[csa] Typify Smi arithmetic and comparison operations.

Bug: v8:7754
Change-Id: Id22020984e10bd2ddb22119c50b490419c897174
Reviewed-on: https://chromium-review.googlesource.com/1062272Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53232}

src/builtins/builtins-array-gen.cc

@@ -150,7 +150,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
 
       BIND(&fast);
       {
-        GotoIf(SmiNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
+        GotoIf(WordNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
         kind = EnsureArrayPushable(LoadMap(a()), &runtime);
         GotoIf(IsElementsKindGreaterThan(kind, HOLEY_SMI_ELEMENTS),
                &object_push_pre);
@@ -211,9 +211,10 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
         context(), original_array, length, method_name);
     // In the Spec and our current implementation, the length check is already
     // performed in TypedArraySpeciesCreate.
-    CSA_ASSERT(this,
-               SmiLessThanOrEqual(
-                   len_, LoadObjectField(a, JSTypedArray::kLengthOffset)));
+    CSA_ASSERT(
+        this,
+        SmiLessThanOrEqual(
+            CAST(len_), CAST(LoadObjectField(a, JSTypedArray::kLengthOffset))));
     fast_typed_array_target_ =
         Word32Equal(LoadInstanceType(LoadElements(original_array)),
                     LoadInstanceType(LoadElements(a)));
@@ -706,7 +707,8 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
           TNode<JSArray> o_array = CAST(o());
           // Check if o's length has changed during the callback and if the
           // index is now out of range of the new length.
-          GotoIf(SmiGreaterThanOrEqual(k_.value(), LoadJSArrayLength(o_array)),
+          GotoIf(SmiGreaterThanOrEqual(CAST(k_.value()),
+                                       CAST(LoadJSArrayLength(o_array))),
                  array_changed);
 
           // Re-load the elements array. If may have been resized.
@@ -868,8 +870,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
     GotoIf(WordEqual(value, protector_invalid), &runtime);
 
     GotoIfNot(TaggedIsPositiveSmi(len), &runtime);
-    GotoIf(SmiAbove(len, SmiConstant(JSArray::kInitialMaxFastElementArray)),
-           &runtime);
+    GotoIf(
+        SmiAbove(CAST(len), SmiConstant(JSArray::kInitialMaxFastElementArray)),
+        &runtime);
 
     // We need to be conservative and start with holey because the builtins
     // that create output arrays aren't guaranteed to be called for every
@@ -1163,9 +1166,9 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
     // Make sure that the length hasn't been changed by side-effect.
     Node* array_length = LoadJSArrayLength(array);
     GotoIf(TaggedIsNotSmi(array_length), slow);
-    GotoIf(SmiAbove(SmiAdd(from, count), array_length), slow);
+    GotoIf(SmiAbove(SmiAdd(CAST(from), CAST(count)), CAST(array_length)), slow);
 
-    CSA_ASSERT(this, SmiGreaterThanOrEqual(from, SmiConstant(0)));
+    CSA_ASSERT(this, SmiGreaterThanOrEqual(CAST(from), SmiConstant(0)));
 
     result.Bind(CallStub(CodeFactory::ExtractFastJSArray(isolate()), context,
                          array, from, count));
@@ -1179,8 +1182,9 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
     GotoIf(WordNotEqual(map, fast_aliasted_arguments_map), &try_simple_slice);
 
     Node* sloppy_elements = LoadElements(array);
-    Node* sloppy_elements_length = LoadFixedArrayBaseLength(sloppy_elements);
-    Node* parameter_map_length =
+    TNode<Smi> sloppy_elements_length =
+        LoadFixedArrayBaseLength(sloppy_elements);
+    TNode<Smi> parameter_map_length =
         SmiSub(sloppy_elements_length,
                SmiConstant(SloppyArgumentsElements::kParameterMapStart));
     VARIABLE(index_out, MachineType::PointerRepresentation());
@@ -1189,16 +1193,16 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
         (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - JSArray::kSize -
          AllocationMemento::kSize) /
         kPointerSize;
-    GotoIf(SmiAboveOrEqual(count, SmiConstant(max_fast_elements)),
+    GotoIf(SmiAboveOrEqual(CAST(count), SmiConstant(max_fast_elements)),
            &try_simple_slice);
 
-    GotoIf(SmiLessThan(from, SmiConstant(0)), slow);
+    GotoIf(SmiLessThan(CAST(from), SmiConstant(0)), slow);
 
-    Node* end = SmiAdd(from, count);
+    TNode<Smi> end = SmiAdd(CAST(from), CAST(count));
 
     Node* unmapped_elements = LoadFixedArrayElement(
         sloppy_elements, SloppyArgumentsElements::kArgumentsIndex);
-    Node* unmapped_elements_length =
+    TNode<Smi> unmapped_elements_length =
         LoadFixedArrayBaseLength(unmapped_elements);
 
     GotoIf(SmiAbove(end, unmapped_elements_length), slow);
@@ -1209,8 +1213,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
 
     index_out.Bind(IntPtrConstant(0));
     Node* result_elements = LoadElements(result.value());
-    Node* from_mapped = SmiMin(parameter_map_length, from);
-    Node* to = SmiMin(parameter_map_length, end);
+    TNode<Smi> from_mapped = SmiMin(parameter_map_length, CAST(from));
+    TNode<Smi> to = SmiMin(parameter_map_length, end);
     Node* arguments_context = LoadFixedArrayElement(
         sloppy_elements, SloppyArgumentsElements::kContextIndex);
     VariableList var_list({&index_out}, zone());
@@ -1240,7 +1244,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
         },
         1, SMI_PARAMETERS, IndexAdvanceMode::kPost);
 
-    Node* unmapped_from = SmiMin(SmiMax(parameter_map_length, from), end);
+    TNode<Smi> unmapped_from =
+        SmiMin(SmiMax(parameter_map_length, CAST(from)), end);
 
     BuildFastLoop(
         var_list, unmapped_from, end,
@@ -2132,7 +2137,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
 
     TVARIABLE(Number, index, SmiConstant(0));
 
-    GotoIf(SmiEqual(length.value(), SmiConstant(0)), &finished);
+    GotoIf(SmiEqual(CAST(length.value()), SmiConstant(0)), &finished);
 
     // Loop from 0 to length-1.
     {
@@ -3508,17 +3513,14 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     Node* elements_kind = LoadMapElementsKind(array_map);
     GotoIfNot(IsFastElementsKind(elements_kind), &if_other);
 
-    Node* length = LoadJSArrayLength(array);
+    TNode<Smi> length = CAST(LoadJSArrayLength(array));
 
-    CSA_ASSERT(this, TaggedIsSmi(length));
-    CSA_ASSERT(this, TaggedIsSmi(index));
-
-    GotoIfNot(SmiBelow(index, length), &set_done);
+    GotoIfNot(SmiBelow(CAST(index), length), &set_done);
 
     var_value.Bind(index);
-    Node* one = SmiConstant(1);
+    TNode<Smi> one = SmiConstant(1);
     StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                   SmiAdd(index, one));
+                                   SmiAdd(CAST(index), one));
     var_done.Bind(FalseConstant());
 
     GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
@@ -3623,17 +3625,15 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
     Node* buffer = LoadObjectField(array, JSTypedArray::kBufferOffset);
     GotoIf(IsDetachedBuffer(buffer), &if_detached);
 
-    Node* length = LoadObjectField(array, JSTypedArray::kLengthOffset);
-
-    CSA_ASSERT(this, TaggedIsSmi(length));
-    CSA_ASSERT(this, TaggedIsSmi(index));
+    TNode<Smi> length =
+        CAST(LoadObjectField(array, JSTypedArray::kLengthOffset));
 
-    GotoIfNot(SmiBelow(index, length), &set_done);
+    GotoIfNot(SmiBelow(CAST(index), length), &set_done);
 
     var_value.Bind(index);
-    Node* one = SmiConstant(1);
+    TNode<Smi> one = SmiConstant(1);
     StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                   SmiAdd(index, one));
+                                   SmiAdd(CAST(index), one));
     var_done.Bind(FalseConstant());
 
     GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
@@ -3784,7 +3784,8 @@ class ArrayFlattenAssembler : public CodeStubAssembler {
 
       // a. Let P be ! ToString(sourceIndex).
       // b. Let exists be ? HasProperty(source, P).
-      CSA_ASSERT(this, SmiGreaterThanOrEqual(source_index, SmiConstant(0)));
+      CSA_ASSERT(this,
+                 SmiGreaterThanOrEqual(CAST(source_index), SmiConstant(0)));
       Node* const exists =
           HasProperty(source, source_index, context, kHasProperty);
 

src/builtins/builtins-async-function-gen.cc

@@ -55,9 +55,9 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResumeClosure(
   // Ensure that the generator is neither closed nor running.
   CSA_SLOW_ASSERT(
       this,
-      SmiGreaterThan(
-          LoadObjectField(generator, JSGeneratorObject::kContinuationOffset),
-          SmiConstant(JSGeneratorObject::kGeneratorClosed)));
+      SmiGreaterThan(CAST(LoadObjectField(
+                         generator, JSGeneratorObject::kContinuationOffset)),
+                     SmiConstant(JSGeneratorObject::kGeneratorClosed)));
 
   // Remember the {resume_mode} for the {generator}.
   StoreObjectFieldNoWriteBarrier(generator,

src/builtins/builtins-async-generator-gen.cc

@@ -41,37 +41,39 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
     return LoadObjectField(generator, JSGeneratorObject::kContinuationOffset);
   }
 
-  inline Node* IsGeneratorStateClosed(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateClosed(SloppyTNode<Smi> const state) {
     return SmiEqual(state, SmiConstant(JSGeneratorObject::kGeneratorClosed));
   }
-  inline Node* IsGeneratorClosed(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorClosed(Node* const generator) {
     return IsGeneratorStateClosed(LoadGeneratorState(generator));
   }
 
-  inline Node* IsGeneratorStateSuspended(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateSuspended(SloppyTNode<Smi> const state) {
     return SmiGreaterThanOrEqual(state, SmiConstant(0));
   }
 
-  inline Node* IsGeneratorSuspended(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorSuspended(Node* const generator) {
     return IsGeneratorStateSuspended(LoadGeneratorState(generator));
   }
 
-  inline Node* IsGeneratorStateSuspendedAtStart(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateSuspendedAtStart(
+      SloppyTNode<Smi> const state) {
     return SmiEqual(state, SmiConstant(0));
   }
 
-  inline Node* IsGeneratorStateNotExecuting(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateNotExecuting(
+      SloppyTNode<Smi> const state) {
     return SmiNotEqual(state,
                        SmiConstant(JSGeneratorObject::kGeneratorExecuting));
   }
-  inline Node* IsGeneratorNotExecuting(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorNotExecuting(Node* const generator) {
     return IsGeneratorStateNotExecuting(LoadGeneratorState(generator));
   }
 
-  inline Node* IsGeneratorAwaiting(Node* const generator) {
-    Node* is_generator_awaiting =
+  inline TNode<BoolT> IsGeneratorAwaiting(Node* const generator) {
+    TNode<Object> is_generator_awaiting =
         LoadObjectField(generator, JSAsyncGeneratorObject::kIsAwaitingOffset);
-    return SmiEqual(is_generator_awaiting, SmiConstant(1));
+    return WordEqual(is_generator_awaiting, SmiConstant(1));
   }
 
   inline void SetGeneratorAwaiting(Node* const generator) {
@@ -118,7 +120,7 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
     return LoadObjectField(request, AsyncGeneratorRequest::kValueOffset);
   }
 
-  inline Node* IsAbruptResumeType(Node* const resume_type) {
+  inline TNode<BoolT> IsAbruptResumeType(SloppyTNode<Smi> const resume_type) {
     return SmiNotEqual(resume_type, SmiConstant(JSGeneratorObject::kNext));
   }
 
@@ -174,7 +176,7 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorEnqueue(
     // If state is not "executing", then
     //     Perform AsyncGeneratorResumeNext(Generator)
     // Check if the {receiver} is running or already closed.
-    Node* continuation = LoadGeneratorState(generator);
+    TNode<Smi> continuation = CAST(LoadGeneratorState(generator));
 
     GotoIf(SmiEqual(continuation,
                     SmiConstant(JSAsyncGeneratorObject::kGeneratorExecuting)),
@@ -430,7 +432,8 @@ TF_BUILTIN(AsyncGeneratorResumeNext, AsyncGeneratorBuiltinsAssembler) {
   ReturnIf(IsUndefined(var_next.value()), UndefinedConstant());
 
   Node* const next = var_next.value();
-  Node* const resume_type = LoadResumeTypeFromAsyncGeneratorRequest(next);
+  TNode<Smi> const resume_type =
+      CAST(LoadResumeTypeFromAsyncGeneratorRequest(next));
 
   Label if_abrupt(this), if_normal(this), resume_generator(this);
   Branch(IsAbruptResumeType(resume_type), &if_abrupt, &if_normal);

src/builtins/builtins-collections-gen.cc

@@ -983,10 +983,8 @@ void CollectionsBuiltinsAssembler::SameValueZeroHeapNumber(Node* key_float,
 }
 
 TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
-  Node* table = Parameter(Descriptor::kTable);
-  Node* index = Parameter(Descriptor::kIndex);
-  CSA_ASSERT(this, TaggedIsNotSmi(table));
-  CSA_ASSERT(this, TaggedIsSmi(index));
+  TNode<HeapObject> table = CAST(Parameter(Descriptor::kTable));
+  TNode<Smi> index = CAST(Parameter(Descriptor::kIndex));
   Label return_index(this), return_zero(this);
 
   // Check if we need to update the {index}.
@@ -1007,8 +1005,8 @@ TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
   {
     Node* i = var_i.value();
     GotoIfNot(IntPtrLessThan(i, number_of_deleted_elements), &return_index);
-    Node* removed_index = LoadFixedArrayElement(
-        table, i, OrderedHashTableBase::kRemovedHolesIndex * kPointerSize);
+    TNode<Smi> removed_index = CAST(LoadFixedArrayElement(
+        table, i, OrderedHashTableBase::kRemovedHolesIndex * kPointerSize));
     GotoIf(SmiGreaterThanOrEqual(removed_index, index), &return_index);
     Decrement(&var_index, 1, SMI_PARAMETERS);
     Increment(&var_i);
@@ -1120,8 +1118,8 @@ TF_BUILTIN(MapPrototypeGet, CollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.get");
 
   Node* const table = LoadObjectField(receiver, JSMap::kTableOffset);
-  Node* index =
-      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key);
+  TNode<Smi> index = CAST(
+      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
 
   Label if_found(this), if_not_found(this);
   Branch(SmiGreaterThanOrEqual(index, SmiConstant(0)), &if_found,
@@ -1145,8 +1143,8 @@ TF_BUILTIN(MapPrototypeHas, CollectionsBuiltinsAssembler) {
   ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.has");
 
   Node* const table = LoadObjectField(receiver, JSMap::kTableOffset);
-  Node* index =
-      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key);
+  TNode<Smi> index = CAST(
+      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
 
   Label if_found(this), if_not_found(this);
   Branch(SmiGreaterThanOrEqual(index, SmiConstant(0)), &if_found,
@@ -1282,8 +1280,8 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashMapNewEntry(
                          OrderedHashMap::kHashTableStartIndex * kPointerSize);
 
   // Bump the elements count.
-  Node* const number_of_elements =
-      LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset);
+  TNode<Smi> const number_of_elements =
+      CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashMap::kNumberOfElementsOffset,
                                  SmiAdd(number_of_elements, SmiConstant(1)));
 }
@@ -1320,20 +1318,20 @@ TF_BUILTIN(MapPrototypeDelete, CollectionsBuiltinsAssembler) {
                                          OrderedHashMap::kValueOffset));
 
   // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements = SmiSub(
+  TNode<Smi> const number_of_elements = SmiSub(
       CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset)),
       SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashMap::kNumberOfElementsOffset,
                                  number_of_elements);
-  Node* const number_of_deleted =
+  TNode<Smi> const number_of_deleted =
       SmiAdd(CAST(LoadObjectField(
                  table, OrderedHashMap::kNumberOfDeletedElementsOffset)),
              SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashMap::kNumberOfDeletedElementsOffset, number_of_deleted);
 
-  Node* const number_of_buckets =
-      LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex);
+  TNode<Smi> const number_of_buckets =
+      CAST(LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex));
 
   // If there fewer elements than #buckets / 2, shrink the table.
   Label shrink(this);
@@ -1445,8 +1443,8 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashSetNewEntry(
                          OrderedHashSet::kHashTableStartIndex * kPointerSize);
 
   // Bump the elements count.
-  Node* const number_of_elements =
-      LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset);
+  TNode<Smi> const number_of_elements =
+      CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashSet::kNumberOfElementsOffset,
                                  SmiAdd(number_of_elements, SmiConstant(1)));
 }
@@ -1479,20 +1477,20 @@ TF_BUILTIN(SetPrototypeDelete, CollectionsBuiltinsAssembler) {
                          kPointerSize * OrderedHashSet::kHashTableStartIndex);
 
   // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements = SmiSub(
+  TNode<Smi> const number_of_elements = SmiSub(
       CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset)),
       SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashSet::kNumberOfElementsOffset,
                                  number_of_elements);
-  Node* const number_of_deleted =
+  TNode<Smi> const number_of_deleted =
       SmiAdd(CAST(LoadObjectField(
                  table, OrderedHashSet::kNumberOfDeletedElementsOffset)),
              SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashSet::kNumberOfDeletedElementsOffset, number_of_deleted);
 
-  Node* const number_of_buckets =
-      LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex);
+  TNode<Smi> const number_of_buckets =
+      CAST(LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex));
 
   // If there fewer elements than #buckets / 2, shrink the table.
   Label shrink(this);

src/builtins/builtins-generator-gen.cc

@@ -35,11 +35,11 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
             &if_receiverisincompatible);
 
   // Check if the {receiver} is running or already closed.
-  Node* receiver_continuation =
-      LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset);
+  TNode<Smi> receiver_continuation =
+      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
   Label if_receiverisclosed(this, Label::kDeferred),
       if_receiverisrunning(this, Label::kDeferred);
-  Node* closed = SmiConstant(JSGeneratorObject::kGeneratorClosed);
+  TNode<Smi> closed = SmiConstant(JSGeneratorObject::kGeneratorClosed);
   GotoIf(SmiEqual(receiver_continuation, closed), &if_receiverisclosed);
   DCHECK_LT(JSGeneratorObject::kGeneratorExecuting,
             JSGeneratorObject::kGeneratorClosed);
@@ -59,14 +59,14 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
 
   // If the generator is not suspended (i.e., its state is 'executing'),
   // close it and wrap the return value in IteratorResult.
-  Node* result_continuation =
-      LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset);
+  TNode<Smi> result_continuation =
+      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
 
   // The generator function should not close the generator by itself, let's
   // check it is indeed not closed yet.
   CSA_ASSERT(this, SmiNotEqual(result_continuation, closed));
 
-  Node* executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
+  TNode<Smi> executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
   GotoIf(SmiEqual(result_continuation, executing), &if_final_return);
 
   args->PopAndReturn(result);

src/builtins/builtins-math-gen.cc

@@ -50,7 +50,7 @@ TF_BUILTIN(MathAbs, CodeStubAssembler) {
       } else {
         // Check if {x} is already positive.
         Label if_xispositive(this), if_xisnotpositive(this);
-        BranchIfSmiLessThanOrEqual(SmiConstant(0), x, &if_xispositive,
+        BranchIfSmiLessThanOrEqual(SmiConstant(0), CAST(x), &if_xispositive,
                                    &if_xisnotpositive);
 
         BIND(&if_xispositive);
@@ -404,8 +404,8 @@ TF_BUILTIN(MathRandom, CodeStubAssembler) {
   Node* native_context = LoadNativeContext(context);
 
   // Load cache index.
-  VARIABLE(smi_index, MachineRepresentation::kTagged);
-  smi_index.Bind(
+  TVARIABLE(Smi, smi_index);
+  smi_index = CAST(
       LoadContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX));
 
   // Cached random numbers are exhausted if index is 0. Go to slow path.
@@ -413,12 +413,12 @@ TF_BUILTIN(MathRandom, CodeStubAssembler) {
   GotoIf(SmiAbove(smi_index.value(), SmiConstant(0)), &if_cached);
 
   // Cache exhausted, populate the cache. Return value is the new index.
-  smi_index.Bind(CallRuntime(Runtime::kGenerateRandomNumbers, context));
+  smi_index = CAST(CallRuntime(Runtime::kGenerateRandomNumbers, context));
   Goto(&if_cached);
 
   // Compute next index by decrement.
   BIND(&if_cached);
-  Node* new_smi_index = SmiSub(smi_index.value(), SmiConstant(1));
+  TNode<Smi> new_smi_index = SmiSub(smi_index.value(), SmiConstant(1));
   StoreContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX,
                       new_smi_index);
 

src/builtins/builtins-number-gen.cc

@@ -830,7 +830,7 @@ TF_BUILTIN(Negate, NumberBuiltinsAssembler) {
                       &do_bigint);
 
   BIND(&do_smi);
-  { Return(SmiMul(var_input.value(), SmiConstant(-1))); }
+  { Return(SmiMul(CAST(var_input.value()), SmiConstant(-1))); }
 
   BIND(&do_double);
   {
@@ -858,7 +858,7 @@ TF_BUILTIN(Multiply, NumberBuiltinsAssembler) {
 
   BIND(&do_smi_mul);
   // The result is not necessarily a smi, in case of overflow.
-  Return(SmiMul(var_left.value(), var_right.value()));
+  Return(SmiMul(CAST(var_left.value()), CAST(var_right.value())));
 
   BIND(&do_double_mul);
   Node* value = Float64Mul(var_left_double.value(), var_right_double.value());
@@ -886,8 +886,8 @@ TF_BUILTIN(Divide, NumberBuiltinsAssembler) {
   {
     // TODO(jkummerow): Consider just always doing a double division.
     Label bailout(this);
-    Node* dividend = var_left.value();
-    Node* divisor = var_right.value();
+    TNode<Smi> dividend = CAST(var_left.value());
+    TNode<Smi> divisor = CAST(var_right.value());
 
     // Do floating point division if {divisor} is zero.
     GotoIf(SmiEqual(divisor, SmiConstant(0)), &bailout);
@@ -967,7 +967,7 @@ TF_BUILTIN(Modulus, NumberBuiltinsAssembler) {
                        &var_left_double, &var_right_double, &do_bigint_mod);
 
   BIND(&do_smi_mod);
-  Return(SmiMod(var_left.value(), var_right.value()));
+  Return(SmiMod(CAST(var_left.value()), CAST(var_right.value())));
 
   BIND(&do_double_mod);
   Node* value = Float64Mod(var_left_double.value(), var_right_double.value());

src/builtins/builtins-promise-gen.cc

@@ -221,8 +221,7 @@ Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementContext(
 }
 
 Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementFunction(
-    Node* context, Node* index, Node* native_context) {
-  CSA_ASSERT(this, TaggedIsSmi(index));
+    Node* context, TNode<Smi> index, Node* native_context) {
   CSA_ASSERT(this, SmiGreaterThan(index, SmiConstant(0)));
   CSA_ASSERT(this, SmiLessThanOrEqual(
                        index, SmiConstant(PropertyArray::HashField::kMax)));
@@ -266,8 +265,9 @@ Node* PromiseBuiltinsAssembler::PromiseHasHandler(Node* promise) {
 }
 
 void PromiseBuiltinsAssembler::PromiseSetHasHandler(Node* promise) {
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
-  Node* const new_flags =
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
+  TNode<Smi> const new_flags =
       SmiOr(flags, SmiConstant(1 << JSPromise::kHasHandlerBit));
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
 }
@@ -279,7 +279,8 @@ Node* PromiseBuiltinsAssembler::IsPromiseStatus(
 
 Node* PromiseBuiltinsAssembler::PromiseStatus(Node* promise) {
   STATIC_ASSERT(JSPromise::kStatusShift == 0);
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
   return Word32And(SmiToInt32(flags), Int32Constant(JSPromise::kStatusMask));
 }
 
@@ -289,15 +290,17 @@ void PromiseBuiltinsAssembler::PromiseSetStatus(
              IsPromiseStatus(PromiseStatus(promise), v8::Promise::kPending));
   CHECK_NE(status, v8::Promise::kPending);
 
-  Node* mask = SmiConstant(status);
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> mask = SmiConstant(status);
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset,
                                  SmiOr(flags, mask));
 }
 
 void PromiseBuiltinsAssembler::PromiseSetHandledHint(Node* promise) {
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
-  Node* const new_flags =
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
+  TNode<Smi> const new_flags =
       SmiOr(flags, SmiConstant(1 << JSPromise::kHandledHintBit));
   StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
 }
@@ -1801,7 +1804,7 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
   Node* const resolve_element_context =
       CreatePromiseAllResolveElementContext(capability, native_context);
 
-  VARIABLE(var_index, MachineRepresentation::kTagged, SmiConstant(1));
+  TVARIABLE(Smi, var_index, SmiConstant(1));
   Label loop(this, &var_index), done_loop(this),
       too_many_elements(this, Label::kDeferred),
       close_iterator(this, Label::kDeferred);
@@ -1831,14 +1834,14 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
                       var_exception);
 
     // Check if we reached the limit.
-    Node* const index = var_index.value();
+    TNode<Smi> const index = var_index.value();
     GotoIf(SmiEqual(index, SmiConstant(PropertyArray::HashField::kMax)),
            &too_many_elements);
 
     // Set remainingElementsCount.[[Value]] to
     //     remainingElementsCount.[[Value]] + 1.
-    Node* const remaining_elements_count = LoadContextElement(
-        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+    TNode<Smi> const remaining_elements_count = CAST(LoadContextElement(
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot));
     StoreContextElementNoWriteBarrier(
         resolve_element_context, kPromiseAllResolveElementRemainingSlot,
         SmiAdd(remaining_elements_count, SmiConstant(1)));
@@ -1877,7 +1880,7 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     });
 
     // Set index to index + 1.
-    var_index.Bind(SmiAdd(index, SmiConstant(1)));
+    var_index = SmiAdd(index, SmiConstant(1));
     Goto(&loop);
   }
 
@@ -1911,8 +1914,8 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     // Set iteratorRecord.[[Done]] to true.
     // Set remainingElementsCount.[[Value]] to
     //    remainingElementsCount.[[Value]] - 1.
-    Node* remaining_elements_count = LoadContextElement(
-        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+    TNode<Smi> remaining_elements_count = CAST(LoadContextElement(
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot));
     remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
     StoreContextElementNoWriteBarrier(resolve_element_context,
                                       kPromiseAllResolveElementRemainingSlot,
@@ -1927,8 +1930,8 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
     Node* const values_array = LoadContextElement(
         resolve_element_context, kPromiseAllResolveElementValuesArraySlot);
     Node* const old_elements = LoadElements(values_array);
-    Node* const old_capacity = LoadFixedArrayBaseLength(old_elements);
-    Node* const new_capacity = var_index.value();
+    TNode<Smi> const old_capacity = LoadFixedArrayBaseLength(old_elements);
+    TNode<Smi> const new_capacity = var_index.value();
     GotoIf(SmiGreaterThanOrEqual(old_capacity, new_capacity), &return_promise);
     Node* const new_elements =
         AllocateFixedArray(PACKED_ELEMENTS, new_capacity, SMI_PARAMETERS,
@@ -2105,8 +2108,8 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
   }
 
   BIND(&done);
-  Node* remaining_elements_count =
-      LoadContextElement(context, kPromiseAllResolveElementRemainingSlot);
+  TNode<Smi> remaining_elements_count =
+      CAST(LoadContextElement(context, kPromiseAllResolveElementRemainingSlot));
   remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
   StoreContextElement(context, kPromiseAllResolveElementRemainingSlot,
                       remaining_elements_count);

src/builtins/builtins-promise-gen.h

@@ -113,7 +113,7 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
   // case to mark it's done).
   Node* CreatePromiseAllResolveElementContext(Node* promise_capability,
                                               Node* native_context);
-  Node* CreatePromiseAllResolveElementFunction(Node* context, Node* index,
+  Node* CreatePromiseAllResolveElementFunction(Node* context, TNode<Smi> index,
                                                Node* native_context);
 
   Node* CreatePromiseResolvingFunctionsContext(Node* promise, Node* debug_event,

src/builtins/builtins-proxy-gen.cc

@@ -544,7 +544,7 @@ TF_BUILTIN(ProxySetProperty, ProxiesCodeStubAssembler) {
   Node* name = Parameter(Descriptor::kName);
   Node* value = Parameter(Descriptor::kValue);
   Node* receiver = Parameter(Descriptor::kReceiverValue);
-  Node* language_mode = Parameter(Descriptor::kLanguageMode);
+  TNode<Smi> language_mode = CAST(Parameter(Descriptor::kLanguageMode));
 
   CSA_ASSERT(this, IsJSProxy(proxy));
 

src/builtins/builtins-regexp-gen.h

@@ -125,7 +125,8 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                                      Node* const string);
 
   void RegExpPrototypeSplitBody(Node* const context, Node* const regexp,
-                                TNode<String> const string, Node* const limit);
+                                TNode<String> const string,
+                                TNode<Smi> const limit);
 
   Node* ReplaceGlobalCallableFastPath(Node* context, Node* regexp, Node* string,
                                       Node* replace_callable);

src/builtins/builtins-string-gen.cc

@@ -1054,7 +1054,7 @@ void StringIncludesIndexOfAssembler::Generate(SearchVariant variant) {
       arguments.PopAndReturn((variant == kIndexOf)
                                  ? result
                                  : SelectBooleanConstant(SmiGreaterThanOrEqual(
-                                       result, SmiConstant(0))));
+                                       CAST(result), SmiConstant(0))));
     });
   }
   BIND(&call_runtime);
@@ -1156,16 +1156,15 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
   BIND(&out);
 }
 
-compiler::Node* StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
-                                                           Node* const string) {
+TNode<Smi> StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
+                                                      Node* const string) {
   CSA_ASSERT(this, IsString(string));
 
-  Node* const dollar_string = HeapConstant(
+  TNode<String> const dollar_string = HeapConstant(
       isolate()->factory()->LookupSingleCharacterStringFromCode('$'));
-  Node* const dollar_ix = CallBuiltin(Builtins::kStringIndexOf, context, string,
-                                      dollar_string, SmiConstant(0));
-
-  CSA_ASSERT(this, TaggedIsSmi(dollar_ix));
+  TNode<Smi> const dollar_ix =
+      CAST(CallBuiltin(Builtins::kStringIndexOf, context, string, dollar_string,
+                       SmiConstant(0)));
   return dollar_ix;
 }
 
@@ -1188,7 +1187,7 @@ compiler::Node* StringBuiltinsAssembler::GetSubstitution(
   // TODO(jgruber): Possibly extend this in the future to handle more complex
   // cases without runtime calls.
 
-  Node* const dollar_index = IndexOfDollarChar(context, replace_string);
+  TNode<Smi> const dollar_index = IndexOfDollarChar(context, replace_string);
   Branch(SmiIsNegative(dollar_index), &out, &runtime);
 
   BIND(&runtime);
@@ -1233,16 +1232,17 @@ TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
     Label if_count_isheapnumber(this, Label::kDeferred);
 
     GotoIfNot(TaggedIsSmi(var_count.value()), &if_count_isheapnumber);
-
-    // If count is a SMI, throw a RangeError if less than 0 or greater than
-    // the maximum string length.
-    GotoIf(SmiLessThan(var_count.value(), SmiConstant(0)), &invalid_count);
-    GotoIf(SmiEqual(var_count.value(), SmiConstant(0)), &return_emptystring);
-    GotoIf(is_stringempty, &return_emptystring);
-    GotoIf(SmiGreaterThan(var_count.value(), SmiConstant(String::kMaxLength)),
-           &invalid_string_length);
-    Return(CallBuiltin(Builtins::kStringRepeat, context, string,
-                       var_count.value()));
+    {
+      // If count is a SMI, throw a RangeError if less than 0 or greater than
+      // the maximum string length.
+      TNode<Smi> smi_count = CAST(var_count.value());
+      GotoIf(SmiLessThan(smi_count, SmiConstant(0)), &invalid_count);
+      GotoIf(SmiEqual(smi_count, SmiConstant(0)), &return_emptystring);
+      GotoIf(is_stringempty, &return_emptystring);
+      GotoIf(SmiGreaterThan(smi_count, SmiConstant(String::kMaxLength)),
+             &invalid_string_length);
+      Return(CallBuiltin(Builtins::kStringRepeat, context, string, smi_count));
+    }
 
     // If count is a Heap Number...
     // 1) If count is Infinity, throw a RangeError exception
@@ -1280,7 +1280,7 @@ TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
 TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
   Node* const context = Parameter(Descriptor::kContext);
   Node* const string = Parameter(Descriptor::kString);
-  Node* const count = Parameter(Descriptor::kCount);
+  TNode<Smi> const count = CAST(Parameter(Descriptor::kCount));
 
   CSA_ASSERT(this, IsString(string));
   CSA_ASSERT(this, Word32BinaryNot(IsEmptyString(string)));
@@ -1299,7 +1299,7 @@ TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
   //   }
   VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
   VARIABLE(var_temp, MachineRepresentation::kTagged, string);
-  VARIABLE(var_count, MachineRepresentation::kTagged, count);
+  TVARIABLE(Smi, var_count, count);
 
   Callable stringadd_callable =
       CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
@@ -1317,7 +1317,7 @@ TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
       BIND(&next);
     }
 
-    var_count.Bind(SmiShr(var_count.value(), 1));
+    var_count = SmiShr(var_count.value(), 1);
     GotoIf(SmiEqual(var_count.value(), SmiConstant(0)), &return_result);
     var_temp.Bind(CallStub(stringadd_callable, context, var_temp.value(),
                            var_temp.value()));
@@ -1337,7 +1337,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   Node* const replace = Parameter(Descriptor::kReplace);
   Node* const context = Parameter(Descriptor::kContext);
 
-  Node* const smi_zero = SmiConstant(0);
+  TNode<Smi> const smi_zero = SmiConstant(0);
 
   RequireObjectCoercible(context, receiver, "String.prototype.replace");
 
@@ -1392,10 +1392,9 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
   // longer substrings - we can handle up to 8 chars (one-byte) / 4 chars
   // (2-byte).
 
-  Node* const match_start_index =
-      CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
-                  search_string, smi_zero);
-  CSA_ASSERT(this, TaggedIsSmi(match_start_index));
+  TNode<Smi> const match_start_index =
+      CAST(CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
+                       search_string, smi_zero));
 
   // Early exit if no match found.
   {
@@ -1421,7 +1420,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
     BIND(&next);
   }
 
-  Node* const match_end_index = SmiAdd(match_start_index, search_length);
+  TNode<Smi> const match_end_index = SmiAdd(match_start_index, search_length);
 
   Callable stringadd_callable =
       CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
@@ -1638,18 +1637,20 @@ class StringPadAssembler : public StringBuiltinsAssembler {
     // If no max_length was provided, return the string.
     GotoIf(IntPtrEqual(argc, IntPtrConstant(0)), &dont_pad);
 
-    Node* const max_length = ToLength_Inline(context, arguments.AtIndex(0));
+    TNode<Number> const max_length =
+        ToLength_Inline(context, arguments.AtIndex(0));
     CSA_ASSERT(this, IsNumberNormalized(max_length));
 
     // Throw if max_length is not a smi or greater than the max string length.
-    GotoIfNot(Word32And(TaggedIsSmi(max_length),
-                        SmiLessThanOrEqual(max_length,
-                                           SmiConstant(String::kMaxLength))),
-              &invalid_string_length);
+    GotoIfNot(TaggedIsSmi(max_length), &invalid_string_length);
+    TNode<Smi> smi_max_length = CAST(max_length);
+    GotoIfNot(
+        SmiLessThanOrEqual(smi_max_length, SmiConstant(String::kMaxLength)),
+        &invalid_string_length);
 
     // If the max_length is less than length of the string, return the string.
-    CSA_ASSERT(this, TaggedIsPositiveSmi(max_length));
-    GotoIf(SmiLessThanOrEqual(max_length, string_length), &dont_pad);
+    CSA_ASSERT(this, TaggedIsPositiveSmi(smi_max_length));
+    GotoIf(SmiLessThanOrEqual(smi_max_length, string_length), &dont_pad);
 
     Branch(IntPtrEqual(argc, IntPtrConstant(1)), &pad, &argc_2);
     BIND(&argc_2);
@@ -1667,11 +1668,11 @@ class StringPadAssembler : public StringBuiltinsAssembler {
     {
       CSA_ASSERT(this,
                  IntPtrGreaterThan(var_fill_length.value(), IntPtrConstant(0)));
-      CSA_ASSERT(this, SmiGreaterThan(max_length, string_length));
+      CSA_ASSERT(this, SmiGreaterThan(smi_max_length, string_length));
 
       Callable stringadd_callable =
           CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
-      TNode<Smi> const pad_length = SmiSub(max_length, string_length);
+      TNode<Smi> const pad_length = SmiSub(smi_max_length, string_length);
 
       VARIABLE(var_pad, MachineRepresentation::kTagged);
 
@@ -1841,7 +1842,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
   // Shortcut for {limit} == 0.
   {
     Label next(this);
-    GotoIfNot(SmiEqual(limit_number, smi_zero), &next);
+    GotoIfNot(WordEqual(limit_number, smi_zero), &next);
 
     const ElementsKind kind = PACKED_ELEMENTS;
     Node* const native_context = LoadNativeContext(context);
@@ -2069,24 +2070,24 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
 
   Label out(this);
 
-  VARIABLE(var_start, MachineRepresentation::kTagged);
-  VARIABLE(var_end, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, var_start);
+  TVARIABLE(Smi, var_end);
 
   // Check that {receiver} is coercible to Object and convert it to a String.
   TNode<String> const string =
       ToThisString(context, receiver, "String.prototype.substring");
 
-  Node* const length = LoadStringLengthAsSmi(string);
+  TNode<Smi> const length = LoadStringLengthAsSmi(string);
 
   // Conversion and bounds-checks for {start}.
-  var_start.Bind(ToSmiBetweenZeroAnd(context, start, length));
+  var_start = ToSmiBetweenZeroAnd(context, start, length);
 
   // Conversion and bounds-checks for {end}.
   {
-    var_end.Bind(length);
+    var_end = length;
     GotoIf(IsUndefined(end), &out);
 
-    var_end.Bind(ToSmiBetweenZeroAnd(context, end, length));
+    var_end = ToSmiBetweenZeroAnd(context, end, length);
 
     Label if_endislessthanstart(this);
     Branch(SmiLessThan(var_end.value(), var_start.value()),
@@ -2094,9 +2095,9 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
 
     BIND(&if_endislessthanstart);
     {
-      Node* const tmp = var_end.value();
-      var_end.Bind(var_start.value());
-      var_start.Bind(tmp);
+      TNode<Smi> const tmp = var_end.value();
+      var_end = var_start.value();
+      var_start = tmp;
       Goto(&out);
     }
   }

src/builtins/builtins-string-gen.h

@@ -74,12 +74,12 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
   void StringIndexOf(Node* const subject_string, Node* const search_string,
                      Node* const position, std::function<void(Node*)> f_return);
 
-  Node* IndexOfDollarChar(Node* const context, Node* const string);
+  TNode<Smi> IndexOfDollarChar(Node* const context, Node* const string);
 
   void RequireObjectCoercible(Node* const context, Node* const value,
                               const char* method_name);
 
-  Node* SmiIsNegative(Node* const value) {
+  TNode<BoolT> SmiIsNegative(TNode<Smi> value) {
     return SmiLessThan(value, SmiConstant(0));
   }
 

src/builtins/builtins-typed-array-gen.cc

@@ -205,8 +205,10 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
     StoreObjectField(holder, JSArrayBufferView::kBufferOffset, buffer);
 
     // Check the alignment.
-    GotoIf(SmiEqual(SmiMod(element_size, SmiConstant(kObjectAlignment)),
-                    SmiConstant(0)),
+    // TODO(ishell): remove <Object, Object>
+    GotoIf(WordEqual<Object, Object>(
+               SmiMod(element_size, SmiConstant(kObjectAlignment)),
+               SmiConstant(0)),
            &aligned);
 
     // Fix alignment if needed.
@@ -367,10 +369,12 @@ void TypedArrayBuiltinsAssembler::ConstructByArrayBuffer(
   // Check that the offset is a multiple of the element size.
   BIND(&offset_is_smi);
   {
-    GotoIf(SmiEqual(offset.value(), SmiConstant(0)), &check_length);
-    GotoIf(SmiLessThan(offset.value(), SmiConstant(0)), &invalid_length);
-    Node* remainder = SmiMod(offset.value(), element_size);
-    Branch(SmiEqual(remainder, SmiConstant(0)), &check_length,
+    TNode<Smi> smi_offset = CAST(offset.value());
+    GotoIf(SmiEqual(smi_offset, SmiConstant(0)), &check_length);
+    GotoIf(SmiLessThan(smi_offset, SmiConstant(0)), &invalid_length);
+    TNode<Number> remainder = SmiMod(smi_offset, element_size);
+    // TODO(ishell): remove <Object, Object>
+    Branch(WordEqual<Object, Object>(remainder, SmiConstant(0)), &check_length,
            &start_offset_error);
   }
   BIND(&offset_not_smi);

src/code-stub-assembler.h

@@ -187,7 +187,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 #define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName) \
   Node* OpName(Node* a, Node* b, ParameterMode mode) {   \
     if (mode == SMI_PARAMETERS) {                        \
-      return SmiOpName(a, b);                            \
+      return SmiOpName(CAST(a), CAST(b));                \
     } else {                                             \
       DCHECK_EQ(INTPTR_PARAMETERS, mode);                \
       return IntPtrOpName(a, b);                         \
@@ -275,7 +275,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // Smi operations.
 #define SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName)                  \
-  TNode<Smi> SmiOpName(SloppyTNode<Smi> a, SloppyTNode<Smi> b) {       \
+  TNode<Smi> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                   \
     return BitcastWordToTaggedSigned(                                  \
         IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b))); \
   }
@@ -288,11 +288,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Smi> TrySmiAdd(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
   TNode<Smi> TrySmiSub(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
 
-  TNode<Smi> SmiShl(SloppyTNode<Smi> a, int shift) {
+  TNode<Smi> SmiShl(TNode<Smi> a, int shift) {
     return BitcastWordToTaggedSigned(WordShl(BitcastTaggedToWord(a), shift));
   }
 
-  TNode<Smi> SmiShr(SloppyTNode<Smi> a, int shift) {
+  TNode<Smi> SmiShr(TNode<Smi> a, int shift) {
     return BitcastWordToTaggedSigned(
         WordAnd(WordShr(BitcastTaggedToWord(a), shift),
                 BitcastTaggedToWord(SmiConstant(-1))));
@@ -300,7 +300,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   Node* WordOrSmiShl(Node* a, int shift, ParameterMode mode) {
     if (mode == SMI_PARAMETERS) {
-      return SmiShl(a, shift);
+      return SmiShl(CAST(a), shift);
     } else {
       DCHECK_EQ(INTPTR_PARAMETERS, mode);
       return WordShl(a, shift);
@@ -309,7 +309,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   Node* WordOrSmiShr(Node* a, int shift, ParameterMode mode) {
     if (mode == SMI_PARAMETERS) {
-      return SmiShr(a, shift);
+      return SmiShr(CAST(a), shift);
     } else {
       DCHECK_EQ(INTPTR_PARAMETERS, mode);
       return WordShr(a, shift);
@@ -317,7 +317,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   }
 
 #define SMI_COMPARISON_OP(SmiOpName, IntPtrOpName)                       \
-  TNode<BoolT> SmiOpName(Node* a, Node* b) {                             \
+  TNode<BoolT> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                   \
     return IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b)); \
   }
   SMI_COMPARISON_OP(SmiEqual, WordEqual)
@@ -330,15 +330,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   SMI_COMPARISON_OP(SmiGreaterThan, IntPtrGreaterThan)
   SMI_COMPARISON_OP(SmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual)
 #undef SMI_COMPARISON_OP
-  TNode<Smi> SmiMax(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
-  TNode<Smi> SmiMin(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Smi> SmiMax(TNode<Smi> a, TNode<Smi> b);
+  TNode<Smi> SmiMin(TNode<Smi> a, TNode<Smi> b);
   // Computes a % b for Smi inputs a and b; result is not necessarily a Smi.
-  TNode<Number> SmiMod(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Number> SmiMod(TNode<Smi> a, TNode<Smi> b);
   // Computes a * b for Smi inputs a and b; result is not necessarily a Smi.
-  TNode<Number> SmiMul(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
-  // Tries to computes dividend / divisor for Smi inputs; branching to bailout
+  TNode<Number> SmiMul(TNode<Smi> a, TNode<Smi> b);
+  // Tries to compute dividend / divisor for Smi inputs; branching to bailout
   // if the division needs to be performed as a floating point operation.
-  Node* TrySmiDiv(Node* dividend, Node* divisor, Label* bailout);
+  TNode<Smi> TrySmiDiv(TNode<Smi> dividend, TNode<Smi> divisor, Label* bailout);
 
   // Smi | HeapNumber operations.
   TNode<Number> NumberInc(SloppyTNode<Number> value);
@@ -349,7 +349,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void GotoIfNumber(Node* value, Label* is_number);
   TNode<Number> SmiToNumber(TNode<Smi> v) { return v; }
 
-  Node* BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
+  TNode<Number> BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
 
   // Allocate an object of the given size.
   Node* AllocateInNewSpace(Node* size, AllocationFlags flags = kNone);
@@ -471,15 +471,17 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   void Bind(Label* label);
 #endif  // DEBUG
 
-  void BranchIfSmiEqual(Node* a, Node* b, Label* if_true, Label* if_false) {
+  void BranchIfSmiEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
+                        Label* if_false) {
     Branch(SmiEqual(a, b), if_true, if_false);
   }
 
-  void BranchIfSmiLessThan(Node* a, Node* b, Label* if_true, Label* if_false) {
+  void BranchIfSmiLessThan(TNode<Smi> a, TNode<Smi> b, Label* if_true,
+                           Label* if_false) {
     Branch(SmiLessThan(a, b), if_true, if_false);
   }
 
-  void BranchIfSmiLessThanOrEqual(Node* a, Node* b, Label* if_true,
+  void BranchIfSmiLessThanOrEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
                                   Label* if_false) {
     Branch(SmiLessThanOrEqual(a, b), if_true, if_false);
   }
@@ -2465,7 +2467,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   TNode<Uint32T> GetSortedKeyIndex(TNode<Array> descriptors,
                                    TNode<Uint32T> entry_index);
 
-  Node* CollectFeedbackForString(Node* instance_type);
+  TNode<Smi> CollectFeedbackForString(SloppyTNode<Int32T> instance_type);
   void GenerateEqual_Same(Node* value, Label* if_equal, Label* if_notequal,
                           Variable* var_type_feedback = nullptr);
   TNode<String> AllocAndCopyStringCharacters(Node* from,

src/code-stubs.cc

@@ -527,7 +527,7 @@ void ArrayConstructorAssembler::GenerateConstructor(
 
   if (IsFastPackedElementsKind(elements_kind)) {
     Label abort(this, Label::kDeferred);
-    Branch(SmiEqual(array_size, SmiConstant(0)), &small_smi_size, &abort);
+    Branch(SmiEqual(CAST(array_size), SmiConstant(0)), &small_smi_size, &abort);
 
     BIND(&abort);
     Node* reason = SmiConstant(AbortReason::kAllocatingNonEmptyPackedArray);
@@ -539,7 +539,7 @@ void ArrayConstructorAssembler::GenerateConstructor(
         (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - JSArray::kSize -
          AllocationMemento::kSize) /
         element_size;
-    Branch(SmiAboveOrEqual(array_size, SmiConstant(max_fast_elements)),
+    Branch(SmiAboveOrEqual(CAST(array_size), SmiConstant(max_fast_elements)),
            &call_runtime, &small_smi_size);
   }
 

src/ic/accessor-assembler.cc

@@ -123,7 +123,7 @@ void AccessorAssembler::HandlePolymorphicCase(
 
     if (i >= min_feedback_capacity) {
       if (length == nullptr) length = LoadWeakFixedArrayLength(feedback);
-      GotoIf(SmiGreaterThanOrEqual(SmiConstant(handler_index), length),
+      GotoIf(SmiGreaterThanOrEqual(SmiConstant(handler_index), CAST(length)),
              if_miss);
     }
 

src/ic/binary-op-assembler.cc

@@ -443,7 +443,7 @@ Node* BinaryOpAssembler::Generate_MultiplyWithFeedback(Node* context, Node* lhs,
                                                        Node* feedback_vector,
                                                        bool rhs_is_smi) {
   auto smiFunction = [=](Node* lhs, Node* rhs, Variable* var_type_feedback) {
-    Node* result = SmiMul(lhs, rhs);
+    TNode<Number> result = SmiMul(CAST(lhs), CAST(rhs));
     var_type_feedback->Bind(SelectSmiConstant(
         TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
         BinaryOperationFeedback::kNumber));
@@ -467,7 +467,7 @@ Node* BinaryOpAssembler::Generate_DivideWithFeedback(
     // Smi and Number operations, so this path should not be marked as Deferred.
     Label bailout(this, rhs_is_smi ? Label::kDeferred : Label::kNonDeferred),
         end(this);
-    var_result.Bind(TrySmiDiv(lhs, rhs, &bailout));
+    var_result.Bind(TrySmiDiv(CAST(lhs), CAST(rhs), &bailout));
     var_type_feedback->Bind(SmiConstant(BinaryOperationFeedback::kSignedSmall));
     Goto(&end);
 
@@ -495,7 +495,7 @@ Node* BinaryOpAssembler::Generate_ModulusWithFeedback(
     Node* context, Node* dividend, Node* divisor, Node* slot_id,
     Node* feedback_vector, bool rhs_is_smi) {
   auto smiFunction = [=](Node* lhs, Node* rhs, Variable* var_type_feedback) {
-    Node* result = SmiMod(lhs, rhs);
+    TNode<Number> result = SmiMod(CAST(lhs), CAST(rhs));
     var_type_feedback->Bind(SelectSmiConstant(
         TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
         BinaryOperationFeedback::kNumber));

src/interpreter/interpreter-generator.cc

@@ -902,8 +902,8 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
     Node* slot_index = BytecodeOperandIdx(1);
     Node* feedback_vector = LoadFeedbackVector();
 
-    VARIABLE(var_left_feedback, MachineRepresentation::kTaggedSigned);
-    VARIABLE(var_right_feedback, MachineRepresentation::kTaggedSigned);
+    TVARIABLE(Smi, var_left_feedback);
+    TVARIABLE(Smi, var_right_feedback);
     VARIABLE(var_left_word32, MachineRepresentation::kWord32);
     VARIABLE(var_right_word32, MachineRepresentation::kWord32);
     VARIABLE(var_left_bigint, MachineRepresentation::kTagged, left);
@@ -919,12 +919,12 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
                                        &var_right_word32, &do_bigint_op,
                                        &var_right_bigint, &var_right_feedback);
     BIND(&do_number_op);
-    Node* result = BitwiseOp(var_left_word32.value(), var_right_word32.value(),
-                             bitwise_op);
-    Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
-                                          BinaryOperationFeedback::kSignedSmall,
-                                          BinaryOperationFeedback::kNumber);
-    Node* input_feedback =
+    TNode<Number> result = BitwiseOp(var_left_word32.value(),
+                                     var_right_word32.value(), bitwise_op);
+    TNode<Smi> result_type = SelectSmiConstant(
+        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
+        BinaryOperationFeedback::kNumber);
+    TNode<Smi> input_feedback =
         SmiOr(var_left_feedback.value(), var_right_feedback.value());
     UpdateFeedback(SmiOr(result_type, input_feedback), feedback_vector,
                    slot_index);
@@ -952,7 +952,7 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
     Node* feedback_vector = LoadFeedbackVector();
     Node* context = GetContext();
 
-    VARIABLE(var_left_feedback, MachineRepresentation::kTaggedSigned);
+    TVARIABLE(Smi, var_left_feedback);
     VARIABLE(var_left_word32, MachineRepresentation::kWord32);
     VARIABLE(var_left_bigint, MachineRepresentation::kTagged);
     Label do_smi_op(this), if_bigint_mix(this);
@@ -961,11 +961,11 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
                                        &var_left_word32, &if_bigint_mix,
                                        &var_left_bigint, &var_left_feedback);
     BIND(&do_smi_op);
-    Node* result =
+    TNode<Number> result =
         BitwiseOp(var_left_word32.value(), SmiToInt32(right), bitwise_op);
-    Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
-                                          BinaryOperationFeedback::kSignedSmall,
-                                          BinaryOperationFeedback::kNumber);
+    TNode<Smi> result_type = SelectSmiConstant(
+        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
+        BinaryOperationFeedback::kNumber);
     UpdateFeedback(SmiOr(result_type, var_left_feedback.value()),
                    feedback_vector, slot_index);
     SetAccumulator(result);
@@ -1059,7 +1059,7 @@ IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
   Node* context = GetContext();
 
   VARIABLE(var_word32, MachineRepresentation::kWord32);
-  VARIABLE(var_feedback, MachineRepresentation::kTaggedSigned);
+  TVARIABLE(Smi, var_feedback);
   VARIABLE(var_bigint, MachineRepresentation::kTagged);
   Label if_number(this), if_bigint(this);
   TaggedToWord32OrBigIntWithFeedback(context, operand, &if_number, &var_word32,
@@ -1067,10 +1067,11 @@ IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
 
   // Number case.
   BIND(&if_number);
-  Node* result = ChangeInt32ToTagged(Signed(Word32Not(var_word32.value())));
-  Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
-                                        BinaryOperationFeedback::kSignedSmall,
-                                        BinaryOperationFeedback::kNumber);
+  TNode<Number> result =
+      ChangeInt32ToTagged(Signed(Word32Not(var_word32.value())));
+  TNode<Smi> result_type = SelectSmiConstant(
+      TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
+      BinaryOperationFeedback::kNumber);
   UpdateFeedback(SmiOr(result_type, var_feedback.value()), feedback_vector,
                  slot_index);
   SetAccumulator(result);
@@ -1122,8 +1123,8 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
   virtual ~UnaryNumericOpAssembler() {}
 
   // Must return a tagged value.
-  virtual Node* SmiOp(Node* smi_value, Variable* var_feedback,
-                      Label* do_float_op, Variable* var_float) = 0;
+  virtual TNode<Number> SmiOp(TNode<Smi> smi_value, Variable* var_feedback,
+                              Label* do_float_op, Variable* var_float) = 0;
   // Must return a Float64 value.
   virtual Node* FloatOp(Node* float_value) = 0;
   // Must return a tagged value.
@@ -1136,8 +1137,7 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
 
     VARIABLE(var_result, MachineRepresentation::kTagged);
     VARIABLE(var_float_value, MachineRepresentation::kFloat64);
-    VARIABLE(var_feedback, MachineRepresentation::kTaggedSigned,
-             SmiConstant(BinaryOperationFeedback::kNone));
+    TVARIABLE(Smi, var_feedback, SmiConstant(BinaryOperationFeedback::kNone));
     Variable* loop_vars[] = {&var_value, &var_feedback};
     Label start(this, arraysize(loop_vars), loop_vars), end(this);
     Label do_float_op(this, &var_float_value);
@@ -1159,7 +1159,7 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
       BIND(&if_smi);
       {
         var_result.Bind(
-            SmiOp(value, &var_feedback, &do_float_op, &var_float_value));
+            SmiOp(CAST(value), &var_feedback, &do_float_op, &var_float_value));
         Goto(&end);
       }
 
@@ -1224,9 +1224,9 @@ class NegateAssemblerImpl : public UnaryNumericOpAssembler {
                                OperandScale operand_scale)
       : UnaryNumericOpAssembler(state, bytecode, operand_scale) {}
 
-  Node* SmiOp(Node* smi_value, Variable* var_feedback, Label* do_float_op,
-              Variable* var_float) override {
-    VARIABLE(var_result, MachineRepresentation::kTagged);
+  TNode<Number> SmiOp(TNode<Smi> smi_value, Variable* var_feedback,
+                      Label* do_float_op, Variable* var_float) override {
+    TVARIABLE(Number, var_result);
     Label if_zero(this), if_min_smi(this), end(this);
     // Return -0 if operand is 0.
     GotoIf(SmiEqual(smi_value, SmiConstant(0)), &if_zero);
@@ -1236,12 +1236,12 @@ class NegateAssemblerImpl : public UnaryNumericOpAssembler {
 
     // Else simply subtract operand from 0.
     CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
-    var_result.Bind(SmiSub(SmiConstant(0), smi_value));
+    var_result = SmiSub(SmiConstant(0), smi_value);
     Goto(&end);
 
     BIND(&if_zero);
     CombineFeedback(var_feedback, BinaryOperationFeedback::kNumber);
-    var_result.Bind(MinusZeroConstant());
+    var_result = MinusZeroConstant();
     Goto(&end);
 
     BIND(&if_min_smi);
@@ -1320,9 +1320,8 @@ class IncDecAssembler : public UnaryNumericOpAssembler {
     return op_;
   }
 
-  Node* SmiOp(Node* smi_value, Variable* var_feedback, Label* do_float_op,
-              Variable* var_float) override {
-    TNode<Smi> value = CAST(smi_value);
+  TNode<Number> SmiOp(TNode<Smi> value, Variable* var_feedback,
+                      Label* do_float_op, Variable* var_float) override {
     TNode<Smi> one = SmiConstant(1);
     Label if_overflow(this), if_notoverflow(this);
     TNode<Smi> result = op() == Operation::kIncrement
@@ -1332,7 +1331,7 @@ class IncDecAssembler : public UnaryNumericOpAssembler {
 
     BIND(&if_overflow);
     {
-      var_float->Bind(SmiToFloat64(smi_value));
+      var_float->Bind(SmiToFloat64(value));
       Goto(do_float_op);
     }
 
@@ -2966,9 +2965,9 @@ IGNITION_HANDLER(ForInContinue, InterpreterAssembler) {
 // Increments the loop counter in register |index| and stores the result
 // in the accumulator.
 IGNITION_HANDLER(ForInStep, InterpreterAssembler) {
-  Node* index = LoadRegisterAtOperandIndex(0);
-  Node* one = SmiConstant(1);
-  Node* result = SmiAdd(index, one);
+  TNode<Smi> index = CAST(LoadRegisterAtOperandIndex(0));
+  TNode<Smi> one = SmiConstant(1);
+  TNode<Smi> result = SmiAdd(index, one);
   SetAccumulator(result);
   Dispatch();
 }

test/cctest/test-code-stub-assembler.cc

@@ -1959,13 +1959,14 @@ TEST(ArgumentsForEach) {
 
   CodeStubArguments arguments(&m, m.IntPtrConstant(3));
 
-  Variable sum(&m, MachineRepresentation::kTagged);
+  TVariable<Smi> sum(&m);
   CodeAssemblerVariableList list({&sum}, m.zone());
 
-  sum.Bind(m.SmiConstant(0));
+  sum = m.SmiConstant(0);
 
-  arguments.ForEach(
-      list, [&m, &sum](Node* arg) { sum.Bind(m.SmiAdd(sum.value(), arg)); });
+  arguments.ForEach(list, [&m, &sum](Node* arg) {
+    sum = m.SmiAdd(sum.value(), m.CAST(arg));
+  });
 
   arguments.PopAndReturn(sum.value());