{

auto bytecode = currentInstruction->as<OpGetByVal>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::GetByVal::baseJSR;

using BaselineJITRegisters::GetByVal::propertyJSR;

using BaselineJITRegisters::GetByVal::resultJSR;

using BaselineJITRegisters::GetByVal::propertyCacheGPR;

using BaselineJITRegisters::GetByVal::profileGPR;

using BaselineJITRegisters::GetByVal::scratch1GPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

materializePointerIntoMetadata(bytecode, OpGetByVal::Metadata::offsetOfArrayProfile(), profileGPR);

JITGetByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::GetByVal, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, profileGPR, propertyCacheGPR);

if (isOperandConstantInt(property))

propertyCache->propertyIsInt32 = true;

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitArrayProfilingSiteWithCellAndProfile(baseJSR.payloadGPR(), profileGPR, scratch1GPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_getByVals.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(dst, resultJSR);

{

ASSERT(hasAnySlowCases(iter));

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByValGenerator& gen = m_getByVals[m_getByValIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpGetPrivateName>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::GetByVal::baseJSR;

using BaselineJITRegisters::GetByVal::propertyJSR;

using BaselineJITRegisters::GetByVal::resultJSR;

using BaselineJITRegisters::GetByVal::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITGetByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::GetPrivateName,

RegisterSet::stubUnavailableRegisters(), baseJSR, propertyJSR, resultJSR, InvalidGPRReg, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_getByVals.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(dst, resultJSR);

{

ASSERT(hasAnySlowCases(iter));

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByValGenerator& gen = m_getByVals[m_getByValIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpSetPrivateBrand>();

VirtualRegister base = bytecode.m_base;

VirtualRegister brand = bytecode.m_brand;

using BaselineJITRegisters::PrivateBrand::baseJSR;

using BaselineJITRegisters::PrivateBrand::propertyJSR;

using BaselineJITRegisters::PrivateBrand::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(brand, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITPrivateBrandAccessGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::SetPrivateBrand, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_privateBrandAccesses.append(gen);

// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

{

UNUSED_PARAM(currentInstruction);

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPrivateBrandAccessGenerator& gen = m_privateBrandAccesses[m_privateBrandAccessIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpCheckPrivateBrand>();

VirtualRegister base = bytecode.m_base;

VirtualRegister brand = bytecode.m_brand;

using BaselineJITRegisters::PrivateBrand::baseJSR;

using BaselineJITRegisters::PrivateBrand::propertyJSR;

using BaselineJITRegisters::PrivateBrand::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(brand, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITPrivateBrandAccessGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::CheckPrivateBrand, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_privateBrandAccesses.append(gen);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPrivateBrandAccessGenerator& gen = m_privateBrandAccesses[m_privateBrandAccessIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<Op>();

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

VirtualRegister value = bytecode.m_value;

using BaselineJITRegisters::PutByVal::baseJSR;

using BaselineJITRegisters::PutByVal::propertyJSR;

using BaselineJITRegisters::PutByVal::valueJSR;

using BaselineJITRegisters::PutByVal::profileGPR;

using BaselineJITRegisters::PutByVal::propertyCacheGPR;

using BaselineJITRegisters::PutByVal::scratch1GPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

emitGetVirtualRegister(value, valueJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

materializePointerIntoMetadata(bytecode, Op::Metadata::offsetOfArrayProfile(), profileGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitArrayProfilingSiteWithCellAndProfile(baseJSR.payloadGPR(), profileGPR, scratch1GPR);

ECMAMode ecmaMode = this->ecmaMode(bytecode);

bool isDirect = std::is_same_v<Op, OpPutByValDirect>;

JITPutByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex),

isDirect ? (ecmaMode.isStrict() ? AccessType::PutByValDirectStrict : AccessType::PutByValDirectSloppy) : (ecmaMode.isStrict() ? AccessType::PutByValStrict : AccessType::PutByValSloppy),

RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, valueJSR, profileGPR, propertyCacheGPR);

if (isOperandConstantInt(property))

propertyCache->propertyIsInt32 = true;

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_putByVals.append(gen);

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

setFastPathResumePoint();

{

ASSERT(hasAnySlowCases(iter));

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPutByValGenerator& gen = m_putByVals[m_putByValIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpPutPrivateName>();

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

VirtualRegister value = bytecode.m_value;

using BaselineJITRegisters::PutByVal::baseJSR;

using BaselineJITRegisters::PutByVal::propertyJSR;

using BaselineJITRegisters::PutByVal::valueJSR;

using BaselineJITRegisters::PutByVal::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

emitGetVirtualRegister(value, valueJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITPutByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), bytecode.m_putKind.isDefine() ? AccessType::DefinePrivateNameByVal : AccessType::SetPrivateNameByVal, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, valueJSR, InvalidGPRReg, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_putByVals.append(gen);

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(base, ShouldFilterBase);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPutByValGenerator& gen = m_putByVals[m_putByValIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpPutGetterById>();

emitGetVirtualRegister(bytecode.m_base, regT0);

int32_t options = bytecode.m_attributes;

emitGetVirtualRegister(bytecode.m_accessor, regT1);

loadGlobalObject(regT2);

callOperation(operationPutGetterById, regT2, regT0, TrustedImmPtr(m_unlinkedCodeBlock->identifier(bytecode.m_property).impl()), options, regT1);

{

auto bytecode = currentInstruction->as<OpPutSetterById>();

emitGetVirtualRegister(bytecode.m_base, regT0);

int32_t options = bytecode.m_attributes;

emitGetVirtualRegister(bytecode.m_accessor, regT1);

loadGlobalObject(regT2);

callOperation(operationPutSetterById, regT2, regT0, TrustedImmPtr(m_unlinkedCodeBlock->identifier(bytecode.m_property).impl()), options, regT1);

{

auto bytecode = currentInstruction->as<OpPutGetterSetterById>();

emitGetVirtualRegister(bytecode.m_base, regT0);

int32_t attribute = bytecode.m_attributes;

emitGetVirtualRegister(bytecode.m_getter, regT1);

emitGetVirtualRegister(bytecode.m_setter, regT2);

loadGlobalObject(regT3);

callOperation(operationPutGetterSetter, regT3, regT0, TrustedImmPtr(m_unlinkedCodeBlock->identifier(bytecode.m_property).impl()), attribute, regT1, regT2);

{

auto bytecode = currentInstruction->as<OpPutGetterByVal>();

using SlowOperation = decltype(operationPutGetterByVal);

constexpr GPRReg globalObjectGPR = preferredArgumentGPR<SlowOperation, 0>();

constexpr GPRReg baseGPR = preferredArgumentGPR<SlowOperation, 1>();

constexpr JSValueRegs propertyJSR = preferredArgumentJSR<SlowOperation, 2>();

// Attributes in argument 3

constexpr GPRReg setterGPR = preferredArgumentGPR<SlowOperation, 4>();

emitGetVirtualRegister(bytecode.m_base, baseGPR);

emitGetVirtualRegister(bytecode.m_property, propertyJSR);

int32_t attributes = bytecode.m_attributes;

emitGetVirtualRegister(bytecode.m_accessor, setterGPR);

loadGlobalObject(globalObjectGPR);

callOperation(operationPutGetterByVal, globalObjectGPR, baseGPR, propertyJSR, attributes, setterGPR);

{

auto bytecode = currentInstruction->as<OpPutSetterByVal>();

using SlowOperation = decltype(operationPutSetterByVal);

constexpr GPRReg globalObjectGPR = preferredArgumentGPR<SlowOperation, 0>();

constexpr GPRReg baseGPR = preferredArgumentGPR<SlowOperation, 1>();

constexpr JSValueRegs propertyJSR = preferredArgumentJSR<SlowOperation, 2>();

// Attributes in argument 3

constexpr GPRReg setterGPR = preferredArgumentGPR<SlowOperation, 4>();

emitGetVirtualRegister(bytecode.m_base, baseGPR);

emitGetVirtualRegister(bytecode.m_property, propertyJSR);

int32_t attributes = bytecode.m_attributes;

emitGetVirtualRegister(bytecode.m_accessor, setterGPR);

loadGlobalObject(globalObjectGPR);

callOperation(operationPutSetterByVal, globalObjectGPR, baseGPR, propertyJSR, attributes, setterGPR);

{

auto bytecode = currentInstruction->as<OpDelById>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

ECMAMode ecmaMode = bytecode.m_ecmaMode;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::DelById::baseJSR;

using BaselineJITRegisters::DelById::resultJSR;

using BaselineJITRegisters::DelById::propertyCacheGPR;

using BaselineJITRegisters::DelById::scratchJSR;

emitGetVirtualRegister(base, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITDelByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), ecmaMode.isStrict() ? AccessType::DeleteByIdStrict : AccessType::DeleteByIdSloppy, RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident),

baseJSR, resultJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_delByIds.append(gen);

setFastPathResumePoint();

emitGetVirtualRegister(base, scratchJSR); // IC may clobber baseJSR so reload from virtual register

boxBoolean(resultJSR.payloadGPR(), resultJSR);

emitPutVirtualRegister(dst, resultJSR);

// IC can write new Structure without write-barrier if a base is cell.

// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(scratchJSR, ShouldFilterBase);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITDelByIdGenerator& gen = m_delByIds[m_delByIdIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpDelByVal>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::DelByVal::baseJSR;

using BaselineJITRegisters::DelByVal::propertyJSR;

using BaselineJITRegisters::DelByVal::resultJSR;

using BaselineJITRegisters::DelByVal::propertyCacheGPR;

using BaselineJITRegisters::DelByVal::scratchJSR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitJumpSlowCaseIfNotJSCell(propertyJSR, property);

JITDelByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex),

bytecode.m_ecmaMode.isStrict() ? AccessType::DeleteByValStrict : AccessType::DeleteByValSloppy,

RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_delByVals.append(gen);

setFastPathResumePoint();

emitGetVirtualRegister(base, scratchJSR); // IC may clobber baseJSR so reload from virtual register

boxBoolean(resultJSR.payloadGPR(), resultJSR);

emitPutVirtualRegister(dst, resultJSR);

// We should emit write-barrier at the end of sequence since write-barrier clobbers registers.

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(scratchJSR, ShouldFilterBase);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITDelByValGenerator& gen = m_delByVals[m_delByValIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpGetByIdDirect>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::GetById::baseJSR;

using BaselineJITRegisters::GetById::resultJSR;

using BaselineJITRegisters::GetById::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITGetByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), baseJSR, resultJSR, propertyCacheGPR, AccessType::GetByIdDirect, CacheType::GetByIdSelf);

gen.generateDataICFastPath(*this);

addSlowCase();

m_getByIds.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];

gen.generateDataICSlowPath(*this);

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpGetById>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

GetByIdModeMetadata modeMetadata = bytecode.metadata(m_profiledCodeBlock).m_modeMetadata;

CacheType cacheType = CacheType::GetByIdSelf;

if (modeMetadata.mode == GetByIdMode::ProtoLoad)

cacheType = CacheType::GetByIdPrototype;

using BaselineJITRegisters::GetById::baseJSR;

using BaselineJITRegisters::GetById::resultJSR;

using BaselineJITRegisters::GetById::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITGetByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), baseJSR, resultJSR, propertyCacheGPR, AccessType::GetById, cacheType);

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_getByIds.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

{

auto bytecode = currentInstruction->as<OpGetLength>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &vm().propertyNames->length;

using BaselineJITRegisters::GetById::baseJSR;

using BaselineJITRegisters::GetById::resultJSR;

using BaselineJITRegisters::GetById::propertyCacheGPR;

using BaselineJITRegisters::GetById::scratch1GPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

if (shouldEmitProfiling())

emitArrayProfilingSiteWithCell(bytecode, baseJSR.payloadGPR(), scratch1GPR);

JITGetByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromImmortalIdentifier(ident->impl()), baseJSR, resultJSR, propertyCacheGPR, AccessType::GetById, CacheType::ArrayLength);

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_getByIds.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];

gen.generateDataICSlowPath(*this);

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdGenerator& gen = m_getByIds[m_getByIdIndex++];

gen.generateDataICSlowPath(*this);

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpGetByIdWithThis>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

VirtualRegister thisVReg = bytecode.m_thisValue;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::GetByIdWithThis::baseJSR;

using BaselineJITRegisters::GetByIdWithThis::thisJSR;

using BaselineJITRegisters::GetByIdWithThis::resultJSR;

using BaselineJITRegisters::GetByIdWithThis::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

emitGetVirtualRegister(thisVReg, thisJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

emitJumpSlowCaseIfNotJSCell(thisJSR, thisVReg);

JITGetByIdWithThisGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), resultJSR, baseJSR, thisJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_getByIdsWithThis.append(gen);

setFastPathResumePoint();

emitValueProfilingSite(bytecode, resultJSR);

emitPutVirtualRegister(resultVReg, resultJSR);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITGetByIdWithThisGenerator& gen = m_getByIdsWithThis[m_getByIdWithThisIndex++];

gen.generateDataICSlowPath(*this);

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpPutById>();

VirtualRegister baseVReg = bytecode.m_base;

VirtualRegister valueVReg = bytecode.m_value;

bool direct = bytecode.m_flags.isDirect();

ECMAMode ecmaMode = this->ecmaMode(bytecode);

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

// In order to be able to patch both the Structure, and the object offset, we store one pointer,

// to just after the arguments have been loaded into registers 'hotPathBegin', and we generate code

// such that the Structure & offset are always at the same distance from this.

using BaselineJITRegisters::PutById::baseJSR;

using BaselineJITRegisters::PutById::valueJSR;

using BaselineJITRegisters::PutById::propertyCacheGPR;

using BaselineJITRegisters::PutById::scratch1GPR;

emitGetVirtualRegister(baseVReg, baseJSR);

emitGetVirtualRegister(valueVReg, valueJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITPutByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident),

baseJSR, valueJSR, propertyCacheGPR, scratch1GPR, direct ? (ecmaMode.isStrict() ? AccessType::PutByIdDirectStrict : AccessType::PutByIdDirectSloppy) : (ecmaMode.isStrict() ? AccessType::PutByIdStrict : AccessType::PutByIdSloppy));

gen.generateDataICFastPath(*this);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

addSlowCase();

m_putByIds.append(gen);

// IC can write new Structure without write-barrier if a base is cell.

// FIXME: Use UnconditionalWriteBarrier in Baseline effectively to reduce code size.

// https://bugs.webkit.org/show_bug.cgi?id=209395

emitWriteBarrier(baseVReg, ShouldFilterBase);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITPutByIdGenerator& gen = m_putByIds[m_putByIdIndex++];

gen.generateDataICSlowPath(*this);

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpInById>();

VirtualRegister resultVReg = bytecode.m_dst;

VirtualRegister baseVReg = bytecode.m_base;

const Identifier* ident = &(m_unlinkedCodeBlock->identifier(bytecode.m_property));

using BaselineJITRegisters::InById::baseJSR;

using BaselineJITRegisters::InById::resultJSR;

using BaselineJITRegisters::InById::propertyCacheGPR;

emitGetVirtualRegister(baseVReg, baseJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, baseVReg);

JITInByIdGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), RegisterSet::stubUnavailableRegisters(),

CacheableIdentifier::createFromIdentifierOwnedByCodeBlock(m_unlinkedCodeBlock, *ident), baseJSR, resultJSR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_inByIds.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitPutVirtualRegister(resultVReg, resultJSR);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITInByIdGenerator& gen = m_inByIds[m_inByIdIndex++];

gen.generateDataICSlowPath(*this);

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpInByVal>();

VirtualRegister dst = bytecode.m_dst;

VirtualRegister base = bytecode.m_base;

VirtualRegister property = bytecode.m_property;

using BaselineJITRegisters::InByVal::baseJSR;

using BaselineJITRegisters::InByVal::propertyJSR;

using BaselineJITRegisters::InByVal::resultJSR;

using BaselineJITRegisters::InByVal::propertyCacheGPR;

using BaselineJITRegisters::InByVal::profileGPR;

using BaselineJITRegisters::InByVal::scratch1GPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(property, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

materializePointerIntoMetadata(bytecode, OpInByVal::Metadata::offsetOfArrayProfile(), profileGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

emitArrayProfilingSiteWithCellAndProfile(baseJSR.payloadGPR(), profileGPR, scratch1GPR);

JITInByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), AccessType::InByVal, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, profileGPR, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_inByVals.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitPutVirtualRegister(dst, resultJSR);

{

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITInByValGenerator& gen = m_inByVals[m_inByValIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

using BaselineJITRegisters::InByVal::baseJSR;

using BaselineJITRegisters::InByVal::propertyJSR;

using BaselineJITRegisters::InByVal::resultJSR;

using BaselineJITRegisters::InByVal::propertyCacheGPR;

emitGetVirtualRegister(base, baseJSR);

emitGetVirtualRegister(propertyOrBrand, propertyJSR);

auto [ propertyCache, propertyCacheIndex ] = addUnlinkedPropertyInlineCache();

loadPropertyInlineCache(propertyCacheIndex, propertyCacheGPR);

emitJumpSlowCaseIfNotJSCell(baseJSR, base);

JITInByValGenerator gen(

nullptr, propertyCache, JITType::BaselineJIT, CodeOrigin(m_bytecodeIndex), CallSiteIndex(m_bytecodeIndex), type, RegisterSet::stubUnavailableRegisters(),

baseJSR, propertyJSR, resultJSR, InvalidGPRReg, propertyCacheGPR);

gen.generateDataICFastPath(*this);

addSlowCase();

m_inByVals.append(gen);

resetSP(); // We might OSR exit here, so we need to conservatively reset SP

setFastPathResumePoint();

emitPutVirtualRegister(dst, resultJSR);

{

ASSERT_UNUSED(type, type == AccessType::HasPrivateName || type == AccessType::HasPrivateBrand);

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

JITInByValGenerator& gen = m_inByVals[m_inByValIndex++];

linkAllSlowCases(iter);

nearCallThunk(CodeLocationLabel { InlineCacheCompiler::generateSlowPathCode(vm(), gen.accessType()).retaggedCode<NoPtrTag>() });

{

auto bytecode = currentInstruction->as<OpHasPrivateName>();

emitHasPrivate(bytecode.m_dst, bytecode.m_base, bytecode.m_property, AccessType::HasPrivateName);

{

auto bytecode = currentInstruction->as<OpHasPrivateBrand>();

emitHasPrivate(bytecode.m_dst, bytecode.m_base, bytecode.m_brand, AccessType::HasPrivateBrand);

{

auto bytecode = currentInstruction->as<OpResolveScope>();

ResolveType profiledResolveType = bytecode.metadata(m_profiledCodeBlock).m_resolveType;

VirtualRegister dst = bytecode.m_dst;

VirtualRegister scope = bytecode.m_scope;

uint32_t bytecodeOffset = m_bytecodeIndex.offset();

ASSERT(BytecodeIndex(m_bytecodeIndex.offset()) == m_bytecodeIndex);

ASSERT(m_unlinkedCodeBlock->instructionAt(m_bytecodeIndex) == currentInstruction);

using BaselineJITRegisters::ResolveScope::scopeGPR;

using BaselineJITRegisters::ResolveScope::bytecodeOffsetGPR;

using BaselineJITRegisters::ResolveScope::scratch1GPR;

using BaselineJITRegisters::ResolveScope::metadataGPR;

using Metadata = OpResolveScope::Metadata;

// If we profile certain resolve types, we're guaranteed all linked code will have the same

// resolve type.

if (profiledResolveType == ModuleVar)

loadPtrFromMetadata(bytecode, Metadata::offsetOfLexicalEnvironment(), returnValueGPR);

else if (profiledResolveType == ClosureVar) {

emitGetVirtualRegister(scope, scopeGPR);

static_assert(scopeGPR == returnValueGPR);

unsigned localScopeDepth = bytecode.metadata(m_profiledCodeBlock).m_localScopeDepth;

if (localScopeDepth < 8) {

for (unsigned index = 0; index < localScopeDepth; ++index)

loadPtr(Address(returnValueGPR, JSScope::offsetOfNext()), returnValueGPR);

} else {

ASSERT(localScopeDepth >= 8);

load32FromMetadata(bytecode, Metadata::offsetOfLocalScopeDepth(), scratch1GPR);

auto loop = label();

loadPtr(Address(returnValueGPR, JSScope::offsetOfNext()), returnValueGPR);

branchSub32(NonZero, scratch1GPR, TrustedImm32(1), scratch1GPR).linkTo(loop, this);

}

} else {

// Inlined fast path for common types.

constexpr size_t metadataMinAlignment = 4;

static_assert(!(Metadata::offsetOfResolveType() % metadataMinAlignment));

static_assert(!(Metadata::offsetOfGlobalLexicalBindingEpoch() % metadataMinAlignment));

auto metadataAddress = computeBaseAddressForMetadata<4>(bytecode, metadataGPR);

auto resolveTypeAddress = metadataAddress.withOffset(Metadata::offsetOfResolveType());

auto globalLexicalBindingEpochAddress = metadataAddress.withOffset(Metadata::offsetOfGlobalLexicalBindingEpoch());

// FIXME: This code is weird when caching fails because it goes to a slow path that will check the exact same condition before falling into the C++ slow path.

// It's unclear if that makes a meaningful difference for perf but we should consider doing something smarter.

switch (profiledResolveType) {

case GlobalProperty: {

addSlowCase(branch32(NotEqual, resolveTypeAddress, TrustedImm32(profiledResolveType)));

loadGlobalObject(returnValueGPR);

load32(globalLexicalBindingEpochAddress, scratch1GPR);

addSlowCase(branch32(NotEqual, Address(returnValueGPR, JSGlobalObject::offsetOfGlobalLexicalBindingEpoch()), scratch1GPR));

break;

}

case GlobalVar: {

addSlowCase(branch32(NotEqual, resolveTypeAddress, TrustedImm32(profiledResolveType)));

loadGlobalObject(returnValueGPR);

break;

}

case GlobalLexicalVar: {

addSlowCase(branch32(NotEqual, resolveTypeAddress, TrustedImm32(profiledResolveType)));

loadGlobalObject(returnValueGPR);

loadPtr(Address(returnValueGPR, JSGlobalObject::offsetOfGlobalLexicalEnvironment()), returnValueGPR);

break;

}

default: {

if (metadataAddress.base != metadataGPR) {

// Materialize metadataGPR for the thunks if we didn't already.

uint32_t metadataOffset = m_profiledCodeBlock->metadataTable()->offsetInMetadataTable(bytecode);

addPtr(TrustedImm32(metadataOffset), GPRInfo::metadataTableRegister, metadataGPR);

}

MacroAssemblerCodeRef<JITThunkPtrTag> code;

if (profiledResolveType == ClosureVarWithVarInjectionChecks)

code = vm().getCTIStub(generateOpResolveScopeThunk<ClosureVarWithVarInjectionChecks>);

else if (profiledResolveType == GlobalVarWithVarInjectionChecks)

code = vm().getCTIStub(generateOpResolveScopeThunk<GlobalVarWithVarInjectionChecks>);

else if (profiledResolveType == GlobalPropertyWithVarInjectionChecks)

code = vm().getCTIStub(generateOpResolveScopeThunk<GlobalPropertyWithVarInjectionChecks>);

else if (profiledResolveType == GlobalLexicalVarWithVarInjectionChecks)

code = vm().getCTIStub(generateOpResolveScopeThunk<GlobalLexicalVarWithVarInjectionChecks>);

else

code = vm().getCTIStub(generateOpResolveScopeThunk<GlobalVar>);

emitGetVirtualRegister(scope, scopeGPR);

move(TrustedImm32(bytecodeOffset), bytecodeOffsetGPR);

nearCallThunk(CodeLocationLabel { code.retaggedCode<NoPtrTag>() });

break;

}

}

}

setFastPathResumePoint();

boxCell(returnValueGPR, returnValueJSR);

emitPutVirtualRegister(dst, returnValueJSR);

{

linkAllSlowCases(iter);

auto bytecode = currentInstruction->as<OpResolveScope>();

VirtualRegister scope = bytecode.m_scope;

ResolveType profiledResolveType = bytecode.metadata(m_profiledCodeBlock).m_resolveType;

uint32_t bytecodeOffset = m_bytecodeIndex.offset();

using BaselineJITRegisters::ResolveScope::metadataGPR;

using BaselineJITRegisters::ResolveScope::scopeGPR;

using BaselineJITRegisters::ResolveScope::bytecodeOffsetGPR;

// Materialize metadataGPR if we didn't already.

constexpr size_t metadataMinAlignment = 4;

Address metadataAddress = computeBaseAddressForMetadata<metadataMinAlignment>(bytecode, metadataGPR);

if (metadataAddress.base != metadataGPR)

addPtr(TrustedImm32(m_profiledCodeBlock->metadataTable()->offsetInMetadataTable(bytecode)), GPRInfo::metadataTableRegister, metadataGPR);

MacroAssemblerCodeRef<JITThunkPtrTag> code;

// FIXME: Why do we generate the cases for the thunks we already emitted in the fast path. It seems like those should just go straight to the generic slow path thunk.

if (profiledResolveType == ClosureVarWithVarInjectionChecks)

code = vm().getCTIStub(generateOpResolveScopeThunk<ClosureVarWithVarInjectionChecks>);