AVM2 Instructions
Summary of the AVM2 instructions that can appear in an ABC file or tag
 
Mnemonic Opcode Arguments Stack Before Stack After
add 0xA0
-
 b
a		 a + b

Add two items according to their types.
add_i 0xC5
-
 b
a		 int(a) + int(b)

Convert two items to integers and add them.
astype 0x86 type name a a or null

Implements the 'as' operator.

Pop an object. If it is an instance of the type given by the argument then it is put back, otherwise null is pushed.
astypelate 0x87
-
 class
a		 a or null

Implements the 'as' operator.

Pop a class constructor and an object. If the object is an instance of the class then it is put back, otherwise null is pushed.
bitand 0xA8
-
 b
a		 int(a) & int(b)

Bitwise AND.
bitnot 0x97
-
 a ~int(a)

Bitwise NOT.
bitor 0xA9
-
 b
a		 int(a) | int(b)

Pop two ints and push their bitwise OR.
bitxor 0xAA
-
 b
a		 int(a) ^ int(b)

Bitwise XOR.
bkpt 0x01
-
-
-

If in debug mode, enter the debugger.
bkptline 0xF2 line number
-
-

If in debug mode, set the debug line number and enter the debugger.
call 0x41 n = arg count arg n
..
arg 1
"this"
function		 function result

Call a function on the stack.

Throws an error if the function object is not actually a function.
callmethod 0x43 dispatch id
n = arg count		 arg n
..
arg 1
target		 method result

Call an instance method via a VTable.

Throws an error if the target object is null.
callproperty 0x46 name
n = arg count		 arg n
..
arg 1
(name string)
(namespace)
target		 method result

Call a method of the target with the given name.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
callproplex 0x4C name
n = arg count		 arg n
..
arg 1
(name string)
(namespace)
target		 method result

Call a function of the target with the given name. The function is called with "this" set to null.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
callpropvoid 0x4F name
n = arg count		 arg n
..
arg 1
(name string)
(namespace)
target
-

Call a method of the target with the given name. The result is discarded.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
callstatic 0x44 method id
n = arg count		 arg n
..
arg 1
target		 method result

Call a static method via a method id.

Throws an error if the target object is null.
callsuper 0x45 name
n = arg count		 arg n
..
arg 1
(name string)
(namespace)
target		 method result

Call a super method with the given name.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
callsupervoid 0x4E name
n = arg count		 arg n
..
arg 1
(name string)
(namespace)
target
-

Call a super method with the given name. The result (if any) is discarded.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
checkfilter 0x78
-
 a a

Check that the object on the stack is an XML or XMLList object and raise an error if not.
coerce 0x80 name a b

Convert a value to the type given by the name argument. This implements the ES4 implicit conversion.

Throw an exception if conversion is not possible.
coerce_a 0x82
-
 a a

Convert a value to an atom. Appears to be a no-op since the AVM2 interpreter only uses atoms.
coerce_b 0x81
-
 a boolean(a)

Deprecated.

Convert a value to a boolean. Use convert_b instead.
coerce_d 0x84
-
 a number(a)

Deprecated.

Convert a value to a number.

Use convert_d instead.
coerce_i 0x83
-
 a int(a)

Deprecated.

Convert a value to a signed int.

Use convert_i instead.
coerce_o 0x89
-
 a a

Convert a value to an object.

The only action appears to be to convert undefined to null.
coerce_s 0x85
-
 a string(a)

Convert a value or object to a string.

Null or undefined are converted to a null string.
coerce_u 0x88
-
 a uint(a)

Deprecated.

Convert a value to an unsigned int.

Use convert_u instead.
construct 0x42 n = arg count arg n
..
arg 1
function		 new instance

Call a constructor function on the stack.
constructprop 0x4A name
n = arg count		 arg n
..
arg 1
(name string)
(namespace)
target		 new instance

Call a constructor function that is a named property of the target. The property cannot be a method of the target.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
constructsuper 0x49 n = arg count arg n
..
arg 1
target
-

Implements the super(..) call.

Call the constructor of the superclass with the target as "this".
convert_b 0x76
-
 a boolean(a)

Convert a value to a boolean.
convert_d 0x75
-
 a number(a)

Convert a value to a number.
convert_i 0x73
-
 a int(a)

Convert a value to a signed int.
convert_o 0x77
-
 a a

Convert to object.

Appears to do nothing other than raise an error if the value is null or undefined.
convert_s 0x70
-
 a string(a)

Convert a value to a string.

Undefined is converted to "undefined" and null is converted to "null".
convert_u 0x74
-
 a uint(a)

Convert a value to an unsigned int.
debug 0xEF
-
-
-

Does not appear to be implemented yet.
debugfile 0xF1 string
-
-

If in debug mode, set the debug filename.
debugline 0xF0 line number
-
-

If in debug mode, set the debug line number.
declocal 0x94 register index
-
-

Decrement the given local register.

Convert the value to a number if required.
declocal_i 0xC3 register index
-
-

Decrement the given local register.

Convert the value to an int if required.
decrement 0x93
-
 a number(a) - 1

Decrement the top value - converting to a number if necessary.
decrement_i 0xC1
-
 a int(a) - 1

Decrement the top value - converting to an int if necessary.
deleteproperty 0x6A name (name string)
(namespace)
target		 true or false

Delete the named property of the target object. Push true if deleted, false if not.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
divide 0xA3
-
 b
a		 number(a)/number(b)

Numeric division.
dup 0x2A
-
 a a
a

Duplicate the item on the top of the stack.
dxns 0x06 string
-
-

Set the default XML namespace to the given string argument.
dxnslate 0x07
-
 string
-

Set the default XML namespace to the string on the stack.
equals 0xAB
-
 b
a		 a == b

The equality operator.

See also: strictequals.
esc_xattr 0x72
-
 a string(a) escaped

Escape the value as an XML attribute value.
esc_xelem 0x71
-
 a string(a) escaped

Escape the value as an XML element value.
finddef 0x5F name
-
 object

Find a global definition. TODO: What exactly does this do ?
findproperty 0x5E name
-
 object

Search the scope chain for the first scope object that has the property given by the name argument. If no matching object is found then the object at the top of the scope chain is pushed.

If the property is found via the prototype chain of an object then the object, not the prototype, is pushed. This will find the correct object for setting the property (prototype properties should not be altered).
findpropstrict 0x5D name
-
 object

Search the scope chain for the first scope object that has the property given by the name argument. If no object is found then an error is thrown.

If the property is found via the prototype chain of an object then the object, not the prototype, is pushed. This will find the correct object for setting the property (prototype properties should not be altered).
getdescendants 0x59 name (name string)
(namespace)
XMLObject/List		 XMLList

Get the descendants of the XML object or list that have the given name. The result is an XMLList.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
getglobalscope 0x64
-
-
 scope object

Get the object at the top of the scope chain.
getglobalslot 0x6E slot id
-
 a

Deprecated.

Get the item in the given slot of the global scope (object at top of scope chain).
getlex 0x60 name
-
 a

Get the named property from the current scope.

Equivalent to findpropstrict followed by getproperty (but runtime names or namespaces are not allowed).
getlocal 0x62 register index
-
 a

Push the value of the given local register.
getlocal0 0xD0
-
-
 a

Push the value of local register 0.
getlocal1 0xD1
-
-
 a

Push the value of local register 1.
getlocal2 0xD2
-
-
 a

Push the value of local register 2.
getlocal3 0xD3
-
-
 a

Push the value of local register 3.
getproperty 0x66 name (name string)
(namespace)
target		 a

Get the named property of the given target.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
getscopeobject 0x65 index
-
 object

Get the scope object at the given index in the scope chain.

Index zero is the top of the scope chain (most global).
getslot 0x6C slot id a b

Get the item in the given slot of the top object.
getsuper 0x04 name (name string)
(namespace)
target		 a

Get the named item of the super object of the target.

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
greaterequals 0xB0
-
 b
a		 a >= b

Greater-than-or-equals operator.

Result is false if either operand is NaN.
greaterthan 0xAF
-
 b
a		 a > b

Greater-than operator.

Result is false if either operand is NaN.
hasnext 0x1F
-
 index
target		 next index

Get the index of the next property, zero if none.
hasnext2 0x32 target register
index register
-
 true or false

Get the index of the next property of the target. Push true if there is a next property, false otherwise.

The index register is updated to the next index and the target register is updated to the object (the target itself, or a prototype of the target) that has the next property.
ifeq 0x13 offset b
a
-

Branch if a == b.
iffalse 0x12 offset a
-

Branch if value is false.
ifge 0x18 offset b
a
-

Branch if a >= b.

If either value is NaN then the branch is skipped.
ifgt 0x17 offset b
a
-

Branch if a > b.

If either value is NaN then the branch is skipped.
ifle 0x16 offset b
a
-

Branch if a <= b.

If either value is NaN then the branch is skipped.
iflt 0x15 offset b
a
-

Branch if a < b.

If either value is NaN then the branch is skipped.
ifne 0x14 offset b
a
-

Branch if a != b.

If either value is NaN then the branch is skipped.
ifnge 0x0F offset b
a
-

Branch if not(a >= b).

If either value is NaN then the branch is taken.
ifngt 0x0E offset b
a
-

Branch if not(a > b).

If either value is NaN then the branch is taken.
ifnle 0x0D offset b
a
-

Branch if not(a <= b).

If either value is NaN then the branch is taken.
ifnlt 0x0C offset b
a
-

Branch if not (a < b).

If either value is NaN then the branch is taken.
ifstricteq 0x19 offset b
a
-

Branch if a === b.
ifstrictne 0x1A offset b
a
-

Branch if a !== b.
iftrue 0x11 offset a
-

Branch if value is true.
in 0xB4
-
 target
string name		 true or false

The "in" operator.

If the given property exists on the target or in its prototype chain then push true.
inclocal 0x92 register index
-
-

Increment the given local register.

Convert the value to an int if required.
inclocal_i 0xC2 register index
-
-

Increment the given local register.

Convert the value to an int if required.
increment 0x91
-
 a number(a) + 1

Increment the top value - converting to a number if necessary.
increment_i 0xC0
-
 a number(a) + 1

Increment the top value - converting to an int if necessary.
initproperty 0x68 name value
(name string)
(namespace)
target
-

Initialize the named property of the target with the given value.

TODO: How is this different from setproperty - does it not go up the scope chain but set the property directly on the object ?

If the name is a runtime name then the actual name string will be on the stack.

If the name has a runtime namespace then the actual namespace object will be on the stack.
instanceof 0xB1
-
 b
a		 a instanceof b

The instanceof operator.
istype 0xB2 name a a is name

The "is" operator with a fixed type name.
istypelate 0xB3
-
 b:Function
a		 a is b

The "is" operator with a stack supplied type constructor function.
jump 0x10 offset
-
-

Unconditional branch.
kill 0x08 register index
-
-

Set the local register to undefined.
label 0x09
-
-
-

Appears to be a no-op.
lessequals 0xAE
-
 b
a		 a <= b

Less-than-or-equals operator.

Result is false if either operand is NaN.
lessthan 0xAD
-
 b
a		 a < b

Less-than operator.

Result is false if either operand is NaN.
lookupswitch 0x1B default offset
n = max index
offset 0
...
offset n		 index:integer
-

Switch on uint(index). If the index is between 0 and n then branch with the corresponding offset, otherwise branch with the default offset.

This is misnamed - it is really a tableswitch.
lshift 0xA5
-
 b
a		 int(a) << uint(b)

Bitwise shift-left.
modulo 0xA4
-
 b
a		 number(a) % number(b)

The mod operator.
multiply 0xA2
-
 b
a		 number(a) * number(b)

The multiplication operator.
multiply_i 0xC7
-
 b
a		 int(a) * int(b)

The integer multiplication operator.
negate 0x90
-
 a -number(a)

The negation operator.
negate_i 0xC4
-
 a -int(a)

The integer negation operator.
newactivation 0x57
-
-
 activation

Create a new activation object.
newarray 0x56 arg count = n arg n
..
arg 1		 [ arg 1, .. , arg n ]

Create and initialize a new array.
newcatch 0x5A exception index
-
 catch object

Create a new catch object for the exception given by the index (within the exception handlers of the current method).

TODO: What is this used for ?
newclass 0x58 class index base class closure new class

Create a new class closure from the class definition given by the index.
newfunction 0x40 method index
-
 function object

Create a new function object (as a closure within the current scope) from the method definition given by the index.
newobject 0x55 arg count = N valueN
keyN
..
value1
key1		 { key1: value1, .. , keyN: valueN }

Create and initialize a new object.
nextname 0x1E
-
 index:int
target		 string

Get the next property name from the given index. Null string if no more enumerable properties.
nextvalue 0x23
-
 index:int
target		 value

Get the next property value from the given index. Undefined if no more enumerable properties.
nop 0x02
-
-
-

Do nothing.
not 0x96
-
 a ! boolean(a)

Boolean NOT operator.
pop 0x29
-
 a
-

Discard the value on the top of the stack.
popscope 0x1D
-
-
-

Remove the object at the bottom of the scope chain (least global).
pushbyte 0x24 signed byte = a
-
 a

Push a signed byte value.
pushdouble 0x2F index
-
 double_pool[index]

Push a double from the double constant pool.
pushfalse 0x27
-
-
 false

Push the constant false.
pushint 0x2D index
-
 int_pool[index]

Push an int from the int constant pool.
pushnamespace 0x31 index
-
 namespace_pool[index]

Push a namespace object from the namespace constant pool.
pushnan 0x28
-
-
 NaN

Push the constant NaN.
pushnull 0x20
-
-
 null

Push the constant null.
pushscope 0x30
-
 scope object
-

Add an object to the bottom of the scope chain.
pushshort 0x25 short int = a
-
 a

Push a short value.
pushstring 0x2C index
-
 string_pool[index]

Push a string from the string constant pool.
pushtrue 0x26
-
-
 true

Push the constant true.
pushuint 0x2E index
-
 uint_pool[index]

Push a uint from the uint constant pool.
pushundefined 0x21
-
-
 undefined

Push the constant undefined.
pushwith 0x1C
-
 object
-

Add an object to the bottom of the scope chain.

TODO: how is this different from pushscope ?
returnvalue 0x48
-
 a
-

Return a value from a function or method.

Coerce the value according the return type.
returnvoid 0x47
-
-
-

Return undefined from a function or method.

Coerce undefined according the return type.
rshift 0xA6
-
 b
a		 int(a) >> uint(b)

Signed bitwise shift-right.
setglobalslot 0x6F slot id value
-

Deprecated.

Set the property with the given slot id on the global scope object.
setlocal 0x63 register index a
-

Set the given local register from the value on the stack.
setlocal0 0xD4
-
 a
-

Set local register 0 from the value on the stack.
setlocal1 0xD5
-
 a
-

Set local register 1 from the value on the stack.
setlocal2 0xD6
-
 a
-

Set local register 2 from the value on the stack.
setlocal3 0xD7
-
 a
-

Set local register 3 from the value on the stack.