[csa] Add C++ compile time type checks to CSA.

Bug: 
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I2e1b36303f8b9ad4a3dc4e488123e6e4ce8b02ec
Reviewed-on: https://chromium-review.googlesource.com/533033
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47149}

src/assembler.cc

@@ -47,6 +47,7 @@
 #include "src/base/platform/platform.h"
 #include "src/base/utils/random-number-generator.h"
 #include "src/codegen.h"
+#include "src/compiler/code-assembler.h"
 #include "src/counters.h"
 #include "src/debug/debug.h"
 #include "src/deoptimizer.h"
@@ -1510,6 +1511,10 @@ ExternalReference ExternalReference::try_internalize_string_function(
       isolate, FUNCTION_ADDR(StringTable::LookupStringIfExists_NoAllocate)));
 }
 
+ExternalReference ExternalReference::check_object_type(Isolate* isolate) {
+  return ExternalReference(Redirect(isolate, FUNCTION_ADDR(CheckObjectType)));
+}
+
 #ifdef V8_INTL_SUPPORT
 ExternalReference ExternalReference::intl_convert_one_byte_to_lower(
     Isolate* isolate) {

src/assembler.h

@@ -986,6 +986,8 @@ class ExternalReference BASE_EMBEDDED {
 
   static ExternalReference try_internalize_string_function(Isolate* isolate);
 
+  static ExternalReference check_object_type(Isolate* isolate);
+
 #ifdef V8_INTL_SUPPORT
   static ExternalReference intl_convert_one_byte_to_lower(Isolate* isolate);
   static ExternalReference intl_to_latin1_lower_table(Isolate* isolate);

src/base/template-utils.h

@@ -55,6 +55,13 @@ std::unique_ptr<T> make_unique(Args&&... args) {
   return std::unique_ptr<T>(new T(std::forward<Args>(args)...));
 }
 
+// implicit_cast<A>(x) triggers an implicit cast from {x} to type {A}. This is
+// useful in situations where static_cast<A>(x) would do too much.
+template <class A>
+A implicit_cast(A x) {
+  return x;
+}
+
 }  // namespace base
 }  // namespace v8
 

src/builtins/builtins-arguments-gen.cc

@@ -145,7 +145,7 @@ Node* ArgumentsBuiltinsAssembler::ConstructParametersObjectFromArgs(
                     [this, elements, &offset](Node* arg) {
                       StoreNoWriteBarrier(MachineRepresentation::kTagged,
                                           elements, offset.value(), arg);
-                      Increment(offset, kPointerSize);
+                      Increment(&offset, kPointerSize);
                     },
                     first_arg, nullptr, param_mode);
   return result;
@@ -332,7 +332,7 @@ Node* ArgumentsBuiltinsAssembler::EmitFastNewSloppyArguments(Node* context,
     mapped_offset = BuildFastLoop(
         var_list1, argument_offset, mapped_offset,
         [this, elements, &current_argument](Node* offset) {
-          Increment(current_argument, kPointerSize);
+          Increment(&current_argument, kPointerSize);
           Node* arg = LoadBufferObject(current_argument.value(), 0);
           StoreNoWriteBarrier(MachineRepresentation::kTagged, elements, offset,
                               arg);
@@ -370,7 +370,7 @@ Node* ArgumentsBuiltinsAssembler::EmitFastNewSloppyArguments(Node* context,
                     StoreNoWriteBarrier(
                         MachineRepresentation::kTagged, adjusted_map_array,
                         offset, ParameterToTagged(context_index.value(), mode));
-                    Increment(context_index, 1, mode);
+                    Increment(&context_index, 1, mode);
                   },
                   -kPointerSize, INTPTR_PARAMETERS);
 

src/builtins/builtins-collections-gen.cc

@@ -699,8 +699,8 @@ TF_BUILTIN(OrderedHashTableHealIndex, CollectionsBuiltinsAssembler) {
     Node* removed_index = LoadFixedArrayElement(
         table, i, OrderedHashTableBase::kRemovedHolesIndex * kPointerSize);
     GotoIf(SmiGreaterThanOrEqual(removed_index, index), &return_index);
-    Decrement(var_index, 1, SMI_PARAMETERS);
-    Increment(var_i);
+    Decrement(&var_index, 1, SMI_PARAMETERS);
+    Increment(&var_i);
     Goto(&loop);
   }
 
@@ -792,7 +792,7 @@ std::tuple<Node*, Node*, Node*> CollectionsBuiltinsAssembler::NextSkipHoles(
     entry_key =
         LoadFixedArrayElement(table, entry_start_position,
                               TableType::kHashTableStartIndex * kPointerSize);
-    Increment(var_index);
+    Increment(&var_index);
     Branch(IsTheHole(entry_key), &loop, &done_loop);
   }
 
@@ -898,7 +898,7 @@ TF_BUILTIN(MapSet, CollectionsBuiltinsAssembler) {
 
     // Otherwise, go to runtime to compute the hash code.
     entry_start_position_or_hash.Bind(
-        SmiUntag(CallRuntime(Runtime::kGenericHash, context, key)));
+        SmiUntag(CAST(CallRuntime(Runtime::kGenericHash, context, key))));
     Goto(&add_entry);
   }
 
@@ -914,9 +914,9 @@ TF_BUILTIN(MapSet, CollectionsBuiltinsAssembler) {
     STATIC_ASSERT(OrderedHashMap::kLoadFactor == 2);
     Node* const capacity = WordShl(number_of_buckets.value(), 1);
     Node* const number_of_elements = SmiUntag(
-        LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset));
-    Node* const number_of_deleted = SmiUntag(
-        LoadObjectField(table, OrderedHashMap::kNumberOfDeletedElementsOffset));
+        CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset)));
+    Node* const number_of_deleted = SmiUntag(CAST(LoadObjectField(
+        table, OrderedHashMap::kNumberOfDeletedElementsOffset)));
     occupancy.Bind(IntPtrAdd(number_of_elements, number_of_deleted));
     GotoIf(IntPtrLessThan(occupancy.value(), capacity), &store_new_entry);
 
@@ -926,10 +926,10 @@ TF_BUILTIN(MapSet, CollectionsBuiltinsAssembler) {
     table_var.Bind(LoadObjectField(receiver, JSMap::kTableOffset));
     number_of_buckets.Bind(SmiUntag(LoadFixedArrayElement(
         table_var.value(), OrderedHashMap::kNumberOfBucketsIndex)));
-    Node* const new_number_of_elements = SmiUntag(LoadObjectField(
-        table_var.value(), OrderedHashMap::kNumberOfElementsOffset));
-    Node* const new_number_of_deleted = SmiUntag(LoadObjectField(
-        table_var.value(), OrderedHashMap::kNumberOfDeletedElementsOffset));
+    Node* const new_number_of_elements = SmiUntag(CAST(LoadObjectField(
+        table_var.value(), OrderedHashMap::kNumberOfElementsOffset)));
+    Node* const new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
+        table_var.value(), OrderedHashMap::kNumberOfDeletedElementsOffset)));
     occupancy.Bind(IntPtrAdd(new_number_of_elements, new_number_of_deleted));
     Goto(&store_new_entry);
   }
@@ -1005,14 +1005,15 @@ TF_BUILTIN(MapDelete, CollectionsBuiltinsAssembler) {
                                          OrderedHashMap::kValueOffset));
 
   // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements =
-      SmiSub(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset),
-             SmiConstant(1));
+  Node* const number_of_elements = SmiSub(
+      CAST(LoadObjectField(table, OrderedHashMap::kNumberOfElementsOffset)),
+      SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashMap::kNumberOfElementsOffset,
                                  number_of_elements);
-  Node* const number_of_deleted = SmiAdd(
-      LoadObjectField(table, OrderedHashMap::kNumberOfDeletedElementsOffset),
-      SmiConstant(1));
+  Node* const number_of_deleted =
+      SmiAdd(CAST(LoadObjectField(
+                 table, OrderedHashMap::kNumberOfDeletedElementsOffset)),
+             SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashMap::kNumberOfDeletedElementsOffset, number_of_deleted);
 
@@ -1064,7 +1065,7 @@ TF_BUILTIN(SetAdd, CollectionsBuiltinsAssembler) {
 
     // Otherwise, go to runtime to compute the hash code.
     entry_start_position_or_hash.Bind(
-        SmiUntag(CallRuntime(Runtime::kGenericHash, context, key)));
+        SmiUntag(CAST(CallRuntime(Runtime::kGenericHash, context, key))));
     Goto(&add_entry);
   }
 
@@ -1080,9 +1081,9 @@ TF_BUILTIN(SetAdd, CollectionsBuiltinsAssembler) {
     STATIC_ASSERT(OrderedHashSet::kLoadFactor == 2);
     Node* const capacity = WordShl(number_of_buckets.value(), 1);
     Node* const number_of_elements = SmiUntag(
-        LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset));
-    Node* const number_of_deleted = SmiUntag(
-        LoadObjectField(table, OrderedHashSet::kNumberOfDeletedElementsOffset));
+        CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset)));
+    Node* const number_of_deleted = SmiUntag(CAST(LoadObjectField(
+        table, OrderedHashSet::kNumberOfDeletedElementsOffset)));
     occupancy.Bind(IntPtrAdd(number_of_elements, number_of_deleted));
     GotoIf(IntPtrLessThan(occupancy.value(), capacity), &store_new_entry);
 
@@ -1092,10 +1093,10 @@ TF_BUILTIN(SetAdd, CollectionsBuiltinsAssembler) {
     table_var.Bind(LoadObjectField(receiver, JSMap::kTableOffset));
     number_of_buckets.Bind(SmiUntag(LoadFixedArrayElement(
         table_var.value(), OrderedHashSet::kNumberOfBucketsIndex)));
-    Node* const new_number_of_elements = SmiUntag(LoadObjectField(
-        table_var.value(), OrderedHashSet::kNumberOfElementsOffset));
-    Node* const new_number_of_deleted = SmiUntag(LoadObjectField(
-        table_var.value(), OrderedHashSet::kNumberOfDeletedElementsOffset));
+    Node* const new_number_of_elements = SmiUntag(CAST(LoadObjectField(
+        table_var.value(), OrderedHashSet::kNumberOfElementsOffset)));
+    Node* const new_number_of_deleted = SmiUntag(CAST(LoadObjectField(
+        table_var.value(), OrderedHashSet::kNumberOfDeletedElementsOffset)));
     occupancy.Bind(IntPtrAdd(new_number_of_elements, new_number_of_deleted));
     Goto(&store_new_entry);
   }
@@ -1164,14 +1165,15 @@ TF_BUILTIN(SetDelete, CollectionsBuiltinsAssembler) {
                          kPointerSize * OrderedHashSet::kHashTableStartIndex);
 
   // Decrement the number of elements, increment the number of deleted elements.
-  Node* const number_of_elements =
-      SmiSub(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset),
-             SmiConstant(1));
+  Node* const number_of_elements = SmiSub(
+      CAST(LoadObjectField(table, OrderedHashSet::kNumberOfElementsOffset)),
+      SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(table, OrderedHashSet::kNumberOfElementsOffset,
                                  number_of_elements);
-  Node* const number_of_deleted = SmiAdd(
-      LoadObjectField(table, OrderedHashSet::kNumberOfDeletedElementsOffset),
-      SmiConstant(1));
+  Node* const number_of_deleted =
+      SmiAdd(CAST(LoadObjectField(
+                 table, OrderedHashSet::kNumberOfDeletedElementsOffset)),
+             SmiConstant(1));
   StoreObjectFieldNoWriteBarrier(
       table, OrderedHashSet::kNumberOfDeletedElementsOffset, number_of_deleted);
 
@@ -1648,7 +1650,7 @@ TF_BUILTIN(WeakMapLookupHashIndex, CollectionsBuiltinsAssembler) {
     GotoIf(WordEqual(current, key), &if_found);
 
     // See HashTable::NextProbe().
-    Increment(var_count);
+    Increment(&var_count);
     entry = WordAnd(IntPtrAdd(entry, var_count.value()), mask);
 
     var_entry.Bind(entry);
@@ -1659,7 +1661,7 @@ TF_BUILTIN(WeakMapLookupHashIndex, CollectionsBuiltinsAssembler) {
   Return(SmiConstant(-1));
 
   BIND(&if_found);
-  Return(SmiTag(IntPtrAdd(index, IntPtrConstant(1))));
+  Return(SmiTag(Signed(IntPtrAdd(index, IntPtrConstant(1)))));
 }
 
 TF_BUILTIN(WeakMapGet, CollectionsBuiltinsAssembler) {

src/builtins/builtins-constructor-gen.cc

@@ -571,9 +571,9 @@ Node* ConstructorBuiltinsAssembler::EmitCreateEmptyArrayLiteral(
 
   BIND(&create_empty_array);
   CSA_ASSERT(this, IsAllocationSite(allocation_site.value()));
-  Node* kind = SmiToWord32(
+  Node* kind = SmiToWord32(CAST(
       LoadObjectField(allocation_site.value(),
-                      AllocationSite::kTransitionInfoOrBoilerplateOffset));
+                      AllocationSite::kTransitionInfoOrBoilerplateOffset)));
   CSA_ASSERT(this, IsFastElementsKind(kind));
   Node* native_context = LoadNativeContext(context);
   Comment("LoadJSArrayElementsMap");

src/builtins/builtins-forin-gen.cc

@@ -82,7 +82,12 @@ void ForInBuiltinsAssembler::CheckPrototypeEnumCache(Node* receiver, Node* map,
   BIND(&loop);
   {
     Label if_elements(this), if_no_elements(this);
-    Node* elements = LoadElements(current_js_object.value());
+    TNode<JSReceiver> receiver = CAST(current_js_object.value());
+    // The following relies on the elements only aliasing with JSProxy::target,
+    // which is a Javascript value and hence cannot be confused with an elements
+    // backing store.
+    STATIC_ASSERT(JSObject::kElementsOffset == JSProxy::kTargetOffset);
+    Node* elements = LoadObjectField(receiver, JSObject::kElementsOffset);
     Node* empty_fixed_array = LoadRoot(Heap::kEmptyFixedArrayRootIndex);
     // Check that there are no elements.
     Branch(WordEqual(elements, empty_fixed_array), &if_no_elements,

src/builtins/builtins-function-gen.cc

@@ -104,7 +104,8 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   Label empty_arguments(this);
   Label arguments_done(this, &argument_array);
   GotoIf(Uint32LessThanOrEqual(argc, Int32Constant(1)), &empty_arguments);
-  Node* elements_length = ChangeUint32ToWord(Int32Sub(argc, Int32Constant(1)));
+  Node* elements_length =
+      ChangeUint32ToWord(Unsigned(Int32Sub(argc, Int32Constant(1))));
   Node* elements = AllocateFixedArray(PACKED_ELEMENTS, elements_length);
   VARIABLE(index, MachineType::PointerRepresentation());
   index.Bind(IntPtrConstant(0));
@@ -112,7 +113,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
   args.ForEach(foreach_vars,
                [this, elements, &index](Node* arg) {
                  StoreFixedArrayElement(elements, index.value(), arg);
-                 Increment(index);
+                 Increment(&index);
                },
                IntPtrConstant(1));
   argument_array.Bind(elements);

src/builtins/builtins-intl-gen.cc

@@ -75,7 +75,7 @@ TF_BUILTIN(StringToLowerCaseIntl, IntlBuiltinsAssembler) {
                     var_did_change.Bind(Word32Or(Word32NotEqual(c, lower),
                                                  var_did_change.value()));
 
-                    Increment(var_cursor);
+                    Increment(&var_cursor);
                   },
                   kCharSize, INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
 

src/builtins/builtins-math-gen.cc

@@ -19,12 +19,15 @@ class MathBuiltinsAssembler : public CodeStubAssembler {
       : CodeStubAssembler(state) {}
 
  protected:
-  void MathRoundingOperation(Node* context, Node* x,
-                             Node* (CodeStubAssembler::*float64op)(Node*));
-  void MathUnaryOperation(Node* context, Node* x,
-                          Node* (CodeStubAssembler::*float64op)(Node*));
+  void MathRoundingOperation(
+      Node* context, Node* x,
+      TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>));
+  void MathUnaryOperation(
+      Node* context, Node* x,
+      TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>));
   void MathMaxMin(Node* context, Node* argc,
-                  Node* (CodeStubAssembler::*float64op)(Node*, Node*),
+                  TNode<Float64T> (CodeStubAssembler::*float64op)(
+                      SloppyTNode<Float64T>, SloppyTNode<Float64T>),
                   double default_val);
 };
 
@@ -114,7 +117,8 @@ TF_BUILTIN(MathAbs, CodeStubAssembler) {
 }
 
 void MathBuiltinsAssembler::MathRoundingOperation(
-    Node* context, Node* x, Node* (CodeStubAssembler::*float64op)(Node*)) {
+    Node* context, Node* x,
+    TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>)) {
   // We might need to loop once for ToNumber conversion.
   VARIABLE(var_x, MachineRepresentation::kTagged, x);
   Label loop(this, &var_x);
@@ -159,7 +163,8 @@ void MathBuiltinsAssembler::MathRoundingOperation(
 }
 
 void MathBuiltinsAssembler::MathUnaryOperation(
-    Node* context, Node* x, Node* (CodeStubAssembler::*float64op)(Node*)) {
+    Node* context, Node* x,
+    TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>)) {
   Node* x_value = TruncateTaggedToFloat64(context, x);
   Node* value = (this->*float64op)(x_value);
   Node* result = AllocateHeapNumberWithValue(value);
@@ -168,7 +173,9 @@ void MathBuiltinsAssembler::MathUnaryOperation(
 
 void MathBuiltinsAssembler::MathMaxMin(
     Node* context, Node* argc,
-    Node* (CodeStubAssembler::*float64op)(Node*, Node*), double default_val) {
+    TNode<Float64T> (CodeStubAssembler::*float64op)(SloppyTNode<Float64T>,
+                                                    SloppyTNode<Float64T>),
+    double default_val) {
   CodeStubArguments arguments(this, ChangeInt32ToIntPtr(argc));
   argc = arguments.GetLength();
 

src/builtins/builtins-object-gen.cc

@@ -384,11 +384,11 @@ TF_BUILTIN(ObjectPrototypeToString, ObjectBuiltinsAssembler) {
     // as the exception is observable.
     Node* receiver_is_array =
         CallRuntime(Runtime::kArrayIsArray, context, receiver);
-    Node* builtin_tag = SelectTaggedConstant(
+    Node* builtin_tag = SelectTaggedConstant<Object>(
         IsTrue(receiver_is_array), LoadRoot(Heap::kArray_stringRootIndex),
-        SelectTaggedConstant(IsCallableMap(receiver_map),
-                             LoadRoot(Heap::kFunction_stringRootIndex),
-                             LoadRoot(Heap::kObject_stringRootIndex)));
+        SelectTaggedConstant<Object>(IsCallableMap(receiver_map),
+                                     LoadRoot(Heap::kFunction_stringRootIndex),
+                                     LoadRoot(Heap::kObject_stringRootIndex)));
 
     // Lookup the @@toStringTag property on the {receiver}.
     VARIABLE(var_tag, MachineRepresentation::kTagged,

src/builtins/builtins-promise-gen.cc

@@ -639,7 +639,7 @@ void PromiseBuiltinsAssembler::BranchIfFastPath(Node* native_context,
 
   Node* const initial_proto_initial_map =
       LoadContextElement(native_context, Context::PROMISE_PROTOTYPE_MAP_INDEX);
-  Node* const proto_map = LoadMap(LoadMapPrototype(map));
+  Node* const proto_map = LoadMap(CAST(LoadMapPrototype(map)));
   Node* const proto_has_initialmap =
       WordEqual(proto_map, initial_proto_initial_map);
 

src/builtins/builtins-proxy-gen.cc

@@ -104,7 +104,7 @@ class ProxiesCodeStubAssembler : public CodeStubAssembler {
     args.ForEach(list, [this, elements, &index](Node* arg) {
       StoreNoWriteBarrier(MachineRepresentation::kTagged, elements,
                           index.value(), arg);
-      Increment(index, kPointerSize);
+      Increment(&index, kPointerSize);
     });
     return array;
   }

src/builtins/builtins-regexp-gen.cc

@@ -75,7 +75,7 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
 
   Label named_captures(this), out(this);
 
-  Node* const num_indices = SmiUntag(LoadFixedArrayElement(
+  TNode<IntPtrT> num_indices = SmiUntag(LoadFixedArrayElement(
       match_info, RegExpMatchInfo::kNumberOfCapturesIndex));
   Node* const num_results = SmiTag(WordShr(num_indices, 1));
   Node* const start =
@@ -525,7 +525,7 @@ Node* RegExpBuiltinsAssembler::RegExpExecInternal(Node* const context,
             Node* const smi_value = SmiFromWord32(value);
             StoreNoWriteBarrier(MachineRepresentation::kTagged, match_info,
                                 var_to_offset.value(), smi_value);
-            Increment(var_to_offset, kPointerSize);
+            Increment(&var_to_offset, kPointerSize);
           },
           kInt32Size, INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
     }
@@ -822,7 +822,7 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp(Node* const context,
 
   Node* const initial_proto_initial_map =
       LoadContextElement(native_context, Context::REGEXP_PROTOTYPE_MAP_INDEX);
-  Node* const proto_map = LoadMap(LoadMapPrototype(map));
+  Node* const proto_map = LoadMap(CAST(LoadMapPrototype(map)));
   Node* const proto_has_initialmap =
       WordEqual(proto_map, initial_proto_initial_map);
 
@@ -1147,16 +1147,16 @@ Node* RegExpBuiltinsAssembler::RegExpInitialize(Node* const context,
   CSA_ASSERT(this, IsJSRegExp(regexp));
 
   // Normalize pattern.
-  Node* const pattern =
-      Select(IsUndefined(maybe_pattern), [=] { return EmptyStringConstant(); },
-             [=] { return ToString_Inline(context, maybe_pattern); },
-             MachineRepresentation::kTagged);
+  Node* const pattern = Select<Object>(
+      IsUndefined(maybe_pattern), [=] { return EmptyStringConstant(); },
+      [=] { return ToString_Inline(context, maybe_pattern); },
+      MachineRepresentation::kTagged);
 
   // Normalize flags.
-  Node* const flags =
-      Select(IsUndefined(maybe_flags), [=] { return EmptyStringConstant(); },
-             [=] { return ToString_Inline(context, maybe_flags); },
-             MachineRepresentation::kTagged);
+  Node* const flags = Select<Object>(
+      IsUndefined(maybe_flags), [=] { return EmptyStringConstant(); },
+      [=] { return ToString_Inline(context, maybe_flags); },
+      MachineRepresentation::kTagged);
 
   // Initialize.
 
@@ -1868,7 +1868,8 @@ class GrowableFixedArray {
     var_length_.Bind(a->IntPtrConstant(0));
   }
 
-  Node* NewCapacity(CodeStubAssembler* a, Node* const current_capacity) {
+  Node* NewCapacity(CodeStubAssembler* a,
+                    compiler::SloppyTNode<IntPtrT> current_capacity) {
     CSA_ASSERT(a, a->IntPtrGreaterThan(current_capacity, a->IntPtrConstant(0)));
 
     // Growth rate is analog to JSObject::NewElementsCapacity:
@@ -2672,10 +2673,10 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
 
         BIND(&if_ispositive);
         {
-          Node* const int_elem = SmiUntag(elem);
-          Node* const new_match_start =
-              IntPtrAdd(WordShr(int_elem, IntPtrConstant(11)),
-                        WordAnd(int_elem, IntPtrConstant(0x7ff)));
+          TNode<IntPtrT> int_elem = SmiUntag(elem);
+          TNode<IntPtrT> new_match_start =
+              Signed(IntPtrAdd(WordShr(int_elem, IntPtrConstant(11)),
+                               WordAnd(int_elem, IntPtrConstant(0x7ff))));
           var_match_start.Bind(SmiTag(new_match_start));
           Goto(&loop_epilogue);
         }

src/builtins/builtins-sharedarraybuffer-gen.cc

@@ -57,8 +57,7 @@ void SharedArrayBufferBuiltinsAssembler::ValidateSharedTypedArray(
   GotoIfNot(IsSetWord32<JSArrayBuffer::IsShared>(bitfield), &invalid);
 
   // Fail if the array's element type is float32, float64 or clamped.
-  Node* elements_instance_type =
-      LoadInstanceType(LoadObjectField(tagged, JSObject::kElementsOffset));
+  Node* elements_instance_type = LoadInstanceType(LoadElements(tagged));
   STATIC_ASSERT(FIXED_INT8_ARRAY_TYPE < FIXED_FLOAT32_ARRAY_TYPE);
   STATIC_ASSERT(FIXED_INT16_ARRAY_TYPE < FIXED_FLOAT32_ARRAY_TYPE);
   STATIC_ASSERT(FIXED_INT32_ARRAY_TYPE < FIXED_FLOAT32_ARRAY_TYPE);

src/builtins/builtins-string-gen.cc

@@ -15,6 +15,8 @@ namespace internal {
 
 typedef CodeStubAssembler::RelationalComparisonMode RelationalComparisonMode;
 typedef compiler::Node Node;
+template <class A>
+using TNode = compiler::TNode<A>;
 
 Node* StringBuiltinsAssembler::DirectStringData(Node* string,
                                                 Node* string_instance_type) {
@@ -124,9 +126,9 @@ Node* StringBuiltinsAssembler::PointerToStringDataAtIndex(
 
 void StringBuiltinsAssembler::ConvertAndBoundsCheckStartArgument(
     Node* context, Variable* var_start, Node* start, Node* string_length) {
-  Node* const start_int =
+  TNode<Object> const start_int =
       ToInteger(context, start, CodeStubAssembler::kTruncateMinusZero);
-  Node* const zero = SmiConstant(0);
+  TNode<Smi> const zero = SmiConstant(0);
 
   Label done(this);
   Label if_issmi(this), if_isheapnumber(this, Label::kDeferred);
@@ -134,10 +136,11 @@ void StringBuiltinsAssembler::ConvertAndBoundsCheckStartArgument(
 
   BIND(&if_issmi);
   {
-    var_start->Bind(
-        Select(SmiLessThan(start_int, zero),
-               [&] { return SmiMax(SmiAdd(string_length, start_int), zero); },
-               [&] { return start_int; }, MachineRepresentation::kTagged));
+    TNode<Smi> const start_int_smi = CAST(start_int);
+    var_start->Bind(Select(
+        SmiLessThan(start_int_smi, zero),
+        [&] { return SmiMax(SmiAdd(string_length, start_int_smi), zero); },
+        [&] { return start_int_smi; }, MachineRepresentation::kTagged));
     Goto(&done);
   }
 
@@ -147,9 +150,10 @@ void StringBuiltinsAssembler::ConvertAndBoundsCheckStartArgument(
     // negative, {start} = max({string_length} + {start}),0) = 0'. If it is
     // positive, set {start} to {string_length} which ultimately results in
     // returning an empty string.
-    Node* const float_zero = Float64Constant(0.);
-    Node* const start_float = LoadHeapNumberValue(start_int);
-    var_start->Bind(SelectTaggedConstant(
+    TNode<HeapNumber> const start_int_hn = CAST(start_int);
+    TNode<Float64T> const float_zero = Float64Constant(0.);
+    TNode<Float64T> const start_float = LoadHeapNumberValue(start_int_hn);
+    var_start->Bind(SelectTaggedConstant<Smi>(
         Float64LessThan(start_float, float_zero), zero, string_length));
     Goto(&done);
   }
@@ -921,8 +925,9 @@ void StringBuiltinsAssembler::StringIndexOf(
     // Simplified version of the runtime call where the types of the arguments
     // are already known due to type checks in this stub.
     Comment("Call Runtime Unchecked");
-    Node* result = CallRuntime(Runtime::kStringIndexOfUnchecked, SmiConstant(0),
-                               subject_string, search_string, position);
+    Node* result =
+        CallRuntime(Runtime::kStringIndexOfUnchecked, NoContextConstant(),
+                    subject_string, search_string, position);
     f_return(result);
   }
 }
@@ -1058,7 +1063,7 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
         LoadContextElement(native_context, Context::STRING_FUNCTION_INDEX);
     Node* const initial_map =
         LoadObjectField(string_fun, JSFunction::kPrototypeOrInitialMapOffset);
-    Node* const proto_map = LoadMap(LoadMapPrototype(initial_map));
+    Node* const proto_map = LoadMap(CAST(LoadMapPrototype(initial_map)));
 
     Branch(WordEqual(proto_map, initial_proto_initial_map), &out, &next);
 
@@ -1335,7 +1340,7 @@ TF_BUILTIN(StringPrototypeSlice, StringBuiltinsAssembler) {
   Node* const end = args.GetOptionalArgumentValue(kEnd);
   Node* const context = Parameter(BuiltinDescriptor::kContext);
 
-  Node* const smi_zero = SmiConstant(0);
+  TNode<Smi> const smi_zero = SmiConstant(0);
 
   // 1. Let O be ? RequireObjectCoercible(this value).
   RequireObjectCoercible(context, receiver, "String.prototype.slice");
@@ -1381,8 +1386,8 @@ TF_BUILTIN(StringPrototypeSlice, StringBuiltinsAssembler) {
     // returning an empty string.
     Node* const float_zero = Float64Constant(0.);
     Node* const end_float = LoadHeapNumberValue(end_int);
-    var_end.Bind(SelectTaggedConstant(Float64LessThan(end_float, float_zero),
-                                      smi_zero, length));
+    var_end.Bind(SelectTaggedConstant<Smi>(
+        Float64LessThan(end_float, float_zero), smi_zero, length));
     Goto(&out);
   }
 
@@ -1597,13 +1602,13 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
   }
 }
 
-compiler::Node* StringBuiltinsAssembler::ToSmiBetweenZeroAnd(Node* context,
-                                                             Node* value,
-                                                             Node* limit) {
+TNode<Smi> StringBuiltinsAssembler::ToSmiBetweenZeroAnd(
+    SloppyTNode<Context> context, SloppyTNode<Object> value,
+    SloppyTNode<Smi> limit) {
   Label out(this);
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, var_result);
 
-  Node* const value_int =
+  TNode<Object> const value_int =
       this->ToInteger(context, value, CodeStubAssembler::kTruncateMinusZero);
 
   Label if_issmi(this), if_isnotsmi(this, Label::kDeferred);
@@ -1616,15 +1621,15 @@ compiler::Node* StringBuiltinsAssembler::ToSmiBetweenZeroAnd(Node* context,
 
     BIND(&if_isinbounds);
     {
-      var_result.Bind(value_int);
+      var_result = CAST(value_int);
       Goto(&out);
     }
 
     BIND(&if_isoutofbounds);
     {
-      Node* const zero = SmiConstant(0);
-      var_result.Bind(
-          SelectTaggedConstant(SmiLessThan(value_int, zero), zero, limit));
+      TNode<Smi> const zero = SmiConstant(0);
+      var_result =
+          SelectTaggedConstant(SmiLessThan(value_int, zero), zero, limit);
       Goto(&out);
     }
   }
@@ -1632,18 +1637,18 @@ compiler::Node* StringBuiltinsAssembler::ToSmiBetweenZeroAnd(Node* context,
   BIND(&if_isnotsmi);
   {
     // {value} is a heap number - in this case, it is definitely out of bounds.
-    CSA_ASSERT(this, IsHeapNumber(value_int));
+    TNode<HeapNumber> value_int_hn = CAST(value_int);
 
-    Node* const float_zero = Float64Constant(0.);
-    Node* const smi_zero = SmiConstant(0);
-    Node* const value_float = LoadHeapNumberValue(value_int);
-    var_result.Bind(SelectTaggedConstant(
-        Float64LessThan(value_float, float_zero), smi_zero, limit));
+    TNode<Float64T> const float_zero = Float64Constant(0.);
+    TNode<Smi> const smi_zero = SmiConstant(0);
+    TNode<Float64T> const value_float = LoadHeapNumberValue(value_int_hn);
+    var_result = SelectTaggedConstant(Float64LessThan(value_float, float_zero),
+                                      smi_zero, limit);
     Goto(&out);
   }
 
   BIND(&out);
-  return var_result.value();
+  return var_result;
 }
 
 // ES6 #sec-string.prototype.substring
@@ -1748,30 +1753,30 @@ TF_BUILTIN(StringPrototypeIterator, CodeStubAssembler) {
 
 // Return the |word32| codepoint at {index}. Supports SeqStrings and
 // ExternalStrings.
-compiler::Node* StringBuiltinsAssembler::LoadSurrogatePairAt(
-    compiler::Node* string, compiler::Node* length, compiler::Node* index,
+TNode<Uint32T> StringBuiltinsAssembler::LoadSurrogatePairAt(
+    SloppyTNode<String> string, SloppyTNode<Smi> length, SloppyTNode<Smi> index,
     UnicodeEncoding encoding) {
   Label handle_surrogate_pair(this), return_result(this);
-  VARIABLE(var_result, MachineRepresentation::kWord32);
-  VARIABLE(var_trail, MachineRepresentation::kWord32);
-  var_result.Bind(StringCharCodeAt(string, index));
-  var_trail.Bind(Int32Constant(0));
+  TVARIABLE(Uint32T, var_result);
+  TVARIABLE(Uint32T, var_trail);
+  var_result = StringCharCodeAt(string, index);
+  var_trail = Unsigned(Int32Constant(0));
 
-  GotoIf(Word32NotEqual(Word32And(var_result.value(), Int32Constant(0xFC00)),
+  GotoIf(Word32NotEqual(Word32And(var_result, Int32Constant(0xFC00)),
                         Int32Constant(0xD800)),
          &return_result);
-  Node* next_index = SmiAdd(index, SmiConstant(1));
+  TNode<Smi> next_index = SmiAdd(index, SmiConstant(1));
 
   GotoIfNot(SmiLessThan(next_index, length), &return_result);
-  var_trail.Bind(StringCharCodeAt(string, next_index));
-  Branch(Word32Equal(Word32And(var_trail.value(), Int32Constant(0xFC00)),
+  var_trail = StringCharCodeAt(string, next_index);
+  Branch(Word32Equal(Word32And(var_trail, Int32Constant(0xFC00)),
                      Int32Constant(0xDC00)),
          &handle_surrogate_pair, &return_result);
 
   BIND(&handle_surrogate_pair);
   {
-    Node* lead = var_result.value();
-    Node* trail = var_trail.value();
+    TNode<Uint32T> lead = var_result;
+    TNode<Uint32T> trail = var_trail;
 
     // Check that this path is only taken if a surrogate pair is found
     CSA_SLOW_ASSERT(this,
@@ -1783,10 +1788,10 @@ compiler::Node* StringBuiltinsAssembler::LoadSurrogatePairAt(
 
     switch (encoding) {
       case UnicodeEncoding::UTF16:
-        var_result.Bind(Word32Or(
+        var_result = Unsigned(Word32Or(
 // Need to swap the order for big-endian platforms
 #if V8_TARGET_BIG_ENDIAN
-            Word32Shl(lead, Int32Constant(16)), trail));
+            Word32Shl(lead, Int32Constant(16)), trail);
 #else
             Word32Shl(trail, Int32Constant(16)), lead));
 #endif
@@ -1795,12 +1800,12 @@ compiler::Node* StringBuiltinsAssembler::LoadSurrogatePairAt(
       case UnicodeEncoding::UTF32: {
         // Convert UTF16 surrogate pair into |word32| code point, encoded as
         // UTF32.
-        Node* surrogate_offset =
+        TNode<Int32T> surrogate_offset =
             Int32Constant(0x10000 - (0xD800 << 10) - 0xDC00);
 
         // (lead << 10) + trail + SURROGATE_OFFSET
-        var_result.Bind(Int32Add(Word32Shl(lead, Int32Constant(10)),
-                                 Int32Add(trail, surrogate_offset)));
+        var_result = Unsigned(Int32Add(Word32Shl(lead, Int32Constant(10)),
+                                       Int32Add(trail, surrogate_offset)));
         break;
       }
     }
@@ -1808,7 +1813,7 @@ compiler::Node* StringBuiltinsAssembler::LoadSurrogatePairAt(
   }
 
   BIND(&return_result);
-  return var_result.value();
+  return var_result;
 }
 
 // ES6 #sec-%stringiteratorprototype%.next

src/builtins/builtins-string-gen.h

@@ -49,10 +49,14 @@ class StringBuiltinsAssembler : public CodeStubAssembler {
                                           Node* right,
                                           RelationalComparisonMode mode);
 
-  Node* ToSmiBetweenZeroAnd(Node* context, Node* value, Node* limit);
-
-  Node* LoadSurrogatePairAt(Node* string, Node* length, Node* index,
-                            UnicodeEncoding encoding);
+  TNode<Smi> ToSmiBetweenZeroAnd(SloppyTNode<Context> context,
+                                 SloppyTNode<Object> value,
+                                 SloppyTNode<Smi> limit);
+
+  TNode<Uint32T> LoadSurrogatePairAt(SloppyTNode<String> string,
+                                     SloppyTNode<Smi> length,
+                                     SloppyTNode<Smi> index,
+                                     UnicodeEncoding encoding);
 
   void StringIndexOf(Node* const subject_string,
                      Node* const subject_instance_type,

src/compiler/instruction.cc

@@ -895,6 +895,7 @@ static MachineRepresentation FilterRepresentation(MachineRepresentation rep) {
     case MachineRepresentation::kNone:
       break;
   }
+
   UNREACHABLE();
 }
 

src/external-reference-table.cc

@@ -253,6 +253,8 @@ void ExternalReferenceTable::AddReferences(Isolate* isolate) {
       "libc_memset");
   Add(ExternalReference::try_internalize_string_function(isolate).address(),
       "try_internalize_string_function");
+  Add(ExternalReference::check_object_type(isolate).address(),
+      "check_object_type");
 #ifdef V8_INTL_SUPPORT
   Add(ExternalReference::intl_convert_one_byte_to_lower(isolate).address(),
       "intl_convert_one_byte_to_lower");

src/ic/accessor-assembler.cc

@@ -1167,7 +1167,7 @@ void AccessorAssembler::EmitFastElementsBoundsCheck(Node* object,
   }
   BIND(&if_array);
   {
-    var_length.Bind(SmiUntag(LoadJSArrayLength(object)));
+    var_length.Bind(SmiUntag(LoadFastJSArrayLength(object)));
     Goto(&length_loaded);
   }
   BIND(&length_loaded);
@@ -1281,7 +1281,7 @@ void AccessorAssembler::EmitElementLoad(
 
     // Bounds check.
     Node* length =
-        SmiUntag(LoadObjectField(object, JSTypedArray::kLengthOffset));
+        SmiUntag(CAST(LoadObjectField(object, JSTypedArray::kLengthOffset)));
     GotoIfNot(UintPtrLessThan(intptr_index, length), out_of_bounds);
 
     // Backing store = external_pointer + base_pointer.

src/ic/keyed-store-generic.cc

@@ -225,7 +225,7 @@ void KeyedStoreGenericAssembler::TryChangeToHoleyMapMulti(
 void KeyedStoreGenericAssembler::MaybeUpdateLengthAndReturn(
     Node* receiver, Node* index, Node* value, UpdateLength update_length) {
   if (update_length != kDontChangeLength) {
-    Node* new_length = SmiTag(IntPtrAdd(index, IntPtrConstant(1)));
+    Node* new_length = SmiTag(Signed(IntPtrAdd(index, IntPtrConstant(1))));
     StoreObjectFieldNoWriteBarrier(receiver, JSArray::kLengthOffset, new_length,
                                    MachineRepresentation::kTagged);
   }
@@ -445,7 +445,7 @@ void KeyedStoreGenericAssembler::EmitGenericElementStore(
   }
   BIND(&if_array);
   {
-    Node* length = SmiUntag(LoadJSArrayLength(receiver));
+    Node* length = SmiUntag(LoadFastJSArrayLength(receiver));
     GotoIf(UintPtrLessThan(intptr_index, length), &if_in_bounds);
     Node* capacity = SmiUntag(LoadFixedArrayBaseLength(elements));
     GotoIf(UintPtrGreaterThanOrEqual(intptr_index, capacity), &if_grow);

src/interpreter/interpreter-assembler.cc

@@ -1377,7 +1377,7 @@ Node* InterpreterAssembler::LoadOSRNestingLevel() {
 
 void InterpreterAssembler::Abort(BailoutReason bailout_reason) {
   disable_stack_check_across_call_ = true;
-  Node* abort_id = SmiTag(Int32Constant(bailout_reason));
+  Node* abort_id = SmiConstant(bailout_reason);
   CallRuntime(Runtime::kAbort, GetContext(), abort_id);
   disable_stack_check_across_call_ = false;
 }

src/machine-type.cc

@@ -8,6 +8,18 @@
 namespace v8 {
 namespace internal {
 
+bool IsSubtype(MachineRepresentation rep1, MachineRepresentation rep2) {
+  if (rep1 == rep2) return true;
+  switch (rep1) {
+    case MachineRepresentation::kTaggedSigned:
+      return rep2 == MachineRepresentation::kTagged;
+    case MachineRepresentation ::kTaggedPointer:
+      return rep2 == MachineRepresentation ::kTagged;
+    default:
+      return false;
+  }
+}
+
 std::ostream& operator<<(std::ostream& os, MachineRepresentation rep) {
   return os << MachineReprToString(rep);
 }

src/machine-type.h

@@ -33,6 +33,8 @@ enum class MachineRepresentation {
   kLastRepresentation = kSimd128
 };
 
+bool IsSubtype(MachineRepresentation rep1, MachineRepresentation rep2);
+
 static_assert(static_cast<int>(MachineRepresentation::kLastRepresentation) <
                   kIntSize * kBitsPerByte,
               "Bit masks of MachineRepresentation should fit in an int");

test/cctest/compiler/test-code-assembler.cc

@@ -410,12 +410,15 @@ TEST(TestOutOfScopeVariable) {
   Label block2(&m);
   Label block3(&m);
   Label block4(&m);
-  m.Branch(m.WordEqual(m.Parameter(0), m.IntPtrConstant(0)), &block1, &block4);
+  m.Branch(m.WordEqual(m.UncheckedCast<IntPtrT>(m.Parameter(0)),
+                       m.IntPtrConstant(0)),
+           &block1, &block4);
   m.Bind(&block4);
   {
     Variable var_object(&m, MachineRepresentation::kTagged);
-    m.Branch(m.WordEqual(m.Parameter(0), m.IntPtrConstant(0)), &block2,
-             &block3);
+    m.Branch(m.WordEqual(m.UncheckedCast<IntPtrT>(m.Parameter(0)),
+                         m.IntPtrConstant(0)),
+             &block2, &block3);
 
     m.Bind(&block2);
     var_object.Bind(m.IntPtrConstant(55));

test/cctest/test-code-stub-assembler.cc

@@ -170,7 +170,7 @@ TEST(FixedArrayAccessSmiIndex) {
   Handle<FixedArray> array = isolate->factory()->NewFixedArray(5);
   array->set(4, Smi::FromInt(733));
   m.Return(m.LoadFixedArrayElement(m.HeapConstant(array),
-                                   m.SmiTag(m.Int32Constant(4)), 0,
+                                   m.SmiTag(m.IntPtrConstant(4)), 0,
                                    CodeStubAssembler::SMI_PARAMETERS));
   FunctionTester ft(asm_tester.GenerateCode());
   MaybeHandle<Object> result = ft.Call();
@@ -1775,15 +1775,15 @@ class AppendJSArrayCodeStubAssembler : public CodeStubAssembler {
                          Handle<Smi>(Smi::FromInt(2), isolate), SLOPPY)
         .Check();
     CodeStubArguments args(this, IntPtrConstant(kNumParams));
-    Variable arg_index(this, MachineType::PointerRepresentation());
+    TVariable<IntPtrT> arg_index(this);
     Label bailout(this);
-    arg_index.Bind(IntPtrConstant(0));
-    Node* length = BuildAppendJSArray(kind_, HeapConstant(array), args,
-                                      arg_index, &bailout);
+    arg_index = IntPtrConstant(0);
+    Node* length = BuildAppendJSArray(kind_, HeapConstant(array), &args,
+                                      &arg_index, &bailout);
     Return(length);
 
     BIND(&bailout);
-    Return(SmiTag(IntPtrAdd(arg_index.value(), IntPtrConstant(2))));
+    Return(SmiTag(IntPtrAdd(arg_index, IntPtrConstant(2))));
 
     FunctionTester ft(csa_tester->GenerateCode(), kNumParams);