Adding upstream version 115.7.0esr.upstream/115.7.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1314 insertions, 0 deletions

diff --git a/js/src/jit/CacheIRCompiler.h b/js/src/jit/CacheIRCompiler.h
new file mode 100644
index 0000000000..465db7a9b8
--- /dev/null
+++ b/js/src/jit/CacheIRCompiler.h
@@ -0,0 +1,1314 @@
+/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*-
+ * vim: set ts=8 sts=2 et sw=2 tw=80:
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef jit_CacheIRCompiler_h
+#define jit_CacheIRCompiler_h
+
+#include "mozilla/Casting.h"
+#include "mozilla/Maybe.h"
+
+#include "jit/CacheIR.h"
+#include "jit/CacheIRReader.h"
+#include "jit/CacheIRWriter.h"
+#include "jit/JitOptions.h"
+#include "jit/MacroAssembler.h"
+#include "jit/PerfSpewer.h"
+#include "jit/SharedICRegisters.h"
+#include "js/ScalarType.h"  // js::Scalar::Type
+
+namespace JS {
+class BigInt;
+}
+
+namespace js {
+
+class TypedArrayObject;
+enum class UnaryMathFunction : uint8_t;
+
+namespace jit {
+
+class BaselineCacheIRCompiler;
+class ICCacheIRStub;
+class IonCacheIRCompiler;
+class IonScript;
+
+enum class ICStubEngine : uint8_t;
+
+// [SMDOC] CacheIR Value Representation and Tracking
+//
+// While compiling an IC stub the CacheIR compiler needs to keep track of the
+// physical location for each logical piece of data we care about, as well as
+// ensure that in the case of a stub failing, we are able to restore the input
+// state so that a subsequent stub can attempt to provide a value.
+//
+// OperandIds are created in the CacheIR front-end to keep track of values that
+// are passed between CacheIR ops during the execution of a given CacheIR stub.
+// In the CacheRegisterAllocator these OperandIds are given OperandLocations,
+// that represent the physical location of the OperandId at a given point in
+// time during CacheRegister allocation.
+//
+// In the CacheRegisterAllocator physical locations include the stack, and
+// registers, as well as whether or not the value has been unboxed or not.
+// Constants are also represented separately to provide for on-demand
+// materialization.
+//
+// Intra-op Register allocation:
+//
+// During the emission of a CacheIR op, code can ask the CacheRegisterAllocator
+// for access to a particular OperandId, and the register allocator will
+// generate the required code to fill that request.
+//
+// Input OperandIds should be considered as immutable, and should not be mutated
+// during the execution of a stub.
+//
+// There are also a number of RAII classes that interact with the register
+// allocator, in order to provide access to more registers than just those
+// provided for by the OperandIds.
+//
+// - AutoOutputReg: The register which will hold the output value of the stub.
+// - AutoScratchReg: By default, an arbitrary scratch register, however a
+//   specific register can be requested.
+// - AutoScratchRegMaybeOutput: Any arbitrary scratch register, but the output
+//   register may be used as well.
+//
+// These RAII classes take ownership of a register for the duration of their
+// lifetime so they can be used for computation or output. The register
+// allocator can spill values with OperandLocations in order to try to ensure
+// that a register is made available for use.
+//
+// If a specific register is required (via AutoScratchRegister), it should be
+// the first register acquired, as the register rallocator will be unable to
+// allocate the fixed register if the current op is using it for something else.
+//
+// If no register can be provided after attempting to spill, a
+// MOZ_RELEASE_ASSERT ensures the browser will crash. The register allocator is
+// not provided enough information in its current design to insert spills and
+// fills at arbitrary locations, and so it can fail to find an allocation
+// solution. However, this will only happen within the implementation of an
+// operand emitter, and because the cache register allocator is mostly
+// determinstic, so long as the operand id emitter is tested, this won't
+// suddenly crop up in an arbitrary webpage. It's worth noting the most
+// difficult platform to support is x86-32, because it has the least number of
+// registers available.
+//
+// FailurePaths checkpoint the state of the register allocator so that the input
+// state can be recomputed from the current state before jumping to the next
+// stub in the IC chain. An important invariant is that the FailurePath must be
+// allocated for each op after all the manipulation of OperandLocations has
+// happened, so that its recording is correct.
+//
+// Inter-op Register Allocation:
+//
+// The RAII register management classes are RAII because all register state
+// outside the OperandLocations is reset before the compilation of each
+// individual CacheIR op. This means that you cannot rely on a value surviving
+// between ops, even if you use the ability of AutoScratchRegister to name a
+// specific register. Values that need to be preserved between ops must be given
+// an OperandId.
+
+// Represents a Value on the Baseline frame's expression stack. Slot 0 is the
+// value on top of the stack (the most recently pushed value), slot 1 is the
+// value pushed before that, etc.
+class BaselineFrameSlot {
+  uint32_t slot_;
+
+ public:
+  explicit BaselineFrameSlot(uint32_t slot) : slot_(slot) {}
+  uint32_t slot() const { return slot_; }
+
+  bool operator==(const BaselineFrameSlot& other) const {
+    return slot_ == other.slot_;
+  }
+  bool operator!=(const BaselineFrameSlot& other) const {
+    return slot_ != other.slot_;
+  }
+};
+
+// OperandLocation represents the location of an OperandId. The operand is
+// either in a register or on the stack, and is either boxed or unboxed.
+class OperandLocation {
+ public:
+  enum Kind {
+    Uninitialized = 0,
+    PayloadReg,
+    DoubleReg,
+    ValueReg,
+    PayloadStack,
+    ValueStack,
+    BaselineFrame,
+    Constant,
+  };
+
+ private:
+  Kind kind_;
+
+  union Data {
+    struct {
+      Register reg;
+      JSValueType type;
+    } payloadReg;
+    FloatRegister doubleReg;
+    ValueOperand valueReg;
+    struct {
+      uint32_t stackPushed;
+      JSValueType type;
+    } payloadStack;
+    uint32_t valueStackPushed;
+    BaselineFrameSlot baselineFrameSlot;
+    Value constant;
+
+    Data() : valueStackPushed(0) {}
+  };
+  Data data_;
+
+ public:
+  OperandLocation() : kind_(Uninitialized) {}
+
+  Kind kind() const { return kind_; }
+
+  void setUninitialized() { kind_ = Uninitialized; }
+
+  ValueOperand valueReg() const {
+    MOZ_ASSERT(kind_ == ValueReg);
+    return data_.valueReg;
+  }
+  Register payloadReg() const {
+    MOZ_ASSERT(kind_ == PayloadReg);
+    return data_.payloadReg.reg;
+  }
+  FloatRegister doubleReg() const {
+    MOZ_ASSERT(kind_ == DoubleReg);
+    return data_.doubleReg;
+  }
+  uint32_t payloadStack() const {
+    MOZ_ASSERT(kind_ == PayloadStack);
+    return data_.payloadStack.stackPushed;
+  }
+  uint32_t valueStack() const {
+    MOZ_ASSERT(kind_ == ValueStack);
+    return data_.valueStackPushed;
+  }
+  JSValueType payloadType() const {
+    if (kind_ == PayloadReg) {
+      return data_.payloadReg.type;
+    }
+    MOZ_ASSERT(kind_ == PayloadStack);
+    return data_.payloadStack.type;
+  }
+  Value constant() const {
+    MOZ_ASSERT(kind_ == Constant);
+    return data_.constant;
+  }
+  BaselineFrameSlot baselineFrameSlot() const {
+    MOZ_ASSERT(kind_ == BaselineFrame);
+    return data_.baselineFrameSlot;
+  }
+
+  void setPayloadReg(Register reg, JSValueType type) {
+    kind_ = PayloadReg;
+    data_.payloadReg.reg = reg;
+    data_.payloadReg.type = type;
+  }
+  void setDoubleReg(FloatRegister reg) {
+    kind_ = DoubleReg;
+    data_.doubleReg = reg;
+  }
+  void setValueReg(ValueOperand reg) {
+    kind_ = ValueReg;
+    data_.valueReg = reg;
+  }
+  void setPayloadStack(uint32_t stackPushed, JSValueType type) {
+    kind_ = PayloadStack;
+    data_.payloadStack.stackPushed = stackPushed;
+    data_.payloadStack.type = type;
+  }
+  void setValueStack(uint32_t stackPushed) {
+    kind_ = ValueStack;
+    data_.valueStackPushed = stackPushed;
+  }
+  void setConstant(const Value& v) {
+    kind_ = Constant;
+    data_.constant = v;
+  }
+  void setBaselineFrame(BaselineFrameSlot slot) {
+    kind_ = BaselineFrame;
+    data_.baselineFrameSlot = slot;
+  }
+
+  bool isUninitialized() const { return kind_ == Uninitialized; }
+  bool isInRegister() const { return kind_ == PayloadReg || kind_ == ValueReg; }
+  bool isOnStack() const {
+    return kind_ == PayloadStack || kind_ == ValueStack;
+  }
+
+  size_t stackPushed() const {
+    if (kind_ == PayloadStack) {
+      return data_.payloadStack.stackPushed;
+    }
+    MOZ_ASSERT(kind_ == ValueStack);
+    return data_.valueStackPushed;
+  }
+  size_t stackSizeInBytes() const {
+    if (kind_ == PayloadStack) {
+      return sizeof(uintptr_t);
+    }
+    MOZ_ASSERT(kind_ == ValueStack);
+    return sizeof(js::Value);
+  }
+  void adjustStackPushed(int32_t diff) {
+    if (kind_ == PayloadStack) {
+      data_.payloadStack.stackPushed += diff;
+      return;
+    }
+    MOZ_ASSERT(kind_ == ValueStack);
+    data_.valueStackPushed += diff;
+  }
+
+  bool aliasesReg(Register reg) const {
+    if (kind_ == PayloadReg) {
+      return payloadReg() == reg;
+    }
+    if (kind_ == ValueReg) {
+      return valueReg().aliases(reg);
+    }
+    return false;
+  }
+  bool aliasesReg(ValueOperand reg) const {
+#if defined(JS_NUNBOX32)
+    return aliasesReg(reg.typeReg()) || aliasesReg(reg.payloadReg());
+#else
+    return aliasesReg(reg.valueReg());
+#endif
+  }
+
+  bool aliasesReg(const OperandLocation& other) const;
+
+  bool operator==(const OperandLocation& other) const;
+  bool operator!=(const OperandLocation& other) const {
+    return !operator==(other);
+  }
+};
+
+struct SpilledRegister {
+  Register reg;
+  uint32_t stackPushed;
+
+  SpilledRegister(Register reg, uint32_t stackPushed)
+      : reg(reg), stackPushed(stackPushed) {}
+  bool operator==(const SpilledRegister& other) const {
+    return reg == other.reg && stackPushed == other.stackPushed;
+  }
+  bool operator!=(const SpilledRegister& other) const {
+    return !(*this == other);
+  }
+};
+
+using SpilledRegisterVector = Vector<SpilledRegister, 2, SystemAllocPolicy>;
+
+// Class to track and allocate registers while emitting IC code.
+class MOZ_RAII CacheRegisterAllocator {
+  // The original location of the inputs to the cache.
+  Vector<OperandLocation, 4, SystemAllocPolicy> origInputLocations_;
+
+  // The current location of each operand.
+  Vector<OperandLocation, 8, SystemAllocPolicy> operandLocations_;
+
+  // Free lists for value- and payload-slots on stack
+  Vector<uint32_t, 2, SystemAllocPolicy> freeValueSlots_;
+  Vector<uint32_t, 2, SystemAllocPolicy> freePayloadSlots_;
+
+  // The registers allocated while emitting the current CacheIR op.
+  // This prevents us from allocating a register and then immediately
+  // clobbering it for something else, while we're still holding on to it.
+  LiveGeneralRegisterSet currentOpRegs_;
+
+  const AllocatableGeneralRegisterSet allocatableRegs_;
+
+  // Registers that are currently unused and available.
+  AllocatableGeneralRegisterSet availableRegs_;
+
+  // Registers that are available, but before use they must be saved and
+  // then restored when returning from the stub.
+  AllocatableGeneralRegisterSet availableRegsAfterSpill_;
+
+  // Registers we took from availableRegsAfterSpill_ and spilled to the stack.
+  SpilledRegisterVector spilledRegs_;
+
+  // The number of bytes pushed on the native stack.
+  uint32_t stackPushed_;
+
+#ifdef DEBUG
+  // Flag used to assert individual CacheIR instructions don't allocate
+  // registers after calling addFailurePath.
+  bool addedFailurePath_;
+#endif
+
+  // The index of the CacheIR instruction we're currently emitting.
+  uint32_t currentInstruction_;
+
+  // Whether the stack contains a double spilled by AutoScratchFloatRegister.
+  bool hasAutoScratchFloatRegisterSpill_ = false;
+
+  const CacheIRWriter& writer_;
+
+  CacheRegisterAllocator(const CacheRegisterAllocator&) = delete;
+  CacheRegisterAllocator& operator=(const CacheRegisterAllocator&) = delete;
+
+  void freeDeadOperandLocations(MacroAssembler& masm);
+
+  void spillOperandToStack(MacroAssembler& masm, OperandLocation* loc);
+  void spillOperandToStackOrRegister(MacroAssembler& masm,
+                                     OperandLocation* loc);
+
+  void popPayload(MacroAssembler& masm, OperandLocation* loc, Register dest);
+  void popValue(MacroAssembler& masm, OperandLocation* loc, ValueOperand dest);
+  Address payloadAddress(MacroAssembler& masm,
+                         const OperandLocation* loc) const;
+  Address valueAddress(MacroAssembler& masm, const OperandLocation* loc) const;
+
+#ifdef DEBUG
+  void assertValidState() const;
+#endif
+
+ public:
+  friend class AutoScratchRegister;
+  friend class AutoScratchRegisterExcluding;
+
+  explicit CacheRegisterAllocator(const CacheIRWriter& writer)
+      : allocatableRegs_(GeneralRegisterSet::All()),
+        stackPushed_(0),
+#ifdef DEBUG
+        addedFailurePath_(false),
+#endif
+        currentInstruction_(0),
+        writer_(writer) {
+  }
+
+  [[nodiscard]] bool init();
+
+  void initAvailableRegs(const AllocatableGeneralRegisterSet& available) {
+    availableRegs_ = available;
+  }
+  void initAvailableRegsAfterSpill();
+
+  void fixupAliasedInputs(MacroAssembler& masm);
+
+  OperandLocation operandLocation(size_t i) const {
+    return operandLocations_[i];
+  }
+  void setOperandLocation(size_t i, const OperandLocation& loc) {
+    operandLocations_[i] = loc;
+  }
+
+  OperandLocation origInputLocation(size_t i) const {
+    return origInputLocations_[i];
+  }
+  void initInputLocation(size_t i, ValueOperand reg) {
+    origInputLocations_[i].setValueReg(reg);
+    operandLocations_[i].setValueReg(reg);
+  }
+  void initInputLocation(size_t i, Register reg, JSValueType type) {
+    origInputLocations_[i].setPayloadReg(reg, type);
+    operandLocations_[i].setPayloadReg(reg, type);
+  }
+  void initInputLocation(size_t i, FloatRegister reg) {
+    origInputLocations_[i].setDoubleReg(reg);
+    operandLocations_[i].setDoubleReg(reg);
+  }
+  void initInputLocation(size_t i, const Value& v) {
+    origInputLocations_[i].setConstant(v);
+    operandLocations_[i].setConstant(v);
+  }
+  void initInputLocation(size_t i, BaselineFrameSlot slot) {
+    origInputLocations_[i].setBaselineFrame(slot);
+    operandLocations_[i].setBaselineFrame(slot);
+  }
+
+  void initInputLocation(size_t i, const TypedOrValueRegister& reg);
+  void initInputLocation(size_t i, const ConstantOrRegister& value);
+
+  const SpilledRegisterVector& spilledRegs() const { return spilledRegs_; }
+
+  [[nodiscard]] bool setSpilledRegs(const SpilledRegisterVector& regs) {
+    spilledRegs_.clear();
+    return spilledRegs_.appendAll(regs);
+  }
+
+  bool hasAutoScratchFloatRegisterSpill() const {
+    return hasAutoScratchFloatRegisterSpill_;
+  }
+  void setHasAutoScratchFloatRegisterSpill(bool b) {
+    MOZ_ASSERT(hasAutoScratchFloatRegisterSpill_ != b);
+    hasAutoScratchFloatRegisterSpill_ = b;
+  }
+
+  void nextOp() {
+#ifdef DEBUG
+    assertValidState();
+    addedFailurePath_ = false;
+#endif
+    currentOpRegs_.clear();
+    currentInstruction_++;
+  }
+
+#ifdef DEBUG
+  void setAddedFailurePath() {
+    MOZ_ASSERT(!addedFailurePath_, "multiple failure paths for instruction");
+    addedFailurePath_ = true;
+  }
+#endif
+
+  bool isDeadAfterInstruction(OperandId opId) const {
+    return writer_.operandIsDead(opId.id(), currentInstruction_ + 1);
+  }
+
+  uint32_t stackPushed() const { return stackPushed_; }
+  void setStackPushed(uint32_t pushed) { stackPushed_ = pushed; }
+
+  bool isAllocatable(Register reg) const { return allocatableRegs_.has(reg); }
+
+  // Allocates a new register.
+  Register allocateRegister(MacroAssembler& masm);
+  ValueOperand allocateValueRegister(MacroAssembler& masm);
+
+  void allocateFixedRegister(MacroAssembler& masm, Register reg);
+  void allocateFixedValueRegister(MacroAssembler& masm, ValueOperand reg);
+
+  // Releases a register so it can be reused later.
+  void releaseRegister(Register reg) {
+    MOZ_ASSERT(currentOpRegs_.has(reg));
+    availableRegs_.add(reg);
+    currentOpRegs_.take(reg);
+  }
+  void releaseValueRegister(ValueOperand reg) {
+#ifdef JS_NUNBOX32
+    releaseRegister(reg.payloadReg());
+    releaseRegister(reg.typeReg());
+#else
+    releaseRegister(reg.valueReg());
+#endif
+  }
+
+  // Removes spilled values from the native stack. This should only be
+  // called after all registers have been allocated.
+  void discardStack(MacroAssembler& masm);
+
+  Address addressOf(MacroAssembler& masm, BaselineFrameSlot slot) const;
+  BaseValueIndex addressOf(MacroAssembler& masm, Register argcReg,
+                           BaselineFrameSlot slot) const;
+
+  // Returns the register for the given operand. If the operand is currently
+  // not in a register, it will load it into one.
+  ValueOperand useValueRegister(MacroAssembler& masm, ValOperandId val);
+  Register useRegister(MacroAssembler& masm, TypedOperandId typedId);
+
+  ConstantOrRegister useConstantOrRegister(MacroAssembler& masm,
+                                           ValOperandId val);
+
+  // Allocates an output register for the given operand.
+  Register defineRegister(MacroAssembler& masm, TypedOperandId typedId);
+  ValueOperand defineValueRegister(MacroAssembler& masm, ValOperandId val);
+
+  // Loads (potentially coercing) and unboxes a value into a float register
+  // This is infallible, as there should have been a previous guard
+  // to ensure the value is already a number.
+  // Does not change the allocator's state.
+  void ensureDoubleRegister(MacroAssembler& masm, NumberOperandId op,
+                            FloatRegister dest) const;
+
+  // Loads an unboxed value into a scratch register. This can be useful
+  // especially on 32-bit x86 when there are not enough registers for
+  // useRegister.
+  // Does not change the allocator's state.
+  void copyToScratchRegister(MacroAssembler& masm, TypedOperandId typedId,
+                             Register dest) const;
+  void copyToScratchValueRegister(MacroAssembler& masm, ValOperandId valId,
+                                  ValueOperand dest) const;
+
+  // Returns |val|'s JSValueType or JSVAL_TYPE_UNKNOWN.
+  JSValueType knownType(ValOperandId val) const;
+
+  // Emits code to restore registers and stack to the state at the start of
+  // the stub.
+  void restoreInputState(MacroAssembler& masm, bool discardStack = true);
+
+  // Returns the set of registers storing the IC input operands.
+  GeneralRegisterSet inputRegisterSet() const;
+
+  void saveIonLiveRegisters(MacroAssembler& masm, LiveRegisterSet liveRegs,
+                            Register scratch, IonScript* ionScript);
+  void restoreIonLiveRegisters(MacroAssembler& masm, LiveRegisterSet liveRegs);
+};
+
+// RAII class to allocate a scratch register and release it when we're done
+// with it.
+class MOZ_RAII AutoScratchRegister {
+  CacheRegisterAllocator& alloc_;
+  Register reg_;
+
+  AutoScratchRegister(const AutoScratchRegister&) = delete;
+  void operator=(const AutoScratchRegister&) = delete;
+
+ public:
+  AutoScratchRegister(CacheRegisterAllocator& alloc, MacroAssembler& masm,
+                      Register reg = InvalidReg)
+      : alloc_(alloc) {
+    if (reg != InvalidReg) {
+      alloc.allocateFixedRegister(masm, reg);
+      reg_ = reg;
+    } else {
+      reg_ = alloc.allocateRegister(masm);
+    }
+    MOZ_ASSERT(alloc_.currentOpRegs_.has(reg_));
+  }
+  ~AutoScratchRegister() { alloc_.releaseRegister(reg_); }
+
+  Register get() const { return reg_; }
+  operator Register() const { return reg_; }
+};
+
+// On x86, spectreBoundsCheck32 can emit better code if it has a scratch
+// register and index masking is enabled.
+class MOZ_RAII AutoSpectreBoundsScratchRegister {
+  mozilla::Maybe<AutoScratchRegister> scratch_;
+  Register reg_ = InvalidReg;
+
+  AutoSpectreBoundsScratchRegister(const AutoSpectreBoundsScratchRegister&) =
+      delete;
+  void operator=(const AutoSpectreBoundsScratchRegister&) = delete;
+
+ public:
+  AutoSpectreBoundsScratchRegister(CacheRegisterAllocator& alloc,
+                                   MacroAssembler& masm) {
+#ifdef JS_CODEGEN_X86
+    if (JitOptions.spectreIndexMasking) {
+      scratch_.emplace(alloc, masm);
+      reg_ = scratch_->get();
+    }
+#endif
+  }
+
+  Register get() const { return reg_; }
+  operator Register() const { return reg_; }
+};
+
+// Scratch Register64. Implemented with a single AutoScratchRegister on 64-bit
+// platforms and two AutoScratchRegisters on 32-bit platforms.
+class MOZ_RAII AutoScratchRegister64 {
+  AutoScratchRegister reg1_;
+#if JS_BITS_PER_WORD == 32
+  AutoScratchRegister reg2_;
+#endif
+
+ public:
+  AutoScratchRegister64(const AutoScratchRegister64&) = delete;
+  void operator=(const AutoScratchRegister64&) = delete;
+
+#if JS_BITS_PER_WORD == 32
+  AutoScratchRegister64(CacheRegisterAllocator& alloc, MacroAssembler& masm)
+      : reg1_(alloc, masm), reg2_(alloc, masm) {}
+
+  Register64 get() const { return Register64(reg1_, reg2_); }
+#else
+  AutoScratchRegister64(CacheRegisterAllocator& alloc, MacroAssembler& masm)
+      : reg1_(alloc, masm) {}
+
+  Register64 get() const { return Register64(reg1_); }
+#endif
+
+  operator Register64() const { return get(); }
+};
+
+// Scratch ValueOperand. Implemented with a single AutoScratchRegister on 64-bit
+// platforms and two AutoScratchRegisters on 32-bit platforms.
+class MOZ_RAII AutoScratchValueRegister {
+  AutoScratchRegister reg1_;
+#if JS_BITS_PER_WORD == 32
+  AutoScratchRegister reg2_;
+#endif
+
+ public:
+  AutoScratchValueRegister(const AutoScratchValueRegister&) = delete;
+  void operator=(const AutoScratchValueRegister&) = delete;
+
+#if JS_BITS_PER_WORD == 32
+  AutoScratchValueRegister(CacheRegisterAllocator& alloc, MacroAssembler& masm)
+      : reg1_(alloc, masm), reg2_(alloc, masm) {}
+
+  ValueOperand get() const { return ValueOperand(reg1_, reg2_); }
+#else
+  AutoScratchValueRegister(CacheRegisterAllocator& alloc, MacroAssembler& masm)
+      : reg1_(alloc, masm) {}
+
+  ValueOperand get() const { return ValueOperand(reg1_); }
+#endif
+
+  operator ValueOperand() const { return get(); }
+};
+
+// The FailurePath class stores everything we need to generate a failure path
+// at the end of the IC code. The failure path restores the input registers, if
+// needed, and jumps to the next stub.
+class FailurePath {
+  Vector<OperandLocation, 4, SystemAllocPolicy> inputs_;
+  SpilledRegisterVector spilledRegs_;
+  NonAssertingLabel label_;
+  uint32_t stackPushed_;
+#ifdef DEBUG
+  // Flag to ensure FailurePath::label() isn't taken while there's a scratch
+  // float register which still needs to be restored.
+  bool hasAutoScratchFloatRegister_ = false;
+#endif
+
+ public:
+  FailurePath() = default;
+
+  FailurePath(FailurePath&& other)
+      : inputs_(std::move(other.inputs_)),
+        spilledRegs_(std::move(other.spilledRegs_)),
+        label_(other.label_),
+        stackPushed_(other.stackPushed_) {}
+
+  Label* labelUnchecked() { return &label_; }
+  Label* label() {
+    MOZ_ASSERT(!hasAutoScratchFloatRegister_);
+    return labelUnchecked();
+  }
+
+  void setStackPushed(uint32_t i) { stackPushed_ = i; }
+  uint32_t stackPushed() const { return stackPushed_; }
+
+  [[nodiscard]] bool appendInput(const OperandLocation& loc) {
+    return inputs_.append(loc);
+  }
+  OperandLocation input(size_t i) const { return inputs_[i]; }
+
+  const SpilledRegisterVector& spilledRegs() const { return spilledRegs_; }
+
+  [[nodiscard]] bool setSpilledRegs(const SpilledRegisterVector& regs) {
+    MOZ_ASSERT(spilledRegs_.empty());
+    return spilledRegs_.appendAll(regs);
+  }
+
+  // If canShareFailurePath(other) returns true, the same machine code will
+  // be emitted for two failure paths, so we can share them.
+  bool canShareFailurePath(const FailurePath& other) const;
+
+  void setHasAutoScratchFloatRegister() {
+#ifdef DEBUG
+    MOZ_ASSERT(!hasAutoScratchFloatRegister_);
+    hasAutoScratchFloatRegister_ = true;
+#endif
+  }
+
+  void clearHasAutoScratchFloatRegister() {
+#ifdef DEBUG
+    MOZ_ASSERT(hasAutoScratchFloatRegister_);
+    hasAutoScratchFloatRegister_ = false;
+#endif
+  }
+};
+
+/**
+ * Wrap an offset so that a call can decide to embed a constant
+ * or load from the stub data.
+ */
+class StubFieldOffset {
+ private:
+  uint32_t offset_;
+  StubField::Type type_;
+
+ public:
+  StubFieldOffset(uint32_t offset, StubField::Type type)
+      : offset_(offset), type_(type) {}
+
+  uint32_t getOffset() { return offset_; }
+  StubField::Type getStubFieldType() { return type_; }
+};
+
+class AutoOutputRegister;
+
+// Base class for BaselineCacheIRCompiler and IonCacheIRCompiler.
+class MOZ_RAII CacheIRCompiler {
+ protected:
+  friend class AutoOutputRegister;
+  friend class AutoStubFrame;
+  friend class AutoSaveLiveRegisters;
+  friend class AutoCallVM;
+  friend class AutoScratchFloatRegister;
+  friend class AutoAvailableFloatRegister;
+
+  enum class Mode { Baseline, Ion };
+
+  bool enteredStubFrame_;
+
+  bool isBaseline();
+  bool isIon();
+  BaselineCacheIRCompiler* asBaseline();
+  IonCacheIRCompiler* asIon();
+
+  JSContext* cx_;
+  const CacheIRWriter& writer_;
+  StackMacroAssembler masm;
+
+  CacheRegisterAllocator allocator;
+  Vector<FailurePath, 4, SystemAllocPolicy> failurePaths;
+
+  // Float registers that are live. Registers not in this set can be
+  // clobbered and don't need to be saved before performing a VM call.
+  // Doing this for non-float registers is a bit more complicated because
+  // the IC register allocator allocates GPRs.
+  LiveFloatRegisterSet liveFloatRegs_;
+
+  mozilla::Maybe<TypedOrValueRegister> outputUnchecked_;
+  Mode mode_;
+
+  // Distance from the IC to the stub data; mostly will be
+  // sizeof(stubType)
+  uint32_t stubDataOffset_;
+
+  enum class StubFieldPolicy { Address, Constant };
+
+  StubFieldPolicy stubFieldPolicy_;
+
+  CacheIRCompiler(JSContext* cx, TempAllocator& alloc,
+                  const CacheIRWriter& writer, uint32_t stubDataOffset,
+                  Mode mode, StubFieldPolicy policy)
+      : enteredStubFrame_(false),
+        cx_(cx),
+        writer_(writer),
+        masm(cx, alloc),
+        allocator(writer_),
+        liveFloatRegs_(FloatRegisterSet::All()),
+        mode_(mode),
+        stubDataOffset_(stubDataOffset),
+        stubFieldPolicy_(policy) {
+    MOZ_ASSERT(!writer.failed());
+  }
+
+  [[nodiscard]] bool addFailurePath(FailurePath** failure);
+  [[nodiscard]] bool emitFailurePath(size_t i);
+
+  // Returns the set of volatile float registers that are live. These
+  // registers need to be saved when making non-GC calls with callWithABI.
+  FloatRegisterSet liveVolatileFloatRegs() const {
+    return FloatRegisterSet::Intersect(liveFloatRegs_.set(),
+                                       FloatRegisterSet::Volatile());
+  }
+
+  bool objectGuardNeedsSpectreMitigations(ObjOperandId objId) const {
+    // Instructions like GuardShape need Spectre mitigations if
+    // (1) mitigations are enabled and (2) the object is used by other
+    // instructions (if the object is *not* used by other instructions,
+    // zeroing its register is pointless).
+    return JitOptions.spectreObjectMitigations &&
+           !allocator.isDeadAfterInstruction(objId);
+  }
+
+ private:
+  void emitPostBarrierShared(Register obj, const ConstantOrRegister& val,
+                             Register scratch, Register maybeIndex);
+
+  void emitPostBarrierShared(Register obj, ValueOperand val, Register scratch,
+                             Register maybeIndex) {
+    emitPostBarrierShared(obj, ConstantOrRegister(val), scratch, maybeIndex);
+  }
+
+ protected:
+  template <typename T>
+  void emitPostBarrierSlot(Register obj, const T& val, Register scratch) {
+    emitPostBarrierShared(obj, val, scratch, InvalidReg);
+  }
+
+  template <typename T>
+  void emitPostBarrierElement(Register obj, const T& val, Register scratch,
+                              Register index) {
+    MOZ_ASSERT(index != InvalidReg);
+    emitPostBarrierShared(obj, val, scratch, index);
+  }
+
+  bool emitComparePointerResultShared(JSOp op, TypedOperandId lhsId,
+                                      TypedOperandId rhsId);
+
+  [[nodiscard]] bool emitMathFunctionNumberResultShared(
+      UnaryMathFunction fun, FloatRegister inputScratch, ValueOperand output);
+
+  template <typename Fn, Fn fn>
+  [[nodiscard]] bool emitBigIntBinaryOperationShared(BigIntOperandId lhsId,
+                                                     BigIntOperandId rhsId);
+
+  template <typename Fn, Fn fn>
+  [[nodiscard]] bool emitBigIntUnaryOperationShared(BigIntOperandId inputId);
+
+  bool emitDoubleIncDecResult(bool isInc, NumberOperandId inputId);
+
+  using AtomicsReadWriteModifyFn = int32_t (*)(TypedArrayObject*, size_t,
+                                               int32_t);
+
+  [[nodiscard]] bool emitAtomicsReadModifyWriteResult(
+      ObjOperandId objId, IntPtrOperandId indexId, uint32_t valueId,
+      Scalar::Type elementType, AtomicsReadWriteModifyFn fn);
+
+  using AtomicsReadWriteModify64Fn = JS::BigInt* (*)(JSContext*,
+                                                     TypedArrayObject*, size_t,
+                                                     const JS::BigInt*);
+
+  template <AtomicsReadWriteModify64Fn fn>
+  [[nodiscard]] bool emitAtomicsReadModifyWriteResult64(ObjOperandId objId,
+                                                        IntPtrOperandId indexId,
+                                                        uint32_t valueId);
+
+  void emitActivateIterator(Register objBeingIterated, Register iterObject,
+                            Register nativeIter, Register scratch,
+                            Register scratch2, uint32_t enumeratorsAddrOffset);
+
+  CACHE_IR_COMPILER_SHARED_GENERATED
+
+  void emitLoadStubField(StubFieldOffset val, Register dest);
+  void emitLoadStubFieldConstant(StubFieldOffset val, Register dest);
+
+  void emitLoadValueStubField(StubFieldOffset val, ValueOperand dest);
+  void emitLoadDoubleValueStubField(StubFieldOffset val, ValueOperand dest,
+                                    FloatRegister scratch);
+
+  uintptr_t readStubWord(uint32_t offset, StubField::Type type) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    MOZ_ASSERT((offset % sizeof(uintptr_t)) == 0);
+    return writer_.readStubField(offset, type).asWord();
+  }
+  uint64_t readStubInt64(uint32_t offset, StubField::Type type) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    MOZ_ASSERT((offset % sizeof(uintptr_t)) == 0);
+    return writer_.readStubField(offset, type).asInt64();
+  }
+  int32_t int32StubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return readStubWord(offset, StubField::Type::RawInt32);
+  }
+  uint32_t uint32StubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return readStubWord(offset, StubField::Type::RawInt32);
+  }
+  Shape* shapeStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (Shape*)readStubWord(offset, StubField::Type::Shape);
+  }
+  GetterSetter* getterSetterStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (GetterSetter*)readStubWord(offset, StubField::Type::GetterSetter);
+  }
+  JSObject* objectStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (JSObject*)readStubWord(offset, StubField::Type::JSObject);
+  }
+  Value valueStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    uint64_t raw = readStubInt64(offset, StubField::Type::Value);
+    return Value::fromRawBits(raw);
+  }
+  double doubleStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    uint64_t raw = readStubInt64(offset, StubField::Type::Double);
+    return mozilla::BitwiseCast<double>(raw);
+  }
+  JSString* stringStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (JSString*)readStubWord(offset, StubField::Type::String);
+  }
+  JS::Symbol* symbolStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (JS::Symbol*)readStubWord(offset, StubField::Type::Symbol);
+  }
+  JS::Compartment* compartmentStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (JS::Compartment*)readStubWord(offset, StubField::Type::RawPointer);
+  }
+  BaseScript* baseScriptStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (BaseScript*)readStubWord(offset, StubField::Type::BaseScript);
+  }
+  const JSClass* classStubField(uintptr_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (const JSClass*)readStubWord(offset, StubField::Type::RawPointer);
+  }
+  const void* proxyHandlerStubField(uintptr_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (const void*)readStubWord(offset, StubField::Type::RawPointer);
+  }
+  const void* pointerStubField(uintptr_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return (const void*)readStubWord(offset, StubField::Type::RawPointer);
+  }
+  jsid idStubField(uint32_t offset) {
+    MOZ_ASSERT(stubFieldPolicy_ == StubFieldPolicy::Constant);
+    return jsid::fromRawBits(readStubWord(offset, StubField::Type::Id));
+  }
+
+#ifdef DEBUG
+  void assertFloatRegisterAvailable(FloatRegister reg);
+#endif
+
+  void callVMInternal(MacroAssembler& masm, VMFunctionId id);
+  template <typename Fn, Fn fn>
+  void callVM(MacroAssembler& masm);
+};
+
+// Ensures the IC's output register is available for writing.
+class MOZ_RAII AutoOutputRegister {
+  TypedOrValueRegister output_;
+  CacheRegisterAllocator& alloc_;
+
+  AutoOutputRegister(const AutoOutputRegister&) = delete;
+  void operator=(const AutoOutputRegister&) = delete;
+
+ public:
+  explicit AutoOutputRegister(CacheIRCompiler& compiler);
+  ~AutoOutputRegister();
+
+  Register maybeReg() const {
+    if (output_.hasValue()) {
+      return output_.valueReg().scratchReg();
+    }
+    if (!output_.typedReg().isFloat()) {
+      return output_.typedReg().gpr();
+    }
+    return InvalidReg;
+  }
+
+  bool hasValue() const { return output_.hasValue(); }
+  ValueOperand valueReg() const { return output_.valueReg(); }
+  AnyRegister typedReg() const { return output_.typedReg(); }
+
+  JSValueType type() const {
+    MOZ_ASSERT(!hasValue());
+    return ValueTypeFromMIRType(output_.type());
+  }
+
+  operator TypedOrValueRegister() const { return output_; }
+};
+
+enum class CallCanGC { CanGC, CanNotGC };
+
+// Instructions that have to perform a callVM require a stub frame. Call its
+// enter() and leave() methods to enter/leave the stub frame.
+// Hoisted from jit/BaselineCacheIRCompiler.cpp. See there for method
+// definitions.
+class MOZ_RAII AutoStubFrame {
+  BaselineCacheIRCompiler& compiler;
+#ifdef DEBUG
+  uint32_t framePushedAtEnterStubFrame_;
+#endif
+
+  AutoStubFrame(const AutoStubFrame&) = delete;
+  void operator=(const AutoStubFrame&) = delete;
+
+ public:
+  explicit AutoStubFrame(BaselineCacheIRCompiler& compiler);
+
+  void enter(MacroAssembler& masm, Register scratch,
+             CallCanGC canGC = CallCanGC::CanGC);
+  void leave(MacroAssembler& masm);
+
+#ifdef DEBUG
+  ~AutoStubFrame();
+#endif
+};
+// AutoSaveLiveRegisters must be used when we make a call that can GC. The
+// constructor ensures all live registers are stored on the stack (where the GC
+// expects them) and the destructor restores these registers.
+class MOZ_RAII AutoSaveLiveRegisters {
+  IonCacheIRCompiler& compiler_;
+
+  AutoSaveLiveRegisters(const AutoSaveLiveRegisters&) = delete;
+  void operator=(const AutoSaveLiveRegisters&) = delete;
+
+ public:
+  explicit AutoSaveLiveRegisters(IonCacheIRCompiler& compiler);
+
+  ~AutoSaveLiveRegisters();
+};
+// Like AutoScratchRegister, but reuse a register of |output| if possible.
+class MOZ_RAII AutoScratchRegisterMaybeOutput {
+  mozilla::Maybe<AutoScratchRegister> scratch_;
+  Register scratchReg_;
+
+  AutoScratchRegisterMaybeOutput(const AutoScratchRegisterMaybeOutput&) =
+      delete;
+  void operator=(const AutoScratchRegisterMaybeOutput&) = delete;
+
+ public:
+  AutoScratchRegisterMaybeOutput(CacheRegisterAllocator& alloc,
+                                 MacroAssembler& masm,
+                                 const AutoOutputRegister& output) {
+    scratchReg_ = output.maybeReg();
+    if (scratchReg_ == InvalidReg) {
+      scratch_.emplace(alloc, masm);
+      scratchReg_ = scratch_.ref();
+    }
+  }
+  AutoScratchRegisterMaybeOutput(CacheRegisterAllocator& alloc,
+                                 MacroAssembler& masm) {
+    scratch_.emplace(alloc, masm);
+    scratchReg_ = scratch_.ref();
+  }
+
+  Register get() const { return scratchReg_; }
+  operator Register() const { return scratchReg_; }
+};
+
+// Like AutoScratchRegisterMaybeOutput, but tries to use the ValueOperand's
+// type register for the scratch register on 32-bit.
+//
+// Word of warning: Passing an instance of this class and AutoOutputRegister to
+// functions may not work correctly, because no guarantee is given that the type
+// register is used last when modifying the output's ValueOperand.
+class MOZ_RAII AutoScratchRegisterMaybeOutputType {
+  mozilla::Maybe<AutoScratchRegister> scratch_;
+  Register scratchReg_;
+
+ public:
+  AutoScratchRegisterMaybeOutputType(CacheRegisterAllocator& alloc,
+                                     MacroAssembler& masm,
+                                     const AutoOutputRegister& output) {
+#if defined(JS_NUNBOX32)
+    scratchReg_ = output.hasValue() ? output.valueReg().typeReg() : InvalidReg;
+#else
+    scratchReg_ = InvalidReg;
+#endif
+    if (scratchReg_ == InvalidReg) {
+      scratch_.emplace(alloc, masm);
+      scratchReg_ = scratch_.ref();
+    }
+  }
+
+  AutoScratchRegisterMaybeOutputType(
+      const AutoScratchRegisterMaybeOutputType&) = delete;
+
+  void operator=(const AutoScratchRegisterMaybeOutputType&) = delete;
+
+  Register get() const { return scratchReg_; }
+  operator Register() const { return scratchReg_; }
+};
+
+// AutoCallVM is a wrapper class that unifies methods shared by
+// IonCacheIRCompiler and BaselineCacheIRCompiler that perform a callVM, but
+// require stub specific functionality before performing the VM call.
+//
+// Expected Usage:
+//
+//   OPs with implementations that may be unified by this class must:
+//     - Be listed in the CACHEIR_OPS list but not in the CACHE_IR_SHARED_OPS
+//     list
+//     - Differ only in their use of `AutoSaveLiveRegisters`,
+//       `AutoOutputRegister`, and `AutoScratchRegister`. The Ion
+//       implementation will use `AutoSaveLiveRegisters` and
+//       `AutoOutputRegister`, while the Baseline implementation will use
+//       `AutoScratchRegister`.
+//     - Both use the `callVM` method.
+//
+//   Using AutoCallVM:
+//     - The constructor initializes `AutoOutputRegister` for both compiler
+//       types. Additionally it initializes an `AutoSaveLiveRegisters` for
+//       CacheIRCompilers with the mode Ion, and initializes
+//       `AutoScratchRegisterMaybeOutput` and `AutoStubFrame` variables for
+//       compilers with mode Baseline.
+//     - The `prepare()` method calls the IonCacheIRCompiler method
+//       `prepareVMCall` for IonCacheIRCompilers, calls the `enter()` method of
+//       `AutoStubFrame` for BaselineCacheIRCompilers, and calls the
+//       `discardStack` method of the `Register` class for both compiler types.
+//     - The `call()` method invokes `callVM` on the CacheIRCompiler and stores
+//       the call result according to its type. Finally it calls the `leave`
+//       method of `AutoStubFrame` for BaselineCacheIRCompilers.
+//
+//   Expected Usage Example:
+//     See: `CacheIRCompiler::emitCallGetSparseElementResult()`
+//
+// Restrictions:
+//   - OPs that do not meet the criteria listed above can not be unified with
+//     AutoCallVM
+//
+
+class MOZ_RAII AutoCallVM {
+  MacroAssembler& masm_;
+  CacheIRCompiler* compiler_;
+  CacheRegisterAllocator& allocator_;
+  mozilla::Maybe<AutoOutputRegister> output_;
+
+  // Baseline specific stuff
+  mozilla::Maybe<AutoStubFrame> stubFrame_;
+  mozilla::Maybe<AutoScratchRegisterMaybeOutput> scratch_;
+
+  // Ion specific stuff
+  mozilla::Maybe<AutoSaveLiveRegisters> save_;
+
+  void storeResult(JSValueType returnType);
+
+  template <typename Fn>
+  void storeResult();
+
+  void leaveBaselineStubFrame();
+
+ public:
+  AutoCallVM(MacroAssembler& masm, CacheIRCompiler* compiler,
+             CacheRegisterAllocator& allocator);
+
+  void prepare();
+
+  template <typename Fn, Fn fn>
+  void call() {
+    compiler_->callVM<Fn, fn>(masm_);
+    storeResult<Fn>();
+    leaveBaselineStubFrame();
+  }
+
+  template <typename Fn, Fn fn>
+  void callNoResult() {
+    compiler_->callVM<Fn, fn>(masm_);
+    leaveBaselineStubFrame();
+  }
+
+  const AutoOutputRegister& output() const { return *output_; }
+  ValueOperand outputValueReg() const { return output_->valueReg(); }
+};
+
+// RAII class to allocate FloatReg0 as a scratch register and release it when
+// we're done with it. The previous contents of FloatReg0 may be spilled on the
+// stack and, if necessary, are restored when the destructor runs.
+//
+// When FailurePath is passed to the constructor, FailurePath::label() must not
+// be used during the life time of the AutoScratchFloatRegister. Instead use
+// AutoScratchFloatRegister::failure().
+class MOZ_RAII AutoScratchFloatRegister {
+  Label failurePopReg_{};
+  CacheIRCompiler* compiler_;
+  FailurePath* failure_;
+
+  AutoScratchFloatRegister(const AutoScratchFloatRegister&) = delete;
+  void operator=(const AutoScratchFloatRegister&) = delete;
+
+ public:
+  explicit AutoScratchFloatRegister(CacheIRCompiler* compiler)
+      : AutoScratchFloatRegister(compiler, nullptr) {}
+
+  AutoScratchFloatRegister(CacheIRCompiler* compiler, FailurePath* failure);
+
+  ~AutoScratchFloatRegister();
+
+  Label* failure();
+
+  FloatRegister get() const { return FloatReg0; }
+  operator FloatRegister() const { return FloatReg0; }
+};
+
+// This class can be used to assert a certain FloatRegister is available. In
+// Baseline mode, all float registers are available. In Ion mode, only the
+// registers added as fixed temps in LIRGenerator are available.
+class MOZ_RAII AutoAvailableFloatRegister {
+  FloatRegister reg_;
+
+  AutoAvailableFloatRegister(const AutoAvailableFloatRegister&) = delete;
+  void operator=(const AutoAvailableFloatRegister&) = delete;
+
+ public:
+  explicit AutoAvailableFloatRegister(CacheIRCompiler& compiler,
+                                      FloatRegister reg)
+      : reg_(reg) {
+#ifdef DEBUG
+    compiler.assertFloatRegisterAvailable(reg);
+#endif
+  }
+
+  FloatRegister get() const { return reg_; }
+  operator FloatRegister() const { return reg_; }
+};
+
+// See the 'Sharing Baseline stub code' comment in CacheIR.h for a description
+// of this class.
+//
+// CacheIRStubInfo has a trailing variable-length array of bytes. The memory
+// layout is as follows:
+//
+//   Item             | Offset
+//   -----------------+--------------------------------------
+//   CacheIRStubInfo  | 0
+//   CacheIR bytecode | sizeof(CacheIRStubInfo)
+//   Stub field types | sizeof(CacheIRStubInfo) + codeLength_
+//
+// The array of stub field types is terminated by StubField::Type::Limit.
+class CacheIRStubInfo {
+  uint32_t codeLength_;
+  CacheKind kind_;
+  ICStubEngine engine_;
+  uint8_t stubDataOffset_;
+  bool makesGCCalls_;
+
+  CacheIRStubInfo(CacheKind kind, ICStubEngine engine, bool makesGCCalls,
+                  uint32_t stubDataOffset, uint32_t codeLength)
+      : codeLength_(codeLength),
+        kind_(kind),
+        engine_(engine),
+        stubDataOffset_(stubDataOffset),
+        makesGCCalls_(makesGCCalls) {
+    MOZ_ASSERT(kind_ == kind, "Kind must fit in bitfield");
+    MOZ_ASSERT(engine_ == engine, "Engine must fit in bitfield");
+    MOZ_ASSERT(stubDataOffset_ == stubDataOffset,
+               "stubDataOffset must fit in uint8_t");
+  }
+
+  CacheIRStubInfo(const CacheIRStubInfo&) = delete;
+  CacheIRStubInfo& operator=(const CacheIRStubInfo&) = delete;
+
+ public:
+  CacheKind kind() const { return kind_; }
+  ICStubEngine engine() const { return engine_; }
+  bool makesGCCalls() const { return makesGCCalls_; }
+
+  const uint8_t* code() const {
+    return reinterpret_cast<const uint8_t*>(this) + sizeof(CacheIRStubInfo);
+  }
+  uint32_t codeLength() const { return codeLength_; }
+  uint32_t stubDataOffset() const { return stubDataOffset_; }
+
+  size_t stubDataSize() const;
+
+  StubField::Type fieldType(uint32_t i) const {
+    static_assert(sizeof(StubField::Type) == sizeof(uint8_t));
+    const uint8_t* fieldTypes = code() + codeLength_;
+    return static_cast<StubField::Type>(fieldTypes[i]);
+  }
+
+  static CacheIRStubInfo* New(CacheKind kind, ICStubEngine engine,
+                              bool canMakeCalls, uint32_t stubDataOffset,
+                              const CacheIRWriter& writer);
+
+  template <class Stub, class T>
+  js::GCPtr<T>& getStubField(Stub* stub, uint32_t offset) const;
+
+  template <class Stub, class T>
+  T* getPtrStubField(Stub* stub, uint32_t offset) const;
+
+  template <class T>
+  js::GCPtr<T>& getStubField(ICCacheIRStub* stub, uint32_t offset) const {
+    return getStubField<ICCacheIRStub, T>(stub, offset);
+  }
+
+  uintptr_t getStubRawWord(const uint8_t* stubData, uint32_t offset) const;
+  uintptr_t getStubRawWord(ICCacheIRStub* stub, uint32_t offset) const;
+
+  int64_t getStubRawInt64(const uint8_t* stubData, uint32_t offset) const;
+  int64_t getStubRawInt64(ICCacheIRStub* stub, uint32_t offset) const;
+
+  void replaceStubRawWord(uint8_t* stubData, uint32_t offset, uintptr_t oldWord,
+                          uintptr_t newWord) const;
+};
+
+template <typename T>
+void TraceCacheIRStub(JSTracer* trc, T* stub, const CacheIRStubInfo* stubInfo);
+
+}  // namespace jit
+}  // namespace js
+
+#endif /* jit_CacheIRCompiler_h */