/*

 * Copyright (C) 2009 Apple Inc. All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

 */

#include "config.h"

#include "JIT.h"

#if ENABLE(JIT)

#include "JITInlineMethods.h"

#include "JITStubCall.h"

#include "JSArray.h"

#include "JSCell.h"

#include "JSFunction.h"

#include "JSPropertyNameIterator.h"

#include "LinkBuffer.h"

namespace JSC {

#if USE(JSVALUE32_64)

void JIT::privateCompileCTIMachineTrampolines(RefPtr<ExecutablePool>* executablePool, JSGlobalData* globalData, CodePtr* ctiStringLengthTrampoline, CodePtr* ctiVirtualCallLink, CodePtr* ctiVirtualCall, CodePtr* ctiNativeCallThunk)

{

#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)

    // (1) This function provides fast property access for string length

    Label stringLengthBegin = align();

    // regT0 holds payload, regT1 holds tag

    Jump string_failureCases1 = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));

    Jump string_failureCases2 = branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsStringVPtr));

    // Checks out okay! - get the length from the Ustring.

    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSString, m_value) + OBJECT_OFFSETOF(UString, m_rep)), regT2);

    load32(Address(regT2, OBJECT_OFFSETOF(UString::Rep, len)), regT2);

    Jump string_failureCases3 = branch32(Above, regT2, Imm32(INT_MAX));

    move(regT2, regT0);

    move(Imm32(JSValue::Int32Tag), regT1);

    ret();

#endif

    // (2) Trampolines for the slow cases of op_call / op_call_eval / op_construct.

#if ENABLE(JIT_OPTIMIZE_CALL)

    // VirtualCallLink Trampoline

    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.

    Label virtualCallLinkBegin = align();

    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);

    Jump isNativeFunc2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));

    Jump hasCodeBlock2 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));

    preserveReturnAddressAfterCall(regT3);

    restoreArgumentReference();

    Call callJSFunction2 = call();

    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);

    emitGetJITStubArg(2, regT1); // argCount

    restoreReturnAddressBeforeReturn(regT3);

    hasCodeBlock2.link(this);

    // Check argCount matches callee arity.

    Jump arityCheckOkay2 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);

    preserveReturnAddressAfterCall(regT3);

    emitPutJITStubArg(regT3, 1); // return address

    restoreArgumentReference();

    Call callArityCheck2 = call();

    move(regT1, callFrameRegister);

    emitGetJITStubArg(2, regT1); // argCount

    restoreReturnAddressBeforeReturn(regT3);

    arityCheckOkay2.link(this);

    isNativeFunc2.link(this);

    compileOpCallInitializeCallFrame();

    preserveReturnAddressAfterCall(regT3);

    emitPutJITStubArg(regT3, 1); // return address

    restoreArgumentReference();

    Call callLazyLinkCall = call();

    restoreReturnAddressBeforeReturn(regT3);

    jump(regT0);

#endif // ENABLE(JIT_OPTIMIZE_CALL)

    // VirtualCall Trampoline

    // regT0 holds callee, regT1 holds argCount.  regT2 will hold the FunctionExecutable.

    Label virtualCallBegin = align();

    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);

    Jump isNativeFunc3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));

    Jump hasCodeBlock3 = branch32(GreaterThan, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), Imm32(0));

    preserveReturnAddressAfterCall(regT3);

    restoreArgumentReference();

    Call callJSFunction1 = call();

    emitGetJITStubArg(2, regT1); // argCount

    restoreReturnAddressBeforeReturn(regT3);

    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);

    hasCodeBlock3.link(this);

    // Check argCount matches callee arity.

    Jump arityCheckOkay3 = branch32(Equal, Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_numParameters)), regT1);

    preserveReturnAddressAfterCall(regT3);

    emitPutJITStubArg(regT3, 1); // return address

    restoreArgumentReference();

    Call callArityCheck1 = call();

    move(regT1, callFrameRegister);

    emitGetJITStubArg(2, regT1); // argCount

    restoreReturnAddressBeforeReturn(regT3);

    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSFunction, m_executable)), regT2);

    arityCheckOkay3.link(this);

    isNativeFunc3.link(this);

    compileOpCallInitializeCallFrame();

    loadPtr(Address(regT2, OBJECT_OFFSETOF(FunctionExecutable, m_jitCode)), regT0);

    jump(regT0);

#if PLATFORM(X86)

    Label nativeCallThunk = align();

    preserveReturnAddressAfterCall(regT0);

    emitPutToCallFrameHeader(regT0, RegisterFile::ReturnPC); // Push return address

    // Load caller frame's scope chain into this callframe so that whatever we call can

    // get to its global data.

    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, regT1);

    emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1, regT1);

    emitPutToCallFrameHeader(regT1, RegisterFile::ScopeChain);

    emitGetFromCallFrameHeader32(RegisterFile::ArgumentCount, regT0);

    /* We have two structs that we use to describe the stackframe we set up for our

     * call to native code.  NativeCallFrameStructure describes the how we set up the stack

     * in advance of the call.  NativeFunctionCalleeSignature describes the callframe

     * as the native code expects it.  We do this as we are using the fastcall calling

     * convention which results in the callee popping its arguments off the stack, but

     * not the rest of the callframe so we need a nice way to ensure we increment the

     * stack pointer by the right amount after the call.

     */

#if COMPILER(MSVC) || PLATFORM(LINUX)

#if COMPILER(MSVC)

#pragma pack(push)

#pragma pack(4)

#endif // COMPILER(MSVC)

    struct NativeCallFrameStructure {

      //  CallFrame* callFrame; // passed in EDX

        JSObject* callee;

        JSValue thisValue;

        ArgList* argPointer;

        ArgList args;

        JSValue result;

    };

    struct NativeFunctionCalleeSignature {

        JSObject* callee;

        JSValue thisValue;

        ArgList* argPointer;

    };

#if COMPILER(MSVC)

#pragma pack(pop)

#endif // COMPILER(MSVC)

#else

    struct NativeCallFrameStructure {

      //  CallFrame* callFrame; // passed in ECX

      //  JSObject* callee; // passed in EDX

        JSValue thisValue;

        ArgList* argPointer;

        ArgList args;

    };

    struct NativeFunctionCalleeSignature {

        JSValue thisValue;

        ArgList* argPointer;

    };

#endif

    const int NativeCallFrameSize = (sizeof(NativeCallFrameStructure) + 15) & ~15;

    // Allocate system stack frame

    subPtr(Imm32(NativeCallFrameSize), stackPointerRegister);

    // Set up arguments

    subPtr(Imm32(1), regT0); // Don't include 'this' in argcount

    // push argcount

    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_argCount)));

    // Calculate the start of the callframe header, and store in regT1

    addPtr(Imm32(-RegisterFile::CallFrameHeaderSize * (int)sizeof(Register)), callFrameRegister, regT1);

    // Calculate start of arguments as callframe header - sizeof(Register) * argcount (regT0)

    mul32(Imm32(sizeof(Register)), regT0, regT0);

    subPtr(regT0, regT1);

    storePtr(regT1, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, args) + OBJECT_OFFSETOF(ArgList, m_args)));

    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)

    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, args)), stackPointerRegister, regT0);

    storePtr(regT0, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, argPointer)));

    // regT1 currently points to the first argument, regT1 - sizeof(Register) points to 'this'

    loadPtr(Address(regT1, -(int)sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);

    loadPtr(Address(regT1, -(int)sizeof(Register) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)), regT3);

    storePtr(regT2, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)));

    storePtr(regT3, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, thisValue) + OBJECT_OFFSETOF(JSValue, u.asBits.tag)));

#if COMPILER(MSVC) || PLATFORM(LINUX)

    // ArgList is passed by reference so is stackPointerRegister + 4 * sizeof(Register)

    addPtr(Imm32(OBJECT_OFFSETOF(NativeCallFrameStructure, result)), stackPointerRegister, X86Registers::ecx);

    // Plant callee

    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::eax);

    storePtr(X86Registers::eax, Address(stackPointerRegister, OBJECT_OFFSETOF(NativeCallFrameStructure, callee)));

    // Plant callframe

    move(callFrameRegister, X86Registers::edx);

    call(Address(X86Registers::eax, OBJECT_OFFSETOF(JSFunction, m_data)));

    // JSValue is a non-POD type, so eax points to it

    emitLoad(0, regT1, regT0, X86Registers::eax);

#else

    emitGetFromCallFrameHeaderPtr(RegisterFile::Callee, X86Registers::edx); // callee

    move(callFrameRegister, X86Registers::ecx); // callFrame

    call(Address(X86Registers::edx, OBJECT_OFFSETOF(JSFunction, m_data)));

#endif

    // We've put a few temporaries on the stack in addition to the actual arguments

    // so pull them off now

    addPtr(Imm32(NativeCallFrameSize - sizeof(NativeFunctionCalleeSignature)), stackPointerRegister);

    // Check for an exception

    move(ImmPtr(&globalData->exception), regT2);

    Jump sawException = branch32(NotEqual, tagFor(0, regT2), Imm32(JSValue::EmptyValueTag));

    // Grab the return address.

    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT3);

    // Restore our caller's "r".

    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);

    // Return.

    restoreReturnAddressBeforeReturn(regT3);

    ret();

    // Handle an exception

    sawException.link(this);

    // Grab the return address.

    emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT1);

    move(ImmPtr(&globalData->exceptionLocation), regT2);

    storePtr(regT1, regT2);

    move(ImmPtr(FunctionPtr(ctiVMThrowTrampoline).value()), regT2);

    emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);

    poke(callFrameRegister, OBJECT_OFFSETOF(struct JITStackFrame, callFrame) / sizeof (void*));

    restoreReturnAddressBeforeReturn(regT2);

    ret();

#elif ENABLE(JIT_OPTIMIZE_NATIVE_CALL)

#error "JIT_OPTIMIZE_NATIVE_CALL not yet supported on this platform."

#else

    breakpoint();

#endif

#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)

    Call string_failureCases1Call = makeTailRecursiveCall(string_failureCases1);

    Call string_failureCases2Call = makeTailRecursiveCall(string_failureCases2);

    Call string_failureCases3Call = makeTailRecursiveCall(string_failureCases3);

#endif

    // All trampolines constructed! copy the code, link up calls, and set the pointers on the Machine object.

    LinkBuffer patchBuffer(this, m_globalData->executableAllocator.poolForSize(m_assembler.size()));

#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)

    patchBuffer.link(string_failureCases1Call, FunctionPtr(cti_op_get_by_id_string_fail));

    patchBuffer.link(string_failureCases2Call, FunctionPtr(cti_op_get_by_id_string_fail));

    patchBuffer.link(string_failureCases3Call, FunctionPtr(cti_op_get_by_id_string_fail));

#endif

    patchBuffer.link(callArityCheck1, FunctionPtr(cti_op_call_arityCheck));

    patchBuffer.link(callJSFunction1, FunctionPtr(cti_op_call_JSFunction));

#if ENABLE(JIT_OPTIMIZE_CALL)

    patchBuffer.link(callArityCheck2, FunctionPtr(cti_op_call_arityCheck));

    patchBuffer.link(callJSFunction2, FunctionPtr(cti_op_call_JSFunction));

    patchBuffer.link(callLazyLinkCall, FunctionPtr(cti_vm_lazyLinkCall));

#endif

    CodeRef finalCode = patchBuffer.finalizeCode();

    *executablePool = finalCode.m_executablePool;

    *ctiVirtualCall = trampolineAt(finalCode, virtualCallBegin);

    *ctiNativeCallThunk = trampolineAt(finalCode, nativeCallThunk);

#if ENABLE(JIT_OPTIMIZE_PROPERTY_ACCESS)

    *ctiStringLengthTrampoline = trampolineAt(finalCode, stringLengthBegin);

#else

    UNUSED_PARAM(ctiStringLengthTrampoline);

#endif

#if ENABLE(JIT_OPTIMIZE_CALL)

    *ctiVirtualCallLink = trampolineAt(finalCode, virtualCallLinkBegin);

#else

    UNUSED_PARAM(ctiVirtualCallLink);

#endif

}

void JIT::emit_op_mov(Instruction* currentInstruction)

{

    unsigned dst = currentInstruction[1].u.operand;

    unsigned src = currentInstruction[2].u.operand;

    if (m_codeBlock->isConstantRegisterIndex(src))

        emitStore(dst, getConstantOperand(src));

    else {

        emitLoad(src, regT1, regT0);

        emitStore(dst, regT1, regT0);

        map(m_bytecodeIndex + OPCODE_LENGTH(op_mov), dst, regT1, regT0);

    }

}

void JIT::emit_op_end(Instruction* currentInstruction)

{

    if (m_codeBlock->needsFullScopeChain())

        JITStubCall(this, cti_op_end).call();

    ASSERT(returnValueRegister != callFrameRegister);

    emitLoad(currentInstruction[1].u.operand, regT1, regT0);

    restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));

    ret();

}

void JIT::emit_op_jmp(Instruction* currentInstruction)

{

    unsigned target = currentInstruction[1].u.operand;

    addJump(jump(), target);

}

void JIT::emit_op_loop(Instruction* currentInstruction)

{

    unsigned target = currentInstruction[1].u.operand;

    emitTimeoutCheck();

    addJump(jump(), target);

}

void JIT::emit_op_loop_if_less(Instruction* currentInstruction)

{

    unsigned op1 = currentInstruction[1].u.operand;

    unsigned op2 = currentInstruction[2].u.operand;

    unsigned target = currentInstruction[3].u.operand;

    emitTimeoutCheck();

    if (isOperandConstantImmediateInt(op1)) {

        emitLoad(op2, regT1, regT0);

        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));

        addJump(branch32(GreaterThan, regT0, Imm32(getConstantOperand(op1).asInt32())), target);

        return;

    }

    if (isOperandConstantImmediateInt(op2)) {

        emitLoad(op1, regT1, regT0);

        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));

        addJump(branch32(LessThan, regT0, Imm32(getConstantOperand(op2).asInt32())), target);

        return;

    }

    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);

    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));

    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));

    addJump(branch32(LessThan, regT0, regT2), target);

}

void JIT::emitSlow_op_loop_if_less(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

    unsigned op1 = currentInstruction[1].u.operand;

    unsigned op2 = currentInstruction[2].u.operand;

    unsigned target = currentInstruction[3].u.operand;

    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))

        linkSlowCase(iter); // int32 check

    linkSlowCase(iter); // int32 check

    JITStubCall stubCall(this, cti_op_loop_if_less);

    stubCall.addArgument(op1);

    stubCall.addArgument(op2);

    stubCall.call();

    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);

}

void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)

{

    unsigned op1 = currentInstruction[1].u.operand;

    unsigned op2 = currentInstruction[2].u.operand;

    unsigned target = currentInstruction[3].u.operand;

    emitTimeoutCheck();

    if (isOperandConstantImmediateInt(op1)) {

        emitLoad(op2, regT1, regT0);

        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));

        addJump(branch32(GreaterThanOrEqual, regT0, Imm32(getConstantOperand(op1).asInt32())), target);

        return;

    }

    if (isOperandConstantImmediateInt(op2)) {

        emitLoad(op1, regT1, regT0);

        addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));

        addJump(branch32(LessThanOrEqual, regT0, Imm32(getConstantOperand(op2).asInt32())), target);

        return;

    }

    emitLoad2(op1, regT1, regT0, op2, regT3, regT2);

    addSlowCase(branch32(NotEqual, regT1, Imm32(JSValue::Int32Tag)));

    addSlowCase(branch32(NotEqual, regT3, Imm32(JSValue::Int32Tag)));

    addJump(branch32(LessThanOrEqual, regT0, regT2), target);

}

void JIT::emitSlow_op_loop_if_lesseq(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

    unsigned op1 = currentInstruction[1].u.operand;

    unsigned op2 = currentInstruction[2].u.operand;

    unsigned target = currentInstruction[3].u.operand;

    if (!isOperandConstantImmediateInt(op1) && !isOperandConstantImmediateInt(op2))

        linkSlowCase(iter); // int32 check

    linkSlowCase(iter); // int32 check

    JITStubCall stubCall(this, cti_op_loop_if_lesseq);

    stubCall.addArgument(op1);

    stubCall.addArgument(op2);

    stubCall.call();

    emitJumpSlowToHot(branchTest32(NonZero, regT0), target);

}

void JIT::emit_op_new_object(Instruction* currentInstruction)

{

    JITStubCall(this, cti_op_new_object).call(currentInstruction[1].u.operand);

}

void JIT::emit_op_instanceof(Instruction* currentInstruction)

{

    unsigned dst = currentInstruction[1].u.operand;

    unsigned value = currentInstruction[2].u.operand;

    unsigned baseVal = currentInstruction[3].u.operand;

    unsigned proto = currentInstruction[4].u.operand;

    // Load the operands into registers.

    // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.

    emitLoadPayload(value, regT2);

    emitLoadPayload(baseVal, regT0);

    emitLoadPayload(proto, regT1);

    // Check that value, baseVal, and proto are cells.

    emitJumpSlowCaseIfNotJSCell(value);

    emitJumpSlowCaseIfNotJSCell(baseVal);

    emitJumpSlowCaseIfNotJSCell(proto);

    // Check that baseVal 'ImplementsDefaultHasInstance'.

    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT0);

    addSlowCase(branchTest32(Zero, Address(regT0, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(ImplementsDefaultHasInstance)));

    // Optimistically load the result true, and start looping.

    // Initially, regT1 still contains proto and regT2 still contains value.

    // As we loop regT2 will be updated with its prototype, recursively walking the prototype chain.

    move(Imm32(JSValue::TrueTag), regT0);

    Label loop(this);

    // Load the prototype of the cell in regT2.  If this is equal to regT1 - WIN!

    // Otherwise, check if we've hit null - if we have then drop out of the loop, if not go again.

    loadPtr(Address(regT2, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);

    load32(Address(regT2, OBJECT_OFFSETOF(Structure, m_prototype) + OBJECT_OFFSETOF(JSValue, u.asBits.payload)), regT2);

    Jump isInstance = branchPtr(Equal, regT2, regT1);

    branchTest32(NonZero, regT2).linkTo(loop, this);

    // We get here either by dropping out of the loop, or if value was not an Object.  Result is false.

    move(Imm32(JSValue::FalseTag), regT0);

    // isInstance jumps right down to here, to skip setting the result to false (it has already set true).

    isInstance.link(this);

    emitStoreBool(dst, regT0);

}

void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)

{

    unsigned dst = currentInstruction[1].u.operand;

    unsigned value = currentInstruction[2].u.operand;

    unsigned baseVal = currentInstruction[3].u.operand;

    unsigned proto = currentInstruction[4].u.operand;

    linkSlowCaseIfNotJSCell(iter, value);

    linkSlowCaseIfNotJSCell(iter, baseVal);

    linkSlowCaseIfNotJSCell(iter, proto);

    linkSlowCase(iter);

    JITStubCall stubCall(this, cti_op_instanceof);

    stubCall.addArgument(value);

    stubCall.addArgument(baseVal);

    stubCall.addArgument(proto);

    stubCall.call(dst);

}

void JIT::emit_op_new_func(Instruction* currentInstruction)

{

    JITStubCall stubCall(this, cti_op_new_func);

    stubCall.addArgument(ImmPtr(m_codeBlock->functionDecl(currentInstruction[2].u.operand)));

    stubCall.call(currentInstruction[1].u.operand);

}

void JIT::emit_op_get_global_var(Instruction* currentInstruction)

{

    int dst = currentInstruction[1].u.operand;

    JSGlobalObject* globalObject = static_cast<JSGlobalObject*>(currentInstruction[2].u.jsCell);

    ASSERT(globalObject->isGlobalObject());

    int index = currentInstruction[3].u.operand;