1 # This Source Code Form is subject to the terms of the Mozilla Public
2 # License, v. 2.0. If a copy of the MPL was not distributed with this
3 # file, You can obtain one at http://mozilla.org/MPL/2.0/.
5 # [SMDOC] CacheIR Opcodes
6 # =======================
7 # This file defines all CacheIR opcodes and their arguments.
9 # Each op has the following attributes:
13 # Opcode name. Convention is to use a name ending in *Result for ops that store
14 # to the IC's output register.
18 # If true, Baseline and Ion use the same CacheIRCompiler code for this op.
19 # If false, the op must be implemented in both BaselineCacheIRCompiler and
24 # Whether this op can be transpiled to MIR by WarpCacheIRTranspiler.
28 # Score of an individual CacheIR Opcode's contribution to the overall score for
29 # each stub. This score is based off of the cost of the masm calls made by the op's
30 # implementation. The higher the score the more costly the op is.
32 # How to decide the cost estimate for a CacheIROp:
33 # 0 points - Generates no code
34 # 1 point - 1-5 simple masm ops, no callVM or callWithABI
35 # 2 points - 5-20 masm ops, no callVM or callWithABI
36 # 3 points - 20+ masm ops, no callVM or callWithABI
37 # 4 points - callWithABI
39 # 6 points - more than one callWithABI or callVM
41 # In the case of the op not being shared, default to counting the Baseline
44 # If the cost estimate is different based off of what branch of a conditional
45 # is taken, assign the score of the branch with the highest cost.
48 # Currently, the scoring is tentative. It is in place to provide an
49 # estimate for the cost of each op. The scoring will be refined.
51 # custom_writer (optional)
52 # ========================
53 # If true, the generated CacheIRWriter method will be private and has a trailing
54 # '_'. This is useful for ops that need custom CacheIRWriter logic on top of the
59 # List of arguments encoded in the bytecode stream. There are three argument
62 # - Id (ObjId, ValId, ...): refers to either an IC input or a value defined by
63 # a previous CacheIR instruction. This is encoded as integer in the bytecode
66 # - Field (ObjectField, StringField, ...): specific value is stored in the stub
67 # data and the bytecode stream stores the offset of this field. This means the
68 # CacheIR is not specialized for particular values and code can be shared.
70 # - Immediate (BoolImm, Int32Imm, JSOpImm, ...): a value baked directly into
71 # the bytecode stream. This is useful for bits of state that need to be
72 # available to all CacheIR compilers/transpilers.
74 # If there's an argument named 'result', the generated CacheIRWriter method will
75 # return a new OperandId of this type.
91 - name: GuardIsNullOrUndefined
105 - name: GuardIsUndefined
112 - name: GuardIsNotUninitializedLexical
119 - name: GuardToBoolean
127 - name: GuardToString
135 - name: GuardToSymbol
143 - name: GuardToBigInt
151 - name: GuardIsNumber
167 - name: GuardToNonGCThing
174 # If the Value is a boolean, convert it to int32.
175 - name: GuardBooleanToInt32
183 - name: GuardToInt32Index
191 - name: Int32ToIntPtr
199 - name: GuardNumberToIntPtrIndex
208 - name: GuardToInt32ModUint32
216 - name: GuardToUint8Clamped
224 # Note: this doesn't accept doubles to avoid ambiguity about whether it includes
225 # int32 values. Use GuardIsNumber instead.
226 - name: GuardNonDoubleType
240 shape: WeakShapeField
242 - name: GuardMultipleShapes
257 proto: WeakObjectField
259 - name: GuardNullProto
266 # Guard per GuardClassKind.
273 kind: GuardClassKindImm
275 # Guard on a realm fuse.
281 fuseWord: RealmFuseIndexImm
283 # Guard on an arbitrary JSClass.
284 - name: GuardAnyClass
290 clasp: RawPointerField
292 - name: GuardGlobalGeneration
297 expected: RawInt32Field
298 generationAddr: RawPointerField
300 - name: HasClassResult
306 clasp: RawPointerField
308 - name: CallRegExpMatcherResult
318 - name: CallRegExpSearcherResult
328 - name: RegExpSearcherLastLimitResult
334 - name: RegExpHasCaptureGroupsResult
342 - name: RegExpBuiltinExecMatchResult
351 - name: RegExpBuiltinExecTestResult
360 - name: RegExpFlagResult
368 - name: CallSubstringKernelResult
377 - name: StringReplaceStringResult
384 replacement: StringId
386 - name: StringSplitStringResult
394 - name: RegExpPrototypeOptimizableResult
401 - name: RegExpInstanceOptimizableResult
409 - name: GetFirstDollarIndexResult
416 # Add a reference to a global in the compartment to keep it alive.
417 - name: GuardCompartment
424 compartment: RawPointerField
426 - name: GuardIsExtensible
433 - name: GuardIsNativeObject
447 - name: GuardIsNotProxy
454 - name: GuardIsNotArrayBufferMaybeShared
461 - name: GuardIsTypedArray
468 - name: GuardIsFixedLengthTypedArray
475 - name: GuardHasProxyHandler
481 handler: RawPointerField
483 - name: GuardIsNotDOMProxy
490 - name: GuardSpecificObject
496 expected: WeakObjectField
498 - name: GuardObjectIdentity
506 - name: GuardSpecificFunction
513 expected: WeakObjectField
514 nargsAndFlags: RawInt32Field
516 - name: GuardFunctionScript
523 expected: WeakBaseScriptField
524 nargsAndFlags: RawInt32Field
526 - name: GuardSpecificAtom
534 - name: GuardSpecificSymbol
540 expected: SymbolField
542 - name: GuardSpecificInt32
550 - name: GuardNoDenseElements
557 - name: GuardStringToIndex
565 - name: GuardStringToInt32
573 - name: GuardStringToNumber
581 - name: BooleanToNumber
589 - name: GuardHasGetterSetter
596 getterSetter: WeakGetterSetterField
598 - name: GuardInt32IsNonNegative
605 - name: GuardIndexIsValidUpdateOrAdd
613 - name: GuardIndexIsNotDenseElement
621 - name: GuardTagNotEqual
629 - name: GuardXrayExpandoShapeAndDefaultProto
635 shapeWrapper: ObjectField
637 - name: GuardXrayNoExpando
644 # Guard obj[slot] == expected.
645 - name: GuardDynamicSlotIsSpecificObject
654 # Guard obj[slot] is not an object.
655 - name: GuardDynamicSlotIsNotObject
663 - name: GuardFixedSlotValue
669 offset: RawInt32Field
672 - name: GuardDynamicSlotValue
678 offset: RawInt32Field
681 - name: LoadScriptedProxyHandler
689 - name: IdToStringOrSymbol
697 - name: LoadFixedSlot
704 offset: RawInt32Field
706 - name: LoadDynamicSlot
715 - name: GuardNoAllocationMetadataBuilder
720 builderAddr: RawPointerField
722 - name: GuardFunctionHasJitEntry
728 constructing: BoolImm
730 - name: GuardFunctionHasNoJitEntry
737 - name: GuardFunctionIsNonBuiltinCtor
744 - name: GuardFunctionIsConstructor
751 - name: GuardNotClassConstructor
758 - name: GuardArrayIsPacked
765 - name: GuardArgumentsObjectFlags
781 # This is just LoadObject with extra information for the purpose of optimizing
782 # out shape guards if we're just storing to slots of the receiver object.
783 - name: LoadProtoObject
789 protoObj: ObjectField
800 - name: LoadEnclosingEnvironment
808 - name: LoadWrapperTarget
824 - name: LoadArgumentFixedSlot
833 - name: LoadArgumentDynamicSlot
843 - name: TruncateDoubleToUInt32
851 - name: DoubleToUint8Clamped
859 - name: MegamorphicLoadSlotResult
867 - name: MegamorphicLoadSlotByValueResult
875 - name: MegamorphicStoreSlot
885 - name: MegamorphicSetElement
895 - name: MegamorphicHasPropResult
904 - name: ObjectToIteratorResult
910 enumeratorsAddr: RawPointerField
912 - name: ValueToIteratorResult
919 # See CacheIR.cpp 'DOM proxies' comment.
920 - name: LoadDOMExpandoValue
928 - name: LoadDOMExpandoValueGuardGeneration
934 expandoAndGeneration: RawPointerField
935 generation: RawInt64Field
938 - name: LoadDOMExpandoValueIgnoreGeneration
946 - name: GuardDOMExpandoMissingOrGuardShape
954 - name: StoreFixedSlot
960 offset: RawInt32Field
963 - name: StoreDynamicSlot
969 offset: RawInt32Field
972 - name: AddAndStoreFixedSlot
978 offset: RawInt32Field
982 - name: AddAndStoreDynamicSlot
988 offset: RawInt32Field
992 - name: AllocateAndStoreDynamicSlot
998 offset: RawInt32Field
1000 newShape: ShapeField
1001 numNewSlots: RawInt32Field
1003 - name: AddSlotAndCallAddPropHook
1010 newShape: ShapeField
1012 - name: StoreDenseElement
1021 - name: StoreDenseElementHole
1039 - name: ArrayJoinResult
1047 - name: ObjectKeysResult
1054 - name: PackedArrayPopResult
1061 - name: PackedArrayShiftResult
1068 - name: PackedArraySliceResult
1073 templateObject: ObjectField
1078 - name: ArgumentsSliceResult
1083 templateObject: ObjectField
1088 - name: IsArrayResult
1095 - name: StoreFixedSlotUndefinedResult
1100 offset: RawInt32Field
1103 - name: IsObjectResult
1110 - name: IsPackedArrayResult
1117 - name: IsCallableResult
1124 - name: IsConstructorResult
1131 - name: IsCrossRealmArrayConstructorResult
1138 - name: IsTypedArrayResult
1144 isPossiblyWrapped: BoolImm
1146 - name: IsTypedArrayConstructorResult
1153 - name: ArrayBufferViewByteOffsetInt32Result
1160 - name: ArrayBufferViewByteOffsetDoubleResult
1167 - name: TypedArrayByteLengthInt32Result
1174 - name: TypedArrayByteLengthDoubleResult
1181 - name: TypedArrayElementSizeResult
1188 - name: GuardHasAttachedArrayBuffer
1195 - name: NewArrayIteratorResult
1200 templateObject: ObjectField
1202 - name: NewStringIteratorResult
1207 templateObject: ObjectField
1209 - name: NewRegExpStringIteratorResult
1214 templateObject: ObjectField
1216 - name: ObjectCreateResult
1221 templateObject: ObjectField
1223 - name: NewArrayFromLengthResult
1228 templateObject: ObjectField
1231 - name: NewTypedArrayFromLengthResult
1236 templateObject: ObjectField
1239 - name: NewTypedArrayFromArrayBufferResult
1244 templateObject: ObjectField
1249 - name: NewTypedArrayFromArrayResult
1254 templateObject: ObjectField
1257 - name: NewStringObjectResult
1262 templateObject: ObjectField
1265 - name: StringFromCharCodeResult
1272 - name: StringFromCodePointResult
1279 - name: StringIncludesResult
1287 - name: StringIndexOfResult
1295 - name: StringLastIndexOfResult
1303 - name: StringStartsWithResult
1311 - name: StringEndsWithResult
1319 - name: StringToLowerCaseResult
1326 - name: StringToUpperCaseResult
1333 - name: StringTrimResult
1340 - name: StringTrimStartResult
1347 - name: StringTrimEndResult
1354 - name: MathAbsInt32Result
1361 - name: MathAbsNumberResult
1368 - name: MathClz32Result
1375 - name: MathSignInt32Result
1382 - name: MathSignNumberResult
1389 - name: MathSignNumberToInt32Result
1396 - name: MathImulResult
1404 - name: MathSqrtNumberResult
1411 - name: MathFRoundNumberResult
1418 # Because Baseline stub code is shared by all realms in the Zone, this
1419 # instruction loads a pointer to the RNG from a stub field.
1420 - name: MathRandomResult
1425 rng: RawPointerField
1427 - name: MathHypot2NumberResult
1435 - name: MathHypot3NumberResult
1444 - name: MathHypot4NumberResult
1454 - name: MathAtan2NumberResult
1462 - name: MathFloorNumberResult
1469 - name: MathCeilNumberResult
1476 - name: MathTruncNumberResult
1483 - name: MathFloorToInt32Result
1490 - name: MathCeilToInt32Result
1497 - name: MathTruncToInt32Result
1503 - name: MathRoundToInt32Result
1520 - name: NumberMinMax
1530 - name: Int32MinMaxArrayResult
1538 - name: NumberMinMaxArrayResult
1546 - name: MathFunctionNumberResult
1552 fun: UnaryMathFunctionImm
1554 - name: NumberParseIntResult
1562 - name: DoubleParseIntResult
1569 - name: ObjectToStringResult
1576 - name: ReflectGetPrototypeOfResult
1583 - name: StoreTypedArrayElement
1589 elementType: ScalarTypeImm
1594 - name: AtomicsCompareExchangeResult
1603 elementType: ScalarTypeImm
1605 - name: AtomicsExchangeResult
1613 elementType: ScalarTypeImm
1615 - name: AtomicsAddResult
1623 elementType: ScalarTypeImm
1626 - name: AtomicsSubResult
1634 elementType: ScalarTypeImm
1637 - name: AtomicsAndResult
1645 elementType: ScalarTypeImm
1648 - name: AtomicsOrResult
1656 elementType: ScalarTypeImm
1659 - name: AtomicsXorResult
1667 elementType: ScalarTypeImm
1670 - name: AtomicsLoadResult
1677 elementType: ScalarTypeImm
1679 - name: AtomicsStoreResult
1687 elementType: ScalarTypeImm
1689 - name: AtomicsIsLockFreeResult
1696 - name: CallNativeSetter
1706 nargsAndFlags: RawInt32Field
1708 - name: CallScriptedSetter
1718 nargsAndFlags: RawInt32Field
1720 - name: CallInlinedSetter
1729 icScript: RawPointerField
1731 nargsAndFlags: RawInt32Field
1733 - name: CallDOMSetter
1739 jitInfo: RawPointerField
1742 - name: CallSetArrayLength
1761 - name: ProxySetByValue
1771 - name: CallAddOrUpdateSparseElementHelper
1781 - name: CallInt32ToString
1789 - name: CallNumberToString
1797 - name: Int32ToStringWithBaseResult
1805 - name: BooleanToString
1813 - name: CallScriptedFunction
1822 argcFixed: UInt32Imm
1824 - name: CallBoundScriptedFunction
1833 numBoundArgs: UInt32Imm
1835 - name: CallWasmFunction
1843 argcFixed: UInt32Imm
1844 funcExport: RawPointerField
1845 instance: ObjectField
1847 - name: GuardWasmArg
1853 type: WasmValTypeImm
1855 - name: CallNativeFunction
1864 argcFixed: UInt32Imm
1866 target: RawPointerField
1868 ignoresReturnValue: BoolImm
1871 - name: CallDOMFunction
1881 argcFixed: UInt32Imm
1883 target: RawPointerField
1886 - name: CallClassHook
1895 argcFixed: UInt32Imm
1896 target: RawPointerField
1898 - name: CallInlinedFunction
1906 icScript: RawPointerField
1908 argcFixed: UInt32Imm
1911 - name: CallScriptedProxyGetResult
1922 nargsAndFlags: UInt32Imm
1924 - name: CallScriptedProxyGetByValueResult
1935 nargsAndFlags: UInt32Imm
1938 # Meta ops generate no code, but contain data for the Warp Transpiler.
1939 - name: MetaScriptedThisShape
1945 thisShape: ShapeField
1947 - name: BindFunctionResult
1954 templateObject: ObjectField
1956 - name: SpecializedBindFunctionResult
1963 templateObject: ObjectField
1965 - name: LoadFixedSlotResult
1971 offset: RawInt32Field
1973 - name: LoadFixedSlotTypedResult
1979 offset: RawInt32Field
1982 - name: LoadDynamicSlotResult
1988 offset: RawInt32Field
1990 - name: LoadDenseElementResult
1998 - name: LoadDenseElementHoleResult
2006 - name: CallGetSparseElementResult
2014 - name: LoadDenseElementExistsResult
2022 - name: LoadTypedArrayElementExistsResult
2030 - name: LoadDenseElementHoleExistsResult
2038 - name: LoadTypedArrayElementResult
2045 elementType: ScalarTypeImm
2047 forceDoubleForUint32: BoolImm
2049 - name: LoadDataViewValueResult
2056 littleEndian: BooleanId
2057 elementType: ScalarTypeImm
2058 forceDoubleForUint32: BoolImm
2060 - name: StoreDataViewValueResult
2068 littleEndian: BooleanId
2069 elementType: ScalarTypeImm
2071 - name: LoadInt32ArrayLengthResult
2078 - name: LoadInt32ArrayLength
2086 - name: LoadArgumentsObjectArgResult
2094 - name: LoadArgumentsObjectArgHoleResult
2102 - name: LoadArgumentsObjectArgExistsResult
2110 - name: LoadArgumentsObjectLengthResult
2117 - name: LoadArgumentsObjectLength
2125 - name: LoadFunctionLengthResult
2132 - name: LoadFunctionNameResult
2139 - name: LoadBoundFunctionNumArgs
2147 - name: LoadBoundFunctionTarget
2155 - name: GuardBoundFunctionIsConstructor
2162 - name: LoadArrayBufferByteLengthInt32Result
2169 - name: LoadArrayBufferByteLengthDoubleResult
2176 - name: LoadArrayBufferViewLengthInt32Result
2183 - name: LoadArrayBufferViewLengthDoubleResult
2190 - name: LinearizeForCharAccess
2199 - name: LinearizeForCodePointAccess
2208 - name: ToRelativeStringIndex
2217 - name: LoadStringCharResult
2226 - name: LoadStringAtResult
2235 - name: LoadStringCharCodeResult
2244 - name: LoadStringCodePointResult
2253 - name: LoadStringLengthResult
2260 - name: FrameIsConstructingResult
2266 - name: LoadObjectResult
2273 - name: LoadStringResult
2280 - name: LoadSymbolResult
2287 - name: LoadInt32Result
2294 - name: LoadDoubleResult
2301 - name: LoadBigIntResult
2308 - name: CallScriptedGetterResult
2317 nargsAndFlags: RawInt32Field
2319 - name: CallInlinedGetterResult
2327 icScript: RawPointerField
2329 nargsAndFlags: RawInt32Field
2331 - name: CallNativeGetterResult
2340 nargsAndFlags: RawInt32Field
2342 - name: CallDOMGetterResult
2348 jitInfo: RawPointerField
2350 - name: ProxyGetResult
2358 - name: ProxyGetByValueResult
2366 - name: ProxyHasPropResult
2375 - name: CallObjectHasSparseElementResult
2383 - name: CallNativeGetElementResult
2391 - name: CallNativeGetElementSuperResult
2400 - name: GetNextMapSetEntryForIteratorResult
2409 - name: LoadUndefinedResult
2415 - name: LoadBooleanResult
2422 - name: LoadInt32Constant
2430 - name: LoadDoubleConstant
2438 - name: LoadBooleanConstant
2446 - name: LoadUndefined
2453 - name: LoadConstantString
2461 - name: LoadConstantStringResult
2468 - name: LoadInstanceOfObjectResult
2476 - name: LoadTypeOfObjectResult
2483 - name: DoubleAddResult
2491 - name: DoubleSubResult
2499 - name: DoubleMulResult
2507 - name: DoubleDivResult
2515 - name: DoubleModResult
2523 - name: DoublePowResult
2531 - name: Int32AddResult
2539 - name: Int32SubResult
2547 - name: Int32MulResult
2555 - name: Int32DivResult
2563 - name: Int32ModResult
2571 - name: Int32PowResult
2579 - name: BigIntAddResult
2587 - name: BigIntSubResult
2595 - name: BigIntMulResult
2603 - name: BigIntDivResult
2611 - name: BigIntModResult
2619 - name: BigIntPowResult
2627 - name: Int32BitOrResult
2635 - name: Int32BitXorResult
2643 - name: Int32BitAndResult
2651 - name: Int32LeftShiftResult
2659 - name: Int32RightShiftResult
2667 - name: Int32URightShiftResult
2674 forceDouble: BoolImm
2676 - name: Int32NotResult
2683 - name: BigIntBitOrResult
2691 - name: BigIntBitXorResult
2699 - name: BigIntBitAndResult
2707 - name: BigIntLeftShiftResult
2715 - name: BigIntRightShiftResult
2723 - name: BigIntNotResult
2730 - name: Int32NegationResult
2737 - name: DoubleNegationResult
2744 - name: BigIntNegationResult
2751 - name: Int32IncResult
2758 - name: Int32DecResult
2765 - name: DoubleIncResult
2772 - name: DoubleDecResult
2779 - name: BigIntIncResult
2786 - name: BigIntDecResult
2793 - name: LoadInt32TruthyResult
2800 - name: LoadDoubleTruthyResult
2807 - name: LoadStringTruthyResult
2814 - name: LoadObjectTruthyResult
2821 - name: LoadBigIntTruthyResult
2828 - name: LoadValueTruthyResult
2835 - name: LoadValueResult
2842 - name: LoadOperandResult
2849 - name: NewPlainObjectResult
2854 numFixedSlots: UInt32Imm
2855 numDynamicSlots: UInt32Imm
2856 allocKind: AllocKindImm
2858 site: AllocSiteField
2860 - name: NewArrayObjectResult
2865 arrayLength: UInt32Imm
2867 site: AllocSiteField
2869 - name: CallStringConcatResult
2877 - name: CallStringObjectConcatResult
2885 - name: CallIsSuspendedGeneratorResult
2892 - name: CompareStringResult
2901 - name: CompareObjectResult
2910 - name: CompareSymbolResult
2919 - name: CompareInt32Result
2928 - name: CompareDoubleResult
2937 - name: CompareBigIntResult
2946 - name: CompareBigIntInt32Result
2955 - name: CompareBigIntNumberResult
2964 - name: CompareBigIntStringResult
2973 - name: CompareNullUndefinedResult
2979 isUndefined: BoolImm
2982 - name: CompareDoubleSameValueResult
2990 - name: SameValueResult
2998 - name: IndirectTruncateInt32Result
3005 - name: BigIntAsIntNResult
3013 - name: BigIntAsUintNResult
3021 - name: SetHasResult
3029 - name: SetHasNonGCThingResult
3037 - name: SetHasStringResult
3045 - name: SetHasSymbolResult
3053 - name: SetHasBigIntResult
3061 - name: SetHasObjectResult
3069 - name: SetSizeResult
3076 - name: MapHasResult
3084 - name: MapHasNonGCThingResult
3092 - name: MapHasStringResult
3100 - name: MapHasSymbolResult
3108 - name: MapHasBigIntResult
3116 - name: MapHasObjectResult
3124 - name: MapGetResult
3132 - name: MapGetNonGCThingResult
3140 - name: MapGetStringResult
3148 - name: MapGetSymbolResult
3156 - name: MapGetBigIntResult
3164 - name: MapGetObjectResult
3172 - name: MapSizeResult
3179 - name: ArrayFromArgumentsObjectResult
3187 - name: CloseIterScriptedResult
3194 kind: CompletionKindImm
3195 targetNargs: UInt32Imm
3197 - name: CallPrintString
3202 str: StaticStringImm
3222 - name: AssertRecoveredOnBailoutResult
3228 mustBeRecovered: BoolImm
3230 - name: AssertPropertyLookup
3239 #ifdef FUZZING_JS_FUZZILLI
3240 - name: FuzzilliHashResult