CWS AVM2 instructions

The code of each method body in an ABC file is a run of AVM2 instructions. The AVM2 is a stack machine with an operand stack, a scope stack and numbered local registers (register 0 is this). The explorer disassembles every method body and links each instruction here.

Instruction format

An instruction is a one-byte opcode followed by its operands. Operands are u30 unless the table says otherwise. Many are indexes: “mn” is a multiname index, and “string”, “int”, “uint”, “double” and “namespace” index those constant pools. In the stack column, values before the arrow are popped and those after it pushed; [ns] and [name] are the parts a run-time multiname (RTQName, MultinameL and the rest) takes from the stack.

Branch offsets are s24, counted in bytes from the end of the branch instruction (after its 3-byte operand).
lookupswitch is the exception: s24 default offset, u30 case_count, then case_count + 1 s24 offsets, all counted from the start of the lookupswitch instruction.

Instructions marked “not in the overview” are not described in the May 2007 AVM2 Overview; their names and operands come from Tamarin’s opcode table and RABCDAsm. (Which instructions the overview documents is as remembered; the PDF was not rechecked.)

All instructions

Hex	Name	Operands	Stack and meaning
01	bkpt	—	A debugger breakpoint. Not in the overview
02	nop	—	Does nothing
03	throw	—	value → throws value
04	getsuper	mn	object, [ns], [name] → value from the base class
05	setsuper	mn	object, [ns], [name], value → sets it in the base class
06	dxns	string	Sets the default XML namespace
07	dxnslate	—	value → sets the default XML namespace to value
08	kill	register	Sets a local register to undefined
09	label	—	Marks a backward branch target; does nothing
0C	ifnlt	s24	a, b → branches unless a < b
0D	ifnle	s24	a, b → branches unless a <= b
0E	ifngt	s24	a, b → branches unless a > b
0F	ifnge	s24	a, b → branches unless a >= b
10	jump	s24	Branches always
11	iftrue	s24	value → branches if true
12	iffalse	s24	value → branches if false
13	ifeq	s24	a, b → branches if a == b
14	ifne	s24	a, b → branches if a != b
15	iflt	s24	a, b → branches if a < b
16	ifle	s24	a, b → branches if a <= b
17	ifgt	s24	a, b → branches if a > b
18	ifge	s24	a, b → branches if a >= b
19	ifstricteq	s24	a, b → branches if a === b
1A	ifstrictne	s24	a, b → branches if a !== b
1B	lookupswitch	s24 default, u30 case_count, s24 × (case_count + 1)	index → branches to that case, or the default when out of range
1C	pushwith	—	object → onto the scope stack as a with scope
1D	popscope	—	Pops the scope stack
1E	nextname	—	object, index → name (for … in)
1F	hasnext	—	object, index → next index, or 0 when done
20	pushnull	—	→ null
21	pushundefined	—	→ undefined
22	pushuninitialized	unknown	Tamarin internal, never used by released players. Not in the overview
23	nextvalue	—	object, index → value (for each … in)
24	pushbyte	u8, signed	→ int
25	pushshort	u30, used as a signed 16-bit number	→ int
26	pushtrue	—	→ true
27	pushfalse	—	→ false
28	pushnan	—	→ NaN
29	pop	—	value →
2A	dup	—	value → value, value
2B	swap	—	a, b → b, a
2C	pushstring	string	→ String
2D	pushint	int	→ int from the pool
2E	pushuint	uint	→ uint from the pool
2F	pushdouble	double	→ Number from the pool
30	pushscope	—	object → onto the scope stack
31	pushnamespace	namespace	→ Namespace
32	hasnext2	register, register	→ Boolean; steps the object and index registers to the next property
33	pushdecimal	unknown	For decimal numbers, which never shipped. Not in the overview
34	pushdnan	unknown	For decimal numbers, which never shipped. Not in the overview
35	li8	—	address → int: a byte from domain memory (“Alchemy”, Flash Player 10). Not in the overview
36	li16	—	address → int: 16 bits from domain memory. Not in the overview
37	li32	—	address → int: 32 bits. Not in the overview
38	lf32	—	address → Number: a 32-bit float. Not in the overview
39	lf64	—	address → Number: a 64-bit float. Not in the overview
3A	si8	—	value, address → stores a byte. Not in the overview
3B	si16	—	value, address → stores 16 bits. Not in the overview
3C	si32	—	value, address → stores 32 bits. Not in the overview
3D	sf32	—	value, address → stores a 32-bit float. Not in the overview
3E	sf64	—	value, address → stores a 64-bit float. Not in the overview
40	newfunction	method	→ Function, a closure over the current scope
41	call	arg_count	function, receiver, args → value
42	construct	arg_count	object, args → new object
43	callmethod	disp_id, arg_count	receiver, args → value
44	callstatic	method, arg_count	receiver, args → value
45	callsuper	mn, arg_count	receiver, [ns], [name], args → value from the base class method
46	callproperty	mn, arg_count	object, [ns], [name], args → value
47	returnvoid	—	Returns undefined
48	returnvalue	—	value → returns it
49	constructsuper	arg_count	object, args → runs the base class constructor
4A	constructprop	mn, arg_count	object, [ns], [name], args → new object
4B	callsuperid	unknown	Tamarin internal. Not in the overview
4C	callproplex	mn, arg_count	As callproperty, with a null receiver
4D	callinterface	unknown	Tamarin internal. Not in the overview
4E	callsupervoid	mn, arg_count	As callsuper, the result dropped
4F	callpropvoid	mn, arg_count	As callproperty, the result dropped
50	sxi1	—	value → int, sign-extended from 1 bit. Not in the overview
51	sxi8	—	value → int, sign-extended from 8 bits. Not in the overview
52	sxi16	—	value → int, sign-extended from 16 bits. Not in the overview
53	applytype	arg_count	factory, types → type, as in `Vector.<int>` (Flash Player 10). Not in the overview
55	newobject	arg_count	name1, value1 … → Object
56	newarray	arg_count	values → Array
57	newactivation	—	→ the activation object
58	newclass	class index	base class → class; runs its cinit
59	getdescendants	mn	object, [ns], [name] → XMLList (the `..` operator)
5A	newcatch	exception index	→ the scope object of a catch block
5B	deldescendants	unknown	Tamarin internal. Not in the overview
5D	findpropstrict	mn	[ns], [name] → the object holding the name, or a ReferenceError
5E	findproperty	mn	[ns], [name] → the object holding the name, or the global object
5F	finddef	mn	→ the script object that defines the name. Not in the overview
60	getlex	mn	→ value: findpropstrict and getproperty in one
61	setproperty	mn	object, [ns], [name], value →
62	getlocal	register	→ value
63	setlocal	register	value →
64	getglobalscope	—	→ the global scope object
65	getscopeobject	u8 index	→ the scope object at that index
66	getproperty	mn	object, [ns], [name] → value
67	getouterscope	u30	→ an object of the outer scope chain (Tamarin internal). Not in the overview
68	initproperty	mn	object, [ns], [name], value → initialises a property, constants included
69	setpropertylate	—	object, name, value → (Tamarin internal). Not in the overview
6A	deleteproperty	mn	object, [ns], [name] → Boolean
6B	deletepropertylate	—	object, name → Boolean (Tamarin internal). Not in the overview
6C	getslot	slot	object → value
6D	setslot	slot	object, value →
6E	getglobalslot	slot	→ value of a slot of the global object
6F	setglobalslot	slot	value →
70	convert_s	—	value → String
71	esc_xelem	—	value → String escaped for XML element content
72	esc_xattr	—	value → String escaped for an XML attribute
73	convert_i	—	value → int
74	convert_u	—	value → uint
75	convert_d	—	value → Number
76	convert_b	—	value → Boolean
77	convert_o	—	value → value, or a TypeError if null or undefined
78	checkfilter	—	value → value, or a TypeError unless XML or XMLList
79	convert_m	unknown	For decimal numbers, which never shipped. Not in the overview
7A	convert_m_p	unknown	For decimal numbers. Not in the overview
80	coerce	mn	value → value coerced to the type
81	coerce_b	—	value → Boolean. Not in the overview
82	coerce_a	—	value → value as any type (`*`)
83	coerce_i	—	value → int. Not in the overview
84	coerce_d	—	value → Number. Not in the overview
85	coerce_s	—	value → String; null stays null
86	astype	mn	value → value if it is of the type, otherwise null
87	astypelate	—	value, class → value or null
88	coerce_u	—	value → uint. Not in the overview
89	coerce_o	—	value → Object. Not in the overview
8F	negate_p	unknown	For decimal numbers. Not in the overview
90	negate	—	value → −value
91	increment	—	value → value + 1
92	inclocal	register	Adds 1 to a local register
93	decrement	—	value → value − 1
94	declocal	register	Subtracts 1 from a local register
95	typeof	—	value → String, its type name
96	not	—	value → !value
97	bitnot	—	value → ~value
9A	concat	unknown	Tamarin internal. Not in the overview
9B	add_d	unknown	Tamarin internal. Not in the overview
9C	increment_p	unknown	For decimal numbers. Not in the overview
9D	inclocal_p	unknown	For decimal numbers. Not in the overview
9E	decrement_p	unknown	For decimal numbers. Not in the overview
9F	declocal_p	unknown	For decimal numbers. Not in the overview
A0	add	—	a, b → a + b
A1	subtract	—	a, b → a − b
A2	multiply	—	a, b → a × b
A3	divide	—	a, b → a ÷ b
A4	modulo	—	a, b → a % b
A5	lshift	—	a, b → a << b
A6	rshift	—	a, b → a >> b
A7	urshift	—	a, b → a >>> b
A8	bitand	—	a, b → a & b
A9	bitor	—	a, b → a \| b
AA	bitxor	—	a, b → a ^ b
AB	equals	—	a, b → a == b
AC	strictequals	—	a, b → a === b
AD	lessthan	—	a, b → a < b
AE	lessequals	—	a, b → a <= b
AF	greaterthan	—	a, b → a > b
B0	greaterequals	—	a, b → a >= b
B1	instanceof	—	value, type → Boolean, by the prototype chain
B2	istype	mn	value → Boolean
B3	istypelate	—	value, type → Boolean
B4	in	—	name, object → Boolean
B5	add_p	unknown	For decimal numbers. Not in the overview
B6	subtract_p	unknown	For decimal numbers. Not in the overview
B7	multiply_p	unknown	For decimal numbers. Not in the overview
B8	divide_p	unknown	For decimal numbers. Not in the overview
B9	modulo_p	unknown	For decimal numbers. Not in the overview
C0	increment_i	—	value → int(value) + 1
C1	decrement_i	—	value → int(value) − 1
C2	inclocal_i	register	register = int(register) + 1
C3	declocal_i	register	register = int(register) − 1
C4	negate_i	—	value → −int(value)
C5	add_i	—	a, b → int(a) + int(b)
C6	subtract_i	—	a, b → int(a) − int(b)
C7	multiply_i	—	a, b → int(a) × int(b)
D0	getlocal_0	—	→ register 0 (`this`)
D1	getlocal_1	—	→ register 1
D2	getlocal_2	—	→ register 2
D3	getlocal_3	—	→ register 3
D4	setlocal_0	—	value → register 0
D5	setlocal_1	—	value → register 1
D6	setlocal_2	—	value → register 2
D7	setlocal_3	—	value → register 3
EF	debug	u8 debug_type, u30 string, u8 register, u30 extra	Debugging information (type 1: a register’s name)
F0	debugline	u30 line	The source line of what follows
F1	debugfile	string	The source file of what follows
F2	bkptline	u30 line	A breakpoint at a line. Not in the overview
F3	timestamp	—	Profiling. Not in the overview

Opcodes that never shipped

The rows with “unknown” operands (22, 33, 34, 4B, 4D, 5B, 79, 7A, 8F, 9A to 9F and B5 to B9) are named in Tamarin and RABCDAsm but were never written by a released compiler. The _p, _m and decimal ones belong to support for decimal numbers that never shipped. Because their operands are not known, the explorer stops decoding a method body when it meets one, and says so. None of them occurs in the 3,837 ABC blocks examined for this site. Every other byte value is not an instruction.

A constructor

A class constructor compiled by Flex or Flash typically starts:

D0        getlocal_0
30        pushscope
D0        getlocal_0
49 00     constructsuper 0
47        returnvoid

Push this as the scope, call the base class constructor with no arguments, return

.SWF File Format – AVM2 instructions

Instruction format

All instructions

Opcodes that never shipped

A constructor