Unreviewed, rolling out r202627.
[WebKit-https.git] / Source / JavaScriptCore / llint / LLIntSlowPaths.cpp
1 /*
2  * Copyright (C) 2011-2016 Apple Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions
6  * are met:
7  * 1. Redistributions of source code must retain the above copyright
8  *    notice, this list of conditions and the following disclaimer.
9  * 2. Redistributions in binary form must reproduce the above copyright
10  *    notice, this list of conditions and the following disclaimer in the
11  *    documentation and/or other materials provided with the distribution.
12  *
13  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
14  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
15  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
16  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
17  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
18  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
19  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
20  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
21  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
23  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
24  */
25
26 #include "config.h"
27 #include "LLIntSlowPaths.h"
28
29 #include "ArrayConstructor.h"
30 #include "CallFrame.h"
31 #include "CommonSlowPaths.h"
32 #include "CommonSlowPathsExceptions.h"
33 #include "Error.h"
34 #include "ErrorHandlingScope.h"
35 #include "Exception.h"
36 #include "ExceptionFuzz.h"
37 #include "FunctionWhitelist.h"
38 #include "GetterSetter.h"
39 #include "HostCallReturnValue.h"
40 #include "Interpreter.h"
41 #include "JIT.h"
42 #include "JITExceptions.h"
43 #include "JITWorklist.h"
44 #include "JSLexicalEnvironment.h"
45 #include "JSCInlines.h"
46 #include "JSCJSValue.h"
47 #include "JSGeneratorFunction.h"
48 #include "JSGlobalObjectFunctions.h"
49 #include "JSStackInlines.h"
50 #include "JSString.h"
51 #include "JSWithScope.h"
52 #include "LLIntCommon.h"
53 #include "LLIntData.h"
54 #include "LLIntExceptions.h"
55 #include "LowLevelInterpreter.h"
56 #include "ObjectConstructor.h"
57 #include "ObjectPropertyConditionSet.h"
58 #include "ProtoCallFrame.h"
59 #include "ShadowChicken.h"
60 #include "StructureRareDataInlines.h"
61 #include "VMInlines.h"
62 #include <wtf/NeverDestroyed.h>
63 #include <wtf/StringPrintStream.h>
64
65 namespace JSC { namespace LLInt {
66
67 #define LLINT_BEGIN_NO_SET_PC() \
68     VM& vm = exec->vm();      \
69     NativeCallFrameTracer tracer(&vm, exec)
70
71 #ifndef NDEBUG
72 #define LLINT_SET_PC_FOR_STUBS() do { \
73         exec->codeBlock()->bytecodeOffset(pc); \
74         exec->setCurrentVPC(pc); \
75     } while (false)
76 #else
77 #define LLINT_SET_PC_FOR_STUBS() do { \
78         exec->setCurrentVPC(pc); \
79     } while (false)
80 #endif
81
82 #define LLINT_BEGIN()                           \
83     LLINT_BEGIN_NO_SET_PC();                    \
84     LLINT_SET_PC_FOR_STUBS()
85
86 #define LLINT_OP(index) (exec->uncheckedR(pc[index].u.operand))
87 #define LLINT_OP_C(index) (exec->r(pc[index].u.operand))
88
89 #define LLINT_RETURN_TWO(first, second) do {       \
90         return encodeResult(first, second);        \
91     } while (false)
92
93 #define LLINT_END_IMPL() LLINT_RETURN_TWO(pc, 0)
94
95 #define LLINT_THROW(exceptionToThrow) do {                        \
96         vm.throwException(exec, exceptionToThrow);                \
97         pc = returnToThrow(exec);                                 \
98         LLINT_END_IMPL();                                         \
99     } while (false)
100
101 #define LLINT_CHECK_EXCEPTION() do {                    \
102         doExceptionFuzzingIfEnabled(exec, "LLIntSlowPaths", pc);    \
103         if (UNLIKELY(vm.exception())) {                 \
104             pc = returnToThrow(exec);                   \
105             LLINT_END_IMPL();                           \
106         }                                               \
107     } while (false)
108
109 #define LLINT_END() do {                        \
110         LLINT_CHECK_EXCEPTION();                \
111         LLINT_END_IMPL();                       \
112     } while (false)
113
114 #define LLINT_BRANCH(opcode, condition) do {                      \
115         bool __b_condition = (condition);                         \
116         LLINT_CHECK_EXCEPTION();                                  \
117         if (__b_condition)                                        \
118             pc += pc[OPCODE_LENGTH(opcode) - 1].u.operand;        \
119         else                                                      \
120             pc += OPCODE_LENGTH(opcode);                          \
121         LLINT_END_IMPL();                                         \
122     } while (false)
123
124 #define LLINT_RETURN(value) do {                \
125         JSValue __r_returnValue = (value);      \
126         LLINT_CHECK_EXCEPTION();                \
127         LLINT_OP(1) = __r_returnValue;          \
128         LLINT_END_IMPL();                       \
129     } while (false)
130
131 #define LLINT_RETURN_WITH_PC_ADJUSTMENT(value, pcAdjustment) do { \
132         JSValue __r_returnValue = (value);      \
133         LLINT_CHECK_EXCEPTION();                \
134         LLINT_OP(1) = __r_returnValue;          \
135         pc += (pcAdjustment);                   \
136         LLINT_END_IMPL();                       \
137     } while (false)
138
139 #define LLINT_RETURN_PROFILED(opcode, value) do {               \
140         JSValue __rp_returnValue = (value);                     \
141         LLINT_CHECK_EXCEPTION();                                \
142         LLINT_OP(1) = __rp_returnValue;                         \
143         LLINT_PROFILE_VALUE(opcode, __rp_returnValue);          \
144         LLINT_END_IMPL();                                       \
145     } while (false)
146
147 #define LLINT_PROFILE_VALUE(opcode, value) do { \
148         pc[OPCODE_LENGTH(opcode) - 1].u.profile->m_buckets[0] = \
149         JSValue::encode(value);                  \
150     } while (false)
151
152 #define LLINT_CALL_END_IMPL(exec, callTarget) LLINT_RETURN_TWO((callTarget), (exec))
153
154 #define LLINT_CALL_THROW(exec, exceptionToThrow) do {                   \
155         ExecState* __ct_exec = (exec);                                  \
156         vm.throwException(__ct_exec, exceptionToThrow);                 \
157         LLINT_CALL_END_IMPL(0, callToThrow(__ct_exec));                 \
158     } while (false)
159
160 #define LLINT_CALL_CHECK_EXCEPTION(exec, execCallee) do {               \
161         ExecState* __cce_exec = (exec);                                 \
162         ExecState* __cce_execCallee = (execCallee);                     \
163         doExceptionFuzzingIfEnabled(__cce_exec, "LLIntSlowPaths/call", nullptr); \
164         if (UNLIKELY(vm.exception()))                                   \
165             LLINT_CALL_END_IMPL(0, callToThrow(__cce_execCallee));      \
166     } while (false)
167
168 #define LLINT_CALL_RETURN(exec, execCallee, callTarget) do {            \
169         ExecState* __cr_exec = (exec);                                  \
170         ExecState* __cr_execCallee = (execCallee);                      \
171         void* __cr_callTarget = (callTarget);                           \
172         LLINT_CALL_CHECK_EXCEPTION(__cr_exec, __cr_execCallee);         \
173         LLINT_CALL_END_IMPL(__cr_execCallee, __cr_callTarget);          \
174     } while (false)
175
176 #define LLINT_RETURN_CALLEE_FRAME(execCallee) do {                      \
177         ExecState* __rcf_exec = (execCallee);                           \
178         LLINT_RETURN_TWO(pc, __rcf_exec);                               \
179     } while (false)
180     
181 extern "C" SlowPathReturnType llint_trace_operand(ExecState* exec, Instruction* pc, int fromWhere, int operand)
182 {
183     LLINT_BEGIN();
184     dataLogF("%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d\n",
185             exec->codeBlock(),
186             exec,
187             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
188             exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
189             fromWhere,
190             operand,
191             pc[operand].u.operand);
192     LLINT_END();
193 }
194
195 extern "C" SlowPathReturnType llint_trace_value(ExecState* exec, Instruction* pc, int fromWhere, int operand)
196 {
197     JSValue value = LLINT_OP_C(operand).jsValue();
198     union {
199         struct {
200             uint32_t tag;
201             uint32_t payload;
202         } bits;
203         EncodedJSValue asValue;
204     } u;
205     u.asValue = JSValue::encode(value);
206     dataLogF(
207         "%p / %p: executing bc#%zu, op#%u: Trace(%d): %d: %d: %08x:%08x: %s\n",
208         exec->codeBlock(),
209         exec,
210         static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
211         exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
212         fromWhere,
213         operand,
214         pc[operand].u.operand,
215         u.bits.tag,
216         u.bits.payload,
217         toCString(value).data());
218     LLINT_END_IMPL();
219 }
220
221 LLINT_SLOW_PATH_DECL(trace_prologue)
222 {
223     dataLogF("%p / %p: in prologue.\n", exec->codeBlock(), exec);
224     LLINT_END_IMPL();
225 }
226
227 static void traceFunctionPrologue(ExecState* exec, const char* comment, CodeSpecializationKind kind)
228 {
229     JSFunction* callee = jsCast<JSFunction*>(exec->callee());
230     FunctionExecutable* executable = callee->jsExecutable();
231     CodeBlock* codeBlock = executable->codeBlockFor(kind);
232     dataLogF("%p / %p: in %s of function %p, executable %p; numVars = %u, numParameters = %u, numCalleeLocals = %u, caller = %p.\n",
233             codeBlock, exec, comment, callee, executable,
234             codeBlock->m_numVars, codeBlock->numParameters(), codeBlock->m_numCalleeLocals,
235             exec->callerFrame());
236 }
237
238 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_call)
239 {
240     traceFunctionPrologue(exec, "call prologue", CodeForCall);
241     LLINT_END_IMPL();
242 }
243
244 LLINT_SLOW_PATH_DECL(trace_prologue_function_for_construct)
245 {
246     traceFunctionPrologue(exec, "construct prologue", CodeForConstruct);
247     LLINT_END_IMPL();
248 }
249
250 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_call)
251 {
252     traceFunctionPrologue(exec, "call arity check", CodeForCall);
253     LLINT_END_IMPL();
254 }
255
256 LLINT_SLOW_PATH_DECL(trace_arityCheck_for_construct)
257 {
258     traceFunctionPrologue(exec, "construct arity check", CodeForConstruct);
259     LLINT_END_IMPL();
260 }
261
262 LLINT_SLOW_PATH_DECL(trace)
263 {
264     dataLogF("%p / %p: executing bc#%zu, %s, pc = %p\n",
265             exec->codeBlock(),
266             exec,
267             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
268             opcodeNames[exec->vm().interpreter->getOpcodeID(pc[0].u.opcode)], pc);
269     if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_enter) {
270         dataLogF("Frame will eventually return to %p\n", exec->returnPC().value());
271         *bitwise_cast<volatile char*>(exec->returnPC().value());
272     }
273     if (exec->vm().interpreter->getOpcodeID(pc[0].u.opcode) == op_ret) {
274         dataLogF("Will be returning to %p\n", exec->returnPC().value());
275         dataLogF("The new cfr will be %p\n", exec->callerFrame());
276     }
277     LLINT_END_IMPL();
278 }
279
280 LLINT_SLOW_PATH_DECL(special_trace)
281 {
282     dataLogF("%p / %p: executing special case bc#%zu, op#%u, return PC is %p\n",
283             exec->codeBlock(),
284             exec,
285             static_cast<intptr_t>(pc - exec->codeBlock()->instructions().begin()),
286             exec->vm().interpreter->getOpcodeID(pc[0].u.opcode),
287             exec->returnPC().value());
288     LLINT_END_IMPL();
289 }
290
291 enum EntryKind { Prologue, ArityCheck };
292
293 #if ENABLE(JIT)
294 static FunctionWhitelist& ensureGlobalJITWhitelist()
295 {
296     static LazyNeverDestroyed<FunctionWhitelist> baselineWhitelist;
297     static std::once_flag initializeWhitelistFlag;
298     std::call_once(initializeWhitelistFlag, [] {
299         const char* functionWhitelistFile = Options::jitWhitelist();
300         baselineWhitelist.construct(functionWhitelistFile);
301     });
302     return baselineWhitelist;
303 }
304
305 inline bool shouldJIT(ExecState* exec, CodeBlock* codeBlock)
306 {
307     if (!Options::bytecodeRangeToJITCompile().isInRange(codeBlock->instructionCount())
308         || !ensureGlobalJITWhitelist().contains(codeBlock))
309         return false;
310
311     // You can modify this to turn off JITting without rebuilding the world.
312     return exec->vm().canUseJIT();
313 }
314
315 // Returns true if we should try to OSR.
316 inline bool jitCompileAndSetHeuristics(CodeBlock* codeBlock, ExecState* exec)
317 {
318     VM& vm = exec->vm();
319     DeferGCForAWhile deferGC(vm.heap); // My callers don't set top callframe, so we don't want to GC here at all.
320     
321     codeBlock->updateAllValueProfilePredictions();
322
323     if (!codeBlock->checkIfJITThresholdReached()) {
324         CODEBLOCK_LOG_EVENT(codeBlock, "delayJITCompile", ("threshold not reached, counter = ", codeBlock->llintExecuteCounter()));
325         if (Options::verboseOSR())
326             dataLogF("    JIT threshold should be lifted.\n");
327         return false;
328     }
329     
330     JITWorklist::instance()->poll(vm);
331     
332     switch (codeBlock->jitType()) {
333     case JITCode::BaselineJIT: {
334         if (Options::verboseOSR())
335             dataLogF("    Code was already compiled.\n");
336         codeBlock->jitSoon();
337         return true;
338     }
339     case JITCode::InterpreterThunk: {
340         JITWorklist::instance()->compileLater(codeBlock);
341         return codeBlock->jitType() == JITCode::BaselineJIT;
342     }
343     default:
344         dataLog("Unexpected code block in LLInt: ", *codeBlock, "\n");
345         RELEASE_ASSERT_NOT_REACHED();
346         return false;
347     }
348 }
349
350 static SlowPathReturnType entryOSR(ExecState* exec, Instruction*, CodeBlock* codeBlock, const char *name, EntryKind kind)
351 {
352     if (Options::verboseOSR()) {
353         dataLog(
354             *codeBlock, ": Entered ", name, " with executeCounter = ",
355             codeBlock->llintExecuteCounter(), "\n");
356     }
357     
358     if (!shouldJIT(exec, codeBlock)) {
359         codeBlock->dontJITAnytimeSoon();
360         LLINT_RETURN_TWO(0, 0);
361     }
362     if (!jitCompileAndSetHeuristics(codeBlock, exec))
363         LLINT_RETURN_TWO(0, 0);
364     
365     CODEBLOCK_LOG_EVENT(codeBlock, "OSR entry", ("in prologue"));
366     
367     if (kind == Prologue)
368         LLINT_RETURN_TWO(codeBlock->jitCode()->executableAddress(), 0);
369     ASSERT(kind == ArityCheck);
370     LLINT_RETURN_TWO(codeBlock->jitCode()->addressForCall(MustCheckArity).executableAddress(), 0);
371 }
372 #else // ENABLE(JIT)
373 static SlowPathReturnType entryOSR(ExecState* exec, Instruction*, CodeBlock* codeBlock, const char*, EntryKind)
374 {
375     codeBlock->dontJITAnytimeSoon();
376     LLINT_RETURN_TWO(0, exec);
377 }
378 #endif // ENABLE(JIT)
379
380 LLINT_SLOW_PATH_DECL(entry_osr)
381 {
382     return entryOSR(exec, pc, exec->codeBlock(), "entry_osr", Prologue);
383 }
384
385 LLINT_SLOW_PATH_DECL(entry_osr_function_for_call)
386 {
387     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForCall(), "entry_osr_function_for_call", Prologue);
388 }
389
390 LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct)
391 {
392     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForConstruct(), "entry_osr_function_for_construct", Prologue);
393 }
394
395 LLINT_SLOW_PATH_DECL(entry_osr_function_for_call_arityCheck)
396 {
397     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForCall(), "entry_osr_function_for_call_arityCheck", ArityCheck);
398 }
399
400 LLINT_SLOW_PATH_DECL(entry_osr_function_for_construct_arityCheck)
401 {
402     return entryOSR(exec, pc, jsCast<JSFunction*>(exec->callee())->jsExecutable()->codeBlockForConstruct(), "entry_osr_function_for_construct_arityCheck", ArityCheck);
403 }
404
405 LLINT_SLOW_PATH_DECL(loop_osr)
406 {
407     CodeBlock* codeBlock = exec->codeBlock();
408
409 #if ENABLE(JIT)
410     if (Options::verboseOSR()) {
411         dataLog(
412             *codeBlock, ": Entered loop_osr with executeCounter = ",
413             codeBlock->llintExecuteCounter(), "\n");
414     }
415     
416     if (!shouldJIT(exec, codeBlock)) {
417         codeBlock->dontJITAnytimeSoon();
418         LLINT_RETURN_TWO(0, 0);
419     }
420     
421     if (!jitCompileAndSetHeuristics(codeBlock, exec))
422         LLINT_RETURN_TWO(0, 0);
423     
424     CODEBLOCK_LOG_EVENT(codeBlock, "osrEntry", ("at bc#", pc - codeBlock->instructions().begin()));
425
426     ASSERT(codeBlock->jitType() == JITCode::BaselineJIT);
427     
428     Vector<BytecodeAndMachineOffset> map;
429     codeBlock->jitCodeMap()->decode(map);
430     BytecodeAndMachineOffset* mapping = binarySearch<BytecodeAndMachineOffset, unsigned>(map, map.size(), pc - codeBlock->instructions().begin(), BytecodeAndMachineOffset::getBytecodeIndex);
431     ASSERT(mapping);
432     ASSERT(mapping->m_bytecodeIndex == static_cast<unsigned>(pc - codeBlock->instructions().begin()));
433     
434     void* jumpTarget = codeBlock->jitCode()->executableAddressAtOffset(mapping->m_machineCodeOffset);
435     ASSERT(jumpTarget);
436     
437     LLINT_RETURN_TWO(jumpTarget, exec->topOfFrame());
438 #else // ENABLE(JIT)
439     UNUSED_PARAM(pc);
440     codeBlock->dontJITAnytimeSoon();
441     LLINT_RETURN_TWO(0, 0);
442 #endif // ENABLE(JIT)
443 }
444
445 LLINT_SLOW_PATH_DECL(replace)
446 {
447     CodeBlock* codeBlock = exec->codeBlock();
448
449 #if ENABLE(JIT)
450     if (Options::verboseOSR()) {
451         dataLog(
452             *codeBlock, ": Entered replace with executeCounter = ",
453             codeBlock->llintExecuteCounter(), "\n");
454     }
455     
456     if (shouldJIT(exec, codeBlock))
457         jitCompileAndSetHeuristics(codeBlock, exec);
458     else
459         codeBlock->dontJITAnytimeSoon();
460     LLINT_END_IMPL();
461 #else // ENABLE(JIT)
462     codeBlock->dontJITAnytimeSoon();
463     LLINT_END_IMPL();
464 #endif // ENABLE(JIT)
465 }
466
467 LLINT_SLOW_PATH_DECL(stack_check)
468 {
469     VM& vm = exec->vm();
470     VMEntryFrame* vmEntryFrame = vm.topVMEntryFrame;
471     CallFrame* callerFrame = exec->callerFrame(vmEntryFrame);
472     if (!callerFrame) {
473         callerFrame = exec;
474         vmEntryFrame = vm.topVMEntryFrame;
475     }
476     NativeCallFrameTracerWithRestore tracer(&vm, vmEntryFrame, callerFrame);
477
478     LLINT_SET_PC_FOR_STUBS();
479
480 #if LLINT_SLOW_PATH_TRACING
481     dataLogF("Checking stack height with exec = %p.\n", exec);
482     dataLogF("CodeBlock = %p.\n", exec->codeBlock());
483     dataLogF("Num callee registers = %u.\n", exec->codeBlock()->m_numCalleeLocals);
484     dataLogF("Num vars = %u.\n", exec->codeBlock()->m_numVars);
485
486 #if ENABLE(JIT)
487     dataLogF("Current end is at %p.\n", exec->vm().stackLimit());
488 #else
489     dataLogF("Current end is at %p.\n", exec->vm().jsStackLimit());
490 #endif
491
492 #endif
493     // If the stack check succeeds and we don't need to throw the error, then
494     // we'll return 0 instead. The prologue will check for a non-zero value
495     // when determining whether to set the callFrame or not.
496
497     // For JIT enabled builds which uses the C stack, the stack is not growable.
498     // Hence, if we get here, then we know a stack overflow is imminent. So, just
499     // throw the StackOverflowError unconditionally.
500 #if !ENABLE(JIT)
501     ASSERT(!vm.interpreter->stack().containsAddress(exec->topOfFrame()));
502     if (LIKELY(vm.interpreter->stack().ensureCapacityFor(exec->topOfFrame())))
503         LLINT_RETURN_TWO(pc, 0);
504 #endif
505
506     ErrorHandlingScope errorScope(vm);
507     throwStackOverflowError(callerFrame);
508     pc = returnToThrow(callerFrame);
509     LLINT_RETURN_TWO(pc, exec);
510 }
511
512 LLINT_SLOW_PATH_DECL(slow_path_new_object)
513 {
514     LLINT_BEGIN();
515     LLINT_RETURN(constructEmptyObject(exec, pc[3].u.objectAllocationProfile->structure()));
516 }
517
518 LLINT_SLOW_PATH_DECL(slow_path_new_array)
519 {
520     LLINT_BEGIN();
521     LLINT_RETURN(constructArrayNegativeIndexed(exec, pc[4].u.arrayAllocationProfile, bitwise_cast<JSValue*>(&LLINT_OP(2)), pc[3].u.operand));
522 }
523
524 LLINT_SLOW_PATH_DECL(slow_path_new_array_with_size)
525 {
526     LLINT_BEGIN();
527     LLINT_RETURN(constructArrayWithSizeQuirk(exec, pc[3].u.arrayAllocationProfile, exec->lexicalGlobalObject(), LLINT_OP_C(2).jsValue()));
528 }
529
530 LLINT_SLOW_PATH_DECL(slow_path_new_array_buffer)
531 {
532     LLINT_BEGIN();
533     LLINT_RETURN(constructArray(exec, pc[4].u.arrayAllocationProfile, exec->codeBlock()->constantBuffer(pc[2].u.operand), pc[3].u.operand));
534 }
535
536 LLINT_SLOW_PATH_DECL(slow_path_new_regexp)
537 {
538     LLINT_BEGIN();
539     RegExp* regExp = exec->codeBlock()->regexp(pc[2].u.operand);
540     if (!regExp->isValid())
541         LLINT_THROW(createSyntaxError(exec, "Invalid flag supplied to RegExp constructor."));
542     LLINT_RETURN(RegExpObject::create(vm, exec->lexicalGlobalObject()->regExpStructure(), regExp));
543 }
544
545 LLINT_SLOW_PATH_DECL(slow_path_instanceof)
546 {
547     LLINT_BEGIN();
548     JSValue value = LLINT_OP_C(2).jsValue();
549     JSValue proto = LLINT_OP_C(3).jsValue();
550     LLINT_RETURN(jsBoolean(JSObject::defaultHasInstance(exec, value, proto)));
551 }
552
553 LLINT_SLOW_PATH_DECL(slow_path_instanceof_custom)
554 {
555     LLINT_BEGIN();
556
557     JSValue value = LLINT_OP_C(2).jsValue();
558     JSValue constructor = LLINT_OP_C(3).jsValue();
559     JSValue hasInstanceValue = LLINT_OP_C(4).jsValue();
560
561     ASSERT(constructor.isObject());
562     ASSERT(hasInstanceValue != exec->lexicalGlobalObject()->functionProtoHasInstanceSymbolFunction() || !constructor.getObject()->structure()->typeInfo().implementsDefaultHasInstance());
563
564     JSValue result = jsBoolean(constructor.getObject()->hasInstance(exec, value, hasInstanceValue));
565     LLINT_RETURN(result);
566 }
567
568 LLINT_SLOW_PATH_DECL(slow_path_try_get_by_id)
569 {
570     LLINT_BEGIN();
571     CodeBlock* codeBlock = exec->codeBlock();
572     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
573     JSValue baseValue = LLINT_OP_C(2).jsValue();
574     PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::VMInquiry);
575
576     baseValue.getPropertySlot(exec, ident, slot);
577
578     LLINT_RETURN(slot.getPureResult());
579 }
580
581 static void setupGetByIdPrototypeCache(ExecState* exec, VM& vm, Instruction* pc, JSCell* baseCell, PropertySlot& slot, const Identifier& ident)
582 {
583     CodeBlock* codeBlock = exec->codeBlock();
584     Structure* structure = baseCell->structure();
585
586     if (structure->typeInfo().prohibitsPropertyCaching())
587         return;
588     
589     if (structure->needImpurePropertyWatchpoint())
590         return;
591
592     if (structure->isDictionary()) {
593         if (structure->hasBeenFlattenedBefore())
594             return;
595         structure->flattenDictionaryStructure(vm, jsCast<JSObject*>(baseCell));
596     }
597
598     ObjectPropertyConditionSet conditions;
599     if (slot.isUnset())
600         conditions = generateConditionsForPropertyMiss(vm, codeBlock, exec, structure, ident.impl());
601     else
602         conditions = generateConditionsForPrototypePropertyHit(vm, codeBlock, exec, structure, slot.slotBase(), ident.impl());
603
604     if (!conditions.isValid())
605         return;
606
607     PropertyOffset offset = invalidOffset;
608     CodeBlock::StructureWatchpointMap& watchpointMap = codeBlock->llintGetByIdWatchpointMap();
609     auto result = watchpointMap.add(structure, Bag<LLIntPrototypeLoadAdaptiveStructureWatchpoint>());
610     for (ObjectPropertyCondition condition : conditions) {
611         if (!condition.isWatchable())
612             return;
613         if (condition.condition().kind() == PropertyCondition::Presence)
614             offset = condition.condition().offset();
615         result.iterator->value.add(condition, pc)->install();
616     }
617     ASSERT((offset == invalidOffset) == slot.isUnset());
618
619     ConcurrentJITLocker locker(codeBlock->m_lock);
620
621     if (slot.isUnset()) {
622         pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_unset);
623         pc[4].u.structureID = structure->id();
624         return;
625     }
626     ASSERT(slot.isValue());
627
628     pc[0].u.opcode = LLInt::getOpcode(op_get_by_id_proto_load);
629     pc[4].u.structureID = structure->id();
630     pc[5].u.operand = offset;
631     // We know that this pointer will remain valid because it will be cleared by either a watchpoint fire or
632     // during GC when we clear the LLInt caches.
633     pc[6].u.pointer = slot.slotBase();
634 }
635
636
637 LLINT_SLOW_PATH_DECL(slow_path_get_by_id)
638 {
639     LLINT_BEGIN();
640     CodeBlock* codeBlock = exec->codeBlock();
641     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
642     JSValue baseValue = LLINT_OP_C(2).jsValue();
643     PropertySlot slot(baseValue, PropertySlot::PropertySlot::InternalMethodType::Get);
644
645     JSValue result = baseValue.get(exec, ident, slot);
646     LLINT_CHECK_EXCEPTION();
647     LLINT_OP(1) = result;
648     
649     if (!LLINT_ALWAYS_ACCESS_SLOW
650         && baseValue.isCell()
651         && slot.isCacheable()) {
652
653         JSCell* baseCell = baseValue.asCell();
654         Structure* structure = baseCell->structure();
655         if (slot.isValue() && slot.slotBase() == baseValue) {
656             // Start out by clearing out the old cache.
657             pc[0].u.opcode = LLInt::getOpcode(op_get_by_id);
658             pc[4].u.pointer = nullptr; // old structure
659             pc[5].u.pointer = nullptr; // offset
660
661             // Prevent the prototype cache from ever happening.
662             pc[7].u.operand = 0;
663         
664             if (structure->propertyAccessesAreCacheable()) {
665                 vm.heap.writeBarrier(codeBlock);
666                 
667                 ConcurrentJITLocker locker(codeBlock->m_lock);
668
669                 pc[4].u.structureID = structure->id();
670                 pc[5].u.operand = slot.cachedOffset();
671             }
672         } else if (UNLIKELY(pc[7].u.operand && (slot.isValue() || slot.isUnset()))) {
673             ASSERT(slot.slotBase() != baseValue);
674
675             if (!(--pc[7].u.operand))
676                 setupGetByIdPrototypeCache(exec, vm, pc, baseCell, slot, ident);
677         }
678     } else if (!LLINT_ALWAYS_ACCESS_SLOW
679         && isJSArray(baseValue)
680         && ident == exec->propertyNames().length) {
681         pc[0].u.opcode = LLInt::getOpcode(op_get_array_length);
682         ArrayProfile* arrayProfile = codeBlock->getOrAddArrayProfile(pc - codeBlock->instructions().begin());
683         arrayProfile->observeStructure(baseValue.asCell()->structure());
684         pc[4].u.arrayProfile = arrayProfile;
685
686         // Prevent the prototype cache from ever happening.
687         pc[7].u.operand = 0;
688     }
689
690     pc[OPCODE_LENGTH(op_get_by_id) - 1].u.profile->m_buckets[0] = JSValue::encode(result);
691     LLINT_END();
692 }
693
694 LLINT_SLOW_PATH_DECL(slow_path_get_arguments_length)
695 {
696     LLINT_BEGIN();
697     CodeBlock* codeBlock = exec->codeBlock();
698     const Identifier& ident = codeBlock->identifier(pc[3].u.operand);
699     JSValue baseValue = LLINT_OP(2).jsValue();
700     PropertySlot slot(baseValue, PropertySlot::InternalMethodType::Get);
701     LLINT_RETURN(baseValue.get(exec, ident, slot));
702 }
703
704 LLINT_SLOW_PATH_DECL(slow_path_put_by_id)
705 {
706     LLINT_BEGIN();
707     CodeBlock* codeBlock = exec->codeBlock();
708     const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
709     
710     JSValue baseValue = LLINT_OP_C(1).jsValue();
711     PutPropertySlot slot(baseValue, codeBlock->isStrictMode(), codeBlock->putByIdContext());
712     if (pc[8].u.putByIdFlags & PutByIdIsDirect)
713         asObject(baseValue)->putDirect(vm, ident, LLINT_OP_C(3).jsValue(), slot);
714     else
715         baseValue.putInline(exec, ident, LLINT_OP_C(3).jsValue(), slot);
716     LLINT_CHECK_EXCEPTION();
717     
718     if (!LLINT_ALWAYS_ACCESS_SLOW
719         && baseValue.isCell()
720         && slot.isCacheablePut()) {
721
722         // Start out by clearing out the old cache.
723         pc[4].u.pointer = nullptr; // old structure
724         pc[5].u.pointer = nullptr; // offset
725         pc[6].u.pointer = nullptr; // new structure
726         pc[7].u.pointer = nullptr; // structure chain
727         pc[8].u.putByIdFlags =
728             static_cast<PutByIdFlags>(pc[8].u.putByIdFlags & PutByIdPersistentFlagsMask);
729         
730         JSCell* baseCell = baseValue.asCell();
731         Structure* structure = baseCell->structure();
732         
733         if (!structure->isUncacheableDictionary()
734             && !structure->typeInfo().prohibitsPropertyCaching()
735             && baseCell == slot.base()) {
736
737             vm.heap.writeBarrier(codeBlock);
738             
739             if (slot.type() == PutPropertySlot::NewProperty) {
740                 GCSafeConcurrentJITLocker locker(codeBlock->m_lock, vm.heap);
741             
742                 if (!structure->isDictionary() && structure->previousID()->outOfLineCapacity() == structure->outOfLineCapacity()) {
743                     ASSERT(structure->previousID()->transitionWatchpointSetHasBeenInvalidated());
744
745                     if (normalizePrototypeChain(exec, structure) != InvalidPrototypeChain) {
746                         ASSERT(structure->previousID()->isObject());
747                         pc[4].u.structureID = structure->previousID()->id();
748                         pc[5].u.operand = slot.cachedOffset();
749                         pc[6].u.structureID = structure->id();
750                         if (!(pc[8].u.putByIdFlags & PutByIdIsDirect)) {
751                             StructureChain* chain = structure->prototypeChain(exec);
752                             ASSERT(chain);
753                             pc[7].u.structureChain.set(
754                                 vm, codeBlock, chain);
755                         }
756                         pc[8].u.putByIdFlags = static_cast<PutByIdFlags>(
757                             pc[8].u.putByIdFlags |
758                             structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
759                     }
760                 }
761             } else {
762                 structure->didCachePropertyReplacement(vm, slot.cachedOffset());
763                 pc[4].u.structureID = structure->id();
764                 pc[5].u.operand = slot.cachedOffset();
765                 pc[8].u.putByIdFlags = static_cast<PutByIdFlags>(
766                     pc[8].u.putByIdFlags |
767                     structure->inferredTypeDescriptorFor(ident.impl()).putByIdFlags());
768             }
769         }
770     }
771     
772     LLINT_END();
773 }
774
775 LLINT_SLOW_PATH_DECL(slow_path_del_by_id)
776 {
777     LLINT_BEGIN();
778     CodeBlock* codeBlock = exec->codeBlock();
779     JSObject* baseObject = LLINT_OP_C(2).jsValue().toObject(exec);
780     LLINT_CHECK_EXCEPTION();
781     bool couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, codeBlock->identifier(pc[3].u.operand));
782     LLINT_CHECK_EXCEPTION();
783     if (!couldDelete && codeBlock->isStrictMode())
784         LLINT_THROW(createTypeError(exec, "Unable to delete property."));
785     LLINT_RETURN(jsBoolean(couldDelete));
786 }
787
788 inline JSValue getByVal(ExecState* exec, JSValue baseValue, JSValue subscript)
789 {
790     if (LIKELY(baseValue.isCell() && subscript.isString())) {
791         VM& vm = exec->vm();
792         Structure& structure = *baseValue.asCell()->structure(vm);
793         if (JSCell::canUseFastGetOwnProperty(structure)) {
794             if (RefPtr<AtomicStringImpl> existingAtomicString = asString(subscript)->toExistingAtomicString(exec)) {
795                 if (JSValue result = baseValue.asCell()->fastGetOwnProperty(vm, structure, existingAtomicString.get()))
796                     return result;
797             }
798         }
799     }
800     
801     if (subscript.isUInt32()) {
802         uint32_t i = subscript.asUInt32();
803         if (isJSString(baseValue) && asString(baseValue)->canGetIndex(i))
804             return asString(baseValue)->getIndex(exec, i);
805         
806         return baseValue.get(exec, i);
807     }
808
809     baseValue.requireObjectCoercible(exec);
810     if (exec->hadException())
811         return jsUndefined();
812     auto property = subscript.toPropertyKey(exec);
813     if (exec->hadException())
814         return jsUndefined();
815     return baseValue.get(exec, property);
816 }
817
818 LLINT_SLOW_PATH_DECL(slow_path_get_by_val)
819 {
820     LLINT_BEGIN();
821     LLINT_RETURN_PROFILED(op_get_by_val, getByVal(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(3).jsValue()));
822 }
823
824 LLINT_SLOW_PATH_DECL(slow_path_put_by_val)
825 {
826     LLINT_BEGIN();
827     
828     JSValue baseValue = LLINT_OP_C(1).jsValue();
829     JSValue subscript = LLINT_OP_C(2).jsValue();
830     JSValue value = LLINT_OP_C(3).jsValue();
831     
832     if (LIKELY(subscript.isUInt32())) {
833         uint32_t i = subscript.asUInt32();
834         if (baseValue.isObject()) {
835             JSObject* object = asObject(baseValue);
836             if (object->canSetIndexQuickly(i))
837                 object->setIndexQuickly(vm, i, value);
838             else
839                 object->methodTable()->putByIndex(object, exec, i, value, exec->codeBlock()->isStrictMode());
840             LLINT_END();
841         }
842         baseValue.putByIndex(exec, i, value, exec->codeBlock()->isStrictMode());
843         LLINT_END();
844     }
845
846     auto property = subscript.toPropertyKey(exec);
847     LLINT_CHECK_EXCEPTION();
848     PutPropertySlot slot(baseValue, exec->codeBlock()->isStrictMode());
849     baseValue.put(exec, property, value, slot);
850     LLINT_END();
851 }
852
853 LLINT_SLOW_PATH_DECL(slow_path_put_by_val_direct)
854 {
855     LLINT_BEGIN();
856     
857     JSValue baseValue = LLINT_OP_C(1).jsValue();
858     JSValue subscript = LLINT_OP_C(2).jsValue();
859     JSValue value = LLINT_OP_C(3).jsValue();
860     RELEASE_ASSERT(baseValue.isObject());
861     JSObject* baseObject = asObject(baseValue);
862     bool isStrictMode = exec->codeBlock()->isStrictMode();
863     if (LIKELY(subscript.isUInt32())) {
864         // Despite its name, JSValue::isUInt32 will return true only for positive boxed int32_t; all those values are valid array indices.
865         ASSERT(isIndex(subscript.asUInt32()));
866         baseObject->putDirectIndex(exec, subscript.asUInt32(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
867         LLINT_END();
868     }
869
870     if (subscript.isDouble()) {
871         double subscriptAsDouble = subscript.asDouble();
872         uint32_t subscriptAsUInt32 = static_cast<uint32_t>(subscriptAsDouble);
873         if (subscriptAsDouble == subscriptAsUInt32 && isIndex(subscriptAsUInt32)) {
874             baseObject->putDirectIndex(exec, subscriptAsUInt32, value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
875             LLINT_END();
876         }
877     }
878
879     // Don't put to an object if toString threw an exception.
880     auto property = subscript.toPropertyKey(exec);
881     if (exec->vm().exception())
882         LLINT_END();
883
884     if (Optional<uint32_t> index = parseIndex(property))
885         baseObject->putDirectIndex(exec, index.value(), value, 0, isStrictMode ? PutDirectIndexShouldThrow : PutDirectIndexShouldNotThrow);
886     else {
887         PutPropertySlot slot(baseObject, isStrictMode);
888         baseObject->putDirect(exec->vm(), property, value, slot);
889     }
890     LLINT_END();
891 }
892
893 LLINT_SLOW_PATH_DECL(slow_path_del_by_val)
894 {
895     LLINT_BEGIN();
896     JSValue baseValue = LLINT_OP_C(2).jsValue();
897     JSObject* baseObject = baseValue.toObject(exec);
898     LLINT_CHECK_EXCEPTION();
899
900     JSValue subscript = LLINT_OP_C(3).jsValue();
901     
902     bool couldDelete;
903     
904     uint32_t i;
905     if (subscript.getUInt32(i))
906         couldDelete = baseObject->methodTable()->deletePropertyByIndex(baseObject, exec, i);
907     else {
908         LLINT_CHECK_EXCEPTION();
909         auto property = subscript.toPropertyKey(exec);
910         LLINT_CHECK_EXCEPTION();
911         couldDelete = baseObject->methodTable()->deleteProperty(baseObject, exec, property);
912     }
913     
914     if (!couldDelete && exec->codeBlock()->isStrictMode())
915         LLINT_THROW(createTypeError(exec, "Unable to delete property."));
916     
917     LLINT_RETURN(jsBoolean(couldDelete));
918 }
919
920 LLINT_SLOW_PATH_DECL(slow_path_put_by_index)
921 {
922     LLINT_BEGIN();
923     JSValue arrayValue = LLINT_OP_C(1).jsValue();
924     ASSERT(isJSArray(arrayValue));
925     asArray(arrayValue)->putDirectIndex(exec, pc[2].u.operand, LLINT_OP_C(3).jsValue());
926     LLINT_END();
927 }
928
929 LLINT_SLOW_PATH_DECL(slow_path_put_getter_by_id)
930 {
931     LLINT_BEGIN();
932     ASSERT(LLINT_OP(1).jsValue().isObject());
933     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
934
935     unsigned options = pc[3].u.operand;
936
937     JSValue getter = LLINT_OP(4).jsValue();
938     ASSERT(getter.isObject());
939
940     baseObj->putGetter(exec, exec->codeBlock()->identifier(pc[2].u.operand), asObject(getter), options);
941     LLINT_END();
942 }
943
944 LLINT_SLOW_PATH_DECL(slow_path_put_setter_by_id)
945 {
946     LLINT_BEGIN();
947     ASSERT(LLINT_OP(1).jsValue().isObject());
948     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
949
950     unsigned options = pc[3].u.operand;
951
952     JSValue setter = LLINT_OP(4).jsValue();
953     ASSERT(setter.isObject());
954
955     baseObj->putSetter(exec, exec->codeBlock()->identifier(pc[2].u.operand), asObject(setter), options);
956     LLINT_END();
957 }
958
959 LLINT_SLOW_PATH_DECL(slow_path_put_getter_setter_by_id)
960 {
961     LLINT_BEGIN();
962     ASSERT(LLINT_OP(1).jsValue().isObject());
963     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
964     
965     GetterSetter* accessor = GetterSetter::create(vm, exec->lexicalGlobalObject());
966     LLINT_CHECK_EXCEPTION();
967
968     JSValue getter = LLINT_OP(4).jsValue();
969     JSValue setter = LLINT_OP(5).jsValue();
970     ASSERT(getter.isObject() || getter.isUndefined());
971     ASSERT(setter.isObject() || setter.isUndefined());
972     ASSERT(getter.isObject() || setter.isObject());
973     
974     if (!getter.isUndefined())
975         accessor->setGetter(vm, exec->lexicalGlobalObject(), asObject(getter));
976     if (!setter.isUndefined())
977         accessor->setSetter(vm, exec->lexicalGlobalObject(), asObject(setter));
978     baseObj->putDirectAccessor(
979         exec,
980         exec->codeBlock()->identifier(pc[2].u.operand),
981         accessor, pc[3].u.operand);
982     LLINT_END();
983 }
984
985 LLINT_SLOW_PATH_DECL(slow_path_put_getter_by_val)
986 {
987     LLINT_BEGIN();
988     ASSERT(LLINT_OP(1).jsValue().isObject());
989     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
990     JSValue subscript = LLINT_OP_C(2).jsValue();
991
992     unsigned options = pc[3].u.operand;
993
994     JSValue getter = LLINT_OP(4).jsValue();
995     ASSERT(getter.isObject());
996
997     auto property = subscript.toPropertyKey(exec);
998     LLINT_CHECK_EXCEPTION();
999
1000     baseObj->putGetter(exec, property, asObject(getter), options);
1001     LLINT_END();
1002 }
1003
1004 LLINT_SLOW_PATH_DECL(slow_path_put_setter_by_val)
1005 {
1006     LLINT_BEGIN();
1007     ASSERT(LLINT_OP(1).jsValue().isObject());
1008     JSObject* baseObj = asObject(LLINT_OP(1).jsValue());
1009     JSValue subscript = LLINT_OP_C(2).jsValue();
1010
1011     unsigned options = pc[3].u.operand;
1012
1013     JSValue setter = LLINT_OP(4).jsValue();
1014     ASSERT(setter.isObject());
1015
1016     auto property = subscript.toPropertyKey(exec);
1017     LLINT_CHECK_EXCEPTION();
1018
1019     baseObj->putSetter(exec, property, asObject(setter), options);
1020     LLINT_END();
1021 }
1022
1023 LLINT_SLOW_PATH_DECL(slow_path_jtrue)
1024 {
1025     LLINT_BEGIN();
1026     LLINT_BRANCH(op_jtrue, LLINT_OP_C(1).jsValue().toBoolean(exec));
1027 }
1028
1029 LLINT_SLOW_PATH_DECL(slow_path_jfalse)
1030 {
1031     LLINT_BEGIN();
1032     LLINT_BRANCH(op_jfalse, !LLINT_OP_C(1).jsValue().toBoolean(exec));
1033 }
1034
1035 LLINT_SLOW_PATH_DECL(slow_path_jless)
1036 {
1037     LLINT_BEGIN();
1038     LLINT_BRANCH(op_jless, jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1039 }
1040
1041 LLINT_SLOW_PATH_DECL(slow_path_jnless)
1042 {
1043     LLINT_BEGIN();
1044     LLINT_BRANCH(op_jnless, !jsLess<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1045 }
1046
1047 LLINT_SLOW_PATH_DECL(slow_path_jgreater)
1048 {
1049     LLINT_BEGIN();
1050     LLINT_BRANCH(op_jgreater, jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1051 }
1052
1053 LLINT_SLOW_PATH_DECL(slow_path_jngreater)
1054 {
1055     LLINT_BEGIN();
1056     LLINT_BRANCH(op_jngreater, !jsLess<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1057 }
1058
1059 LLINT_SLOW_PATH_DECL(slow_path_jlesseq)
1060 {
1061     LLINT_BEGIN();
1062     LLINT_BRANCH(op_jlesseq, jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1063 }
1064
1065 LLINT_SLOW_PATH_DECL(slow_path_jnlesseq)
1066 {
1067     LLINT_BEGIN();
1068     LLINT_BRANCH(op_jnlesseq, !jsLessEq<true>(exec, LLINT_OP_C(1).jsValue(), LLINT_OP_C(2).jsValue()));
1069 }
1070
1071 LLINT_SLOW_PATH_DECL(slow_path_jgreatereq)
1072 {
1073     LLINT_BEGIN();
1074     LLINT_BRANCH(op_jgreatereq, jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1075 }
1076
1077 LLINT_SLOW_PATH_DECL(slow_path_jngreatereq)
1078 {
1079     LLINT_BEGIN();
1080     LLINT_BRANCH(op_jngreatereq, !jsLessEq<false>(exec, LLINT_OP_C(2).jsValue(), LLINT_OP_C(1).jsValue()));
1081 }
1082
1083 LLINT_SLOW_PATH_DECL(slow_path_switch_imm)
1084 {
1085     LLINT_BEGIN();
1086     JSValue scrutinee = LLINT_OP_C(3).jsValue();
1087     ASSERT(scrutinee.isDouble());
1088     double value = scrutinee.asDouble();
1089     int32_t intValue = static_cast<int32_t>(value);
1090     int defaultOffset = pc[2].u.operand;
1091     if (value == intValue) {
1092         CodeBlock* codeBlock = exec->codeBlock();
1093         pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue(intValue, defaultOffset);
1094     } else
1095         pc += defaultOffset;
1096     LLINT_END();
1097 }
1098
1099 LLINT_SLOW_PATH_DECL(slow_path_switch_char)
1100 {
1101     LLINT_BEGIN();
1102     JSValue scrutinee = LLINT_OP_C(3).jsValue();
1103     ASSERT(scrutinee.isString());
1104     JSString* string = asString(scrutinee);
1105     ASSERT(string->length() == 1);
1106     int defaultOffset = pc[2].u.operand;
1107     StringImpl* impl = string->value(exec).impl();
1108     CodeBlock* codeBlock = exec->codeBlock();
1109     pc += codeBlock->switchJumpTable(pc[1].u.operand).offsetForValue((*impl)[0], defaultOffset);
1110     LLINT_END();
1111 }
1112
1113 LLINT_SLOW_PATH_DECL(slow_path_switch_string)
1114 {
1115     LLINT_BEGIN();
1116     JSValue scrutinee = LLINT_OP_C(3).jsValue();
1117     int defaultOffset = pc[2].u.operand;
1118     if (!scrutinee.isString())
1119         pc += defaultOffset;
1120     else {
1121         CodeBlock* codeBlock = exec->codeBlock();
1122         pc += codeBlock->stringSwitchJumpTable(pc[1].u.operand).offsetForValue(asString(scrutinee)->value(exec).impl(), defaultOffset);
1123     }
1124     LLINT_END();
1125 }
1126
1127 LLINT_SLOW_PATH_DECL(slow_path_new_func)
1128 {
1129     LLINT_BEGIN();
1130     CodeBlock* codeBlock = exec->codeBlock();
1131     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1132 #if LLINT_SLOW_PATH_TRACING
1133     dataLogF("Creating function!\n");
1134 #endif
1135     LLINT_RETURN(JSFunction::create(vm, codeBlock->functionDecl(pc[3].u.operand), scope));
1136 }
1137
1138 LLINT_SLOW_PATH_DECL(slow_path_new_generator_func)
1139 {
1140     LLINT_BEGIN();
1141     CodeBlock* codeBlock = exec->codeBlock();
1142     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1143 #if LLINT_SLOW_PATH_TRACING
1144     dataLogF("Creating function!\n");
1145 #endif
1146     LLINT_RETURN(JSGeneratorFunction::create(vm, codeBlock->functionDecl(pc[3].u.operand), scope));
1147 }
1148
1149 LLINT_SLOW_PATH_DECL(slow_path_new_func_exp)
1150 {
1151     LLINT_BEGIN();
1152     
1153     CodeBlock* codeBlock = exec->codeBlock();
1154     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1155     FunctionExecutable* executable = codeBlock->functionExpr(pc[3].u.operand);
1156     
1157     LLINT_RETURN(JSFunction::create(vm, executable, scope));
1158 }
1159
1160 LLINT_SLOW_PATH_DECL(slow_path_new_generator_func_exp)
1161 {
1162     LLINT_BEGIN();
1163
1164     CodeBlock* codeBlock = exec->codeBlock();
1165     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1166     FunctionExecutable* executable = codeBlock->functionExpr(pc[3].u.operand);
1167
1168     LLINT_RETURN(JSGeneratorFunction::create(vm, executable, scope));
1169 }
1170
1171 LLINT_SLOW_PATH_DECL(slow_path_set_function_name)
1172 {
1173     LLINT_BEGIN();
1174     JSFunction* func = jsCast<JSFunction*>(LLINT_OP(1).Register::unboxedCell());
1175     JSValue name = LLINT_OP_C(2).Register::jsValue();
1176     func->setFunctionName(exec, name);
1177     LLINT_END();
1178 }
1179
1180 static SlowPathReturnType handleHostCall(ExecState* execCallee, Instruction* pc, JSValue callee, CodeSpecializationKind kind)
1181 {
1182     UNUSED_PARAM(pc);
1183
1184 #if LLINT_SLOW_PATH_TRACING
1185     dataLog("Performing host call.\n");
1186 #endif
1187     
1188     ExecState* exec = execCallee->callerFrame();
1189     VM& vm = exec->vm();
1190
1191     execCallee->setCodeBlock(0);
1192     execCallee->clearReturnPC();
1193
1194     if (kind == CodeForCall) {
1195         CallData callData;
1196         CallType callType = getCallData(callee, callData);
1197     
1198         ASSERT(callType != CallType::JS);
1199     
1200         if (callType == CallType::Host) {
1201             NativeCallFrameTracer tracer(&vm, execCallee);
1202             execCallee->setCallee(asObject(callee));
1203             vm.hostCallReturnValue = JSValue::decode(callData.native.function(execCallee));
1204             
1205             LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
1206         }
1207         
1208 #if LLINT_SLOW_PATH_TRACING
1209         dataLog("Call callee is not a function: ", callee, "\n");
1210 #endif
1211
1212         ASSERT(callType == CallType::None);
1213         LLINT_CALL_THROW(exec, createNotAFunctionError(exec, callee));
1214     }
1215
1216     ASSERT(kind == CodeForConstruct);
1217     
1218     ConstructData constructData;
1219     ConstructType constructType = getConstructData(callee, constructData);
1220     
1221     ASSERT(constructType != ConstructType::JS);
1222     
1223     if (constructType == ConstructType::Host) {
1224         NativeCallFrameTracer tracer(&vm, execCallee);
1225         execCallee->setCallee(asObject(callee));
1226         vm.hostCallReturnValue = JSValue::decode(constructData.native.function(execCallee));
1227
1228         LLINT_CALL_RETURN(execCallee, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
1229     }
1230     
1231 #if LLINT_SLOW_PATH_TRACING
1232     dataLog("Constructor callee is not a function: ", callee, "\n");
1233 #endif
1234
1235     ASSERT(constructType == ConstructType::None);
1236     LLINT_CALL_THROW(exec, createNotAConstructorError(exec, callee));
1237 }
1238
1239 inline SlowPathReturnType setUpCall(ExecState* execCallee, Instruction* pc, CodeSpecializationKind kind, JSValue calleeAsValue, LLIntCallLinkInfo* callLinkInfo = 0)
1240 {
1241     ExecState* exec = execCallee->callerFrame();
1242
1243 #if LLINT_SLOW_PATH_TRACING
1244     dataLogF("Performing call with recorded PC = %p\n", exec->currentVPC());
1245 #endif
1246     
1247     JSCell* calleeAsFunctionCell = getJSFunction(calleeAsValue);
1248     if (!calleeAsFunctionCell)
1249         return handleHostCall(execCallee, pc, calleeAsValue, kind);
1250     
1251     JSFunction* callee = jsCast<JSFunction*>(calleeAsFunctionCell);
1252     JSScope* scope = callee->scopeUnchecked();
1253     VM& vm = *scope->vm();
1254     ExecutableBase* executable = callee->executable();
1255
1256     MacroAssemblerCodePtr codePtr;
1257     CodeBlock* codeBlock = 0;
1258     bool isWebAssemblyExecutable = false;
1259 #if ENABLE(WEBASSEMBLY)
1260     isWebAssemblyExecutable = executable->isWebAssemblyExecutable();
1261 #endif
1262
1263     if (executable->isHostFunction()) {
1264         codePtr = executable->entrypointFor(kind, MustCheckArity);
1265     } else if (!isWebAssemblyExecutable) {
1266         FunctionExecutable* functionExecutable = static_cast<FunctionExecutable*>(executable);
1267
1268         if (!isCall(kind) && functionExecutable->constructAbility() == ConstructAbility::CannotConstruct)
1269             LLINT_CALL_THROW(exec, createNotAConstructorError(exec, callee));
1270
1271         JSObject* error = functionExecutable->prepareForExecution(execCallee, callee, scope, kind);
1272         if (error)
1273             LLINT_CALL_THROW(exec, error);
1274         codeBlock = functionExecutable->codeBlockFor(kind);
1275         ASSERT(codeBlock);
1276         ArityCheckMode arity;
1277         if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
1278             arity = MustCheckArity;
1279         else
1280             arity = ArityCheckNotRequired;
1281         codePtr = functionExecutable->entrypointFor(kind, arity);
1282     } else {
1283 #if ENABLE(WEBASSEMBLY)
1284         WebAssemblyExecutable* webAssemblyExecutable = static_cast<WebAssemblyExecutable*>(executable);
1285         webAssemblyExecutable->prepareForExecution(execCallee);
1286         codeBlock = webAssemblyExecutable->codeBlockForCall();
1287         ASSERT(codeBlock);
1288         ArityCheckMode arity;
1289         if (execCallee->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()))
1290             arity = MustCheckArity;
1291         else
1292             arity = ArityCheckNotRequired;
1293         codePtr = webAssemblyExecutable->entrypointFor(kind, arity);
1294 #endif
1295     }
1296     
1297     ASSERT(!!codePtr);
1298     
1299     if (!LLINT_ALWAYS_ACCESS_SLOW && callLinkInfo) {
1300         CodeBlock* callerCodeBlock = exec->codeBlock();
1301
1302         ConcurrentJITLocker locker(callerCodeBlock->m_lock);
1303         
1304         if (callLinkInfo->isOnList())
1305             callLinkInfo->remove();
1306         callLinkInfo->callee.set(vm, callerCodeBlock, callee);
1307         callLinkInfo->lastSeenCallee.set(vm, callerCodeBlock, callee);
1308         callLinkInfo->machineCodeTarget = codePtr;
1309         if (codeBlock)
1310             codeBlock->linkIncomingCall(exec, callLinkInfo);
1311     }
1312
1313     LLINT_CALL_RETURN(exec, execCallee, codePtr.executableAddress());
1314 }
1315
1316 inline SlowPathReturnType genericCall(ExecState* exec, Instruction* pc, CodeSpecializationKind kind)
1317 {
1318     // This needs to:
1319     // - Set up a call frame.
1320     // - Figure out what to call and compile it if necessary.
1321     // - If possible, link the call's inline cache.
1322     // - Return a tuple of machine code address to call and the new call frame.
1323     
1324     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
1325     
1326     ExecState* execCallee = exec - pc[4].u.operand;
1327     
1328     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
1329     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1330     execCallee->setCallerFrame(exec);
1331     
1332     ASSERT(pc[5].u.callLinkInfo);
1333     return setUpCall(execCallee, pc, kind, calleeAsValue, pc[5].u.callLinkInfo);
1334 }
1335
1336 LLINT_SLOW_PATH_DECL(slow_path_call)
1337 {
1338     LLINT_BEGIN_NO_SET_PC();
1339     return genericCall(exec, pc, CodeForCall);
1340 }
1341
1342 LLINT_SLOW_PATH_DECL(slow_path_construct)
1343 {
1344     LLINT_BEGIN_NO_SET_PC();
1345     return genericCall(exec, pc, CodeForConstruct);
1346 }
1347
1348 LLINT_SLOW_PATH_DECL(slow_path_size_frame_for_varargs)
1349 {
1350     LLINT_BEGIN();
1351     // This needs to:
1352     // - Set up a call frame while respecting the variable arguments.
1353     
1354     unsigned numUsedStackSlots = -pc[5].u.operand;
1355     unsigned length = sizeFrameForVarargs(exec, &vm.interpreter->stack(),
1356         LLINT_OP_C(4).jsValue(), numUsedStackSlots, pc[6].u.operand);
1357     LLINT_CALL_CHECK_EXCEPTION(exec, exec);
1358     
1359     ExecState* execCallee = calleeFrameForVarargs(exec, numUsedStackSlots, length + 1);
1360     vm.varargsLength = length;
1361     vm.newCallFrameReturnValue = execCallee;
1362
1363     LLINT_RETURN_CALLEE_FRAME(execCallee);
1364 }
1365
1366 LLINT_SLOW_PATH_DECL(slow_path_size_frame_for_forward_arguments)
1367 {
1368     LLINT_BEGIN();
1369     // This needs to:
1370     // - Set up a call frame with the same arguments as the current frame.
1371
1372     unsigned numUsedStackSlots = -pc[5].u.operand;
1373
1374     unsigned arguments = sizeFrameForForwardArguments(exec, &vm.interpreter->stack(), numUsedStackSlots);
1375     LLINT_CALL_CHECK_EXCEPTION(exec, exec);
1376
1377     ExecState* execCallee = calleeFrameForVarargs(exec, numUsedStackSlots, arguments + 1);
1378
1379     vm.varargsLength = arguments;
1380     vm.newCallFrameReturnValue = execCallee;
1381
1382     LLINT_RETURN_CALLEE_FRAME(execCallee);
1383 }
1384
1385 enum class SetArgumentsWith {
1386     Object,
1387     CurrentArguments
1388 };
1389
1390 inline SlowPathReturnType varargsSetup(ExecState* exec, Instruction* pc, CodeSpecializationKind kind, SetArgumentsWith set)
1391 {
1392     LLINT_BEGIN_NO_SET_PC();
1393     // This needs to:
1394     // - Figure out what to call and compile it if necessary.
1395     // - Return a tuple of machine code address to call and the new call frame.
1396
1397     JSValue calleeAsValue = LLINT_OP_C(2).jsValue();
1398
1399     ExecState* execCallee = vm.newCallFrameReturnValue;
1400
1401     if (set == SetArgumentsWith::Object) {
1402         setupVarargsFrameAndSetThis(exec, execCallee, LLINT_OP_C(3).jsValue(), LLINT_OP_C(4).jsValue(), pc[6].u.operand, vm.varargsLength);
1403         LLINT_CALL_CHECK_EXCEPTION(exec, exec);
1404     } else
1405         setupForwardArgumentsFrameAndSetThis(exec, execCallee, LLINT_OP_C(3).jsValue(), vm.varargsLength);
1406
1407     execCallee->setCallerFrame(exec);
1408     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1409     exec->setCurrentVPC(pc);
1410
1411     return setUpCall(execCallee, pc, kind, calleeAsValue);
1412 }
1413
1414 LLINT_SLOW_PATH_DECL(slow_path_call_varargs)
1415 {
1416     return varargsSetup(exec, pc, CodeForCall, SetArgumentsWith::Object);
1417 }
1418
1419 LLINT_SLOW_PATH_DECL(slow_path_tail_call_forward_arguments)
1420 {
1421     return varargsSetup(exec, pc, CodeForCall, SetArgumentsWith::CurrentArguments);
1422 }
1423
1424 LLINT_SLOW_PATH_DECL(slow_path_construct_varargs)
1425 {
1426     return varargsSetup(exec, pc, CodeForConstruct, SetArgumentsWith::Object);
1427 }
1428
1429     
1430 LLINT_SLOW_PATH_DECL(slow_path_call_eval)
1431 {
1432     LLINT_BEGIN_NO_SET_PC();
1433     JSValue calleeAsValue = LLINT_OP(2).jsValue();
1434     
1435     ExecState* execCallee = exec - pc[4].u.operand;
1436     
1437     execCallee->setArgumentCountIncludingThis(pc[3].u.operand);
1438     execCallee->setCallerFrame(exec);
1439     execCallee->uncheckedR(JSStack::Callee) = calleeAsValue;
1440     execCallee->setReturnPC(LLInt::getCodePtr(llint_generic_return_point));
1441     execCallee->setCodeBlock(0);
1442     exec->setCurrentVPC(pc);
1443     
1444     if (!isHostFunction(calleeAsValue, globalFuncEval))
1445         return setUpCall(execCallee, pc, CodeForCall, calleeAsValue);
1446     
1447     vm.hostCallReturnValue = eval(execCallee);
1448     LLINT_CALL_RETURN(exec, execCallee, LLInt::getCodePtr(getHostCallReturnValue));
1449 }
1450
1451 LLINT_SLOW_PATH_DECL(slow_path_strcat)
1452 {
1453     LLINT_BEGIN();
1454     LLINT_RETURN(jsStringFromRegisterArray(exec, &LLINT_OP(2), pc[3].u.operand));
1455 }
1456
1457 LLINT_SLOW_PATH_DECL(slow_path_to_primitive)
1458 {
1459     LLINT_BEGIN();
1460     LLINT_RETURN(LLINT_OP_C(2).jsValue().toPrimitive(exec));
1461 }
1462
1463 LLINT_SLOW_PATH_DECL(slow_path_throw)
1464 {
1465     LLINT_BEGIN();
1466     LLINT_THROW(LLINT_OP_C(1).jsValue());
1467 }
1468
1469 LLINT_SLOW_PATH_DECL(slow_path_throw_static_error)
1470 {
1471     LLINT_BEGIN();
1472     JSValue errorMessageValue = LLINT_OP_C(1).jsValue();
1473     RELEASE_ASSERT(errorMessageValue.isString());
1474     String errorMessage = asString(errorMessageValue)->value(exec);
1475     if (pc[2].u.operand)
1476         LLINT_THROW(createReferenceError(exec, errorMessage));
1477     else
1478         LLINT_THROW(createTypeError(exec, errorMessage));
1479 }
1480
1481 LLINT_SLOW_PATH_DECL(slow_path_handle_watchdog_timer)
1482 {
1483     LLINT_BEGIN_NO_SET_PC();
1484     ASSERT(vm.watchdog());
1485     if (UNLIKELY(vm.shouldTriggerTermination(exec)))
1486         LLINT_THROW(createTerminatedExecutionException(&vm));
1487     LLINT_RETURN_TWO(0, exec);
1488 }
1489
1490 LLINT_SLOW_PATH_DECL(slow_path_debug)
1491 {
1492     LLINT_BEGIN();
1493     int debugHookID = pc[1].u.operand;
1494     vm.interpreter->debug(exec, static_cast<DebugHookID>(debugHookID));
1495     
1496     LLINT_END();
1497 }
1498
1499 LLINT_SLOW_PATH_DECL(slow_path_handle_exception)
1500 {
1501     LLINT_BEGIN_NO_SET_PC();
1502     genericUnwind(&vm, exec);
1503     LLINT_END_IMPL();
1504 }
1505
1506 LLINT_SLOW_PATH_DECL(slow_path_get_from_scope)
1507 {
1508     LLINT_BEGIN();
1509
1510     const Identifier& ident = exec->codeBlock()->identifier(pc[3].u.operand);
1511     JSObject* scope = jsCast<JSObject*>(LLINT_OP(2).jsValue());
1512     GetPutInfo getPutInfo(pc[4].u.operand);
1513
1514     // ModuleVar is always converted to ClosureVar for get_from_scope.
1515     ASSERT(getPutInfo.resolveType() != ModuleVar);
1516
1517     LLINT_RETURN(scope->getPropertySlot(exec, ident, [&] (bool found, PropertySlot& slot) -> JSValue {
1518         if (!found) {
1519             if (getPutInfo.resolveMode() == ThrowIfNotFound)
1520                 return exec->vm().throwException(exec, createUndefinedVariableError(exec, ident));
1521             return jsUndefined();
1522         }
1523
1524         JSValue result = JSValue();
1525         if (scope->isGlobalLexicalEnvironment()) {
1526             // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
1527             result = slot.getValue(exec, ident);
1528             if (result == jsTDZValue())
1529                 return exec->vm().throwException(exec, createTDZError(exec));
1530         }
1531
1532         CommonSlowPaths::tryCacheGetFromScopeGlobal(exec, vm, pc, scope, slot, ident);
1533
1534         if (!result)
1535             return slot.getValue(exec, ident);
1536         return result;
1537     }));
1538 }
1539
1540 LLINT_SLOW_PATH_DECL(slow_path_put_to_scope)
1541 {
1542     LLINT_BEGIN();
1543
1544     CodeBlock* codeBlock = exec->codeBlock();
1545     const Identifier& ident = codeBlock->identifier(pc[2].u.operand);
1546     JSObject* scope = jsCast<JSObject*>(LLINT_OP(1).jsValue());
1547     JSValue value = LLINT_OP_C(3).jsValue();
1548     GetPutInfo getPutInfo = GetPutInfo(pc[4].u.operand);
1549     if (getPutInfo.resolveType() == LocalClosureVar) {
1550         JSLexicalEnvironment* environment = jsCast<JSLexicalEnvironment*>(scope);
1551         environment->variableAt(ScopeOffset(pc[6].u.operand)).set(vm, environment, value);
1552         
1553         // Have to do this *after* the write, because if this puts the set into IsWatched, then we need
1554         // to have already changed the value of the variable. Otherwise we might watch and constant-fold
1555         // to the Undefined value from before the assignment.
1556         if (WatchpointSet* set = pc[5].u.watchpointSet)
1557             set->touch(vm, "Executed op_put_scope<LocalClosureVar>");
1558         LLINT_END();
1559     }
1560
1561     bool hasProperty = scope->hasProperty(exec, ident);
1562     if (hasProperty
1563         && scope->isGlobalLexicalEnvironment()
1564         && !isInitialization(getPutInfo.initializationMode())) {
1565         // When we can't statically prove we need a TDZ check, we must perform the check on the slow path.
1566         PropertySlot slot(scope, PropertySlot::InternalMethodType::Get);
1567         JSGlobalLexicalEnvironment::getOwnPropertySlot(scope, exec, ident, slot);
1568         if (slot.getValue(exec, ident) == jsTDZValue())
1569             LLINT_THROW(createTDZError(exec));
1570     }
1571
1572     if (getPutInfo.resolveMode() == ThrowIfNotFound && !hasProperty)
1573         LLINT_THROW(createUndefinedVariableError(exec, ident));
1574
1575     PutPropertySlot slot(scope, codeBlock->isStrictMode(), PutPropertySlot::UnknownContext, isInitialization(getPutInfo.initializationMode()));
1576     scope->methodTable()->put(scope, exec, ident, value, slot);
1577     
1578     CommonSlowPaths::tryCachePutToScopeGlobal(exec, codeBlock, pc, scope, getPutInfo, slot, ident);
1579
1580     LLINT_END();
1581 }
1582
1583 LLINT_SLOW_PATH_DECL(slow_path_check_if_exception_is_uncatchable_and_notify_profiler)
1584 {
1585     LLINT_BEGIN();
1586     RELEASE_ASSERT(!!vm.exception());
1587
1588     if (isTerminatedExecutionException(vm.exception()))
1589         LLINT_RETURN_TWO(pc, bitwise_cast<void*>(static_cast<uintptr_t>(1)));
1590     LLINT_RETURN_TWO(pc, 0);
1591 }
1592
1593 LLINT_SLOW_PATH_DECL(slow_path_log_shadow_chicken_prologue)
1594 {
1595     LLINT_BEGIN();
1596     
1597     JSScope* scope = exec->uncheckedR(pc[1].u.operand).Register::scope();
1598     vm.shadowChicken().log(vm, exec, ShadowChicken::Packet::prologue(exec->callee(), exec, exec->callerFrame(), scope));
1599     
1600     LLINT_END();
1601 }
1602
1603 LLINT_SLOW_PATH_DECL(slow_path_log_shadow_chicken_tail)
1604 {
1605     LLINT_BEGIN();
1606
1607     JSValue thisValue = LLINT_OP(1).jsValue();
1608     JSScope* scope = exec->uncheckedR(pc[2].u.operand).Register::scope();
1609     
1610 #if USE(JSVALUE64)
1611     CallSiteIndex callSiteIndex(exec->codeBlock()->bytecodeOffset(pc));
1612 #else
1613     CallSiteIndex callSiteIndex(pc);
1614 #endif
1615     vm.shadowChicken().log(vm, exec, ShadowChicken::Packet::tail(exec, thisValue, scope, exec->codeBlock(), callSiteIndex));
1616     
1617     LLINT_END();
1618 }
1619
1620 extern "C" SlowPathReturnType llint_throw_stack_overflow_error(VM* vm, ProtoCallFrame* protoFrame)
1621 {
1622     ExecState* exec = vm->topCallFrame;
1623     if (!exec)
1624         exec = protoFrame->callee()->globalObject()->globalExec();
1625     throwStackOverflowError(exec);
1626     return encodeResult(0, 0);
1627 }
1628
1629 #if !ENABLE(JIT)
1630 extern "C" SlowPathReturnType llint_stack_check_at_vm_entry(VM* vm, Register* newTopOfStack)
1631 {
1632     bool success = vm->interpreter->stack().ensureCapacityFor(newTopOfStack);
1633     return encodeResult(reinterpret_cast<void*>(success), 0);
1634 }
1635 #endif
1636
1637 extern "C" void llint_write_barrier_slow(ExecState* exec, JSCell* cell)
1638 {
1639     VM& vm = exec->vm();
1640     vm.heap.writeBarrier(cell);
1641 }
1642
1643 extern "C" NO_RETURN_DUE_TO_CRASH void llint_crash()
1644 {
1645     CRASH();
1646 }
1647
1648 #if ENABLE(LLINT_STATS)
1649
1650 LLINT_SLOW_PATH_DECL(count_opcode)
1651 {
1652     OpcodeID opcodeID = exec->vm().interpreter->getOpcodeID(pc[0].u.opcode);
1653     Data::opcodeStats(opcodeID).count++;
1654     LLINT_END_IMPL();
1655 }
1656
1657 LLINT_SLOW_PATH_DECL(count_opcode_slow_path)
1658 {
1659     OpcodeID opcodeID = exec->vm().interpreter->getOpcodeID(pc[0].u.opcode);
1660     Data::opcodeStats(opcodeID).slowPathCount++;
1661     LLINT_END_IMPL();
1662 }
1663
1664 #endif // ENABLE(LLINT_STATS)
1665
1666 } } // namespace JSC::LLInt