Reland "[CSA][cleanup] TNodify some methods related to prototype and property lookup"

This is a reland of 82111e22

Relanding since we now have more shards:
https://chromium-review.googlesource.com/c/v8/v8/+/1760810

Original change's description:
> [CSA][cleanup] TNodify some methods related to prototype and property lookup
>
> This is a CL in a string of CLs that aims to TNodify CSA. In particular,
> there were some loads that were done in AnyTagged instead of
> TaggedPointer. TNode-ifying them brings improvement in pointer
> compression since we are able to decompress using the Pointer
> decompression.
>
> TNodified:
>  * LoadJSFunctionPrototype
>  * TryPrototypeChainLookup
>  * OrdinaryHasInstance
>
> Also TNodified loads regarding:
>  * FeedbackCell::kValueOffset
>  * HeapObject::kMapOffset
>  * JSFunction::kSharedFunctionInfoOffset
>  * JSFunction::kFeedbackCellOffset
>  * Map::kInstanceTypeOffset
>  * Map::kInstanceDescriptorsOffset
>  * Map::kPrototypeOffset
>
> Drive-by cleanup: StoreJSArrayLength and StoreElements were unused.
>
> Bug: v8:6949, v8:9396
> Change-Id: I89697b5c02490906be1eee63cf3d9e60a1094d48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1755844
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63216}

Bug: v8:6949, v8:9396
Change-Id: I040aefcf8af60611f7b3c24f3bd5c661e03b6ada
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760811Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63249}

src/builtins/builtins-handler-gen.cc

@@ -403,7 +403,7 @@ TF_BUILTIN(LoadIC_FunctionPrototype, CodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
 
   Label miss(this, Label::kDeferred);
-  Return(LoadJSFunctionPrototype(receiver, &miss));
+  Return(LoadJSFunctionPrototype(CAST(receiver), &miss));
 
   BIND(&miss);
   TailCallRuntime(Runtime::kLoadIC_Miss, context, receiver, name, slot, vector);

src/codegen/code-stub-assembler.h

@@ -1289,7 +1289,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void GotoIfPrototypeRequiresRuntimeLookup(TNode<JSFunction> function,
                                             TNode<Map> map, Label* runtime);
   // Load the "prototype" property of a JSFunction.
-  Node* LoadJSFunctionPrototype(Node* function, Label* if_bailout);
+  Node* LoadJSFunctionPrototype(TNode<JSFunction> function, Label* if_bailout);
 
   TNode<BytecodeArray> LoadSharedFunctionInfoBytecodeArray(
       SloppyTNode<SharedFunctionInfo> shared);
@@ -1372,9 +1372,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                   CheckBounds::kDebugOnly);
   }
 
-  void StoreJSArrayLength(TNode<JSArray> array, TNode<Smi> length);
-  void StoreElements(TNode<Object> object, TNode<FixedArrayBase> elements);
-
   void StoreFixedArrayOrPropertyArrayElement(
       Node* array, Node* index, Node* value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,

src/ic/accessor-assembler.cc

@@ -2298,10 +2298,10 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
       GotoIf(InstanceTypeEqual(var_holder_instance_type.value(),
                                JS_TYPED_ARRAY_TYPE),
              slow);
-      Node* proto = LoadMapPrototype(var_holder_map.value());
+      TNode<HeapObject> proto = LoadMapPrototype(var_holder_map.value());
       GotoIf(WordEqual(proto, NullConstant()), &return_undefined);
-      Node* proto_map = LoadMap(proto);
-      Node* proto_instance_type = LoadMapInstanceType(proto_map);
+      TNode<Map> proto_map = LoadMap(proto);
+      TNode<Uint16T> proto_instance_type = LoadMapInstanceType(proto_map);
       var_holder_map.Bind(proto_map);
       var_holder_instance_type.Bind(proto_instance_type);
       Label next_proto(this), return_value(this, &var_value), goto_slow(this);
@@ -2623,7 +2623,7 @@ void AccessorAssembler::LoadIC_NoFeedback(const LoadICParameters* p) {
 
     GotoIfPrototypeRequiresRuntimeLookup(CAST(receiver), CAST(receiver_map),
                                          &not_function_prototype);
-    Return(LoadJSFunctionPrototype(receiver, &miss));
+    Return(LoadJSFunctionPrototype(CAST(receiver), &miss));
     BIND(&not_function_prototype);
   }
 

src/interpreter/interpreter-assembler.cc

@@ -1246,7 +1246,7 @@ void InterpreterAssembler::UpdateInterruptBudget(Node* weight, bool backward) {
   Label load_budget_from_bytecode(this), load_budget_done(this);
   TNode<JSFunction> function = CAST(LoadRegister(Register::function_closure()));
   TNode<FeedbackCell> feedback_cell =
-      CAST(LoadObjectField(function, JSFunction::kFeedbackCellOffset));
+      LoadObjectField<FeedbackCell>(function, JSFunction::kFeedbackCellOffset);
   TNode<Int32T> old_budget = LoadObjectField<Int32T>(
       feedback_cell, FeedbackCell::kInterruptBudgetOffset);
 

test/unittests/compiler/node-test-utils.cc

@@ -2204,6 +2204,7 @@ IS_UNOP_MATCHER(ChangeInt32ToInt64)
 IS_UNOP_MATCHER(ChangeUint32ToFloat64)
 IS_UNOP_MATCHER(ChangeUint32ToUint64)
 IS_UNOP_MATCHER(ChangeCompressedToTagged)
+IS_UNOP_MATCHER(ChangeCompressedPointerToTaggedPointer)
 IS_UNOP_MATCHER(TruncateFloat64ToFloat32)
 IS_UNOP_MATCHER(TruncateInt64ToInt32)
 IS_UNOP_MATCHER(Float32Abs)

test/unittests/compiler/node-test-utils.h

@@ -427,6 +427,8 @@ Matcher<Node*> IsChangeInt32ToInt64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeUint32ToFloat64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeUint32ToUint64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeCompressedToTagged(const Matcher<Node*>& input_matcher);
+Matcher<Node*> IsChangeCompressedPointerToTaggedPointer(
+    const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsTruncateFloat64ToFloat32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsTruncateInt64ToInt32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsFloat32Abs(const Matcher<Node*>& input_matcher);

test/unittests/interpreter/interpreter-assembler-unittest.cc

@@ -601,21 +601,22 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadFeedbackVector) {
                  c::IsIntPtrConstant(Register::function_closure().ToOperand() *
                                      kSystemPointerSize)));
 #ifdef V8_COMPRESS_POINTERS
-    Matcher<Node*> load_vector_cell_matcher = IsChangeCompressedToTagged(
-        m.IsLoadFromObject(MachineType::AnyCompressed(), load_function_matcher,
-                           c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset -
-                                               kHeapObjectTag)));
+    Matcher<Node*> load_vector_cell_matcher =
+        IsChangeCompressedPointerToTaggedPointer(m.IsLoadFromObject(
+            MachineType::CompressedPointer(), load_function_matcher,
+            c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset -
+                                kHeapObjectTag)));
     EXPECT_THAT(load_feedback_vector,
-                IsChangeCompressedToTagged(m.IsLoadFromObject(
-                    MachineType::AnyCompressed(), load_vector_cell_matcher,
+                IsChangeCompressedPointerToTaggedPointer(m.IsLoadFromObject(
+                    MachineType::CompressedPointer(), load_vector_cell_matcher,
                     c::IsIntPtrConstant(Cell::kValueOffset - kHeapObjectTag))));
 #else
     Matcher<Node*> load_vector_cell_matcher = m.IsLoadFromObject(
-        MachineType::AnyTagged(), load_function_matcher,
+        MachineType::TaggedPointer(), load_function_matcher,
         c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset - kHeapObjectTag));
     EXPECT_THAT(load_feedback_vector,
                 m.IsLoadFromObject(
-                    MachineType::AnyTagged(), load_vector_cell_matcher,
+                    MachineType::TaggedPointer(), load_vector_cell_matcher,
                     c::IsIntPtrConstant(Cell::kValueOffset - kHeapObjectTag)));
 #endif
   }