GitHub Viewer

/* * Copyright (C) 2013-2025 Apple Inc. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include "config.h" #include "JITOperations.h" WTF_ALLOW_UNSAFE_BUFFER_USAGE_BEGIN #if ENABLE(JIT) #include "ArithProfile.h" #include "ArrayConstructor.h" #include "CacheableIdentifierInlines.h" #include "CodeBlockInlines.h" #include "CommonSlowPathsInlines.h" #include "DFGDriver.h" #include "DFGOSREntry.h" #include "DFGThunks.h" #include "Debugger.h" #include "EnsureStillAliveHere.h" #include "ExceptionFuzz.h" #include "FrameTracers.h" #include "GetterSetter.h" #include "ICStats.h" #include "InlineCacheCompiler.h" #include "Interpreter.h" #include "JIT.h" #include "JITExceptions.h" #include "JITThunks.h" #include "JITToDFGDeferredCompilationCallback.h" #include "JITWorklist.h" #include "JSArrayIterator.h" #include "JSArrayIteratorInlines.h" #include "JSAsyncFromSyncIterator.h" #include "JSAsyncFunction.h" #include "JSAsyncFunctionGenerator.h" #include "JSAsyncGenerator.h" #include "JSAsyncGeneratorFunction.h" #include "JSBoundFunction.h" #include "JSCInlines.h" #include "JSCPtrTag.h" #include "JSGeneratorFunction.h" #include "JSGlobalObjectFunctions.h" #include "JSLexicalEnvironmentInlines.h" #include "JSMapIterator.h" #include "JSMicrotask.h" #include "JSPromise.h" #include "JSRemoteFunction.h" #include "JSSentinel.h" #include "JSSetIterator.h" #include "JSStringIteratorInlines.h" #include "JSWithScope.h" #include "JumpTable.h" #include "LLIntEntrypoint.h" #include "MegamorphicCache.h" #include "ObjectConstructor.h" #include "PropertyInlineCache.h" #include "PropertyName.h" #include "PropertyNameInlines.h" #include "RegExpObject.h" #include "RepatchInlines.h" #include "ShadowChicken.h" #include "SuperSampler.h" #include "ThunkGenerators.h" #include "TypeProfilerLog.h" #include "VMInlines.h" #include "VMTrapsInlines.h" IGNORE_WARNINGS_BEGIN("frame-address") namespace JSC { ALWAYS_INLINE ICSlowPathCallFrameTracer::ICSlowPathCallFrameTracer(VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache) #if ASSERT_ENABLED : m_vm(vm) #endif { UNUSED_PARAM(vm); UNUSED_PARAM(callFrame); ASSERT(callFrame); ASSERT(reinterpret_cast(callFrame) < reinterpret_cast(vm.topEntryFrame)); assertStackPointerIsAligned(); // If ASSERT_ENABLED and USE(BUILTIN_FRAME_ADDRESS), prepareCallOperation() will put the frame pointer into vm.topCallFrame. // We can ensure here that a call to prepareCallOperation() (or its equivalent) is not missing by comparing vm.topCallFrame to // the result of __builtin_frame_address which is passed in as callFrame. ASSERT(vm.topCallFrame == callFrame); vm.topCallFrame = callFrame; callFrame->setCallSiteIndex(propertyCache->callSiteIndex); } ALWAYS_INLINE JSValue profiledAdd(JSGlobalObject* globalObject, JSValue op1, JSValue op2, BinaryArithProfile& arithProfile) { arithProfile.observeLHSAndRHS(op1, op2); JSValue result = jsAdd(globalObject, op1, op2); arithProfile.observeResult(result); return result; } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationThrowStackOverflowError, void, (CodeBlock* codeBlock)) { // We pass in our own code block, because the callframe hasn't been populated. VM& vm = codeBlock->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); callFrame->convertToZombieFrame(vm, codeBlock); throwStackOverflowError(codeBlock->globalObject(), scope); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationThrowStackOverflowErrorFromThunk, void, (JSGlobalObject* globalObject)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); throwStackOverflowError(globalObject, scope); genericUnwind(vm, callFrame); ASSERT(vm.targetMachinePCForThrow); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationThrowOutOfMemoryError, void, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CodeBlock* codeBlock = callFrame->codeBlock(); if (JSC::JITCode::isOptimizingJIT(codeBlock->jitType())) codeBlock = baselineCodeBlockForOriginAndBaselineCodeBlock(callFrame->codeOrigin(), codeBlock->baselineAlternative()); JSGlobalObject* globalObject = codeBlock->globalObject(); scope.throwException(globalObject, createOutOfMemoryError(globalObject)); } static JSValue getWrappedValue(JSGlobalObject* globalObject, JSGlobalObject* targetGlobalObject, JSValue value) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); if (!value.isObject()) RELEASE_AND_RETURN(scope, value); if (value.isCallable()) RELEASE_AND_RETURN(scope, JSRemoteFunction::tryCreate(targetGlobalObject, vm, static_cast(value.asCell()))); throwTypeError(globalObject, scope, "value passing between realms must be callable or primitive"_s); return jsUndefined(); } JSC_DEFINE_JIT_OPERATION(operationGetWrappedValueForTarget, EncodedJSValue, (JSRemoteFunction* callee, EncodedJSValue encodedValue)) { JSGlobalObject* globalObject = callee->realm(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(isRemoteFunction(callee)); JSGlobalObject* targetGlobalObject = callee->targetFunction()->realm(); OPERATION_RETURN(scope, JSValue::encode(getWrappedValue(globalObject, targetGlobalObject, JSValue::decode(encodedValue)))); } JSC_DEFINE_JIT_OPERATION(operationGetWrappedValueForCaller, EncodedJSValue, (JSRemoteFunction* callee, EncodedJSValue encodedValue)) { JSGlobalObject* globalObject = callee->realm(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(isRemoteFunction(callee)); OPERATION_RETURN(scope, JSValue::encode(getWrappedValue(globalObject, globalObject, JSValue::decode(encodedValue)))); } static inline UGPRPair materializeTargetCode(VM& vm, JSFunction* targetFunction) { auto throwScope = DECLARE_THROW_SCOPE(vm); ExecutableBase* executable = targetFunction->executable(); // Force the executable to cache its arity entrypoint. { DeferTraps deferTraps(vm); // We can't jettison any code until after we link the call. CodeBlock* codeBlockSlot = nullptr; if (!executable->isHostFunction()) { JSScope* scope = targetFunction->scopeUnchecked(); FunctionExecutable* functionExecutable = static_cast(executable); functionExecutable->prepareForExecution(vm, targetFunction, scope, CodeSpecializationKind::CodeForCall, codeBlockSlot); RETURN_IF_EXCEPTION(throwScope, encodeResult(nullptr, nullptr)); } return encodeResult(executable->entrypointFor(CodeSpecializationKind::CodeForCall, ArityCheckMode::MustCheckArity).taggedPtr(), codeBlockSlot); } } JSC_DEFINE_JIT_OPERATION(operationMaterializeBoundFunctionTargetCode, UGPRPair, (JSBoundFunction* callee)) { JSGlobalObject* globalObject = callee->realm(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); auto* targetFunction = uncheckedDowncast(callee->targetFunction()); // We call this function only when JSBoundFunction's target is JSFunction. OPERATION_RETURN(scope, materializeTargetCode(vm, targetFunction)); } JSC_DEFINE_JIT_OPERATION(operationMaterializeRemoteFunctionTargetCode, UGPRPair, (JSRemoteFunction* callee)) { JSGlobalObject* globalObject = callee->realm(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(isRemoteFunction(callee)); auto* targetFunction = uncheckedDowncast(callee->targetFunction()); // We call this function only when JSRemoteFunction's target is JSFunction. OPERATION_RETURN(scope, materializeTargetCode(vm, targetFunction)); } JSC_DEFINE_JIT_OPERATION(operationThrowRemoteFunctionException, EncodedJSValue, (JSRemoteFunction* callee)) { JSGlobalObject* globalObject = callee->realm(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(isRemoteFunction(callee)); Exception* exception = scope.exception(); // We should only be here when "rethrowing" an exception RELEASE_ASSERT(exception); JSValue exceptionValue = exception->value(); if (!scope.tryClearException()) [[unlikely]] { scope.release(); OPERATION_RETURN(scope, encodedJSValue()); } String exceptionString = exceptionValue.toWTFString(globalObject); if (!scope.tryClearException()) [[unlikely]] { scope.release(); OPERATION_RETURN(scope, encodedJSValue()); } if (exceptionString.length()) OPERATION_RETURN(scope, throwVMTypeError(globalObject, scope, exceptionString)); OPERATION_RETURN(scope, throwVMTypeError(globalObject, scope)); } JSC_DEFINE_JIT_OPERATION(operationThrowIteratorResultIsNotObject, void, (JSGlobalObject* globalObject)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); throwTypeError(globalObject, scope, "Iterator result interface is not an object."_s); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationGetByIdDirectGaveUp, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); PropertySlot slot(baseValue, PropertySlot::InternalMethodType::GetOwnProperty); bool found = baseValue.getOwnPropertySlot(globalObject, identifier, slot); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); OPERATION_RETURN(scope, JSValue::encode(found ? slot.getValue(globalObject, identifier) : jsUndefined())); } JSC_DEFINE_JIT_OPERATION(operationGetByIdDirectGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); JSValue baseValue = JSValue::decode(base); PropertySlot slot(baseValue, PropertySlot::InternalMethodType::GetOwnProperty); bool found = baseValue.getOwnPropertySlot(globalObject, identifier, slot); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); OPERATION_RETURN(scope, JSValue::encode(found ? slot.getValue(globalObject, identifier) : jsUndefined())); } JSC_DEFINE_JIT_OPERATION(operationGetByIdDirectOptimize, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); PropertySlot slot(baseValue, PropertySlot::InternalMethodType::GetOwnProperty); bool found = baseValue.getOwnPropertySlot(globalObject, identifier, slot); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); CodeBlock* codeBlock = callFrame->codeBlock(); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ByIdDirect, /* isNonStringPrimitiveKey */ false); OPERATION_RETURN(scope, JSValue::encode(found ? slot.getValue(globalObject, identifier) : jsUndefined())); } template static ALWAYS_INLINE JSValue getByIdMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, JSValue baseValue, JSValue thisValue, CacheableIdentifier identifier) { auto scope = DECLARE_THROW_SCOPE(vm); auto* uid = identifier.uid(); PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get); JSObject* baseObject = nullptr; if (!baseValue.isObject()) [[unlikely]] { if (!baseValue.isString()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); RELEASE_AND_RETURN(scope, baseValue.get(globalObject, uid, slot)); } baseObject = globalObject->stringPrototype(); } else baseObject = asObject(baseValue); JSObject* object = baseObject; bool shouldGiveUp = false; bool cacheable = true; while (true) { if (TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()) && object->type() != ArrayType && object->type() != JSFunctionType && object->type() != DerivedStringObjectType && object != globalObject->arrayPrototype()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); bool hasProperty = object->getNonIndexPropertySlot(globalObject, uid, slot); RETURN_IF_EXCEPTION(scope, { }); if (hasProperty) RELEASE_AND_RETURN(scope, slot.getValue(globalObject, uid)); return jsUndefined(); } Structure* structure = object->structure(); bool hasProperty = object->getOwnNonIndexPropertySlot(vm, structure, uid, slot); structure = object->structure(); // Reload it again since static-class-table can cause transition. But this transition only affects on this Structure. if (!structure->propertyAccessesAreCacheable()) { shouldGiveUp = true; cacheable = false; } if (hasProperty) { if (cacheable && slot.isCacheableValue() && slot.cachedOffset() structure()->isDictionary()) vm.megamorphicCache()->initAsHit(baseObject->structureID(), uid, slot.slotBase(), slot.cachedOffset(), slot.slotBase() == baseValue); else { if (baseObject->structure()->hasBeenFlattenedBefore()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); } } } else if constexpr (kind == GetByKind::ById) { if (cacheable && slot.isCacheableGetter() && slot.cachedOffset() structure()->isDictionary()) vm.megamorphicCache()->initAsGetterHit(baseObject->structureID(), uid, slot.slotBase(), slot.cachedOffset(), slot.slotBase() == baseValue); else { if (baseObject->structure()->hasBeenFlattenedBefore()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); } } } else { if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); } } else { if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); } RELEASE_AND_RETURN(scope, slot.getValue(globalObject, uid)); } if (!structure->propertyAccessesAreCacheableForAbsence()) { shouldGiveUp = true; cacheable = false; } cacheable &= structure->hasMonoProto(); JSValue prototype = object->getPrototypeDirect(); if (!prototype.isObject()) { if (cacheable) [[likely]] { if (!baseObject->structure()->isDictionary()) [[likely]] { vm.megamorphicCache()->initAsMiss(baseObject->structureID(), uid); return jsUndefined(); } if (!baseObject->structure()->hasBeenFlattenedBefore()) [[likely]] return jsUndefined(); } if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); return jsUndefined(); } object = asObject(prototype); } } JSC_DEFINE_JIT_OPERATION(operationGetByIdMegamorphic, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(base); CacheableIdentifier identifier = propertyCache->identifier(); OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic(globalObject, vm, callFrame, propertyCache, baseValue, baseValue, identifier))); } JSC_DEFINE_JIT_OPERATION(operationGetByIdMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(base); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic(globalObject, vm, callFrame, nullptr, baseValue, baseValue, identifier))); } JSC_DEFINE_JIT_OPERATION(operationGetByIdGaveUp, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(base); PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get); CacheableIdentifier identifier = propertyCache->identifier(); JSValue result = baseValue.get(globalObject, identifier, slot); LOG_IC((ICEvent::OperationGetByIdGaveUp, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByIdGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier)) { SuperSamplerScope superSamplerScope(false); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(base); PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); JSValue result = baseValue.get(globalObject, identifier, slot); LOG_IC((ICEvent::OperationGetByIdGeneric, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByIdOptimize, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); OPERATION_RETURN(scope, JSValue::encode(baseValue.getPropertySlot(globalObject, identifier, [&] (bool found, PropertySlot& slot) -> JSValue { LOG_IC((ICEvent::OperationGetByIdOptimize, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); CodeBlock* codeBlock = callFrame->codeBlock(); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ById, /* isNonStringPrimitiveKey */ false); return found ? slot.getValue(globalObject, identifier) : jsUndefined(); }))); } JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisGaveUp, EncodedJSValue, (EncodedJSValue base, EncodedJSValue thisEncoded, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); JSValue thisValue = JSValue::decode(thisEncoded); PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get); JSValue result = baseValue.get(globalObject, identifier, slot); LOG_IC((ICEvent::OperationGetByIdWithThisGaveUp, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, EncodedJSValue thisEncoded, uintptr_t rawCacheableIdentifier)) { SuperSamplerScope superSamplerScope(false); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); JSValue baseValue = JSValue::decode(base); JSValue thisValue = JSValue::decode(thisEncoded); PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get); JSValue result = baseValue.get(globalObject, identifier, slot); LOG_IC((ICEvent::OperationGetByIdWithThisGeneric, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisOptimize, EncodedJSValue, (EncodedJSValue base, EncodedJSValue thisEncoded, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); JSValue thisValue = JSValue::decode(thisEncoded); PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get); OPERATION_RETURN(scope, JSValue::encode(baseValue.getPropertySlot(globalObject, identifier, slot, [&] (bool found, PropertySlot& slot) -> JSValue { LOG_IC((ICEvent::OperationGetByIdWithThisOptimize, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); CodeBlock* codeBlock = callFrame->codeBlock(); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ByIdWithThis, /* isNonStringPrimitiveKey */ false); return found ? slot.getValue(globalObject, identifier) : jsUndefined(); }))); } JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisMegamorphic, EncodedJSValue, (EncodedJSValue base, EncodedJSValue encodedThis, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic(globalObject, vm, callFrame, propertyCache, JSValue::decode(base), JSValue::decode(encodedThis), identifier))); } JSC_DEFINE_JIT_OPERATION(operationGetByIdWithThisMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, EncodedJSValue encodedThis, uintptr_t rawCacheableIdentifier)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); OPERATION_RETURN(scope, JSValue::encode(getByIdMegamorphic(globalObject, vm, callFrame, nullptr, JSValue::decode(base), JSValue::decode(encodedThis), identifier))); } JSC_DEFINE_JIT_OPERATION(operationInByIdGaveUp, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); if (!baseValue.isObject()) { throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); OPERATION_RETURN(scope, JSValue::encode(jsUndefined())); } JSObject* baseObject = asObject(baseValue); LOG_IC((ICEvent::OperationInByIdGeneric, baseObject->classInfo())); scope.release(); PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(baseObject->getPropertySlot(globalObject, identifier, slot)))); } JSC_DEFINE_JIT_OPERATION(operationInByIdOptimize, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); if (!baseValue.isObject()) { throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); OPERATION_RETURN(scope, JSValue::encode(jsUndefined())); } JSObject* baseObject = asObject(baseValue); LOG_IC((ICEvent::OperationInByIdOptimize, baseObject->classInfo())); PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty); bool found = baseObject->getPropertySlot(globalObject, identifier, slot); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); CodeBlock* codeBlock = callFrame->codeBlock(); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier)) repatchInBy(globalObject, codeBlock, baseObject, identifier, found, slot, *propertyCache, InByKind::ById); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(found))); } static ALWAYS_INLINE JSValue inByIdMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, JSValue baseValue, CacheableIdentifier identifier) { constexpr bool verbose = false; auto scope = DECLARE_THROW_SCOPE(vm); auto* uid = identifier.uid(); PropertySlot slot(baseValue, PropertySlot::InternalMethodType::HasProperty); if (!baseValue.isObject()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { dataLogLnIf(verbose, " ", __LINE__); repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ById); } throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); return jsUndefined(); } JSObject* baseObject = asObject(baseValue); JSObject* object = baseObject; bool shouldGiveUp = false; bool cacheable = true; while (true) { if (TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()) && object->type() != ArrayType && object->type() != JSFunctionType && object != globalObject->arrayPrototype()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { dataLogLnIf(verbose, " ", __LINE__); repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ById); } RELEASE_AND_RETURN(scope, jsBoolean(object->getNonIndexPropertySlot(globalObject, uid, slot))); } Structure* structure = object->structure(); bool hasProperty = object->getOwnNonIndexPropertySlot(vm, structure, uid, slot); structure = object->structure(); // Reload it again since static-class-table can cause transition. But this transition only affects on this Structure. if (!structure->propertyAccessesAreCacheable()) { shouldGiveUp = true; cacheable = false; } if (hasProperty) { if (cacheable && slot.isCacheable()) [[likely]] { if (slot.slotBase() == baseObject || !baseObject->structure()->isDictionary()) vm.megamorphicCache()->initAsHasHit(baseObject->structureID(), uid); else { if (baseObject->structure()->hasBeenFlattenedBefore()) [[unlikely]] { if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { dataLogLnIf(verbose, " ", __LINE__); repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ById); } } dataLogLnIf(verbose, " ", __LINE__); } } else { if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { dataLogLnIf(verbose, " ", __LINE__); repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ById); } } return jsBoolean(true); } if (!structure->propertyAccessesAreCacheableForAbsence()) { shouldGiveUp = true; cacheable = false; } cacheable &= structure->hasMonoProto(); JSValue prototype = object->getPrototypeDirect(); if (!prototype.isObject()) { if (cacheable) [[likely]] { if (!baseObject->structure()->isDictionary()) [[likely]] { vm.megamorphicCache()->initAsHasMiss(baseObject->structureID(), uid); return jsBoolean(false); } if (!baseObject->structure()->hasBeenFlattenedBefore()) [[likely]] return jsBoolean(false); } if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { dataLogLnIf(verbose, " ", __LINE__); repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ById); } return jsBoolean(false); } object = asObject(prototype); } } JSC_DEFINE_JIT_OPERATION(operationInByIdMegamorphic, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(base); CacheableIdentifier identifier = propertyCache->identifier(); OPERATION_RETURN(scope, JSValue::encode(inByIdMegamorphic(globalObject, vm, callFrame, propertyCache, baseValue, identifier))); } JSC_DEFINE_JIT_OPERATION(operationInByIdMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(base); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); OPERATION_RETURN(scope, JSValue::encode(inByIdMegamorphic(globalObject, vm, callFrame, nullptr, baseValue, identifier))); } JSC_DEFINE_JIT_OPERATION(operationInByValOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedKey, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue key = JSValue::decode(encodedKey); if (!baseValue.isObject()) { throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); OPERATION_RETURN(scope, encodedJSValue()); } JSObject* baseObject = asObject(baseValue); uint32_t i; if (key.getUInt32(i)) { if (profile) profile->observeIndexedRead(baseObject, i); CodeBlock* codeBlock = callFrame->codeBlock(); Structure* structure = baseValue.asCell()->structure(); if (propertyCache->considerRepatchingCacheGeneric(vm, codeBlock, structure)) { if (profile) profile->computeUpdatedPrediction(codeBlock, structure); repatchArrayInByVal(globalObject, codeBlock, baseValue, key, *propertyCache, InByKind::ByVal); } OPERATION_RETURN(scope, JSValue::encode(jsBoolean(baseObject->hasProperty(globalObject, i)))); } const Identifier propertyName = key.toPropertyKey(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty); bool found = baseObject->getPropertySlot(globalObject, propertyName, slot); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); if (CacheableIdentifier::isCacheableIdentifierCell(key) && (key.isSymbol() || !parseIndex(propertyName))) { CodeBlock* codeBlock = callFrame->codeBlock(); CacheableIdentifier identifier = CacheableIdentifier::createFromCell(key.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier)) repatchInBy(globalObject, codeBlock, baseObject, identifier, found, slot, *propertyCache, InByKind::ByVal); } OPERATION_RETURN(scope, JSValue::encode(jsBoolean(found))); } JSC_DEFINE_JIT_OPERATION(operationInByValGaveUp, EncodedJSValue, (EncodedJSValue base, EncodedJSValue key, PropertyInlineCache* propertyCache, ArrayProfile* arrayProfile)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; OPERATION_RETURN(scope, JSValue::encode(jsBoolean(CommonSlowPaths::opInByVal(globalObject, JSValue::decode(base), JSValue::decode(key), arrayProfile)))); } static ALWAYS_INLINE JSValue inByValMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, ArrayProfile* profile, JSValue baseValue, JSValue subscript) { constexpr bool verbose = false; auto scope = DECLARE_THROW_SCOPE(vm); if (!baseValue.isObject() || !CacheableIdentifier::isCacheableIdentifierCell(subscript)) [[unlikely]] { dataLogLnIf(verbose, " ", __LINE__); if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ByVal); } RELEASE_AND_RETURN(scope, jsBoolean(CommonSlowPaths::opInByVal(globalObject, baseValue, subscript, profile))); } Identifier propertyName = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, { }); JSObject* baseObject = asObject(baseValue); UniquedStringImpl* uid = propertyName.impl(); if (!canUseMegamorphicInById(vm, uid)) [[unlikely]] { dataLogLnIf(verbose, " ", __LINE__); if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ByVal); } if (profile) profile->observeStructure(baseObject->structure()); RELEASE_AND_RETURN(scope, jsBoolean(baseObject->hasProperty(globalObject, uid))); } PropertySlot slot(baseValue, PropertySlot::InternalMethodType::HasProperty); JSObject* object = baseObject; bool shouldGiveUp = false; bool cacheable = true; while (true) { if (TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()) && object->type() != ArrayType && object->type() != JSFunctionType && object != globalObject->arrayPrototype()) [[unlikely]] { dataLogLnIf(verbose, " ", __LINE__); if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ByVal); } RELEASE_AND_RETURN(scope, jsBoolean(object->getNonIndexPropertySlot(globalObject, uid, slot))); } Structure* structure = object->structure(); bool hasProperty = object->getOwnNonIndexPropertySlot(vm, structure, uid, slot); structure = object->structure(); // Reload it again since static-class-table can cause transition. But this transition only affects on this Structure. if (!structure->propertyAccessesAreCacheable()) { cacheable = false; shouldGiveUp = true; } if (hasProperty) { if (cacheable && slot.isCacheable()) [[likely]] { if (slot.slotBase() == baseObject || !baseObject->structure()->isDictionary()) vm.megamorphicCache()->initAsHasHit(baseObject->structureID(), uid); else { if (baseObject->structure()->hasBeenFlattenedBefore()) [[unlikely]] { dataLogLnIf(verbose, " ", __LINE__); if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ByVal); } } } } else { dataLogLnIf(verbose, " ", __LINE__); if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ByVal); } } return jsBoolean(true); } if (!structure->propertyAccessesAreCacheableForAbsence()) { cacheable = false; shouldGiveUp = true; } cacheable &= structure->hasMonoProto(); JSValue prototype = object->getPrototypeDirect(); if (!prototype.isObject()) { if (cacheable) [[likely]] { if (!baseObject->structure()->isDictionary()) [[likely]] { vm.megamorphicCache()->initAsHasMiss(baseObject->structureID(), uid); return jsBoolean(false); } if (!baseObject->structure()->hasBeenFlattenedBefore()) [[likely]] return jsBoolean(false); } dataLogLnIf(verbose, " ", __LINE__); if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) { repatchInBySlowPathCall(callFrame->codeBlock(), *propertyCache, InByKind::ByVal); } return jsBoolean(false); } object = asObject(prototype); } } JSC_DEFINE_JIT_OPERATION(operationInByValMegamorphic, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache, ArrayProfile* arrayProfile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); OPERATION_RETURN(scope, JSValue::encode(inByValMegamorphic(globalObject, vm, callFrame, propertyCache, arrayProfile, baseValue, subscript))); } JSC_DEFINE_JIT_OPERATION(operationInByValMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); OPERATION_RETURN(scope, JSValue::encode(inByValMegamorphic(globalObject, vm, callFrame, nullptr, nullptr, baseValue, JSValue::decode(encodedSubscript)))); } JSC_DEFINE_JIT_OPERATION(operationHasPrivateNameOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedProperty, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); if (!baseValue.isObject()) { throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); OPERATION_RETURN(scope, encodedJSValue()); } JSObject* baseObject = asObject(baseValue); JSValue propertyValue = JSValue::decode(encodedProperty); ASSERT(propertyValue.isSymbol()); auto property = propertyValue.toPropertyKey(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); PropertySlot slot(baseObject, PropertySlot::InternalMethodType::HasProperty); bool found = JSObject::getPrivateFieldSlot(baseObject, globalObject, property, slot); ASSERT(CacheableIdentifier::isCacheableIdentifierCell(propertyValue)); CodeBlock* codeBlock = callFrame->codeBlock(); CacheableIdentifier identifier = CacheableIdentifier::createFromCell(propertyValue.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier)) repatchInBy(globalObject, codeBlock, baseObject, identifier, found, slot, *propertyCache, InByKind::PrivateName); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(found))); } JSC_DEFINE_JIT_OPERATION(operationHasPrivateNameGaveUp, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedProperty, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); if (!baseValue.isObject()) { throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); OPERATION_RETURN(scope, encodedJSValue()); } JSValue propertyValue = JSValue::decode(encodedProperty); ASSERT(propertyValue.isSymbol()); auto property = propertyValue.toPropertyKey(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(asObject(baseValue)->hasPrivateField(globalObject, property)))); } JSC_DEFINE_JIT_OPERATION(operationHasPrivateBrandOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedBrand, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); if (!baseValue.isObject()) { throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); OPERATION_RETURN(scope, encodedJSValue()); } JSObject* baseObject = asObject(baseValue); JSValue brand = JSValue::decode(encodedBrand); bool found = asObject(baseValue)->hasPrivateBrand(globalObject, brand); ASSERT(CacheableIdentifier::isCacheableIdentifierCell(brand)); CodeBlock* codeBlock = callFrame->codeBlock(); CacheableIdentifier identifier = CacheableIdentifier::createFromCell(brand.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier)) repatchHasPrivateBrand(globalObject, codeBlock, baseObject, identifier, found, *propertyCache); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(found))); } JSC_DEFINE_JIT_OPERATION(operationHasPrivateBrandGaveUp, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedBrand, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); if (!baseValue.isObject()) { throwException(globalObject, scope, createInvalidInParameterError(globalObject, baseValue)); OPERATION_RETURN(scope, encodedJSValue()); } OPERATION_RETURN(scope, JSValue::encode(jsBoolean(asObject(baseValue)->hasPrivateBrand(globalObject, JSValue::decode(encodedBrand))))); } JSC_DEFINE_JIT_OPERATION(operationPutByIdStrictGaveUp, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); CacheableIdentifier identifier = propertyCache->identifier(); PutPropertySlot slot(baseValue, true, callFrame->codeBlock()->putByIdContext()); baseValue.putInline(globalObject, identifier, JSValue::decode(encodedValue), slot); LOG_IC((ICEvent::OperationPutByIdStrictGaveUp, baseValue.classInfoOrNull(), slot.base() == baseValue)); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdSloppyGaveUp, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); CacheableIdentifier identifier = propertyCache->identifier(); PutPropertySlot slot(baseValue, false, callFrame->codeBlock()->putByIdContext()); baseValue.putInline(globalObject, identifier, JSValue::decode(encodedValue), slot); LOG_IC((ICEvent::OperationPutByIdSloppyGaveUp, baseValue.classInfoOrNull(), slot.base() == baseValue)); OPERATION_RETURN(scope); } ALWAYS_INLINE static void putByIdMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, JSValue baseValue, JSValue value, CacheableIdentifier identifier, PutByKind kind) { auto scope = DECLARE_THROW_SCOPE(vm); auto* uid = identifier.uid(); bool isStrict = kind == PutByKind::ByIdStrict; PutPropertySlot slot(baseValue, isStrict, callFrame->codeBlock()->putByIdContext()); if (!baseValue.isObject()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); scope.release(); baseValue.put(globalObject, uid, value, slot); return; } JSObject* baseObject = asObject(baseValue); Structure* structure = baseObject->structure(); if (structure->typeInfo().overridesPut()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); scope.release(); baseValue.put(globalObject, uid, value, slot); return; } { JSObject* object = baseObject; while (true) { if (structure->hasReadOnlyOrGetterSetterPropertiesExcludingProto() || structure->typeInfo().overridesGetPrototype() || structure->typeInfo().overridesPut() || structure->hasPolyProto()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); scope.release(); baseObject->putInlineSlow(globalObject, uid, value, slot); return; } JSValue prototype = object->getPrototypeDirect(); if (prototype.isNull()) break; object = asObject(prototype); structure = object->structure(); } } Structure* oldStructure = baseObject->structure(); baseObject->putInlineFast(globalObject, uid, value, slot); RETURN_IF_EXCEPTION(scope, void()); if (!slot.isCacheablePut() || !oldStructure->propertyAccessesAreCacheable()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); return; } Structure* newStructure = baseObject->structure(); if (slot.type() == PutPropertySlot::ExistingProperty) { if (oldStructure == newStructure && slot.cachedOffset() didCachePropertyReplacement(vm, slot.cachedOffset()); // Ensure invalidating watchpoint set. vm.megamorphicCache()->initAsReplace(StructureID::encode(oldStructure), uid, slot.cachedOffset()); } return; } ASSERT(slot.type() == PutPropertySlot::NewProperty); // This is not worth registering. Dictionary Structure is one-on-one to this object. And NewProperty happens only once. // So this cache will be never used again. if (oldStructure->isDictionary() || newStructure->isDictionary()) return; if (oldStructure->mayBePrototype() || (newStructure->previousID() != oldStructure) || !newStructure->propertyAccessesAreCacheable()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); return; } bool reallocating = newStructure->outOfLineCapacity() != oldStructure->outOfLineCapacity(); if (slot.cachedOffset() initAsTransition(StructureID::encode(oldStructure), StructureID::encode(newStructure), uid, slot.cachedOffset(), reallocating); } JSC_DEFINE_JIT_OPERATION(operationPutByIdStrictMegamorphic, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue value = JSValue::decode(encodedValue); CacheableIdentifier identifier = propertyCache->identifier(); putByIdMegamorphic(globalObject, vm, callFrame, propertyCache, baseValue, value, identifier, PutByKind::ByIdStrict); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdStrictMegamorphicGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedValue, EncodedJSValue encodedBase, uintptr_t rawCacheableIdentifier)) { SuperSamplerScope superSamplerScope(false); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue value = JSValue::decode(encodedValue); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); putByIdMegamorphic(globalObject, vm, callFrame, nullptr, baseValue, value, identifier, PutByKind::ByIdStrict); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdSloppyMegamorphic, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue value = JSValue::decode(encodedValue); CacheableIdentifier identifier = propertyCache->identifier(); putByIdMegamorphic(globalObject, vm, callFrame, propertyCache, baseValue, value, identifier, PutByKind::ByIdSloppy); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdSloppyMegamorphicGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedValue, EncodedJSValue encodedBase, uintptr_t rawCacheableIdentifier)) { SuperSamplerScope superSamplerScope(false); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue value = JSValue::decode(encodedValue); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); putByIdMegamorphic(globalObject, vm, callFrame, nullptr, baseValue, value, identifier, PutByKind::ByIdSloppy); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByMegamorphicReallocating, void, (VM* vmPointer, JSObject* baseObject, EncodedJSValue encodedValue, const MegamorphicCache::StoreEntry* entry)) { constexpr bool verbose = false; VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); Structure* oldStructure = WTF::opaque(baseObject->structure()); Structure* newStructure = WTF::opaque(entry->m_newStructureID.decode()); PropertyOffset offset = entry->m_offset; ASSERT(oldStructure == entry->m_oldStructureID.decode()); Butterfly* newButterfly = baseObject->allocateMoreOutOfLineStorage(vm, oldStructure->outOfLineCapacity(), newStructure->outOfLineCapacity()); baseObject->nukeStructureAndSetButterfly(vm, StructureID::encode(oldStructure), newButterfly); baseObject->putDirectOffset(vm, offset, JSValue::decode(encodedValue)); baseObject->setStructure(vm, newStructure); ASSERT(newStructure == baseObject->structure()); dataLogLnIf(verbose, JSValue(baseObject), " ", offset); ensureStillAliveHere(oldStructure); ensureStillAliveHere(newStructure); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdDirectStrictGaveUp, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); CacheableIdentifier identifier = propertyCache->identifier(); PutPropertySlot slot(baseValue, true, callFrame->codeBlock()->putByIdContext()); CommonSlowPaths::putDirectWithReify(vm, globalObject, asObject(baseValue), identifier, JSValue::decode(encodedValue), slot); LOG_IC((ICEvent::OperationPutByIdDirectStrictGaveUp, baseValue.classInfoOrNull(), slot.base() == baseValue)); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdDirectSloppyGaveUp, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); CacheableIdentifier identifier = propertyCache->identifier(); PutPropertySlot slot(baseValue, false, callFrame->codeBlock()->putByIdContext()); CommonSlowPaths::putDirectWithReify(vm, globalObject, asObject(baseValue), identifier, JSValue::decode(encodedValue), slot); LOG_IC((ICEvent::OperationPutByIdDirectSloppyGaveUp, baseValue.classInfoOrNull(), slot.base() == baseValue)); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdStrictOptimize, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); AccessType accessType = static_cast(propertyCache->accessType); JSValue value = JSValue::decode(encodedValue); JSValue baseValue = JSValue::decode(encodedBase); CodeBlock* codeBlock = callFrame->codeBlock(); PutPropertySlot slot(baseValue, true, codeBlock->putByIdContext()); Structure* structure = CommonSlowPaths::originalStructureBeforePut(baseValue); baseValue.putInline(globalObject, identifier, value, slot); LOG_IC((ICEvent::OperationPutByIdStrictOptimize, baseValue.classInfoOrNull(), slot.base() == baseValue)); OPERATION_RETURN_IF_EXCEPTION(scope); if (accessType != static_cast(propertyCache->accessType)) OPERATION_RETURN(scope); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, structure, identifier)) repatchPutBy(globalObject, codeBlock, baseValue, structure, identifier, slot, *propertyCache, PutByKind::ByIdStrict, /* isNonStringPrimitiveKey */ false); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdSloppyOptimize, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); AccessType accessType = static_cast(propertyCache->accessType); JSValue value = JSValue::decode(encodedValue); JSValue baseValue = JSValue::decode(encodedBase); CodeBlock* codeBlock = callFrame->codeBlock(); PutPropertySlot slot(baseValue, false, codeBlock->putByIdContext()); Structure* structure = CommonSlowPaths::originalStructureBeforePut(baseValue); baseValue.putInline(globalObject, identifier, value, slot); LOG_IC((ICEvent::OperationPutByIdSloppyOptimize, baseValue.classInfoOrNull(), slot.base() == baseValue)); OPERATION_RETURN_IF_EXCEPTION(scope); if (accessType != static_cast(propertyCache->accessType)) OPERATION_RETURN(scope); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, structure, identifier)) repatchPutBy(globalObject, codeBlock, baseValue, structure, identifier, slot, *propertyCache, PutByKind::ByIdSloppy, /* isNonStringPrimitiveKey */ false); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdDirectStrictOptimize, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); AccessType accessType = static_cast(propertyCache->accessType); JSValue value = JSValue::decode(encodedValue); JSObject* baseObject = asObject(JSValue::decode(encodedBase)); CodeBlock* codeBlock = callFrame->codeBlock(); PutPropertySlot slot(baseObject, true, codeBlock->putByIdContext()); Structure* structure = nullptr; CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, identifier, value, slot, &structure); LOG_IC((ICEvent::OperationPutByIdDirectStrictOptimize, baseObject->classInfo(), slot.base() == baseObject)); OPERATION_RETURN_IF_EXCEPTION(scope); if (accessType != static_cast(propertyCache->accessType)) OPERATION_RETURN(scope); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, structure, identifier)) repatchPutBy(globalObject, codeBlock, baseObject, structure, identifier, slot, *propertyCache, PutByKind::ByIdDirectStrict, /* isNonStringPrimitiveKey */ false); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdDirectSloppyOptimize, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); AccessType accessType = static_cast(propertyCache->accessType); JSValue value = JSValue::decode(encodedValue); JSObject* baseObject = asObject(JSValue::decode(encodedBase)); CodeBlock* codeBlock = callFrame->codeBlock(); PutPropertySlot slot(baseObject, false, codeBlock->putByIdContext()); Structure* structure = nullptr; CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, identifier, value, slot, &structure); LOG_IC((ICEvent::OperationPutByIdDirectSloppyOptimize, baseObject->classInfo(), slot.base() == baseObject)); OPERATION_RETURN_IF_EXCEPTION(scope); if (accessType != static_cast(propertyCache->accessType)) OPERATION_RETURN(scope); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, structure, identifier)) repatchPutBy(globalObject, codeBlock, baseObject, structure, identifier, slot, *propertyCache, PutByKind::ByIdDirectSloppy, /* isNonStringPrimitiveKey */ false); OPERATION_RETURN(scope); } template ALWAYS_INLINE static void setPrivateField(VM& vm, JSGlobalObject* globalObject, CallFrame* callFrame, JSValue baseValue, CacheableIdentifier identifier, JSValue value, PutPrivateFieldCallback callback) { auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(identifier.isPrivateName()); JSObject* baseObject = baseValue.toObject(globalObject); RETURN_IF_EXCEPTION(scope, void()); CodeBlock* codeBlock = callFrame->codeBlock(); Structure* oldStructure = baseObject->structure(); PutPropertySlot putSlot(baseObject, true, codeBlock->putByIdContext()); baseObject->setPrivateField(globalObject, identifier, value, putSlot); RETURN_IF_EXCEPTION(scope, void()); callback(vm, codeBlock, oldStructure, putSlot); } template ALWAYS_INLINE static void definePrivateField(VM& vm, JSGlobalObject* globalObject, CallFrame* callFrame, JSValue baseValue, CacheableIdentifier identifier, JSValue value, PutPrivateFieldCallback callback) { auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(identifier.isPrivateName()); JSObject* baseObject = baseValue.toObject(globalObject); RETURN_IF_EXCEPTION(scope, void()); CodeBlock* codeBlock = callFrame->codeBlock(); Structure* oldStructure = baseObject->structure(); PutPropertySlot putSlot(baseObject, true, codeBlock->putByIdContext()); baseObject->definePrivateField(globalObject, identifier, value, putSlot); RETURN_IF_EXCEPTION(scope, void()); callback(vm, codeBlock, oldStructure, putSlot); } JSC_DEFINE_JIT_OPERATION(operationPutByIdDefinePrivateFieldStrictGaveUp, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; CacheableIdentifier identifier = propertyCache->identifier(); JSValue value = JSValue::decode(encodedValue); JSValue baseValue = JSValue::decode(encodedBase); definePrivateField(vm, globalObject, callFrame, baseValue, identifier, value, [](VM&, CodeBlock*, Structure*, PutPropertySlot&) { }); LOG_IC((ICEvent::OperationPutByIdDefinePrivateFieldStrictGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdDefinePrivateFieldStrictOptimize, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); AccessType accessType = static_cast(propertyCache->accessType); JSValue value = JSValue::decode(encodedValue); JSValue baseValue = JSValue::decode(encodedBase); definePrivateField(vm, globalObject, callFrame, baseValue, identifier, value, [&](VM& vm, CodeBlock* codeBlock, Structure* oldStructure, PutPropertySlot& putSlot) { JSObject* baseObject = asObject(baseValue); LOG_IC((ICEvent::OperationPutByIdDefinePrivateFieldStrictOptimize, baseObject->classInfo(), putSlot.base() == baseObject)); ASSERT_UNUSED(accessType, accessType == static_cast(propertyCache->accessType)); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, oldStructure, identifier)) repatchPutBy(globalObject, codeBlock, baseObject, oldStructure, identifier, putSlot, *propertyCache, PutByKind::DefinePrivateNameById, /* isNonStringPrimitiveKey */ false); }); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdSetPrivateFieldStrictGaveUp, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; CacheableIdentifier identifier = propertyCache->identifier(); JSValue value = JSValue::decode(encodedValue); JSValue baseValue = JSValue::decode(encodedBase); setPrivateField(vm, globalObject, callFrame, baseValue, identifier, value, [](VM&, CodeBlock*, Structure*, PutPropertySlot&) { }); LOG_IC((ICEvent::OperationPutByIdSetPrivateFieldStrictGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByIdSetPrivateFieldStrictOptimize, void, (EncodedJSValue encodedValue, EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); AccessType accessType = static_cast(propertyCache->accessType); JSValue value = JSValue::decode(encodedValue); JSValue baseValue = JSValue::decode(encodedBase); setPrivateField(vm, globalObject, callFrame, baseValue, identifier, value, [&](VM& vm, CodeBlock* codeBlock, Structure* oldStructure, PutPropertySlot& putSlot) { JSObject* baseObject = asObject(baseValue); LOG_IC((ICEvent::OperationPutByIdSetPrivateFieldStrictOptimize, baseObject->classInfo(), putSlot.base() == baseObject)); ASSERT_UNUSED(accessType, accessType == static_cast(propertyCache->accessType)); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, oldStructure, identifier)) repatchPutBy(globalObject, codeBlock, baseObject, oldStructure, identifier, putSlot, *propertyCache, PutByKind::SetPrivateNameById, /* isNonStringPrimitiveKey */ false); }); OPERATION_RETURN(scope); } static ALWAYS_INLINE void putByVal(JSGlobalObject* globalObject, JSValue baseValue, JSValue subscript, JSValue value, ArrayProfile* arrayProfile, ECMAMode ecmaMode) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); if (std::optional index = subscript.tryGetAsUint32Index()) { uint32_t i = *index; if (baseValue.isObject()) { JSObject* object = asObject(baseValue); if (object->trySetIndexQuickly(vm, i, value, arrayProfile)) return; if (arrayProfile) arrayProfile->setOutOfBounds(); scope.release(); object->methodTable()->putByIndex(object, globalObject, i, value, ecmaMode.isStrict()); return; } scope.release(); baseValue.putByIndex(globalObject, i, value, ecmaMode.isStrict()); return; } if (arrayProfile) { if (subscript.isNumber()) { if (baseValue.isObject()) arrayProfile->setOutOfBounds(); } } GCOwnedDataScope propertyName; Identifier propertyKey; UniquedStringImpl* uid = nullptr; if (subscript.isString()) { propertyName = asString(subscript)->toAtomString(globalObject); uid = propertyName.data; } else { propertyKey = subscript.toPropertyKey(globalObject); uid = propertyKey.impl(); } RETURN_IF_EXCEPTION(scope, void()); scope.release(); PutPropertySlot slot(baseValue, ecmaMode.isStrict()); baseValue.putInline(globalObject, uid, value, slot); } static void directPutByVal(JSGlobalObject* globalObject, JSObject* baseObject, JSValue subscript, JSValue value, ArrayProfile* arrayProfile, ECMAMode ecmaMode) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); if (std::optional maybeIndex = subscript.tryGetAsUint32Index()) { uint32_t index = *maybeIndex; switch (baseObject->indexingType()) { case ALL_INT32_INDEXING_TYPES: case ALL_DOUBLE_INDEXING_TYPES: case ALL_CONTIGUOUS_INDEXING_TYPES: if (arrayProfile) { if (index < baseObject->butterfly()->vectorLength()) { if (index >= baseObject->butterfly()->publicLength()) arrayProfile->setMayStoreHole(); break; } arrayProfile->setOutOfBounds(); } break; case ALL_ARRAY_STORAGE_INDEXING_TYPES: if (arrayProfile) { ArrayStorage* storage = baseObject->butterfly()->arrayStorage(); if (index < storage->vectorLength()) { if (!storage->m_vector[index]) arrayProfile->setMayStoreHole(); break; } arrayProfile->setOutOfBounds(); } break; default: if (arrayProfile) arrayProfile->setOutOfBounds(); break; } scope.release(); baseObject->putDirectIndex(globalObject, index, value, 0, ecmaMode.isStrict() ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow); return; } // Don't put to an object if toString threw an exception. auto property = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, void()); if (std::optional index = parseIndex(property)) { scope.release(); baseObject->putDirectIndex(globalObject, index.value(), value, 0, ecmaMode.isStrict() ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow); return; } scope.release(); PutPropertySlot slot(baseObject, ecmaMode.isStrict()); CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, property, value, slot); } enum class OptimizationResult { NotOptimized, SeenOnce, Optimized, GiveUp, }; static ALWAYS_INLINE void putByValOptimize(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, JSValue subscript, JSValue value, PropertyInlineCache* propertyCache, ArrayProfile* profile, PutByKind kind) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); bool isStrict = kind == PutByKind::ByValStrict; if (baseValue.isObject()) { JSObject* baseObject = asObject(baseValue); if (!isCopyOnWrite(baseObject->indexingMode()) && subscript.isInt32()) { Structure* structure = baseObject->structure(); if (propertyCache->considerRepatchingCacheGeneric(vm, codeBlock, structure)) { if (profile) profile->computeUpdatedPrediction(codeBlock, structure); repatchArrayPutByVal(globalObject, codeBlock, baseValue, subscript, *propertyCache, kind); } } { CacheableIdentifier identifier; bool isNonStringPrimitiveKey = false; if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) { RETURN_IF_EXCEPTION(scope, void()); if (subscript.isSymbol() || !parseIndex(*propertyName.data)) identifier = CacheableIdentifier::createFromCell(subscript.asCell()); } else { identifier = nonStringPrimitiveKeyForSubscript(vm, subscript); isNonStringPrimitiveKey = !!identifier; } if (identifier) { AccessType accessType = static_cast(propertyCache->accessType); PutPropertySlot slot(baseValue, isStrict, codeBlock->putByIdContext()); Structure* structure = CommonSlowPaths::originalStructureBeforePut(baseValue); baseObject->putInline(globalObject, identifier, value, slot); RETURN_IF_EXCEPTION(scope, void()); if (accessType != static_cast(propertyCache->accessType)) return; if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, structure, identifier)) repatchPutBy(globalObject, codeBlock, baseValue, structure, identifier, slot, *propertyCache, kind, isNonStringPrimitiveKey); return; } } } RELEASE_AND_RETURN(scope, putByVal(globalObject, baseValue, subscript, value, profile, isStrict ? ECMAMode::strict() : ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationPutByValStrictOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByValOptimize(globalObject, callFrame->codeBlock(), baseValue, subscript, value, propertyCache, profile, PutByKind::ByValStrict); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSloppyOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByValOptimize(globalObject, callFrame->codeBlock(), baseValue, subscript, value, propertyCache, profile, PutByKind::ByValSloppy); OPERATION_RETURN(scope); } static ALWAYS_INLINE void directPutByValOptimize(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, JSValue subscript, JSValue value, PropertyInlineCache* propertyCache, ArrayProfile* profile, PutByKind kind) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); bool isStrict = kind == PutByKind::ByValDirectStrict; RELEASE_ASSERT(baseValue.isObject()); JSObject* baseObject = asObject(baseValue); if (!isCopyOnWrite(baseObject->indexingMode()) && subscript.isInt32()) { Structure* structure = baseObject->structure(); if (propertyCache->considerRepatchingCacheGeneric(vm, codeBlock, structure)) { if (profile) profile->computeUpdatedPrediction(codeBlock, structure); repatchArrayPutByVal(globalObject, codeBlock, baseValue, subscript, *propertyCache, kind); } } { CacheableIdentifier identifier; bool isNonStringPrimitiveKey = false; if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) { RETURN_IF_EXCEPTION(scope, void()); if (subscript.isSymbol() || !parseIndex(*propertyName.data)) identifier = CacheableIdentifier::createFromCell(subscript.asCell()); } else { identifier = nonStringPrimitiveKeyForSubscript(vm, subscript); isNonStringPrimitiveKey = !!identifier; } if (identifier) { AccessType accessType = static_cast(propertyCache->accessType); PutPropertySlot slot(baseValue, isStrict, codeBlock->putByIdContext()); Structure* structure = CommonSlowPaths::originalStructureBeforePut(baseValue); CommonSlowPaths::putDirectWithReify(vm, globalObject, baseObject, identifier, value, slot); RETURN_IF_EXCEPTION(scope, void()); if (accessType != static_cast(propertyCache->accessType)) return; if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, structure, identifier)) repatchPutBy(globalObject, codeBlock, baseValue, structure, identifier, slot, *propertyCache, kind, isNonStringPrimitiveKey); return; } } RELEASE_AND_RETURN(scope, directPutByVal(globalObject, baseObject, subscript, value, profile, isStrict ? ECMAMode::strict() : ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationDirectPutByValStrictOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); directPutByValOptimize(globalObject, callFrame->codeBlock(), baseValue, subscript, value, propertyCache, profile, PutByKind::ByValDirectStrict); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationDirectPutByValSloppyOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); directPutByValOptimize(globalObject, callFrame->codeBlock(), baseValue, subscript, value, propertyCache, profile, PutByKind::ByValDirectSloppy); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValStrictGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByVal(globalObject, baseValue, subscript, value, profile, ECMAMode::strict()); LOG_IC((ICEvent::OperationPutByValStrictGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValStrictGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByVal(globalObject, baseValue, subscript, value, nullptr, ECMAMode::strict()); LOG_IC((ICEvent::OperationPutByValStrictGeneric, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSloppyGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByVal(globalObject, baseValue, subscript, value, profile, ECMAMode::sloppy()); LOG_IC((ICEvent::OperationPutByValSloppyGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSloppyGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByVal(globalObject, baseValue, subscript, value, nullptr, ECMAMode::sloppy()); LOG_IC((ICEvent::OperationPutByValSloppyGeneric, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationDirectPutByValStrictGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); RELEASE_ASSERT(baseValue.isObject()); directPutByVal(globalObject, asObject(baseValue), subscript, value, profile, ECMAMode::strict()); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationDirectPutByValStrictGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); RELEASE_ASSERT(baseValue.isObject()); directPutByVal(globalObject, asObject(baseValue), subscript, value, nullptr, ECMAMode::strict()); OPERATION_RETURN(scope); } ALWAYS_INLINE static void putByValMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, ArrayProfile* profile, JSValue baseValue, JSValue subscript, JSValue value, PutByKind kind) { auto scope = DECLARE_THROW_SCOPE(vm); bool isStrict = kind == PutByKind::ByValStrict; if (!baseValue.isObject() || !CacheableIdentifier::isCacheableIdentifierCell(subscript)) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); scope.release(); putByVal(globalObject, baseValue, subscript, value, profile, isStrict ? ECMAMode::strict() : ECMAMode::sloppy()); return; } Identifier propertyName = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, void()); JSObject* baseObject = asObject(baseValue); Structure* structure = baseObject->structure(); PutPropertySlot slot(baseValue, isStrict); UniquedStringImpl* uid = propertyName.impl(); if (!canUseMegamorphicPutById(vm, uid) || structure->typeInfo().overridesPut()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); scope.release(); baseValue.put(globalObject, uid, value, slot); return; } { JSObject* object = baseObject; while (true) { if (structure->hasReadOnlyOrGetterSetterPropertiesExcludingProto() || structure->typeInfo().overridesGetPrototype() || structure->typeInfo().overridesPut() || structure->hasPolyProto()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); scope.release(); baseObject->putInlineSlow(globalObject, uid, value, slot); return; } JSValue prototype = object->getPrototypeDirect(); if (prototype.isNull()) break; object = asObject(prototype); structure = object->structure(); } } Structure* oldStructure = baseObject->structure(); baseObject->putInlineFast(globalObject, uid, value, slot); RETURN_IF_EXCEPTION(scope, void()); if (!slot.isCacheablePut() || !oldStructure->propertyAccessesAreCacheable()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); return; } Structure* newStructure = baseObject->structure(); if (slot.type() == PutPropertySlot::ExistingProperty) { if (oldStructure == newStructure && slot.cachedOffset() didCachePropertyReplacement(vm, slot.cachedOffset()); // Ensure invalidating watchpoint set. vm.megamorphicCache()->initAsReplace(StructureID::encode(oldStructure), uid, slot.cachedOffset()); } return; } ASSERT(slot.type() == PutPropertySlot::NewProperty); // This is not worth registering. Dictionary Structure is one-on-one to this object. And NewProperty happens only once. // So this cache will be never used again. if (oldStructure->isDictionary() || newStructure->isDictionary()) return; if (oldStructure->mayBePrototype() || (newStructure->previousID() != oldStructure) || !newStructure->propertyAccessesAreCacheable()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchPutBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); return; } bool reallocating = newStructure->outOfLineCapacity() != oldStructure->outOfLineCapacity(); if (slot.cachedOffset() initAsTransition(StructureID::encode(oldStructure), StructureID::encode(newStructure), uid, slot.cachedOffset(), reallocating); } JSC_DEFINE_JIT_OPERATION(operationPutByValStrictMegamorphic, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByValMegamorphic(globalObject, vm, callFrame, propertyCache, profile, baseValue, subscript, value, PutByKind::ByValStrict); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValStrictMegamorphicGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByValMegamorphic(globalObject, vm, callFrame, nullptr, nullptr, baseValue, subscript, value, PutByKind::ByValStrict); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSloppyMegamorphic, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByValMegamorphic(globalObject, vm, callFrame, propertyCache, profile, baseValue, subscript, value, PutByKind::ByValSloppy); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSloppyMegamorphicGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putByValMegamorphic(globalObject, vm, callFrame, nullptr, nullptr, baseValue, subscript, value, PutByKind::ByValSloppy); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationDirectPutByValSloppyGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); RELEASE_ASSERT(baseValue.isObject()); directPutByVal(globalObject, asObject(baseValue), subscript, value, profile, ECMAMode::sloppy()); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationDirectPutByValSloppyGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); RELEASE_ASSERT(baseValue.isObject()); directPutByVal(globalObject, asObject(baseValue), subscript, value, nullptr, ECMAMode::sloppy()); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationSetPrivateBrandOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedBrand, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue brand = JSValue::decode(encodedBrand); ASSERT(baseValue.isObject()); ASSERT(brand.isSymbol()); JSObject* baseObject = asObject(baseValue); Structure* oldStructure = baseObject->structure(); baseObject->setPrivateBrand(globalObject, brand); OPERATION_RETURN_IF_EXCEPTION(scope); CodeBlock* codeBlock = callFrame->codeBlock(); if (CacheableIdentifier::isCacheableIdentifierCell(brand)) { CacheableIdentifier identifier = CacheableIdentifier::createFromCell(brand.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier)) repatchSetPrivateBrand(globalObject, codeBlock, baseObject, oldStructure, identifier, *propertyCache); } OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationSetPrivateBrandGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedBrand, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue brand = JSValue::decode(encodedBrand); ASSERT(baseValue.isObject()); ASSERT(brand.isSymbol()); JSObject* baseObject = asObject(baseValue); baseObject->setPrivateBrand(globalObject, brand); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationCheckPrivateBrandOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedBrand, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue brand = JSValue::decode(encodedBrand); JSObject* baseObject = baseValue.toObject(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope); ASSERT(brand.isSymbol()); baseObject->checkPrivateBrand(globalObject, brand); OPERATION_RETURN_IF_EXCEPTION(scope); CodeBlock* codeBlock = callFrame->codeBlock(); if (CacheableIdentifier::isCacheableIdentifierCell(brand)) { CacheableIdentifier identifier = CacheableIdentifier::createFromCell(brand.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseObject->structure(), identifier)) repatchCheckPrivateBrand(globalObject, codeBlock, baseObject, identifier, *propertyCache); } OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationCheckPrivateBrandGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedBrand, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue brand = JSValue::decode(encodedBrand); JSObject* baseObject = baseValue.toObject(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope); ASSERT(brand.isSymbol()); baseObject->checkPrivateBrand(globalObject, brand); OPERATION_RETURN(scope); } template static ALWAYS_INLINE void putPrivateNameOptimize(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, JSValue subscript, JSValue value, PropertyInlineCache* propertyCache) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); auto baseObject = baseValue.toObject(globalObject); RETURN_IF_EXCEPTION(scope, void()); auto propertyName = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, void()); // Private fields can only be accessed within class lexical scope // and class methods are always in strict mode AccessType accessType = static_cast(propertyCache->accessType); Structure* structure = CommonSlowPaths::originalStructureBeforePut(baseValue); constexpr bool isStrictMode = true; PutPropertySlot slot(baseObject, isStrictMode); if constexpr (define) baseObject->definePrivateField(globalObject, propertyName, value, slot); else baseObject->setPrivateField(globalObject, propertyName, value, slot); RETURN_IF_EXCEPTION(scope, void()); if (accessType != static_cast(propertyCache->accessType)) return; if (baseValue.isObject() && CacheableIdentifier::isCacheableIdentifierCell(subscript)) { CacheableIdentifier identifier = CacheableIdentifier::createFromCell(subscript.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, structure, identifier)) repatchPutBy(globalObject, codeBlock, baseValue, structure, identifier, slot, *propertyCache, define ? PutByKind::DefinePrivateNameByVal : PutByKind::SetPrivateNameByVal, /* isNonStringPrimitiveKey */ false); } } template static ALWAYS_INLINE void putPrivateName(JSGlobalObject* globalObject, JSValue baseValue, JSValue subscript, JSValue value) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); auto baseObject = baseValue.toObject(globalObject); RETURN_IF_EXCEPTION(scope, void()); auto propertyName = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, void()); scope.release(); // Private fields can only be accessed within class lexical scope // and class methods are always in strict mode constexpr bool isStrictMode = true; PutPropertySlot slot(baseObject, isStrictMode); if constexpr (define) baseObject->definePrivateField(globalObject, propertyName, value, slot); else baseObject->setPrivateField(globalObject, propertyName, value, slot); } JSC_DEFINE_JIT_OPERATION(operationPutByValDefinePrivateFieldOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile*)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CodeBlock* codeBlock = callFrame->codeBlock(); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putPrivateNameOptimize(globalObject, codeBlock, baseValue, subscript, value, propertyCache); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSetPrivateFieldOptimize, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile*)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CodeBlock* codeBlock = callFrame->codeBlock(); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putPrivateNameOptimize(globalObject, codeBlock, baseValue, subscript, value, propertyCache); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValDefinePrivateFieldGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile*)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putPrivateName(globalObject, baseValue, subscript, value); LOG_IC((ICEvent::OperationPutByValDefinePrivateFieldGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValDefinePrivateFieldGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putPrivateName(globalObject, baseValue, subscript, value); LOG_IC((ICEvent::OperationPutByValDefinePrivateFieldGeneric, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSetPrivateFieldGaveUp, void, (EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, PropertyInlineCache* propertyCache, ArrayProfile*)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putPrivateName(globalObject, baseValue, subscript, value); LOG_IC((ICEvent::OperationPutByValSetPrivateFieldGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutByValSetPrivateFieldGeneric, void, (JSGlobalObject* globalObject, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBaseValue); JSValue subscript = JSValue::decode(encodedSubscript); JSValue value = JSValue::decode(encodedValue); putPrivateName(globalObject, baseValue, subscript, value); LOG_IC((ICEvent::OperationPutByValSetPrivateFieldGeneric, baseValue.classInfoOrNull())); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationCallDirectEvalSloppy, EncodedJSValue, (void* frame, JSScope* callerScopeChain, EncodedJSValue encodedThisValue, CodeBlock* callerBaselineCodeBlock, uint32_t bytecodeIndexBits)) { CallFrame* calleeFrame = reinterpret_cast(frame); CallFrame* callFrame = calleeFrame->callerFrame(); // We can't trust our callee since it could be garbage but our caller's should be ok. VM& vm = callFrame->deprecatedVM(); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); calleeFrame->setCodeBlock(nullptr); OPERATION_RETURN(scope, JSValue::encode(eval(calleeFrame, JSValue::decode(encodedThisValue), callerScopeChain, callerBaselineCodeBlock, BytecodeIndex::fromBits(bytecodeIndexBits), NoLexicallyScopedFeatures))); } JSC_DEFINE_JIT_OPERATION(operationCallDirectEvalStrict, EncodedJSValue, (void* frame, JSScope* callerScopeChain, EncodedJSValue encodedThisValue, CodeBlock* callerBaselineCodeBlock, uint32_t bytecodeIndexBits)) { CallFrame* calleeFrame = reinterpret_cast(frame); CallFrame* callFrame = calleeFrame->callerFrame(); // We can't trust our callee since it could be garbage but our caller's should be ok. VM& vm = callFrame->deprecatedVM(); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); calleeFrame->setCodeBlock(nullptr); OPERATION_RETURN(scope, JSValue::encode(eval(calleeFrame, JSValue::decode(encodedThisValue), callerScopeChain, callerBaselineCodeBlock, BytecodeIndex::fromBits(bytecodeIndexBits), StrictModeLexicallyScopedFeature))); } JSC_DEFINE_JIT_OPERATION(operationCallDirectEvalSloppyTaintedByWithScope, EncodedJSValue, (void* frame, JSScope* callerScopeChain, EncodedJSValue encodedThisValue, CodeBlock* callerBaselineCodeBlock, uint32_t bytecodeIndexBits)) { CallFrame* calleeFrame = reinterpret_cast(frame); CallFrame* callFrame = calleeFrame->callerFrame(); // We can't trust our callee since it could be garbage but our caller's should be ok. VM& vm = callFrame->deprecatedVM(); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); calleeFrame->setCodeBlock(nullptr); OPERATION_RETURN(scope, JSValue::encode(eval(calleeFrame, JSValue::decode(encodedThisValue), callerScopeChain, callerBaselineCodeBlock, BytecodeIndex::fromBits(bytecodeIndexBits), TaintedByWithScopeLexicallyScopedFeature))); } JSC_DEFINE_JIT_OPERATION(operationCallDirectEvalStrictTaintedByWithScope, EncodedJSValue, (void* frame, JSScope* callerScopeChain, EncodedJSValue encodedThisValue, CodeBlock* callerBaselineCodeBlock, uint32_t bytecodeIndexBits)) { CallFrame* calleeFrame = reinterpret_cast(frame); CallFrame* callFrame = calleeFrame->callerFrame(); // We can't trust our callee since it could be garbage but our caller's should be ok. VM& vm = callFrame->deprecatedVM(); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); calleeFrame->setCodeBlock(nullptr); OPERATION_RETURN(scope, JSValue::encode(eval(calleeFrame, JSValue::decode(encodedThisValue), callerScopeChain, callerBaselineCodeBlock, BytecodeIndex::fromBits(bytecodeIndexBits), StrictModeLexicallyScopedFeature | TaintedByWithScopeLexicallyScopedFeature))); } JSC_DEFINE_JIT_OPERATION(operationPolymorphicCall, UCPURegister, (CallFrame* calleeFrame, CallLinkInfo* callLinkInfo)) { JSCell* owner = callLinkInfo->ownerForSlowPath(calleeFrame); VM& vm = owner->vm(); NativeCallFrameTracer tracer(vm, calleeFrame); sanitizeStackForVM(vm); auto scope = DECLARE_THROW_SCOPE(vm); calleeFrame->setCodeBlock(nullptr); JSCell* calleeAsFunctionCell; void* callTarget = virtualForWithFunction(vm, owner, calleeFrame, callLinkInfo, calleeAsFunctionCell); if (scope.exception()) [[unlikely]] OPERATION_RETURN(scope, std::bit_cast(vm.getCTIStub(CommonJITThunkID::ThrowExceptionFromCall).template retagged().code().taggedPtr())); // A null cell means virtualForWithFunction did a host call that ran JS and may have freed *callLinkInfo; don't link. if (calleeAsFunctionCell) [[likely]] linkPolymorphicCall(vm, owner, calleeFrame, *callLinkInfo, CallVariant(calleeAsFunctionCell)); // Keep owner alive explicitly. Now this function can be called from tail-call. This means that CallFrame for that owner already goes away, so we should keep it alive if we would like to use it. ensureStillAliveHere(owner); if (scope.exception()) [[unlikely]] OPERATION_RETURN(scope, std::bit_cast(vm.getCTIStub(CommonJITThunkID::ThrowExceptionFromCall).template retagged().code().taggedPtr())); OPERATION_RETURN(scope, static_cast(std::bit_cast(callTarget))); } JSC_DEFINE_JIT_OPERATION(operationVirtualCall, UCPURegister, (CallFrame* calleeFrame, CallLinkInfo* callLinkInfo)) { JSCell* owner = callLinkInfo->ownerForSlowPath(calleeFrame); VM& vm = owner->vm(); NativeCallFrameTracer tracer(vm, calleeFrame); sanitizeStackForVM(vm); auto scope = DECLARE_THROW_SCOPE(vm); calleeFrame->setCodeBlock(nullptr); JSCell* calleeAsFunctionCell; void* callTarget = virtualForWithFunction(vm, owner, calleeFrame, callLinkInfo, calleeAsFunctionCell); // Keep owner alive explicitly. Now this function can be called from tail-call. This means that CallFrame for that owner already goes away, so we should keep it alive if we would like to use it. ensureStillAliveHere(owner); if (scope.exception()) [[unlikely]] OPERATION_RETURN(scope, std::bit_cast(vm.getCTIStub(CommonJITThunkID::ThrowExceptionFromCall).template retagged().code().taggedPtr())); OPERATION_RETURN(scope, std::bit_cast(std::bit_cast(callTarget))); } JSC_DEFINE_JIT_OPERATION(operationDefaultCall, UCPURegister, (CallFrame* calleeFrame, CallLinkInfo* callLinkInfo)) { JSCell* owner = callLinkInfo->ownerForSlowPath(calleeFrame); VM& vm = owner->vm(); NativeCallFrameTracer tracer(vm, calleeFrame); sanitizeStackForVM(vm); auto scope = DECLARE_THROW_SCOPE(vm); calleeFrame->setCodeBlock(nullptr); void* callTarget = linkFor(vm, owner, calleeFrame, callLinkInfo); // Keep owner alive explicitly. Now this function can be called from tail-call. This means that CallFrame for that owner already goes away, so we should keep it alive if we would like to use it. ensureStillAliveHere(owner); if (scope.exception()) [[unlikely]] OPERATION_RETURN(scope, std::bit_cast(vm.getCTIStub(CommonJITThunkID::ThrowExceptionFromCall).template retagged().code().taggedPtr())); OPERATION_RETURN(scope, std::bit_cast(std::bit_cast(callTarget))); } JSC_DEFINE_JIT_OPERATION(operationCompareLess, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, jsLess(globalObject, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2))); } JSC_DEFINE_JIT_OPERATION(operationCompareLessEq, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, jsLessEq(globalObject, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2))); } JSC_DEFINE_JIT_OPERATION(operationCompareGreater, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, jsLess(globalObject, JSValue::decode(encodedOp2), JSValue::decode(encodedOp1))); } JSC_DEFINE_JIT_OPERATION(operationCompareGreaterEq, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, jsLessEq(globalObject, JSValue::decode(encodedOp2), JSValue::decode(encodedOp1))); } JSC_DEFINE_JIT_OPERATION(operationCompareEq, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::equalSlowCaseInline(globalObject, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2))); } JSC_DEFINE_JIT_OPERATION(operationCompareStringEq, EncodedJSValue, (JSGlobalObject* globalObject, JSCell* left, JSCell* right)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); bool result = asString(left)->equalInline(globalObject, asString(right)); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(result))); } JSC_DEFINE_JIT_OPERATION(operationCompareStrictEq, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue src1 = JSValue::decode(encodedOp1); JSValue src2 = JSValue::decode(encodedOp2); OPERATION_RETURN(scope, JSValue::strictEqual(globalObject, src1, src2)); } #if USE(BIGINT32) JSC_DEFINE_JIT_OPERATION(operationCompareEqHeapBigIntToInt32, size_t, (JSGlobalObject* globalObject, JSCell* heapBigInt, int32_t smallInt)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(heapBigInt->isHeapBigInt()); OPERATION_RETURN(scope, static_cast(heapBigInt)->equalsToInt32(smallInt)); } #endif JSC_DEFINE_JIT_OPERATION(operationNewArrayWithProfile, EncodedJSValue, (JSGlobalObject* globalObject, ArrayAllocationProfile* profile, const JSValue* values, int size)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(constructArrayNegativeIndexed(globalObject, profile, values, size))); } JSC_DEFINE_JIT_OPERATION(operationNewArrayWithSizeAndProfile, EncodedJSValue, (JSGlobalObject* globalObject, ArrayAllocationProfile* profile, EncodedJSValue size)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue sizeValue = JSValue::decode(size); OPERATION_RETURN(scope, JSValue::encode(constructArrayWithSizeQuirk(globalObject, profile, sizeValue))); } JSC_DEFINE_JIT_OPERATION(operationCreateLexicalEnvironmentTDZ, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, SymbolTable* table)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(JSLexicalEnvironment::create(vm, globalObject->activationStructure(), environment, table, jsTDZValue()))); } JSC_DEFINE_JIT_OPERATION(operationCreateLexicalEnvironmentUndefined, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, SymbolTable* table)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(JSLexicalEnvironment::create(vm, globalObject->activationStructure(), environment, table, jsUndefined()))); } JSC_DEFINE_JIT_OPERATION(operationCreateDirectArgumentsBaseline, EncodedJSValue, (JSGlobalObject* globalObject)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(DirectArguments::createByCopying(globalObject, callFrame))); } JSC_DEFINE_JIT_OPERATION(operationCreateScopedArgumentsBaseline, EncodedJSValue, (JSGlobalObject* globalObject, JSLexicalEnvironment* environment)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ScopedArgumentsTable* table = environment->symbolTable()->arguments(); OPERATION_RETURN(scope, JSValue::encode(ScopedArguments::createByCopying(globalObject, callFrame, table, environment))); } JSC_DEFINE_JIT_OPERATION(operationCreateClonedArgumentsBaseline, EncodedJSValue, (JSGlobalObject* globalObject)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(ClonedArguments::createWithMachineFrame(globalObject, callFrame, ArgumentsMode::Cloned))); } template static EncodedJSValue newFunctionCommon(VM& vm, JSGlobalObject* globalObject, JSScope* scope, JSCell* functionExecutable, Structure* structure) { ASSERT(functionExecutable->inherits()); if constexpr (isInvalidated) return JSValue::encode(FunctionType::createWithInvalidatedReallocationWatchpoint(vm, globalObject, static_cast(functionExecutable), scope, structure)); else return JSValue::encode(FunctionType::create(vm, globalObject, static_cast(functionExecutable), scope, structure)); } JSC_DEFINE_JIT_OPERATION(operationNewFunction, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = false; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, JSFunction::selectStructureForNewFuncExp(globalObject, uncheckedDowncast(functionExecutable)))); } JSC_DEFINE_JIT_OPERATION(operationNewFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = true; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, JSFunction::selectStructureForNewFuncExp(globalObject, uncheckedDowncast(functionExecutable)))); } JSC_DEFINE_JIT_OPERATION(operationNewSloppyFunction, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = false; constexpr bool isBuiltin = false; if (uncheckedDowncast(functionExecutable)->hasPrototypeProperty()) OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->sloppyFunctionStructure(isBuiltin))); OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->sloppyMethodStructure(isBuiltin))); } JSC_DEFINE_JIT_OPERATION(operationNewSloppyFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = true; constexpr bool isBuiltin = false; if (uncheckedDowncast(functionExecutable)->hasPrototypeProperty()) OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->sloppyFunctionStructure(isBuiltin))); OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->sloppyMethodStructure(isBuiltin))); } JSC_DEFINE_JIT_OPERATION(operationNewStrictFunction, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = false; constexpr bool isBuiltin = false; if (uncheckedDowncast(functionExecutable)->hasPrototypeProperty()) OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->strictFunctionStructure(isBuiltin))); OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->strictMethodStructure(isBuiltin))); } JSC_DEFINE_JIT_OPERATION(operationNewStrictFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = true; constexpr bool isBuiltin = false; if (uncheckedDowncast(functionExecutable)->hasPrototypeProperty()) OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->strictFunctionStructure(isBuiltin))); OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->strictMethodStructure(isBuiltin))); } JSC_DEFINE_JIT_OPERATION(operationNewArrowFunction, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = false; constexpr bool isBuiltin = false; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->arrowFunctionStructure(isBuiltin))); } JSC_DEFINE_JIT_OPERATION(operationNewArrowFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = true; constexpr bool isBuiltin = false; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->arrowFunctionStructure(isBuiltin))); } JSC_DEFINE_JIT_OPERATION(operationNewGeneratorFunction, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = false; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->generatorFunctionStructure())); } JSC_DEFINE_JIT_OPERATION(operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = true; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->generatorFunctionStructure())); } JSC_DEFINE_JIT_OPERATION(operationNewAsyncFunction, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = false; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->asyncFunctionStructure())); } JSC_DEFINE_JIT_OPERATION(operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = true; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->asyncFunctionStructure())); } JSC_DEFINE_JIT_OPERATION(operationNewAsyncGeneratorFunction, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = false; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->asyncGeneratorFunctionStructure())); } JSC_DEFINE_JIT_OPERATION(operationNewAsyncGeneratorFunctionWithInvalidatedReallocationWatchpoint, EncodedJSValue, (JSGlobalObject* globalObject, JSScope* environment, JSCell* functionExecutable)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); constexpr bool isInvalidated = true; OPERATION_RETURN(scope, newFunctionCommon(vm, globalObject, environment, functionExecutable, globalObject->asyncGeneratorFunctionStructure())); } JSC_DEFINE_JIT_OPERATION(operationSetFunctionName, void, (JSGlobalObject* globalObject, JSCell* funcCell, EncodedJSValue encodedName)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSFunction* func = uncheckedDowncast(funcCell); JSValue name = JSValue::decode(encodedName); func->setFunctionName(globalObject, name); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationAsyncIteratorNextWithDriver, EncodedJSValue, (JSGlobalObject* globalObject, JSObject* iterator, JSObject* driver, EncodedJSValue resumeValue, MicrotaskCallCache* microtaskCallCache)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(asyncIteratorNextWithDriver(globalObject, iterator, driver, JSValue::decode(resumeValue), microtaskCallCache))); } JSC_DEFINE_JIT_OPERATION(operationNewObject, JSCell*, (VM* vmPointer, Structure* structure)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, constructEmptyObject(vm, structure)); } JSC_DEFINE_JIT_OPERATION(operationNewPromise, JSCell*, (VM* vmPointer, Structure* structure)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSPromise::create(vm, structure)); } JSC_DEFINE_JIT_OPERATION(operationNewGenerator, JSCell*, (VM* vmPointer, Structure* structure)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSGenerator::create(vm, structure)); } JSC_DEFINE_JIT_OPERATION(operationNewAsyncFunctionGenerator, JSCell*, (VM* vmPointer, Structure* structure)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSAsyncFunctionGenerator::create(vm, structure)); } JSC_DEFINE_JIT_OPERATION(operationNewAsyncGenerator, JSCell*, (VM* vmPointer, Structure* structure)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSAsyncGenerator::create(vm, structure)); } JSC_DEFINE_JIT_OPERATION(operationNewRegExp, JSCell*, (JSGlobalObject* globalObject, JSCell* regexpPtr)) { SuperSamplerScope superSamplerScope(false); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); RegExp* regexp = static_cast(regexpPtr); static constexpr bool areLegacyFeaturesEnabled = true; OPERATION_RETURN(scope, RegExpObject::create(vm, globalObject->regExpStructure(), regexp, areLegacyFeaturesEnabled)); } // The only reason for returning an UnusedPtr (instead of void) is so that we can reuse the // existing DFG slow path generator machinery when creating the slow path for CheckTraps // in the DFG. If a DFG slow path generator that supports a void return type is added in the // future, we can switch to using that then. JSC_DEFINE_JIT_OPERATION(operationHandleTraps, UnusedPtr, (JSGlobalObject* globalObject)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(vm.traps().needHandling(VMTraps::AsyncEvents)); vm.traps().handleTraps(VMTraps::AsyncEvents); OPERATION_RETURN(scope, nullptr); } JSC_DEFINE_JIT_OPERATION(operationDebug, void, (VM* vmPointer, int32_t debugHookType, EncodedJSValue encodedData)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); vm.interpreter.debug(callFrame, static_cast(debugHookType), JSValue::decode(encodedData)); OPERATION_RETURN(scope); } #if ENABLE(DFG_JIT) static void updateAllPredictionsAndOptimizeAfterWarmUp(CodeBlock* codeBlock) { codeBlock->updateAllPredictions(); codeBlock->optimizeAfterWarmUp(); } JSC_DEFINE_JIT_OPERATION(operationOptimize, UGPRPair, (VM* vmPointer, uint32_t bytecodeIndexBits)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); BytecodeIndex bytecodeIndex = BytecodeIndex::fromBits(bytecodeIndexBits); // Defer GC for a while so that it doesn't run between when we enter into this // slow path and when we figure out the state of our code block. This prevents // a number of awkward reentrancy scenarios, including: // // - The optimized version of our code block being jettisoned by GC right after // we concluded that we wanted to use it, but have not planted it into the JS // stack yet. // // - An optimized version of our code block being installed just as we decided // that it wasn't ready yet. // // Note that jettisoning won't happen if we already initiated OSR, because in // that case we would have already planted the optimized code block into the JS // stack. DeferGCForAWhile deferGC(vm); CodeBlock* codeBlock = callFrame->codeBlock(); if (codeBlock->jitType() != JITType::BaselineJIT) [[unlikely]] { dataLog("Unexpected code block in Baseline->DFG tier-up: ", *codeBlock, "\n"); RELEASE_ASSERT_NOT_REACHED(); } DFG::CapabilityLevel level = codeBlock->capabilityLevel(); if (level == DFG::CannotCompile) OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); if (bytecodeIndex) { // If we're attempting to OSR from a loop, assume that this should be // separately optimized. codeBlock->m_shouldAlwaysBeInlined = false; } if (Options::verboseOSR()) [[unlikely]] { dataLog( *codeBlock, ": Entered optimize with bytecodeIndex = ", bytecodeIndex, ", executeCounter = ", codeBlock->baselineExecuteCounter(), ", optimizationDelayCounter = ", codeBlock->reoptimizationRetryCounter(), ", exitCounter = "); if (codeBlock->hasOptimizedReplacement()) dataLog(codeBlock->replacement()->osrExitCounter()); else dataLog("N/A"); dataLog("\n"); } if (!codeBlock->checkIfOptimizationThresholdReached()) { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("counter = ", codeBlock->baselineExecuteCounter())); codeBlock->updateAllPredictions(); dataLogLnIf(Options::verboseOSR(), "Choosing not to optimize ", *codeBlock, " yet, because the threshold hasn't been reached."); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } if (vm.hasTerminationRequest()) [[unlikely]] { // If termination of the current stack of execution is in progress, // then we need to hold off on optimized compiles so that termination // checks will be called, and we can unwind out of the current stack. CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("Terminating current execution")); updateAllPredictionsAndOptimizeAfterWarmUp(codeBlock); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } Debugger* debugger = codeBlock->globalObject()->debugger(); if (debugger && (debugger->isStepping() || codeBlock->baselineAlternative()->hasDebuggerRequests())) [[unlikely]] { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("debugger is stepping or has requests")); updateAllPredictionsAndOptimizeAfterWarmUp(codeBlock); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } if (codeBlock->m_shouldAlwaysBeInlined) { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should always be inlined")); updateAllPredictionsAndOptimizeAfterWarmUp(codeBlock); dataLogLnIf(Options::verboseOSR(), "Choosing not to optimize ", *codeBlock, " yet, because m_shouldAlwaysBeInlined == true."); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } // The call to JITWorklist::completeAllReadyPlansForVM() will complete all ready // (i.e. compiled) code blocks. But if it completes ours, we also need to know // what the result was so that we don't plow ahead and attempt OSR or immediate // reoptimization. This will have already also set the appropriate JIT execution // count threshold depending on what happened, so if the compilation was anything // but successful we just want to return early. See the case for worklistState == // JITWorklist::Compiled, below. // Note that we could have alternatively just called Worklist::compilationState() // here, and if it returned Compiled, we could have then called // completeAndScheduleOSR() below. But that would have meant that it could take // longer for code blocks to be completed: they would only complete when *their* // execution count trigger fired; but that could take a while since the firing is // racy. It could also mean that code blocks that never run again after being // compiled would sit on the worklist until next GC. That's fine, but it's // probably a waste of memory. Our goal here is to complete code blocks as soon as // possible in order to minimize the chances of us executing baseline code after // optimized code is already available. JITWorklist::State worklistState = JITWorklist::ensureGlobalWorklist().completeAllReadyPlansForVM( vm, JITCompilationKey(codeBlock, Options::forceUnlinkedDFG() ? JITCompilationMode::UnlinkedDFG : JITCompilationMode::DFG)); if (worklistState == JITWorklist::Compiling) { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compiling")); // We cannot be in the process of asynchronous compilation and also have an optimized // replacement. RELEASE_ASSERT(!codeBlock->hasOptimizedReplacement()); codeBlock->setOptimizationThresholdBasedOnCompilationResult(CompilationResult::CompilationDeferred); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } if (worklistState == JITWorklist::Compiled) { // If we don't have an optimized replacement but we did just get compiled, then // the compilation failed or was invalidated, in which case the execution count // thresholds have already been set appropriately by // CodeBlock::setOptimizationThresholdBasedOnCompilationResult() and we have // nothing left to do. if (!codeBlock->hasOptimizedReplacement()) { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compiled and failed")); codeBlock->updateAllPredictions(); dataLogLnIf(Options::verboseOSR(), "Code block ", *codeBlock, " was compiled but it doesn't have an optimized replacement."); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } } else if (codeBlock->hasOptimizedReplacement()) { CodeBlock* replacement = codeBlock->replacement(); dataLogLnIf(Options::verboseOSR(), "Considering OSR ", codeBlock, " -> ", replacement, "."); // If we have an optimized replacement, then it must be the case that we entered // cti_optimize from a loop. That's because if there's an optimized replacement, // then all calls to this function will be relinked to the replacement and so // the prologue OSR will never fire. // This is an interesting threshold check. Consider that a function OSR exits // in the middle of a loop, while having a relatively low exit count. The exit // will reset the execution counter to some target threshold, meaning that this // code won't be reached until that loop heats up for >=1000 executions. But then // we do a second check here, to see if we should either reoptimize, or just // attempt OSR entry. Hence it might even be correct for // shouldReoptimizeFromLoopNow() to always return true. But we make it do some // additional checking anyway, to reduce the amount of recompilation thrashing. if (replacement->shouldReoptimizeFromLoopNow()) { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize from loop now")); dataLogLnIf(Options::verboseOSR(), "Triggering reoptimization of ", codeBlock, "(", replacement, ") (in loop)."); replacement->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTrigger, CountReoptimization); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } } else { if (!codeBlock->shouldOptimizeNowFromBaseline()) { dataLogLnIf(Options::verboseOSR(), "Delaying optimization for ", *codeBlock, " because of insufficient profiling."); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } dataLogLnIf(Options::verboseOSR(), "Triggering optimized compilation of ", *codeBlock, " quickDFGTierUpState=", codeBlock->unlinkedCodeBlock()->quickDFGTierUp(), " counter=", codeBlock->baselineExecuteCounter(), ", optimizationDelayCounter=", codeBlock->optimizationDelayCounter(), " bytecodeCost=", codeBlock->bytecodeCost(), " codeType=", codeBlock->codeType()); unsigned numVarsWithValues = 0; if (bytecodeIndex) numVarsWithValues = codeBlock->numCalleeLocals(); Operands mustHandleValues(codeBlock->numParameters(), numVarsWithValues, 0); int localsUsedForCalleeSaves = static_cast(CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters()); for (size_t i = 0; i < mustHandleValues.size(); ++i) { Operand operand = mustHandleValues.operandForIndex(i); if (operand.isLocal() && operand.toLocal() < localsUsedForCalleeSaves) continue; mustHandleValues[i] = callFrame->uncheckedR(operand.virtualRegister()).jsValue(); } CodeBlock* replacementCodeBlock = codeBlock->newReplacement(); CompilationResult result = DFG::compile( vm, replacementCodeBlock, nullptr, Options::forceUnlinkedDFG() ? JITCompilationMode::UnlinkedDFG : JITCompilationMode::DFG, bytecodeIndex, WTF::move(mustHandleValues), JITToDFGDeferredCompilationCallback::create()); if (result != CompilationResult::CompilationSuccessful) { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compilation failed")); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } } CodeBlock* optimizedCodeBlock = codeBlock->replacement(); ASSERT(optimizedCodeBlock && JSC::JITCode::isOptimizingJIT(optimizedCodeBlock->jitType())); if (void* dataBuffer = DFG::prepareOSREntry(vm, callFrame, optimizedCodeBlock, bytecodeIndex)) { CODEBLOCK_LOG_EVENT(optimizedCodeBlock, "osrEntry", ("at bc#", bytecodeIndex)); dataLogLnIf(Options::verboseOSR(), "Performing OSR ", codeBlock, " -> ", optimizedCodeBlock); codeBlock->optimizeSoon(); codeBlock->unlinkedCodeBlock()->setDidOptimize(TriState::True); void* targetPC = untagCodePtr(vm.getCTIStub(DFG::osrEntryThunkGenerator).code().taggedPtr()); targetPC = tagCodePtrWithStackPointerForJITCall(targetPC, callFrame); OPERATION_RETURN(scope, encodeResult(targetPC, dataBuffer)); } dataLogLnIf(Options::verboseOSR(), "Optimizing ", codeBlock, " -> ", codeBlock->replacement(), " succeeded, OSR failed, after a delay of ", codeBlock->optimizationDelayCounter()); // Count the OSR failure as a speculation failure. If this happens a lot, then // reoptimize. optimizedCodeBlock->countOSRExit(); // We are a lot more conservative about triggering reoptimization after OSR failure than // before it. If we enter the optimize_from_loop trigger with a bucket full of fail // already, then we really would like to reoptimize immediately. But this case covers // something else: there weren't many (or any) speculation failures before, but we just // failed to enter the speculative code because some variable had the wrong value or // because the OSR code decided for any spurious reason that it did not want to OSR // right now. So, we only trigger reoptimization only upon the more conservative (non-loop) // reoptimization trigger. if (optimizedCodeBlock->shouldReoptimizeNow()) { CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize now")); dataLogLnIf(Options::verboseOSR(), "Triggering reoptimization of ", codeBlock, " -> ", codeBlock->replacement(), " (after OSR fail)."); optimizedCodeBlock->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTriggerOnOSREntryFail, CountReoptimization); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } // OSR failed this time, but it might succeed next time! Let the code run a bit // longer and then try again. // Use the normal threshold regardless of quickDFGTierUp: DFG is already installed, // so this controls OSR retry spacing, not compilation trigger timing. Fast retries // increment the exit counter on every attempt, which can cause premature jettison. codeBlock->optimizeAfterWarmUpIgnoreQuickTierUp(); CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("OSR failed")); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } JSC_DEFINE_JIT_OPERATION(operationTryOSREnterAtCatchAndValueProfile, UGPRPair, (VM* vmPointer, uint32_t bytecodeIndexBits)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); BytecodeIndex bytecodeIndex = BytecodeIndex::fromBits(bytecodeIndexBits); CodeBlock* codeBlock = callFrame->codeBlock(); CodeBlock* optimizedReplacement = codeBlock->replacement(); if (!optimizedReplacement) [[unlikely]] OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); switch (optimizedReplacement->jitType()) { case JITType::DFGJIT: case JITType::FTLJIT: { CodePtr entry = DFG::prepareCatchOSREntry(vm, callFrame, codeBlock, optimizedReplacement, bytecodeIndex); OPERATION_RETURN(scope, encodeResult(entry.taggedPtr(), optimizedReplacement)); } default: break; } codeBlock->ensureCatchLivenessIsComputedForBytecodeIndex(bytecodeIndex); auto bytecode = codeBlock->instructions().at(bytecodeIndex)->as(); auto& metadata = bytecode.metadata(codeBlock); metadata.m_buffer->forEach([&] (ValueProfileAndVirtualRegister& profile) { profile.m_buckets[0] = JSValue::encode(callFrame->uncheckedR(profile.m_operand).jsValue()); }); OPERATION_RETURN(scope, encodeResult(nullptr, nullptr)); } #endif enum class AccessorType { Getter, Setter }; static void putAccessorByVal(JSGlobalObject* globalObject, JSObject* base, JSValue subscript, int32_t attribute, JSObject* accessor, AccessorType accessorType) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); auto propertyKey = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, void()); scope.release(); if (accessorType == AccessorType::Getter) base->putGetter(globalObject, propertyKey, accessor, attribute); else base->putSetter(globalObject, propertyKey, accessor, attribute); } JSC_DEFINE_JIT_OPERATION(operationPutGetterById, void, (JSGlobalObject* globalObject, JSCell* object, UniquedStringImpl* uid, int32_t options, JSCell* getter)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(object && object->isObject()); JSObject* baseObj = object->getObject(); ASSERT(getter->isObject()); baseObj->putGetter(globalObject, uid, getter, options); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutSetterById, void, (JSGlobalObject* globalObject, JSCell* object, UniquedStringImpl* uid, int32_t options, JSCell* setter)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(object && object->isObject()); JSObject* baseObj = object->getObject(); ASSERT(setter->isObject()); baseObj->putSetter(globalObject, uid, setter, options); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutGetterByVal, void, (JSGlobalObject* globalObject, JSCell* base, EncodedJSValue encodedSubscript, int32_t attribute, JSCell* getter)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); putAccessorByVal(globalObject, asObject(base), JSValue::decode(encodedSubscript), attribute, asObject(getter), AccessorType::Getter); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutSetterByVal, void, (JSGlobalObject* globalObject, JSCell* base, EncodedJSValue encodedSubscript, int32_t attribute, JSCell* setter)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); putAccessorByVal(globalObject, asObject(base), JSValue::decode(encodedSubscript), attribute, asObject(setter), AccessorType::Setter); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationPutGetterSetter, void, (JSGlobalObject* globalObject, JSCell* object, UniquedStringImpl* uid, int32_t attribute, EncodedJSValue encodedGetterValue, EncodedJSValue encodedSetterValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(object && object->isObject()); JSObject* baseObject = asObject(object); JSValue getter = JSValue::decode(encodedGetterValue); JSValue setter = JSValue::decode(encodedSetterValue); ASSERT(getter.isObject() || setter.isObject()); GetterSetter* accessor = GetterSetter::create(vm, globalObject, getter, setter); CommonSlowPaths::putDirectAccessorWithReify(vm, globalObject, baseObject, uid, accessor, attribute); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationInstanceOfCustom, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedValue, JSObject* constructor, EncodedJSValue encodedHasInstance)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue value = JSValue::decode(encodedValue); JSValue hasInstanceValue = JSValue::decode(encodedHasInstance); if (constructor->hasInstance(globalObject, value, hasInstanceValue)) OPERATION_RETURN(scope, 1); OPERATION_RETURN(scope, 0); } #if CPU(ARM64) || CPU(X86_64) JSC_DEFINE_JIT_OPERATION(operationIteratorNextTryFast, UGPRPair, (JSGlobalObject* globalObject, JSObject* iterator, JSCell*, void* metadataPointer)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); auto& metadata = *std::bit_cast(metadataPointer); if (auto* arrayIterator = dynamicDowncast(iterator)) { auto* array = downcast(arrayIterator->iteratedObject()); ASSERT(isJSArray(array)); IterationKind kind = arrayIterator->kind(); IterationMode mode = IterationMode::FastArrayValues; switch (kind) { case IterationKind::Values: mode = IterationMode::FastArrayValues; break; case IterationKind::Keys: mode = IterationMode::FastArrayKeys; break; case IterationKind::Entries: mode = IterationMode::FastArrayEntries; break; } metadata.m_iterableProfile.observeStructureID(array->structureID()); metadata.m_iterationMetadata.seenModes = metadata.m_iterationMetadata.seenModes | mode; JSValue value; bool hasNext = arrayIterator->next(globalObject, value); OPERATION_RETURN_IF_EXCEPTION(scope, makeUGPRPair(0, 0)); OPERATION_RETURN(scope, makeUGPRPair(JSValue::encode(jsBoolean(!hasNext)), JSValue::encode(value))); } if (auto* mapIterator = dynamicDowncast(iterator)) { IterationKind kind = mapIterator->kind(); IterationMode mode = IterationMode::FastMapEntries; switch (kind) { case IterationKind::Keys: mode = IterationMode::FastMapKeys; break; case IterationKind::Values: mode = IterationMode::FastMapValues; break; case IterationKind::Entries: mode = IterationMode::FastMapEntries; break; } metadata.m_iterationMetadata.seenModes = metadata.m_iterationMetadata.seenModes | mode; auto result = mapIterator->nextWithAdvance(vm); bool done = result.key.isEmpty(); JSValue value; if (!done) { switch (kind) { case IterationKind::Keys: value = result.key; break; case IterationKind::Values: value = result.value; break; case IterationKind::Entries: value = constructArrayPair(globalObject, result.key, result.value); OPERATION_RETURN_IF_EXCEPTION(scope, makeUGPRPair(0, 0)); break; } } OPERATION_RETURN(scope, makeUGPRPair(JSValue::encode(jsBoolean(done)), JSValue::encode(value))); } if (auto* setIterator = dynamicDowncast(iterator)) { IterationKind kind = setIterator->kind(); IterationMode mode = IterationMode::FastSetValues; switch (kind) { case IterationKind::Keys: case IterationKind::Values: mode = IterationMode::FastSetValues; break; case IterationKind::Entries: mode = IterationMode::FastSetEntries; break; } metadata.m_iterationMetadata.seenModes = metadata.m_iterationMetadata.seenModes | mode; JSValue nextKey = setIterator->nextWithAdvance(vm); bool done = nextKey.isEmpty(); JSValue value; if (!done) { switch (kind) { case IterationKind::Keys: case IterationKind::Values: value = nextKey; break; case IterationKind::Entries: value = constructArrayPair(globalObject, nextKey, nextKey); OPERATION_RETURN_IF_EXCEPTION(scope, makeUGPRPair(0, 0)); break; } } OPERATION_RETURN(scope, makeUGPRPair(JSValue::encode(jsBoolean(done)), JSValue::encode(value))); } if (auto* stringIterator = dynamicDowncast(iterator)) { metadata.m_iterationMetadata.seenModes = metadata.m_iterationMetadata.seenModes | IterationMode::FastString; JSString* nextValue = stringIterator->nextWithAdvance(globalObject, vm); OPERATION_RETURN_IF_EXCEPTION(scope, makeUGPRPair(0, 0)); bool done = !nextValue; JSValue value = done ? JSValue() : JSValue(nextValue); OPERATION_RETURN(scope, makeUGPRPair(JSValue::encode(jsBoolean(done)), JSValue::encode(value))); } RELEASE_ASSERT_NOT_REACHED(); OPERATION_RETURN(scope, makeUGPRPair(0, 0)); } #endif ALWAYS_INLINE static JSValue getByVal(JSGlobalObject* globalObject, CallFrame* callFrame, ArrayProfile* arrayProfile, JSValue baseValue, JSValue subscript) { UNUSED_PARAM(callFrame); VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); if (subscript.isString()) { auto propertyName = asString(subscript)->toAtomString(globalObject); RETURN_IF_EXCEPTION(scope, JSValue()); if (baseValue.isCell()) [[likely]] { Structure& structure = *baseValue.asCell()->structure(); if (JSCell::canUseFastGetOwnProperty(structure)) { if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, propertyName.data)) { ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0)); return result; } } RELEASE_AND_RETURN(scope, baseValue.get(globalObject, propertyName.data)); } ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0)); RELEASE_AND_RETURN(scope, baseValue.get(globalObject, propertyName.data)); } else if (std::optional index = subscript.tryGetAsUint32Index()) { uint32_t i = *index; if (isJSString(baseValue)) { if (asString(baseValue)->canGetIndex(i)) RELEASE_AND_RETURN(scope, asString(baseValue)->getIndex(globalObject, i)); if (arrayProfile) arrayProfile->setOutOfBounds(); } else if (baseValue.isObject()) { JSObject* object = asObject(baseValue); if (JSValue result = object->tryGetIndexQuickly(i, arrayProfile)) return result; bool skipMarkingOutOfBounds = false; if (object->indexingType() == ArrayWithContiguous && static_cast(i) < object->butterfly()->publicLength()) { // FIXME: expand this to ArrayStorage, Int32, and maybe Double: // https://bugs.webkit.org/show_bug.cgi?id=182940 auto* globalObject = object->realm(); skipMarkingOutOfBounds = globalObject->isOriginalArrayStructure(object->structure()) && globalObject->arrayPrototypeChainIsSane(); } if (!skipMarkingOutOfBounds && !CommonSlowPaths::canAccessArgumentIndexQuickly(*object, i)) { // FIXME: This will make us think that in-bounds typed array accesses are actually // out-of-bounds. // https://bugs.webkit.org/show_bug.cgi?id=149886 if (arrayProfile) arrayProfile->setOutOfBounds(); } } RELEASE_AND_RETURN(scope, baseValue.get(globalObject, i)); } else if (subscript.isNumber() && baseValue.isCell() && arrayProfile) { arrayProfile->setOutOfBounds(); if (subscript == jsNumber(-1)) { if (auto* array = dynamicDowncast(baseValue.asCell()); array && array->definitelyNegativeOneMiss()) [[likely]] return jsUndefined(); } } baseValue.requireObjectCoercible(globalObject); RETURN_IF_EXCEPTION(scope, JSValue()); auto propertyKey = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, JSValue()); ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0)); RELEASE_AND_RETURN(scope, baseValue.get(globalObject, propertyKey)); } JSC_DEFINE_JIT_OPERATION(operationGetByValGaveUp, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); JSValue result = getByVal(globalObject, callFrame, profile, baseValue, subscript); LOG_IC((ICEvent::OperationGetByValGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByValOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); CodeBlock* codeBlock = callFrame->codeBlock(); if (baseValue.isCell()) { if (subscript.isInt32()) { Structure* structure = baseValue.asCell()->structure(); if (propertyCache->considerRepatchingCacheGeneric(vm, codeBlock, structure)) { if (profile) profile->computeUpdatedPrediction(codeBlock, structure); repatchArrayGetByVal(globalObject, codeBlock, baseValue, subscript, *propertyCache, GetByKind::ByVal); } } else { CacheableIdentifier identifier; bool isNonStringPrimitiveKey = false; if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) { OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); if (subscript.isSymbol() || !parseIndex(*propertyName.data)) identifier = CacheableIdentifier::createFromCell(subscript.asCell()); } else { identifier = nonStringPrimitiveKeyForSubscript(vm, subscript); isNonStringPrimitiveKey = !!identifier; } if (identifier) { scope.release(); OPERATION_RETURN(scope, JSValue::encode(baseValue.getPropertySlot(globalObject, identifier, [&] (bool found, PropertySlot& slot) -> JSValue { LOG_IC((ICEvent::OperationGetByValOptimize, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ByVal, isNonStringPrimitiveKey); return found ? slot.getValue(globalObject, identifier) : jsUndefined(); }))); } } } OPERATION_RETURN(scope, JSValue::encode(getByVal(globalObject, callFrame, profile, baseValue, subscript))); } ALWAYS_INLINE static JSValue getByValWithThis(JSGlobalObject* globalObject, CallFrame* callFrame, ArrayProfile* arrayProfile, JSValue baseValue, JSValue subscript, JSValue thisValue) { UNUSED_PARAM(callFrame); VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); PropertySlot slot(thisValue, PropertySlot::PropertySlot::InternalMethodType::Get); if (subscript.isString()) { auto propertyName = asString(subscript)->toAtomString(globalObject); RETURN_IF_EXCEPTION(scope, { }); if (baseValue.isCell()) [[likely]] { Structure& structure = *baseValue.asCell()->structure(); if (JSCell::canUseFastGetOwnProperty(structure)) { if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, propertyName.data)) { ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0)); return result; } } } ASSERT(callFrame->bytecodeIndex() != BytecodeIndex(0)); RELEASE_AND_RETURN(scope, baseValue.get(globalObject, propertyName.data, slot)); } else if (std::optional index = subscript.tryGetAsUint32Index()) { uint32_t i = *index; if (isJSString(baseValue)) { if (asString(baseValue)->canGetIndex(i)) RELEASE_AND_RETURN(scope, asString(baseValue)->getIndex(globalObject, i)); if (arrayProfile) arrayProfile->setOutOfBounds(); } else if (baseValue.isObject()) { JSObject* object = asObject(baseValue); if (JSValue result = object->tryGetIndexQuickly(i, arrayProfile)) return result; bool skipMarkingOutOfBounds = false; if (object->indexingType() == ArrayWithContiguous && static_cast(i) < object->butterfly()->publicLength()) { // FIXME: expand this to ArrayStorage, Int32, and maybe Double: // https://bugs.webkit.org/show_bug.cgi?id=182940 auto* globalObject = object->realm(); skipMarkingOutOfBounds = globalObject->isOriginalArrayStructure(object->structure()) && globalObject->arrayPrototypeChainIsSane(); } if (!skipMarkingOutOfBounds && !CommonSlowPaths::canAccessArgumentIndexQuickly(*object, i)) { // FIXME: This will make us think that in-bounds typed array accesses are actually // out-of-bounds. // https://bugs.webkit.org/show_bug.cgi?id=149886 if (arrayProfile) arrayProfile->setOutOfBounds(); } } RELEASE_AND_RETURN(scope, baseValue.get(globalObject, i, slot)); } else if (subscript.isNumber() && baseValue.isCell() && arrayProfile) { arrayProfile->setOutOfBounds(); if (subscript == jsNumber(-1)) { if (auto* array = dynamicDowncast(baseValue.asCell()); array && array->definitelyNegativeOneMiss()) [[likely]] return jsUndefined(); } } baseValue.requireObjectCoercible(globalObject); RETURN_IF_EXCEPTION(scope, { }); auto propertyKey = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, { }); RELEASE_AND_RETURN(scope, baseValue.get(globalObject, propertyKey, slot)); } static ALWAYS_INLINE JSValue getByValMegamorphic(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, ArrayProfile* profile, JSValue baseValue, JSValue thisValue, JSValue subscript, GetByKind kind) { auto scope = DECLARE_THROW_SCOPE(vm); if (!baseValue.isObject() || !CacheableIdentifier::isCacheableIdentifierCell(subscript)) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); if (kind == GetByKind::ByVal) RELEASE_AND_RETURN(scope, getByVal(globalObject, callFrame, profile, baseValue, subscript)); RELEASE_AND_RETURN(scope, getByValWithThis(globalObject, callFrame, profile, baseValue, subscript, thisValue)); } JSObject* baseObject = asObject(baseValue); GCOwnedDataScope propertyName; Identifier propertyKey; UniquedStringImpl* uid = nullptr; if (subscript.isString()) { propertyName = asString(subscript)->toAtomString(globalObject); uid = propertyName.data; } else { propertyKey = subscript.toPropertyKey(globalObject); uid = propertyKey.impl(); } RETURN_IF_EXCEPTION(scope, { }); if (!canUseMegamorphicGetByIdExcludingIndex(vm, uid)) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); if (kind == GetByKind::ByVal) RELEASE_AND_RETURN(scope, getByVal(globalObject, callFrame, profile, baseValue, subscript)); RELEASE_AND_RETURN(scope, getByValWithThis(globalObject, callFrame, profile, baseValue, subscript, thisValue)); } if (auto index = parseIndex(*uid); index) [[unlikely]] { if (!baseObject->structure()->isCacheableDictionary() || index.value() >= 100) { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); } if (kind == GetByKind::ByVal) RELEASE_AND_RETURN(scope, getByVal(globalObject, callFrame, profile, baseValue, subscript)); RELEASE_AND_RETURN(scope, getByValWithThis(globalObject, callFrame, profile, baseValue, subscript, thisValue)); } PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get); JSObject* object = baseObject; bool shouldGiveUp = false; bool cacheable = true; while (true) { if (TypeInfo::overridesGetOwnPropertySlot(object->inlineTypeFlags()) && object->type() != ArrayType && object->type() != JSFunctionType && object != globalObject->arrayPrototype()) [[unlikely]] { if (propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); bool result = object->getNonIndexPropertySlot(globalObject, uid, slot); RETURN_IF_EXCEPTION(scope, { }); if (result) RELEASE_AND_RETURN(scope, slot.getValue(globalObject, uid)); return jsUndefined(); } Structure* structure = object->structure(); bool hasProperty = object->getOwnNonIndexPropertySlot(vm, structure, uid, slot); structure = object->structure(); // Reload it again since static-class-table can cause transition. But this transition only affects on this Structure. if (!structure->propertyAccessesAreCacheable()) { cacheable = false; shouldGiveUp = true; } if (hasProperty) { if (cacheable && slot.isCacheableValue() && slot.cachedOffset() structure()->isDictionary()) vm.megamorphicCache()->initAsHit(baseObject->structureID(), uid, slot.slotBase(), slot.cachedOffset(), slot.slotBase() == baseObject); else { if (baseObject->structure()->hasBeenFlattenedBefore()) [[unlikely]] { if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); } } } else { if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); } RELEASE_AND_RETURN(scope, slot.getValue(globalObject, uid)); } if (!structure->propertyAccessesAreCacheableForAbsence()) { shouldGiveUp = true; cacheable = false; } cacheable &= structure->hasMonoProto(); JSValue prototype = object->getPrototypeDirect(); if (!prototype.isObject()) { if (cacheable) [[likely]] { if (!baseObject->structure()->isDictionary()) [[likely]] { vm.megamorphicCache()->initAsMiss(baseObject->structureID(), uid); return jsUndefined(); } if (!baseObject->structure()->hasBeenFlattenedBefore()) [[likely]] return jsUndefined(); } if (shouldGiveUp && propertyCache && propertyCache->considerRepatchingCacheMegamorphic(vm)) repatchGetBySlowPathCall(callFrame->codeBlock(), *propertyCache, kind); return jsUndefined(); } object = asObject(prototype); } } JSC_DEFINE_JIT_OPERATION(operationGetByValMegamorphic, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); OPERATION_RETURN(scope, JSValue::encode(getByValMegamorphic(globalObject, vm, callFrame, propertyCache, profile, baseValue, baseValue, JSValue::decode(encodedSubscript), GetByKind::ByVal))); } JSC_DEFINE_JIT_OPERATION(operationGetByValMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); OPERATION_RETURN(scope, JSValue::encode(getByValMegamorphic(globalObject, vm, callFrame, nullptr, nullptr, baseValue, baseValue, JSValue::decode(encodedSubscript), GetByKind::ByVal))); } JSC_DEFINE_JIT_OPERATION(operationGetByValGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); JSValue result = getByVal(globalObject, callFrame, nullptr, baseValue, subscript); LOG_IC((ICEvent::OperationGetByValGeneric, baseValue.classInfoOrNull())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByValWithThisGaveUp, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, EncodedJSValue encodedThis, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); JSValue thisValue = JSValue::decode(encodedThis); JSValue result = getByValWithThis(globalObject, callFrame, profile, baseValue, subscript, thisValue); LOG_IC((ICEvent::OperationGetByValWithThisGaveUp, baseValue.classInfoOrNull())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByValWithThisOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, EncodedJSValue encodedThis, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); JSValue thisValue = JSValue::decode(encodedThis); CodeBlock* codeBlock = callFrame->codeBlock(); PropertySlot slot(thisValue, PropertySlot::PropertySlot::InternalMethodType::Get); if (baseValue.isCell()) { if (subscript.isInt32()) { Structure* structure = baseValue.asCell()->structure(); if (propertyCache->considerRepatchingCacheGeneric(vm, codeBlock, structure)) { if (profile) profile->computeUpdatedPrediction(codeBlock, structure); repatchArrayGetByVal(globalObject, codeBlock, baseValue, subscript, *propertyCache, GetByKind::ByValWithThis); } } else { CacheableIdentifier identifier; bool isNonStringPrimitiveKey = false; if (auto propertyName = CacheableIdentifier::getCacheableIdentifier(subscript)) { OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); if (subscript.isSymbol() || !parseIndex(*propertyName.data)) identifier = CacheableIdentifier::createFromCell(subscript.asCell()); } else { identifier = nonStringPrimitiveKeyForSubscript(vm, subscript); isNonStringPrimitiveKey = !!identifier; } if (identifier) { scope.release(); OPERATION_RETURN(scope, JSValue::encode(baseValue.getPropertySlot(globalObject, identifier, slot, [&] (bool found, PropertySlot& slot) -> JSValue { LOG_IC((ICEvent::OperationGetByValWithThisOptimize, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::ByValWithThis, isNonStringPrimitiveKey); return found ? slot.getValue(globalObject, identifier) : jsUndefined(); }))); } } } OPERATION_RETURN(scope, JSValue::encode(getByValWithThis(globalObject, callFrame, profile, baseValue, subscript, thisValue))); } JSC_DEFINE_JIT_OPERATION(operationGetByValWithThisGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedProperty, EncodedJSValue encodedThis)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue property = JSValue::decode(encodedProperty); JSValue thisValue = JSValue::decode(encodedThis); if (baseValue.isCell()) [[likely]] { JSCell* base = baseValue.asCell(); if (std::optional index = property.tryGetAsUint32Index()) OPERATION_RETURN(scope, getByValWithIndexAndThis(globalObject, base, *index, thisValue)); if (property.isString()) { Structure& structure = *base->structure(); if (JSCell::canUseFastGetOwnProperty(structure)) { auto existingAtomString = asString(property)->toExistingAtomString(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); if (existingAtomString) { if (JSValue result = base->fastGetOwnProperty(vm, structure, existingAtomString.data)) OPERATION_RETURN(scope, JSValue::encode(result)); } } } } baseValue.requireObjectCoercible(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); auto propertyName = property.toPropertyKey(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); PropertySlot slot(thisValue, PropertySlot::PropertySlot::InternalMethodType::Get); JSValue result = baseValue.get(globalObject, propertyName, slot); LOG_IC((ICEvent::OperationGetByValWithThisGeneric, baseValue.classInfoOrNull(), baseValue == slot.slotBase())); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetByValWithThisMegamorphic, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, EncodedJSValue encodedThis, PropertyInlineCache* propertyCache, ArrayProfile* profile)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(getByValMegamorphic(globalObject, vm, callFrame, propertyCache, profile, JSValue::decode(encodedBase), JSValue::decode(encodedThis), JSValue::decode(encodedSubscript), GetByKind::ByValWithThis))); } JSC_DEFINE_JIT_OPERATION(operationGetByValWithThisMegamorphicGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, EncodedJSValue encodedThis)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(getByValMegamorphic(globalObject, vm, callFrame, nullptr, nullptr, JSValue::decode(encodedBase), JSValue::decode(encodedThis), JSValue::decode(encodedSubscript), GetByKind::ByValWithThis))); } ALWAYS_INLINE static JSValue getPrivateName(JSGlobalObject* globalObject, CallFrame* callFrame, JSValue baseValue, JSValue fieldNameValue) { UNUSED_PARAM(callFrame); VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); JSObject* base = baseValue.toObject(globalObject); RETURN_IF_EXCEPTION(scope, JSValue()); auto fieldName = fieldNameValue.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, JSValue()); PropertySlot slot(base, PropertySlot::InternalMethodType::GetOwnProperty); base->getPrivateField(globalObject, fieldName, slot); RETURN_IF_EXCEPTION(scope, JSValue()); return slot.getValue(globalObject, fieldName); } ALWAYS_INLINE static JSValue getPrivateName(JSGlobalObject* globalObject, CallFrame* callFrame, JSValue baseValue, PropertyName fieldName) { ASSERT(fieldName.isPrivateName()); UNUSED_PARAM(callFrame); VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); baseValue.requireObjectCoercible(globalObject); RETURN_IF_EXCEPTION(scope, JSValue()); JSObject* base = baseValue.toObject(globalObject); RETURN_IF_EXCEPTION(scope, JSValue()); PropertySlot slot(base, PropertySlot::InternalMethodType::GetOwnProperty); base->getPrivateField(globalObject, fieldName, slot); RETURN_IF_EXCEPTION(scope, JSValue()); return slot.getValue(globalObject, fieldName); } JSC_DEFINE_JIT_OPERATION(operationGetPrivateNameOptimize, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedFieldName, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue fieldNameValue = JSValue::decode(encodedFieldName); ASSERT(CacheableIdentifier::isCacheableIdentifierCell(fieldNameValue)); CodeBlock* codeBlock = callFrame->codeBlock(); if (baseValue.isObject()) { const Identifier fieldName = fieldNameValue.toPropertyKey(globalObject); EXCEPTION_ASSERT(!scope.exception() || vm.hasPendingTerminationException()); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); ASSERT(fieldName.isSymbol()); JSObject* base = uncheckedDowncast(baseValue.asCell()); PropertySlot slot(base, PropertySlot::InternalMethodType::GetOwnProperty); base->getPrivateField(globalObject, fieldName, slot); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); LOG_IC((ICEvent::OperationGetPrivateNameOptimize, baseValue.classInfoOrNull(), true)); CacheableIdentifier identifier = CacheableIdentifier::createFromCell(fieldNameValue.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::PrivateName, /* isNonStringPrimitiveKey */ false); OPERATION_RETURN(scope, JSValue::encode(slot.getValue(globalObject, fieldName))); } OPERATION_RETURN(scope, JSValue::encode(getPrivateName(globalObject, callFrame, baseValue, fieldNameValue))); } JSC_DEFINE_JIT_OPERATION(operationGetPrivateNameGaveUp, EncodedJSValue, (EncodedJSValue encodedBase, EncodedJSValue encodedFieldName, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(encodedBase); JSValue fieldNameValue = JSValue::decode(encodedFieldName); OPERATION_RETURN(scope, JSValue::encode(getPrivateName(globalObject, callFrame, baseValue, fieldNameValue))); } JSC_DEFINE_JIT_OPERATION(operationGetPrivateNameGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedFieldName)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue fieldNameValue = JSValue::decode(encodedFieldName); OPERATION_RETURN(scope, JSValue::encode(getPrivateName(globalObject, callFrame, baseValue, fieldNameValue))); } JSC_DEFINE_JIT_OPERATION(operationGetPrivateNameByIdGaveUp, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue baseValue = JSValue::decode(base); CacheableIdentifier identifier = propertyCache->identifier(); JSValue result = getPrivateName(globalObject, callFrame, baseValue, identifier); LOG_IC((ICEvent::OperationGetPrivateNameById, baseValue.classInfoOrNull(), true)); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationGetPrivateNameByIdOptimize, EncodedJSValue, (EncodedJSValue base, PropertyInlineCache* propertyCache)) { SuperSamplerScope superSamplerScope(false); JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = propertyCache->identifier(); JSValue baseValue = JSValue::decode(base); if (baseValue.isObject()) { JSObject* base = uncheckedDowncast(baseValue.asCell()); PropertySlot slot(base, PropertySlot::InternalMethodType::GetOwnProperty); base->getPrivateField(globalObject, identifier, slot); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); LOG_IC((ICEvent::OperationGetPrivateNameByIdOptimize, baseValue.classInfoOrNull(), true)); CodeBlock* codeBlock = callFrame->codeBlock(); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchGetBy(globalObject, codeBlock, baseValue, identifier, slot, *propertyCache, GetByKind::PrivateNameById, /* isNonStringPrimitiveKey */ false); OPERATION_RETURN(scope, JSValue::encode(slot.getValue(globalObject, identifier))); } OPERATION_RETURN(scope, JSValue::encode(getPrivateName(globalObject, callFrame, baseValue, identifier))); } JSC_DEFINE_JIT_OPERATION(operationGetPrivateNameByIdGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue base, uintptr_t rawCacheableIdentifier)) { SuperSamplerScope superSamplerScope(false); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(base); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); JSValue result = getPrivateName(globalObject, callFrame, baseValue, identifier); LOG_IC((ICEvent::OperationGetPrivateNameByIdGeneric, baseValue.classInfoOrNull(), true)); OPERATION_RETURN(scope, JSValue::encode(result)); } static bool deleteById(JSGlobalObject* globalObject, VM& vm, DeletePropertySlot& slot, JSValue base, PropertyName propertyName, ECMAMode ecmaMode) { auto scope = DECLARE_THROW_SCOPE(vm); JSObject* baseObj = base.toObject(globalObject); RETURN_IF_EXCEPTION(scope, false); if (!baseObj) return false; bool couldDelete = baseObj->methodTable()->deleteProperty(baseObj, globalObject, propertyName, slot); RETURN_IF_EXCEPTION(scope, false); if (!couldDelete && ecmaMode.isStrict()) throwTypeError(globalObject, scope, UnableToDeletePropertyError); return couldDelete; } static ALWAYS_INLINE size_t deleteByIdOptimize(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, PropertyInlineCache* propertyCache, JSValue baseValue, CacheableIdentifier identifier, ECMAMode ecmaMode) { auto scope = DECLARE_THROW_SCOPE(vm); Structure* oldStructure = baseValue.structureOrNull(); DeletePropertySlot slot; bool result = deleteById(globalObject, vm, slot, baseValue, identifier, ecmaMode); RETURN_IF_EXCEPTION(scope, encodedJSValue()); if (baseValue.isObject()) { if (!parseIndex(identifier)) { CodeBlock* codeBlock = callFrame->codeBlock(); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchDeleteBy(globalObject, codeBlock, slot, baseValue, oldStructure, identifier, *propertyCache, ecmaMode.isStrict() ? DelByKind::ByIdStrict : DelByKind::ByIdSloppy, ecmaMode); } } return result; } JSC_DEFINE_JIT_OPERATION(operationDeleteByIdSloppyOptimize, size_t, (EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); CacheableIdentifier identifier = propertyCache->identifier(); OPERATION_RETURN(scope, deleteByIdOptimize(globalObject, vm, callFrame, propertyCache, baseValue, identifier, ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByIdStrictOptimize, size_t, (EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); CacheableIdentifier identifier = propertyCache->identifier(); OPERATION_RETURN(scope, deleteByIdOptimize(globalObject, vm, callFrame, propertyCache, baseValue, identifier, ECMAMode::strict())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByIdSloppyGaveUp, size_t, (EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; CacheableIdentifier identifier = propertyCache->identifier(); DeletePropertySlot slot; OPERATION_RETURN(scope, deleteById(globalObject, vm, slot, JSValue::decode(encodedBase), identifier, ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByIdStrictGaveUp, size_t, (EncodedJSValue encodedBase, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; CacheableIdentifier identifier = propertyCache->identifier(); DeletePropertySlot slot; OPERATION_RETURN(scope, deleteById(globalObject, vm, slot, JSValue::decode(encodedBase), identifier, ECMAMode::strict())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByIdSloppyGeneric, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, uintptr_t rawCacheableIdentifier)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); DeletePropertySlot slot; OPERATION_RETURN(scope, deleteById(globalObject, vm, slot, JSValue::decode(encodedBase), identifier, ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByIdStrictGeneric, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, uintptr_t rawCacheableIdentifier)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CacheableIdentifier identifier = CacheableIdentifier::createFromRawBits(rawCacheableIdentifier); DeletePropertySlot slot; OPERATION_RETURN(scope, deleteById(globalObject, vm, slot, JSValue::decode(encodedBase), identifier, ECMAMode::strict())); } static bool deleteByVal(JSGlobalObject* globalObject, VM& vm, DeletePropertySlot& slot, JSValue base, JSValue key, ECMAMode ecmaMode) { auto scope = DECLARE_THROW_SCOPE(vm); JSObject* baseObj = base.toObject(globalObject); RETURN_IF_EXCEPTION(scope, false); if (!baseObj) return false; bool couldDelete; uint32_t index; if (key.getUInt32(index)) couldDelete = baseObj->methodTable()->deletePropertyByIndex(baseObj, globalObject, index); else { Identifier property = key.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, false); couldDelete = baseObj->methodTable()->deleteProperty(baseObj, globalObject, property, slot); } RETURN_IF_EXCEPTION(scope, false); if (!couldDelete && ecmaMode.isStrict()) throwTypeError(globalObject, scope, UnableToDeletePropertyError); return couldDelete; } static ALWAYS_INLINE size_t deleteByValOptimize(JSGlobalObject* globalObject, VM& vm, CallFrame* callFrame, JSValue baseValue, JSValue subscript, PropertyInlineCache* propertyCache, ECMAMode ecmaMode) { auto scope = DECLARE_THROW_SCOPE(vm); DeletePropertySlot slot; Structure* oldStructure = baseValue.structureOrNull(); bool result = deleteByVal(globalObject, vm, slot, baseValue, subscript, ecmaMode); RETURN_IF_EXCEPTION(scope, { }); if (baseValue.isObject() && CacheableIdentifier::isCacheableIdentifierCell(subscript)) { const Identifier propertyName = subscript.toPropertyKey(globalObject); RETURN_IF_EXCEPTION(scope, { }); if (subscript.isSymbol() || !parseIndex(propertyName)) { CodeBlock* codeBlock = callFrame->codeBlock(); CacheableIdentifier identifier = CacheableIdentifier::createFromCell(subscript.asCell()); if (propertyCache->considerRepatchingCacheBy(vm, codeBlock, baseValue.structureOrNull(), identifier)) repatchDeleteBy(globalObject, codeBlock, slot, baseValue, oldStructure, identifier, *propertyCache, ecmaMode.isStrict() ? DelByKind::ByValStrict : DelByKind::ByValSloppy, ecmaMode); } } return result; } JSC_DEFINE_JIT_OPERATION(operationDeleteByValSloppyOptimize, size_t, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); OPERATION_RETURN(scope, deleteByValOptimize(globalObject, vm, callFrame, baseValue, subscript, propertyCache, ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByValStrictOptimize, size_t, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue baseValue = JSValue::decode(encodedBase); JSValue subscript = JSValue::decode(encodedSubscript); OPERATION_RETURN(scope, deleteByValOptimize(globalObject, vm, callFrame, baseValue, subscript, propertyCache, ECMAMode::strict())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByValSloppyGaveUp, size_t, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; DeletePropertySlot slot; OPERATION_RETURN(scope, deleteByVal(globalObject, vm, slot, JSValue::decode(encodedBase), JSValue::decode(encodedSubscript), ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByValStrictGaveUp, size_t, (EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; DeletePropertySlot slot; OPERATION_RETURN(scope, deleteByVal(globalObject, vm, slot, JSValue::decode(encodedBase), JSValue::decode(encodedSubscript), ECMAMode::strict())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByValSloppyGeneric, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); DeletePropertySlot slot; OPERATION_RETURN(scope, deleteByVal(globalObject, vm, slot, JSValue::decode(encodedBase), JSValue::decode(encodedSubscript), ECMAMode::sloppy())); } JSC_DEFINE_JIT_OPERATION(operationDeleteByValStrictGeneric, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); DeletePropertySlot slot; OPERATION_RETURN(scope, deleteByVal(globalObject, vm, slot, JSValue::decode(encodedBase), JSValue::decode(encodedSubscript), ECMAMode::strict())); } JSC_DEFINE_JIT_OPERATION(operationPushWithScope, JSCell*, (JSGlobalObject* globalObject, JSCell* currentScopeCell, EncodedJSValue objectValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSObject* object = JSValue::decode(objectValue).toObject(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, nullptr); JSScope* currentScope = uncheckedDowncast(currentScopeCell); OPERATION_RETURN(scope, JSWithScope::create(vm, globalObject, currentScope, object)); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationPushWithScopeObject, JSCell*, (JSGlobalObject* globalObject, JSCell* currentScopeCell, JSObject* object)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSScope* currentScope = uncheckedDowncast(currentScopeCell); OPERATION_RETURN(scope, JSWithScope::create(vm, globalObject, currentScope, object)); } JSC_DEFINE_JIT_OPERATION(operationInstanceOfGaveUp, EncodedJSValue, (EncodedJSValue encodedValue, EncodedJSValue encodedProto, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); propertyCache->tookSlowPath = true; JSValue value = JSValue::decode(encodedValue); JSValue proto = JSValue::decode(encodedProto); bool result = JSObject::defaultHasInstance(globalObject, value, proto); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(result))); } JSC_DEFINE_JIT_OPERATION(operationInstanceOfGeneric, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedValue, EncodedJSValue encodedProto)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue value = JSValue::decode(encodedValue); JSValue proto = JSValue::decode(encodedProto); bool result = JSObject::defaultHasInstance(globalObject, value, proto); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(result))); } JSC_DEFINE_JIT_OPERATION(operationInstanceOfOptimize, EncodedJSValue, (EncodedJSValue encodedValue, EncodedJSValue encodedProto, PropertyInlineCache* propertyCache)) { JSGlobalObject* globalObject = propertyCache->globalObject(); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); ICSlowPathCallFrameTracer tracer(vm, callFrame, propertyCache); auto scope = DECLARE_THROW_SCOPE(vm); JSValue value = JSValue::decode(encodedValue); JSValue proto = JSValue::decode(encodedProto); bool result = JSObject::defaultHasInstance(globalObject, value, proto); OPERATION_RETURN_IF_EXCEPTION(scope, JSValue::encode(jsUndefined())); CodeBlock* codeBlock = callFrame->codeBlock(); if (propertyCache->considerRepatchingCacheGeneric(vm, codeBlock, value.structureOrNull())) repatchInstanceOf(globalObject, codeBlock, value, proto, *propertyCache, result); OPERATION_RETURN(scope, JSValue::encode(jsBoolean(result))); } JSC_DEFINE_JIT_OPERATION(operationSizeFrameForForwardArguments, size_t, (JSGlobalObject* globalObject, EncodedJSValue, int32_t numUsedStackSlots, int32_t)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, sizeFrameForForwardArguments(globalObject, callFrame, vm, numUsedStackSlots)); } JSC_DEFINE_JIT_OPERATION(operationSizeFrameForVarargs, size_t, (JSGlobalObject* globalObject, EncodedJSValue encodedArguments, int32_t numUsedStackSlots, int32_t firstVarArgOffset)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue arguments = JSValue::decode(encodedArguments); OPERATION_RETURN(scope, sizeFrameForVarargs(globalObject, callFrame, vm, arguments, numUsedStackSlots, firstVarArgOffset)); } JSC_DEFINE_JIT_OPERATION(operationSetupForwardArgumentsFrame, CallFrame*, (JSGlobalObject* globalObject, CallFrame* newCallFrame, EncodedJSValue, int32_t, int32_t length)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); setupForwardArgumentsFrame(globalObject, callFrame, newCallFrame, length); OPERATION_RETURN(scope, newCallFrame); } JSC_DEFINE_JIT_OPERATION(operationSetupVarargsFrame, CallFrame*, (JSGlobalObject* globalObject, CallFrame* newCallFrame, EncodedJSValue encodedArguments, int32_t firstVarArgOffset, int32_t length)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue arguments = JSValue::decode(encodedArguments); setupVarargsFrame(globalObject, callFrame, newCallFrame, arguments, firstVarArgOffset, length); OPERATION_RETURN(scope, newCallFrame); } JSC_DEFINE_JIT_OPERATION(operationResolveRope, StringImpl*, (JSGlobalObject* globalObject, JSString* string)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, string->value(globalObject)->impl()); } JSC_DEFINE_JIT_OPERATION(operationResolveRopeString, JSString*, (JSGlobalObject* globalObject, JSRopeString* string)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); string->resolveRope(globalObject); OPERATION_RETURN(scope, string); } JSC_DEFINE_JIT_OPERATION(operationSwitchStringWithUnknownKeyType, char*, (JSGlobalObject* globalObject, EncodedJSValue encodedKey, size_t tableIndex)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue key = JSValue::decode(encodedKey); CodeBlock* codeBlock = callFrame->codeBlock(); void* result; const StringJumpTable& linkedTable = codeBlock->baselineStringSwitchJumpTable(tableIndex); if (key.isString()) { const UnlinkedStringJumpTable& unlinkedTable = codeBlock->unlinkedStringSwitchJumpTable(tableIndex); auto* string = asString(key); unsigned length = string->length(); if (length < unlinkedTable.minLength() || length > unlinkedTable.maxLength()) result = linkedTable.ctiDefault().taggedPtr(); else { auto value = string->value(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, nullptr); result = linkedTable.ctiForValue(unlinkedTable, value.data.impl()).taggedPtr(); } } else result = linkedTable.ctiDefault().taggedPtr(); assertIsTaggedWith(result); OPERATION_RETURN(scope, reinterpret_cast(result)); } JSC_DEFINE_JIT_OPERATION(operationResolveScopeForBaseline, EncodedJSValue, (JSGlobalObject* globalObject, const JSInstruction* pc)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CodeBlock* codeBlock = callFrame->codeBlock(); auto bytecode = pc->as(); const Identifier& ident = codeBlock->identifier(bytecode.m_var); JSScope* environment = callFrame->uncheckedR(bytecode.m_scope).Register::scope(); JSObject* resolvedScope = JSScope::resolve(globalObject, environment, ident); // Proxy can throw an error here, e.g. Proxy in with statement's @unscopables. OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); auto& metadata = bytecode.metadata(codeBlock); ResolveType resolveType = metadata.m_resolveType; // ModuleVar does not keep the scope register value alive in DFG. ASSERT(resolveType != ModuleVar); switch (resolveType) { case GlobalProperty: case GlobalPropertyWithVarInjectionChecks: case UnresolvedProperty: case UnresolvedPropertyWithVarInjectionChecks: { if (resolvedScope->isGlobalObject()) { JSGlobalObject* globalObject = uncheckedDowncast(resolvedScope); bool hasProperty = globalObject->hasProperty(globalObject, ident); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); if (hasProperty) { ConcurrentJSLocker locker(codeBlock->m_lock); metadata.m_resolveType = needsVarInjectionChecks(resolveType) ? GlobalPropertyWithVarInjectionChecks : GlobalProperty; metadata.m_globalObject.set(vm, codeBlock, globalObject); metadata.m_globalLexicalBindingEpoch = globalObject->globalLexicalBindingEpoch(); } } else if (resolvedScope->isGlobalLexicalEnvironment()) { JSGlobalLexicalEnvironment* globalLexicalEnvironment = uncheckedDowncast(resolvedScope); ConcurrentJSLocker locker(codeBlock->m_lock); metadata.m_resolveType = needsVarInjectionChecks(resolveType) ? GlobalLexicalVarWithVarInjectionChecks : GlobalLexicalVar; metadata.m_globalLexicalEnvironment.set(vm, codeBlock, globalLexicalEnvironment); } break; } default: break; } OPERATION_RETURN(scope, JSValue::encode(resolvedScope)); } JSC_DEFINE_JIT_OPERATION(operationGetFromScope, EncodedJSValue, (JSGlobalObject* globalObject, const JSInstruction* pc)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CodeBlock* codeBlock = callFrame->codeBlock(); auto bytecode = pc->as(); const Identifier& ident = codeBlock->identifier(bytecode.m_var); JSObject* environment = uncheckedDowncast(callFrame->uncheckedR(bytecode.m_scope).jsValue()); GetPutInfo& getPutInfo = bytecode.metadata(codeBlock).m_getPutInfo; // ModuleVar is always converted to ClosureVar for get_from_scope. ASSERT(getPutInfo.resolveType() != ModuleVar); OPERATION_RETURN(scope, JSValue::encode(environment->getPropertySlot(globalObject, ident, [&] (bool found, PropertySlot& slot) -> JSValue { if (!found) { if (getPutInfo.resolveMode() == ThrowIfNotFound) throwException(globalObject, scope, createUndefinedVariableError(globalObject, ident)); return jsUndefined(); } JSValue result = JSValue(); if (environment->isGlobalLexicalEnvironment()) { // When we can't statically prove we need a TDZ check, we must perform the check on the slow path. result = slot.getValue(globalObject, ident); if (result == jsTDZValue()) { throwException(globalObject, scope, createTDZError(globalObject, ident.string())); return jsUndefined(); } } CommonSlowPaths::tryCacheGetFromScopeGlobal(globalObject, codeBlock, vm, bytecode, environment, slot, ident); if (!result) return slot.getValue(globalObject, ident); return result; }))); } JSC_DEFINE_JIT_OPERATION(operationPutToScope, void, (JSGlobalObject* globalObject, const JSInstruction* pc)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); CodeBlock* codeBlock = callFrame->codeBlock(); auto bytecode = pc->as(); auto& metadata = bytecode.metadata(codeBlock); const Identifier& ident = codeBlock->identifier(bytecode.m_var); JSObject* jsScope = uncheckedDowncast(callFrame->uncheckedR(bytecode.m_scope).jsValue()); JSValue value = callFrame->r(bytecode.m_value).jsValue(); GetPutInfo& getPutInfo = metadata.m_getPutInfo; // ModuleVar does not keep the scope register value alive in DFG. ASSERT(getPutInfo.resolveType() != ModuleVar); if (getPutInfo.resolveType() == ResolvedClosureVar) { JSLexicalEnvironment* environment = uncheckedDowncast(jsScope); environment->variableAt(ScopeOffset(metadata.m_operand)).set(vm, environment, value); if (InlineWatchpointSet* set = metadata.m_watchpointSet) set->touch(vm, "Executed op_put_scope"); OPERATION_RETURN(scope); } bool hasProperty = jsScope->hasProperty(globalObject, ident); OPERATION_RETURN_IF_EXCEPTION(scope); if (hasProperty && jsScope->isGlobalLexicalEnvironment() && !isInitialization(getPutInfo.initializationMode())) { // When we can't statically prove we need a TDZ check, we must perform the check on the slow path. PropertySlot slot(jsScope, PropertySlot::InternalMethodType::Get); JSGlobalLexicalEnvironment::getOwnPropertySlot(jsScope, globalObject, ident, slot); if (slot.getValue(globalObject, ident) == jsTDZValue()) { throwException(globalObject, scope, createTDZError(globalObject, ident.string())); OPERATION_RETURN(scope); } } if (getPutInfo.resolveMode() == ThrowIfNotFound && !hasProperty) { throwException(globalObject, scope, createUndefinedVariableError(globalObject, ident)); OPERATION_RETURN(scope); } PutPropertySlot slot(jsScope, getPutInfo.ecmaMode().isStrict(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode())); jsScope->methodTable()->put(jsScope, globalObject, ident, value, slot); OPERATION_RETURN_IF_EXCEPTION(scope); CommonSlowPaths::tryCachePutToScopeGlobal(globalObject, codeBlock, bytecode, jsScope, slot, ident); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationThrow, void, (JSGlobalObject* globalObject, EncodedJSValue encodedExceptionValue)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue exceptionValue = JSValue::decode(encodedExceptionValue); throwException(globalObject, scope, exceptionValue); // Results stored out-of-band in vm.targetMachinePCForThrow & vm.callFrameForCatch genericUnwind(vm, callFrame); OPERATION_RETURN(scope); } JSC_DEFINE_JIT_OPERATION(operationReallocateButterflyToHavePropertyStorageWithInitialCapacity, char*, (VM* vmPointer, JSObject* object)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(!object->structure()->outOfLineCapacity()); Butterfly* result = object->allocateMoreOutOfLineStorage(vm, 0, initialOutOfLineCapacity); object->nukeStructureAndSetButterfly(vm, object->structureID(), result); OPERATION_RETURN(scope, reinterpret_cast(result)); } JSC_DEFINE_JIT_OPERATION(operationReallocateButterflyToGrowPropertyStorage, char*, (VM* vmPointer, JSObject* object, size_t newSize)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); Butterfly* result = object->allocateMoreOutOfLineStorage(vm, object->structure()->outOfLineCapacity(), newSize); object->nukeStructureAndSetButterfly(vm, object->structureID(), result); OPERATION_RETURN(scope, reinterpret_cast(result)); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationReallocateButterflyAndTransition, void, (VM* vmPointer, JSObject* baseObject, const InlineCacheHandler* handler, EncodedJSValue encodedValue)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); size_t newSize = handler->newSize() / sizeof(JSValue); size_t oldSize = handler->oldSize() / sizeof(JSValue); PropertyOffset offset = handler->offset(); Structure* oldStructure = WTF::opaque(handler->structureID().decode()); Structure* newStructure = WTF::opaque(handler->newStructureID().decode()); ASSERT(oldStructure == baseObject->structure()); Butterfly* newButterfly = baseObject->allocateMoreOutOfLineStorage(vm, oldSize, newSize); baseObject->nukeStructureAndSetButterfly(vm, StructureID::encode(oldStructure), newButterfly); baseObject->putDirectOffset(vm, offset, JSValue::decode(encodedValue)); baseObject->setStructure(vm, newStructure); ensureStillAliveHere(oldStructure); ensureStillAliveHere(newStructure); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationOSRWriteBarrier, void, (VM* vmPointer, JSCell* cell)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); vm.writeBarrier(cell); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationWriteBarrierSlowPath, void, (VM* vmPointer, JSCell* cell)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); vm.writeBarrierSlowPath(cell); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationLookupExceptionHandler, void, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); genericUnwind(vm, callFrame); ASSERT(vm.targetMachinePCForThrow); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationLookupExceptionHandlerFromCallerFrame, void, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); ASSERT(callFrame->isZombieFrame()); ASSERT(vm.hasPendingTerminationException() || uncheckedDowncast(vm.exceptionForInspection()->value().asCell())->isStackOverflowError()); genericUnwind(vm, callFrame); ASSERT(vm.targetMachinePCForThrow); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationVMHandleException, void, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); genericUnwind(vm, callFrame); } // This function "should" just take the JSGlobalObject*, but doing so would make it more difficult // to call from exception check sites. So, unlike all of our other functions, we allow // ourselves to play some gnarly ABI tricks just to simplify the calling convention. This is // particularly safe here since this is never called on the critical path - it's only for // testing. JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationExceptionFuzz, void, (JSGlobalObject* globalObject)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); UNUSED_PARAM(scope); void* returnPC = __builtin_return_address(0); // FIXME (see rdar://72897291): Work around a Clang bug where __builtin_return_address() // sometimes gives us a signed pointer, and sometimes does not. returnPC = removeCodePtrTag(returnPC); doExceptionFuzzing(globalObject, scope, "JITOperations", returnPC); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationExceptionFuzzWithCallFrame, void, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); UNUSED_PARAM(scope); void* returnPC = __builtin_return_address(0); // FIXME (see rdar://72897291): Work around a Clang bug where __builtin_return_address() // sometimes gives us a signed pointer, and sometimes does not. returnPC = removeCodePtrTag(returnPC); doExceptionFuzzing(callFrame->lexicalGlobalObject(vm), scope, "JITOperations", returnPC); } JSC_DEFINE_JIT_OPERATION(operationValueAdd, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(jsAdd(globalObject, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2)))); } JSC_DEFINE_JIT_OPERATION(operationValueAddProfiled, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, BinaryArithProfile* arithProfile)) { ASSERT(arithProfile); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, JSValue::encode(profiledAdd(globalObject, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2), *arithProfile))); } JSC_DEFINE_JIT_OPERATION(operationValueAddProfiledOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue op1 = JSValue::decode(encodedOp1); JSValue op2 = JSValue::decode(encodedOp2); BinaryArithProfile* arithProfile = addIC->arithProfile(); ASSERT(arithProfile); arithProfile->observeLHSAndRHS(op1, op2); auto nonOptimizeVariant = operationValueAddProfiledNoOptimize; addIC->generateOutOfLine(callFrame->codeBlock(), nonOptimizeVariant); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif JSValue result = jsAdd(globalObject, op1, op2); arithProfile->observeResult(result); OPERATION_RETURN(scope, JSValue::encode(result)); } JSC_DEFINE_JIT_OPERATION(operationValueAddProfiledNoOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); BinaryArithProfile* arithProfile = addIC->arithProfile(); ASSERT(arithProfile); OPERATION_RETURN(scope, JSValue::encode(profiledAdd(globalObject, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2), *arithProfile))); } JSC_DEFINE_JIT_OPERATION(operationValueAddOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue op1 = JSValue::decode(encodedOp1); JSValue op2 = JSValue::decode(encodedOp2); auto nonOptimizeVariant = operationValueAddNoOptimize; if (BinaryArithProfile* arithProfile = addIC->arithProfile()) arithProfile->observeLHSAndRHS(op1, op2); addIC->generateOutOfLine(callFrame->codeBlock(), nonOptimizeVariant); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif OPERATION_RETURN(scope, JSValue::encode(jsAdd(globalObject, op1, op2))); } JSC_DEFINE_JIT_OPERATION(operationValueAddNoOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC*)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue op1 = JSValue::decode(encodedOp1); JSValue op2 = JSValue::decode(encodedOp2); JSValue result = jsAdd(globalObject, op1, op2); OPERATION_RETURN(scope, JSValue::encode(result)); } ALWAYS_INLINE static EncodedJSValue unprofiledMul(JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) { JSValue op1 = JSValue::decode(encodedOp1); JSValue op2 = JSValue::decode(encodedOp2); return JSValue::encode(jsMul(globalObject, op1, op2)); } ALWAYS_INLINE static EncodedJSValue profiledMul(JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, BinaryArithProfile& arithProfile, bool shouldObserveLHSAndRHSTypes = true) { VM& vm = globalObject->vm(); auto scope = DECLARE_THROW_SCOPE(vm); JSValue op1 = JSValue::decode(encodedOp1); JSValue op2 = JSValue::decode(encodedOp2); if (shouldObserveLHSAndRHSTypes) arithProfile.observeLHSAndRHS(op1, op2); JSValue result = jsMul(globalObject, op1, op2); RETURN_IF_EXCEPTION(scope, encodedJSValue()); arithProfile.observeResult(result); return JSValue::encode(result); } JSC_DEFINE_JIT_OPERATION(operationValueMul, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, unprofiledMul(globalObject, encodedOp1, encodedOp2)); } JSC_DEFINE_JIT_OPERATION(operationValueMulNoOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC*)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, unprofiledMul(globalObject, encodedOp1, encodedOp2)); } JSC_DEFINE_JIT_OPERATION(operationValueMulOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); auto nonOptimizeVariant = operationValueMulNoOptimize; if (BinaryArithProfile* arithProfile = mulIC->arithProfile()) arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2)); mulIC->generateOutOfLine(callFrame->codeBlock(), nonOptimizeVariant); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif OPERATION_RETURN(scope, unprofiledMul(globalObject, encodedOp1, encodedOp2)); } JSC_DEFINE_JIT_OPERATION(operationValueMulProfiled, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, BinaryArithProfile* arithProfile)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); ASSERT(arithProfile); OPERATION_RETURN(scope, profiledMul(globalObject, encodedOp1, encodedOp2, *arithProfile)); } JSC_DEFINE_JIT_OPERATION(operationValueMulProfiledOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); BinaryArithProfile* arithProfile = mulIC->arithProfile(); ASSERT(arithProfile); arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2)); auto nonOptimizeVariant = operationValueMulProfiledNoOptimize; mulIC->generateOutOfLine(callFrame->codeBlock(), nonOptimizeVariant); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif OPERATION_RETURN(scope, profiledMul(globalObject, encodedOp1, encodedOp2, *arithProfile, false)); } JSC_DEFINE_JIT_OPERATION(operationValueMulProfiledNoOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); BinaryArithProfile* arithProfile = mulIC->arithProfile(); ASSERT(arithProfile); OPERATION_RETURN(scope, profiledMul(globalObject, encodedOp1, encodedOp2, *arithProfile)); } // FIXME: it would be better to call those operationValueNegate, since the operand can be a BigInt JSC_DEFINE_JIT_OPERATION(operationArithNegate, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOperand)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue operand = JSValue::decode(encodedOperand); JSValue primValue = operand.toPrimitive(globalObject, PreferNumber); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); #if USE(BIGINT32) if (primValue.isBigInt32()) OPERATION_RETURN(scope, JSValue::encode(JSBigInt::unaryMinus(globalObject, primValue.bigInt32AsInt32()))); #endif if (primValue.isHeapBigInt()) OPERATION_RETURN(scope, JSValue::encode(JSBigInt::unaryMinus(globalObject, primValue.asHeapBigInt()))); double number = primValue.toNumber(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); OPERATION_RETURN(scope, JSValue::encode(jsNumber(-number))); } // FIXME: it would be better to call those operationValueNegate, since the operand can be a BigInt JSC_DEFINE_JIT_OPERATION(operationArithNegateProfiled, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOperand, UnaryArithProfile* arithProfile)) { ASSERT(arithProfile); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue operand = JSValue::decode(encodedOperand); arithProfile->observeArg(operand); JSValue primValue = operand.toPrimitive(globalObject, PreferNumber); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); #if USE(BIGINT32) if (primValue.isBigInt32()) { JSValue result = JSBigInt::unaryMinus(globalObject, primValue.bigInt32AsInt32()); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); arithProfile->observeResult(result); OPERATION_RETURN(scope, JSValue::encode(result)); } #endif if (primValue.isHeapBigInt()) { JSValue result = JSBigInt::unaryMinus(globalObject, primValue.asHeapBigInt()); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); arithProfile->observeResult(result); OPERATION_RETURN(scope, JSValue::encode(result)); } double number = primValue.toNumber(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); JSValue result = jsNumber(-number); arithProfile->observeResult(result); OPERATION_RETURN(scope, JSValue::encode(result)); } // FIXME: it would be better to call those operationValueNegate, since the operand can be a BigInt JSC_DEFINE_JIT_OPERATION(operationArithNegateProfiledOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOperand, JITNegIC* negIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue operand = JSValue::decode(encodedOperand); UnaryArithProfile* arithProfile = negIC->arithProfile(); ASSERT(arithProfile); arithProfile->observeArg(operand); negIC->generateOutOfLine(callFrame->codeBlock(), operationArithNegateProfiled); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif JSValue primValue = operand.toPrimitive(globalObject, PreferNumber); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); #if USE(BIGINT32) if (primValue.isBigInt32()) { JSValue result = JSBigInt::unaryMinus(globalObject, primValue.bigInt32AsInt32()); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); arithProfile->observeResult(result); OPERATION_RETURN(scope, JSValue::encode(result)); } #endif if (primValue.isHeapBigInt()) { JSValue result = JSBigInt::unaryMinus(globalObject, primValue.asHeapBigInt()); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); arithProfile->observeResult(result); OPERATION_RETURN(scope, JSValue::encode(result)); } double number = primValue.toNumber(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); JSValue result = jsNumber(-number); arithProfile->observeResult(result); OPERATION_RETURN(scope, JSValue::encode(result)); } // FIXME: it would be better to call those operationValueNegate, since the operand can be a BigInt JSC_DEFINE_JIT_OPERATION(operationArithNegateOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOperand, JITNegIC* negIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); JSValue operand = JSValue::decode(encodedOperand); if (UnaryArithProfile* arithProfile = negIC->arithProfile()) arithProfile->observeArg(operand); negIC->generateOutOfLine(callFrame->codeBlock(), operationArithNegate); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif JSValue primValue = operand.toPrimitive(globalObject, PreferNumber); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); #if USE(BIGINT32) // FIXME: why does this function profile the argument but not the result? if (primValue.isBigInt32()) OPERATION_RETURN(scope, JSValue::encode(JSBigInt::unaryMinus(globalObject, primValue.bigInt32AsInt32()))); #endif if (primValue.isHeapBigInt()) OPERATION_RETURN(scope, JSValue::encode(JSBigInt::unaryMinus(globalObject, primValue.asHeapBigInt()))); double number = primValue.toNumber(globalObject); OPERATION_RETURN_IF_EXCEPTION(scope, encodedJSValue()); OPERATION_RETURN(scope, JSValue::encode(jsNumber(-number))); } ALWAYS_INLINE static EncodedJSValue unprofiledSub(JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2) { JSValue op1 = JSValue::decode(encodedOp1); JSValue op2 = JSValue::decode(encodedOp2); return JSValue::encode(jsSub(globalObject, op1, op2)); } ALWAYS_INLINE static EncodedJSValue profiledSub(VM& vm, JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, BinaryArithProfile& arithProfile, bool shouldObserveLHSAndRHSTypes = true) { auto scope = DECLARE_THROW_SCOPE(vm); JSValue op1 = JSValue::decode(encodedOp1); JSValue op2 = JSValue::decode(encodedOp2); if (shouldObserveLHSAndRHSTypes) arithProfile.observeLHSAndRHS(op1, op2); JSValue result = jsSub(globalObject, op1, op2); RETURN_IF_EXCEPTION(scope, encodedJSValue()); arithProfile.observeResult(result); return JSValue::encode(result); } JSC_DEFINE_JIT_OPERATION(operationValueSub, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, unprofiledSub(globalObject, encodedOp1, encodedOp2)); } JSC_DEFINE_JIT_OPERATION(operationValueSubProfiled, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, BinaryArithProfile* arithProfile)) { ASSERT(arithProfile); VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, profiledSub(vm, globalObject, encodedOp1, encodedOp2, *arithProfile)); } JSC_DEFINE_JIT_OPERATION(operationValueSubOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); auto nonOptimizeVariant = operationValueSubNoOptimize; if (BinaryArithProfile* arithProfile = subIC->arithProfile()) arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2)); subIC->generateOutOfLine(callFrame->codeBlock(), nonOptimizeVariant); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif OPERATION_RETURN(scope, unprofiledSub(globalObject, encodedOp1, encodedOp2)); } JSC_DEFINE_JIT_OPERATION(operationValueSubNoOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC*)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); OPERATION_RETURN(scope, unprofiledSub(globalObject, encodedOp1, encodedOp2)); } JSC_DEFINE_JIT_OPERATION(operationValueSubProfiledOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); BinaryArithProfile* arithProfile = subIC->arithProfile(); ASSERT(arithProfile); arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2)); auto nonOptimizeVariant = operationValueSubProfiledNoOptimize; subIC->generateOutOfLine(callFrame->codeBlock(), nonOptimizeVariant); #if ENABLE(MATH_IC_STATS) callFrame->codeBlock()->dumpMathICStats(); #endif OPERATION_RETURN(scope, profiledSub(vm, globalObject, encodedOp1, encodedOp2, *arithProfile, false)); } JSC_DEFINE_JIT_OPERATION(operationValueSubProfiledNoOptimize, EncodedJSValue, (JSGlobalObject* globalObject, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)) { VM& vm = globalObject->vm(); CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); BinaryArithProfile* arithProfile = subIC->arithProfile(); ASSERT(arithProfile); OPERATION_RETURN(scope, profiledSub(vm, globalObject, encodedOp1, encodedOp2, *arithProfile)); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationDebuggerWillCallNativeExecutable, void, (CallFrame* callFrame)) { ASSERT(!callFrame->isNativeCalleeFrame()); auto* globalObject = callFrame->jsCallee()->realm(); if (!globalObject) return; auto* debugger = globalObject->debugger(); if (!debugger) return; debugger->willCallNativeExecutable(callFrame); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationProcessTypeProfilerLog, void, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); vm.typeProfilerLog()->processLogEntries(vm, "Log Full, called from inside baseline JIT"_s); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationProcessShadowChickenLog, void, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); RELEASE_ASSERT(vm.shadowChicken()); vm.shadowChicken()->update(vm, callFrame); } JSC_DEFINE_NOEXCEPT_JIT_OPERATION(operationRetrieveAndClearExceptionIfCatchable, JSCell*, (VM* vmPointer)) { VM& vm = *vmPointer; CallFrame* callFrame = DECLARE_CALL_FRAME(vm); JITOperationPrologueCallFrameTracer tracer(vm, callFrame); auto scope = DECLARE_THROW_SCOPE(vm); RELEASE_ASSERT(!!scope.exception()); Exception* exception = scope.exception(); // We want to clear the exception here rather than in the catch prologue // JIT code because clearing it also entails clearing a bit in an Atomic // bit field in VMTraps. if (!scope.tryClearException()) [[unlikely]] { genericUnwind(vm, callFrame); return nullptr; } return exception; } } // namespace JSC IGNORE_WARNINGS_END #endif // ENABLE(JIT) WTF_ALLOW_UNSAFE_BUFFER_USAGE_END