code-stub-assembler.h 146 KB
Newer Older
1 2 3 4 5 6 7
// Copyright 2016 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#ifndef V8_CODE_STUB_ASSEMBLER_H_
#define V8_CODE_STUB_ASSEMBLER_H_

8 9
#include <functional>

10
#include "src/base/macros.h"
11
#include "src/compiler/code-assembler.h"
12
#include "src/globals.h"
13
#include "src/objects.h"
14
#include "src/objects/bigint.h"
15
#include "src/roots.h"
16 17 18 19 20

namespace v8 {
namespace internal {

class CallInterfaceDescriptor;
21
class CodeStubArguments;
22
class CodeStubAssembler;
23 24
class StatsCounter;
class StubCache;
25

26 27
enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };

28 29 30 31 32 33 34 35 36 37
#define HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V)                              \
  V(ArraySpeciesProtector, array_species_protector, ArraySpeciesProtector) \
  V(EmptyPropertyDictionary, empty_property_dictionary,                    \
    EmptyPropertyDictionary)                                               \
  V(PromiseSpeciesProtector, promise_species_protector,                    \
    PromiseSpeciesProtector)                                               \
  V(TypedArraySpeciesProtector, typed_array_species_protector,             \
    TypedArraySpeciesProtector)                                            \
  V(StoreHandler0Map, store_handler0_map, StoreHandler0Map)

38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87
#define HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)                              \
  V(AccessorInfoMap, accessor_info_map, AccessorInfoMap)                     \
  V(AccessorPairMap, accessor_pair_map, AccessorPairMap)                     \
  V(AllocationSiteWithWeakNextMap, allocation_site_map, AllocationSiteMap)   \
  V(AllocationSiteWithoutWeakNextMap, allocation_site_without_weaknext_map,  \
    AllocationSiteWithoutWeakNextMap)                                        \
  V(BooleanMap, boolean_map, BooleanMap)                                     \
  V(CodeMap, code_map, CodeMap)                                              \
  V(EmptyFixedArray, empty_fixed_array, EmptyFixedArray)                     \
  V(EmptySlowElementDictionary, empty_slow_element_dictionary,               \
    EmptySlowElementDictionary)                                              \
  V(empty_string, empty_string, EmptyString)                                 \
  V(FalseValue, false_value, False)                                          \
  V(FeedbackVectorMap, feedback_vector_map, FeedbackVectorMap)               \
  V(FixedArrayMap, fixed_array_map, FixedArrayMap)                           \
  V(FixedCOWArrayMap, fixed_cow_array_map, FixedCOWArrayMap)                 \
  V(FixedDoubleArrayMap, fixed_double_array_map, FixedDoubleArrayMap)        \
  V(FunctionTemplateInfoMap, function_template_info_map,                     \
    FunctionTemplateInfoMap)                                                 \
  V(GlobalPropertyCellMap, global_property_cell_map, PropertyCellMap)        \
  V(has_instance_symbol, has_instance_symbol, HasInstanceSymbol)             \
  V(HeapNumberMap, heap_number_map, HeapNumberMap)                           \
  V(iterator_symbol, iterator_symbol, IteratorSymbol)                        \
  V(length_string, length_string, LengthString)                              \
  V(ManyClosuresCellMap, many_closures_cell_map, ManyClosuresCellMap)        \
  V(MetaMap, meta_map, MetaMap)                                              \
  V(MinusZeroValue, minus_zero_value, MinusZero)                             \
  V(MutableHeapNumberMap, mutable_heap_number_map, MutableHeapNumberMap)     \
  V(NanValue, nan_value, Nan)                                                \
  V(NoClosuresCellMap, no_closures_cell_map, NoClosuresCellMap)              \
  V(NullValue, null_value, Null)                                             \
  V(OneClosureCellMap, one_closure_cell_map, OneClosureCellMap)              \
  V(PreParsedScopeDataMap, pre_parsed_scope_data_map, PreParsedScopeDataMap) \
  V(prototype_string, prototype_string, PrototypeString)                     \
  V(SharedFunctionInfoMap, shared_function_info_map, SharedFunctionInfoMap)  \
  V(SymbolMap, symbol_map, SymbolMap)                                        \
  V(TheHoleValue, the_hole_value, TheHole)                                   \
  V(TransitionArrayMap, transition_array_map, TransitionArrayMap)            \
  V(TrueValue, true_value, True)                                             \
  V(Tuple2Map, tuple2_map, Tuple2Map)                                        \
  V(Tuple3Map, tuple3_map, Tuple3Map)                                        \
  V(ArrayBoilerplateDescriptionMap, array_boilerplate_description_map,       \
    ArrayBoilerplateDescriptionMap)                                          \
  V(UncompiledDataWithoutPreParsedScopeMap,                                  \
    uncompiled_data_without_pre_parsed_scope_map,                            \
    UncompiledDataWithoutPreParsedScopeMap)                                  \
  V(UncompiledDataWithPreParsedScopeMap,                                     \
    uncompiled_data_with_pre_parsed_scope_map,                               \
    UncompiledDataWithPreParsedScopeMap)                                     \
  V(UndefinedValue, undefined_value, Undefined)                              \
88
  V(WeakFixedArrayMap, weak_fixed_array_map, WeakFixedArrayMap)
89

90 91 92 93
#define HEAP_IMMOVABLE_OBJECT_LIST(V)   \
  HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(V) \
  HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(V)

94 95 96 97 98 99 100 101 102 103 104
// Returned from IteratorBuiltinsAssembler::GetIterator(). Struct is declared
// here to simplify use in other generated builtins.
struct IteratorRecord {
 public:
  // iteratorRecord.[[Iterator]]
  compiler::TNode<JSReceiver> object;

  // iteratorRecord.[[NextMethod]]
  compiler::TNode<Object> next;
};

105
#ifdef DEBUG
106 107 108 109 110 111
#define CSA_CHECK(csa, x)                                        \
  (csa)->Check(                                                  \
      [&]() -> compiler::Node* {                                 \
        return implicit_cast<compiler::SloppyTNode<Word32T>>(x); \
      },                                                         \
      #x, __FILE__, __LINE__)
112 113 114
#else
#define CSA_CHECK(csa, x) (csa)->FastCheck(x)
#endif
115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159

#ifdef DEBUG
// Add stringified versions to the given values, except the first. That is,
// transform
//   x, a, b, c, d, e, f
// to
//   a, "a", b, "b", c, "c", d, "d", e, "e", f, "f"
//
// __VA_ARGS__  is ignored to allow the caller to pass through too many
// parameters, and the first element is ignored to support having no extra
// values without empty __VA_ARGS__ (which cause all sorts of problems with
// extra commas).
#define CSA_ASSERT_STRINGIFY_EXTRA_VALUES_5(_, v1, v2, v3, v4, v5, ...) \
  v1, #v1, v2, #v2, v3, #v3, v4, #v4, v5, #v5

// Stringify the given variable number of arguments. The arguments are trimmed
// to 5 if there are too many, and padded with nullptr if there are not enough.
#define CSA_ASSERT_STRINGIFY_EXTRA_VALUES(...)                                \
  CSA_ASSERT_STRINGIFY_EXTRA_VALUES_5(__VA_ARGS__, nullptr, nullptr, nullptr, \
                                      nullptr, nullptr)

#define CSA_ASSERT_GET_FIRST(x, ...) (x)
#define CSA_ASSERT_GET_FIRST_STR(x, ...) #x

// CSA_ASSERT(csa, <condition>, <extra values to print...>)

// We have to jump through some hoops to allow <extra values to print...> to be
// empty.
#define CSA_ASSERT(csa, ...)                                             \
  (csa)->Assert(                                                         \
      [&]() -> compiler::Node* {                                         \
        return implicit_cast<compiler::SloppyTNode<Word32T>>(            \
            EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)));                  \
      },                                                                 \
      EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, __LINE__, \
      CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))

// CSA_ASSERT_BRANCH(csa, [](Label* ok, Label* not_ok) {...},
//     <extra values to print...>)

#define CSA_ASSERT_BRANCH(csa, ...)                                      \
  (csa)->Assert(EXPAND(CSA_ASSERT_GET_FIRST(__VA_ARGS__)),               \
                EXPAND(CSA_ASSERT_GET_FIRST_STR(__VA_ARGS__)), __FILE__, \
                __LINE__, CSA_ASSERT_STRINGIFY_EXTRA_VALUES(__VA_ARGS__))

160 161 162 163 164 165 166 167 168
#define CSA_ASSERT_JS_ARGC_OP(csa, Op, op, expected)                       \
  (csa)->Assert(                                                           \
      [&]() -> compiler::Node* {                                           \
        compiler::Node* const argc =                                       \
            (csa)->Parameter(Descriptor::kJSActualArgumentsCount);         \
        return (csa)->Op(argc, (csa)->Int32Constant(expected));            \
      },                                                                   \
      "argc " #op " " #expected, __FILE__, __LINE__,                       \
      SmiFromInt32((csa)->Parameter(Descriptor::kJSActualArgumentsCount)), \
169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203
      "argc")

#define CSA_ASSERT_JS_ARGC_EQ(csa, expected) \
  CSA_ASSERT_JS_ARGC_OP(csa, Word32Equal, ==, expected)

#define CSA_DEBUG_INFO(name) \
  { #name, __FILE__, __LINE__ }
#define BIND(label) Bind(label, CSA_DEBUG_INFO(label))
#define VARIABLE(name, ...) \
  Variable name(this, CSA_DEBUG_INFO(name), __VA_ARGS__)
#define VARIABLE_CONSTRUCTOR(name, ...) \
  name(this, CSA_DEBUG_INFO(name), __VA_ARGS__)
#define TYPED_VARIABLE_DEF(type, name, ...) \
  TVariable<type> name(CSA_DEBUG_INFO(name), __VA_ARGS__)
#else  // DEBUG
#define CSA_ASSERT(csa, ...) ((void)0)
#define CSA_ASSERT_BRANCH(csa, ...) ((void)0)
#define CSA_ASSERT_JS_ARGC_EQ(csa, expected) ((void)0)
#define BIND(label) Bind(label)
#define VARIABLE(name, ...) Variable name(this, __VA_ARGS__)
#define VARIABLE_CONSTRUCTOR(name, ...) name(this, __VA_ARGS__)
#define TYPED_VARIABLE_DEF(type, name, ...) TVariable<type> name(__VA_ARGS__)
#endif  // DEBUG

#define TVARIABLE(...) EXPAND(TYPED_VARIABLE_DEF(__VA_ARGS__, this))

#ifdef ENABLE_SLOW_DCHECKS
#define CSA_SLOW_ASSERT(csa, ...) \
  if (FLAG_enable_slow_asserts) { \
    CSA_ASSERT(csa, __VA_ARGS__); \
  }
#else
#define CSA_SLOW_ASSERT(csa, ...) ((void)0)
#endif

204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
class int31_t {
 public:
  int31_t() : value_(0) {}
  int31_t(int value) : value_(value) {  // NOLINT(runtime/explicit)
    DCHECK_EQ((value & 0x80000000) != 0, (value & 0x40000000) != 0);
  }
  int31_t& operator=(int value) {
    DCHECK_EQ((value & 0x80000000) != 0, (value & 0x40000000) != 0);
    value_ = value;
    return *this;
  }
  int32_t value() const { return value_; }
  operator int32_t() const { return value_; }

 private:
  int32_t value_;
};

222 223 224 225 226
// Provides JavaScript-specific "macro-assembler" functionality on top of the
// CodeAssembler. By factoring the JavaScript-isms out of the CodeAssembler,
// it's possible to add JavaScript-specific useful CodeAssembler "macros"
// without modifying files in the compiler directory (and requiring a review
// from a compiler directory OWNER).
227
class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
228
 public:
229
  using Node = compiler::Node;
230 231 232 233
  template <class T>
  using TNode = compiler::TNode<T>;
  template <class T>
  using SloppyTNode = compiler::SloppyTNode<T>;
234

235 236 237
  template <typename T>
  using LazyNode = std::function<TNode<T>()>;

238
  CodeStubAssembler(compiler::CodeAssemblerState* state);
239

240 241 242
  enum AllocationFlag : uint8_t {
    kNone = 0,
    kDoubleAlignment = 1,
243 244
    kPretenured = 1 << 1,
    kAllowLargeObjectAllocation = 1 << 2,
245 246
  };

247 248
  enum SlackTrackingMode { kWithSlackTracking, kNoSlackTracking };

249 250
  typedef base::Flags<AllocationFlag> AllocationFlags;

251
  enum ParameterMode { SMI_PARAMETERS, INTPTR_PARAMETERS };
252

253 254 255 256 257 258 259 260 261 262
  // On 32-bit platforms, there is a slight performance advantage to doing all
  // of the array offset/index arithmetic with SMIs, since it's possible
  // to save a few tag/untag operations without paying an extra expense when
  // calculating array offset (the smi math can be folded away) and there are
  // fewer live ranges. Thus only convert indices to untagged value on 64-bit
  // platforms.
  ParameterMode OptimalParameterMode() const {
    return Is64() ? INTPTR_PARAMETERS : SMI_PARAMETERS;
  }

263 264 265 266 267
  MachineRepresentation ParameterRepresentation(ParameterMode mode) const {
    return mode == INTPTR_PARAMETERS ? MachineType::PointerRepresentation()
                                     : MachineRepresentation::kTaggedSigned;
  }

268
  MachineRepresentation OptimalParameterRepresentation() const {
269
    return ParameterRepresentation(OptimalParameterMode());
270 271
  }

272
  TNode<IntPtrT> ParameterToIntPtr(Node* value, ParameterMode mode) {
273
    if (mode == SMI_PARAMETERS) value = SmiUntag(value);
274
    return UncheckedCast<IntPtrT>(value);
275 276
  }

277
  Node* IntPtrToParameter(SloppyTNode<IntPtrT> value, ParameterMode mode) {
278
    if (mode == SMI_PARAMETERS) return SmiTag(value);
279 280 281
    return value;
  }

282 283
  Node* Int32ToParameter(SloppyTNode<Int32T> value, ParameterMode mode) {
    return IntPtrToParameter(ChangeInt32ToIntPtr(value), mode);
284 285
  }

286 287 288
  TNode<Smi> ParameterToTagged(Node* value, ParameterMode mode) {
    if (mode != SMI_PARAMETERS) return SmiTag(value);
    return UncheckedCast<Smi>(value);
289 290
  }

291 292
  Node* TaggedToParameter(SloppyTNode<Smi> value, ParameterMode mode) {
    if (mode != SMI_PARAMETERS) return SmiUntag(value);
293 294 295
    return value;
  }

296 297 298 299 300
  TNode<Smi> TaggedToSmi(TNode<Object> value, Label* fail) {
    GotoIf(TaggedIsNotSmi(value), fail);
    return UncheckedCast<Smi>(value);
  }

301 302 303 304 305
  TNode<Number> TaggedToNumber(TNode<Object> value, Label* fail) {
    GotoIfNot(IsNumber(value), fail);
    return UncheckedCast<Number>(value);
  }

306 307 308 309 310
  TNode<HeapObject> TaggedToHeapObject(TNode<Object> value, Label* fail) {
    GotoIf(TaggedIsSmi(value), fail);
    return UncheckedCast<HeapObject>(value);
  }

311 312
  TNode<JSArray> HeapObjectToJSArray(TNode<HeapObject> heap_object,
                                     Label* fail) {
313 314
    GotoIfNot(IsJSArray(heap_object), fail);
    return UncheckedCast<JSArray>(heap_object);
315 316
  }

317 318 319 320 321 322 323 324
  TNode<JSArray> TaggedToFastJSArray(TNode<Context> context,
                                     TNode<Object> value, Label* fail) {
    GotoIf(TaggedIsSmi(value), fail);
    TNode<HeapObject> heap_object = CAST(value);
    GotoIfNot(IsFastJSArray(heap_object, context), fail);
    return UncheckedCast<JSArray>(heap_object);
  }

325 326
  TNode<JSDataView> HeapObjectToJSDataView(TNode<HeapObject> heap_object,
                                           Label* fail) {
327
    GotoIfNot(IsJSDataView(heap_object), fail);
328
    return CAST(heap_object);
329 330
  }

331 332 333 334
  TNode<JSReceiver> HeapObjectToCallable(TNode<HeapObject> heap_object,
                                         Label* fail) {
    GotoIfNot(IsCallable(heap_object), fail);
    return CAST(heap_object);
335 336
  }

337 338 339 340
  TNode<HeapNumber> UnsafeCastNumberToHeapNumber(TNode<Number> p_n) {
    return CAST(p_n);
  }

341 342 343 344
  TNode<FixedArrayBase> UnsafeCastObjectToFixedArrayBase(TNode<Object> p_o) {
    return CAST(p_o);
  }

345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363 364 365 366 367 368 369 370 371 372 373 374 375 376 377 378 379 380 381 382
  TNode<FixedArray> UnsafeCastObjectToFixedArray(TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<FixedDoubleArray> UnsafeCastObjectToFixedDoubleArray(
      TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<HeapNumber> UnsafeCastObjectToHeapNumber(TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<HeapObject> UnsafeCastObjectToCallable(TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<Smi> UnsafeCastObjectToSmi(TNode<Object> p_o) { return CAST(p_o); }

  TNode<Number> UnsafeCastObjectToNumber(TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<HeapObject> UnsafeCastObjectToHeapObject(TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<JSArray> UnsafeCastObjectToJSArray(TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<FixedTypedArrayBase> UnsafeCastObjectToFixedTypedArrayBase(
      TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<Object> UnsafeCastObjectToCompareBuiltinFn(TNode<Object> p_o) {
    return p_o;
383 384 385 386 387 388
  }

  TNode<Object> UnsafeCastObjectToLoadFn(TNode<Object> p_o) { return p_o; }
  TNode<Object> UnsafeCastObjectToStoreFn(TNode<Object> p_o) { return p_o; }
  TNode<Object> UnsafeCastObjectToCanUseSameAccessorFn(TNode<Object> p_o) {
    return p_o;
389 390
  }

391 392 393 394 395 396 397 398 399 400 401 402 403
  TNode<NumberDictionary> UnsafeCastObjectToNumberDictionary(
      TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<JSReceiver> UnsafeCastObjectToJSReceiver(TNode<Object> p_o) {
    return CAST(p_o);
  }

  TNode<JSObject> UnsafeCastObjectToJSObject(TNode<Object> p_o) {
    return CAST(p_o);
  }

404 405
  TNode<Map> UnsafeCastObjectToMap(TNode<Object> p_o) { return CAST(p_o); }

jgruber's avatar
jgruber committed
406 407
  Node* MatchesParameterMode(Node* value, ParameterMode mode);

408 409 410
#define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName) \
  Node* OpName(Node* a, Node* b, ParameterMode mode) {   \
    if (mode == SMI_PARAMETERS) {                        \
411
      return SmiOpName(CAST(a), CAST(b));                \
412 413 414 415
    } else {                                             \
      DCHECK_EQ(INTPTR_PARAMETERS, mode);                \
      return IntPtrOpName(a, b);                         \
    }                                                    \
416
  }
417
  PARAMETER_BINOP(IntPtrOrSmiMin, IntPtrMin, SmiMin)
418
  PARAMETER_BINOP(IntPtrOrSmiAdd, IntPtrAdd, SmiAdd)
419
  PARAMETER_BINOP(IntPtrOrSmiSub, IntPtrSub, SmiSub)
420
  PARAMETER_BINOP(IntPtrOrSmiLessThan, IntPtrLessThan, SmiLessThan)
421 422
  PARAMETER_BINOP(IntPtrOrSmiLessThanOrEqual, IntPtrLessThanOrEqual,
                  SmiLessThanOrEqual)
423
  PARAMETER_BINOP(IntPtrOrSmiGreaterThan, IntPtrGreaterThan, SmiGreaterThan)
424
  PARAMETER_BINOP(IntPtrOrSmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual,
425 426
                  SmiGreaterThanOrEqual)
  PARAMETER_BINOP(UintPtrOrSmiLessThan, UintPtrLessThan, SmiBelow)
427
  PARAMETER_BINOP(UintPtrOrSmiGreaterThanOrEqual, UintPtrGreaterThanOrEqual,
428
                  SmiAboveOrEqual)
429
#undef PARAMETER_BINOP
430

431
  TNode<Object> NoContextConstant();
432 433 434 435 436 437 438 439

#define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name) \
  compiler::TNode<std::remove_reference<decltype(                     \
      *std::declval<ReadOnlyRoots>().rootAccessorName())>::type>      \
      name##Constant();
  HEAP_IMMUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
#undef HEAP_CONSTANT_ACCESSOR

440 441 442 443
#define HEAP_CONSTANT_ACCESSOR(rootIndexName, rootAccessorName, name) \
  compiler::TNode<std::remove_reference<decltype(                     \
      *std::declval<Heap>().rootAccessorName())>::type>               \
      name##Constant();
444
  HEAP_MUTABLE_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_ACCESSOR)
445 446
#undef HEAP_CONSTANT_ACCESSOR

447 448 449
#define HEAP_CONSTANT_TEST(rootIndexName, rootAccessorName, name) \
  TNode<BoolT> Is##name(SloppyTNode<Object> value);               \
  TNode<BoolT> IsNot##name(SloppyTNode<Object> value);
450
  HEAP_IMMOVABLE_OBJECT_LIST(HEAP_CONSTANT_TEST)
451 452
#undef HEAP_CONSTANT_TEST

Yang Guo's avatar
Yang Guo committed
453 454 455
  TNode<Int64T> HashSeed();
  TNode<Int32T> HashSeedHigh();
  TNode<Int32T> HashSeedLow();
456

457
  Node* IntPtrOrSmiConstant(int value, ParameterMode mode);
458 459 460
  TNode<Smi> LanguageModeConstant(LanguageMode mode) {
    return SmiConstant(static_cast<int>(mode));
  }
461

462 463 464
  bool IsIntPtrOrSmiConstantZero(Node* test, ParameterMode mode);
  bool TryGetIntPtrOrSmiConstantValue(Node* maybe_constant, int* value,
                                      ParameterMode mode);
465

466
  // Round the 32bits payload of the provided word up to the next power of two.
467
  TNode<IntPtrT> IntPtrRoundUpToPowerOfTwo32(TNode<IntPtrT> value);
468
  // Select the maximum of the two provided IntPtr values.
469 470
  TNode<IntPtrT> IntPtrMax(SloppyTNode<IntPtrT> left,
                           SloppyTNode<IntPtrT> right);
471
  // Select the minimum of the two provided IntPtr values.
472 473
  TNode<IntPtrT> IntPtrMin(SloppyTNode<IntPtrT> left,
                           SloppyTNode<IntPtrT> right);
474

475
  // Float64 operations.
476 477 478 479 480
  TNode<Float64T> Float64Ceil(SloppyTNode<Float64T> x);
  TNode<Float64T> Float64Floor(SloppyTNode<Float64T> x);
  TNode<Float64T> Float64Round(SloppyTNode<Float64T> x);
  TNode<Float64T> Float64RoundToEven(SloppyTNode<Float64T> x);
  TNode<Float64T> Float64Trunc(SloppyTNode<Float64T> x);
481 482 483 484
  // Select the minimum of the two provided Number values.
  TNode<Object> NumberMax(SloppyTNode<Object> left, SloppyTNode<Object> right);
  // Select the minimum of the two provided Number values.
  TNode<Object> NumberMin(SloppyTNode<Object> left, SloppyTNode<Object> right);
485

486 487
  // After converting an index to an integer, calculate a relative index: if
  // index < 0, max(length + index, 0); else min(index, length)
488 489 490
  TNode<IntPtrT> ConvertToRelativeIndex(TNode<Context> context,
                                        TNode<Object> index,
                                        TNode<IntPtrT> length);
491

492 493 494
  // Returns true iff the given value fits into smi range and is >= 0.
  TNode<BoolT> IsValidPositiveSmi(TNode<IntPtrT> value);

495
  // Tag an IntPtr as a Smi value.
496
  TNode<Smi> SmiTag(SloppyTNode<IntPtrT> value);
497
  // Untag a Smi value as an IntPtr.
498
  TNode<IntPtrT> SmiUntag(SloppyTNode<Smi> value);
499

500
  // Smi conversions.
501
  TNode<Float64T> SmiToFloat64(SloppyTNode<Smi> value);
502 503 504 505
  TNode<Smi> SmiFromIntPtr(SloppyTNode<IntPtrT> value) { return SmiTag(value); }
  TNode<Smi> SmiFromInt32(SloppyTNode<Int32T> value);
  TNode<IntPtrT> SmiToIntPtr(SloppyTNode<Smi> value) { return SmiUntag(value); }
  TNode<Int32T> SmiToInt32(SloppyTNode<Smi> value);
506 507

  // Smi operations.
508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527
#define SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName, Int32OpName)       \
  TNode<Smi> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                     \
    if (SmiValuesAre32Bits()) {                                          \
      return BitcastWordToTaggedSigned(                                  \
          IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b))); \
    } else {                                                             \
      DCHECK(SmiValuesAre31Bits());                                      \
      if (kPointerSize == kInt64Size) {                                  \
        CSA_ASSERT(this, IsValidSmi(a));                                 \
        CSA_ASSERT(this, IsValidSmi(b));                                 \
      }                                                                  \
      return BitcastWordToTaggedSigned(ChangeInt32ToIntPtr(              \
          Int32OpName(TruncateIntPtrToInt32(BitcastTaggedToWord(a)),     \
                      TruncateIntPtrToInt32(BitcastTaggedToWord(b)))));  \
    }                                                                    \
  }
  SMI_ARITHMETIC_BINOP(SmiAdd, IntPtrAdd, Int32Add)
  SMI_ARITHMETIC_BINOP(SmiSub, IntPtrSub, Int32Sub)
  SMI_ARITHMETIC_BINOP(SmiAnd, WordAnd, Word32And)
  SMI_ARITHMETIC_BINOP(SmiOr, WordOr, Word32Or)
528
#undef SMI_ARITHMETIC_BINOP
529
  TNode<Smi> SmiInc(TNode<Smi> value) { return SmiAdd(value, SmiConstant(1)); }
530

531 532 533
  TNode<Smi> TrySmiAdd(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
  TNode<Smi> TrySmiSub(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);

534
  TNode<Smi> SmiShl(TNode<Smi> a, int shift) {
535 536
    return BitcastWordToTaggedSigned(WordShl(BitcastTaggedToWord(a), shift));
  }
537

538
  TNode<Smi> SmiShr(TNode<Smi> a, int shift) {
539 540 541 542 543 544 545
    return BitcastWordToTaggedSigned(
        WordAnd(WordShr(BitcastTaggedToWord(a), shift),
                BitcastTaggedToWord(SmiConstant(-1))));
  }

  Node* WordOrSmiShl(Node* a, int shift, ParameterMode mode) {
    if (mode == SMI_PARAMETERS) {
546
      return SmiShl(CAST(a), shift);
547 548 549 550 551 552 553 554
    } else {
      DCHECK_EQ(INTPTR_PARAMETERS, mode);
      return WordShl(a, shift);
    }
  }

  Node* WordOrSmiShr(Node* a, int shift, ParameterMode mode) {
    if (mode == SMI_PARAMETERS) {
555
      return SmiShr(CAST(a), shift);
556 557 558 559 560
    } else {
      DCHECK_EQ(INTPTR_PARAMETERS, mode);
      return WordShr(a, shift);
    }
  }
561

562 563 564 565 566 567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585 586 587
#define SMI_COMPARISON_OP(SmiOpName, IntPtrOpName, Int32OpName)            \
  TNode<BoolT> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                     \
    if (SmiValuesAre32Bits()) {                                            \
      return IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b)); \
    } else {                                                               \
      DCHECK(SmiValuesAre31Bits());                                        \
      if (kPointerSize == kInt64Size) {                                    \
        CSA_ASSERT(this, IsValidSmi(a));                                   \
        CSA_ASSERT(this, IsValidSmi(b));                                   \
      }                                                                    \
      return Int32OpName(TruncateIntPtrToInt32(BitcastTaggedToWord(a)),    \
                         TruncateIntPtrToInt32(BitcastTaggedToWord(b)));   \
    }                                                                      \
  }
  SMI_COMPARISON_OP(SmiEqual, WordEqual, Word32Equal)
  SMI_COMPARISON_OP(SmiNotEqual, WordNotEqual, Word32NotEqual)
  SMI_COMPARISON_OP(SmiAbove, UintPtrGreaterThan, Uint32GreaterThan)
  SMI_COMPARISON_OP(SmiAboveOrEqual, UintPtrGreaterThanOrEqual,
                    Uint32GreaterThanOrEqual)
  SMI_COMPARISON_OP(SmiBelow, UintPtrLessThan, Uint32LessThan)
  SMI_COMPARISON_OP(SmiLessThan, IntPtrLessThan, Int32LessThan)
  SMI_COMPARISON_OP(SmiLessThanOrEqual, IntPtrLessThanOrEqual,
                    Int32LessThanOrEqual)
  SMI_COMPARISON_OP(SmiGreaterThan, IntPtrGreaterThan, Int32GreaterThan)
  SMI_COMPARISON_OP(SmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual,
                    Int32GreaterThanOrEqual)
588
#undef SMI_COMPARISON_OP
589 590
  TNode<Smi> SmiMax(TNode<Smi> a, TNode<Smi> b);
  TNode<Smi> SmiMin(TNode<Smi> a, TNode<Smi> b);
591
  // Computes a % b for Smi inputs a and b; result is not necessarily a Smi.
592
  TNode<Number> SmiMod(TNode<Smi> a, TNode<Smi> b);
593
  // Computes a * b for Smi inputs a and b; result is not necessarily a Smi.
594 595
  TNode<Number> SmiMul(TNode<Smi> a, TNode<Smi> b);
  // Tries to compute dividend / divisor for Smi inputs; branching to bailout
596
  // if the division needs to be performed as a floating point operation.
597
  TNode<Smi> TrySmiDiv(TNode<Smi> dividend, TNode<Smi> divisor, Label* bailout);
598

599 600 601 602 603 604 605
  // Compares two Smis a and b as if they were converted to strings and then
  // compared lexicographically. Returns:
  // -1 iff x < y.
  //  0 iff x == y.
  //  1 iff x > y.
  TNode<Smi> SmiLexicographicCompare(TNode<Smi> x, TNode<Smi> y);

606
  // Smi | HeapNumber operations.
607 608 609 610
  TNode<Number> NumberInc(SloppyTNode<Number> value);
  TNode<Number> NumberDec(SloppyTNode<Number> value);
  TNode<Number> NumberAdd(SloppyTNode<Number> a, SloppyTNode<Number> b);
  TNode<Number> NumberSub(SloppyTNode<Number> a, SloppyTNode<Number> b);
611 612
  void GotoIfNotNumber(Node* value, Label* is_not_number);
  void GotoIfNumber(Node* value, Label* is_number);
613
  TNode<Number> SmiToNumber(TNode<Smi> v) { return v; }
614

615
  TNode<Number> BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
616

617
  // Allocate an object of the given size.
618 619
  Node* AllocateInNewSpace(Node* size, AllocationFlags flags = kNone);
  Node* AllocateInNewSpace(int size, AllocationFlags flags = kNone);
620 621 622 623 624 625
  Node* Allocate(Node* size, AllocationFlags flags = kNone);
  Node* Allocate(int size, AllocationFlags flags = kNone);
  Node* InnerAllocate(Node* previous, int offset);
  Node* InnerAllocate(Node* previous, Node* offset);
  Node* IsRegularHeapObjectSize(Node* size);

626
  typedef std::function<void(Label*, Label*)> BranchGenerator;
627 628
  typedef std::function<Node*()> NodeGenerator;

629 630 631 632 633 634 635
  void Assert(const BranchGenerator& branch, const char* message = nullptr,
              const char* file = nullptr, int line = 0,
              Node* extra_node1 = nullptr, const char* extra_node1_name = "",
              Node* extra_node2 = nullptr, const char* extra_node2_name = "",
              Node* extra_node3 = nullptr, const char* extra_node3_name = "",
              Node* extra_node4 = nullptr, const char* extra_node4_name = "",
              Node* extra_node5 = nullptr, const char* extra_node5_name = "");
636 637 638 639 640 641 642 643
  void Assert(const NodeGenerator& condition_body,
              const char* message = nullptr, const char* file = nullptr,
              int line = 0, Node* extra_node1 = nullptr,
              const char* extra_node1_name = "", Node* extra_node2 = nullptr,
              const char* extra_node2_name = "", Node* extra_node3 = nullptr,
              const char* extra_node3_name = "", Node* extra_node4 = nullptr,
              const char* extra_node4_name = "", Node* extra_node5 = nullptr,
              const char* extra_node5_name = "");
644 645 646 647 648 649 650
  void Check(const BranchGenerator& branch, const char* message = nullptr,
             const char* file = nullptr, int line = 0,
             Node* extra_node1 = nullptr, const char* extra_node1_name = "",
             Node* extra_node2 = nullptr, const char* extra_node2_name = "",
             Node* extra_node3 = nullptr, const char* extra_node3_name = "",
             Node* extra_node4 = nullptr, const char* extra_node4_name = "",
             Node* extra_node5 = nullptr, const char* extra_node5_name = "");
651 652 653 654 655 656 657
  void Check(const NodeGenerator& condition_body, const char* message = nullptr,
             const char* file = nullptr, int line = 0,
             Node* extra_node1 = nullptr, const char* extra_node1_name = "",
             Node* extra_node2 = nullptr, const char* extra_node2_name = "",
             Node* extra_node3 = nullptr, const char* extra_node3_name = "",
             Node* extra_node4 = nullptr, const char* extra_node4_name = "",
             Node* extra_node5 = nullptr, const char* extra_node5_name = "");
658
  void FastCheck(TNode<BoolT> condition);
659

660 661 662 663 664 665 666 667 668 669 670 671 672
  // The following Call wrappers call an object according to the semantics that
  // one finds in the EcmaScript spec, operating on an Callable (e.g. a
  // JSFunction or proxy) rather than a Code object.
  template <class... TArgs>
  TNode<Object> Call(TNode<Context> context, TNode<Object> callable,
                     TNode<JSReceiver> receiver, TArgs... args) {
    return UncheckedCast<Object>(CallJS(
        CodeFactory::Call(isolate(), ConvertReceiverMode::kNotNullOrUndefined),
        context, callable, receiver, args...));
  }
  template <class... TArgs>
  TNode<Object> Call(TNode<Context> context, TNode<Object> callable,
                     TNode<Object> receiver, TArgs... args) {
673 674 675 676 677
    if (IsUndefinedConstant(receiver) || IsNullConstant(receiver)) {
      return UncheckedCast<Object>(CallJS(
          CodeFactory::Call(isolate(), ConvertReceiverMode::kNullOrUndefined),
          context, callable, receiver, args...));
    }
678 679 680 681
    return UncheckedCast<Object>(CallJS(CodeFactory::Call(isolate()), context,
                                        callable, receiver, args...));
  }

682 683
  template <class A, class F, class G>
  TNode<A> Select(SloppyTNode<BoolT> condition, const F& true_body,
684 685
                  const G& false_body) {
    return UncheckedCast<A>(SelectImpl(
686
        condition,
687 688
        [&]() -> Node* { return implicit_cast<TNode<A>>(true_body()); },
        [&]() -> Node* { return implicit_cast<TNode<A>>(false_body()); },
689
        MachineRepresentationOf<A>::value));
690
  }
691

692 693
  template <class A>
  TNode<A> SelectConstant(TNode<BoolT> condition, TNode<A> true_value,
694 695 696
                          TNode<A> false_value) {
    return Select<A>(condition, [=] { return true_value; },
                     [=] { return false_value; });
697
  }
698

699 700 701 702 703 704 705 706 707
  TNode<Int32T> SelectInt32Constant(SloppyTNode<BoolT> condition,
                                    int true_value, int false_value);
  TNode<IntPtrT> SelectIntPtrConstant(SloppyTNode<BoolT> condition,
                                      int true_value, int false_value);
  TNode<Oddball> SelectBooleanConstant(SloppyTNode<BoolT> condition);
  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, Smi* true_value,
                               Smi* false_value);
  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, int true_value,
                               Smi* false_value) {
708 709
    return SelectSmiConstant(condition, Smi::FromInt(true_value), false_value);
  }
710 711
  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, Smi* true_value,
                               int false_value) {
712 713
    return SelectSmiConstant(condition, true_value, Smi::FromInt(false_value));
  }
714 715
  TNode<Smi> SelectSmiConstant(SloppyTNode<BoolT> condition, int true_value,
                               int false_value) {
716 717 718
    return SelectSmiConstant(condition, Smi::FromInt(true_value),
                             Smi::FromInt(false_value));
  }
719

720
  TNode<Int32T> TruncateIntPtrToInt32(SloppyTNode<IntPtrT> value);
721

722
  // Check a value for smi-ness
723
  TNode<BoolT> TaggedIsSmi(SloppyTNode<Object> a);
724
  TNode<BoolT> TaggedIsSmi(TNode<MaybeObject> a);
725
  TNode<BoolT> TaggedIsNotSmi(SloppyTNode<Object> a);
726
  // Check that the value is a non-negative smi.
727
  TNode<BoolT> TaggedIsPositiveSmi(SloppyTNode<Object> a);
728
  // Check that a word has a word-aligned address.
729 730
  TNode<BoolT> WordIsWordAligned(SloppyTNode<WordT> word);
  TNode<BoolT> WordIsPowerOfTwo(SloppyTNode<IntPtrT> value);
731

732 733 734 735 736 737
#if DEBUG
  void Bind(Label* label, AssemblerDebugInfo debug_info);
#else
  void Bind(Label* label);
#endif  // DEBUG

738 739
  void BranchIfSmiEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
                        Label* if_false) {
740
    Branch(SmiEqual(a, b), if_true, if_false);
741 742
  }

743 744
  void BranchIfSmiLessThan(TNode<Smi> a, TNode<Smi> b, Label* if_true,
                           Label* if_false) {
745
    Branch(SmiLessThan(a, b), if_true, if_false);
746 747
  }

748
  void BranchIfSmiLessThanOrEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
749
                                  Label* if_false) {
750
    Branch(SmiLessThanOrEqual(a, b), if_true, if_false);
751 752
  }

753
  void BranchIfFloat64IsNaN(Node* value, Label* if_true, Label* if_false) {
754
    Branch(Float64Equal(value, value), if_false, if_true);
755 756
  }

757 758
  // Branches to {if_true} if ToBoolean applied to {value} yields true,
  // otherwise goes to {if_false}.
759
  void BranchIfToBooleanIsTrue(Node* value, Label* if_true, Label* if_false);
760

761
  void BranchIfJSReceiver(Node* object, Label* if_true, Label* if_false);
762

763
  void BranchIfFastJSArray(Node* object, Node* context, Label* if_true,
764
                           Label* if_false, bool iteration_only = false);
765 766 767 768
  void BranchIfNotFastJSArray(Node* object, Node* context, Label* if_true,
                              Label* if_false) {
    BranchIfFastJSArray(object, context, if_false, if_true);
  }
769 770
  void BranchIfFastJSArrayForCopy(Node* object, Node* context, Label* if_true,
                                  Label* if_false);
771

772 773 774 775
  // Branches to {if_true} when --force-slow-path flag has been passed.
  // It's used for testing to ensure that slow path implementation behave
  // equivalent to corresponding fast paths (where applicable).
  //
776
  // Works only with V8_ENABLE_FORCE_SLOW_PATH compile time flag. Nop otherwise.
777 778
  void GotoIfForceSlowPath(Label* if_true);

779 780 781
  // Branches to {if_true} when Debug::ExecutionMode is DebugInfo::kSideEffect.
  void GotoIfDebugExecutionModeChecksSideEffects(Label* if_true);

782
  // Load value from current frame by given offset in bytes.
783
  Node* LoadFromFrame(int offset, MachineType rep = MachineType::AnyTagged());
784
  // Load value from current parent frame by given offset in bytes.
785 786
  Node* LoadFromParentFrame(int offset,
                            MachineType rep = MachineType::AnyTagged());
787

788 789 790 791 792 793 794 795
  // Load target function from the current JS frame.
  // This is an alternative way of getting the target function in addition to
  // Parameter(Descriptor::kJSTarget). The latter should be used near the
  // beginning of builtin code while the target value is still in the register
  // and the former should be used in slow paths in order to reduce register
  // pressure on the fast path.
  TNode<JSFunction> LoadTargetFromFrame();

796
  // Load an object pointer from a buffer that isn't in the heap.
797 798
  Node* LoadBufferObject(Node* buffer, int offset,
                         MachineType rep = MachineType::AnyTagged());
799
  // Load a field from an object on the heap.
800 801
  Node* LoadObjectField(SloppyTNode<HeapObject> object, int offset,
                        MachineType rep);
802 803 804 805 806 807 808 809 810 811 812 813 814
  template <class T, typename std::enable_if<
                         std::is_convertible<TNode<T>, TNode<Object>>::value,
                         int>::type = 0>
  TNode<T> LoadObjectField(TNode<HeapObject> object, int offset) {
    return CAST(LoadObjectField(object, offset, MachineTypeOf<T>::value));
  }
  template <class T, typename std::enable_if<
                         std::is_convertible<TNode<T>, TNode<UntaggedT>>::value,
                         int>::type = 0>
  TNode<T> LoadObjectField(TNode<HeapObject> object, int offset) {
    return UncheckedCast<T>(
        LoadObjectField(object, offset, MachineTypeOf<T>::value));
  }
815 816 817 818 819 820 821 822 823 824 825
  TNode<Object> LoadObjectField(SloppyTNode<HeapObject> object, int offset) {
    return UncheckedCast<Object>(
        LoadObjectField(object, offset, MachineType::AnyTagged()));
  }
  Node* LoadObjectField(SloppyTNode<HeapObject> object,
                        SloppyTNode<IntPtrT> offset, MachineType rep);
  TNode<Object> LoadObjectField(SloppyTNode<HeapObject> object,
                                SloppyTNode<IntPtrT> offset) {
    return UncheckedCast<Object>(
        LoadObjectField(object, offset, MachineType::AnyTagged()));
  }
826
  // Load a SMI field and untag it.
827 828
  TNode<IntPtrT> LoadAndUntagObjectField(SloppyTNode<HeapObject> object,
                                         int offset);
829
  // Load a SMI field, untag it, and convert to Word32.
830
  TNode<Int32T> LoadAndUntagToWord32ObjectField(Node* object, int offset);
831
  // Load a SMI and untag it.
832
  TNode<IntPtrT> LoadAndUntagSmi(Node* base, int index);
833
  // Load a SMI root, untag it, and convert to Word32.
834
  TNode<Int32T> LoadAndUntagToWord32Root(RootIndex root_index);
835

836 837 838 839 840 841
  TNode<MaybeObject> LoadMaybeWeakObjectField(SloppyTNode<HeapObject> object,
                                              int offset) {
    return UncheckedCast<MaybeObject>(
        LoadObjectField(object, offset, MachineType::AnyTagged()));
  }

842 843 844
  // Tag a smi and store it.
  Node* StoreAndTagSmi(Node* base, int offset, Node* value);

845
  // Load the floating point value of a HeapNumber.
846
  TNode<Float64T> LoadHeapNumberValue(SloppyTNode<HeapNumber> object);
847
  // Load the Map of an HeapObject.
848
  TNode<Map> LoadMap(SloppyTNode<HeapObject> object);
849
  // Load the instance type of an HeapObject.
850
  TNode<Int32T> LoadInstanceType(SloppyTNode<HeapObject> object);
851
  // Compare the instance the type of the object against the provided one.
852 853 854 855 856 857
  TNode<BoolT> HasInstanceType(SloppyTNode<HeapObject> object,
                               InstanceType type);
  TNode<BoolT> DoesntHaveInstanceType(SloppyTNode<HeapObject> object,
                                      InstanceType type);
  TNode<BoolT> TaggedDoesntHaveInstanceType(SloppyTNode<HeapObject> any_tagged,
                                            InstanceType type);
858
  // Load the properties backing store of a JSObject.
859 860
  TNode<HeapObject> LoadSlowProperties(SloppyTNode<JSObject> object);
  TNode<HeapObject> LoadFastProperties(SloppyTNode<JSObject> object);
861
  // Load the elements backing store of a JSObject.
862
  TNode<FixedArrayBase> LoadElements(SloppyTNode<JSObject> object);
863
  // Load the length of a JSArray instance.
864
  TNode<Number> LoadJSArrayLength(SloppyTNode<JSArray> array);
865 866
  // Load the length of a fast JSArray instance. Returns a positive Smi.
  TNode<Smi> LoadFastJSArrayLength(SloppyTNode<JSArray> array);
867
  // Load the length of a fixed array base instance.
868
  TNode<Smi> LoadFixedArrayBaseLength(SloppyTNode<FixedArrayBase> array);
869
  // Load the length of a fixed array base instance.
870 871
  TNode<IntPtrT> LoadAndUntagFixedArrayBaseLength(
      SloppyTNode<FixedArrayBase> array);
872
  // Load the length of a WeakFixedArray.
873
  TNode<Smi> LoadWeakFixedArrayLength(TNode<WeakFixedArray> array);
874 875
  TNode<IntPtrT> LoadAndUntagWeakFixedArrayLength(
      SloppyTNode<WeakFixedArray> array);
876
  // Load the bit field of a Map.
877
  TNode<Int32T> LoadMapBitField(SloppyTNode<Map> map);
878
  // Load bit field 2 of a map.
879
  TNode<Int32T> LoadMapBitField2(SloppyTNode<Map> map);
880
  // Load bit field 3 of a map.
881
  TNode<Uint32T> LoadMapBitField3(SloppyTNode<Map> map);
882
  // Load the instance type of a map.
883
  TNode<Int32T> LoadMapInstanceType(SloppyTNode<Map> map);
884
  // Load the ElementsKind of a map.
885
  TNode<Int32T> LoadMapElementsKind(SloppyTNode<Map> map);
886
  TNode<Int32T> LoadElementsKind(SloppyTNode<HeapObject> map);
887
  // Load the instance descriptors of a map.
888
  TNode<DescriptorArray> LoadMapDescriptors(SloppyTNode<Map> map);
889
  // Load the prototype of a map.
890
  TNode<HeapObject> LoadMapPrototype(SloppyTNode<Map> map);
891 892
  // Load the prototype info of a map. The result has to be checked if it is a
  // prototype info object or not.
893 894
  TNode<PrototypeInfo> LoadMapPrototypeInfo(SloppyTNode<Map> map,
                                            Label* if_has_no_proto_info);
895
  // Load the instance size of a Map.
896 897 898
  TNode<IntPtrT> LoadMapInstanceSizeInWords(SloppyTNode<Map> map);
  // Load the inobject properties start of a Map (valid only for JSObjects).
  TNode<IntPtrT> LoadMapInobjectPropertiesStartInWords(SloppyTNode<Map> map);
899
  // Load the constructor function index of a Map (only for primitive maps).
900 901 902
  TNode<IntPtrT> LoadMapConstructorFunctionIndex(SloppyTNode<Map> map);
  // Load the constructor of a Map (equivalent to Map::GetConstructor()).
  TNode<Object> LoadMapConstructor(SloppyTNode<Map> map);
903 904
  // Load the EnumLength of a Map.
  Node* LoadMapEnumLength(SloppyTNode<Map> map);
905
  // Load the back-pointer of a Map.
906
  TNode<Object> LoadMapBackPointer(SloppyTNode<Map> map);
907 908 909 910
  // Checks that |map| has only simple properties, returns bitfield3.
  TNode<Uint32T> EnsureOnlyHasSimpleProperties(TNode<Map> map,
                                               TNode<Int32T> instance_type,
                                               Label* bailout);
911 912 913
  // Load the identity hash of a JSRececiver.
  TNode<IntPtrT> LoadJSReceiverIdentityHash(SloppyTNode<Object> receiver,
                                            Label* if_no_hash = nullptr);
914

915 916 917 918 919
  // This is only used on a newly allocated PropertyArray which
  // doesn't have an existing hash.
  void InitializePropertyArrayLength(Node* property_array, Node* length,
                                     ParameterMode mode);

920
  // Check if the map is set for slow properties.
921
  TNode<BoolT> IsDictionaryMap(SloppyTNode<Map> map);
922

923
  // Load the hash field of a name as an uint32 value.
924
  TNode<Uint32T> LoadNameHashField(SloppyTNode<Name> name);
925 926 927
  // Load the hash value of a name as an uint32 value.
  // If {if_hash_not_computed} label is specified then it also checks if
  // hash is actually computed.
928 929
  TNode<Uint32T> LoadNameHash(SloppyTNode<Name> name,
                              Label* if_hash_not_computed = nullptr);
930

931
  // Load length field of a String object as Smi value.
932 933 934 935 936
  TNode<Smi> LoadStringLengthAsSmi(SloppyTNode<String> string);
  // Load length field of a String object as intptr_t value.
  TNode<IntPtrT> LoadStringLengthAsWord(SloppyTNode<String> string);
  // Load length field of a String object as uint32_t value.
  TNode<Uint32T> LoadStringLengthAsWord32(SloppyTNode<String> string);
937 938
  // Loads a pointer to the sequential String char array.
  Node* PointerToSeqStringData(Node* seq_string);
939
  // Load value field of a JSValue object.
940
  Node* LoadJSValueValue(Node* object);
941

942 943 944 945 946 947 948 949
  // Figures out whether the value of maybe_object is:
  // - a SMI (jump to "if_smi", "extracted" will be the SMI value)
  // - a cleared weak reference (jump to "if_cleared", "extracted" will be
  // untouched)
  // - a weak reference (jump to "if_weak", "extracted" will be the object
  // pointed to)
  // - a strong reference (jump to "if_strong", "extracted" will be the object
  // pointed to)
950 951 952
  void DispatchMaybeObject(TNode<MaybeObject> maybe_object, Label* if_smi,
                           Label* if_cleared, Label* if_weak, Label* if_strong,
                           TVariable<Object>* extracted);
953
  // See MaybeObject for semantics of these functions.
954
  TNode<BoolT> IsStrongHeapObject(TNode<MaybeObject> value);
955 956 957 958
  // This variant is for overzealous checking.
  TNode<BoolT> IsStrongHeapObject(TNode<Object> value) {
    return IsStrongHeapObject(ReinterpretCast<MaybeObject>(value));
  }
959 960
  TNode<HeapObject> ToStrongHeapObject(TNode<MaybeObject> value,
                                       Label* if_not_strong);
961 962 963 964 965 966 967 968

  TNode<BoolT> IsWeakOrClearedHeapObject(TNode<MaybeObject> value);
  TNode<BoolT> IsClearedWeakHeapObject(TNode<MaybeObject> value);
  TNode<BoolT> IsNotClearedWeakHeapObject(TNode<MaybeObject> value);

  // Removes the weak bit + asserts it was set.
  TNode<HeapObject> ToWeakHeapObject(TNode<MaybeObject> value);

969 970 971
  TNode<HeapObject> ToWeakHeapObject(TNode<MaybeObject> value,
                                     Label* if_cleared);

972 973 974 975
  TNode<BoolT> IsWeakReferenceTo(TNode<MaybeObject> object,
                                 TNode<Object> value);
  TNode<BoolT> IsNotWeakReferenceTo(TNode<MaybeObject> object,
                                    TNode<Object> value);
976 977
  TNode<BoolT> IsStrongReferenceTo(TNode<MaybeObject> object,
                                   TNode<Object> value);
978 979

  TNode<MaybeObject> MakeWeak(TNode<HeapObject> value);
980

981
  void FixedArrayBoundsCheck(TNode<FixedArrayBase> array, Node* index,
982 983 984
                             int additional_offset = 0,
                             ParameterMode parameter_mode = INTPTR_PARAMETERS);

985
  // Load an array element from a FixedArray / WeakFixedArray / PropertyArray.
986
  TNode<MaybeObject> LoadArrayElement(
987
      SloppyTNode<HeapObject> object, int array_header_size, Node* index,
988 989 990
      int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS,
      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
991

992
  // Load an array element from a FixedArray.
993
  TNode<Object> LoadFixedArrayElement(
994
      TNode<FixedArray> object, Node* index, int additional_offset = 0,
995 996
      ParameterMode parameter_mode = INTPTR_PARAMETERS,
      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
997

998
  TNode<Object> LoadFixedArrayElement(TNode<FixedArray> object,
999 1000
                                      TNode<IntPtrT> index,
                                      LoadSensitivity needs_poisoning) {
1001 1002 1003
    return LoadFixedArrayElement(object, index, 0, INTPTR_PARAMETERS,
                                 needs_poisoning);
  }
1004 1005

  TNode<Object> LoadFixedArrayElement(
1006
      TNode<FixedArray> object, TNode<IntPtrT> index, int additional_offset = 0,
1007 1008 1009 1010 1011 1012
      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
    return LoadFixedArrayElement(object, index, additional_offset,
                                 INTPTR_PARAMETERS, needs_poisoning);
  }

  TNode<Object> LoadFixedArrayElement(
1013
      TNode<FixedArray> object, int index, int additional_offset = 0,
1014
      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
1015
    return LoadFixedArrayElement(object, IntPtrConstant(index),
1016 1017
                                 additional_offset, INTPTR_PARAMETERS,
                                 needs_poisoning);
1018
  }
1019
  TNode<Object> LoadFixedArrayElement(TNode<FixedArray> object,
1020
                                      TNode<Smi> index) {
1021 1022
    return LoadFixedArrayElement(object, index, 0, SMI_PARAMETERS);
  }
1023

1024 1025
  TNode<Object> LoadPropertyArrayElement(SloppyTNode<PropertyArray> object,
                                         SloppyTNode<IntPtrT> index);
1026
  TNode<IntPtrT> LoadPropertyArrayLength(TNode<PropertyArray> object);
1027

1028 1029 1030
  // Load an array element from a FixedArray / WeakFixedArray, untag it and
  // return it as Word32.
  TNode<Int32T> LoadAndUntagToWord32ArrayElement(
1031
      SloppyTNode<HeapObject> object, int array_header_size, Node* index,
1032 1033 1034
      int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS);

1035
  // Load an array element from a FixedArray, untag it and return it as Word32.
1036
  TNode<Int32T> LoadAndUntagToWord32FixedArrayElement(
1037
      SloppyTNode<HeapObject> object, Node* index, int additional_offset = 0,
1038
      ParameterMode parameter_mode = INTPTR_PARAMETERS);
1039 1040

  TNode<Int32T> LoadAndUntagToWord32FixedArrayElement(
1041
      SloppyTNode<HeapObject> object, int index, int additional_offset = 0) {
1042 1043 1044 1045
    return LoadAndUntagToWord32FixedArrayElement(
        object, IntPtrConstant(index), additional_offset, INTPTR_PARAMETERS);
  }

1046 1047 1048 1049 1050 1051 1052 1053 1054 1055 1056 1057 1058 1059
  // Load an array element from a WeakFixedArray.
  TNode<MaybeObject> LoadWeakFixedArrayElement(
      TNode<WeakFixedArray> object, Node* index, int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS,
      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);

  TNode<MaybeObject> LoadWeakFixedArrayElement(
      TNode<WeakFixedArray> object, int index, int additional_offset = 0,
      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
    return LoadWeakFixedArrayElement(object, IntPtrConstant(index),
                                     additional_offset, INTPTR_PARAMETERS,
                                     needs_poisoning);
  }

1060
  // Load an array element from a FixedDoubleArray.
1061 1062 1063
  TNode<Float64T> LoadFixedDoubleArrayElement(
      SloppyTNode<FixedDoubleArray> object, Node* index,
      MachineType machine_type, int additional_offset = 0,
1064
      ParameterMode parameter_mode = INTPTR_PARAMETERS,
1065 1066
      Label* if_hole = nullptr);

1067 1068 1069 1070 1071 1072
  Node* LoadFixedDoubleArrayElement(TNode<FixedDoubleArray> object,
                                    TNode<Smi> index) {
    return LoadFixedDoubleArrayElement(object, index, MachineType::Float64(), 0,
                                       SMI_PARAMETERS);
  }

1073 1074 1075 1076 1077 1078 1079
  // Load an array element from a FixedArray, FixedDoubleArray or a
  // NumberDictionary (depending on the |elements_kind|) and return
  // it as a tagged value. Assumes that the |index| passed a length
  // check before. Bails out to |if_accessor| if the element that
  // was found is an accessor, or to |if_hole| if the element at
  // the given |index| is not found in |elements|.
  TNode<Object> LoadFixedArrayBaseElementAsTagged(
1080
      TNode<FixedArrayBase> elements, TNode<IntPtrT> index,
1081 1082
      TNode<Int32T> elements_kind, Label* if_accessor, Label* if_hole);

1083
  // Load a feedback slot from a FeedbackVector.
1084
  TNode<MaybeObject> LoadFeedbackVectorSlot(
1085 1086 1087
      Node* object, Node* index, int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS);

1088
  TNode<IntPtrT> LoadFeedbackVectorLength(TNode<FeedbackVector>);
1089 1090 1091
  TNode<Float64T> LoadDoubleWithHoleCheck(TNode<FixedDoubleArray> array,
                                          TNode<Smi> index,
                                          Label* if_hole = nullptr);
1092

1093 1094 1095
  // Load Float64 value by |base| + |offset| address. If the value is a double
  // hole then jump to |if_hole|. If |machine_type| is None then only the hole
  // check is generated.
1096 1097
  TNode<Float64T> LoadDoubleWithHoleCheck(
      SloppyTNode<Object> base, SloppyTNode<IntPtrT> offset, Label* if_hole,
1098
      MachineType machine_type = MachineType::Float64());
1099 1100
  TNode<RawPtrT> LoadFixedTypedArrayBackingStore(
      TNode<FixedTypedArrayBase> typed_array);
1101 1102
  Node* LoadFixedTypedArrayElementAsTagged(
      Node* data_pointer, Node* index_node, ElementsKind elements_kind,
1103
      ParameterMode parameter_mode = INTPTR_PARAMETERS);
1104 1105
  TNode<Numeric> LoadFixedTypedArrayElementAsTagged(
      TNode<WordT> data_pointer, TNode<Smi> index, TNode<Int32T> elements_kind);
1106 1107 1108 1109
  // Parts of the above, factored out for readability:
  Node* LoadFixedBigInt64ArrayElementAsTagged(Node* data_pointer, Node* offset);
  Node* LoadFixedBigUint64ArrayElementAsTagged(Node* data_pointer,
                                               Node* offset);
1110

1111 1112 1113 1114
  void StoreFixedTypedArrayElementFromTagged(
      TNode<Context> context, TNode<FixedTypedArrayBase> elements,
      TNode<Object> index_node, TNode<Object> value, ElementsKind elements_kind,
      ParameterMode parameter_mode);
1115

1116
  // Context manipulation
1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129
  TNode<Object> LoadContextElement(SloppyTNode<Context> context,
                                   int slot_index);
  TNode<Object> LoadContextElement(SloppyTNode<Context> context,
                                   SloppyTNode<IntPtrT> slot_index);
  void StoreContextElement(SloppyTNode<Context> context, int slot_index,
                           SloppyTNode<Object> value);
  void StoreContextElement(SloppyTNode<Context> context,
                           SloppyTNode<IntPtrT> slot_index,
                           SloppyTNode<Object> value);
  void StoreContextElementNoWriteBarrier(SloppyTNode<Context> context,
                                         int slot_index,
                                         SloppyTNode<Object> value);
  TNode<Context> LoadNativeContext(SloppyTNode<Context> context);
1130 1131
  // Calling this is only valid if there's a module context in the chain.
  TNode<Context> LoadModuleContext(SloppyTNode<Context> context);
1132

1133 1134 1135 1136 1137 1138
  void GotoIfContextElementEqual(Node* value, Node* native_context,
                                 int slot_index, Label* if_equal) {
    GotoIf(WordEqual(value, LoadContextElement(native_context, slot_index)),
           if_equal);
  }

1139 1140 1141 1142
  TNode<Map> LoadJSArrayElementsMap(ElementsKind kind,
                                    SloppyTNode<Context> native_context);
  TNode<Map> LoadJSArrayElementsMap(SloppyTNode<Int32T> kind,
                                    SloppyTNode<Context> native_context);
1143

1144 1145 1146 1147
  TNode<BoolT> IsGeneratorFunction(TNode<JSFunction> function);
  TNode<BoolT> HasPrototypeProperty(TNode<JSFunction> function, TNode<Map> map);
  void GotoIfPrototypeRequiresRuntimeLookup(TNode<JSFunction> function,
                                            TNode<Map> map, Label* runtime);
1148 1149 1150
  // Load the "prototype" property of a JSFunction.
  Node* LoadJSFunctionPrototype(Node* function, Label* if_bailout);

1151 1152
  Node* LoadSharedFunctionInfoBytecodeArray(Node* shared);

1153 1154 1155
  void StoreObjectByteNoWriteBarrier(TNode<HeapObject> object, int offset,
                                     TNode<Word32T> value);

1156
  // Store the floating point value of a HeapNumber.
1157 1158
  void StoreHeapNumberValue(SloppyTNode<HeapNumber> object,
                            SloppyTNode<Float64T> value);
1159 1160
  void StoreMutableHeapNumberValue(SloppyTNode<MutableHeapNumber> object,
                                   SloppyTNode<Float64T> value);
1161
  // Store a field to an object on the heap.
1162 1163 1164 1165
  Node* StoreObjectField(Node* object, int offset, Node* value);
  Node* StoreObjectField(Node* object, Node* offset, Node* value);
  Node* StoreObjectFieldNoWriteBarrier(
      Node* object, int offset, Node* value,
1166
      MachineRepresentation rep = MachineRepresentation::kTagged);
1167 1168
  Node* StoreObjectFieldNoWriteBarrier(
      Node* object, Node* offset, Node* value,
1169
      MachineRepresentation rep = MachineRepresentation::kTagged);
1170
  // Store the Map of an HeapObject.
1171
  Node* StoreMap(Node* object, Node* map);
1172
  Node* StoreMapNoWriteBarrier(Node* object, RootIndex map_root_index);
1173
  Node* StoreMapNoWriteBarrier(Node* object, Node* map);
1174
  Node* StoreObjectFieldRoot(Node* object, int offset, RootIndex root);
1175
  // Store an array element to a FixedArray.
1176 1177
  void StoreFixedArrayElement(
      TNode<FixedArray> object, int index, SloppyTNode<Object> value,
1178 1179
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER) {
    return StoreFixedArrayElement(object, IntPtrConstant(index), value,
1180
                                  barrier_mode);
1181 1182
  }

1183 1184 1185
  Node* StoreJSArrayLength(TNode<JSArray> array, TNode<Smi> length);
  Node* StoreElements(TNode<Object> object, TNode<FixedArrayBase> elements);

1186 1187
  void StoreFixedArrayOrPropertyArrayElement(
      Node* array, Node* index, Node* value,
1188
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
1189
      int additional_offset = 0,
1190
      ParameterMode parameter_mode = INTPTR_PARAMETERS);
1191

1192 1193 1194 1195 1196
  void StoreFixedArrayElement(
      TNode<FixedArray> array, Node* index, SloppyTNode<Object> value,
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
      int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS) {
1197
    FixedArrayBoundsCheck(array, index, additional_offset, parameter_mode);
1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209 1210 1211 1212
    StoreFixedArrayOrPropertyArrayElement(array, index, value, barrier_mode,
                                          additional_offset, parameter_mode);
  }

  void StorePropertyArrayElement(
      TNode<PropertyArray> array, Node* index, SloppyTNode<Object> value,
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
      int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS) {
    StoreFixedArrayOrPropertyArrayElement(array, index, value, barrier_mode,
                                          additional_offset, parameter_mode);
  }

  void StoreFixedArrayElementSmi(
      TNode<FixedArray> array, TNode<Smi> index, TNode<Object> value,
1213
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER) {
1214 1215
    StoreFixedArrayElement(array, index, value, barrier_mode, 0,
                           SMI_PARAMETERS);
1216 1217
  }

1218 1219
  void StoreFixedDoubleArrayElement(
      TNode<FixedDoubleArray> object, Node* index, TNode<Float64T> value,
1220
      ParameterMode parameter_mode = INTPTR_PARAMETERS);
1221

1222 1223 1224 1225 1226 1227 1228 1229 1230 1231 1232 1233 1234
  void StoreFixedDoubleArrayElementSmi(TNode<FixedDoubleArray> object,
                                       TNode<Smi> index,
                                       TNode<Float64T> value) {
    StoreFixedDoubleArrayElement(object, index, value, SMI_PARAMETERS);
  }

  void StoreFixedDoubleArrayHole(TNode<FixedDoubleArray> array, Node* index,
                                 ParameterMode mode = INTPTR_PARAMETERS);
  void StoreFixedDoubleArrayHoleSmi(TNode<FixedDoubleArray> array,
                                    TNode<Smi> index) {
    StoreFixedDoubleArrayHole(array, index, SMI_PARAMETERS);
  }

1235 1236 1237 1238 1239 1240
  Node* StoreFeedbackVectorSlot(
      Node* object, Node* index, Node* value,
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
      int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS);

1241
  void EnsureArrayLengthWritable(TNode<Map> map, Label* bailout);
1242

1243
  // EnsureArrayPushable verifies that receiver with this map is:
1244 1245 1246 1247
  //   1. Is not a prototype.
  //   2. Is not a dictionary.
  //   3. Has a writeable length property.
  // It returns ElementsKind as a node for further division into cases.
1248
  TNode<Int32T> EnsureArrayPushable(TNode<Map> map, Label* bailout);
1249 1250 1251 1252 1253

  void TryStoreArrayElement(ElementsKind kind, ParameterMode mode,
                            Label* bailout, Node* elements, Node* index,
                            Node* value);
  // Consumes args into the array, and returns tagged new length.
1254 1255 1256
  TNode<Smi> BuildAppendJSArray(ElementsKind kind, SloppyTNode<JSArray> array,
                                CodeStubArguments* args,
                                TVariable<IntPtrT>* arg_index, Label* bailout);
1257 1258 1259
  // Pushes value onto the end of array.
  void BuildAppendJSArray(ElementsKind kind, Node* array, Node* value,
                          Label* bailout);
1260

1261 1262
  void StoreFieldsNoWriteBarrier(Node* start_address, Node* end_address,
                                 Node* value);
1263

1264 1265 1266 1267 1268 1269 1270 1271 1272 1273 1274
  Node* AllocateCellWithValue(Node* value,
                              WriteBarrierMode mode = UPDATE_WRITE_BARRIER);
  Node* AllocateSmiCell(int value = 0) {
    return AllocateCellWithValue(SmiConstant(value), SKIP_WRITE_BARRIER);
  }

  Node* LoadCellValue(Node* cell);

  Node* StoreCellValue(Node* cell, Node* value,
                       WriteBarrierMode mode = UPDATE_WRITE_BARRIER);

1275
  // Allocate a HeapNumber without initializing its value.
1276
  TNode<HeapNumber> AllocateHeapNumber();
1277
  // Allocate a HeapNumber with a specific value.
1278 1279 1280 1281 1282 1283 1284 1285
  TNode<HeapNumber> AllocateHeapNumberWithValue(SloppyTNode<Float64T> value);
  TNode<HeapNumber> AllocateHeapNumberWithValue(double value) {
    return AllocateHeapNumberWithValue(Float64Constant(value));
  }

  // Allocate a MutableHeapNumber with a specific value.
  TNode<MutableHeapNumber> AllocateMutableHeapNumberWithValue(
      SloppyTNode<Float64T> value);
1286

1287 1288 1289 1290 1291 1292 1293 1294
  // Allocate a BigInt with {length} digits. Sets the sign bit to {false}.
  // Does not initialize the digits.
  TNode<BigInt> AllocateBigInt(TNode<IntPtrT> length);
  // Like above, but allowing custom bitfield initialization.
  TNode<BigInt> AllocateRawBigInt(TNode<IntPtrT> length);
  void StoreBigIntBitfield(TNode<BigInt> bigint, TNode<WordT> bitfield);
  void StoreBigIntDigit(TNode<BigInt> bigint, int digit_index,
                        TNode<UintPtrT> digit);
1295 1296
  TNode<WordT> LoadBigIntBitfield(TNode<BigInt> bigint);
  TNode<UintPtrT> LoadBigIntDigit(TNode<BigInt> bigint, int digit_index);
1297

1298
  // Allocate a SeqOneByteString with the given length.
1299
  TNode<String> AllocateSeqOneByteString(uint32_t length,
1300
                                         AllocationFlags flags = kNone);
1301
  TNode<String> AllocateSeqOneByteString(Node* context, TNode<Uint32T> length,
1302
                                         AllocationFlags flags = kNone);
1303
  // Allocate a SeqTwoByteString with the given length.
1304
  TNode<String> AllocateSeqTwoByteString(uint32_t length,
1305
                                         AllocationFlags flags = kNone);
1306
  TNode<String> AllocateSeqTwoByteString(Node* context, TNode<Uint32T> length,
1307
                                         AllocationFlags flags = kNone);
1308 1309 1310

  // Allocate a SlicedOneByteString with the given length, parent and offset.
  // |length| and |offset| are expected to be tagged.
1311

1312
  TNode<String> AllocateSlicedOneByteString(TNode<Uint32T> length,
1313 1314
                                            TNode<String> parent,
                                            TNode<Smi> offset);
1315 1316
  // Allocate a SlicedTwoByteString with the given length, parent and offset.
  // |length| and |offset| are expected to be tagged.
1317
  TNode<String> AllocateSlicedTwoByteString(TNode<Uint32T> length,
1318 1319
                                            TNode<String> parent,
                                            TNode<Smi> offset);
1320

1321 1322 1323
  // Allocate a one-byte ConsString with the given length, first and second
  // parts. |length| is expected to be tagged, and |first| and |second| are
  // expected to be one-byte strings.
1324
  TNode<String> AllocateOneByteConsString(TNode<Uint32T> length,
1325 1326 1327
                                          TNode<String> first,
                                          TNode<String> second,
                                          AllocationFlags flags = kNone);
1328 1329 1330
  // Allocate a two-byte ConsString with the given length, first and second
  // parts. |length| is expected to be tagged, and |first| and |second| are
  // expected to be two-byte strings.
1331
  TNode<String> AllocateTwoByteConsString(TNode<Uint32T> length,
1332 1333 1334
                                          TNode<String> first,
                                          TNode<String> second,
                                          AllocationFlags flags = kNone);
1335 1336

  // Allocate an appropriate one- or two-byte ConsString with the first and
1337
  // second parts specified by |left| and |right|.
1338
  TNode<String> NewConsString(TNode<Uint32T> length, TNode<String> left,
1339
                              TNode<String> right,
1340
                              AllocationFlags flags = kNone);
1341

1342 1343 1344 1345 1346 1347 1348
  TNode<NameDictionary> AllocateNameDictionary(int at_least_space_for);
  TNode<NameDictionary> AllocateNameDictionary(
      TNode<IntPtrT> at_least_space_for);
  TNode<NameDictionary> AllocateNameDictionaryWithCapacity(
      TNode<IntPtrT> capacity);
  TNode<NameDictionary> CopyNameDictionary(TNode<NameDictionary> dictionary,
                                           Label* large_object_fallback);
1349

1350 1351 1352
  template <typename CollectionType>
  Node* AllocateOrderedHashTable();

1353 1354 1355 1356 1357 1358 1359 1360 1361 1362 1363 1364
  // Builds code that finds OrderedHashTable entry for a key with hash code
  // {hash} with using the comparison code generated by {key_compare}. The code
  // jumps to {entry_found} if the key is found, or to {not_found} if the key
  // was not found. In the {entry_found} branch, the variable
  // entry_start_position will be bound to the index of the entry (relative to
  // OrderedHashTable::kHashTableStartIndex).
  //
  // The {CollectionType} template parameter stands for the particular instance
  // of OrderedHashTable, it should be OrderedHashMap or OrderedHashSet.
  template <typename CollectionType>
  void FindOrderedHashTableEntry(
      Node* table, Node* hash,
1365
      const std::function<void(Node*, Label*, Label*)>& key_compare,
1366 1367
      Variable* entry_start_position, Label* entry_found, Label* not_found);

1368 1369 1370
  template <typename CollectionType>
  TNode<CollectionType> AllocateSmallOrderedHashTable(TNode<IntPtrT> capacity);

1371 1372 1373
  Node* AllocateStruct(Node* map, AllocationFlags flags = kNone);
  void InitializeStructBody(Node* object, Node* map, Node* size,
                            int start_offset = Struct::kHeaderSize);
1374

1375 1376 1377 1378 1379 1380 1381 1382 1383
  Node* AllocateJSObjectFromMap(
      Node* map, Node* properties = nullptr, Node* elements = nullptr,
      AllocationFlags flags = kNone,
      SlackTrackingMode slack_tracking_mode = kNoSlackTracking);

  void InitializeJSObjectFromMap(
      Node* object, Node* map, Node* instance_size, Node* properties = nullptr,
      Node* elements = nullptr,
      SlackTrackingMode slack_tracking_mode = kNoSlackTracking);
1384

1385 1386 1387 1388 1389
  void InitializeJSObjectBodyWithSlackTracking(Node* object, Node* map,
                                               Node* instance_size);
  void InitializeJSObjectBodyNoSlackTracking(
      Node* object, Node* map, Node* instance_size,
      int start_offset = JSObject::kHeaderSize);
1390

1391
  // Allocate a JSArray without elements and initialize the header fields.
1392 1393
  Node* AllocateUninitializedJSArrayWithoutElements(
      Node* array_map, Node* length, Node* allocation_site = nullptr);
1394 1395 1396
  // Allocate and return a JSArray with initialized header fields and its
  // uninitialized elements.
  // The ParameterMode argument is only used for the capacity parameter.
1397 1398
  std::pair<Node*, Node*> AllocateUninitializedJSArrayWithElements(
      ElementsKind kind, Node* array_map, Node* length, Node* allocation_site,
1399
      Node* capacity, ParameterMode capacity_mode = INTPTR_PARAMETERS);
1400 1401
  // Allocate a JSArray and fill elements with the hole.
  // The ParameterMode argument is only used for the capacity parameter.
1402 1403
  Node* AllocateJSArray(ElementsKind kind, Node* array_map, Node* capacity,
                        Node* length, Node* allocation_site = nullptr,
1404
                        ParameterMode capacity_mode = INTPTR_PARAMETERS);
1405

1406 1407 1408 1409 1410 1411 1412 1413 1414 1415 1416 1417
  Node* AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
                        TNode<Smi> capacity, TNode<Smi> length) {
    return AllocateJSArray(kind, array_map, capacity, length, nullptr,
                           SMI_PARAMETERS);
  }

  Node* AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
                        TNode<IntPtrT> capacity, TNode<Smi> length) {
    return AllocateJSArray(kind, array_map, capacity, length, nullptr,
                           INTPTR_PARAMETERS);
  }

1418 1419 1420 1421 1422 1423 1424 1425 1426
  Node* CloneFastJSArray(Node* context, Node* array,
                         ParameterMode mode = INTPTR_PARAMETERS,
                         Node* allocation_site = nullptr);

  Node* ExtractFastJSArray(Node* context, Node* array, Node* begin, Node* count,
                           ParameterMode mode = INTPTR_PARAMETERS,
                           Node* capacity = nullptr,
                           Node* allocation_site = nullptr);

1427
  TNode<FixedArrayBase> AllocateFixedArray(
1428 1429 1430
      ElementsKind kind, Node* capacity, ParameterMode mode = INTPTR_PARAMETERS,
      AllocationFlags flags = kNone,
      SloppyTNode<Map> fixed_array_map = nullptr);
1431

1432
  TNode<FixedArrayBase> AllocateFixedArray(
1433 1434 1435 1436
      ElementsKind kind, TNode<IntPtrT> capacity, AllocationFlags flags,
      SloppyTNode<Map> fixed_array_map = nullptr) {
    return AllocateFixedArray(kind, capacity, INTPTR_PARAMETERS, flags,
                              fixed_array_map);
1437 1438
  }

1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449
  TNode<FixedArray> AllocateZeroedFixedArray(TNode<IntPtrT> capacity) {
    TNode<FixedArray> result = UncheckedCast<FixedArray>(
        AllocateFixedArray(PACKED_ELEMENTS, capacity,
                           AllocationFlag::kAllowLargeObjectAllocation));
    FillFixedArrayWithSmiZero(result, capacity);
    return result;
  }

  TNode<FixedDoubleArray> AllocateZeroedFixedDoubleArray(
      TNode<IntPtrT> capacity) {
    TNode<FixedDoubleArray> result = UncheckedCast<FixedDoubleArray>(
1450
        AllocateFixedArray(PACKED_DOUBLE_ELEMENTS, capacity,
1451 1452 1453 1454 1455
                           AllocationFlag::kAllowLargeObjectAllocation));
    FillFixedDoubleArrayWithZero(result, capacity);
    return result;
  }

1456 1457 1458
  Node* AllocatePropertyArray(Node* capacity,
                              ParameterMode mode = INTPTR_PARAMETERS,
                              AllocationFlags flags = kNone);
1459

1460
  // Perform CreateArrayIterator (ES #sec-createarrayiterator).
1461 1462 1463
  TNode<JSArrayIterator> CreateArrayIterator(TNode<Context> context,
                                             TNode<Object> object,
                                             IterationKind mode);
1464

1465 1466
  Node* AllocateJSIteratorResult(Node* context, Node* value, Node* done);
  Node* AllocateJSIteratorResultForEntry(Node* context, Node* key, Node* value);
1467

1468 1469
  Node* ArraySpeciesCreate(TNode<Context> context, TNode<Object> originalArray,
                           TNode<Number> len);
1470
  Node* InternalArrayCreate(TNode<Context> context, TNode<Number> len);
1471

1472
  void FillFixedArrayWithValue(ElementsKind kind, Node* array, Node* from_index,
1473
                               Node* to_index, RootIndex value_root_index,
1474
                               ParameterMode mode = INTPTR_PARAMETERS);
1475

1476 1477 1478 1479 1480 1481
  // Uses memset to effectively initialize the given FixedArray with zeroes.
  void FillFixedArrayWithSmiZero(TNode<FixedArray> array,
                                 TNode<IntPtrT> length);
  void FillFixedDoubleArrayWithZero(TNode<FixedDoubleArray> array,
                                    TNode<IntPtrT> length);

1482 1483 1484 1485 1486 1487 1488 1489 1490
  void FillPropertyArrayWithUndefined(Node* array, Node* from_index,
                                      Node* to_index,
                                      ParameterMode mode = INTPTR_PARAMETERS);

  void CopyPropertyArrayValues(
      Node* from_array, Node* to_array, Node* length,
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
      ParameterMode mode = INTPTR_PARAMETERS);

1491 1492
  // Copies all elements from |from_array| of |length| size to
  // |to_array| of the same size respecting the elements kind.
1493
  void CopyFixedArrayElements(
1494
      ElementsKind kind, Node* from_array, Node* to_array, Node* length,
1495
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
1496
      ParameterMode mode = INTPTR_PARAMETERS) {
1497 1498
    CopyFixedArrayElements(kind, from_array, kind, to_array,
                           IntPtrOrSmiConstant(0, mode), length, length,
1499 1500 1501
                           barrier_mode, mode);
  }

1502 1503 1504
  // Copies |element_count| elements from |from_array| starting from element
  // zero to |to_array| of |capacity| size respecting both array's elements
  // kinds.
1505
  void CopyFixedArrayElements(
1506 1507
      ElementsKind from_kind, Node* from_array, ElementsKind to_kind,
      Node* to_array, Node* element_count, Node* capacity,
1508
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521
      ParameterMode mode = INTPTR_PARAMETERS) {
    CopyFixedArrayElements(from_kind, from_array, to_kind, to_array,
                           IntPtrOrSmiConstant(0, mode), element_count,
                           capacity, barrier_mode, mode);
  }

  // Copies |element_count| elements from |from_array| starting from element
  // |first_element| to |to_array| of |capacity| size respecting both array's
  // elements kinds.
  void CopyFixedArrayElements(
      ElementsKind from_kind, Node* from_array, ElementsKind to_kind,
      Node* to_array, Node* first_element, Node* element_count, Node* capacity,
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
1522
      ParameterMode mode = INTPTR_PARAMETERS);
1523

1524 1525 1526 1527 1528 1529 1530 1531 1532 1533
  void CopyFixedArrayElements(
      ElementsKind from_kind, TNode<FixedArrayBase> from_array,
      ElementsKind to_kind, TNode<FixedArrayBase> to_array,
      TNode<Smi> first_element, TNode<Smi> element_count, TNode<Smi> capacity,
      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER) {
    CopyFixedArrayElements(from_kind, from_array, to_kind, to_array,
                           first_element, element_count, capacity, barrier_mode,
                           SMI_PARAMETERS);
  }

1534 1535
  TNode<FixedArray> HeapObjectToFixedArray(TNode<HeapObject> base,
                                           Label* cast_fail);
1536

1537 1538
  TNode<FixedDoubleArray> HeapObjectToFixedDoubleArray(TNode<HeapObject> base,
                                                       Label* cast_fail) {
1539 1540 1541
    GotoIf(
        WordNotEqual(LoadMap(base), LoadRoot(RootIndex::kFixedDoubleArrayMap)),
        cast_fail);
1542 1543 1544
    return UncheckedCast<FixedDoubleArray>(base);
  }

1545 1546 1547 1548
  TNode<Int32T> ConvertElementsKindToInt(TNode<Int32T> elements_kind) {
    return UncheckedCast<Int32T>(elements_kind);
  }

1549 1550 1551
  enum class ExtractFixedArrayFlag {
    kFixedArrays = 1,
    kFixedDoubleArrays = 2,
1552
    kDontCopyCOW = 4,
1553
    kNewSpaceAllocationOnly = 8,
1554 1555
    kAllFixedArrays = kFixedArrays | kFixedDoubleArrays,
    kAllFixedArraysDontCopyCOW = kAllFixedArrays | kDontCopyCOW
1556 1557 1558 1559 1560 1561 1562 1563 1564 1565 1566 1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581
  };

  typedef base::Flags<ExtractFixedArrayFlag> ExtractFixedArrayFlags;

  // Copy a portion of an existing FixedArray or FixedDoubleArray into a new
  // FixedArray, including special appropriate handling for empty arrays and COW
  // arrays.
  //
  // * |source| is either a FixedArray or FixedDoubleArray from which to copy
  // elements.
  // * |first| is the starting element index to copy from, if nullptr is passed
  // then index zero is used by default.
  // * |count| is the number of elements to copy out of the source array
  // starting from and including the element indexed by |start|. If |count| is
  // nullptr, then all of the elements from |start| to the end of |source| are
  // copied.
  // * |capacity| determines the size of the allocated result array, with
  // |capacity| >= |count|. If |capacity| is nullptr, then |count| is used as
  // the destination array's capacity.
  // * |extract_flags| determines whether FixedArrays, FixedDoubleArrays or both
  // are detected and copied. Although it's always correct to pass
  // kAllFixedArrays, the generated code is more compact and efficient if the
  // caller can specify whether only FixedArrays or FixedDoubleArrays will be
  // passed as the |source| parameter.
  // * |parameter_mode| determines the parameter mode of |first|, |count| and
  // |capacity|.
1582
  TNode<FixedArrayBase> ExtractFixedArray(
1583 1584 1585 1586 1587 1588
      Node* source, Node* first, Node* count = nullptr,
      Node* capacity = nullptr,
      ExtractFixedArrayFlags extract_flags =
          ExtractFixedArrayFlag::kAllFixedArrays,
      ParameterMode parameter_mode = INTPTR_PARAMETERS);

1589 1590 1591 1592 1593 1594
  TNode<FixedArrayBase> ExtractFixedArray(
      TNode<FixedArrayBase> source, TNode<Smi> first, TNode<Smi> count,
      TNode<Smi> capacity,
      ExtractFixedArrayFlags extract_flags =
          ExtractFixedArrayFlag::kAllFixedArrays) {
    return ExtractFixedArray(source, first, count, capacity, extract_flags,
1595
                             SMI_PARAMETERS);
1596
  }
1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608

  // Copy the entire contents of a FixedArray or FixedDoubleArray to a new
  // array, including special appropriate handling for empty arrays and COW
  // arrays.
  //
  // * |source| is either a FixedArray or FixedDoubleArray from which to copy
  // elements.
  // * |extract_flags| determines whether FixedArrays, FixedDoubleArrays or both
  // are detected and copied. Although it's always correct to pass
  // kAllFixedArrays, the generated code is more compact and efficient if the
  // caller can specify whether only FixedArrays or FixedDoubleArrays will be
  // passed as the |source| parameter.
1609 1610 1611
  Node* CloneFixedArray(Node* source,
                        ExtractFixedArrayFlags flags =
                            ExtractFixedArrayFlag::kAllFixedArraysDontCopyCOW) {
1612 1613 1614 1615 1616
    ParameterMode mode = OptimalParameterMode();
    return ExtractFixedArray(source, IntPtrOrSmiConstant(0, mode), nullptr,
                             nullptr, flags, mode);
  }

1617
  // Copies |character_count| elements from |from_string| to |to_string|
1618
  // starting at the |from_index|'th character. |from_string| and |to_string|
1619 1620
  // can either be one-byte strings or two-byte strings, although if
  // |from_string| is two-byte, then |to_string| must be two-byte.
1621 1622 1623
  // |from_index|, |to_index| and |character_count| must be intptr_ts s.t. 0 <=
  // |from_index| <= |from_index| + |character_count| <= from_string.length and
  // 0 <= |to_index| <= |to_index| + |character_count| <= to_string.length.
1624
  void CopyStringCharacters(Node* from_string, Node* to_string,
1625 1626
                            TNode<IntPtrT> from_index, TNode<IntPtrT> to_index,
                            TNode<IntPtrT> character_count,
1627
                            String::Encoding from_encoding,
1628
                            String::Encoding to_encoding);
1629

1630 1631 1632 1633
  // Loads an element from |array| of |from_kind| elements by given |offset|
  // (NOTE: not index!), does a hole check if |if_hole| is provided and
  // converts the value so that it becomes ready for storing to array of
  // |to_kind| elements.
1634 1635 1636
  Node* LoadElementAndPrepareForStore(Node* array, Node* offset,
                                      ElementsKind from_kind,
                                      ElementsKind to_kind, Label* if_hole);
1637

1638
  Node* CalculateNewElementsCapacity(Node* old_capacity,
1639
                                     ParameterMode mode = INTPTR_PARAMETERS);
1640

1641 1642
  // Tries to grow the |elements| array of given |object| to store the |key|
  // or bails out if the growing gap is too big. Returns new elements.
1643 1644
  Node* TryGrowElementsCapacity(Node* object, Node* elements, ElementsKind kind,
                                Node* key, Label* bailout);
1645 1646 1647 1648

  // Tries to grow the |capacity|-length |elements| array of given |object|
  // to store the |key| or bails out if the growing gap is too big. Returns
  // new elements.
1649 1650 1651
  Node* TryGrowElementsCapacity(Node* object, Node* elements, ElementsKind kind,
                                Node* key, Node* capacity, ParameterMode mode,
                                Label* bailout);
1652 1653

  // Grows elements capacity of given object. Returns new elements.
1654 1655 1656 1657
  Node* GrowElementsCapacity(Node* object, Node* elements,
                             ElementsKind from_kind, ElementsKind to_kind,
                             Node* capacity, Node* new_capacity,
                             ParameterMode mode, Label* bailout);
1658

1659 1660 1661 1662 1663 1664 1665 1666
  // Given a need to grow by |growth|, allocate an appropriate new capacity
  // if necessary, and return a new elements FixedArray object. Label |bailout|
  // is followed for allocation failure.
  void PossiblyGrowElementsCapacity(ParameterMode mode, ElementsKind kind,
                                    Node* array, Node* length,
                                    Variable* var_elements, Node* growth,
                                    Label* bailout);

1667
  // Allocation site manipulation
1668
  void InitializeAllocationMemento(Node* base_allocation,
1669
                                   Node* base_allocation_size,
1670 1671 1672 1673 1674
                                   Node* allocation_site);

  Node* TryTaggedToFloat64(Node* value, Label* if_valueisnotnumber);
  Node* TruncateTaggedToFloat64(Node* context, Node* value);
  Node* TruncateTaggedToWord32(Node* context, Node* value);
1675 1676 1677 1678 1679 1680 1681
  void TaggedToWord32OrBigInt(Node* context, Node* value, Label* if_number,
                              Variable* var_word32, Label* if_bigint,
                              Variable* var_bigint);
  void TaggedToWord32OrBigIntWithFeedback(
      Node* context, Node* value, Label* if_number, Variable* var_word32,
      Label* if_bigint, Variable* var_bigint, Variable* var_feedback);

1682
  // Truncate the floating point value of a HeapNumber to an Int32.
1683
  Node* TruncateHeapNumberValueToWord32(Node* object);
1684 1685

  // Conversions.
1686 1687 1688 1689
  void TryHeapNumberToSmi(TNode<HeapNumber> number, TVariable<Smi>& output,
                          Label* if_smi);
  void TryFloat64ToSmi(TNode<Float64T> number, TVariable<Smi>& output,
                       Label* if_smi);
1690 1691 1692
  TNode<Number> ChangeFloat64ToTagged(SloppyTNode<Float64T> value);
  TNode<Number> ChangeInt32ToTagged(SloppyTNode<Int32T> value);
  TNode<Number> ChangeUint32ToTagged(SloppyTNode<Uint32T> value);
1693
  TNode<Number> ChangeUintPtrToTagged(TNode<UintPtrT> value);
1694
  TNode<Uint32T> ChangeNumberToUint32(TNode<Number> value);
1695
  TNode<Float64T> ChangeNumberToFloat64(SloppyTNode<Number> value);
1696
  TNode<UintPtrT> ChangeNonnegativeNumberToUintPtr(TNode<Number> value);
1697

1698 1699 1700 1701 1702 1703
  void TaggedToNumeric(Node* context, Node* value, Label* done,
                       Variable* var_numeric);
  void TaggedToNumericWithFeedback(Node* context, Node* value, Label* done,
                                   Variable* var_numeric,
                                   Variable* var_feedback);

1704 1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717
  TNode<WordT> TimesPointerSize(SloppyTNode<WordT> value);
  TNode<IntPtrT> TimesPointerSize(TNode<IntPtrT> value) {
    return Signed(TimesPointerSize(implicit_cast<TNode<WordT>>(value)));
  }
  TNode<UintPtrT> TimesPointerSize(TNode<UintPtrT> value) {
    return Unsigned(TimesPointerSize(implicit_cast<TNode<WordT>>(value)));
  }
  TNode<WordT> TimesDoubleSize(SloppyTNode<WordT> value);
  TNode<UintPtrT> TimesDoubleSize(TNode<UintPtrT> value) {
    return Unsigned(TimesDoubleSize(implicit_cast<TNode<WordT>>(value)));
  }
  TNode<IntPtrT> TimesDoubleSize(TNode<IntPtrT> value) {
    return Signed(TimesDoubleSize(implicit_cast<TNode<WordT>>(value)));
  }
1718

1719 1720 1721
  // Type conversions.
  // Throws a TypeError for {method_name} if {value} is not coercible to Object,
  // or returns the {value} converted to a String otherwise.
1722 1723
  TNode<String> ToThisString(Node* context, Node* value,
                             char const* method_name);
1724 1725 1726
  // Throws a TypeError for {method_name} if {value} is neither of the given
  // {primitive_type} nor a JSValue wrapping a value of {primitive_type}, or
  // returns the {value} (or wrapped value) otherwise.
1727 1728
  Node* ToThisValue(Node* context, Node* value, PrimitiveType primitive_type,
                    char const* method_name);
1729

1730 1731
  // Throws a TypeError for {method_name} if {value} is not of the given
  // instance type. Returns {value}'s map.
1732 1733 1734
  Node* ThrowIfNotInstanceType(Node* context, Node* value,
                               InstanceType instance_type,
                               char const* method_name);
1735 1736 1737 1738 1739
  // Throws a TypeError for {method_name} if {value} is not a JSReceiver.
  // Returns the {value}'s map.
  Node* ThrowIfNotJSReceiver(Node* context, Node* value,
                             MessageTemplate::Template msg_template,
                             const char* method_name = nullptr);
1740 1741 1742 1743

  void ThrowRangeError(Node* context, MessageTemplate::Template message,
                       Node* arg0 = nullptr, Node* arg1 = nullptr,
                       Node* arg2 = nullptr);
1744 1745 1746 1747
  void ThrowTypeError(Node* context, MessageTemplate::Template message,
                      char const* arg0 = nullptr, char const* arg1 = nullptr);
  void ThrowTypeError(Node* context, MessageTemplate::Template message,
                      Node* arg0, Node* arg1 = nullptr, Node* arg2 = nullptr);
1748

1749
  // Type checks.
1750 1751
  // Check whether the map is for an object with special properties, such as a
  // JSProxy or an object with interceptors.
1752
  TNode<BoolT> InstanceTypeEqual(SloppyTNode<Int32T> instance_type, int type);
1753 1754 1755 1756 1757 1758 1759 1760 1761 1762 1763 1764 1765 1766 1767 1768 1769
  TNode<BoolT> IsAccessorInfo(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsAccessorPair(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsAllocationSite(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsAnyHeapNumber(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsNoElementsProtectorCellInvalid();
  TNode<BoolT> IsBigIntInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsBigInt(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsBoolean(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsCallableMap(SloppyTNode<Map> map);
  TNode<BoolT> IsCallable(SloppyTNode<HeapObject> object);
  TNode<BoolT> TaggedIsCallable(TNode<Object> object);
  TNode<BoolT> IsCell(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsCode(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsConsStringInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsConstructorMap(SloppyTNode<Map> map);
  TNode<BoolT> IsConstructor(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsDeprecatedMap(SloppyTNode<Map> map);
1770 1771
  TNode<BoolT> IsNameDictionary(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsGlobalDictionary(SloppyTNode<HeapObject> object);
1772
  TNode<BoolT> IsExtensibleMap(SloppyTNode<Map> map);
1773
  TNode<BoolT> IsExtensibleNonPrototypeMap(TNode<Map> map);
1774
  TNode<BoolT> IsExternalStringInstanceType(SloppyTNode<Int32T> instance_type);
1775 1776
  TNode<BoolT> IsFastJSArray(SloppyTNode<Object> object,
                             SloppyTNode<Context> context);
1777 1778
  TNode<BoolT> IsFastJSArrayWithNoCustomIteration(TNode<Object> object,
                                                  TNode<Context> context);
1779 1780 1781 1782 1783 1784 1785 1786 1787 1788 1789 1790 1791
  TNode<BoolT> IsFeedbackCell(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsFeedbackVector(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsContext(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsFixedArray(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsFixedArraySubclass(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsFixedArrayWithKind(SloppyTNode<HeapObject> object,
                                    ElementsKind kind);
  TNode<BoolT> IsFixedArrayWithKindOrEmpty(SloppyTNode<HeapObject> object,
                                           ElementsKind kind);
  TNode<BoolT> IsFixedDoubleArray(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsFixedTypedArray(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsFunctionWithPrototypeSlotMap(SloppyTNode<Map> map);
  TNode<BoolT> IsHashTable(SloppyTNode<HeapObject> object);
1792
  TNode<BoolT> IsEphemeronHashTable(SloppyTNode<HeapObject> object);
1793
  TNode<BoolT> IsHeapNumber(SloppyTNode<HeapObject> object);
1794 1795
  TNode<BoolT> IsHeapNumberInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsOddballInstanceType(SloppyTNode<Int32T> instance_type);
1796 1797
  TNode<BoolT> IsIndirectStringInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsJSArrayBuffer(SloppyTNode<HeapObject> object);
1798
  TNode<BoolT> IsJSDataView(TNode<HeapObject> object);
1799 1800 1801 1802 1803 1804
  TNode<BoolT> IsJSArrayInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsJSArrayMap(SloppyTNode<Map> map);
  TNode<BoolT> IsJSArray(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSArrayIterator(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSAsyncGeneratorObject(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSFunctionInstanceType(SloppyTNode<Int32T> instance_type);
1805
  TNode<BoolT> IsAllocationSiteInstanceType(SloppyTNode<Int32T> instance_type);
1806 1807 1808 1809 1810 1811 1812 1813 1814 1815 1816 1817 1818 1819 1820 1821 1822 1823 1824 1825 1826 1827
  TNode<BoolT> IsJSFunctionMap(SloppyTNode<Map> map);
  TNode<BoolT> IsJSFunction(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSGeneratorObject(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSGlobalProxyInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsJSGlobalProxy(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSObjectInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsJSObjectMap(SloppyTNode<Map> map);
  TNode<BoolT> IsJSObject(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSPromiseMap(SloppyTNode<Map> map);
  TNode<BoolT> IsJSPromise(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSProxy(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSReceiverInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsJSReceiverMap(SloppyTNode<Map> map);
  TNode<BoolT> IsJSReceiver(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSRegExp(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSTypedArray(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsJSValueInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsJSValueMap(SloppyTNode<Map> map);
  TNode<BoolT> IsJSValue(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsMap(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsMutableHeapNumber(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsName(SloppyTNode<HeapObject> object);
1828
  TNode<BoolT> IsNameInstanceType(SloppyTNode<Int32T> instance_type);
1829 1830 1831 1832 1833 1834 1835 1836 1837 1838 1839 1840
  TNode<BoolT> IsNativeContext(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsNullOrJSReceiver(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsNullOrUndefined(SloppyTNode<Object> object);
  TNode<BoolT> IsNumberDictionary(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsOneByteStringInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsPrimitiveInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsPrivateSymbol(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsPromiseCapability(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsPropertyArray(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsPropertyCell(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsPrototypeInitialArrayPrototype(SloppyTNode<Context> context,
                                                SloppyTNode<Map> map);
1841 1842
  TNode<BoolT> IsPrototypeTypedArrayPrototype(SloppyTNode<Context> context,
                                              SloppyTNode<Map> map);
1843 1844
  TNode<BoolT> IsSequentialStringInstanceType(
      SloppyTNode<Int32T> instance_type);
1845
  TNode<BoolT> IsUncachedExternalStringInstanceType(
1846
      SloppyTNode<Int32T> instance_type);
1847 1848 1849
  TNode<BoolT> IsSpecialReceiverInstanceType(TNode<Int32T> instance_type);
  TNode<BoolT> IsCustomElementsReceiverInstanceType(
      TNode<Int32T> instance_type);
1850
  TNode<BoolT> IsSpecialReceiverMap(SloppyTNode<Map> map);
1851 1852 1853
  // Returns true if the map corresponds to non-special fast or dictionary
  // object.
  TNode<BoolT> IsSimpleObjectMap(TNode<Map> map);
1854 1855 1856 1857 1858 1859
  TNode<BoolT> IsStringInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsString(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsSymbolInstanceType(SloppyTNode<Int32T> instance_type);
  TNode<BoolT> IsSymbol(SloppyTNode<HeapObject> object);
  TNode<BoolT> IsUndetectableMap(SloppyTNode<Map> map);
  TNode<BoolT> IsNotWeakFixedArraySubclass(SloppyTNode<HeapObject> object);
1860
  TNode<BoolT> IsZeroOrContext(SloppyTNode<Object> object);
1861

1862 1863 1864
  inline Node* IsSharedFunctionInfo(Node* object) {
    return IsSharedFunctionInfoMap(LoadMap(object));
  }
1865

1866 1867 1868 1869 1870
  TNode<BoolT> IsPromiseResolveProtectorCellInvalid();
  TNode<BoolT> IsPromiseThenProtectorCellInvalid();
  TNode<BoolT> IsArraySpeciesProtectorCellInvalid();
  TNode<BoolT> IsTypedArraySpeciesProtectorCellInvalid();
  TNode<BoolT> IsPromiseSpeciesProtectorCellInvalid();
1871

1872
  // True iff |object| is a Smi or a HeapNumber.
1873
  TNode<BoolT> IsNumber(SloppyTNode<Object> object);
1874
  // True iff |object| is a Smi or a HeapNumber or a BigInt.
1875
  TNode<BoolT> IsNumeric(SloppyTNode<Object> object);
1876 1877 1878

  // True iff |number| is either a Smi, or a HeapNumber whose value is not
  // within Smi range.
1879 1880
  TNode<BoolT> IsNumberNormalized(SloppyTNode<Number> number);
  TNode<BoolT> IsNumberPositive(SloppyTNode<Number> number);
1881 1882 1883 1884 1885 1886 1887 1888 1889 1890 1891 1892 1893 1894 1895 1896
  TNode<BoolT> IsHeapNumberPositive(TNode<HeapNumber> number);

  // True iff {number} is non-negative and less or equal than 2**53-1.
  TNode<BoolT> IsNumberNonNegativeSafeInteger(TNode<Number> number);

  // True iff {number} represents an integer value.
  TNode<BoolT> IsInteger(TNode<Object> number);
  TNode<BoolT> IsInteger(TNode<HeapNumber> number);

  // True iff abs({number}) <= 2**53 -1
  TNode<BoolT> IsSafeInteger(TNode<Object> number);
  TNode<BoolT> IsSafeInteger(TNode<HeapNumber> number);

  // True iff {number} represents a valid uint32t value.
  TNode<BoolT> IsHeapNumberUint32(TNode<HeapNumber> number);

1897 1898
  // True iff {number} is a positive number and a valid array index in the range
  // [0, 2^32-1).
1899
  TNode<BoolT> IsNumberArrayIndex(TNode<Number> number);
1900 1901 1902 1903

  Node* FixedArraySizeDoesntFitInNewSpace(
      Node* element_count, int base_size = FixedArray::kHeaderSize,
      ParameterMode mode = INTPTR_PARAMETERS);
1904

1905
  // ElementsKind helpers:
1906 1907 1908 1909
  TNode<BoolT> ElementsKindEqual(TNode<Int32T> a, TNode<Int32T> b) {
    return Word32Equal(a, b);
  }
  bool ElementsKindEqual(ElementsKind a, ElementsKind b) { return a == b; }
1910
  Node* IsFastElementsKind(Node* elements_kind);
1911 1912 1913
  bool IsFastElementsKind(ElementsKind kind) {
    return v8::internal::IsFastElementsKind(kind);
  }
1914 1915 1916
  TNode<BoolT> IsDictionaryElementsKind(TNode<Int32T> elements_kind) {
    return ElementsKindEqual(elements_kind, Int32Constant(DICTIONARY_ELEMENTS));
  }
1917 1918 1919 1920
  TNode<BoolT> IsDoubleElementsKind(TNode<Int32T> elements_kind);
  bool IsDoubleElementsKind(ElementsKind kind) {
    return v8::internal::IsDoubleElementsKind(kind);
  }
1921
  Node* IsFastSmiOrTaggedElementsKind(Node* elements_kind);
1922
  Node* IsFastSmiElementsKind(Node* elements_kind);
1923
  Node* IsHoleyFastElementsKind(Node* elements_kind);
1924 1925
  Node* IsElementsKindGreaterThan(Node* target_kind,
                                  ElementsKind reference_kind);
1926

1927 1928
  // String helpers.
  // Load a character from a String (might flatten a ConsString).
1929 1930
  TNode<Int32T> StringCharCodeAt(SloppyTNode<String> string,
                                 SloppyTNode<IntPtrT> index);
1931
  // Return the single character string with only {code}.
1932
  TNode<String> StringFromSingleCharCode(TNode<Int32T> code);
1933

1934
  // Return a new string object which holds a substring containing the range
1935
  // [from,to[ of string.
1936 1937
  TNode<String> SubString(TNode<String> string, TNode<IntPtrT> from,
                          TNode<IntPtrT> to);
1938

1939
  // Return a new string object produced by concatenating |first| with |second|.
1940 1941
  TNode<String> StringAdd(Node* context, TNode<String> first,
                          TNode<String> second, AllocationFlags flags = kNone);
1942

1943 1944 1945 1946 1947 1948
  // Check if |string| is an indirect (thin or flat cons) string type that can
  // be dereferenced by DerefIndirectString.
  void BranchIfCanDerefIndirectString(Node* string, Node* instance_type,
                                      Label* can_deref, Label* cannot_deref);
  // Unpack an indirect (thin or flat cons) string type.
  void DerefIndirectString(Variable* var_string, Node* instance_type);
1949 1950 1951
  // Check if |var_string| has an indirect (thin or flat cons) string type,
  // and unpack it if so.
  void MaybeDerefIndirectString(Variable* var_string, Node* instance_type,
1952
                                Label* did_deref, Label* cannot_deref);
1953 1954 1955 1956 1957
  // Check if |var_left| or |var_right| has an indirect (thin or flat cons)
  // string type, and unpack it/them if so. Fall through if nothing was done.
  void MaybeDerefIndirectStrings(Variable* var_left, Node* left_instance_type,
                                 Variable* var_right, Node* right_instance_type,
                                 Label* did_something);
1958 1959
  Node* DerefIndirectString(TNode<String> string, TNode<Int32T> instance_type,
                            Label* cannot_deref);
1960

1961 1962
  TNode<String> StringFromSingleCodePoint(TNode<Int32T> codepoint,
                                          UnicodeEncoding encoding);
1963

1964
  // Type conversion helpers.
1965
  enum class BigIntHandling { kConvertToNumber, kThrow };
1966
  // Convert a String to a Number.
1967
  TNode<Number> StringToNumber(TNode<String> input);
1968
  // Convert a Number to a String.
1969
  TNode<String> NumberToString(TNode<Number> input);
1970
  // Convert a Non-Number object to a Number.
1971 1972 1973
  TNode<Number> NonNumberToNumber(
      SloppyTNode<Context> context, SloppyTNode<HeapObject> input,
      BigIntHandling bigint_handling = BigIntHandling::kThrow);
1974
  // Convert a Non-Number object to a Numeric.
1975 1976
  TNode<Numeric> NonNumberToNumeric(SloppyTNode<Context> context,
                                    SloppyTNode<HeapObject> input);
1977
  // Convert any object to a Number.
1978 1979 1980 1981 1982 1983
  // Conforms to ES#sec-tonumber if {bigint_handling} == kThrow.
  // With {bigint_handling} == kConvertToNumber, matches behavior of
  // tc39.github.io/proposal-bigint/#sec-number-constructor-number-value.
  TNode<Number> ToNumber(
      SloppyTNode<Context> context, SloppyTNode<Object> input,
      BigIntHandling bigint_handling = BigIntHandling::kThrow);
1984 1985
  TNode<Number> ToNumber_Inline(SloppyTNode<Context> context,
                                SloppyTNode<Object> input);
1986

1987 1988 1989 1990 1991
  // Try to convert an object to a BigInt. Throws on failure (e.g. for Numbers).
  // https://tc39.github.io/proposal-bigint/#sec-to-bigint
  TNode<BigInt> ToBigInt(SloppyTNode<Context> context,
                         SloppyTNode<Object> input);

1992
  // Converts |input| to one of 2^32 integer values in the range 0 through
1993
  // 2^32-1, inclusive.
1994
  // ES#sec-touint32
1995
  TNode<Number> ToUint32(SloppyTNode<Context> context,
1996
                         SloppyTNode<Object> input);
1997

1998
  // Convert any object to a String.
1999 2000
  TNode<String> ToString(SloppyTNode<Context> context,
                         SloppyTNode<Object> input);
2001 2002
  TNode<String> ToString_Inline(SloppyTNode<Context> context,
                                SloppyTNode<Object> input);
2003 2004

  // Convert any object to a Primitive.
2005
  Node* JSReceiverToPrimitive(Node* context, Node* input);
2006

2007 2008 2009
  TNode<JSReceiver> ToObject(SloppyTNode<Context> context,
                             SloppyTNode<Object> input);

2010 2011 2012 2013 2014
  // Same as ToObject but avoids the Builtin call if |input| is already a
  // JSReceiver.
  TNode<JSReceiver> ToObject_Inline(TNode<Context> context,
                                    TNode<Object> input);

2015 2016 2017 2018 2019
  enum ToIntegerTruncationMode {
    kNoTruncation,
    kTruncateMinusZero,
  };

2020
  // ES6 7.1.17 ToIndex, but jumps to range_error if the result is not a Smi.
2021 2022
  TNode<Smi> ToSmiIndex(TNode<Object> input, TNode<Context> context,
                        Label* range_error);
2023

2024
  // ES6 7.1.15 ToLength, but jumps to range_error if the result is not a Smi.
2025 2026
  TNode<Smi> ToSmiLength(TNode<Object> input, TNode<Context> context,
                         Label* range_error);
2027

2028
  // ES6 7.1.15 ToLength, but with inlined fast path.
2029 2030
  TNode<Number> ToLength_Inline(SloppyTNode<Context> context,
                                SloppyTNode<Object> input);
2031

2032
  // ES6 7.1.4 ToInteger ( argument )
2033 2034
  TNode<Number> ToInteger_Inline(SloppyTNode<Context> context,
                                 SloppyTNode<Object> input,
2035
                                 ToIntegerTruncationMode mode = kNoTruncation);
2036
  TNode<Number> ToInteger(SloppyTNode<Context> context,
2037 2038
                          SloppyTNode<Object> input,
                          ToIntegerTruncationMode mode = kNoTruncation);
2039

2040
  // Returns a node that contains a decoded (unsigned!) value of a bit
2041 2042
  // field |BitField| in |word32|. Returns result as an uint32 node.
  template <typename BitField>
2043
  TNode<Uint32T> DecodeWord32(SloppyTNode<Word32T> word32) {
2044
    return DecodeWord32(word32, BitField::kShift, BitField::kMask);
2045 2046 2047
  }

  // Returns a node that contains a decoded (unsigned!) value of a bit
2048 2049
  // field |BitField| in |word|. Returns result as a word-size node.
  template <typename BitField>
2050
  TNode<UintPtrT> DecodeWord(SloppyTNode<WordT> word) {
2051
    return DecodeWord(word, BitField::kShift, BitField::kMask);
2052 2053
  }

2054
  // Returns a node that contains a decoded (unsigned!) value of a bit
2055 2056
  // field |BitField| in |word32|. Returns result as a word-size node.
  template <typename BitField>
2057
  TNode<UintPtrT> DecodeWordFromWord32(SloppyTNode<Word32T> word32) {
2058
    return DecodeWord<BitField>(ChangeUint32ToWord(word32));
2059 2060
  }

2061
  // Returns a node that contains a decoded (unsigned!) value of a bit
2062 2063
  // field |BitField| in |word|. Returns result as an uint32 node.
  template <typename BitField>
2064 2065
  TNode<Uint32T> DecodeWord32FromWord(SloppyTNode<WordT> word) {
    return UncheckedCast<Uint32T>(
2066
        TruncateIntPtrToInt32(Signed(DecodeWord<BitField>(word))));
2067 2068
  }

2069
  // Decodes an unsigned (!) value from |word32| to an uint32 node.
2070 2071
  TNode<Uint32T> DecodeWord32(SloppyTNode<Word32T> word32, uint32_t shift,
                              uint32_t mask);
2072 2073

  // Decodes an unsigned (!) value from |word| to a word-size node.
2074 2075
  TNode<UintPtrT> DecodeWord(SloppyTNode<WordT> word, uint32_t shift,
                             uint32_t mask);
2076

2077 2078
  // Returns a node that contains the updated values of a |BitField|.
  template <typename BitField>
2079
  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<WordT> value) {
2080 2081 2082 2083 2084
    return UpdateWord(word, value, BitField::kShift, BitField::kMask);
  }

  // Returns a node that contains the updated {value} inside {word} starting
  // at {shift} and fitting in {mask}.
2085 2086
  TNode<WordT> UpdateWord(TNode<WordT> word, TNode<WordT> value, uint32_t shift,
                          uint32_t mask);
2087

2088 2089
  // Returns true if any of the |T|'s bits in given |word32| are set.
  template <typename T>
2090
  TNode<BoolT> IsSetWord32(SloppyTNode<Word32T> word32) {
2091 2092 2093 2094
    return IsSetWord32(word32, T::kMask);
  }

  // Returns true if any of the mask's bits in given |word32| are set.
2095
  TNode<BoolT> IsSetWord32(SloppyTNode<Word32T> word32, uint32_t mask) {
2096
    return Word32NotEqual(Word32And(word32, Int32Constant(mask)),
2097 2098 2099
                          Int32Constant(0));
  }

2100 2101 2102 2103 2104 2105
  // Returns true if none of the mask's bits in given |word32| are set.
  TNode<BoolT> IsNotSetWord32(SloppyTNode<Word32T> word32, uint32_t mask) {
    return Word32Equal(Word32And(word32, Int32Constant(mask)),
                       Int32Constant(0));
  }

2106 2107 2108 2109 2110 2111
  // Returns true if all of the mask's bits in a given |word32| are set.
  TNode<BoolT> IsAllSetWord32(SloppyTNode<Word32T> word32, uint32_t mask) {
    TNode<Int32T> const_mask = Int32Constant(mask);
    return Word32Equal(Word32And(word32, const_mask), const_mask);
  }

2112 2113
  // Returns true if any of the |T|'s bits in given |word| are set.
  template <typename T>
2114
  TNode<BoolT> IsSetWord(SloppyTNode<WordT> word) {
2115
    return IsSetWord(word, T::kMask);
2116
  }
2117

2118
  // Returns true if any of the mask's bits in given |word| are set.
2119
  TNode<BoolT> IsSetWord(SloppyTNode<WordT> word, uint32_t mask) {
2120
    return WordNotEqual(WordAnd(word, IntPtrConstant(mask)), IntPtrConstant(0));
2121 2122
  }

2123 2124
  // Returns true if any of the mask's bit are set in the given Smi.
  // Smi-encoding of the mask is performed implicitly!
2125
  TNode<BoolT> IsSetSmi(SloppyTNode<Smi> smi, int untagged_mask) {
2126 2127 2128 2129 2130 2131
    intptr_t mask_word = bit_cast<intptr_t>(Smi::FromInt(untagged_mask));
    return WordNotEqual(
        WordAnd(BitcastTaggedToWord(smi), IntPtrConstant(mask_word)),
        IntPtrConstant(0));
  }

2132 2133
  // Returns true if all of the |T|'s bits in given |word32| are clear.
  template <typename T>
2134
  TNode<BoolT> IsClearWord32(SloppyTNode<Word32T> word32) {
2135 2136 2137 2138
    return IsClearWord32(word32, T::kMask);
  }

  // Returns true if all of the mask's bits in given |word32| are clear.
2139
  TNode<BoolT> IsClearWord32(SloppyTNode<Word32T> word32, uint32_t mask) {
2140 2141 2142 2143 2144 2145
    return Word32Equal(Word32And(word32, Int32Constant(mask)),
                       Int32Constant(0));
  }

  // Returns true if all of the |T|'s bits in given |word| are clear.
  template <typename T>
2146
  TNode<BoolT> IsClearWord(SloppyTNode<WordT> word) {
2147 2148 2149 2150
    return IsClearWord(word, T::kMask);
  }

  // Returns true if all of the mask's bits in given |word| are clear.
2151
  TNode<BoolT> IsClearWord(SloppyTNode<WordT> word, uint32_t mask) {
2152 2153 2154
    return WordEqual(WordAnd(word, IntPtrConstant(mask)), IntPtrConstant(0));
  }

2155 2156 2157 2158
  void SetCounter(StatsCounter* counter, int value);
  void IncrementCounter(StatsCounter* counter, int delta);
  void DecrementCounter(StatsCounter* counter, int delta);

2159
  void Increment(Variable* variable, int value = 1,
2160
                 ParameterMode mode = INTPTR_PARAMETERS);
2161
  void Decrement(Variable* variable, int value = 1,
2162 2163 2164
                 ParameterMode mode = INTPTR_PARAMETERS) {
    Increment(variable, -value, mode);
  }
2165

2166 2167 2168 2169 2170
  // Generates "if (false) goto label" code. Useful for marking a label as
  // "live" to avoid assertion failures during graph building. In the resulting
  // code this check will be eliminated.
  void Use(Label* label);

2171
  // Various building blocks for stubs doing property lookups.
2172 2173

  // |if_notinternalized| is optional; |if_bailout| will be used by default.
2174
  void TryToName(Node* key, Label* if_keyisindex, Variable* var_index,
2175 2176 2177 2178 2179 2180 2181 2182 2183 2184 2185 2186 2187 2188 2189
                 Label* if_keyisunique, Variable* var_unique, Label* if_bailout,
                 Label* if_notinternalized = nullptr);

  // Performs a hash computation and string table lookup for the given string,
  // and jumps to:
  // - |if_index| if the string is an array index like "123"; |var_index|
  //              will contain the intptr representation of that index.
  // - |if_internalized| if the string exists in the string table; the
  //                     internalized version will be in |var_internalized|.
  // - |if_not_internalized| if the string is not in the string table (but
  //                         does not add it).
  // - |if_bailout| for unsupported cases (e.g. uncachable array index).
  void TryInternalizeString(Node* string, Label* if_index, Variable* var_index,
                            Label* if_internalized, Variable* var_internalized,
                            Label* if_not_internalized, Label* if_bailout);
2190

2191 2192 2193
  // Calculates array index for given dictionary entry and entry field.
  // See Dictionary::EntryToIndex().
  template <typename Dictionary>
2194
  TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry, int field_index);
2195
  template <typename Dictionary>
2196
  TNode<IntPtrT> EntryToIndex(TNode<IntPtrT> entry) {
2197 2198
    return EntryToIndex<Dictionary>(entry, Dictionary::kEntryKeyIndex);
  }
2199 2200 2201 2202

  // Loads the details for the entry with the given key_index.
  // Returns an untagged int32.
  template <class ContainerType>
2203
  TNode<Uint32T> LoadDetailsByKeyIndex(Node* container, Node* key_index) {
2204 2205
    static_assert(!std::is_same<ContainerType, DescriptorArray>::value,
                  "Use the non-templatized version for DescriptorArray");
2206 2207 2208
    const int kKeyToDetailsOffset =
        (ContainerType::kEntryDetailsIndex - ContainerType::kEntryKeyIndex) *
        kPointerSize;
2209 2210
    return Unsigned(LoadAndUntagToWord32FixedArrayElement(
        CAST(container), key_index, kKeyToDetailsOffset));
2211 2212 2213 2214 2215
  }

  // Loads the value for the entry with the given key_index.
  // Returns a tagged value.
  template <class ContainerType>
2216
  TNode<Object> LoadValueByKeyIndex(Node* container, Node* key_index) {
2217 2218
    static_assert(!std::is_same<ContainerType, DescriptorArray>::value,
                  "Use the non-templatized version for DescriptorArray");
2219 2220 2221
    const int kKeyToValueOffset =
        (ContainerType::kEntryValueIndex - ContainerType::kEntryKeyIndex) *
        kPointerSize;
2222
    return LoadFixedArrayElement(CAST(container), key_index, kKeyToValueOffset);
2223 2224
  }

2225 2226 2227 2228 2229 2230 2231
  TNode<Uint32T> LoadDetailsByKeyIndex(TNode<DescriptorArray> container,
                                       TNode<IntPtrT> key_index);
  TNode<Object> LoadValueByKeyIndex(TNode<DescriptorArray> container,
                                    TNode<IntPtrT> key_index);
  TNode<MaybeObject> LoadFieldTypeByKeyIndex(TNode<DescriptorArray> container,
                                             TNode<IntPtrT> key_index);

2232 2233 2234
  // Stores the details for the entry with the given key_index.
  // |details| must be a Smi.
  template <class ContainerType>
2235 2236
  void StoreDetailsByKeyIndex(TNode<ContainerType> container,
                              TNode<IntPtrT> key_index, TNode<Smi> details) {
2237 2238 2239 2240 2241 2242 2243 2244 2245
    const int kKeyToDetailsOffset =
        (ContainerType::kEntryDetailsIndex - ContainerType::kEntryKeyIndex) *
        kPointerSize;
    StoreFixedArrayElement(container, key_index, details, SKIP_WRITE_BARRIER,
                           kKeyToDetailsOffset);
  }

  // Stores the value for the entry with the given key_index.
  template <class ContainerType>
2246
  void StoreValueByKeyIndex(
2247 2248
      TNode<ContainerType> container, TNode<IntPtrT> key_index,
      TNode<Object> value,
2249
      WriteBarrierMode write_barrier = UPDATE_WRITE_BARRIER) {
2250 2251 2252
    const int kKeyToValueOffset =
        (ContainerType::kEntryValueIndex - ContainerType::kEntryKeyIndex) *
        kPointerSize;
2253
    StoreFixedArrayElement(container, key_index, value, write_barrier,
2254 2255 2256
                           kKeyToValueOffset);
  }

2257
  // Calculate a valid size for the a hash table.
2258
  TNode<IntPtrT> HashTableComputeCapacity(TNode<IntPtrT> at_least_space_for);
2259

2260
  template <class Dictionary>
2261 2262 2263
  TNode<Smi> GetNumberOfElements(TNode<Dictionary> dictionary) {
    return CAST(
        LoadFixedArrayElement(dictionary, Dictionary::kNumberOfElementsIndex));
2264
  }
2265 2266

  template <class Dictionary>
2267 2268
  void SetNumberOfElements(TNode<Dictionary> dictionary,
                           TNode<Smi> num_elements_smi) {
2269 2270 2271
    StoreFixedArrayElement(dictionary, Dictionary::kNumberOfElementsIndex,
                           num_elements_smi, SKIP_WRITE_BARRIER);
  }
2272 2273

  template <class Dictionary>
2274 2275 2276
  TNode<Smi> GetNumberOfDeletedElements(TNode<Dictionary> dictionary) {
    return CAST(LoadFixedArrayElement(
        dictionary, Dictionary::kNumberOfDeletedElementsIndex));
2277
  }
2278 2279

  template <class Dictionary>
2280 2281
  void SetNumberOfDeletedElements(TNode<Dictionary> dictionary,
                                  TNode<Smi> num_deleted_smi) {
2282 2283 2284 2285 2286 2287
    StoreFixedArrayElement(dictionary,
                           Dictionary::kNumberOfDeletedElementsIndex,
                           num_deleted_smi, SKIP_WRITE_BARRIER);
  }

  template <class Dictionary>
2288 2289
  TNode<Smi> GetCapacity(TNode<Dictionary> dictionary) {
    return CAST(LoadFixedArrayElement(dictionary, Dictionary::kCapacityIndex));
2290
  }
2291 2292

  template <class Dictionary>
2293 2294 2295 2296
  TNode<Smi> GetNextEnumerationIndex(TNode<Dictionary> dictionary) {
    return CAST(LoadFixedArrayElement(dictionary,
                                      Dictionary::kNextEnumerationIndexIndex));
  }
2297 2298

  template <class Dictionary>
2299 2300 2301 2302 2303
  void SetNextEnumerationIndex(TNode<Dictionary> dictionary,
                               TNode<Smi> next_enum_index_smi) {
    StoreFixedArrayElement(dictionary, Dictionary::kNextEnumerationIndexIndex,
                           next_enum_index_smi, SKIP_WRITE_BARRIER);
  }
2304

2305 2306 2307 2308
  // Looks up an entry in a NameDictionaryBase successor. If the entry is found
  // control goes to {if_found} and {var_name_index} contains an index of the
  // key field of the entry found. If the key is not found control goes to
  // {if_not_found}.
2309
  static const int kInlinedDictionaryProbes = 4;
2310
  enum LookupMode { kFindExisting, kFindInsertionIndex };
2311 2312

  template <typename Dictionary>
2313
  TNode<HeapObject> LoadName(TNode<HeapObject> key);
2314

2315
  template <typename Dictionary>
2316 2317 2318
  void NameDictionaryLookup(TNode<Dictionary> dictionary,
                            TNode<Name> unique_name, Label* if_found,
                            TVariable<IntPtrT>* var_name_index,
2319
                            Label* if_not_found,
2320 2321
                            int inlined_probes = kInlinedDictionaryProbes,
                            LookupMode mode = kFindExisting);
2322

2323 2324
  Node* ComputeUnseededHash(Node* key);
  Node* ComputeSeededHash(Node* key);
2325

2326 2327 2328
  void NumberDictionaryLookup(TNode<NumberDictionary> dictionary,
                              TNode<IntPtrT> intptr_index, Label* if_found,
                              TVariable<IntPtrT>* var_entry,
2329
                              Label* if_not_found);
2330

2331 2332 2333 2334 2335
  TNode<Object> BasicLoadNumberDictionaryElement(
      TNode<NumberDictionary> dictionary, TNode<IntPtrT> intptr_index,
      Label* not_data, Label* if_hole);
  void BasicStoreNumberDictionaryElement(TNode<NumberDictionary> dictionary,
                                         TNode<IntPtrT> intptr_index,
2336 2337
                                         TNode<Object> value, Label* not_data,
                                         Label* if_hole, Label* read_only);
2338

2339
  template <class Dictionary>
2340 2341
  void FindInsertionEntry(TNode<Dictionary> dictionary, TNode<Name> key,
                          TVariable<IntPtrT>* var_key_index);
2342 2343

  template <class Dictionary>
2344 2345 2346
  void InsertEntry(TNode<Dictionary> dictionary, TNode<Name> key,
                   TNode<Object> value, TNode<IntPtrT> index,
                   TNode<Smi> enum_index);
2347 2348

  template <class Dictionary>
2349 2350
  void Add(TNode<Dictionary> dictionary, TNode<Name> key, TNode<Object> value,
           Label* bailout);
2351

2352
  // Tries to check if {object} has own {unique_name} property.
2353 2354
  void TryHasOwnProperty(Node* object, Node* map, Node* instance_type,
                         Node* unique_name, Label* if_found,
2355
                         Label* if_not_found, Label* if_bailout);
2356

2357 2358 2359
  // Operating mode for TryGetOwnProperty and CallGetterIfAccessor
  // kReturnAccessorPair is used when we're only getting the property descriptor
  enum GetOwnPropertyMode { kCallJSGetter, kReturnAccessorPair };
2360 2361 2362
  // Tries to get {object}'s own {unique_name} property value. If the property
  // is an accessor then it also calls a getter. If the property is a double
  // field it re-wraps value in an immutable heap number.
2363 2364 2365 2366
  void TryGetOwnProperty(Node* context, Node* receiver, Node* object, Node* map,
                         Node* instance_type, Node* unique_name,
                         Label* if_found, Variable* var_value,
                         Label* if_not_found, Label* if_bailout);
2367 2368 2369 2370
  void TryGetOwnProperty(Node* context, Node* receiver, Node* object, Node* map,
                         Node* instance_type, Node* unique_name,
                         Label* if_found, Variable* var_value,
                         Variable* var_details, Variable* var_raw_value,
2371
                         Label* if_not_found, Label* if_bailout,
2372
                         GetOwnPropertyMode mode);
2373

2374 2375
  TNode<Object> GetProperty(SloppyTNode<Context> context,
                            SloppyTNode<Object> receiver, Handle<Name> name) {
2376 2377 2378
    return GetProperty(context, receiver, HeapConstant(name));
  }

2379 2380 2381
  TNode<Object> GetProperty(SloppyTNode<Context> context,
                            SloppyTNode<Object> receiver,
                            SloppyTNode<Object> name) {
2382 2383 2384 2385 2386 2387 2388
    return CallBuiltin(Builtins::kGetProperty, context, receiver, name);
  }

  TNode<Object> SetPropertyStrict(TNode<Context> context,
                                  TNode<Object> receiver, TNode<Object> key,
                                  TNode<Object> value) {
    return CallBuiltin(Builtins::kSetProperty, context, receiver, key, value);
2389 2390
  }

2391 2392 2393
  Node* GetMethod(Node* context, Node* object, Handle<Name> name,
                  Label* if_null_or_undefined);

2394
  template <class... TArgs>
2395
  TNode<Object> CallBuiltin(Builtins::Name id, SloppyTNode<Object> context,
2396
                            TArgs... args) {
2397 2398
    DCHECK_IMPLIES(Builtins::KindOf(id) == Builtins::TFJ,
                   !Builtins::IsLazy(id));
2399 2400
    return CallStub<Object>(Builtins::CallableFor(isolate(), id), context,
                            args...);
2401 2402
  }

2403
  template <class... TArgs>
2404 2405
  void TailCallBuiltin(Builtins::Name id, SloppyTNode<Object> context,
                       TArgs... args) {
2406 2407
    DCHECK_IMPLIES(Builtins::KindOf(id) == Builtins::TFJ,
                   !Builtins::IsLazy(id));
2408
    return TailCallStub(Builtins::CallableFor(isolate(), id), context, args...);
2409 2410
  }

2411 2412
  void LoadPropertyFromFastObject(Node* object, Node* map,
                                  TNode<DescriptorArray> descriptors,
2413 2414 2415
                                  Node* name_index, Variable* var_details,
                                  Variable* var_value);

2416 2417
  void LoadPropertyFromFastObject(Node* object, Node* map,
                                  TNode<DescriptorArray> descriptors,
2418 2419 2420
                                  Node* name_index, Node* details,
                                  Variable* var_value);

2421
  void LoadPropertyFromNameDictionary(Node* dictionary, Node* entry,
2422 2423 2424
                                      Variable* var_details,
                                      Variable* var_value);

2425
  void LoadPropertyFromGlobalDictionary(Node* dictionary, Node* entry,
2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440
                                        Variable* var_details,
                                        Variable* var_value, Label* if_deleted);

  // Generic property lookup generator. If the {object} is fast and
  // {unique_name} property is found then the control goes to {if_found_fast}
  // label and {var_meta_storage} and {var_name_index} will contain
  // DescriptorArray and an index of the descriptor's name respectively.
  // If the {object} is slow or global then the control goes to {if_found_dict}
  // or {if_found_global} and the {var_meta_storage} and {var_name_index} will
  // contain a dictionary and an index of the key field of the found entry.
  // If property is not found or given lookup is not supported then
  // the control goes to {if_not_found} or {if_bailout} respectively.
  //
  // Note: this code does not check if the global dictionary points to deleted
  // entry! This has to be done by the caller.
2441 2442 2443
  void TryLookupProperty(SloppyTNode<JSObject> object, SloppyTNode<Map> map,
                         SloppyTNode<Int32T> instance_type,
                         SloppyTNode<Name> unique_name, Label* if_found_fast,
2444
                         Label* if_found_dict, Label* if_found_global,
2445 2446
                         TVariable<HeapObject>* var_meta_storage,
                         TVariable<IntPtrT>* var_name_index,
2447 2448
                         Label* if_not_found, Label* if_bailout);

2449 2450 2451 2452 2453 2454 2455 2456 2457 2458
  // This is a building block for TryLookupProperty() above. Supports only
  // non-special fast and dictionary objects.
  void TryLookupPropertyInSimpleObject(TNode<JSObject> object, TNode<Map> map,
                                       TNode<Name> unique_name,
                                       Label* if_found_fast,
                                       Label* if_found_dict,
                                       TVariable<HeapObject>* var_meta_storage,
                                       TVariable<IntPtrT>* var_name_index,
                                       Label* if_not_found);

2459 2460 2461
  // This method jumps to if_found if the element is known to exist. To
  // if_absent if it's known to not exist. To if_not_found if the prototype
  // chain needs to be checked. And if_bailout if the lookup is unsupported.
2462
  void TryLookupElement(Node* object, Node* map,
2463 2464 2465
                        SloppyTNode<Int32T> instance_type,
                        SloppyTNode<IntPtrT> intptr_index, Label* if_found,
                        Label* if_absent, Label* if_not_found,
2466
                        Label* if_bailout);
2467

2468
  // This is a type of a lookup in holder generator function. In case of a
2469
  // property lookup the {key} is guaranteed to be an unique name and in case of
2470
  // element lookup the key is an Int32 index.
2471 2472
  typedef std::function<void(Node* receiver, Node* holder, Node* map,
                             Node* instance_type, Node* key, Label* next_holder,
2473 2474 2475
                             Label* if_bailout)>
      LookupInHolder;

2476 2477 2478 2479 2480 2481 2482 2483 2484
  // For integer indexed exotic cases, check if the given string cannot be a
  // special index. If we are not sure that the given string is not a special
  // index with a simple check, return False. Note that "False" return value
  // does not mean that the name_string is a special index in the current
  // implementation.
  void BranchIfMaybeSpecialIndex(TNode<String> name_string,
                                 Label* if_maybe_special_index,
                                 Label* if_not_special_index);

2485 2486 2487 2488 2489 2490
  // Generic property prototype chain lookup generator.
  // For properties it generates lookup using given {lookup_property_in_holder}
  // and for elements it uses {lookup_element_in_holder}.
  // Upon reaching the end of prototype chain the control goes to {if_end}.
  // If it can't handle the case {receiver}/{key} case then the control goes
  // to {if_bailout}.
2491
  // If {if_proxy} is nullptr, proxies go to if_bailout.
2492
  void TryPrototypeChainLookup(Node* receiver, Node* key,
2493 2494
                               const LookupInHolder& lookup_property_in_holder,
                               const LookupInHolder& lookup_element_in_holder,
2495 2496
                               Label* if_end, Label* if_bailout,
                               Label* if_proxy = nullptr);
2497

2498
  // Instanceof helpers.
2499 2500 2501 2502
  // Returns true if {object} has {prototype} somewhere in it's prototype
  // chain, otherwise false is returned. Might cause arbitrary side effects
  // due to [[GetPrototypeOf]] invocations.
  Node* HasInPrototypeChain(Node* context, Node* object, Node* prototype);
2503
  // ES6 section 7.3.19 OrdinaryHasInstance (C, O)
2504
  Node* OrdinaryHasInstance(Node* context, Node* callable, Node* object);
2505

2506
  // Load type feedback vector from the stub caller's frame.
2507
  TNode<FeedbackVector> LoadFeedbackVectorForStub();
2508

2509
  // Load type feedback vector for the given closure.
2510 2511
  TNode<FeedbackVector> LoadFeedbackVector(SloppyTNode<JSFunction> closure,
                                           Label* if_undefined = nullptr);
2512

2513
  // Update the type feedback vector.
2514
  void UpdateFeedback(Node* feedback, Node* feedback_vector, Node* slot_id);
2515

2516 2517 2518 2519 2520
  // Report that there was a feedback update, performing any tasks that should
  // be done after a feedback update.
  void ReportFeedbackUpdate(SloppyTNode<FeedbackVector> feedback_vector,
                            SloppyTNode<IntPtrT> slot_id, const char* reason);

2521 2522 2523
  // Combine the new feedback with the existing_feedback. Do nothing if
  // existing_feedback is nullptr.
  void CombineFeedback(Variable* existing_feedback, int feedback);
2524 2525
  void CombineFeedback(Variable* existing_feedback, Node* feedback);

2526 2527 2528 2529
  // Overwrite the existing feedback with new_feedback. Do nothing if
  // existing_feedback is nullptr.
  void OverwriteFeedback(Variable* existing_feedback, int new_feedback);

2530 2531 2532 2533
  // Check if a property name might require protector invalidation when it is
  // used for a property store or deletion.
  void CheckForAssociatedProtector(Node* name, Label* if_protector);

2534
  TNode<Map> LoadReceiverMap(SloppyTNode<Object> receiver);
2535

2536
  // Emits keyed sloppy arguments load. Returns either the loaded value.
2537
  Node* LoadKeyedSloppyArguments(Node* receiver, Node* key, Label* bailout) {
2538 2539 2540 2541
    return EmitKeyedSloppyArguments(receiver, key, nullptr, bailout);
  }

  // Emits keyed sloppy arguments store.
2542 2543
  void StoreKeyedSloppyArguments(Node* receiver, Node* key, Node* value,
                                 Label* bailout) {
2544 2545 2546 2547
    DCHECK_NOT_NULL(value);
    EmitKeyedSloppyArguments(receiver, key, value, bailout);
  }

2548
  // Loads script context from the script context table.
2549 2550
  TNode<Context> LoadScriptContext(TNode<Context> context,
                                   TNode<IntPtrT> context_index);
2551

2552 2553 2554
  Node* Int32ToUint8Clamped(Node* int32_value);
  Node* Float64ToUint8Clamped(Node* float64_value);

2555 2556 2557
  Node* PrepareValueForWriteToTypedArray(TNode<Object> input,
                                         ElementsKind elements_kind,
                                         TNode<Context> context);
2558 2559

  // Store value to an elements array with given elements kind.
2560
  void StoreElement(Node* elements, ElementsKind kind, Node* index, Node* value,
2561 2562
                    ParameterMode mode);

2563 2564 2565 2566 2567 2568
  void EmitBigTypedArrayElementStore(TNode<JSTypedArray> object,
                                     TNode<FixedTypedArrayBase> elements,
                                     TNode<IntPtrT> intptr_key,
                                     TNode<Object> value,
                                     TNode<Context> context,
                                     Label* opt_if_neutered);
2569
  // Part of the above, refactored out to reuse in another place
2570 2571
  void EmitBigTypedArrayElementStore(TNode<FixedTypedArrayBase> elements,
                                     TNode<RawPtrT> backing_store,
2572 2573
                                     TNode<IntPtrT> offset,
                                     TNode<BigInt> bigint_value);
2574

2575
  void EmitElementStore(Node* object, Node* key, Node* value, bool is_jsarray,
2576
                        ElementsKind elements_kind,
2577 2578
                        KeyedAccessStoreMode store_mode, Label* bailout,
                        Node* context);
2579

2580
  Node* CheckForCapacityGrow(Node* object, Node* elements, ElementsKind kind,
2581 2582 2583
                             KeyedAccessStoreMode store_mode, Node* length,
                             Node* key, ParameterMode mode, bool is_js_array,
                             Label* bailout);
2584

2585 2586
  Node* CopyElementsOnWrite(Node* object, Node* elements, ElementsKind kind,
                            Node* length, ParameterMode mode, Label* bailout);
2587

2588 2589 2590
  void TransitionElementsKind(Node* object, Node* map, ElementsKind from_kind,
                              ElementsKind to_kind, bool is_jsarray,
                              Label* bailout);
2591

2592 2593 2594 2595 2596 2597
  void TransitionElementsKind(TNode<JSReceiver> object, TNode<Map> map,
                              ElementsKind from_kind, ElementsKind to_kind,
                              Label* bailout) {
    TransitionElementsKind(object, map, from_kind, to_kind, true, bailout);
  }

2598
  void TrapAllocationMemento(Node* object, Label* memento_found);
2599

2600
  TNode<IntPtrT> PageFromAddress(TNode<IntPtrT> address);
2601

2602 2603
  // Store a weak in-place reference into the FeedbackVector.
  TNode<MaybeObject> StoreWeakReferenceInFeedbackVector(
2604 2605 2606
      SloppyTNode<FeedbackVector> feedback_vector, Node* slot,
      SloppyTNode<HeapObject> value, int additional_offset = 0,
      ParameterMode parameter_mode = INTPTR_PARAMETERS);
2607

2608
  // Create a new AllocationSite and install it into a feedback vector.
2609
  TNode<AllocationSite> CreateAllocationSiteInFeedbackVector(
2610
      SloppyTNode<FeedbackVector> feedback_vector, TNode<Smi> slot);
2611

2612 2613 2614 2615 2616 2617
  // TODO(ishell, cbruni): Change to HasBoilerplate.
  TNode<BoolT> NotHasBoilerplate(TNode<Object> maybe_literal_site);
  TNode<Smi> LoadTransitionInfo(TNode<AllocationSite> allocation_site);
  TNode<JSObject> LoadBoilerplate(TNode<AllocationSite> allocation_site);
  TNode<Int32T> LoadElementsKind(TNode<AllocationSite> allocation_site);

2618 2619
  enum class IndexAdvanceMode { kPre, kPost };

2620 2621
  typedef std::function<void(Node* index)> FastLoopBody;

2622
  Node* BuildFastLoop(const VariableList& var_list, Node* start_index,
2623
                      Node* end_index, const FastLoopBody& body, int increment,
2624 2625 2626 2627 2628 2629 2630 2631 2632
                      ParameterMode parameter_mode,
                      IndexAdvanceMode advance_mode = IndexAdvanceMode::kPre);

  Node* BuildFastLoop(Node* start_index, Node* end_index,
                      const FastLoopBody& body, int increment,
                      ParameterMode parameter_mode,
                      IndexAdvanceMode advance_mode = IndexAdvanceMode::kPre) {
    return BuildFastLoop(VariableList(0, zone()), start_index, end_index, body,
                         increment, parameter_mode, advance_mode);
2633
  }
2634 2635 2636

  enum class ForEachDirection { kForward, kReverse };

2637 2638 2639
  typedef std::function<void(Node* fixed_array, Node* offset)>
      FastFixedArrayForEachBody;

2640
  void BuildFastFixedArrayForEach(
2641 2642
      const CodeStubAssembler::VariableList& vars, Node* fixed_array,
      ElementsKind kind, Node* first_element_inclusive,
2643
      Node* last_element_exclusive, const FastFixedArrayForEachBody& body,
2644 2645 2646
      ParameterMode mode = INTPTR_PARAMETERS,
      ForEachDirection direction = ForEachDirection::kReverse);

2647 2648 2649 2650 2651 2652 2653 2654 2655 2656
  void BuildFastFixedArrayForEach(
      Node* fixed_array, ElementsKind kind, Node* first_element_inclusive,
      Node* last_element_exclusive, const FastFixedArrayForEachBody& body,
      ParameterMode mode = INTPTR_PARAMETERS,
      ForEachDirection direction = ForEachDirection::kReverse) {
    CodeStubAssembler::VariableList list(0, zone());
    BuildFastFixedArrayForEach(list, fixed_array, kind, first_element_inclusive,
                               last_element_exclusive, body, mode, direction);
  }

2657 2658
  TNode<IntPtrT> GetArrayAllocationSize(Node* element_count, ElementsKind kind,
                                        ParameterMode mode, int header_size) {
2659 2660 2661
    return ElementOffsetFromIndex(element_count, kind, mode, header_size);
  }

2662 2663 2664
  TNode<IntPtrT> GetFixedArrayAllocationSize(Node* element_count,
                                             ElementsKind kind,
                                             ParameterMode mode) {
2665
    return GetArrayAllocationSize(element_count, kind, mode,
2666 2667 2668
                                  FixedArray::kHeaderSize);
  }

2669 2670
  TNode<IntPtrT> GetPropertyArrayAllocationSize(Node* element_count,
                                                ParameterMode mode) {
2671 2672 2673 2674
    return GetArrayAllocationSize(element_count, PACKED_ELEMENTS, mode,
                                  PropertyArray::kHeaderSize);
  }

2675 2676 2677 2678
  void GotoIfFixedArraySizeDoesntFitInNewSpace(Node* element_count,
                                               Label* doesnt_fit, int base_size,
                                               ParameterMode mode);

2679
  void InitializeFieldsWithRoot(Node* object, Node* start_offset,
2680
                                Node* end_offset, RootIndex root);
2681

2682 2683
  Node* RelationalComparison(Operation op, Node* left, Node* right,
                             Node* context,
2684
                             Variable* var_type_feedback = nullptr);
2685

2686 2687
  void BranchIfNumberRelationalComparison(Operation op, Node* left, Node* right,
                                          Label* if_true, Label* if_false);
2688

2689 2690 2691 2692 2693 2694 2695 2696
  void BranchIfNumberEqual(TNode<Number> left, TNode<Number> right,
                           Label* if_true, Label* if_false) {
    BranchIfNumberRelationalComparison(Operation::kEqual, left, right, if_true,
                                       if_false);
  }

  void BranchIfNumberLessThan(TNode<Number> left, TNode<Number> right,
                              Label* if_true, Label* if_false) {
2697 2698 2699 2700
    BranchIfNumberRelationalComparison(Operation::kLessThan, left, right,
                                       if_true, if_false);
  }

2701 2702
  void BranchIfNumberLessThanOrEqual(TNode<Number> left, TNode<Number> right,
                                     Label* if_true, Label* if_false) {
2703 2704 2705 2706
    BranchIfNumberRelationalComparison(Operation::kLessThanOrEqual, left, right,
                                       if_true, if_false);
  }

2707 2708
  void BranchIfNumberGreaterThan(TNode<Number> left, TNode<Number> right,
                                 Label* if_true, Label* if_false) {
2709 2710 2711 2712
    BranchIfNumberRelationalComparison(Operation::kGreaterThan, left, right,
                                       if_true, if_false);
  }

2713 2714
  void BranchIfNumberGreaterThanOrEqual(TNode<Number> left, TNode<Number> right,
                                        Label* if_true, Label* if_false) {
2715 2716 2717 2718
    BranchIfNumberRelationalComparison(Operation::kGreaterThanOrEqual, left,
                                       right, if_true, if_false);
  }

2719 2720 2721 2722 2723 2724
  void BranchIfAccessorPair(Node* value, Label* if_accessor_pair,
                            Label* if_not_accessor_pair) {
    GotoIf(TaggedIsSmi(value), if_not_accessor_pair);
    Branch(IsAccessorPair(value), if_accessor_pair, if_not_accessor_pair);
  }

2725
  void GotoIfNumberGreaterThanOrEqual(Node* left, Node* right, Label* if_false);
2726

2727 2728
  Node* Equal(Node* lhs, Node* rhs, Node* context,
              Variable* var_type_feedback = nullptr);
2729

2730 2731
  Node* StrictEqual(Node* lhs, Node* rhs,
                    Variable* var_type_feedback = nullptr);
2732

2733 2734 2735
  // ECMA#sec-samevalue
  // Similar to StrictEqual except that NaNs are treated as equal and minus zero
  // differs from positive zero.
2736
  void BranchIfSameValue(Node* lhs, Node* rhs, Label* if_true, Label* if_false);
2737

2738 2739
  enum HasPropertyLookupMode { kHasProperty, kForInHasProperty };

2740 2741
  TNode<Oddball> HasProperty(SloppyTNode<Context> context,
                             SloppyTNode<Object> object,
2742
                             SloppyTNode<Object> key,
2743
                             HasPropertyLookupMode mode);
2744

2745 2746 2747 2748 2749 2750 2751 2752
  // Due to naming conflict with the builtin function namespace.
  TNode<Oddball> HasProperty_Inline(TNode<Context> context,
                                    TNode<JSReceiver> object,
                                    TNode<Object> key) {
    return HasProperty(context, object, key,
                       HasPropertyLookupMode::kHasProperty);
  }

2753
  Node* Typeof(Node* value);
2754

2755 2756
  TNode<Object> GetSuperConstructor(SloppyTNode<Context> context,
                                    SloppyTNode<JSFunction> active_function);
2757

2758 2759 2760
  TNode<Object> SpeciesConstructor(SloppyTNode<Context> context,
                                   SloppyTNode<Object> object,
                                   SloppyTNode<Object> default_constructor);
2761

2762
  Node* InstanceOf(Node* object, Node* callable, Node* context);
2763

2764
  // Debug helpers
2765
  Node* IsDebugActive();
2766

2767 2768
  TNode<BoolT> IsRuntimeCallStatsEnabled();

2769 2770 2771 2772
  // JSArrayBuffer helpers
  TNode<Uint32T> LoadJSArrayBufferBitField(TNode<JSArrayBuffer> array_buffer);
  TNode<RawPtrT> LoadJSArrayBufferBackingStore(
      TNode<JSArrayBuffer> array_buffer);
2773
  Node* IsDetachedBuffer(Node* buffer);
2774 2775 2776
  void ThrowIfArrayBufferIsDetached(SloppyTNode<Context> context,
                                    TNode<JSArrayBuffer> array_buffer,
                                    const char* method_name);
2777 2778 2779 2780 2781 2782 2783 2784

  // JSArrayBufferView helpers
  TNode<JSArrayBuffer> LoadJSArrayBufferViewBuffer(
      TNode<JSArrayBufferView> array_buffer_view);
  TNode<UintPtrT> LoadJSArrayBufferViewByteLength(
      TNode<JSArrayBufferView> array_buffer_view);
  TNode<UintPtrT> LoadJSArrayBufferViewByteOffset(
      TNode<JSArrayBufferView> array_buffer_view);
2785 2786 2787
  void ThrowIfArrayBufferViewBufferIsDetached(
      SloppyTNode<Context> context, TNode<JSArrayBufferView> array_buffer_view,
      const char* method_name);
2788 2789 2790

  // JSTypedArray helpers
  TNode<Smi> LoadJSTypedArrayLength(TNode<JSTypedArray> typed_array);
2791

2792 2793
  TNode<IntPtrT> ElementOffsetFromIndex(Node* index, ElementsKind kind,
                                        ParameterMode mode, int base_size = 0);
2794

2795 2796 2797 2798 2799
  // Check that a field offset is within the bounds of the an object.
  TNode<BoolT> IsOffsetInBounds(SloppyTNode<IntPtrT> offset,
                                SloppyTNode<IntPtrT> length, int header_size,
                                ElementsKind kind = HOLEY_ELEMENTS);

2800 2801 2802 2803
  // Load a builtin's code from the builtin array in the isolate.
  TNode<Code> LoadBuiltin(TNode<Smi> builtin_id);

  // Figure out the SFI's code object using its data field.
2804 2805
  // If |if_compile_lazy| is provided then the execution will go to the given
  // label in case of an CompileLazy code object.
2806
  TNode<Code> GetSharedFunctionInfoCode(
2807 2808
      SloppyTNode<SharedFunctionInfo> shared_info,
      Label* if_compile_lazy = nullptr);
2809

2810 2811 2812
  Node* AllocateFunctionWithMapAndContext(Node* map, Node* shared_info,
                                          Node* context);

2813
  // Promise helpers
2814 2815 2816
  Node* IsPromiseHookEnabled();
  Node* HasAsyncEventDelegate();
  Node* IsPromiseHookEnabledOrHasAsyncEventDelegate();
2817

2818 2819 2820 2821 2822 2823
  // Helpers for StackFrame markers.
  Node* MarkerIsFrameType(Node* marker_or_function,
                          StackFrame::Type frame_type);
  Node* MarkerIsNotFrameType(Node* marker_or_function,
                             StackFrame::Type frame_type);

2824 2825 2826 2827 2828
  // for..in helpers
  void CheckPrototypeEnumCache(Node* receiver, Node* receiver_map,
                               Label* if_fast, Label* if_slow);
  Node* CheckEnumCache(Node* receiver, Label* if_empty, Label* if_runtime);

2829 2830 2831
  TNode<IntPtrT> GetArgumentsLength(CodeStubArguments* args);
  TNode<Object> GetArgumentValue(CodeStubArguments* args, TNode<IntPtrT> index);

2832 2833 2834
  // Support for printf-style debugging
  void Print(const char* s);
  void Print(const char* prefix, Node* tagged_value);
2835 2836 2837
  inline void Print(SloppyTNode<Object> tagged_value) {
    return Print(nullptr, tagged_value);
  }
2838 2839 2840
  inline void Print(TNode<MaybeObject> tagged_value) {
    return Print(nullptr, tagged_value);
  }
2841

2842 2843 2844 2845 2846 2847 2848 2849 2850 2851
  template <class... TArgs>
  Node* MakeTypeError(MessageTemplate::Template message, Node* context,
                      TArgs... args) {
    STATIC_ASSERT(sizeof...(TArgs) <= 3);
    Node* const make_type_error = LoadContextElement(
        LoadNativeContext(context), Context::MAKE_TYPE_ERROR_INDEX);
    return CallJS(CodeFactory::Call(isolate()), context, make_type_error,
                  UndefinedConstant(), SmiConstant(message), args...);
  }

2852
  void Abort(AbortReason reason) {
2853 2854 2855 2856
    CallRuntime(Runtime::kAbort, NoContextConstant(), SmiConstant(reason));
    Unreachable();
  }

2857 2858
  bool ConstexprBoolNot(bool value) { return !value; }

2859 2860
  bool ConstexprInt31Equal(int31_t a, int31_t b) { return a == b; }

2861
  void PerformStackCheck(TNode<Context> context);
2862

2863
 protected:
2864 2865 2866 2867 2868
  // Implements DescriptorArray::Search().
  void DescriptorLookup(SloppyTNode<Name> unique_name,
                        SloppyTNode<DescriptorArray> descriptors,
                        SloppyTNode<Uint32T> bitfield3, Label* if_found,
                        TVariable<IntPtrT>* var_name_index,
2869
                        Label* if_not_found);
2870

2871 2872 2873 2874 2875 2876 2877 2878
  // Implements TransitionArray::SearchName() - searches for first transition
  // entry with given name (note that there could be multiple entries with
  // the same name).
  void TransitionLookup(SloppyTNode<Name> unique_name,
                        SloppyTNode<TransitionArray> transitions,
                        Label* if_found, TVariable<IntPtrT>* var_name_index,
                        Label* if_not_found);

2879 2880 2881 2882 2883 2884 2885 2886 2887 2888 2889 2890 2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909
  // Implements generic search procedure like i::Search<Array>().
  template <typename Array>
  void Lookup(TNode<Name> unique_name, TNode<Array> array,
              TNode<Uint32T> number_of_valid_entries, Label* if_found,
              TVariable<IntPtrT>* var_name_index, Label* if_not_found);

  // Implements generic linear search procedure like i::LinearSearch<Array>().
  template <typename Array>
  void LookupLinear(TNode<Name> unique_name, TNode<Array> array,
                    TNode<Uint32T> number_of_valid_entries, Label* if_found,
                    TVariable<IntPtrT>* var_name_index, Label* if_not_found);

  // Implements generic binary search procedure like i::BinarySearch<Array>().
  template <typename Array>
  void LookupBinary(TNode<Name> unique_name, TNode<Array> array,
                    TNode<Uint32T> number_of_valid_entries, Label* if_found,
                    TVariable<IntPtrT>* var_name_index, Label* if_not_found);

  // Converts [Descriptor/Transition]Array entry number to a fixed array index.
  template <typename Array>
  TNode<IntPtrT> EntryIndexToIndex(TNode<Uint32T> entry_index);

  // Implements [Descriptor/Transition]Array::ToKeyIndex.
  template <typename Array>
  TNode<IntPtrT> ToKeyIndex(TNode<Uint32T> entry_index);

  // Implements [Descriptor/Transition]Array::GetKey.
  template <typename Array>
  TNode<Name> GetKey(TNode<Array> array, TNode<Uint32T> entry_index);

  // Implements DescriptorArray::GetDetails.
2910 2911
  TNode<Uint32T> DescriptorArrayGetDetails(TNode<DescriptorArray> descriptors,
                                           TNode<Uint32T> descriptor_number);
2912

2913 2914 2915 2916 2917 2918 2919 2920
  typedef std::function<void(TNode<UintPtrT> descriptor_key_index)>
      ForEachDescriptorBodyFunction;

  void DescriptorArrayForEach(VariableList& variable_list,
                              TNode<Uint32T> start_descriptor,
                              TNode<Uint32T> end_descriptor,
                              const ForEachDescriptorBodyFunction& body);

2921 2922 2923 2924 2925 2926 2927 2928 2929 2930 2931
  typedef std::function<void(TNode<Name> key, TNode<Object> value)>
      ForEachKeyValueFunction;

  // For each JSObject property (in DescriptorArray order), check if the key is
  // enumerable, and if so, load the value from the receiver and evaluate the
  // closure.
  void ForEachEnumerableOwnProperty(TNode<Context> context, TNode<Map> map,
                                    TNode<JSObject> object,
                                    const ForEachKeyValueFunction& body,
                                    Label* bailout);

2932 2933 2934
  TNode<Object> CallGetterIfAccessor(Node* value, Node* details, Node* context,
                                     Node* receiver, Label* if_bailout,
                                     GetOwnPropertyMode mode = kCallJSGetter);
2935

2936
  TNode<IntPtrT> TryToIntptr(Node* key, Label* miss);
2937

2938
  void BranchIfPrototypesHaveNoElements(Node* receiver_map,
2939 2940
                                        Label* definitely_no_elements,
                                        Label* possibly_elements);
2941

2942 2943 2944
  void InitializeFunctionContext(Node* native_context, Node* context,
                                 int slots);

2945 2946 2947
 private:
  friend class CodeStubArguments;

2948 2949
  void HandleBreakOnNode();

2950 2951
  Node* AllocateRawDoubleAligned(Node* size_in_bytes, AllocationFlags flags,
                                 Node* top_address, Node* limit_address);
2952 2953
  Node* AllocateRawUnaligned(Node* size_in_bytes, AllocationFlags flags,
                             Node* top_adddress, Node* limit_address);
2954 2955
  Node* AllocateRaw(Node* size_in_bytes, AllocationFlags flags,
                    Node* top_address, Node* limit_address);
2956 2957
  // Allocate and return a JSArray of given total size in bytes with header
  // fields initialized.
2958 2959
  Node* AllocateUninitializedJSArray(Node* array_map, Node* length,
                                     Node* allocation_site,
2960
                                     Node* size_in_bytes);
2961

2962
  TNode<BoolT> IsValidSmi(TNode<Smi> smi);
2963
  Node* SmiShiftBitsConstant();
2964

2965 2966
  // Emits keyed sloppy arguments load if the |value| is nullptr or store
  // otherwise. Returns either the loaded value or |value|.
2967 2968 2969
  Node* EmitKeyedSloppyArguments(Node* receiver, Node* key, Node* value,
                                 Label* bailout);

2970
  TNode<String> AllocateSlicedString(RootIndex map_root_index,
2971 2972
                                     TNode<Uint32T> length,
                                     TNode<String> parent, TNode<Smi> offset);
2973

2974
  TNode<String> AllocateConsString(RootIndex map_root_index,
2975
                                   TNode<Uint32T> length, TNode<String> first,
2976
                                   TNode<String> second, AllocationFlags flags);
2977

2978 2979 2980
  // Allocate a MutableHeapNumber without initializing its value.
  TNode<MutableHeapNumber> AllocateMutableHeapNumber();

2981 2982 2983
  Node* SelectImpl(TNode<BoolT> condition, const NodeGenerator& true_body,
                   const NodeGenerator& false_body, MachineRepresentation rep);

2984 2985 2986 2987 2988 2989 2990 2991
  // Implements [Descriptor/Transition]Array::number_of_entries.
  template <typename Array>
  TNode<Uint32T> NumberOfEntries(TNode<Array> array);

  // Implements [Descriptor/Transition]Array::GetSortedKeyIndex.
  template <typename Array>
  TNode<Uint32T> GetSortedKeyIndex(TNode<Array> descriptors,
                                   TNode<Uint32T> entry_index);
2992

2993
  TNode<Smi> CollectFeedbackForString(SloppyTNode<Int32T> instance_type);
2994 2995
  void GenerateEqual_Same(Node* value, Label* if_equal, Label* if_notequal,
                          Variable* var_type_feedback = nullptr);
2996 2997 2998
  TNode<String> AllocAndCopyStringCharacters(Node* from,
                                             Node* from_instance_type,
                                             TNode<IntPtrT> from_index,
2999
                                             TNode<IntPtrT> character_count);
3000

3001
  static const int kElementLoopUnrollThreshold = 8;
3002

3003 3004 3005 3006
  // {convert_bigint} is only meaningful when {mode} == kToNumber.
  Node* NonNumberToNumberOrNumeric(
      Node* context, Node* input, Object::Conversion mode,
      BigIntHandling bigint_handling = BigIntHandling::kThrow);
3007 3008

  void TaggedToNumeric(Node* context, Node* value, Label* done,
3009
                       Variable* var_numeric, Variable* var_feedback);
3010

3011
  template <Object::Conversion conversion>
3012 3013 3014 3015 3016
  void TaggedToWord32OrBigIntImpl(Node* context, Node* value, Label* if_number,
                                  Variable* var_word32,
                                  Label* if_bigint = nullptr,
                                  Variable* var_bigint = nullptr,
                                  Variable* var_feedback = nullptr);
3017 3018
};

3019 3020
class CodeStubArguments {
 public:
3021
  typedef compiler::Node Node;
3022 3023 3024 3025
  template <class T>
  using TNode = compiler::TNode<T>;
  template <class T>
  using SloppyTNode = compiler::SloppyTNode<T>;
3026
  enum ReceiverMode { kHasReceiver, kNoReceiver };
3027

3028
  // |argc| is an intptr value which specifies the number of arguments passed
3029 3030
  // to the builtin excluding the receiver. The arguments will include a
  // receiver iff |receiver_mode| is kHasReceiver.
3031
  CodeStubArguments(CodeStubAssembler* assembler, Node* argc,
3032
                    ReceiverMode receiver_mode = ReceiverMode::kHasReceiver)
3033
      : CodeStubArguments(assembler, argc, nullptr,
3034 3035
                          CodeStubAssembler::INTPTR_PARAMETERS, receiver_mode) {
  }
3036

3037 3038
  // |argc| is either a smi or intptr depending on |param_mode|. The arguments
  // include a receiver iff |receiver_mode| is kHasReceiver.
3039 3040
  CodeStubArguments(CodeStubAssembler* assembler, Node* argc, Node* fp,
                    CodeStubAssembler::ParameterMode param_mode,
3041
                    ReceiverMode receiver_mode = ReceiverMode::kHasReceiver);
3042

3043
  TNode<Object> GetReceiver() const;
3044 3045 3046 3047
  // Replaces receiver argument on the expression stack. Should be used only
  // for manipulating arguments in trampoline builtins before tail calling
  // further with passing all the JS arguments as is.
  void SetReceiver(TNode<Object> object) const;
3048

3049 3050 3051
  TNode<RawPtr<Object>> AtIndexPtr(
      Node* index, CodeStubAssembler::ParameterMode mode =
                       CodeStubAssembler::INTPTR_PARAMETERS) const;
3052

3053
  // |index| is zero-based and does not include the receiver
3054 3055 3056
  TNode<Object> AtIndex(Node* index,
                        CodeStubAssembler::ParameterMode mode =
                            CodeStubAssembler::INTPTR_PARAMETERS) const;
3057

3058
  TNode<Object> AtIndex(int index) const;
3059

3060
  TNode<Object> GetOptionalArgumentValue(int index) {
3061 3062
    return GetOptionalArgumentValue(index, assembler_->UndefinedConstant());
  }
3063
  TNode<Object> GetOptionalArgumentValue(int index,
3064
                                         TNode<Object> default_value);
3065

3066 3067 3068 3069
  Node* GetLength(CodeStubAssembler::ParameterMode mode) const {
    DCHECK_EQ(mode, argc_mode_);
    return argc_;
  }
3070

3071 3072 3073 3074 3075 3076 3077 3078 3079 3080
  TNode<Object> GetOptionalArgumentValue(TNode<IntPtrT> index) {
    return GetOptionalArgumentValue(index, assembler_->UndefinedConstant());
  }
  TNode<Object> GetOptionalArgumentValue(TNode<IntPtrT> index,
                                         TNode<Object> default_value);
  TNode<IntPtrT> GetLength() const {
    DCHECK_EQ(argc_mode_, CodeStubAssembler::INTPTR_PARAMETERS);
    return assembler_->UncheckedCast<IntPtrT>(argc_);
  }

3081
  typedef std::function<void(Node* arg)> ForEachBodyFunction;
3082 3083

  // Iteration doesn't include the receiver. |first| and |last| are zero-based.
3084
  void ForEach(const ForEachBodyFunction& body, Node* first = nullptr,
3085 3086 3087
               Node* last = nullptr,
               CodeStubAssembler::ParameterMode mode =
                   CodeStubAssembler::INTPTR_PARAMETERS) {
3088 3089 3090 3091 3092 3093
    CodeStubAssembler::VariableList list(0, assembler_->zone());
    ForEach(list, body, first, last);
  }

  // Iteration doesn't include the receiver. |first| and |last| are zero-based.
  void ForEach(const CodeStubAssembler::VariableList& vars,
3094
               const ForEachBodyFunction& body, Node* first = nullptr,
3095 3096 3097
               Node* last = nullptr,
               CodeStubAssembler::ParameterMode mode =
                   CodeStubAssembler::INTPTR_PARAMETERS);
3098

3099
  void PopAndReturn(Node* value);
3100 3101

 private:
3102
  Node* GetArguments();
3103 3104

  CodeStubAssembler* assembler_;
3105
  CodeStubAssembler::ParameterMode argc_mode_;
3106
  ReceiverMode receiver_mode_;
3107
  Node* argc_;
3108
  TNode<RawPtr<Object>> arguments_;
3109
  Node* fp_;
3110 3111
};

3112 3113 3114 3115 3116
class ToDirectStringAssembler : public CodeStubAssembler {
 private:
  enum StringPointerKind { PTR_TO_DATA, PTR_TO_STRING };

 public:
3117 3118 3119 3120 3121 3122 3123
  enum Flag {
    kDontUnpackSlicedStrings = 1 << 0,
  };
  typedef base::Flags<Flag> Flags;

  ToDirectStringAssembler(compiler::CodeAssemblerState* state, Node* string,
                          Flags flags = Flags());
3124 3125 3126

  // Converts flat cons, thin, and sliced strings and returns the direct
  // string. The result can be either a sequential or external string.
3127 3128
  // Jumps to if_bailout if the string if the string is indirect and cannot
  // be unpacked.
3129
  TNode<String> TryToDirect(Label* if_bailout);
3130 3131

  // Returns a pointer to the beginning of the string data.
3132
  // Jumps to if_bailout if the external string cannot be unpacked.
3133
  TNode<RawPtrT> PointerToData(Label* if_bailout) {
3134 3135 3136 3137
    return TryToSequential(PTR_TO_DATA, if_bailout);
  }

  // Returns a pointer that, offset-wise, looks like a String.
3138
  // Jumps to if_bailout if the external string cannot be unpacked.
3139
  TNode<RawPtrT> PointerToString(Label* if_bailout) {
3140 3141 3142 3143 3144
    return TryToSequential(PTR_TO_STRING, if_bailout);
  }

  Node* string() { return var_string_.value(); }
  Node* instance_type() { return var_instance_type_.value(); }
3145 3146 3147
  TNode<IntPtrT> offset() {
    return UncheckedCast<IntPtrT>(var_offset_.value());
  }
3148 3149 3150
  Node* is_external() { return var_is_external_.value(); }

 private:
3151
  TNode<RawPtrT> TryToSequential(StringPointerKind ptr_kind, Label* if_bailout);
3152 3153 3154 3155 3156

  Variable var_string_;
  Variable var_instance_type_;
  Variable var_offset_;
  Variable var_is_external_;
3157 3158

  const Flags flags_;
3159 3160
};

3161

3162 3163
DEFINE_OPERATORS_FOR_FLAGS(CodeStubAssembler::AllocationFlags);

3164 3165 3166
}  // namespace internal
}  // namespace v8
#endif  // V8_CODE_STUB_ASSEMBLER_H_