[CSA][cleanup] TNodify builtins constructor gen

TNodify:
 * EmitFastNewFunctionContext
 * EmitCreateRegExpLiteral
 * EmitCreateEmptyArrayLiteral
 * EmitCreateEmptyObjectLiteral

Bug: v8:6949, v8:9396
Change-Id: I2a06e0a43feca42cf89d154b8fa9e84573676b4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1793142Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63713}

src/builtins/builtins-constructor-gen.h

@@ -15,21 +15,25 @@ class ConstructorBuiltinsAssembler : public CodeStubAssembler {
   explicit ConstructorBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
-  Node* EmitFastNewFunctionContext(Node* closure, Node* slots, Node* context,
+  TNode<Context> EmitFastNewFunctionContext(TNode<ScopeInfo> scope_info,
+                                            TNode<Uint32T> slots,
+                                            TNode<Context> context,
                                             ScopeType scope_type);
 
-  Node* EmitCreateRegExpLiteral(Node* feedback_vector, Node* slot,
-                                Node* pattern, Node* flags, Node* context);
+  TNode<JSRegExp> EmitCreateRegExpLiteral(
+      TNode<HeapObject> maybe_feedback_vector, TNode<UintPtrT> slot,
+      TNode<Object> pattern, TNode<Smi> flags, TNode<Context> context);
   Node* EmitCreateShallowArrayLiteral(Node* feedback_vector, Node* slot,
                                       Node* context, Label* call_runtime,
                                       AllocationSiteMode allocation_site_mode);
 
-  Node* EmitCreateEmptyArrayLiteral(Node* feedback_vector, Node* slot,
-                                    Node* context);
+  TNode<JSArray> EmitCreateEmptyArrayLiteral(
+      TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot,
+      TNode<Context> context);
 
   Node* EmitCreateShallowObjectLiteral(Node* feedback_vector, Node* slot,
                                        Label* call_runtime);
-  Node* EmitCreateEmptyObjectLiteral(Node* context);
+  TNode<JSObject> EmitCreateEmptyObjectLiteral(TNode<Context> context);
 
   TNode<JSObject> EmitFastNewObject(SloppyTNode<Context> context,
                                     SloppyTNode<JSFunction> target,

src/codegen/interface-descriptors.h

@@ -707,7 +707,7 @@ class FastNewFunctionContextDescriptor : public CallInterfaceDescriptor {
  public:
   DEFINE_PARAMETERS(kScopeInfo, kSlots)
   DEFINE_PARAMETER_TYPES(MachineType::AnyTagged(),  // kScopeInfo
-                         MachineType::Int32())      // kSlots
+                         MachineType::Uint32())     // kSlots
   DECLARE_DESCRIPTOR(FastNewFunctionContextDescriptor, CallInterfaceDescriptor)
 
   static const Register ScopeInfoRegister();

src/interpreter/interpreter-generator.cc

@@ -2459,8 +2459,8 @@ IGNITION_HANDLER(CreateRegExpLiteral, InterpreterAssembler) {
   TVARIABLE(JSRegExp, result);
 
   ConstructorBuiltinsAssembler constructor_assembler(state());
-  result = CAST(constructor_assembler.EmitCreateRegExpLiteral(
-      feedback_vector, slot_id, pattern, flags, context));
+  result = constructor_assembler.EmitCreateRegExpLiteral(
+      feedback_vector, slot_id, pattern, flags, context);
   SetAccumulator(result.value());
   Dispatch();
 }
@@ -2512,17 +2512,17 @@ IGNITION_HANDLER(CreateArrayLiteral, InterpreterAssembler) {
 //
 // Creates an empty JSArray literal for literal index <literal_idx>.
 IGNITION_HANDLER(CreateEmptyArrayLiteral, InterpreterAssembler) {
-  TNode<HeapObject> feedback_vector = LoadFeedbackVector();
+  TNode<HeapObject> maybe_feedback_vector = LoadFeedbackVector();
   TNode<UintPtrT> slot_id = BytecodeOperandIdx(0);
   TNode<Context> context = GetContext();
 
   Label no_feedback(this, Label::kDeferred), end(this);
   TVARIABLE(JSArray, result);
-  GotoIf(IsUndefined(feedback_vector), &no_feedback);
+  GotoIf(IsUndefined(maybe_feedback_vector), &no_feedback);
 
   ConstructorBuiltinsAssembler constructor_assembler(state());
-  result = CAST(constructor_assembler.EmitCreateEmptyArrayLiteral(
-      feedback_vector, slot_id, context));
+  result = constructor_assembler.EmitCreateEmptyArrayLiteral(
+      CAST(maybe_feedback_vector), slot_id, context);
   Goto(&end);
 
   BIND(&no_feedback);
@@ -2608,7 +2608,8 @@ IGNITION_HANDLER(CreateObjectLiteral, InterpreterAssembler) {
 IGNITION_HANDLER(CreateEmptyObjectLiteral, InterpreterAssembler) {
   TNode<Context> context = GetContext();
   ConstructorBuiltinsAssembler constructor_assembler(state());
-  Node* result = constructor_assembler.EmitCreateEmptyObjectLiteral(context);
+  TNode<JSObject> result =
+      constructor_assembler.EmitCreateEmptyObjectLiteral(context);
   SetAccumulator(result);
   Dispatch();
 }

test/mozilla/mozilla.status

@@ -1011,6 +1011,8 @@
 
   #BUG(3837): Crashes due to C stack overflow.
   'js1_5/extensions/regress-355497': [SKIP],
+  # Slow test
+  'js1_5/Regress/regress-80981': [PASS, SLOW],
 }],  # 'arch == arm and simulator_run'
 
 ['arch == arm64 and simulator_run', {