[csa] Typify Smi arithmetic and comparison operations.

Bug: v8:7754 Change-Id: Id22020984e10bd2ddb22119c50b490419c897174 Reviewed-on: https://chromium-review.googlesource.com/1062272Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53232}

[csa] Typify Smi arithmetic and comparison operations.
Bug: v8:7754 Change-Id: Id22020984e10bd2ddb22119c50b490419c897174 Reviewed-on: https://chromium-review.googlesource.com/1062272Reviewed-by: Leszek Swirski <leszeks@chromium.org> Reviewed-by: Jakob Gruber <jgruber@chromium.org> Commit-Queue: Igor Sheludko <ishell@chromium.org> Cr-Commit-Position: refs/heads/master@{#53232}
0aff573b · Igor Sheludko · Commit Bot · 6cbd3186 · 0aff573b · 0aff573b
Commit 0aff573b authored May 17, 2018 by Igor Sheludko Committed by Commit Bot May 17, 2018
22 changed files
--- a/src/builtins/builtins-array-gen.cc
+++ b/src/builtins/builtins-array-gen.cc
@@ -150,7 +150,7 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
      BIND(&fast);
      {
-        GotoIf(SmiNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
+        GotoIf(WordNotEqual(LoadJSArrayLength(a()), to_.value()), &runtime);
        kind = EnsureArrayPushable(LoadMap(a()), &runtime);
        GotoIf(IsElementsKindGreaterThan(kind, HOLEY_SMI_ELEMENTS),
               &object_push_pre);
@@ -211,9 +211,10 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
        context(), original_array, length, method_name);
    // In the Spec and our current implementation, the length check is already
    // performed in TypedArraySpeciesCreate.
-    CSA_ASSERT(this,
+    CSA_ASSERT(
-               SmiLessThanOrEqual(
+        this,
-                   len_, LoadObjectField(a, JSTypedArray::kLengthOffset)));
+        SmiLessThanOrEqual(
+            CAST(len_), CAST(LoadObjectField(a, JSTypedArray::kLengthOffset))));
    fast_typed_array_target_ =
        Word32Equal(LoadInstanceType(LoadElements(original_array)),
                    LoadInstanceType(LoadElements(a)));
@@ -706,7 +707,8 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
          TNode<JSArray> o_array = CAST(o());
          // Check if o's length has changed during the callback and if the
          // index is now out of range of the new length.
-          GotoIf(SmiGreaterThanOrEqual(k_.value(), LoadJSArrayLength(o_array)),
+          GotoIf(SmiGreaterThanOrEqual(CAST(k_.value()),
+                                       CAST(LoadJSArrayLength(o_array))),
                 array_changed);
          // Re-load the elements array. If may have been resized.
@@ -868,8 +870,9 @@ Node* ArrayBuiltinsAssembler::FindProcessor(Node* k_value, Node* k) {
    GotoIf(WordEqual(value, protector_invalid), &runtime);
    GotoIfNot(TaggedIsPositiveSmi(len), &runtime);
-    GotoIf(SmiAbove(len, SmiConstant(JSArray::kInitialMaxFastElementArray)),
+    GotoIf(
-           &runtime);
+        SmiAbove(CAST(len), SmiConstant(JSArray::kInitialMaxFastElementArray)),
+        &runtime);
    // We need to be conservative and start with holey because the builtins
    // that create output arrays aren't guaranteed to be called for every
@@ -1163,9 +1166,9 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
    // Make sure that the length hasn't been changed by side-effect.
    Node* array_length = LoadJSArrayLength(array);
    GotoIf(TaggedIsNotSmi(array_length), slow);
-    GotoIf(SmiAbove(SmiAdd(from, count), array_length), slow);
+    GotoIf(SmiAbove(SmiAdd(CAST(from), CAST(count)), CAST(array_length)), slow);
-    CSA_ASSERT(this, SmiGreaterThanOrEqual(from, SmiConstant(0)));
+    CSA_ASSERT(this, SmiGreaterThanOrEqual(CAST(from), SmiConstant(0)));
    result.Bind(CallStub(CodeFactory::ExtractFastJSArray(isolate()), context,
                         array, from, count));
@@ -1179,8 +1182,9 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
    GotoIf(WordNotEqual(map, fast_aliasted_arguments_map), &try_simple_slice);
    Node* sloppy_elements = LoadElements(array);
-    Node* sloppy_elements_length = LoadFixedArrayBaseLength(sloppy_elements);
+    TNode<Smi> sloppy_elements_length =
-    Node* parameter_map_length =
+        LoadFixedArrayBaseLength(sloppy_elements);
+    TNode<Smi> parameter_map_length =
        SmiSub(sloppy_elements_length,
               SmiConstant(SloppyArgumentsElements::kParameterMapStart));
    VARIABLE(index_out, MachineType::PointerRepresentation());
@@ -1189,16 +1193,16 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
        (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - JSArray::kSize -
         AllocationMemento::kSize) /
        kPointerSize;
-    GotoIf(SmiAboveOrEqual(count, SmiConstant(max_fast_elements)),
+    GotoIf(SmiAboveOrEqual(CAST(count), SmiConstant(max_fast_elements)),
           &try_simple_slice);
-    GotoIf(SmiLessThan(from, SmiConstant(0)), slow);
+    GotoIf(SmiLessThan(CAST(from), SmiConstant(0)), slow);
-    Node* end = SmiAdd(from, count);
+    TNode<Smi> end = SmiAdd(CAST(from), CAST(count));
    Node* unmapped_elements = LoadFixedArrayElement(
        sloppy_elements, SloppyArgumentsElements::kArgumentsIndex);
-    Node* unmapped_elements_length =
+    TNode<Smi> unmapped_elements_length =
        LoadFixedArrayBaseLength(unmapped_elements);
    GotoIf(SmiAbove(end, unmapped_elements_length), slow);
@@ -1209,8 +1213,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
    index_out.Bind(IntPtrConstant(0));
    Node* result_elements = LoadElements(result.value());
-    Node* from_mapped = SmiMin(parameter_map_length, from);
+    TNode<Smi> from_mapped = SmiMin(parameter_map_length, CAST(from));
-    Node* to = SmiMin(parameter_map_length, end);
+    TNode<Smi> to = SmiMin(parameter_map_length, end);
    Node* arguments_context = LoadFixedArrayElement(
        sloppy_elements, SloppyArgumentsElements::kContextIndex);
    VariableList var_list({&index_out}, zone());
@@ -1240,7 +1244,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
        },
        1, SMI_PARAMETERS, IndexAdvanceMode::kPost);
-    Node* unmapped_from = SmiMin(SmiMax(parameter_map_length, from), end);
+    TNode<Smi> unmapped_from =
+        SmiMin(SmiMax(parameter_map_length, CAST(from)), end);
    BuildFastLoop(
        var_list, unmapped_from, end,
@@ -2132,7 +2137,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
    TVARIABLE(Number, index, SmiConstant(0));
-    GotoIf(SmiEqual(length.value(), SmiConstant(0)), &finished);
+    GotoIf(SmiEqual(CAST(length.value()), SmiConstant(0)), &finished);
    // Loop from 0 to length-1.
    {
@@ -3508,17 +3513,14 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
    Node* elements_kind = LoadMapElementsKind(array_map);
    GotoIfNot(IsFastElementsKind(elements_kind), &if_other);
-    Node* length = LoadJSArrayLength(array);
+    TNode<Smi> length = CAST(LoadJSArrayLength(array));
-    CSA_ASSERT(this, TaggedIsSmi(length));
+    GotoIfNot(SmiBelow(CAST(index), length), &set_done);
-    CSA_ASSERT(this, TaggedIsSmi(index));
-    GotoIfNot(SmiBelow(index, length), &set_done);
    var_value.Bind(index);
-    Node* one = SmiConstant(1);
+    TNode<Smi> one = SmiConstant(1);
    StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                   SmiAdd(index, one));
+                                   SmiAdd(CAST(index), one));
    var_done.Bind(FalseConstant());
    GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
@@ -3623,17 +3625,15 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
    Node* buffer = LoadObjectField(array, JSTypedArray::kBufferOffset);
    GotoIf(IsDetachedBuffer(buffer), &if_detached);
-    Node* length = LoadObjectField(array, JSTypedArray::kLengthOffset);
+    TNode<Smi> length =
+        CAST(LoadObjectField(array, JSTypedArray::kLengthOffset));
-    CSA_ASSERT(this, TaggedIsSmi(length));
-    CSA_ASSERT(this, TaggedIsSmi(index));
-    GotoIfNot(SmiBelow(index, length), &set_done);
+    GotoIfNot(SmiBelow(CAST(index), length), &set_done);
    var_value.Bind(index);
-    Node* one = SmiConstant(1);
+    TNode<Smi> one = SmiConstant(1);
    StoreObjectFieldNoWriteBarrier(iterator, JSArrayIterator::kNextIndexOffset,
-                                   SmiAdd(index, one));
+                                   SmiAdd(CAST(index), one));
    var_done.Bind(FalseConstant());
    GotoIf(Word32Equal(LoadAndUntagToWord32ObjectField(
@@ -3784,7 +3784,8 @@ class ArrayFlattenAssembler : public CodeStubAssembler {
      // a. Let P be ! ToString(sourceIndex).
      // b. Let exists be ? HasProperty(source, P).
-      CSA_ASSERT(this, SmiGreaterThanOrEqual(source_index, SmiConstant(0)));
+      CSA_ASSERT(this,
+                 SmiGreaterThanOrEqual(CAST(source_index), SmiConstant(0)));
      Node* const exists =
          HasProperty(source, source_index, context, kHasProperty);

--- a/src/builtins/builtins-async-function-gen.cc
+++ b/src/builtins/builtins-async-function-gen.cc
@@ -55,9 +55,9 @@ void AsyncFunctionBuiltinsAssembler::AsyncFunctionAwaitResumeClosure(
  // Ensure that the generator is neither closed nor running.
  CSA_SLOW_ASSERT(
      this,
-      SmiGreaterThan(
+      SmiGreaterThan(CAST(LoadObjectField(
-          LoadObjectField(generator, JSGeneratorObject::kContinuationOffset),
+                         generator, JSGeneratorObject::kContinuationOffset)),
-          SmiConstant(JSGeneratorObject::kGeneratorClosed)));
+                     SmiConstant(JSGeneratorObject::kGeneratorClosed)));
  // Remember the {resume_mode} for the {generator}.
  StoreObjectFieldNoWriteBarrier(generator,

--- a/src/builtins/builtins-async-generator-gen.cc
+++ b/src/builtins/builtins-async-generator-gen.cc
@@ -41,37 +41,39 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
    return LoadObjectField(generator, JSGeneratorObject::kContinuationOffset);
  }
-  inline Node* IsGeneratorStateClosed(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateClosed(SloppyTNode<Smi> const state) {
    return SmiEqual(state, SmiConstant(JSGeneratorObject::kGeneratorClosed));
  }
-  inline Node* IsGeneratorClosed(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorClosed(Node* const generator) {
    return IsGeneratorStateClosed(LoadGeneratorState(generator));
  }
-  inline Node* IsGeneratorStateSuspended(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateSuspended(SloppyTNode<Smi> const state) {
    return SmiGreaterThanOrEqual(state, SmiConstant(0));
  }
-  inline Node* IsGeneratorSuspended(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorSuspended(Node* const generator) {
    return IsGeneratorStateSuspended(LoadGeneratorState(generator));
  }
-  inline Node* IsGeneratorStateSuspendedAtStart(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateSuspendedAtStart(
+      SloppyTNode<Smi> const state) {
    return SmiEqual(state, SmiConstant(0));
  }
-  inline Node* IsGeneratorStateNotExecuting(Node* const state) {
+  inline TNode<BoolT> IsGeneratorStateNotExecuting(
+      SloppyTNode<Smi> const state) {
    return SmiNotEqual(state,
                       SmiConstant(JSGeneratorObject::kGeneratorExecuting));
  }
-  inline Node* IsGeneratorNotExecuting(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorNotExecuting(Node* const generator) {
    return IsGeneratorStateNotExecuting(LoadGeneratorState(generator));
  }
-  inline Node* IsGeneratorAwaiting(Node* const generator) {
+  inline TNode<BoolT> IsGeneratorAwaiting(Node* const generator) {
-    Node* is_generator_awaiting =
+    TNode<Object> is_generator_awaiting =
        LoadObjectField(generator, JSAsyncGeneratorObject::kIsAwaitingOffset);
-    return SmiEqual(is_generator_awaiting, SmiConstant(1));
+    return WordEqual(is_generator_awaiting, SmiConstant(1));
  }
  inline void SetGeneratorAwaiting(Node* const generator) {
@@ -118,7 +120,7 @@ class AsyncGeneratorBuiltinsAssembler : public AsyncBuiltinsAssembler {
    return LoadObjectField(request, AsyncGeneratorRequest::kValueOffset);
  }
-  inline Node* IsAbruptResumeType(Node* const resume_type) {
+  inline TNode<BoolT> IsAbruptResumeType(SloppyTNode<Smi> const resume_type) {
    return SmiNotEqual(resume_type, SmiConstant(JSGeneratorObject::kNext));
  }
@@ -174,7 +176,7 @@ void AsyncGeneratorBuiltinsAssembler::AsyncGeneratorEnqueue(
    // If state is not "executing", then
    //     Perform AsyncGeneratorResumeNext(Generator)
    // Check if the {receiver} is running or already closed.
-    Node* continuation = LoadGeneratorState(generator);
+    TNode<Smi> continuation = CAST(LoadGeneratorState(generator));
    GotoIf(SmiEqual(continuation,
                    SmiConstant(JSAsyncGeneratorObject::kGeneratorExecuting)),
@@ -430,7 +432,8 @@ TF_BUILTIN(AsyncGeneratorResumeNext, AsyncGeneratorBuiltinsAssembler) {
  ReturnIf(IsUndefined(var_next.value()), UndefinedConstant());
  Node* const next = var_next.value();
-  Node* const resume_type = LoadResumeTypeFromAsyncGeneratorRequest(next);
+  TNode<Smi> const resume_type =
+      CAST(LoadResumeTypeFromAsyncGeneratorRequest(next));
  Label if_abrupt(this), if_normal(this), resume_generator(this);
  Branch(IsAbruptResumeType(resume_type), &if_abrupt, &if_normal);

--- a/src/builtins/builtins-collections-gen.cc
+++ b/src/builtins/builtins-collections-gen.cc
@@ -983,10 +983,8 @@ void CollectionsBuiltinsAssembler::SameValueZeroHeapNumber(Node* key_float,
 }
 TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
-  Node* table = Parameter(Descriptor::kTable);
+  TNode<HeapObject> table = CAST(Parameter(Descriptor::kTable));
-  Node* index = Parameter(Descriptor::kIndex);
+  TNode<Smi> index = CAST(Parameter(Descriptor::kIndex));
-  CSA_ASSERT(this, TaggedIsNotSmi(table));
-  CSA_ASSERT(this, TaggedIsSmi(index));
  Label return_index(this), return_zero(this);
  // Check if we need to update the {index}.
@@ -1007,8 +1005,8 @@ TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
  {
    Node* i = var_i.value();
    GotoIfNot(IntPtrLessThan(i, number_of_deleted_elements), &return_index);
-    Node* removed_index = LoadFixedArrayElement(
+    TNode<Smi> removed_index = CAST(LoadFixedArrayElement(
-        table, i, OrderedHashTableBase::kRemovedHolesIndex * kPointerSize);
+        table, i, OrderedHashTableBase::kRemovedHolesIndex * kPointerSize));
    GotoIf(SmiGreaterThanOrEqual(removed_index, index), &return_index);
    Decrement(&var_index, 1, SMI_PARAMETERS);
    Increment(&var_i);
@@ -1120,8 +1118,8 @@ TF_BUILTIN(MapPrototypeGet, CollectionsBuiltinsAssembler) {
  ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.get");
  Node* const table = LoadObjectField(receiver, JSMap::kTableOffset);
-  Node* index =
+  TNode<Smi> index = CAST(
-      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key);
+      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
  Label if_found(this), if_not_found(this);
  Branch(SmiGreaterThanOrEqual(index, SmiConstant(0)), &if_found,
@@ -1145,8 +1143,8 @@ TF_BUILTIN(MapPrototypeHas, CollectionsBuiltinsAssembler) {
  ThrowIfNotInstanceType(context, receiver, JS_MAP_TYPE, "Map.prototype.has");
  Node* const table = LoadObjectField(receiver, JSMap::kTableOffset);
-  Node* index =
+  TNode<Smi> index = CAST(
-      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key);
+      CallBuiltin(Builtins::kFindOrderedHashMapEntry, context, table, key));
  Label if_found(this), if_not_found(this);
  Branch(SmiGreaterThanOrEqual(index, SmiConstant(0)), &if_found,
@@ -1282,8 +1280,8 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashMapNewEntry(
                         OrderedHashMap::kHashTableStartIndex * kPointerSize);
  // Bump the elements count.
-  Node* const number_of_elements =
+  TNode<Smi> const number_of_elements =
-      LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset);
+      CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset));
  StoreObjectFieldNoWriteBarrier(table, OrderedHashMap::kNumberOfElementsOffset,
                                 SmiAdd(number_of_elements, SmiConstant(1)));
 }
@@ -1320,20 +1318,20 @@ TF_BUILTIN(MapPrototypeDelete, CollectionsBuiltinsAssembler) {
                                         OrderedHashMap::kValueOffset));
  // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements = SmiSub(
+  TNode<Smi> const number_of_elements = SmiSub(
      CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset)),
      SmiConstant(1));
  StoreObjectFieldNoWriteBarrier(table, OrderedHashMap::kNumberOfElementsOffset,
                                 number_of_elements);
-  Node* const number_of_deleted =
+  TNode<Smi> const number_of_deleted =
      SmiAdd(CAST(LoadObjectField(
                 table, OrderedHashMap::kNumberOfDeletedElementsOffset)),
             SmiConstant(1));
  StoreObjectFieldNoWriteBarrier(
      table, OrderedHashMap::kNumberOfDeletedElementsOffset, number_of_deleted);
-  Node* const number_of_buckets =
+  TNode<Smi> const number_of_buckets =
-      LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex);
+      CAST(LoadFixedArrayElement(table, OrderedHashMap::kNumberOfBucketsIndex));
  // If there fewer elements than #buckets / 2, shrink the table.
  Label shrink(this);
@@ -1445,8 +1443,8 @@ void CollectionsBuiltinsAssembler::StoreOrderedHashSetNewEntry(
                         OrderedHashSet::kHashTableStartIndex * kPointerSize);
  // Bump the elements count.
-  Node* const number_of_elements =
+  TNode<Smi> const number_of_elements =
-      LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset);
+      CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset));
  StoreObjectFieldNoWriteBarrier(table, OrderedHashSet::kNumberOfElementsOffset,
                                 SmiAdd(number_of_elements, SmiConstant(1)));
 }
@@ -1479,20 +1477,20 @@ TF_BUILTIN(SetPrototypeDelete, CollectionsBuiltinsAssembler) {
                         kPointerSize * OrderedHashSet::kHashTableStartIndex);
  // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements = SmiSub(
+  TNode<Smi> const number_of_elements = SmiSub(
      CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset)),
      SmiConstant(1));
  StoreObjectFieldNoWriteBarrier(table, OrderedHashSet::kNumberOfElementsOffset,
                                 number_of_elements);
-  Node* const number_of_deleted =
+  TNode<Smi> const number_of_deleted =
      SmiAdd(CAST(LoadObjectField(
                 table, OrderedHashSet::kNumberOfDeletedElementsOffset)),
             SmiConstant(1));
  StoreObjectFieldNoWriteBarrier(
      table, OrderedHashSet::kNumberOfDeletedElementsOffset, number_of_deleted);
-  Node* const number_of_buckets =
+  TNode<Smi> const number_of_buckets =
-      LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex);
+      CAST(LoadFixedArrayElement(table, OrderedHashSet::kNumberOfBucketsIndex));
  // If there fewer elements than #buckets / 2, shrink the table.
  Label shrink(this);

--- a/src/builtins/builtins-generator-gen.cc
+++ b/src/builtins/builtins-generator-gen.cc
@@ -35,11 +35,11 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
            &if_receiverisincompatible);
  // Check if the {receiver} is running or already closed.
-  Node* receiver_continuation =
+  TNode<Smi> receiver_continuation =
-      LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset);
+      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
  Label if_receiverisclosed(this, Label::kDeferred),
      if_receiverisrunning(this, Label::kDeferred);
-  Node* closed = SmiConstant(JSGeneratorObject::kGeneratorClosed);
+  TNode<Smi> closed = SmiConstant(JSGeneratorObject::kGeneratorClosed);
  GotoIf(SmiEqual(receiver_continuation, closed), &if_receiverisclosed);
  DCHECK_LT(JSGeneratorObject::kGeneratorExecuting,
            JSGeneratorObject::kGeneratorClosed);
@@ -59,14 +59,14 @@ void GeneratorBuiltinsAssembler::GeneratorPrototypeResume(
  // If the generator is not suspended (i.e., its state is 'executing'),
  // close it and wrap the return value in IteratorResult.
-  Node* result_continuation =
+  TNode<Smi> result_continuation =
-      LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset);
+      CAST(LoadObjectField(receiver, JSGeneratorObject::kContinuationOffset));
  // The generator function should not close the generator by itself, let's
  // check it is indeed not closed yet.
  CSA_ASSERT(this, SmiNotEqual(result_continuation, closed));
-  Node* executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
+  TNode<Smi> executing = SmiConstant(JSGeneratorObject::kGeneratorExecuting);
  GotoIf(SmiEqual(result_continuation, executing), &if_final_return);
  args->PopAndReturn(result);

--- a/src/builtins/builtins-math-gen.cc
+++ b/src/builtins/builtins-math-gen.cc
@@ -50,7 +50,7 @@ TF_BUILTIN(MathAbs, CodeStubAssembler) {
      } else {
        // Check if {x} is already positive.
        Label if_xispositive(this), if_xisnotpositive(this);
-        BranchIfSmiLessThanOrEqual(SmiConstant(0), x, &if_xispositive,
+        BranchIfSmiLessThanOrEqual(SmiConstant(0), CAST(x), &if_xispositive,
                                   &if_xisnotpositive);
        BIND(&if_xispositive);
@@ -404,8 +404,8 @@ TF_BUILTIN(MathRandom, CodeStubAssembler) {
  Node* native_context = LoadNativeContext(context);
  // Load cache index.
-  VARIABLE(smi_index, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, smi_index);
-  smi_index.Bind(
+  smi_index = CAST(
      LoadContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX));
  // Cached random numbers are exhausted if index is 0. Go to slow path.
@@ -413,12 +413,12 @@ TF_BUILTIN(MathRandom, CodeStubAssembler) {
  GotoIf(SmiAbove(smi_index.value(), SmiConstant(0)), &if_cached);
  // Cache exhausted, populate the cache. Return value is the new index.
-  smi_index.Bind(CallRuntime(Runtime::kGenerateRandomNumbers, context));
+  smi_index = CAST(CallRuntime(Runtime::kGenerateRandomNumbers, context));
  Goto(&if_cached);
  // Compute next index by decrement.
  BIND(&if_cached);
-  Node* new_smi_index = SmiSub(smi_index.value(), SmiConstant(1));
+  TNode<Smi> new_smi_index = SmiSub(smi_index.value(), SmiConstant(1));
  StoreContextElement(native_context, Context::MATH_RANDOM_INDEX_INDEX,
                      new_smi_index);

--- a/src/builtins/builtins-number-gen.cc
+++ b/src/builtins/builtins-number-gen.cc
@@ -830,7 +830,7 @@ TF_BUILTIN(Negate, NumberBuiltinsAssembler) {
                      &do_bigint);
  BIND(&do_smi);
-  { Return(SmiMul(var_input.value(), SmiConstant(-1))); }
+  { Return(SmiMul(CAST(var_input.value()), SmiConstant(-1))); }
  BIND(&do_double);
  {
@@ -858,7 +858,7 @@ TF_BUILTIN(Multiply, NumberBuiltinsAssembler) {
  BIND(&do_smi_mul);
  // The result is not necessarily a smi, in case of overflow.
-  Return(SmiMul(var_left.value(), var_right.value()));
+  Return(SmiMul(CAST(var_left.value()), CAST(var_right.value())));
  BIND(&do_double_mul);
  Node* value = Float64Mul(var_left_double.value(), var_right_double.value());
@@ -886,8 +886,8 @@ TF_BUILTIN(Divide, NumberBuiltinsAssembler) {
  {
    // TODO(jkummerow): Consider just always doing a double division.
    Label bailout(this);
-    Node* dividend = var_left.value();
+    TNode<Smi> dividend = CAST(var_left.value());
-    Node* divisor = var_right.value();
+    TNode<Smi> divisor = CAST(var_right.value());
    // Do floating point division if {divisor} is zero.
    GotoIf(SmiEqual(divisor, SmiConstant(0)), &bailout);
@@ -967,7 +967,7 @@ TF_BUILTIN(Modulus, NumberBuiltinsAssembler) {
                       &var_left_double, &var_right_double, &do_bigint_mod);
  BIND(&do_smi_mod);
-  Return(SmiMod(var_left.value(), var_right.value()));
+  Return(SmiMod(CAST(var_left.value()), CAST(var_right.value())));
  BIND(&do_double_mod);
  Node* value = Float64Mod(var_left_double.value(), var_right_double.value());

--- a/src/builtins/builtins-promise-gen.cc
+++ b/src/builtins/builtins-promise-gen.cc
@@ -221,8 +221,7 @@ Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementContext(
 }
 Node* PromiseBuiltinsAssembler::CreatePromiseAllResolveElementFunction(
-    Node* context, Node* index, Node* native_context) {
+    Node* context, TNode<Smi> index, Node* native_context) {
-  CSA_ASSERT(this, TaggedIsSmi(index));
  CSA_ASSERT(this, SmiGreaterThan(index, SmiConstant(0)));
  CSA_ASSERT(this, SmiLessThanOrEqual(
                       index, SmiConstant(PropertyArray::HashField::kMax)));
@@ -266,8 +265,9 @@ Node* PromiseBuiltinsAssembler::PromiseHasHandler(Node* promise) {
 }
 void PromiseBuiltinsAssembler::PromiseSetHasHandler(Node* promise) {
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> const flags =
-  Node* const new_flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
+  TNode<Smi> const new_flags =
      SmiOr(flags, SmiConstant(1 << JSPromise::kHasHandlerBit));
  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
 }
@@ -279,7 +279,8 @@ Node* PromiseBuiltinsAssembler::IsPromiseStatus(
 Node* PromiseBuiltinsAssembler::PromiseStatus(Node* promise) {
  STATIC_ASSERT(JSPromise::kStatusShift == 0);
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
  return Word32And(SmiToInt32(flags), Int32Constant(JSPromise::kStatusMask));
 }
@@ -289,15 +290,17 @@ void PromiseBuiltinsAssembler::PromiseSetStatus(
             IsPromiseStatus(PromiseStatus(promise), v8::Promise::kPending));
  CHECK_NE(status, v8::Promise::kPending);
-  Node* mask = SmiConstant(status);
+  TNode<Smi> mask = SmiConstant(status);
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> const flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset,
                                 SmiOr(flags, mask));
 }
 void PromiseBuiltinsAssembler::PromiseSetHandledHint(Node* promise) {
-  Node* const flags = LoadObjectField(promise, JSPromise::kFlagsOffset);
+  TNode<Smi> const flags =
-  Node* const new_flags =
+      CAST(LoadObjectField(promise, JSPromise::kFlagsOffset));
+  TNode<Smi> const new_flags =
      SmiOr(flags, SmiConstant(1 << JSPromise::kHandledHintBit));
  StoreObjectFieldNoWriteBarrier(promise, JSPromise::kFlagsOffset, new_flags);
 }
@@ -1801,7 +1804,7 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
  Node* const resolve_element_context =
      CreatePromiseAllResolveElementContext(capability, native_context);
-  VARIABLE(var_index, MachineRepresentation::kTagged, SmiConstant(1));
+  TVARIABLE(Smi, var_index, SmiConstant(1));
  Label loop(this, &var_index), done_loop(this),
      too_many_elements(this, Label::kDeferred),
      close_iterator(this, Label::kDeferred);
@@ -1831,14 +1834,14 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
                      var_exception);
    // Check if we reached the limit.
-    Node* const index = var_index.value();
+    TNode<Smi> const index = var_index.value();
    GotoIf(SmiEqual(index, SmiConstant(PropertyArray::HashField::kMax)),
           &too_many_elements);
    // Set remainingElementsCount.[[Value]] to
    //     remainingElementsCount.[[Value]] + 1.
-    Node* const remaining_elements_count = LoadContextElement(
+    TNode<Smi> const remaining_elements_count = CAST(LoadContextElement(
-        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot));
    StoreContextElementNoWriteBarrier(
        resolve_element_context, kPromiseAllResolveElementRemainingSlot,
        SmiAdd(remaining_elements_count, SmiConstant(1)));
@@ -1877,7 +1880,7 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
    });
    // Set index to index + 1.
-    var_index.Bind(SmiAdd(index, SmiConstant(1)));
+    var_index = SmiAdd(index, SmiConstant(1));
    Goto(&loop);
  }
@@ -1911,8 +1914,8 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
    // Set iteratorRecord.[[Done]] to true.
    // Set remainingElementsCount.[[Value]] to
    //    remainingElementsCount.[[Value]] - 1.
-    Node* remaining_elements_count = LoadContextElement(
+    TNode<Smi> remaining_elements_count = CAST(LoadContextElement(
-        resolve_element_context, kPromiseAllResolveElementRemainingSlot);
+        resolve_element_context, kPromiseAllResolveElementRemainingSlot));
    remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
    StoreContextElementNoWriteBarrier(resolve_element_context,
                                      kPromiseAllResolveElementRemainingSlot,
@@ -1927,8 +1930,8 @@ Node* PromiseBuiltinsAssembler::PerformPromiseAll(
    Node* const values_array = LoadContextElement(
        resolve_element_context, kPromiseAllResolveElementValuesArraySlot);
    Node* const old_elements = LoadElements(values_array);
-    Node* const old_capacity = LoadFixedArrayBaseLength(old_elements);
+    TNode<Smi> const old_capacity = LoadFixedArrayBaseLength(old_elements);
-    Node* const new_capacity = var_index.value();
+    TNode<Smi> const new_capacity = var_index.value();
    GotoIf(SmiGreaterThanOrEqual(old_capacity, new_capacity), &return_promise);
    Node* const new_elements =
        AllocateFixedArray(PACKED_ELEMENTS, new_capacity, SMI_PARAMETERS,
@@ -2105,8 +2108,8 @@ TF_BUILTIN(PromiseAllResolveElementClosure, PromiseBuiltinsAssembler) {
  }
  BIND(&done);
-  Node* remaining_elements_count =
+  TNode<Smi> remaining_elements_count =
-      LoadContextElement(context, kPromiseAllResolveElementRemainingSlot);
+      CAST(LoadContextElement(context, kPromiseAllResolveElementRemainingSlot));
  remaining_elements_count = SmiSub(remaining_elements_count, SmiConstant(1));
  StoreContextElement(context, kPromiseAllResolveElementRemainingSlot,
                      remaining_elements_count);

--- a/src/builtins/builtins-promise-gen.h
+++ b/src/builtins/builtins-promise-gen.h
@@ -113,7 +113,7 @@ class PromiseBuiltinsAssembler : public CodeStubAssembler {
  // case to mark it's done).
  Node* CreatePromiseAllResolveElementContext(Node* promise_capability,
                                              Node* native_context);
-  Node* CreatePromiseAllResolveElementFunction(Node* context, Node* index,
+  Node* CreatePromiseAllResolveElementFunction(Node* context, TNode<Smi> index,
                                               Node* native_context);
  Node* CreatePromiseResolvingFunctionsContext(Node* promise, Node* debug_event,

--- a/src/builtins/builtins-proxy-gen.cc
+++ b/src/builtins/builtins-proxy-gen.cc
@@ -544,7 +544,7 @@ TF_BUILTIN(ProxySetProperty, ProxiesCodeStubAssembler) {
  Node* name = Parameter(Descriptor::kName);
  Node* value = Parameter(Descriptor::kValue);
  Node* receiver = Parameter(Descriptor::kReceiverValue);
-  Node* language_mode = Parameter(Descriptor::kLanguageMode);
+  TNode<Smi> language_mode = CAST(Parameter(Descriptor::kLanguageMode));
  CSA_ASSERT(this, IsJSProxy(proxy));

--- a/src/builtins/builtins-regexp-gen.cc
+++ b/src/builtins/builtins-regexp-gen.cc
--- a/src/builtins/builtins-regexp-gen.h
+++ b/src/builtins/builtins-regexp-gen.h
@@ -125,7 +125,8 @@ class RegExpBuiltinsAssembler : public CodeStubAssembler {
                                     Node* const string);
  void RegExpPrototypeSplitBody(Node* const context, Node* const regexp,
-                                TNode<String> const string, Node* const limit);
+                                TNode<String> const string,
+                                TNode<Smi> const limit);
  Node* ReplaceGlobalCallableFastPath(Node* context, Node* regexp, Node* string,
                                      Node* replace_callable);

--- a/src/builtins/builtins-string-gen.cc
+++ b/src/builtins/builtins-string-gen.cc
@@ -1054,7 +1054,7 @@ void StringIncludesIndexOfAssembler::Generate(SearchVariant variant) {
      arguments.PopAndReturn((variant == kIndexOf)
                                 ? result
                                 : SelectBooleanConstant(SmiGreaterThanOrEqual(
-                                       result, SmiConstant(0))));
+                                       CAST(result), SmiConstant(0))));
    });
  }
  BIND(&call_runtime);
@@ -1156,16 +1156,15 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
  BIND(&out);
 }
-compiler::Node* StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
+TNode<Smi> StringBuiltinsAssembler::IndexOfDollarChar(Node* const context,
-                                                           Node* const string) {
+                                                      Node* const string) {
  CSA_ASSERT(this, IsString(string));
-  Node* const dollar_string = HeapConstant(
+  TNode<String> const dollar_string = HeapConstant(
      isolate()->factory()->LookupSingleCharacterStringFromCode('$'));
-  Node* const dollar_ix = CallBuiltin(Builtins::kStringIndexOf, context, string,
+  TNode<Smi> const dollar_ix =
-                                      dollar_string, SmiConstant(0));
+      CAST(CallBuiltin(Builtins::kStringIndexOf, context, string, dollar_string,
+                       SmiConstant(0)));
-  CSA_ASSERT(this, TaggedIsSmi(dollar_ix));
  return dollar_ix;
 }
@@ -1188,7 +1187,7 @@ compiler::Node* StringBuiltinsAssembler::GetSubstitution(
  // TODO(jgruber): Possibly extend this in the future to handle more complex
  // cases without runtime calls.
-  Node* const dollar_index = IndexOfDollarChar(context, replace_string);
+  TNode<Smi> const dollar_index = IndexOfDollarChar(context, replace_string);
  Branch(SmiIsNegative(dollar_index), &out, &runtime);
  BIND(&runtime);
@@ -1233,16 +1232,17 @@ TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
    Label if_count_isheapnumber(this, Label::kDeferred);
    GotoIfNot(TaggedIsSmi(var_count.value()), &if_count_isheapnumber);
+    {
-    // If count is a SMI, throw a RangeError if less than 0 or greater than
+      // If count is a SMI, throw a RangeError if less than 0 or greater than
-    // the maximum string length.
+      // the maximum string length.
-    GotoIf(SmiLessThan(var_count.value(), SmiConstant(0)), &invalid_count);
+      TNode<Smi> smi_count = CAST(var_count.value());
-    GotoIf(SmiEqual(var_count.value(), SmiConstant(0)), &return_emptystring);
+      GotoIf(SmiLessThan(smi_count, SmiConstant(0)), &invalid_count);
-    GotoIf(is_stringempty, &return_emptystring);
+      GotoIf(SmiEqual(smi_count, SmiConstant(0)), &return_emptystring);
-    GotoIf(SmiGreaterThan(var_count.value(), SmiConstant(String::kMaxLength)),
+      GotoIf(is_stringempty, &return_emptystring);
-           &invalid_string_length);
+      GotoIf(SmiGreaterThan(smi_count, SmiConstant(String::kMaxLength)),
-    Return(CallBuiltin(Builtins::kStringRepeat, context, string,
+             &invalid_string_length);
-                       var_count.value()));
+      Return(CallBuiltin(Builtins::kStringRepeat, context, string, smi_count));
+    }
    // If count is a Heap Number...
    // 1) If count is Infinity, throw a RangeError exception
@@ -1280,7 +1280,7 @@ TF_BUILTIN(StringPrototypeRepeat, StringBuiltinsAssembler) {
 TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
  Node* const context = Parameter(Descriptor::kContext);
  Node* const string = Parameter(Descriptor::kString);
-  Node* const count = Parameter(Descriptor::kCount);
+  TNode<Smi> const count = CAST(Parameter(Descriptor::kCount));
  CSA_ASSERT(this, IsString(string));
  CSA_ASSERT(this, Word32BinaryNot(IsEmptyString(string)));
@@ -1299,7 +1299,7 @@ TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
  //   }
  VARIABLE(var_result, MachineRepresentation::kTagged, EmptyStringConstant());
  VARIABLE(var_temp, MachineRepresentation::kTagged, string);
-  VARIABLE(var_count, MachineRepresentation::kTagged, count);
+  TVARIABLE(Smi, var_count, count);
  Callable stringadd_callable =
      CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
@@ -1317,7 +1317,7 @@ TF_BUILTIN(StringRepeat, StringBuiltinsAssembler) {
      BIND(&next);
    }
-    var_count.Bind(SmiShr(var_count.value(), 1));
+    var_count = SmiShr(var_count.value(), 1);
    GotoIf(SmiEqual(var_count.value(), SmiConstant(0)), &return_result);
    var_temp.Bind(CallStub(stringadd_callable, context, var_temp.value(),
                           var_temp.value()));
@@ -1337,7 +1337,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
  Node* const replace = Parameter(Descriptor::kReplace);
  Node* const context = Parameter(Descriptor::kContext);
-  Node* const smi_zero = SmiConstant(0);
+  TNode<Smi> const smi_zero = SmiConstant(0);
  RequireObjectCoercible(context, receiver, "String.prototype.replace");
@@ -1392,10 +1392,9 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
  // longer substrings - we can handle up to 8 chars (one-byte) / 4 chars
  // (2-byte).
-  Node* const match_start_index =
+  TNode<Smi> const match_start_index =
-      CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
+      CAST(CallBuiltin(Builtins::kStringIndexOf, context, subject_string,
-                  search_string, smi_zero);
+                       search_string, smi_zero));
-  CSA_ASSERT(this, TaggedIsSmi(match_start_index));
  // Early exit if no match found.
  {
@@ -1421,7 +1420,7 @@ TF_BUILTIN(StringPrototypeReplace, StringBuiltinsAssembler) {
    BIND(&next);
  }
-  Node* const match_end_index = SmiAdd(match_start_index, search_length);
+  TNode<Smi> const match_end_index = SmiAdd(match_start_index, search_length);
  Callable stringadd_callable =
      CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
@@ -1638,18 +1637,20 @@ class StringPadAssembler : public StringBuiltinsAssembler {
    // If no max_length was provided, return the string.
    GotoIf(IntPtrEqual(argc, IntPtrConstant(0)), &dont_pad);
-    Node* const max_length = ToLength_Inline(context, arguments.AtIndex(0));
+    TNode<Number> const max_length =
+        ToLength_Inline(context, arguments.AtIndex(0));
    CSA_ASSERT(this, IsNumberNormalized(max_length));
    // Throw if max_length is not a smi or greater than the max string length.
-    GotoIfNot(Word32And(TaggedIsSmi(max_length),
+    GotoIfNot(TaggedIsSmi(max_length), &invalid_string_length);
-                        SmiLessThanOrEqual(max_length,
+    TNode<Smi> smi_max_length = CAST(max_length);
-                                           SmiConstant(String::kMaxLength))),
+    GotoIfNot(
-              &invalid_string_length);
+        SmiLessThanOrEqual(smi_max_length, SmiConstant(String::kMaxLength)),
+        &invalid_string_length);
    // If the max_length is less than length of the string, return the string.
-    CSA_ASSERT(this, TaggedIsPositiveSmi(max_length));
+    CSA_ASSERT(this, TaggedIsPositiveSmi(smi_max_length));
-    GotoIf(SmiLessThanOrEqual(max_length, string_length), &dont_pad);
+    GotoIf(SmiLessThanOrEqual(smi_max_length, string_length), &dont_pad);
    Branch(IntPtrEqual(argc, IntPtrConstant(1)), &pad, &argc_2);
    BIND(&argc_2);
@@ -1667,11 +1668,11 @@ class StringPadAssembler : public StringBuiltinsAssembler {
    {
      CSA_ASSERT(this,
                 IntPtrGreaterThan(var_fill_length.value(), IntPtrConstant(0)));
-      CSA_ASSERT(this, SmiGreaterThan(max_length, string_length));
+      CSA_ASSERT(this, SmiGreaterThan(smi_max_length, string_length));
      Callable stringadd_callable =
          CodeFactory::StringAdd(isolate(), STRING_ADD_CHECK_NONE, NOT_TENURED);
-      TNode<Smi> const pad_length = SmiSub(max_length, string_length);
+      TNode<Smi> const pad_length = SmiSub(smi_max_length, string_length);
      VARIABLE(var_pad, MachineRepresentation::kTagged);
@@ -1841,7 +1842,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
  // Shortcut for {limit} == 0.
  {
    Label next(this);
-    GotoIfNot(SmiEqual(limit_number, smi_zero), &next);
+    GotoIfNot(WordEqual(limit_number, smi_zero), &next);
    const ElementsKind kind = PACKED_ELEMENTS;
    Node* const native_context = LoadNativeContext(context);
@@ -2069,24 +2070,24 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
  Label out(this);
-  VARIABLE(var_start, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, var_start);
-  VARIABLE(var_end, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, var_end);
  // Check that {receiver} is coercible to Object and convert it to a String.
  TNode<String> const string =
      ToThisString(context, receiver, "String.prototype.substring");
-  Node* const length = LoadStringLengthAsSmi(string);
+  TNode<Smi> const length = LoadStringLengthAsSmi(string);
  // Conversion and bounds-checks for {start}.
-  var_start.Bind(ToSmiBetweenZeroAnd(context, start, length));
+  var_start = ToSmiBetweenZeroAnd(context, start, length);
  // Conversion and bounds-checks for {end}.
  {
-    var_end.Bind(length);
+    var_end = length;
    GotoIf(IsUndefined(end), &out);
-    var_end.Bind(ToSmiBetweenZeroAnd(context, end, length));
+    var_end = ToSmiBetweenZeroAnd(context, end, length);
    Label if_endislessthanstart(this);
    Branch(SmiLessThan(var_end.value(), var_start.value()),
@@ -2094,9 +2095,9 @@ TF_BUILTIN(StringPrototypeSubstring, StringBuiltinsAssembler) {
    BIND(&if_endislessthanstart);
    {
-      Node* const tmp = var_end.value();
+      TNode<Smi> const tmp = var_end.value();
-      var_end.Bind(var_start.value());
+      var_end = var_start.value();
-      var_start.Bind(tmp);
+      var_start = tmp;
      Goto(&out);
    }
  }

--- a/src/builtins/builtins-string-gen.h
+++ b/src/builtins/builtins-string-gen.h
@@ -74,12 +74,12 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
  void StringIndexOf(Node* const subject_string, Node* const search_string,
                     Node* const position, std::function<void(Node*)> f_return);
-  Node* IndexOfDollarChar(Node* const context, Node* const string);
+  TNode<Smi> IndexOfDollarChar(Node* const context, Node* const string);
  void RequireObjectCoercible(Node* const context, Node* const value,
                              const char* method_name);
-  Node* SmiIsNegative(Node* const value) {
+  TNode<BoolT> SmiIsNegative(TNode<Smi> value) {
    return SmiLessThan(value, SmiConstant(0));
  }

--- a/src/builtins/builtins-typed-array-gen.cc
+++ b/src/builtins/builtins-typed-array-gen.cc
@@ -205,8 +205,10 @@ TF_BUILTIN(TypedArrayInitialize, TypedArrayBuiltinsAssembler) {
    StoreObjectField(holder, JSArrayBufferView::kBufferOffset, buffer);
    // Check the alignment.
-    GotoIf(SmiEqual(SmiMod(element_size, SmiConstant(kObjectAlignment)),
+    // TODO(ishell): remove <Object, Object>
-                    SmiConstant(0)),
+    GotoIf(WordEqual<Object, Object>(
+               SmiMod(element_size, SmiConstant(kObjectAlignment)),
+               SmiConstant(0)),
           &aligned);
    // Fix alignment if needed.
@@ -367,10 +369,12 @@ void TypedArrayBuiltinsAssembler::ConstructByArrayBuffer(
  // Check that the offset is a multiple of the element size.
  BIND(&offset_is_smi);
  {
-    GotoIf(SmiEqual(offset.value(), SmiConstant(0)), &check_length);
+    TNode<Smi> smi_offset = CAST(offset.value());
-    GotoIf(SmiLessThan(offset.value(), SmiConstant(0)), &invalid_length);
+    GotoIf(SmiEqual(smi_offset, SmiConstant(0)), &check_length);
-    Node* remainder = SmiMod(offset.value(), element_size);
+    GotoIf(SmiLessThan(smi_offset, SmiConstant(0)), &invalid_length);
-    Branch(SmiEqual(remainder, SmiConstant(0)), &check_length,
+    TNode<Number> remainder = SmiMod(smi_offset, element_size);
+    // TODO(ishell): remove <Object, Object>
+    Branch(WordEqual<Object, Object>(remainder, SmiConstant(0)), &check_length,
           &start_offset_error);
  }
  BIND(&offset_not_smi);

--- a/src/code-stub-assembler.cc
+++ b/src/code-stub-assembler.cc
--- a/src/code-stub-assembler.h
+++ b/src/code-stub-assembler.h
@@ -187,7 +187,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 #define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName) \
  Node* OpName(Node* a, Node* b, ParameterMode mode) {   \
    if (mode == SMI_PARAMETERS) {                        \
-      return SmiOpName(a, b);                            \
+      return SmiOpName(CAST(a), CAST(b));                \
    } else {                                             \
      DCHECK_EQ(INTPTR_PARAMETERS, mode);                \
      return IntPtrOpName(a, b);                         \
@@ -275,7 +275,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  // Smi operations.
 #define SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName)                  \
-  TNode<Smi> SmiOpName(SloppyTNode<Smi> a, SloppyTNode<Smi> b) {       \
+  TNode<Smi> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                   \
    return BitcastWordToTaggedSigned(                                  \
        IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b))); \
  }
@@ -288,11 +288,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  TNode<Smi> TrySmiAdd(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
  TNode<Smi> TrySmiSub(TNode<Smi> a, TNode<Smi> b, Label* if_overflow);
-  TNode<Smi> SmiShl(SloppyTNode<Smi> a, int shift) {
+  TNode<Smi> SmiShl(TNode<Smi> a, int shift) {
    return BitcastWordToTaggedSigned(WordShl(BitcastTaggedToWord(a), shift));
  }
-  TNode<Smi> SmiShr(SloppyTNode<Smi> a, int shift) {
+  TNode<Smi> SmiShr(TNode<Smi> a, int shift) {
    return BitcastWordToTaggedSigned(
        WordAnd(WordShr(BitcastTaggedToWord(a), shift),
                BitcastTaggedToWord(SmiConstant(-1))));
@@ -300,7 +300,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  Node* WordOrSmiShl(Node* a, int shift, ParameterMode mode) {
    if (mode == SMI_PARAMETERS) {
-      return SmiShl(a, shift);
+      return SmiShl(CAST(a), shift);
    } else {
      DCHECK_EQ(INTPTR_PARAMETERS, mode);
      return WordShl(a, shift);
@@ -309,7 +309,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  Node* WordOrSmiShr(Node* a, int shift, ParameterMode mode) {
    if (mode == SMI_PARAMETERS) {
-      return SmiShr(a, shift);
+      return SmiShr(CAST(a), shift);
    } else {
      DCHECK_EQ(INTPTR_PARAMETERS, mode);
      return WordShr(a, shift);
@@ -317,7 +317,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  }
 #define SMI_COMPARISON_OP(SmiOpName, IntPtrOpName)                       \
-  TNode<BoolT> SmiOpName(Node* a, Node* b) {                             \
+  TNode<BoolT> SmiOpName(TNode<Smi> a, TNode<Smi> b) {                   \
    return IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b)); \
  }
  SMI_COMPARISON_OP(SmiEqual, WordEqual)
@@ -330,15 +330,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  SMI_COMPARISON_OP(SmiGreaterThan, IntPtrGreaterThan)
  SMI_COMPARISON_OP(SmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual)
 #undef SMI_COMPARISON_OP
-  TNode<Smi> SmiMax(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Smi> SmiMax(TNode<Smi> a, TNode<Smi> b);
-  TNode<Smi> SmiMin(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Smi> SmiMin(TNode<Smi> a, TNode<Smi> b);
  // Computes a % b for Smi inputs a and b; result is not necessarily a Smi.
-  TNode<Number> SmiMod(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Number> SmiMod(TNode<Smi> a, TNode<Smi> b);
  // Computes a * b for Smi inputs a and b; result is not necessarily a Smi.
-  TNode<Number> SmiMul(SloppyTNode<Smi> a, SloppyTNode<Smi> b);
+  TNode<Number> SmiMul(TNode<Smi> a, TNode<Smi> b);
-  // Tries to computes dividend / divisor for Smi inputs; branching to bailout
+  // Tries to compute dividend / divisor for Smi inputs; branching to bailout
  // if the division needs to be performed as a floating point operation.
-  Node* TrySmiDiv(Node* dividend, Node* divisor, Label* bailout);
+  TNode<Smi> TrySmiDiv(TNode<Smi> dividend, TNode<Smi> divisor, Label* bailout);
  // Smi | HeapNumber operations.
  TNode<Number> NumberInc(SloppyTNode<Number> value);
@@ -349,7 +349,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  void GotoIfNumber(Node* value, Label* is_number);
  TNode<Number> SmiToNumber(TNode<Smi> v) { return v; }
-  Node* BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
+  TNode<Number> BitwiseOp(Node* left32, Node* right32, Operation bitwise_op);
  // Allocate an object of the given size.
  Node* AllocateInNewSpace(Node* size, AllocationFlags flags = kNone);
@@ -471,15 +471,17 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  void Bind(Label* label);
 #endif  // DEBUG
-  void BranchIfSmiEqual(Node* a, Node* b, Label* if_true, Label* if_false) {
+  void BranchIfSmiEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
+                        Label* if_false) {
    Branch(SmiEqual(a, b), if_true, if_false);
  }
-  void BranchIfSmiLessThan(Node* a, Node* b, Label* if_true, Label* if_false) {
+  void BranchIfSmiLessThan(TNode<Smi> a, TNode<Smi> b, Label* if_true,
+                           Label* if_false) {
    Branch(SmiLessThan(a, b), if_true, if_false);
  }
-  void BranchIfSmiLessThanOrEqual(Node* a, Node* b, Label* if_true,
+  void BranchIfSmiLessThanOrEqual(TNode<Smi> a, TNode<Smi> b, Label* if_true,
                                  Label* if_false) {
    Branch(SmiLessThanOrEqual(a, b), if_true, if_false);
  }
@@ -2465,7 +2467,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
  TNode<Uint32T> GetSortedKeyIndex(TNode<Array> descriptors,
                                   TNode<Uint32T> entry_index);
-  Node* CollectFeedbackForString(Node* instance_type);
+  TNode<Smi> CollectFeedbackForString(SloppyTNode<Int32T> instance_type);
  void GenerateEqual_Same(Node* value, Label* if_equal, Label* if_notequal,
                          Variable* var_type_feedback = nullptr);
  TNode<String> AllocAndCopyStringCharacters(Node* from,

--- a/src/code-stubs.cc
+++ b/src/code-stubs.cc
@@ -527,7 +527,7 @@ void ArrayConstructorAssembler::GenerateConstructor(
  if (IsFastPackedElementsKind(elements_kind)) {
    Label abort(this, Label::kDeferred);
-    Branch(SmiEqual(array_size, SmiConstant(0)), &small_smi_size, &abort);
+    Branch(SmiEqual(CAST(array_size), SmiConstant(0)), &small_smi_size, &abort);
    BIND(&abort);
    Node* reason = SmiConstant(AbortReason::kAllocatingNonEmptyPackedArray);
@@ -539,7 +539,7 @@ void ArrayConstructorAssembler::GenerateConstructor(
        (kMaxRegularHeapObjectSize - FixedArray::kHeaderSize - JSArray::kSize -
         AllocationMemento::kSize) /
        element_size;
-    Branch(SmiAboveOrEqual(array_size, SmiConstant(max_fast_elements)),
+    Branch(SmiAboveOrEqual(CAST(array_size), SmiConstant(max_fast_elements)),
           &call_runtime, &small_smi_size);
  }

--- a/src/ic/accessor-assembler.cc
+++ b/src/ic/accessor-assembler.cc
@@ -123,7 +123,7 @@ void AccessorAssembler::HandlePolymorphicCase(
    if (i >= min_feedback_capacity) {
      if (length == nullptr) length = LoadWeakFixedArrayLength(feedback);
-      GotoIf(SmiGreaterThanOrEqual(SmiConstant(handler_index), length),
+      GotoIf(SmiGreaterThanOrEqual(SmiConstant(handler_index), CAST(length)),
             if_miss);
    }

--- a/src/ic/binary-op-assembler.cc
+++ b/src/ic/binary-op-assembler.cc
@@ -443,7 +443,7 @@ Node* BinaryOpAssembler::Generate_MultiplyWithFeedback(Node* context, Node* lhs,
                                                       Node* feedback_vector,
                                                       bool rhs_is_smi) {
  auto smiFunction = [=](Node* lhs, Node* rhs, Variable* var_type_feedback) {
-    Node* result = SmiMul(lhs, rhs);
+    TNode<Number> result = SmiMul(CAST(lhs), CAST(rhs));
    var_type_feedback->Bind(SelectSmiConstant(
        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
        BinaryOperationFeedback::kNumber));
@@ -467,7 +467,7 @@ Node* BinaryOpAssembler::Generate_DivideWithFeedback(
    // Smi and Number operations, so this path should not be marked as Deferred.
    Label bailout(this, rhs_is_smi ? Label::kDeferred : Label::kNonDeferred),
        end(this);
-    var_result.Bind(TrySmiDiv(lhs, rhs, &bailout));
+    var_result.Bind(TrySmiDiv(CAST(lhs), CAST(rhs), &bailout));
    var_type_feedback->Bind(SmiConstant(BinaryOperationFeedback::kSignedSmall));
    Goto(&end);
@@ -495,7 +495,7 @@ Node* BinaryOpAssembler::Generate_ModulusWithFeedback(
    Node* context, Node* dividend, Node* divisor, Node* slot_id,
    Node* feedback_vector, bool rhs_is_smi) {
  auto smiFunction = [=](Node* lhs, Node* rhs, Variable* var_type_feedback) {
-    Node* result = SmiMod(lhs, rhs);
+    TNode<Number> result = SmiMod(CAST(lhs), CAST(rhs));
    var_type_feedback->Bind(SelectSmiConstant(
        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
        BinaryOperationFeedback::kNumber));

--- a/src/interpreter/interpreter-generator.cc
+++ b/src/interpreter/interpreter-generator.cc
@@ -902,8 +902,8 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
    Node* slot_index = BytecodeOperandIdx(1);
    Node* feedback_vector = LoadFeedbackVector();
-    VARIABLE(var_left_feedback, MachineRepresentation::kTaggedSigned);
+    TVARIABLE(Smi, var_left_feedback);
-    VARIABLE(var_right_feedback, MachineRepresentation::kTaggedSigned);
+    TVARIABLE(Smi, var_right_feedback);
    VARIABLE(var_left_word32, MachineRepresentation::kWord32);
    VARIABLE(var_right_word32, MachineRepresentation::kWord32);
    VARIABLE(var_left_bigint, MachineRepresentation::kTagged, left);
@@ -919,12 +919,12 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
                                       &var_right_word32, &do_bigint_op,
                                       &var_right_bigint, &var_right_feedback);
    BIND(&do_number_op);
-    Node* result = BitwiseOp(var_left_word32.value(), var_right_word32.value(),
+    TNode<Number> result = BitwiseOp(var_left_word32.value(),
-                             bitwise_op);
+                                     var_right_word32.value(), bitwise_op);
-    Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
+    TNode<Smi> result_type = SelectSmiConstant(
-                                          BinaryOperationFeedback::kSignedSmall,
+        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
-                                          BinaryOperationFeedback::kNumber);
+        BinaryOperationFeedback::kNumber);
-    Node* input_feedback =
+    TNode<Smi> input_feedback =
        SmiOr(var_left_feedback.value(), var_right_feedback.value());
    UpdateFeedback(SmiOr(result_type, input_feedback), feedback_vector,
                   slot_index);
@@ -952,7 +952,7 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
    Node* feedback_vector = LoadFeedbackVector();
    Node* context = GetContext();
-    VARIABLE(var_left_feedback, MachineRepresentation::kTaggedSigned);
+    TVARIABLE(Smi, var_left_feedback);
    VARIABLE(var_left_word32, MachineRepresentation::kWord32);
    VARIABLE(var_left_bigint, MachineRepresentation::kTagged);
    Label do_smi_op(this), if_bigint_mix(this);
@@ -961,11 +961,11 @@ class InterpreterBitwiseBinaryOpAssembler : public InterpreterAssembler {
                                       &var_left_word32, &if_bigint_mix,
                                       &var_left_bigint, &var_left_feedback);
    BIND(&do_smi_op);
-    Node* result =
+    TNode<Number> result =
        BitwiseOp(var_left_word32.value(), SmiToInt32(right), bitwise_op);
-    Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
+    TNode<Smi> result_type = SelectSmiConstant(
-                                          BinaryOperationFeedback::kSignedSmall,
+        TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
-                                          BinaryOperationFeedback::kNumber);
+        BinaryOperationFeedback::kNumber);
    UpdateFeedback(SmiOr(result_type, var_left_feedback.value()),
                   feedback_vector, slot_index);
    SetAccumulator(result);
@@ -1059,7 +1059,7 @@ IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
  Node* context = GetContext();
  VARIABLE(var_word32, MachineRepresentation::kWord32);
-  VARIABLE(var_feedback, MachineRepresentation::kTaggedSigned);
+  TVARIABLE(Smi, var_feedback);
  VARIABLE(var_bigint, MachineRepresentation::kTagged);
  Label if_number(this), if_bigint(this);
  TaggedToWord32OrBigIntWithFeedback(context, operand, &if_number, &var_word32,
@@ -1067,10 +1067,11 @@ IGNITION_HANDLER(BitwiseNot, InterpreterAssembler) {
  // Number case.
  BIND(&if_number);
-  Node* result = ChangeInt32ToTagged(Signed(Word32Not(var_word32.value())));
+  TNode<Number> result =
-  Node* result_type = SelectSmiConstant(TaggedIsSmi(result),
+      ChangeInt32ToTagged(Signed(Word32Not(var_word32.value())));
-                                        BinaryOperationFeedback::kSignedSmall,
+  TNode<Smi> result_type = SelectSmiConstant(
-                                        BinaryOperationFeedback::kNumber);
+      TaggedIsSmi(result), BinaryOperationFeedback::kSignedSmall,
+      BinaryOperationFeedback::kNumber);
  UpdateFeedback(SmiOr(result_type, var_feedback.value()), feedback_vector,
                 slot_index);
  SetAccumulator(result);
@@ -1122,8 +1123,8 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
  virtual ~UnaryNumericOpAssembler() {}
  // Must return a tagged value.
-  virtual Node* SmiOp(Node* smi_value, Variable* var_feedback,
+  virtual TNode<Number> SmiOp(TNode<Smi> smi_value, Variable* var_feedback,
-                      Label* do_float_op, Variable* var_float) = 0;
+                              Label* do_float_op, Variable* var_float) = 0;
  // Must return a Float64 value.
  virtual Node* FloatOp(Node* float_value) = 0;
  // Must return a tagged value.
@@ -1136,8 +1137,7 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
    VARIABLE(var_result, MachineRepresentation::kTagged);
    VARIABLE(var_float_value, MachineRepresentation::kFloat64);
-    VARIABLE(var_feedback, MachineRepresentation::kTaggedSigned,
+    TVARIABLE(Smi, var_feedback, SmiConstant(BinaryOperationFeedback::kNone));
-             SmiConstant(BinaryOperationFeedback::kNone));
    Variable* loop_vars[] = {&var_value, &var_feedback};
    Label start(this, arraysize(loop_vars), loop_vars), end(this);
    Label do_float_op(this, &var_float_value);
@@ -1159,7 +1159,7 @@ class UnaryNumericOpAssembler : public InterpreterAssembler {
      BIND(&if_smi);
      {
        var_result.Bind(
-            SmiOp(value, &var_feedback, &do_float_op, &var_float_value));
+            SmiOp(CAST(value), &var_feedback, &do_float_op, &var_float_value));
        Goto(&end);
      }
@@ -1224,9 +1224,9 @@ class NegateAssemblerImpl : public UnaryNumericOpAssembler {
                               OperandScale operand_scale)
      : UnaryNumericOpAssembler(state, bytecode, operand_scale) {}
-  Node* SmiOp(Node* smi_value, Variable* var_feedback, Label* do_float_op,
+  TNode<Number> SmiOp(TNode<Smi> smi_value, Variable* var_feedback,
-              Variable* var_float) override {
+                      Label* do_float_op, Variable* var_float) override {
-    VARIABLE(var_result, MachineRepresentation::kTagged);
+    TVARIABLE(Number, var_result);
    Label if_zero(this), if_min_smi(this), end(this);
    // Return -0 if operand is 0.
    GotoIf(SmiEqual(smi_value, SmiConstant(0)), &if_zero);
@@ -1236,12 +1236,12 @@ class NegateAssemblerImpl : public UnaryNumericOpAssembler {
    // Else simply subtract operand from 0.
    CombineFeedback(var_feedback, BinaryOperationFeedback::kSignedSmall);
-    var_result.Bind(SmiSub(SmiConstant(0), smi_value));
+    var_result = SmiSub(SmiConstant(0), smi_value);
    Goto(&end);
    BIND(&if_zero);
    CombineFeedback(var_feedback, BinaryOperationFeedback::kNumber);
-    var_result.Bind(MinusZeroConstant());
+    var_result = MinusZeroConstant();
    Goto(&end);
    BIND(&if_min_smi);
@@ -1320,9 +1320,8 @@ class IncDecAssembler : public UnaryNumericOpAssembler {
    return op_;
  }
-  Node* SmiOp(Node* smi_value, Variable* var_feedback, Label* do_float_op,
+  TNode<Number> SmiOp(TNode<Smi> value, Variable* var_feedback,
-              Variable* var_float) override {
+                      Label* do_float_op, Variable* var_float) override {
-    TNode<Smi> value = CAST(smi_value);
    TNode<Smi> one = SmiConstant(1);
    Label if_overflow(this), if_notoverflow(this);
    TNode<Smi> result = op() == Operation::kIncrement
@@ -1332,7 +1331,7 @@ class IncDecAssembler : public UnaryNumericOpAssembler {
    BIND(&if_overflow);
    {
-      var_float->Bind(SmiToFloat64(smi_value));
+      var_float->Bind(SmiToFloat64(value));
      Goto(do_float_op);
    }
@@ -2966,9 +2965,9 @@ IGNITION_HANDLER(ForInContinue, InterpreterAssembler) {
 // Increments the loop counter in register |index| and stores the result
 // in the accumulator.
 IGNITION_HANDLER(ForInStep, InterpreterAssembler) {
-  Node* index = LoadRegisterAtOperandIndex(0);
+  TNode<Smi> index = CAST(LoadRegisterAtOperandIndex(0));
-  Node* one = SmiConstant(1);
+  TNode<Smi> one = SmiConstant(1);
-  Node* result = SmiAdd(index, one);
+  TNode<Smi> result = SmiAdd(index, one);
  SetAccumulator(result);
  Dispatch();
 }

--- a/test/cctest/test-code-stub-assembler.cc
+++ b/test/cctest/test-code-stub-assembler.cc
@@ -1959,13 +1959,14 @@ TEST(ArgumentsForEach) {
  CodeStubArguments arguments(&m, m.IntPtrConstant(3));
-  Variable sum(&m, MachineRepresentation::kTagged);
+  TVariable<Smi> sum(&m);
  CodeAssemblerVariableList list({&sum}, m.zone());
-  sum.Bind(m.SmiConstant(0));
+  sum = m.SmiConstant(0);
-  arguments.ForEach(
+  arguments.ForEach(list, [&m, &sum](Node* arg) {
-      list, [&m, &sum](Node* arg) { sum.Bind(m.SmiAdd(sum.value(), arg)); });
+    sum = m.SmiAdd(sum.value(), m.CAST(arg));
+  });
  arguments.PopAndReturn(sum.value());