Repatch.cpp

/*
 * Copyright (C) 2011-2023 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
 * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 */

#include "config.h"
#include "Repatch.h"

#include "BinarySwitch.h"
#include "CCallHelpers.h"
#include "CacheableIdentifierInlines.h"
#include "CallFrameShuffler.h"
#include "DFGOperations.h"
#include "DFGSpeculativeJIT.h"
#include "DOMJITGetterSetter.h"
#include "DirectArguments.h"
#include "ECMAMode.h"
#include "ExecutableBaseInlines.h"
#include "FTLThunks.h"
#include "FullCodeOrigin.h"
#include "FunctionCodeBlock.h"
#include "GCAwareJITStubRoutine.h"
#include "GetterSetter.h"
#include "GetterSetterAccessCase.h"
#include "ICStats.h"
#include "InlineAccess.h"
#include "InlineCacheCompiler.h"
#include "InstanceOfAccessCase.h"
#include "IntrinsicGetterAccessCase.h"
#include "JIT.h"
#include "JITInlines.h"
#include "JITThunks.h"
#include "JSCInlines.h"
#include "JSModuleNamespaceObject.h"
#include "JSWebAssembly.h"
#include "JSWebAssemblyInstance.h"
#include "JSWebAssemblyModule.h"
#include "LLIntData.h"
#include "LinkBuffer.h"
#include "MaxFrameExtentForSlowPathCall.h"
#include "ModuleNamespaceAccessCase.h"
#include "PropertyInlineCache.h"
#include "PropertyInlineCacheClearingWatchpoint.h"
#include "RegExpObject.h"
#include "ScopedArguments.h"
#include "ScratchRegisterAllocator.h"
#include "StackAlignment.h"
#include "StructureRareDataInlines.h"
#include "SuperSampler.h"
#include "ThunkGenerators.h"
#include "WebAssemblyFunction.h"
#include <wtf/CommaPrinter.h>
#include <wtf/ListDump.h>
#include <wtf/StringPrintStream.h>

namespace JSC {

static void linkSlowFor(VM& vm, CallLinkInfo& callLinkInfo)
{
    if (callLinkInfo.type() == CallLinkInfo::Type::Optimizing)
        callLinkInfo.setVirtualCall(vm);
}

void linkMonomorphicCall(VM& vm, JSCell* owner, CallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock, JSObject* callee, CodePtr<JSEntryPtrTag> codePtr)
{
    CodeBlock* callerCodeBlock = dynamicDowncast<CodeBlock>(owner); // WebAssembly -> JS stubs don't have a valid CodeBlock.
    ASSERT(owner);

    if (Options::forceICFailure()) [[unlikely]]
        return;

    if (vm.gilOff()) [[unlikely]] {
        // AB18-D (amended per review): N mutators can take the same call
        // site's slow path concurrently (both saw Mode::Init + seenOnce()).
        // The Init->Monomorphic transition — and, per precondition 11
        // (INTEGRATE-jit), every other call-link transition writer — is
        // serialized on the single process-wide link lock; per-CodeBlock
        // locking was rejected in review (it covered one writer pair out of
        // six and risked caller/callee ABBA between mutually-recursive
        // CodeBlocks). The loser keeps the winner's publication and just
        // returns: linkFor computed codePtr for THIS call independently of
        // the IC, so the current call still lands on a correct target.
        // Taking the callee push under the SAME lock also serializes it
        // against every other locked push/remove (the SentinelLinkedList
        // prev/next corruption signature); the isOnList() re-check makes a
        // racing upgrade-relink idempotent rather than a double push.
        Locker locker { CallLinkInfo::s_callLinkSerializationLock };
        if (callLinkInfo.isLinked() || callLinkInfo.stub())
            return; // Lost the race; the winner's link stands.
        callLinkInfo.setMonomorphicCallee(vm, owner, callee, calleeCodeBlock, codePtr);
        callLinkInfo.setLastSeenCallee(vm, owner, callee);

        if (shouldDumpDisassemblyFor(callerCodeBlock))
            dataLog("Linking call in ", FullCodeOrigin(callerCodeBlock, callLinkInfo.codeOrigin()), " to ", pointerDump(calleeCodeBlock), ", entrypoint at ", codePtr, "\n");

        if (calleeCodeBlock && !callLinkInfo.isOnList())
            calleeCodeBlock->linkIncomingCall(owner, &callLinkInfo);

        if (callLinkInfo.specializationKind() == CodeSpecializationKind::CodeForCall)
            return;
        linkSlowFor(vm, callLinkInfo);
        return;
    }

    ASSERT(!callLinkInfo.stub());
    ASSERT(!callLinkInfo.isLinked());
    callLinkInfo.setMonomorphicCallee(vm, owner, callee, calleeCodeBlock, codePtr);
    callLinkInfo.setLastSeenCallee(vm, owner, callee);

    if (shouldDumpDisassemblyFor(callerCodeBlock))
        dataLog("Linking call in ", FullCodeOrigin(callerCodeBlock, callLinkInfo.codeOrigin()), " to ", pointerDump(calleeCodeBlock), ", entrypoint at ", codePtr, "\n");

    if (calleeCodeBlock)
        calleeCodeBlock->linkIncomingCall(owner, &callLinkInfo);

    if (callLinkInfo.specializationKind() == CodeSpecializationKind::CodeForCall)
        return;
    linkSlowFor(vm, callLinkInfo);
}

CodePtr<JSEntryPtrTag> jsToWasmICCodePtr(CodeSpecializationKind kind, JSObject* callee)
{
#if ENABLE(WEBASSEMBLY)
    if (!callee)
        return nullptr;
    if (kind != CodeSpecializationKind::CodeForCall)
        return nullptr;
    if (auto* wasmFunction = dynamicDowncast<WebAssemblyFunction>(callee))
        return wasmFunction->jsCallICEntrypoint();
#else
    UNUSED_PARAM(kind);
    UNUSED_PARAM(callee);
#endif
    return nullptr;
}

static void linkPolymorphicCallImpl(VM& vm, JSCell* owner, CallFrame* callFrame, CallLinkInfo& callLinkInfo, CallVariant newVariant)
{
    // Precondition-11 loser path: gilOff we run under
    // s_callLinkSerializationLock (taken in linkPolymorphicCall), but a
    // racing slow-path entrant may have already moved this site to Virtual
    // while we waited on the lock. Virtual is terminal, and its m_callee
    // slot holds the raw always-call sentinel (polymorphicCalleeMask), so
    // the callee() read below would hand a non-cell word (0x1) to the
    // WriteBarrier cell validation. Same lost-the-race bail shape as
    // linkMonomorphicCall: the winner's virtual link stands, and the
    // current call was dispatched independently of the IC, so just return.
    if (vm.gilOff() && callLinkInfo.mode() == CallLinkInfo::Mode::Virtual) [[unlikely]]
        return;

    if (!newVariant || Options::forceICFailure()) {
        callLinkInfo.setVirtualCall(vm);
        return;
    }

    CodeBlock* callerCodeBlock = dynamicDowncast<CodeBlock>(owner); // WebAssembly -> JS stubs don't have a valid CodeBlock.
    ASSERT(owner);
#if ENABLE(WEBASSEMBLY)
    bool isWebAssembly = owner->inherits<JSWebAssemblyModule>();
#else
    bool isWebAssembly = false;
#endif
    bool isTailCall = callLinkInfo.isTailCall();

    bool isClosureCall = false;
    CallVariantList list;
    if (PolymorphicCallStubRoutine* stub = callLinkInfo.stub()) {
        list = stub->variants();
        isClosureCall = stub->isClosureCall();
    } else if (JSObject* oldCallee = callLinkInfo.callee())
        list = CallVariantList { CallVariant(oldCallee) };

    list = variantListWithVariant(list, newVariant);

    // If there are any closure calls then it makes sense to treat all of them as closure calls.
    // This makes switching on callee cheaper. It also produces profiling that's easier on the DFG;
    // the DFG doesn't really want to deal with a combination of closure and non-closure callees.
    if (!isClosureCall) {
        for (CallVariant variant : list)  {
            if (variant.isClosureCall()) {
                list = despecifiedVariantList(list);
                isClosureCall = true;
                break;
            }
        }
    }

    if (isClosureCall)
        callLinkInfo.setHasSeenClosure();

    // If we are over the limit, just use a normal virtual call.
    unsigned maxPolymorphicCallVariantListSize;
    if (isWebAssembly)
        maxPolymorphicCallVariantListSize = Options::maxPolymorphicCallVariantListSizeForWasmToJS();
    else if (callerCodeBlock->jitType() == JITCode::topTierJIT())
        maxPolymorphicCallVariantListSize = Options::maxPolymorphicCallVariantListSizeForTopTier();
    else
        maxPolymorphicCallVariantListSize = Options::maxPolymorphicCallVariantListSize();

    // We use list.size() instead of callSlots.size() because we respect CallVariant size for now.
    if (list.size() > maxPolymorphicCallVariantListSize) {
        callLinkInfo.setVirtualCall(vm);
        return;
    }

    Vector<CallSlot, 16> callSlots;

    // Figure out what our cases are.
    for (CallVariant variant : list) {
        CodeBlock* codeBlock = nullptr;
        if (variant.executable() && !variant.executable()->isHostFunction()) {
            ExecutableBase* executable = variant.executable();
            codeBlock = uncheckedDowncast<FunctionExecutable>(executable)->codeBlockForCall();
            // If we cannot handle a callee, because we don't have a CodeBlock,
            // assume that it's better for this whole thing to be a virtual call.
            if (!codeBlock) {
                callLinkInfo.setVirtualCall(vm);
                return;
            }
        }

        JSCell* caseValue = nullptr;
        if (isClosureCall) {
            caseValue = variant.executable();
            // FIXME: We could add a fast path for InternalFunction with closure call.
            // https://bugs.webkit.org/show_bug.cgi?id=179311
            if (!caseValue)
                continue;
        } else {
            if (auto* function = variant.function())
                caseValue = function;
            else
                caseValue = variant.internalFunction();
        }

        CallSlot slot;

        CodePtr<JSEntryPtrTag> codePtr;
        if (variant.executable()) {
            // gilOff, ScriptExecutable::installCode retracts the
            // m_jitCodeForCall mirror FIRST (retract-first store order,
            // runtime/ScriptExecutable.cpp) under a lock domain that
            // s_callLinkSerializationLock does not cover, so the mirror read
            // in hasJITCodeForCall() can be transiently null even though the
            // variant genuinely has code. The per-variant CodeBlock snapshot
            // taken above is the authoritative witness — the value path below
            // already derives the entrypoint through it (ANNEX CBI item 3,
            // AB17c F4). So under gilOff, assert the witness each downstream
            // deref actually relies on: the snapshot's jitCode() for script
            // executables (codeBlock non-null — non-host variants with a null
            // snapshot already bailed to setVirtualCall above), and the
            // mirror for hosts, which publish m_jitCodeForCall once at
            // construction and never retract, so the mirror check stays
            // race-free and meaningful for them.
            ASSERT(vm.gilOff()
                ? (codeBlock ? !!codeBlock->jitCode() : variant.executable()->hasJITCodeForCall())
                : variant.executable()->hasJITCodeForCall());

            codePtr = jsToWasmICCodePtr(callLinkInfo.specializationKind(), variant.function());
            if (!codePtr) {
                ArityCheckMode arityCheck = ArityCheckMode::ArityCheckNotRequired;
                if (codeBlock) {
                    ASSERT(!variant.executable()->isHostFunction());
                    if ((callFrame->argumentCountIncludingThis() < static_cast<size_t>(codeBlock->numParameters()) || callLinkInfo.isVarargs()))
                        arityCheck = ArityCheckMode::MustCheckArity;

                }
                if (vm.gilOff() && codeBlock) [[unlikely]] {
                    // ANNEX CBI item 3 (AB17c F4): derive the entrypoint
                    // THROUGH the per-variant CodeBlock snapshot taken
                    // above. The executable's m_jitCodeForCall mirror is
                    // (a) transiently NULL during a live installCode (the
                    // retract-first store order) — generatedJITCodeForCall
                    // unconditionally derefs it — and (b) independently
                    // republished, so reading it here could pair a target
                    // from one tier with slot.m_codeBlock from another.
                    // Host functions (codeBlock == nullptr) keep the mirror
                    // read: their jitCode is set once at creation.
                    codePtr = codeBlock->jitCode()->addressForCall(arityCheck);
                } else
                    codePtr = variant.executable()->generatedJITCodeForCall()->addressForCall(arityCheck);
                slot.m_arityCheckMode = arityCheck;
            }
        } else {
            ASSERT(variant.internalFunction());
            codePtr = vm.getCTIInternalFunctionTrampolineFor(CodeSpecializationKind::CodeForCall);
        }

        slot.m_index = callSlots.size();
        slot.m_target = codePtr;
        slot.m_codeBlock = codeBlock;
        slot.m_calleeOrExecutable = caseValue;

        callSlots.append(WTF::move(slot));
    }

    bool notUsingCounting = isWebAssembly || callerCodeBlock->jitType() == JITCode::topTierJIT();
    if (callSlots.isEmpty())
        notUsingCounting = true;

    CallFrame* callerFrame = nullptr;
    if (!isTailCall)
        callerFrame = callFrame->callerFrame();

    MacroAssemblerCodeRef<JITStubRoutinePtrTag> code;
#if ENABLE(JIT)
    if (Options::useJIT()) {
        CommonJITThunkID jitThunk = CommonJITThunkID::PolymorphicThunkForClosure;
        if (notUsingCounting)
            jitThunk = isClosureCall ? CommonJITThunkID::PolymorphicTopTierThunkForClosure : CommonJITThunkID::PolymorphicTopTierThunk;
        else
            jitThunk = isClosureCall ? CommonJITThunkID::PolymorphicThunkForClosure : CommonJITThunkID::PolymorphicThunk;
        code = vm.getCTIStub(jitThunk).retagged<JITStubRoutinePtrTag>();
    }
#endif
    if (!code) {
        if (isClosureCall)
            code = LLInt::getCodeRef<JITStubRoutinePtrTag>(llint_polymorphic_closure_call_trampoline);
        else
            code = LLInt::getCodeRef<JITStubRoutinePtrTag>(llint_polymorphic_normal_call_trampoline);
    }

    auto stubRoutine = PolymorphicCallStubRoutine::create(WTF::move(code), vm, owner, callerFrame, callLinkInfo, callSlots, notUsingCounting, isClosureCall);

    // If there had been a previous stub routine, that one will die as soon as the GC runs and sees
    // that it's no longer on stack.
    callLinkInfo.setStub(vm, WTF::move(stubRoutine));
}

void linkPolymorphicCall(VM& vm, JSCell* owner, CallFrame* callFrame, CallLinkInfo& callLinkInfo, CallVariant newVariant)
{
    // During execution of linkPolymorphicCall, we strongly assume that we never do GC.
    // GC jettisons CodeBlocks, changes CallLinkInfo etc. and breaks assumption done before and after this call.
    DeferGCForAWhile deferGCForAWhile(vm);

    if (vm.gilOff()) [[unlikely]] {
        // AB18-D (amended per review): this is a transition writer too — it
        // reads the current stub/callee, then setStub/setVirtualCall rewrite
        // the mirrors, swap m_stub, publish a record, and remove() this node
        // from a callee's m_incomingCalls. All of that must be in the
        // precondition-11 writer set, serialized on the same link lock as
        // linkMonomorphicCall — the reviewed proposal locked only the
        // Init->Monomorphic pair. Holding the lock across stub creation is
        // acceptable: rare slow path, GC is deferred above, and the lock
        // nests nothing (single process-wide lock; holders never park).
        Locker locker { CallLinkInfo::s_callLinkSerializationLock };
        linkPolymorphicCallImpl(vm, owner, callFrame, callLinkInfo, newVariant);
        return;
    }
    linkPolymorphicCallImpl(vm, owner, callFrame, callLinkInfo, newVariant);
}

#if ENABLE(JIT)

static ECMAMode NODELETE ecmaModeFor(PutByKind putByKind)
{
    switch (putByKind) {
    case PutByKind::ByIdSloppy:
    case PutByKind::ByValSloppy:
    case PutByKind::ByIdDirectSloppy:
    case PutByKind::ByValDirectSloppy:
        return ECMAMode::sloppy();

    case PutByKind::ByIdStrict:
    case PutByKind::ByValStrict:
    case PutByKind::ByIdDirectStrict:
    case PutByKind::ByValDirectStrict:
    case PutByKind::DefinePrivateNameById:
    case PutByKind::DefinePrivateNameByVal:
    case PutByKind::SetPrivateNameById:
    case PutByKind::SetPrivateNameByVal:
        return ECMAMode::strict();
    }
    RELEASE_ASSERT_NOT_REACHED();
}



void ftlThunkAwareRepatchCall(CodeBlock* codeBlock, CodeLocationCall<JSInternalPtrTag> call, CodePtr<CFunctionPtrTag> newCalleeFunction)
{
#if ENABLE(FTL_JIT)
    if (codeBlock->jitType() == JITType::FTLJIT) {
        VM& vm = codeBlock->vm();
        FTL::Thunks& thunks = *vm.ftlThunks;
        CodePtr<JITThunkPtrTag> slowPathThunk = MacroAssembler::readCallTarget<JITThunkPtrTag>(call);
        FTL::SlowPathCallKey key = thunks.keyForSlowPathCallThunk(slowPathThunk);
        key = key.withCallTarget(newCalleeFunction);
        MacroAssembler::repatchCall(call, thunks.getSlowPathCallThunk(vm, key).code());
        return;
    }
#else // ENABLE(FTL_JIT)
    UNUSED_PARAM(codeBlock);
#endif // ENABLE(FTL_JIT)
    MacroAssembler::repatchCall(call, newCalleeFunction.retagged<OperationPtrTag>());
}

// TSAN ic-stubinfo (SPEC-jit §5.1/D3): IC state is mutable multi-field data;
// every writer must hold the owner CodeBlock's m_lock. This primitive
// REQUIRES the caller to hold codeBlock->m_lock already — the tryCache*
// bodies and the reset* family (reached from PropertyInlineCache::reset,
// whose callers all hold the lock) satisfy that. Callers on the lock-free
// GaveUp/megamorphic-demotion tails must use repatchSlowPathCallLocking
// below instead: without the lock, two slow paths demoting the same shared
// IC concurrently (or racing a locked Optimize-revert writer in tryCache*)
// make m_slowOperation a plain-store data race.
static void repatchSlowPathCall(CodeBlock* codeBlock, PropertyInlineCache& propertyCache, CodePtr<CFunctionPtrTag> newCalleeFunction)
{
    if (auto* handlerIC = dynamicDowncast<HandlerPropertyInlineCache>(propertyCache)) {
        handlerIC->m_slowOperation = newCalleeFunction.retagged<OperationPtrTag>();
        return;
    }
    ftlThunkAwareRepatchCall(codeBlock, downcast<RepatchingPropertyInlineCache>(propertyCache).m_slowPathCallLocation, newCalleeFunction);
}

// See above: the lock-acquiring shape for the repatch* tails, which run AFTER
// tryCache* released the locker. The store itself does not allocate, so a
// plain ConcurrentJSLocker suffices (no GC-safe bracket needed).
static void repatchSlowPathCallLocking(CodeBlock* codeBlock, PropertyInlineCache& propertyCache, CodePtr<CFunctionPtrTag> newCalleeFunction)
{
    ConcurrentJSLocker locker(codeBlock->m_lock);
    repatchSlowPathCall(codeBlock, propertyCache, newCalleeFunction);
}

enum InlineCacheAction {
    GiveUpOnCache,
    RetryCacheLater,
    AttemptToCache,
    PromoteToMegamorphic,
};

static InlineCacheAction actionForCell(VM& vm, JSCell* cell)
{
    Structure* structure = cell->structure();

    TypeInfo typeInfo = structure->typeInfo();
    if (typeInfo.prohibitsPropertyCaching())
        return GiveUpOnCache;

    if (structure->isUncacheableDictionary()) {
        if (structure->hasBeenFlattenedBefore())
            return GiveUpOnCache;
        if (vm.gilOff()) [[unlikely]] {
            // O2/GT11 (stw-watchdog-timeout root cause, transition-vs-write):
            // every tryCache* caller holds codeBlock->m_lock (rank 6b) here,
            // and flag-on flattenDictionaryObject routes through
            // flattenDictionaryStructureUnderStop — a §10.6 per-event stop.
            // Requesting a stop while holding a lock that other mutators
            // block on WITH heap access held (ConcurrentJSLocker has no
            // access-release bracket) wedges the conductor's quiescence
            // predicate into the 30s watchdog. Skip the inline flatten: the
            // IC stays uncached this round and the access keeps taking the
            // slow path — a perf forgone, never a correctness change.
            return RetryCacheLater;
        }
        // Flattening could have changed the offset, so return early for another try.
        asObject(cell)->flattenDictionaryObject(vm);
        return RetryCacheLater;
    }
    
    if (!structure->propertyAccessesAreCacheable())
        return GiveUpOnCache;

    return AttemptToCache;
}

static bool NODELETE forceICFailure(JSGlobalObject*)
{
    return Options::forceICFailure();
}

ALWAYS_INLINE static void fireWatchpointsAndClearStubIfNeeded(VM& vm, PropertyInlineCache& propertyCache, CodeBlock* codeBlock, AccessGenerationResult& result)
{
    if (result.shouldResetStubAndFireWatchpoints()) {
        result.fireWatchpoints(vm);

        {
            GCSafeConcurrentJSLocker locker(codeBlock->m_lock, vm);
            propertyCache.reset(locker, vm, codeBlock);
        }
    }
}

CacheableIdentifier nonStringPrimitiveKeyForSubscript(VM& vm, JSValue subscript)
{
    if (subscript.isUndefined())
        return CacheableIdentifier::createFromImmortalIdentifier(vm.propertyNames->undefinedKeyword.impl());
    if (subscript.isNull())
        return CacheableIdentifier::createFromImmortalIdentifier(vm.propertyNames->nullKeyword.impl());
    if (subscript.isTrue())
        return CacheableIdentifier::createFromImmortalIdentifier(vm.propertyNames->trueKeyword.impl());
    if (subscript.isFalse())
        return CacheableIdentifier::createFromImmortalIdentifier(vm.propertyNames->falseKeyword.impl());
    return { };
}

struct NonStringPrimitiveKeyInfo {
    SUPPRESS_UNCOUNTED_MEMBER UniquedStringImpl* uid;
    AccessCase::AccessType loadType;
    AccessCase::AccessType missType;
    AccessCase::AccessType replaceType;
    AccessCase::AccessType transitionType;
};

static std::optional<NonStringPrimitiveKeyInfo> nonStringPrimitiveKeyInfoForUID(VM& vm, UniquedStringImpl* uid)
{
    if (uid == vm.propertyNames->undefinedKeyword.impl()) {
        return NonStringPrimitiveKeyInfo {
            uid, AccessCase::IndexedUndefinedKeyLoad, AccessCase::IndexedUndefinedKeyMiss,
            AccessCase::IndexedUndefinedKeyReplace, AccessCase::IndexedUndefinedKeyTransition
        };
    }
    if (uid == vm.propertyNames->nullKeyword.impl()) {
        return NonStringPrimitiveKeyInfo {
            uid, AccessCase::IndexedNullKeyLoad, AccessCase::IndexedNullKeyMiss,
            AccessCase::IndexedNullKeyReplace, AccessCase::IndexedNullKeyTransition
        };
    }
    if (uid == vm.propertyNames->trueKeyword.impl()) {
        return NonStringPrimitiveKeyInfo {
            uid, AccessCase::IndexedTrueKeyLoad, AccessCase::IndexedTrueKeyMiss,
            AccessCase::IndexedTrueKeyReplace, AccessCase::IndexedTrueKeyTransition
        };
    }
    if (uid == vm.propertyNames->falseKeyword.impl()) {
        return NonStringPrimitiveKeyInfo {
            uid, AccessCase::IndexedFalseKeyLoad, AccessCase::IndexedFalseKeyMiss,
            AccessCase::IndexedFalseKeyReplace, AccessCase::IndexedFalseKeyTransition
        };
    }
    return std::nullopt;
}

inline CodePtr<CFunctionPtrTag> NODELETE appropriateGetByOptimizeFunction(GetByKind kind)
{
    switch (kind) {
    case GetByKind::ById:
        return operationGetByIdOptimize;
    case GetByKind::ByIdWithThis:
        return operationGetByIdWithThisOptimize;
    case GetByKind::TryById:
        return operationTryGetByIdOptimize;
    case GetByKind::ByIdDirect:
        return operationGetByIdDirectOptimize;
    case GetByKind::ByVal:
        return operationGetByValOptimize;
    case GetByKind::ByValWithThis:
        return operationGetByValWithThisOptimize;
    case GetByKind::PrivateName:
        return operationGetPrivateNameOptimize;
    case GetByKind::PrivateNameById:
        return operationGetPrivateNameByIdOptimize;
    }
    RELEASE_ASSERT_NOT_REACHED();
}

inline CodePtr<CFunctionPtrTag> NODELETE appropriateGetByGaveUpFunction(GetByKind kind)
{
    switch (kind) {
    case GetByKind::ById:
        return operationGetByIdGaveUp;
    case GetByKind::ByIdWithThis:
        return operationGetByIdWithThisGaveUp;
    case GetByKind::TryById:
        return operationTryGetByIdGaveUp;
    case GetByKind::ByIdDirect:
        return operationGetByIdDirectGaveUp;
    case GetByKind::ByVal:
        return operationGetByValGaveUp;
    case GetByKind::ByValWithThis:
        return operationGetByValWithThisGaveUp;
    case GetByKind::PrivateName:
        return operationGetPrivateNameGaveUp;
    case GetByKind::PrivateNameById:
        return operationGetPrivateNameByIdGaveUp;
    }
    RELEASE_ASSERT_NOT_REACHED();
}

static InlineCacheAction tryCacheGetBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, CacheableIdentifier propertyName, const PropertySlot& slot, PropertyInlineCache& propertyCache, GetByKind kind, bool isNonStringPrimitiveKey)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, globalObject->vm());

        if (forceICFailure(globalObject))
            return GiveUpOnCache;
        
        // FIXME: Cache property access for immediates.
        if (!baseValue.isCell())
            return GiveUpOnCache;
        JSCell* baseCell = baseValue.asCell();
        const bool isPrivate = kind == GetByKind::PrivateName || kind == GetByKind::PrivateNameById;

        RefPtr<AccessCase> newCase;

        if (propertyName == vm.propertyNames->length) {
            auto lengthPropertyName = CacheableIdentifier::createFromImmortalIdentifier(vm.propertyNames->length.impl());
            if (isJSArray(baseCell)) {
                if (propertyCache.cacheType() == CacheType::Unset
                    && slot.slotBase() == baseCell
                    && InlineAccess::isCacheableArrayLength(propertyCache, uncheckedDowncast<JSArray>(baseCell))) {
                    bool generatedCodeInline = InlineAccess::generateArrayLength(propertyCache, uncheckedDowncast<JSArray>(baseCell));
                    if (generatedCodeInline) {
                        repatchSlowPathCall(codeBlock, propertyCache, appropriateGetByOptimizeFunction(kind));
                        propertyCache.initArrayLength(locker);
                        return RetryCacheLater;
                    }
                }

                newCase = AccessCase::create(vm, codeBlock, AccessCase::ArrayLength, lengthPropertyName);
            } else if (isJSString(baseCell)) {
                if (propertyCache.cacheType() == CacheType::Unset
                    && InlineAccess::isCacheableStringLength(propertyCache)) {
                    bool generatedCodeInline = InlineAccess::generateStringLength(propertyCache);
                    if (generatedCodeInline) {
                        repatchSlowPathCall(codeBlock, propertyCache, appropriateGetByOptimizeFunction(kind));
                        propertyCache.initStringLength(locker);
                        return RetryCacheLater;
                    }
                }

                newCase = AccessCase::create(vm, codeBlock, AccessCase::StringLength, lengthPropertyName);
            } else if (DirectArguments* arguments = dynamicDowncast<DirectArguments>(baseCell)) {
                // If there were overrides, then we can handle this as a normal property load! Guarding
                // this with such a check enables us to add an IC case for that load if needed.
                if (!arguments->overrodeThings())
                    newCase = AccessCase::create(vm, codeBlock, AccessCase::DirectArgumentsLength, lengthPropertyName);
            } else if (ScopedArguments* arguments = dynamicDowncast<ScopedArguments>(baseCell)) {
                // Ditto.
                if (!arguments->overrodeThings())
                    newCase = AccessCase::create(vm, codeBlock, AccessCase::ScopedArgumentsLength, lengthPropertyName);
            }
        }

        if (!newCase && propertyName == vm.propertyNames->lastIndex) {
            if (is<RegExpObject>(baseCell))
                newCase = AccessCase::create(vm, codeBlock, AccessCase::RegExpLastIndexLoad, CacheableIdentifier::createFromImmortalIdentifier(vm.propertyNames->lastIndex.impl()));
        }

        if (!propertyName.isSymbol() && baseCell->inherits<JSModuleNamespaceObject>() && !slot.isUnset()) {
            if (auto moduleNamespaceSlot = slot.moduleNamespaceSlot())
                newCase = ModuleNamespaceAccessCase::create(vm, codeBlock, propertyName, uncheckedDowncast<JSModuleNamespaceObject>(baseCell), moduleNamespaceSlot->environment, ScopeOffset(moduleNamespaceSlot->scopeOffset));
        }

        if (!propertyName.isPrivateName() && baseCell->inherits<ProxyObject>()) {
            switch (kind) {
            case GetByKind::ById:
            case GetByKind::ByIdWithThis: {
                propertyName.ensureIsCell(vm);
                newCase = AccessCase::create(vm, codeBlock, AccessCase::ProxyObjectLoad, propertyName);
                break;
            }
            case GetByKind::ByVal:
            case GetByKind::ByValWithThis: {
                newCase = AccessCase::create(vm, codeBlock, AccessCase::IndexedProxyObjectLoad, nullptr);
                break;
            }
            case GetByKind::PrivateName:
            case GetByKind::PrivateNameById:
                RELEASE_ASSERT_NOT_REACHED();
            default:
                break;
            }
        }

        if (!newCase) {
            if (!slot.isCacheable() && !slot.isUnset())
                return GiveUpOnCache;

            ObjectPropertyConditionSet conditionSet;
            Structure* structure = baseCell->structure();

            bool loadTargetFromProxy = false;
            if (baseCell->type() == GlobalProxyType) {
                if (isPrivate)
                    return GiveUpOnCache;
                baseValue = uncheckedDowncast<JSGlobalProxy>(baseCell)->target();
                baseCell = baseValue.asCell();
                structure = baseCell->structure();
                loadTargetFromProxy = true;
            }

            InlineCacheAction action = actionForCell(vm, baseCell);
            if (action != AttemptToCache)
                return action;

            if (vm.gilOff() && !slot.isUnset() && (slot.isCacheableValue() || slot.isCacheableGetter())) [[unlikely]] {
                // OM-1 (gilOff() mode-split) — GetBy analog of the
                // tryCachePutBy Replace/Setter revalidation: the slow-path
                // operation filled `slot` {slotBase, cachedOffset} DURING
                // getOwnPropertySlot, but the guarding structure is read NOW.
                // GIL-off, another mutator can transition base or the holder
                // between those points (delete / dictionary flatten shift
                // named offsets), so publishing (structure-now, offset-then)
                // keys an IC that loads a sibling slot on every future hit
                // (named-property corruption), or treats a data slot as a
                // GetterSetter and calls through a non-callable cell. Bind
                // the offset to the structure the IC will actually be keyed
                // on: for self access that is `structure` itself (its
                // uid->offset table is immutable for non-dictionaries, so
                // this hard-closes the tear including A->B->A); for proto
                // hits it is the holder's current structure, which is also
                // what generateConditionsForPrototypePropertyHit asserts
                // against. getConcurrently is the structure-lock walk; the
                // codeBlock-lock -> structure-lock order here is the existing
                // concurrent-JIT order (same as the landed PutBy OM-1 guard).
                // Require the entry's kind to match the slot's. Cacheable
                // dictionaries mutate their table in place under the same
                // structureID, invisible to the IC guard; refuse those.
                JSObject* slotBaseObject = slot.slotBase();
                if (!slotBaseObject)
                    return RetryCacheLater;
                Structure* validationStructure = slot.slotBase() == baseValue ? structure : slotBaseObject->structure();
                // T4-ic-never-settles-giloff (alloctax2 #4, restore caching):
                // previously refused ALL dictionaries here, which under GIL-off
                // (where O2/GT11 forbids flattening from IC paths) made
                // global-object / cacheable-dictionary self loads return
                // RetryCacheLater forever — the Optimize operation never
                // settles and every execution pays the full tryCache walk.
                // CACHEABLE dictionaries are safe to revalidate and key on:
                // getConcurrently() is the structure-lock walk, the
                // uid->offset binding for an existing slot is stable (adds
                // append, replace keeps the offset, delete transitions to an
                // UNCACHEABLE dictionary i.e. a different StructureID so the
                // IC guard fails), and startWatchingPropertyForReplacements
                // covers in-place value churn. Only UNCACHEABLE dictionaries
                // mutate their table in a way the IC guard cannot observe.
                if (validationStructure->isUncacheableDictionary())
                    return RetryCacheLater;
                unsigned attributes;
                PropertyOffset tableOffset = validationStructure->getConcurrently(propertyName.uid(), attributes);
                if (tableOffset != slot.cachedOffset())
                    return RetryCacheLater;
                if (slot.isCacheableGetter() != !!(attributes & PropertyAttribute::Accessor))
                    return RetryCacheLater;
                if (attributes & PropertyAttribute::CustomAccessorOrValue)
                    return RetryCacheLater;
            }

            // Optimize self access.
            if (propertyCache.cacheType() == CacheType::Unset
                && slot.isCacheableValue()
                && slot.slotBase() == baseValue
                && !slot.watchpointSet()
                && !structure->needImpurePropertyWatchpoint()
                && !loadTargetFromProxy) {
                bool generatedCodeInline = InlineAccess::generateSelfPropertyAccess(propertyCache, structure, slot.cachedOffset());
                if (generatedCodeInline) {
                    LOG_IC((ICEvent::GetBySelfPatch, structure->classInfoForCells(), slot.slotBase() == baseValue));
                    structure->startWatchingPropertyForReplacements(vm, slot.cachedOffset());
                    repatchSlowPathCall(codeBlock, propertyCache, appropriateGetByOptimizeFunction(kind));
                    propertyCache.initGetByIdSelf(locker, codeBlock, structure, slot.cachedOffset());
                    return RetryCacheLater;
                }
            }

            RefPtr<PolyProtoAccessChain> prototypeAccessChain;

            PropertyOffset offset = slot.isUnset() ? invalidOffset : slot.cachedOffset();

            if (slot.isCustom() && slot.slotBase() == baseValue) {
                // To cache self customs, we must disallow dictionaries because we
                // need to be informed if the custom goes away since we cache the
                // constant function pointer.

                if (!prepareChainForCaching(globalObject, slot.slotBase(), propertyName.uid(), slot.slotBase()))
                    return GiveUpOnCache;
            }

            if (slot.isUnset() || slot.slotBase() != baseValue) {
                if (structure->typeInfo().prohibitsPropertyCaching())
                    return GiveUpOnCache;

                if (structure->isDictionary()) {
                    if (structure->hasBeenFlattenedBefore())
                        return GiveUpOnCache;
                    if (vm.gilOff()) [[unlikely]] {
                        // O2/GT11 (AB17e: sibling site of the actionForCell
                        // gate): we hold codeBlock->m_lock (rank 6b) with
                        // heap access, and flag-on flattenDictionaryStructure
                        // ALWAYS routes through the §10.6 per-event stop —
                        // requesting a stop here wedges the conductor's
                        // quiescence predicate into the 30s watchdog. Rule:
                        // gilOff, NEVER flatten from any IC-caching path;
                        // flattening happens only from unlocked runtime
                        // sites. Perf forgone, never a correctness change.
                        return RetryCacheLater;
                    }
                    structure->flattenDictionaryStructure(vm, uncheckedDowncast<JSObject>(baseCell));
                    return RetryCacheLater; // We may have changed property offsets.
                }

                if (slot.isUnset() && structure->typeInfo().getOwnPropertySlotIsImpureForPropertyAbsence())
                    return GiveUpOnCache;

                // If a kind is GetByKind::ByIdDirect or GetByKind::PrivateName, we do not need to investigate prototype chains further.
                // Cacheability just depends on the head structure.
                if (kind != GetByKind::ByIdDirect && !isPrivate) {
                    auto cacheStatus = prepareChainForCaching(globalObject, baseCell, propertyName.uid(), slot);
                    if (!cacheStatus)
                        return GiveUpOnCache;

                    if (cacheStatus->flattenedDictionary) {
                        // Property offsets may have changed due to flattening. We'll cache later.
                        return RetryCacheLater;
                    }

                    if (cacheStatus->usesPolyProto) {
                        prototypeAccessChain = PolyProtoAccessChain::tryCreate(globalObject, baseCell, propertyName, slot);
                        if (!prototypeAccessChain)
                            return GiveUpOnCache;
                        ASSERT(slot.isCacheableCustom() || prototypeAccessChain->slotBaseStructure(vm, structure)->get(vm, propertyName.uid()) == offset);
                    } else {
                        // We use ObjectPropertyConditionSet instead for faster accesses.
                        prototypeAccessChain = nullptr;

                        // FIXME: Maybe this `if` should be inside generateConditionsForPropertyBlah.
                        // https://bugs.webkit.org/show_bug.cgi?id=185215
                        if (slot.isUnset()) {
                            conditionSet = generateConditionsForPropertyMiss(
                                vm, codeBlock, globalObject, structure, propertyName.uid());
                        } else if (!slot.isCacheableCustom()) {
                            conditionSet = generateConditionsForPrototypePropertyHit(
                                vm, codeBlock, globalObject, structure, slot.slotBase(),
                                propertyName.uid());
                            if (vm.gilOff()) [[unlikely]] {
                                // OM-1: generateConditionsForPrototypePropertyHit
                                // re-walks the holder AFTER the revalidation guard
                                // above, so GIL-off a racing transition can leave
                                // the freshly generated condition's offset
                                // disagreeing with the slot's. That is a benign
                                // publish-time race, not a corrupted invariant —
                                // refuse the cache attempt instead of crashing.
                                if (conditionSet.isValid() && conditionSet.slotBaseCondition().offset() != offset)
                                    return RetryCacheLater;
                            } else
                                RELEASE_ASSERT(!conditionSet.isValid() || conditionSet.slotBaseCondition().offset() == offset);
                        } else {
                            conditionSet = generateConditionsForPrototypePropertyHitCustom(
                                vm, codeBlock, globalObject, structure, slot.slotBase(),
                                propertyName.uid(), slot.attributes());
                        }

                        if (!conditionSet.isValid())
                            return GiveUpOnCache;
                    }
                }
            }

            JSFunction* getter = nullptr;
            if (slot.isCacheableGetter())
                getter = dynamicDowncast<JSFunction>(slot.getterSetter()->getter());

            std::optional<DOMAttributeAnnotation> domAttribute;
            if (slot.isCacheableCustom() && slot.domAttribute())
                domAttribute = slot.domAttribute();

            if (kind == GetByKind::TryById) {
                AccessCase::AccessType type;
                if (slot.isCacheableValue())
                    type = AccessCase::Load;
                else if (slot.isUnset())
                    type = AccessCase::Miss;
                else if (slot.isCacheableGetter())
                    type = AccessCase::GetGetter;
                else
                    RELEASE_ASSERT_NOT_REACHED();

                newCase = ProxyableAccessCase::create(vm, codeBlock, type, propertyName, offset, structure, conditionSet, loadTargetFromProxy, slot.watchpointSet(), WTF::move(prototypeAccessChain));
            } else if (!loadTargetFromProxy && getter && InlineCacheCompiler::canEmitIntrinsicGetter(propertyCache, getter, structure))
                newCase = IntrinsicGetterAccessCase::create(vm, codeBlock, propertyName, slot.cachedOffset(), structure, conditionSet, getter, WTF::move(prototypeAccessChain));
            else {
                if (isPrivate) {
                    RELEASE_ASSERT(!slot.isUnset());
                    RELEASE_ASSERT(conditionSet.isEmpty());
                    constexpr bool isGlobalProxy = false;
                    if (!slot.isCacheable())
                        return GiveUpOnCache;
                    newCase = ProxyableAccessCase::create(vm, codeBlock, AccessCase::Load, propertyName, offset, structure,
                        conditionSet, isGlobalProxy, slot.watchpointSet(), WTF::move(prototypeAccessChain));
                } else if (slot.isCacheableValue() || slot.isUnset()) {
                    newCase = ProxyableAccessCase::create(vm, codeBlock, slot.isUnset() ? AccessCase::Miss : AccessCase::Load,
                        propertyName, offset, structure, conditionSet, loadTargetFromProxy, slot.watchpointSet(), WTF::move(prototypeAccessChain));
                } else {
                    AccessCase::AccessType type;
                    if (slot.isCacheableGetter())
                        type = AccessCase::Getter;
                    else if (slot.attributes() & PropertyAttribute::CustomAccessor)
                        type = AccessCase::CustomAccessorGetter;
                    else
                        type = AccessCase::CustomValueGetter;

                    if ((kind == GetByKind::ByIdWithThis || kind == GetByKind::ByValWithThis) && type == AccessCase::CustomAccessorGetter && domAttribute)
                        return GiveUpOnCache;

                    CodePtr<CustomAccessorPtrTag> customAccessor;
                    if (slot.isCacheableCustom())
                        customAccessor = slot.customGetter();
                    newCase = GetterSetterAccessCase::create(
                        vm, codeBlock, type, propertyName, offset, structure, conditionSet, loadTargetFromProxy,
                        slot.watchpointSet(), customAccessor,
                        slot.isCacheableCustom() && slot.slotBase() != baseValue ? slot.slotBase() : nullptr,
                        domAttribute, WTF::move(prototypeAccessChain));
                }
            }
        }

        LOG_IC((ICEvent::GetByAddAccessCase, baseValue.classInfoOrNull(), slot.slotBase() == baseValue));

        if (isNonStringPrimitiveKey) {
            if (!newCase)
                return GiveUpOnCache;
            auto keyInfo = nonStringPrimitiveKeyInfoForUID(vm, propertyName.uid());
            ASSERT(keyInfo);
            switch (newCase->type()) {
            case AccessCase::Load:
                newCase->convertToNonStringPrimitiveKeyAccessType(keyInfo->loadType);
                break;
            case AccessCase::Miss:
                newCase->convertToNonStringPrimitiveKeyAccessType(keyInfo->missType);
                break;
            default:
                return GiveUpOnCache;
            }
        }

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), isNonStringPrimitiveKey ? nullptr : propertyName, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::GetByReplaceWithJump, baseValue.classInfoOrNull(), slot.slotBase() == baseValue));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);

    if (result.generatedMegamorphicCode())
        return PromoteToMegamorphic;
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchGetBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, CacheableIdentifier propertyName, const PropertySlot& slot, PropertyInlineCache& propertyCache, GetByKind kind, bool isNonStringPrimitiveKey)
{
    SuperSamplerScope superSamplerScope(false);

    switch (tryCacheGetBy(globalObject, codeBlock, baseValue, propertyName, slot, propertyCache, kind, isNonStringPrimitiveKey)) {
    case PromoteToMegamorphic: {
        switch (kind) {
        case GetByKind::ById:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByIdMegamorphic);
            break;
        case GetByKind::ByIdWithThis:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByIdWithThisMegamorphic);
            break;
        case GetByKind::ByVal:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByValMegamorphic);
            break;
        case GetByKind::ByValWithThis:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByValWithThisMegamorphic);
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
    }
    case GiveUpOnCache:
        repatchSlowPathCallLocking(codeBlock, propertyCache, appropriateGetByGaveUpFunction(kind));
        break;
    case RetryCacheLater:
        // T4-ic-never-settles-giloff (alloctax2 #4, escalation): GIL-off, the
        // O2/GT11 "never flatten from an IC path" rule plus the OM-1
        // uncacheable-dictionary refusal above make several RetryCacheLater
        // returns permanent — the condition never clears, so this site stays
        // wired to operationGetBy*Optimize forever and every call pays
        // considerRepatchingCacheImpl + tryCacheGetBy for nothing (the +1.43G
        // / 15.5% residual on the pc-loop bench). Count consecutive retries
        // that left the IC still at Unset; once a small threshold is crossed,
        // repatch to the GaveUp operation — the same cheap settled state
        // GIL-on reaches after a single flatten. gilOff-gated so flag-off
        // codegen and IC behavior are byte-identical (the counter is never
        // touched and shouldGiveUpPermanently() is never consulted flag-off).
        if (globalObject->vm().gilOff()) [[unlikely]] {
            propertyCache.noteRetryWithoutProgress();
            if (propertyCache.shouldGiveUpPermanently()) {
                ConcurrentJSLocker locker(codeBlock->m_lock);
                // Re-check under the lock (m_cacheType is lock-guarded): never
                // demote an IC that has since installed a case.
                if (propertyCache.cacheType() == CacheType::Unset)
                    repatchSlowPathCall(codeBlock, propertyCache, appropriateGetByGaveUpFunction(kind));
            }
        }
        break;
    case AttemptToCache:
        break;
    }
}

// Mainly used to transition from megamorphic case to generic case.
void repatchGetBySlowPathCall(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache, GetByKind kind)
{
    // TSAN ic-stubinfo (SPEC-jit §5.1/D3): IC-state writers hold the owner
    // CodeBlock's m_lock; this megamorphic->generic demotion is reached from
    // JIT slow paths with no lock held.
    ConcurrentJSLocker locker(codeBlock->m_lock);
    resetGetBy(vm, codeBlock, propertyCache, kind);
    repatchSlowPathCall(codeBlock, propertyCache, appropriateGetByGaveUpFunction(kind));
}

static InlineCacheAction tryCacheArrayGetByVal(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, JSValue index, PropertyInlineCache& propertyCache)
{
    if (!baseValue.isCell() || forceICFailure(globalObject))
        return GiveUpOnCache;

    if (!index.isInt32())
        return RetryCacheLater;

    VM& vm = globalObject->vm();
    AccessGenerationResult result;

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, globalObject->vm());

        JSCell* base = baseValue.asCell();

        RefPtr<AccessCase> newCase;
        AccessCase::AccessType accessType = AccessCase::IndexedInt32Load;
        if (base->type() == DirectArgumentsType)
            accessType = AccessCase::IndexedDirectArgumentsLoad;
        else if (base->type() == ScopedArgumentsType)
            accessType = AccessCase::IndexedScopedArgumentsLoad;
        else if (base->type() == StringType)
            accessType = AccessCase::IndexedStringLoad;
        else if (base->type() == ProxyObjectType)
            accessType = AccessCase::IndexedProxyObjectLoad;
        else if (isTypedView(base->type())) {
            auto* typedArray = uncheckedDowncast<JSArrayBufferView>(base);
#if USE(JSVALUE32_64)
            if (typedArray->isResizableOrGrowableShared())
                return GiveUpOnCache;
#endif
            switch (typedArray->type()) {
            case Int8ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt8Load : AccessCase::IndexedTypedArrayInt8Load;
                break;
            case Uint8ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint8Load : AccessCase::IndexedTypedArrayUint8Load;
                break;
            case Uint8ClampedArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint8ClampedLoad : AccessCase::IndexedTypedArrayUint8ClampedLoad;
                break;
            case Int16ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt16Load : AccessCase::IndexedTypedArrayInt16Load;
                break;
            case Uint16ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint16Load : AccessCase::IndexedTypedArrayUint16Load;
                break;
            case Int32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt32Load : AccessCase::IndexedTypedArrayInt32Load;
                break;
            case Uint32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint32Load : AccessCase::IndexedTypedArrayUint32Load;
                break;
            case Float16ArrayType:
                if (!CCallHelpers::supportsFloat16())
                    return GiveUpOnCache;
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat16Load : AccessCase::IndexedTypedArrayFloat16Load;
                break;
            case Float32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat32Load : AccessCase::IndexedTypedArrayFloat32Load;
                break;
            case Float64ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat64Load : AccessCase::IndexedTypedArrayFloat64Load;
                break;
            // FIXME: Optimize BigInt64Array / BigUint64Array in IC
            // https://bugs.webkit.org/show_bug.cgi?id=221183
            case BigInt64ArrayType:
            case BigUint64ArrayType:
                return GiveUpOnCache;
            default:
                RELEASE_ASSERT_NOT_REACHED();
            }
        } else {
            IndexingType indexingShape = base->indexingType() & IndexingShapeMask;
            switch (indexingShape) {
            case Int32Shape:
                accessType = AccessCase::IndexedInt32Load;
                break;
            case DoubleShape:
                ASSERT(Options::allowDoubleShape());
                accessType = AccessCase::IndexedDoubleLoad;
                break;
            case ContiguousShape:
                accessType = AccessCase::IndexedContiguousLoad;
                break;
            case ArrayStorageShape:
                accessType = AccessCase::IndexedArrayStorageLoad;
                break;
            case NoIndexingShape: {
                if (!base->isObject())
                    return GiveUpOnCache;

                if (base->structure()->mayInterceptIndexedAccesses() || base->structure()->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
                    return GiveUpOnCache;

                // FIXME: prepareChainForCaching is conservative. We should have another function which only cares about information related to this IC.
                auto cacheStatus = prepareChainForCaching(globalObject, base, nullptr, nullptr);
                if (!cacheStatus)
                    return GiveUpOnCache;

                if (cacheStatus->usesPolyProto)
                    return GiveUpOnCache;

                Structure* headStructure = base->structure();
                ObjectPropertyConditionSet conditionSet = generateConditionsForIndexedMiss(vm, codeBlock, globalObject, headStructure);
                if (!conditionSet.isValid())
                    return GiveUpOnCache;

                newCase = AccessCase::create(vm, codeBlock, AccessCase::IndexedNoIndexingMiss, nullptr, invalidOffset, headStructure, conditionSet);
                break;
            }
            default:
                return GiveUpOnCache;
            }
        }

        if (!newCase)
            newCase = AccessCase::create(vm, codeBlock, accessType, nullptr);

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), nullptr, newCase.releaseNonNull());

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::GetByReplaceWithJump, baseValue.classInfoOrNull()));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    if (result.generatedMegamorphicCode())
        return PromoteToMegamorphic;
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchArrayGetByVal(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue base, JSValue index, PropertyInlineCache& propertyCache, GetByKind kind)
{
    switch (tryCacheArrayGetByVal(globalObject, codeBlock, base, index, propertyCache)) {
    case PromoteToMegamorphic: {
        switch (kind) {
        case GetByKind::ById:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByIdMegamorphic);
            break;
        case GetByKind::ByIdWithThis:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByIdWithThisMegamorphic);
            break;
        case GetByKind::ByVal:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByValMegamorphic);
            break;
        case GetByKind::ByValWithThis:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationGetByValWithThisMegamorphic);
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
    }
    case GiveUpOnCache:
        repatchSlowPathCallLocking(codeBlock, propertyCache, appropriateGetByGaveUpFunction(kind));
        break;
    case RetryCacheLater:
    case AttemptToCache:
        break;
    }
}

static CodePtr<CFunctionPtrTag> NODELETE appropriatePutByGaveUpFunction(PutByKind putByKind)
{
    switch (putByKind) {
    case PutByKind::ByIdStrict:
        return operationPutByIdStrictGaveUp;
    case PutByKind::ByIdSloppy:
        return operationPutByIdSloppyGaveUp;
    case PutByKind::ByIdDirectStrict:
        return operationPutByIdDirectStrictGaveUp;
    case PutByKind::ByIdDirectSloppy:
        return operationPutByIdDirectSloppyGaveUp;
    case PutByKind::DefinePrivateNameById:
        return operationPutByIdDefinePrivateFieldStrictGaveUp;
    case PutByKind::SetPrivateNameById:
        return operationPutByIdSetPrivateFieldStrictGaveUp;
    case PutByKind::ByValStrict:
        return operationPutByValStrictGaveUp;
    case PutByKind::ByValSloppy:
        return operationPutByValSloppyGaveUp;
    case PutByKind::ByValDirectStrict:
        return operationDirectPutByValStrictGaveUp;
    case PutByKind::ByValDirectSloppy:
        return operationDirectPutByValSloppyGaveUp;
    case PutByKind::DefinePrivateNameByVal:
        return operationPutByValDefinePrivateFieldGaveUp;
    case PutByKind::SetPrivateNameByVal:
        return operationPutByValSetPrivateFieldGaveUp;
    }
    // Make win port compiler happy
    RELEASE_ASSERT_NOT_REACHED();
    return nullptr;
}

// Mainly used to transition from megamorphic case to generic case.
void repatchPutBySlowPathCall(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache, PutByKind kind)
{
    // TSAN ic-stubinfo (SPEC-jit §5.1/D3): see repatchGetBySlowPathCall.
    ConcurrentJSLocker locker(codeBlock->m_lock);
    resetPutBy(vm, codeBlock, propertyCache, kind);
    repatchSlowPathCall(codeBlock, propertyCache, appropriatePutByGaveUpFunction(kind));
}

static CodePtr<CFunctionPtrTag> NODELETE appropriatePutByOptimizeFunction(PutByKind putByKind)
{
    switch (putByKind) {
    case PutByKind::ByIdStrict:
        return operationPutByIdStrictOptimize;
    case PutByKind::ByIdSloppy:
        return operationPutByIdSloppyOptimize;
    case PutByKind::ByIdDirectStrict:
        return operationPutByIdDirectStrictOptimize;
    case PutByKind::ByIdDirectSloppy:
        return operationPutByIdDirectSloppyOptimize;
    case PutByKind::DefinePrivateNameById:
        return operationPutByIdDefinePrivateFieldStrictOptimize;
    case PutByKind::SetPrivateNameById:
        return operationPutByIdSetPrivateFieldStrictOptimize;
    case PutByKind::ByValStrict:
        return operationPutByValStrictOptimize;
    case PutByKind::ByValSloppy:
        return operationPutByValSloppyOptimize;
    case PutByKind::ByValDirectStrict:
        return operationDirectPutByValStrictOptimize;
    case PutByKind::ByValDirectSloppy:
        return operationDirectPutByValSloppyOptimize;
    case PutByKind::DefinePrivateNameByVal:
        return operationPutByValDefinePrivateFieldOptimize;
    case PutByKind::SetPrivateNameByVal:
        return operationPutByValSetPrivateFieldOptimize;
    }
    // Make win port compiler happy
    RELEASE_ASSERT_NOT_REACHED();
    return nullptr;
}

static InlineCacheAction tryCachePutBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, Structure* oldStructure, CacheableIdentifier propertyName, const PutPropertySlot& slot, PropertyInlineCache& propertyCache, PutByKind putByKind, bool isNonStringPrimitiveKey)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;
    Identifier ident = Identifier::fromUid(vm, propertyName.uid());

    if (Options::useJSThreads()) [[unlikely]] {
        // SPEC-jit App. 5.6(c) / Task-11 bucket (iii): the (oldStructure, offset)
        // replacement-set fire in the ExistingProperty branch below is a direct
        // Class-A fireAll and must NOT run under CodeBlock::m_lock (section-7):
        // the requester parks inside the stop protocol (arbitration tryLock loop
        // or quiescence-predicate wait) while sibling mutators blind-wait on
        // m_lock in tryCacheGetBy/tryCachePutBy with heap access held, so the
        // conductor's predicate can never be satisfied (30s STW-watchdog abort;
        // bughunt H1-lockheld-classA-fire-repatch-1360). Fire HERE, before the
        // locker, exactly like the LLInt (LLIntSlowPaths.cpp:1384/1398/1705),
        // scope (CommonSlowPathsInlines.h:105) and megamorphic
        // (JITOperations.cpp:1277/2135) put caches: the fire COMPLETES (world-
        // stopped jettison of every consumer that constant-folded this
        // property) strictly before any Replace IC is published under the
        // lock, so the M6.1 fireAllSlow ORDERING CAVEAT ("fact published
        // before fire") never applies to this site. Firing for an attempt
        // that later refuses to cache (forceICFailure, length/lastIndex
        // special cases, CoW indexing) is sound: the set is invalidate-only
        // and one-shot per (structure, offset).
        if (baseValue.isCell() && slot.isCacheablePut() && slot.type() == PutPropertySlot::ExistingProperty && isValidOffset(slot.cachedOffset())) {
            JSCell* replaceBase = baseValue.asCell();
            if (replaceBase->type() == GlobalProxyType)
                replaceBase = uncheckedDowncast<JSGlobalProxy>(replaceBase)->target();
            if (slot.base() == replaceBase && oldStructure->propertyAccessesAreCacheable()) {
                bool offsetStillValid = true;
                if (vm.gilOff()) [[unlikely]] {
                    // Mirror of the OM-1 revalidation in the locked region
                    // below: never fire (or cache) a (structure, offset) pair
                    // the structure's own table does not vouch for, and
                    // refuse dictionaries (in-place table mutation under the
                    // same structureID).
                    if (oldStructure->isDictionary())
                        offsetStillValid = false;
                    else {
                        unsigned attributes;
                        PropertyOffset tableOffset = oldStructure->getConcurrently(propertyName.uid(), attributes);
                        offsetStillValid = tableOffset == slot.cachedOffset() && !(attributes & (PropertyAttribute::Accessor | PropertyAttribute::CustomAccessorOrValue | PropertyAttribute::ReadOnly));
                    }
                }
                if (offsetStillValid)
                    oldStructure->didCachePropertyReplacement(vm, slot.cachedOffset());
            }
        }
    }
    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, globalObject->vm());

        if (forceICFailure(globalObject))
            return GiveUpOnCache;
        
        if (!baseValue.isCell())
            return GiveUpOnCache;

        JSCell* baseCell = baseValue.asCell();

        RefPtr<AccessCase> newCase;

        if (propertyName == vm.propertyNames->length) {
            if (baseCell->type() == ArrayType)
                newCase = AccessCase::create(vm, codeBlock, AccessCase::ArrayLengthStore, propertyName);
        } else if (propertyName == vm.propertyNames->lastIndex) {
            if (is<RegExpObject>(baseCell))
                newCase = AccessCase::create(vm, codeBlock, AccessCase::RegExpLastIndexStore, propertyName);
        }

        bool isProxyObject = baseCell->type() == ProxyObjectType;
        if (!newCase && !isProxyObject) {
            if (!slot.isCacheablePut() && !slot.isCacheableCustom() && !slot.isCacheableSetter())
                return GiveUpOnCache;

            // FIXME: We should try to do something smarter here...
            if (isCopyOnWrite(oldStructure->indexingMode()))
                return GiveUpOnCache;
            // We can't end up storing to a CoW on the prototype since it shouldn't own properties.
            ASSERT(!isCopyOnWrite(slot.base()->indexingMode()));

            if (!oldStructure->propertyAccessesAreCacheable())
                return GiveUpOnCache;
        }
        
        bool isGlobalProxy = false;
        if (baseCell->type() == GlobalProxyType) {
            baseCell = uncheckedDowncast<JSGlobalProxy>(baseCell)->target();
            baseValue = baseCell;
            isGlobalProxy = true;

            // We currently only cache Replace and JS/Custom Setters on JSGlobalProxy. We don't
            // cache transitions because global objects will never share the same structure
            // in our current implementation.
            bool isCacheableProxy = (slot.isCacheablePut() && slot.type() == PutPropertySlot::ExistingProperty)
                || slot.isCacheableSetter()
                || slot.isCacheableCustom();
            if (!isCacheableProxy)
                return GiveUpOnCache;
        }

        if (isGlobalProxy) {
            switch (putByKind) {
            case PutByKind::DefinePrivateNameById:
            case PutByKind::DefinePrivateNameByVal:
            case PutByKind::SetPrivateNameById:
            case PutByKind::SetPrivateNameByVal:
                return GiveUpOnCache;
            case PutByKind::ByIdStrict:
            case PutByKind::ByIdSloppy:
            case PutByKind::ByValStrict:
            case PutByKind::ByValSloppy:
            case PutByKind::ByIdDirectStrict:
            case PutByKind::ByIdDirectSloppy:
            case PutByKind::ByValDirectStrict:
            case PutByKind::ByValDirectSloppy:
                break;
            }
        }

        if (vm.gilOff()) [[unlikely]] {
            // OM-1 (gilOff() mode-split): the slow-path operation snapshotted
            // oldStructure BEFORE running the put, and the PutPropertySlot was
            // filled in DURING the put. GIL-off, another mutator can transition
            // baseCell between those points and now, so (oldStructure,
            // slot.cachedOffset()) may describe two different shapes. Publishing
            // that torn pair keys an IC on oldStructure that stores/loads at a
            // foreign offset: oldStructure-shaped objects then take wrong-offset
            // hits (named-property corruption; non-object "setter" cells reaching
            // JSC::call). Revalidate here, under the codeBlock lock, and refuse
            // to cache anything structure-keyed when the cell no longer wears
            // oldStructure. The cacheable NewProperty transition legitimately
            // leaves the cell in newStructure; let it fall through to the
            // useJSThreads GiveUpOnCache below (SPEC-jit 5.5 Task 8) so hot
            // transition sites still get the gave-up repatch instead of
            // retrying forever.
            bool isCacheableTransition = slot.base() == baseValue && slot.isCacheablePut() && slot.type() == PutPropertySlot::NewProperty;
            if (!isCacheableTransition && !newCase && !isProxyObject && baseValue.asCell()->structure() != oldStructure)
                return RetryCacheLater;
        }

        if (!newCase && slot.base() == baseValue && slot.isCacheablePut()) {
            if (slot.type() == PutPropertySlot::ExistingProperty) {
                // This assert helps catch bugs if we accidentally forget to disable caching
                // when we transition then store to an existing property. This is common among
                // paths that reify lazy properties. If we reify a lazy property and forget
                // to disable caching, we may come down this path. The Replace IC does not
                // know how to model these types of structure transitions (or any structure
                // transition for that matter).
                if (vm.gilOff()) [[unlikely]] {
                    // OM-1: structure equality was re-checked above, but an
                    // A->B->A interleaving can still leave slot.cachedOffset()
                    // computed against an intermediate shape. Bind the offset to
                    // oldStructure's own table (getConcurrently: structure-lock
                    // walk; codeBlock-lock -> structure-lock is the existing
                    // concurrent-JIT order) before publishing a Replace case or
                    // firing the replacement watchpoint at that offset. The kind
                    // must match too: a same-offset entry that is an Accessor /
                    // Custom / ReadOnly property must not take a data-Replace IC
                    // (it would clobber a GetterSetter box or a read-only slot).
                    // Cacheable dictionaries mutate their table in place under
                    // the SAME structureID, which the IC's structure guard
                    // cannot see; refuse those outright.
                    if (oldStructure->isDictionary())
                        return RetryCacheLater;
                    unsigned attributes;
                    PropertyOffset tableOffset = oldStructure->getConcurrently(propertyName.uid(), attributes);
                    if (tableOffset != slot.cachedOffset() || (attributes & (PropertyAttribute::Accessor | PropertyAttribute::CustomAccessorOrValue | PropertyAttribute::ReadOnly)))
                        return RetryCacheLater;
                } else
                    RELEASE_ASSERT(baseValue.asCell()->structure() == oldStructure);

                if (!Options::useJSThreads()) [[likely]]
                    oldStructure->didCachePropertyReplacement(vm, slot.cachedOffset());
                else {
                    // App. 5.6(c): the Class-A fire for this (structure, offset)
                    // ran before the locker scope (pre-lock block above) — never
                    // fire under codeBlock->m_lock. If the set is not invalidated
                    // here, the pre-lock guard and this branch disagreed (the
                    // base/structure changed in the unlocked window); REFUSE to
                    // publish a Replace case against a still-watched set and let
                    // the next slow-path call retry — publishing would let IC
                    // stores mutate the property without a fire while constant-
                    // folding consumers are still live. (codeBlock-lock ->
                    // structure-lock is the established order, so the set query
                    // is legal here.)
                    WatchpointSet* replacementSet = oldStructure->propertyReplacementWatchpointSet(slot.cachedOffset());
                    if (!replacementSet || !replacementSet->hasBeenInvalidated())
                        return RetryCacheLater;
                }

                if (propertyCache.cacheType() == CacheType::Unset
                    && InlineAccess::canGenerateSelfPropertyReplace(propertyCache, slot.cachedOffset())
                    && !oldStructure->needImpurePropertyWatchpoint()
                    && !isGlobalProxy) {

                    bool generatedCodeInline = InlineAccess::generateSelfPropertyReplace(propertyCache, oldStructure, slot.cachedOffset());
                    if (generatedCodeInline) {
                        LOG_IC((ICEvent::PutBySelfPatch, oldStructure->classInfoForCells(), slot.base() == baseValue));
                        repatchSlowPathCall(codeBlock, propertyCache, appropriatePutByOptimizeFunction(putByKind));
                        propertyCache.initPutByIdReplace(locker, codeBlock, oldStructure, slot.cachedOffset());
                        return RetryCacheLater;
                    }
                }

                newCase = AccessCase::createReplace(vm, codeBlock, propertyName, slot.cachedOffset(), oldStructure, isGlobalProxy);
            } else {
                ASSERT(!isGlobalProxy);
                ASSERT(slot.type() == PutPropertySlot::NewProperty);

                // SPEC-jit section 5.5 (Task 8): generated transitions are
                // illegal under useJSThreads until the structures'
                // transitionThreadLocal/writeThreadLocal watchpoint sets land
                // (OM E4: compile-time TTL validity + runtime PA/TID tests).
                // Until then every transition takes the generic locked OM
                // path; see docs/threads/INTEGRATE-jit.md, Task 8.
                if (Options::useJSThreads()) [[unlikely]]
                    return GiveUpOnCache;

                if (!oldStructure->isObject())
                    return GiveUpOnCache;

                // Right now, we disable IC for put onto prototype for NewProperty case.
                if (oldStructure->mayBePrototype())
                    return GiveUpOnCache;

                // If the old structure is dictionary, it means that this is one-on-one between an object and a structure.
                // If this is NewProperty operation, generating IC for this does not offer any benefit because this transition never happens again.
                if (oldStructure->isDictionary())
                    return RetryCacheLater;

                PropertyOffset offset;
                Structure* newStructure = Structure::addPropertyTransitionToExistingStructureConcurrently(oldStructure, ident.impl(), static_cast<unsigned>(PropertyAttribute::None), offset);
                if (!newStructure || !newStructure->propertyAccessesAreCacheable())
                    return GiveUpOnCache;

                // If JSObject::put is overridden by UserObject, UserObject::put performs side-effect on JSObject::put, and it neglects to mark the PutPropertySlot as non-cachaeble,
                // then arbitrary structure transitions can happen during the put operation, and this generates wrong transition information here as if oldStructure -> newStructure.
                // In reality, the transition is oldStructure -> something unknown structures -> baseValue's structure.
                // To guard against the embedder's potentially incorrect UserObject::put implementation, we should check for this condition and if found, and give up on caching the put.
                ASSERT(baseValue.asCell()->structure() == newStructure);
                if (baseValue.asCell()->structure() != newStructure)
                    return GiveUpOnCache;

                ASSERT(newStructure->previousID() == oldStructure);
                ASSERT(!newStructure->isDictionary());
                ASSERT(newStructure->isObject());
                
                RefPtr<PolyProtoAccessChain> prototypeAccessChain;
                ObjectPropertyConditionSet conditionSet;
                switch (putByKind) {
                case PutByKind::ByIdStrict:
                case PutByKind::ByIdSloppy:
                case PutByKind::ByValStrict:
                case PutByKind::ByValSloppy: {
                    auto cacheStatus = prepareChainForCaching(globalObject, baseCell, propertyName.uid(), nullptr);
                    if (!cacheStatus)
                        return GiveUpOnCache;

                    if (cacheStatus->usesPolyProto) {
                        prototypeAccessChain = PolyProtoAccessChain::tryCreate(globalObject, baseCell, propertyName, nullptr);
                        if (!prototypeAccessChain)
                            return GiveUpOnCache;
                    } else {
                        prototypeAccessChain = nullptr;
                        conditionSet = generateConditionsForPropertySetterMiss(
                            vm, codeBlock, globalObject, newStructure, ident.impl());
                        if (!conditionSet.isValid())
                            return GiveUpOnCache;
                    }
                    break;
                }
                case PutByKind::DefinePrivateNameById:
                case PutByKind::DefinePrivateNameByVal:
                    ASSERT(ident.isPrivateName());
                    break;
                case PutByKind::ByIdDirectStrict:
                case PutByKind::ByIdDirectSloppy:
                case PutByKind::ByValDirectStrict:
                case PutByKind::ByValDirectSloppy:
                case PutByKind::SetPrivateNameById:
                case PutByKind::SetPrivateNameByVal:
                    break;
                }

                newCase = AccessCase::createTransition(vm, codeBlock, propertyName, offset, oldStructure, newStructure, conditionSet, WTF::move(prototypeAccessChain), propertyCache);
            }
        } else if (!newCase && (slot.isCacheableCustom() || slot.isCacheableSetter())) {
            if (slot.isCacheableCustom()) {
                ObjectPropertyConditionSet conditionSet;
                RefPtr<PolyProtoAccessChain> prototypeAccessChain;

                // We need to do this even if we're a self custom, since we must disallow dictionaries
                // because we need to be informed if the custom goes away since we cache the constant
                // function pointer.
                auto cacheStatus = prepareChainForCaching(globalObject, baseCell, propertyName.uid(), slot.base());
                if (!cacheStatus)
                    return GiveUpOnCache;

                if (slot.base() != baseValue) {
                    if (cacheStatus->usesPolyProto) {
                        prototypeAccessChain = PolyProtoAccessChain::tryCreate(globalObject, baseCell, propertyName, slot.base());
                        if (!prototypeAccessChain)
                            return GiveUpOnCache;
                    } else {
                        prototypeAccessChain = nullptr;
                        conditionSet = generateConditionsForPrototypePropertyHitCustom(
                            vm, codeBlock, globalObject, oldStructure, slot.base(), ident.impl(), static_cast<unsigned>(PropertyAttribute::None));
                        if (!conditionSet.isValid())
                            return GiveUpOnCache;
                    }
                }

                newCase = GetterSetterAccessCase::create(
                    vm, codeBlock, slot.isCustomAccessor() ? AccessCase::CustomAccessorSetter : AccessCase::CustomValueSetter, oldStructure, propertyName,
                    invalidOffset, conditionSet, WTF::move(prototypeAccessChain), isGlobalProxy, slot.customSetter(), slot.base() != baseValue ? slot.base() : nullptr);
            } else {
                ASSERT(slot.isCacheableSetter());
                ObjectPropertyConditionSet conditionSet;
                RefPtr<PolyProtoAccessChain> prototypeAccessChain;
                PropertyOffset offset = slot.cachedOffset();

                if (vm.gilOff() && slot.base() == baseValue) [[unlikely]] {
                    // OM-1: same A->B->A tear as the Replace path, for the
                    // self-Setter case. The published Setter AccessCase is keyed
                    // on oldStructure and loads-then-calls the cell at `offset`;
                    // a torn offset (or a same-offset DATA property) makes the
                    // IC call a non-callable cell (the counter-lock
                    // "cell->isObjectSlow() in asObject from JSC::call"
                    // signature). Bind the offset to oldStructure's own table
                    // and require the entry to actually be an Accessor. The
                    // prototype-Setter branch below recomputes the offset
                    // against oldStructure's chain itself and needs no extra
                    // check here.
                    unsigned attributes;
                    PropertyOffset tableOffset = oldStructure->getConcurrently(propertyName.uid(), attributes);
                    if (tableOffset != offset || !(attributes & PropertyAttribute::Accessor))
                        return RetryCacheLater;
                }

                if (slot.base() != baseValue) {
                    auto cacheStatus = prepareChainForCaching(globalObject, baseCell, propertyName.uid(), slot.base());
                    if (!cacheStatus)
                        return GiveUpOnCache;
                    if (cacheStatus->flattenedDictionary)
                        return RetryCacheLater;

                    if (cacheStatus->usesPolyProto) {
                        prototypeAccessChain = PolyProtoAccessChain::tryCreate(globalObject, baseCell, propertyName, slot.base());
                        if (!prototypeAccessChain)
                            return GiveUpOnCache;
                        unsigned attributes;
                        offset = prototypeAccessChain->slotBaseStructure(vm, baseCell->structure())->get(vm, ident.impl(), attributes);
                        if (!isValidOffset(offset) || !(attributes & PropertyAttribute::Accessor))
                            return RetryCacheLater;
                    } else {
                        prototypeAccessChain = nullptr;
                        conditionSet = generateConditionsForPrototypePropertyHit(
                            vm, codeBlock, globalObject, oldStructure, slot.base(), ident.impl());
                        if (!conditionSet.isValid())
                            return GiveUpOnCache;

                        if (!(conditionSet.slotBaseCondition().attributes() & PropertyAttribute::Accessor))
                            return GiveUpOnCache;

                        offset = conditionSet.slotBaseCondition().offset();
                    }
                }

                newCase = GetterSetterAccessCase::create(
                    vm, codeBlock, AccessCase::Setter, oldStructure, propertyName, offset, conditionSet, WTF::move(prototypeAccessChain), isGlobalProxy);
            }
        } else if (!propertyName.isPrivateName() && isProxyObject) {
            switch (putByKind) {
            case PutByKind::ByIdStrict:
            case PutByKind::ByIdSloppy: {
                propertyName.ensureIsCell(vm);
                newCase = AccessCase::create(vm, codeBlock, AccessCase::ProxyObjectStore, propertyName);
                break;
            }
            case PutByKind::ByValStrict:
            case PutByKind::ByValSloppy: {
                newCase = AccessCase::create(vm, codeBlock, AccessCase::IndexedProxyObjectStore, nullptr);
                break;
            }
            case PutByKind::DefinePrivateNameById:
            case PutByKind::DefinePrivateNameByVal:
            case PutByKind::SetPrivateNameById:
            case PutByKind::SetPrivateNameByVal:
                RELEASE_ASSERT_NOT_REACHED();
            case PutByKind::ByIdDirectStrict:
            case PutByKind::ByIdDirectSloppy:
            case PutByKind::ByValDirectStrict:
            case PutByKind::ByValDirectSloppy:
                return GiveUpOnCache;
            }
        }

        LOG_IC((ICEvent::PutByAddAccessCase, oldStructure->classInfoForCells(), slot.base() == baseValue));

        if (isNonStringPrimitiveKey) {
            if (!newCase)
                return GiveUpOnCache;
            auto keyInfo = nonStringPrimitiveKeyInfoForUID(vm, propertyName.uid());
            ASSERT(keyInfo);
            switch (newCase->type()) {
            case AccessCase::Replace:
                newCase->convertToNonStringPrimitiveKeyAccessType(keyInfo->replaceType);
                break;
            case AccessCase::Transition:
                newCase->convertToNonStringPrimitiveKeyAccessType(keyInfo->transitionType);
                break;
            default:
                return GiveUpOnCache;
            }
        }

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, slot.isStrictMode() ? ECMAMode::strict() : ECMAMode::sloppy(), isNonStringPrimitiveKey ? nullptr : propertyName, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::PutByReplaceWithJump, oldStructure->classInfoForCells(), slot.base() == baseValue));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    if (result.generatedMegamorphicCode())
        return PromoteToMegamorphic;
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchPutBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, Structure* oldStructure, CacheableIdentifier propertyName, const PutPropertySlot& slot, PropertyInlineCache& propertyCache, PutByKind putByKind, bool isNonStringPrimitiveKey)
{
    SuperSamplerScope superSamplerScope(false);

    switch (tryCachePutBy(globalObject, codeBlock, baseValue, oldStructure, propertyName, slot, propertyCache, putByKind, isNonStringPrimitiveKey)) {
    case PromoteToMegamorphic: {
        switch (putByKind) {
        case PutByKind::ByIdStrict:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByIdStrictMegamorphic);
            break;
        case PutByKind::ByIdSloppy:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByIdSloppyMegamorphic);
            break;
        case PutByKind::ByValStrict:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByValStrictMegamorphic);
            break;
        case PutByKind::ByValSloppy:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByValSloppyMegamorphic);
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
    }
    case GiveUpOnCache:
        repatchSlowPathCallLocking(codeBlock, propertyCache, appropriatePutByGaveUpFunction(putByKind));
        break;
    case RetryCacheLater:
    case AttemptToCache:
        break;
    }
}

static InlineCacheAction tryCacheArrayPutByVal(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, JSValue index, PropertyInlineCache& propertyCache, PutByKind putByKind)
{
    if (!baseValue.isCell() || forceICFailure(globalObject))
        return GiveUpOnCache;

    if (!index.isInt32())
        return RetryCacheLater;

    VM& vm = globalObject->vm();
    AccessGenerationResult result;

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, globalObject->vm());

        JSCell* base = baseValue.asCell();

        RefPtr<AccessCase> newCase;
        AccessCase::AccessType accessType = AccessCase::IndexedInt32Store;
        if (base->type() == ProxyObjectType) {
            switch (putByKind) {
            case PutByKind::ByValStrict:
            case PutByKind::ByValSloppy:
                accessType = AccessCase::IndexedProxyObjectStore;
                break;
            default:
                return RetryCacheLater;
            }
        } else if (isTypedView(base->type())) {
            auto* typedArray = uncheckedDowncast<JSArrayBufferView>(base);
#if USE(JSVALUE32_64)
            if (typedArray->isResizableOrGrowableShared())
                return GiveUpOnCache;
#endif
            switch (typedArray->type()) {
            case Int8ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt8Store : AccessCase::IndexedTypedArrayInt8Store;
                break;
            case Uint8ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint8Store : AccessCase::IndexedTypedArrayUint8Store;
                break;
            case Uint8ClampedArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint8ClampedStore : AccessCase::IndexedTypedArrayUint8ClampedStore;
                break;
            case Int16ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt16Store : AccessCase::IndexedTypedArrayInt16Store;
                break;
            case Uint16ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint16Store : AccessCase::IndexedTypedArrayUint16Store;
                break;
            case Int32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt32Store : AccessCase::IndexedTypedArrayInt32Store;
                break;
            case Uint32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint32Store : AccessCase::IndexedTypedArrayUint32Store;
                break;
            case Float16ArrayType:
                if (!CCallHelpers::supportsFloat16())
                    return GiveUpOnCache;
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat16Store : AccessCase::IndexedTypedArrayFloat16Store;
                break;
            case Float32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat32Store : AccessCase::IndexedTypedArrayFloat32Store;
                break;
            case Float64ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat64Store : AccessCase::IndexedTypedArrayFloat64Store;
                break;
            // FIXME: Optimize BigInt64Array / BigUint64Array in IC
            // https://bugs.webkit.org/show_bug.cgi?id=221183
            case BigInt64ArrayType:
            case BigUint64ArrayType:
                return GiveUpOnCache;
            default:
                RELEASE_ASSERT_NOT_REACHED();
            }
        } else {
            IndexingType indexingShape = base->indexingType() & IndexingShapeMask;
            switch (indexingShape) {
            case Int32Shape:
                accessType = AccessCase::IndexedInt32Store;
                break;
            case DoubleShape:
                ASSERT(Options::allowDoubleShape());
                accessType = AccessCase::IndexedDoubleStore;
                break;
            case ContiguousShape:
                accessType = AccessCase::IndexedContiguousStore;
                break;
            case ArrayStorageShape:
                accessType = AccessCase::IndexedArrayStorageStore;
                break;
            default:
                return GiveUpOnCache;
            }
        }

        if (!newCase)
            newCase = AccessCase::create(vm, codeBlock, accessType, nullptr);

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ecmaModeFor(putByKind), nullptr, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::PutByReplaceWithJump, baseValue.classInfoOrNull()));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    if (result.generatedMegamorphicCode())
        return PromoteToMegamorphic;
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchArrayPutByVal(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue base, JSValue index, PropertyInlineCache& propertyCache, PutByKind putByKind)
{
    switch (tryCacheArrayPutByVal(globalObject, codeBlock, base, index, propertyCache, putByKind)) {
    case PromoteToMegamorphic: {
        switch (putByKind) {
        case PutByKind::ByIdStrict:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByIdStrictMegamorphic);
            break;
        case PutByKind::ByIdSloppy:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByIdSloppyMegamorphic);
            break;
        case PutByKind::ByValStrict:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByValStrictMegamorphic);
            break;
        case PutByKind::ByValSloppy:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationPutByValSloppyMegamorphic);
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
    }
    case GiveUpOnCache:
        repatchSlowPathCallLocking(codeBlock, propertyCache, appropriatePutByGaveUpFunction(putByKind));
        break;
    case RetryCacheLater:
    case AttemptToCache:
        break;
    }
}

static InlineCacheAction tryCacheDeleteBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, DeletePropertySlot& slot, JSValue baseValue, Structure* oldStructure, CacheableIdentifier propertyName, PropertyInlineCache& propertyCache, DelByKind, ECMAMode ecmaMode)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, globalObject->vm());

        if (forceICFailure(globalObject))
            return GiveUpOnCache;

        // SPEC-jit section 5.5 (Task 8): deletes are transitions with slot
        // clearing; flag-on they require the locked/quarantined OM path, so
        // delete ICs are never created (generic operation handles them).
        if (Options::useJSThreads()) [[unlikely]]
            return GiveUpOnCache;

        ASSERT(oldStructure);
        if (!baseValue.isObject() || !oldStructure->propertyAccessesAreCacheable() || oldStructure->isProxy())
            return GiveUpOnCache;

        if (!slot.isCacheableDelete())
            return GiveUpOnCache;

        if (baseValue.asCell()->structure()->isDictionary()) {
            if (baseValue.asCell()->structure()->hasBeenFlattenedBefore())
                return GiveUpOnCache;
            uncheckedDowncast<JSObject>(baseValue)->flattenDictionaryObject(vm);
            return RetryCacheLater;
        }

        if (oldStructure->isDictionary())
            return RetryCacheLater;

        RefPtr<AccessCase> newCase;

        if (slot.isDeleteHit()) {
            PropertyOffset newOffset = invalidOffset;
            Structure* newStructure = Structure::removePropertyTransitionFromExistingStructureConcurrently(oldStructure, propertyName.uid(), newOffset);
            if (!newStructure)
                return RetryCacheLater;
            if (!newStructure->propertyAccessesAreCacheable() || newStructure->isDictionary())
                return GiveUpOnCache;
            // Right now, we disable IC for put onto prototype.
            if (oldStructure->mayBePrototype())
                return GiveUpOnCache;

            ASSERT(newOffset == slot.cachedOffset());
            ASSERT(newStructure->previousID() == oldStructure);
            ASSERT(newStructure->transitionKind() == TransitionKind::PropertyDeletion);
            ASSERT(newStructure->isObject());
            ASSERT(isValidOffset(newOffset));
            newCase = AccessCase::createDelete(vm, codeBlock, propertyName, newOffset, oldStructure, newStructure);
        } else if (slot.isNonconfigurable()) {
            if (ecmaMode.isStrict())
                return GiveUpOnCache;
            // Right now, we disable IC for put onto prototype.
            if (oldStructure->mayBePrototype())
                return GiveUpOnCache;
            newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteNonConfigurable, propertyName, invalidOffset, oldStructure, { }, nullptr);
        } else
            newCase = AccessCase::create(vm, codeBlock, AccessCase::DeleteMiss, propertyName, invalidOffset, oldStructure, { }, nullptr);

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ecmaMode, propertyName, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::DelByReplaceWithJump, oldStructure->classInfoForCells()));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchDeleteBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, DeletePropertySlot& slot, JSValue baseValue, Structure* oldStructure, CacheableIdentifier propertyName, PropertyInlineCache& propertyCache, DelByKind kind, ECMAMode ecmaMode)
{
    SuperSamplerScope superSamplerScope(false);

    if (tryCacheDeleteBy(globalObject, codeBlock, slot, baseValue, oldStructure, propertyName, propertyCache, kind, ecmaMode) == GiveUpOnCache) {
        LOG_IC((ICEvent::DelByReplaceWithGeneric, baseValue.classInfoOrNull()));
        switch (kind) {
        case DelByKind::ByIdStrict:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationDeleteByIdStrictGaveUp);
            break;
        case DelByKind::ByIdSloppy:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationDeleteByIdSloppyGaveUp);
            break;
        case DelByKind::ByValStrict:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationDeleteByValStrictGaveUp);
            break;
        case DelByKind::ByValSloppy:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationDeleteByValSloppyGaveUp);
            break;
        }
    }
}

inline CodePtr<CFunctionPtrTag> NODELETE appropriateInByOptimizeFunction(InByKind kind)
{
    switch (kind) {
    case InByKind::ById:
        return operationInByIdOptimize;
    case InByKind::ByVal:
        return operationInByValOptimize;
    case InByKind::PrivateName:
        return operationHasPrivateNameOptimize;
    }
    RELEASE_ASSERT_NOT_REACHED();
}

inline CodePtr<CFunctionPtrTag> NODELETE appropriateInByGaveUpFunction(InByKind kind)
{
    switch (kind) {
    case InByKind::ById:
        return operationInByIdGaveUp;
    case InByKind::ByVal:
        return operationInByValGaveUp;
    case InByKind::PrivateName:
        return operationHasPrivateNameGaveUp;
    }
    RELEASE_ASSERT_NOT_REACHED();
}

// Mainly used to transition from megamorphic case to generic case.
void repatchInBySlowPathCall(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache, InByKind kind)
{
    // TSAN ic-stubinfo (SPEC-jit §5.1/D3): see repatchGetBySlowPathCall.
    ConcurrentJSLocker locker(codeBlock->m_lock);
    resetInBy(vm, codeBlock, propertyCache, kind);
    repatchSlowPathCall(codeBlock, propertyCache, appropriateInByGaveUpFunction(kind));
}

static InlineCacheAction tryCacheInBy(
    JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* base, CacheableIdentifier propertyName,
    bool wasFound, const PropertySlot& slot, PropertyInlineCache& propertyCache, InByKind kind)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;
    Identifier ident = Identifier::fromUid(vm, propertyName.uid());

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, vm);
        if (forceICFailure(globalObject))
            return GiveUpOnCache;
        
        RefPtr<AccessCase> newCase;
        Structure* structure = base->structure();
        
        RefPtr<PolyProtoAccessChain> prototypeAccessChain;
        ObjectPropertyConditionSet conditionSet;
        if ((kind == InByKind::ById || kind == InByKind::ByVal) && !propertyName.isPrivateName() && base->inherits<ProxyObject>()) {
            switch (kind) {
            case InByKind::ById: {
                propertyName.ensureIsCell(vm);
                newCase = AccessCase::create(vm, codeBlock, AccessCase::ProxyObjectIn, propertyName);
                break;
            }
            case InByKind::ByVal: {
                newCase = AccessCase::create(vm, codeBlock, AccessCase::IndexedProxyObjectIn, nullptr);
                break;
            }
            default:
                RELEASE_ASSERT_NOT_REACHED();
            }
        } else if (wasFound) {
            if (!structure->propertyAccessesAreCacheable())
                return GiveUpOnCache;

            if (!slot.isCacheable())
                return GiveUpOnCache;

            InlineCacheAction action = actionForCell(vm, base);
            if (action != AttemptToCache)
                return action;

            // Optimize self access.
            if (propertyCache.cacheType() == CacheType::Unset
                && slot.isCacheableValue()
                && slot.slotBase() == base
                && !slot.watchpointSet()
                && !structure->needImpurePropertyWatchpoint()) {
                bool generatedCodeInline = InlineAccess::generateSelfInAccess(propertyCache, structure);
                if (generatedCodeInline) {
                    LOG_IC((ICEvent::InBySelfPatch, structure->classInfoForCells(), slot.slotBase() == base));
                    structure->startWatchingPropertyForReplacements(vm, slot.cachedOffset());
                    repatchSlowPathCall(codeBlock, propertyCache, operationInByIdOptimize);
                    propertyCache.initInByIdSelf(locker, codeBlock, structure, slot.cachedOffset());
                    return RetryCacheLater;
                }
            }

            if (slot.slotBase() != base) {
                auto cacheStatus = prepareChainForCaching(globalObject, base, propertyName.uid(), slot);
                if (!cacheStatus)
                    return GiveUpOnCache;
                if (cacheStatus->flattenedDictionary)
                    return RetryCacheLater;

                if (cacheStatus->usesPolyProto) {
                    prototypeAccessChain = PolyProtoAccessChain::tryCreate(globalObject, base, propertyName, slot);
                    if (!prototypeAccessChain)
                        return GiveUpOnCache;
                    ASSERT(slot.isCacheableCustom() || prototypeAccessChain->slotBaseStructure(vm, structure)->get(vm, propertyName.uid()) == slot.cachedOffset());
                } else {
                    prototypeAccessChain = nullptr;
                    conditionSet = generateConditionsForPrototypePropertyHit(
                        vm, codeBlock, globalObject, structure, slot.slotBase(), ident.impl());
                    if (!conditionSet.isValid())
                        return GiveUpOnCache;
                    ASSERT(slot.isCacheableCustom() || conditionSet.slotBaseCondition().offset() == slot.cachedOffset());
                }
            }
        } else {
            if (!structure->propertyAccessesAreCacheable() || !structure->propertyAccessesAreCacheableForAbsence())
                return GiveUpOnCache;

            auto cacheStatus = prepareChainForCaching(globalObject, base, propertyName.uid(), nullptr);
            if (!cacheStatus)
                return GiveUpOnCache;

            if (cacheStatus->usesPolyProto) {
                prototypeAccessChain = PolyProtoAccessChain::tryCreate(globalObject, base, propertyName, slot);
                if (!prototypeAccessChain)
                    return GiveUpOnCache;
            } else {
                prototypeAccessChain = nullptr;
                conditionSet = generateConditionsForPropertyMiss(
                    vm, codeBlock, globalObject, structure, ident.impl());
                if (!conditionSet.isValid())
                    return GiveUpOnCache;
            }
        }

        LOG_IC((ICEvent::InAddAccessCase, structure->classInfoForCells(), slot.slotBase() == base));

        if (!newCase)
            newCase = AccessCase::create(vm, codeBlock, wasFound ? AccessCase::InHit : AccessCase::InMiss, propertyName, wasFound ? slot.cachedOffset() : invalidOffset, structure, conditionSet, WTF::move(prototypeAccessChain));

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), propertyName, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::InReplaceWithJump, structure->classInfoForCells(), slot.slotBase() == base));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    if (result.generatedMegamorphicCode())
        return PromoteToMegamorphic;
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchInBy(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* baseObject, CacheableIdentifier propertyName, bool wasFound, const PropertySlot& slot, PropertyInlineCache& propertyCache, InByKind kind)
{
    SuperSamplerScope superSamplerScope(false);

    switch (tryCacheInBy(globalObject, codeBlock, baseObject, propertyName, wasFound, slot, propertyCache, kind)) {
    case PromoteToMegamorphic: {
        switch (kind) {
        case InByKind::ById:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationInByIdMegamorphic);
            break;
        case InByKind::ByVal:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationInByValMegamorphic);
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
    }
    case GiveUpOnCache:
        LOG_IC((ICEvent::InReplaceWithGeneric, baseObject->classInfo()));
        repatchSlowPathCallLocking(codeBlock, propertyCache, appropriateInByGaveUpFunction(kind));
        break;
    case RetryCacheLater:
    case AttemptToCache:
        break;
    }
}

static InlineCacheAction tryCacheHasPrivateBrand(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* base, CacheableIdentifier brandID, bool wasFound, PropertyInlineCache& propertyCache)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;
    Identifier ident = Identifier::fromUid(vm, brandID.uid());

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, vm);
        if (forceICFailure(globalObject))
            return GiveUpOnCache;

        Structure* structure = base->structure();

        InlineCacheAction action = actionForCell(vm, base);
        if (action != AttemptToCache)
            return action;

        bool isBaseProperty = true;
        LOG_IC((ICEvent::InAddAccessCase, structure->classInfoForCells(), isBaseProperty));

        Ref<AccessCase> newCase = AccessCase::create(vm, codeBlock, wasFound ? AccessCase::InHit : AccessCase::InMiss, brandID, invalidOffset, structure, { }, { });

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), brandID, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::InReplaceWithJump, structure->classInfoForCells(), isBaseProperty));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchHasPrivateBrand(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* baseObject, CacheableIdentifier brandID, bool wasFound, PropertyInlineCache& propertyCache)
{
    SuperSamplerScope superSamplerScope(false);

    if (tryCacheHasPrivateBrand(globalObject, codeBlock, baseObject, brandID, wasFound, propertyCache) == GiveUpOnCache)
        repatchSlowPathCallLocking(codeBlock, propertyCache, operationHasPrivateBrandGaveUp);
}

static InlineCacheAction tryCacheCheckPrivateBrand(
    JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* base, CacheableIdentifier brandID,
    PropertyInlineCache& propertyCache)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;
    Identifier ident = Identifier::fromUid(vm, brandID.uid());

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, vm);
        if (forceICFailure(globalObject))
            return GiveUpOnCache;

        Structure* structure = base->structure();

        InlineCacheAction action = actionForCell(vm, base);
        if (action != AttemptToCache)
            return action;

        bool isBaseProperty = true;
        LOG_IC((ICEvent::CheckPrivateBrandAddAccessCase, structure->classInfoForCells(), isBaseProperty));

        Ref<AccessCase> newCase = AccessCase::createCheckPrivateBrand(vm, codeBlock, brandID, structure);

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), brandID, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::CheckPrivateBrandReplaceWithJump, structure->classInfoForCells(), isBaseProperty));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchCheckPrivateBrand(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* baseObject, CacheableIdentifier brandID, PropertyInlineCache& propertyCache)
{
    SuperSamplerScope superSamplerScope(false);

    if (tryCacheCheckPrivateBrand(globalObject, codeBlock, baseObject, brandID, propertyCache) == GiveUpOnCache)
        repatchSlowPathCallLocking(codeBlock, propertyCache, operationCheckPrivateBrandGaveUp);
}

static InlineCacheAction tryCacheSetPrivateBrand(
    JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* base, Structure* oldStructure, CacheableIdentifier brandID,
    PropertyInlineCache& propertyCache)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;
    Identifier ident = Identifier::fromUid(vm, brandID.uid());

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, vm);
        if (forceICFailure(globalObject))
            return GiveUpOnCache;

        // SPEC-jit section 5.5 (Task 8): SetBrand is a structure-only
        // transition (OM N2); flag-on it requires the locked header-CAS
        // path, so the IC form is never created.
        if (Options::useJSThreads()) [[unlikely]]
            return GiveUpOnCache;

        ASSERT(oldStructure);

        if (oldStructure->isDictionary())
            return RetryCacheLater;

        InlineCacheAction action = actionForCell(vm, base);
        if (action != AttemptToCache)
            return action;

        Structure* newStructure = Structure::setBrandTransitionFromExistingStructureConcurrently(oldStructure, brandID.uid());
        if (!newStructure)
            return RetryCacheLater;
        if (newStructure->isDictionary())
            return GiveUpOnCache;
        ASSERT(newStructure->previousID() == oldStructure);
        ASSERT(newStructure->transitionKind() == TransitionKind::SetBrand);
        ASSERT(newStructure->isObject());
        
        bool isBaseProperty = true;
        LOG_IC((ICEvent::SetPrivateBrandAddAccessCase, oldStructure->classInfoForCells(), isBaseProperty));

        Ref<AccessCase> newCase = AccessCase::createSetPrivateBrand(vm, codeBlock, brandID, oldStructure, newStructure);

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), brandID, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::SetPrivateBrandReplaceWithJump, oldStructure->classInfoForCells(), isBaseProperty));
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchSetPrivateBrand(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSObject* baseObject, Structure* oldStructure, CacheableIdentifier brandID, PropertyInlineCache& propertyCache)
{
    SuperSamplerScope superSamplerScope(false);

    if (tryCacheSetPrivateBrand(globalObject, codeBlock, baseObject, oldStructure,  brandID, propertyCache) == GiveUpOnCache)
        repatchSlowPathCallLocking(codeBlock, propertyCache, operationSetPrivateBrandGaveUp);
}

static InlineCacheAction tryCacheInstanceOf(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue valueValue, JSValue prototypeValue, PropertyInlineCache& propertyCache, bool wasFound)
{
    VM& vm = globalObject->vm();
    AccessGenerationResult result;
    
    RELEASE_ASSERT(valueValue.isCell()); // shouldConsiderCaching rejects non-cells.
    
    if (forceICFailure(globalObject))
        return GiveUpOnCache;
    
    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, vm);
        
        JSCell* value = valueValue.asCell();
        Structure* structure = value->structure();
        RefPtr<AccessCase> newCase;
        JSObject* prototype = dynamicDowncast<JSObject>(prototypeValue);
        if (prototype) {
            if (!is<JSObject>(value)) {
                newCase = InstanceOfAccessCase::create(
                    vm, codeBlock, AccessCase::InstanceOfMiss, structure, ObjectPropertyConditionSet(),
                    prototype);
            } else if (structure->prototypeQueriesAreCacheable()) {
                // FIXME: Teach this to do poly proto.
                // https://bugs.webkit.org/show_bug.cgi?id=185663
                prepareChainForCaching(globalObject, value, nullptr, wasFound ? prototype : nullptr);
                ObjectPropertyConditionSet conditionSet = generateConditionsForInstanceOf(
                    vm, codeBlock, globalObject, structure, prototype, wasFound);

                if (conditionSet.isValid()) {
                    newCase = InstanceOfAccessCase::create(
                        vm, codeBlock,
                        wasFound ? AccessCase::InstanceOfHit : AccessCase::InstanceOfMiss,
                        structure, conditionSet, prototype);
                }
            }
        }
        
        if (!newCase)
            newCase = AccessCase::create(vm, codeBlock, AccessCase::InstanceOfMegamorphic, nullptr);
        
        LOG_IC((ICEvent::InstanceOfAddAccessCase, structure->classInfoForCells()));
        
        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), nullptr, WTF::move(newCase));

        if (result.generatedSomeCode())
            LOG_IC((ICEvent::InstanceOfReplaceWithJump, structure->classInfoForCells()));
    }
    
    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    if (result.generatedMegamorphicCode())
        return GiveUpOnCache; // In this case, we give up since we do not cache the results in the megamorphic table.
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

static InlineCacheAction tryCacheArrayInByVal(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue baseValue, JSValue index, PropertyInlineCache& propertyCache)
{
    ASSERT(baseValue.isCell());

    if (forceICFailure(globalObject))
        return GiveUpOnCache;

    if (!index.isInt32())
        return RetryCacheLater;

    VM& vm = globalObject->vm();
    AccessGenerationResult result;

    {
        GCSafeConcurrentJSLocker locker(codeBlock->m_lock, globalObject->vm());

        JSCell* base = baseValue.asCell();

        RefPtr<AccessCase> newCase;
        AccessCase::AccessType accessType = AccessCase::IndexedInt32InHit;
        if (base->type() == DirectArgumentsType)
            accessType = AccessCase::IndexedDirectArgumentsInHit;
        else if (base->type() == ScopedArgumentsType)
            accessType = AccessCase::IndexedScopedArgumentsInHit;
        else if (base->type() == StringType)
            accessType = AccessCase::IndexedStringInHit;
        else if (base->type() == ProxyObjectType)
            accessType = AccessCase::IndexedProxyObjectIn;
        else if (isTypedView(base->type())) {
            auto* typedArray = uncheckedDowncast<JSArrayBufferView>(base);
#if USE(JSVALUE32_64)
            if (typedArray->isResizableOrGrowableShared())
                return GiveUpOnCache;
#endif
            switch (typedArray->type()) {
            case Int8ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt8In : AccessCase::IndexedTypedArrayInt8In;
                break;
            case Uint8ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint8In : AccessCase::IndexedTypedArrayUint8In;
                break;
            case Uint8ClampedArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint8ClampedIn : AccessCase::IndexedTypedArrayUint8ClampedIn;
                break;
            case Int16ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt16In : AccessCase::IndexedTypedArrayInt16In;
                break;
            case Uint16ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint16In : AccessCase::IndexedTypedArrayUint16In;
                break;
            case Int32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayInt32In : AccessCase::IndexedTypedArrayInt32In;
                break;
            case Uint32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayUint32In : AccessCase::IndexedTypedArrayUint32In;
                break;
            case Float16ArrayType:
                if (!CCallHelpers::supportsFloat16())
                    return GiveUpOnCache;
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat16In : AccessCase::IndexedTypedArrayFloat16In;
                break;
            case Float32ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat32In : AccessCase::IndexedTypedArrayFloat32In;
                break;
            case Float64ArrayType:
                accessType = typedArray->isResizableOrGrowableShared() ? AccessCase::IndexedResizableTypedArrayFloat64In : AccessCase::IndexedTypedArrayFloat64In;
                break;
            // FIXME: Optimize BigInt64Array / BigUint64Array in IC
            // https://bugs.webkit.org/show_bug.cgi?id=221183
            case BigInt64ArrayType:
            case BigUint64ArrayType:
                return GiveUpOnCache;
            default:
                RELEASE_ASSERT_NOT_REACHED();
            }
        } else {
            IndexingType indexingShape = base->indexingType() & IndexingShapeMask;
            switch (indexingShape) {
            case Int32Shape:
                accessType = AccessCase::IndexedInt32InHit;
                break;
            case DoubleShape:
                ASSERT(Options::allowDoubleShape());
                accessType = AccessCase::IndexedDoubleInHit;
                break;
            case ContiguousShape:
                accessType = AccessCase::IndexedContiguousInHit;
                break;
            case ArrayStorageShape:
                accessType = AccessCase::IndexedArrayStorageInHit;
                break;
            case NoIndexingShape: {
                if (!base->isObject())
                    return GiveUpOnCache;

                if (base->structure()->mayInterceptIndexedAccesses() || base->structure()->typeInfo().interceptsGetOwnPropertySlotByIndexEvenWhenLengthIsNotZero())
                    return GiveUpOnCache;

                // FIXME: prepareChainForCaching is conservative. We should have another function which only cares about information related to this IC.
                auto cacheStatus = prepareChainForCaching(globalObject, base, nullptr, nullptr);
                if (!cacheStatus)
                    return GiveUpOnCache;

                if (cacheStatus->usesPolyProto)
                    return GiveUpOnCache;

                Structure* headStructure = base->structure();
                ObjectPropertyConditionSet conditionSet = generateConditionsForIndexedMiss(vm, codeBlock, globalObject, headStructure);
                if (!conditionSet.isValid())
                    return GiveUpOnCache;

                newCase = AccessCase::create(vm, codeBlock, AccessCase::IndexedNoIndexingInMiss, nullptr, invalidOffset, headStructure, conditionSet);
                break;
            }
            default:
                return GiveUpOnCache;
            }
        }

        if (!newCase)
            newCase = AccessCase::create(vm, codeBlock, accessType, nullptr);

        result = propertyCache.addAccessCase(locker, globalObject, codeBlock, ECMAMode::strict(), nullptr, newCase.releaseNonNull());
    }

    fireWatchpointsAndClearStubIfNeeded(vm, propertyCache, codeBlock, result);
    if (result.generatedMegamorphicCode())
        return PromoteToMegamorphic;
    return result.shouldGiveUpNow() ? GiveUpOnCache : RetryCacheLater;
}

void repatchArrayInByVal(JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue base, JSValue index, PropertyInlineCache& propertyCache, InByKind kind)
{
    switch (tryCacheArrayInByVal(globalObject, codeBlock, base, index, propertyCache)) {
    case PromoteToMegamorphic: {
        switch (kind) {
        case InByKind::ById:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationInByIdMegamorphic);
            break;
        case InByKind::ByVal:
            repatchSlowPathCallLocking(codeBlock, propertyCache, operationInByValMegamorphic);
            break;
        default:
            RELEASE_ASSERT_NOT_REACHED();
            break;
        }
        break;
    }
    case GiveUpOnCache:
        repatchSlowPathCallLocking(codeBlock, propertyCache, appropriateInByGaveUpFunction(kind));
        break;
    case RetryCacheLater:
    case AttemptToCache:
        break;
    }
}

void repatchInstanceOf(
    JSGlobalObject* globalObject, CodeBlock* codeBlock, JSValue valueValue, JSValue prototypeValue, PropertyInlineCache& propertyCache,
    bool wasFound)
{
    SuperSamplerScope superSamplerScope(false);
    if (tryCacheInstanceOf(globalObject, codeBlock, valueValue, prototypeValue, propertyCache, wasFound) == GiveUpOnCache)
        repatchSlowPathCallLocking(codeBlock, propertyCache, operationInstanceOfGaveUp);
}

void linkDirectCall(VM& vm, DirectCallLinkInfo& callLinkInfo, CodeBlock* calleeCodeBlock, CodePtr<JSEntryPtrTag> codePtr)
{
    // DirectCall is only used from DFG / FTL.
    // AB18-D: direct linking publishes a record and pushes onto the callee's
    // m_incomingCalls, so it is in the precondition-11 writer set. The VM is
    // the linking mutator's, passed down from the operation (AB18-E: never
    // derived from the owner cell — on the drain paths the owner can be a
    // dead cell, and even here taking it from a cell would be one stale
    // pattern more to audit).
    if (vm.gilOff()) [[unlikely]] {
        Locker locker { CallLinkInfo::s_callLinkSerializationLock };
        // AB18-F loser-path fix: two mutators direct-linking the same call
        // site concurrently must not double-push the node (SentinelLinkedList
        // corruption) — but the loser may also have resolved a DIFFERENT
        // calleeCodeBlock than the winner (a tier-up install can land between
        // the two racers' prepareForExecution resolutions). If we left the
        // node on the OLD callee's m_incomingCalls while publishing the new
        // target, jettisoning the new callee could never unlink this caller
        // (it is not on the new callee's list), so the call site would keep
        // dispatching into jettisoned code. Under the lock, isOnList() implies
        // the node sits on codeBlock()'s list, so delist on mismatch and
        // relink below. Same-callee losers keep the old behavior: skip the
        // re-push; the second setCallTarget republishes an identical record,
        // which is benign.
        if (callLinkInfo.isOnList() && callLinkInfo.codeBlock() != calleeCodeBlock)
            callLinkInfo.remove();
        callLinkInfo.setCallTarget(vm, uncheckedDowncast<FunctionCodeBlock>(calleeCodeBlock), CodeLocationLabel<JSEntryPtrTag>(codePtr));
        if (calleeCodeBlock && !callLinkInfo.isOnList())
            calleeCodeBlock->linkIncomingCall(callLinkInfo.owner(), &callLinkInfo);
        return;
    }
    callLinkInfo.setCallTarget(vm, uncheckedDowncast<FunctionCodeBlock>(calleeCodeBlock), CodeLocationLabel<JSEntryPtrTag>(codePtr));
    if (calleeCodeBlock)
        calleeCodeBlock->linkIncomingCall(callLinkInfo.owner(), &callLinkInfo);
}

void resetGetBy(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache, GetByKind kind)
{
    repatchSlowPathCall(codeBlock, propertyCache, appropriateGetByOptimizeFunction(kind));
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

void resetPutBy(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache, PutByKind kind)
{
    CodePtr<CFunctionPtrTag> optimizedFunction;
    switch (kind) {
    case PutByKind::ByIdStrict:
        optimizedFunction = operationPutByIdStrictOptimize;
        break;
    case PutByKind::ByIdSloppy:
        optimizedFunction = operationPutByIdSloppyOptimize;
        break;
    case PutByKind::ByIdDirectStrict:
        optimizedFunction = operationPutByIdDirectStrictOptimize;
        break;
    case PutByKind::ByIdDirectSloppy:
        optimizedFunction = operationPutByIdDirectSloppyOptimize;
        break;
    case PutByKind::DefinePrivateNameById:
        optimizedFunction = operationPutByIdDefinePrivateFieldStrictOptimize;
        break;
    case PutByKind::SetPrivateNameById:
        optimizedFunction = operationPutByIdSetPrivateFieldStrictOptimize;
        break;
    case PutByKind::ByValStrict:
        optimizedFunction = operationPutByValStrictOptimize;
        break;
    case PutByKind::ByValSloppy:
        optimizedFunction = operationPutByValSloppyOptimize;
        break;
    case PutByKind::ByValDirectStrict:
        optimizedFunction = operationDirectPutByValStrictOptimize;
        break;
    case PutByKind::ByValDirectSloppy:
        optimizedFunction = operationDirectPutByValSloppyOptimize;
        break;
    case PutByKind::DefinePrivateNameByVal:
        optimizedFunction = operationPutByValDefinePrivateFieldOptimize;
        break;
    case PutByKind::SetPrivateNameByVal:
        optimizedFunction = operationPutByValSetPrivateFieldOptimize;
        break;
    }

    repatchSlowPathCall(codeBlock, propertyCache, optimizedFunction);
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

void resetDelBy(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache, DelByKind kind)
{
    switch (kind) {
    case DelByKind::ByIdStrict:
        repatchSlowPathCall(codeBlock, propertyCache, operationDeleteByIdStrictOptimize);
        break;
    case DelByKind::ByIdSloppy:
        repatchSlowPathCall(codeBlock, propertyCache, operationDeleteByIdSloppyOptimize);
        break;
    case DelByKind::ByValStrict:
        repatchSlowPathCall(codeBlock, propertyCache, operationDeleteByValStrictOptimize);
        break;
    case DelByKind::ByValSloppy:
        repatchSlowPathCall(codeBlock, propertyCache, operationDeleteByValSloppyOptimize);
        break;
    }
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

void resetInBy(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache, InByKind kind)
{
    repatchSlowPathCall(codeBlock, propertyCache, appropriateInByOptimizeFunction(kind));
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

void resetHasPrivateBrand(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache)
{
    repatchSlowPathCall(codeBlock, propertyCache, operationHasPrivateBrandOptimize);
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

void resetInstanceOf(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache)
{
    repatchSlowPathCall(codeBlock, propertyCache, operationInstanceOfOptimize);
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

void resetCheckPrivateBrand(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache)
{
    repatchSlowPathCall(codeBlock, propertyCache, operationCheckPrivateBrandOptimize);
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

void resetSetPrivateBrand(VM& vm, CodeBlock* codeBlock, PropertyInlineCache& propertyCache)
{
    repatchSlowPathCall(codeBlock, propertyCache, operationSetPrivateBrandOptimize);
    propertyCache.resetStubAsJumpInAccess(vm, codeBlock);
}

#endif

} // namespace JSC