Enable named offsets into JSC bytecodes
https://bugs.webkit.org/show_bug.cgi?id=175561

Reviewed by Mark Lam.

This patch adds the ability to add named offsets into JSC's
bytecodes.  In the bytecode json file, instead of listing a
length, you can now list a set of names and their types. Each
opcode with an offsets property will have a struct named after the
opcode by in our C++ naming style. For example,
op_overrides_has_instance would become OpOverridesHasInstance. The
struct has the same memory layout as the instruction list has but
comes with handy named accessors.

As a first cut I converted the various instanceof bytecodes to use
named offsets.

As an example op_overrides_has_instance produces the following struct:

struct OpOverridesHasInstance {
public:
    Opcode& opcode() { return *reinterpret_cast<Opcode*>(&m_opcode); }
    const Opcode& opcode() const { return *reinterpret_cast<const Opcode*>(&m_opcode); }
    int& dst() { return *reinterpret_cast<int*>(&m_dst); }
    const int& dst() const { return *reinterpret_cast<const int*>(&m_dst); }
    int& constructor() { return *reinterpret_cast<int*>(&m_constructor); }
    const int& constructor() const { return *reinterpret_cast<const int*>(&m_constructor); }
    int& hasInstanceValue() { return *reinterpret_cast<int*>(&m_hasInstanceValue); }
    const int& hasInstanceValue() const { return *reinterpret_cast<const int*>(&m_hasInstanceValue); }

private:
    friend class LLIntOffsetsExtractor;
    std::aligned_storage<sizeof(Opcode), sizeof(Instruction)>::type m_opcode;
    std::aligned_storage<sizeof(int), sizeof(Instruction)>::type m_dst;
    std::aligned_storage<sizeof(int), sizeof(Instruction)>::type m_constructor;
    std::aligned_storage<sizeof(int), sizeof(Instruction)>::type m_hasInstanceValue;
};

* CMakeLists.txt:
* DerivedSources.make:
* JavaScriptCore.xcodeproj/project.pbxproj:
* bytecode/BytecodeList.json:
* dfg/DFGByteCodeParser.cpp:
(JSC::DFG::ByteCodeParser::parseBlock):
* generate-bytecode-files:
* jit/JITOpcodes.cpp:
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
* jit/JITOpcodes32_64.cpp:
(JSC::JIT::emit_op_overrides_has_instance):
(JSC::JIT::emit_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof):
(JSC::JIT::emitSlow_op_instanceof_custom):
* llint/LLIntOffsetsExtractor.cpp:
* llint/LowLevelInterpreter.asm:
* llint/LowLevelInterpreter32_64.asm:
* llint/LowLevelInterpreter64.asm:


git-svn-id: http://svn.webkit.org/repository/webkit/trunk@220753 268f45cc-cd09-0410-ab3c-d52691b4dbfc
diff --git a/Source/JavaScriptCore/CMakeLists.txt b/Source/JavaScriptCore/CMakeLists.txt
index 0b1e1c5..89809fa 100644
--- a/Source/JavaScriptCore/CMakeLists.txt
+++ b/Source/JavaScriptCore/CMakeLists.txt
@@ -1149,14 +1149,15 @@
 )
 
 add_custom_command(
-    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm
+    OUTPUT ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/BytecodeStructs.h
     MAIN_DEPENDENCY ${JAVASCRIPTCORE_DIR}/generate-bytecode-files
     DEPENDS ${JAVASCRIPTCORE_DIR}/generate-bytecode-files bytecode/BytecodeList.json
-    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/generate-bytecode-files --bytecodes_h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h --init_bytecodes_asm ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm ${JAVASCRIPTCORE_DIR}/bytecode/BytecodeList.json
+    COMMAND ${PYTHON_EXECUTABLE} ${JAVASCRIPTCORE_DIR}/generate-bytecode-files --bytecodes_h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h --init_bytecodes_asm ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/InitBytecodes.asm --bytecode_structs_h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/BytecodeStructs.h ${JAVASCRIPTCORE_DIR}/bytecode/BytecodeList.json
     VERBATIM)
 
 list(APPEND JavaScriptCore_HEADERS
     ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/BytecodeStructs.h
 )
 
 add_custom_command(
@@ -1177,7 +1178,7 @@
 # actually be run multiple times!
 add_executable(LLIntOffsetsExtractor
     ${JAVASCRIPTCORE_DIR}/llint/LLIntOffsetsExtractor.cpp
-    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h
+    ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/LLIntDesiredOffsets.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/Bytecodes.h ${DERIVED_SOURCES_JAVASCRIPTCORE_DIR}/BytecodeStructs.h
 )
 target_link_libraries(LLIntOffsetsExtractor WTF)
 
diff --git a/Source/JavaScriptCore/ChangeLog b/Source/JavaScriptCore/ChangeLog
index 903a908..86eaf05 100644
--- a/Source/JavaScriptCore/ChangeLog
+++ b/Source/JavaScriptCore/ChangeLog
@@ -1,3 +1,65 @@
+2017-08-15  Keith Miller  <keith_miller@apple.com>
+
+        Enable named offsets into JSC bytecodes
+        https://bugs.webkit.org/show_bug.cgi?id=175561
+
+        Reviewed by Mark Lam.
+
+        This patch adds the ability to add named offsets into JSC's
+        bytecodes.  In the bytecode json file, instead of listing a
+        length, you can now list a set of names and their types. Each
+        opcode with an offsets property will have a struct named after the
+        opcode by in our C++ naming style. For example,
+        op_overrides_has_instance would become OpOverridesHasInstance. The
+        struct has the same memory layout as the instruction list has but
+        comes with handy named accessors.
+
+        As a first cut I converted the various instanceof bytecodes to use
+        named offsets.
+
+        As an example op_overrides_has_instance produces the following struct:
+
+        struct OpOverridesHasInstance {
+        public:
+            Opcode& opcode() { return *reinterpret_cast<Opcode*>(&m_opcode); }
+            const Opcode& opcode() const { return *reinterpret_cast<const Opcode*>(&m_opcode); }
+            int& dst() { return *reinterpret_cast<int*>(&m_dst); }
+            const int& dst() const { return *reinterpret_cast<const int*>(&m_dst); }
+            int& constructor() { return *reinterpret_cast<int*>(&m_constructor); }
+            const int& constructor() const { return *reinterpret_cast<const int*>(&m_constructor); }
+            int& hasInstanceValue() { return *reinterpret_cast<int*>(&m_hasInstanceValue); }
+            const int& hasInstanceValue() const { return *reinterpret_cast<const int*>(&m_hasInstanceValue); }
+
+        private:
+            friend class LLIntOffsetsExtractor;
+            std::aligned_storage<sizeof(Opcode), sizeof(Instruction)>::type m_opcode;
+            std::aligned_storage<sizeof(int), sizeof(Instruction)>::type m_dst;
+            std::aligned_storage<sizeof(int), sizeof(Instruction)>::type m_constructor;
+            std::aligned_storage<sizeof(int), sizeof(Instruction)>::type m_hasInstanceValue;
+        };
+
+        * CMakeLists.txt:
+        * DerivedSources.make:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/BytecodeList.json:
+        * dfg/DFGByteCodeParser.cpp:
+        (JSC::DFG::ByteCodeParser::parseBlock):
+        * generate-bytecode-files:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof_custom):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_overrides_has_instance):
+        (JSC::JIT::emit_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof):
+        (JSC::JIT::emitSlow_op_instanceof_custom):
+        * llint/LLIntOffsetsExtractor.cpp:
+        * llint/LowLevelInterpreter.asm:
+        * llint/LowLevelInterpreter32_64.asm:
+        * llint/LowLevelInterpreter64.asm:
+
 2017-08-15  Mark Lam  <mark.lam@apple.com>
 
         Update testmasm to use new CPUState APIs.
diff --git a/Source/JavaScriptCore/DerivedSources.make b/Source/JavaScriptCore/DerivedSources.make
index 55c508c..084804d 100644
--- a/Source/JavaScriptCore/DerivedSources.make
+++ b/Source/JavaScriptCore/DerivedSources.make
@@ -52,6 +52,7 @@
 all : \
     udis86_itab.h \
     Bytecodes.h \
+    BytecodeStructs.h \
     CombinedDomains.json \
     InitBytecodes.asm \
     InjectedScriptSource.h \
@@ -205,6 +206,9 @@
 Bytecodes.h: $(JavaScriptCore)/generate-bytecode-files $(JavaScriptCore)/bytecode/BytecodeList.json
 	$(PYTHON) $(JavaScriptCore)/generate-bytecode-files --bytecodes_h Bytecodes.h $(JavaScriptCore)/bytecode/BytecodeList.json
 
+BytecodeStructs.h: $(JavaScriptCore)/generate-bytecode-files $(JavaScriptCore)/bytecode/BytecodeList.json
+	$(PYTHON) $(JavaScriptCore)/generate-bytecode-files --bytecode_structs_h BytecodeStructs.h $(JavaScriptCore)/bytecode/BytecodeList.json
+
 InitBytecodes.asm: $(JavaScriptCore)/generate-bytecode-files $(JavaScriptCore)/bytecode/BytecodeList.json
 	$(PYTHON) $(JavaScriptCore)/generate-bytecode-files --init_bytecodes_asm InitBytecodes.asm $(JavaScriptCore)/bytecode/BytecodeList.json
 
diff --git a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index f9847e7..16d3f2c 100644
--- a/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/Source/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -5309,9 +5309,9 @@
 				0F6183431C45F62A0072450B /* testair */,
 				14BD59BF0A3E8F9000BAF59C /* testapi */,
 				0FEC85AD1BDB5CF10080FF74 /* testb3 */,
+				FE533CAC1F217DB40016A1FE /* testmasm */,
 				6511230514046A4C002B101D /* testRegExp */,
 				932F5BD90822A1C700736975 /* JavaScriptCore.framework */,
-				FE533CAC1F217DB40016A1FE /* testmasm */,
 			);
 			name = Products;
 			sourceTree = "<group>";
@@ -6664,9 +6664,6 @@
 				52678F901A04177C006A306D /* ControlFlowProfiler.h */,
 				2A111243192FCE79005EE18D /* CustomGetterSetter.cpp */,
 				2A111244192FCE79005EE18D /* CustomGetterSetter.h */,
-				E31618101EC5FE080006A218 /* DOMAnnotation.h */,
-				E31618111EC5FE080006A218 /* DOMAttributeGetterSetter.cpp */,
-				E31618121EC5FE080006A218 /* DOMAttributeGetterSetter.h */,
 				0F2B66B017B6B5AB00A7AE3F /* DataView.cpp */,
 				0F2B66B117B6B5AB00A7AE3F /* DataView.h */,
 				BCD203450E17135E002C7E82 /* DateConstructor.cpp */,
@@ -6688,6 +6685,9 @@
 				FE54DEFE1E8D742800A892C5 /* DisallowScope.h */,
 				FE54DEFC1E8C6DFF00A892C5 /* DisallowVMReentry.cpp */,
 				FE54DEFA1E8C6D7200A892C5 /* DisallowVMReentry.h */,
+				E31618101EC5FE080006A218 /* DOMAnnotation.h */,
+				E31618111EC5FE080006A218 /* DOMAttributeGetterSetter.cpp */,
+				E31618121EC5FE080006A218 /* DOMAttributeGetterSetter.h */,
 				A70447EB17A0BD7000F5898E /* DumpContext.cpp */,
 				A70447EC17A0BD7000F5898E /* DumpContext.h */,
 				FE318FDD1CAC8C5300DFCC54 /* ECMAScriptSpecInternalFunctions.cpp */,
@@ -7676,8 +7676,8 @@
 				86C568DF11A213EE0007F7F0 /* MIPSAssembler.h */,
 				FE63DD551EA9BC5D00103A69 /* Printer.cpp */,
 				FE63DD531EA9B60E00103A69 /* Printer.h */,
-				9688CB140ED12B4E001D649F /* X86Assembler.h */,
 				FE533CA01F217C310016A1FE /* testmasm.cpp */,
+				9688CB140ED12B4E001D649F /* X86Assembler.h */,
 			);
 			path = assembler;
 			sourceTree = "<group>";
@@ -8062,8 +8062,8 @@
 				DE26E9021CB5DD0500D2BE82 /* BuiltinExecutableCreator.h */,
 				A7D801A11880D66E0026C39B /* BuiltinExecutables.cpp */,
 				A7D801A21880D66E0026C39B /* BuiltinExecutables.h */,
-				A75EE9B018AAB7E200AAD043 /* BuiltinNames.h */,
 				E380D66B1F19249D00A59095 /* BuiltinNames.cpp */,
+				A75EE9B018AAB7E200AAD043 /* BuiltinNames.h */,
 				41DEA1311B9F3154006D65DD /* BuiltinUtils.h */,
 				A1FE1EB01C2C537E00A289FF /* DatePrototype.js */,
 				A7A979C418BE8D9E002C3733 /* FunctionPrototype.js */,
@@ -8292,6 +8292,7 @@
 				0FE0E4AE1C24C94A002E17B6 /* AirTmpWidth.h in Headers */,
 				0F3730931C0D67EE00052BFA /* AirUseCounts.h in Headers */,
 				0FEC85911BDACDC70080FF74 /* AirValidate.h in Headers */,
+				0FEC3C531F33A41600F59B6C /* AlignedMemoryAllocator.h in Headers */,
 				0FA7620B1DB959F900B7A2FD /* AllocatingScope.h in Headers */,
 				0F96303A1D4192C8005609D9 /* AllocatorAttributes.h in Headers */,
 				0F3730911C0CD70C00052BFA /* AllowMacroScratchRegisterUsage.h in Headers */,
@@ -8335,6 +8336,8 @@
 				0F38D2A31D44196D00680499 /* AuxiliaryBarrierInlines.h in Headers */,
 				0FEC84FF1BDACDAC0080FF74 /* B3ArgumentRegValue.h in Headers */,
 				0F2C63B71E6343ED00C13839 /* B3AtomicValue.h in Headers */,
+				0F5BF1671F23A0980029D91D /* B3BackwardsCFG.h in Headers */,
+				0F5BF16B1F23A0C10029D91D /* B3BackwardsDominators.h in Headers */,
 				0F2C63B01E60AE4300C13839 /* B3Bank.h in Headers */,
 				0FEC85011BDACDAC0080FF74 /* B3BasicBlock.h in Headers */,
 				0FEC85021BDACDAC0080FF74 /* B3BasicBlockInlines.h in Headers */,
@@ -8365,6 +8368,7 @@
 				0F6B8AD91C4EDDA200969052 /* B3DuplicateTails.h in Headers */,
 				0FEC85C11BE167A00080FF74 /* B3Effects.h in Headers */,
 				0F725CA81C503DED00AD943A /* B3EliminateCommonSubexpressions.h in Headers */,
+				0F5BF1711F23A5A10029D91D /* B3EnsureLoopPreHeaders.h in Headers */,
 				0F6971EA1D92F42400BA02A5 /* B3FenceValue.h in Headers */,
 				0F6B8AE51C4EFE1700969052 /* B3FixSSA.h in Headers */,
 				0F725CB01C506D3B00AD943A /* B3FoldPathConstants.h in Headers */,
@@ -8374,6 +8378,7 @@
 				0F2C63B81E6343F700C13839 /* B3GenericBlockInsertionSet.h in Headers */,
 				0FEC851A1BDACDAC0080FF74 /* B3GenericFrequentedBlock.h in Headers */,
 				0FEC85C31BE167A00080FF74 /* B3HeapRange.h in Headers */,
+				0F5BF1641F2317120029D91D /* B3HoistLoopInvariantValues.h in Headers */,
 				DC69B99D1D15F914002E3C00 /* B3InferSwitches.h in Headers */,
 				0FEC85BA1BE1462F0080FF74 /* B3InsertionSet.h in Headers */,
 				0FEC85BB1BE1462F0080FF74 /* B3InsertionSetInlines.h in Headers */,
@@ -8387,6 +8392,7 @@
 				0F2C63C41E69EF9400C13839 /* B3MemoryValueInlines.h in Headers */,
 				0F338E101BF0276C0013C88F /* B3MoveConstants.h in Headers */,
 				0F2C63C21E664A5C00C13839 /* B3NativeTraits.h in Headers */,
+				0F5BF1691F23A0AA0029D91D /* B3NaturalLoops.h in Headers */,
 				0F338E111BF0276C0013C88F /* B3OpaqueByproduct.h in Headers */,
 				0F338E131BF0276C0013C88F /* B3OpaqueByproducts.h in Headers */,
 				0FEC85221BDACDAC0080FF74 /* B3Opcode.h in Headers */,
@@ -8470,6 +8476,7 @@
 				0F885E111849A3BE00F1E3FA /* BytecodeUseDef.h in Headers */,
 				0F8023EA1613832B00A0BA45 /* ByValInfo.h in Headers */,
 				65B8392E1BACAD360044E824 /* CachedRecovery.h in Headers */,
+				0FEC3C601F379F5300F59B6C /* CagedBarrierPtr.h in Headers */,
 				BC18C3ED0E16F5CD00B34460 /* CallData.h in Headers */,
 				0F64B27A1A7957B2006E4E66 /* CallEdge.h in Headers */,
 				796DAA2B1E89CCD6005DF24A /* CalleeBits.h in Headers */,
@@ -8505,7 +8512,6 @@
 				0F0B83A714BCF50700885B4F /* CodeType.h in Headers */,
 				0FD0E5F21E46C8AF0006AB08 /* CollectingScope.h in Headers */,
 				0FA762051DB9242900B7A2FD /* CollectionScope.h in Headers */,
-				0FD9EA891F29162C00F32BEE /* DFGFixedButterflyAccessUncagingPhase.h in Headers */,
 				0FD0E5E91E43D3490006AB08 /* CollectorPhase.h in Headers */,
 				A53243981856A489002ED692 /* CombinedDomains.json in Headers */,
 				BC18C3F30E16F5CD00B34460 /* CommonIdentifiers.h in Headers */,
@@ -8558,7 +8564,6 @@
 				0FBB73BB1DEF8645002C009E /* DeleteAllCodeEffort.h in Headers */,
 				0F96303C1D4192CD005609D9 /* DestructionMode.h in Headers */,
 				A77A423E17A0BBFD00A8DB81 /* DFGAbstractHeap.h in Headers */,
-				0F5BF1691F23A0AA0029D91D /* B3NaturalLoops.h in Headers */,
 				A704D90317A0BAA8006BA554 /* DFGAbstractInterpreter.h in Headers */,
 				A704D90417A0BAA8006BA554 /* DFGAbstractInterpreterInlines.h in Headers */,
 				0F620177143FCD3F0068B77C /* DFGAbstractValue.h in Headers */,
@@ -8626,6 +8631,7 @@
 				A78A9775179738B8009DF744 /* DFGFailedFinalizer.h in Headers */,
 				A7BFF3C0179868940002F462 /* DFGFiltrationResult.h in Headers */,
 				A78A9777179738B8009DF744 /* DFGFinalizer.h in Headers */,
+				0FD9EA891F29162C00F32BEE /* DFGFixedButterflyAccessUncagingPhase.h in Headers */,
 				0F2BDC16151C5D4F00CD8910 /* DFGFixupPhase.h in Headers */,
 				0F2017801DCADC3500EA5950 /* DFGFlowIndexing.h in Headers */,
 				0F2017821DCADD4200EA5950 /* DFGFlowMap.h in Headers */,
@@ -8642,7 +8648,6 @@
 				0FB14E2318130955009B6B4D /* DFGInlineCacheWrapperInlines.h in Headers */,
 				A704D90617A0BAA8006BA554 /* DFGInPlaceAbstractState.h in Headers */,
 				0F2BDC21151E803B00CD8910 /* DFGInsertionSet.h in Headers */,
-				0FEC3C601F379F5300F59B6C /* CagedBarrierPtr.h in Headers */,
 				0F300B7C18AB1B1400A6D72E /* DFGIntegerCheckCombiningPhase.h in Headers */,
 				0F898F321B27689F0083A33C /* DFGIntegerRangeOptimizationPhase.h in Headers */,
 				0FC97F3E18202119002C9B26 /* DFGInvalidationPointInjectionPhase.h in Headers */,
@@ -8743,13 +8748,14 @@
 				0F1FB3971E1AF7E300A9BE50 /* DFGWorklistInlines.h in Headers */,
 				0FE050181AA9091100D33B33 /* DirectArguments.h in Headers */,
 				0FE050161AA9091100D33B33 /* DirectArgumentsOffset.h in Headers */,
-				0F5BF1711F23A5A10029D91D /* B3EnsureLoopPreHeaders.h in Headers */,
 				969A07980ED1D3AE00F1F681 /* DirectEvalCodeCache.h in Headers */,
 				14386A751DD69895008652C4 /* DirectEvalExecutable.h in Headers */,
 				0F37308F1C0CD68500052BFA /* DisallowMacroScratchRegisterUsage.h in Headers */,
 				FE54DEFF1E8D76FA00A892C5 /* DisallowScope.h in Headers */,
 				FE54DEFB1E8C6D8800A892C5 /* DisallowVMReentry.h in Headers */,
 				0FF42731158EBD54004CB9FF /* Disassembler.h in Headers */,
+				E31618131EC5FE170006A218 /* DOMAnnotation.h in Headers */,
+				E31618151EC5FE270006A218 /* DOMAttributeGetterSetter.h in Headers */,
 				E35CA1561DBC3A5F00F83516 /* DOMJITAbstractHeap.h in Headers */,
 				E3555B8A1DAE03A500F36921 /* DOMJITCallDOMGetterSnippet.h in Headers */,
 				E3C79CAB1DB9A4DC00D1ECA4 /* DOMJITEffect.h in Headers */,
@@ -8782,6 +8788,7 @@
 				0F3AC754188E5EC80032029F /* ExitingJITType.h in Headers */,
 				0FB105861675481200F8AB6E /* ExitKind.h in Headers */,
 				0F0B83AB14BCF5BB00885B4F /* ExpressionRangeInfo.h in Headers */,
+				0FEC3C571F33A45300F59B6C /* FastMallocAlignedMemoryAllocator.h in Headers */,
 				A7A8AF3817ADB5F3005AB174 /* Float32Array.h in Headers */,
 				A7A8AF3917ADB5F3005AB174 /* Float64Array.h in Headers */,
 				0F24E54317EA9F5900ABB217 /* FPRInfo.h in Headers */,
@@ -8875,7 +8882,6 @@
 				A5EA710319F6DE6F0098F5EC /* generate_objc_backend_dispatcher_header.py in Headers */,
 				A5EA710419F6DE720098F5EC /* generate_objc_backend_dispatcher_implementation.py in Headers */,
 				A5EA710519F6DE740098F5EC /* generate_objc_configuration_header.py in Headers */,
-				E31618151EC5FE270006A218 /* DOMAttributeGetterSetter.h in Headers */,
 				A5EA710619F6DE760098F5EC /* generate_objc_configuration_implementation.py in Headers */,
 				A5EA710819F6DE7A0098F5EC /* generate_objc_frontend_dispatcher_implementation.py in Headers */,
 				A5EA710919F6DE7C0098F5EC /* generate_objc_header.py in Headers */,
@@ -8898,6 +8904,7 @@
 				0F0332C418B01763005F979A /* GetByIdVariant.h in Headers */,
 				7964656A1B952FF0003059EE /* GetPutInfo.h in Headers */,
 				534E03581E53BF2F00213F64 /* GetterSetterAccessCase.h in Headers */,
+				0FEC3C5B1F33A48900F59B6C /* GigacageAlignedMemoryAllocator.h in Headers */,
 				14AD910E1DCA92940014F9FE /* GlobalCodeBlock.h in Headers */,
 				0F24E54417EA9F5900ABB217 /* GPRInfo.h in Headers */,
 				142E3134134FF0A600AFADB5 /* Handle.h in Headers */,
@@ -8929,12 +8936,10 @@
 				A5FD0076189B038C00633231 /* IdentifiersFactory.h in Headers */,
 				C25F8BCE157544A900245B71 /* IncrementalSweeper.h in Headers */,
 				0FB7F39915ED8E4600F167B2 /* IndexingHeader.h in Headers */,
-				0F5BF16B1F23A0C10029D91D /* B3BackwardsDominators.h in Headers */,
 				0FB7F39A15ED8E4600F167B2 /* IndexingHeaderInlines.h in Headers */,
 				0FB7F39B15ED8E4600F167B2 /* IndexingType.h in Headers */,
 				14386A791DD6989C008652C4 /* IndirectEvalExecutable.h in Headers */,
 				0F0A75231B94BFA900110660 /* InferredType.h in Headers */,
-				0F5BF1671F23A0980029D91D /* B3BackwardsCFG.h in Headers */,
 				0FFC92121B94D4DF0071DD66 /* InferredTypeTable.h in Headers */,
 				0FF8BDEB1AD4CF7100DFE884 /* InferredValue.h in Headers */,
 				BC18C4100E16F5CD00B34460 /* InitializeThreading.h in Headers */,
@@ -8963,7 +8968,6 @@
 				99F1A7011B98FBEC00463B26 /* InspectorFrontendRouter.h in Headers */,
 				A5339EC61BB399A60054F005 /* InspectorHeapAgent.h in Headers */,
 				E35E03601B7AB43E0073AD2A /* InspectorInstrumentationObject.h in Headers */,
-				E31618131EC5FE170006A218 /* DOMAnnotation.h in Headers */,
 				E33B3E261B7ABD750048DB2E /* InspectorInstrumentationObject.lut.h in Headers */,
 				A532438C18568335002ED692 /* InspectorProtocolObjects.h in Headers */,
 				A55D93AC18514F7900400DED /* InspectorProtocolTypes.h in Headers */,
@@ -9138,7 +9142,6 @@
 				7C184E2317BEE240007CB63A /* JSPromiseConstructor.h in Headers */,
 				996B731E1BDA08EF00331B84 /* JSPromiseConstructor.lut.h in Headers */,
 				7C008CDB187124BB00955C24 /* JSPromiseDeferred.h in Headers */,
-				0FEC3C571F33A45300F59B6C /* FastMallocAlignedMemoryAllocator.h in Headers */,
 				7C184E1F17BEE22E007CB63A /* JSPromisePrototype.h in Headers */,
 				996B731F1BDA08EF00331B84 /* JSPromisePrototype.lut.h in Headers */,
 				2A05ABD61961DF2400341750 /* JSPropertyNameEnumerator.h in Headers */,
@@ -9240,7 +9243,6 @@
 				86C36EEA0EE1289D00B3DF59 /* MacroAssembler.h in Headers */,
 				86D3B2C610156BDE002865E7 /* MacroAssemblerARM.h in Headers */,
 				A1A009C01831A22D00CF8711 /* MacroAssemblerARM64.h in Headers */,
-				0F5BF1641F2317120029D91D /* B3HoistLoopInvariantValues.h in Headers */,
 				86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */,
 				863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */,
 				E32AB2441DCD75F400D7533A /* MacroAssemblerHelpers.h in Headers */,
@@ -9251,7 +9253,6 @@
 				860161E60F3A83C100F84710 /* MacroAssemblerX86Common.h in Headers */,
 				A5EF13F91F073204000F0442 /* make-js-file-arrays.py in Headers */,
 				A700873A17CBE85300C3E643 /* MapConstructor.h in Headers */,
-				0FEC3C531F33A41600F59B6C /* AlignedMemoryAllocator.h in Headers */,
 				A74DEF94182D991400522C22 /* MapIteratorPrototype.h in Headers */,
 				A700873E17CBE8D300C3E643 /* MapPrototype.h in Headers */,
 				C2B916C214DA014E00CBAC86 /* MarkedAllocator.h in Headers */,
@@ -9572,7 +9573,6 @@
 				AD00659E1ECAC812000CA926 /* WasmLimits.h in Headers */,
 				53E9E0AC1EAE83DF00FEE251 /* WasmMachineThreads.h in Headers */,
 				535557141D9D9EA5006D583B /* WasmMemory.h in Headers */,
-				0FEC3C5B1F33A48900F59B6C /* GigacageAlignedMemoryAllocator.h in Headers */,
 				79B759751DFA4C600052174C /* WasmMemoryInformation.h in Headers */,
 				790081391E95A8EC0052D7CD /* WasmModule.h in Headers */,
 				53E777E41E92E265007CBEC4 /* WasmModuleInformation.h in Headers */,
@@ -10213,6 +10213,7 @@
 				0FEC858D1BDACDC70080FF74 /* AirTmp.cpp in Sources */,
 				0FE0E4AD1C24C94A002E17B6 /* AirTmpWidth.cpp in Sources */,
 				0FEC85901BDACDC70080FF74 /* AirValidate.cpp in Sources */,
+				0FEC3C521F33A41600F59B6C /* AlignedMemoryAllocator.cpp in Sources */,
 				0F9630391D4192C6005609D9 /* AllocatorAttributes.cpp in Sources */,
 				147F39BD107EC37600427A48 /* ArgList.cpp in Sources */,
 				79A228351D35D71E00D8E067 /* ArithProfile.cpp in Sources */,
@@ -10257,11 +10258,13 @@
 				0F6B8AD81C4EDDA200969052 /* B3DuplicateTails.cpp in Sources */,
 				0FEC85C51BE16F5A0080FF74 /* B3Effects.cpp in Sources */,
 				0F725CA71C503DED00AD943A /* B3EliminateCommonSubexpressions.cpp in Sources */,
+				0F5BF1701F23A5A10029D91D /* B3EnsureLoopPreHeaders.cpp in Sources */,
 				0F6971EB1D92F42D00BA02A5 /* B3FenceValue.cpp in Sources */,
 				0F6B8AE41C4EFE1700969052 /* B3FixSSA.cpp in Sources */,
 				0F725CAF1C506D3B00AD943A /* B3FoldPathConstants.cpp in Sources */,
 				0FEC85151BDACDAC0080FF74 /* B3FrequencyClass.cpp in Sources */,
 				0FEC85181BDACDAC0080FF74 /* B3Generate.cpp in Sources */,
+				0F5BF1631F2317120029D91D /* B3HoistLoopInvariantValues.cpp in Sources */,
 				DC69B99C1D15F912002E3C00 /* B3InferSwitches.cpp in Sources */,
 				0FEC85B91BE1462F0080FF74 /* B3InsertionSet.cpp in Sources */,
 				0FDF67D31D9C6D2A001B9825 /* B3Kind.cpp in Sources */,
@@ -10313,6 +10316,7 @@
 				14280865107EC11A0013E7B2 /* BooleanPrototype.cpp in Sources */,
 				DE26E9071CB5DEFB00D2BE82 /* BuiltinExecutableCreator.cpp in Sources */,
 				A7D801A41880D66E0026C39B /* BuiltinExecutables.cpp in Sources */,
+				E380D66C1F1924A800A59095 /* BuiltinNames.cpp in Sources */,
 				9EA5C7A1190F084200508EBE /* BundlePath.mm in Sources */,
 				C2FCAE1017A9C24E0034C735 /* BytecodeBasicBlock.cpp in Sources */,
 				E3D877731E65C09E00BE945A /* BytecodeDumper.cpp in Sources */,
@@ -10328,7 +10332,6 @@
 				62EC9BB61B7EB07C00303AD1 /* CallFrameShuffleData.cpp in Sources */,
 				62D755D61B84FB46001801FA /* CallFrameShuffler.cpp in Sources */,
 				62D755D51B84FB40001801FA /* CallFrameShuffler32_64.cpp in Sources */,
-				0FEC3C561F33A45300F59B6C /* FastMallocAlignedMemoryAllocator.cpp in Sources */,
 				62D755D41B84FB3D001801FA /* CallFrameShuffler64.cpp in Sources */,
 				0F0B83B014BCF71600885B4F /* CallLinkInfo.cpp in Sources */,
 				0F93329D14CA7DC30085F3C6 /* CallLinkStatus.cpp in Sources */,
@@ -10411,7 +10414,6 @@
 				0FF0F19D16B72A08005DF95B /* DFGCommon.cpp in Sources */,
 				0FEA0A31170D40BF00BB722C /* DFGCommonData.cpp in Sources */,
 				0F38B01717CFE75500B144D3 /* DFGCompilationKey.cpp in Sources */,
-				E31618141EC5FE220006A218 /* DOMAttributeGetterSetter.cpp in Sources */,
 				0F38B01917CFE75500B144D3 /* DFGCompilationMode.cpp in Sources */,
 				0F3B3A1A153E68F2003ED0FF /* DFGConstantFoldingPhase.cpp in Sources */,
 				0FED67B91B26256D0066CE15 /* DFGConstantHoistingPhase.cpp in Sources */,
@@ -10431,6 +10433,7 @@
 				0FBC0AE71496C7C400D4FBDD /* DFGExitProfile.cpp in Sources */,
 				A78A9774179738B8009DF744 /* DFGFailedFinalizer.cpp in Sources */,
 				A78A9776179738B8009DF744 /* DFGFinalizer.cpp in Sources */,
+				0FD9EA881F29162C00F32BEE /* DFGFixedButterflyAccessUncagingPhase.cpp in Sources */,
 				0F2BDC15151C5D4D00CD8910 /* DFGFixupPhase.cpp in Sources */,
 				0F20177F1DCADC3300EA5950 /* DFGFlowIndexing.cpp in Sources */,
 				0F9D339617FFC4E60073C2BC /* DFGFlushedAt.cpp in Sources */,
@@ -10467,7 +10470,6 @@
 				0F2017861DCAE14C00EA5950 /* DFGNodeFlowProjection.cpp in Sources */,
 				0F5D085D1B8CF99D001143B4 /* DFGNodeOrigin.cpp in Sources */,
 				0F2B9CE619D0BA7D00B1D1B5 /* DFGObjectAllocationSinkingPhase.cpp in Sources */,
-				0FD9EA881F29162C00F32BEE /* DFGFixedButterflyAccessUncagingPhase.cpp in Sources */,
 				0F2B9CE819D0BA7D00B1D1B5 /* DFGObjectMaterializationData.cpp in Sources */,
 				86EC9DCF1328DF82002B2AD7 /* DFGOperations.cpp in Sources */,
 				A7D89CFD17A0B8CC00773AD8 /* DFGOSRAvailabilityAnalysisPhase.cpp in Sources */,
@@ -10530,6 +10532,7 @@
 				14386A741DD69895008652C4 /* DirectEvalExecutable.cpp in Sources */,
 				FE54DEFD1E8C6E3700A892C5 /* DisallowVMReentry.cpp in Sources */,
 				0F9D3370165DBB90005AD387 /* Disassembler.cpp in Sources */,
+				E31618141EC5FE220006A218 /* DOMAttributeGetterSetter.cpp in Sources */,
 				E35CA1551DBC3A5F00F83516 /* DOMJITAbstractHeap.cpp in Sources */,
 				E35CA1531DBC3A5C00F83516 /* DOMJITHeapRange.cpp in Sources */,
 				A70447ED17A0BD7000F5898E /* DumpContext.cpp in Sources */,
@@ -10554,6 +10557,7 @@
 				0F56A1D515001CF4002992B1 /* ExecutionCounter.cpp in Sources */,
 				0F0332C018ADFAE1005F979A /* ExitingJITType.cpp in Sources */,
 				0FB105851675480F00F8AB6E /* ExitKind.cpp in Sources */,
+				0FEC3C561F33A45300F59B6C /* FastMallocAlignedMemoryAllocator.cpp in Sources */,
 				0F5513A81D5A68CD00C32BD8 /* FreeList.cpp in Sources */,
 				0FEA0A1C1708B00700BB722C /* FTLAbstractHeap.cpp in Sources */,
 				0FEA0A1E1708B00700BB722C /* FTLAbstractHeapRepository.cpp in Sources */,
@@ -10604,7 +10608,6 @@
 				2AACE63C18CA5A0300ED0191 /* GCActivityCallback.cpp in Sources */,
 				0F766D2F15A8DCE0008F363E /* GCAwareJITStubRoutine.cpp in Sources */,
 				0FD0E5EC1E43D3530006AB08 /* GCConductor.cpp in Sources */,
-				E380D66C1F1924A800A59095 /* BuiltinNames.cpp in Sources */,
 				2ADFA26318EF3540004F9FCC /* GCLogging.cpp in Sources */,
 				0F9715301EB28BEB00A1645D /* GCRequest.cpp in Sources */,
 				70B791941C024A28002481E2 /* GeneratorFunctionConstructor.cpp in Sources */,
@@ -10614,6 +10617,7 @@
 				0F0332C318B01763005F979A /* GetByIdVariant.cpp in Sources */,
 				14280855107EC0E70013E7B2 /* GetterSetter.cpp in Sources */,
 				53B0BE341E561AC900A8FC29 /* GetterSetterAccessCase.cpp in Sources */,
+				0FEC3C5A1F33A48900F59B6C /* GigacageAlignedMemoryAllocator.cpp in Sources */,
 				0F93274D1C1F66AA00CF6564 /* GPRInfo.cpp in Sources */,
 				142E3135134FF0A600AFADB5 /* HandleSet.cpp in Sources */,
 				142E3137134FF0A600AFADB5 /* HandleStack.cpp in Sources */,
@@ -10758,7 +10762,6 @@
 				A503FA1B188E0FB000110F14 /* JSJavaScriptCallFrame.cpp in Sources */,
 				A503FA1D188E0FB000110F14 /* JSJavaScriptCallFramePrototype.cpp in Sources */,
 				7013CA8B1B491A9400CAE613 /* JSJob.cpp in Sources */,
-				0FEC3C521F33A41600F59B6C /* AlignedMemoryAllocator.cpp in Sources */,
 				140B7D1D0DC69AF7009C42B8 /* JSLexicalEnvironment.cpp in Sources */,
 				14280875107EC13E0013E7B2 /* JSLock.cpp in Sources */,
 				C25D709B16DE99F400FCA6BC /* JSManagedValue.mm in Sources */,
@@ -10821,7 +10824,6 @@
 				AD2FCBE81DB58DAD00B3E736 /* JSWebAssemblyRuntimeError.cpp in Sources */,
 				AD2FCBEA1DB58DAD00B3E736 /* JSWebAssemblyTable.cpp in Sources */,
 				1442566115EDE98D0066A49B /* JSWithScope.cpp in Sources */,
-				0F5BF1631F2317120029D91D /* B3HoistLoopInvariantValues.cpp in Sources */,
 				86E3C618167BABEE006D760A /* JSWrapperMap.mm in Sources */,
 				14280870107EC1340013E7B2 /* JSWrapperObject.cpp in Sources */,
 				BCFD8C920EEB2EE700283848 /* JumpTable.cpp in Sources */,
@@ -10888,7 +10890,6 @@
 				0FD3E40B1B618B6600C80E1E /* ObjectPropertyConditionSet.cpp in Sources */,
 				14469DE6107EC7E700650446 /* ObjectPrototype.cpp in Sources */,
 				E124A8F80E555775003091F1 /* OpaqueJSString.cpp in Sources */,
-				0F5BF1701F23A5A10029D91D /* B3EnsureLoopPreHeaders.cpp in Sources */,
 				969A079A0ED1D3AE00F1F681 /* Opcode.cpp in Sources */,
 				14280850107EC0D70013E7B2 /* Operations.cpp in Sources */,
 				0FE228EE1436AB2C00196C48 /* Options.cpp in Sources */,
@@ -11076,7 +11077,6 @@
 				AD7438C11E0457AA00FD0C2A /* WasmSignature.cpp in Sources */,
 				5250D2D11E8DA05A0029A932 /* WasmThunks.cpp in Sources */,
 				53FF7F9B1DBFD2B900A26CCC /* WasmValidate.cpp in Sources */,
-				0FEC3C5A1F33A48900F59B6C /* GigacageAlignedMemoryAllocator.cpp in Sources */,
 				530FB3041E7A1146003C19DD /* WasmWorklist.cpp in Sources */,
 				FED94F2E171E3E2300BE77A4 /* Watchdog.cpp in Sources */,
 				0F919D2515853CE0004A4E7D /* Watchpoint.cpp in Sources */,
@@ -11343,6 +11343,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
+				HEADER_SEARCH_PATHS = (
+					"\"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"",
+					"\"$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders\"",
+					"$(inherited)",
+				);
 			};
 			name = Debug;
 		};
@@ -11350,6 +11355,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
+				HEADER_SEARCH_PATHS = (
+					"\"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"",
+					"\"$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders\"",
+					"$(inherited)",
+				);
 			};
 			name = Release;
 		};
@@ -11357,6 +11367,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
+				HEADER_SEARCH_PATHS = (
+					"\"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"",
+					"\"$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders\"",
+					"$(inherited)",
+				);
 			};
 			name = Profiling;
 		};
@@ -11364,6 +11379,11 @@
 			isa = XCBuildConfiguration;
 			baseConfigurationReference = BC021BF2136900C300FC5467 /* ToolExecutable.xcconfig */;
 			buildSettings = {
+				HEADER_SEARCH_PATHS = (
+					"\"${BUILT_PRODUCTS_DIR}/DerivedSources/JavaScriptCore\"",
+					"\"$(JAVASCRIPTCORE_FRAMEWORKS_DIR)/JavaScriptCore.framework/PrivateHeaders\"",
+					"$(inherited)",
+				);
 			};
 			name = Production;
 		};
diff --git a/Source/JavaScriptCore/bytecode/BytecodeList.json b/Source/JavaScriptCore/bytecode/BytecodeList.json
index 781e8f6..86edea9 100644
--- a/Source/JavaScriptCore/bytecode/BytecodeList.json
+++ b/Source/JavaScriptCore/bytecode/BytecodeList.json
@@ -1,7 +1,7 @@
 [
     {
-        "section" : "Bytecodes", "emitInHFile" : true, "emitInASMFile" : true, "emitOpcodeIDStringValuesInHFile" : true,
-        "macroNameComponent" : "BYTECODE", "asmPrefix" : "llint_", 
+        "section" : "Bytecodes", "emitInHFile" : true, "emitInStructsFile" : true, "emitInASMFile" : true,
+        "emitOpcodeIDStringValuesInHFile" : true, "macroNameComponent" : "BYTECODE", "asmPrefix" : "llint_",
         "bytecodes" : [
             { "name" : "op_enter", "length" : 1 },
             { "name" : "op_get_scope", "length" : 2 },
@@ -50,10 +50,20 @@
             { "name" : "op_bitand", "length" : 5 },
             { "name" : "op_bitxor", "length" : 5 },
             { "name" : "op_bitor", "length" : 5 },
-            { "name" : "op_overrides_has_instance", "length" : 4 },
             { "name" : "op_identity_with_profile", "length" : 4 },
-            { "name" : "op_instanceof", "length" : 4 },
-            { "name" : "op_instanceof_custom", "length" : 5 },
+            { "name" : "op_overrides_has_instance", "offsets" :
+                       [{"dst" : "int"},
+                        {"constructor" : "int"},
+                        {"hasInstanceValue" : "int"}] },
+            { "name" : "op_instanceof", "offsets" :
+                       [{"dst" : "int"},
+                        {"value" : "int"},
+                        {"prototype" : "int"}] },
+            { "name" : "op_instanceof_custom", "offsets" :
+                       [{"dst" : "int"},
+                        {"value" : "int"},
+                        {"constructor" : "int"},
+                        {"hasInstanceValue" : "int"}] },
             { "name" : "op_typeof", "length" : 3 },
             { "name" : "op_is_empty", "length" : 3 },
             { "name" : "op_is_undefined", "length" : 3 },
@@ -160,8 +170,8 @@
         ]
     },
     {
-        "section" : "CLoopHelpers", "emitInHFile" : true, "emitInASMFile" : false, "emitOpcodeIDStringValuesInHFile" : false, "defaultLength" : 1,
-        "macroNameComponent" : "CLOOP_BYTECODE_HELPER",
+        "section" : "CLoopHelpers", "emitInHFile" : true, "emitInStructsFile" : false, "emitInASMFile" : false,
+        "emitOpcodeIDStringValuesInHFile" : false, "defaultLength" : 1, "macroNameComponent" : "CLOOP_BYTECODE_HELPER",
         "bytecodes" : [
             { "name" : "llint_entry" },
             { "name" : "getHostCallReturnValue" },
@@ -183,8 +193,8 @@
         ]
     },
     {
-        "section" : "NativeHelpers", "emitInHFile" : true, "emitInASMFile" : true, "emitOpcodeIDStringValuesInHFile" : false, "defaultLength" : 1,
-        "macroNameComponent" : "BYTECODE_HELPER",
+        "section" : "NativeHelpers", "emitInHFile" : true, "emitInStructsFile" : false, "emitInASMFile" : true,
+        "emitOpcodeIDStringValuesInHFile" : false, "defaultLength" : 1, "macroNameComponent" : "BYTECODE_HELPER",
         "bytecodes" : [
             { "name" : "llint_program_prologue" },
             { "name" : "llint_eval_prologue" },
diff --git a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
index c7b075e..80e699d 100644
--- a/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
+++ b/Source/JavaScriptCore/dfg/DFGByteCodeParser.cpp
@@ -31,6 +31,7 @@
 #include "ArithProfile.h"
 #include "ArrayConstructor.h"
 #include "BasicBlockLocation.h"
+#include "BytecodeStructs.h"
 #include "CallLinkStatus.h"
 #include "CodeBlock.h"
 #include "CodeBlockWithJITType.h"
@@ -4450,12 +4451,13 @@
         }
 
         case op_overrides_has_instance: {
+            auto bytecode = reinterpret_cast<OpOverridesHasInstance*>(currentInstruction);
             JSFunction* defaultHasInstanceSymbolFunction = m_inlineStackTop->m_codeBlock->globalObjectFor(currentCodeOrigin())->functionProtoHasInstanceSymbolFunction();
 
-            Node* constructor = get(VirtualRegister(currentInstruction[2].u.operand));
-            Node* hasInstanceValue = get(VirtualRegister(currentInstruction[3].u.operand));
+            Node* constructor = get(VirtualRegister(bytecode->constructor()));
+            Node* hasInstanceValue = get(VirtualRegister(bytecode->hasInstanceValue()));
 
-            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(OverridesHasInstance, OpInfo(m_graph.freeze(defaultHasInstanceSymbolFunction)), constructor, hasInstanceValue));
+            set(VirtualRegister(bytecode->dst()), addToGraph(OverridesHasInstance, OpInfo(m_graph.freeze(defaultHasInstanceSymbolFunction)), constructor, hasInstanceValue));
             NEXT_OPCODE(op_overrides_has_instance);
         }
 
@@ -4467,17 +4469,19 @@
         }
 
         case op_instanceof: {
-            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
-            Node* prototype = get(VirtualRegister(currentInstruction[3].u.operand));
-            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(InstanceOf, value, prototype));
+            auto bytecode = reinterpret_cast<OpInstanceof*>(currentInstruction);
+            Node* value = get(VirtualRegister(bytecode->value()));
+            Node* prototype = get(VirtualRegister(bytecode->prototype()));
+            set(VirtualRegister(bytecode->dst()), addToGraph(InstanceOf, value, prototype));
             NEXT_OPCODE(op_instanceof);
         }
 
         case op_instanceof_custom: {
-            Node* value = get(VirtualRegister(currentInstruction[2].u.operand));
-            Node* constructor = get(VirtualRegister(currentInstruction[3].u.operand));
-            Node* hasInstanceValue = get(VirtualRegister(currentInstruction[4].u.operand));
-            set(VirtualRegister(currentInstruction[1].u.operand), addToGraph(InstanceOfCustom, value, constructor, hasInstanceValue));
+            auto bytecode = reinterpret_cast<OpInstanceofCustom*>(currentInstruction);
+            Node* value = get(VirtualRegister(bytecode->value()));
+            Node* constructor = get(VirtualRegister(bytecode->constructor()));
+            Node* hasInstanceValue = get(VirtualRegister(bytecode->hasInstanceValue()));
+            set(VirtualRegister(bytecode->dst()), addToGraph(InstanceOfCustom, value, constructor, hasInstanceValue));
             NEXT_OPCODE(op_instanceof_custom);
         }
         case op_is_empty: {
diff --git a/Source/JavaScriptCore/generate-bytecode-files b/Source/JavaScriptCore/generate-bytecode-files
index 71b4f80..9c80776c 100644
--- a/Source/JavaScriptCore/generate-bytecode-files
+++ b/Source/JavaScriptCore/generate-bytecode-files
@@ -104,9 +104,45 @@
 
     return sha1.hexdigest()
 
+
+def toCpp(name):
+    camelCase = re.sub(r'([^a-z0-9].)', lambda c: c.group(0)[1].upper(), name)
+    CamelCase = camelCase[:1].upper() + camelCase[1:]
+    return CamelCase
+
+
+def writeInstructionAccessor(bytecodeHFile, typeName, name):
+    bytecodeHFile.write("    {0}& {1}() {{ return *reinterpret_cast<{0}*>(&m_{1}); }}\n".format(typeName, name))
+    bytecodeHFile.write("    const {0}& {1}() const {{ return *reinterpret_cast<const {0}*>(&m_{1}); }}\n".format(typeName, name))
+
+
+def writeInstructionMember(bytecodeHFile, typeName, name):
+    bytecodeHFile.write("    std::aligned_storage<sizeof({0}), sizeof(Instruction)>::type m_{1};\n".format(typeName, name))
+
+
+def writeStruct(bytecodeHFile, bytecode):
+    bytecodeHFile.write("struct {0} {{\n".format(toCpp(bytecode["name"])))
+    bytecodeHFile.write("public:\n")
+
+    writeInstructionAccessor(bytecodeHFile, "Opcode", "opcode")
+    for offset in bytecode["offsets"]:
+        for name, typeName in offset.iteritems():
+            writeInstructionAccessor(bytecodeHFile, typeName, name)
+
+    bytecodeHFile.write("\nprivate:\n")
+    bytecodeHFile.write("    friend class LLIntOffsetsExtractor;\n\n")
+
+    writeInstructionMember(bytecodeHFile, "Opcode", "opcode")
+    for offset in bytecode["offsets"]:
+        for name, typeName in offset.iteritems():
+            writeInstructionMember(bytecodeHFile, typeName, name)
+    bytecodeHFile.write("};\n\n")
+
+
 if __name__ == "__main__":
     parser = optparse.OptionParser(usage = "usage: %prog [--bytecodes_h <FILE>] [--init_bytecodes_asm <FILE>] <bytecode-json-file>")
     parser.add_option("-b", "--bytecodes_h", dest = "bytecodesHFileName", help = "generate bytecodes macro .h FILE", metavar = "FILE")
+    parser.add_option("-s", "--bytecode_structs_h", dest = "bytecodeStructsHFileName", help = "generate bytecodes macro .h FILE", metavar = "FILE")
     parser.add_option("-a", "--init_bytecodes_asm", dest = "initASMFileName", help="generate ASM bytecodes init FILE", metavar = "FILE")
     (options, args) = parser.parse_args()
 
@@ -121,9 +157,10 @@
     asmFileHashString = "# SHA1Hash: {0}\n".format(sha1Hash)
 
     bytecodeHFilename = options.bytecodesHFileName
+    bytecodeStructsHFilename = options.bytecodeStructsHFileName
     initASMFileName = options.initASMFileName
 
-    if not bytecodeHFilename and not initASMFileName:
+    if not bytecodeHFilename and not initASMFileName and not bytecodeStructsHFilename:
         parser.print_help()
         exit(0)
 
@@ -132,7 +169,7 @@
     if bytecodeHFilename:
         try:
             bytecodeHReadFile = open(bytecodeHFilename, "rb")
-            
+
             hashLine = bytecodeHReadFile.readline()
             if hashLine != hFileHashString:
                 needToGenerate = True
@@ -141,6 +178,18 @@
         else:
             bytecodeHReadFile.close()
 
+    if bytecodeStructsHFilename:
+        try:
+            bytecodeStructsHReadFile = open(bytecodeStructsHFilename, "rb")
+
+            hashLine = bytecodeStructsHReadFile.readline()
+            if hashLine != hFileHashString:
+                needToGenerate = True
+        except:
+            needToGenerate = True
+        else:
+            bytecodeStructsHReadFile.close()
+
     if initASMFileName:
         try:
             initBytecodesReadFile = open(initASMFileName, "rb")
@@ -159,6 +208,9 @@
     if bytecodeHFilename:
         bytecodeHFile = openOrExit(bytecodeHFilename, "wb")
 
+    if bytecodeStructsHFilename:
+        bytecodeStructsHFile = openOrExit(bytecodeStructsHFilename, "wb")
+
     if initASMFileName:
         initBytecodesFile = openOrExit(initASMFileName, "wb")
 
@@ -172,6 +224,13 @@
         bytecodeHFile.write(cCopyrightMsg % bytecodeJSONFile)
         bytecodeHFile.write("#pragma once\n\n")
 
+    if bytecodeStructsHFilename:
+        bytecodeStructsHFile.write(hFileHashString)
+        bytecodeStructsHFile.write(cCopyrightMsg % bytecodeJSONFile)
+        bytecodeStructsHFile.write("#pragma once\n\n")
+        bytecodeStructsHFile.write("#include \"Instruction.h\"\n")
+        bytecodeStructsHFile.write("\n")
+
     if initASMFileName:
         initBytecodesFile.write(asmFileHashString)
         initBytecodesFile.write(asmCopyrightMsg % bytecodeJSONFile)
@@ -193,6 +252,9 @@
                 length = defaultLength
                 if "length" in bytecode:
                     length = bytecode["length"]
+                elif "offsets" in bytecode:
+                    # Add one for the opcode
+                    length = len(bytecode["offsets"]) + 1
 
                 bytecodeHFile.write("    macro({0}, {1})".format(bytecode["name"], length))
                 firstMacro = False
@@ -201,6 +263,17 @@
             bytecodeHFile.write("\n\n")
             bytecodeHFile.write("#define NUMBER_OF_{0}_IDS {1}\n\n".format(section["macroNameComponent"], bytecodeNum))
 
+
+        if bytecodeStructsHFilename and section['emitInStructsFile']:
+            bytecodeStructsHFile.write("namespace JSC {\n\n")
+
+            for bytecode in section["bytecodes"]:
+                if not "offsets" in bytecode:
+                    continue
+                writeStruct(bytecodeStructsHFile, bytecode)
+
+            bytecodeStructsHFile.write("} // namespace JSC \n")
+
         if bytecodeHFilename and section['emitOpcodeIDStringValuesInHFile']:
             bytecodeNum = 0
             for bytecode in section["bytecodes"]:
diff --git a/Source/JavaScriptCore/jit/JITOpcodes.cpp b/Source/JavaScriptCore/jit/JITOpcodes.cpp
index b015734..d31f20f 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes.cpp
@@ -29,6 +29,7 @@
 #include "JIT.h"
 
 #include "BasicBlockLocation.h"
+#include "BytecodeStructs.h"
 #include "Exception.h"
 #include "Heap.h"
 #include "InterpreterInlines.h"
@@ -112,9 +113,10 @@
 
 void JIT::emit_op_overrides_has_instance(Instruction* currentInstruction)
 {
-    int dst = currentInstruction[1].u.operand;
-    int constructor = currentInstruction[2].u.operand;
-    int hasInstanceValue = currentInstruction[3].u.operand;
+    auto bytecode = reinterpret_cast<OpOverridesHasInstance*>(currentInstruction);
+    int dst = bytecode->dst();
+    int constructor = bytecode->constructor();
+    int hasInstanceValue = bytecode->hasInstanceValue();
 
     emitGetVirtualRegister(hasInstanceValue, regT0);
 
@@ -137,9 +139,10 @@
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
 {
-    int dst = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    int proto = currentInstruction[3].u.operand;
+    auto bytecode = reinterpret_cast<OpInstanceof*>(currentInstruction);
+    int dst = bytecode->dst();
+    int value = bytecode->value();
+    int proto = bytecode->prototype();
 
     // Load the operands (baseVal, proto, and value respectively) into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
@@ -860,9 +863,10 @@
 
 void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    int dst = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    int proto = currentInstruction[3].u.operand;
+    auto bytecode = reinterpret_cast<OpInstanceof*>(currentInstruction);
+    int dst = bytecode->dst();
+    int value = bytecode->value();
+    int proto = bytecode->prototype();
 
     linkSlowCaseIfNotJSCell(iter, value);
     linkSlowCaseIfNotJSCell(iter, proto);
@@ -875,10 +879,11 @@
 
 void JIT::emitSlow_op_instanceof_custom(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    int dst = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    int constructor = currentInstruction[3].u.operand;
-    int hasInstanceValue = currentInstruction[4].u.operand;
+    auto bytecode = reinterpret_cast<OpInstanceofCustom*>(currentInstruction);
+    int dst = bytecode->dst();
+    int value = bytecode->value();
+    int constructor = bytecode->constructor();
+    int hasInstanceValue = bytecode->hasInstanceValue();
 
     linkSlowCase(iter);
     emitGetVirtualRegister(value, regT0);
diff --git a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
index 3aa0305..c5993009 100644
--- a/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/Source/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -30,6 +30,7 @@
 #if USE(JSVALUE32_64)
 #include "JIT.h"
 
+#include "BytecodeStructs.h"
 #include "CCallHelpers.h"
 #include "Exception.h"
 #include "JITInlines.h"
@@ -192,9 +193,10 @@
 
 void JIT::emit_op_overrides_has_instance(Instruction* currentInstruction)
 {
-    int dst = currentInstruction[1].u.operand;
-    int constructor = currentInstruction[2].u.operand;
-    int hasInstanceValue = currentInstruction[3].u.operand;
+    auto bytecode = reinterpret_cast<OpOverridesHasInstance*>(currentInstruction);
+    int dst = bytecode->dst();
+    int constructor = bytecode->constructor();
+    int hasInstanceValue = bytecode->hasInstanceValue();
 
     emitLoadPayload(hasInstanceValue, regT0);
     // We don't jump if we know what Symbol.hasInstance would do.
@@ -219,9 +221,10 @@
 
 void JIT::emit_op_instanceof(Instruction* currentInstruction)
 {
-    int dst = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    int proto = currentInstruction[3].u.operand;
+    auto bytecode = reinterpret_cast<OpInstanceof*>(currentInstruction);
+    int dst = bytecode->dst();
+    int value = bytecode->value();
+    int proto = bytecode->prototype();
 
     // Load the operands into registers.
     // We use regT0 for baseVal since we will be done with this first, and we can then use it for the result.
@@ -266,9 +269,10 @@
 
 void JIT::emitSlow_op_instanceof(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    int dst = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    int proto = currentInstruction[3].u.operand;
+    auto bytecode = reinterpret_cast<OpInstanceof*>(currentInstruction);
+    int dst = bytecode->dst();
+    int value = bytecode->value();
+    int proto = bytecode->prototype();
 
     linkSlowCaseIfNotJSCell(iter, value);
     linkSlowCaseIfNotJSCell(iter, proto);
@@ -282,10 +286,11 @@
 
 void JIT::emitSlow_op_instanceof_custom(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
-    int dst = currentInstruction[1].u.operand;
-    int value = currentInstruction[2].u.operand;
-    int constructor = currentInstruction[3].u.operand;
-    int hasInstanceValue = currentInstruction[4].u.operand;
+    auto bytecode = reinterpret_cast<OpInstanceofCustom*>(currentInstruction);
+    int dst = bytecode->dst();
+    int value = bytecode->value();
+    int constructor = bytecode->constructor();
+    int hasInstanceValue = bytecode->hasInstanceValue();
 
     linkSlowCase(iter);
 
diff --git a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
index 12073ad..502799d 100644
--- a/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
+++ b/Source/JavaScriptCore/llint/LLIntOffsetsExtractor.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 
 #include "ArrayProfile.h"
+#include "BytecodeStructs.h"
 #include "CodeBlock.h"
 #include "CommonSlowPaths.h"
 #include "DirectArguments.h"
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
index 52562e5..582f23b3 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter.asm
@@ -293,7 +293,15 @@
     macro loadpFromInstruction(offset, dest)
         loadp offset * 8[PB, PC, 8], dest
     end
-    
+
+    macro loadisFromStruct(offset, dest)
+        loadis offset[PB, PC, 8], dest
+    end
+
+    macro loadpFromStruct(offset, dest)
+        loadp offset[PB, PC, 8], dest
+    end
+
     macro storeisToInstruction(value, offset)
         storei value, offset * 8[PB, PC, 8]
     end
@@ -302,6 +310,14 @@
         storep value, offset * 8[PB, PC, 8]
     end
 
+    macro storeisFromStruct(value, offset)
+        storei value, offset[PB, PC, 8]
+    end
+
+    macro storepFromStruct(value, offset)
+        storep value, offset[PB, PC, 8]
+    end
+
 else
     const PC = t4 # When changing this, make sure LLIntPC is up to date in LLIntPCRanges.h
     macro loadisFromInstruction(offset, dest)
@@ -315,6 +331,18 @@
     macro storeisToInstruction(value, offset)
         storei value, offset * 4[PC]
     end
+
+    macro loadisFromStruct(offset, dest)
+        loadis offset[PC], dest
+    end
+
+    macro loadpFromStruct(offset, dest)
+        loadp offset[PC], dest
+    end
+
+    macro storeisToStruct(value, offset)
+        storei value, offset[PC]
+    end
 end
 
 if X86_64_WIN
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
index a70e2b5..70ae8bc 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm
@@ -1185,11 +1185,11 @@
 _llint_op_overrides_has_instance:
     traceExecution()
 
-    loadisFromInstruction(1, t3)
+    loadisFromStruct(OpOverridesHasInstance::m_dst, t3)
     storei BooleanTag, TagOffset[cfr, t3, 8]
 
     # First check if hasInstanceValue is the one on Function.prototype[Symbol.hasInstance]
-    loadisFromInstruction(3, t0)
+    loadisFromStruct(OpOverridesHasInstance::m_hasInstanceValue, t0)
     loadConstantOrVariablePayload(t0, CellTag, t2, .opOverrideshasInstanceValueNotCell)
     loadConstantOrVariable(t0, t1, t2)
     bineq t1, CellTag, .opOverrideshasInstanceValueNotCell
@@ -1201,7 +1201,7 @@
     bineq t1, t2, .opOverrideshasInstanceValueNotDefault
 
     # We know the constructor is a cell.
-    loadisFromInstruction(2, t0)
+    loadisFromStruct(OpOverridesHasInstance::m_constructor, t0)
     loadConstantOrVariablePayloadUnchecked(t0, t1)
     tbz JSCell::m_flags[t1], ImplementsDefaultHasInstance, t0
     storei t0, PayloadOffset[cfr, t3, 8]
diff --git a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
index 1d5e055..da29592 100644
--- a/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
+++ b/Source/JavaScriptCore/llint/LowLevelInterpreter64.asm
@@ -1090,16 +1090,16 @@
 
 _llint_op_overrides_has_instance:
     traceExecution()
-    loadisFromInstruction(1, t3)
+    loadisFromStruct(OpOverridesHasInstance::m_dst, t3)
 
-    loadisFromInstruction(3, t1)
+    loadisFromStruct(OpOverridesHasInstance::m_hasInstanceValue, t1)
     loadConstantOrVariable(t1, t0)
     loadp CodeBlock[cfr], t2
     loadp CodeBlock::m_globalObject[t2], t2
     loadp JSGlobalObject::m_functionProtoHasInstanceSymbolFunction[t2], t2
     bqneq t0, t2, .opOverridesHasInstanceNotDefaultSymbol
 
-    loadisFromInstruction(2, t1)
+    loadisFromStruct(OpOverridesHasInstance::m_constructor, t1)
     loadConstantOrVariable(t1, t0)
     tbz JSCell::m_flags[t0], ImplementsDefaultHasInstance, t1
     orq ValueFalse, t1