jit/JITOpcodes.cpp

   1 /*
   2  * Copyright (C) 2009, 2012, 2013 Apple Inc. All rights reserved.
   3  * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
  15  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
  17  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
  18  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
  19  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
  20  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
  21  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
  22  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  23  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  24  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  25  */
  26
  27 #include "config.h"
  28 #if ENABLE(JIT)
  29 #include "JIT.h"
  30
  31 #include "Arguments.h"
  32 #include "CopiedSpaceInlines.h"
  33 #include "Debugger.h"
  34 #include "Heap.h"
  35 #include "JITInlines.h"
  36 #include "JSArray.h"
  37 #include "JSCell.h"
  38 #include "JSFunction.h"
  39 #include "JSPropertyNameIterator.h"
  40 #include "MaxFrameExtentForSlowPathCall.h"
  41 #include "SlowPathCall.h"
  42 #include "VirtualRegister.h"
  43
  44 namespace JSC {
  45
  46 #if USE(JSVALUE64)
  47
  48 JIT::CodeRef JIT::privateCompileCTINativeCall(VM* vm, NativeFunction)
  49 {
  50     return vm->getCTIStub(nativeCallGenerator);
  51 }
  52
  53 void JIT::emit_op_mov(Instruction* currentInstruction)
  54 {
  55     int dst = currentInstruction[1].u.operand;
  56     int src = currentInstruction[2].u.operand;
  57
  58     emitGetVirtualRegister(src, regT0);
  59     emitPutVirtualRegister(dst);
  60 }
  61
  62 void JIT::emit_op_captured_mov(Instruction* currentInstruction)
  63 {
  64     int dst = currentInstruction[1].u.operand;
  65     int src = currentInstruction[2].u.operand;
  66
  67     emitGetVirtualRegister(src, regT0);
  68     emitNotifyWrite(regT0, regT1, currentInstruction[3].u.watchpointSet);
  69     emitPutVirtualRegister(dst);
  70 }
  71
  72 void JIT::emit_op_end(Instruction* currentInstruction)
  73 {
  74     RELEASE_ASSERT(returnValueGPR != callFrameRegister);
  75     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
  76     emitFunctionEpilogue();
  77     ret();
  78 }
  79
  80 void JIT::emit_op_jmp(Instruction* currentInstruction)
  81 {
  82     unsigned target = currentInstruction[1].u.operand;
  83     addJump(jump(), target);
  84 }
  85
  86 void JIT::emit_op_new_object(Instruction* currentInstruction)
  87 {
  88     Structure* structure = currentInstruction[3].u.objectAllocationProfile->structure();
  89     size_t allocationSize = JSFinalObject::allocationSize(structure->inlineCapacity());
  90     MarkedAllocator* allocator = &m_vm->heap.allocatorForObjectWithoutDestructor(allocationSize);
  91
  92     RegisterID resultReg = regT0;
  93     RegisterID allocatorReg = regT1;
  94     RegisterID scratchReg = regT2;
  95
  96     move(TrustedImmPtr(allocator), allocatorReg);
  97     emitAllocateJSObject(allocatorReg, TrustedImmPtr(structure), resultReg, scratchReg);
  98     emitPutVirtualRegister(currentInstruction[1].u.operand);
  99 }
 100
 101 void JIT::emitSlow_op_new_object(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 102 {
 103     linkSlowCase(iter);
 104     int dst = currentInstruction[1].u.operand;
 105     Structure* structure = currentInstruction[3].u.objectAllocationProfile->structure();
 106     callOperation(operationNewObject, structure);
 107     emitStoreCell(dst, returnValueGPR);
 108 }
 109
 110 void JIT::emit_op_check_has_instance(Instruction* currentInstruction)
 111 {
 112     int baseVal = currentInstruction[3].u.operand;
 113
 114     emitGetVirtualRegister(baseVal, regT0);
 115
 116     // Check that baseVal is a cell.
 117     emitJumpSlowCaseIfNotJSCell(regT0, baseVal);
 118
 119     // Check that baseVal 'ImplementsHasInstance'.
 120     addSlowCase(branchTest8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(ImplementsDefaultHasInstance)));
 121 }
 122
 123 void JIT::emit_op_instanceof(Instruction* currentInstruction)
 124 {
 125     int dst = currentInstruction[1].u.operand;
 126     int value = currentInstruction[2].u.operand;
 127     int proto = currentInstruction[3].u.operand;
 128
 129     // Load the operands (baseVal, proto, and value respectively) into registers.
 130     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
 131     emitGetVirtualRegister(value, regT2);
 132     emitGetVirtualRegister(proto, regT1);
 133
 134     // Check that proto are cells.  baseVal must be a cell - this is checked by op_check_has_instance.
 135     emitJumpSlowCaseIfNotJSCell(regT2, value);
 136     emitJumpSlowCaseIfNotJSCell(regT1, proto);
 137
 138     // Check that prototype is an object
 139     addSlowCase(emitJumpIfCellNotObject(regT1));
 140
 141     // Optimistically load the result true, and start looping.
 142     // Initially, regT1 still contains proto and regT2 still contains value.
 143     // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.
 144     move(TrustedImm64(JSValue::encode(jsBoolean(true))), regT0);
 145     Label loop(this);
 146
 147     // Load the prototype of the object in regT2.  If this is equal to regT1 - WIN!
 148     // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.
 149     emitLoadStructure(regT2, regT2, regT3);
 150     load64(Address(regT2, Structure::prototypeOffset()), regT2);
 151     Jump isInstance = branchPtr(Equal, regT2, regT1);
 152     emitJumpIfJSCell(regT2).linkTo(loop, this);
 153
 154     // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.
 155     move(TrustedImm64(JSValue::encode(jsBoolean(false))), regT0);
 156
 157     // isInstance jumps right down to here, to skip setting the result to false (it has already set true).
 158     isInstance.link(this);
 159     emitPutVirtualRegister(dst);
 160 }
 161
 162 void JIT::emit_op_is_undefined(Instruction* currentInstruction)
 163 {
 164     int dst = currentInstruction[1].u.operand;
 165     int value = currentInstruction[2].u.operand;
 166
 167     emitGetVirtualRegister(value, regT0);
 168     Jump isCell = emitJumpIfJSCell(regT0);
 169
 170     compare64(Equal, regT0, TrustedImm32(ValueUndefined), regT0);
 171     Jump done = jump();
 172
 173     isCell.link(this);
 174     Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
 175     move(TrustedImm32(0), regT0);
 176     Jump notMasqueradesAsUndefined = jump();
 177
 178     isMasqueradesAsUndefined.link(this);
 179     emitLoadStructure(regT0, regT1, regT2);
 180     move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
 181     loadPtr(Address(regT1, Structure::globalObjectOffset()), regT1);
 182     comparePtr(Equal, regT0, regT1, regT0);
 183
 184     notMasqueradesAsUndefined.link(this);
 185     done.link(this);
 186     emitTagAsBoolImmediate(regT0);
 187     emitPutVirtualRegister(dst);
 188 }
 189
 190 void JIT::emit_op_is_boolean(Instruction* currentInstruction)
 191 {
 192     int dst = currentInstruction[1].u.operand;
 193     int value = currentInstruction[2].u.operand;
 194
 195     emitGetVirtualRegister(value, regT0);
 196     xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
 197     test64(Zero, regT0, TrustedImm32(static_cast<int32_t>(~1)), regT0);
 198     emitTagAsBoolImmediate(regT0);
 199     emitPutVirtualRegister(dst);
 200 }
 201
 202 void JIT::emit_op_is_number(Instruction* currentInstruction)
 203 {
 204     int dst = currentInstruction[1].u.operand;
 205     int value = currentInstruction[2].u.operand;
 206
 207     emitGetVirtualRegister(value, regT0);
 208     test64(NonZero, regT0, tagTypeNumberRegister, regT0);
 209     emitTagAsBoolImmediate(regT0);
 210     emitPutVirtualRegister(dst);
 211 }
 212
 213 void JIT::emit_op_is_string(Instruction* currentInstruction)
 214 {
 215     int dst = currentInstruction[1].u.operand;
 216     int value = currentInstruction[2].u.operand;
 217
 218     emitGetVirtualRegister(value, regT0);
 219     Jump isNotCell = emitJumpIfNotJSCell(regT0);
 220
 221     compare8(Equal, Address(regT0, JSCell::typeInfoTypeOffset()), TrustedImm32(StringType), regT0);
 222     emitTagAsBoolImmediate(regT0);
 223     Jump done = jump();
 224
 225     isNotCell.link(this);
 226     move(TrustedImm32(ValueFalse), regT0);
 227
 228     done.link(this);
 229     emitPutVirtualRegister(dst);
 230 }
 231
 232 void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
 233 {
 234     int activation = currentInstruction[1].u.operand;
 235     Jump activationNotCreated = branchTest64(Zero, addressFor(activation));
 236     emitGetVirtualRegister(activation, regT0);
 237     callOperation(operationTearOffActivation, regT0);
 238     activationNotCreated.link(this);
 239 }
 240
 241 void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
 242 {
 243     int arguments = currentInstruction[1].u.operand;
 244     int activation = currentInstruction[2].u.operand;
 245
 246     Jump argsNotCreated = branchTest64(Zero, Address(callFrameRegister, sizeof(Register) * (unmodifiedArgumentsRegister(VirtualRegister(arguments)).offset())));
 247     emitGetVirtualRegister(unmodifiedArgumentsRegister(VirtualRegister(arguments)).offset(), regT0);
 248     emitGetVirtualRegister(activation, regT1);
 249     callOperation(operationTearOffArguments, regT0, regT1);
 250     argsNotCreated.link(this);
 251 }
 252
 253 void JIT::emit_op_ret(Instruction* currentInstruction)
 254 {
 255     ASSERT(callFrameRegister != regT1);
 256     ASSERT(regT1 != returnValueGPR);
 257     ASSERT(returnValueGPR != callFrameRegister);
 258
 259     // Return the result in %eax.
 260     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
 261
 262     checkStackPointerAlignment();
 263     emitFunctionEpilogue();
 264     ret();
 265 }
 266
 267 void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
 268 {
 269     ASSERT(callFrameRegister != regT1);
 270     ASSERT(regT1 != returnValueGPR);
 271     ASSERT(returnValueGPR != callFrameRegister);
 272
 273     // Return the result in %eax.
 274     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
 275     Jump notJSCell = emitJumpIfNotJSCell(returnValueGPR);
 276     Jump notObject = emitJumpIfCellNotObject(returnValueGPR);
 277
 278     // Return.
 279     emitFunctionEpilogue();
 280     ret();
 281
 282     // Return 'this' in %eax.
 283     notJSCell.link(this);
 284     notObject.link(this);
 285     emitGetVirtualRegister(currentInstruction[2].u.operand, returnValueGPR);
 286
 287     // Return.
 288     emitFunctionEpilogue();
 289     ret();
 290 }
 291
 292 void JIT::emit_op_to_primitive(Instruction* currentInstruction)
 293 {
 294     int dst = currentInstruction[1].u.operand;
 295     int src = currentInstruction[2].u.operand;
 296
 297     emitGetVirtualRegister(src, regT0);
 298
 299     Jump isImm = emitJumpIfNotJSCell(regT0);
 300     addSlowCase(branchStructure(NotEqual,
 301         Address(regT0, JSCell::structureIDOffset()),
 302         m_vm->stringStructure.get()));
 303     isImm.link(this);
 304
 305     if (dst != src)
 306         emitPutVirtualRegister(dst);
 307
 308 }
 309
 310 void JIT::emit_op_strcat(Instruction* currentInstruction)
 311 {
 312     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_strcat);
 313     slowPathCall.call();
 314 }
 315
 316 void JIT::emit_op_not(Instruction* currentInstruction)
 317 {
 318     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
 319
 320     // Invert against JSValue(false); if the value was tagged as a boolean, then all bits will be
 321     // clear other than the low bit (which will be 0 or 1 for false or true inputs respectively).
 322     // Then invert against JSValue(true), which will add the tag back in, and flip the low bit.
 323     xor64(TrustedImm32(static_cast<int32_t>(ValueFalse)), regT0);
 324     addSlowCase(branchTestPtr(NonZero, regT0, TrustedImm32(static_cast<int32_t>(~1))));
 325     xor64(TrustedImm32(static_cast<int32_t>(ValueTrue)), regT0);
 326
 327     emitPutVirtualRegister(currentInstruction[1].u.operand);
 328 }
 329
 330 void JIT::emit_op_jfalse(Instruction* currentInstruction)
 331 {
 332     unsigned target = currentInstruction[2].u.operand;
 333     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 334
 335     addJump(branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsNumber(0)))), target);
 336     Jump isNonZero = emitJumpIfImmediateInteger(regT0);
 337
 338     addJump(branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsBoolean(false)))), target);
 339     addSlowCase(branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsBoolean(true)))));
 340
 341     isNonZero.link(this);
 342 }
 343
 344 void JIT::emit_op_jeq_null(Instruction* currentInstruction)
 345 {
 346     int src = currentInstruction[1].u.operand;
 347     unsigned target = currentInstruction[2].u.operand;
 348
 349     emitGetVirtualRegister(src, regT0);
 350     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 351
 352     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
 353     Jump isNotMasqueradesAsUndefined = branchTest8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
 354     emitLoadStructure(regT0, regT2, regT1);
 355     move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
 356     addJump(branchPtr(Equal, Address(regT2, Structure::globalObjectOffset()), regT0), target);
 357     Jump masqueradesGlobalObjectIsForeign = jump();
 358
 359     // Now handle the immediate cases - undefined & null
 360     isImmediate.link(this);
 361     and64(TrustedImm32(~TagBitUndefined), regT0);
 362     addJump(branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsNull()))), target);
 363
 364     isNotMasqueradesAsUndefined.link(this);
 365     masqueradesGlobalObjectIsForeign.link(this);
 366 };
 367 void JIT::emit_op_jneq_null(Instruction* currentInstruction)
 368 {
 369     int src = currentInstruction[1].u.operand;
 370     unsigned target = currentInstruction[2].u.operand;
 371
 372     emitGetVirtualRegister(src, regT0);
 373     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 374
 375     // First, handle JSCell cases - check MasqueradesAsUndefined bit on the structure.
 376     addJump(branchTest8(Zero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined)), target);
 377     emitLoadStructure(regT0, regT2, regT1);
 378     move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
 379     addJump(branchPtr(NotEqual, Address(regT2, Structure::globalObjectOffset()), regT0), target);
 380     Jump wasNotImmediate = jump();
 381
 382     // Now handle the immediate cases - undefined & null
 383     isImmediate.link(this);
 384     and64(TrustedImm32(~TagBitUndefined), regT0);
 385     addJump(branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsNull()))), target);
 386
 387     wasNotImmediate.link(this);
 388 }
 389
 390 void JIT::emit_op_jneq_ptr(Instruction* currentInstruction)
 391 {
 392     int src = currentInstruction[1].u.operand;
 393     Special::Pointer ptr = currentInstruction[2].u.specialPointer;
 394     unsigned target = currentInstruction[3].u.operand;
 395
 396     emitGetVirtualRegister(src, regT0);
 397     addJump(branchPtr(NotEqual, regT0, TrustedImmPtr(actualPointerFor(m_codeBlock, ptr))), target);
 398 }
 399
 400 void JIT::emit_op_eq(Instruction* currentInstruction)
 401 {
 402     emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
 403     emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
 404     compare32(Equal, regT1, regT0, regT0);
 405     emitTagAsBoolImmediate(regT0);
 406     emitPutVirtualRegister(currentInstruction[1].u.operand);
 407 }
 408
 409 void JIT::emit_op_jtrue(Instruction* currentInstruction)
 410 {
 411     unsigned target = currentInstruction[2].u.operand;
 412     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 413
 414     Jump isZero = branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsNumber(0))));
 415     addJump(emitJumpIfImmediateInteger(regT0), target);
 416
 417     addJump(branch64(Equal, regT0, TrustedImm64(JSValue::encode(jsBoolean(true)))), target);
 418     addSlowCase(branch64(NotEqual, regT0, TrustedImm64(JSValue::encode(jsBoolean(false)))));
 419
 420     isZero.link(this);
 421 }
 422
 423 void JIT::emit_op_neq(Instruction* currentInstruction)
 424 {
 425     emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
 426     emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
 427     compare32(NotEqual, regT1, regT0, regT0);
 428     emitTagAsBoolImmediate(regT0);
 429
 430     emitPutVirtualRegister(currentInstruction[1].u.operand);
 431
 432 }
 433
 434 void JIT::emit_op_bitxor(Instruction* currentInstruction)
 435 {
 436     emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
 437     emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
 438     xor64(regT1, regT0);
 439     emitFastArithReTagImmediate(regT0, regT0);
 440     emitPutVirtualRegister(currentInstruction[1].u.operand);
 441 }
 442
 443 void JIT::emit_op_bitor(Instruction* currentInstruction)
 444 {
 445     emitGetVirtualRegisters(currentInstruction[2].u.operand, regT0, currentInstruction[3].u.operand, regT1);
 446     emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
 447     or64(regT1, regT0);
 448     emitPutVirtualRegister(currentInstruction[1].u.operand);
 449 }
 450
 451 void JIT::emit_op_throw(Instruction* currentInstruction)
 452 {
 453     ASSERT(regT0 == returnValueGPR);
 454     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 455     callOperationNoExceptionCheck(operationThrow, regT0);
 456     jumpToExceptionHandler();
 457 }
 458
 459 void JIT::emit_op_get_pnames(Instruction* currentInstruction)
 460 {
 461     int dst = currentInstruction[1].u.operand;
 462     int base = currentInstruction[2].u.operand;
 463     int i = currentInstruction[3].u.operand;
 464     int size = currentInstruction[4].u.operand;
 465     int breakTarget = currentInstruction[5].u.operand;
 466
 467     JumpList isNotObject;
 468
 469     emitGetVirtualRegister(base, regT0);
 470     if (!m_codeBlock->isKnownNotImmediate(base))
 471         isNotObject.append(emitJumpIfNotJSCell(regT0));
 472     if (base != m_codeBlock->thisRegister().offset() || m_codeBlock->isStrictMode())
 473         isNotObject.append(emitJumpIfCellNotObject(regT0));
 474
 475     // We could inline the case where you have a valid cache, but
 476     // this call doesn't seem to be hot.
 477     Label isObject(this);
 478     callOperation(operationGetPNames, regT0);
 479     emitStoreCell(dst, returnValueGPR);
 480     load32(Address(regT0, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStringsSize)), regT3);
 481     store64(tagTypeNumberRegister, addressFor(i));
 482     store32(TrustedImm32(Int32Tag), intTagFor(size));
 483     store32(regT3, intPayloadFor(size));
 484     Jump end = jump();
 485
 486     isNotObject.link(this);
 487     move(regT0, regT1);
 488     and32(TrustedImm32(~TagBitUndefined), regT1);
 489     addJump(branch32(Equal, regT1, TrustedImm32(ValueNull)), breakTarget);
 490     callOperation(operationToObject, base, regT0);
 491     jump().linkTo(isObject, this);
 492
 493     end.link(this);
 494 }
 495
 496 void JIT::emit_op_next_pname(Instruction* currentInstruction)
 497 {
 498     int dst = currentInstruction[1].u.operand;
 499     int base = currentInstruction[2].u.operand;
 500     int i = currentInstruction[3].u.operand;
 501     int size = currentInstruction[4].u.operand;
 502     int it = currentInstruction[5].u.operand;
 503     int target = currentInstruction[6].u.operand;
 504
 505     JumpList callHasProperty;
 506
 507     Label begin(this);
 508     load32(intPayloadFor(i), regT0);
 509     Jump end = branch32(Equal, regT0, intPayloadFor(size));
 510
 511     // Grab key @ i
 512     loadPtr(addressFor(it), regT1);
 513     loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
 514
 515     load64(BaseIndex(regT2, regT0, TimesEight), regT2);
 516
 517     emitPutVirtualRegister(dst, regT2);
 518
 519     // Increment i
 520     add32(TrustedImm32(1), regT0);
 521     store32(regT0, intPayloadFor(i));
 522
 523     // Verify that i is valid:
 524     emitGetVirtualRegister(base, regT0);
 525
 526     // Test base's structure
 527     emitLoadStructure(regT0, regT2, regT3);
 528     callHasProperty.append(branchPtr(NotEqual, regT2, Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedStructure)))));
 529
 530     // Test base's prototype chain
 531     loadPtr(Address(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_cachedPrototypeChain))), regT3);
 532     loadPtr(Address(regT3, OBJECT_OFFSETOF(StructureChain, m_vector)), regT3);
 533     addJump(branchTestPtr(Zero, Address(regT3)), target);
 534
 535     Label checkPrototype(this);
 536     load64(Address(regT2, Structure::prototypeOffset()), regT2);
 537     callHasProperty.append(emitJumpIfNotJSCell(regT2));
 538     emitLoadStructure(regT2, regT2, regT1);
 539     callHasProperty.append(branchPtr(NotEqual, regT2, Address(regT3)));
 540     addPtr(TrustedImm32(sizeof(Structure*)), regT3);
 541     branchTestPtr(NonZero, Address(regT3)).linkTo(checkPrototype, this);
 542
 543     // Continue loop.
 544     addJump(jump(), target);
 545
 546     // Slow case: Ask the object if i is valid.
 547     callHasProperty.link(this);
 548     emitGetVirtualRegister(dst, regT1);
 549     callOperation(operationHasProperty, regT0, regT1);
 550
 551     // Test for valid key.
 552     addJump(branchTest32(NonZero, regT0), target);
 553     jump().linkTo(begin, this);
 554
 555     // End of loop.
 556     end.link(this);
 557 }
 558
 559 void JIT::emit_op_push_with_scope(Instruction* currentInstruction)
 560 {
 561     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 562     callOperation(operationPushWithScope, regT0);
 563 }
 564
 565 void JIT::emit_op_pop_scope(Instruction*)
 566 {
 567     callOperation(operationPopScope);
 568 }
 569
 570 void JIT::compileOpStrictEq(Instruction* currentInstruction, CompileOpStrictEqType type)
 571 {
 572     int dst = currentInstruction[1].u.operand;
 573     int src1 = currentInstruction[2].u.operand;
 574     int src2 = currentInstruction[3].u.operand;
 575
 576     emitGetVirtualRegisters(src1, regT0, src2, regT1);
 577
 578     // Jump slow if both are cells (to cover strings).
 579     move(regT0, regT2);
 580     or64(regT1, regT2);
 581     addSlowCase(emitJumpIfJSCell(regT2));
 582
 583     // Jump slow if either is a double. First test if it's an integer, which is fine, and then test
 584     // if it's a double.
 585     Jump leftOK = emitJumpIfImmediateInteger(regT0);
 586     addSlowCase(emitJumpIfImmediateNumber(regT0));
 587     leftOK.link(this);
 588     Jump rightOK = emitJumpIfImmediateInteger(regT1);
 589     addSlowCase(emitJumpIfImmediateNumber(regT1));
 590     rightOK.link(this);
 591
 592     if (type == OpStrictEq)
 593         compare64(Equal, regT1, regT0, regT0);
 594     else
 595         compare64(NotEqual, regT1, regT0, regT0);
 596     emitTagAsBoolImmediate(regT0);
 597
 598     emitPutVirtualRegister(dst);
 599 }
 600
 601 void JIT::emit_op_stricteq(Instruction* currentInstruction)
 602 {
 603     compileOpStrictEq(currentInstruction, OpStrictEq);
 604 }
 605
 606 void JIT::emit_op_nstricteq(Instruction* currentInstruction)
 607 {
 608     compileOpStrictEq(currentInstruction, OpNStrictEq);
 609 }
 610
 611 void JIT::emit_op_to_number(Instruction* currentInstruction)
 612 {
 613     int srcVReg = currentInstruction[2].u.operand;
 614     emitGetVirtualRegister(srcVReg, regT0);
 615
 616     addSlowCase(emitJumpIfNotImmediateNumber(regT0));
 617
 618     emitPutVirtualRegister(currentInstruction[1].u.operand);
 619 }
 620
 621 void JIT::emit_op_push_name_scope(Instruction* currentInstruction)
 622 {
 623     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
 624     callOperation(operationPushNameScope, &m_codeBlock->identifier(currentInstruction[1].u.operand), regT0, currentInstruction[3].u.operand);
 625 }
 626
 627 void JIT::emit_op_catch(Instruction* currentInstruction)
 628 {
 629     move(TrustedImmPtr(m_vm), regT3);
 630     load64(Address(regT3, VM::callFrameForThrowOffset()), callFrameRegister);
 631
 632     addPtr(TrustedImm32(stackPointerOffsetFor(codeBlock()) * sizeof(Register)), callFrameRegister, stackPointerRegister);
 633
 634     load64(Address(regT3, VM::exceptionOffset()), regT0);
 635     store64(TrustedImm64(JSValue::encode(JSValue())), Address(regT3, VM::exceptionOffset()));
 636     emitPutVirtualRegister(currentInstruction[1].u.operand);
 637 }
 638
 639 void JIT::emit_op_switch_imm(Instruction* currentInstruction)
 640 {
 641     size_t tableIndex = currentInstruction[1].u.operand;
 642     unsigned defaultOffset = currentInstruction[2].u.operand;
 643     unsigned scrutinee = currentInstruction[3].u.operand;
 644
 645     // create jump table for switch destinations, track this switch statement.
 646     SimpleJumpTable* jumpTable = &m_codeBlock->switchJumpTable(tableIndex);
 647     m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset, SwitchRecord::Immediate));
 648     jumpTable->ensureCTITable();
 649
 650     emitGetVirtualRegister(scrutinee, regT0);
 651     callOperation(operationSwitchImmWithUnknownKeyType, regT0, tableIndex);
 652     jump(returnValueGPR);
 653 }
 654
 655 void JIT::emit_op_switch_char(Instruction* currentInstruction)
 656 {
 657     size_t tableIndex = currentInstruction[1].u.operand;
 658     unsigned defaultOffset = currentInstruction[2].u.operand;
 659     unsigned scrutinee = currentInstruction[3].u.operand;
 660
 661     // create jump table for switch destinations, track this switch statement.
 662     SimpleJumpTable* jumpTable = &m_codeBlock->switchJumpTable(tableIndex);
 663     m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset, SwitchRecord::Character));
 664     jumpTable->ensureCTITable();
 665
 666     emitGetVirtualRegister(scrutinee, regT0);
 667     callOperation(operationSwitchCharWithUnknownKeyType, regT0, tableIndex);
 668     jump(returnValueGPR);
 669 }
 670
 671 void JIT::emit_op_switch_string(Instruction* currentInstruction)
 672 {
 673     size_t tableIndex = currentInstruction[1].u.operand;
 674     unsigned defaultOffset = currentInstruction[2].u.operand;
 675     unsigned scrutinee = currentInstruction[3].u.operand;
 676
 677     // create jump table for switch destinations, track this switch statement.
 678     StringJumpTable* jumpTable = &m_codeBlock->stringSwitchJumpTable(tableIndex);
 679     m_switches.append(SwitchRecord(jumpTable, m_bytecodeOffset, defaultOffset));
 680
 681     emitGetVirtualRegister(scrutinee, regT0);
 682     callOperation(operationSwitchStringWithUnknownKeyType, regT0, tableIndex);
 683     jump(returnValueGPR);
 684 }
 685
 686 void JIT::emit_op_throw_static_error(Instruction* currentInstruction)
 687 {
 688     move(TrustedImm64(JSValue::encode(m_codeBlock->getConstant(currentInstruction[1].u.operand))), regT0);
 689     callOperation(operationThrowStaticError, regT0, currentInstruction[2].u.operand);
 690 }
 691
 692 void JIT::emit_op_debug(Instruction* currentInstruction)
 693 {
 694     load32(codeBlock()->debuggerRequestsAddress(), regT0);
 695     Jump noDebuggerRequests = branchTest32(Zero, regT0);
 696     callOperation(operationDebug, currentInstruction[1].u.operand);
 697     noDebuggerRequests.link(this);
 698 }
 699
 700 void JIT::emit_op_eq_null(Instruction* currentInstruction)
 701 {
 702     int dst = currentInstruction[1].u.operand;
 703     int src1 = currentInstruction[2].u.operand;
 704
 705     emitGetVirtualRegister(src1, regT0);
 706     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 707
 708     Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
 709     move(TrustedImm32(0), regT0);
 710     Jump wasNotMasqueradesAsUndefined = jump();
 711
 712     isMasqueradesAsUndefined.link(this);
 713     emitLoadStructure(regT0, regT2, regT1);
 714     move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
 715     loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
 716     comparePtr(Equal, regT0, regT2, regT0);
 717     Jump wasNotImmediate = jump();
 718
 719     isImmediate.link(this);
 720
 721     and64(TrustedImm32(~TagBitUndefined), regT0);
 722     compare64(Equal, regT0, TrustedImm32(ValueNull), regT0);
 723
 724     wasNotImmediate.link(this);
 725     wasNotMasqueradesAsUndefined.link(this);
 726
 727     emitTagAsBoolImmediate(regT0);
 728     emitPutVirtualRegister(dst);
 729
 730 }
 731
 732 void JIT::emit_op_neq_null(Instruction* currentInstruction)
 733 {
 734     int dst = currentInstruction[1].u.operand;
 735     int src1 = currentInstruction[2].u.operand;
 736
 737     emitGetVirtualRegister(src1, regT0);
 738     Jump isImmediate = emitJumpIfNotJSCell(regT0);
 739
 740     Jump isMasqueradesAsUndefined = branchTest8(NonZero, Address(regT0, JSCell::typeInfoFlagsOffset()), TrustedImm32(MasqueradesAsUndefined));
 741     move(TrustedImm32(1), regT0);
 742     Jump wasNotMasqueradesAsUndefined = jump();
 743
 744     isMasqueradesAsUndefined.link(this);
 745     emitLoadStructure(regT0, regT2, regT1);
 746     move(TrustedImmPtr(m_codeBlock->globalObject()), regT0);
 747     loadPtr(Address(regT2, Structure::globalObjectOffset()), regT2);
 748     comparePtr(NotEqual, regT0, regT2, regT0);
 749     Jump wasNotImmediate = jump();
 750
 751     isImmediate.link(this);
 752
 753     and64(TrustedImm32(~TagBitUndefined), regT0);
 754     compare64(NotEqual, regT0, TrustedImm32(ValueNull), regT0);
 755
 756     wasNotImmediate.link(this);
 757     wasNotMasqueradesAsUndefined.link(this);
 758
 759     emitTagAsBoolImmediate(regT0);
 760     emitPutVirtualRegister(dst);
 761 }
 762
 763 void JIT::emit_op_enter(Instruction*)
 764 {
 765     // Even though CTI doesn't use them, we initialize our constant
 766     // registers to zap stale pointers, to avoid unnecessarily prolonging
 767     // object lifetime and increasing GC pressure.
 768     size_t count = m_codeBlock->m_numVars;
 769     for (size_t j = 0; j < count; ++j)
 770         emitInitRegister(virtualRegisterForLocal(j).offset());
 771
 772     emitWriteBarrier(m_codeBlock->ownerExecutable());
 773
 774     emitEnterOptimizationCheck();
 775 }
 776
 777 void JIT::emit_op_create_activation(Instruction* currentInstruction)
 778 {
 779     int dst = currentInstruction[1].u.operand;
 780
 781     Jump activationCreated = branchTest64(NonZero, Address(callFrameRegister, sizeof(Register) * dst));
 782     callOperation(operationCreateActivation, 0);
 783     emitStoreCell(dst, returnValueGPR);
 784     activationCreated.link(this);
 785 }
 786
 787 void JIT::emit_op_create_arguments(Instruction* currentInstruction)
 788 {
 789     int dst = currentInstruction[1].u.operand;
 790
 791     Jump argsCreated = branchTest64(NonZero, Address(callFrameRegister, sizeof(Register) * dst));
 792
 793     callOperation(operationCreateArguments);
 794     emitStoreCell(dst, returnValueGPR);
 795     emitStoreCell(unmodifiedArgumentsRegister(VirtualRegister(dst)), returnValueGPR);
 796
 797     argsCreated.link(this);
 798 }
 799
 800 void JIT::emit_op_init_lazy_reg(Instruction* currentInstruction)
 801 {
 802     int dst = currentInstruction[1].u.operand;
 803
 804     store64(TrustedImm64((int64_t)0), Address(callFrameRegister, sizeof(Register) * dst));
 805 }
 806
 807 void JIT::emit_op_to_this(Instruction* currentInstruction)
 808 {
 809     WriteBarrierBase<Structure>* cachedStructure = &currentInstruction[2].u.structure;
 810     emitGetVirtualRegister(currentInstruction[1].u.operand, regT1);
 811
 812     emitJumpSlowCaseIfNotJSCell(regT1);
 813
 814     addSlowCase(branch8(NotEqual, Address(regT1, JSCell::typeInfoTypeOffset()), TrustedImm32(FinalObjectType)));
 815     loadPtr(cachedStructure, regT2);
 816     addSlowCase(branchTestPtr(Zero, regT2));
 817     load32(Address(regT2, Structure::structureIDOffset()), regT2);
 818     addSlowCase(branch32(NotEqual, Address(regT1, JSCell::structureIDOffset()), regT2));
 819 }
 820
 821 void JIT::emit_op_get_callee(Instruction* currentInstruction)
 822 {
 823     int result = currentInstruction[1].u.operand;
 824     WriteBarrierBase<JSCell>* cachedFunction = &currentInstruction[2].u.jsCell;
 825     emitGetFromCallFrameHeaderPtr(JSStack::Callee, regT0);
 826
 827     loadPtr(cachedFunction, regT2);
 828     addSlowCase(branchPtr(NotEqual, regT0, regT2));
 829
 830     emitPutVirtualRegister(result);
 831 }
 832
 833 void JIT::emitSlow_op_get_callee(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 834 {
 835     linkSlowCase(iter);
 836
 837     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_get_callee);
 838     slowPathCall.call();
 839 }
 840
 841 void JIT::emit_op_create_this(Instruction* currentInstruction)
 842 {
 843     int callee = currentInstruction[2].u.operand;
 844     RegisterID calleeReg = regT0;
 845     RegisterID resultReg = regT0;
 846     RegisterID allocatorReg = regT1;
 847     RegisterID structureReg = regT2;
 848     RegisterID scratchReg = regT3;
 849
 850     emitGetVirtualRegister(callee, calleeReg);
 851     loadPtr(Address(calleeReg, JSFunction::offsetOfAllocationProfile() + ObjectAllocationProfile::offsetOfAllocator()), allocatorReg);
 852     loadPtr(Address(calleeReg, JSFunction::offsetOfAllocationProfile() + ObjectAllocationProfile::offsetOfStructure()), structureReg);
 853     addSlowCase(branchTestPtr(Zero, allocatorReg));
 854
 855     emitAllocateJSObject(allocatorReg, structureReg, resultReg, scratchReg);
 856     emitPutVirtualRegister(currentInstruction[1].u.operand);
 857 }
 858
 859 void JIT::emitSlow_op_create_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 860 {
 861     linkSlowCase(iter); // doesn't have an allocation profile
 862     linkSlowCase(iter); // allocation failed
 863
 864     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_create_this);
 865     slowPathCall.call();
 866 }
 867
 868 void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
 869 {
 870     Jump profilerDone = branchTestPtr(Zero, AbsoluteAddress(m_vm->enabledProfilerAddress()));
 871     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 872     callOperation(operationProfileWillCall, regT0);
 873     profilerDone.link(this);
 874 }
 875
 876 void JIT::emit_op_profile_did_call(Instruction* currentInstruction)
 877 {
 878     Jump profilerDone = branchTestPtr(Zero, AbsoluteAddress(m_vm->enabledProfilerAddress()));
 879     emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
 880     callOperation(operationProfileDidCall, regT0);
 881     profilerDone.link(this);
 882 }
 883
 884
 885 // Slow cases
 886
 887 void JIT::emitSlow_op_to_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 888 {
 889     linkSlowCase(iter);
 890     linkSlowCase(iter);
 891     linkSlowCase(iter);
 892     linkSlowCase(iter);
 893
 894     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_this);
 895     slowPathCall.call();
 896 }
 897
 898 void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 899 {
 900     linkSlowCase(iter);
 901
 902     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_primitive);
 903     slowPathCall.call();
 904 }
 905
 906 void JIT::emitSlow_op_not(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 907 {
 908     linkSlowCase(iter);
 909
 910     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_not);
 911     slowPathCall.call();
 912 }
 913
 914 void JIT::emitSlow_op_jfalse(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 915 {
 916     linkSlowCase(iter);
 917     callOperation(operationConvertJSValueToBoolean, regT0);
 918     emitJumpSlowToHot(branchTest32(Zero, returnValueGPR), currentInstruction[2].u.operand); // inverted!
 919 }
 920
 921 void JIT::emitSlow_op_jtrue(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 922 {
 923     linkSlowCase(iter);
 924     callOperation(operationConvertJSValueToBoolean, regT0);
 925     emitJumpSlowToHot(branchTest32(NonZero, returnValueGPR), currentInstruction[2].u.operand);
 926 }
 927
 928 void JIT::emitSlow_op_bitxor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 929 {
 930     linkSlowCase(iter);
 931     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_bitxor);
 932     slowPathCall.call();
 933 }
 934
 935 void JIT::emitSlow_op_bitor(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 936 {
 937     linkSlowCase(iter);
 938     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_bitor);
 939     slowPathCall.call();
 940 }
 941
 942 void JIT::emitSlow_op_eq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 943 {
 944     linkSlowCase(iter);
 945     callOperation(operationCompareEq, regT0, regT1);
 946     emitTagAsBoolImmediate(returnValueGPR);
 947     emitPutVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
 948 }
 949
 950 void JIT::emitSlow_op_neq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 951 {
 952     linkSlowCase(iter);
 953     callOperation(operationCompareEq, regT0, regT1);
 954     xor32(TrustedImm32(0x1), regT0);
 955     emitTagAsBoolImmediate(returnValueGPR);
 956     emitPutVirtualRegister(currentInstruction[1].u.operand, returnValueGPR);
 957 }
 958
 959 void JIT::emitSlow_op_stricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 960 {
 961     linkSlowCase(iter);
 962     linkSlowCase(iter);
 963     linkSlowCase(iter);
 964     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_stricteq);
 965     slowPathCall.call();
 966 }
 967
 968 void JIT::emitSlow_op_nstricteq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 969 {
 970     linkSlowCase(iter);
 971     linkSlowCase(iter);
 972     linkSlowCase(iter);
 973     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_nstricteq);
 974     slowPathCall.call();
 975 }
 976
 977 void JIT::emitSlow_op_check_has_instance(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 978 {
 979     int dst = currentInstruction[1].u.operand;
 980     int value = currentInstruction[2].u.operand;
 981     int baseVal = currentInstruction[3].u.operand;
 982
 983     linkSlowCaseIfNotJSCell(iter, baseVal);
 984     linkSlowCase(iter);
 985     emitGetVirtualRegister(value, regT0);
 986     emitGetVirtualRegister(baseVal, regT1);
 987     callOperation(operationCheckHasInstance, dst, regT0, regT1);
 988
 989     emitJumpSlowToHot(jump(), currentInstruction[4].u.operand);
 990 }
 991
 992 void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 993 {
 994     int dst = currentInstruction[1].u.operand;
 995     int value = currentInstruction[2].u.operand;
 996     int proto = currentInstruction[3].u.operand;
 997
 998     linkSlowCaseIfNotJSCell(iter, value);
 999     linkSlowCaseIfNotJSCell(iter, proto);
1000     linkSlowCase(iter);
1001     emitGetVirtualRegister(value, regT0);
1002     emitGetVirtualRegister(proto, regT1);
1003     callOperation(operationInstanceOf, dst, regT0, regT1);
1004 }
1005
1006 void JIT::emitSlow_op_to_number(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
1007 {
1008     linkSlowCase(iter);
1009
1010     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_to_number);
1011     slowPathCall.call();
1012 }
1013
1014 void JIT::emit_op_get_arguments_length(Instruction* currentInstruction)
1015 {
1016     int dst = currentInstruction[1].u.operand;
1017     int argumentsRegister = currentInstruction[2].u.operand;
1018     addSlowCase(branchTest64(NonZero, addressFor(argumentsRegister)));
1019     emitGetFromCallFrameHeader32(JSStack::ArgumentCount, regT0);
1020     sub32(TrustedImm32(1), regT0);
1021     emitFastArithReTagImmediate(regT0, regT0);
1022     emitPutVirtualRegister(dst, regT0);
1023 }
1024
1025 void JIT::emitSlow_op_get_arguments_length(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
1026 {
1027     linkSlowCase(iter);
1028     int dst = currentInstruction[1].u.operand;
1029     int base = currentInstruction[2].u.operand;
1030     callOperation(operationGetArgumentsLength, dst, base);
1031 }
1032
1033 void JIT::emit_op_get_argument_by_val(Instruction* currentInstruction)
1034 {
1035     int dst = currentInstruction[1].u.operand;
1036     int argumentsRegister = currentInstruction[2].u.operand;
1037     int property = currentInstruction[3].u.operand;
1038     addSlowCase(branchTest64(NonZero, addressFor(argumentsRegister)));
1039     emitGetVirtualRegister(property, regT1);
1040     addSlowCase(emitJumpIfNotImmediateInteger(regT1));
1041     add32(TrustedImm32(1), regT1);
1042     // regT1 now contains the integer index of the argument we want, including this
1043     emitGetFromCallFrameHeader32(JSStack::ArgumentCount, regT2);
1044     addSlowCase(branch32(AboveOrEqual, regT1, regT2));
1045
1046     signExtend32ToPtr(regT1, regT1);
1047     load64(BaseIndex(callFrameRegister, regT1, TimesEight, CallFrame::thisArgumentOffset() * static_cast<int>(sizeof(Register))), regT0);
1048     emitValueProfilingSite();
1049     emitPutVirtualRegister(dst, regT0);
1050 }
1051
1052 void JIT::emitSlow_op_get_argument_by_val(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
1053 {
1054     int dst = currentInstruction[1].u.operand;
1055     int arguments = currentInstruction[2].u.operand;
1056     int property = currentInstruction[3].u.operand;
1057
1058     linkSlowCase(iter);
1059     Jump skipArgumentsCreation = jump();
1060
1061     linkSlowCase(iter);
1062     linkSlowCase(iter);
1063     callOperation(operationCreateArguments);
1064     emitStoreCell(arguments, returnValueGPR);
1065     emitStoreCell(unmodifiedArgumentsRegister(VirtualRegister(arguments)), returnValueGPR);
1066
1067     skipArgumentsCreation.link(this);
1068     emitGetVirtualRegister(arguments, regT0);
1069     emitGetVirtualRegister(property, regT1);
1070     callOperation(WithProfile, operationGetByValGeneric, dst, regT0, regT1);
1071 }
1072
1073 #endif // USE(JSVALUE64)
1074
1075 void JIT::emit_op_touch_entry(Instruction* currentInstruction)
1076 {
1077     if (m_codeBlock->symbolTable()->m_functionEnteredOnce.hasBeenInvalidated())
1078         return;
1079
1080     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_touch_entry);
1081     slowPathCall.call();
1082 }
1083
1084 void JIT::emit_op_loop_hint(Instruction*)
1085 {
1086     // Emit the JIT optimization check:
1087     if (canBeOptimized()) {
1088         addSlowCase(branchAdd32(PositiveOrZero, TrustedImm32(Options::executionCounterIncrementForLoop()),
1089             AbsoluteAddress(m_codeBlock->addressOfJITExecuteCounter())));
1090     }
1091
1092     // Emit the watchdog timer check:
1093     if (m_vm->watchdog && m_vm->watchdog->isEnabled())
1094         addSlowCase(branchTest8(NonZero, AbsoluteAddress(m_vm->watchdog->timerDidFireAddress())));
1095 }
1096
1097 void JIT::emitSlow_op_loop_hint(Instruction*, Vector<SlowCaseEntry>::iterator& iter)
1098 {
1099 #if ENABLE(DFG_JIT)
1100     // Emit the slow path for the JIT optimization check:
1101     if (canBeOptimized()) {
1102         linkSlowCase(iter);
1103
1104         callOperation(operationOptimize, m_bytecodeOffset);
1105         Jump noOptimizedEntry = branchTestPtr(Zero, returnValueGPR);
1106         if (!ASSERT_DISABLED) {
1107             Jump ok = branchPtr(MacroAssembler::Above, regT0, TrustedImmPtr(bitwise_cast<void*>(static_cast<intptr_t>(1000))));
1108             abortWithReason(JITUnreasonableLoopHintJumpTarget);
1109             ok.link(this);
1110         }
1111         jump(returnValueGPR);
1112         noOptimizedEntry.link(this);
1113
1114         emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_loop_hint));
1115     }
1116 #endif
1117
1118     // Emit the slow path of the watchdog timer check:
1119     if (m_vm->watchdog && m_vm->watchdog->isEnabled()) {
1120         linkSlowCase(iter);
1121         callOperation(operationHandleWatchdogTimer);
1122
1123         emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_loop_hint));
1124     }
1125
1126 }
1127
1128 void JIT::emit_op_new_regexp(Instruction* currentInstruction)
1129 {
1130     callOperation(operationNewRegexp, currentInstruction[1].u.operand, m_codeBlock->regexp(currentInstruction[2].u.operand));
1131 }
1132
1133 void JIT::emit_op_new_func(Instruction* currentInstruction)
1134 {
1135     Jump lazyJump;
1136     int dst = currentInstruction[1].u.operand;
1137     if (currentInstruction[3].u.operand) {
1138 #if USE(JSVALUE32_64)
1139         lazyJump = branch32(NotEqual, tagFor(dst), TrustedImm32(JSValue::EmptyValueTag));
1140 #else
1141         lazyJump = branchTest64(NonZero, addressFor(dst));
1142 #endif
1143     }
1144
1145     FunctionExecutable* funcExec = m_codeBlock->functionDecl(currentInstruction[2].u.operand);
1146     callOperation(operationNewFunction, dst, funcExec);
1147
1148     if (currentInstruction[3].u.operand)
1149         lazyJump.link(this);
1150 }
1151
1152 void JIT::emit_op_new_captured_func(Instruction* currentInstruction)
1153 {
1154     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_new_captured_func);
1155     slowPathCall.call();
1156 }
1157
1158 void JIT::emit_op_new_func_exp(Instruction* currentInstruction)
1159 {
1160     int dst = currentInstruction[1].u.operand;
1161     FunctionExecutable* funcExpr = m_codeBlock->functionExpr(currentInstruction[2].u.operand);
1162     callOperation(operationNewFunction, dst, funcExpr);
1163 }
1164
1165 void JIT::emit_op_new_array(Instruction* currentInstruction)
1166 {
1167     int dst = currentInstruction[1].u.operand;
1168     int valuesIndex = currentInstruction[2].u.operand;
1169     int size = currentInstruction[3].u.operand;
1170     addPtr(TrustedImm32(valuesIndex * sizeof(Register)), callFrameRegister, regT0);
1171     callOperation(operationNewArrayWithProfile, dst,
1172         currentInstruction[4].u.arrayAllocationProfile, regT0, size);
1173 }
1174
1175 void JIT::emit_op_new_array_with_size(Instruction* currentInstruction)
1176 {
1177     int dst = currentInstruction[1].u.operand;
1178     int sizeIndex = currentInstruction[2].u.operand;
1179 #if USE(JSVALUE64)
1180     emitGetVirtualRegister(sizeIndex, regT0);
1181     callOperation(operationNewArrayWithSizeAndProfile, dst,
1182         currentInstruction[3].u.arrayAllocationProfile, regT0);
1183 #else
1184     emitLoad(sizeIndex, regT1, regT0);
1185     callOperation(operationNewArrayWithSizeAndProfile, dst,
1186         currentInstruction[3].u.arrayAllocationProfile, regT1, regT0);
1187 #endif
1188 }
1189
1190 void JIT::emit_op_new_array_buffer(Instruction* currentInstruction)
1191 {
1192     int dst = currentInstruction[1].u.operand;
1193     int valuesIndex = currentInstruction[2].u.operand;
1194     int size = currentInstruction[3].u.operand;
1195     const JSValue* values = codeBlock()->constantBuffer(valuesIndex);
1196     callOperation(operationNewArrayBufferWithProfile, dst, currentInstruction[4].u.arrayAllocationProfile, values, size);
1197 }
1198
1199 void JIT::emitSlow_op_captured_mov(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
1200 {
1201     VariableWatchpointSet* set = currentInstruction[3].u.watchpointSet;
1202     if (!set || set->state() == IsInvalidated)
1203         return;
1204 #if USE(JSVALUE32_64)
1205     linkSlowCase(iter);
1206 #endif
1207     linkSlowCase(iter);
1208     JITSlowPathCall slowPathCall(this, currentInstruction, slow_path_captured_mov);
1209     slowPathCall.call();
1210 }
1211
1212 } // namespace JSC
1213
1214 #endif // ENABLE(JIT)