Adding upstream version 86.0.1.upstream/86.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 854 insertions, 0 deletions

diff --git a/js/src/jit/JSJitFrameIter.h b/js/src/jit/JSJitFrameIter.h
new file mode 100644
index 0000000000..f1d008926a
--- /dev/null
+++ b/js/src/jit/JSJitFrameIter.h
@@ -0,0 +1,854 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef jit_JSJitFrameIter_h
+#define jit_JSJitFrameIter_h
+
+#include "mozilla/Maybe.h"
+
+#include "jstypes.h"
+
+#include "jit/JitCode.h"
+#include "jit/Snapshots.h"
+#include "js/ProfilingFrameIterator.h"
+#include "vm/JSFunction.h"
+#include "vm/JSScript.h"
+
+namespace js {
+
+class ArgumentsObject;
+
+namespace jit {
+
+enum class FrameType {
+  // A JS frame is analogous to a js::InterpreterFrame, representing one
+  // scripted function activation. IonJS frames are used by the optimizing
+  // compiler.
+  IonJS,
+
+  // JS frame used by the Baseline Interpreter and Baseline JIT.
+  BaselineJS,
+
+  // Frame pushed by Baseline stubs that make non-tail calls, so that the
+  // return address -> ICEntry mapping works.
+  BaselineStub,
+
+  // The entry frame is the initial prologue block transitioning from the VM
+  // into the Ion world.
+  CppToJSJit,
+
+  // A rectifier frame sits in between two JS frames, adapting argc != nargs
+  // mismatches in calls.
+  Rectifier,
+
+  // Ion IC calling a scripted getter/setter or a VMFunction.
+  IonICCall,
+
+  // An exit frame is necessary for transitioning from a JS frame into C++.
+  // From within C++, an exit frame is always the last frame in any
+  // JitActivation.
+  Exit,
+
+  // A bailout frame is a special IonJS jit frame after a bailout, and before
+  // the reconstruction of the BaselineJS frame. From within C++, a bailout
+  // frame is always the last frame in a JitActivation iff the bailout frame
+  // information is recorded on the JitActivation.
+  Bailout,
+
+  // A wasm to JS frame is constructed during fast calls from wasm to the JS
+  // jits, used as a marker to interleave JS jit and wasm frames. From the
+  // point of view of JS JITs, this is just another kind of entry frame.
+  WasmToJSJit,
+
+  // A JS to wasm frame is constructed during fast calls from any JS jits to
+  // wasm, and is a special kind of exit frame that doesn't have the exit
+  // footer. From the point of view of the jit, it can be skipped as an exit.
+  JSJitToWasm,
+};
+
+enum ReadFrameArgsBehavior {
+  // Only read formals (i.e. [0 ... callee()->nargs]
+  ReadFrame_Formals,
+
+  // Only read overflown args (i.e. [callee()->nargs ... numActuals()]
+  ReadFrame_Overflown,
+
+  // Read all args (i.e. [0 ... numActuals()])
+  ReadFrame_Actuals
+};
+
+class CommonFrameLayout;
+class JitFrameLayout;
+class ExitFrameLayout;
+
+class BaselineFrame;
+class JitActivation;
+class SafepointIndex;
+class OsiIndex;
+
+// Iterate over the JIT stack to assert that all invariants are respected.
+//  - Check that all entry frames are aligned on JitStackAlignment.
+//  - Check that all rectifier frames keep the JitStackAlignment.
+
+void AssertJitStackInvariants(JSContext* cx);
+
+// A JSJitFrameIter can iterate over a linear frame group of JS jit frames
+// only. It will stop at the first frame that is not of the same kind, or at
+// the end of an activation.
+//
+// If you want to handle every kind of frames (including wasm frames), use
+// JitFrameIter. If you want to skip interleaved frames of other kinds, use
+// OnlyJSJitFrameIter.
+
+class JSJitFrameIter {
+ protected:
+  uint8_t* current_;
+  FrameType type_;
+  uint8_t* resumePCinCurrentFrame_;
+  size_t frameSize_;
+
+  // Size of the current Baseline frame. Equivalent to
+  // BaselineFrame::debugFrameSize_ in debug builds.
+  mozilla::Maybe<uint32_t> baselineFrameSize_;
+
+ private:
+  mutable const SafepointIndex* cachedSafepointIndex_;
+  const JitActivation* activation_;
+
+  void dumpBaseline() const;
+
+ public:
+  // See comment above the class.
+  explicit JSJitFrameIter(const JitActivation* activation);
+
+  // A constructor specialized for jit->wasm frames, which starts at a
+  // specific FP.
+  JSJitFrameIter(const JitActivation* activation, FrameType frameType,
+                 uint8_t* fp);
+
+  void setResumePCInCurrentFrame(uint8_t* newAddr) {
+    resumePCinCurrentFrame_ = newAddr;
+  }
+
+  // Current frame information.
+  FrameType type() const { return type_; }
+  uint8_t* fp() const { return current_; }
+  const JitActivation* activation() const { return activation_; }
+
+  CommonFrameLayout* current() const { return (CommonFrameLayout*)current_; }
+
+  inline uint8_t* returnAddress() const;
+
+  // Return the pointer of the JitFrame, the iterator is assumed to be settled
+  // on a scripted frame.
+  JitFrameLayout* jsFrame() const;
+
+  inline ExitFrameLayout* exitFrame() const;
+
+  // Returns whether the JS frame has been invalidated and, if so,
+  // places the invalidated Ion script in |ionScript|.
+  bool checkInvalidation(IonScript** ionScript) const;
+  bool checkInvalidation() const;
+
+  bool isExitFrame() const { return type_ == FrameType::Exit; }
+  bool isScripted() const {
+    return type_ == FrameType::BaselineJS || type_ == FrameType::IonJS ||
+           type_ == FrameType::Bailout;
+  }
+  bool isBaselineJS() const { return type_ == FrameType::BaselineJS; }
+  bool isIonScripted() const {
+    return type_ == FrameType::IonJS || type_ == FrameType::Bailout;
+  }
+  bool isIonJS() const { return type_ == FrameType::IonJS; }
+  bool isIonICCall() const { return type_ == FrameType::IonICCall; }
+  bool isBailoutJS() const { return type_ == FrameType::Bailout; }
+  bool isBaselineStub() const { return type_ == FrameType::BaselineStub; }
+  bool isRectifier() const { return type_ == FrameType::Rectifier; }
+  bool isBareExit() const;
+  template <typename T>
+  bool isExitFrameLayout() const;
+
+  static bool isEntry(FrameType type) {
+    return type == FrameType::CppToJSJit || type == FrameType::WasmToJSJit;
+  }
+  bool isEntry() const { return isEntry(type_); }
+
+  bool isFunctionFrame() const;
+
+  bool isConstructing() const;
+
+  void* calleeToken() const;
+  JSFunction* callee() const;
+  JSFunction* maybeCallee() const;
+  unsigned numActualArgs() const;
+  JSScript* script() const;
+  JSScript* maybeForwardedScript() const;
+  void baselineScriptAndPc(JSScript** scriptRes, jsbytecode** pcRes) const;
+  Value* actualArgs() const;
+
+  // Returns the address of the next instruction that will execute in this
+  // frame, once control returns to this frame.
+  uint8_t* resumePCinCurrentFrame() const { return resumePCinCurrentFrame_; }
+
+  // Previous frame information extracted from the current frame.
+  inline size_t prevFrameLocalSize() const;
+  inline FrameType prevType() const;
+  uint8_t* prevFp() const;
+
+  // Returns the stack space used by the current frame, in bytes. This does
+  // not include the size of its fixed header.
+  size_t frameSize() const {
+    MOZ_ASSERT(!isExitFrame());
+    return frameSize_;
+  }
+
+  // Functions used to iterate on frames. When prevType is an entry,
+  // the current frame is the last JS Jit frame.
+  bool done() const { return isEntry(); }
+  void operator++();
+
+  // Returns the IonScript associated with this JS frame.
+  IonScript* ionScript() const;
+
+  // Returns the IonScript associated with this JS frame; the frame must
+  // not be invalidated.
+  IonScript* ionScriptFromCalleeToken() const;
+
+  // Returns the Safepoint associated with this JS frame. Incurs a lookup
+  // overhead.
+  const SafepointIndex* safepoint() const;
+
+  // Returns the OSI index associated with this JS frame. Incurs a lookup
+  // overhead.
+  const OsiIndex* osiIndex() const;
+
+  // Returns the Snapshot offset associated with this JS frame. Incurs a
+  // lookup overhead.
+  SnapshotOffset snapshotOffset() const;
+
+  uintptr_t* spillBase() const;
+  MachineState machineState() const;
+
+  template <class Op>
+  void unaliasedForEachActual(Op op, ReadFrameArgsBehavior behavior) const {
+    MOZ_ASSERT(isBaselineJS());
+
+    unsigned nactual = numActualArgs();
+    unsigned start, end;
+    switch (behavior) {
+      case ReadFrame_Formals:
+        start = 0;
+        end = callee()->nargs();
+        break;
+      case ReadFrame_Overflown:
+        start = callee()->nargs();
+        end = nactual;
+        break;
+      case ReadFrame_Actuals:
+        start = 0;
+        end = nactual;
+    }
+
+    Value* argv = actualArgs();
+    for (unsigned i = start; i < end; i++) {
+      op(argv[i]);
+    }
+  }
+
+  void dump() const;
+
+  inline BaselineFrame* baselineFrame() const;
+
+  // Returns the number of local and expression stack Values for the current
+  // Baseline frame.
+  inline uint32_t baselineFrameNumValueSlots() const;
+
+  // This function isn't used, but we keep it here (debug-only) because it is
+  // helpful when chasing issues with the jitcode map.
+#ifdef DEBUG
+  bool verifyReturnAddressUsingNativeToBytecodeMap();
+#else
+  bool verifyReturnAddressUsingNativeToBytecodeMap() { return true; }
+#endif
+};
+
+class JitcodeGlobalTable;
+
+class JSJitProfilingFrameIterator {
+  uint8_t* fp_;
+  FrameType type_;
+  void* resumePCinCurrentFrame_;
+
+  inline JitFrameLayout* framePtr() const;
+  inline JSScript* frameScript() const;
+  [[nodiscard]] bool tryInitWithPC(void* pc);
+  [[nodiscard]] bool tryInitWithTable(JitcodeGlobalTable* table, void* pc,
+                                      bool forLastCallSite);
+
+  void moveToCppEntryFrame();
+  void moveToWasmFrame(CommonFrameLayout* frame);
+  void moveToNextFrame(CommonFrameLayout* frame);
+
+ public:
+  JSJitProfilingFrameIterator(JSContext* cx, void* pc);
+  explicit JSJitProfilingFrameIterator(CommonFrameLayout* exitFP);
+
+  void operator++();
+  bool done() const { return fp_ == nullptr; }
+
+  const char* baselineInterpreterLabel() const;
+  void baselineInterpreterScriptPC(JSScript** script, jsbytecode** pc,
+                                   uint64_t* realmID) const;
+
+  void* fp() const {
+    MOZ_ASSERT(!done());
+    return fp_;
+  }
+  void* stackAddress() const { return fp(); }
+  FrameType frameType() const {
+    MOZ_ASSERT(!done());
+    return type_;
+  }
+  void* resumePCinCurrentFrame() const {
+    MOZ_ASSERT(!done());
+    return resumePCinCurrentFrame_;
+  }
+};
+
+class RInstructionResults {
+  // Vector of results of recover instructions.
+  typedef mozilla::Vector<HeapPtr<Value>, 1, SystemAllocPolicy> Values;
+  UniquePtr<Values> results_;
+
+  // The frame pointer is used as a key to check if the current frame already
+  // bailed out.
+  JitFrameLayout* fp_;
+
+  // Record if we tried and succeed at allocating and filling the vector of
+  // recover instruction results, if needed.  This flag is needed in order to
+  // avoid evaluating the recover instruction twice.
+  bool initialized_;
+
+ public:
+  explicit RInstructionResults(JitFrameLayout* fp);
+  RInstructionResults(RInstructionResults&& src);
+
+  RInstructionResults& operator=(RInstructionResults&& rhs);
+
+  ~RInstructionResults();
+
+  [[nodiscard]] bool init(JSContext* cx, uint32_t numResults);
+  bool isInitialized() const;
+  size_t length() const;
+
+  JitFrameLayout* frame() const;
+
+  HeapPtr<Value>& operator[](size_t index);
+
+  void trace(JSTracer* trc);
+};
+
+struct MaybeReadFallback {
+  enum NoGCValue { NoGC_UndefinedValue, NoGC_MagicOptimizedOut };
+
+  enum FallbackConsequence { Fallback_Invalidate, Fallback_DoNothing };
+
+  JSContext* maybeCx;
+  JitActivation* activation;
+  const JSJitFrameIter* frame;
+  const NoGCValue unreadablePlaceholder_;
+  const FallbackConsequence consequence;
+
+  explicit MaybeReadFallback(const Value& placeholder = UndefinedValue())
+      : maybeCx(nullptr),
+        activation(nullptr),
+        frame(nullptr),
+        unreadablePlaceholder_(noGCPlaceholder(placeholder)),
+        consequence(Fallback_Invalidate) {}
+
+  MaybeReadFallback(JSContext* cx, JitActivation* activation,
+                    const JSJitFrameIter* frame,
+                    FallbackConsequence consequence = Fallback_Invalidate)
+      : maybeCx(cx),
+        activation(activation),
+        frame(frame),
+        unreadablePlaceholder_(NoGC_UndefinedValue),
+        consequence(consequence) {}
+
+  bool canRecoverResults() { return maybeCx; }
+
+  Value unreadablePlaceholder() const {
+    if (unreadablePlaceholder_ == NoGC_MagicOptimizedOut) {
+      return MagicValue(JS_OPTIMIZED_OUT);
+    }
+    return UndefinedValue();
+  }
+
+  NoGCValue noGCPlaceholder(const Value& v) const {
+    if (v.isMagic(JS_OPTIMIZED_OUT)) {
+      return NoGC_MagicOptimizedOut;
+    }
+    return NoGC_UndefinedValue;
+  }
+};
+
+class RResumePoint;
+
+// Reads frame information in snapshot-encoding order (that is, outermost frame
+// to innermost frame).
+class SnapshotIterator {
+ protected:
+  SnapshotReader snapshot_;
+  RecoverReader recover_;
+  JitFrameLayout* fp_;
+  const MachineState* machine_;
+  IonScript* ionScript_;
+  RInstructionResults* instructionResults_;
+
+  enum ReadMethod {
+    // Read the normal value.
+    RM_Normal = 1 << 0,
+
+    // Read the default value, or the normal value if there is no default.
+    RM_AlwaysDefault = 1 << 1,
+
+    // Try to read the normal value if it is readable, otherwise default to
+    // the Default value.
+    RM_NormalOrDefault = RM_Normal | RM_AlwaysDefault,
+  };
+
+ private:
+  // Read a spilled register from the machine state.
+  bool hasRegister(Register reg) const { return machine_->has(reg); }
+  uintptr_t fromRegister(Register reg) const { return machine_->read(reg); }
+
+  bool hasRegister(FloatRegister reg) const { return machine_->has(reg); }
+  double fromRegister(FloatRegister reg) const { return machine_->read(reg); }
+
+  // Read an uintptr_t from the stack.
+  bool hasStack(int32_t offset) const { return true; }
+  uintptr_t fromStack(int32_t offset) const;
+
+  bool hasInstructionResult(uint32_t index) const {
+    return instructionResults_;
+  }
+  bool hasInstructionResults() const { return instructionResults_; }
+  Value fromInstructionResult(uint32_t index) const;
+
+  Value allocationValue(const RValueAllocation& a, ReadMethod rm = RM_Normal);
+  [[nodiscard]] bool allocationReadable(const RValueAllocation& a,
+                                        ReadMethod rm = RM_Normal);
+  void writeAllocationValuePayload(const RValueAllocation& a, const Value& v);
+  void warnUnreadableAllocation();
+
+ private:
+  const FloatRegisters::RegisterContent* floatAllocationPointer(
+      const RValueAllocation& a) const;
+
+ public:
+  // Handle iterating over RValueAllocations of the snapshots.
+  inline RValueAllocation readAllocation() {
+    MOZ_ASSERT(moreAllocations());
+    return snapshot_.readAllocation();
+  }
+  Value skip() {
+    snapshot_.skipAllocation();
+    return UndefinedValue();
+  }
+
+  const RResumePoint* resumePoint() const;
+  const RInstruction* instruction() const { return recover_.instruction(); }
+
+  uint32_t numAllocations() const;
+  inline bool moreAllocations() const {
+    return snapshot_.numAllocationsRead() < numAllocations();
+  }
+
+  int32_t readOuterNumActualArgs() const;
+
+  // Used by recover instruction to store the value back into the instruction
+  // results array.
+  void storeInstructionResult(const Value& v);
+
+ public:
+  // Exhibits frame properties contained in the snapshot.
+  uint32_t pcOffset() const;
+  [[nodiscard]] inline bool resumeAfter() const {
+    // Inline frames are inlined on calls, which are considered as being
+    // resumed on the Call as baseline will push the pc once we return from
+    // the call.
+    if (moreFrames()) {
+      return false;
+    }
+    return recover_.resumeAfter();
+  }
+  inline BailoutKind bailoutKind() const { return snapshot_.bailoutKind(); }
+
+ public:
+  // Read the next instruction available and get ready to either skip it or
+  // evaluate it.
+  inline void nextInstruction() {
+    MOZ_ASSERT(snapshot_.numAllocationsRead() == numAllocations());
+    recover_.nextInstruction();
+    snapshot_.resetNumAllocationsRead();
+  }
+
+  // Skip an Instruction by walking to the next instruction and by skipping
+  // all the allocations corresponding to this instruction.
+  void skipInstruction();
+
+  inline bool moreInstructions() const { return recover_.moreInstructions(); }
+
+  // Register a vector used for storing the results of the evaluation of
+  // recover instructions. This vector should be registered before the
+  // beginning of the iteration. This function is in charge of allocating
+  // enough space for all instructions results, and return false iff it fails.
+  [[nodiscard]] bool initInstructionResults(MaybeReadFallback& fallback);
+
+ protected:
+  // This function is used internally for computing the result of the recover
+  // instructions.
+  [[nodiscard]] bool computeInstructionResults(
+      JSContext* cx, RInstructionResults* results) const;
+
+ public:
+  // Handle iterating over frames of the snapshots.
+  void nextFrame();
+  void settleOnFrame();
+
+  inline bool moreFrames() const {
+    // The last instruction is recovering the innermost frame, so as long as
+    // there is more instruction there is necesseray more frames.
+    return moreInstructions();
+  }
+
+ public:
+  // Connect all informations about the current script in order to recover the
+  // content of baseline frames.
+
+  SnapshotIterator(const JSJitFrameIter& iter,
+                   const MachineState* machineState);
+  SnapshotIterator();
+
+  Value read() { return allocationValue(readAllocation()); }
+
+  // Read the |Normal| value unless it is not available and that the snapshot
+  // provides a |Default| value. This is useful to avoid invalidations of the
+  // frame while we are only interested in a few properties which are provided
+  // by the |Default| value.
+  Value readWithDefault(RValueAllocation* alloc) {
+    *alloc = RValueAllocation();
+    RValueAllocation a = readAllocation();
+    if (allocationReadable(a)) {
+      return allocationValue(a);
+    }
+
+    *alloc = a;
+    return allocationValue(a, RM_AlwaysDefault);
+  }
+
+  Value maybeRead(const RValueAllocation& a, MaybeReadFallback& fallback);
+  Value maybeRead(MaybeReadFallback& fallback) {
+    RValueAllocation a = readAllocation();
+    return maybeRead(a, fallback);
+  }
+
+  void traceAllocation(JSTracer* trc);
+
+  template <class Op>
+  void readFunctionFrameArgs(Op& op, ArgumentsObject** argsObj, Value* thisv,
+                             unsigned start, unsigned end, JSScript* script,
+                             MaybeReadFallback& fallback) {
+    // Assumes that the common frame arguments have already been read.
+    if (script->argumentsHasVarBinding()) {
+      if (argsObj) {
+        Value v = read();
+        if (v.isObject()) {
+          *argsObj = &v.toObject().as<ArgumentsObject>();
+        }
+      } else {
+        skip();
+      }
+    }
+
+    if (thisv) {
+      *thisv = maybeRead(fallback);
+    } else {
+      skip();
+    }
+
+    unsigned i = 0;
+    if (end < start) {
+      i = start;
+    }
+
+    for (; i < start; i++) {
+      skip();
+    }
+    for (; i < end; i++) {
+      // We are not always able to read values from the snapshots, some values
+      // such as non-gc things may still be live in registers and cause an
+      // error while reading the machine state.
+      Value v = maybeRead(fallback);
+      op(v);
+    }
+  }
+
+  // Iterate over all the allocations and return only the value of the
+  // allocation located at one index.
+  Value maybeReadAllocByIndex(size_t index);
+
+#ifdef TRACK_SNAPSHOTS
+  void spewBailingFrom() const { snapshot_.spewBailingFrom(); }
+#endif
+};
+
+// Reads frame information in callstack order (that is, innermost frame to
+// outermost frame).
+class InlineFrameIterator {
+  const JSJitFrameIter* frame_;
+  SnapshotIterator start_;
+  SnapshotIterator si_;
+  uint32_t framesRead_;
+
+  // When the inline-frame-iterator is created, this variable is defined to
+  // UINT32_MAX. Then the first iteration of findNextFrame, which settle on
+  // the innermost frame, is used to update this counter to the number of
+  // frames contained in the recover buffer.
+  uint32_t frameCount_;
+
+  // The |calleeTemplate_| fields contains either the JSFunction or the
+  // template from which it is supposed to be cloned. The |calleeRVA_| is an
+  // Invalid value allocation, if the |calleeTemplate_| field is the effective
+  // JSFunction, and not its template. On the other hand, any other value
+  // allocation implies that the |calleeTemplate_| is the template JSFunction
+  // from which the effective one would be derived and cached by the Recover
+  // instruction result.
+  RootedFunction calleeTemplate_;
+  RValueAllocation calleeRVA_;
+
+  RootedScript script_;
+  jsbytecode* pc_;
+  uint32_t numActualArgs_;
+
+  // Register state, used by all snapshot iterators.
+  MachineState machine_;
+
+  struct Nop {
+    void operator()(const Value& v) {}
+  };
+
+ private:
+  void findNextFrame();
+  JSObject* computeEnvironmentChain(const Value& envChainValue,
+                                    MaybeReadFallback& fallback,
+                                    bool* hasInitialEnv = nullptr) const;
+
+ public:
+  InlineFrameIterator(JSContext* cx, const JSJitFrameIter* iter);
+  InlineFrameIterator(JSContext* cx, const InlineFrameIterator* iter);
+
+  bool more() const { return frame_ && framesRead_ < frameCount_; }
+
+  // Due to optimizations, we are not always capable of reading the callee of
+  // inlined frames without invalidating the IonCode. This function might
+  // return either the effective callee of the JSFunction which might be used
+  // to create it.
+  //
+  // As such, the |calleeTemplate()| can be used to read most of the metadata
+  // which are conserved across clones.
+  JSFunction* calleeTemplate() const {
+    MOZ_ASSERT(isFunctionFrame());
+    return calleeTemplate_;
+  }
+  JSFunction* maybeCalleeTemplate() const { return calleeTemplate_; }
+
+  JSFunction* callee(MaybeReadFallback& fallback) const;
+
+  unsigned numActualArgs() const {
+    // The number of actual arguments of inline frames is recovered by the
+    // iteration process. It is recovered from the bytecode because this
+    // property still hold since the for inlined frames. This property does not
+    // hold for the parent frame because it can have optimize a call to
+    // js_fun_call or js_fun_apply.
+    if (more()) {
+      return numActualArgs_;
+    }
+
+    return frame_->numActualArgs();
+  }
+
+  template <class ArgOp, class LocalOp>
+  void readFrameArgsAndLocals(JSContext* cx, ArgOp& argOp, LocalOp& localOp,
+                              JSObject** envChain, bool* hasInitialEnv,
+                              Value* rval, ArgumentsObject** argsObj,
+                              Value* thisv, Value* newTarget,
+                              ReadFrameArgsBehavior behavior,
+                              MaybeReadFallback& fallback) const {
+    SnapshotIterator s(si_);
+
+    // Read the env chain.
+    if (envChain) {
+      Value envChainValue = s.maybeRead(fallback);
+      *envChain =
+          computeEnvironmentChain(envChainValue, fallback, hasInitialEnv);
+    } else {
+      s.skip();
+    }
+
+    // Read return value.
+    if (rval) {
+      *rval = s.maybeRead(fallback);
+    } else {
+      s.skip();
+    }
+
+    if (newTarget) {
+      // For now, only support reading new.target when we are reading
+      // overflown arguments.
+      MOZ_ASSERT(behavior != ReadFrame_Formals);
+      newTarget->setUndefined();
+    }
+
+    // Read arguments, which only function frames have.
+    if (isFunctionFrame()) {
+      unsigned nactual = numActualArgs();
+      unsigned nformal = calleeTemplate()->nargs();
+
+      // Get the non overflown arguments, which are taken from the inlined
+      // frame, because it will have the updated value when JSOp::SetArg is
+      // done.
+      if (behavior != ReadFrame_Overflown) {
+        s.readFunctionFrameArgs(argOp, argsObj, thisv, 0, nformal, script(),
+                                fallback);
+      }
+
+      if (behavior != ReadFrame_Formals) {
+        if (more()) {
+          // There is still a parent frame of this inlined frame.  All
+          // arguments (also the overflown) are the last pushed values
+          // in the parent frame.  To get the overflown arguments, we
+          // need to take them from there.
+
+          // The overflown arguments are not available in current frame.
+          // They are the last pushed arguments in the parent frame of
+          // this inlined frame.
+          InlineFrameIterator it(cx, this);
+          ++it;
+          unsigned argsObjAdj = it.script()->argumentsHasVarBinding() ? 1 : 0;
+          bool hasNewTarget = isConstructing();
+          SnapshotIterator parent_s(it.snapshotIterator());
+
+          // Skip over all slots until we get to the last slots
+          // (= arguments slots of callee) the +3 is for [this], [returnvalue],
+          // [envchain], and maybe +1 for [argsObj]
+          MOZ_ASSERT(parent_s.numAllocations() >=
+                     nactual + 3 + argsObjAdj + hasNewTarget);
+          unsigned skip = parent_s.numAllocations() - nactual - 3 - argsObjAdj -
+                          hasNewTarget;
+          for (unsigned j = 0; j < skip; j++) {
+            parent_s.skip();
+          }
+
+          // Get the overflown arguments
+          MaybeReadFallback unusedFallback;
+          parent_s.skip();  // env chain
+          parent_s.skip();  // return value
+          parent_s.readFunctionFrameArgs(argOp, nullptr, nullptr, nformal,
+                                         nactual, it.script(), fallback);
+          if (newTarget && isConstructing()) {
+            *newTarget = parent_s.maybeRead(fallback);
+          }
+        } else {
+          // There is no parent frame to this inlined frame, we can read
+          // from the frame's Value vector directly.
+          Value* argv = frame_->actualArgs();
+          for (unsigned i = nformal; i < nactual; i++) {
+            argOp(argv[i]);
+          }
+          if (newTarget && isConstructing()) {
+            *newTarget = argv[nactual];
+          }
+        }
+      }
+    }
+
+    // At this point we've read all the formals in s, and can read the
+    // locals.
+    for (unsigned i = 0; i < script()->nfixed(); i++) {
+      localOp(s.maybeRead(fallback));
+    }
+  }
+
+  template <class Op>
+  void unaliasedForEachActual(JSContext* cx, Op op,
+                              ReadFrameArgsBehavior behavior,
+                              MaybeReadFallback& fallback) const {
+    Nop nop;
+    readFrameArgsAndLocals(cx, op, nop, nullptr, nullptr, nullptr, nullptr,
+                           nullptr, nullptr, behavior, fallback);
+  }
+
+  JSScript* script() const { return script_; }
+  jsbytecode* pc() const { return pc_; }
+  SnapshotIterator snapshotIterator() const { return si_; }
+  bool isFunctionFrame() const;
+  bool isModuleFrame() const;
+  bool isConstructing() const;
+
+  JSObject* environmentChain(MaybeReadFallback& fallback,
+                             bool* hasInitialEnvironment = nullptr) const {
+    SnapshotIterator s(si_);
+
+    // envChain
+    Value v = s.maybeRead(fallback);
+    return computeEnvironmentChain(v, fallback, hasInitialEnvironment);
+  }
+
+  Value thisArgument(MaybeReadFallback& fallback) const {
+    SnapshotIterator s(si_);
+
+    // envChain
+    s.skip();
+
+    // return value
+    s.skip();
+
+    // Arguments object.
+    if (script()->argumentsHasVarBinding()) {
+      s.skip();
+    }
+
+    return s.maybeRead(fallback);
+  }
+
+  InlineFrameIterator& operator++() {
+    findNextFrame();
+    return *this;
+  }
+
+  void dump() const;
+
+  void resetOn(const JSJitFrameIter* iter);
+
+  const JSJitFrameIter& frame() const { return *frame_; }
+
+  // Inline frame number, 0 for the outermost (non-inlined) frame.
+  size_t frameNo() const { return frameCount() - framesRead_; }
+  size_t frameCount() const {
+    MOZ_ASSERT(frameCount_ != UINT32_MAX);
+    return frameCount_;
+  }
+
+ private:
+  InlineFrameIterator() = delete;
+  InlineFrameIterator(const InlineFrameIterator& iter) = delete;
+};
+
+}  // namespace jit
+}  // namespace js
+
+#endif /* jit_JSJitFrameIter_h */