1 # This Source Code Form is subject to the terms of the Mozilla Public
2 # License, v. 2.0. If a copy of the MPL was not distributed with this
3 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
5 # [SMDOC] CacheIR Opcodes
6 # =======================
7 # This file defines all CacheIR opcodes and their arguments.
9 # Each op has the following attributes:
13 # Opcode name. Convention is to use a name ending in *Result for ops that store
14 # to the IC's output register.
18 # If true, Baseline and Ion use the same CacheIRCompiler code for this op.
19 # If false, the op must be implemented in both BaselineCacheIRCompiler and
24 # Whether this op can be transpiled to MIR by WarpCacheIRTranspiler.
28 # Score of an individual CacheIR Opcode's contribution to the overall score for
29 # each stub. This score is based off of the cost of the masm calls made by the op's
30 # implementation. The higher the score the more costly the op is.
32 # How to decide the cost estimate for a CacheIROp:
33 # 0 points - Generates no code
34 # 1 point - 1-5 simple masm ops, no callVM or callWithABI
35 # 2 points - 5-20 masm ops, no callVM or callWithABI
36 # 3 points - 20+ masm ops, no callVM or callWithABI
37 # 4 points - callWithABI
39 # 6 points - more than one callWithABI or callVM
41 # In the case of the op not being shared, default to counting the Baseline
44 # If the cost estimate is different based off of what branch of a conditional
45 # is taken, assign the score of the branch with the highest cost.
48 # Currently, the scoring is tentative. It is in place to provide an
49 # estimate for the cost of each op. The scoring will be refined.
51 # custom_writer (optional)
52 # ========================
53 # If true, the generated CacheIRWriter method will be private and has a trailing
54 # '_'. This is useful for ops that need custom CacheIRWriter logic on top of the
59 # List of arguments encoded in the bytecode stream. There are three argument
62 # - Id (ObjId, ValId, ...): refers to either an IC input or a value defined by
63 # a previous CacheIR instruction. This is encoded as integer in the bytecode
66 # - Field (ObjectField, StringField, ...): specific value is stored in the stub
67 # data and the bytecode stream stores the offset of this field. This means the
68 # CacheIR is not specialized for particular values and code can be shared.
70 # - Immediate (BoolImm, Int32Imm, JSOpImm, ...): a value baked directly into
71 # the bytecode stream. This is useful for bits of state that need to be
72 # available to all CacheIR compilers/transpilers.
74 # If there's an argument named 'result', the generated CacheIRWriter method will
75 # return a new OperandId of this type.
91 - name: GuardIsNullOrUndefined
105 - name: GuardIsUndefined
112 - name: GuardIsNotUninitializedLexical
119 - name: GuardToBoolean
127 - name: GuardToString
135 - name: GuardToSymbol
143 - name: GuardToBigInt
151 - name: GuardIsNumber
167 - name: GuardToNonGCThing
174 # If the Value is a boolean, convert it to int32.
175 - name: GuardBooleanToInt32
183 - name: GuardToInt32Index
191 - name: Int32ToIntPtr
199 - name: GuardNumberToIntPtrIndex
208 - name: GuardToInt32ModUint32
216 - name: GuardToUint8Clamped
224 # Note: this doesn't accept doubles to avoid ambiguity about whether it includes
225 # int32 values. Use GuardIsNumber instead.
226 - name: GuardNonDoubleType
240 shape: WeakShapeField
242 - name: GuardMultipleShapes
257 proto: WeakObjectField
259 - name: GuardNullProto
266 # Guard per GuardClassKind.
273 kind: GuardClassKindImm
275 # Guard per GuardClassKind.
276 - name: GuardEitherClass
282 kind1: GuardClassKindImm
283 kind2: GuardClassKindImm
285 # Guard on a realm fuse.
291 fuseWord: RealmFuseIndexImm
293 # Guard on an arbitrary JSClass.
294 - name: GuardAnyClass
300 clasp: RawPointerField
302 - name: GuardGlobalGeneration
307 expected: RawInt32Field
308 generationAddr: RawPointerField
310 - name: HasClassResult
316 clasp: RawPointerField
318 - name: CallRegExpMatcherResult
328 - name: CallRegExpSearcherResult
338 - name: RegExpSearcherLastLimitResult
344 - name: RegExpHasCaptureGroupsResult
352 - name: RegExpBuiltinExecMatchResult
361 - name: RegExpBuiltinExecTestResult
370 - name: RegExpFlagResult
378 - name: CallSubstringKernelResult
387 - name: StringReplaceStringResult
394 replacement: StringId
396 - name: StringSplitStringResult
404 - name: RegExpPrototypeOptimizableResult
411 - name: RegExpInstanceOptimizableResult
419 - name: GetFirstDollarIndexResult
426 # Add a reference to a global in the compartment to keep it alive.
427 - name: GuardCompartment
434 compartment: RawPointerField
436 - name: GuardIsExtensible
443 - name: GuardIsNativeObject
457 - name: GuardIsNotProxy
464 - name: GuardIsNotArrayBufferMaybeShared
471 - name: GuardIsTypedArray
478 - name: GuardIsFixedLengthTypedArray
485 - name: GuardIsResizableTypedArray
492 - name: GuardHasProxyHandler
498 handler: RawPointerField
500 - name: GuardIsNotDOMProxy
507 - name: GuardSpecificObject
513 expected: WeakObjectField
515 - name: GuardObjectIdentity
523 - name: GuardSpecificFunction
530 expected: WeakObjectField
531 nargsAndFlags: RawInt32Field
533 - name: GuardFunctionScript
540 expected: WeakBaseScriptField
541 nargsAndFlags: RawInt32Field
543 - name: GuardSpecificAtom
551 - name: GuardSpecificSymbol
557 expected: SymbolField
559 - name: GuardSpecificInt32
567 - name: GuardNoDenseElements
574 - name: GuardStringToIndex
582 - name: GuardStringToInt32
590 - name: GuardStringToNumber
606 - name: BooleanToNumber
614 - name: GuardHasGetterSetter
621 getterSetter: WeakGetterSetterField
623 - name: GuardInt32IsNonNegative
630 - name: GuardIndexIsValidUpdateOrAdd
638 - name: GuardIndexIsNotDenseElement
646 - name: GuardTagNotEqual
654 - name: GuardXrayExpandoShapeAndDefaultProto
660 shapeWrapper: ObjectField
662 - name: GuardXrayNoExpando
669 # Guard obj[slot] == expected.
670 - name: GuardDynamicSlotIsSpecificObject
679 # Guard obj[slot] is not an object.
680 - name: GuardDynamicSlotIsNotObject
688 - name: GuardFixedSlotValue
694 offset: RawInt32Field
697 - name: GuardDynamicSlotValue
703 offset: RawInt32Field
706 - name: LoadScriptedProxyHandler
714 - name: IdToStringOrSymbol
722 - name: LoadFixedSlot
729 offset: RawInt32Field
731 - name: LoadDynamicSlot
740 - name: GuardNoAllocationMetadataBuilder
745 builderAddr: RawPointerField
747 - name: GuardFunctionHasJitEntry
754 - name: GuardFunctionHasNoJitEntry
761 - name: GuardFunctionIsNonBuiltinCtor
768 - name: GuardFunctionIsConstructor
775 - name: GuardNotClassConstructor
782 - name: GuardArrayIsPacked
789 - name: GuardArgumentsObjectFlags
805 # This is just LoadObject with extra information for the purpose of optimizing
806 # out shape guards if we're just storing to slots of the receiver object.
807 - name: LoadProtoObject
813 protoObj: ObjectField
824 - name: LoadEnclosingEnvironment
832 - name: LoadWrapperTarget
849 - name: LoadArgumentFixedSlot
858 - name: LoadArgumentDynamicSlot
868 - name: TruncateDoubleToUInt32
876 - name: DoubleToUint8Clamped
884 - name: MegamorphicLoadSlotResult
892 - name: MegamorphicLoadSlotByValueResult
900 - name: MegamorphicLoadSlotPermissiveResult
908 - name: MegamorphicLoadSlotByValuePermissiveResult
916 - name: MegamorphicStoreSlot
926 - name: MegamorphicSetElement
936 - name: MegamorphicHasPropResult
945 # For the case where we have an object with a small number of properties,
946 # we can do better than a megamorphic hasprop if we just run through those
947 # IDs and check for atom pointer equality.
948 - name: SmallObjectVariableKeyHasOwnResult
953 # We don't actually need the object, because we only care about the shape,
954 # which was guarded before this
956 # We include the prop names to speed up and simplify the Baseline case,
957 # but only the shape is used from Ion to achieve an unrolled loop with
958 # comparisons to known atoms
959 propNames: ObjectField
962 - name: ObjectToIteratorResult
968 enumeratorsAddr: RawPointerField
970 - name: ValueToIteratorResult
977 # See CacheIR.cpp 'DOM proxies' comment.
978 - name: LoadDOMExpandoValue
986 - name: LoadDOMExpandoValueGuardGeneration
992 expandoAndGeneration: RawPointerField
993 generation: RawInt64Field
996 - name: LoadDOMExpandoValueIgnoreGeneration
1004 - name: GuardDOMExpandoMissingOrGuardShape
1012 - name: StoreFixedSlot
1018 offset: RawInt32Field
1021 - name: StoreDynamicSlot
1027 offset: RawInt32Field
1030 - name: AddAndStoreFixedSlot
1036 offset: RawInt32Field
1038 newShape: ShapeField
1040 - name: AddAndStoreDynamicSlot
1046 offset: RawInt32Field
1048 newShape: ShapeField
1050 - name: AllocateAndStoreDynamicSlot
1056 offset: RawInt32Field
1058 newShape: ShapeField
1059 numNewSlots: RawInt32Field
1061 - name: AddSlotAndCallAddPropHook
1068 newShape: ShapeField
1070 - name: StoreDenseElement
1079 - name: StoreDenseElementHole
1097 - name: ArrayJoinResult
1105 - name: ObjectKeysResult
1112 - name: PackedArrayPopResult
1119 - name: PackedArrayShiftResult
1126 - name: PackedArraySliceResult
1131 templateObject: ObjectField
1136 - name: ArgumentsSliceResult
1141 templateObject: ObjectField
1146 - name: IsArrayResult
1153 - name: StoreFixedSlotUndefinedResult
1158 offset: RawInt32Field
1161 - name: IsObjectResult
1168 - name: IsPackedArrayResult
1175 - name: IsCallableResult
1182 - name: IsConstructorResult
1189 - name: IsCrossRealmArrayConstructorResult
1196 - name: IsTypedArrayResult
1202 isPossiblyWrapped: BoolImm
1204 - name: IsTypedArrayConstructorResult
1211 - name: ArrayBufferViewByteOffsetInt32Result
1218 - name: ArrayBufferViewByteOffsetDoubleResult
1225 - name: ResizableTypedArrayByteOffsetMaybeOutOfBoundsInt32Result
1232 - name: ResizableTypedArrayByteOffsetMaybeOutOfBoundsDoubleResult
1239 - name: TypedArrayByteLengthInt32Result
1246 - name: TypedArrayByteLengthDoubleResult
1253 - name: ResizableTypedArrayByteLengthInt32Result
1260 - name: ResizableTypedArrayByteLengthDoubleResult
1267 - name: ResizableTypedArrayLengthInt32Result
1274 - name: ResizableTypedArrayLengthDoubleResult
1281 - name: TypedArrayElementSizeResult
1288 - name: ResizableDataViewByteLengthInt32Result
1295 - name: ResizableDataViewByteLengthDoubleResult
1302 - name: GrowableSharedArrayBufferByteLengthInt32Result
1309 - name: GrowableSharedArrayBufferByteLengthDoubleResult
1316 - name: GuardHasAttachedArrayBuffer
1323 - name: GuardResizableArrayBufferViewInBounds
1330 - name: GuardResizableArrayBufferViewInBoundsOrDetached
1337 - name: NewArrayIteratorResult
1342 templateObject: ObjectField
1344 - name: NewStringIteratorResult
1349 templateObject: ObjectField
1351 - name: NewRegExpStringIteratorResult
1356 templateObject: ObjectField
1358 - name: ObjectCreateResult
1363 templateObject: ObjectField
1365 - name: NewArrayFromLengthResult
1370 templateObject: ObjectField
1373 - name: NewTypedArrayFromLengthResult
1378 templateObject: ObjectField
1381 - name: NewTypedArrayFromArrayBufferResult
1386 templateObject: ObjectField
1391 - name: NewTypedArrayFromArrayResult
1396 templateObject: ObjectField
1399 - name: NewStringObjectResult
1404 templateObject: ObjectField
1407 - name: StringFromCharCodeResult
1414 - name: StringFromCodePointResult
1421 - name: StringIncludesResult
1429 - name: StringIndexOfResult
1437 - name: StringLastIndexOfResult
1445 - name: StringStartsWithResult
1453 - name: StringEndsWithResult
1461 - name: StringToLowerCaseResult
1468 - name: StringToUpperCaseResult
1475 - name: StringTrimResult
1482 - name: StringTrimStartResult
1489 - name: StringTrimEndResult
1496 - name: MathAbsInt32Result
1503 - name: MathAbsNumberResult
1510 - name: MathClz32Result
1517 - name: MathSignInt32Result
1524 - name: MathSignNumberResult
1531 - name: MathSignNumberToInt32Result
1538 - name: MathImulResult
1546 - name: MathSqrtNumberResult
1553 - name: MathFRoundNumberResult
1560 - name: MathF16RoundNumberResult
1567 # Because Baseline stub code is shared by all realms in the Zone, this
1568 # instruction loads a pointer to the RNG from a stub field.
1569 - name: MathRandomResult
1574 rng: RawPointerField
1576 - name: MathHypot2NumberResult
1584 - name: MathHypot3NumberResult
1593 - name: MathHypot4NumberResult
1603 - name: MathAtan2NumberResult
1611 - name: MathFloorNumberResult
1618 - name: MathCeilNumberResult
1625 - name: MathTruncNumberResult
1632 - name: MathFloorToInt32Result
1639 - name: MathCeilToInt32Result
1646 - name: MathTruncToInt32Result
1652 - name: MathRoundToInt32Result
1669 - name: NumberMinMax
1679 - name: Int32MinMaxArrayResult
1687 - name: NumberMinMaxArrayResult
1695 - name: MathFunctionNumberResult
1701 fun: UnaryMathFunctionImm
1703 - name: NumberParseIntResult
1711 - name: DoubleParseIntResult
1718 - name: ObjectToStringResult
1725 - name: ReflectGetPrototypeOfResult
1732 - name: StoreTypedArrayElement
1738 elementType: ScalarTypeImm
1742 viewKind: ArrayBufferViewKindImm
1744 - name: AtomicsCompareExchangeResult
1753 elementType: ScalarTypeImm
1754 viewKind: ArrayBufferViewKindImm
1756 - name: AtomicsExchangeResult
1764 elementType: ScalarTypeImm
1765 viewKind: ArrayBufferViewKindImm
1767 - name: AtomicsAddResult
1775 elementType: ScalarTypeImm
1777 viewKind: ArrayBufferViewKindImm
1779 - name: AtomicsSubResult
1787 elementType: ScalarTypeImm
1789 viewKind: ArrayBufferViewKindImm
1791 - name: AtomicsAndResult
1799 elementType: ScalarTypeImm
1801 viewKind: ArrayBufferViewKindImm
1803 - name: AtomicsOrResult
1811 elementType: ScalarTypeImm
1813 viewKind: ArrayBufferViewKindImm
1815 - name: AtomicsXorResult
1823 elementType: ScalarTypeImm
1825 viewKind: ArrayBufferViewKindImm
1827 - name: AtomicsLoadResult
1834 elementType: ScalarTypeImm
1835 viewKind: ArrayBufferViewKindImm
1837 - name: AtomicsStoreResult
1845 elementType: ScalarTypeImm
1846 viewKind: ArrayBufferViewKindImm
1848 - name: AtomicsIsLockFreeResult
1855 - name: CallNativeSetter
1865 nargsAndFlags: RawInt32Field
1867 - name: CallScriptedSetter
1877 nargsAndFlags: RawInt32Field
1879 - name: CallInlinedSetter
1888 icScript: RawPointerField
1890 nargsAndFlags: RawInt32Field
1892 - name: CallDOMSetter
1898 jitInfo: RawPointerField
1901 - name: CallSetArrayLength
1920 - name: ProxySetByValue
1930 - name: CallAddOrUpdateSparseElementHelper
1940 - name: CallInt32ToString
1948 - name: CallNumberToString
1956 - name: Int32ToStringWithBaseResult
1964 - name: BooleanToString
1972 - name: CallScriptedFunction
1981 argcFixed: UInt32Imm
1983 - name: CallBoundScriptedFunction
1992 numBoundArgs: UInt32Imm
1994 - name: CallWasmFunction
2002 argcFixed: UInt32Imm
2003 funcType: RawPointerField
2004 instance: ObjectField
2006 - name: GuardWasmArg
2012 type: WasmValTypeImm
2014 - name: CallNativeFunction
2023 argcFixed: UInt32Imm
2025 target: RawPointerField
2027 ignoresReturnValue: BoolImm
2030 - name: CallDOMFunction
2040 argcFixed: UInt32Imm
2042 target: RawPointerField
2045 - name: CallClassHook
2054 argcFixed: UInt32Imm
2055 target: RawPointerField
2057 - name: CallInlinedFunction
2065 icScript: RawPointerField
2067 argcFixed: UInt32Imm
2070 - name: CallScriptedProxyGetResult
2081 nargsAndFlags: UInt32Imm
2083 - name: CallScriptedProxyGetByValueResult
2094 nargsAndFlags: UInt32Imm
2097 # Meta ops generate no code, but contain data for the Warp Transpiler.
2098 - name: MetaScriptedThisShape
2104 thisShape: ShapeField
2106 - name: BindFunctionResult
2113 templateObject: ObjectField
2115 - name: SpecializedBindFunctionResult
2122 templateObject: ObjectField
2124 - name: LoadFixedSlotResult
2130 offset: RawInt32Field
2132 - name: LoadFixedSlotTypedResult
2138 offset: RawInt32Field
2141 - name: LoadDynamicSlotResult
2147 offset: RawInt32Field
2149 - name: LoadDenseElementResult
2157 - name: LoadDenseElementHoleResult
2165 - name: CallGetSparseElementResult
2173 - name: LoadDenseElementExistsResult
2181 - name: LoadTypedArrayElementExistsResult
2188 viewKind: ArrayBufferViewKindImm
2190 - name: LoadDenseElementHoleExistsResult
2198 - name: LoadTypedArrayElementResult
2205 elementType: ScalarTypeImm
2207 forceDoubleForUint32: BoolImm
2208 viewKind: ArrayBufferViewKindImm
2210 - name: LoadDataViewValueResult
2217 littleEndian: BooleanId
2218 elementType: ScalarTypeImm
2219 forceDoubleForUint32: BoolImm
2220 viewKind: ArrayBufferViewKindImm
2222 - name: StoreDataViewValueResult
2230 littleEndian: BooleanId
2231 elementType: ScalarTypeImm
2232 viewKind: ArrayBufferViewKindImm
2234 - name: LoadInt32ArrayLengthResult
2241 - name: LoadInt32ArrayLength
2249 - name: LoadArgumentsObjectArgResult
2257 - name: LoadArgumentsObjectArgHoleResult
2265 - name: LoadArgumentsObjectArgExistsResult
2273 - name: LoadArgumentsObjectLengthResult
2280 - name: LoadArgumentsObjectLength
2288 - name: LoadFunctionLengthResult
2295 - name: LoadFunctionNameResult
2302 - name: LoadBoundFunctionNumArgs
2310 - name: LoadBoundFunctionTarget
2318 - name: GuardBoundFunctionIsConstructor
2325 - name: LoadArrayBufferByteLengthInt32Result
2332 - name: LoadArrayBufferByteLengthDoubleResult
2339 - name: LoadArrayBufferViewLengthInt32Result
2346 - name: LoadArrayBufferViewLengthDoubleResult
2353 - name: LinearizeForCharAccess
2362 - name: LinearizeForCodePointAccess
2371 - name: ToRelativeStringIndex
2380 - name: LoadStringCharResult
2389 - name: LoadStringAtResult
2398 - name: LoadStringCharCodeResult
2407 - name: LoadStringCodePointResult
2416 - name: LoadStringLengthResult
2423 - name: FrameIsConstructingResult
2429 - name: LoadObjectResult
2436 - name: LoadStringResult
2443 - name: LoadSymbolResult
2450 - name: LoadInt32Result
2457 - name: LoadDoubleResult
2464 - name: LoadBigIntResult
2471 - name: CallScriptedGetterResult
2480 nargsAndFlags: RawInt32Field
2482 - name: CallInlinedGetterResult
2490 icScript: RawPointerField
2492 nargsAndFlags: RawInt32Field
2494 - name: CallNativeGetterResult
2503 nargsAndFlags: RawInt32Field
2505 - name: CallDOMGetterResult
2511 jitInfo: RawPointerField
2513 - name: ProxyGetResult
2521 - name: ProxyGetByValueResult
2529 - name: ProxyHasPropResult
2538 - name: CallObjectHasSparseElementResult
2546 - name: CallNativeGetElementResult
2554 - name: CallNativeGetElementSuperResult
2563 - name: GetNextMapSetEntryForIteratorResult
2572 - name: LoadUndefinedResult
2578 - name: LoadBooleanResult
2585 - name: LoadInt32Constant
2593 - name: LoadDoubleConstant
2601 - name: LoadBooleanConstant
2609 - name: LoadUndefined
2616 - name: LoadConstantString
2624 - name: LoadConstantStringResult
2631 - name: LoadInstanceOfObjectResult
2639 - name: LoadTypeOfObjectResult
2646 - name: LoadTypeOfEqObjectResult
2652 operand: TypeofEqOperandImm
2654 - name: DoubleAddResult
2662 - name: DoubleSubResult
2670 - name: DoubleMulResult
2678 - name: DoubleDivResult
2686 - name: DoubleModResult
2694 - name: DoublePowResult
2702 - name: Int32AddResult
2710 - name: Int32SubResult
2718 - name: Int32MulResult
2726 - name: Int32DivResult
2734 - name: Int32ModResult
2742 - name: Int32PowResult
2750 - name: BigIntAddResult
2758 - name: BigIntSubResult
2766 - name: BigIntMulResult
2774 - name: BigIntDivResult
2782 - name: BigIntModResult
2790 - name: BigIntPowResult
2798 - name: Int32BitOrResult
2806 - name: Int32BitXorResult
2814 - name: Int32BitAndResult
2822 - name: Int32LeftShiftResult
2830 - name: Int32RightShiftResult
2838 - name: Int32URightShiftResult
2845 forceDouble: BoolImm
2847 - name: Int32NotResult
2854 - name: BigIntBitOrResult
2862 - name: BigIntBitXorResult
2870 - name: BigIntBitAndResult
2878 - name: BigIntLeftShiftResult
2886 - name: BigIntRightShiftResult
2894 - name: BigIntNotResult
2901 - name: Int32NegationResult
2908 - name: DoubleNegationResult
2915 - name: BigIntNegationResult
2922 - name: Int32IncResult
2929 - name: Int32DecResult
2936 - name: DoubleIncResult
2943 - name: DoubleDecResult
2950 - name: BigIntIncResult
2957 - name: BigIntDecResult
2964 - name: LoadInt32TruthyResult
2971 - name: LoadDoubleTruthyResult
2978 - name: LoadStringTruthyResult
2985 - name: LoadObjectTruthyResult
2992 - name: LoadBigIntTruthyResult
2999 - name: LoadValueTruthyResult
3006 - name: LoadValueResult
3013 - name: LoadOperandResult
3020 - name: NewPlainObjectResult
3025 numFixedSlots: UInt32Imm
3026 numDynamicSlots: UInt32Imm
3027 allocKind: AllocKindImm
3029 site: AllocSiteField
3031 - name: NewArrayObjectResult
3036 arrayLength: UInt32Imm
3038 site: AllocSiteField
3040 - name: CallStringConcatResult
3048 - name: CallStringObjectConcatResult
3056 - name: CallIsSuspendedGeneratorResult
3063 - name: CompareStringResult
3072 - name: CompareObjectResult
3081 - name: CompareSymbolResult
3090 - name: CompareInt32Result
3099 - name: CompareDoubleResult
3108 - name: CompareBigIntResult
3117 - name: CompareBigIntInt32Result
3126 - name: CompareBigIntNumberResult
3135 - name: CompareBigIntStringResult
3144 - name: CompareNullUndefinedResult
3150 isUndefined: BoolImm
3153 - name: CompareDoubleSameValueResult
3161 - name: SameValueResult
3169 - name: IndirectTruncateInt32Result
3176 - name: BigIntAsIntNResult
3184 - name: BigIntAsUintNResult
3192 - name: SetHasResult
3200 - name: SetHasNonGCThingResult
3208 - name: SetHasStringResult
3216 - name: SetHasSymbolResult
3224 - name: SetHasBigIntResult
3232 - name: SetHasObjectResult
3240 - name: SetSizeResult
3247 - name: MapHasResult
3255 - name: MapHasNonGCThingResult
3263 - name: MapHasStringResult
3271 - name: MapHasSymbolResult
3279 - name: MapHasBigIntResult
3287 - name: MapHasObjectResult
3295 - name: MapGetResult
3303 - name: MapGetNonGCThingResult
3311 - name: MapGetStringResult
3319 - name: MapGetSymbolResult
3327 - name: MapGetBigIntResult
3335 - name: MapGetObjectResult
3343 - name: MapSizeResult
3350 - name: ArrayFromArgumentsObjectResult
3358 - name: CloseIterScriptedResult
3365 kind: CompletionKindImm
3366 targetNargs: UInt32Imm
3368 - name: CallPrintString
3373 str: StaticStringImm
3393 - name: AssertRecoveredOnBailoutResult
3399 mustBeRecovered: BoolImm
3401 - name: AssertPropertyLookup
3410 #ifdef FUZZING_JS_FUZZILLI
3411 - name: FuzzilliHashResult