#include "config.h"

#include "JITOperations.h"

#if ENABLE(JIT)

#include "ArithProfile.h"

#include "ArrayConstructor.h"

#include "CacheableIdentifierInlines.h"

#include "CodeBlockInlines.h"

#include "CommonSlowPathsInlines.h"

#include "DFGDriver.h"

#include "DFGOSREntry.h"

#include "DFGThunks.h"

#include "Debugger.h"

#include "EnsureStillAliveHere.h"

#include "ExceptionFuzz.h"

#include "FrameTracers.h"

#include "GetterSetter.h"

#include "ICStats.h"

#include "InlineCacheCompiler.h"

#include "Interpreter.h"

#include "JIT.h"

#include "JITExceptions.h"

#include "JITThunks.h"

#include "JITToDFGDeferredCompilationCallback.h"

#include "JITWorklist.h"

#include "JSArrayIterator.h"

#include "JSArrayIteratorInlines.h"

#include "JSAsyncFromSyncIterator.h"

#include "JSAsyncFunction.h"

#include "JSAsyncFunctionGenerator.h"

#include "JSAsyncGenerator.h"

#include "JSAsyncGeneratorFunction.h"

#include "JSBoundFunction.h"

#include "JSCInlines.h"

#include "JSCPtrTag.h"

#include "JSGeneratorFunction.h"

#include "JSGlobalObjectFunctions.h"

#include "JSLexicalEnvironmentInlines.h"

#include "JSMapIterator.h"

#include "JSMicrotask.h"

#include "JSPromise.h"

#include "JSRemoteFunction.h"

#include "JSSentinel.h"

#include "JSSetIterator.h"

#include "JSStringIteratorInlines.h"

#include "JSWithScope.h"

#include "JumpTable.h"

#include "LLIntEntrypoint.h"

#include "MegamorphicCache.h"

#include "ObjectConstructor.h"

#include "PropertyInlineCache.h"

#include "PropertyName.h"

#include "PropertyNameInlines.h"

#include "RegExpObject.h"

#include "RepatchInlines.h"

#include "ShadowChicken.h"

#include "SuperSampler.h"

#include "ThunkGenerators.h"

#include "TypeProfilerLog.h"

#include "VMInlines.h"

#include "VMTrapsInlines.h"

IGNORE_WARNINGS_BEGIN("frame-address")

namespace JSC {

ALWAYS_INLINE ICSlowPathCallFrameTracer::ICSlowPathCallFrameTracer(VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache)

#if ASSERT_ENABLED

: m_vm(vm)

#endif

{

UNUSED_PARAM(vm);

UNUSED_PARAM(callFrame);

ASSERT(callFrame);

ASSERT(reinterpret_cast<void*>(callFrame) < reinterpret_cast<void*>(vm.topEntryFrame));

assertStackPointerIsAligned();

// If ASSERT_ENABLED and USE(BUILTIN_FRAME_ADDRESS), prepareCallOperation() will put the frame pointer into vm.topCallFrame.

// We can ensure here that a call to prepareCallOperation() (or its equivalent) is not missing by comparing vm.topCallFrame to

// the result of __builtin_frame_address which is passed in as callFrame.

ASSERT(vm.topCallFrame == callFrame);

vm.topCallFrame = callFrame;

callFrame->setCallSiteIndex(propertyCache->callSiteIndex);

}

ALWAYS_INLINE JSValue profiledAdd(JSGlobalObject* globalObject, JSValue op1, JSValue op2, BinaryArithProfile& arithProfile)

}

JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationThrowStackOverflowError, void, (CodeBlock* codeBlock))

}

JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationThrowStackOverflowErrorFromThunk, void, (JSGlobalObject* globalObject))

}

JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationThrowOutOfMemoryError, void, (VM* vmPointer))

}

static JSValue getWrappedValue(JSGlobalObject* globalObject, JSGlobalObject* targetGlobalObject, JSValue value)

}

JSC_DEFINE_JIT_OPERATION(operationGetWrappedValueForTarget, EncodedJSValue, (JSRemoteFunction* callee, EncodedJSValue encodedValue))

{

JSGlobalObject* globalObject = callee->realm();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

ASSERT(isRemoteFunction(callee));

JSGlobalObject* targetGlobalObject = callee->targetFunction()->realm();

OPERATION_RETURN(scope, JSValue::encode(getWrappedValue(globalObject, targetGlobalObject, JSValue::decode(encodedValue))));

}

JSC_DEFINE_JIT_OPERATION(operationGetWrappedValueForCaller, EncodedJSValue, (JSRemoteFunction* callee, EncodedJSValue encodedValue))

{

JSGlobalObject* globalObject = callee->realm();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

ASSERT(isRemoteFunction(callee));

OPERATION_RETURN(scope, JSValue::encode(getWrappedValue(globalObject, globalObject, JSValue::decode(encodedValue))));

}

static inline UGPRPair materializeTargetCode(VM& vm, JSFunction* targetFunction)

}

JSC_DEFINE_JIT_OPERATION(operationMaterializeBoundFunctionTargetCode, UGPRPair, (JSBoundFunction* callee))

{

JSGlobalObject* globalObject = callee->realm();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

auto* targetFunction = uncheckedDowncast<JSFunction>(callee->targetFunction()); // We call this function only when JSBoundFunction's target is JSFunction.

OPERATION_RETURN(scope, materializeTargetCode(vm, targetFunction));

}

JSC_DEFINE_JIT_OPERATION(operationMaterializeRemoteFunctionTargetCode, UGPRPair, (JSRemoteFunction* callee))

{

JSGlobalObject* globalObject = callee->realm();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

ASSERT(isRemoteFunction(callee));

auto* targetFunction = uncheckedDowncast<JSFunction>(callee->targetFunction()); // We call this function only when JSRemoteFunction's target is JSFunction.

OPERATION_RETURN(scope, materializeTargetCode(vm, targetFunction));

}

JSC_DEFINE_JIT_OPERATION(operationThrowRemoteFunctionException, EncodedJSValue, (JSRemoteFunction* callee))

{

JSGlobalObject* globalObject = callee->realm();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

ASSERT(isRemoteFunction(callee));

Exception* exception = scope.exception();

// We should only be here when "rethrowing" an exception

RELEASE_ASSERT(exception);

JSValue exceptionValue = exception->value();

if (!scope.tryClearException()) [[unlikely]] {

scope.release();

OPERATION_RETURN(scope, encodedJSValue());

}

String exceptionString = exceptionValue.toWTFString(globalObject);

if (!scope.tryClearException()) [[unlikely]] {

scope.release();

OPERATION_RETURN(scope, encodedJSValue());

}

if (exceptionString.length())

OPERATION_RETURN(scope, throwVMTypeError(globalObject, scope, exceptionString));

OPERATION_RETURN(scope, throwVMTypeError(globalObject, scope));

}

JSC_DEFINE_JIT_OPERATION(operationThrowIteratorResultIsNotObject, void, (JSGlobalObject* globalObject))

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdDirectGaveUp, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

propertyCache->tookSlowPath = true;

CacheableIdentifier identifier = propertyCache->identifier();

JSValue baseValue = JSValue::decode(base);

PropertySlot slot(baseValue, PropertySlot::InternalMethodType::GetOwnProperty);

bool found = baseValue.getOwnPropertySlot(globalObject, identifier, slot);

OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());

OPERATION_RETURN(scope, JSValue::encode(found ? slot.getValue(globalObject, identifier) : jsUndefined()));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdDirectGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier))

{

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier);

JSValue baseValue = JSValue::decode(base);

PropertySlot slot(baseValue, PropertySlot::InternalMethodType::GetOwnProperty);

bool found = baseValue.getOwnPropertySlot(globalObject, identifier, slot);

OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());

OPERATION_RETURN(scope, JSValue::encode(found ? slot.getValue(globalObject, identifier) : jsUndefined()));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdDirectOptimize, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = propertyCache->identifier();

JSValue baseValue = JSValue::decode(base);

PropertySlot slot(baseValue, PropertySlot::InternalMethodType::GetOwnProperty);

bool found = baseValue.getOwnPropertySlot(globalObject, identifier, slot);

OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());

CodeBlock* codeBlock = callFrame->codeBlock();

if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier))

repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ByIdDirect, /* isNonStringPrimitiveKey */ false);

OPERATION_RETURN(scope, JSValue::encode(found ? slot.getValue(globalObject, identifier) : jsUndefined()));

}

template<GetByKind kind>

static ALWAYS_INLINE JSValue getByIdMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, JSValue baseValue, JSValue thisValue, CacheableIdentifier identifier)

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdMegamorphic, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(base);

CacheableIdentifier identifier = propertyCache->identifier();

OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic<GetByKind::ById>(globalObject, vm, callFrame, propertyCache, baseValue, baseValue, identifier)));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier))

{

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(base);

CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier);

OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic<GetByKind::ById>(globalObject, vm, callFrame, nullptr, baseValue, baseValue, identifier)));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdGaveUp, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

propertyCache->tookSlowPath = true;

JSValue baseValue = JSValue::decode(base);

PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);

CacheableIdentifier identifier = propertyCache->identifier();

JSValue result = baseValue.get(globalObject, identifier, slot);

LOG_IC((ICEvent::OperationGetByIdGaveUp, baseValue.classInfoOrNull(), baseValue == slot.slotBase()));

OPERATION_RETURN(scope, JSValue::encode(result));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier))

{

SuperSamplerScope superSamplerScope(false);

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(base);

PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);

CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier);

JSValue result = baseValue.get(globalObject, identifier, slot);

LOG_IC((ICEvent::OperationGetByIdGeneric, baseValue.classInfoOrNull(), baseValue == slot.slotBase()));

OPERATION_RETURN(scope, JSValue::encode(result));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdOptimize, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = propertyCache->identifier();

JSValue baseValue = JSValue::decode(base);

OPERATION_RETURN(scope, JSValue::encode(baseValue.getPropertySlot(globalObject, identifier, [&] (bool found, PropertySlot& slot) -> JSValue {

LOG_IC((ICEvent::OperationGetByIdOptimize, baseValue.classInfoOrNull(), baseValue == slot.slotBase()));

CodeBlock* codeBlock = callFrame->codeBlock();

if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier))

repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ById, /* isNonStringPrimitiveKey */ false);

return found ? slot.getValue(globalObject, identifier) : jsUndefined();

})));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisGaveUp, EncodedJSValue, (EncodedJSValue base, EncodedJSValue thisEncoded, PropertyInlineCache* propertyCache))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

propertyCache->tookSlowPath = true;

CacheableIdentifier identifier = propertyCache->identifier();

JSValue baseValue = JSValue::decode(base);

JSValue thisValue = JSValue::decode(thisEncoded);

PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get);

JSValue result = baseValue.get(globalObject, identifier, slot);

LOG_IC((ICEvent::OperationGetByIdWithThisGaveUp, baseValue.classInfoOrNull(), baseValue == slot.slotBase()));

OPERATION_RETURN(scope, JSValue::encode(result));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, EncodedJSValue thisEncoded, uintptr_t rawCacheableIdentifier))

{

SuperSamplerScope superSamplerScope(false);

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier);

JSValue baseValue = JSValue::decode(base);

JSValue thisValue = JSValue::decode(thisEncoded);

PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get);

JSValue result = baseValue.get(globalObject, identifier, slot);

LOG_IC((ICEvent::OperationGetByIdWithThisGeneric, baseValue.classInfoOrNull(), baseValue == slot.slotBase()));

OPERATION_RETURN(scope, JSValue::encode(result));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisOptimize, EncodedJSValue, (EncodedJSValue base, EncodedJSValue thisEncoded, PropertyInlineCache* propertyCache))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = propertyCache->identifier();

JSValue baseValue = JSValue::decode(base);

JSValue thisValue = JSValue::decode(thisEncoded);

PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get);

OPERATION_RETURN(scope, JSValue::encode(baseValue.getPropertySlot(globalObject, identifier, slot, [&] (bool found, PropertySlot& slot) -> JSValue {

LOG_IC((ICEvent::OperationGetByIdWithThisOptimize, baseValue.classInfoOrNull(), baseValue == slot.slotBase()));

CodeBlock* codeBlock = callFrame->codeBlock();

if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier))

repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ByIdWithThis, /* isNonStringPrimitiveKey */ false);

return found ? slot.getValue(globalObject, identifier) : jsUndefined();

})));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisMegamorphic, EncodedJSValue, (EncodedJSValue base, EncodedJSValue encodedThis, PropertyInlineCache* propertyCache))

{

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = propertyCache->identifier();

OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic<GetByKind::ByIdWithThis>(globalObject, vm, callFrame, propertyCache, JSValue::decode(base), JSValue::decode(encodedThis), identifier)));

}

JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, EncodedJSValue encodedThis, uintptr_t rawCacheableIdentifier))

{

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier);

OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic<GetByKind::ByIdWithThis>(globalObject, vm, callFrame, nullptr, JSValue::decode(base), JSValue::decode(encodedThis), identifier)));

}

JSC_DEFINE_JIT_OPERATION(operationInByIdGaveUp, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

propertyCache->tookSlowPath = true;

CacheableIdentifier identifier = propertyCache->identifier();

JSValue baseValue = JSValue::decode(base);

if (!baseValue.isObject()) {

throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue));

OPERATION_RETURN(scope, JSValue::encode(jsUndefined()));

}

JSObject* baseObject = asObject(baseValue);

LOG_IC((ICEvent::OperationInByIdGeneric, baseObject->classInfo()));

scope.release();

PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty);

OPERATION_RETURN(scope, JSValue::encode(jsBoolean(baseObject->getPropertySlot(globalObject, identifier, slot))));

}

JSC_DEFINE_JIT_OPERATION(operationInByIdOptimize, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

CacheableIdentifier identifier = propertyCache->identifier();

JSValue baseValue = JSValue::decode(base);

if (!baseValue.isObject()) {

throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue));

OPERATION_RETURN(scope, JSValue::encode(jsUndefined()));

}

JSObject* baseObject = asObject(baseValue);

LOG_IC((ICEvent::OperationInByIdOptimize, baseObject->classInfo()));

PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty);

bool found = baseObject->getPropertySlot(globalObject, identifier, slot);

OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());

CodeBlock* codeBlock = callFrame->codeBlock();

if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier))

repatchInBy(globalObject, codeBlock, baseObject, identifier, found, slot, *propertyCache, InByKind::ById);

OPERATION_RETURN(scope, JSValue::encode(jsBoolean(found)));

}

static ALWAYS_INLINE JSValue inByIdMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, JSValue baseValue, CacheableIdentifier identifier)

}

JSC_DEFINE_JIT_OPERATION(operationInByIdMegamorphic, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache))

{

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(base);

CacheableIdentifier identifier = propertyCache->identifier();

OPERATION_RETURN(scope, JSValue::encode(inByIdMegamorphic(globalObject, vm, callFrame, propertyCache, baseValue, identifier)));

}

JSC_DEFINE_JIT_OPERATION(operationInByIdMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier))

{

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(base);

CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier);

OPERATION_RETURN(scope, JSValue::encode(inByIdMegamorphic(globalObject, vm, callFrame, nullptr, baseValue, identifier)));

}

JSC_DEFINE_JIT_OPERATION(operationInByValOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedKey, PropertyInlineCache* propertyCache, ArrayProfile* profile))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(encodedBase);

JSValue key = JSValue::decode(encodedKey);

if (!baseValue.isObject()) {

throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue));

OPERATION_RETURN(scope, encodedJSValue());

}

JSObject* baseObject = asObject(baseValue);

uint32_t i;

if (key.getUInt32(i)) {

if (profile)

profile->observeIndexedRead(baseObject, i);

CodeBlock* codeBlock = callFrame->codeBlock();

Structure* structure = baseValue.asCell()->structure();

if (propertyCache->considerRepatchingCacheGeneric(vm, codeBlock, structure)) {

if (profile)

profile->computeUpdatedPrediction(codeBlock, structure);

repatchArrayInByVal(globalObject, codeBlock, baseValue, key, *propertyCache, InByKind::ByVal);

}

OPERATION_RETURN(scope, JSValue::encode(jsBoolean(baseObject->hasProperty(globalObject, i))));

}

const Identifier propertyName = key.toPropertyKey(globalObject);

OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());

PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty);

bool found = baseObject->getPropertySlot(globalObject, propertyName, slot);

OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue());

if (CacheableIdentifier::isCacheableIdentifierCell(key) && (key.isSymbol() || !parseIndex(propertyName))) {

CodeBlock* codeBlock = callFrame->codeBlock();

CacheableIdentifier identifier = CacheableIdentifier::createFromCell(key.asCell());

if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier))

repatchInBy(globalObject, codeBlock, baseObject, identifier, found, slot, *propertyCache, InByKind::ByVal);

}

OPERATION_RETURN(scope, JSValue::encode(jsBoolean(found)));

}

JSC_DEFINE_JIT_OPERATION(operationInByValGaveUp, EncodedJSValue, (EncodedJSValue base, EncodedJSValue key, PropertyInlineCache* propertyCache, ArrayProfile* arrayProfile))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

propertyCache->tookSlowPath = true;

OPERATION_RETURN(scope, JSValue::encode(jsBoolean(CommonSlowPaths::opInByVal(globalObject, JSValue::decode(base), JSValue::decode(key), arrayProfile))));

}

static ALWAYS_INLINE JSValue inByValMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, ArrayProfile* profile, JSValue baseValue, JSValue subscript)

}

JSC_DEFINE_JIT_OPERATION(operationInByValMegamorphic, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache, ArrayProfile* arrayProfile))

{

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(encodedBase);

JSValue subscript = JSValue::decode(encodedSubscript);

OPERATION_RETURN(scope, JSValue::encode(inByValMegamorphic(globalObject, vm, callFrame, propertyCache, arrayProfile, baseValue, subscript)));

}

JSC_DEFINE_JIT_OPERATION(operationInByValMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript))

{

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);

JITOperationPrologueCallFrameTracer tracer(vm, callFrame);

auto scope = DECLARE_THROW_SCOPE(vm);

JSValue baseValue = JSValue::decode(encodedBase);

OPERATION_RETURN(scope, JSValue::encode(inByValMegamorphic(globalObject, vm, callFrame, nullptr, nullptr, baseValue, JSValue::decode(encodedSubscript))));

}

JSC_DEFINE_JIT_OPERATION(operationHasPrivateNameOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedProperty, PropertyInlineCache* propertyCache))

{

SuperSamplerScope superSamplerScope(false);

JSGlobalObject* globalObject = propertyCache->globalObject();

VM& vm = globalObject->vm();

CallFrame* callFrame = DECLARE_CALL_FRAME(vm);