Source/JavaScriptCore/llint/LLIntSlowPaths.cpp

   1 /*
   2  * Copyright (C) 2011, 2012, 2013 Apple Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions
   6  * are met:
   7  * 1. Redistributions of source code must retain the above copyright
   8  *    notice, this list of conditions and the following disclaimer.
   9  * 2. Redistributions in binary form must reproduce the above copyright
  10  *    notice, this list of conditions and the following disclaimer in the
  11  *    documentation and/or other materials provided with the distribution.
  12  *
  13  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  14  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  16  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  17  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  18  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  19  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  20  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  21  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  24  */
  25
  26 #include "config.h"
  27 #include "LLIntSlowPaths.h"
  28
  29 #if ENABLE(LLINT)
  30
  31 #include "Arguments.h"
  32 #include "ArrayConstructor.h"
  33 #include "CallFrame.h"
  34 #include "CommonSlowPaths.h"
  35 #include "CommonSlowPathsExceptions.h"
  36 #include "GetterSetter.h"
  37 #include "HostCallReturnValue.h"
  38 #include "Interpreter.h"
  39 #include "JIT.h"
  40 #include "JITDriver.h"
  41 #include "JSActivation.h"
  42 #include "JSCJSValue.h"
  43 #include "JSGlobalObjectFunctions.h"
  44 #include "JSNameScope.h"
  45 #include "JSPropertyNameIterator.h"
  46 #include "JSString.h"
  47 #include "JSWithScope.h"
  48 #include "LLIntCommon.h"
  49 #include "LLIntExceptions.h"
  50 #include "LowLevelInterpreter.h"
  51 #include "ObjectConstructor.h"
  52 #include "Operations.h"
  53 #include "StructureRareDataInlines.h"
  54 #include <wtf/StringPrintStream.h>
  55
  56 namespace JSC { namespace LLInt {
  57
  58 #define LLINT_BEGIN_NO_SET_PC() \
  59     VM& vm = exec->vm();      \
  60     NativeCallFrameTracer tracer(&vm, exec)
  61
  62 #ifndef NDEBUG
  63 #define LLINT_SET_PC_FOR_STUBS() do { \
  64         exec->codeBlock()->bytecodeOffset(pc); \
  65         exec->setCurrentVPC(pc + 1); \
  66     } while (false)
  67 #else
  68 #define LLINT_SET_PC_FOR_STUBS() do { \
  69         exec->setCurrentVPC(pc + 1); \
  70     } while (false)
  71 #endif
  72
  73 #define LLINT_BEGIN()                           \
  74     LLINT_BEGIN_NO_SET_PC();                    \
  75     LLINT_SET_PC_FOR_STUBS()
  76
  77 #define LLINT_OP(index) (exec->uncheckedR(pc[index].u.operand))
  78 #define LLINT_OP_C(index) (exec->r(pc[index].u.operand))
  79
  80 #define LLINT_RETURN_TWO(first, second) do {       \
  81         return encodeResult(first, second);        \
  82     } while (false)
  83
  84 #define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, exec)
  85
  86 #define LLINT_THROW(exceptionToThrow) do {                        \
  87         vm.throwException(exec, exceptionToThrow);             \
  88         pc = returnToThrow(exec, pc);                             \
  89         LLINT_END_IMPL();                                         \
  90     } while (false)
  91
  92 #define LLINT_CHECK_EXCEPTION() do {                    \
  93         if (UNLIKELY(vm.exception())) {           \
  94             pc = returnToThrow(exec, pc);               \
  95             LLINT_END_IMPL();                           \
  96         }                                               \
  97     } while (false)
  98
  99 #define LLINT_END() do {                        \
 100         LLINT_CHECK_EXCEPTION();                \
 101         LLINT_END_IMPL();                       \
 102     } while (false)
 103
 104 #define LLINT_BRANCH(opcode, condition) do {                      \
 105         bool __b_condition = (condition);                         \
 106         LLINT_CHECK_EXCEPTION();                                  \
 107         if (__b_condition)                                        \
 108             pc += pc[OPCODE_LENGTH(opcode) - 1].u.operand;        \
 109         else                                                      \
 110             pc += OPCODE_LENGTH(opcode);                          \
 111         LLINT_END_IMPL();                                         \
 112     } while (false)
 113
 114 #define LLINT_RETURN(value) do {                \
 115         JSValue __r_returnValue = (value);      \
 116         LLINT_CHECK_EXCEPTION();                \
 117         LLINT_OP(1) = __r_returnValue;          \
 118         LLINT_END_IMPL();                       \
 119     } while (false)
 120
 121 #if ENABLE(VALUE_PROFILER)
 122 #define LLINT_RETURN_PROFILED(opcode, value) do {               \
 123         JSValue __rp_returnValue = (value);                     \
 124         LLINT_CHECK_EXCEPTION();                                \
 125         LLINT_OP(1) = __rp_returnValue;                         \
 126         LLINT_PROFILE_VALUE(opcode, __rp_returnValue);          \
 127         LLINT_END_IMPL();                                       \
 128     } while (false)
 129
 130 #define LLINT_PROFILE_VALUE(opcode, value) do { \
 131         pc[OPCODE_LENGTH(opcode) - 1].u.profile->m_buckets[0] = \
 132         JSValue::encode(value);                  \
 133     } while (false)
 134
 135 #else // ENABLE(VALUE_PROFILER)
 136 #define LLINT_RETURN_PROFILED(opcode, value) LLINT_RETURN(value)
 137
 138 #define LLINT_PROFILE_VALUE(opcode, value) do { } while (false)
 139
 140 #endif // ENABLE(VALUE_PROFILER)
 141
 142 #define LLINT_CALL_END_IMPL(exec, callTarget) LLINT_RETURN_TWO((callTarget), (exec))
 143
 144 #define LLINT_CALL_THROW(exec, pc, exceptionToThrow) do {               \
 145         ExecState* __ct_exec = (exec);                                  \
 146         Instruction* __ct_pc = (pc);                                    \
 147         vm.throwException(__ct_exec, exceptionToThrow);                     \
 148         LLINT_CALL_END_IMPL(__ct_exec, callToThrow(__ct_exec, __ct_pc)); \
 149     } while (false)
 150
 151 #define LLINT_CALL_CHECK_EXCEPTION(exec, pc) do {                       \
 152         ExecState* __cce_exec = (exec);                                 \
 153         Instruction* __cce_pc = (pc);                                   \
 154         if (UNLIKELY(vm.exception()))                                     \
 155             LLINT_CALL_END_IMPL(__cce_exec, callToThrow(__cce_exec, __cce_pc)); \
 156     } while (false)
 157
 158 #define LLINT_CALL_RETURN(exec, pc, callTarget) do {                    \
 159         ExecState* __cr_exec = (exec);                                  \
 160         Instruction* __cr_pc = (pc);                                    \
 161         void* __cr_callTarget = (callTarget);                           \
 162         LLINT_CALL_CHECK_EXCEPTION(__cr_exec->callerFrame(), __cr_pc);  \
 163         LLINT_CALL_END_IMPL(__cr_exec, __cr_callTarget);                \
 164     } while (false)
 165
 166 extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
 167 {
 168     LLINT_BEGIN();
 169     dataLogF("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d\n",
 170             exec->codeBlock(),
 171             exec,
 172             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
 173             exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
 174             fromWhere,
 175             operand,
 176             pc[operand].u.operand);
 177     LLINT_END();
 178 }
 179
 180 extern "C" SlowPathReturnType llint_trace_value(ExecState* exec, Instruction* pc, int fromWhere, int operand)
 181 {
 182     JSValue value = LLINT_OP_C(operand).jsValue();
 183     union {
 184         struct {
 185             uint32_t tag;
 186             uint32_t payload;
 187         } bits;
 188         EncodedJSValue asValue;
 189     } u;
 190     u.asValue = JSValue::encode(value);
 191     dataLogF(
 192         "%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d: %08x:%08x: %s\n",
 193         exec->codeBlock(),
 194         exec,
 195         static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
 196         exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
 197         fromWhere,
 198         operand,
 199         pc[operand].u.operand,
 200         u.bits.tag,
 201         u.bits.payload,
 202         toCString(value).data());
 203     LLINT_END_IMPL();
 204 }
 205
 206 LLINT_SLOW_PATH_DECL(trace_prologue)
 207 {
 208     dataLogF("%p / %p: in prologue.\n", exec->codeBlock(), exec);
 209     LLINT_END_IMPL();
 210 }
 211
 212 static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpecializationKind kind)
 213 {
 214     JSFunction* callee = jsCast<JSFunction*>(exec->callee());
 215     FunctionExecutable* executable = callee->jsExecutable();
 216     CodeBlock* codeBlock = &executable->generatedBytecodeFor(kind);
 217     dataLogF("%p / %p: in %s of function %p, executable %p; numVars = %u, numParameters = %u, numCalleeRegisters = %u, caller = %p.\n",
 218             codeBlock, exec, comment, callee, executable,
 219             codeBlock->m_numVars, codeBlock->numParameters(), codeBlock->m_numCalleeRegisters,
 220             exec->callerFrame());
 221 }
 222
 223 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_call)
 224 {
 225     traceFunctionPrologue(exec, "call prologue", CodeForCall);
 226     LLINT_END_IMPL();
 227 }
 228
 229 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_construct)
 230 {
 231     traceFunctionPrologue(exec, "construct prologue", CodeForConstruct);
 232     LLINT_END_IMPL();
 233 }
 234
 235 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_call)
 236 {
 237     traceFunctionPrologue(exec, "call arity check", CodeForCall);
 238     LLINT_END_IMPL();
 239 }
 240
 241 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_construct)
 242 {
 243     traceFunctionPrologue(exec, "construct arity check", CodeForConstruct);
 244     LLINT_END_IMPL();
 245 }
 246
 247 LLINT_SLOW_PATH_DECL(trace)
 248 {
 249     dataLogF("%p / %p: executing bc#%zu, %s, scope %p\n",
 250             exec->codeBlock(),
 251             exec,
 252             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
 253             opcodeNames[exec->vm().interpreter->getOpcodeID(pc[0].u.opcode)],
 254             exec->scope());
 255     if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_ret) {
 256         dataLogF("Will be returning to %p\n", exec->returnPC().value());
 257         dataLogF("The new cfr will be %p\n", exec->callerFrame());
 258     }
 259     LLINT_END_IMPL();
 260 }
 261
 262 LLINT_SLOW_PATH_DECL(special_trace)
 263 {
 264     dataLogF("%p / %p: executing special case bc#%zu, op#%u, return PC is %p\n",
 265             exec->codeBlock(),
 266             exec,
 267             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
 268             exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
 269             exec->returnPC().value());
 270     LLINT_END_IMPL();
 271 }
 272
 273 #if ENABLE(JIT)
 274 inline bool shouldJIT(ExecState* exec)
 275 {
 276     // You can modify this to turn off JITting without rebuilding the world.
 277     return exec->vm().canUseJIT();
 278 }
 279
 280 // Returns true if we should try to OSR.
 281 inline bool jitCompileAndSetHeuristics(CodeBlock* codeBlock, ExecState* exec)
 282 {
 283     codeBlock->updateAllValueProfilePredictions();
 284
 285     if (!codeBlock->checkIfJITThresholdReached()) {
 286         if (Options::verboseOSR())
 287             dataLogF("    JIT threshold should be lifted.\n");
 288         return false;
 289     }
 290
 291     CompilationResult result = codeBlock->jitCompile(exec);
 292     switch (result) {
 293     case CompilationNotNeeded:
 294         if (Options::verboseOSR())
 295             dataLogF("    Code was already compiled.\n");
 296         codeBlock->jitSoon();
 297         return true;
 298     case CompilationFailed:
 299         if (Options::verboseOSR())
 300             dataLogF("    JIT compilation failed.\n");
 301         codeBlock->dontJITAnytimeSoon();
 302         return false;
 303     case CompilationSuccessful:
 304         if (Options::verboseOSR())
 305             dataLogF("    JIT compilation successful.\n");
 306         codeBlock->jitSoon();
 307         return true;
 308     default:
 309         RELEASE_ASSERT_NOT_REACHED();
 310         return false;
 311     }
 312 }
 313
 314 enum EntryKind { Prologue, ArityCheck };
 315 static SlowPathReturnType entryOSR(ExecState* exec, Instruction*, CodeBlock* codeBlock, const char *name, EntryKind kind)
 316 {
 317     if (Options::verboseOSR()) {
 318         dataLog(
 319             *codeBlock, ": Entered ", name, " with executeCounter = ",
 320             codeBlock->llintExecuteCounter(), "\n");
 321     }
 322
 323     if (!shouldJIT(exec)) {
 324         codeBlock->dontJITAnytimeSoon();
 325         LLINT_RETURN_TWO(0, exec);
 326     }
 327     if (!jitCompileAndSetHeuristics(codeBlock, exec))
 328         LLINT_RETURN_TWO(0, exec);
 329
 330     if (kind == Prologue)
 331         LLINT_RETURN_TWO(codeBlock->jitCode()->executableAddress(), exec);
 332     ASSERT(kind == ArityCheck);
 333     LLINT_RETURN_TWO(codeBlock->jitCodeWithArityCheck().executableAddress(), exec);
 334 }
 335
 336 LLINT_SLOW_PATH_DECL(entry_osr)
 337 {
 338     return entryOSR(exec, pc, exec->codeBlock(), "entry_osr", Prologue);
 339 }
 340
 341 LLINT_SLOW_PATH_DECL(entry_osr_function_for_call)
 342 {
 343     return entryOSR(exec, pc, &jsCast<JSFunction*>(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForCall), "entry_osr_function_for_call", Prologue);
 344 }
 345
 346 LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct)
 347 {
 348     return entryOSR(exec, pc, &jsCast<JSFunction*>(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForConstruct), "entry_osr_function_for_construct", Prologue);
 349 }
 350
 351 LLINT_SLOW_PATH_DECL(entry_osr_function_for_call_arityCheck)
 352 {
 353     return entryOSR(exec, pc, &jsCast<JSFunction*>(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForCall), "entry_osr_function_for_call_arityCheck", ArityCheck);
 354 }
 355
 356 LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct_arityCheck)
 357 {
 358     return entryOSR(exec, pc, &jsCast<JSFunction*>(exec->callee())->jsExecutable()->generatedBytecodeFor(CodeForConstruct), "entry_osr_function_for_construct_arityCheck", ArityCheck);
 359 }
 360
 361 LLINT_SLOW_PATH_DECL(loop_osr)
 362 {
 363     CodeBlock* codeBlock = exec->codeBlock();
 364
 365     if (Options::verboseOSR()) {
 366         dataLog(
 367             *codeBlock, ": Entered loop_osr with executeCounter = ",
 368             codeBlock->llintExecuteCounter(), "\n");
 369     }
 370
 371     if (!shouldJIT(exec)) {
 372         codeBlock->dontJITAnytimeSoon();
 373         LLINT_RETURN_TWO(0, exec);
 374     }
 375
 376     if (!jitCompileAndSetHeuristics(codeBlock, exec))
 377         LLINT_RETURN_TWO(0, exec);
 378
 379     ASSERT(codeBlock->jitType() == JITCode::BaselineJIT);
 380
 381     Vector<BytecodeAndMachineOffset> map;
 382     codeBlock->jitCodeMap()->decode(map);
 383     BytecodeAndMachineOffset* mapping = binarySearch<BytecodeAndMachineOffset, unsigned>(map, map.size(), pc - codeBlock->instructions().begin(), BytecodeAndMachineOffset::getBytecodeIndex);
 384     ASSERT(mapping);
 385     ASSERT(mapping->m_bytecodeIndex == static_cast<unsigned>(pc - codeBlock->instructions().begin()));
 386
 387     void* jumpTarget = codeBlock->jitCode()->executableAddressAtOffset(mapping->m_machineCodeOffset);
 388     ASSERT(jumpTarget);
 389
 390     LLINT_RETURN_TWO(jumpTarget, exec);
 391 }
 392
 393 LLINT_SLOW_PATH_DECL(replace)
 394 {
 395     CodeBlock* codeBlock = exec->codeBlock();
 396
 397     if (Options::verboseOSR()) {
 398         dataLog(
 399             *codeBlock, ": Entered replace with executeCounter = ",
 400             codeBlock->llintExecuteCounter(), "\n");
 401     }
 402
 403     if (shouldJIT(exec))
 404         jitCompileAndSetHeuristics(codeBlock, exec);
 405     else
 406         codeBlock->dontJITAnytimeSoon();
 407     LLINT_END_IMPL();
 408 }
 409 #endif // ENABLE(JIT)
 410
 411 LLINT_SLOW_PATH_DECL(stack_check)
 412 {
 413     LLINT_BEGIN();
 414 #if LLINT_SLOW_PATH_TRACING
 415     dataLogF("Checking stack height with exec = %p.\n", exec);
 416     dataLogF("CodeBlock = %p.\n", exec->codeBlock());
 417     dataLogF("Num callee registers = %u.\n", exec->codeBlock()->m_numCalleeRegisters);
 418     dataLogF("Num vars = %u.\n", exec->codeBlock()->m_numVars);
 419     dataLogF("Current end is at %p.\n", exec->vm().interpreter->stack().end());
 420 #endif
 421     ASSERT(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters] > exec->vm().interpreter->stack().end());
 422     if (UNLIKELY(!vm.interpreter->stack().grow(&exec->registers()[exec->codeBlock()->m_numCalleeRegisters]))) {
 423         ReturnAddressPtr returnPC = exec->returnPC();
 424         exec = exec->callerFrame();
 425         vm.throwException(exec, createStackOverflowError(exec));
 426         CommonSlowPaths::interpreterThrowInCaller(exec, returnPC);
 427         pc = returnToThrowForThrownException(exec);
 428     }
 429     LLINT_END_IMPL();
 430 }
 431
 432 LLINT_SLOW_PATH_DECL(slow_path_create_activation)
 433 {
 434     LLINT_BEGIN();
 435 #if LLINT_SLOW_PATH_TRACING
 436     dataLogF("Creating an activation, exec = %p!\n", exec);
 437 #endif
 438     JSActivation* activation = JSActivation::create(vm, exec, exec->codeBlock());
 439     exec->setScope(activation);
 440     LLINT_RETURN(JSValue(activation));
 441 }
 442
 443 LLINT_SLOW_PATH_DECL(slow_path_new_object)
 444 {
 445     LLINT_BEGIN();
 446     LLINT_RETURN(constructEmptyObject(exec, pc[3].u.objectAllocationProfile->structure()));
 447 }
 448
 449 LLINT_SLOW_PATH_DECL(slow_path_new_array)
 450 {
 451     LLINT_BEGIN();
 452     LLINT_RETURN(constructArray(exec, pc[4].u.arrayAllocationProfile, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
 453 }
 454
 455 LLINT_SLOW_PATH_DECL(slow_path_new_array_with_size)
 456 {
 457     LLINT_BEGIN();
 458     LLINT_RETURN(constructArrayWithSizeQuirk(exec, pc[3].u.arrayAllocationProfile, exec->lexicalGlobalObject(), LLINT_OP_C(2).jsValue()));
 459 }
 460
 461 LLINT_SLOW_PATH_DECL(slow_path_new_array_buffer)
 462 {
 463     LLINT_BEGIN();
 464     LLINT_RETURN(constructArray(exec, pc[4].u.arrayAllocationProfile, exec->codeBlock()->constantBuffer(pc[2].u.operand), pc[3].u.operand));
 465 }
 466
 467 LLINT_SLOW_PATH_DECL(slow_path_new_regexp)
 468 {
 469     LLINT_BEGIN();
 470     RegExp* regExp = exec->codeBlock()->regexp(pc[2].u.operand);
 471     if (!regExp->isValid())
 472         LLINT_THROW(createSyntaxError(exec, "Invalid flag supplied to RegExp constructor."));
 473     LLINT_RETURN(RegExpObject::create(vm, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp));
 474 }
 475
 476 LLINT_SLOW_PATH_DECL(slow_path_check_has_instance)
 477 {
 478     LLINT_BEGIN();
 479
 480     JSValue value = LLINT_OP_C(2).jsValue();
 481     JSValue baseVal = LLINT_OP_C(3).jsValue();
 482     if (baseVal.isObject()) {
 483         JSObject* baseObject = asObject(baseVal);
 484         ASSERT(!baseObject->structure()->typeInfo().implementsDefaultHasInstance());
 485         if (baseObject->structure()->typeInfo().implementsHasInstance()) {
 486             pc += pc[4].u.operand;
 487             LLINT_RETURN(jsBoolean(baseObject->methodTable()->customHasInstance(baseObject, exec, value)));
 488         }
 489     }
 490     LLINT_THROW(createInvalidParameterError(exec, "instanceof", baseVal));
 491 }
 492
 493 LLINT_SLOW_PATH_DECL(slow_path_instanceof)
 494 {
 495     LLINT_BEGIN();
 496     JSValue value = LLINT_OP_C(2).jsValue();
 497     JSValue proto = LLINT_OP_C(3).jsValue();
 498     ASSERT(!value.isObject() || !proto.isObject());
 499     LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
 500 }
 501
 502 LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
 503 {
 504     LLINT_BEGIN();
 505     CodeBlock* codeBlock = exec->codeBlock();
 506     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
 507     JSValue baseValue = LLINT_OP_C(2).jsValue();
 508     PropertySlot slot(baseValue);
 509
 510     JSValue result = baseValue.get(exec, ident, slot);
 511     LLINT_CHECK_EXCEPTION();
 512     LLINT_OP(1) = result;
 513
 514     if (!LLINT_ALWAYS_ACCESS_SLOW
 515         && baseValue.isCell()
 516         && slot.isCacheable()
 517         && slot.slotBase() == baseValue
 518         && slot.isCacheableValue()) {
 519
 520         JSCell* baseCell = baseValue.asCell();
 521         Structure* structure = baseCell->structure();
 522
 523         if (!structure->isUncacheableDictionary()
 524             && !structure->typeInfo().prohibitsPropertyCaching()) {
 525             ConcurrentJITLocker locker(codeBlock->m_lock);
 526
 527             pc[4].u.structure.set(
 528                 vm, codeBlock->ownerExecutable(), structure);
 529             if (isInlineOffset(slot.cachedOffset())) {
 530                 pc[0].u.opcode = LLInt::getOpcode(llint_op_get_by_id);
 531                 pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
 532             } else {
 533                 pc[0].u.opcode = LLInt::getOpcode(llint_op_get_by_id_out_of_line);
 534                 pc[5].u.operand = offsetInButterfly(slot.cachedOffset()) * sizeof(JSValue);
 535             }
 536         }
 537     }
 538
 539     if (!LLINT_ALWAYS_ACCESS_SLOW
 540         && isJSArray(baseValue)
 541         && ident == exec->propertyNames().length) {
 542         pc[0].u.opcode = LLInt::getOpcode(llint_op_get_array_length);
 543 #if ENABLE(VALUE_PROFILER)
 544         ArrayProfile* arrayProfile = codeBlock->getOrAddArrayProfile(pc - codeBlock->instructions().begin());
 545         arrayProfile->observeStructure(baseValue.asCell()->structure());
 546         pc[4].u.arrayProfile = arrayProfile;
 547 #endif
 548     }
 549
 550 #if ENABLE(VALUE_PROFILER)
 551     pc[OPCODE_LENGTH(op_get_by_id) - 1].u.profile->m_buckets[0] = JSValue::encode(result);
 552 #endif
 553     LLINT_END();
 554 }
 555
 556 LLINT_SLOW_PATH_DECL(slow_path_get_arguments_length)
 557 {
 558     LLINT_BEGIN();
 559     CodeBlock* codeBlock = exec->codeBlock();
 560     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
 561     JSValue baseValue = LLINT_OP(2).jsValue();
 562     PropertySlot slot(baseValue);
 563     LLINT_RETURN(baseValue.get(exec, ident, slot));
 564 }
 565
 566 LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
 567 {
 568     LLINT_BEGIN();
 569     CodeBlock* codeBlock = exec->codeBlock();
 570     const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
 571
 572     JSValue baseValue = LLINT_OP_C(1).jsValue();
 573     PutPropertySlot slot(codeBlock->isStrictMode(), codeBlock->putByIdContext());
 574     if (pc[8].u.operand)
 575         asObject(baseValue)->putDirect(vm, ident, LLINT_OP_C(3).jsValue(), slot);
 576     else
 577         baseValue.put(exec, ident, LLINT_OP_C(3).jsValue(), slot);
 578     LLINT_CHECK_EXCEPTION();
 579
 580     if (!LLINT_ALWAYS_ACCESS_SLOW
 581         && baseValue.isCell()
 582         && slot.isCacheable()) {
 583
 584         JSCell* baseCell = baseValue.asCell();
 585         Structure* structure = baseCell->structure();
 586
 587         if (!structure->isUncacheableDictionary()
 588             && !structure->typeInfo().prohibitsPropertyCaching()
 589             && baseCell == slot.base()) {
 590
 591             if (slot.type() == PutPropertySlot::NewProperty) {
 592                 ConcurrentJITLocker locker(codeBlock->m_lock);
 593
 594                 if (!structure->isDictionary() && structure->previousID()->outOfLineCapacity() == structure->outOfLineCapacity()) {
 595                     ASSERT(structure->previousID()->transitionWatchpointSetHasBeenInvalidated());
 596
 597                     // This is needed because some of the methods we call
 598                     // below may GC.
 599                     pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id);
 600
 601                     if (normalizePrototypeChain(exec, baseCell) != InvalidPrototypeChain) {
 602                         ASSERT(structure->previousID()->isObject());
 603                         pc[4].u.structure.set(
 604                             vm, codeBlock->ownerExecutable(), structure->previousID());
 605                         if (isInlineOffset(slot.cachedOffset()))
 606                             pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
 607                         else
 608                             pc[5].u.operand = offsetInButterfly(slot.cachedOffset()) * sizeof(JSValue);
 609                         pc[6].u.structure.set(
 610                             vm, codeBlock->ownerExecutable(), structure);
 611                         StructureChain* chain = structure->prototypeChain(exec);
 612                         ASSERT(chain);
 613                         pc[7].u.structureChain.set(
 614                             vm, codeBlock->ownerExecutable(), chain);
 615
 616                         if (pc[8].u.operand) {
 617                             if (isInlineOffset(slot.cachedOffset()))
 618                                 pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct);
 619                             else
 620                                 pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_direct_out_of_line);
 621                         } else {
 622                             if (isInlineOffset(slot.cachedOffset()))
 623                                 pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal);
 624                             else
 625                                 pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_transition_normal_out_of_line);
 626                         }
 627                     }
 628                 }
 629             } else {
 630                 pc[4].u.structure.set(
 631                     vm, codeBlock->ownerExecutable(), structure);
 632                 if (isInlineOffset(slot.cachedOffset())) {
 633                     pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id);
 634                     pc[5].u.operand = offsetInInlineStorage(slot.cachedOffset()) * sizeof(JSValue) + JSObject::offsetOfInlineStorage();
 635                 } else {
 636                     pc[0].u.opcode = LLInt::getOpcode(llint_op_put_by_id_out_of_line);
 637                     pc[5].u.operand = offsetInButterfly(slot.cachedOffset()) * sizeof(JSValue);
 638                 }
 639             }
 640         }
 641     }
 642
 643     LLINT_END();
 644 }
 645
 646 LLINT_SLOW_PATH_DECL(slow_path_del_by_id)
 647 {
 648     LLINT_BEGIN();
 649     CodeBlock* codeBlock = exec->codeBlock();
 650     JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
 651     bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
 652     LLINT_CHECK_EXCEPTION();
 653     if (!couldDelete && codeBlock->isStrictMode())
 654         LLINT_THROW(createTypeError(exec, "Unable to delete property."));
 655     LLINT_RETURN(jsBoolean(couldDelete));
 656 }
 657
 658 inline JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript)
 659 {
 660     if (LIKELY(baseValue.isCell() && subscript.isString())) {
 661         if (JSValue result = baseValue.asCell()->fastGetOwnProperty(exec, asString(subscript)->value(exec)))
 662             return result;
 663     }
 664
 665     if (subscript.isUInt32()) {
 666         uint32_t i = subscript.asUInt32();
 667         if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
 668             return asString(baseValue)->getIndex(exec, i);
 669
 670         return baseValue.get(exec, i);
 671     }
 672
 673     if (isName(subscript))
 674         return baseValue.get(exec, jsCast<NameInstance*>(subscript.asCell())->privateName());
 675
 676     Identifier property(exec, subscript.toString(exec)->value(exec));
 677     return baseValue.get(exec, property);
 678 }
 679
 680 LLINT_SLOW_PATH_DECL(slow_path_get_by_val)
 681 {
 682     LLINT_BEGIN();
 683     LLINT_RETURN_PROFILED(op_get_by_val, getByVal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
 684 }
 685
 686 LLINT_SLOW_PATH_DECL(slow_path_get_argument_by_val)
 687 {
 688     LLINT_BEGIN();
 689     JSValue arguments = LLINT_OP(2).jsValue();
 690     if (!arguments) {
 691         arguments = Arguments::create(vm, exec);
 692         LLINT_CHECK_EXCEPTION();
 693         LLINT_OP(2) = arguments;
 694         exec->uncheckedR(unmodifiedArgumentsRegister(pc[2].u.operand)) = arguments;
 695     }
 696
 697     LLINT_RETURN_PROFILED(op_get_argument_by_val, getByVal(exec, arguments, LLINT_OP_C(3).jsValue()));
 698 }
 699
 700 LLINT_SLOW_PATH_DECL(slow_path_get_by_pname)
 701 {
 702     LLINT_BEGIN();
 703     LLINT_RETURN(getByVal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
 704 }
 705
 706 LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
 707 {
 708     LLINT_BEGIN();
 709
 710     JSValue baseValue = LLINT_OP_C(1).jsValue();
 711     JSValue subscript = LLINT_OP_C(2).jsValue();
 712     JSValue value = LLINT_OP_C(3).jsValue();
 713
 714     if (LIKELY(subscript.isUInt32())) {
 715         uint32_t i = subscript.asUInt32();
 716         if (baseValue.isObject()) {
 717             JSObject* object = asObject(baseValue);
 718             if (object->canSetIndexQuickly(i))
 719                 object->setIndexQuickly(vm, i, value);
 720             else
 721                 object->methodTable()->putByIndex(object, exec, i, value, exec->codeBlock()->isStrictMode());
 722             LLINT_END();
 723         }
 724         baseValue.putByIndex(exec, i, value, exec->codeBlock()->isStrictMode());
 725         LLINT_END();
 726     }
 727
 728     if (isName(subscript)) {
 729         PutPropertySlot slot(exec->codeBlock()->isStrictMode());
 730         baseValue.put(exec, jsCast<NameInstance*>(subscript.asCell())->privateName(), value, slot);
 731         LLINT_END();
 732     }
 733
 734     Identifier property(exec, subscript.toString(exec)->value(exec));
 735     LLINT_CHECK_EXCEPTION();
 736     PutPropertySlot slot(exec->codeBlock()->isStrictMode());
 737     baseValue.put(exec, property, value, slot);
 738     LLINT_END();
 739 }
 740
 741 LLINT_SLOW_PATH_DECL(slow_path_del_by_val)
 742 {
 743     LLINT_BEGIN();
 744     JSValue baseValue = LLINT_OP_C(2).jsValue();
 745     JSObject* baseObject = baseValue.toObject(exec);
 746
 747     JSValue subscript = LLINT_OP_C(3).jsValue();
 748
 749     bool couldDelete;
 750
 751     uint32_t i;
 752     if (subscript.getUInt32(i))
 753         couldDelete = baseObject->methodTable()->deletePropertyByIndex(baseObject, exec, i);
 754     else if (isName(subscript))
 755         couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, jsCast<NameInstance*>(subscript.asCell())->privateName());
 756     else {
 757         LLINT_CHECK_EXCEPTION();
 758         Identifier property(exec, subscript.toString(exec)->value(exec));
 759         LLINT_CHECK_EXCEPTION();
 760         couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, property);
 761     }
 762
 763     if (!couldDelete && exec->codeBlock()->isStrictMode())
 764         LLINT_THROW(createTypeError(exec, "Unable to delete property."));
 765
 766     LLINT_RETURN(jsBoolean(couldDelete));
 767 }
 768
 769 LLINT_SLOW_PATH_DECL(slow_path_put_by_index)
 770 {
 771     LLINT_BEGIN();
 772     JSValue arrayValue = LLINT_OP_C(1).jsValue();
 773     ASSERT(isJSArray(arrayValue));
 774     asArray(arrayValue)->putDirectIndex(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
 775     LLINT_END();
 776 }
 777
 778 LLINT_SLOW_PATH_DECL(slow_path_put_getter_setter)
 779 {
 780     LLINT_BEGIN();
 781     ASSERT(LLINT_OP(1).jsValue().isObject());
 782     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
 783
 784     GetterSetter* accessor = GetterSetter::create(exec);
 785     LLINT_CHECK_EXCEPTION();
 786
 787     JSValue getter = LLINT_OP(3).jsValue();
 788     JSValue setter = LLINT_OP(4).jsValue();
 789     ASSERT(getter.isObject() || getter.isUndefined());
 790     ASSERT(setter.isObject() || setter.isUndefined());
 791     ASSERT(getter.isObject() || setter.isObject());
 792
 793     if (!getter.isUndefined())
 794         accessor->setGetter(vm, asObject(getter));
 795     if (!setter.isUndefined())
 796         accessor->setSetter(vm, asObject(setter));
 797     baseObj->putDirectAccessor(
 798         exec,
 799         exec->codeBlock()->identifier(pc[2].u.operand),
 800         accessor, Accessor);
 801     LLINT_END();
 802 }
 803
 804 LLINT_SLOW_PATH_DECL(slow_path_jtrue)
 805 {
 806     LLINT_BEGIN();
 807     LLINT_BRANCH(op_jtrue, LLINT_OP_C(1).jsValue().toBoolean(exec));
 808 }
 809
 810 LLINT_SLOW_PATH_DECL(slow_path_jfalse)
 811 {
 812     LLINT_BEGIN();
 813     LLINT_BRANCH(op_jfalse, !LLINT_OP_C(1).jsValue().toBoolean(exec));
 814 }
 815
 816 LLINT_SLOW_PATH_DECL(slow_path_jless)
 817 {
 818     LLINT_BEGIN();
 819     LLINT_BRANCH(op_jless, jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
 820 }
 821
 822 LLINT_SLOW_PATH_DECL(slow_path_jnless)
 823 {
 824     LLINT_BEGIN();
 825     LLINT_BRANCH(op_jnless, !jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
 826 }
 827
 828 LLINT_SLOW_PATH_DECL(slow_path_jgreater)
 829 {
 830     LLINT_BEGIN();
 831     LLINT_BRANCH(op_jgreater, jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
 832 }
 833
 834 LLINT_SLOW_PATH_DECL(slow_path_jngreater)
 835 {
 836     LLINT_BEGIN();
 837     LLINT_BRANCH(op_jngreater, !jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
 838 }
 839
 840 LLINT_SLOW_PATH_DECL(slow_path_jlesseq)
 841 {
 842     LLINT_BEGIN();
 843     LLINT_BRANCH(op_jlesseq, jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
 844 }
 845
 846 LLINT_SLOW_PATH_DECL(slow_path_jnlesseq)
 847 {
 848     LLINT_BEGIN();
 849     LLINT_BRANCH(op_jnlesseq, !jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
 850 }
 851
 852 LLINT_SLOW_PATH_DECL(slow_path_jgreatereq)
 853 {
 854     LLINT_BEGIN();
 855     LLINT_BRANCH(op_jgreatereq, jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
 856 }
 857
 858 LLINT_SLOW_PATH_DECL(slow_path_jngreatereq)
 859 {
 860     LLINT_BEGIN();
 861     LLINT_BRANCH(op_jngreatereq, !jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
 862 }
 863
 864 LLINT_SLOW_PATH_DECL(slow_path_switch_imm)
 865 {
 866     LLINT_BEGIN();
 867     JSValue scrutinee = LLINT_OP_C(3).jsValue();
 868     ASSERT(scrutinee.isDouble());
 869     double value = scrutinee.asDouble();
 870     int32_t intValue = static_cast<int32_t>(value);
 871     int defaultOffset = pc[2].u.operand;
 872     if (value == intValue) {
 873         CodeBlock* codeBlock = exec->codeBlock();
 874         pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue(intValue, defaultOffset);
 875     } else
 876         pc += defaultOffset;
 877     LLINT_END();
 878 }
 879
 880 LLINT_SLOW_PATH_DECL(slow_path_switch_char)
 881 {
 882     LLINT_BEGIN();
 883     JSValue scrutinee = LLINT_OP_C(3).jsValue();
 884     ASSERT(scrutinee.isString());
 885     JSString* string = asString(scrutinee);
 886     ASSERT(string->length() == 1);
 887     int defaultOffset = pc[2].u.operand;
 888     StringImpl* impl = string->value(exec).impl();
 889     CodeBlock* codeBlock = exec->codeBlock();
 890     pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue((*impl)[0], defaultOffset);
 891     LLINT_END();
 892 }
 893
 894 LLINT_SLOW_PATH_DECL(slow_path_switch_string)
 895 {
 896     LLINT_BEGIN();
 897     JSValue scrutinee = LLINT_OP_C(3).jsValue();
 898     int defaultOffset = pc[2].u.operand;
 899     if (!scrutinee.isString())
 900         pc += defaultOffset;
 901     else {
 902         CodeBlock* codeBlock = exec->codeBlock();
 903         pc += codeBlock->stringSwitchJumpTable(pc[1].u.operand).offsetForValue(asString(scrutinee)->value(exec).impl(), defaultOffset);
 904     }
 905     LLINT_END();
 906 }
 907
 908 LLINT_SLOW_PATH_DECL(slow_path_new_func)
 909 {
 910     LLINT_BEGIN();
 911     CodeBlock* codeBlock = exec->codeBlock();
 912     ASSERT(codeBlock->codeType() != FunctionCode
 913            || !codeBlock->needsFullScopeChain()
 914            || exec->uncheckedR(codeBlock->activationRegister()).jsValue());
 915 #if LLINT_SLOW_PATH_TRACING
 916     dataLogF("Creating function!\n");
 917 #endif
 918     LLINT_RETURN(JSFunction::create(exec, codeBlock->functionDecl(pc[2].u.operand), exec->scope()));
 919 }
 920
 921 LLINT_SLOW_PATH_DECL(slow_path_new_func_exp)
 922 {
 923     LLINT_BEGIN();
 924     CodeBlock* codeBlock = exec->codeBlock();
 925     FunctionExecutable* function = codeBlock->functionExpr(pc[2].u.operand);
 926     JSFunction* func = JSFunction::create(exec, function, exec->scope());
 927
 928     LLINT_RETURN(func);
 929 }
 930
 931 static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc, JSValue callee, CodeSpecializationKind kind)
 932 {
 933     ExecState* exec = execCallee->callerFrame();
 934     VM& vm = exec->vm();
 935
 936     execCallee->setScope(exec->scope());
 937     execCallee->setCodeBlock(0);
 938     execCallee->clearReturnPC();
 939
 940     if (kind == CodeForCall) {
 941         CallData callData;
 942         CallType callType = getCallData(callee, callData);
 943
 944         ASSERT(callType != CallTypeJS);
 945
 946         if (callType == CallTypeHost) {
 947             NativeCallFrameTracer tracer(&vm, execCallee);
 948             execCallee->setCallee(asObject(callee));
 949             vm.hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
 950
 951             LLINT_CALL_RETURN(execCallee, pc, LLInt::getCodePtr(getHostCallReturnValue));
 952         }
 953
 954 #if LLINT_SLOW_PATH_TRACING
 955         dataLog("Call callee is not a function: ", callee, "\n");
 956 #endif
 957
 958         ASSERT(callType == CallTypeNone);
 959         LLINT_CALL_THROW(exec, pc, createNotAFunctionError(exec, callee));
 960     }
 961
 962     ASSERT(kind == CodeForConstruct);
 963
 964     ConstructData constructData;
 965     ConstructType constructType = getConstructData(callee, constructData);
 966
 967     ASSERT(constructType != ConstructTypeJS);
 968
 969     if (constructType == ConstructTypeHost) {
 970         NativeCallFrameTracer tracer(&vm, execCallee);
 971         execCallee->setCallee(asObject(callee));
 972         vm.hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
 973
 974         LLINT_CALL_RETURN(execCallee, pc, LLInt::getCodePtr(getHostCallReturnValue));
 975     }
 976
 977 #if LLINT_SLOW_PATH_TRACING
 978     dataLog("Constructor callee is not a function: ", callee, "\n");
 979 #endif
 980
 981     ASSERT(constructType == ConstructTypeNone);
 982     LLINT_CALL_THROW(exec, pc, createNotAConstructorError(exec, callee));
 983 }
 984
 985 inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, CodeSpecializationKind kind, JSValue calleeAsValue, LLIntCallLinkInfo* callLinkInfo = 0)
 986 {
 987 #if LLINT_SLOW_PATH_TRACING
 988     dataLogF("Performing call with recorded PC = %p\n", execCallee->callerFrame()->currentVPC());
 989 #endif
 990
 991     JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
 992     if (!calleeAsFunctionCell)
 993         return handleHostCall(execCallee, pc, calleeAsValue, kind);
 994
 995     JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
 996     JSScope* scope = callee->scopeUnchecked();
 997     VM& vm = *scope->vm();
 998     execCallee->setScope(scope);
 999     ExecutableBase* executable = callee->executable();
1000
1001     MacroAssemblerCodePtr codePtr;
1002     CodeBlock* codeBlock = 0;
1003     if (executable->isHostFunction())
1004         codePtr = executable->hostCodeEntryFor(kind);
1005     else {
1006         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
1007         JSObject* error = functionExecutable->compileFor(execCallee, callee->scope(), kind);
1008         if (error)
1009             LLINT_CALL_THROW(execCallee->callerFrame(), pc, error);
1010         codeBlock = &functionExecutable->generatedBytecodeFor(kind);
1011         ASSERT(codeBlock);
1012         if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
1013             codePtr = functionExecutable->jsCodeWithArityCheckEntryFor(kind);
1014         else
1015             codePtr = functionExecutable->jsCodeEntryFor(kind);
1016     }
1017
1018     if (!LLINT_ALWAYS_ACCESS_SLOW && callLinkInfo) {
1019         ExecState* execCaller = execCallee->callerFrame();
1020
1021         CodeBlock* callerCodeBlock = execCaller->codeBlock();
1022
1023         ConcurrentJITLocker locker(callerCodeBlock->m_lock);
1024
1025         if (callLinkInfo->isOnList())
1026             callLinkInfo->remove();
1027         callLinkInfo->callee.set(vm, callerCodeBlock->ownerExecutable(), callee);
1028         callLinkInfo->lastSeenCallee.set(vm, callerCodeBlock->ownerExecutable(), callee);
1029         callLinkInfo->machineCodeTarget = codePtr;
1030         if (codeBlock)
1031             codeBlock->linkIncomingCall(execCaller, callLinkInfo);
1032     }
1033
1034     LLINT_CALL_RETURN(execCallee, pc, codePtr.executableAddress());
1035 }
1036
1037 inline SlowPathReturnType genericCall(ExecState* exec, Instruction* pc, CodeSpecializationKind kind)
1038 {
1039     // This needs to:
1040     // - Set up a call frame.
1041     // - Figure out what to call and compile it if necessary.
1042     // - If possible, link the call's inline cache.
1043     // - Return a tuple of machine code address to call and the new call frame.
1044
1045     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
1046
1047     ExecState* execCallee = exec + pc[4].u.operand;
1048
1049     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
1050     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1051     execCallee->setCallerFrame(exec);
1052
1053     ASSERT(pc[5].u.callLinkInfo);
1054     return setUpCall(execCallee, pc, kind, calleeAsValue, pc[5].u.callLinkInfo);
1055 }
1056
1057 LLINT_SLOW_PATH_DECL(slow_path_call)
1058 {
1059     LLINT_BEGIN_NO_SET_PC();
1060     return genericCall(exec, pc, CodeForCall);
1061 }
1062
1063 LLINT_SLOW_PATH_DECL(slow_path_construct)
1064 {
1065     LLINT_BEGIN_NO_SET_PC();
1066     return genericCall(exec, pc, CodeForConstruct);
1067 }
1068
1069 LLINT_SLOW_PATH_DECL(slow_path_call_varargs)
1070 {
1071     LLINT_BEGIN();
1072     // This needs to:
1073     // - Set up a call frame while respecting the variable arguments.
1074     // - Figure out what to call and compile it if necessary.
1075     // - Return a tuple of machine code address to call and the new call frame.
1076
1077     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
1078
1079     ExecState* execCallee = loadVarargs(
1080         exec, &vm.interpreter->stack(),
1081         LLINT_OP_C(3).jsValue(), LLINT_OP_C(4).jsValue(), pc[5].u.operand);
1082     LLINT_CALL_CHECK_EXCEPTION(exec, pc);
1083
1084     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1085     execCallee->setCallerFrame(exec);
1086     exec->setCurrentVPC(pc);
1087
1088     return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
1089 }
1090
1091 LLINT_SLOW_PATH_DECL(slow_path_call_eval)
1092 {
1093     LLINT_BEGIN_NO_SET_PC();
1094     JSValue calleeAsValue = LLINT_OP(2).jsValue();
1095
1096     ExecState* execCallee = exec + pc[4].u.operand;
1097
1098     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
1099     execCallee->setCallerFrame(exec);
1100     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1101     execCallee->setScope(exec->scope());
1102     execCallee->setReturnPC(LLInt::getCodePtr(llint_generic_return_point));
1103     execCallee->setCodeBlock(0);
1104     exec->setCurrentVPC(pc);
1105
1106     if (!isHostFunction(calleeAsValue, globalFuncEval))
1107         return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
1108
1109     vm.hostCallReturnValue = eval(execCallee);
1110     LLINT_CALL_RETURN(execCallee, pc, LLInt::getCodePtr(getHostCallReturnValue));
1111 }
1112
1113 LLINT_SLOW_PATH_DECL(slow_path_tear_off_activation)
1114 {
1115     LLINT_BEGIN();
1116     ASSERT(exec->codeBlock()->needsFullScopeChain());
1117     jsCast<JSActivation*>(LLINT_OP(1).jsValue())->tearOff(vm);
1118     LLINT_END();
1119 }
1120
1121 LLINT_SLOW_PATH_DECL(slow_path_tear_off_arguments)
1122 {
1123     LLINT_BEGIN();
1124     ASSERT(exec->codeBlock()->usesArguments());
1125     Arguments* arguments = jsCast<Arguments*>(exec->uncheckedR(unmodifiedArgumentsRegister(pc[1].u.operand)).jsValue());
1126     if (JSValue activationValue = LLINT_OP_C(2).jsValue())
1127         arguments->didTearOffActivation(exec, jsCast<JSActivation*>(activationValue));
1128     else
1129         arguments->tearOff(exec);
1130     LLINT_END();
1131 }
1132
1133 LLINT_SLOW_PATH_DECL(slow_path_strcat)
1134 {
1135     LLINT_BEGIN();
1136     LLINT_RETURN(jsString(exec, &LLINT_OP(2), pc[3].u.operand));
1137 }
1138
1139 LLINT_SLOW_PATH_DECL(slow_path_to_primitive)
1140 {
1141     LLINT_BEGIN();
1142     LLINT_RETURN(LLINT_OP_C(2).jsValue().toPrimitive(exec));
1143 }
1144
1145 LLINT_SLOW_PATH_DECL(slow_path_get_pnames)
1146 {
1147     LLINT_BEGIN();
1148     JSValue v = LLINT_OP(2).jsValue();
1149     if (v.isUndefinedOrNull()) {
1150         pc += pc[5].u.operand;
1151         LLINT_END();
1152     }
1153
1154     JSObject* o = v.toObject(exec);
1155     Structure* structure = o->structure();
1156     JSPropertyNameIterator* jsPropertyNameIterator = structure->enumerationCache();
1157     if (!jsPropertyNameIterator || jsPropertyNameIterator->cachedPrototypeChain() != structure->prototypeChain(exec))
1158         jsPropertyNameIterator = JSPropertyNameIterator::create(exec, o);
1159
1160     LLINT_OP(1) = JSValue(jsPropertyNameIterator);
1161     LLINT_OP(2) = JSValue(o);
1162     LLINT_OP(3) = Register::withInt(0);
1163     LLINT_OP(4) = Register::withInt(jsPropertyNameIterator->size());
1164
1165     pc += OPCODE_LENGTH(op_get_pnames);
1166     LLINT_END();
1167 }
1168
1169 LLINT_SLOW_PATH_DECL(slow_path_next_pname)
1170 {
1171     LLINT_BEGIN();
1172     JSObject* base = asObject(LLINT_OP(2).jsValue());
1173     JSString* property = asString(LLINT_OP(1).jsValue());
1174     if (base->hasProperty(exec, Identifier(exec, property->value(exec)))) {
1175         // Go to target.
1176         pc += pc[6].u.operand;
1177     } // Else, don't change the PC, so the interpreter will reloop.
1178     LLINT_END();
1179 }
1180
1181 LLINT_SLOW_PATH_DECL(slow_path_push_with_scope)
1182 {
1183     LLINT_BEGIN();
1184     JSValue v = LLINT_OP_C(1).jsValue();
1185     JSObject* o = v.toObject(exec);
1186     LLINT_CHECK_EXCEPTION();
1187
1188     exec->setScope(JSWithScope::create(exec, o));
1189
1190     LLINT_END();
1191 }
1192
1193 LLINT_SLOW_PATH_DECL(slow_path_pop_scope)
1194 {
1195     LLINT_BEGIN();
1196     exec->setScope(exec->scope()->next());
1197     LLINT_END();
1198 }
1199
1200 LLINT_SLOW_PATH_DECL(slow_path_push_name_scope)
1201 {
1202     LLINT_BEGIN();
1203     CodeBlock* codeBlock = exec->codeBlock();
1204     JSNameScope* scope = JSNameScope::create(exec, codeBlock->identifier(pc[1].u.operand), LLINT_OP(2).jsValue(), pc[3].u.operand);
1205     exec->setScope(scope);
1206     LLINT_END();
1207 }
1208
1209 LLINT_SLOW_PATH_DECL(slow_path_throw)
1210 {
1211     LLINT_BEGIN();
1212     LLINT_THROW(LLINT_OP_C(1).jsValue());
1213 }
1214
1215 LLINT_SLOW_PATH_DECL(slow_path_throw_static_error)
1216 {
1217     LLINT_BEGIN();
1218     if (pc[2].u.operand)
1219         LLINT_THROW(createReferenceError(exec, errorDescriptionForValue(exec, LLINT_OP_C(1).jsValue())->value(exec)));
1220     else
1221         LLINT_THROW(createTypeError(exec, errorDescriptionForValue(exec, LLINT_OP_C(1).jsValue())->value(exec)));
1222 }
1223
1224 LLINT_SLOW_PATH_DECL(slow_path_handle_watchdog_timer)
1225 {
1226     LLINT_BEGIN_NO_SET_PC();
1227     if (UNLIKELY(vm.watchdog.didFire(exec)))
1228         LLINT_THROW(createTerminatedExecutionException(&vm));
1229     LLINT_RETURN_TWO(0, exec);
1230 }
1231
1232 LLINT_SLOW_PATH_DECL(slow_path_debug)
1233 {
1234     LLINT_BEGIN();
1235     int debugHookID = pc[1].u.operand;
1236     int firstLine = pc[2].u.operand;
1237     int lastLine = pc[3].u.operand;
1238     int column = pc[4].u.operand;
1239
1240     vm.interpreter->debug(exec, static_cast<DebugHookID>(debugHookID), firstLine, lastLine, column);
1241
1242     LLINT_END();
1243 }
1244
1245 LLINT_SLOW_PATH_DECL(slow_path_profile_will_call)
1246 {
1247     LLINT_BEGIN();
1248     if (LegacyProfiler* profiler = vm.enabledProfiler())
1249         profiler->willExecute(exec, LLINT_OP(1).jsValue());
1250     LLINT_END();
1251 }
1252
1253 LLINT_SLOW_PATH_DECL(slow_path_profile_did_call)
1254 {
1255     LLINT_BEGIN();
1256     if (LegacyProfiler* profiler = vm.enabledProfiler())
1257         profiler->didExecute(exec, LLINT_OP(1).jsValue());
1258     LLINT_END();
1259 }
1260
1261 LLINT_SLOW_PATH_DECL(throw_from_native_call)
1262 {
1263     LLINT_BEGIN();
1264     ASSERT(vm.exception());
1265     LLINT_END();
1266 }
1267
1268 LLINT_SLOW_PATH_DECL(slow_path_resolve_scope)
1269 {
1270     LLINT_BEGIN();
1271     const Identifier& ident = exec->codeBlock()->identifier(pc[2].u.operand);
1272     LLINT_RETURN(JSScope::resolve(exec, exec->scope(), ident));
1273 }
1274
1275 LLINT_SLOW_PATH_DECL(slow_path_get_from_scope)
1276 {
1277     LLINT_BEGIN();
1278     const Identifier& ident = exec->codeBlock()->identifier(pc[3].u.operand);
1279     JSObject* scope = jsCast<JSObject*>(LLINT_OP(2).jsValue());
1280     ResolveModeAndType modeAndType(pc[4].u.operand);
1281
1282     PropertySlot slot(scope);
1283     if (!scope->getPropertySlot(exec, ident, slot)) {
1284         if (modeAndType.mode() == ThrowIfNotFound)
1285             LLINT_RETURN(exec->vm().throwException(exec, createUndefinedVariableError(exec, ident)));
1286         LLINT_RETURN(jsUndefined());
1287     }
1288
1289     // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
1290     if (slot.isCacheableValue() && slot.slotBase() == scope && scope->structure()->propertyAccessesAreCacheable()) {
1291         if (modeAndType.type() == GlobalProperty || modeAndType.type() == GlobalPropertyWithVarInjectionChecks) {
1292             CodeBlock* codeBlock = exec->codeBlock();
1293             ConcurrentJITLocker locker(codeBlock->m_lock);
1294             pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), scope->structure());
1295             pc[6].u.operand = slot.cachedOffset();
1296         }
1297     }
1298
1299     LLINT_RETURN(slot.getValue(exec, ident));
1300 }
1301
1302 LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
1303 {
1304     LLINT_BEGIN();
1305     CodeBlock* codeBlock = exec->codeBlock();
1306     const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
1307     JSObject* scope = jsCast<JSObject*>(LLINT_OP(1).jsValue());
1308     JSValue value = LLINT_OP_C(3).jsValue();
1309     ResolveModeAndType modeAndType = ResolveModeAndType(pc[4].u.operand);
1310
1311     if (modeAndType.mode() == ThrowIfNotFound && !scope->hasProperty(exec, ident))
1312         LLINT_THROW(createUndefinedVariableError(exec, ident));
1313
1314     PutPropertySlot slot(codeBlock->isStrictMode());
1315     scope->methodTable()->put(scope, exec, ident, value, slot);
1316
1317     // Covers implicit globals. Since they don't exist until they first execute, we didn't know how to cache them at compile time.
1318     if (modeAndType.type() == GlobalProperty || modeAndType.type() == GlobalPropertyWithVarInjectionChecks) {
1319         if (slot.isCacheable() && slot.base() == scope && scope->structure()->propertyAccessesAreCacheable()) {
1320             ConcurrentJITLocker locker(codeBlock->m_lock);
1321             pc[5].u.structure.set(exec->vm(), codeBlock->ownerExecutable(), scope->structure());
1322             pc[6].u.operand = slot.cachedOffset();
1323         }
1324     }
1325
1326     LLINT_END();
1327 }
1328
1329 } } // namespace JSC::LLInt
1330
1331 #endif // ENABLE(LLINT)