Opcodes of the Hermes virtual machine

With the opcode byte value indicated respective to each stable version of the React Native Hermes VM bytecode format, as well as the auto-generated documentation from the "BytecodeList.def" file from the Hermes VM source tree.

This list of opcodes is used by the hermes-dec open-source reverse engineering project.

Instruction Bytecode version to opcode Documentation
515859627073768389909295
Add212121212121212222222222 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 + Arg3 (JS addition/concatenation)
Add32190190192192 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 + Arg3 (32-bit integer addition)
AddEmptyString113115116116116116116121126126128128 Reg8, Reg8 (total size 2)

Convert a value to a string as if evaluating the expression:
Arg1 = "" + Arg2
In practice this means
Arg1 = ToString(ToPrimitive(Arg2, PreferredType::NONE))
with ToPrimitive (ES5.1 9.1) and ToString (ES5.1 9.8).
AddN222222222222222323232323 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 + Arg3 (Numeric addition, skips number check)
AsyncBreakCheck919191919496969898 (total size 0)

Fast check for an async interrupt request.
BitAnd333333333333333434343434 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 & Arg3 (JS bitwise AND)
BitNot111111111111111212121212 Reg8, Reg8 (total size 2)

Arg1 = ~Arg2 (Bitwise not)
BitOr353535353535353636363636 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 | Arg3 (JS bitwise OR)
BitXor343434343434343535353535 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 ^ Arg3 (JS bitwise XOR)
Call747474747474747577777979 Reg8, Reg8, UInt8 (total size 3)

Call a function.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame.
Call1767676767676767779798181 Reg8, Reg8, Reg8 (total size 3)

Call a function with one arg.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Call2787878787878787981818383 Reg8, Reg8, Reg8, Reg8 (total size 4)

Call a function with two args.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Arg4 is the second argument.
Call3797979797979798082828484 Reg8, Reg8, Reg8, Reg8, Reg8 (total size 5)

Call a function with three args.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Arg4 is the second argument.
Arg5 is the third argument.
Call4808080808080808183838585 Reg8, Reg8, Reg8, Reg8, Reg8, Reg8 (total size 6)

Call a function with four args.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the first argument.
Arg4 is the second argument.
Arg5 is the third argument.
Arg6 is the fourth argument.
CallBuiltin848484848484848587878989 Reg8, UInt8, UInt8 (total size 3)

Call a builtin function.
Note this is NOT marked as a Ret target, because the callee is native
and therefore never JS.
Arg1 is the destination of the return value.
Arg2 is the builtin number.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame.
thisArg is set to "undefined".
CallBuiltinLong8688889090 Reg8, UInt8, UInt32 (total size 6)

Call a builtin function.
Note this is NOT marked as a Ret target, because the callee is native
and therefore never JS.
Arg1 is the destination of the return value.
Arg2 is the builtin number.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame.
thisArg is set to "undefined".
CallDirect777777777777777880808282 Reg8, UInt8, UInt16 (function_id) (total size 4)

Call a function directly without a closure.
Arg1 is the destination of the return value.
Arg2 is the number of arguments, assumed to be found in reverse order
from the end of the current frame. The first argument 'this'
is assumed to be created with CreateThis.
Arg3 is index in the function table.
Note that we expect the variable-sized argument to be last.
CallDirectLongIndex838383838383838486868888 Reg8, UInt8, UInt32 (total size 6)

Identical to CallDirect, but the function index is 32-bit.
CallLong818181818181818284848686 Reg8, Reg8, UInt32 (total size 6)

Identical to Call, but allowing more arguments.
Catch868686868686868991919393 Reg8 (total size 1)

Catch an exception (the first instruction in an exception handler).
} catch(Arg1) {
CoerceThisNS109111112112112112112117121121123123 Reg8, Reg8 (total size 2)

Coerce a value assumed to contain 'this' to an object using non-strict
mode rules. Primitives are boxed, \c null or \c undefed produce the global
object.
Arg1 = coerce_to_object(Arg2)
CompleteGenerator123124124124124124129134134136136 (total size 0)

Set the generator status to complete, but do not return.
Construct757575757575757678788080 Reg8, Reg8, UInt8 (total size 3)

Call a constructor, with semantics identical to Call.
Arg1 is the destination of the return value.
Arg2 is the closure to invoke.
Arg3 is the number of arguments, assumed to be found in reverse order
from the end of the current frame. The first argument 'this'
is assumed to be created with CreateThis.
ConstructLong828282828282828385858787 Reg8, Reg8, UInt32 (total size 6)

Identical to Construct, but allowing more arguments.
CreateAsyncClosure100102102104104 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a closure for an AsyncFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateAsyncClosureLongIndex101103103105105 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a closure for an AsyncFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateClosure93939494949494969898100100 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a closure.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateClosureLongIndex94949595959595979999101101 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a closure.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateEnvironment474747474747474850505050 Reg8 (total size 1)

Create a new environment, to store values captured by closures.
CreateGenerator124125125125125125130135135137137 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a generator.
Arg1 is the register in which to store the generator.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateGeneratorClosure95969696969698100100102102 Reg8, Reg8, UInt16 (function_id) (total size 4)

Create a closure for a GeneratorFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateGeneratorClosureLongIndex96979797979799101101103103 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a closure for a GeneratorFunction.
Arg1 is the register in which to store the closure.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateGeneratorLongIndex125126126126126126131136136138138 Reg8, Reg8, UInt32 (function_id) (total size 6)

Create a generator.
Arg1 is the register in which to store the generator.
Arg2 is the current environment as loaded by GetEnvironment 0.
Arg3 is index in the function table.
CreateInnerEnvironment5151 Reg8, Reg8, UInt32 (total size 6)

Create a new inner environment, to store values captured by closures.
Arg1 is the destination.
Arg2 is the parent environment.
Arg3 is the number of slots in the environment.
CreateRegExp117119120120120120120125130130132132 Reg8, UInt32 (string_id), UInt32 (string_id), UInt32 (total size 13)

Create a regular expression.
Arg1 is the result.
Arg2 is the string index of the pattern.
Arg3 is the string index of the flags.
Arg4 is the regexp bytecode index in the regexp table.
CreateThis95979898989898102104104106106 Reg8, Reg8, Reg8 (total size 3)

Allocate an empty, uninitialized object (immediately before a constructor).
Arg1 is the destination register.
Arg2 is the prototype to assign it.
Arg3 is the constructor closure that will be used*.
* To allow internal constructors to have special objects allocated.
Debugger898990909090909395959797 (total size 0)

Implementation dependent debugger action.
DebuggerCheckBreak909091 (total size 0)

Fast check for a debugger break request.
Dec38383838 Reg8, Reg8 (total size 2)

Arg1 = Arg2 - 1 (JS decrement, skips number check)
DeclareGlobalVar484848484848484951515252 UInt32 (string_id) (total size 4)

Declare a global variable by string table index.
The variable will be set to undefined.
DelById666666666666666769697171 Reg8, Reg8, UInt16 (string_id) (total size 4)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByIdLong676767676767676870707272 Reg8, Reg8, UInt32 (string_id) (total size 6)

Delete a property by string table index.
Arg1 = delete Arg2[stringtable[Arg3]]
DelByVal707070707070707173737575 Reg8, Reg8, Reg8 (total size 3)

Delete a property by value (when the value is not known at compile time).
Arg1 = delete Arg2[Arg3]
DirectEval878787878787879092929494 Reg8, Reg8, UInt8 (total size 3)

ES6 18.2.1.1 PerformEval(Arg2, evalRealm, strictCaller=true, direct=true)
Arg1 is the destination of the return value.
Arg2 is the value to eval.
Arg3 is a boolean which is true if the eval should be performed in strict mode.
Div252525252525252626262626 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (JS division)
DivN262626262626262727272727 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (Numeric division, skips number check)
Divi32193193195195 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (32-bit signed integer division)
Divu32194194196196 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 / Arg3 (32-bit unsigned integer division)
Eq131313131313131414141414 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 == Arg3 (JS equality)
GetArgumentsLength115117118118118118118123128128130130 Reg8, Reg8 (total size 2)

Get the length of the 'arguments' array.
Arg1 is the result.
Arg2 is the lazy loaded register.
Arg1 = arguments.length
GetArgumentsPropByVal114116117117117117117122127127129129 Reg8, Reg8, Reg8 (total size 3)

Get a property of the 'arguments' array by value.
Arg1 is the result.
Arg2 is the index.
Arg3 is the lazy loaded register.
Arg1 = arguments[Arg2]
GetBuiltinClosure8789899191 Reg8, UInt8 (total size 2)

Get a closure from a builtin function.
Arg1 is the destination of the return value.
Arg2 is the builtin number.
GetById505050505050505153535555 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Get an object property by string table index.
Arg1 = Arg2[stringtable[Arg4]]
Arg3 is a cache index used to speed up the above operation.
GetByIdLong515151515151515254545656 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Get an object property by string table index.
Arg1 = Arg2[stringtable[Arg4]]
Arg3 is a cache index used to speed up the above operation.
GetByIdShort494949494949495052525454 Reg8, Reg8, UInt8, UInt8 (string_id) (total size 4)

Get an object property by string table index.
Arg1 = Arg2[stringtable[Arg4]]
Arg3 is a cache index used to speed up the above operation.
GetByVal686868686868686971717373 Reg8, Reg8, Reg8 (total size 3)

Get a property by value. Constants string values should instead use GetById.
Arg1 = Arg2[Arg3]
GetEnvironment383838383838383941414141 Reg8, UInt8 (total size 2)

Get an environment (scope) from N levels up the stack.
0 is the current environment, 1 is the caller's environment, etc.
GetGlobalObject454545454545454648484848 Reg8 (total size 1)

Get the global object (the object in which global variables are stored).
GetNewTarget464646464646464749494949 Reg8 (total size 1)

Obtain the value of NewTarget from the frame.
Arg1 = NewTarget
GetNextPName737373737373737476767878 Reg8, Reg8, Reg8, Reg8, Reg8 (total size 5)

Get the next property in the for..in iterator.
Returns Arg1, which is the next property. Undefined if unavailable.
Arg2 is the register that holds array of properties.
Arg3 is the register that holds the object.
Arg4 is the register that holds the iterating index.
Arg5 is the register that holds the size of the property list.
GetPNameList727272727272727375757777 Reg8, Reg8, Reg8, Reg8 (total size 4)

Get the list of properties from an object to implement for..in loop.
Returns Arg1, which is the register that holds array of properties.
Returns Undefined if the object is null/undefined.
Arg2 is the register that holds the object.
Arg3 is the register that holds the iterating index.
Arg4 is the register that holds the size of the property list.
Greater191919191919192020202020 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 > Arg3 (JS greater-than)
GreaterEq202020202020202121212121 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 >= Arg3 (JS greater-than-or-equals)
Inc37373737 Reg8, Reg8 (total size 2)

Arg1 = Arg2 + 1 (JS increment, skips number check)
InstanceOf363636363636363739393939 Reg8, Reg8, Reg8 (total size 3)

Check whether Arg2 contains Arg3 in its prototype chain.
Note that this is not the same as JS instanceof.
Pseudocode: Arg1 = prototypechain(Arg2).contains(Arg3)
IsIn373737373737373840404040 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 in Arg3 (JS relational 'in')
IteratorBegin127127132137137139139 Reg8, Reg8 (total size 2)

Arg1 [out] is the result iterator or index.
Arg2 [in/out] is the source. Output for either the source or next method.
If source is an array with an unmodified [Symbol.iterator], the result is
0. Else the result is source[Symbol.iterator] and the output is the .next()
method on the iterator.
See IR.md for IteratorBeginInst.
IteratorClose129129134139139141141 Reg8, UInt8 (total size 2)

Arg1 [in] is the iterator or array index.
Arg2 is a bool indicating whether to ignore the inner exception.
If the iterator is an object, call iterator.return().
If Arg2 is true, ignore exceptions which are thrown by iterator.return().
See IR.md for IteratorCloseInst.
IteratorNext128128133138138140140 Reg8, Reg8, Reg8 (total size 3)

Arg1 [out] is the result, or undefined if done.
Arg2 [in/out] is the iterator or index.
Arg2 [in] is the source or the next method.
If iterator is undefined, result = undefined.
If iterator is a number:
If iterator is less than source.length, return source[iterator++]
Else iterator = undefined and result = undefined
Else:
n = iterator.next()
If n.done, iterator = undefined and result = undefined.
Else result = n.value
See IR.md for IteratorNextInst.
JEqual159168169169169172172177182182184184 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JEqualLong160169170170170173173178183183185185 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreater143152153153153156156161166166168168 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqual151160161161161164164169174174176176 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqualLong152161162162162165165170175175177177 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqualN155164165165165168168173178178180180 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterEqualNLong156165166166166169169174179179181181 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterLong144153154154154157157162167167169169 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterN147156157157157160160165170170172172 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JGreaterNLong148157158158158161161166171171173173 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLess127136137137137140140145150150152152 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqual135144145145145148148153158158160160 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqualLong136145146146146149149154159159161161 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqualN139148149149149152152157162162164164 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessEqualNLong140149150150150153153158163163165165 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessLong128137138138138141141146151151153153 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessN131140141141141144144149154154156156 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JLessNLong132141142142142145145150155155157157 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotEqual161170171171171174174179184184186186 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotEqualLong162171172172172175175180185185187187 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreater145154155155155158158163168168170170 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqual153162163163163166166171176176178178 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqualLong154163164164164167167172177177179179 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqualN157166167167167170170175180180182182 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterEqualNLong158167168168168171171176181181183183 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterLong146155156156156159159164169169171171 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterN149158159159159162162167172172174174 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotGreaterNLong150159160160160163163168173173175175 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLess129138139139139142142147152152154154 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqual137146147147147150150155160160162162 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqualLong138147148148148151151156161161163163 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqualN141150151151151154154159164164166166 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessEqualNLong142151152152152155155160165165167167 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessLong130139140140140143143148153153155155 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessN133142143143143146146151156156158158 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JNotLessNLong134143144144144147147152157157159159 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictEqual163172173173173176176181186186188188 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictEqualLong164173174174174177177182187187189189 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictNotEqual165174175175175178178183188188190190 Addr8, Reg8, Reg8 (total size 3)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
JStrictNotEqualLong166175176176176179179184189189191191 Addr32, Reg8, Reg8 (total size 6)

Not conditionals are required for NaN comparisons
Since we want to be able to reorder targets to allow for fall-throughs,
we need to be able to say "jump when not less than to BB2" instead of
"jump when less than to BB1".
Since NaN comparisons always return false, "not less" != "greater or equal"
Jmp119126127127127130130135140140142142 Addr8 (total size 1)

Unconditional branch to Arg1.
JmpFalse123130131131131134134139144144146146 Addr8, Reg8 (total size 2)

Conditional branches to Arg1 based on Arg2.
JmpFalseLong124131132132132135135140145145147147 Addr32, Reg8 (total size 5)

Conditional branches to Arg1 based on Arg2.
JmpLong120127128128128131131136141141143143 Addr32 (total size 4)

Unconditional branch to Arg1.
JmpTrue121128129129129132132137142142144144 Addr8, Reg8 (total size 2)

Conditional branches to Arg1 based on Arg2.
JmpTrueLong122129130130130133133138143143145145 Addr32, Reg8 (total size 5)

Conditional branches to Arg1 based on Arg2.
JmpUndefined125132133133133136136141146146148148 Addr8, Reg8 (total size 2)

Jump if the value is undefined.
JmpUndefinedLong126133134134134137137142147147149149 Addr32, Reg8 (total size 5)

Jump if the value is undefined.
LShift303030303030303131313131 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 << Arg3 (JS bitshift left)
Less171717171717171818181818 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 < Arg3 (JS less-than)
LessEq181818181818181919191919 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 <= Arg3 (JS less-than-or-equals)
LoadConstBigInt111111113113 Reg8, UInt16 (bigint_id) (total size 3)

Load a constant BigInt value by bigint table index.
LoadConstBigIntLongIndex112112114114 Reg8, UInt32 (bigint_id) (total size 5)

Load a constant BigInt value by bigint table index.
LoadConstDouble101103104104104104104108110110112112 Reg8, Double (total size 9)

Load a constant double value.
LoadConstEmpty111115115117117 Reg8 (total size 1)

Load common constants.
LoadConstFalse107109110110110110110115119119121121 Reg8 (total size 1)

Load common constants.
LoadConstInt100102103103103103103107109109111111 Reg8, Imm32 (total size 5)

Load a constant integer value.
LoadConstNull105107108108108108108113117117119119 Reg8 (total size 1)

Load common constants.
LoadConstString102104105105105105105109113113115115 Reg8, UInt16 (string_id) (total size 3)

Load a constant string value by string table index.
LoadConstStringLongIndex103105106106106106106110114114116116 Reg8, UInt32 (string_id) (total size 5)

Load a constant string value by string table index.
LoadConstTrue106108109109109109109114118118120120 Reg8 (total size 1)

Load common constants.
LoadConstUInt899101102102102102102106108108110110 Reg8, UInt8 (total size 2)

Load a constant integer value.
LoadConstUndefined104106107107107107107112116116118118 Reg8 (total size 1)

Load common constants.
LoadConstZero108110111111111111111116120120122122 Reg8 (total size 1)

Load common constants.
LoadFromEnvironment434343434343434446464646 Reg8, Reg8, UInt8 (total size 3)

Load a value from an environment.
Arg1 is the destination.
Arg2 is the environment (as fetched by GetEnvironment).
Arg3 is the environment index slot number.
LoadFromEnvironmentL444444444444444547474747 Reg8, Reg8, UInt16 (total size 4)

Load a value from an environment.
Arg1 is the destination.
Arg2 is the environment (as fetched by GetEnvironment).
Arg3 is the environment index slot number.
LoadParam9799100100100100100104106106108108 Reg8, UInt8 (total size 2)

Load a function parameter by index. Starts at 0 with 'this'.
Arg1 = Arg2 == 0 ? this : arguments[Arg2 - 1];
LoadParamLong98100101101101101101105107107109109 Reg8, UInt32 (total size 5)

Like LoadParam, but allows accessing arguments >= 255.
LoadThisNS110112113113113113113118122122124124 Reg8 (total size 1)

Obtain the raw \c this value and coerce it to an object. Equivalent to:
\code
LoadParam Arg1, #0
CoerceThisNS Arg1, Arg1
\endcode
Loadi16197197199199 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAP16[Arg3 >> 1] (load signed 16-bit integer)
Loadi32199199201201 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAP32[Arg3 >> 2] (load signed 32-bit integer)
Loadi8195195197197 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAP8[Arg3] (load signed 8-bit integer)
Loadu16198198200200 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAPU16[Arg3 >> 1] (load unsigned 16-bit integer)
Loadu32200200202202 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAPU32[Arg3 >> 2] (load unsigned 32-bit integer)
Loadu8196196198198 Reg8, Reg8, Reg8 (total size 3)

Arg1 = HEAPU8[Arg3] (load unsigned 8-bit integer)
Mod272727272727272828282828 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 % Arg3 (JS remainder)
Mov777777788888 Reg8, Reg8 (total size 2)

Arg1 = Arg2 (Register copy)
MovLong888888899999 Reg32, Reg32 (total size 8)

Arg1 = Arg2 (Register copy, long index)
Mul232323232323232424242424 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 * Arg3 (JS multiplication)
Mul32192192194194 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 * Arg3 (32-bit integer multiplication)
MulN242424242424242525252525 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 * Arg3 (Numeric multiplication, skips number check)
Negate99999991010101010 Reg8, Reg8 (total size 2)

Arg1 = -Arg2 (Unary minus)
Neq151515151515151616161616 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 != Arg3 (JS inequality)
NewArray666666677777 Reg8, UInt16 (total size 3)

Create a new array of a given size.
Arg1 = new Array(Arg2)
NewArrayWithBuffer444444455555 Reg8, UInt16, UInt16, UInt16 (total size 7)

Create an array from a static list of values, as for var=[1,2,3].
Any non-constant elements can be set afterwards with PutOwnByIndex.
Arg1 is the destination.
Arg2 is a preallocation size hint.
Arg3 is the number of static elements.
Arg4 is the index in the array buffer table.
NewArrayWithBufferLong555555566666 Reg8, UInt16, UInt16, UInt32 (total size 9)

Create an array from a static list of values, as for var=[1,2,3].
Any non-constant elements can be set afterwards with PutOwnByIndex.
Arg1 is the destination.
Arg2 is a preallocation size hint.
Arg3 is the number of static elements.
Arg4 is the index in the array buffer table.
NewObject222222233333 Reg8 (total size 1)

Create a new, empty Object using the built-in constructor (regardless of
whether it was overridden).
Arg1 = {}
NewObjectWithBuffer000000011111 Reg8, UInt16, UInt16, UInt16, UInt16 (total size 9)

Create an object from a static map of values, as for var={'a': 3}.
Any non-constant elements can be set afterwards with PutOwnByInd.
Arg1 is the destination.
Arg2 is a preallocation size hint.
Arg3 is the number of static elements.
Arg4 is the index in the object key buffer table.
Arg5 is the index in the object val buffer table.
NewObjectWithBufferLong111111122222 Reg8, UInt16, UInt16, UInt32, UInt32 (total size 13)

Create an object from a static map of values, as for var={'a': 3}.
Any non-constant elements can be set afterwards with PutOwnByInd.
Arg1 is the destination.
Arg2 is a preallocation size hint.
Arg3 is the number of static elements.
Arg4 is the index in the object key buffer table.
Arg5 is the index in the object val buffer table.
NewObjectWithParent333333344444 Reg8, Reg8 (total size 2)

Create a new empty Object with the specified parent. If the parent is
null, no parent is used. If the parent is not an object, the builtin
Object.prototype is used. Otherwise the parent itself is used.
Arg1 = the created object
Arg2 = the parent.
Not101010101010101111111111 Reg8, Reg8 (total size 2)

Arg1 = !Arg2 (Boolean not)
ProfilePoint919192929292929597979999 UInt16 (total size 2)

Define a profile point.
Arg1 is the function local profile point index. The first one will have the
largest index. If there are more than 2^16 profile points in the function,
all the overflowed profile points have index zero.
PutById545454545454545557575959 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByIdLong555555555555555658586060 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index.
Arg1[stringtable[Arg4]] = Arg2.
PutByVal696969696969697072727474 Reg8, Reg8, Reg8 (total size 3)

Set a property by value. Constant string values should instead use GetById
(unless they are array indices according to ES5.1 section 15.4, in which
case this is still the right opcode).
Arg1[Arg2] = Arg3
PutNewOwnById595959595959596062626464 Reg8, Reg8, UInt16 (string_id) (total size 4)

Create a new own property on an object. This is similar to PutById, but
the destination must be an object, it only deals with own properties,
ignoring the prototype chain, and the property must not already be defined.
Similarly to PutById, the property name cannot be a valid array index.
Arg1 is the destination object, which is known to be an object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnByIdLong606060606060606163636565 Reg8, Reg8, UInt32 (string_id) (total size 6)

Create a new own property on an object. This is similar to PutById, but
the destination must be an object, it only deals with own properties,
ignoring the prototype chain, and the property must not already be defined.
Similarly to PutById, the property name cannot be a valid array index.
Arg1 is the destination object, which is known to be an object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnByIdShort585858585858585961616363 Reg8, Reg8, UInt8 (string_id) (total size 3)

Create a new own property on an object. This is similar to PutById, but
the destination must be an object, it only deals with own properties,
ignoring the prototype chain, and the property must not already be defined.
Similarly to PutById, the property name cannot be a valid array index.
Arg1 is the destination object, which is known to be an object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnNEById616161616161616264646666 Reg8, Reg8, UInt16 (string_id) (total size 4)

Create a new non-enumerable own property on an object. This is the same as
PutNewOwnById, but creates the property with different enumerability.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutNewOwnNEByIdLong626262626262626365656767 Reg8, Reg8, UInt32 (string_id) (total size 6)

Create a new non-enumerable own property on an object. This is the same as
PutNewOwnById, but creates the property with different enumerability.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the string table ID of the property name.
Arg1[stringtable[Arg3]] = Arg2
PutOwnByIndex636363636363636466666868 Reg8, Reg8, UInt8 (total size 3)

Assign a value to a constant integer own property which will be created as
enumerable. This is used (potentially in conjunction with
NewArrayWithBuffer) for arr=[foo,bar] initializations.
Arg1[Arg3] = Arg2;
PutOwnByIndexL646464646464646567676969 Reg8, Reg8, UInt32 (total size 6)

Assign a value to a constant integer own property which will be created as
enumerable. This is used (potentially in conjunction with
NewArrayWithBuffer) for arr=[foo,bar] initializations.
Arg1[Arg3] = Arg2;
PutOwnByVal656565656565656668687070 Reg8, Reg8, Reg8, UInt8 (total size 4)

Set an own property identified by value.
Arg1 is the destination object.
Arg2 is the value to write.
Arg3 is the property name.
Arg4 : bool -> enumerable. If true, the property is created as enumerable,
non-enumerable otherwise.
Arg1[Arg3] = Arg2;
PutOwnGetterSetterByVal717171717171717274747676 Reg8, Reg8, Reg8, Reg8, UInt8 (total size 5)

Add a getter and a setter for a property by value.
Object.defineProperty(Arg1, Arg2, { get: Arg3, set: Arg4 }).
Arg1 is the target object which will have a property defined.
Arg2 is the property name
Arg3 is the getter closure or undefined
Arg4 is the setter closure or undefined
Arg5 : boolean - if true, the property will be enumerable.
RShift313131313131313232323232 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 >> Arg3 (JS signed bitshift right)
ReifyArguments116118119119119119119124129129131131 Reg8 (total size 1)

Create an actual 'arguments' array, if get-by-index and length isn't enough.
Arg1 is the lazy loaded register, which afterwards will contain a proper
object that can be used by non-*Arguments* opcodes like Return.
ResumeGenerator122123123123123123128133133135135 Reg8, Reg8 (total size 2)

Resume generator by performing one of the following user-requested actions:
- next(val): Set Arg1 to val, Arg2 to false, run next instruction
- return(val): Set Arg1 to val, Arg2 to true, run next instruction
- throw(val): Throw val as an error
Arg1 is the result provided by the user.
Arg2 is a boolean which is true if the user requested a return().
Ret858585858585858890909292 Reg8 (total size 1)

Return a value from the current function.
return Arg1;
SaveGenerator134135135135138138143148148150150 Addr8 (total size 1)

Save the provided value, yield, and signal the VM to restart execution
at the provided target.
SaveGeneratorLong135136136136139139144149149151151 Addr32 (total size 4)

Save the provided value, yield, and signal the VM to restart execution
at the provided target.
SelectObject96989999999999103105105107107 Reg8, Reg8, Reg8 (total size 3)

Choose the result of a constructor: 'this' or a returned object.
Arg1 is the result.
Arg2 is the 'this' object used for the constructor.
Arg3 is the constructor's return value.
Arg1 = Arg3 instanceof Object ? Arg3 : Arg2
StartGenerator121122122122122122127132132134134 (total size 0)

Start the generator by jumping to the next instruction to begin.
Restore the stack frame if this generator has previously been suspended.
Store16202202204204 Reg8, Reg8, Reg8 (total size 3)

HEAP16[Arg2] = Arg3 (store signed or unsigned 16-bit integer)
Store32203203205205 Reg8, Reg8, Reg8 (total size 3)

HEAP32[Arg2] = Arg3 (store signed or unsigned 32-bit integer)
Store8201201203203 Reg8, Reg8, Reg8 (total size 3)

HEAP8[Arg2] = Arg3 (store signed or unsigned 8-bit integer)
StoreNPToEnvironment414141414141414244444444 Reg8, UInt8, Reg8 (total size 3)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StoreNPToEnvironmentL424242424242424345454545 Reg8, UInt16, Reg8 (total size 4)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StoreToEnvironment393939393939394042424242 Reg8, UInt8, Reg8 (total size 3)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StoreToEnvironmentL404040404040404143434343 Reg8, UInt16, Reg8 (total size 4)

Store a value in an environment.
StoreNPToEnvironment[L] store a non-pointer value in an environment
Arg1 is the environment (as fetched by GetEnvironment).
Arg2 is the environment index slot number.
Arg3 is the value.
StrictEq141414141414141515151515 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 === Arg3 (JS strict equality)
StrictNeq161616161616161717171717 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 !== Arg3 (JS strict inequality)
Sub282828282828282929292929 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 - Arg3 (JS subtraction)
Sub32191191193193 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 - Arg3 (32-bit integer subtraction)
SubN292929292929293030303030 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 - Arg3 (Numeric subtraction, skips number check)
SwitchImm118120121121121121121126131131133133 Reg8, UInt32, Addr32, UInt32, UInt32 (total size 17)

Jump table switch - using a table of offset, jump to the offset of the given
input or to the default block if out of range (or not right type)
Arg 1 is the value to be branched upon
Arg 2 is the relative offset of the jump table to be used by this
instruction. Jump tables are appended to the bytecode. Arg 3 is the relative
offset for the "default" jump. Arg 4 is the unsigned min value, if arg 1 is
less than this value jmp to
default block
Arg 5 is the unsigned max value, if arg 1 is greater than this value jmp to
default block.
Given the above, the jump table entry for a given value (that is in range)
is located at offset ip + arg2 + arg1 - arg4. We subtract arg4 to avoid
wasting space when compiling denses switches that do not start at zero. Note
that Arg2 is *unaligned* it is dynamically aligned at runtime.
Throw888888888888889193939595 Reg8 (total size 1)

Throw an exception.
throw Arg1;
ThrowIfEmpty9294949696 Reg8, Reg8 (total size 2)

If Arg2 is Empty, throw ReferenceError, otherwise move it into Arg1.
Arg1 is the destination of the return value
Arg2 is the value to check
ThrowIfHasRestrictedGlobalProperty5353 UInt32 (string_id) (total size 4)

Checks if globalThis has a restricted global property with the given name.
Arg1 is the name to check.
ThrowIfUndefinedInst8989898989 Reg8 (total size 1)

Throw ReferenceError if the operand is HermesValue::undefined
ToInt32112114115115115115115120125125127127 Reg8, Reg8 (total size 2)

Convert a value to a 32-bit signed integer.
Arg1 = Arg2 | 0
ToNumber111113114114114114114119123123125125 Reg8, Reg8 (total size 2)

Convert a value to a number.
Arg1 = Arg2 - 0
ToNumeric124124126126 Reg8, Reg8 (total size 2)

Convert a value to a numberic.
Arg1 = ToNumeric(Arg2)
TryGetById525252525252525355555757 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Get an object property by string table index, or throw if not found.
This is similar to GetById, but intended for use with global variables
where Arg2 = GetGlobalObject.
TryGetByIdLong535353535353535456565858 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Get an object property by string table index, or throw if not found.
This is similar to GetById, but intended for use with global variables
where Arg2 = GetGlobalObject.
TryPutById565656565656565759596161 Reg8, Reg8, UInt8, UInt16 (string_id) (total size 5)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TryPutByIdLong575757575757575860606262 Reg8, Reg8, UInt8, UInt32 (string_id) (total size 7)

Set an object property by string index, or throw if undeclared.
This is similar to PutById, but intended for use with global variables
where Arg1 = GetGlobalObject.
TypeOf121212121212121313131313 Reg8, Reg8 (total size 2)

Arg1 = typeof Arg2 (JS typeof)
URshift323232323232323333333333 Reg8, Reg8, Reg8 (total size 3)

Arg1 = Arg2 >>> Arg3 (JS unsigned bitshift right)
Unreachable9292939393939300000 (total size 0)

Unreachable opcode for stubs and similar. This is first so that it has the
value zero.