Unreviewed, reland r201532. The associated regressions have been fixed
[WebKit-https.git] / Source / JavaScriptCore / llint / LLIntSlowPaths.cpp
1 /*
2  * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
17  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
24  */
25
26 #include "config.h"
27 #include "LLIntSlowPaths.h"
28
29 #include "ArrayConstructor.h"
30 #include "CallFrame.h"
31 #include "CommonSlowPaths.h"
32 #include "CommonSlowPathsExceptions.h"
33 #include "Error.h"
34 #include "ErrorHandlingScope.h"
35 #include "Exception.h"
36 #include "ExceptionFuzz.h"
37 #include "FunctionWhitelist.h"
38 #include "GetterSetter.h"
39 #include "HostCallReturnValue.h"
40 #include "Interpreter.h"
41 #include "JIT.h"
42 #include "JITExceptions.h"
43 #include "JSLexicalEnvironment.h"
44 #include "JSCInlines.h"
45 #include "JSCJSValue.h"
46 #include "JSGeneratorFunction.h"
47 #include "JSGlobalObjectFunctions.h"
48 #include "JSStackInlines.h"
49 #include "JSString.h"
50 #include "JSWithScope.h"
51 #include "LLIntCommon.h"
52 #include "LLIntExceptions.h"
53 #include "LowLevelInterpreter.h"
54 #include "ObjectConstructor.h"
55 #include "ObjectPropertyConditionSet.h"
56 #include "ProtoCallFrame.h"
57 #include "ShadowChicken.h"
58 #include "StructureRareDataInlines.h"
59 #include "VMInlines.h"
60 #include <wtf/NeverDestroyed.h>
61 #include <wtf/StringPrintStream.h>
62
63 namespace JSC { namespace LLInt {
64
65 #define LLINT_BEGIN_NO_SET_PC() \
66     VM& vm = exec->vm();      \
67     NativeCallFrameTracer tracer(&vm, exec)
68
69 #ifndef NDEBUG
70 #define LLINT_SET_PC_FOR_STUBS() do { \
71         exec->codeBlock()->bytecodeOffset(pc); \
72         exec->setCurrentVPC(pc); \
73     } while (false)
74 #else
75 #define LLINT_SET_PC_FOR_STUBS() do { \
76         exec->setCurrentVPC(pc); \
77     } while (false)
78 #endif
79
80 #define LLINT_BEGIN()                           \
81     LLINT_BEGIN_NO_SET_PC();                    \
82     LLINT_SET_PC_FOR_STUBS()
83
84 #define LLINT_OP(index) (exec->uncheckedR(pc[index].u.operand))
85 #define LLINT_OP_C(index) (exec->r(pc[index].u.operand))
86
87 #define LLINT_RETURN_TWO(first, second) do {       \
88         return encodeResult(first, second);        \
89     } while (false)
90
91 #define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, 0)
92
93 #define LLINT_THROW(exceptionToThrow) do {                        \
94         vm.throwException(exec, exceptionToThrow);                \
95         pc = returnToThrow(exec);                                 \
96         LLINT_END_IMPL();                                         \
97     } while (false)
98
99 #define LLINT_CHECK_EXCEPTION() do {                    \
100         doExceptionFuzzingIfEnabled(exec, "LLIntSlowPaths", pc);    \
101         if (UNLIKELY(vm.exception())) {                 \
102             pc = returnToThrow(exec);                   \
103             LLINT_END_IMPL();                           \
104         }                                               \
105     } while (false)
106
107 #define LLINT_END() do {                        \
108         LLINT_CHECK_EXCEPTION();                \
109         LLINT_END_IMPL();                       \
110     } while (false)
111
112 #define LLINT_BRANCH(opcode, condition) do {                      \
113         bool __b_condition = (condition);                         \
114         LLINT_CHECK_EXCEPTION();                                  \
115         if (__b_condition)                                        \
116             pc += pc[OPCODE_LENGTH(opcode) - 1].u.operand;        \
117         else                                                      \
118             pc += OPCODE_LENGTH(opcode);                          \
119         LLINT_END_IMPL();                                         \
120     } while (false)
121
122 #define LLINT_RETURN(value) do {                \
123         JSValue __r_returnValue = (value);      \
124         LLINT_CHECK_EXCEPTION();                \
125         LLINT_OP(1) = __r_returnValue;          \
126         LLINT_END_IMPL();                       \
127     } while (false)
128
129 #define LLINT_RETURN_WITH_PC_ADJUSTMENT(value, pcAdjustment) do { \
130         JSValue __r_returnValue = (value);      \
131         LLINT_CHECK_EXCEPTION();                \
132         LLINT_OP(1) = __r_returnValue;          \
133         pc += (pcAdjustment);                   \
134         LLINT_END_IMPL();                       \
135     } while (false)
136
137 #define LLINT_RETURN_PROFILED(opcode, value) do {               \
138         JSValue __rp_returnValue = (value);                     \
139         LLINT_CHECK_EXCEPTION();                                \
140         LLINT_OP(1) = __rp_returnValue;                         \
141         LLINT_PROFILE_VALUE(opcode, __rp_returnValue);          \
142         LLINT_END_IMPL();                                       \
143     } while (false)
144
145 #define LLINT_PROFILE_VALUE(opcode, value) do { \
146         pc[OPCODE_LENGTH(opcode) - 1].u.profile->m_buckets[0] = \
147         JSValue::encode(value);                  \
148     } while (false)
149
150 #define LLINT_CALL_END_IMPL(exec, callTarget) LLINT_RETURN_TWO((callTarget), (exec))
151
152 #define LLINT_CALL_THROW(exec, exceptionToThrow) do {                   \
153         ExecState* __ct_exec = (exec);                                  \
154         vm.throwException(__ct_exec, exceptionToThrow);                 \
155         LLINT_CALL_END_IMPL(0, callToThrow(__ct_exec));                 \
156     } while (false)
157
158 #define LLINT_CALL_CHECK_EXCEPTION(exec, execCallee) do {               \
159         ExecState* __cce_exec = (exec);                                 \
160         ExecState* __cce_execCallee = (execCallee);                     \
161         doExceptionFuzzingIfEnabled(__cce_exec, "LLIntSlowPaths/call", nullptr); \
162         if (UNLIKELY(vm.exception()))                                   \
163             LLINT_CALL_END_IMPL(0, callToThrow(__cce_execCallee));      \
164     } while (false)
165
166 #define LLINT_CALL_RETURN(exec, execCallee, callTarget) do {            \
167         ExecState* __cr_exec = (exec);                                  \
168         ExecState* __cr_execCallee = (execCallee);                      \
169         void* __cr_callTarget = (callTarget);                           \
170         LLINT_CALL_CHECK_EXCEPTION(__cr_exec, __cr_execCallee);         \
171         LLINT_CALL_END_IMPL(__cr_execCallee, __cr_callTarget);          \
172     } while (false)
173
174 #define LLINT_RETURN_CALLEE_FRAME(execCallee) do {                      \
175         ExecState* __rcf_exec = (execCallee);                           \
176         LLINT_RETURN_TWO(pc, __rcf_exec);                               \
177     } while (false)
178     
179 extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
180 {
181     LLINT_BEGIN();
182     dataLogF("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d\n",
183             exec->codeBlock(),
184             exec,
185             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
186             exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
187             fromWhere,
188             operand,
189             pc[operand].u.operand);
190     LLINT_END();
191 }
192
193 extern "C" SlowPathReturnType llint_trace_value(ExecState* exec, Instruction* pc, int fromWhere, int operand)
194 {
195     JSValue value = LLINT_OP_C(operand).jsValue();
196     union {
197         struct {
198             uint32_t tag;
199             uint32_t payload;
200         } bits;
201         EncodedJSValue asValue;
202     } u;
203     u.asValue = JSValue::encode(value);
204     dataLogF(
205         "%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d: %08x:%08x: %s\n",
206         exec->codeBlock(),
207         exec,
208         static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
209         exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
210         fromWhere,
211         operand,
212         pc[operand].u.operand,
213         u.bits.tag,
214         u.bits.payload,
215         toCString(value).data());
216     LLINT_END_IMPL();
217 }
218
219 LLINT_SLOW_PATH_DECL(trace_prologue)
220 {
221     dataLogF("%p / %p: in prologue.\n", exec->codeBlock(), exec);
222     LLINT_END_IMPL();
223 }
224
225 static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpecializationKind kind)
226 {
227     JSFunction* callee = jsCast<JSFunction*>(exec->callee());
228     FunctionExecutable* executable = callee->jsExecutable();
229     CodeBlock* codeBlock = executable->codeBlockFor(kind);
230     dataLogF("%p / %p: in %s of function %p, executable %p; numVars = %u, numParameters = %u, numCalleeLocals = %u, caller = %p.\n",
231             codeBlock, exec, comment, callee, executable,
232             codeBlock->m_numVars, codeBlock->numParameters(), codeBlock->m_numCalleeLocals,
233             exec->callerFrame());
234 }
235
236 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_call)
237 {
238     traceFunctionPrologue(exec, "call prologue", CodeForCall);
239     LLINT_END_IMPL();
240 }
241
242 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_construct)
243 {
244     traceFunctionPrologue(exec, "construct prologue", CodeForConstruct);
245     LLINT_END_IMPL();
246 }
247
248 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_call)
249 {
250     traceFunctionPrologue(exec, "call arity check", CodeForCall);
251     LLINT_END_IMPL();
252 }
253
254 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_construct)
255 {
256     traceFunctionPrologue(exec, "construct arity check", CodeForConstruct);
257     LLINT_END_IMPL();
258 }
259
260 LLINT_SLOW_PATH_DECL(trace)
261 {
262     dataLogF("%p / %p: executing bc#%zu, %s, pc = %p\n",
263             exec->codeBlock(),
264             exec,
265             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
266             opcodeNames[exec->vm().interpreter->getOpcodeID(pc[0].u.opcode)], pc);
267     if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_enter) {
268         dataLogF("Frame will eventually return to %p\n", exec->returnPC().value());
269         *bitwise_cast<volatile char*>(exec->returnPC().value());
270     }
271     if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_ret) {
272         dataLogF("Will be returning to %p\n", exec->returnPC().value());
273         dataLogF("The new cfr will be %p\n", exec->callerFrame());
274     }
275     LLINT_END_IMPL();
276 }
277
278 LLINT_SLOW_PATH_DECL(special_trace)
279 {
280     dataLogF("%p / %p: executing special case bc#%zu, op#%u, return PC is %p\n",
281             exec->codeBlock(),
282             exec,
283             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
284             exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
285             exec->returnPC().value());
286     LLINT_END_IMPL();
287 }
288
289 enum EntryKind { Prologue, ArityCheck };
290
291 #if ENABLE(JIT)
292 static FunctionWhitelist& ensureGlobalJITWhitelist()
293 {
294     static LazyNeverDestroyed<FunctionWhitelist> baselineWhitelist;
295     static std::once_flag initializeWhitelistFlag;
296     std::call_once(initializeWhitelistFlag, [] {
297         const char* functionWhitelistFile = Options::jitWhitelist();
298         baselineWhitelist.construct(functionWhitelistFile);
299     });
300     return baselineWhitelist;
301 }
302
303 inline bool shouldJIT(ExecState* exec, CodeBlock* codeBlock)
304 {
305     if (!Options::bytecodeRangeToJITCompile().isInRange(codeBlock->instructionCount())
306         || !ensureGlobalJITWhitelist().contains(codeBlock))
307         return false;
308
309     // You can modify this to turn off JITting without rebuilding the world.
310     return exec->vm().canUseJIT();
311 }
312
313 // Returns true if we should try to OSR.
314 inline bool jitCompileAndSetHeuristics(CodeBlock* codeBlock, ExecState* exec)
315 {
316     VM& vm = exec->vm();
317     DeferGCForAWhile deferGC(vm.heap); // My callers don't set top callframe, so we don't want to GC here at all.
318     
319     codeBlock->updateAllValueProfilePredictions();
320
321     if (!codeBlock->checkIfJITThresholdReached()) {
322         CODEBLOCK_LOG_EVENT(codeBlock, "delayJITCompile", ("threshold not reached, counter = ", codeBlock->llintExecuteCounter()));
323         if (Options::verboseOSR())
324             dataLogF("    JIT threshold should be lifted.\n");
325         return false;
326     }
327     
328     switch (codeBlock->jitType()) {
329     case JITCode::BaselineJIT: {
330         if (Options::verboseOSR())
331             dataLogF("    Code was already compiled.\n");
332         codeBlock->jitSoon();
333         return true;
334     }
335     case JITCode::InterpreterThunk: {
336         CompilationResult result = JIT::compile(&vm, codeBlock, JITCompilationCanFail);
337         switch (result) {
338         case CompilationFailed:
339             CODEBLOCK_LOG_EVENT(codeBlock, "delayJITCompile", ("compilation failed"));
340             if (Options::verboseOSR())
341                 dataLogF("    JIT compilation failed.\n");
342             codeBlock->dontJITAnytimeSoon();
343             return false;
344         case CompilationSuccessful:
345             if (Options::verboseOSR())
346                 dataLogF("    JIT compilation successful.\n");
347             codeBlock->ownerScriptExecutable()->installCode(codeBlock);
348             codeBlock->jitSoon();
349             return true;
350         default:
351             RELEASE_ASSERT_NOT_REACHED();
352             return false;
353         }
354     }
355     default:
356         dataLog("Unexpected code block in LLInt: ", *codeBlock, "\n");
357         RELEASE_ASSERT_NOT_REACHED();
358         return false;
359     }
360 }
361
362 static SlowPathReturnType entryOSR(ExecState* exec, Instruction*, CodeBlock* codeBlock, const char *name, EntryKind kind)
363 {
364     if (Options::verboseOSR()) {
365         dataLog(
366             *codeBlock, ": Entered ", name, " with executeCounter = ",
367             codeBlock->llintExecuteCounter(), "\n");
368     }
369     
370     if (!shouldJIT(exec, codeBlock)) {
371         codeBlock->dontJITAnytimeSoon();
372         LLINT_RETURN_TWO(0, 0);
373     }
374     if (!jitCompileAndSetHeuristics(codeBlock, exec))
375         LLINT_RETURN_TWO(0, 0);
376     
377     CODEBLOCK_LOG_EVENT(codeBlock, "OSR entry", ("in prologue"));
378     
379     if (kind == Prologue)
380         LLINT_RETURN_TWO(codeBlock->jitCode()->executableAddress(), 0);
381     ASSERT(kind == ArityCheck);
382     LLINT_RETURN_TWO(codeBlock->jitCode()->addressForCall(MustCheckArity).executableAddress(), 0);
383 }
384 #else // ENABLE(JIT)
385 static SlowPathReturnType entryOSR(ExecState* exec, Instruction*, CodeBlock* codeBlock, const char*, EntryKind)
386 {
387     codeBlock->dontJITAnytimeSoon();
388     LLINT_RETURN_TWO(0, exec);
389 }
390 #endif // ENABLE(JIT)
391
392 LLINT_SLOW_PATH_DECL(entry_osr)
393 {
394     return entryOSR(exec, pc, exec->codeBlock(), "entry_osr", Prologue);
395 }
396
397 LLINT_SLOW_PATH_DECL(entry_osr_function_for_call)
398 {
399     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForCall(), "entry_osr_function_for_call", Prologue);
400 }
401
402 LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct)
403 {
404     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForConstruct(), "entry_osr_function_for_construct", Prologue);
405 }
406
407 LLINT_SLOW_PATH_DECL(entry_osr_function_for_call_arityCheck)
408 {
409     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForCall(), "entry_osr_function_for_call_arityCheck", ArityCheck);
410 }
411
412 LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct_arityCheck)
413 {
414     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForConstruct(), "entry_osr_function_for_construct_arityCheck", ArityCheck);
415 }
416
417 LLINT_SLOW_PATH_DECL(loop_osr)
418 {
419     CodeBlock* codeBlock = exec->codeBlock();
420
421 #if ENABLE(JIT)
422     if (Options::verboseOSR()) {
423         dataLog(
424             *codeBlock, ": Entered loop_osr with executeCounter = ",
425             codeBlock->llintExecuteCounter(), "\n");
426     }
427     
428     if (!shouldJIT(exec, codeBlock)) {
429         codeBlock->dontJITAnytimeSoon();
430         LLINT_RETURN_TWO(0, 0);
431     }
432     
433     if (!jitCompileAndSetHeuristics(codeBlock, exec))
434         LLINT_RETURN_TWO(0, 0);
435     
436     CODEBLOCK_LOG_EVENT(codeBlock, "osrEntry", ("at bc#", pc - codeBlock->instructions().begin()));
437
438     ASSERT(codeBlock->jitType() == JITCode::BaselineJIT);
439     
440     Vector<BytecodeAndMachineOffset> map;
441     codeBlock->jitCodeMap()->decode(map);
442     BytecodeAndMachineOffset* mapping = binarySearch<BytecodeAndMachineOffset, unsigned>(map, map.size(), pc - codeBlock->instructions().begin(), BytecodeAndMachineOffset::getBytecodeIndex);
443     ASSERT(mapping);
444     ASSERT(mapping->m_bytecodeIndex == static_cast<unsigned>(pc - codeBlock->instructions().begin()));
445     
446     void* jumpTarget = codeBlock->jitCode()->executableAddressAtOffset(mapping->m_machineCodeOffset);
447     ASSERT(jumpTarget);
448     
449     LLINT_RETURN_TWO(jumpTarget, exec->topOfFrame());
450 #else // ENABLE(JIT)
451     UNUSED_PARAM(pc);
452     codeBlock->dontJITAnytimeSoon();
453     LLINT_RETURN_TWO(0, 0);
454 #endif // ENABLE(JIT)
455 }
456
457 LLINT_SLOW_PATH_DECL(replace)
458 {
459     CodeBlock* codeBlock = exec->codeBlock();
460
461 #if ENABLE(JIT)
462     if (Options::verboseOSR()) {
463         dataLog(
464             *codeBlock, ": Entered replace with executeCounter = ",
465             codeBlock->llintExecuteCounter(), "\n");
466     }
467     
468     if (shouldJIT(exec, codeBlock))
469         jitCompileAndSetHeuristics(codeBlock, exec);
470     else
471         codeBlock->dontJITAnytimeSoon();
472     LLINT_END_IMPL();
473 #else // ENABLE(JIT)
474     codeBlock->dontJITAnytimeSoon();
475     LLINT_END_IMPL();
476 #endif // ENABLE(JIT)
477 }
478
479 LLINT_SLOW_PATH_DECL(stack_check)
480 {
481     LLINT_BEGIN();
482 #if LLINT_SLOW_PATH_TRACING
483     dataLogF("Checking stack height with exec = %p.\n", exec);
484     dataLogF("CodeBlock = %p.\n", exec->codeBlock());
485     dataLogF("Num callee registers = %u.\n", exec->codeBlock()->m_numCalleeLocals);
486     dataLogF("Num vars = %u.\n", exec->codeBlock()->m_numVars);
487
488 #if ENABLE(JIT)
489     dataLogF("Current end is at %p.\n", exec->vm().stackLimit());
490 #else
491     dataLogF("Current end is at %p.\n", exec->vm().jsStackLimit());
492 #endif
493
494 #endif
495     // If the stack check succeeds and we don't need to throw the error, then
496     // we'll return 0 instead. The prologue will check for a non-zero value
497     // when determining whether to set the callFrame or not.
498
499     // For JIT enabled builds which uses the C stack, the stack is not growable.
500     // Hence, if we get here, then we know a stack overflow is imminent. So, just
501     // throw the StackOverflowError unconditionally.
502 #if !ENABLE(JIT)
503     ASSERT(!vm.interpreter->stack().containsAddress(exec->topOfFrame()));
504     if (LIKELY(vm.interpreter->stack().ensureCapacityFor(exec->topOfFrame())))
505         LLINT_RETURN_TWO(pc, 0);
506 #endif
507
508     vm.topCallFrame = exec;
509     ErrorHandlingScope errorScope(vm);
510     vm.throwException(exec, createStackOverflowError(exec));
511     pc = returnToThrow(exec);
512     LLINT_RETURN_TWO(pc, exec);
513 }
514
515 LLINT_SLOW_PATH_DECL(slow_path_new_object)
516 {
517     LLINT_BEGIN();
518     LLINT_RETURN(constructEmptyObject(exec, pc[3].u.objectAllocationProfile->structure()));
519 }
520
521 LLINT_SLOW_PATH_DECL(slow_path_new_array)
522 {
523     LLINT_BEGIN();
524     LLINT_RETURN(constructArrayNegativeIndexed(exec, pc[4].u.arrayAllocationProfile, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
525 }
526
527 LLINT_SLOW_PATH_DECL(slow_path_new_array_with_size)
528 {
529     LLINT_BEGIN();
530     LLINT_RETURN(constructArrayWithSizeQuirk(exec, pc[3].u.arrayAllocationProfile, exec->lexicalGlobalObject(), LLINT_OP_C(2).jsValue()));
531 }
532
533 LLINT_SLOW_PATH_DECL(slow_path_new_array_buffer)
534 {
535     LLINT_BEGIN();
536     LLINT_RETURN(constructArray(exec, pc[4].u.arrayAllocationProfile, exec->codeBlock()->constantBuffer(pc[2].u.operand), pc[3].u.operand));
537 }
538
539 LLINT_SLOW_PATH_DECL(slow_path_new_regexp)
540 {
541     LLINT_BEGIN();
542     RegExp* regExp = exec->codeBlock()->regexp(pc[2].u.operand);
543     if (!regExp->isValid())
544         LLINT_THROW(createSyntaxError(exec, "Invalid flag supplied to RegExp constructor."));
545     LLINT_RETURN(RegExpObject::create(vm, exec->lexicalGlobalObject()->regExpStructure(), regExp));
546 }
547
548 LLINT_SLOW_PATH_DECL(slow_path_instanceof)
549 {
550     LLINT_BEGIN();
551     JSValue value = LLINT_OP_C(2).jsValue();
552     JSValue proto = LLINT_OP_C(3).jsValue();
553     LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
554 }
555
556 LLINT_SLOW_PATH_DECL(slow_path_instanceof_custom)
557 {
558     LLINT_BEGIN();
559
560     JSValue value = LLINT_OP_C(2).jsValue();
561     JSValue constructor = LLINT_OP_C(3).jsValue();
562     JSValue hasInstanceValue = LLINT_OP_C(4).jsValue();
563
564     ASSERT(constructor.isObject());
565     ASSERT(hasInstanceValue != exec->lexicalGlobalObject()->functionProtoHasInstanceSymbolFunction() || !constructor.getObject()->structure()->typeInfo().implementsDefaultHasInstance());
566
567     JSValue result = jsBoolean(constructor.getObject()->hasInstance(exec, value, hasInstanceValue));
568     LLINT_RETURN(result);
569 }
570
571 LLINT_SLOW_PATH_DECL(slow_path_try_get_by_id)
572 {
573     LLINT_BEGIN();
574     CodeBlock* codeBlock = exec->codeBlock();
575     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
576     JSValue baseValue = LLINT_OP_C(2).jsValue();
577     PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::VMInquiry);
578
579     baseValue.getPropertySlot(exec, ident, slot);
580
581     LLINT_RETURN(slot.getPureResult());
582 }
583
584 static void setupGetByIdPrototypeCache(ExecState* exec, VM& vm, Instruction* pc, JSCell* baseCell, PropertySlot& slot, const Identifier& ident)
585 {
586     CodeBlock* codeBlock = exec->codeBlock();
587     Structure* structure = baseCell->structure();
588
589     if (structure->typeInfo().prohibitsPropertyCaching())
590         return;
591
592     if (structure->isDictionary()) {
593         if (structure->hasBeenFlattenedBefore())
594             return;
595         structure->flattenDictionaryStructure(vm, jsCast<JSObject*>(baseCell));
596     }
597
598     ObjectPropertyConditionSet conditions;
599     if (slot.isUnset())
600         conditions = generateConditionsForPropertyMiss(vm, codeBlock, exec, structure, ident.impl());
601     else
602         conditions = generateConditionsForPrototypePropertyHit(vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
603
604     if (!conditions.isValid())
605         return;
606
607     PropertyOffset offset = invalidOffset;
608     CodeBlock::StructureWatchpointMap& watchpointMap = codeBlock->llintGetByIdWatchpointMap();
609     auto result = watchpointMap.add(structure, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>());
610     for (ObjectPropertyCondition condition : conditions) {
611         if (!condition.isWatchable())
612             return;
613         if (condition.condition().kind() == PropertyCondition::Presence)
614             offset = condition.condition().offset();
615         result.iterator->value.add(condition, pc)->install();
616     }
617     ASSERT((offset == invalidOffset) == slot.isUnset());
618
619     ConcurrentJITLocker locker(codeBlock->m_lock);
620
621     if (slot.isUnset()) {
622         pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_unset);
623         pc[4].u.structureID = structure->id();
624         return;
625     }
626     ASSERT(slot.isValue());
627
628     pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_proto_load);
629     pc[4].u.structureID = structure->id();
630     pc[5].u.operand = offset;
631     // We know that this pointer will remain valid because it will be cleared by either a watchpoint fire or
632     // during GC when we clear the LLInt caches.
633     pc[6].u.pointer = slot.slotBase();
634 }
635
636
637 LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
638 {
639     LLINT_BEGIN();
640     CodeBlock* codeBlock = exec->codeBlock();
641     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
642     JSValue baseValue = LLINT_OP_C(2).jsValue();
643     PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::Get);
644
645     JSValue result = baseValue.get(exec, ident, slot);
646     LLINT_CHECK_EXCEPTION();
647     LLINT_OP(1) = result;
648     
649     if (!LLINT_ALWAYS_ACCESS_SLOW
650         && baseValue.isCell()
651         && slot.isCacheable()) {
652
653         JSCell* baseCell = baseValue.asCell();
654         Structure* structure = baseCell->structure();
655         if (slot.isValue() && slot.slotBase() == baseValue) {
656             // Start out by clearing out the old cache.
657             pc[0].u.opcode = LLInt::getOpcode(op_get_by_id);
658             pc[4].u.pointer = nullptr; // old structure
659             pc[5].u.pointer = nullptr; // offset
660
661             // Prevent the prototype cache from ever happening.
662             pc[7].u.operand = 0;
663         
664             if (structure->propertyAccessesAreCacheable()) {
665                 vm.heap.writeBarrier(codeBlock);
666                 
667                 ConcurrentJITLocker locker(codeBlock->m_lock);
668
669                 pc[4].u.structureID = structure->id();
670                 pc[5].u.operand = slot.cachedOffset();
671             }
672         } else if (UNLIKELY(pc[7].u.operand && (slot.isValue() || slot.isUnset()))) {
673             ASSERT(slot.slotBase() != baseValue);
674
675             if (!(--pc[7].u.operand))
676                 setupGetByIdPrototypeCache(exec, vm, pc, baseCell, slot, ident);
677         }
678     } else if (!LLINT_ALWAYS_ACCESS_SLOW
679         && isJSArray(baseValue)
680         && ident == exec->propertyNames().length) {
681         pc[0].u.opcode = LLInt::getOpcode(op_get_array_length);
682         ArrayProfile* arrayProfile = codeBlock->getOrAddArrayProfile(pc - codeBlock->instructions().begin());
683         arrayProfile->observeStructure(baseValue.asCell()->structure());
684         pc[4].u.arrayProfile = arrayProfile;
685
686         // Prevent the prototype cache from ever happening.
687         pc[7].u.operand = 0;
688     }
689
690     pc[OPCODE_LENGTH(op_get_by_id) - 1].u.profile->m_buckets[0] = JSValue::encode(result);
691     LLINT_END();
692 }
693
694 LLINT_SLOW_PATH_DECL(slow_path_get_arguments_length)
695 {
696     LLINT_BEGIN();
697     CodeBlock* codeBlock = exec->codeBlock();
698     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
699     JSValue baseValue = LLINT_OP(2).jsValue();
700     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
701     LLINT_RETURN(baseValue.get(exec, ident, slot));
702 }
703
704 LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
705 {
706     LLINT_BEGIN();
707     CodeBlock* codeBlock = exec->codeBlock();
708     const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
709     
710     JSValue baseValue = LLINT_OP_C(1).jsValue();
711     PutPropertySlot slot(baseValue, codeBlock->isStrictMode(), codeBlock->putByIdContext());
712     if (pc[8].u.putByIdFlags & PutByIdIsDirect)
713         asObject(baseValue)->putDirect(vm, ident, LLINT_OP_C(3).jsValue(), slot);
714     else
715         baseValue.putInline(exec, ident, LLINT_OP_C(3).jsValue(), slot);
716     LLINT_CHECK_EXCEPTION();
717     
718     if (!LLINT_ALWAYS_ACCESS_SLOW
719         && baseValue.isCell()
720         && slot.isCacheablePut()) {
721
722         // Start out by clearing out the old cache.
723         pc[4].u.pointer = nullptr; // old structure
724         pc[5].u.pointer = nullptr; // offset
725         pc[6].u.pointer = nullptr; // new structure
726         pc[7].u.pointer = nullptr; // structure chain
727         pc[8].u.putByIdFlags =
728             static_cast<PutByIdFlags>(pc[8].u.putByIdFlags & PutByIdPersistentFlagsMask);
729         
730         JSCell* baseCell = baseValue.asCell();
731         Structure* structure = baseCell->structure();
732         
733         if (!structure->isUncacheableDictionary()
734             && !structure->typeInfo().prohibitsPropertyCaching()
735             && baseCell == slot.base()) {
736
737             vm.heap.writeBarrier(codeBlock);
738             
739             if (slot.type() == PutPropertySlot::NewProperty) {
740                 GCSafeConcurrentJITLocker locker(codeBlock->m_lock, vm.heap);
741             
742                 if (!structure->isDictionary() && structure->previousID()->outOfLineCapacity() == structure->outOfLineCapacity()) {
743                     ASSERT(structure->previousID()->transitionWatchpointSetHasBeenInvalidated());
744
745                     if (normalizePrototypeChain(exec, structure) != InvalidPrototypeChain) {
746                         ASSERT(structure->previousID()->isObject());
747                         pc[4].u.structureID = structure->previousID()->id();
748                         pc[5].u.operand = slot.cachedOffset();
749                         pc[6].u.structureID = structure->id();
750                         if (!(pc[8].u.putByIdFlags & PutByIdIsDirect)) {
751                             StructureChain* chain = structure->prototypeChain(exec);
752                             ASSERT(chain);
753                             pc[7].u.structureChain.set(
754                                 vm, codeBlock, chain);
755                         }
756                         pc[8].u.putByIdFlags = static_cast<PutByIdFlags>(
757                             pc[8].u.putByIdFlags |
758                             structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
759                     }
760                 }
761             } else {
762                 structure->didCachePropertyReplacement(vm, slot.cachedOffset());
763                 pc[4].u.structureID = structure->id();
764                 pc[5].u.operand = slot.cachedOffset();
765                 pc[8].u.putByIdFlags = static_cast<PutByIdFlags>(
766                     pc[8].u.putByIdFlags |
767                     structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
768             }
769         }
770     }
771     
772     LLINT_END();
773 }
774
775 LLINT_SLOW_PATH_DECL(slow_path_del_by_id)
776 {
777     LLINT_BEGIN();
778     CodeBlock* codeBlock = exec->codeBlock();
779     JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
780     LLINT_CHECK_EXCEPTION();
781     bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
782     LLINT_CHECK_EXCEPTION();
783     if (!couldDelete && codeBlock->isStrictMode())
784         LLINT_THROW(createTypeError(exec, "Unable to delete property."));
785     LLINT_RETURN(jsBoolean(couldDelete));
786 }
787
788 inline JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript)
789 {
790     if (LIKELY(baseValue.isCell() && subscript.isString())) {
791         VM& vm = exec->vm();
792         Structure& structure = *baseValue.asCell()->structure(vm);
793         if (JSCell::canUseFastGetOwnProperty(structure)) {
794             if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
795                 if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
796                     return result;
797             }
798         }
799     }
800     
801     if (subscript.isUInt32()) {
802         uint32_t i = subscript.asUInt32();
803         if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
804             return asString(baseValue)->getIndex(exec, i);
805         
806         return baseValue.get(exec, i);
807     }
808
809     baseValue.requireObjectCoercible(exec);
810     if (exec->hadException())
811         return jsUndefined();
812     auto property = subscript.toPropertyKey(exec);
813     if (exec->hadException())
814         return jsUndefined();
815     return baseValue.get(exec, property);
816 }
817
818 LLINT_SLOW_PATH_DECL(slow_path_get_by_val)
819 {
820     LLINT_BEGIN();
821     LLINT_RETURN_PROFILED(op_get_by_val, getByVal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
822 }
823
824 LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
825 {
826     LLINT_BEGIN();
827     
828     JSValue baseValue = LLINT_OP_C(1).jsValue();
829     JSValue subscript = LLINT_OP_C(2).jsValue();
830     JSValue value = LLINT_OP_C(3).jsValue();
831     
832     if (LIKELY(subscript.isUInt32())) {
833         uint32_t i = subscript.asUInt32();
834         if (baseValue.isObject()) {
835             JSObject* object = asObject(baseValue);
836             if (object->canSetIndexQuickly(i))
837                 object->setIndexQuickly(vm, i, value);
838             else
839                 object->methodTable()->putByIndex(object, exec, i, value, exec->codeBlock()->isStrictMode());
840             LLINT_END();
841         }
842         baseValue.putByIndex(exec, i, value, exec->codeBlock()->isStrictMode());
843         LLINT_END();
844     }
845
846     auto property = subscript.toPropertyKey(exec);
847     LLINT_CHECK_EXCEPTION();
848     PutPropertySlot slot(baseValue, exec->codeBlock()->isStrictMode());
849     baseValue.put(exec, property, value, slot);
850     LLINT_END();
851 }
852
853 LLINT_SLOW_PATH_DECL(slow_path_put_by_val_direct)
854 {
855     LLINT_BEGIN();
856     
857     JSValue baseValue = LLINT_OP_C(1).jsValue();
858     JSValue subscript = LLINT_OP_C(2).jsValue();
859     JSValue value = LLINT_OP_C(3).jsValue();
860     RELEASE_ASSERT(baseValue.isObject());
861     JSObject* baseObject = asObject(baseValue);
862     bool isStrictMode = exec->codeBlock()->isStrictMode();
863     if (LIKELY(subscript.isUInt32())) {
864         // Despite its name, JSValue::isUInt32 will return true only for positive boxed int32_t; all those values are valid array indices.
865         ASSERT(isIndex(subscript.asUInt32()));
866         baseObject->putDirectIndex(exec, subscript.asUInt32(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
867         LLINT_END();
868     }
869
870     if (subscript.isDouble()) {
871         double subscriptAsDouble = subscript.asDouble();
872         uint32_t subscriptAsUInt32 = static_cast<uint32_t>(subscriptAsDouble);
873         if (subscriptAsDouble == subscriptAsUInt32 && isIndex(subscriptAsUInt32)) {
874             baseObject->putDirectIndex(exec, subscriptAsUInt32, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
875             LLINT_END();
876         }
877     }
878
879     // Don't put to an object if toString threw an exception.
880     auto property = subscript.toPropertyKey(exec);
881     if (exec->vm().exception())
882         LLINT_END();
883
884     if (Optional<uint32_t> index = parseIndex(property))
885         baseObject->putDirectIndex(exec, index.value(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
886     else {
887         PutPropertySlot slot(baseObject, isStrictMode);
888         baseObject->putDirect(exec->vm(), property, value, slot);
889     }
890     LLINT_END();
891 }
892
893 LLINT_SLOW_PATH_DECL(slow_path_del_by_val)
894 {
895     LLINT_BEGIN();
896     JSValue baseValue = LLINT_OP_C(2).jsValue();
897     JSObject* baseObject = baseValue.toObject(exec);
898     LLINT_CHECK_EXCEPTION();
899
900     JSValue subscript = LLINT_OP_C(3).jsValue();
901     
902     bool couldDelete;
903     
904     uint32_t i;
905     if (subscript.getUInt32(i))
906         couldDelete = baseObject->methodTable()->deletePropertyByIndex(baseObject, exec, i);
907     else {
908         LLINT_CHECK_EXCEPTION();
909         auto property = subscript.toPropertyKey(exec);
910         LLINT_CHECK_EXCEPTION();
911         couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, property);
912     }
913     
914     if (!couldDelete && exec->codeBlock()->isStrictMode())
915         LLINT_THROW(createTypeError(exec, "Unable to delete property."));
916     
917     LLINT_RETURN(jsBoolean(couldDelete));
918 }
919
920 LLINT_SLOW_PATH_DECL(slow_path_put_by_index)
921 {
922     LLINT_BEGIN();
923     JSValue arrayValue = LLINT_OP_C(1).jsValue();
924     ASSERT(isJSArray(arrayValue));
925     asArray(arrayValue)->putDirectIndex(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
926     LLINT_END();
927 }
928
929 LLINT_SLOW_PATH_DECL(slow_path_put_getter_by_id)
930 {
931     LLINT_BEGIN();
932     ASSERT(LLINT_OP(1).jsValue().isObject());
933     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
934
935     unsigned options = pc[3].u.operand;
936
937     JSValue getter = LLINT_OP(4).jsValue();
938     ASSERT(getter.isObject());
939
940     baseObj->putGetter(exec, exec->codeBlock()->identifier(pc[2].u.operand), asObject(getter), options);
941     LLINT_END();
942 }
943
944 LLINT_SLOW_PATH_DECL(slow_path_put_setter_by_id)
945 {
946     LLINT_BEGIN();
947     ASSERT(LLINT_OP(1).jsValue().isObject());
948     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
949
950     unsigned options = pc[3].u.operand;
951
952     JSValue setter = LLINT_OP(4).jsValue();
953     ASSERT(setter.isObject());
954
955     baseObj->putSetter(exec, exec->codeBlock()->identifier(pc[2].u.operand), asObject(setter), options);
956     LLINT_END();
957 }
958
959 LLINT_SLOW_PATH_DECL(slow_path_put_getter_setter_by_id)
960 {
961     LLINT_BEGIN();
962     ASSERT(LLINT_OP(1).jsValue().isObject());
963     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
964     
965     GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
966     LLINT_CHECK_EXCEPTION();
967
968     JSValue getter = LLINT_OP(4).jsValue();
969     JSValue setter = LLINT_OP(5).jsValue();
970     ASSERT(getter.isObject() || getter.isUndefined());
971     ASSERT(setter.isObject() || setter.isUndefined());
972     ASSERT(getter.isObject() || setter.isObject());
973     
974     if (!getter.isUndefined())
975         accessor->setGetter(vm, exec->lexicalGlobalObject(), asObject(getter));
976     if (!setter.isUndefined())
977         accessor->setSetter(vm, exec->lexicalGlobalObject(), asObject(setter));
978     baseObj->putDirectAccessor(
979         exec,
980         exec->codeBlock()->identifier(pc[2].u.operand),
981         accessor, pc[3].u.operand);
982     LLINT_END();
983 }
984
985 LLINT_SLOW_PATH_DECL(slow_path_put_getter_by_val)
986 {
987     LLINT_BEGIN();
988     ASSERT(LLINT_OP(1).jsValue().isObject());
989     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
990     JSValue subscript = LLINT_OP_C(2).jsValue();
991
992     unsigned options = pc[3].u.operand;
993
994     JSValue getter = LLINT_OP(4).jsValue();
995     ASSERT(getter.isObject());
996
997     auto property = subscript.toPropertyKey(exec);
998     LLINT_CHECK_EXCEPTION();
999
1000     baseObj->putGetter(exec, property, asObject(getter), options);
1001     LLINT_END();
1002 }
1003
1004 LLINT_SLOW_PATH_DECL(slow_path_put_setter_by_val)
1005 {
1006     LLINT_BEGIN();
1007     ASSERT(LLINT_OP(1).jsValue().isObject());
1008     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
1009     JSValue subscript = LLINT_OP_C(2).jsValue();
1010
1011     unsigned options = pc[3].u.operand;
1012
1013     JSValue setter = LLINT_OP(4).jsValue();
1014     ASSERT(setter.isObject());
1015
1016     auto property = subscript.toPropertyKey(exec);
1017     LLINT_CHECK_EXCEPTION();
1018
1019     baseObj->putSetter(exec, property, asObject(setter), options);
1020     LLINT_END();
1021 }
1022
1023 LLINT_SLOW_PATH_DECL(slow_path_jtrue)
1024 {
1025     LLINT_BEGIN();
1026     LLINT_BRANCH(op_jtrue, LLINT_OP_C(1).jsValue().toBoolean(exec));
1027 }
1028
1029 LLINT_SLOW_PATH_DECL(slow_path_jfalse)
1030 {
1031     LLINT_BEGIN();
1032     LLINT_BRANCH(op_jfalse, !LLINT_OP_C(1).jsValue().toBoolean(exec));
1033 }
1034
1035 LLINT_SLOW_PATH_DECL(slow_path_jless)
1036 {
1037     LLINT_BEGIN();
1038     LLINT_BRANCH(op_jless, jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1039 }
1040
1041 LLINT_SLOW_PATH_DECL(slow_path_jnless)
1042 {
1043     LLINT_BEGIN();
1044     LLINT_BRANCH(op_jnless, !jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1045 }
1046
1047 LLINT_SLOW_PATH_DECL(slow_path_jgreater)
1048 {
1049     LLINT_BEGIN();
1050     LLINT_BRANCH(op_jgreater, jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1051 }
1052
1053 LLINT_SLOW_PATH_DECL(slow_path_jngreater)
1054 {
1055     LLINT_BEGIN();
1056     LLINT_BRANCH(op_jngreater, !jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1057 }
1058
1059 LLINT_SLOW_PATH_DECL(slow_path_jlesseq)
1060 {
1061     LLINT_BEGIN();
1062     LLINT_BRANCH(op_jlesseq, jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1063 }
1064
1065 LLINT_SLOW_PATH_DECL(slow_path_jnlesseq)
1066 {
1067     LLINT_BEGIN();
1068     LLINT_BRANCH(op_jnlesseq, !jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1069 }
1070
1071 LLINT_SLOW_PATH_DECL(slow_path_jgreatereq)
1072 {
1073     LLINT_BEGIN();
1074     LLINT_BRANCH(op_jgreatereq, jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1075 }
1076
1077 LLINT_SLOW_PATH_DECL(slow_path_jngreatereq)
1078 {
1079     LLINT_BEGIN();
1080     LLINT_BRANCH(op_jngreatereq, !jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1081 }
1082
1083 LLINT_SLOW_PATH_DECL(slow_path_switch_imm)
1084 {
1085     LLINT_BEGIN();
1086     JSValue scrutinee = LLINT_OP_C(3).jsValue();
1087     ASSERT(scrutinee.isDouble());
1088     double value = scrutinee.asDouble();
1089     int32_t intValue = static_cast<int32_t>(value);
1090     int defaultOffset = pc[2].u.operand;
1091     if (value == intValue) {
1092         CodeBlock* codeBlock = exec->codeBlock();
1093         pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue(intValue, defaultOffset);
1094     } else
1095         pc += defaultOffset;
1096     LLINT_END();
1097 }
1098
1099 LLINT_SLOW_PATH_DECL(slow_path_switch_char)
1100 {
1101     LLINT_BEGIN();
1102     JSValue scrutinee = LLINT_OP_C(3).jsValue();
1103     ASSERT(scrutinee.isString());
1104     JSString* string = asString(scrutinee);
1105     ASSERT(string->length() == 1);
1106     int defaultOffset = pc[2].u.operand;
1107     StringImpl* impl = string->value(exec).impl();
1108     CodeBlock* codeBlock = exec->codeBlock();
1109     pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue((*impl)[0], defaultOffset);
1110     LLINT_END();
1111 }
1112
1113 LLINT_SLOW_PATH_DECL(slow_path_switch_string)
1114 {
1115     LLINT_BEGIN();
1116     JSValue scrutinee = LLINT_OP_C(3).jsValue();
1117     int defaultOffset = pc[2].u.operand;
1118     if (!scrutinee.isString())
1119         pc += defaultOffset;
1120     else {
1121         CodeBlock* codeBlock = exec->codeBlock();
1122         pc += codeBlock->stringSwitchJumpTable(pc[1].u.operand).offsetForValue(asString(scrutinee)->value(exec).impl(), defaultOffset);
1123     }
1124     LLINT_END();
1125 }
1126
1127 LLINT_SLOW_PATH_DECL(slow_path_new_func)
1128 {
1129     LLINT_BEGIN();
1130     CodeBlock* codeBlock = exec->codeBlock();
1131     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1132 #if LLINT_SLOW_PATH_TRACING
1133     dataLogF("Creating function!\n");
1134 #endif
1135     LLINT_RETURN(JSFunction::create(vm, codeBlock->functionDecl(pc[3].u.operand), scope));
1136 }
1137
1138 LLINT_SLOW_PATH_DECL(slow_path_new_generator_func)
1139 {
1140     LLINT_BEGIN();
1141     CodeBlock* codeBlock = exec->codeBlock();
1142     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1143 #if LLINT_SLOW_PATH_TRACING
1144     dataLogF("Creating function!\n");
1145 #endif
1146     LLINT_RETURN(JSGeneratorFunction::create(vm, codeBlock->functionDecl(pc[3].u.operand), scope));
1147 }
1148
1149 LLINT_SLOW_PATH_DECL(slow_path_new_func_exp)
1150 {
1151     LLINT_BEGIN();
1152     
1153     CodeBlock* codeBlock = exec->codeBlock();
1154     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1155     FunctionExecutable* executable = codeBlock->functionExpr(pc[3].u.operand);
1156     
1157     LLINT_RETURN(JSFunction::create(vm, executable, scope));
1158 }
1159
1160 LLINT_SLOW_PATH_DECL(slow_path_new_generator_func_exp)
1161 {
1162     LLINT_BEGIN();
1163
1164     CodeBlock* codeBlock = exec->codeBlock();
1165     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1166     FunctionExecutable* executable = codeBlock->functionExpr(pc[3].u.operand);
1167
1168     LLINT_RETURN(JSGeneratorFunction::create(vm, executable, scope));
1169 }
1170
1171 LLINT_SLOW_PATH_DECL(slow_path_set_function_name)
1172 {
1173     LLINT_BEGIN();
1174     JSFunction* func = jsCast<JSFunction*>(LLINT_OP(1).Register::unboxedCell());
1175     JSValue name = LLINT_OP_C(2).Register::jsValue();
1176     func->setFunctionName(exec, name);
1177     LLINT_END();
1178 }
1179
1180 static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc, JSValue callee, CodeSpecializationKind kind)
1181 {
1182     UNUSED_PARAM(pc);
1183
1184 #if LLINT_SLOW_PATH_TRACING
1185     dataLog("Performing host call.\n");
1186 #endif
1187     
1188     ExecState* exec = execCallee->callerFrame();
1189     VM& vm = exec->vm();
1190
1191     execCallee->setCodeBlock(0);
1192     execCallee->clearReturnPC();
1193
1194     if (kind == CodeForCall) {
1195         CallData callData;
1196         CallType callType = getCallData(callee, callData);
1197     
1198         ASSERT(callType != CallType::JS);
1199     
1200         if (callType == CallType::Host) {
1201             NativeCallFrameTracer tracer(&vm, execCallee);
1202             execCallee->setCallee(asObject(callee));
1203             vm.hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
1204             
1205             LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
1206         }
1207         
1208 #if LLINT_SLOW_PATH_TRACING
1209         dataLog("Call callee is not a function: ", callee, "\n");
1210 #endif
1211
1212         ASSERT(callType == CallType::None);
1213         LLINT_CALL_THROW(exec, createNotAFunctionError(exec, callee));
1214     }
1215
1216     ASSERT(kind == CodeForConstruct);
1217     
1218     ConstructData constructData;
1219     ConstructType constructType = getConstructData(callee, constructData);
1220     
1221     ASSERT(constructType != ConstructType::JS);
1222     
1223     if (constructType == ConstructType::Host) {
1224         NativeCallFrameTracer tracer(&vm, execCallee);
1225         execCallee->setCallee(asObject(callee));
1226         vm.hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
1227
1228         LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
1229     }
1230     
1231 #if LLINT_SLOW_PATH_TRACING
1232     dataLog("Constructor callee is not a function: ", callee, "\n");
1233 #endif
1234
1235     ASSERT(constructType == ConstructType::None);
1236     LLINT_CALL_THROW(exec, createNotAConstructorError(exec, callee));
1237 }
1238
1239 inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, CodeSpecializationKind kind, JSValue calleeAsValue, LLIntCallLinkInfo* callLinkInfo = 0)
1240 {
1241     ExecState* exec = execCallee->callerFrame();
1242
1243 #if LLINT_SLOW_PATH_TRACING
1244     dataLogF("Performing call with recorded PC = %p\n", exec->currentVPC());
1245 #endif
1246     
1247     JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
1248     if (!calleeAsFunctionCell)
1249         return handleHostCall(execCallee, pc, calleeAsValue, kind);
1250     
1251     JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
1252     JSScope* scope = callee->scopeUnchecked();
1253     VM& vm = *scope->vm();
1254     ExecutableBase* executable = callee->executable();
1255
1256     MacroAssemblerCodePtr codePtr;
1257     CodeBlock* codeBlock = 0;
1258     bool isWebAssemblyExecutable = false;
1259 #if ENABLE(WEBASSEMBLY)
1260     isWebAssemblyExecutable = executable->isWebAssemblyExecutable();
1261 #endif
1262
1263     if (executable->isHostFunction()) {
1264         codePtr = executable->entrypointFor(kind, MustCheckArity);
1265     } else if (!isWebAssemblyExecutable) {
1266         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
1267
1268         if (!isCall(kind) && functionExecutable->constructAbility() == ConstructAbility::CannotConstruct)
1269             LLINT_CALL_THROW(exec, createNotAConstructorError(exec, callee));
1270
1271         JSObject* error = functionExecutable->prepareForExecution(execCallee, callee, scope, kind);
1272         if (error)
1273             LLINT_CALL_THROW(exec, error);
1274         codeBlock = functionExecutable->codeBlockFor(kind);
1275         ASSERT(codeBlock);
1276         ArityCheckMode arity;
1277         if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
1278             arity = MustCheckArity;
1279         else
1280             arity = ArityCheckNotRequired;
1281         codePtr = functionExecutable->entrypointFor(kind, arity);
1282     } else {
1283 #if ENABLE(WEBASSEMBLY)
1284         WebAssemblyExecutable* webAssemblyExecutable = static_cast<WebAssemblyExecutable*>(executable);
1285         webAssemblyExecutable->prepareForExecution(execCallee);
1286         codeBlock = webAssemblyExecutable->codeBlockForCall();
1287         ASSERT(codeBlock);
1288         ArityCheckMode arity;
1289         if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
1290             arity = MustCheckArity;
1291         else
1292             arity = ArityCheckNotRequired;
1293         codePtr = webAssemblyExecutable->entrypointFor(kind, arity);
1294 #endif
1295     }
1296     
1297     ASSERT(!!codePtr);
1298     
1299     if (!LLINT_ALWAYS_ACCESS_SLOW && callLinkInfo) {
1300         CodeBlock* callerCodeBlock = exec->codeBlock();
1301
1302         ConcurrentJITLocker locker(callerCodeBlock->m_lock);
1303         
1304         if (callLinkInfo->isOnList())
1305             callLinkInfo->remove();
1306         callLinkInfo->callee.set(vm, callerCodeBlock, callee);
1307         callLinkInfo->lastSeenCallee.set(vm, callerCodeBlock, callee);
1308         callLinkInfo->machineCodeTarget = codePtr;
1309         if (codeBlock)
1310             codeBlock->linkIncomingCall(exec, callLinkInfo);
1311     }
1312
1313     LLINT_CALL_RETURN(exec, execCallee, codePtr.executableAddress());
1314 }
1315
1316 inline SlowPathReturnType genericCall(ExecState* exec, Instruction* pc, CodeSpecializationKind kind)
1317 {
1318     // This needs to:
1319     // - Set up a call frame.
1320     // - Figure out what to call and compile it if necessary.
1321     // - If possible, link the call's inline cache.
1322     // - Return a tuple of machine code address to call and the new call frame.
1323     
1324     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
1325     
1326     ExecState* execCallee = exec - pc[4].u.operand;
1327     
1328     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
1329     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1330     execCallee->setCallerFrame(exec);
1331     
1332     ASSERT(pc[5].u.callLinkInfo);
1333     return setUpCall(execCallee, pc, kind, calleeAsValue, pc[5].u.callLinkInfo);
1334 }
1335
1336 LLINT_SLOW_PATH_DECL(slow_path_call)
1337 {
1338     LLINT_BEGIN_NO_SET_PC();
1339     return genericCall(exec, pc, CodeForCall);
1340 }
1341
1342 LLINT_SLOW_PATH_DECL(slow_path_construct)
1343 {
1344     LLINT_BEGIN_NO_SET_PC();
1345     return genericCall(exec, pc, CodeForConstruct);
1346 }
1347
1348 LLINT_SLOW_PATH_DECL(slow_path_size_frame_for_varargs)
1349 {
1350     LLINT_BEGIN();
1351     // This needs to:
1352     // - Set up a call frame while respecting the variable arguments.
1353     
1354     unsigned numUsedStackSlots = -pc[5].u.operand;
1355     unsigned length = sizeFrameForVarargs(exec, &vm.interpreter->stack(),
1356         LLINT_OP_C(4).jsValue(), numUsedStackSlots, pc[6].u.operand);
1357     LLINT_CALL_CHECK_EXCEPTION(exec, exec);
1358     
1359     ExecState* execCallee = calleeFrameForVarargs(exec, numUsedStackSlots, length + 1);
1360     vm.varargsLength = length;
1361     vm.newCallFrameReturnValue = execCallee;
1362
1363     LLINT_RETURN_CALLEE_FRAME(execCallee);
1364 }
1365
1366 LLINT_SLOW_PATH_DECL(slow_path_call_varargs)
1367 {
1368     LLINT_BEGIN_NO_SET_PC();
1369     // This needs to:
1370     // - Figure out what to call and compile it if necessary.
1371     // - Return a tuple of machine code address to call and the new call frame.
1372     
1373     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
1374     
1375     ExecState* execCallee = vm.newCallFrameReturnValue;
1376
1377     setupVarargsFrameAndSetThis(exec, execCallee, LLINT_OP_C(3).jsValue(), LLINT_OP_C(4).jsValue(), pc[6].u.operand, vm.varargsLength);
1378     LLINT_CALL_CHECK_EXCEPTION(exec, exec);
1379     
1380     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1381     execCallee->setCallerFrame(exec);
1382     exec->setCurrentVPC(pc);
1383     
1384     return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
1385 }
1386     
1387 LLINT_SLOW_PATH_DECL(slow_path_construct_varargs)
1388 {
1389     LLINT_BEGIN_NO_SET_PC();
1390     // This needs to:
1391     // - Figure out what to call and compile it if necessary.
1392     // - Return a tuple of machine code address to call and the new call frame.
1393     
1394     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
1395     
1396     ExecState* execCallee = vm.newCallFrameReturnValue;
1397     
1398     setupVarargsFrameAndSetThis(exec, execCallee, LLINT_OP_C(3).jsValue(), LLINT_OP_C(4).jsValue(), pc[6].u.operand, vm.varargsLength);
1399     LLINT_CALL_CHECK_EXCEPTION(exec, exec);
1400     
1401     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1402     execCallee->setCallerFrame(exec);
1403     exec->setCurrentVPC(pc);
1404     
1405     return setUpCall(execCallee, pc, CodeForConstruct, calleeAsValue);
1406 }
1407     
1408 LLINT_SLOW_PATH_DECL(slow_path_call_eval)
1409 {
1410     LLINT_BEGIN_NO_SET_PC();
1411     JSValue calleeAsValue = LLINT_OP(2).jsValue();
1412     
1413     ExecState* execCallee = exec - pc[4].u.operand;
1414     
1415     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
1416     execCallee->setCallerFrame(exec);
1417     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1418     execCallee->setReturnPC(LLInt::getCodePtr(llint_generic_return_point));
1419     execCallee->setCodeBlock(0);
1420     exec->setCurrentVPC(pc);
1421     
1422     if (!isHostFunction(calleeAsValue, globalFuncEval))
1423         return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
1424     
1425     vm.hostCallReturnValue = eval(execCallee);
1426     LLINT_CALL_RETURN(exec, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
1427 }
1428
1429 LLINT_SLOW_PATH_DECL(slow_path_strcat)
1430 {
1431     LLINT_BEGIN();
1432     LLINT_RETURN(jsStringFromRegisterArray(exec, &LLINT_OP(2), pc[3].u.operand));
1433 }
1434
1435 LLINT_SLOW_PATH_DECL(slow_path_to_primitive)
1436 {
1437     LLINT_BEGIN();
1438     LLINT_RETURN(LLINT_OP_C(2).jsValue().toPrimitive(exec));
1439 }
1440
1441 LLINT_SLOW_PATH_DECL(slow_path_throw)
1442 {
1443     LLINT_BEGIN();
1444     LLINT_THROW(LLINT_OP_C(1).jsValue());
1445 }
1446
1447 LLINT_SLOW_PATH_DECL(slow_path_throw_static_error)
1448 {
1449     LLINT_BEGIN();
1450     JSValue errorMessageValue = LLINT_OP_C(1).jsValue();
1451     RELEASE_ASSERT(errorMessageValue.isString());
1452     String errorMessage = asString(errorMessageValue)->value(exec);
1453     if (pc[2].u.operand)
1454         LLINT_THROW(createReferenceError(exec, errorMessage));
1455     else
1456         LLINT_THROW(createTypeError(exec, errorMessage));
1457 }
1458
1459 LLINT_SLOW_PATH_DECL(slow_path_handle_watchdog_timer)
1460 {
1461     LLINT_BEGIN_NO_SET_PC();
1462     ASSERT(vm.watchdog());
1463     if (UNLIKELY(vm.shouldTriggerTermination(exec)))
1464         LLINT_THROW(createTerminatedExecutionException(&vm));
1465     LLINT_RETURN_TWO(0, exec);
1466 }
1467
1468 LLINT_SLOW_PATH_DECL(slow_path_debug)
1469 {
1470     LLINT_BEGIN();
1471     int debugHookID = pc[1].u.operand;
1472     vm.interpreter->debug(exec, static_cast<DebugHookID>(debugHookID));
1473     
1474     LLINT_END();
1475 }
1476
1477 LLINT_SLOW_PATH_DECL(slow_path_handle_exception)
1478 {
1479     LLINT_BEGIN_NO_SET_PC();
1480     genericUnwind(&vm, exec);
1481     LLINT_END_IMPL();
1482 }
1483
1484 LLINT_SLOW_PATH_DECL(slow_path_get_from_scope)
1485 {
1486     LLINT_BEGIN();
1487
1488     const Identifier& ident = exec->codeBlock()->identifier(pc[3].u.operand);
1489     JSObject* scope = jsCast<JSObject*>(LLINT_OP(2).jsValue());
1490     GetPutInfo getPutInfo(pc[4].u.operand);
1491
1492     // ModuleVar is always converted to ClosureVar for get_from_scope.
1493     ASSERT(getPutInfo.resolveType() != ModuleVar);
1494
1495     PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
1496     if (!scope->getPropertySlot(exec, ident, slot)) {
1497         if (getPutInfo.resolveMode() == ThrowIfNotFound)
1498             LLINT_RETURN(exec->vm().throwException(exec, createUndefinedVariableError(exec, ident)));
1499         LLINT_RETURN(jsUndefined());
1500     }
1501
1502     JSValue result = JSValue();
1503     if (scope->isGlobalLexicalEnvironment()) {
1504         // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
1505         result = slot.getValue(exec, ident);
1506         if (result == jsTDZValue())
1507             LLINT_THROW(createTDZError(exec));
1508     }
1509
1510     CommonSlowPaths::tryCacheGetFromScopeGlobal(exec, vm, pc, scope, slot, ident);
1511
1512     if (!result)
1513         result = slot.getValue(exec, ident);
1514     LLINT_RETURN(result);
1515 }
1516
1517 LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
1518 {
1519     LLINT_BEGIN();
1520
1521     CodeBlock* codeBlock = exec->codeBlock();
1522     const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
1523     JSObject* scope = jsCast<JSObject*>(LLINT_OP(1).jsValue());
1524     JSValue value = LLINT_OP_C(3).jsValue();
1525     GetPutInfo getPutInfo = GetPutInfo(pc[4].u.operand);
1526     if (getPutInfo.resolveType() == LocalClosureVar) {
1527         JSLexicalEnvironment* environment = jsCast<JSLexicalEnvironment*>(scope);
1528         environment->variableAt(ScopeOffset(pc[6].u.operand)).set(vm, environment, value);
1529         
1530         // Have to do this *after* the write, because if this puts the set into IsWatched, then we need
1531         // to have already changed the value of the variable. Otherwise we might watch and constant-fold
1532         // to the Undefined value from before the assignment.
1533         if (WatchpointSet* set = pc[5].u.watchpointSet)
1534             set->touch("Executed op_put_scope<LocalClosureVar>");
1535         LLINT_END();
1536     }
1537
1538     bool hasProperty = scope->hasProperty(exec, ident);
1539     if (hasProperty
1540         && scope->isGlobalLexicalEnvironment()
1541         && !isInitialization(getPutInfo.initializationMode())) {
1542         // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
1543         PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
1544         JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
1545         if (slot.getValue(exec, ident) == jsTDZValue())
1546             LLINT_THROW(createTDZError(exec));
1547     }
1548
1549     if (getPutInfo.resolveMode() == ThrowIfNotFound && !hasProperty)
1550         LLINT_THROW(createUndefinedVariableError(exec, ident));
1551
1552     PutPropertySlot slot(scope, codeBlock->isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
1553     scope->methodTable()->put(scope, exec, ident, value, slot);
1554     
1555     CommonSlowPaths::tryCachePutToScopeGlobal(exec, codeBlock, pc, scope, getPutInfo, slot, ident);
1556
1557     LLINT_END();
1558 }
1559
1560 LLINT_SLOW_PATH_DECL(slow_path_check_if_exception_is_uncatchable_and_notify_profiler)
1561 {
1562     LLINT_BEGIN();
1563     RELEASE_ASSERT(!!vm.exception());
1564
1565     if (isTerminatedExecutionException(vm.exception()))
1566         LLINT_RETURN_TWO(pc, bitwise_cast<void*>(static_cast<uintptr_t>(1)));
1567     LLINT_RETURN_TWO(pc, 0);
1568 }
1569
1570 LLINT_SLOW_PATH_DECL(slow_path_log_shadow_chicken_prologue)
1571 {
1572     LLINT_BEGIN();
1573     
1574     JSScope* scope = exec->uncheckedR(pc[1].u.operand).Register::scope();
1575     vm.shadowChicken().log(vm, exec, ShadowChicken::Packet::prologue(exec->callee(), exec, exec->callerFrame(), scope));
1576     
1577     LLINT_END();
1578 }
1579
1580 LLINT_SLOW_PATH_DECL(slow_path_log_shadow_chicken_tail)
1581 {
1582     LLINT_BEGIN();
1583
1584     JSValue thisValue = LLINT_OP(1).jsValue();
1585     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1586     
1587 #if USE(JSVALUE64)
1588     CallSiteIndex callSiteIndex(exec->codeBlock()->bytecodeOffset(pc));
1589 #else
1590     CallSiteIndex callSiteIndex(pc);
1591 #endif
1592     vm.shadowChicken().log(vm, exec, ShadowChicken::Packet::tail(exec, thisValue, scope, exec->codeBlock(), callSiteIndex));
1593     
1594     LLINT_END();
1595 }
1596
1597 extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM* vm, ProtoCallFrame* protoFrame)
1598 {
1599     ExecState* exec = vm->topCallFrame;
1600     if (!exec)
1601         exec = protoFrame->callee()->globalObject()->globalExec();
1602     throwStackOverflowError(exec);
1603     return encodeResult(0, 0);
1604 }
1605
1606 #if !ENABLE(JIT)
1607 extern "C" SlowPathReturnType llint_stack_check_at_vm_entry(VM* vm, Register* newTopOfStack)
1608 {
1609     bool success = vm->interpreter->stack().ensureCapacityFor(newTopOfStack);
1610     return encodeResult(reinterpret_cast<void*>(success), 0);
1611 }
1612 #endif
1613
1614 extern "C" void llint_write_barrier_slow(ExecState* exec, JSCell* cell)
1615 {
1616     VM& vm = exec->vm();
1617     vm.heap.writeBarrier(cell);
1618 }
1619
1620 extern "C" NO_RETURN_DUE_TO_CRASH void llint_crash()
1621 {
1622     CRASH();
1623 }
1624
1625 } } // namespace JSC::LLInt