Source/JavaScriptCore/jit/JITOperations.cpp

   1 /*
   2  * Copyright (C) 2013-2017 Apple Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  * 1. Redistributions of source code must retain the above copyright
   8  *    notice, this list of conditions and the following disclaimer.
   9  * 2. Redistributions in binary form must reproduce the above copyright
  10  *    notice, this list of conditions and the following disclaimer in the
  11  *    documentation and/or other materials provided with the distribution.
  12  *
  13  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  14  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  16  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  17  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  18  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  19  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  20  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  21  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include "config.h"
  27 #include "JITOperations.h"
  28
  29 #if ENABLE(JIT)
  30
  31 #include "ArithProfile.h"
  32 #include "ArrayConstructor.h"
  33 #include "CommonSlowPaths.h"
  34 #include "DFGCompilationMode.h"
  35 #include "DFGDriver.h"
  36 #include "DFGOSREntry.h"
  37 #include "DFGThunks.h"
  38 #include "DFGWorklist.h"
  39 #include "Debugger.h"
  40 #include "DirectArguments.h"
  41 #include "Error.h"
  42 #include "ErrorHandlingScope.h"
  43 #include "EvalCodeBlock.h"
  44 #include "ExceptionFuzz.h"
  45 #include "FTLOSREntry.h"
  46 #include "FrameTracers.h"
  47 #include "FunctionCodeBlock.h"
  48 #include "GetterSetter.h"
  49 #include "HostCallReturnValue.h"
  50 #include "ICStats.h"
  51 #include "Interpreter.h"
  52 #include "JIT.h"
  53 #include "JITExceptions.h"
  54 #include "JITToDFGDeferredCompilationCallback.h"
  55 #include "JSAsyncFunction.h"
  56 #include "JSAsyncGeneratorFunction.h"
  57 #include "JSCInlines.h"
  58 #include "JSGeneratorFunction.h"
  59 #include "JSGlobalObjectFunctions.h"
  60 #include "JSLexicalEnvironment.h"
  61 #include "JSPropertyNameEnumerator.h"
  62 #include "JSWithScope.h"
  63 #include "ModuleProgramCodeBlock.h"
  64 #include "ObjectConstructor.h"
  65 #include "PolymorphicAccess.h"
  66 #include "ProgramCodeBlock.h"
  67 #include "PropertyName.h"
  68 #include "RegExpObject.h"
  69 #include "Repatch.h"
  70 #include "ScopedArguments.h"
  71 #include "ShadowChicken.h"
  72 #include "StructureStubInfo.h"
  73 #include "SuperSampler.h"
  74 #include "TestRunnerUtils.h"
  75 #include "ThunkGenerators.h"
  76 #include "TypeProfilerLog.h"
  77 #include "VMInlines.h"
  78 #include <wtf/InlineASM.h>
  79
  80 namespace JSC {
  81
  82 extern "C" {
  83
  84 #if COMPILER(MSVC)
  85 void * _ReturnAddress(void);
  86 #pragma intrinsic(_ReturnAddress)
  87
  88 #define OUR_RETURN_ADDRESS _ReturnAddress()
  89 #else
  90 #define OUR_RETURN_ADDRESS __builtin_return_address(0)
  91 #endif
  92
  93 #if ENABLE(OPCODE_SAMPLING)
  94 #define CTI_SAMPLER vm->interpreter->sampler()
  95 #else
  96 #define CTI_SAMPLER 0
  97 #endif
  98
  99
 100 void JIT_OPERATION operationThrowStackOverflowError(ExecState* exec, CodeBlock* codeBlock)
 101 {
 102     // We pass in our own code block, because the callframe hasn't been populated.
 103     VM* vm = codeBlock->vm();
 104     auto scope = DECLARE_THROW_SCOPE(*vm);
 105
 106     EntryFrame* entryFrame = vm->topEntryFrame;
 107     CallFrame* callerFrame = exec->callerFrame(entryFrame);
 108     if (!callerFrame) {
 109         callerFrame = exec;
 110         entryFrame = vm->topEntryFrame;
 111     }
 112
 113     NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
 114     throwStackOverflowError(callerFrame, scope);
 115 }
 116
 117 #if ENABLE(WEBASSEMBLY)
 118 void JIT_OPERATION operationThrowDivideError(ExecState* exec)
 119 {
 120     VM* vm = &exec->vm();
 121     auto scope = DECLARE_THROW_SCOPE(*vm);
 122
 123     EntryFrame* entryFrame = vm->topEntryFrame;
 124     CallFrame* callerFrame = exec->callerFrame(entryFrame);
 125
 126     NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
 127     ErrorHandlingScope errorScope(*vm);
 128     throwException(callerFrame, scope, createError(callerFrame, ASCIILiteral("Division by zero or division overflow.")));
 129 }
 130
 131 void JIT_OPERATION operationThrowOutOfBoundsAccessError(ExecState* exec)
 132 {
 133     VM* vm = &exec->vm();
 134     auto scope = DECLARE_THROW_SCOPE(*vm);
 135
 136     EntryFrame* entryFrame = vm->topEntryFrame;
 137     CallFrame* callerFrame = exec->callerFrame(entryFrame);
 138
 139     NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
 140     ErrorHandlingScope errorScope(*vm);
 141     throwException(callerFrame, scope, createError(callerFrame, ASCIILiteral("Out-of-bounds access.")));
 142 }
 143 #endif
 144
 145 int32_t JIT_OPERATION operationCallArityCheck(ExecState* exec)
 146 {
 147     VM* vm = &exec->vm();
 148     auto scope = DECLARE_THROW_SCOPE(*vm);
 149
 150     int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForCall);
 151     if (missingArgCount < 0) {
 152         EntryFrame* entryFrame = vm->topEntryFrame;
 153         CallFrame* callerFrame = exec->callerFrame(entryFrame);
 154         NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
 155         throwStackOverflowError(callerFrame, scope);
 156     }
 157
 158     return missingArgCount;
 159 }
 160
 161 int32_t JIT_OPERATION operationConstructArityCheck(ExecState* exec)
 162 {
 163     VM* vm = &exec->vm();
 164     auto scope = DECLARE_THROW_SCOPE(*vm);
 165
 166     int32_t missingArgCount = CommonSlowPaths::arityCheckFor(exec, *vm, CodeForConstruct);
 167     if (missingArgCount < 0) {
 168         EntryFrame* entryFrame = vm->topEntryFrame;
 169         CallFrame* callerFrame = exec->callerFrame(entryFrame);
 170         NativeCallFrameTracerWithRestore tracer(vm, entryFrame, callerFrame);
 171         throwStackOverflowError(callerFrame, scope);
 172     }
 173
 174     return missingArgCount;
 175 }
 176
 177 EncodedJSValue JIT_OPERATION operationTryGetById(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
 178 {
 179     VM* vm = &exec->vm();
 180     NativeCallFrameTracer tracer(vm, exec);
 181     Identifier ident = Identifier::fromUid(vm, uid);
 182     stubInfo->tookSlowPath = true;
 183
 184     JSValue baseValue = JSValue::decode(base);
 185     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
 186     baseValue.getPropertySlot(exec, ident, slot);
 187
 188     return JSValue::encode(slot.getPureResult());
 189 }
 190
 191
 192 EncodedJSValue JIT_OPERATION operationTryGetByIdGeneric(ExecState* exec, EncodedJSValue base, UniquedStringImpl* uid)
 193 {
 194     VM* vm = &exec->vm();
 195     NativeCallFrameTracer tracer(vm, exec);
 196     Identifier ident = Identifier::fromUid(vm, uid);
 197
 198     JSValue baseValue = JSValue::decode(base);
 199     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
 200     baseValue.getPropertySlot(exec, ident, slot);
 201
 202     return JSValue::encode(slot.getPureResult());
 203 }
 204
 205 EncodedJSValue JIT_OPERATION operationTryGetByIdOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
 206 {
 207     VM* vm = &exec->vm();
 208     NativeCallFrameTracer tracer(vm, exec);
 209     auto scope = DECLARE_THROW_SCOPE(*vm);
 210     Identifier ident = Identifier::fromUid(vm, uid);
 211
 212     JSValue baseValue = JSValue::decode(base);
 213     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::VMInquiry);
 214
 215     baseValue.getPropertySlot(exec, ident, slot);
 216     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 217
 218     if (stubInfo->considerCaching(exec->codeBlock(), baseValue.structureOrNull()) && !slot.isTaintedByOpaqueObject() && (slot.isCacheableValue() || slot.isCacheableGetter() || slot.isUnset()))
 219         repatchGetByID(exec, baseValue, ident, slot, *stubInfo, GetByIDKind::Try);
 220
 221     return JSValue::encode(slot.getPureResult());
 222 }
 223
 224 EncodedJSValue JIT_OPERATION operationGetById(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
 225 {
 226     SuperSamplerScope superSamplerScope(false);
 227
 228     VM* vm = &exec->vm();
 229     NativeCallFrameTracer tracer(vm, exec);
 230
 231     stubInfo->tookSlowPath = true;
 232
 233     JSValue baseValue = JSValue::decode(base);
 234     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
 235     Identifier ident = Identifier::fromUid(vm, uid);
 236
 237     LOG_IC((ICEvent::OperationGetById, baseValue.classInfoOrNull(*vm), ident));
 238     return JSValue::encode(baseValue.get(exec, ident, slot));
 239 }
 240
 241 EncodedJSValue JIT_OPERATION operationGetByIdGeneric(ExecState* exec, EncodedJSValue base, UniquedStringImpl* uid)
 242 {
 243     SuperSamplerScope superSamplerScope(false);
 244
 245     VM* vm = &exec->vm();
 246     NativeCallFrameTracer tracer(vm, exec);
 247
 248     JSValue baseValue = JSValue::decode(base);
 249     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
 250     Identifier ident = Identifier::fromUid(vm, uid);
 251     LOG_IC((ICEvent::OperationGetByIdGeneric, baseValue.classInfoOrNull(*vm), ident));
 252     return JSValue::encode(baseValue.get(exec, ident, slot));
 253 }
 254
 255 EncodedJSValue JIT_OPERATION operationGetByIdOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, UniquedStringImpl* uid)
 256 {
 257     SuperSamplerScope superSamplerScope(false);
 258
 259     VM* vm = &exec->vm();
 260     NativeCallFrameTracer tracer(vm, exec);
 261     Identifier ident = Identifier::fromUid(vm, uid);
 262
 263     JSValue baseValue = JSValue::decode(base);
 264     LOG_IC((ICEvent::OperationGetByIdOptimize, baseValue.classInfoOrNull(*vm), ident));
 265
 266     return JSValue::encode(baseValue.getPropertySlot(exec, ident, [&] (bool found, PropertySlot& slot) -> JSValue {
 267         if (stubInfo->considerCaching(exec->codeBlock(), baseValue.structureOrNull()))
 268             repatchGetByID(exec, baseValue, ident, slot, *stubInfo, GetByIDKind::Normal);
 269         return found ? slot.getValue(exec, ident) : jsUndefined();
 270     }));
 271 }
 272
 273 EncodedJSValue JIT_OPERATION operationGetByIdWithThisGeneric(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, EncodedJSValue thisEncoded, UniquedStringImpl* uid)
 274 {
 275     SuperSamplerScope superSamplerScope(false);
 276
 277     VM* vm = &exec->vm();
 278     NativeCallFrameTracer tracer(vm, exec);
 279     Identifier ident = Identifier::fromUid(vm, uid);
 280
 281     stubInfo->tookSlowPath = true;
 282
 283     JSValue baseValue = JSValue::decode(base);
 284     JSValue thisValue = JSValue::decode(thisEncoded);
 285     PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get);
 286
 287     return JSValue::encode(baseValue.get(exec, ident, slot));
 288 }
 289
 290 EncodedJSValue JIT_OPERATION operationGetByIdWithThisOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue base, EncodedJSValue thisEncoded, UniquedStringImpl* uid)
 291 {
 292     SuperSamplerScope superSamplerScope(false);
 293
 294     VM* vm = &exec->vm();
 295     NativeCallFrameTracer tracer(vm, exec);
 296     Identifier ident = Identifier::fromUid(vm, uid);
 297
 298     JSValue baseValue = JSValue::decode(base);
 299     JSValue thisValue = JSValue::decode(thisEncoded);
 300     LOG_IC((ICEvent::OperationGetByIdWithThisOptimize, baseValue.classInfoOrNull(*vm), ident));
 301
 302     PropertySlot slot(thisValue, PropertySlot::InternalMethodType::Get);
 303     return JSValue::encode(baseValue.getPropertySlot(exec, ident, slot, [&] (bool found, PropertySlot& slot) -> JSValue {
 304         if (stubInfo->considerCaching(exec->codeBlock(), baseValue.structureOrNull()))
 305             repatchGetByID(exec, baseValue, ident, slot, *stubInfo, GetByIDKind::WithThis);
 306         return found ? slot.getValue(exec, ident) : jsUndefined();
 307     }));
 308 }
 309
 310 EncodedJSValue JIT_OPERATION operationInOptimize(ExecState* exec, StructureStubInfo* stubInfo, JSCell* base, UniquedStringImpl* key)
 311 {
 312     SuperSamplerScope superSamplerScope(false);
 313
 314     VM* vm = &exec->vm();
 315     NativeCallFrameTracer tracer(vm, exec);
 316     auto scope = DECLARE_THROW_SCOPE(*vm);
 317
 318     if (!base->isObject()) {
 319         throwException(exec, scope, createInvalidInParameterError(exec, base));
 320         return JSValue::encode(jsUndefined());
 321     }
 322
 323     AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
 324
 325     Identifier ident = Identifier::fromUid(vm, key);
 326     LOG_IC((ICEvent::OperationInOptimize, base->classInfo(*vm), ident));
 327     PropertySlot slot(base, PropertySlot::InternalMethodType::HasProperty);
 328     bool result = asObject(base)->getPropertySlot(exec, ident, slot);
 329     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 330
 331     RELEASE_ASSERT(accessType == stubInfo->accessType);
 332
 333     if (stubInfo->considerCaching(exec->codeBlock(), asObject(base)->structure()))
 334         repatchIn(exec, base, ident, result, slot, *stubInfo);
 335
 336     return JSValue::encode(jsBoolean(result));
 337 }
 338
 339 EncodedJSValue JIT_OPERATION operationIn(ExecState* exec, StructureStubInfo* stubInfo, JSCell* base, UniquedStringImpl* key)
 340 {
 341     SuperSamplerScope superSamplerScope(false);
 342
 343     VM* vm = &exec->vm();
 344     NativeCallFrameTracer tracer(vm, exec);
 345     auto scope = DECLARE_THROW_SCOPE(*vm);
 346
 347     stubInfo->tookSlowPath = true;
 348
 349     if (!base->isObject()) {
 350         throwException(exec, scope, createInvalidInParameterError(exec, base));
 351         return JSValue::encode(jsUndefined());
 352     }
 353
 354     Identifier ident = Identifier::fromUid(vm, key);
 355     LOG_IC((ICEvent::OperationIn, base->classInfo(*vm), ident));
 356     scope.release();
 357     return JSValue::encode(jsBoolean(asObject(base)->hasProperty(exec, ident)));
 358 }
 359
 360 EncodedJSValue JIT_OPERATION operationGenericIn(ExecState* exec, JSCell* base, EncodedJSValue key)
 361 {
 362     SuperSamplerScope superSamplerScope(false);
 363
 364     VM* vm = &exec->vm();
 365     NativeCallFrameTracer tracer(vm, exec);
 366
 367     return JSValue::encode(jsBoolean(CommonSlowPaths::opIn(exec, base, JSValue::decode(key))));
 368 }
 369
 370 void JIT_OPERATION operationPutByIdStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 371 {
 372     SuperSamplerScope superSamplerScope(false);
 373
 374     VM* vm = &exec->vm();
 375     NativeCallFrameTracer tracer(vm, exec);
 376
 377     stubInfo->tookSlowPath = true;
 378
 379     JSValue baseValue = JSValue::decode(encodedBase);
 380     Identifier ident = Identifier::fromUid(vm, uid);
 381     LOG_IC((ICEvent::OperationPutByIdStrict, baseValue.classInfoOrNull(*vm), ident));
 382
 383     PutPropertySlot slot(baseValue, true, exec->codeBlock()->putByIdContext());
 384     baseValue.putInline(exec, ident, JSValue::decode(encodedValue), slot);
 385 }
 386
 387 void JIT_OPERATION operationPutByIdNonStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 388 {
 389     SuperSamplerScope superSamplerScope(false);
 390
 391     VM* vm = &exec->vm();
 392     NativeCallFrameTracer tracer(vm, exec);
 393
 394     stubInfo->tookSlowPath = true;
 395
 396     JSValue baseValue = JSValue::decode(encodedBase);
 397     Identifier ident = Identifier::fromUid(vm, uid);
 398     LOG_IC((ICEvent::OperationPutByIdNonStrict, baseValue.classInfoOrNull(*vm), ident));
 399     PutPropertySlot slot(baseValue, false, exec->codeBlock()->putByIdContext());
 400     baseValue.putInline(exec, ident, JSValue::decode(encodedValue), slot);
 401 }
 402
 403 void JIT_OPERATION operationPutByIdDirectStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 404 {
 405     SuperSamplerScope superSamplerScope(false);
 406
 407     VM* vm = &exec->vm();
 408     NativeCallFrameTracer tracer(vm, exec);
 409
 410     stubInfo->tookSlowPath = true;
 411
 412     JSValue baseValue = JSValue::decode(encodedBase);
 413     Identifier ident = Identifier::fromUid(vm, uid);
 414     LOG_IC((ICEvent::OperationPutByIdDirectStrict, baseValue.classInfoOrNull(*vm), ident));
 415     PutPropertySlot slot(baseValue, true, exec->codeBlock()->putByIdContext());
 416     asObject(baseValue)->putDirect(*vm, ident, JSValue::decode(encodedValue), slot);
 417 }
 418
 419 void JIT_OPERATION operationPutByIdDirectNonStrict(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 420 {
 421     SuperSamplerScope superSamplerScope(false);
 422
 423     VM* vm = &exec->vm();
 424     NativeCallFrameTracer tracer(vm, exec);
 425
 426     stubInfo->tookSlowPath = true;
 427
 428     JSValue baseValue = JSValue::decode(encodedBase);
 429     Identifier ident = Identifier::fromUid(vm, uid);
 430     LOG_IC((ICEvent::OperationPutByIdDirectNonStrict, baseValue.classInfoOrNull(*vm), ident));
 431     PutPropertySlot slot(baseValue, false, exec->codeBlock()->putByIdContext());
 432     asObject(baseValue)->putDirect(*vm, ident, JSValue::decode(encodedValue), slot);
 433 }
 434
 435 void JIT_OPERATION operationPutByIdStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 436 {
 437     SuperSamplerScope superSamplerScope(false);
 438
 439     VM* vm = &exec->vm();
 440     NativeCallFrameTracer tracer(vm, exec);
 441     auto scope = DECLARE_THROW_SCOPE(*vm);
 442
 443     Identifier ident = Identifier::fromUid(vm, uid);
 444     AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
 445
 446     JSValue value = JSValue::decode(encodedValue);
 447     JSValue baseValue = JSValue::decode(encodedBase);
 448     LOG_IC((ICEvent::OperationPutByIdStrictOptimize, baseValue.classInfoOrNull(*vm), ident));
 449     CodeBlock* codeBlock = exec->codeBlock();
 450     PutPropertySlot slot(baseValue, true, codeBlock->putByIdContext());
 451
 452     Structure* structure = baseValue.isCell() ? baseValue.asCell()->structure(*vm) : nullptr;
 453     baseValue.putInline(exec, ident, value, slot);
 454     RETURN_IF_EXCEPTION(scope, void());
 455
 456     if (accessType != static_cast<AccessType>(stubInfo->accessType))
 457         return;
 458
 459     if (stubInfo->considerCaching(codeBlock, structure))
 460         repatchPutByID(exec, baseValue, structure, ident, slot, *stubInfo, NotDirect);
 461 }
 462
 463 void JIT_OPERATION operationPutByIdNonStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 464 {
 465     SuperSamplerScope superSamplerScope(false);
 466
 467     VM* vm = &exec->vm();
 468     NativeCallFrameTracer tracer(vm, exec);
 469     auto scope = DECLARE_THROW_SCOPE(*vm);
 470
 471     Identifier ident = Identifier::fromUid(vm, uid);
 472     AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
 473
 474     JSValue value = JSValue::decode(encodedValue);
 475     JSValue baseValue = JSValue::decode(encodedBase);
 476     LOG_IC((ICEvent::OperationPutByIdNonStrictOptimize, baseValue.classInfoOrNull(*vm), ident));
 477     CodeBlock* codeBlock = exec->codeBlock();
 478     PutPropertySlot slot(baseValue, false, codeBlock->putByIdContext());
 479
 480     Structure* structure = baseValue.isCell() ? baseValue.asCell()->structure(*vm) : nullptr;
 481     baseValue.putInline(exec, ident, value, slot);
 482     RETURN_IF_EXCEPTION(scope, void());
 483
 484     if (accessType != static_cast<AccessType>(stubInfo->accessType))
 485         return;
 486
 487     if (stubInfo->considerCaching(codeBlock, structure))
 488         repatchPutByID(exec, baseValue, structure, ident, slot, *stubInfo, NotDirect);
 489 }
 490
 491 void JIT_OPERATION operationPutByIdDirectStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 492 {
 493     SuperSamplerScope superSamplerScope(false);
 494
 495     VM* vm = &exec->vm();
 496     NativeCallFrameTracer tracer(vm, exec);
 497
 498     Identifier ident = Identifier::fromUid(vm, uid);
 499     AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
 500
 501     JSValue value = JSValue::decode(encodedValue);
 502     JSObject* baseObject = asObject(JSValue::decode(encodedBase));
 503     LOG_IC((ICEvent::OperationPutByIdDirectStrictOptimize, baseObject->classInfo(*vm), ident));
 504     CodeBlock* codeBlock = exec->codeBlock();
 505     PutPropertySlot slot(baseObject, true, codeBlock->putByIdContext());
 506
 507     Structure* structure = baseObject->structure(*vm);
 508     baseObject->putDirect(*vm, ident, value, slot);
 509
 510     if (accessType != static_cast<AccessType>(stubInfo->accessType))
 511         return;
 512
 513     if (stubInfo->considerCaching(codeBlock, structure))
 514         repatchPutByID(exec, baseObject, structure, ident, slot, *stubInfo, Direct);
 515 }
 516
 517 void JIT_OPERATION operationPutByIdDirectNonStrictOptimize(ExecState* exec, StructureStubInfo* stubInfo, EncodedJSValue encodedValue, EncodedJSValue encodedBase, UniquedStringImpl* uid)
 518 {
 519     SuperSamplerScope superSamplerScope(false);
 520
 521     VM* vm = &exec->vm();
 522     NativeCallFrameTracer tracer(vm, exec);
 523
 524     Identifier ident = Identifier::fromUid(vm, uid);
 525     AccessType accessType = static_cast<AccessType>(stubInfo->accessType);
 526
 527     JSValue value = JSValue::decode(encodedValue);
 528     JSObject* baseObject = asObject(JSValue::decode(encodedBase));
 529     LOG_IC((ICEvent::OperationPutByIdDirectNonStrictOptimize, baseObject->classInfo(*vm), ident));
 530     CodeBlock* codeBlock = exec->codeBlock();
 531     PutPropertySlot slot(baseObject, false, codeBlock->putByIdContext());
 532
 533     Structure* structure = baseObject->structure(*vm);
 534     baseObject->putDirect(*vm, ident, value, slot);
 535
 536     if (accessType != static_cast<AccessType>(stubInfo->accessType))
 537         return;
 538
 539     if (stubInfo->considerCaching(codeBlock, structure))
 540         repatchPutByID(exec, baseObject, structure, ident, slot, *stubInfo, Direct);
 541 }
 542
 543 ALWAYS_INLINE static bool isStringOrSymbol(JSValue value)
 544 {
 545     return value.isString() || value.isSymbol();
 546 }
 547
 548 static void putByVal(CallFrame* callFrame, JSValue baseValue, JSValue subscript, JSValue value, ByValInfo* byValInfo)
 549 {
 550     VM& vm = callFrame->vm();
 551     auto scope = DECLARE_THROW_SCOPE(vm);
 552     if (LIKELY(subscript.isUInt32())) {
 553         byValInfo->tookSlowPath = true;
 554         uint32_t i = subscript.asUInt32();
 555         if (baseValue.isObject()) {
 556             JSObject* object = asObject(baseValue);
 557             if (object->canSetIndexQuickly(i)) {
 558                 object->setIndexQuickly(vm, i, value);
 559                 return;
 560             }
 561
 562             // FIXME: This will make us think that in-bounds typed array accesses are actually
 563             // out-of-bounds.
 564             // https://bugs.webkit.org/show_bug.cgi?id=149886
 565             byValInfo->arrayProfile->setOutOfBounds();
 566             scope.release();
 567             object->methodTable(vm)->putByIndex(object, callFrame, i, value, callFrame->codeBlock()->isStrictMode());
 568             return;
 569         }
 570
 571         scope.release();
 572         baseValue.putByIndex(callFrame, i, value, callFrame->codeBlock()->isStrictMode());
 573         return;
 574     }
 575
 576     auto property = subscript.toPropertyKey(callFrame);
 577     // Don't put to an object if toString threw an exception.
 578     RETURN_IF_EXCEPTION(scope, void());
 579
 580     if (byValInfo->stubInfo && (!isStringOrSymbol(subscript) || byValInfo->cachedId != property))
 581         byValInfo->tookSlowPath = true;
 582
 583     scope.release();
 584     PutPropertySlot slot(baseValue, callFrame->codeBlock()->isStrictMode());
 585     baseValue.putInline(callFrame, property, value, slot);
 586 }
 587
 588 static void directPutByVal(CallFrame* callFrame, JSObject* baseObject, JSValue subscript, JSValue value, ByValInfo* byValInfo)
 589 {
 590     VM& vm = callFrame->vm();
 591     auto scope = DECLARE_THROW_SCOPE(vm);
 592     bool isStrictMode = callFrame->codeBlock()->isStrictMode();
 593     if (LIKELY(subscript.isUInt32())) {
 594         // Despite its name, JSValue::isUInt32 will return true only for positive boxed int32_t; all those values are valid array indices.
 595         byValInfo->tookSlowPath = true;
 596         uint32_t index = subscript.asUInt32();
 597         ASSERT(isIndex(index));
 598
 599         switch (baseObject->indexingType()) {
 600         case ALL_INT32_INDEXING_TYPES:
 601         case ALL_DOUBLE_INDEXING_TYPES:
 602         case ALL_CONTIGUOUS_INDEXING_TYPES:
 603         case ALL_ARRAY_STORAGE_INDEXING_TYPES:
 604             if (index < baseObject->butterfly()->vectorLength())
 605                 break;
 606             FALLTHROUGH;
 607         default:
 608             byValInfo->arrayProfile->setOutOfBounds();
 609             break;
 610         }
 611
 612         scope.release();
 613         baseObject->putDirectIndex(callFrame, index, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
 614         return;
 615     }
 616
 617     if (subscript.isDouble()) {
 618         double subscriptAsDouble = subscript.asDouble();
 619         uint32_t subscriptAsUInt32 = static_cast<uint32_t>(subscriptAsDouble);
 620         if (subscriptAsDouble == subscriptAsUInt32 && isIndex(subscriptAsUInt32)) {
 621             byValInfo->tookSlowPath = true;
 622             scope.release();
 623             baseObject->putDirectIndex(callFrame, subscriptAsUInt32, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
 624             return;
 625         }
 626     }
 627
 628     // Don't put to an object if toString threw an exception.
 629     auto property = subscript.toPropertyKey(callFrame);
 630     RETURN_IF_EXCEPTION(scope, void());
 631
 632     if (std::optional<uint32_t> index = parseIndex(property)) {
 633         byValInfo->tookSlowPath = true;
 634         scope.release();
 635         baseObject->putDirectIndex(callFrame, index.value(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
 636         return;
 637     }
 638
 639     if (byValInfo->stubInfo && (!isStringOrSymbol(subscript) || byValInfo->cachedId != property))
 640         byValInfo->tookSlowPath = true;
 641
 642     PutPropertySlot slot(baseObject, isStrictMode);
 643     baseObject->putDirect(vm, property, value, slot);
 644 }
 645
 646 enum class OptimizationResult {
 647     NotOptimized,
 648     SeenOnce,
 649     Optimized,
 650     GiveUp,
 651 };
 652
 653 static OptimizationResult tryPutByValOptimize(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
 654 {
 655     // See if it's worth optimizing at all.
 656     OptimizationResult optimizationResult = OptimizationResult::NotOptimized;
 657
 658     VM& vm = exec->vm();
 659
 660     if (baseValue.isObject() && subscript.isInt32()) {
 661         JSObject* object = asObject(baseValue);
 662
 663         ASSERT(exec->bytecodeOffset());
 664         ASSERT(!byValInfo->stubRoutine);
 665
 666         Structure* structure = object->structure(vm);
 667         if (hasOptimizableIndexing(structure)) {
 668             // Attempt to optimize.
 669             JITArrayMode arrayMode = jitArrayModeForStructure(structure);
 670             if (jitArrayModePermitsPut(arrayMode) && arrayMode != byValInfo->arrayMode) {
 671                 CodeBlock* codeBlock = exec->codeBlock();
 672                 ConcurrentJSLocker locker(codeBlock->m_lock);
 673                 byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
 674
 675                 JIT::compilePutByVal(&vm, codeBlock, byValInfo, returnAddress, arrayMode);
 676                 optimizationResult = OptimizationResult::Optimized;
 677             }
 678         }
 679
 680         // If we failed to patch and we have some object that intercepts indexed get, then don't even wait until 10 times.
 681         if (optimizationResult != OptimizationResult::Optimized && object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
 682             optimizationResult = OptimizationResult::GiveUp;
 683     }
 684
 685     if (baseValue.isObject() && isStringOrSymbol(subscript)) {
 686         const Identifier propertyName = subscript.toPropertyKey(exec);
 687         if (subscript.isSymbol() || !parseIndex(propertyName)) {
 688             ASSERT(exec->bytecodeOffset());
 689             ASSERT(!byValInfo->stubRoutine);
 690             if (byValInfo->seen) {
 691                 if (byValInfo->cachedId == propertyName) {
 692                     JIT::compilePutByValWithCachedId(&vm, exec->codeBlock(), byValInfo, returnAddress, NotDirect, propertyName);
 693                     optimizationResult = OptimizationResult::Optimized;
 694                 } else {
 695                     // Seem like a generic property access site.
 696                     optimizationResult = OptimizationResult::GiveUp;
 697                 }
 698             } else {
 699                 CodeBlock* codeBlock = exec->codeBlock();
 700                 ConcurrentJSLocker locker(codeBlock->m_lock);
 701                 byValInfo->seen = true;
 702                 byValInfo->cachedId = propertyName;
 703                 if (subscript.isSymbol())
 704                     byValInfo->cachedSymbol.set(vm, codeBlock, asSymbol(subscript));
 705                 optimizationResult = OptimizationResult::SeenOnce;
 706             }
 707         }
 708     }
 709
 710     if (optimizationResult != OptimizationResult::Optimized && optimizationResult != OptimizationResult::SeenOnce) {
 711         // If we take slow path more than 10 times without patching then make sure we
 712         // never make that mistake again. For cases where we see non-index-intercepting
 713         // objects, this gives 10 iterations worth of opportunity for us to observe
 714         // that the put_by_val may be polymorphic. We count up slowPathCount even if
 715         // the result is GiveUp.
 716         if (++byValInfo->slowPathCount >= 10)
 717             optimizationResult = OptimizationResult::GiveUp;
 718     }
 719
 720     return optimizationResult;
 721 }
 722
 723 void JIT_OPERATION operationPutByValOptimize(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
 724 {
 725     VM& vm = exec->vm();
 726     NativeCallFrameTracer tracer(&vm, exec);
 727
 728     JSValue baseValue = JSValue::decode(encodedBaseValue);
 729     JSValue subscript = JSValue::decode(encodedSubscript);
 730     JSValue value = JSValue::decode(encodedValue);
 731     if (tryPutByValOptimize(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS)) == OptimizationResult::GiveUp) {
 732         // Don't ever try to optimize.
 733         byValInfo->tookSlowPath = true;
 734         ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationPutByValGeneric));
 735     }
 736     putByVal(exec, baseValue, subscript, value, byValInfo);
 737 }
 738
 739 static OptimizationResult tryDirectPutByValOptimize(ExecState* exec, JSObject* object, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
 740 {
 741     // See if it's worth optimizing at all.
 742     OptimizationResult optimizationResult = OptimizationResult::NotOptimized;
 743
 744     VM& vm = exec->vm();
 745
 746     if (subscript.isInt32()) {
 747         ASSERT(exec->bytecodeOffset());
 748         ASSERT(!byValInfo->stubRoutine);
 749
 750         Structure* structure = object->structure(vm);
 751         if (hasOptimizableIndexing(structure)) {
 752             // Attempt to optimize.
 753             JITArrayMode arrayMode = jitArrayModeForStructure(structure);
 754             if (jitArrayModePermitsPutDirect(arrayMode) && arrayMode != byValInfo->arrayMode) {
 755                 CodeBlock* codeBlock = exec->codeBlock();
 756                 ConcurrentJSLocker locker(codeBlock->m_lock);
 757                 byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
 758
 759                 JIT::compileDirectPutByVal(&vm, codeBlock, byValInfo, returnAddress, arrayMode);
 760                 optimizationResult = OptimizationResult::Optimized;
 761             }
 762         }
 763
 764         // If we failed to patch and we have some object that intercepts indexed get, then don't even wait until 10 times.
 765         if (optimizationResult != OptimizationResult::Optimized && object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
 766             optimizationResult = OptimizationResult::GiveUp;
 767     } else if (isStringOrSymbol(subscript)) {
 768         const Identifier propertyName = subscript.toPropertyKey(exec);
 769         if (subscript.isSymbol() || !parseIndex(propertyName)) {
 770             ASSERT(exec->bytecodeOffset());
 771             ASSERT(!byValInfo->stubRoutine);
 772             if (byValInfo->seen) {
 773                 if (byValInfo->cachedId == propertyName) {
 774                     JIT::compilePutByValWithCachedId(&vm, exec->codeBlock(), byValInfo, returnAddress, Direct, propertyName);
 775                     optimizationResult = OptimizationResult::Optimized;
 776                 } else {
 777                     // Seem like a generic property access site.
 778                     optimizationResult = OptimizationResult::GiveUp;
 779                 }
 780             } else {
 781                 CodeBlock* codeBlock = exec->codeBlock();
 782                 ConcurrentJSLocker locker(codeBlock->m_lock);
 783                 byValInfo->seen = true;
 784                 byValInfo->cachedId = propertyName;
 785                 if (subscript.isSymbol())
 786                     byValInfo->cachedSymbol.set(vm, codeBlock, asSymbol(subscript));
 787                 optimizationResult = OptimizationResult::SeenOnce;
 788             }
 789         }
 790     }
 791
 792     if (optimizationResult != OptimizationResult::Optimized && optimizationResult != OptimizationResult::SeenOnce) {
 793         // If we take slow path more than 10 times without patching then make sure we
 794         // never make that mistake again. For cases where we see non-index-intercepting
 795         // objects, this gives 10 iterations worth of opportunity for us to observe
 796         // that the get_by_val may be polymorphic. We count up slowPathCount even if
 797         // the result is GiveUp.
 798         if (++byValInfo->slowPathCount >= 10)
 799             optimizationResult = OptimizationResult::GiveUp;
 800     }
 801
 802     return optimizationResult;
 803 }
 804
 805 void JIT_OPERATION operationDirectPutByValOptimize(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
 806 {
 807     VM& vm = exec->vm();
 808     NativeCallFrameTracer tracer(&vm, exec);
 809
 810     JSValue baseValue = JSValue::decode(encodedBaseValue);
 811     JSValue subscript = JSValue::decode(encodedSubscript);
 812     JSValue value = JSValue::decode(encodedValue);
 813     RELEASE_ASSERT(baseValue.isObject());
 814     JSObject* object = asObject(baseValue);
 815     if (tryDirectPutByValOptimize(exec, object, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS)) == OptimizationResult::GiveUp) {
 816         // Don't ever try to optimize.
 817         byValInfo->tookSlowPath = true;
 818         ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationDirectPutByValGeneric));
 819     }
 820
 821     directPutByVal(exec, object, subscript, value, byValInfo);
 822 }
 823
 824 void JIT_OPERATION operationPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
 825 {
 826     VM& vm = exec->vm();
 827     NativeCallFrameTracer tracer(&vm, exec);
 828
 829     JSValue baseValue = JSValue::decode(encodedBaseValue);
 830     JSValue subscript = JSValue::decode(encodedSubscript);
 831     JSValue value = JSValue::decode(encodedValue);
 832
 833     putByVal(exec, baseValue, subscript, value, byValInfo);
 834 }
 835
 836
 837 void JIT_OPERATION operationDirectPutByValGeneric(ExecState* exec, EncodedJSValue encodedBaseValue, EncodedJSValue encodedSubscript, EncodedJSValue encodedValue, ByValInfo* byValInfo)
 838 {
 839     VM& vm = exec->vm();
 840     NativeCallFrameTracer tracer(&vm, exec);
 841
 842     JSValue baseValue = JSValue::decode(encodedBaseValue);
 843     JSValue subscript = JSValue::decode(encodedSubscript);
 844     JSValue value = JSValue::decode(encodedValue);
 845     RELEASE_ASSERT(baseValue.isObject());
 846     directPutByVal(exec, asObject(baseValue), subscript, value, byValInfo);
 847 }
 848
 849 EncodedJSValue JIT_OPERATION operationCallEval(ExecState* exec, ExecState* execCallee)
 850 {
 851     VM* vm = &exec->vm();
 852     auto scope = DECLARE_THROW_SCOPE(*vm);
 853
 854     execCallee->setCodeBlock(0);
 855
 856     if (!isHostFunction(execCallee->guaranteedJSValueCallee(), globalFuncEval))
 857         return JSValue::encode(JSValue());
 858
 859     JSValue result = eval(execCallee);
 860     RETURN_IF_EXCEPTION(scope, encodedJSValue());
 861
 862     return JSValue::encode(result);
 863 }
 864
 865 static SlowPathReturnType handleHostCall(ExecState* execCallee, JSValue callee, CallLinkInfo* callLinkInfo)
 866 {
 867     ExecState* exec = execCallee->callerFrame();
 868     VM* vm = &exec->vm();
 869     auto scope = DECLARE_THROW_SCOPE(*vm);
 870
 871     execCallee->setCodeBlock(0);
 872
 873     if (callLinkInfo->specializationKind() == CodeForCall) {
 874         CallData callData;
 875         CallType callType = getCallData(callee, callData);
 876
 877         ASSERT(callType != CallType::JS);
 878
 879         if (callType == CallType::Host) {
 880             NativeCallFrameTracer tracer(vm, execCallee);
 881             execCallee->setCallee(asObject(callee));
 882             vm->hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
 883             if (UNLIKELY(scope.exception())) {
 884                 return encodeResult(
 885                     vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
 886                     reinterpret_cast<void*>(KeepTheFrame));
 887             }
 888
 889             return encodeResult(
 890                 bitwise_cast<void*>(getHostCallReturnValue),
 891                 reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
 892         }
 893
 894         ASSERT(callType == CallType::None);
 895         throwException(exec, scope, createNotAFunctionError(exec, callee));
 896         return encodeResult(
 897             vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
 898             reinterpret_cast<void*>(KeepTheFrame));
 899     }
 900
 901     ASSERT(callLinkInfo->specializationKind() == CodeForConstruct);
 902
 903     ConstructData constructData;
 904     ConstructType constructType = getConstructData(callee, constructData);
 905
 906     ASSERT(constructType != ConstructType::JS);
 907
 908     if (constructType == ConstructType::Host) {
 909         NativeCallFrameTracer tracer(vm, execCallee);
 910         execCallee->setCallee(asObject(callee));
 911         vm->hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
 912         if (UNLIKELY(scope.exception())) {
 913             return encodeResult(
 914                 vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
 915                 reinterpret_cast<void*>(KeepTheFrame));
 916         }
 917
 918         return encodeResult(bitwise_cast<void*>(getHostCallReturnValue), reinterpret_cast<void*>(KeepTheFrame));
 919     }
 920
 921     ASSERT(constructType == ConstructType::None);
 922     throwException(exec, scope, createNotAConstructorError(exec, callee));
 923     return encodeResult(
 924         vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
 925         reinterpret_cast<void*>(KeepTheFrame));
 926 }
 927
 928 SlowPathReturnType JIT_OPERATION operationLinkCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
 929 {
 930     ExecState* exec = execCallee->callerFrame();
 931     VM* vm = &exec->vm();
 932     auto throwScope = DECLARE_THROW_SCOPE(*vm);
 933
 934     CodeSpecializationKind kind = callLinkInfo->specializationKind();
 935     NativeCallFrameTracer tracer(vm, exec);
 936
 937     RELEASE_ASSERT(!callLinkInfo->isDirect());
 938
 939     JSValue calleeAsValue = execCallee->guaranteedJSValueCallee();
 940     JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
 941     if (!calleeAsFunctionCell) {
 942         if (calleeAsValue.isCell() && calleeAsValue.asCell()->type() == InternalFunctionType) {
 943             MacroAssemblerCodePtr codePtr = vm->getCTIInternalFunctionTrampolineFor(kind);
 944             RELEASE_ASSERT(!!codePtr);
 945
 946             if (!callLinkInfo->seenOnce())
 947                 callLinkInfo->setSeen();
 948             else
 949                 linkFor(execCallee, *callLinkInfo, nullptr, asObject(calleeAsValue), codePtr);
 950
 951             return encodeResult(codePtr.executableAddress(), reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
 952         }
 953         throwScope.release();
 954         return handleHostCall(execCallee, calleeAsValue, callLinkInfo);
 955     }
 956
 957     JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
 958     JSScope* scope = callee->scopeUnchecked();
 959     ExecutableBase* executable = callee->executable();
 960
 961     MacroAssemblerCodePtr codePtr;
 962     CodeBlock* codeBlock = nullptr;
 963     if (executable->isHostFunction()) {
 964         codePtr = executable->entrypointFor(kind, MustCheckArity);
 965     } else {
 966         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
 967
 968         if (!isCall(kind) && functionExecutable->constructAbility() == ConstructAbility::CannotConstruct) {
 969             throwException(exec, throwScope, createNotAConstructorError(exec, callee));
 970             return encodeResult(
 971                 vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
 972                 reinterpret_cast<void*>(KeepTheFrame));
 973         }
 974
 975         CodeBlock** codeBlockSlot = execCallee->addressOfCodeBlock();
 976         JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(*vm, callee, scope, kind, *codeBlockSlot);
 977         EXCEPTION_ASSERT(throwScope.exception() == reinterpret_cast<Exception*>(error));
 978         if (error) {
 979             return encodeResult(
 980                 vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
 981                 reinterpret_cast<void*>(KeepTheFrame));
 982         }
 983         codeBlock = *codeBlockSlot;
 984         ArityCheckMode arity;
 985         if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo->isVarargs())
 986             arity = MustCheckArity;
 987         else
 988             arity = ArityCheckNotRequired;
 989         codePtr = functionExecutable->entrypointFor(kind, arity);
 990     }
 991     if (!callLinkInfo->seenOnce())
 992         callLinkInfo->setSeen();
 993     else
 994         linkFor(execCallee, *callLinkInfo, codeBlock, callee, codePtr);
 995
 996     return encodeResult(codePtr.executableAddress(), reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
 997 }
 998
 999 void JIT_OPERATION operationLinkDirectCall(ExecState* exec, CallLinkInfo* callLinkInfo, JSFunction* callee)
1000 {
1001     VM* vm = &exec->vm();
1002     auto throwScope = DECLARE_THROW_SCOPE(*vm);
1003
1004     CodeSpecializationKind kind = callLinkInfo->specializationKind();
1005     NativeCallFrameTracer tracer(vm, exec);
1006
1007     RELEASE_ASSERT(callLinkInfo->isDirect());
1008
1009     // This would happen if the executable died during GC but the CodeBlock did not die. That should
1010     // not happen because the CodeBlock should have a weak reference to any executable it uses for
1011     // this purpose.
1012     RELEASE_ASSERT(callLinkInfo->executable());
1013
1014     // Having a CodeBlock indicates that this is linked. We shouldn't be taking this path if it's
1015     // linked.
1016     RELEASE_ASSERT(!callLinkInfo->codeBlock());
1017
1018     // We just don't support this yet.
1019     RELEASE_ASSERT(!callLinkInfo->isVarargs());
1020
1021     ExecutableBase* executable = callLinkInfo->executable();
1022     RELEASE_ASSERT(callee->executable() == callLinkInfo->executable());
1023
1024     JSScope* scope = callee->scopeUnchecked();
1025
1026     MacroAssemblerCodePtr codePtr;
1027     CodeBlock* codeBlock = nullptr;
1028     if (executable->isHostFunction())
1029         codePtr = executable->entrypointFor(kind, MustCheckArity);
1030     else {
1031         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
1032
1033         RELEASE_ASSERT(isCall(kind) || functionExecutable->constructAbility() != ConstructAbility::CannotConstruct);
1034
1035         JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(*vm, callee, scope, kind, codeBlock);
1036         EXCEPTION_ASSERT_UNUSED(throwScope, throwScope.exception() == reinterpret_cast<Exception*>(error));
1037         if (error)
1038             return;
1039         ArityCheckMode arity;
1040         unsigned argumentStackSlots = callLinkInfo->maxNumArguments();
1041         if (argumentStackSlots < static_cast<size_t>(codeBlock->numParameters()))
1042             arity = MustCheckArity;
1043         else
1044             arity = ArityCheckNotRequired;
1045         codePtr = functionExecutable->entrypointFor(kind, arity);
1046     }
1047
1048     linkDirectFor(exec, *callLinkInfo, codeBlock, codePtr);
1049 }
1050
1051 inline SlowPathReturnType virtualForWithFunction(
1052     ExecState* execCallee, CallLinkInfo* callLinkInfo, JSCell*& calleeAsFunctionCell)
1053 {
1054     ExecState* exec = execCallee->callerFrame();
1055     VM* vm = &exec->vm();
1056     auto throwScope = DECLARE_THROW_SCOPE(*vm);
1057
1058     CodeSpecializationKind kind = callLinkInfo->specializationKind();
1059     NativeCallFrameTracer tracer(vm, exec);
1060
1061     JSValue calleeAsValue = execCallee->guaranteedJSValueCallee();
1062     calleeAsFunctionCell = getJSFunction(calleeAsValue);
1063     if (UNLIKELY(!calleeAsFunctionCell)) {
1064         if (calleeAsValue.isCell() && calleeAsValue.asCell()->type() == InternalFunctionType) {
1065             MacroAssemblerCodePtr codePtr = vm->getCTIInternalFunctionTrampolineFor(kind);
1066             ASSERT(!!codePtr);
1067             return encodeResult(codePtr.executableAddress(), reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
1068         }
1069         throwScope.release();
1070         return handleHostCall(execCallee, calleeAsValue, callLinkInfo);
1071     }
1072
1073     JSFunction* function = jsCast<JSFunction*>(calleeAsFunctionCell);
1074     JSScope* scope = function->scopeUnchecked();
1075     ExecutableBase* executable = function->executable();
1076     if (UNLIKELY(!executable->hasJITCodeFor(kind))) {
1077         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
1078
1079         if (!isCall(kind) && functionExecutable->constructAbility() == ConstructAbility::CannotConstruct) {
1080             throwException(exec, throwScope, createNotAConstructorError(exec, function));
1081             return encodeResult(
1082                 vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
1083                 reinterpret_cast<void*>(KeepTheFrame));
1084         }
1085
1086         CodeBlock** codeBlockSlot = execCallee->addressOfCodeBlock();
1087         JSObject* error = functionExecutable->prepareForExecution<FunctionExecutable>(*vm, function, scope, kind, *codeBlockSlot);
1088         EXCEPTION_ASSERT(throwScope.exception() == reinterpret_cast<Exception*>(error));
1089         if (error) {
1090             return encodeResult(
1091                 vm->getCTIStub(throwExceptionFromCallSlowPathGenerator).code().executableAddress(),
1092                 reinterpret_cast<void*>(KeepTheFrame));
1093         }
1094     }
1095     return encodeResult(executable->entrypointFor(
1096         kind, MustCheckArity).executableAddress(),
1097         reinterpret_cast<void*>(callLinkInfo->callMode() == CallMode::Tail ? ReuseTheFrame : KeepTheFrame));
1098 }
1099
1100 SlowPathReturnType JIT_OPERATION operationLinkPolymorphicCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
1101 {
1102     ASSERT(callLinkInfo->specializationKind() == CodeForCall);
1103     JSCell* calleeAsFunctionCell;
1104     SlowPathReturnType result = virtualForWithFunction(execCallee, callLinkInfo, calleeAsFunctionCell);
1105
1106     linkPolymorphicCall(execCallee, *callLinkInfo, CallVariant(calleeAsFunctionCell));
1107
1108     return result;
1109 }
1110
1111 SlowPathReturnType JIT_OPERATION operationVirtualCall(ExecState* execCallee, CallLinkInfo* callLinkInfo)
1112 {
1113     JSCell* calleeAsFunctionCellIgnored;
1114     return virtualForWithFunction(execCallee, callLinkInfo, calleeAsFunctionCellIgnored);
1115 }
1116
1117 size_t JIT_OPERATION operationCompareLess(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
1118 {
1119     VM* vm = &exec->vm();
1120     NativeCallFrameTracer tracer(vm, exec);
1121
1122     return jsLess<true>(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
1123 }
1124
1125 size_t JIT_OPERATION operationCompareLessEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
1126 {
1127     VM* vm = &exec->vm();
1128     NativeCallFrameTracer tracer(vm, exec);
1129
1130     return jsLessEq<true>(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
1131 }
1132
1133 size_t JIT_OPERATION operationCompareGreater(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
1134 {
1135     VM* vm = &exec->vm();
1136     NativeCallFrameTracer tracer(vm, exec);
1137
1138     return jsLess<false>(exec, JSValue::decode(encodedOp2), JSValue::decode(encodedOp1));
1139 }
1140
1141 size_t JIT_OPERATION operationCompareGreaterEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
1142 {
1143     VM* vm = &exec->vm();
1144     NativeCallFrameTracer tracer(vm, exec);
1145
1146     return jsLessEq<false>(exec, JSValue::decode(encodedOp2), JSValue::decode(encodedOp1));
1147 }
1148
1149 size_t JIT_OPERATION operationCompareEq(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
1150 {
1151     VM* vm = &exec->vm();
1152     NativeCallFrameTracer tracer(vm, exec);
1153
1154     return JSValue::equalSlowCaseInline(exec, JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
1155 }
1156
1157 #if USE(JSVALUE64)
1158 EncodedJSValue JIT_OPERATION operationCompareStringEq(ExecState* exec, JSCell* left, JSCell* right)
1159 #else
1160 size_t JIT_OPERATION operationCompareStringEq(ExecState* exec, JSCell* left, JSCell* right)
1161 #endif
1162 {
1163     VM* vm = &exec->vm();
1164     NativeCallFrameTracer tracer(vm, exec);
1165
1166     bool result = asString(left)->equal(exec, asString(right));
1167 #if USE(JSVALUE64)
1168     return JSValue::encode(jsBoolean(result));
1169 #else
1170     return result;
1171 #endif
1172 }
1173
1174 EncodedJSValue JIT_OPERATION operationNewArrayWithProfile(ExecState* exec, ArrayAllocationProfile* profile, const JSValue* values, int size)
1175 {
1176     VM* vm = &exec->vm();
1177     NativeCallFrameTracer tracer(vm, exec);
1178     return JSValue::encode(constructArrayNegativeIndexed(exec, profile, values, size));
1179 }
1180
1181 EncodedJSValue JIT_OPERATION operationNewArrayWithSizeAndProfile(ExecState* exec, ArrayAllocationProfile* profile, EncodedJSValue size)
1182 {
1183     VM* vm = &exec->vm();
1184     NativeCallFrameTracer tracer(vm, exec);
1185     JSValue sizeValue = JSValue::decode(size);
1186     return JSValue::encode(constructArrayWithSizeQuirk(exec, profile, exec->lexicalGlobalObject(), sizeValue));
1187 }
1188
1189 }
1190
1191 template<typename FunctionType>
1192 static EncodedJSValue operationNewFunctionCommon(ExecState* exec, JSScope* scope, JSCell* functionExecutable, bool isInvalidated)
1193 {
1194     VM& vm = exec->vm();
1195     ASSERT(functionExecutable->inherits(vm, FunctionExecutable::info()));
1196     NativeCallFrameTracer tracer(&vm, exec);
1197     if (isInvalidated)
1198         return JSValue::encode(FunctionType::createWithInvalidatedReallocationWatchpoint(vm, static_cast<FunctionExecutable*>(functionExecutable), scope));
1199     return JSValue::encode(FunctionType::create(vm, static_cast<FunctionExecutable*>(functionExecutable), scope));
1200 }
1201
1202 extern "C" {
1203
1204 EncodedJSValue JIT_OPERATION operationNewFunction(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1205 {
1206     return operationNewFunctionCommon<JSFunction>(exec, scope, functionExecutable, false);
1207 }
1208
1209 EncodedJSValue JIT_OPERATION operationNewFunctionWithInvalidatedReallocationWatchpoint(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1210 {
1211     return operationNewFunctionCommon<JSFunction>(exec, scope, functionExecutable, true);
1212 }
1213
1214 EncodedJSValue JIT_OPERATION operationNewGeneratorFunction(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1215 {
1216     return operationNewFunctionCommon<JSGeneratorFunction>(exec, scope, functionExecutable, false);
1217 }
1218
1219 EncodedJSValue JIT_OPERATION operationNewGeneratorFunctionWithInvalidatedReallocationWatchpoint(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1220 {
1221     return operationNewFunctionCommon<JSGeneratorFunction>(exec, scope, functionExecutable, true);
1222 }
1223
1224 EncodedJSValue JIT_OPERATION operationNewAsyncFunction(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1225 {
1226     return operationNewFunctionCommon<JSAsyncFunction>(exec, scope, functionExecutable, false);
1227 }
1228
1229 EncodedJSValue JIT_OPERATION operationNewAsyncFunctionWithInvalidatedReallocationWatchpoint(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1230 {
1231     return operationNewFunctionCommon<JSAsyncFunction>(exec, scope, functionExecutable, true);
1232 }
1233
1234 EncodedJSValue JIT_OPERATION operationNewAsyncGeneratorFunction(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1235 {
1236     return operationNewFunctionCommon<JSAsyncGeneratorFunction>(exec, scope, functionExecutable, false);
1237 }
1238
1239 EncodedJSValue JIT_OPERATION operationNewAsyncGeneratorFunctionWithInvalidatedReallocationWatchpoint(ExecState* exec, JSScope* scope, JSCell* functionExecutable)
1240 {
1241     return operationNewFunctionCommon<JSAsyncGeneratorFunction>(exec, scope, functionExecutable, true);
1242 }
1243
1244 void JIT_OPERATION operationSetFunctionName(ExecState* exec, JSCell* funcCell, EncodedJSValue encodedName)
1245 {
1246     VM* vm = &exec->vm();
1247     NativeCallFrameTracer tracer(vm, exec);
1248
1249     JSFunction* func = jsCast<JSFunction*>(funcCell);
1250     JSValue name = JSValue::decode(encodedName);
1251     func->setFunctionName(exec, name);
1252 }
1253
1254 JSCell* JIT_OPERATION operationNewObject(ExecState* exec, Structure* structure)
1255 {
1256     VM* vm = &exec->vm();
1257     NativeCallFrameTracer tracer(vm, exec);
1258
1259     return constructEmptyObject(exec, structure);
1260 }
1261
1262 JSCell* JIT_OPERATION operationNewRegexp(ExecState* exec, JSCell* regexpPtr)
1263 {
1264     SuperSamplerScope superSamplerScope(false);
1265     VM& vm = exec->vm();
1266     NativeCallFrameTracer tracer(&vm, exec);
1267
1268     RegExp* regexp = static_cast<RegExp*>(regexpPtr);
1269     ASSERT(regexp->isValid());
1270     return RegExpObject::create(vm, exec->lexicalGlobalObject()->regExpStructure(), regexp);
1271 }
1272
1273 // The only reason for returning an UnusedPtr (instead of void) is so that we can reuse the
1274 // existing DFG slow path generator machinery when creating the slow path for CheckTraps
1275 // in the DFG. If a DFG slow path generator that supports a void return type is added in the
1276 // future, we can switch to using that then.
1277 UnusedPtr JIT_OPERATION operationHandleTraps(ExecState* exec)
1278 {
1279     VM& vm = exec->vm();
1280     NativeCallFrameTracer tracer(&vm, exec);
1281     ASSERT(vm.needTrapHandling());
1282     vm.handleTraps(exec);
1283     return nullptr;
1284 }
1285
1286 void JIT_OPERATION operationDebug(ExecState* exec, int32_t debugHookType)
1287 {
1288     VM& vm = exec->vm();
1289     NativeCallFrameTracer tracer(&vm, exec);
1290
1291     vm.interpreter->debug(exec, static_cast<DebugHookType>(debugHookType));
1292 }
1293
1294 #if ENABLE(DFG_JIT)
1295 static void updateAllPredictionsAndOptimizeAfterWarmUp(CodeBlock* codeBlock)
1296 {
1297     codeBlock->updateAllPredictions();
1298     codeBlock->optimizeAfterWarmUp();
1299 }
1300
1301 SlowPathReturnType JIT_OPERATION operationOptimize(ExecState* exec, int32_t bytecodeIndex)
1302 {
1303     VM& vm = exec->vm();
1304     NativeCallFrameTracer tracer(&vm, exec);
1305
1306     // Defer GC for a while so that it doesn't run between when we enter into this
1307     // slow path and when we figure out the state of our code block. This prevents
1308     // a number of awkward reentrancy scenarios, including:
1309     //
1310     // - The optimized version of our code block being jettisoned by GC right after
1311     //   we concluded that we wanted to use it, but have not planted it into the JS
1312     //   stack yet.
1313     //
1314     // - An optimized version of our code block being installed just as we decided
1315     //   that it wasn't ready yet.
1316     //
1317     // Note that jettisoning won't happen if we already initiated OSR, because in
1318     // that case we would have already planted the optimized code block into the JS
1319     // stack.
1320     DeferGCForAWhile deferGC(vm.heap);
1321
1322     CodeBlock* codeBlock = exec->codeBlock();
1323     if (UNLIKELY(codeBlock->jitType() != JITCode::BaselineJIT)) {
1324         dataLog("Unexpected code block in Baseline->DFG tier-up: ", *codeBlock, "\n");
1325         RELEASE_ASSERT_NOT_REACHED();
1326     }
1327
1328     if (bytecodeIndex) {
1329         // If we're attempting to OSR from a loop, assume that this should be
1330         // separately optimized.
1331         codeBlock->m_shouldAlwaysBeInlined = false;
1332     }
1333
1334     if (UNLIKELY(Options::verboseOSR())) {
1335         dataLog(
1336             *codeBlock, ": Entered optimize with bytecodeIndex = ", bytecodeIndex,
1337             ", executeCounter = ", codeBlock->jitExecuteCounter(),
1338             ", optimizationDelayCounter = ", codeBlock->reoptimizationRetryCounter(),
1339             ", exitCounter = ");
1340         if (codeBlock->hasOptimizedReplacement())
1341             dataLog(codeBlock->replacement()->osrExitCounter());
1342         else
1343             dataLog("N/A");
1344         dataLog("\n");
1345     }
1346
1347     if (!codeBlock->checkIfOptimizationThresholdReached()) {
1348         CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("counter = ", codeBlock->jitExecuteCounter()));
1349         codeBlock->updateAllPredictions();
1350         if (UNLIKELY(Options::verboseOSR()))
1351             dataLog("Choosing not to optimize ", *codeBlock, " yet, because the threshold hasn't been reached.\n");
1352         return encodeResult(0, 0);
1353     }
1354
1355     Debugger* debugger = codeBlock->globalObject()->debugger();
1356     if (UNLIKELY(debugger && (debugger->isStepping() || codeBlock->baselineAlternative()->hasDebuggerRequests()))) {
1357         CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("debugger is stepping or has requests"));
1358         updateAllPredictionsAndOptimizeAfterWarmUp(codeBlock);
1359         return encodeResult(0, 0);
1360     }
1361
1362     if (codeBlock->m_shouldAlwaysBeInlined) {
1363         CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should always be inlined"));
1364         updateAllPredictionsAndOptimizeAfterWarmUp(codeBlock);
1365         if (UNLIKELY(Options::verboseOSR()))
1366             dataLog("Choosing not to optimize ", *codeBlock, " yet, because m_shouldAlwaysBeInlined == true.\n");
1367         return encodeResult(0, 0);
1368     }
1369
1370     // We cannot be in the process of asynchronous compilation and also have an optimized
1371     // replacement.
1372     DFG::Worklist* worklist = DFG::existingGlobalDFGWorklistOrNull();
1373     ASSERT(
1374         !worklist
1375         || !(worklist->compilationState(DFG::CompilationKey(codeBlock, DFG::DFGMode)) != DFG::Worklist::NotKnown
1376         && codeBlock->hasOptimizedReplacement()));
1377
1378     DFG::Worklist::State worklistState;
1379     if (worklist) {
1380         // The call to DFG::Worklist::completeAllReadyPlansForVM() will complete all ready
1381         // (i.e. compiled) code blocks. But if it completes ours, we also need to know
1382         // what the result was so that we don't plow ahead and attempt OSR or immediate
1383         // reoptimization. This will have already also set the appropriate JIT execution
1384         // count threshold depending on what happened, so if the compilation was anything
1385         // but successful we just want to return early. See the case for worklistState ==
1386         // DFG::Worklist::Compiled, below.
1387
1388         // Note that we could have alternatively just called Worklist::compilationState()
1389         // here, and if it returned Compiled, we could have then called
1390         // completeAndScheduleOSR() below. But that would have meant that it could take
1391         // longer for code blocks to be completed: they would only complete when *their*
1392         // execution count trigger fired; but that could take a while since the firing is
1393         // racy. It could also mean that code blocks that never run again after being
1394         // compiled would sit on the worklist until next GC. That's fine, but it's
1395         // probably a waste of memory. Our goal here is to complete code blocks as soon as
1396         // possible in order to minimize the chances of us executing baseline code after
1397         // optimized code is already available.
1398         worklistState = worklist->completeAllReadyPlansForVM(
1399             vm, DFG::CompilationKey(codeBlock, DFG::DFGMode));
1400     } else
1401         worklistState = DFG::Worklist::NotKnown;
1402
1403     if (worklistState == DFG::Worklist::Compiling) {
1404         CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compiling"));
1405         // We cannot be in the process of asynchronous compilation and also have an optimized
1406         // replacement.
1407         RELEASE_ASSERT(!codeBlock->hasOptimizedReplacement());
1408         codeBlock->setOptimizationThresholdBasedOnCompilationResult(CompilationDeferred);
1409         return encodeResult(0, 0);
1410     }
1411
1412     if (worklistState == DFG::Worklist::Compiled) {
1413         // If we don't have an optimized replacement but we did just get compiled, then
1414         // the compilation failed or was invalidated, in which case the execution count
1415         // thresholds have already been set appropriately by
1416         // CodeBlock::setOptimizationThresholdBasedOnCompilationResult() and we have
1417         // nothing left to do.
1418         if (!codeBlock->hasOptimizedReplacement()) {
1419             CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compiled and failed"));
1420             codeBlock->updateAllPredictions();
1421             if (UNLIKELY(Options::verboseOSR()))
1422                 dataLog("Code block ", *codeBlock, " was compiled but it doesn't have an optimized replacement.\n");
1423             return encodeResult(0, 0);
1424         }
1425     } else if (codeBlock->hasOptimizedReplacement()) {
1426         if (UNLIKELY(Options::verboseOSR()))
1427             dataLog("Considering OSR ", *codeBlock, " -> ", *codeBlock->replacement(), ".\n");
1428         // If we have an optimized replacement, then it must be the case that we entered
1429         // cti_optimize from a loop. That's because if there's an optimized replacement,
1430         // then all calls to this function will be relinked to the replacement and so
1431         // the prologue OSR will never fire.
1432
1433         // This is an interesting threshold check. Consider that a function OSR exits
1434         // in the middle of a loop, while having a relatively low exit count. The exit
1435         // will reset the execution counter to some target threshold, meaning that this
1436         // code won't be reached until that loop heats up for >=1000 executions. But then
1437         // we do a second check here, to see if we should either reoptimize, or just
1438         // attempt OSR entry. Hence it might even be correct for
1439         // shouldReoptimizeFromLoopNow() to always return true. But we make it do some
1440         // additional checking anyway, to reduce the amount of recompilation thrashing.
1441         if (codeBlock->replacement()->shouldReoptimizeFromLoopNow()) {
1442             CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize from loop now"));
1443             if (UNLIKELY(Options::verboseOSR())) {
1444                 dataLog(
1445                     "Triggering reoptimization of ", *codeBlock,
1446                     "(", *codeBlock->replacement(), ") (in loop).\n");
1447             }
1448             codeBlock->replacement()->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTrigger, CountReoptimization);
1449             return encodeResult(0, 0);
1450         }
1451     } else {
1452         if (!codeBlock->shouldOptimizeNow()) {
1453             CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("insufficient profiling"));
1454             if (UNLIKELY(Options::verboseOSR())) {
1455                 dataLog(
1456                     "Delaying optimization for ", *codeBlock,
1457                     " because of insufficient profiling.\n");
1458             }
1459             return encodeResult(0, 0);
1460         }
1461
1462         if (UNLIKELY(Options::verboseOSR()))
1463             dataLog("Triggering optimized compilation of ", *codeBlock, "\n");
1464
1465         unsigned numVarsWithValues;
1466         if (bytecodeIndex)
1467             numVarsWithValues = codeBlock->m_numCalleeLocals;
1468         else
1469             numVarsWithValues = 0;
1470         Operands<JSValue> mustHandleValues(codeBlock->numParameters(), numVarsWithValues);
1471         int localsUsedForCalleeSaves = static_cast<int>(CodeBlock::llintBaselineCalleeSaveSpaceAsVirtualRegisters());
1472         for (size_t i = 0; i < mustHandleValues.size(); ++i) {
1473             int operand = mustHandleValues.operandForIndex(i);
1474             if (operandIsLocal(operand) && VirtualRegister(operand).toLocal() < localsUsedForCalleeSaves)
1475                 continue;
1476             mustHandleValues[i] = exec->uncheckedR(operand).jsValue();
1477         }
1478
1479         CodeBlock* replacementCodeBlock = codeBlock->newReplacement();
1480         CompilationResult result = DFG::compile(
1481             vm, replacementCodeBlock, nullptr, DFG::DFGMode, bytecodeIndex,
1482             mustHandleValues, JITToDFGDeferredCompilationCallback::create());
1483
1484         if (result != CompilationSuccessful) {
1485             CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("compilation failed"));
1486             return encodeResult(0, 0);
1487         }
1488     }
1489
1490     CodeBlock* optimizedCodeBlock = codeBlock->replacement();
1491     ASSERT(JITCode::isOptimizingJIT(optimizedCodeBlock->jitType()));
1492
1493     if (void* dataBuffer = DFG::prepareOSREntry(exec, optimizedCodeBlock, bytecodeIndex)) {
1494         CODEBLOCK_LOG_EVENT(optimizedCodeBlock, "osrEntry", ("at bc#", bytecodeIndex));
1495         if (UNLIKELY(Options::verboseOSR())) {
1496             dataLog(
1497                 "Performing OSR ", *codeBlock, " -> ", *optimizedCodeBlock, ".\n");
1498         }
1499
1500         codeBlock->optimizeSoon();
1501         codeBlock->unlinkedCodeBlock()->setDidOptimize(TrueTriState);
1502         return encodeResult(vm.getCTIStub(DFG::osrEntryThunkGenerator).code().executableAddress(), dataBuffer);
1503     }
1504
1505     if (UNLIKELY(Options::verboseOSR())) {
1506         dataLog(
1507             "Optimizing ", *codeBlock, " -> ", *codeBlock->replacement(),
1508             " succeeded, OSR failed, after a delay of ",
1509             codeBlock->optimizationDelayCounter(), ".\n");
1510     }
1511
1512     // Count the OSR failure as a speculation failure. If this happens a lot, then
1513     // reoptimize.
1514     optimizedCodeBlock->countOSRExit();
1515
1516     // We are a lot more conservative about triggering reoptimization after OSR failure than
1517     // before it. If we enter the optimize_from_loop trigger with a bucket full of fail
1518     // already, then we really would like to reoptimize immediately. But this case covers
1519     // something else: there weren't many (or any) speculation failures before, but we just
1520     // failed to enter the speculative code because some variable had the wrong value or
1521     // because the OSR code decided for any spurious reason that it did not want to OSR
1522     // right now. So, we only trigger reoptimization only upon the more conservative (non-loop)
1523     // reoptimization trigger.
1524     if (optimizedCodeBlock->shouldReoptimizeNow()) {
1525         CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("should reoptimize now"));
1526         if (UNLIKELY(Options::verboseOSR())) {
1527             dataLog(
1528                 "Triggering reoptimization of ", *codeBlock, " -> ",
1529                 *codeBlock->replacement(), " (after OSR fail).\n");
1530         }
1531         optimizedCodeBlock->jettison(Profiler::JettisonDueToBaselineLoopReoptimizationTriggerOnOSREntryFail, CountReoptimization);
1532         return encodeResult(0, 0);
1533     }
1534
1535     // OSR failed this time, but it might succeed next time! Let the code run a bit
1536     // longer and then try again.
1537     codeBlock->optimizeAfterWarmUp();
1538
1539     CODEBLOCK_LOG_EVENT(codeBlock, "delayOptimizeToDFG", ("OSR failed"));
1540     return encodeResult(0, 0);
1541 }
1542
1543 char* JIT_OPERATION operationTryOSREnterAtCatch(ExecState* exec, uint32_t bytecodeIndex)
1544 {
1545     VM& vm = exec->vm();
1546     NativeCallFrameTracer tracer(&vm, exec);
1547
1548     CodeBlock* optimizedReplacement = exec->codeBlock()->replacement();
1549     switch (optimizedReplacement->jitType()) {
1550     case JITCode::DFGJIT:
1551     case JITCode::FTLJIT:
1552         return static_cast<char*>(DFG::prepareCatchOSREntry(exec, optimizedReplacement, bytecodeIndex));
1553     default:
1554         break;
1555     }
1556     return nullptr;
1557 }
1558
1559 char* JIT_OPERATION operationTryOSREnterAtCatchAndValueProfile(ExecState* exec, uint32_t bytecodeIndex)
1560 {
1561     VM& vm = exec->vm();
1562     NativeCallFrameTracer tracer(&vm, exec);
1563
1564     CodeBlock* codeBlock = exec->codeBlock();
1565     CodeBlock* optimizedReplacement = codeBlock->replacement();
1566
1567     switch (optimizedReplacement->jitType()) {
1568     case JITCode::DFGJIT:
1569     case JITCode::FTLJIT:
1570         return static_cast<char*>(DFG::prepareCatchOSREntry(exec, optimizedReplacement, bytecodeIndex));
1571     default:
1572         break;
1573     }
1574
1575     codeBlock->ensureCatchLivenessIsComputedForBytecodeOffset(bytecodeIndex);
1576     ValueProfileAndOperandBuffer* buffer = static_cast<ValueProfileAndOperandBuffer*>(codeBlock->instructions()[bytecodeIndex + 3].u.pointer);
1577     buffer->forEach([&] (ValueProfileAndOperand& profile) {
1578         profile.m_profile.m_buckets[0] = JSValue::encode(exec->uncheckedR(profile.m_operand).jsValue());
1579     });
1580
1581     return nullptr;
1582 }
1583
1584 #endif
1585
1586 void JIT_OPERATION operationPutByIndex(ExecState* exec, EncodedJSValue encodedArrayValue, int32_t index, EncodedJSValue encodedValue)
1587 {
1588     VM& vm = exec->vm();
1589     NativeCallFrameTracer tracer(&vm, exec);
1590
1591     JSValue arrayValue = JSValue::decode(encodedArrayValue);
1592     ASSERT(isJSArray(arrayValue));
1593     asArray(arrayValue)->putDirectIndex(exec, index, JSValue::decode(encodedValue));
1594 }
1595
1596 enum class AccessorType {
1597     Getter,
1598     Setter
1599 };
1600
1601 static void putAccessorByVal(ExecState* exec, JSObject* base, JSValue subscript, int32_t attribute, JSObject* accessor, AccessorType accessorType)
1602 {
1603     VM& vm = exec->vm();
1604     auto scope = DECLARE_THROW_SCOPE(vm);
1605     auto propertyKey = subscript.toPropertyKey(exec);
1606     RETURN_IF_EXCEPTION(scope, void());
1607
1608     scope.release();
1609     if (accessorType == AccessorType::Getter)
1610         base->putGetter(exec, propertyKey, accessor, attribute);
1611     else
1612         base->putSetter(exec, propertyKey, accessor, attribute);
1613 }
1614
1615 void JIT_OPERATION operationPutGetterById(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t options, JSCell* getter)
1616 {
1617     VM& vm = exec->vm();
1618     NativeCallFrameTracer tracer(&vm, exec);
1619
1620     ASSERT(object && object->isObject());
1621     JSObject* baseObj = object->getObject();
1622
1623     ASSERT(getter->isObject());
1624     baseObj->putGetter(exec, uid, getter, options);
1625 }
1626
1627 void JIT_OPERATION operationPutSetterById(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t options, JSCell* setter)
1628 {
1629     VM& vm = exec->vm();
1630     NativeCallFrameTracer tracer(&vm, exec);
1631
1632     ASSERT(object && object->isObject());
1633     JSObject* baseObj = object->getObject();
1634
1635     ASSERT(setter->isObject());
1636     baseObj->putSetter(exec, uid, setter, options);
1637 }
1638
1639 void JIT_OPERATION operationPutGetterByVal(ExecState* exec, JSCell* base, EncodedJSValue encodedSubscript, int32_t attribute, JSCell* getter)
1640 {
1641     VM& vm = exec->vm();
1642     NativeCallFrameTracer tracer(&vm, exec);
1643
1644     putAccessorByVal(exec, asObject(base), JSValue::decode(encodedSubscript), attribute, asObject(getter), AccessorType::Getter);
1645 }
1646
1647 void JIT_OPERATION operationPutSetterByVal(ExecState* exec, JSCell* base, EncodedJSValue encodedSubscript, int32_t attribute, JSCell* setter)
1648 {
1649     VM& vm = exec->vm();
1650     NativeCallFrameTracer tracer(&vm, exec);
1651
1652     putAccessorByVal(exec, asObject(base), JSValue::decode(encodedSubscript), attribute, asObject(setter), AccessorType::Setter);
1653 }
1654
1655 #if USE(JSVALUE64)
1656 void JIT_OPERATION operationPutGetterSetter(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t attribute, EncodedJSValue encodedGetterValue, EncodedJSValue encodedSetterValue)
1657 {
1658     VM& vm = exec->vm();
1659     NativeCallFrameTracer tracer(&vm, exec);
1660
1661     ASSERT(object && object->isObject());
1662     JSObject* baseObj = asObject(object);
1663
1664     GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
1665
1666     JSValue getter = JSValue::decode(encodedGetterValue);
1667     JSValue setter = JSValue::decode(encodedSetterValue);
1668     ASSERT(getter.isObject() || getter.isUndefined());
1669     ASSERT(setter.isObject() || setter.isUndefined());
1670     ASSERT(getter.isObject() || setter.isObject());
1671
1672     if (!getter.isUndefined())
1673         accessor->setGetter(vm, exec->lexicalGlobalObject(), asObject(getter));
1674     if (!setter.isUndefined())
1675         accessor->setSetter(vm, exec->lexicalGlobalObject(), asObject(setter));
1676     baseObj->putDirectAccessor(exec, uid, accessor, attribute);
1677 }
1678
1679 #else
1680 void JIT_OPERATION operationPutGetterSetter(ExecState* exec, JSCell* object, UniquedStringImpl* uid, int32_t attribute, JSCell* getter, JSCell* setter)
1681 {
1682     VM& vm = exec->vm();
1683     NativeCallFrameTracer tracer(&vm, exec);
1684
1685     ASSERT(object && object->isObject());
1686     JSObject* baseObj = asObject(object);
1687
1688     GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
1689
1690     ASSERT(!getter || getter->isObject());
1691     ASSERT(!setter || setter->isObject());
1692     ASSERT(getter || setter);
1693
1694     if (getter)
1695         accessor->setGetter(vm, exec->lexicalGlobalObject(), getter->getObject());
1696     if (setter)
1697         accessor->setSetter(vm, exec->lexicalGlobalObject(), setter->getObject());
1698     baseObj->putDirectAccessor(exec, uid, accessor, attribute);
1699 }
1700 #endif
1701
1702 void JIT_OPERATION operationPopScope(ExecState* exec, int32_t scopeReg)
1703 {
1704     VM& vm = exec->vm();
1705     NativeCallFrameTracer tracer(&vm, exec);
1706
1707     JSScope* scope = exec->uncheckedR(scopeReg).Register::scope();
1708     exec->uncheckedR(scopeReg) = scope->next();
1709 }
1710
1711 int32_t JIT_OPERATION operationInstanceOfCustom(ExecState* exec, EncodedJSValue encodedValue, JSObject* constructor, EncodedJSValue encodedHasInstance)
1712 {
1713     VM& vm = exec->vm();
1714     NativeCallFrameTracer tracer(&vm, exec);
1715
1716     JSValue value = JSValue::decode(encodedValue);
1717     JSValue hasInstanceValue = JSValue::decode(encodedHasInstance);
1718
1719     ASSERT(hasInstanceValue != exec->lexicalGlobalObject()->functionProtoHasInstanceSymbolFunction() || !constructor->structure()->typeInfo().implementsDefaultHasInstance());
1720
1721     if (constructor->hasInstance(exec, value, hasInstanceValue))
1722         return 1;
1723     return 0;
1724 }
1725
1726 }
1727
1728 static bool canAccessArgumentIndexQuickly(JSObject& object, uint32_t index)
1729 {
1730     switch (object.structure()->typeInfo().type()) {
1731     case DirectArgumentsType: {
1732         DirectArguments* directArguments = jsCast<DirectArguments*>(&object);
1733         if (directArguments->isMappedArgumentInDFG(index))
1734             return true;
1735         break;
1736     }
1737     case ScopedArgumentsType: {
1738         ScopedArguments* scopedArguments = jsCast<ScopedArguments*>(&object);
1739         if (scopedArguments->isMappedArgumentInDFG(index))
1740             return true;
1741         break;
1742     }
1743     default:
1744         break;
1745     }
1746     return false;
1747 }
1748
1749 static JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
1750 {
1751     VM& vm = exec->vm();
1752     auto scope = DECLARE_THROW_SCOPE(vm);
1753
1754     if (LIKELY(baseValue.isCell() && subscript.isString())) {
1755         Structure& structure = *baseValue.asCell()->structure(vm);
1756         if (JSCell::canUseFastGetOwnProperty(structure)) {
1757             if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
1758                 if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get())) {
1759                     ASSERT(exec->bytecodeOffset());
1760                     if (byValInfo->stubInfo && byValInfo->cachedId.impl() != existingAtomicString)
1761                         byValInfo->tookSlowPath = true;
1762                     return result;
1763                 }
1764             }
1765         }
1766     }
1767
1768     if (subscript.isUInt32()) {
1769         ASSERT(exec->bytecodeOffset());
1770         byValInfo->tookSlowPath = true;
1771
1772         uint32_t i = subscript.asUInt32();
1773         if (isJSString(baseValue)) {
1774             if (asString(baseValue)->canGetIndex(i)) {
1775                 ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(operationGetByValString));
1776                 scope.release();
1777                 return asString(baseValue)->getIndex(exec, i);
1778             }
1779             byValInfo->arrayProfile->setOutOfBounds();
1780         } else if (baseValue.isObject()) {
1781             JSObject* object = asObject(baseValue);
1782             if (object->canGetIndexQuickly(i))
1783                 return object->getIndexQuickly(i);
1784
1785             if (!canAccessArgumentIndexQuickly(*object, i)) {
1786                 // FIXME: This will make us think that in-bounds typed array accesses are actually
1787                 // out-of-bounds.
1788                 // https://bugs.webkit.org/show_bug.cgi?id=149886
1789                 byValInfo->arrayProfile->setOutOfBounds();
1790             }
1791         }
1792
1793         scope.release();
1794         return baseValue.get(exec, i);
1795     }
1796
1797     baseValue.requireObjectCoercible(exec);
1798     RETURN_IF_EXCEPTION(scope, JSValue());
1799     auto property = subscript.toPropertyKey(exec);
1800     RETURN_IF_EXCEPTION(scope, JSValue());
1801
1802     ASSERT(exec->bytecodeOffset());
1803     if (byValInfo->stubInfo && (!isStringOrSymbol(subscript) || byValInfo->cachedId != property))
1804         byValInfo->tookSlowPath = true;
1805
1806     scope.release();
1807     return baseValue.get(exec, property);
1808 }
1809
1810 static OptimizationResult tryGetByValOptimize(ExecState* exec, JSValue baseValue, JSValue subscript, ByValInfo* byValInfo, ReturnAddressPtr returnAddress)
1811 {
1812     // See if it's worth optimizing this at all.
1813     OptimizationResult optimizationResult = OptimizationResult::NotOptimized;
1814
1815     VM& vm = exec->vm();
1816
1817     if (baseValue.isObject() && subscript.isInt32()) {
1818         JSObject* object = asObject(baseValue);
1819
1820         ASSERT(exec->bytecodeOffset());
1821         ASSERT(!byValInfo->stubRoutine);
1822
1823         if (hasOptimizableIndexing(object->structure(vm))) {
1824             // Attempt to optimize.
1825             Structure* structure = object->structure(vm);
1826             JITArrayMode arrayMode = jitArrayModeForStructure(structure);
1827             if (arrayMode != byValInfo->arrayMode) {
1828                 // If we reached this case, we got an interesting array mode we did not expect when we compiled.
1829                 // Let's update the profile to do better next time.
1830                 CodeBlock* codeBlock = exec->codeBlock();
1831                 ConcurrentJSLocker locker(codeBlock->m_lock);
1832                 byValInfo->arrayProfile->computeUpdatedPrediction(locker, codeBlock, structure);
1833
1834                 JIT::compileGetByVal(&vm, exec->codeBlock(), byValInfo, returnAddress, arrayMode);
1835                 optimizationResult = OptimizationResult::Optimized;
1836             }
1837         }
1838
1839         // If we failed to patch and we have some object that intercepts indexed get, then don't even wait until 10 times.
1840         if (optimizationResult != OptimizationResult::Optimized && object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
1841             optimizationResult = OptimizationResult::GiveUp;
1842     }
1843
1844     if (baseValue.isObject() && isStringOrSymbol(subscript)) {
1845         const Identifier propertyName = subscript.toPropertyKey(exec);
1846         if (subscript.isSymbol() || !parseIndex(propertyName)) {
1847             ASSERT(exec->bytecodeOffset());
1848             ASSERT(!byValInfo->stubRoutine);
1849             if (byValInfo->seen) {
1850                 if (byValInfo->cachedId == propertyName) {
1851                     JIT::compileGetByValWithCachedId(&vm, exec->codeBlock(), byValInfo, returnAddress, propertyName);
1852                     optimizationResult = OptimizationResult::Optimized;
1853                 } else {
1854                     // Seem like a generic property access site.
1855                     optimizationResult = OptimizationResult::GiveUp;
1856                 }
1857             } else {
1858                 CodeBlock* codeBlock = exec->codeBlock();
1859                 ConcurrentJSLocker locker(codeBlock->m_lock);
1860                 byValInfo->seen = true;
1861                 byValInfo->cachedId = propertyName;
1862                 if (subscript.isSymbol())
1863                     byValInfo->cachedSymbol.set(vm, codeBlock, asSymbol(subscript));
1864                 optimizationResult = OptimizationResult::SeenOnce;
1865             }
1866         }
1867     }
1868
1869     if (optimizationResult != OptimizationResult::Optimized && optimizationResult != OptimizationResult::SeenOnce) {
1870         // If we take slow path more than 10 times without patching then make sure we
1871         // never make that mistake again. For cases where we see non-index-intercepting
1872         // objects, this gives 10 iterations worth of opportunity for us to observe
1873         // that the get_by_val may be polymorphic. We count up slowPathCount even if
1874         // the result is GiveUp.
1875         if (++byValInfo->slowPathCount >= 10)
1876             optimizationResult = OptimizationResult::GiveUp;
1877     }
1878
1879     return optimizationResult;
1880 }
1881
1882 extern "C" {
1883
1884 EncodedJSValue JIT_OPERATION operationGetByValGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
1885 {
1886     VM& vm = exec->vm();
1887     NativeCallFrameTracer tracer(&vm, exec);
1888     JSValue baseValue = JSValue::decode(encodedBase);
1889     JSValue subscript = JSValue::decode(encodedSubscript);
1890
1891     JSValue result = getByVal(exec, baseValue, subscript, byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS));
1892     return JSValue::encode(result);
1893 }
1894
1895 EncodedJSValue JIT_OPERATION operationGetByValOptimize(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
1896 {
1897     VM& vm = exec->vm();
1898     NativeCallFrameTracer tracer(&vm, exec);
1899
1900     JSValue baseValue = JSValue::decode(encodedBase);
1901     JSValue subscript = JSValue::decode(encodedSubscript);
1902     ReturnAddressPtr returnAddress = ReturnAddressPtr(OUR_RETURN_ADDRESS);
1903     if (tryGetByValOptimize(exec, baseValue, subscript, byValInfo, returnAddress) == OptimizationResult::GiveUp) {
1904         // Don't ever try to optimize.
1905         byValInfo->tookSlowPath = true;
1906         ctiPatchCallByReturnAddress(returnAddress, FunctionPtr(operationGetByValGeneric));
1907     }
1908
1909     return JSValue::encode(getByVal(exec, baseValue, subscript, byValInfo, returnAddress));
1910 }
1911
1912 EncodedJSValue JIT_OPERATION operationHasIndexedPropertyDefault(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
1913 {
1914     VM& vm = exec->vm();
1915     NativeCallFrameTracer tracer(&vm, exec);
1916     JSValue baseValue = JSValue::decode(encodedBase);
1917     JSValue subscript = JSValue::decode(encodedSubscript);
1918
1919     ASSERT(baseValue.isObject());
1920     ASSERT(subscript.isUInt32());
1921
1922     JSObject* object = asObject(baseValue);
1923     bool didOptimize = false;
1924
1925     ASSERT(exec->bytecodeOffset());
1926     ASSERT(!byValInfo->stubRoutine);
1927
1928     if (hasOptimizableIndexing(object->structure(vm))) {
1929         // Attempt to optimize.
1930         JITArrayMode arrayMode = jitArrayModeForStructure(object->structure(vm));
1931         if (arrayMode != byValInfo->arrayMode) {
1932             JIT::compileHasIndexedProperty(&vm, exec->codeBlock(), byValInfo, ReturnAddressPtr(OUR_RETURN_ADDRESS), arrayMode);
1933             didOptimize = true;
1934         }
1935     }
1936
1937     if (!didOptimize) {
1938         // If we take slow path more than 10 times without patching then make sure we
1939         // never make that mistake again. Or, if we failed to patch and we have some object
1940         // that intercepts indexed get, then don't even wait until 10 times. For cases
1941         // where we see non-index-intercepting objects, this gives 10 iterations worth of
1942         // opportunity for us to observe that the get_by_val may be polymorphic.
1943         if (++byValInfo->slowPathCount >= 10
1944             || object->structure(vm)->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero()) {
1945             // Don't ever try to optimize.
1946             ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(operationHasIndexedPropertyGeneric));
1947         }
1948     }
1949
1950     uint32_t index = subscript.asUInt32();
1951     if (object->canGetIndexQuickly(index))
1952         return JSValue::encode(JSValue(JSValue::JSTrue));
1953
1954     if (!canAccessArgumentIndexQuickly(*object, index)) {
1955         // FIXME: This will make us think that in-bounds typed array accesses are actually
1956         // out-of-bounds.
1957         // https://bugs.webkit.org/show_bug.cgi?id=149886
1958         byValInfo->arrayProfile->setOutOfBounds();
1959     }
1960     return JSValue::encode(jsBoolean(object->hasPropertyGeneric(exec, index, PropertySlot::InternalMethodType::GetOwnProperty)));
1961 }
1962
1963 EncodedJSValue JIT_OPERATION operationHasIndexedPropertyGeneric(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
1964 {
1965     VM& vm = exec->vm();
1966     NativeCallFrameTracer tracer(&vm, exec);
1967     JSValue baseValue = JSValue::decode(encodedBase);
1968     JSValue subscript = JSValue::decode(encodedSubscript);
1969
1970     ASSERT(baseValue.isObject());
1971     ASSERT(subscript.isUInt32());
1972
1973     JSObject* object = asObject(baseValue);
1974     uint32_t index = subscript.asUInt32();
1975     if (object->canGetIndexQuickly(index))
1976         return JSValue::encode(JSValue(JSValue::JSTrue));
1977
1978     if (!canAccessArgumentIndexQuickly(*object, index)) {
1979         // FIXME: This will make us think that in-bounds typed array accesses are actually
1980         // out-of-bounds.
1981         // https://bugs.webkit.org/show_bug.cgi?id=149886
1982         byValInfo->arrayProfile->setOutOfBounds();
1983     }
1984     return JSValue::encode(jsBoolean(object->hasPropertyGeneric(exec, subscript.asUInt32(), PropertySlot::InternalMethodType::GetOwnProperty)));
1985 }
1986
1987 EncodedJSValue JIT_OPERATION operationGetByValString(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedSubscript, ByValInfo* byValInfo)
1988 {
1989     VM& vm = exec->vm();
1990     NativeCallFrameTracer tracer(&vm, exec);
1991     auto scope = DECLARE_THROW_SCOPE(vm);
1992     JSValue baseValue = JSValue::decode(encodedBase);
1993     JSValue subscript = JSValue::decode(encodedSubscript);
1994
1995     JSValue result;
1996     if (LIKELY(subscript.isUInt32())) {
1997         uint32_t i = subscript.asUInt32();
1998         if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i)) {
1999             scope.release();
2000             return JSValue::encode(asString(baseValue)->getIndex(exec, i));
2001         }
2002         result = baseValue.get(exec, i);
2003         RETURN_IF_EXCEPTION(scope, encodedJSValue());
2004         if (!isJSString(baseValue)) {
2005             ASSERT(exec->bytecodeOffset());
2006             ctiPatchCallByReturnAddress(ReturnAddressPtr(OUR_RETURN_ADDRESS), FunctionPtr(byValInfo->stubRoutine ? operationGetByValGeneric : operationGetByValOptimize));
2007         }
2008     } else {
2009         baseValue.requireObjectCoercible(exec);
2010         RETURN_IF_EXCEPTION(scope, encodedJSValue());
2011         auto property = subscript.toPropertyKey(exec);
2012         RETURN_IF_EXCEPTION(scope, encodedJSValue());
2013         scope.release();
2014         result = baseValue.get(exec, property);
2015     }
2016
2017     return JSValue::encode(result);
2018 }
2019
2020 EncodedJSValue JIT_OPERATION operationDeleteByIdJSResult(ExecState* exec, EncodedJSValue base, UniquedStringImpl* uid)
2021 {
2022     return JSValue::encode(jsBoolean(operationDeleteById(exec, base, uid)));
2023 }
2024
2025 size_t JIT_OPERATION operationDeleteById(ExecState* exec, EncodedJSValue encodedBase, UniquedStringImpl* uid)
2026 {
2027     VM& vm = exec->vm();
2028     NativeCallFrameTracer tracer(&vm, exec);
2029     auto scope = DECLARE_THROW_SCOPE(vm);
2030
2031     JSObject* baseObj = JSValue::decode(encodedBase).toObject(exec);
2032     RETURN_IF_EXCEPTION(scope, false);
2033     if (!baseObj)
2034         return false;
2035     bool couldDelete = baseObj->methodTable(vm)->deleteProperty(baseObj, exec, Identifier::fromUid(&vm, uid));
2036     RETURN_IF_EXCEPTION(scope, false);
2037     if (!couldDelete && exec->codeBlock()->isStrictMode())
2038         throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
2039     return couldDelete;
2040 }
2041
2042 EncodedJSValue JIT_OPERATION operationDeleteByValJSResult(ExecState* exec, EncodedJSValue base,  EncodedJSValue key)
2043 {
2044     return JSValue::encode(jsBoolean(operationDeleteByVal(exec, base, key)));
2045 }
2046
2047 size_t JIT_OPERATION operationDeleteByVal(ExecState* exec, EncodedJSValue encodedBase, EncodedJSValue encodedKey)
2048 {
2049     VM& vm = exec->vm();
2050     NativeCallFrameTracer tracer(&vm, exec);
2051     auto scope = DECLARE_THROW_SCOPE(vm);
2052
2053     JSObject* baseObj = JSValue::decode(encodedBase).toObject(exec);
2054     RETURN_IF_EXCEPTION(scope, false);
2055     JSValue key = JSValue::decode(encodedKey);
2056     if (!baseObj)
2057         return false;
2058
2059     bool couldDelete;
2060     uint32_t index;
2061     if (key.getUInt32(index))
2062         couldDelete = baseObj->methodTable(vm)->deletePropertyByIndex(baseObj, exec, index);
2063     else {
2064         Identifier property = key.toPropertyKey(exec);
2065         RETURN_IF_EXCEPTION(scope, false);
2066         couldDelete = baseObj->methodTable(vm)->deleteProperty(baseObj, exec, property);
2067     }
2068     RETURN_IF_EXCEPTION(scope, false);
2069     if (!couldDelete && exec->codeBlock()->isStrictMode())
2070         throwTypeError(exec, scope, ASCIILiteral(UnableToDeletePropertyError));
2071     return couldDelete;
2072 }
2073
2074 JSCell* JIT_OPERATION operationPushWithScope(ExecState* exec, JSCell* currentScopeCell, EncodedJSValue objectValue)
2075 {
2076     VM& vm = exec->vm();
2077     NativeCallFrameTracer tracer(&vm, exec);
2078     auto scope = DECLARE_THROW_SCOPE(vm);
2079
2080     JSObject* object = JSValue::decode(objectValue).toObject(exec);
2081     RETURN_IF_EXCEPTION(scope, nullptr);
2082
2083     JSScope* currentScope = jsCast<JSScope*>(currentScopeCell);
2084
2085     return JSWithScope::create(vm, exec->lexicalGlobalObject(), currentScope, object);
2086 }
2087
2088 JSCell* JIT_OPERATION operationPushWithScopeObject(ExecState* exec, JSCell* currentScopeCell, JSObject* object)
2089 {
2090     VM& vm = exec->vm();
2091     NativeCallFrameTracer tracer(&vm, exec);
2092     JSScope* currentScope = jsCast<JSScope*>(currentScopeCell);
2093     return JSWithScope::create(vm, exec->lexicalGlobalObject(), currentScope, object);
2094 }
2095
2096 EncodedJSValue JIT_OPERATION operationInstanceOf(ExecState* exec, EncodedJSValue encodedValue, EncodedJSValue encodedProto)
2097 {
2098     VM& vm = exec->vm();
2099     NativeCallFrameTracer tracer(&vm, exec);
2100     JSValue value = JSValue::decode(encodedValue);
2101     JSValue proto = JSValue::decode(encodedProto);
2102
2103     bool result = JSObject::defaultHasInstance(exec, value, proto);
2104     return JSValue::encode(jsBoolean(result));
2105 }
2106
2107 int32_t JIT_OPERATION operationSizeFrameForForwardArguments(ExecState* exec, EncodedJSValue, int32_t numUsedStackSlots, int32_t)
2108 {
2109     VM& vm = exec->vm();
2110     NativeCallFrameTracer tracer(&vm, exec);
2111     return sizeFrameForForwardArguments(exec, vm, numUsedStackSlots);
2112 }
2113
2114 int32_t JIT_OPERATION operationSizeFrameForVarargs(ExecState* exec, EncodedJSValue encodedArguments, int32_t numUsedStackSlots, int32_t firstVarArgOffset)
2115 {
2116     VM& vm = exec->vm();
2117     NativeCallFrameTracer tracer(&vm, exec);
2118     JSValue arguments = JSValue::decode(encodedArguments);
2119     return sizeFrameForVarargs(exec, vm, arguments, numUsedStackSlots, firstVarArgOffset);
2120 }
2121
2122 CallFrame* JIT_OPERATION operationSetupForwardArgumentsFrame(ExecState* exec, CallFrame* newCallFrame, EncodedJSValue, int32_t, int32_t length)
2123 {
2124     VM& vm = exec->vm();
2125     NativeCallFrameTracer tracer(&vm, exec);
2126     setupForwardArgumentsFrame(exec, newCallFrame, length);
2127     return newCallFrame;
2128 }
2129
2130 CallFrame* JIT_OPERATION operationSetupVarargsFrame(ExecState* exec, CallFrame* newCallFrame, EncodedJSValue encodedArguments, int32_t firstVarArgOffset, int32_t length)
2131 {
2132     VM& vm = exec->vm();
2133     NativeCallFrameTracer tracer(&vm, exec);
2134     JSValue arguments = JSValue::decode(encodedArguments);
2135     setupVarargsFrame(exec, newCallFrame, arguments, firstVarArgOffset, length);
2136     return newCallFrame;
2137 }
2138
2139 char* JIT_OPERATION operationSwitchCharWithUnknownKeyType(ExecState* exec, EncodedJSValue encodedKey, size_t tableIndex)
2140 {
2141     VM& vm = exec->vm();
2142     NativeCallFrameTracer tracer(&vm, exec);
2143     JSValue key = JSValue::decode(encodedKey);
2144     CodeBlock* codeBlock = exec->codeBlock();
2145
2146     SimpleJumpTable& jumpTable = codeBlock->switchJumpTable(tableIndex);
2147     void* result = jumpTable.ctiDefault.executableAddress();
2148
2149     if (key.isString()) {
2150         StringImpl* value = asString(key)->value(exec).impl();
2151         if (value->length() == 1)
2152             result = jumpTable.ctiForValue((*value)[0]).executableAddress();
2153     }
2154
2155     return reinterpret_cast<char*>(result);
2156 }
2157
2158 char* JIT_OPERATION operationSwitchImmWithUnknownKeyType(ExecState* exec, EncodedJSValue encodedKey, size_t tableIndex)
2159 {
2160     VM& vm = exec->vm();
2161     NativeCallFrameTracer tracer(&vm, exec);
2162     JSValue key = JSValue::decode(encodedKey);
2163     CodeBlock* codeBlock = exec->codeBlock();
2164
2165     SimpleJumpTable& jumpTable = codeBlock->switchJumpTable(tableIndex);
2166     void* result;
2167     if (key.isInt32())
2168         result = jumpTable.ctiForValue(key.asInt32()).executableAddress();
2169     else if (key.isDouble() && key.asDouble() == static_cast<int32_t>(key.asDouble()))
2170         result = jumpTable.ctiForValue(static_cast<int32_t>(key.asDouble())).executableAddress();
2171     else
2172         result = jumpTable.ctiDefault.executableAddress();
2173     return reinterpret_cast<char*>(result);
2174 }
2175
2176 char* JIT_OPERATION operationSwitchStringWithUnknownKeyType(ExecState* exec, EncodedJSValue encodedKey, size_t tableIndex)
2177 {
2178     VM& vm = exec->vm();
2179     NativeCallFrameTracer tracer(&vm, exec);
2180     JSValue key = JSValue::decode(encodedKey);
2181     CodeBlock* codeBlock = exec->codeBlock();
2182
2183     void* result;
2184     StringJumpTable& jumpTable = codeBlock->stringSwitchJumpTable(tableIndex);
2185
2186     if (key.isString()) {
2187         StringImpl* value = asString(key)->value(exec).impl();
2188         result = jumpTable.ctiForValue(value).executableAddress();
2189     } else
2190         result = jumpTable.ctiDefault.executableAddress();
2191
2192     return reinterpret_cast<char*>(result);
2193 }
2194
2195 EncodedJSValue JIT_OPERATION operationGetFromScope(ExecState* exec, Instruction* bytecodePC)
2196 {
2197     VM& vm = exec->vm();
2198     NativeCallFrameTracer tracer(&vm, exec);
2199     auto throwScope = DECLARE_THROW_SCOPE(vm);
2200
2201     CodeBlock* codeBlock = exec->codeBlock();
2202     Instruction* pc = bytecodePC;
2203
2204     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
2205     JSObject* scope = jsCast<JSObject*>(exec->uncheckedR(pc[2].u.operand).jsValue());
2206     GetPutInfo getPutInfo(pc[4].u.operand);
2207
2208     // ModuleVar is always converted to ClosureVar for get_from_scope.
2209     ASSERT(getPutInfo.resolveType() != ModuleVar);
2210
2211     throwScope.release();
2212     return JSValue::encode(scope->getPropertySlot(exec, ident, [&] (bool found, PropertySlot& slot) -> JSValue {
2213         if (!found) {
2214             if (getPutInfo.resolveMode() == ThrowIfNotFound)
2215                 throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
2216             return jsUndefined();
2217         }
2218
2219         JSValue result = JSValue();
2220         if (scope->isGlobalLexicalEnvironment()) {
2221             // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
2222             result = slot.getValue(exec, ident);
2223             if (result == jsTDZValue()) {
2224                 throwException(exec, throwScope, createTDZError(exec));
2225                 return jsUndefined();
2226             }
2227         }
2228
2229         CommonSlowPaths::tryCacheGetFromScopeGlobal(exec, vm, pc, scope, slot, ident);
2230
2231         if (!result)
2232             return slot.getValue(exec, ident);
2233         return result;
2234     }));
2235 }
2236
2237 void JIT_OPERATION operationPutToScope(ExecState* exec, Instruction* bytecodePC)
2238 {
2239     VM& vm = exec->vm();
2240     NativeCallFrameTracer tracer(&vm, exec);
2241     auto throwScope = DECLARE_THROW_SCOPE(vm);
2242
2243     Instruction* pc = bytecodePC;
2244
2245     CodeBlock* codeBlock = exec->codeBlock();
2246     const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
2247     JSObject* scope = jsCast<JSObject*>(exec->uncheckedR(pc[1].u.operand).jsValue());
2248     JSValue value = exec->r(pc[3].u.operand).jsValue();
2249     GetPutInfo getPutInfo = GetPutInfo(pc[4].u.operand);
2250
2251     // ModuleVar does not keep the scope register value alive in DFG.
2252     ASSERT(getPutInfo.resolveType() != ModuleVar);
2253
2254     if (getPutInfo.resolveType() == LocalClosureVar) {
2255         JSLexicalEnvironment* environment = jsCast<JSLexicalEnvironment*>(scope);
2256         environment->variableAt(ScopeOffset(pc[6].u.operand)).set(vm, environment, value);
2257         if (WatchpointSet* set = pc[5].u.watchpointSet)
2258             set->touch(vm, "Executed op_put_scope<LocalClosureVar>");
2259         return;
2260     }
2261
2262     bool hasProperty = scope->hasProperty(exec, ident);
2263     EXCEPTION_ASSERT(!throwScope.exception() || !hasProperty);
2264     if (hasProperty
2265         && scope->isGlobalLexicalEnvironment()
2266         && !isInitialization(getPutInfo.initializationMode())) {
2267         // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
2268         PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
2269         JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
2270         if (slot.getValue(exec, ident) == jsTDZValue()) {
2271             throwException(exec, throwScope, createTDZError(exec));
2272             return;
2273         }
2274     }
2275
2276     if (getPutInfo.resolveMode() == ThrowIfNotFound && !hasProperty) {
2277         throwException(exec, throwScope, createUndefinedVariableError(exec, ident));
2278         return;
2279     }
2280
2281     PutPropertySlot slot(scope, codeBlock->isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
2282     scope->methodTable(vm)->put(scope, exec, ident, value, slot);
2283
2284     RETURN_IF_EXCEPTION(throwScope, void());
2285
2286     CommonSlowPaths::tryCachePutToScopeGlobal(exec, codeBlock, pc, scope, getPutInfo, slot, ident);
2287 }
2288
2289 void JIT_OPERATION operationThrow(ExecState* exec, EncodedJSValue encodedExceptionValue)
2290 {
2291     VM* vm = &exec->vm();
2292     NativeCallFrameTracer tracer(vm, exec);
2293     auto scope = DECLARE_THROW_SCOPE(*vm);
2294
2295     JSValue exceptionValue = JSValue::decode(encodedExceptionValue);
2296     throwException(exec, scope, exceptionValue);
2297
2298     // Results stored out-of-band in vm.targetMachinePCForThrow & vm.callFrameForCatch
2299     genericUnwind(vm, exec);
2300 }
2301
2302 char* JIT_OPERATION operationReallocateButterflyToHavePropertyStorageWithInitialCapacity(ExecState* exec, JSObject* object)
2303 {
2304     VM& vm = exec->vm();
2305     NativeCallFrameTracer tracer(&vm, exec);
2306
2307     ASSERT(!object->structure()->outOfLineCapacity());
2308     Butterfly* result = object->allocateMoreOutOfLineStorage(vm, 0, initialOutOfLineCapacity);
2309     object->nukeStructureAndSetButterfly(vm, object->structureID(), result, object->indexingType());
2310     return reinterpret_cast<char*>(result);
2311 }
2312
2313 char* JIT_OPERATION operationReallocateButterflyToGrowPropertyStorage(ExecState* exec, JSObject* object, size_t newSize)
2314 {
2315     VM& vm = exec->vm();
2316     NativeCallFrameTracer tracer(&vm, exec);
2317
2318     Butterfly* result = object->allocateMoreOutOfLineStorage(vm, object->structure()->outOfLineCapacity(), newSize);
2319     object->nukeStructureAndSetButterfly(vm, object->structureID(), result, object->indexingType());
2320     return reinterpret_cast<char*>(result);
2321 }
2322
2323 void JIT_OPERATION operationOSRWriteBarrier(ExecState* exec, JSCell* cell)
2324 {
2325     VM* vm = &exec->vm();
2326     NativeCallFrameTracer tracer(vm, exec);
2327     vm->heap.writeBarrier(cell);
2328 }
2329
2330 void JIT_OPERATION operationWriteBarrierSlowPath(ExecState* exec, JSCell* cell)
2331 {
2332     VM* vm = &exec->vm();
2333     NativeCallFrameTracer tracer(vm, exec);
2334     vm->heap.writeBarrierSlowPath(cell);
2335 }
2336
2337 void JIT_OPERATION lookupExceptionHandler(VM* vm, ExecState* exec)
2338 {
2339     NativeCallFrameTracer tracer(vm, exec);
2340     genericUnwind(vm, exec);
2341     ASSERT(vm->targetMachinePCForThrow);
2342 }
2343
2344 void JIT_OPERATION lookupExceptionHandlerFromCallerFrame(VM* vm, ExecState* exec)
2345 {
2346     vm->topCallFrame = exec->callerFrame();
2347     genericUnwind(vm, exec, UnwindFromCallerFrame);
2348     ASSERT(vm->targetMachinePCForThrow);
2349 }
2350
2351 void JIT_OPERATION operationVMHandleException(ExecState* exec)
2352 {
2353     VM* vm = &exec->vm();
2354     NativeCallFrameTracer tracer(vm, exec);
2355     genericUnwind(vm, exec);
2356 }
2357
2358 // This function "should" just take the ExecState*, but doing so would make it more difficult
2359 // to call from exception check sites. So, unlike all of our other functions, we allow
2360 // ourselves to play some gnarly ABI tricks just to simplify the calling convention. This is
2361 // particularly safe here since this is never called on the critical path - it's only for
2362 // testing.
2363 void JIT_OPERATION operationExceptionFuzz(ExecState* exec)
2364 {
2365     VM* vm = &exec->vm();
2366     NativeCallFrameTracer tracer(vm, exec);
2367     auto scope = DECLARE_THROW_SCOPE(*vm);
2368     UNUSED_PARAM(scope);
2369 #if COMPILER(GCC_OR_CLANG)
2370     void* returnPC = __builtin_return_address(0);
2371     doExceptionFuzzing(exec, scope, "JITOperations", returnPC);
2372 #endif // COMPILER(GCC_OR_CLANG)
2373 }
2374
2375 EncodedJSValue JIT_OPERATION operationHasGenericProperty(ExecState* exec, EncodedJSValue encodedBaseValue, JSCell* propertyName)
2376 {
2377     VM& vm = exec->vm();
2378     NativeCallFrameTracer tracer(&vm, exec);
2379     JSValue baseValue = JSValue::decode(encodedBaseValue);
2380     if (baseValue.isUndefinedOrNull())
2381         return JSValue::encode(jsBoolean(false));
2382
2383     JSObject* base = baseValue.toObject(exec);
2384     if (!base)
2385         return JSValue::encode(JSValue());
2386     return JSValue::encode(jsBoolean(base->hasPropertyGeneric(exec, asString(propertyName)->toIdentifier(exec), PropertySlot::InternalMethodType::GetOwnProperty)));
2387 }
2388
2389 JSCell* JIT_OPERATION operationGetPropertyEnumeratorCell(ExecState* exec, JSCell* cell)
2390 {
2391     VM& vm = exec->vm();
2392     NativeCallFrameTracer tracer(&vm, exec);
2393     auto scope = DECLARE_THROW_SCOPE(vm);
2394
2395     JSObject* base = cell->toObject(exec, exec->lexicalGlobalObject());
2396     RETURN_IF_EXCEPTION(scope, { });
2397
2398     scope.release();
2399     return propertyNameEnumerator(exec, base);
2400 }
2401
2402 JSCell* JIT_OPERATION operationGetPropertyEnumerator(ExecState* exec, EncodedJSValue encodedBase)
2403 {
2404     VM& vm = exec->vm();
2405     NativeCallFrameTracer tracer(&vm, exec);
2406     auto scope = DECLARE_THROW_SCOPE(vm);
2407
2408     JSValue base = JSValue::decode(encodedBase);
2409     if (base.isUndefinedOrNull())
2410         return JSPropertyNameEnumerator::create(vm);
2411
2412     JSObject* baseObject = base.toObject(exec);
2413     RETURN_IF_EXCEPTION(scope, { });
2414
2415     scope.release();
2416     return propertyNameEnumerator(exec, baseObject);
2417 }
2418
2419 EncodedJSValue JIT_OPERATION operationNextEnumeratorPname(ExecState* exec, JSCell* enumeratorCell, int32_t index)
2420 {
2421     VM& vm = exec->vm();
2422     NativeCallFrameTracer tracer(&vm, exec);
2423     JSPropertyNameEnumerator* enumerator = jsCast<JSPropertyNameEnumerator*>(enumeratorCell);
2424     JSString* propertyName = enumerator->propertyNameAtIndex(index);
2425     return JSValue::encode(propertyName ? propertyName : jsNull());
2426 }
2427
2428 JSCell* JIT_OPERATION operationToIndexString(ExecState* exec, int32_t index)
2429 {
2430     VM& vm = exec->vm();
2431     NativeCallFrameTracer tracer(&vm, exec);
2432     return jsString(exec, Identifier::from(exec, index).string());
2433 }
2434
2435 ALWAYS_INLINE static EncodedJSValue unprofiledAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
2436 {
2437     VM* vm = &exec->vm();
2438     NativeCallFrameTracer tracer(vm, exec);
2439
2440     JSValue op1 = JSValue::decode(encodedOp1);
2441     JSValue op2 = JSValue::decode(encodedOp2);
2442
2443     return JSValue::encode(jsAdd(exec, op1, op2));
2444 }
2445
2446 ALWAYS_INLINE static EncodedJSValue profiledAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile& arithProfile)
2447 {
2448     VM* vm = &exec->vm();
2449     NativeCallFrameTracer tracer(vm, exec);
2450
2451     JSValue op1 = JSValue::decode(encodedOp1);
2452     JSValue op2 = JSValue::decode(encodedOp2);
2453
2454     arithProfile.observeLHSAndRHS(op1, op2);
2455     JSValue result = jsAdd(exec, op1, op2);
2456     arithProfile.observeResult(result);
2457
2458     return JSValue::encode(result);
2459 }
2460
2461 EncodedJSValue JIT_OPERATION operationValueAdd(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
2462 {
2463     return unprofiledAdd(exec, encodedOp1, encodedOp2);
2464 }
2465
2466 EncodedJSValue JIT_OPERATION operationValueAddProfiled(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile* arithProfile)
2467 {
2468     ASSERT(arithProfile);
2469     return profiledAdd(exec, encodedOp1, encodedOp2, *arithProfile);
2470 }
2471
2472 EncodedJSValue JIT_OPERATION operationValueAddProfiledOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)
2473 {
2474     VM* vm = &exec->vm();
2475     NativeCallFrameTracer tracer(vm, exec);
2476
2477     JSValue op1 = JSValue::decode(encodedOp1);
2478     JSValue op2 = JSValue::decode(encodedOp2);
2479
2480     ArithProfile* arithProfile = addIC->arithProfile();
2481     ASSERT(arithProfile);
2482     arithProfile->observeLHSAndRHS(op1, op2);
2483     auto nonOptimizeVariant = operationValueAddProfiledNoOptimize;
2484     addIC->generateOutOfLine(exec->codeBlock(), nonOptimizeVariant);
2485
2486 #if ENABLE(MATH_IC_STATS)
2487     exec->codeBlock()->dumpMathICStats();
2488 #endif
2489
2490     JSValue result = jsAdd(exec, op1, op2);
2491     arithProfile->observeResult(result);
2492
2493     return JSValue::encode(result);
2494 }
2495
2496 EncodedJSValue JIT_OPERATION operationValueAddProfiledNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)
2497 {
2498     VM* vm = &exec->vm();
2499     NativeCallFrameTracer tracer(vm, exec);
2500
2501     ArithProfile* arithProfile = addIC->arithProfile();
2502     ASSERT(arithProfile);
2503     return profiledAdd(exec, encodedOp1, encodedOp2, *arithProfile);
2504 }
2505
2506 EncodedJSValue JIT_OPERATION operationValueAddOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC* addIC)
2507 {
2508     VM* vm = &exec->vm();
2509     NativeCallFrameTracer tracer(vm, exec);
2510
2511     JSValue op1 = JSValue::decode(encodedOp1);
2512     JSValue op2 = JSValue::decode(encodedOp2);
2513
2514     auto nonOptimizeVariant = operationValueAddNoOptimize;
2515     if (ArithProfile* arithProfile = addIC->arithProfile())
2516         arithProfile->observeLHSAndRHS(op1, op2);
2517     addIC->generateOutOfLine(exec->codeBlock(), nonOptimizeVariant);
2518
2519 #if ENABLE(MATH_IC_STATS)
2520     exec->codeBlock()->dumpMathICStats();
2521 #endif
2522
2523     return JSValue::encode(jsAdd(exec, op1, op2));
2524 }
2525
2526 EncodedJSValue JIT_OPERATION operationValueAddNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITAddIC*)
2527 {
2528     VM* vm = &exec->vm();
2529     NativeCallFrameTracer tracer(vm, exec);
2530
2531     JSValue op1 = JSValue::decode(encodedOp1);
2532     JSValue op2 = JSValue::decode(encodedOp2);
2533
2534     JSValue result = jsAdd(exec, op1, op2);
2535
2536     return JSValue::encode(result);
2537 }
2538
2539 ALWAYS_INLINE static EncodedJSValue unprofiledMul(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
2540 {
2541     auto scope = DECLARE_THROW_SCOPE(vm);
2542     JSValue op1 = JSValue::decode(encodedOp1);
2543     JSValue op2 = JSValue::decode(encodedOp2);
2544
2545     double a = op1.toNumber(exec);
2546     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2547     scope.release();
2548     double b = op2.toNumber(exec);
2549     return JSValue::encode(jsNumber(a * b));
2550 }
2551
2552 ALWAYS_INLINE static EncodedJSValue profiledMul(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile& arithProfile, bool shouldObserveLHSAndRHSTypes = true)
2553 {
2554     auto scope = DECLARE_THROW_SCOPE(vm);
2555     JSValue op1 = JSValue::decode(encodedOp1);
2556     JSValue op2 = JSValue::decode(encodedOp2);
2557
2558     if (shouldObserveLHSAndRHSTypes)
2559         arithProfile.observeLHSAndRHS(op1, op2);
2560
2561     double a = op1.toNumber(exec);
2562     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2563     double b = op2.toNumber(exec);
2564     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2565
2566     JSValue result = jsNumber(a * b);
2567     arithProfile.observeResult(result);
2568     return JSValue::encode(result);
2569 }
2570
2571 EncodedJSValue JIT_OPERATION operationValueMul(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
2572 {
2573     VM* vm = &exec->vm();
2574     NativeCallFrameTracer tracer(vm, exec);
2575
2576     return unprofiledMul(*vm, exec, encodedOp1, encodedOp2);
2577 }
2578
2579 EncodedJSValue JIT_OPERATION operationValueMulNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC*)
2580 {
2581     VM* vm = &exec->vm();
2582     NativeCallFrameTracer tracer(vm, exec);
2583
2584     return unprofiledMul(*vm, exec, encodedOp1, encodedOp2);
2585 }
2586
2587 EncodedJSValue JIT_OPERATION operationValueMulOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)
2588 {
2589     VM* vm = &exec->vm();
2590     NativeCallFrameTracer tracer(vm, exec);
2591
2592     auto nonOptimizeVariant = operationValueMulNoOptimize;
2593     if (ArithProfile* arithProfile = mulIC->arithProfile())
2594         arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
2595     mulIC->generateOutOfLine(exec->codeBlock(), nonOptimizeVariant);
2596
2597 #if ENABLE(MATH_IC_STATS)
2598     exec->codeBlock()->dumpMathICStats();
2599 #endif
2600
2601     return unprofiledMul(*vm, exec, encodedOp1, encodedOp2);
2602 }
2603
2604 EncodedJSValue JIT_OPERATION operationValueMulProfiled(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile* arithProfile)
2605 {
2606     VM* vm = &exec->vm();
2607     NativeCallFrameTracer tracer(vm, exec);
2608
2609     ASSERT(arithProfile);
2610     return profiledMul(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
2611 }
2612
2613 EncodedJSValue JIT_OPERATION operationValueMulProfiledOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)
2614 {
2615     VM* vm = &exec->vm();
2616     NativeCallFrameTracer tracer(vm, exec);
2617
2618     ArithProfile* arithProfile = mulIC->arithProfile();
2619     ASSERT(arithProfile);
2620     arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
2621     auto nonOptimizeVariant = operationValueMulProfiledNoOptimize;
2622     mulIC->generateOutOfLine(exec->codeBlock(), nonOptimizeVariant);
2623
2624 #if ENABLE(MATH_IC_STATS)
2625     exec->codeBlock()->dumpMathICStats();
2626 #endif
2627
2628     return profiledMul(*vm, exec, encodedOp1, encodedOp2, *arithProfile, false);
2629 }
2630
2631 EncodedJSValue JIT_OPERATION operationValueMulProfiledNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITMulIC* mulIC)
2632 {
2633     VM* vm = &exec->vm();
2634     NativeCallFrameTracer tracer(vm, exec);
2635
2636     ArithProfile* arithProfile = mulIC->arithProfile();
2637     ASSERT(arithProfile);
2638     return profiledMul(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
2639 }
2640
2641 ALWAYS_INLINE static EncodedJSValue unprofiledNegate(ExecState* exec, EncodedJSValue encodedOperand)
2642 {
2643     VM& vm = exec->vm();
2644     auto scope = DECLARE_THROW_SCOPE(vm);
2645     NativeCallFrameTracer tracer(&vm, exec);
2646
2647     JSValue operand = JSValue::decode(encodedOperand);
2648     double number = operand.toNumber(exec);
2649     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2650     return JSValue::encode(jsNumber(-number));
2651 }
2652
2653 ALWAYS_INLINE static EncodedJSValue profiledNegate(ExecState* exec, EncodedJSValue encodedOperand, ArithProfile& arithProfile)
2654 {
2655     VM& vm = exec->vm();
2656     auto scope = DECLARE_THROW_SCOPE(vm);
2657     NativeCallFrameTracer tracer(&vm, exec);
2658
2659     JSValue operand = JSValue::decode(encodedOperand);
2660     arithProfile.observeLHS(operand);
2661     double number = operand.toNumber(exec);
2662     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2663
2664     JSValue result = jsNumber(-number);
2665     arithProfile.observeResult(result);
2666     return JSValue::encode(result);
2667 }
2668
2669 EncodedJSValue JIT_OPERATION operationArithNegate(ExecState* exec, EncodedJSValue operand)
2670 {
2671     return unprofiledNegate(exec, operand);
2672 }
2673
2674 EncodedJSValue JIT_OPERATION operationArithNegateProfiled(ExecState* exec, EncodedJSValue operand, ArithProfile* arithProfile)
2675 {
2676     ASSERT(arithProfile);
2677     return profiledNegate(exec, operand, *arithProfile);
2678 }
2679
2680 EncodedJSValue JIT_OPERATION operationArithNegateProfiledOptimize(ExecState* exec, EncodedJSValue encodedOperand, JITNegIC* negIC)
2681 {
2682     VM& vm = exec->vm();
2683     auto scope = DECLARE_THROW_SCOPE(vm);
2684     NativeCallFrameTracer tracer(&vm, exec);
2685
2686     JSValue operand = JSValue::decode(encodedOperand);
2687
2688     ArithProfile* arithProfile = negIC->arithProfile();
2689     ASSERT(arithProfile);
2690     arithProfile->observeLHS(operand);
2691     negIC->generateOutOfLine(exec->codeBlock(), operationArithNegateProfiled);
2692
2693 #if ENABLE(MATH_IC_STATS)
2694     exec->codeBlock()->dumpMathICStats();
2695 #endif
2696
2697     double number = operand.toNumber(exec);
2698     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2699     JSValue result = jsNumber(-number);
2700     arithProfile->observeResult(result);
2701     return JSValue::encode(result);
2702 }
2703
2704 EncodedJSValue JIT_OPERATION operationArithNegateOptimize(ExecState* exec, EncodedJSValue encodedOperand, JITNegIC* negIC)
2705 {
2706     VM& vm = exec->vm();
2707     auto scope = DECLARE_THROW_SCOPE(vm);
2708     NativeCallFrameTracer tracer(&vm, exec);
2709
2710     JSValue operand = JSValue::decode(encodedOperand);
2711
2712     if (ArithProfile* arithProfile = negIC->arithProfile())
2713         arithProfile->observeLHS(operand);
2714     negIC->generateOutOfLine(exec->codeBlock(), operationArithNegate);
2715
2716 #if ENABLE(MATH_IC_STATS)
2717     exec->codeBlock()->dumpMathICStats();
2718 #endif
2719
2720     double number = operand.toNumber(exec);
2721     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2722     return JSValue::encode(jsNumber(-number));
2723 }
2724
2725 ALWAYS_INLINE static EncodedJSValue unprofiledSub(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
2726 {
2727     auto scope = DECLARE_THROW_SCOPE(vm);
2728     JSValue op1 = JSValue::decode(encodedOp1);
2729     JSValue op2 = JSValue::decode(encodedOp2);
2730
2731     double a = op1.toNumber(exec);
2732     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2733     scope.release();
2734     double b = op2.toNumber(exec);
2735     return JSValue::encode(jsNumber(a - b));
2736 }
2737
2738 ALWAYS_INLINE static EncodedJSValue profiledSub(VM& vm, ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile& arithProfile, bool shouldObserveLHSAndRHSTypes = true)
2739 {
2740     auto scope = DECLARE_THROW_SCOPE(vm);
2741     JSValue op1 = JSValue::decode(encodedOp1);
2742     JSValue op2 = JSValue::decode(encodedOp2);
2743
2744     if (shouldObserveLHSAndRHSTypes)
2745         arithProfile.observeLHSAndRHS(op1, op2);
2746
2747     double a = op1.toNumber(exec);
2748     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2749     double b = op2.toNumber(exec);
2750     RETURN_IF_EXCEPTION(scope, encodedJSValue());
2751
2752     JSValue result = jsNumber(a - b);
2753     arithProfile.observeResult(result);
2754     return JSValue::encode(result);
2755 }
2756
2757 EncodedJSValue JIT_OPERATION operationValueSub(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2)
2758 {
2759     VM* vm = &exec->vm();
2760     NativeCallFrameTracer tracer(vm, exec);
2761     return unprofiledSub(*vm, exec, encodedOp1, encodedOp2);
2762 }
2763
2764 EncodedJSValue JIT_OPERATION operationValueSubProfiled(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, ArithProfile* arithProfile)
2765 {
2766     ASSERT(arithProfile);
2767
2768     VM* vm = &exec->vm();
2769     NativeCallFrameTracer tracer(vm, exec);
2770
2771     return profiledSub(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
2772 }
2773
2774 EncodedJSValue JIT_OPERATION operationValueSubOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)
2775 {
2776     VM* vm = &exec->vm();
2777     NativeCallFrameTracer tracer(vm, exec);
2778
2779     auto nonOptimizeVariant = operationValueSubNoOptimize;
2780     if (ArithProfile* arithProfile = subIC->arithProfile())
2781         arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
2782     subIC->generateOutOfLine(exec->codeBlock(), nonOptimizeVariant);
2783
2784 #if ENABLE(MATH_IC_STATS)
2785     exec->codeBlock()->dumpMathICStats();
2786 #endif
2787
2788     return unprofiledSub(*vm, exec, encodedOp1, encodedOp2);
2789 }
2790
2791 EncodedJSValue JIT_OPERATION operationValueSubNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC*)
2792 {
2793     VM* vm = &exec->vm();
2794     NativeCallFrameTracer tracer(vm, exec);
2795
2796     return unprofiledSub(*vm, exec, encodedOp1, encodedOp2);
2797 }
2798
2799 EncodedJSValue JIT_OPERATION operationValueSubProfiledOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)
2800 {
2801     VM* vm = &exec->vm();
2802     NativeCallFrameTracer tracer(vm, exec);
2803
2804     ArithProfile* arithProfile = subIC->arithProfile();
2805     ASSERT(arithProfile);
2806     arithProfile->observeLHSAndRHS(JSValue::decode(encodedOp1), JSValue::decode(encodedOp2));
2807     auto nonOptimizeVariant = operationValueSubProfiledNoOptimize;
2808     subIC->generateOutOfLine(exec->codeBlock(), nonOptimizeVariant);
2809
2810 #if ENABLE(MATH_IC_STATS)
2811     exec->codeBlock()->dumpMathICStats();
2812 #endif
2813
2814     return profiledSub(*vm, exec, encodedOp1, encodedOp2, *arithProfile, false);
2815 }
2816
2817 EncodedJSValue JIT_OPERATION operationValueSubProfiledNoOptimize(ExecState* exec, EncodedJSValue encodedOp1, EncodedJSValue encodedOp2, JITSubIC* subIC)
2818 {
2819     VM* vm = &exec->vm();
2820     NativeCallFrameTracer tracer(vm, exec);
2821
2822     ArithProfile* arithProfile = subIC->arithProfile();
2823     ASSERT(arithProfile);
2824     return profiledSub(*vm, exec, encodedOp1, encodedOp2, *arithProfile);
2825 }
2826
2827 void JIT_OPERATION operationProcessTypeProfilerLog(ExecState* exec)
2828 {
2829     VM& vm = exec->vm();
2830     NativeCallFrameTracer tracer(&vm, exec);
2831     vm.typeProfilerLog()->processLogEntries(ASCIILiteral("Log Full, called from inside baseline JIT"));
2832 }
2833
2834 void JIT_OPERATION operationProcessShadowChickenLog(ExecState* exec)
2835 {
2836     VM& vm = exec->vm();
2837     NativeCallFrameTracer tracer(&vm, exec);
2838     vm.shadowChicken().update(vm, exec);
2839 }
2840
2841 int32_t JIT_OPERATION operationCheckIfExceptionIsUncatchableAndNotifyProfiler(ExecState* exec)
2842 {
2843     VM& vm = exec->vm();
2844     NativeCallFrameTracer tracer(&vm, exec);
2845     auto scope = DECLARE_THROW_SCOPE(vm);
2846     RELEASE_ASSERT(!!scope.exception());
2847
2848     if (isTerminatedExecutionException(vm, scope.exception())) {
2849         genericUnwind(&vm, exec);
2850         return 1;
2851     }
2852     return 0;
2853 }
2854
2855 } // extern "C"
2856
2857 // Note: getHostCallReturnValueWithExecState() needs to be placed before the
2858 // definition of getHostCallReturnValue() below because the Windows build
2859 // requires it.
2860 extern "C" EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValueWithExecState(ExecState* exec)
2861 {
2862     if (!exec)
2863         return JSValue::encode(JSValue());
2864     return JSValue::encode(exec->vm().hostCallReturnValue);
2865 }
2866
2867 #if COMPILER(GCC_OR_CLANG) && CPU(X86_64)
2868 asm (
2869 ".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
2870 HIDE_SYMBOL(getHostCallReturnValue) "\n"
2871 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
2872     "lea -8(%rsp), %rdi\n"
2873     "jmp " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
2874 );
2875
2876 #elif COMPILER(GCC_OR_CLANG) && CPU(X86)
2877 asm (
2878 ".text" "\n" \
2879 ".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
2880 HIDE_SYMBOL(getHostCallReturnValue) "\n"
2881 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
2882     "push %ebp\n"
2883     "mov %esp, %eax\n"
2884     "leal -4(%esp), %esp\n"
2885     "push %eax\n"
2886     "call " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
2887     "leal 8(%esp), %esp\n"
2888     "pop %ebp\n"
2889     "ret\n"
2890 );
2891
2892 #elif COMPILER(GCC_OR_CLANG) && CPU(ARM_THUMB2)
2893 asm (
2894 ".text" "\n"
2895 ".align 2" "\n"
2896 ".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
2897 HIDE_SYMBOL(getHostCallReturnValue) "\n"
2898 ".thumb" "\n"
2899 ".thumb_func " THUMB_FUNC_PARAM(getHostCallReturnValue) "\n"
2900 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
2901     "sub r0, sp, #8" "\n"
2902     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
2903 );
2904
2905 #elif COMPILER(GCC_OR_CLANG) && CPU(ARM_TRADITIONAL)
2906 asm (
2907 ".text" "\n"
2908 ".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
2909 HIDE_SYMBOL(getHostCallReturnValue) "\n"
2910 INLINE_ARM_FUNCTION(getHostCallReturnValue)
2911 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
2912     "sub r0, sp, #8" "\n"
2913     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
2914 );
2915
2916 #elif CPU(ARM64)
2917 asm (
2918 ".text" "\n"
2919 ".align 2" "\n"
2920 ".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
2921 HIDE_SYMBOL(getHostCallReturnValue) "\n"
2922 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
2923      "sub x0, sp, #16" "\n"
2924      "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
2925 );
2926
2927 #elif COMPILER(GCC_OR_CLANG) && CPU(MIPS)
2928
2929 #if WTF_MIPS_PIC
2930 #define LOAD_FUNCTION_TO_T9(function) \
2931         ".set noreorder" "\n" \
2932         ".cpload $25" "\n" \
2933         ".set reorder" "\n" \
2934         "la $t9, " LOCAL_REFERENCE(function) "\n"
2935 #else
2936 #define LOAD_FUNCTION_TO_T9(function) "" "\n"
2937 #endif
2938
2939 asm (
2940 ".text" "\n"
2941 ".globl " SYMBOL_STRING(getHostCallReturnValue) "\n"
2942 HIDE_SYMBOL(getHostCallReturnValue) "\n"
2943 SYMBOL_STRING(getHostCallReturnValue) ":" "\n"
2944     LOAD_FUNCTION_TO_T9(getHostCallReturnValueWithExecState)
2945     "addi $a0, $sp, -8" "\n"
2946     "b " LOCAL_REFERENCE(getHostCallReturnValueWithExecState) "\n"
2947 );
2948
2949 #elif COMPILER(MSVC) && CPU(X86)
2950 extern "C" {
2951     __declspec(naked) EncodedJSValue HOST_CALL_RETURN_VALUE_OPTION getHostCallReturnValue()
2952     {
2953         __asm lea eax, [esp - 4]
2954         __asm mov [esp + 4], eax;
2955         __asm jmp getHostCallReturnValueWithExecState
2956     }
2957 }
2958 #endif
2959
2960 } // namespace JSC
2961
2962 #endif // ENABLE(JIT)