[webkit-dev] Mystery of resolve_global bytecode instruction

wingoog moon wingoog91 at gmail.com
Thu Jul 19 02:28:28 PDT 2012

Hi all.

I'm trying to understand how resolve_global instruction works for several
days. Let's look at the code

void JIT::emit_op_resolve_global(Instruction* currentInstruction, bool)

 // Fast case
    void* globalObject = m_codeBlock->globalObject();
    unsigned currentIndex = m_globalResolveInfoIndex++;
    GlobalResolveInfo* resolveInfoAddress =

    // Check Structure of global object

    move(TrustedImmPtr(globalObject), regT0); //*loads address of
globalObject to eax(regT0)*
    move(TrustedImmPtr(resolveInfoAddress), regT2);*// loads address
of resolveInfoAddress to ecx(regT2)*
    loadPtr(Address(regT2, OBJECT_OFFSETOF(GlobalResolveInfo, structure)),
    addSlowCase(branchPtr(NotEqual, regT1, Address(regT0,
JSCell::structureOffset()))); // Structures don't match *// Do some checking

    // Load cached property
    // Assume that the global object always uses external storage.
    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSGlobalObject,
m_propertyStorage)), regT0); *// loads m_propertyStorage to eax*
*// Here is interesting thing happens*
*// offset member of  GlobalResolveInfo class is always 0;*
  load32(Address(regT2, OBJECT_OFFSETOF(GlobalResolveInfo, offset)),
regT1); *//move value of **GlobalResolveInfo offset member(it's always 0 )
to edx(regT1)*

*//So here we always mov same value to eax(regT0), regardless of whether
our global Array , String or Object*
    loadPtr(BaseIndex(regT0, regT1, ScalePtr), regT0);



1. What is mystery of this instruction, how it's really works let's say for
this example???

var a=Array(5);
var s=String;
var o=Object;

2. What is in m_propertyStorage, and when it's sets?

Thanks for attention!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-dev/attachments/20120719/994fc0a5/attachment.html>

More information about the webkit-dev mailing list