*******************************************

* HipHop Intermediate Representation (HHIR)

*******************************************

Introduction

------------

The HipHop Intermediate Representation (IR) is a typed, in-memory,

static-single-assignment, intermediate-level representation of HHBC programs

used for just in time compilation, with these goals:

1. Complete. The IR represents a program or program fragment entirely,

without reference to HHBC or other upstream forms of the program.

2. Type-Safe. Since the IR deals directly with refined types and internal VM

types, all operations are typesafe. All instruction parameters have a

parameter type P, and all variables have a type S. Given an instruction

with source parameter type P and variable type S, S must be equal to or

more refined than P (S == P or S <: P).

3. Machine Independent. Since this IR is intended to be used in a JIT

compiler, it will always be used in a machine specific context.

Nevertheless, we rely on machine independence in order to separate

concerns and increase portability of the VM. Passes which manipulate IR

based on PHP or HHBC semantics should be portable. Passes which deal with

machine specifics (such as register allocation) should be done in the

lower level IR (vasm). Types are machine independent.

The unit of compilation is the IRUnit, which is a collection of Blocks

containing IRInstructions that produce and consume SSATmp values. Blocks are

single-entry, single-exit sequences of instructions (i.e. basic

blocks). Instructions may be annotated with Type parameter which modifies the

instruction's behavior, or with additional compile-time constant data (see

extra-data.h). Each SSATmp has a Type which describes the set of values it may

hold, over its entire live range. Instructions may have side effects, which

occur in execution order.

The static single assignment form guarantees the following two invariants for a

well-formed compilation unit:

1. Each SSATmp is assigned to by exactly one IRInstruction.

2. Definitions dominate uses. Every path to an IRInstruction using an SSATmp

first executes the IRInstruction defining the SSATmp.

Any pass that generates or manipulates IR must preserve these invariants,

however it is possible and expected for the invariants to be temporarily broken

during IR generation or during an optimization pass.

Control Flow

------------

IRUnits have one entry block, zero or more exit blocks, and zero or more catch

blocks. Exit blocks leave the compilation unit in the middle of the same PHP

function using one of several instructions that exit a compilation unit

(e.g. ReqBindJmp). Catch blocks are blocks that are reachable from exceptional

control flow edges, and are executed during unwinding if an exception

propagates through the instruction that had it as a `taken' edge.

No SSATmps are defined on entry to the main Block.

Blocks which are join points may start with a DefLabel with destination

SSATmps. In that case, each predecessor must be a Jmp passing a matching number

of sources. In this case the Jmp acts as a tail-call, passing arguments the

same way a plain call would.

Together, the sources of the Jmp instructions and the destinations of the

DefLabel instructions act as traditional SSA Phi pseudo-functions; The type of

the DefLabel's destination is the type-union of the corresponding sources.

Because the Jmp sources are at the ends of blocks, they do not violate the SSA

dominator rule (rule 2, above).

Types

-----

For an overview of the HHIR type system, see the "Type System" section in

hackers-guide/jit-core.md.

SSATmps

-------

An SSATmp represents a virtual register. Since HHIR uses SSA, an SSATmp may

only be assigned to by one instruction. The type of an SSATmp represents the

set of values it may hold at the point it is defined, which is invariant over

the lifetime of the variable (from the definition point to the last use).

IRInstructions

--------------

An instruction is an executable operation with zero or more inputs (sources),

zero or one result (destination), and possible side effects such as accessing

memory, doing I/O, and which may branch or throw an exception. Some

instructions have a Type parameter which modifies its behavior, or other "extra

data" in an arbitrary C++ struct (see extra-data.h).

Each instruction has a signature which describes its effect, parameter types,

and return type, for example:

IsType<T>, D(Bool), S(Cell), NF

The first column is the instruction name (and optional Type parameter in <>).

The second column describes the result (destination) using one of the D*

macros documented in hphp/runtime/vm/jit/ir-opcode.h, or ND for no destination.

The third column describes the sources, separated by whitespace, using macros

documented in hphp/runtime/vm/jit/ir-opcode.h, or NA if there are no sources.

The fourth column contains the flags, described below. The short name of the

flag (used in this file) is given first, with the long name that it expands to

in hphp/runtime/vm/jit/ir-opcode.cpp in parentheses after it.

NF

The instruction has no flags.

PRc (ProducesRC)

The instruction produces a value with an unconsumed reference that must be

consumed, either by DecRefing it or storing it somewhere in memory.

The refcount on the produced value could be more than 1 after the instruction.

PNRc (ProducesNewRC)

The instruction produces a new value with an unconsumed reference that must be

consumed, either by DecRefing it or storing it somewhere in memory. This is

subset of PRc flag. The refcount on the produced value will be exactly 1 after

the instruction.

T (Terminal)

The instruction has no next instruction; it either jumps, returns, or throws.

B (Branch)

The instruction has a (sometimes optional) taken edge. Instructions that are

conditional branches (i.e. a Branch that is not Terminal) will also have a

next edge.

P (Passthrough)

The value of the instruction's dest is the same as one of its inputs; it

differs only in the type of the variable, or some other property that doesn't

affect the value of the variable itself.

LA (Layout-Agnostic)

The instruction is generic over array-like inputs and outputs. Most ops that

deal with array-like types can only handle their default ("Vanilla") layouts.

We whitelist those ops that are generic over layout.

LP (Layout-preserving)

The instruction is closed under vanilla array layouts: if the first argument

is vanilla, so too is the destination. The first argument must be an

array-like type. Layout-preserving implies layout-agnostic.

Instruction set

---------------

1. Checks and Asserts

| CheckType<T>, DRefineS(0), S(Cell), B|P

Check that the type of the src S0 is T, and if so copy it to D, and

fallthrough. If S0 cannot be proven to be T, branch to block B. Note that

this means S0 still /may/ be a subtype of T in block B in some circumstances.

Specifically, subtypes of Type::Static may not be checked precisely,

depending on the type of the source. This means the instruction may take the

branch in some circumstances even when S0 is a subtype of T, if T has a

non-empty intersection with Type::Static.

Also note that many types are not supported as the typeParam right now.

| CheckNullptr, ND, S(Cls|StaticStr|Nullptr), B

If S0 is not a null pointer, branch to block B. This is used to check the

return value of a native helper that returns a potentially null StringData*.

| AssertType<T>, DRefineS(0), S(Cell|Nullptr OR Mem), P

Assert that the type of S0 is T, copying it to D.

| CheckTypeMem<T>, ND, S(Mem), B

If the value pointed to by S0 is not type T, branch to the block B.

| CheckLoc<T,localId>, ND, S(FramePtr), B

Check that type of the given localId on the frame S0 is T; if not, branch to

block B.

| CheckStk<T,offset>, ND, S(StkPtr), B

Check that the type of the cell on the stack pointed to by S0 at offset (in

cells) is T; if not, branch to block B.

| CheckMBase<T>, ND, S(Lval), B

Check that the value pointed to by the member base register S0 has type T; if

not, branch to block B. This is functionally the same as CheckTypeMem.

| AssertLoc<T,localId>, ND, S(FramePtr), NF

Asserts that type of the supplied local on the frame S0 is T. This is used

for local type information, and is similar to CheckLoc except it doesn't

imply a runtime check (the assertion must've already been proven to be true)

and cannot cause control flow.

| AssertStk<T,offset>, ND, S(StkPtr), NF

Assert that stack element at `offset' (in cells) from S0 has type T. This is

similar to a CheckStk except that it does not imply a runtime check and

cannot cause control flow.

| AssertMBase<T>, ND, NA, NF

Assert that the value pointed to by the member base register has type T.

This is similar to a CheckMBase except that it does not imply a runtime check

and cannot cause control flow.

| CheckInit, ND, S(Cell), B

If S0's type is Uninit, branch to block B.

| CheckInitMem, ND, S(Mem), B

If the value pointed to by S0 has type Uninit, branch to block B.

| CheckCold<TransID>, ND, NA, B

Check if the counter associated with translation TransID is cold (i.e. within

a fixed threshold). If it's not (i.e. such translation has reached the

"hotness threshold"), then branch to block B.

| EndGuards, ND, NA, NF

A no-op at runtime, this instruction serves to mark the end of the initial

sequence of guards in a trace.

| CheckNonNull, DSubtract(0, Nullptr), SNullptr(Cls OR Func OR Obj OR Str OR Mem OR TCA OR Dict OR Vec), B|P|LA

If the value in S0 is Nullptr, branch to block B. If S0 cannot be Nullptr, or

always is Nullptr, this check may be optimized away.

| AssertNonNull, DSubtract(0, Nullptr), SNullptr(Func OR StaticStr), P

Returns S0, with Nullptr removed from its type. This instruction currently

supports a very limited range of types but can be expanded if needed.

| CheckSmashableClass, ND, S(Smashable) S(Cls), B

If the lower 32 bits of S0 does not match class pointer S1, branch to block B.

2. Arithmetic

| AddInt, D(Int), S(Int) S(Int), NF

| AddOffset, D(VoidPtr), S(VoidPtr) C(Int), NF

| SubInt, D(Int), S(Int) S(Int), NF

| MulInt, D(Int), S(Int) S(Int), NF

| MulIntO, D(Int), S(Int) S(Int), B

| AddDbl, D(Dbl), S(Dbl) S(Dbl), NF

| SubDbl, D(Dbl), S(Dbl) S(Dbl), NF

| MulDbl, D(Dbl), S(Dbl) S(Dbl), NF

| DivDbl, D(Dbl), S(Dbl) S(Dbl), NF

| DivInt, D(Int), S(Int) S(Int), NF

| Floor, D(Dbl), S(Dbl), NF

| Ceil, D(Dbl), S(Dbl), NF

| AbsDbl, D(Dbl), S(Dbl), NF

| Sqrt, D(Dbl), S(Dbl), NF

| AndInt, D(Int), S(Int) S(Int), NF

| OrInt, D(Int), S(Int) S(Int), NF

| XorInt, D(Int), S(Int) S(Int), NF

| Shl, D(Int), S(Int) S(Int), NF

| Shr, D(Int), S(Int) S(Int), NF

| Lshr, D(Int), S(Int) S(Int), NF

Double arithmetic, integer arithmetic, and integer bitwise operations.

Performs the operation described by the opcode name on S0 and S1, and puts

the result in D.

Undefined behavior occurs if Mod is given a divisor of zero, or if the

divisor is -1 and the dividend is the minimum representable integer.

AbsDbl computes the absolute value of a double-precision value.

DivDbl conforms to IEEE 754. In particular, division by zero returns +/- INF

or NAN depending on the dividend; and should the result of a division be zero

the sign will follow the normal sign rules for division.

DivInt will perform integer division of S1 by S0. S0 should not be zero and

must divide S1.

Note that Shr is an arithmetic right shift: The MSB is sign-extended.

Lshr is logical right shift.

Floor and Ceil will return an integral value not greater, or not less

than their input respectively. Their use requires SSE 4.1, availability

should be checked before they are emitted.

MulIntO performs integer arithmetic on S0 and S1, but will branch to

block B on integer overflow.

| XorBool, D(Bool), S(Bool) S(Bool), NF

Logical XOR of the two sources. (Note that && and || do not have

corresponding opcodes because they're handled at the bytecode level, to

implement short-circuiting.)

| Mod, D(Int), S(Int) S(Int), NF

Compute S0 mod S1. If S1 is -1 or 0 the results are undefined.

| PseudoRandomInt, D(Int), S(Int) S(Int), NF

Generates a pseudorandom integer in the range of <S0, S1>.

Equivalent to HH\Lib\_Private\Native\pseudorandom_int(S0, S1).

3. Type conversions

To vec conversions:

| ConvArrLikeToVec, D(Vec), S(ArrLike,MMR), PRc|LP

| ConvObjToVec, D(Vec), S(Obj,MMR), PRc

To dict conversions:

| ConvArrLikeToDict, D(Dict), S(ArrLike,MMR), PRc|LP

| ConvObjToDict, D(Dict), S(Obj,MMR), PRc

To keyset conversions:

| ConvArrLikeToKeyset, D(Keyset), S(ArrLike,MMR), PRc|LP

| ConvObjToKeyset, D(Keyset), S(Obj,MMR), PRc

To bool conversions:

| ConvDblToBool, D(Bool), S(Dbl), NF

| ConvIntToBool, D(Bool), S(Int), NF

| ConvStrToBool, D(Bool), S(Str), NF

| ConvObjToBool, D(Bool), S(Obj), NF

| ConvTVToBool, D(Bool), S(Cell), NF

To double conversions:

| ConvBoolToDbl, D(Dbl), S(Bool), NF

| ConvIntToDbl, D(Dbl), S(Int), NF

| ConvObjToDbl, D(Dbl), S(Obj), NF

| ConvStrToDbl, D(Dbl), S(Str), NF

| ConvResToDbl, D(Dbl), S(Res), NF

| ConvTVToDbl, D(Dbl), S(Cell), NF

To int conversions:

| ConvBoolToInt, D(Int), S(Bool), NF

| ConvDblToInt, D(Int), S(Dbl), NF

| ConvObjToInt, D(Int), S(Obj), NF

| ConvStrToInt, D(Int), S(Str), NF

| ConvResToInt, D(Int), S(Res), NF

| ConvTVToInt, D(Int), S(Cell), NF

To string conversions:

| ConvDblToStr, D(Str), S(Dbl), PRc

| ConvIntToStr, D(Str), S(Int), PRc

| ConvObjToStr, D(Str), S(Obj), PRc

| ConvTVToStr, D(Str), S(Cell), PRc

All the above opcodes convert S0 from its current type to the destination

type, according to the PHP semantics of such a conversion.

| DblAsBits, D(Int), S(Dbl), NF

Reinterpret a double as an integer with the same bit pattern.

| IntAsPtrToElem, D(PtrToElem), S(Int), NF

| PtrToElemAsInt, D(Int), S(PtrToElem), NF

Reinterpret cast between an integer and a PtrToElem.

| OrdStr, D(Int), S(Str), NF

Convert the first byte in a string to an unsigned integer.

Intended as an optimization for ord($str)

| OrdStrIdx, D(Int), S(Str) S(Int), NF

Convert the character at position S1 in base string S0 to an unsigned

integer. Raises a notice if the position is out of bounds.

Intended as an optimization for ord($str[$idx]).

| ChrInt, D(StaticStr), S(Int), NF

Convert the integer S0 to a the one character string with ascii code

S0 & 255.

| StrictlyIntegerConv, D(Str|Int), S(Str), PRc

If S0 is a string representing an integer value (same criteria as array key

conversion), return that value as an integer. Otherwise return S0.

| ConvPtrToLval, DLvalOfPtr, S(Ptr), NF

Convert S0 to an equivalent lval.

| VoidPtrAsDataType<T>, DParam(Cell), S(VoidPtr), NF

Take VoidPtr S0 and convert it to heap type TParam.

4. Boolean predicates

| GtInt, D(Bool), S(Int) S(Int), NF

| GteInt, D(Bool), S(Int) S(Int), NF

| LtInt, D(Bool), S(Int) S(Int), NF

| LteInt, D(Bool), S(Int) S(Int), NF

| EqInt, D(Bool), S(Int) S(Int), NF

| NeqInt, D(Bool), S(Int) S(Int), NF

| CmpInt, D(Int), S(Int) S(Int), NF

Perform 64-bit integer comparisons.

| GtDbl, D(Bool), S(Dbl) S(Dbl), NF

| GteDbl, D(Bool), S(Dbl) S(Dbl), NF

| LtDbl, D(Bool), S(Dbl) S(Dbl), NF

| LteDbl, D(Bool), S(Dbl) S(Dbl), NF

| EqDbl, D(Bool), S(Dbl) S(Dbl), NF

| NeqDbl, D(Bool), S(Dbl) S(Dbl), NF

| CmpDbl, D(Int), S(Dbl) S(Dbl), NF

Perform comparisons of doubles. Comparisons that are unordered according to

IEEE 754 (such as when at least one operand is NaN) result in false.

| GtStr, D(Bool), S(Str) S(Str), NF

| GteStr, D(Bool), S(Str) S(Str), NF

| LtStr, D(Bool), S(Str) S(Str), NF

| LteStr, D(Bool), S(Str) S(Str), NF

| EqStr, D(Bool), S(Str) S(Str), NF

| NeqStr, D(Bool), S(Str) S(Str), NF

| SameStr, D(Bool), S(Str) S(Str), NF

| NSameStr, D(Bool), S(Str) S(Str), NF

| CmpStr, D(Int), S(Str) S(Str), NF

Performs comparison of strings

| GtBool, D(Bool), S(Bool) S(Bool), NF

| GteBool, D(Bool), S(Bool) S(Bool), NF

| LtBool, D(Bool), S(Bool) S(Bool), NF

| LteBool, D(Bool), S(Bool) S(Bool), NF

| EqBool, D(Bool), S(Bool) S(Bool), NF

| NeqBool, D(Bool), S(Bool) S(Bool), NF

| CmpBool, D(Int), S(Bool) S(Bool), NF

Performs comparison of booleans.

| GtObj, D(Bool), S(Obj) S(Obj), NF

| GteObj, D(Bool), S(Obj) S(Obj), NF

| LtObj, D(Bool), S(Obj) S(Obj), NF

| LteObj, D(Bool), S(Obj) S(Obj), NF

| EqObj, D(Bool), S(Obj) S(Obj), NF

| NeqObj, D(Bool), S(Obj) S(Obj), NF

| SameObj, D(Bool), S(Obj) S(Obj), NF

| NSameObj, D(Bool), S(Obj) S(Obj), NF

| CmpObj, D(Int), S(Obj) S(Obj), NF

Perform comparison of object. All versions except for SameObj and NSameObj may

re-enter the VM and therefore may throw exceptions. SameObj and NSameObj never

re-enter or throw.

| GtArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| GteArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| LtArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| LteArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| EqArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| NeqArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| SameArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| NSameArrLike, D(Bool), S(ArrLike) S(ArrLike), NF|LA

| CmpArrLike, D(Int), S(ArrLike) S(ArrLike), NF|LA

Perform comparison of array-likes. All versions except for SameArrLike and

NSameArrLike may re-enter the VM and therefore may throw exceptions.

SameArrLike and NSameArrLike never re-enter or throw. Relational comparisons

for dicts and keysets are not supported. As keysets only contain ints and

strings, comparisons never re-enter or throw.

| GtRes, D(Bool), S(Res) S(Res), NF

| GteRes, D(Bool), S(Res) S(Res), NF

| LtRes, D(Bool), S(Res) S(Res), NF

| LteRes, D(Bool), S(Res) S(Res), NF

| EqRes, D(Bool), S(Res) S(Res), NF

| NeqRes, D(Bool), S(Res) S(Res), NF

| CmpRes, D(Int), S(Res) S(Res), NF

Perform comparison of resources using PHP semantics. Resource comparisons

never re-enter or throw.

| EqCls, D(Bool), S(Cls) S(Cls), NF

Checks if two Class values are equal.

| EqLazyCls, D(Bool), S(LazyCls) S(LazyCls), NF

Checks if two Lazy class values are equal.

| EqFunc, D(Bool), S(Func) S(Func), NF

Checks if two Func values are equal.

| EqFuncId<funcId>, D(Bool), S(Func), B

Tests if the FuncId of S0 matches jit-time funcId.

| EqStrPtr, D(Bool), S(Str) S(Str), NF

Checks if two string values represent the same underlying string. That is,

that they point at the same underlying storage.

| EqArrayDataPtr, D(Bool), S(ArrLike) S(ArrLike), LA

Checks if the two arguments represent the same underlying ArrayData. That is,

that they point at the same underlying storage.

| ProfileInstanceCheck, ND, S(Cls), NF

Profile that S0 has been used as the RHS of an instance check.

| InstanceOf<canCheckVtable>, D(Bool), S(Cls) S(Cls|Nullptr), NF

Sets D based on whether S0 is a descendant of the class, interface, or trait

in S1. (Note that this is always false for a trait). S1 may be null at

runtime if the class is not defined.

canCheckVtable signals that this opcode may be simplified to

InstanceOfIfaceVtable, which we allow when S0 was fetched from an object.

| InstanceOfIface<canCheckVtable>, D(Bool), S(Cls) CStr(), NF

Fast path for interface checks. Sets D based on whether S0 implements S1, but

S1 must be a known interface.

| InstanceOfIfaceVtable<iface,canOptimize>, D(Bool), S(Cls), NF

Faster path for interface checks. Sets D based on whether S0 implements

iface, which must be a unique interface with an assigned vtable slot. In

some circumstances, this instruction is ensuring the presence of the

vtableVec; in those cases, canOptimize is false to avoid eliminating the

guard.

| ExtendsClass<cls,strictLikely>, D(Bool), S(Cls), NF

A fast-path for instanceof checks. Sets D based on whether S0 is a descendant

of cls, where cls must be a unique class that is not an interface or a trait.

If strictLikely is true, optimize for the case where S0 is not equal to S1.

| InstanceOfBitmask, D(Bool), S(Cls) CStr(), NF

| NInstanceOfBitmask, D(Bool), S(Cls) CStr(), NF

A fast-path for instanceof checks. Sets D based on whether S0 is a descendant

of the class named by S1, where S1 must have a bit allocated for it in the

fast instance check bitvector (see class.h).

| InterfaceSupportsArrLike, D(Bool), S(Str), NF

| InterfaceSupportsStr, D(Bool), S(Str), NF

| InterfaceSupportsInt, D(Bool), S(Str), NF

| InterfaceSupportsDbl, D(Bool), S(Str), NF

Returns whether t instanceof S0 returns true when t is of the given type.

| ResolveTypeStruct<class,suppress,offset,size,isOrAsOp>,

| D(Dict), S(StkPtr) S(Cls|Nullptr), LA

Applies class/alias resolution on the type structure that is at the stack

offset given by S0 and offset. If size > 1, combine the type structures on

the stack into the first one's denoted holes. Returns a copy.

S1 is the calling class, used to resolve the this typehint.

If isOrAsOp is set, raises an error if S0 contains traits, function types or

typevars.

If there is an error during type structure resolution, this instruction raises

an error. If suppress is set, this error is demoted to a warning.

| IsTypeStruct<handle>, D(Bool), S(Dict) S(Cell), LA

Returns whether S1 matches the type structure of a defined type in S0 and S1

is a subtype of S0. The input type structure (S0) must be resolved.

Handle is used for caching purposes.

| IsTypeStructShallow<handle>, D(Bool), S(Dict) S(Cell), LA

Returns whether S1 matches the type structure of a defined type in S0 and S1

is a subtype of S0 (but without recursive behavior, matching the semantics of

VerifyReifiedLocalType). The input type structure (S0) must be resolved.

Handle is used for caching purposes.

| IsTypeStructCached, D(Bool), S(Dict) S(Cell), B|LA

Checks if S0 is cached in TSClassCache and if so, returns whehter S1 is a

subtype of S0. Otherwise, it branches.

| ProfileIsTypeStruct<handle>, ND, S(Dict), LA|ND

Profile S0 to determine whether S0 is a type structure holding a reference to

a Class*.

| ThrowAsTypeStructException, ND, S(Dict) S(Cell), LA|T

Throws an TypehintViolationException indicating why S1 does not match the type structure of a

defined type in S0 or why S1 is not a subtype of S0. The input type structure

(S0) must be resolved.

| ThrowAsTypeStructError, ND, S(Dict) S(Cell), LA|T

Throws a recoverable error indicating why S1 does not match the type structure of a

defined type in S0 or why S1 is not a subtype of S0. The input type structure

(S0) must be resolved.

| RaiseErrorOnInvalidIsAsExpressionType, D(Dict), S(Dict), LA

Raises an error if the type hint for is/as expression contains an invalid

type such as callables, erased type variables and trait type hints.

The input type structure (S0) must be resolved.

| ProfileCoeffectFunParam<handle>, ND, S(Cell), ND

Profile S0 to determine which code paths to emit for coeffect fun param.

| HasToString, D(Bool), S(Obj), NF

Returns whether the object S0 has a toString method.

| IsType<T>, D(Bool), S(Cell), NF

Sets D to true iff S0 holds a value that is of type T. T must not be a

specialized type.

| IsNType<T>, D(Bool), S(Cell), NF

Sets D to true iff S0 holds a value that is not of type T. T must not be a

specialized type.

| IsTypeMem<T>, D(Bool), S(Mem), NF

Sets D to true iff the value referenced by S0 is of type T. T must not be a

specialized type.

The value in S0 must not be a pointer into the evaluation stack or frame

locals.

| IsNTypeMem<T>, D(Bool), S(Mem), NF

Sets D to true iff the value referenced by S0 is not of type T. T must not be

a specialized type.

| IsWaitHandle, D(Bool), S(Obj), NF

Sets D to true iff S0 is a subclass of WaitHandle.

| IsCol, D(Bool), S(Obj), NF

Sets D to true iff S0 is a collection.

| FuncHasReifiedGenerics, D(Bool), S(Func), NF

Set D to true iff S0 is a reified function.

| ClassHasReifiedGenerics, D(Bool), S(Cls), NF

Set D to true iff S0 is a reified class.

| GetClsRGProp, D(Vec), S(Cls) S(Obj), PRc

Get the reified generics property for object S1, using the

index of this property as stored in class S0.

| HasReifiedParent, D(Bool), S(Cls), NF

Set D to true iff S0 has a reified parent.

| ReifiedInit, ND, S(Cls) S(Vec) S(Obj), LA

Invokes setReifiedInit on S2 if S0 or its parent is a reified class,

using the generics specified in S1.

| CallViolatesModuleBoundary<caller>, D(Bool), S(Func OR Cls), NF

Set D to true iff function call from caller to S0 violates module boundary.

Requires that S0 is an internal method.

5. Branches

| JmpZero, ND, S(Int OR Bool), B

| JmpNZero, ND, S(Int OR Bool), B

Conditionally jump to based on S0.

| JmpExit, ND, S(TCA) S(StkPtr) S(FramePtr), T

Jump to the specified target S0, leaving the region. The binding of the target

could be achieved using opcodes such as LdBindAddr, LdSwitchDest, etc.

| ProfileSwitchDest<handle,nCases>, ND, S(Int), NF

Profile a switch statement target.

| LdSwitchDest<cases, targets>, D(TCA), S(Int), NF

Load the target of a switch statement, using table metadata <JmpSwitchData>

and index S0, which must be a valid index in the jump table.

| LdSSwitchDest<numCases, cases, defaultOffset, bcSPOff>, D(TCA), S(Str), NF

Using the cases in the extra data, create a hash table for destination lookup.

Then, lookup the destination for the switched value in the table and yield the

default if not present.

| CheckSurpriseFlags, ND, S(FramePtr OR StkPtr), B

Tests the implementation-specific surprise flags. If they're true, branches

to block B. This is done by comparing an evaluation stack pointer to the RDS

stackLimitAndSurprise word. Note that in a resumed, the frame pointer is not

pointing into the eval stack, so S0 should be a StkPtr in that case.

| HandleRequestSurprise, ND, NA, NF

Generate exceptions based on surprise flags on a per request basis.

Make sure CheckSurpriseFlags is true before calling HandleRequestSurprise.

| ReturnHook, ND, S(FramePtr) S(Cell), NF

Surprise flag hook for function returns.

| SuspendHookAwaitEF, ND, S(FramePtr) S(FramePtr) S(Obj), NF

Surprise flag hook for suspending eagerly executing async functions. The S0

frame was already teleported into S1. Decrefs S2 if it throws an exception.

| SuspendHookAwaitEG, ND, S(FramePtr) S(Obj), NF

Surprise flag hook for suspending eagerly executing async generators. The S0

frame has an associated AG, which is already linked to the newly constructed

AGWH in the blocked state. Decrefs S1 if it throws an exception.

| SuspendHookAwaitR, ND, S(FramePtr) S(Obj), NF

Surprise flag hook for suspending async functions and async generators resumed

at Await. The S0 frame has an associated AFWH/AGWH still in the running state,

S1 points to the child WH we are going to block on.

| SuspendHookCreateCont, ND, S(FramePtr) S(FramePtr) S(Obj), NF

Surprise flag hook for suspending generators and async generators during their

invocation. The S0 frame was already teleported into S1. Decrefs S2 if it

throws an exception.

| SuspendHookYield, ND, S(FramePtr), NF

Surprise flag hook for suspending generators and async generators at Yield.

| Unreachable<AssertReason>, ND, NA, T

Indicates an unreachable code path. Any instructions that are post-dominated

by an Unreachable may be treated as unreachable by the optimizer, and the

behavior of a program that attempts to execute an Unreachable is undefined.

| EndBlock<spOff, func, AssertReason>, ND, NA, T

Halt execution, without implying anything about the reachability of

instructions preceding this. Intended for use in internal tests or other code

not meant to be executed.

| Jmp, ND, SVar(Top), B|T

Unconditional jump to block B. In the second form, the target block must

start with a DefLabel with the same number of destinations as Jmp's number of

sources. Jmp parallel-copies its sources to the DefLabel destinations.

| DefLabel, DMulti, NA, NF

DefLabel defines variables received from a previous Jmp. A DefLabel with zero

destinations is a no-op, and the predecessor blocks may not necessarily end

in Jmp. A DefLabel with one or more destinations may only be reached by a Jmp

instruction with the same number of sources. Ordinary branch instructions may

not pass values to a DefLabel.

| Select, DUnion(1,2), S(Bool OR Int) S(Top) S(Top), NF

If S0 is true/non-zero, return S1, otherwise return S2.

6. Loads

| LdStk<T,offset>, DParam(Cell), S(StkPtr), NF

Loads from S0 at offset (in cells), and puts the value in D as type T.

| LdLoc<T,localId>, DParam(Cell), S(FramePtr), NF

Loads local slot localId from the frame S0 and puts the value in D as type T.

| LdLocForeign<T>, DParam(Cell), S(FramePtr) S(Int), NF

Loads local slot S1 from the frame S0 and puts the value in D as type T.

Note that it does not perform the local optimizations that LdLoc does.

Users of this opcode need to ensure that the local is not optimized away.

| LdStkAddr<offset>, D(PtrToStk), S(StkPtr), NF

Loads the address of the stack slot given by the pointer in S0 at the given

stack offset (measured in cells).

| LdLocAddr<localId>, D(PtrToFrame), S(FramePtr), NF

Loads the address of the local slot localId from the frame S0 into D.

| LdRDSAddr<T,RDSHandle>, DParam(Ptr), NA, NF

Load the address of a Cell that lives at the specified RDS handle.

| LdInitRDSAddr<T,RDSHandle>, DParam(Ptr), NA, B

Load the address of a Cell that lives at the specified RDS handle. Branch if

the value at that address is Uninit.

| LdPairElem, D(InitCell), S(Obj) S(Int), NF

Load the element at S1 out of the Pair collection at S0.

| LdMem<T>, DParam(Cell), S(Mem), NF

Loads from S0 and puts the value in D.

| LdTVFromRDS<T,RDSHandle,includeAux>, DParam(InitCell), NA, NF

Load the TypedValue from the specified RDS handle. Must load the aux bits if

`includeAux` is true.

| LdContField<T>, DParam(Cell), S(Obj) C(Int), NF

Loads a property from the object referenced by S0 at the offset given by S1

and puts the value in D. S0 must be a Generator.

| LdClsInitElem<idx>, D(Cell), S(PtrToClsInit), NF

Load the cell at index `idx` from the class init vector at S0 into D0.

| LdColVec, D(Vec), S(Obj), NF

Load the vec array backing a collection instance in S0, which must be a

Vector or ImmVector, and that specific object type must be known at compile

time.

| LdColDict, D(Dict), S(Obj), NF

Load the dict array backing a collection instance in S0, which must be a

Map, Set, ImmMap, or ImmSet, and that specific object type must be known at

compile time.

| LdIterPos<iterId>, D(Int), S(FramePtr), NF

| LdIterEnd<iterId>, D(Int), S(FramePtr), NF

Load the specified field of the iterator at `iterId`. These ops should only

be generated for iterators known to have a specialized type and the values

interpreted accordingly. If the iterator type is pointer based, use

IntAsPtrToElem to obtain the pointer.

| LdFrameThis, DParam(Obj), S(FramePtr), NF

Loads into D the value of m_this from S0.

| LdFrameCls, DParam(Cls), S(FramePtr), NF

Loads into D the value of m_cls from S0.

| LdPublicFunc, D(Func), S(FramePtr), NF

Load the first function in the stack (beginning with S(0)) that is not marked

as AttrNoInjection. If no such function is available then the function from

S(0) is returned instead.

| LdClsCtor, D(Func), S(Cls) S(Func), NF

Loads into D the constructor of class S0. If the constructor cannot be called

from the context of the func S1, raise an error.

| LdSmashable, D(Smashable), NA, NF

Loads a smashable value. The initial value is set to (1 << addr) + 1, where

addr is a pointer pointing to the value in TC. The lowest bit is set for

convenience of checking whether the value was already smashed.