[ptr-compr][turbofan] Specialize accesses known to be pointers.

There are some accesses that we know that are pointers, and we can
specialize them to have Pointer as their Machine Type and Write Barrier.

Drive-by fix: ForJSGeneratorObjectParametersAndRegisters can be changed
to use Pointer.

Bug: v8:7703
Change-Id: I88e371746fc5f08c84795c95b1885264ef6c067c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741658
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63223}

src/compiler/access-builder.cc

@@ -89,6 +89,16 @@ FieldAccess AccessBuilder::ForJSObjectPropertiesOrHash() {
   return access;
 }
 
+// static
+FieldAccess AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer() {
+  FieldAccess access = {
+      kTaggedBase,          JSObject::kPropertiesOrHashOffset,
+      MaybeHandle<Name>(),  MaybeHandle<Map>(),
+      Type::Any(),          MachineType::TypeCompressedTaggedPointer(),
+      kPointerWriteBarrier, LoadSensitivity::kCritical};
+  return access;
+}
+
 // static
 FieldAccess AccessBuilder::ForJSObjectElements() {
   FieldAccess access = {
@@ -292,7 +302,7 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectParametersAndRegisters() {
   FieldAccess access = {
       kTaggedBase,         JSGeneratorObject::kParametersAndRegistersOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTagged(),
+      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -864,6 +874,19 @@ FieldAccess AccessBuilder::ForContextSlot(size_t index) {
   return access;
 }
 
+// static
+FieldAccess AccessBuilder::ForContextSlotKnownPointer(size_t index) {
+  int offset = Context::OffsetOfElementAt(static_cast<int>(index));
+  DCHECK_EQ(offset,
+            Context::SlotOffset(static_cast<int>(index)) + kHeapObjectTag);
+  FieldAccess access = {
+      kTaggedBase,         offset,
+      Handle<Name>(),      MaybeHandle<Map>(),
+      Type::Any(),         MachineType::TypeCompressedTaggedPointer(),
+      kPointerWriteBarrier};
+  return access;
+}
+
 // static
 ElementAccess AccessBuilder::ForFixedArrayElement() {
   ElementAccess access = {kTaggedBase, FixedArray::kHeaderSize, Type::Any(),

src/compiler/access-builder.h

@@ -54,6 +54,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to JSObject::properties() field.
   static FieldAccess ForJSObjectPropertiesOrHash();
 
+  // Provides access to JSObject::properties() field for known pointers.
+  static FieldAccess ForJSObjectPropertiesOrHashKnownPointer();
+
   // Provides access to JSObject::elements() field.
   static FieldAccess ForJSObjectElements();
 
@@ -271,6 +274,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // Provides access to Context slots.
   static FieldAccess ForContextSlot(size_t index);
 
+  // Provides access to Context slots that are known to be pointers.
+  static FieldAccess ForContextSlotKnownPointer(size_t index);
+
   // Provides access to FixedArray elements.
   static ElementAccess ForFixedArrayElement();
   static ElementAccess ForFixedArrayElement(

src/compiler/effect-control-linearizer.cc

@@ -4778,8 +4778,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
     // The {index} is equal to the negated out of property index plus 1.
     __ Bind(&if_outofobject);
     {
-      Node* properties =
-          __ LoadField(AccessBuilder::ForJSObjectPropertiesOrHash(), object);
+      Node* properties = __ LoadField(
+          AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(), object);
       Node* offset =
           __ IntAdd(__ WordShl(__ IntSub(zero, index),
                                __ IntPtrConstant(kTaggedSizeLog2 - 1)),
@@ -4821,8 +4821,8 @@ Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
 
     __ Bind(&if_outofobject);
     {
-      Node* properties =
-          __ LoadField(AccessBuilder::ForJSObjectPropertiesOrHash(), object);
+      Node* properties = __ LoadField(
+          AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(), object);
       Node* offset =
           __ IntAdd(__ WordShl(__ IntSub(zero, index),
                                __ IntPtrConstant(kTaggedSizeLog2)),

src/compiler/js-call-reducer.cc

@@ -1742,7 +1742,8 @@ Reduction JSCallReducer::ReduceArrayFilter(
                 Type::Array());
     ab.Store(AccessBuilder::ForMap(), initial_map);
     Node* empty_fixed_array = jsgraph()->EmptyFixedArrayConstant();
-    ab.Store(AccessBuilder::ForJSObjectPropertiesOrHash(), empty_fixed_array);
+    ab.Store(AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer(),
+             empty_fixed_array);
     ab.Store(AccessBuilder::ForJSObjectElements(), empty_fixed_array);
     ab.Store(AccessBuilder::ForJSArrayLength(packed_kind),
              jsgraph()->ZeroConstant());

src/compiler/js-native-context-specialization.cc

@@ -2227,7 +2227,8 @@ JSNativeContextSpecialization::BuildPropertyStore(
     Node* storage = receiver;
     if (!field_index.is_inobject()) {
       storage = effect = graph()->NewNode(
-          simplified()->LoadField(AccessBuilder::ForJSObjectPropertiesOrHash()),
+          simplified()->LoadField(
+              AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer()),
           storage, effect, control);
     }
     PropertyConstness constness = access_info.IsDataConstant()
@@ -2386,7 +2387,7 @@ JSNativeContextSpecialization::BuildPropertyStore(
                                   storage, value, effect, control);
 
         // Atomically switch to the new properties below.
-        field_access = AccessBuilder::ForJSObjectPropertiesOrHash();
+        field_access = AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer();
         value = storage;
         storage = receiver;
       }

src/compiler/js-typed-lowering.cc

@@ -1320,7 +1320,7 @@ Reduction JSTypedLowering::ReduceJSLoadContext(Node* node) {
   for (size_t i = 0; i < access.depth(); ++i) {
     context = effect = graph()->NewNode(
         simplified()->LoadField(
-            AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX)),
+            AccessBuilder::ForContextSlotKnownPointer(Context::PREVIOUS_INDEX)),
         context, effect, control);
   }
   node->ReplaceInput(0, context);
@@ -1342,7 +1342,7 @@ Reduction JSTypedLowering::ReduceJSStoreContext(Node* node) {
   for (size_t i = 0; i < access.depth(); ++i) {
     context = effect = graph()->NewNode(
         simplified()->LoadField(
-            AccessBuilder::ForContextSlot(Context::PREVIOUS_INDEX)),
+            AccessBuilder::ForContextSlotKnownPointer(Context::PREVIOUS_INDEX)),
         context, effect, control);
   }
   node->ReplaceInput(0, context);

src/compiler/property-access-builder.cc

@@ -199,7 +199,8 @@ Node* PropertyAccessBuilder::BuildLoadDataField(
   Node* storage = ResolveHolder(access_info, receiver);
   if (!field_index.is_inobject()) {
     storage = *effect = graph()->NewNode(
-        simplified()->LoadField(AccessBuilder::ForJSObjectPropertiesOrHash()),
+        simplified()->LoadField(
+            AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer()),
         storage, *effect, *control);
   }
   PropertyConstness constness = access_info.IsDataConstant()

test/cctest/test-poison-disasm-arm64.cc

@@ -114,7 +114,7 @@ TEST(DisasmPoisonPolymorphicLoad) {
       "csel " + kPReg + ", xzr, " + kPReg + ", ne",      // update the poison
       "csdb",                                            // spec. barrier
       "ldursw x<<BSt:[0-9]+>>, \\[<<Obj>>, #[0-9]+\\]",  // load backing store
-      "tbz w<<BSt>>, #0, #\\+0x8",                       // branchful decompress
+                                                         // branchful decompress
       "add x<<BSt>>, x26, x<<BSt>>",                     // Add root to ref
       "and x<<BSt>>, x<<BSt>>, " + kPReg,                // apply the poison
       "ldur w<<Prop:[0-9]+>>, \\[x<<BSt>>, #[0-9]+\\]",  // load the property

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -322,12 +322,13 @@ TEST_F(JSTypedLoweringTest, JSLoadContext) {
       Reduction const r2 = Reduce(graph()->NewNode(
           javascript()->LoadContext(1, index, immutable), context, effect));
       ASSERT_TRUE(r2.Changed());
-      EXPECT_THAT(r2.replacement(),
-                  IsLoadField(AccessBuilder::ForContextSlot(index),
-                              IsLoadField(AccessBuilder::ForContextSlot(
-                                              Context::PREVIOUS_INDEX),
-                                          context, effect, graph()->start()),
-                              _, graph()->start()));
+      EXPECT_THAT(
+          r2.replacement(),
+          IsLoadField(AccessBuilder::ForContextSlot(index),
+                      IsLoadField(AccessBuilder::ForContextSlotKnownPointer(
+                                      Context::PREVIOUS_INDEX),
+                                  context, effect, graph()->start()),
+                      _, graph()->start()));
     }
   }
 }
@@ -357,12 +358,13 @@ TEST_F(JSTypedLoweringTest, JSStoreContext) {
           Reduce(graph()->NewNode(javascript()->StoreContext(1, index), value,
                                   context, effect, control));
       ASSERT_TRUE(r2.Changed());
-      EXPECT_THAT(r2.replacement(),
-                  IsStoreField(AccessBuilder::ForContextSlot(index),
-                               IsLoadField(AccessBuilder::ForContextSlot(
-                                               Context::PREVIOUS_INDEX),
-                                           context, effect, graph()->start()),
-                               value, _, control));
+      EXPECT_THAT(
+          r2.replacement(),
+          IsStoreField(AccessBuilder::ForContextSlot(index),
+                       IsLoadField(AccessBuilder::ForContextSlotKnownPointer(
+                                       Context::PREVIOUS_INDEX),
+                                   context, effect, graph()->start()),
+                       value, _, control));
     }
   }
 }