProxySetByValue
1924 possibly_calls: true
1926 - name: CallSetArrayLength
1932 possibly_calls: true
1934 - name: MegamorphicLoadSlot
1940 # Bails when non-native or accessor properties are encountered, so we can't
1941 # DCE this instruction.
1943 possibly_calls: true
1944 congruent_to: custom
1947 - name: MegamorphicLoadSlotByValue
1952 # Bails when non-native or accessor properties are encountered, so we can't
1953 # DCE this instruction.
1956 congruent_to: if_operands_equal
1958 possibly_calls: true
1960 - name: MegamorphicStoreSlot
1967 possibly_calls: true
1969 - name: MegamorphicHasProp
1975 result_type: Boolean
1976 # Bails when non-native or accessor properties are encountered, so we can't
1977 # DCE this instruction.
1979 congruent_to: custom
1981 possibly_calls: true
1983 - name: SmallObjectVariableKeyHasProp
1988 congruent_to: custom
1989 result_type: Boolean
1992 - name: GuardIsNotArrayBufferMaybeShared
1998 congruent_to: if_operands_equal
2002 - name: GuardIsTypedArray
2008 congruent_to: if_operands_equal
2011 - name: GuardIsFixedLengthTypedArray
2017 congruent_to: if_operands_equal
2020 - name: GuardIsResizableTypedArray
2026 congruent_to: if_operands_equal
2029 - name: GuardHasProxyHandler
2033 handler: const void*
2037 congruent_to: if_operands_equal
2040 # Loads a specific JSObject* that was originally nursery-allocated.
2041 # See also WarpObjectField.
2042 - name: NurseryObject
2044 # Index in the Vector of objects stored in the WarpSnapshot.
2045 nurseryIndex: uint32_t
2048 congruent_to: custom
2052 gen_boilerplate: false
2054 - name: GuardNullOrUndefined
2060 congruent_to: if_operands_equal
2064 - name: GuardIsNotObject
2070 congruent_to: if_operands_equal
2074 - name: GuardFunctionFlags
2075 gen_boilerplate: false
2077 - name: GuardFunctionIsNonBuiltinCtor
2083 congruent_to: if_operands_equal
2086 - name: GuardFunctionKind
2090 expected: FunctionFlags::FunctionKind
2091 bailOnEquality: bool
2095 congruent_to: custom
2098 - name: GuardFunctionScript
2102 expected: BaseScript*
2104 flags: FunctionFlags
2109 congruent_to: custom
2110 # A JSFunction's BaseScript pointer is immutable. Relazification of
2111 # self-hosted functions is an exception to this, but we don't use this
2112 # guard for self-hosted functions.
2115 - name: GuardObjectIdentity
2116 gen_boilerplate: false
2118 - name: GuardSpecificFunction
2119 gen_boilerplate: false
2121 - name: GuardSpecificAtom
2129 congruent_to: custom
2133 - name: GuardSpecificSymbol
2134 gen_boilerplate: false
2136 - name: GuardSpecificInt32
2147 - name: GuardStringToIndex
2151 # Mark as guard because this instruction must not be eliminated. For
2152 # example, if the string is not an index the operation could change from a
2153 # typed array load to a getter call.
2156 congruent_to: if_operands_equal
2160 - name: GuardStringToInt32
2164 # Mark as guard to prevent the issue described in MGuardStringToIndex's
2168 congruent_to: if_operands_equal
2172 - name: GuardStringToDouble
2176 # Mark as guard to prevent the issue described in MGuardStringToIndex's
2180 congruent_to: if_operands_equal
2184 - name: GuardNoDenseElements
2192 - name: GuardTagNotEqual
2193 gen_boilerplate: false
2195 - name: LoadDynamicSlot
2196 gen_boilerplate: false
2198 # Inline call to access a function's environment (scope chain).
2199 - name: FunctionEnvironment
2205 # A function's environment is fixed.
2208 # Allocate a new BlockLexicalEnvironmentObject.
2209 - name: NewLexicalEnvironmentObject
2215 # Allocate a new ClassBodyEnvironmentObject.
2216 - name: NewClassBodyEnvironmentObject
2222 - name: NewVarEnvironmentObject
2233 # A function's [[HomeObject]] is fixed.
2236 - name: AddAndStoreSlot
2237 gen_boilerplate: false
2239 - name: AllocateAndStoreSlot
2244 slotOffset: uint32_t
2246 numNewSlots: uint32_t
2247 possibly_calls: true
2250 - name: AddSlotAndCallAddPropHook
2256 possibly_calls: true
2258 - name: StoreDynamicSlot
2259 gen_boilerplate: false
2261 - name: GetNameCache
2266 - name: CallGetIntrinsicValue
2270 possibly_calls: true
2272 - name: DeleteProperty
2278 result_type: Boolean
2280 - name: DeleteElement
2286 result_type: Boolean
2288 - name: SetPropertyCache
2289 gen_boilerplate: false
2291 - name: MegamorphicSetElement
2292 gen_boilerplate: false
2294 - name: SetDOMProperty
2295 gen_boilerplate: false
2297 - name: GetDOMProperty
2298 gen_boilerplate: false
2300 - name: GetDOMMember
2301 gen_boilerplate: false
2303 - name: ObjectToIterator
2304 gen_boilerplate: false
2306 - name: ValueToIterator
2311 - name: IteratorHasIndices
2315 result_type: Boolean
2318 - name: LoadSlotByIteratorIndex
2321 iterator: Object # TODO: add MIRType::NativeIterator?
2325 - name: StoreSlotByIteratorIndex
2332 # Load the private value expando from a DOM proxy. The target is stored in the
2333 # proxy object's private slot.
2334 # This is either an UndefinedValue (no expando), ObjectValue (the expando
2335 # object), or PrivateValue(ExpandoAndGeneration*).
2336 - name: LoadDOMExpandoValue
2341 congruent_to: if_operands_equal
2344 - name: LoadDOMExpandoValueGuardGeneration
2345 gen_boilerplate: false
2347 - name: LoadDOMExpandoValueIgnoreGeneration
2352 congruent_to: if_operands_equal
2355 # Takes an expando Value as input, then guards it's either UndefinedValue or
2356 # an object with the expected shape.
2357 - name: GuardDOMExpandoMissingOrGuardShape
2365 congruent_to: custom
2368 - name: StringLength
2374 congruent_to: if_operands_equal
2375 # The string |length| property is immutable, so there is no
2376 # implicit dependency.
2378 compute_range: custom
2383 gen_boilerplate: false
2386 gen_boilerplate: false
2389 gen_boilerplate: false
2392 gen_boilerplate: false
2395 gen_boilerplate: false
2397 - name: GetIteratorCache
2398 gen_boilerplate: false
2400 - name: OptimizeSpreadCallCache
2405 - name: IteratorMore
2413 result_type: Boolean
2422 - name: CloseIterCache
2426 completionKind: uint8_t
2427 possibly_calls: true
2429 - name: OptimizeGetIteratorCache
2432 result_type: Boolean
2435 gen_boilerplate: false
2438 gen_boilerplate: false
2440 - name: GuardElementNotHole
2441 gen_boilerplate: false
2443 - name: NewPrivateName
2447 possibly_calls: true
2449 - name: CheckPrivateFieldCache
2450 gen_boilerplate: false
2453 gen_boilerplate: false
2456 gen_boilerplate: false
2458 # Implementation for instanceof operator with unknown rhs.
2459 - name: InstanceOfCache
2463 result_type: Boolean
2465 - name: ArgumentsLength
2468 congruent_to: if_operands_equal
2469 # Arguments |length| cannot be mutated by Ion Code.
2471 compute_range: custom
2474 # This MIR instruction is used to get an argument from the actual arguments.
2475 - name: GetFrameArgument
2480 congruent_to: if_operands_equal
2481 # This instruction is never aliased, because ops like JSOp::SetArg don't
2482 # write to the argument frames. We create an arguments object in that case.
2485 # This MIR instruction is used to get an argument from the actual arguments.
2486 # Returns undefined if |index| is larger-or-equals to |length|. Bails out if
2487 # |index| is negative.
2488 - name: GetFrameArgumentHole
2495 congruent_to: if_operands_equal
2496 # This instruction is never aliased, because ops like JSOp::SetArg don't
2497 # write to the argument frames. We create an arguments object in that case.
2503 congruent_to: if_operands_equal
2510 numFormals: unsigned
2513 possibly_calls: true
2517 - name: PostWriteBarrier
2518 gen_boilerplate: false
2520 - name: PostWriteElementBarrier
2521 gen_boilerplate: false
2523 - name: AssertCanElidePostWriteBarrier
2531 - name: NewNamedLambdaObject
2533 templateObj: NamedLambdaObject*
2537 - name: NewCallObject
2538 gen_boilerplate: false
2540 - name: NewStringObject
2541 gen_boilerplate: false
2544 gen_boilerplate: false
2546 - name: IsConstructor
2549 result_type: Boolean
2551 congruent_to: if_operands_equal
2554 - name: IsCrossRealmArrayConstructor
2557 result_type: Boolean
2559 congruent_to: if_operands_equal
2565 result_type: Boolean
2568 congruent_to: if_operands_equal
2571 - name: IsNullOrUndefined
2574 result_type: Boolean
2577 congruent_to: if_operands_equal
2580 can_consume_float32: true
2583 gen_boilerplate: false
2585 - name: GuardToClass
2586 gen_boilerplate: false
2588 - name: GuardToEitherClass
2589 gen_boilerplate: false
2591 - name: GuardToFunction
2592 gen_boilerplate: false
2595 gen_boilerplate: false
2597 - name: IsTypedArray
2598 gen_boilerplate: false
2600 - name: ObjectClassToString
2606 congruent_to: if_operands_equal
2607 possibly_calls: true
2608 # Tests @@toStringTag is neither present on this object nor on any object
2609 # of the prototype chain.
2629 - name: AsyncResolve
2642 # Returns from this function to the previous caller; this looks like a regular
2643 # Unary instruction and is used to lie to the MIR generator about suspending
2644 # ops like Yield/Await, which are emitted like returns, but MIR-Build like
2645 # regular instructions.
2646 - name: GeneratorReturn
2658 - name: CheckThisReinit
2667 gen_boilerplate: false
2669 - name: CanSkipAwait
2672 result_type: Boolean
2674 - name: MaybeExtractAwaitValue
2675 gen_boilerplate: false
2677 - name: IncrementWarmUpCounter
2682 - name: AtomicIsLockFree
2683 gen_boilerplate: false
2685 - name: CompareExchangeTypedArrayElement
2686 gen_boilerplate: false
2688 - name: AtomicExchangeTypedArrayElement
2689 gen_boilerplate: false
2691 - name: AtomicTypedArrayElementBinop
2692 gen_boilerplate: false
2695 gen_boilerplate: false
2707 - name: CheckObjCoercible
2713 # Throws on null or undefined.
2716 - name: CheckClassHeritage
2722 - name: DebugCheckSelfHosted
2728 - name: IsPackedArray
2731 result_type: Boolean
2735 - name: GuardArrayIsPacked
2741 congruent_to: if_operands_equal
2744 - name: GetPrototypeOf
2748 # May throw if target is a proxy.
2751 - name: ObjectWithProto
2755 # May throw if prototype is neither an object nor null.
2757 possibly_calls: true
2759 - name: ObjectStaticProto
2760 gen_boilerplate: false
2762 # This is basically just a limited case of Constant, for objects which are
2763 # the prototype of another object and will be used for a GuardShape. It
2764 # includes a reference to the receiver object so we can eliminate redundant
2766 - name: ConstantProto
2767 gen_boilerplate: false
2769 - name: BuiltinObject
2771 builtinObjectKind: BuiltinObjectKind
2773 possibly_calls: true
2775 - name: SuperFunction
2780 congruent_to: if_operands_equal
2783 - name: InitHomeObject
2790 # Return true if the object is definitely a TypedArray constructor, but not
2791 # necessarily from the currently active realm. Return false if the object is
2792 # not a TypedArray constructor or if it's a wrapper.
2793 - name: IsTypedArrayConstructor
2796 result_type: Boolean
2799 # Load the JSValueTag on all platforms except ARM64. See the comments in
2800 # MacroAssembler-arm64.h for the |cmpTag(Register, ImmTag)| method for why
2801 # ARM64 doesn't use the raw JSValueTag, but instead a modified tag value. That
2802 # modified tag value can't be directly compared against JSValueTag constants.
2803 - name: LoadValueTag
2808 congruent_to: if_operands_equal
2811 # Load the target object from a proxy wrapper. The target is stored in the
2812 # proxy object's private slot. This operation is fallible if the proxy can
2814 - name: LoadWrapperTarget
2821 congruent_to: custom
2822 # Can't use |AliasSet::None| because the target changes on navigation.
2823 # TODO: Investigate using a narrower or a custom alias set.
2826 # Guard the accessor shape is present on the object or its prototype chain.
2827 - name: GuardHasGetterSetter
2832 getterSetter: GetterSetter*
2836 possibly_calls: true
2837 congruent_to: custom
2840 - name: GuardIsExtensible
2846 congruent_to: if_operands_equal
2849 - name: GuardInt32IsNonNegative
2855 congruent_to: if_operands_equal
2859 - name: GuardInt32Range
2868 congruent_to: if_operands_equal
2872 # Guard the input index is either greater than the dense initialized length of
2873 # an object, or a hole element.
2874 - name: GuardIndexIsNotDenseElement
2881 congruent_to: if_operands_equal
2884 # Guard an array object's length can be updated successfully when adding an
2885 # element at the input index.
2886 - name: GuardIndexIsValidUpdateOrAdd
2893 congruent_to: if_operands_equal
2896 # Add or update a sparse element of an ArrayObject or PlainObject. It's allowed
2897 # for the sparse element to be already present on the object. It may also be an
2898 # accessor property, so this instruction is always marked as effectful.
2899 - name: CallAddOrUpdateSparseElement
2906 possibly_calls: true
2908 # Get a sparse element from an ArrayObject or PlainObject, possibly by calling
2909 # an accessor property.
2910 - name: CallGetSparseElement
2915 possibly_calls: true
2917 - name: CallNativeGetElement
2922 possibly_calls: true
2924 - name: CallNativeGetElementSuper
2930 possibly_calls: true
2932 # Test if a native object has an own element (sparse or dense) at an index.
2933 - name: CallObjectHasSparseElement
2937 result_type: Boolean
2939 congruent_to: if_operands_equal
2940 possibly_calls: true
2943 - name: BigIntAsIntN
2949 congruent_to: if_operands_equal
2950 possibly_calls: true
2955 - name: BigIntAsUintN
2961 congruent_to: if_operands_equal
2962 possibly_calls: true
2967 - name: GuardNonGCThing
2973 congruent_to: if_operands_equal
2977 - name: ToHashableNonGCThing
2982 congruent_to: if_operands_equal
2985 - name: ToHashableString
2990 congruent_to: if_operands_equal
2992 possibly_calls: true
2994 - name: ToHashableValue
2999 congruent_to: if_operands_equal
3001 possibly_calls: true
3003 - name: HashNonGCThing
3008 congruent_to: if_operands_equal
3016 congruent_to: if_operands_equal
3024 congruent_to: if_operands_equal
3032 congruent_to: if_operands_equal
3040 # In contrast to the previous hash operations, we can't move this
3041 # instruction, because the hashcode is computed from the object's address,
3042 # which can change when the object is moved by the GC.
3054 - name: SetObjectHasNonBigInt
3059 result_type: Boolean
3061 congruent_to: if_operands_equal
3064 - name: SetObjectHasBigInt
3069 result_type: Boolean
3071 congruent_to: if_operands_equal
3074 - name: SetObjectHasValue
3079 result_type: Boolean
3081 congruent_to: if_operands_equal
3084 - name: SetObjectHasValueVMCall
3088 result_type: Boolean
3090 congruent_to: if_operands_equal
3092 possibly_calls: true
3094 - name: SetObjectSize
3099 congruent_to: if_operands_equal
3102 - name: MapObjectHasNonBigInt
3107 result_type: Boolean
3109 congruent_to: if_operands_equal
3112 - name: MapObjectHasBigInt
3117 result_type: Boolean
3119 congruent_to: if_operands_equal
3122 - name: MapObjectHasValue
3127 result_type: Boolean
3129 congruent_to: if_operands_equal
3132 - name: MapObjectHasValueVMCall
3136 result_type: Boolean
3138 congruent_to: if_operands_equal
3140 possibly_calls: true
3142 - name: MapObjectGetNonBigInt
3149 congruent_to: if_operands_equal
3152 - name: MapObjectGetBigInt
3159 congruent_to: if_operands_equal
3162 - name: MapObjectGetValue
3169 congruent_to: if_operands_equal
3172 - name: MapObjectGetValueVMCall
3178 congruent_to: if_operands_equal
3180 possibly_calls: true
3182 - name: MapObjectSize
3187 congruent_to: if_operands_equal
3190 - name: PostIntPtrConversion
3191 gen_boilerplate: false
3194 gen_boilerplate: false
3196 - name: WasmBinaryBitwise
3197 gen_boilerplate: false
3199 - name: WasmLoadInstance
3200 gen_boilerplate: false
3202 - name: WasmStoreInstance
3203 gen_boilerplate: false
3206 gen_boilerplate: false
3208 - name: WasmBoundsCheck
3209 gen_boilerplate: false
3211 - name: WasmBoundsCheckRange32
3217 bytecodeOffset: wasm::BytecodeOffset
3219 congruent_to: if_operands_equal
3222 - name: WasmExtendU32Index
3227 congruent_to: if_operands_equal
3232 - name: WasmWrapU32Index
3237 congruent_to: if_operands_equal
3242 - name: WasmAddOffset
3243 gen_boilerplate: false
3245 - name: WasmAlignmentCheck
3246 gen_boilerplate: false
3249 gen_boilerplate: false
3252 gen_boilerplate: false
3254 - name: AsmJSLoadHeap
3255 gen_boilerplate: false
3257 - name: AsmJSStoreHeap
3258 gen_boilerplate: false
3265 - name: WasmCompareExchangeHeap
3266 gen_boilerplate: false
3268 - name: WasmAtomicExchangeHeap
3269 gen_boilerplate: false
3271 - name: WasmAtomicBinopHeap
3272 gen_boilerplate: false
3274 - name: WasmLoadInstanceDataField
3275 gen_boilerplate: false
3277 - name: WasmLoadGlobalCell
3278 gen_boilerplate: false
3280 - name: WasmLoadTableElement
3281 gen_boilerplate: false
3283 - name: WasmStoreInstanceDataField
3284 gen_boilerplate: false
3286 - name: WasmStoreGlobalCell
3287 gen_boilerplate: false
3289 - name: WasmStoreStackResult
3290 gen_boilerplate: false
3292 - name: WasmDerivedPointer
3293 gen_boilerplate: false
3295 - name: WasmDerivedIndexPointer
3296 gen_boilerplate: false
3298 - name: WasmStoreRef
3299 gen_boilerplate: false
3301 - name: WasmPostWriteBarrierImmediate
3302 gen_boilerplate: false
3304 - name: WasmPostWriteBarrierIndex
3305 gen_boilerplate: false
3307 - name: WasmParameter
3308 gen_boilerplate: false
3311 gen_boilerplate: false
3313 - name: WasmReturnVoid
3314 gen_boilerplate: false
3316 - name: WasmStackArg
3317 gen_boilerplate: false
3319 - name: WasmRegisterResult
3320 gen_boilerplate: false
3322 - name: WasmFloatRegisterResult
3323 gen_boilerplate: false
3325 - name: WasmRegister64Result
3326 gen_boilerplate: false
3328 - name: WasmStackResultArea
3329 gen_boilerplate: false
3331 - name: WasmStackResult
3332 gen_boilerplate: false
3334 - name: WasmCallCatchable
3335 gen_boilerplate: false
3337 - name: WasmCallUncatchable
3338 gen_boilerplate: false
3340 - name: WasmCallLandingPrePad
3341 gen_boilerplate: false
3343 - name: WasmReturnCall
3344 gen_boilerplate: false
3347 gen_boilerplate: false
3349 - name: WasmReinterpret
3350 gen_boilerplate: false
3353 gen_boilerplate: false
3355 - name: WasmBinarySimd128
3356 gen_boilerplate: false
3358 - name: WasmBinarySimd128WithConstant
3359 gen_boilerplate: false
3361 # (v128, i32) -> v128 effect-free shift operations.
3362 - name: WasmShiftSimd128
3367 simdOp: wasm::SimdOp
3369 result_type: Simd128
3371 congruent_to: custom
3375 # (v128, v128, mask) -> v128 effect-free operation.
3376 - name: WasmShuffleSimd128
3381 shuffle: SimdShuffle
3383 result_type: Simd128
3385 congruent_to: custom
3389 - name: WasmReplaceLaneSimd128
3390 gen_boilerplate: false
3392 - name: WasmUnarySimd128
3396 simdOp: wasm::SimdOp
3398 result_type: Simd128
3400 congruent_to: custom
3404 - name: WasmTernarySimd128
3405 gen_boilerplate: false
3407 - name: WasmScalarToSimd128
3408 gen_boilerplate: false
3410 - name: WasmReduceSimd128
3411 gen_boilerplate: false
3413 - name: WasmLoadLaneSimd128
3414 gen_boilerplate: false
3416 - name: WasmStoreLaneSimd128
3417 gen_boilerplate: false
3419 - name: UnreachableResult
3420 gen_boilerplate: false
3422 - name: IonToWasmCall
3423 gen_boilerplate: false
3425 - name: WasmLoadField
3426 gen_boilerplate: false
3428 - name: WasmLoadFieldKA
3429 gen_boilerplate: false
3431 - name: WasmLoadElementKA
3432 gen_boilerplate: false
3434 - name: WasmStoreFieldKA
3435 gen_boilerplate: false
3437 - name: WasmStoreFieldRefKA
3438 gen_boilerplate: false
3440 - name: WasmStoreElementKA
3441 gen_boilerplate: false
3443 - name: WasmStoreElementRefKA
3444 gen_boilerplate: false
3446 - name: WasmRefIsSubtypeOfConcrete
3447 gen_boilerplate: false
3449 - name: WasmRefIsSubtypeOfAbstract
3450 gen_boilerplate: false
3452 - name: WasmNewStructObject
3453 gen_boilerplate: false
3455 - name: WasmNewArrayObject
3456 gen_boilerplate: false
3458 #ifdef FUZZING_JS_FUZZILLI
3459 - name: FuzzilliHash
3460 gen_boilerplate: false
3462 - name: FuzzilliHashStore
3463 gen_boilerplate: false