Opcodes of the Hermes virtual machine

With the opcode byte value indicated respective to each stable version of the React Native Hermes VM bytecode format, as well as the auto-generated documentation from the "BytecodeList.def" file from the Hermes VM source tree.

This list of opcodes is used by the hermes-dec open-source reverse engineering project.

Instruction Bytecode version to opcode Documentation
51585962707376838489909295979899
Add21212121212121222222222222223030 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 + Arg3 (JS addition/concatenation)
Add32185190190192192 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 + Arg3 (32-bit integer addition)
AddEmptyString113115116116116116116121121126126128128136157158 Reg8, Reg8 (total size 2)

Convert a value to a string as if evaluating the expression:
Arg1 = "" + Arg2
In practice this means
Arg1 = ToString(ToPrimitive(Arg2, PreferredType::NONE))
with ToPrimitive (ES5.1 9.1) and ToString (ES5.1 9.8).
AddN22222222222222232323232323233131 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 + Arg3 (Numeric addition, skips number check)
AddOwnPrivateBySym100100 Reg8, Reg8, Reg8 (total size 3)

Add a private property to an object. This must be a new property.
The property will be added with the privateName flag set on the PropertyFlags.
Arg1[Arg2] = Arg3
AddS243232 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 + Arg3 (String concat, skips string check)
AsyncBreakCheck91919191949496969898110126126 (total size 0)

Fast check for an async interrupt request.
BitAnd33333333333333343434343434354343 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 & Arg3 (JS bitwise AND)
BitNot11111111111111121212121212122020 Reg8, Reg8 (total size 2)

Arg1 = ~Arg2 (Bitwise not)
BitOr35353535353535363636363636374545 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 | Arg3 (JS bitwise OR)
BitXor34343434343434353535353535364444 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 ^ Arg3 (JS bitwise XOR)
CacheNewObject15 Reg8, Reg8, UInt32, UInt8 (total size 7)

Perform a lookup on the new object cache.
Arg1 = the 'this' value to lookup
Arg2 = the new target to determine whether it is a constructor call
Arg3 = the index in the shape table.
Arg4 = the cache index within the current function
Call7474747474747475757777797993106106 Reg8, Reg8, UInt8 (total size 3)

Call a function.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame.
Call17676767676767677777979818195108108 Reg8, Reg8, Reg8 (total size 3)

Call a function with one arg.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Call27878787878787879798181838397110110 Reg8, Reg8, Reg8, Reg8 (total size 4)

Call a function with two args.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Arg4 is the second argument.
Call37979797979797980808282848498111111 Reg8, Reg8, Reg8, Reg8, Reg8 (total size 5)

Call a function with three args.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Arg4 is the second argument.
Arg5 is the third argument.
Call48080808080808081818383858599112112 Reg8, Reg8, Reg8, Reg8, Reg8, Reg8 (total size 6)

Call a function with four args.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Arg4 is the second argument.
Arg5 is the third argument.
Arg6 is the fourth argument.
CallBuiltin84848484848484858587878989101115115 Reg8, UInt8, UInt8 (total size 3)

Call a builtin function.
Note this is NOT marked as a Ret target, because the callee is native
and therefore never JS.
Arg1 is the destination of the return value.
Arg2 is the builtin number.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame.
thisArg is set to "undefined".
CallBuiltinLong868688889090102116116 Reg8, UInt8, UInt32 (total size 6)

Call a builtin function.
Note this is NOT marked as a Ret target, because the callee is native
and therefore never JS.
Arg1 is the destination of the return value.
Arg2 is the builtin number.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame.
thisArg is set to "undefined".
CallDirect77777777777777787880808282 Reg8, UInt8, UInt16 (function_id) (total size 4)

Call a function directly without a closure.
Arg1 is the destination of the return value.
Arg2 is the number of arguments, assumed to be found in reverse order
from the end of the current frame. The first argument 'this'
is assumed to be created with CreateThis.
Arg3 is index in the function table.
Note that we expect the variable-sized argument to be last.
CallDirectLongIndex83838383838383848486868888 Reg8, UInt8, UInt32 (total size 6)

Identical to CallDirect, but the function index is 32-bit.
CallLong81818181818181828284848686 Reg8, Reg8, UInt32 (total size 6)

Identical to Call, but allowing more arguments.
CallRequire114114 Reg8, Reg8, UInt32 (total size 6)

A Metro require call.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the module index argument, as an immediate.
CallWithNewTarget96109109 Reg8, Reg8, Reg8, UInt8 (total size 4)

Call a function with an explicitly specified `new.target`.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the value of new.target
Arg4 is the number of arguments, assumed to be found in reverse order
from the end of the current frame.
CallWithNewTargetLong100113113 Reg8, Reg8, Reg8, Reg8 (total size 4)

Identical to CallWithNewTarget, but allowing more arguments.
arg4 is a register containing a number, instead of a literal number.
This is done to decrease the size of this opcode.
Catch86868686868686898991919393105119119 Reg8 (total size 1)

Catch an exception (the first instruction in an exception handler).
} catch(Arg1) {
CoerceThisNS109111112112112112112117117121121123123131152152 Reg8, Reg8 (total size 2)

Coerce a value assumed to contain 'this' to an object using non-strict
mode rules. Primitives are boxed, \c null or \c undefed produce the global
object.
Arg1 = coerce_to_object(Arg2)
CompleteGenerator123124124124124124129129134134136136 (total size 0)

Set the generator status to complete, but do not return.
Construct7575757575757576767878808094107107 Reg8, Reg8, UInt8 (total size 3)

Call a constructor, with semantics identical to Call.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame. The first argument 'this'
is assumed to be created with CreateThis.
ConstructLong82828282828282838385858787 Reg8, Reg8, UInt32 (total size 6)

Identical to Construct, but allowing more arguments.
CreateAsyncClosure100100102102104104 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a closure for an AsyncFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateAsyncClosureLongIndex101101103103105105 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a closure for an AsyncFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateBaseClass128128 Reg8, Reg8, Reg8, UInt16 (total size 5)

Create a base class.
Arg1 is the output register for the the closure.
Arg2 is the output register for the home object.
Arg3 is the current environment.
Arg4 is index in the function table.
CreateBaseClassLongIndex129129 Reg8, Reg8, Reg8, UInt32 (total size 7)

Create a base class.
Arg1 is the output register for the the closure.
Arg2 is the output register for the home object.
Arg3 is the current environment.
Arg4 is index in the function table.
CreateClosure9393949494949496969898100100112132132 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a closure.
Arg1 is the register in which to store the closure.
Arg2 is the parent environment of the closure, or undefined.
Arg3 is index in the function table.
CreateClosureLongIndex9494959595959597979999101101113133133 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a closure.
Arg1 is the register in which to store the closure.
Arg2 is the parent environment of the closure, or undefined.
Arg3 is index in the function table.
CreateDerivedClass130130 Reg8, Reg8, Reg8, Reg8, UInt16 (total size 6)

Create a derived class.
Arg1 is the output register for the the closure.
Arg2 is the output register for the home object.
Arg3 is the current environment.
Arg4 is the superClass.
Arg5 is index in the function table.
CreateDerivedClassLongIndex131131 Reg8, Reg8, Reg8, Reg8, UInt32 (total size 8)

Create a derived class.
Arg1 is the output register for the the closure.
Arg2 is the output register for the home object.
Arg3 is the current environment.
Arg4 is the superClass.
Arg5 is index in the function table.
CreateEnvironment47474747474747484850505050556666 Reg8, Reg8, UInt32 (total size 6)

Create a new environment with the given parent.
Arg1 is the destination.
Arg2 is the parent environment to use.
Arg3 is the size of the new environment.
CreateFunctionEnvironment536464 Reg8, UInt8 (total size 2)

Create a new environment, using the current function's enclosing environment
as the parent.
Arg1 is the destination.
Arg2 is the size of the new environment.
CreateGenerator124125125125125125130130135135137137144168169 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a generator.
Arg1 is the register in which to store the generator.
Arg2 is the parent environment of the generator, or undefined.
Arg3 is index in the function table.
CreateGeneratorClosure9596969696969898100100102102 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a closure for a GeneratorFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateGeneratorClosureLongIndex9697979797979999101101103103 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a closure for a GeneratorFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateGeneratorLongIndex125126126126126126131131136136138138145169170 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a generator.
Arg1 is the register in which to store the generator.
Arg2 is the parent environment of the generator, or undefined.
Arg3 is index in the function table.
CreateInnerEnvironment5151 Reg8, Reg8, UInt32 (total size 6)

Create a new inner environment, to store values captured by closures.
Arg1 is the destination.
Arg2 is the parent environment.
Arg3 is the number of slots in the environment.
CreatePrivateName158159 Reg8, UInt32 (string_id) (total size 5)

Create a new primitive symbol, taking in a string description as input.
This is almost equivalent to the following JS, with the important distinction
an object is not computed- just the raw SymbolID.
Arg1 is the result.
Arg2 is the string id for the symbol description.
Arg1 = new Symbol(Arg2)
CreateRegExp117119120120120120120125125130130132132142165166 Reg8, UInt32 (string_id), UInt32 (string_id), UInt32 (total size 13)

Create a regular expression.
Arg1 is the result.
Arg2 is the string index of the pattern.
Arg3 is the string index of the flags.
Arg4 is the regexp bytecode index in the regexp table.
CreateThis95979898989898102102104104106106114 Reg8, Reg8, Reg8 (total size 3)

Allocate an empty, uninitialized object (immediately before a constructor).
Arg1 is the destination register.
Arg2 is the prototype to assign it.
Arg3 is the constructor closure that will be used*.
* To allow internal constructors to have special objects allocated.
CreateThisForNew134134 Reg8, Reg8, UInt8 (total size 3)

Allocate an empty, uninitialized object to be used as the `this` parameter
in a `new` expression. Some closures are responsible for making their own
`this`, so in these cases this instruction will simply return undefined.
Arg1 is the destination register.
Arg2 is the constructor closure that will be invoked.
Arg3 is a cache index used to speed up fetching the new target prototype
property.
CreateThisForSuper135135 Reg8, Reg8, Reg8, UInt8 (total size 4)

Allocate an empty, uninitialized object to be used as the `this` parameter
in a `new` expression.
Arg1 is the destination register.
Arg2 is the constructor closure that will be invoked.
Arg3 is the new.target.
Arg4 is a cache index used to speed up fetching the new target prototype property.
CreateTopLevelEnvironment546565 Reg8, UInt32 (total size 5)

Create a top level environment, without a parent.
TODO: Consider removing this in favor of using CreateEnvironment by using a
different scheme for encoding the top level environment.
Arg1 is the destination.
Arg2 is the size of the new environment.
Debugger89899090909090939395959797109125125 (total size 0)

Implementation dependent debugger action.
DebuggerCheckBreak909091 (total size 0)

Fast check for a debugger break request.
Dec38383838394747 Reg8, Reg8 (total size 2)

Arg1 = Arg2 - 1 (JS decrement, skips number check)
DeclareGlobalVar48484848484848494951515252566767 UInt32 (string_id) (total size 4)

Declare a global variable by string table index.
The variable will be set to undefined.
DefineOwnById8686 Reg8, Reg8, UInt8, UInt16 (total size 5)

Define an object own property by string index.
Arg1[stringtable[Arg4]] = Arg2.
Arg3 is a cache index.
DefineOwnByIdLong8787 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Define an object own property by string index.
Arg1[stringtable[Arg4]] = Arg2.
Arg3 is a cache index.
DefineOwnByIndex8888 Reg8, Reg8, UInt8 (total size 3)

Assign a value to a constant integer own property which will be created as
enumerable. This is used (potentially in conjunction with
NewArrayWithBuffer) for arr=[foo,bar] initializations.
Arg1[Arg3] = Arg2;
DefineOwnByIndexL8989 Reg8, Reg8, UInt32 (total size 6)

Assign a value to a constant integer own property which will be created as
enumerable. This is used (potentially in conjunction with
NewArrayWithBuffer) for arr=[foo,bar] initializations.
Arg1[Arg3] = Arg2;
DefineOwnByVal9292 Reg8, Reg8, Reg8, UInt8 (total size 4)

Set an own property identified by value.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the property name.
Arg4 : bool -> enumerable. If true, the property is created as enumerable,
non-enumerable otherwise.
Arg1[Arg3] = Arg2;
DefineOwnGetterSetterByVal103103 Reg8, Reg8, Reg8, Reg8, UInt8 (total size 5)

Add a getter and a setter for a property by value.
Object.defineProperty(Arg1, Arg2, { get: Arg3, set: Arg4 }).
Arg1 is the target object which will have a property defined.
Arg2 is the property name
Arg3 is the getter closure or undefined
Arg4 is the setter closure or undefined
Arg5 : boolean - if true, the property will be enumerable.
DefineOwnInDenseArray9090 Reg8, Reg8, UInt8 (total size 3)

Define an own property in a dense JavaScript array at a specific index.
Requires that the array is dense and that the ArrayStorage
underlying it has a size which is greater than the arrayIndex operand.
Arg1[Arg3] = Arg2;
Arg1 is the dense array object where the property will be defined.
Arg2 is the value to be stored.
Arg3 is the array index where the property will be stored.
NOTE: The "L" version only goes up to 16-bit array indices,
because NewArray only takes UInt16 argument.
DefineOwnInDenseArrayL9191 Reg8, Reg8, UInt16 (total size 4)

Define an own property in a dense JavaScript array at a specific index.
Requires that the array is dense and that the ArrayStorage
underlying it has a size which is greater than the arrayIndex operand.
Arg1[Arg3] = Arg2;
Arg1 is the dense array object where the property will be defined.
Arg2 is the value to be stored.
Arg3 is the array index where the property will be stored.
NOTE: The "L" version only goes up to 16-bit array indices,
because NewArray only takes UInt16 argument.
DelById66666666666666676769697171 Reg8, Reg8, UInt16 (string_id) (total size 4)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByIdLong67676767676767686870707272 Reg8, Reg8, UInt32 (string_id) (total size 6)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByIdLoose80 Reg8, Reg8, UInt16 (string_id) (total size 4)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByIdLooseLong82 Reg8, Reg8, UInt32 (string_id) (total size 6)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByIdStrict81 Reg8, Reg8, UInt16 (string_id) (total size 4)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByIdStrictLong83 Reg8, Reg8, UInt32 (string_id) (total size 6)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByVal707070707070707171737375759999 Reg8, Reg8, Reg8, UInt8 (total size 4)

Delete a property by value (when the value is not known at compile time).
Arg1 = delete Arg2[Arg3]
Arg4 : Integer value set to 1 for strict mode semantics, 0 for loose.
DelByValLoose88 Reg8, Reg8, Reg8 (total size 3)

Delete a property by value (when the value is not known at compile time).
Arg1 = delete Arg2[Arg3]
DelByValStrict89 Reg8, Reg8, Reg8 (total size 3)

Delete a property by value (when the value is not known at compile time).
Arg1 = delete Arg2[Arg3]
DirectEval87878787878787909092929494106120120 Reg8, Reg8, UInt8 (total size 3)

ES6 18.2.1.1 PerformEval(Arg2, evalRealm, strictCaller=true, direct=true)
Arg1 is the destination of the return value.
Arg2 is the eval text
Arg3 is a bool indicating strictCaller
Div25252525252525262626262626273535 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (JS division)
DivN26262626262626272727272727283636 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (Numeric division, skips number check)
Divi32188193193195195 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (32-bit signed integer division)
Divu32189194194196196 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (32-bit unsigned integer division)
Eq13131313131313141414141414142222 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 == Arg3 (JS equality)
FastArrayAppend1415 Reg8, Reg8 (total size 2)

Append a FastArray onto another FastArray.
Arg1.append(Arg2)
FastArrayLength1011 Reg8, Reg8 (total size 2)

Get the length of a FastArray.
Arg1 = Arg2.length
FastArrayLoad1112 Reg8, Reg8, Reg8 (total size 3)

Load from a FastArray.
Arg1 = Arg2[Arg3]
FastArrayPush1314 Reg8, Reg8 (total size 2)

Push an element onto the end of a FastArray.
Arg1.push(Arg2)
FastArrayStore1213 Reg8, Reg8, Reg8 (total size 3)

Store to a FastArray.
Arg1[Arg2] = Arg3
GetArgumentsLength115117118118118118118123123128128130130139161162 Reg8, Reg8 (total size 2)

Get the length of the 'arguments' array.
Arg1 is the result.
Arg2 is the lazy loaded register.
Arg1 = arguments.length
GetArgumentsPropByVal114116117117117117117122122127127129129 Reg8, Reg8, Reg8 (total size 3)

Get a property of the 'arguments' array by value.
Arg1 is the result.
Arg2 is the index.
Arg3 is the lazy loaded register.
Arg1 = arguments[Arg2]
GetArgumentsPropByValLoose137159160 Reg8, Reg8, Reg8 (total size 3)

Get a property of the 'arguments' array by value.
Arg1 is the result.
Arg2 is the index.
Arg3 is the lazy loaded register.
Arg1 = arguments[Arg2]
GetArgumentsPropByValStrict138160161 Reg8, Reg8, Reg8 (total size 3)

Get a property of the 'arguments' array by value.
Arg1 is the result.
Arg2 is the index.
Arg3 is the lazy loaded register.
Arg1 = arguments[Arg2]
GetBuiltinClosure878789899191103117117 Reg8, UInt8 (total size 2)

Get a closure from a builtin function.
Arg1 is the destination of the return value.
Arg2 is the builtin number.
GetById50505050505050515153535555586969 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Get an object property by string table index.
Arg1 = Arg2[stringtable[Arg4]]
Arg3 is a cache index used to speed up the above operation.
GetByIdLong51515151515151525254545656597070 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Get an object property by string table index.
Arg1 = Arg2[stringtable[Arg4]]
Arg3 is a cache index used to speed up the above operation.
GetByIdShort49494949494949505052525454576868 Reg8, Reg8, UInt8, UInt8 (string_id) (total size 4)

Get an object property by string table index.
Arg1 = Arg2[stringtable[Arg4]]
Arg3 is a cache index used to speed up the above operation.
GetByIdWithReceiverLong7171 Reg8, Reg8, UInt8, Reg8, UInt32 (string_id) (total size 8)

Get an object property by string table index, with a specified receiver.
Arg1 = Arg2[stringtable[Arg5]]
Arg1 is the destination.
Arg2 is the object to begin the property look up.
Arg3 is a cache index used to speed up the above operation.
Arg4 is receiver.
Arg5 is the string id.
GetByIndex859494 Reg8, Reg8, UInt8 (total size 3)

Get a property by value, for the special case where the property is a
numeric literal that is a uint8_t integer. Arg1 = Arg2[Arg3]
GetByVal68686868686868696971717373849393 Reg8, Reg8, Reg8 (total size 3)

Get a property by value. Constants string values should instead use GetById.
Arg1 = Arg2[Arg3]
GetByValWithReceiver9595 Reg8, Reg8, Reg8, Reg8 (total size 4)

Get a property by value with a specified receiver.
Arg1 = Arg2[Arg3]
Arg1 is the destination register.
Arg2 is the object to begin the property look up. It must be an object.
Arg3 is the property key.
Arg4 is the receiver.
GetClosureEnvironment445454 Reg8, Reg8 (total size 2)

Get the environment from a closure.
Arg1 is the destination.
Arg2 is the closure from which to read.
GetEnvironment38383838383838393941414141435353 Reg8, Reg8, UInt8 (total size 3)

Get an environment by traversing the scope chain.
Arg1 is the destination.
Arg2 is the environment from which to start traversing.
Arg3 is the number of levels up the scope chain to go.
GetGlobalObject45454545454545464648484848516161 Reg8 (total size 1)

Get the global object (the object in which global variables are stored).
GetNewTarget46464646464646474749494949526262 Reg8 (total size 1)

Obtain the value of NewTarget from the frame.
Arg1 = NewTarget
GetNextPName7373737373737374747676787892105105 Reg8, Reg8, Reg8, Reg8, Reg8 (total size 5)

Get the next property in the for..in iterator.
Returns Arg1, which is the next property. Undefined if unavailable.
Arg2 is the register that holds array of properties.
Arg3 is the register that holds the object.
Arg4 is the register that holds the iterating index.
Arg5 is the register that holds the size of the property list.
GetOwnBySlotIdx8484 Reg8, Reg8, UInt8 (total size 3)

Get an existing own property at a given slot index.
Arg1 is the result register.
Arg2 is the object.
Arg3 is the hidden class slot index.
Arg2[Arg3] = Arg2;
GetOwnBySlotIdxLong8585 Reg8, Reg8, UInt32 (total size 6)

Get an existing own property at a given slot index.
Arg1 is the result register.
Arg2 is the object.
Arg3 is the hidden class slot index.
Arg2[Arg3] = Arg2;
GetOwnPrivateBySym101101 Reg8, Reg8, UInt8, Reg8 (total size 4)

Get a private property from an object.
Arg1 = Arg2[Arg5]
Arg1 is the result
Arg2 is the object to read from.
Arg3 is a private name cache index used to speed up the above operation.
Arg4 is the symbol value of the private name.
GetPNameList7272727272727273737575777791104104 Reg8, Reg8, Reg8, Reg8 (total size 4)

Get the list of properties from an object to implement for..in loop.
Returns Arg1, which is the register that holds array of properties.
Returns Undefined if the object is null/undefined.
Arg2 is the register that holds the object.
Arg3 is the register that holds the iterating index.
Arg4 is the register that holds the size of the property list.
GetParentEnvironment425252 Reg8, UInt8 (total size 2)

Get an environment (scope) from N levels up relative to the current
function's enclosing environment. 0 retrieves the environment from the
closure, 1 retrieves its parent, etc.
Greater19191919191919202020202020202828 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 > Arg3 (JS greater-than)
GreaterEq20202020202020212121212121212929 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 >= Arg3 (JS greater-than-or-equals)
Inc37373737384646 Reg8, Reg8 (total size 2)

Arg1 = Arg2 + 1 (JS increment, skips number check)
InstanceOf36363636363636373739393939404848 Reg8, Reg8, Reg8 (total size 3)

Check whether Arg2 contains Arg3 in its prototype chain.
Note that this is not the same as JS instanceof.
Pseudocode: Arg1 = prototypechain(Arg2).contains(Arg3)
IsIn37373737373737383840404040414949 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 in Arg3 (JS relational 'in')
IteratorBegin127127132132137137139139146170171 Reg8, Reg8 (total size 2)

Arg1 [out] is the result iterator or index.
Arg2 [in/out] is the source. Output for either the source or next method.
If source is an array with an unmodified [Symbol.iterator], the result is
0. Else the result is source[Symbol.iterator] and the output is the .next()
method on the iterator.
See IR.md for IteratorBeginInst.
IteratorClose129129134134139139141141148172173 Reg8, UInt8 (total size 2)

Arg1 [in] is the iterator or array index.
Arg2 is a bool indicating whether to ignore the inner exception.
If the iterator is an object, call iterator.return().
If Arg2 is true, ignore exceptions which are thrown by iterator.return().
See IR.md for IteratorCloseInst.
IteratorNext128128133133138138140140147171172 Reg8, Reg8, Reg8 (total size 3)

Arg1 [out] is the result, or undefined if done.
Arg2 [in/out] is the iterator or index.
Arg2 [in] is the source or the next method.
If iterator is undefined, result = undefined.
If iterator is a number:
If iterator is less than source.length, return source[iterator++]
Else iterator = undefined and result = undefined
Else:
n = iterator.next()
If n.done, iterator = undefined and result = undefined.
Else result = n.value
See IR.md for IteratorNextInst.
JEqual159168169169169172172177177182182184184189207208 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JEqualLong160169170170170173173178178183183185185190208209 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreater143152153153153156156161161166166168168173199200 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqual151160161161161164164169169174174176176181203204 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqualLong152161162162162165165170170175175177177182204205 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqualN155164165165165168168173173178178180180185 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqualNLong156165166166166169169174174179179181181186 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterLong144153154154154157157162162167167169169174200201 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterN147156157157157160160165165170170172172177 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterNLong148157158158158161161166166171171173173178 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLess127136137137137140140145145150150152152157183184 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqual135144145145145148148153153158158160160165191192 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqualLong136145146146146149149154154159159161161166192193 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqualN139148149149149152152157157162162164164169195196 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqualNLong140149150150150153153158158163163165165170196197 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessLong128137138138138141141146146151151153153158184185 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessN131140141141141144144149149154154156156161187188 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessNLong132141142142142145145150150155155157157162188189 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotEqual161170171171171174174179179184184186186191209210 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotEqualLong162171172172172175175180180185185187187192210211 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreater145154155155155158158163163168168170170175201202 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqual153162163163163166166171171176176178178183205206 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqualLong154163164164164167167172172177177179179184206207 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqualN157166167167167170170175175180180182182187 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqualNLong158167168168168171171176176181181183183188 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterLong146155156156156159159164164169169171171176202203 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterN149158159159159162162167167172172174174179 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterNLong150159160160160163163168168173173175175180 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLess129138139139139142142147147152152154154159185186 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqual137146147147147150150155155160160162162167193194 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqualLong138147148148148151151156156161161163163168194195 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqualN141150151151151154154159159164164166166171197198 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqualNLong142151152152152155155160160165165167167172198199 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessLong130139140140140143143148148153153155155160186187 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessN133142143143143146146151151156156158158163189190 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessNLong134143144144144147147152152157157159159164190191 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictEqual163172173173173176176181181186186188188193211212 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictEqualLong164173174174174177177182182187187189189194212213 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictNotEqual165174175175175178178183183188188190190195213214 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictNotEqualLong166175176176176179179184184189189191191196214215 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
Jmp119126127127127130130135135140140142142149174175 Addr8 (total size 1)

Unconditional branch to Arg1.
JmpBuiltinIs215216 Addr8, UInt8, Reg8 (total size 3)
JmpBuiltinIsLong216217 Addr32, UInt8, Reg8 (total size 6)
JmpBuiltinIsNot217218 Addr8, UInt8, Reg8 (total size 3)
JmpBuiltinIsNotLong218219 Addr32, UInt8, Reg8 (total size 6)
JmpFalse123130131131131134134139139144144146146153178179 Addr8, Reg8 (total size 2)

Conditional branches to Arg1 based on Arg2.
JmpFalseLong124131132132132135135140140145145147147154179180 Addr32, Reg8 (total size 5)

Conditional branches to Arg1 based on Arg2.
JmpLong120127128128128131131136136141141143143150175176 Addr32 (total size 4)

Unconditional branch to Arg1.
JmpTrue121128129129129132132137137142142144144151176177 Addr8, Reg8 (total size 2)

Conditional branches to Arg1 based on Arg2.
JmpTrueLong122129130130130133133138138143143145145152177178 Addr32, Reg8 (total size 5)

Conditional branches to Arg1 based on Arg2.
JmpTypeOfIs182183 Addr32, Reg8, UInt16 (total size 7)

Jump if the type matches the TypeOfIsTypes in Arg3.
Arg1 is the target.
Arg2 is the value to test.
Arg3 is the TypeOfIsTypes (see Typeof.h).
JmpUndefined125132133133133136136141141146146148148155180181 Addr8, Reg8 (total size 2)

Jump if the value is undefined.
JmpUndefinedLong126133134134134137137142142147147149149156181182 Addr32, Reg8 (total size 5)

Jump if the value is undefined.
LShift30303030303030313131313131324040 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 << Arg3 (JS bitshift left)
Less17171717171717181818181818182626 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 < Arg3 (JS less-than)
LessEq18181818181818191919191919192727 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 <= Arg3 (JS less-than-or-equals)
LoadConstBigInt111111113113121142142 Reg8, UInt16 (bigint_id) (total size 3)

Load a constant BigInt value by bigint table index.
LoadConstBigIntLongIndex112112114114122143143 Reg8, UInt32 (bigint_id) (total size 5)

Load a constant BigInt value by bigint table index.
LoadConstDouble101103104104104104104108108110110112112120141141 Reg8, Double (total size 9)

Load a constant double value.
LoadConstEmpty111111115115117117125146146 Reg8 (total size 1)

Load common constants.
LoadConstFalse107109110110110110110115115119119121121129150150 Reg8 (total size 1)

Load common constants.
LoadConstInt100102103103103103103107107109109111111119140140 Reg8, Imm32 (total size 5)

Load a constant integer value.
LoadConstNull105107108108108108108113113117117119119127148148 Reg8 (total size 1)

Load common constants.
LoadConstString102104105105105105105109109113113115115123144144 Reg8, UInt16 (string_id) (total size 3)

Load a constant string value by string table index.
LoadConstStringLongIndex103105106106106106106110110114114116116124145145 Reg8, UInt32 (string_id) (total size 5)

Load a constant string value by string table index.
LoadConstTrue106108109109109109109114114118118120120128149149 Reg8 (total size 1)

Load common constants.
LoadConstUInt899101102102102102102106106108108110110118139139 Reg8, UInt8 (total size 2)

Load a constant integer value.
LoadConstUndefined104106107107107107107112112116116118118126147147 Reg8 (total size 1)

Load common constants.
LoadConstZero108110111111111111111116116120120122122130151151 Reg8 (total size 1)

Load common constants.
LoadFromEnvironment43434343434343444446464646495959 Reg8, Reg8, UInt8 (total size 3)

Load a value from an environment.
Arg1 is the destination.
Arg2 is the environment (as fetched by GetEnvironment).
Arg3 is the environment index slot number.
LoadFromEnvironmentL44444444444444454547474747506060 Reg8, Reg8, UInt16 (total size 4)

Load a value from an environment.
Arg1 is the destination.
Arg2 is the environment (as fetched by GetEnvironment).
Arg3 is the environment index slot number.
LoadParam9799100100100100100104104106106108108116137137 Reg8, UInt8 (total size 2)

Load a function parameter by index. Starts at 0 with 'this'.
Arg1 = Arg2 == 0 ? this : arguments[Arg2 - 1];
LoadParamLong98100101101101101101105105107107109109117138138 Reg8, UInt32 (total size 5)

Like LoadParam, but allows accessing arguments >= 255.
LoadParentNoTraps6363 Reg8, Reg8 (total size 2)

Get the parent of a given object. The parent will either be an object or null.
Arg1 = destination register to write the parent.
Arg2 = the object.
LoadThisNS110112113113113113113118118122122124124132153153 Reg8 (total size 1)

Obtain the raw \c this value and coerce it to an object. Equivalent to:
\code
LoadParam Arg1, #0
CoerceThisNS Arg1, Arg1
\endcode
Loadi16192197197199199 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAP16[Arg3 >> 1] (load signed 16-bit integer)
Loadi32194199199201201 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAP32[Arg3 >> 2] (load signed 32-bit integer)
Loadi8190195195197197 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAP8[Arg3] (load signed 8-bit integer)
Loadu16193198198200200 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAPU16[Arg3 >> 1] (load unsigned 16-bit integer)
Loadu32195200200202202 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAPU32[Arg3 >> 2] (load unsigned 32-bit integer)
Loadu8191196196198198 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAPU8[Arg3] (load unsigned 8-bit integer)
Mod27272727272727282828282828293737 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 % Arg3 (JS remainder)
Mov777777788888881616 Reg8, Reg8 (total size 2)

Arg1 = Arg2 (Register copy)
MovLong888888899999991717 Reg32, Reg32 (total size 8)

Arg1 = Arg2 (Register copy, long index)
Mul23232323232323242424242424253333 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 * Arg3 (JS multiplication)
Mul32187192192194194 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 * Arg3 (32-bit integer multiplication)
MulN24242424242424252525252525263434 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 * Arg3 (Numeric multiplication, skips number check)
Negate9999999101010101010101818 Reg8, Reg8 (total size 2)

Arg1 = -Arg2 (Unary minus)
Neq15151515151515161616161616162424 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 != Arg3 (JS inequality)
NewArray6666666777777789 Reg8, UInt16 (total size 3)

Create a new array of a given size.
Arg1 = new Array(Arg2)
NewArrayWithBuffer4444444555555567 Reg8, UInt16, UInt16, UInt16 (total size 7)

Create an array from a static list of values, as for var=[1,2,3].
Any non-constant elements can be set afterwards with DefineOwnByIndex.
Arg1 is the destination.
Arg2 is a preallocation size hint.
Arg3 is the number of static elements.
Arg4 is the offset in the array buffer table.
NewArrayWithBufferLong5555555666666678 Reg8, UInt16, UInt16, UInt32 (total size 9)

Create an array from a static list of values, as for var=[1,2,3].
Any non-constant elements can be set afterwards with DefineOwnByIndex.
Arg1 is the destination.
Arg2 is a preallocation size hint.
Arg3 is the number of static elements.
Arg4 is the offset in the array buffer table.
NewFastArray910 Reg8, UInt16 (total size 3)

Create a new FastArray.
Arg1 = new FastArray(Arg2)
NewObject2222222333333345 Reg8 (total size 1)

Create a new, empty Object using the built-in constructor (regardless of
whether it was overridden).
Arg1 = {}
NewObjectWithBuffer0000000111111111 Reg8, UInt16, UInt16 (total size 5)

Create an object from a static map of values, as for var={'a': 3}.
Any non-constant elements can be set afterwards with PutOwnByInd.
Arg1 is the destination.
Arg2 is the index in the object shape table.
Arg3 is the offset in the object val buffer table.
NewObjectWithBufferAndParent33 Reg8, Reg8, UInt32, UInt32 (total size 10)

Create an object from a static map of values, setting its parent.
Arg1 is the destination.
Arg2 is the parent.
Arg3 is the index in the object shape table.
Arg4 is the offset in the object val buffer table.
NewObjectWithBufferLong1111111222222222 Reg8, UInt32, UInt32 (total size 9)

Create an object from a static map of values, as for var={'a': 3}.
Any non-constant elements can be set afterwards with PutOwnByInd.
Arg1 is the destination.
Arg2 is the index in the object shape table.
Arg3 is the offset in the object val buffer table.
NewObjectWithParent3333333444444456 Reg8, Reg8 (total size 2)

Create a new empty Object with the specified parent. If the parent is
null, no parent is used. If the parent is not an object, the builtin
Object.prototype is used. Otherwise the parent itself is used.
Arg1 = the created object
Arg2 = the parent.
NewTypedObjectWithBuffer4 Reg8, Reg8, UInt32, UInt32, UInt8 (total size 11)

Create a typed object from a static map of values, for typed classes.
The result will have properties which are readonly from legacy JS,
only mutable via PutOwnBySlotIdx, and some which may be private
(only visible to GetOwnBySlotIdx via typed code).
Arg1 is the destination.
Arg2 is the parent.
Arg3 is the index in the object shape table.
Arg4 is the index in the object val buffer table.
Arg5 is non-zero if properties should be non-enumerable.
Not10101010101010111111111111111919 Reg8, Reg8 (total size 2)

Arg1 = !Arg2 (Boolean not)
PrivateIsIn5050 Reg8, Reg8, Reg8, Reg8 (total size 4)

Arg1 = Arg2 in Arg3 (JS relational 'in' for private names.)
Arg2 must be a symbol.
Arg4 is a private name cache index used to speed up the above operation.
Note that this performs different logic than a normal `in` check. This
instruction does not consult the prototype chain or trigger any proxy
traps. It is a direct check on the own properties of the input object.
ProfilePoint91919292929292959597979999111127127 UInt16 (total size 2)

Define a profile point.
Arg1 is the function local profile point index. The first one will have the
largest index. If there are more than 2^16 profile points in the function,
all the overflowed profile points have index zero.
PutById54545454545454555557575959 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByIdLong55555555555555565658586060 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByIdLoose627474 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByIdLooseLong647676 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByIdStrict637575 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByIdStrictLong657777 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByVal69696969696969707072727474 Reg8, Reg8, Reg8 (total size 3)

Set a property by value. Constant string values should instead use GetById
(unless they are array indices according to ES5.1 section 15.4, in which
case this is still the right opcode).
Arg1[Arg2] = Arg3
PutByValLoose869696 Reg8, Reg8, Reg8 (total size 3)

Set a property by value. Constant string values should instead use GetById
(unless they are array indices according to ES5.1 section 15.4, in which
case this is still the right opcode).
Arg1[Arg2] = Arg3
PutByValStrict879797 Reg8, Reg8, Reg8 (total size 3)

Set a property by value. Constant string values should instead use GetById
(unless they are array indices according to ES5.1 section 15.4, in which
case this is still the right opcode).
Arg1[Arg2] = Arg3
PutByValWithReceiver9898 Reg8, Reg8, Reg8, Reg8, UInt8 (total size 5)

Set a property by value, with a specified receiver.
Arg1[Arg2] = Arg3
Arg4 is the receiver
Arg5 is true if this operation is strict, false for loose.
PutNewOwnById5959595959595960606262646471 Reg8, Reg8, UInt16 (string_id) (total size 4)

Create a new own property on an object. This is similar to PutById, but
the destination must be an object, it only deals with own properties,
ignoring the prototype chain, and the property must not already be defined.
Similarly to PutById, the property name cannot be a valid array index.
Arg1 is the destination object, which is known to be an object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnByIdLong6060606060606061616363656572 Reg8, Reg8, UInt32 (string_id) (total size 6)

Create a new own property on an object. This is similar to PutById, but
the destination must be an object, it only deals with own properties,
ignoring the prototype chain, and the property must not already be defined.
Similarly to PutById, the property name cannot be a valid array index.
Arg1 is the destination object, which is known to be an object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnByIdShort5858585858585859596161636370 Reg8, Reg8, UInt8 (string_id) (total size 3)

Create a new own property on an object. This is similar to PutById, but
the destination must be an object, it only deals with own properties,
ignoring the prototype chain, and the property must not already be defined.
Similarly to PutById, the property name cannot be a valid array index.
Arg1 is the destination object, which is known to be an object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnNEById6161616161616162626464666675 Reg8, Reg8, UInt16 (string_id) (total size 4)

Create a new non-enumerable own property on an object. This is the same as
PutNewOwnById, but creates the property with different enumerability.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnNEByIdLong6262626262626263636565676776 Reg8, Reg8, UInt32 (string_id) (total size 6)

Create a new non-enumerable own property on an object. This is the same as
PutNewOwnById, but creates the property with different enumerability.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutOwnByIndex6363636363636364646666686877 Reg8, Reg8, UInt8 (total size 3)

Assign a value to a constant integer own property which will be created as
enumerable. This is used (potentially in conjunction with
NewArrayWithBuffer) for arr=[foo,bar] initializations.
Arg1[Arg3] = Arg2;
PutOwnByIndexL6464646464646465656767696978 Reg8, Reg8, UInt32 (total size 6)

Assign a value to a constant integer own property which will be created as
enumerable. This is used (potentially in conjunction with
NewArrayWithBuffer) for arr=[foo,bar] initializations.
Arg1[Arg3] = Arg2;
PutOwnBySlotIdx738282 Reg8, Reg8, UInt8 (total size 3)

Set an existing own property identified at a slot index.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the hidden class slot index.
Arg1[Arg3] = Arg2;
PutOwnBySlotIdxLong748383 Reg8, Reg8, UInt32 (total size 6)

Set an existing own property identified at a slot index.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the hidden class slot index.
Arg1[Arg3] = Arg2;
PutOwnByVal6565656565656566666868707079 Reg8, Reg8, Reg8, UInt8 (total size 4)

Set an own property identified by value.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the property name.
Arg4 : bool -> enumerable. If true, the property is created as enumerable,
non-enumerable otherwise.
Arg1[Arg3] = Arg2;
PutOwnGetterSetterByVal7171717171717172727474767690 Reg8, Reg8, Reg8, Reg8, UInt8 (total size 5)

Add a getter and a setter for a property by value.
Object.defineProperty(Arg1, Arg2, { get: Arg3, set: Arg4 }).
Arg1 is the target object which will have a property defined.
Arg2 is the property name
Arg3 is the getter closure or undefined
Arg4 is the setter closure or undefined
Arg5 : boolean - if true, the property will be enumerable.
PutOwnPrivateBySym102102 Reg8, Reg8, UInt8, Reg8 (total size 4)

Store a private property to an object.
Arg1[Arg5] = Arg2
Arg1 is the object to store to.
Arg2 is the value to store.
Arg3 is a private name cache index used to speed up the above operation.
Arg4 is the symbol value of the private name.
RShift31313131313131323232323232334141 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 >> Arg3 (JS signed bitshift right)
ReifyArguments116118119119119119119124124129129131131 Reg8 (total size 1)

Create an actual 'arguments' array, if get-by-index and length isn't enough.
Arg1 is the lazy loaded register, which afterwards will contain a proper
object that can be used by non-*Arguments* opcodes like Return.
ReifyArgumentsLoose141163164 Reg8 (total size 1)

Create an actual 'arguments' array, if get-by-index and length isn't enough.
Arg1 is the lazy loaded register, which afterwards will contain a proper
object that can be used by non-*Arguments* opcodes like Return.
ReifyArgumentsStrict140162163 Reg8 (total size 1)

Create an actual 'arguments' array, if get-by-index and length isn't enough.
Arg1 is the lazy loaded register, which afterwards will contain a proper
object that can be used by non-*Arguments* opcodes like Return.
ResumeGenerator122123123123123123128128133133135135 Reg8, Reg8 (total size 2)

Resume generator by performing one of the following user-requested actions:
- next(val): Set Arg1 to val, Arg2 to false, run next instruction
- return(val): Set Arg1 to val, Arg2 to true, run next instruction
- throw(val): Throw val as an error
Arg1 is the result provided by the user.
Arg2 is a boolean which is true if the user requested a return().
Ret85858585858585888890909292104118118 Reg8 (total size 1)

Return a value from the current function.
return Arg1;
SaveGenerator134135135135138138143143148148150150 Addr8 (total size 1)

Save the provided value, yield, and signal the VM to restart execution
at the provided target.
SaveGeneratorLong135136136136139139144144149149151151 Addr32 (total size 4)

Save the provided value, yield, and signal the VM to restart execution
at the provided target.
SelectObject96989999999999103103105105107107115136136 Reg8, Reg8, Reg8 (total size 3)

Choose the result of a constructor: 'this' or a returned object.
Arg1 is the result.
Arg2 is the 'this' object used for the constructor.
Arg3 is the constructor's return value.
Arg1 = Arg3 instanceof Object ? Arg3 : Arg2
StartGenerator121122122122122122127127132132134134 (total size 0)

Start the generator by jumping to the next instruction to begin.
Restore the stack frame if this generator has previously been suspended.
Store16197202202204204 Reg8, Reg8, Reg8 (total size 3)

HEAP16[Arg2] = Arg3 (store signed or unsigned 16-bit integer)
Store32198203203205205 Reg8, Reg8, Reg8 (total size 3)

HEAP32[Arg2] = Arg3 (store signed or unsigned 32-bit integer)
Store8196201201203203 Reg8, Reg8, Reg8 (total size 3)

HEAP8[Arg2] = Arg3 (store signed or unsigned 8-bit integer)
StoreNPToEnvironment41414141414141424244444444475757 Reg8, UInt8, Reg8 (total size 3)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StoreNPToEnvironmentL42424242424242434345454545485858 Reg8, UInt16, Reg8 (total size 4)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StoreToEnvironment39393939393939404042424242455555 Reg8, UInt8, Reg8 (total size 3)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StoreToEnvironmentL40404040404040414143434343465656 Reg8, UInt16, Reg8 (total size 4)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StrictEq14141414141414151515151515152323 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 === Arg3 (JS strict equality)
StrictNeq16161616161616171717171717172525 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 !== Arg3 (JS strict inequality)
StringSwitchImm167168 Reg8, UInt32, UInt32, Addr32, UInt32 (total size 17)

All-string switch (switch all of whose case labels are string literals).
Arg 1 is the value to be branched upon
Arg 2 is a global index for this StringSwitchImm instruction in the
bytecode file.
Arg 3 is the relative offset of the string switch table. A string switch
table is a sequence of pairs:
<UInt32 string table index, UInt32 jump targets>
Arg 4 is the relative offset for the "default" jump.
Arg 5 is the size of the string switch table.
Given the above, the jump table entry for a given value (that is in range)
is located at offset ip + arg3. Note that Arg3 is *unaligned*; it is
dynamically aligned at runtime.
Sub28282828282828292929292929303838 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 - Arg3 (JS subtraction)
Sub32186191191193193 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 - Arg3 (32-bit integer subtraction)
SubN29292929292929303030303030313939 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 - Arg3 (Numeric subtraction, skips number check)
SwitchImm118120121121121121121126126131131133133143 Reg8, UInt32, Addr32, UInt32, UInt32 (total size 17)

Jump table switch - using a table of offset, jump to the offset of the given
input or to the default block if out of range (or not right type)
Arg 1 is the value to be branched upon
Arg 2 is the relative offset of the jump table to be used by this
instruction. Jump tables are appended to the bytecode. Arg 3 is the relative
offset for the "default" jump. Arg 4 is the unsigned min value, if arg 1 is
less than this value jmp to
default block
Arg 5 is the unsigned max value, if arg 1 is greater than this value jmp to
default block.
Given the above, the jump table entry for a given value (that is in range)
is located at offset ip + arg2 + arg1 - arg4. We subtract arg4 to avoid
wasting space when compiling denses switches that do not start at zero. Note
that Arg2 is *unaligned* it is dynamically aligned at runtime.
Throw88888888888888919193939595107121121 Reg8 (total size 1)

Throw an exception.
throw Arg1;
ThrowIfEmpty929294949696108122122 Reg8, Reg8 (total size 2)

If Arg2 is Empty, throw ReferenceError, otherwise move it into Arg1.
Arg1 is the destination of the return value
Arg2 is the value to check
ThrowIfHasRestrictedGlobalProperty5353 UInt32 (string_id) (total size 4)

Checks if globalThis has a restricted global property with the given name.
Arg1 is the name to check.
ThrowIfThisInitialized124124 Reg8 (total size 1)

If Arg1 is not Empty, throw ReferenceError.
Arg1 is the checked this of a derived constructor.
ThrowIfUndefined123123 Reg8, Reg8 (total size 2)

If Arg2 is Undefined, throw ReferenceError, otherwise move it into Arg1.
Arg1 is the destination of the return value
Arg2 is the value to check
ThrowIfUndefinedInst8989898989 Reg8 (total size 1)

Throw ReferenceError if the operand is HermesValue::undefined
ToInt32112114115115115115115120120125125127127135156156 Reg8, Reg8 (total size 2)

Convert a value to a 32-bit signed integer.
Arg1 = Arg2 | 0
ToNumber111113114114114114114119119123123125125133154154 Reg8, Reg8 (total size 2)

Convert a value to a number.
Arg1 = Arg2 - 0
ToNumeric124124126126134155155 Reg8, Reg8 (total size 2)

Convert a value to a numberic.
Arg1 = ToNumeric(Arg2)
ToPropertyKey164165 Reg8, Reg8 (total size 2)

Convert a value to a property key, used to evaluate a ComputedPropertyName.
Arg1 = ToPropertyKey(Arg2)
ToUint32157 Reg8, Reg8 (total size 2)

Convert a value to a 32-bit unsigned integer.
Arg1 = Arg2 >>> 0
TryGetById52525252525252535355555757607272 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Get an object property by string table index, or throw if not found.
This is similar to GetById, but intended for use with global variables
where Arg2 = GetGlobalObject.
TryGetByIdLong53535353535353545456565858617373 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Get an object property by string table index, or throw if not found.
This is similar to GetById, but intended for use with global variables
where Arg2 = GetGlobalObject.
TryPutById56565656565656575759596161 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TryPutByIdLong57575757575757585860606262 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TryPutByIdLoose667878 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TryPutByIdLooseLong688080 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TryPutByIdStrict677979 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TryPutByIdStrictLong698181 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TypeOf12121212121212131313131313132121 Reg8, Reg8 (total size 2)

Arg1 = typeof Arg2 (JS typeof)
TypeOfIs5151 Reg8, Reg8, UInt16 (total size 4)

Arg1 = typeof Arg2 is in Arg3 (TypeOfIsTypes, see Typeof.h)
TypedLoadParent173174 Reg8, Reg8 (total size 2)

Arg1 [out] is the result.
Arg2 [in] is the source (must be an object).
UIntSwitchImm166167 Reg8, UInt32, Addr32, UInt32, UInt32 (total size 17)

Jump table switch - using a table of offset, jump to the offset of the given
input or to the default block if out of range (or not right type)
Arg 1 is the value to be branched upon
Arg 2 is the relative offset of the jump table to be used by this
instruction. Jump tables are appended to the bytecode.
Arg 3 is the relative offset for the "default" jump.
Arg 4 is the unsigned min value, if arg 1 is/ less than this value jmp to
default block
Arg 5 is the unsigned max value, if arg 1 is greater than this value jmp to
default block.
Given the above, the jump table entry for a given value (that is in range)
is located at offset ip + arg2 + arg1 - arg4. We subtract arg4 to avoid
wasting space when compiling denses switches that do not start at zero. Note
that Arg2 is *unaligned* it is dynamically aligned at runtime.
URshift32323232323232333333333333344242 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 >>> Arg3 (JS unsigned bitshift right)
Unreachable92929393939393000000000 (total size 0)

Unreachable opcode for stubs and similar. This is first so that it has the
value zero.