[csa] type and separate {Load,Store}{Fixed,Property}ArrayElement

This enables fast bounds checks on FixedArray's.

Change-Id: I0ae57b2c6981d8e1b2c7017ba658fd9c890d2bad
Reviewed-on: https://chromium-review.googlesource.com/1163614
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54946}

src/builtins/builtins-arguments-gen.cc

@@ -305,8 +305,8 @@ Node* ArgumentsBuiltinsAssembler::EmitFastNewSloppyArguments(Node* context,
                                 JSSloppyArgumentsObject::kSize);
     StoreObjectFieldNoWriteBarrier(
         argument_object, JSSloppyArgumentsObject::kCalleeOffset, function);
-    StoreFixedArrayElement(map_array, 0, context, SKIP_WRITE_BARRIER);
-    StoreFixedArrayElement(map_array, 1, elements, SKIP_WRITE_BARRIER);
+    StoreFixedArrayElement(CAST(map_array), 0, context, SKIP_WRITE_BARRIER);
+    StoreFixedArrayElement(CAST(map_array), 1, elements, SKIP_WRITE_BARRIER);
 
     Comment("Fill in non-mapped parameters");
     Node* argument_offset =

src/builtins/builtins-array-gen.cc

@@ -994,8 +994,8 @@ TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
 
     BIND(&fast_elements);
     {
-      Node* value = LoadFixedArrayElement(elements, new_length);
-      StoreFixedArrayElement(elements, new_length, TheHoleConstant());
+      Node* value = LoadFixedArrayElement(CAST(elements), new_length);
+      StoreFixedArrayElement(CAST(elements), new_length, TheHoleConstant());
       GotoIf(WordEqual(value, TheHoleConstant()), &return_undefined);
       args.PopAndReturn(value);
     }
@@ -1194,7 +1194,7 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
         native_context, Context::FAST_ALIASED_ARGUMENTS_MAP_INDEX);
     GotoIf(WordNotEqual(map, fast_aliasted_arguments_map), &try_simple_slice);
 
-    Node* sloppy_elements = LoadElements(array);
+    TNode<SloppyArgumentsElements> sloppy_elements = CAST(LoadElements(array));
     TNode<Smi> sloppy_elements_length =
         LoadFixedArrayBaseLength(sloppy_elements);
     TNode<Smi> parameter_map_length =
@@ -1213,8 +1213,8 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
 
     TNode<Smi> end = SmiAdd(CAST(from), CAST(count));
 
-    Node* unmapped_elements = LoadFixedArrayElement(
-        sloppy_elements, SloppyArgumentsElements::kArgumentsIndex);
+    TNode<FixedArray> unmapped_elements = CAST(LoadFixedArrayElement(
+        sloppy_elements, SloppyArgumentsElements::kArgumentsIndex));
     TNode<Smi> unmapped_elements_length =
         LoadFixedArrayBaseLength(unmapped_elements);
 
@@ -1225,7 +1225,7 @@ class ArrayPrototypeSliceCodeStubAssembler : public CodeStubAssembler {
                                 nullptr, SMI_PARAMETERS));
 
     index_out.Bind(IntPtrConstant(0));
-    Node* result_elements = LoadElements(result.value());
+    TNode<FixedArray> result_elements = CAST(LoadElements(result.value()));
     TNode<Smi> from_mapped = SmiMin(parameter_map_length, CAST(from));
     TNode<Smi> to = SmiMin(parameter_map_length, end);
     Node* arguments_context = LoadFixedArrayElement(
@@ -1595,35 +1595,39 @@ TF_BUILTIN(ArrayPrototypeShift, CodeStubAssembler) {
 
     BIND(&fast_elements_tagged);
     {
-      Node* value = LoadFixedArrayElement(elements, 0);
-      BuildFastLoop(IntPtrConstant(0), new_length,
-                    [&](Node* index) {
-                      StoreFixedArrayElement(
-                          elements, index,
-                          LoadFixedArrayElement(
-                              elements, IntPtrAdd(index, IntPtrConstant(1))));
-                    },
-                    1, ParameterMode::INTPTR_PARAMETERS,
-                    IndexAdvanceMode::kPost);
-      StoreFixedArrayElement(elements, new_length, TheHoleConstant());
+      TNode<FixedArray> elements_fixed_array = CAST(elements);
+      Node* value = LoadFixedArrayElement(elements_fixed_array, 0);
+      BuildFastLoop(
+          IntPtrConstant(0), new_length,
+          [&](Node* index) {
+            StoreFixedArrayElement(
+                elements_fixed_array, index,
+                LoadFixedArrayElement(elements_fixed_array,
+                                      IntPtrAdd(index, IntPtrConstant(1))));
+          },
+          1, ParameterMode::INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
+      StoreFixedArrayElement(elements_fixed_array, new_length,
+                             TheHoleConstant());
       GotoIf(WordEqual(value, TheHoleConstant()), &return_undefined);
       args.PopAndReturn(value);
     }
 
     BIND(&fast_elements_smi);
     {
-      Node* value = LoadFixedArrayElement(elements, 0);
-      BuildFastLoop(IntPtrConstant(0), new_length,
-                    [&](Node* index) {
-                      StoreFixedArrayElement(
-                          elements, index,
-                          LoadFixedArrayElement(
-                              elements, IntPtrAdd(index, IntPtrConstant(1))),
-                          SKIP_WRITE_BARRIER);
-                    },
-                    1, ParameterMode::INTPTR_PARAMETERS,
-                    IndexAdvanceMode::kPost);
-      StoreFixedArrayElement(elements, new_length, TheHoleConstant());
+      TNode<FixedArray> elements_fixed_array = CAST(elements);
+      Node* value = LoadFixedArrayElement(elements_fixed_array, 0);
+      BuildFastLoop(
+          IntPtrConstant(0), new_length,
+          [&](Node* index) {
+            StoreFixedArrayElement(
+                elements_fixed_array, index,
+                LoadFixedArrayElement(elements_fixed_array,
+                                      IntPtrAdd(index, IntPtrConstant(1))),
+                SKIP_WRITE_BARRIER);
+          },
+          1, ParameterMode::INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
+      StoreFixedArrayElement(elements_fixed_array, new_length,
+                             TheHoleConstant());
       GotoIf(WordEqual(value, TheHoleConstant()), &return_undefined);
       args.PopAndReturn(value);
     }
@@ -3090,7 +3094,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
   {
     GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
               &return_not_found);
-    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    Node* element_k = LoadFixedArrayElement(CAST(elements), index_var.value());
     GotoIf(WordEqual(element_k, search_element), &return_found);
 
     Increment(&index_var);
@@ -3102,7 +3106,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
 
     GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
               &return_not_found);
-    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    Node* element_k = LoadFixedArrayElement(CAST(elements), index_var.value());
     GotoIf(IsUndefined(element_k), &return_found);
     GotoIf(IsTheHole(element_k), &return_found);
 
@@ -3121,7 +3125,8 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
       Label continue_loop(this), not_smi(this);
       GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
                 &return_not_found);
-      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+      Node* element_k =
+          LoadFixedArrayElement(CAST(elements), index_var.value());
       GotoIfNot(TaggedIsSmi(element_k), &not_smi);
       Branch(Float64Equal(search_num.value(), SmiToFloat64(element_k)),
              &return_found, &continue_loop);
@@ -3142,7 +3147,8 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
       Label continue_loop(this);
       GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
                 &return_not_found);
-      Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+      Node* element_k =
+          LoadFixedArrayElement(CAST(elements), index_var.value());
       GotoIf(TaggedIsSmi(element_k), &continue_loop);
       GotoIfNot(IsHeapNumber(CAST(element_k)), &continue_loop);
       BranchIfFloat64IsNaN(LoadHeapNumberValue(element_k), &return_found,
@@ -3165,7 +3171,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
     BIND(&next_iteration);
     GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
               &return_not_found);
-    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    Node* element_k = LoadFixedArrayElement(CAST(elements), index_var.value());
     GotoIf(TaggedIsSmi(element_k), &continue_loop);
     GotoIf(WordEqual(search_element_string, element_k), &return_found);
     Node* element_k_type = LoadInstanceType(element_k);
@@ -3193,7 +3199,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
     GotoIfNot(UintPtrLessThan(index_var.value(), array_length_untagged),
               &return_not_found);
 
-    Node* element_k = LoadFixedArrayElement(elements, index_var.value());
+    Node* element_k = LoadFixedArrayElement(CAST(elements), index_var.value());
     Label continue_loop(this);
     GotoIf(TaggedIsSmi(element_k), &continue_loop);
     GotoIfNot(IsBigInt(CAST(element_k)), &continue_loop);
@@ -3575,13 +3581,15 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
 
     BIND(&if_packed);
     {
-      var_value.Bind(LoadFixedArrayElement(elements, index, 0, SMI_PARAMETERS));
+      var_value.Bind(
+          LoadFixedArrayElement(CAST(elements), index, 0, SMI_PARAMETERS));
       Goto(&allocate_entry_if_needed);
     }
 
     BIND(&if_holey);
     {
-      Node* element = LoadFixedArrayElement(elements, index, 0, SMI_PARAMETERS);
+      Node* element =
+          LoadFixedArrayElement(CAST(elements), index, 0, SMI_PARAMETERS);
       var_value.Bind(element);
       GotoIfNot(WordEqual(element, TheHoleConstant()),
                 &allocate_entry_if_needed);
@@ -3725,7 +3733,8 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
                        Int32Constant(static_cast<int>(IterationKind::kValues))),
            &allocate_iterator_result);
 
-    Node* elements = AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
+    TNode<FixedArray> elements =
+        AllocateFixedArray(PACKED_ELEMENTS, IntPtrConstant(2));
     StoreFixedArrayElement(elements, 0, index, SKIP_WRITE_BARRIER);
     StoreFixedArrayElement(elements, 1, var_value.value(), SKIP_WRITE_BARRIER);
 

src/builtins/builtins-array-gen.h

@@ -72,9 +72,9 @@ class ArrayBuiltinsAssembler : public BaseBuiltinsFromDSLAssembler {
   TNode<Object> LoadFixedArrayElementInt(TNode<FixedArray> array, int index) {
     return LoadFixedArrayElement(array, index);
   }
-  Node* StoreFixedArrayElementInt(TNode<FixedArray> array, int index,
-                                  TNode<Object> value) {
-    return StoreFixedArrayElement(array, index, value);
+  void StoreFixedArrayElementInt(TNode<FixedArray> array, int index,
+                                 TNode<Object> value) {
+    StoreFixedArrayElement(array, index, value);
   }
 
  protected:

src/builtins/builtins-constructor-gen.cc

@@ -233,7 +233,8 @@ Node* ConstructorBuiltinsAssembler::EmitFastNewFunctionContext(
   Node* size = GetFixedArrayAllocationSize(length, PACKED_ELEMENTS, mode);
 
   // Create a new closure from the given function info in new space
-  Node* function_context = AllocateInNewSpace(size);
+  TNode<Context> function_context =
+      UncheckedCast<Context>(AllocateInNewSpace(size));
 
   Heap::RootListIndex context_type;
   switch (scope_type) {

src/builtins/builtins-conversion-gen.cc

@@ -376,7 +376,7 @@ TF_BUILTIN(ToObject, CodeStubAssembler) {
   Goto(&if_wrapjsvalue);
 
   BIND(&if_wrapjsvalue);
-  Node* native_context = LoadNativeContext(context);
+  TNode<Context> native_context = LoadNativeContext(context);
   Node* constructor = LoadFixedArrayElement(
       native_context, constructor_function_index_var.value());
   Node* initial_map =

src/builtins/builtins-function-gen.cc

@@ -123,8 +123,8 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
     GotoIf(Uint32LessThanOrEqual(argc, Int32Constant(1)), &empty_arguments);
     TNode<IntPtrT> elements_length =
         Signed(ChangeUint32ToWord(Unsigned(Int32Sub(argc, Int32Constant(1)))));
-    Node* elements = AllocateFixedArray(PACKED_ELEMENTS, elements_length,
-                                        kAllowLargeObjectAllocation);
+    TNode<FixedArray> elements = AllocateFixedArray(
+        PACKED_ELEMENTS, elements_length, kAllowLargeObjectAllocation);
     VARIABLE(index, MachineType::PointerRepresentation());
     index.Bind(IntPtrConstant(0));
     VariableList foreach_vars({&index}, zone());

src/builtins/builtins-internal-gen.cc

@@ -100,7 +100,7 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
     BIND(&if_notempty);
     {
       // Allocate a FixedArray in new space.
-      Node* result = AllocateFixedArray(kind, length);
+      TNode<FixedArray> result = AllocateFixedArray(kind, length);
 
       // The elements might be used to back mapped arguments. In that case fill
       // the mapped elements (i.e. the first {mapped_count}) with the hole, but
@@ -109,14 +109,13 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
       Node* the_hole = TheHoleConstant();
 
       // Fill the first elements up to {number_of_holes} with the hole.
-      VARIABLE(var_index, MachineType::PointerRepresentation());
+      TVARIABLE(IntPtrT, var_index, IntPtrConstant(0));
       Label loop1(this, &var_index), done_loop1(this);
-      var_index.Bind(IntPtrConstant(0));
       Goto(&loop1);
       BIND(&loop1);
       {
         // Load the current {index}.
-        Node* index = var_index.value();
+        TNode<IntPtrT> index = var_index.value();
 
         // Check if we are done.
         GotoIf(WordEqual(index, number_of_holes), &done_loop1);
@@ -125,13 +124,13 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
         StoreFixedArrayElement(result, index, the_hole, SKIP_WRITE_BARRIER);
 
         // Continue with next {index}.
-        var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
+        var_index = IntPtrAdd(index, IntPtrConstant(1));
         Goto(&loop1);
       }
       BIND(&done_loop1);
 
       // Compute the effective {offset} into the {frame}.
-      Node* offset = IntPtrAdd(length, IntPtrConstant(1));
+      TNode<IntPtrT> offset = IntPtrAdd(length, IntPtrConstant(1));
 
       // Copy the parameters from {frame} (starting at {offset}) to {result}.
       Label loop2(this, &var_index), done_loop2(this);
@@ -139,20 +138,21 @@ TF_BUILTIN(NewArgumentsElements, CodeStubAssembler) {
       BIND(&loop2);
       {
         // Load the current {index}.
-        Node* index = var_index.value();
+        TNode<IntPtrT> index = var_index.value();
 
         // Check if we are done.
         GotoIf(WordEqual(index, length), &done_loop2);
 
         // Load the parameter at the given {index}.
-        Node* value = Load(MachineType::AnyTagged(), frame,
-                           TimesPointerSize(IntPtrSub(offset, index)));
+        TNode<Object> value =
+            CAST(Load(MachineType::AnyTagged(), frame,
+                      TimesPointerSize(IntPtrSub(offset, index))));
 
         // Store the {value} into the {result}.
         StoreFixedArrayElement(result, index, value, SKIP_WRITE_BARRIER);
 
         // Continue with next {index}.
-        var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
+        var_index = IntPtrAdd(index, IntPtrConstant(1));
         Goto(&loop2);
       }
       BIND(&done_loop2);

src/builtins/builtins-object-gen.cc

@@ -361,8 +361,8 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
         std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
             PACKED_ELEMENTS, array_map, SmiConstant(2), nullptr,
             IntPtrConstant(2));
-        StoreFixedArrayElement(elements, 0, next_key, SKIP_WRITE_BARRIER);
-        StoreFixedArrayElement(elements, 1, value, SKIP_WRITE_BARRIER);
+        StoreFixedArrayElement(CAST(elements), 0, next_key, SKIP_WRITE_BARRIER);
+        StoreFixedArrayElement(CAST(elements), 1, value, SKIP_WRITE_BARRIER);
         value = TNode<JSArray>::UncheckedCast(array);
       }
 

src/builtins/builtins-regexp-gen.cc

@@ -172,12 +172,12 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
   Label named_captures(this), out(this);
 
   TNode<IntPtrT> num_indices = SmiUntag(CAST(LoadFixedArrayElement(
-      match_info, RegExpMatchInfo::kNumberOfCapturesIndex)));
+      CAST(match_info), RegExpMatchInfo::kNumberOfCapturesIndex)));
   TNode<Smi> const num_results = SmiTag(WordShr(num_indices, 1));
-  Node* const start =
-      LoadFixedArrayElement(match_info, RegExpMatchInfo::kFirstCaptureIndex);
+  Node* const start = LoadFixedArrayElement(
+      CAST(match_info), RegExpMatchInfo::kFirstCaptureIndex);
   Node* const end = LoadFixedArrayElement(
-      match_info, RegExpMatchInfo::kFirstCaptureIndex + 1);
+      CAST(match_info), RegExpMatchInfo::kFirstCaptureIndex + 1);
 
   // Calculate the substring of the first match before creating the result array
   // to avoid an unnecessary write barrier storing the first result.
@@ -187,7 +187,7 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
 
   Node* const result =
       AllocateRegExpResult(context, num_results, start, string);
-  Node* const result_elements = LoadElements(result);
+  TNode<FixedArray> const result_elements = CAST(LoadElements(result));
 
   StoreFixedArrayElement(result_elements, 0, first, SKIP_WRITE_BARRIER);
 
@@ -212,13 +212,14 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     Node* const from_cursor = var_from_cursor.value();
     Node* const to_cursor = var_to_cursor.value();
     TNode<Smi> const start =
-        CAST(LoadFixedArrayElement(match_info, from_cursor));
+        CAST(LoadFixedArrayElement(CAST(match_info), from_cursor));
 
     Label next_iter(this);
     GotoIf(SmiEqual(start, SmiConstant(-1)), &next_iter);
 
     Node* const from_cursor_plus1 = IntPtrAdd(from_cursor, IntPtrConstant(1));
-    Node* const end = LoadFixedArrayElement(match_info, from_cursor_plus1);
+    Node* const end =
+        LoadFixedArrayElement(CAST(match_info), from_cursor_plus1);
 
     TNode<String> const capture =
         CAST(CallBuiltin(Builtins::kSubString, context, string, start, end));
@@ -243,7 +244,8 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(
     // Preparations for named capture properties. Exit early if the result does
     // not have any named captures to minimize performance impact.
 
-    Node* const data = LoadObjectField(regexp, JSRegExp::kDataOffset);
+    TNode<FixedArray> const data =
+        CAST(LoadObjectField(regexp, JSRegExp::kDataOffset));
     CSA_ASSERT(this,
                SmiEqual(CAST(LoadFixedArrayElement(data, JSRegExp::kTagIndex)),
                         SmiConstant(JSRegExp::IRREGEXP)));
@@ -762,7 +764,7 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpPrototypeExecBodyWithoutResult(
 
     // Update the new last index from {match_indices}.
     TNode<Number> new_lastindex = CAST(LoadFixedArrayElement(
-        match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1));
+        CAST(match_indices), RegExpMatchInfo::kFirstCaptureIndex + 1));
 
     StoreLastIndex(context, regexp, new_lastindex, is_fastpath);
     Goto(&out);
@@ -1009,16 +1011,15 @@ TF_BUILTIN(RegExpExecAtom, RegExpBuiltinsAssembler) {
   Node* const regexp = Parameter(Descriptor::kRegExp);
   Node* const subject_string = Parameter(Descriptor::kString);
   Node* const last_index = Parameter(Descriptor::kLastIndex);
-  Node* const match_info = Parameter(Descriptor::kMatchInfo);
+  TNode<FixedArray> const match_info = CAST(Parameter(Descriptor::kMatchInfo));
   Node* const context = Parameter(Descriptor::kContext);
 
   CSA_ASSERT(this, IsJSRegExp(regexp));
   CSA_ASSERT(this, IsString(subject_string));
   CSA_ASSERT(this, TaggedIsPositiveSmi(last_index));
-  CSA_ASSERT(this, IsFixedArray(match_info));
 
-  Node* const data = LoadObjectField(regexp, JSRegExp::kDataOffset);
-  CSA_ASSERT(this, IsFixedArray(data));
+  TNode<FixedArray> const data =
+      CAST(LoadObjectField(regexp, JSRegExp::kDataOffset));
   CSA_ASSERT(this,
              SmiEqual(CAST(LoadFixedArrayElement(data, JSRegExp::kTagIndex)),
                       SmiConstant(JSRegExp::ATOM)));
@@ -1907,8 +1908,9 @@ void RegExpBuiltinsAssembler::RegExpPrototypeMatchBody(Node* const context,
       if (is_fastpath) {
         // On the fast path, grab the matching string from the raw match index
         // array.
-        TNode<HeapObject> match_indices = RegExpPrototypeExecBodyWithoutResult(
-            CAST(context), CAST(regexp), string, &if_didnotmatch, true);
+        TNode<FixedArray> match_indices =
+            CAST(RegExpPrototypeExecBodyWithoutResult(
+                CAST(context), CAST(regexp), string, &if_didnotmatch, true));
 
         Node* const match_from = LoadFixedArrayElement(
             match_indices, RegExpMatchInfo::kFirstCaptureIndex);
@@ -2212,8 +2214,8 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSearchBodyFast(
 
   // Call exec.
   Label if_didnotmatch(this);
-  TNode<HeapObject> match_indices = RegExpPrototypeExecBodyWithoutResult(
-      CAST(context), CAST(regexp), CAST(string), &if_didnotmatch, true);
+  TNode<FixedArray> match_indices = CAST(RegExpPrototypeExecBodyWithoutResult(
+      CAST(context), CAST(regexp), CAST(string), &if_didnotmatch, true));
 
   // Successful match.
   {
@@ -2397,7 +2399,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
         Node* const result = AllocateJSArray(kind, array_map, capacity, length,
                                              allocation_site, mode);
 
-        Node* const fixed_array = LoadElements(result);
+        TNode<FixedArray> const fixed_array = CAST(LoadElements(result));
         StoreFixedArrayElement(fixed_array, 0, string);
 
         Return(result);
@@ -2439,17 +2441,18 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(Node* const context,
     Node* const last_match_info = LoadContextElement(
         native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
 
-    Node* const match_indices =
-        CallBuiltin(Builtins::kRegExpExecInternal, context, regexp, string,
-                    next_search_from, last_match_info);
+    TNode<HeapObject> const match_indices_ho =
+        CAST(CallBuiltin(Builtins::kRegExpExecInternal, context, regexp, string,
+                         next_search_from, last_match_info));
 
     // We're done if no match was found.
     {
       Label next(this);
-      Branch(IsNull(match_indices), &push_suffix_and_out, &next);
+      Branch(IsNull(match_indices_ho), &push_suffix_and_out, &next);
       BIND(&next);
     }
 
+    TNode<FixedArray> match_indices = CAST(match_indices_ho);
     TNode<Smi> const match_from = CAST(LoadFixedArrayElement(
         match_indices, RegExpMatchInfo::kFirstCaptureIndex));
 
@@ -2704,8 +2707,8 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
   }
 
   // Call into runtime for RegExpExecMultiple.
-  Node* last_match_info =
-      LoadContextElement(native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
+  TNode<FixedArray> last_match_info = CAST(LoadContextElement(
+      native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
   Node* const res = CallRuntime(Runtime::kRegExpExecMultiple, context, regexp,
                                 string, last_match_info, result_array);
 
@@ -2717,12 +2720,11 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
   GotoIf(IsNull(res), &out);
 
   // Reload last match info since it might have changed.
-  last_match_info =
-      LoadContextElement(native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX);
+  last_match_info = CAST(LoadContextElement(
+      native_context, Context::REGEXP_LAST_MATCH_INFO_INDEX));
 
   Node* const res_length = LoadJSArrayLength(res);
-  Node* const res_elems = LoadElements(res);
-  CSA_ASSERT(this, HasInstanceType(res_elems, FIXED_ARRAY_TYPE));
+  TNode<FixedArray> const res_elems = CAST(LoadElements(res));
 
   TNode<Smi> const num_capture_registers = CAST(LoadFixedArrayElement(
       last_match_info, RegExpMatchInfo::kNumberOfCapturesIndex));
@@ -2887,7 +2889,6 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
   const bool kIsFastPath = true;
 
   TVARIABLE(String, var_result, EmptyStringConstant());
-  VARIABLE(var_match_indices, MachineRepresentation::kTagged);
   VARIABLE(var_last_match_end, MachineRepresentation::kTagged, SmiZero());
   VARIABLE(var_is_unicode, MachineRepresentation::kWord32, Int32Constant(0));
   Variable* vars[] = {&var_result, &var_last_match_end};
@@ -2904,16 +2905,17 @@ Node* RegExpBuiltinsAssembler::ReplaceSimpleStringFastPath(
 
   BIND(&loop);
   {
-    var_match_indices.Bind(RegExpPrototypeExecBodyWithoutResult(
-        CAST(context), CAST(regexp), string, &if_nofurthermatches,
-        kIsFastPath));
+    TNode<FixedArray> var_match_indices =
+        CAST(RegExpPrototypeExecBodyWithoutResult(CAST(context), CAST(regexp),
+                                                  string, &if_nofurthermatches,
+                                                  kIsFastPath));
 
     // Successful match.
     {
       TNode<Smi> const match_start = CAST(LoadFixedArrayElement(
-          var_match_indices.value(), RegExpMatchInfo::kFirstCaptureIndex));
+          var_match_indices, RegExpMatchInfo::kFirstCaptureIndex));
       TNode<Smi> const match_end = CAST(LoadFixedArrayElement(
-          var_match_indices.value(), RegExpMatchInfo::kFirstCaptureIndex + 1));
+          var_match_indices, RegExpMatchInfo::kFirstCaptureIndex + 1));
 
       TNode<Smi> const replace_length = LoadStringLengthAsSmi(replace_string);
 
@@ -3242,8 +3244,8 @@ TF_BUILTIN(RegExpStringIteratorPrototypeNext, RegExpStringIteratorAssembler) {
         CSA_ASSERT(this,
                    SmiNotEqual(LoadFastJSArrayLength(CAST(var_match.value())),
                                SmiZero()));
-        TNode<FixedArrayBase> result_fixed_array =
-            LoadElements(CAST(var_match.value()));
+        TNode<FixedArray> result_fixed_array =
+            CAST(LoadElements(CAST(var_match.value())));
         TNode<String> match_str =
             CAST(LoadFixedArrayElement(result_fixed_array, 0));
 

src/builtins/builtins-string-gen.cc

@@ -1951,7 +1951,7 @@ TF_BUILTIN(StringPrototypeSplit, StringBuiltinsAssembler) {
     Node* const capacity = IntPtrConstant(1);
     Node* const result = AllocateJSArray(kind, array_map, capacity, length);
 
-    Node* const fixed_array = LoadElements(result);
+    TNode<FixedArray> const fixed_array = CAST(LoadElements(result));
     StoreFixedArrayElement(fixed_array, 0, subject_string);
 
     args.PopAndReturn(result);

src/code-stub-assembler.h

@@ -970,11 +970,11 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
 
   // Load an array element from a FixedArray.
   TNode<Object> LoadFixedArrayElement(
-      SloppyTNode<HeapObject> object, Node* index, int additional_offset = 0,
+      TNode<FixedArray> object, Node* index, int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
 
-  TNode<Object> LoadFixedArrayElement(SloppyTNode<HeapObject> object,
+  TNode<Object> LoadFixedArrayElement(TNode<FixedArray> object,
                                       TNode<IntPtrT> index,
                                       LoadSensitivity needs_poisoning) {
     return LoadFixedArrayElement(object, index, 0, INTPTR_PARAMETERS,
@@ -982,21 +982,20 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   }
 
   TNode<Object> LoadFixedArrayElement(
-      SloppyTNode<HeapObject> object, TNode<IntPtrT> index,
-      int additional_offset = 0,
+      TNode<FixedArray> object, TNode<IntPtrT> index, int additional_offset = 0,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     return LoadFixedArrayElement(object, index, additional_offset,
                                  INTPTR_PARAMETERS, needs_poisoning);
   }
 
   TNode<Object> LoadFixedArrayElement(
-      SloppyTNode<HeapObject> object, int index, int additional_offset = 0,
+      TNode<FixedArray> object, int index, int additional_offset = 0,
       LoadSensitivity needs_poisoning = LoadSensitivity::kSafe) {
     return LoadFixedArrayElement(object, IntPtrConstant(index),
                                  additional_offset, INTPTR_PARAMETERS,
                                  needs_poisoning);
   }
-  TNode<Object> LoadFixedArrayElement(TNode<HeapObject> object,
+  TNode<Object> LoadFixedArrayElement(TNode<FixedArray> object,
                                       TNode<Smi> index) {
     return LoadFixedArrayElement(object, index, 0, SMI_PARAMETERS);
   }
@@ -1142,8 +1141,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* StoreObjectFieldRoot(Node* object, int offset,
                              Heap::RootListIndex root);
   // Store an array element to a FixedArray.
-  Node* StoreFixedArrayElement(
-      Node* object, int index, Node* value,
+  void StoreFixedArrayElement(
+      TNode<FixedArray> object, int index, SloppyTNode<Object> value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER) {
     return StoreFixedArrayElement(object, IntPtrConstant(index), value,
                                   barrier_mode);
@@ -1152,17 +1151,35 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* StoreJSArrayLength(TNode<JSArray> array, TNode<Smi> length);
   Node* StoreElements(TNode<Object> object, TNode<FixedArrayBase> elements);
 
-  Node* StoreFixedArrayElement(
-      Node* object, Node* index, Node* value,
+  void StoreFixedArrayOrPropertyArrayElement(
+      Node* array, Node* index, Node* value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
       int additional_offset = 0,
       ParameterMode parameter_mode = INTPTR_PARAMETERS);
 
-  Node* StoreFixedArrayElementSmi(
-      TNode<FixedArray> object, TNode<Smi> index, TNode<Object> value,
+  void StoreFixedArrayElement(
+      TNode<FixedArray> array, Node* index, SloppyTNode<Object> value,
+      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
+      int additional_offset = 0,
+      ParameterMode parameter_mode = INTPTR_PARAMETERS) {
+    StoreFixedArrayOrPropertyArrayElement(array, index, value, barrier_mode,
+                                          additional_offset, parameter_mode);
+  }
+
+  void StorePropertyArrayElement(
+      TNode<PropertyArray> array, Node* index, SloppyTNode<Object> value,
+      WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,
+      int additional_offset = 0,
+      ParameterMode parameter_mode = INTPTR_PARAMETERS) {
+    StoreFixedArrayOrPropertyArrayElement(array, index, value, barrier_mode,
+                                          additional_offset, parameter_mode);
+  }
+
+  void StoreFixedArrayElementSmi(
+      TNode<FixedArray> array, TNode<Smi> index, TNode<Object> value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER) {
-    return StoreFixedArrayElement(object, index, value, barrier_mode, 0,
-                                  SMI_PARAMETERS);
+    StoreFixedArrayElement(array, index, value, barrier_mode, 0,
+                           SMI_PARAMETERS);
   }
 
   Node* StoreFixedDoubleArrayElement(
@@ -2083,8 +2100,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     const int kKeyToDetailsOffset =
         (ContainerType::kEntryDetailsIndex - ContainerType::kEntryKeyIndex) *
         kPointerSize;
-    return Unsigned(LoadAndUntagToWord32FixedArrayElement(container, key_index,
-                                                          kKeyToDetailsOffset));
+    return Unsigned(LoadAndUntagToWord32FixedArrayElement(
+        CAST(container), key_index, kKeyToDetailsOffset));
   }
 
   // Loads the value for the entry with the given key_index.
@@ -2096,8 +2113,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     const int kKeyToValueOffset =
         (ContainerType::kEntryValueIndex - ContainerType::kEntryKeyIndex) *
         kPointerSize;
-    return UncheckedCast<Object>(
-        LoadFixedArrayElement(container, key_index, kKeyToValueOffset));
+    return LoadFixedArrayElement(CAST(container), key_index, kKeyToValueOffset);
   }
 
   TNode<Uint32T> LoadDetailsByKeyIndex(TNode<DescriptorArray> container,
@@ -2110,7 +2126,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Stores the details for the entry with the given key_index.
   // |details| must be a Smi.
   template <class ContainerType>
-  void StoreDetailsByKeyIndex(Node* container, Node* key_index, Node* details) {
+  void StoreDetailsByKeyIndex(TNode<ContainerType> container,
+                              TNode<IntPtrT> key_index, TNode<Smi> details) {
     const int kKeyToDetailsOffset =
         (ContainerType::kEntryDetailsIndex - ContainerType::kEntryKeyIndex) *
         kPointerSize;
@@ -2121,7 +2138,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Stores the value for the entry with the given key_index.
   template <class ContainerType>
   void StoreValueByKeyIndex(
-      Node* container, Node* key_index, Node* value,
+      TNode<ContainerType> container, TNode<IntPtrT> key_index,
+      TNode<Object> value,
       WriteBarrierMode write_barrier = UPDATE_WRITE_BARRIER) {
     const int kKeyToValueOffset =
         (ContainerType::kEntryValueIndex - ContainerType::kEntryKeyIndex) *

src/compiler/code-assembler.h

@@ -671,12 +671,12 @@ class V8_EXPORT_PRIVATE CodeAssembler {
     return TNode<T>::UncheckedCast(value);
   }
 
-  CheckedNode<Object, false> Cast(Node* value, const char* location) {
+  CheckedNode<Object, false> Cast(Node* value, const char* location = "") {
     return {value, this, location};
   }
 
   template <class T>
-  CheckedNode<T, true> Cast(TNode<T> value, const char* location) {
+  CheckedNode<T, true> Cast(TNode<T> value, const char* location = "") {
     return {value, this, location};
   }
 
@@ -686,7 +686,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
 #define CAST(x) \
   Cast(x, "CAST(" #x ") at " __FILE__ ":" TO_STRING_LITERAL(__LINE__))
 #else
-#define CAST(x) Cast(x, "")
+#define CAST(x) Cast(x)
 #endif
 
 #ifdef DEBUG

src/ic/accessor-assembler.cc

@@ -579,8 +579,8 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
     Node* module =
         LoadObjectField(p->receiver, JSModuleNamespace::kModuleOffset,
                         MachineType::TaggedPointer());
-    Node* exports = LoadObjectField(module, Module::kExportsOffset,
-                                    MachineType::TaggedPointer());
+    TNode<ObjectHashTable> exports = CAST(LoadObjectField(
+        module, Module::kExportsOffset, MachineType::TaggedPointer()));
     Node* cell = LoadFixedArrayElement(exports, index);
     // The handler is only installed for exports that exist.
     CSA_ASSERT(this, IsCell(cell));
@@ -1147,16 +1147,16 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
           BIND(&cont);
         }
 
-        Node* properties =
-            ExtendPropertiesBackingStore(object, backing_store_index);
-        StoreFixedArrayElement(properties, backing_store_index,
-                               var_value.value());
+        TNode<PropertyArray> properties =
+            CAST(ExtendPropertiesBackingStore(object, backing_store_index));
+        StorePropertyArrayElement(properties, backing_store_index,
+                                  var_value.value());
         StoreMap(object, object_map);
         Goto(&done);
 
       } else {
         Label tagged_rep(this), double_rep(this);
-        Node* properties = LoadFastProperties(object);
+        TNode<PropertyArray> properties = CAST(LoadFastProperties(object));
         Branch(
             Word32Equal(representation, Int32Constant(Representation::kDouble)),
             &double_rep, &tagged_rep);
@@ -1170,7 +1170,7 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
         }
         BIND(&tagged_rep);
         {
-          StoreFixedArrayElement(properties, backing_store_index, value);
+          StorePropertyArrayElement(properties, backing_store_index, value);
           Goto(&done);
         }
       }
@@ -1267,7 +1267,8 @@ void AccessorAssembler::HandleStoreICProtoHandler(
         STATIC_ASSERT(kData == 0);
         GotoIf(IsSetWord32(details, kTypeAndReadOnlyMask), miss);
 
-        StoreValueByKeyIndex<NameDictionary>(properties, name_index, p->value);
+        StoreValueByKeyIndex<NameDictionary>(
+            CAST(properties), UncheckedCast<IntPtrT>(name_index), p->value);
         Return(p->value);
       },
       miss, ic_mode);
@@ -1768,13 +1769,13 @@ void AccessorAssembler::EmitElementLoad(
   BIND(&if_fast_packed);
   {
     Comment("fast packed elements");
-    exit_point->Return(LoadFixedArrayElement(elements, intptr_index));
+    exit_point->Return(LoadFixedArrayElement(CAST(elements), intptr_index));
   }
 
   BIND(&if_fast_holey);
   {
     Comment("fast holey elements");
-    Node* element = LoadFixedArrayElement(elements, intptr_index);
+    Node* element = LoadFixedArrayElement(CAST(elements), intptr_index);
     GotoIf(WordEqual(element, TheHoleConstant()), if_hole);
     exit_point->Return(element);
   }

src/interpreter/interpreter-assembler.cc

@@ -647,8 +647,8 @@ Node* InterpreterAssembler::BytecodeOperandIntrinsicId(int operand_index) {
 }
 
 Node* InterpreterAssembler::LoadConstantPoolEntry(Node* index) {
-  Node* constant_pool = LoadObjectField(BytecodeArrayTaggedPointer(),
-                                        BytecodeArray::kConstantPoolOffset);
+  TNode<FixedArray> constant_pool = CAST(LoadObjectField(
+      BytecodeArrayTaggedPointer(), BytecodeArray::kConstantPoolOffset));
   return LoadFixedArrayElement(constant_pool, UncheckedCast<IntPtrT>(index),
                                LoadSensitivity::kCritical);
 }
@@ -1599,16 +1599,18 @@ void InterpreterAssembler::AbortIfRegisterCountInvalid(
 }
 
 Node* InterpreterAssembler::ExportParametersAndRegisterFile(
-    Node* array, const RegListNodePair& registers,
-    Node* formal_parameter_count) {
+    TNode<FixedArray> array, const RegListNodePair& registers,
+    TNode<Int32T> formal_parameter_count) {
   // Store the formal parameters (without receiver) followed by the
   // registers into the generator's internal parameters_and_registers field.
-  formal_parameter_count = ChangeInt32ToIntPtr(formal_parameter_count);
+  TNode<IntPtrT> formal_parameter_count_intptr =
+      ChangeInt32ToIntPtr(formal_parameter_count);
   Node* register_count = ChangeUint32ToWord(registers.reg_count());
   if (FLAG_debug_code) {
     CSA_ASSERT(this, IntPtrEqual(registers.base_reg_location(),
                                  RegisterLocation(Register(0))));
-    AbortIfRegisterCountInvalid(array, formal_parameter_count, register_count);
+    AbortIfRegisterCountInvalid(array, formal_parameter_count_intptr,
+                                register_count);
   }
 
   {
@@ -1620,13 +1622,14 @@ Node* InterpreterAssembler::ExportParametersAndRegisterFile(
 
     Node* reg_base = IntPtrAdd(
         IntPtrConstant(Register::FromParameterIndex(0, 1).ToOperand() - 1),
-        formal_parameter_count);
+        formal_parameter_count_intptr);
 
     Goto(&loop);
     BIND(&loop);
     {
       Node* index = var_index.value();
-      GotoIfNot(UintPtrLessThan(index, formal_parameter_count), &done_loop);
+      GotoIfNot(UintPtrLessThan(index, formal_parameter_count_intptr),
+                &done_loop);
 
       Node* reg_index = IntPtrSub(reg_base, index);
       Node* value = LoadRegister(reg_index);
@@ -1657,7 +1660,7 @@ Node* InterpreterAssembler::ExportParametersAndRegisterFile(
           IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
       Node* value = LoadRegister(reg_index);
 
-      Node* array_index = IntPtrAdd(formal_parameter_count, index);
+      Node* array_index = IntPtrAdd(formal_parameter_count_intptr, index);
       StoreFixedArrayElement(array, array_index, value);
 
       var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
@@ -1669,19 +1672,20 @@ Node* InterpreterAssembler::ExportParametersAndRegisterFile(
   return array;
 }
 
-Node* InterpreterAssembler::ImportRegisterFile(Node* array,
-                                               const RegListNodePair& registers,
-                                               Node* formal_parameter_count) {
-  formal_parameter_count = ChangeInt32ToIntPtr(formal_parameter_count);
-  Node* register_count = ChangeUint32ToWord(registers.reg_count());
+Node* InterpreterAssembler::ImportRegisterFile(
+    TNode<FixedArray> array, const RegListNodePair& registers,
+    TNode<Int32T> formal_parameter_count) {
+  TNode<IntPtrT> formal_parameter_count_intptr =
+      ChangeInt32ToIntPtr(formal_parameter_count);
+  TNode<UintPtrT> register_count = ChangeUint32ToWord(registers.reg_count());
   if (FLAG_debug_code) {
     CSA_ASSERT(this, IntPtrEqual(registers.base_reg_location(),
                                  RegisterLocation(Register(0))));
-    AbortIfRegisterCountInvalid(array, formal_parameter_count, register_count);
+    AbortIfRegisterCountInvalid(array, formal_parameter_count_intptr,
+                                register_count);
   }
 
-  Variable var_index(this, MachineType::PointerRepresentation());
-  var_index.Bind(IntPtrConstant(0));
+  TVARIABLE(IntPtrT, var_index, IntPtrConstant(0));
 
   // Iterate over array and write values into register file.  Also erase the
   // array contents to not keep them alive artificially.
@@ -1689,19 +1693,21 @@ Node* InterpreterAssembler::ImportRegisterFile(Node* array,
   Goto(&loop);
   BIND(&loop);
   {
-    Node* index = var_index.value();
+    TNode<IntPtrT> index = var_index.value();
     GotoIfNot(UintPtrLessThan(index, register_count), &done_loop);
 
-    Node* array_index = IntPtrAdd(formal_parameter_count, index);
-    Node* value = LoadFixedArrayElement(array, array_index);
+    TNode<IntPtrT> array_index =
+        IntPtrAdd(formal_parameter_count_intptr, index);
+    TNode<Object> value = LoadFixedArrayElement(array, array_index);
 
-    Node* reg_index = IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
+    TNode<IntPtrT> reg_index =
+        IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
     StoreRegister(value, reg_index);
 
     StoreFixedArrayElement(array, array_index,
                            LoadRoot(Heap::kStaleRegisterRootIndex));
 
-    var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
+    var_index = IntPtrAdd(index, IntPtrConstant(1));
     Goto(&loop);
   }
   BIND(&done_loop);

src/interpreter/interpreter-assembler.h

@@ -103,11 +103,11 @@ class V8_EXPORT_PRIVATE InterpreterAssembler : public CodeStubAssembler {
   // - Resume copies only the registers from the generator, the arguments
   //   are copied by the ResumeGenerator trampoline.
   compiler::Node* ExportParametersAndRegisterFile(
-      compiler::Node* array, const RegListNodePair& registers,
-      compiler::Node* formal_parameter_count);
-  compiler::Node* ImportRegisterFile(compiler::Node* array,
+      TNode<FixedArray> array, const RegListNodePair& registers,
+      TNode<Int32T> formal_parameter_count);
+  compiler::Node* ImportRegisterFile(TNode<FixedArray> array,
                                      const RegListNodePair& registers,
-                                     compiler::Node* formal_parameter_count);
+                                     TNode<Int32T> formal_parameter_count);
 
   // Loads from and stores to the interpreter register file.
   compiler::Node* LoadRegister(Register reg);

src/interpreter/interpreter-generator.cc

@@ -681,8 +681,8 @@ IGNITION_HANDLER(LdaModuleVariable, InterpreterAssembler) {
 
   BIND(&if_export);
   {
-    Node* regular_exports =
-        LoadObjectField(module, Module::kRegularExportsOffset);
+    TNode<FixedArray> regular_exports =
+        CAST(LoadObjectField(module, Module::kRegularExportsOffset));
     // The actual array index is (cell_index - 1).
     Node* export_index = IntPtrSub(cell_index, IntPtrConstant(1));
     Node* cell = LoadFixedArrayElement(regular_exports, export_index);
@@ -692,8 +692,8 @@ IGNITION_HANDLER(LdaModuleVariable, InterpreterAssembler) {
 
   BIND(&if_import);
   {
-    Node* regular_imports =
-        LoadObjectField(module, Module::kRegularImportsOffset);
+    TNode<FixedArray> regular_imports =
+        CAST(LoadObjectField(module, Module::kRegularImportsOffset));
     // The actual array index is (-cell_index - 1).
     Node* import_index = IntPtrSub(IntPtrConstant(-1), cell_index);
     Node* cell = LoadFixedArrayElement(regular_imports, import_index);
@@ -723,8 +723,8 @@ IGNITION_HANDLER(StaModuleVariable, InterpreterAssembler) {
 
   BIND(&if_export);
   {
-    Node* regular_exports =
-        LoadObjectField(module, Module::kRegularExportsOffset);
+    TNode<FixedArray> regular_exports =
+        CAST(LoadObjectField(module, Module::kRegularExportsOffset));
     // The actual array index is (cell_index - 1).
     Node* export_index = IntPtrSub(cell_index, IntPtrConstant(1));
     Node* cell = LoadFixedArrayElement(regular_exports, export_index);
@@ -2932,7 +2932,7 @@ IGNITION_HANDLER(ForInNext, InterpreterAssembler) {
   Node* feedback_vector = LoadFeedbackVector();
 
   // Load the next key from the enumeration array.
-  Node* key = LoadFixedArrayElement(cache_array, index, 0,
+  Node* key = LoadFixedArrayElement(CAST(cache_array), index, 0,
                                     CodeStubAssembler::SMI_PARAMETERS);
 
   // Check if we can use the for-in fast path potentially using the enum cache.
@@ -3025,8 +3025,8 @@ IGNITION_HANDLER(Illegal, InterpreterAssembler) {
 // in the accumulator.
 IGNITION_HANDLER(SuspendGenerator, InterpreterAssembler) {
   Node* generator = LoadRegisterAtOperandIndex(0);
-  Node* array = LoadObjectField(
-      generator, JSGeneratorObject::kParametersAndRegistersOffset);
+  TNode<FixedArray> array = CAST(LoadObjectField(
+      generator, JSGeneratorObject::kParametersAndRegistersOffset));
   Node* closure = LoadRegister(Register::function_closure());
   Node* context = GetContext();
   RegListNodePair registers = GetRegisterListAtOperandIndex(1);
@@ -3034,9 +3034,9 @@ IGNITION_HANDLER(SuspendGenerator, InterpreterAssembler) {
 
   Node* shared =
       LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset);
-  Node* formal_parameter_count =
+  TNode<Int32T> formal_parameter_count = UncheckedCast<Int32T>(
       LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Uint16());
+                      MachineType::Uint16()));
 
   ExportParametersAndRegisterFile(array, registers, formal_parameter_count);
   StoreObjectField(generator, JSGeneratorObject::kContextOffset, context);
@@ -3108,13 +3108,13 @@ IGNITION_HANDLER(ResumeGenerator, InterpreterAssembler) {
 
   Node* shared =
       LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset);
-  Node* formal_parameter_count =
+  TNode<Int32T> formal_parameter_count = UncheckedCast<Int32T>(
       LoadObjectField(shared, SharedFunctionInfo::kFormalParameterCountOffset,
-                      MachineType::Uint16());
+                      MachineType::Uint16()));
 
   ImportRegisterFile(
-      LoadObjectField(generator,
-                      JSGeneratorObject::kParametersAndRegistersOffset),
+      CAST(LoadObjectField(generator,
+                           JSGeneratorObject::kParametersAndRegistersOffset)),
       registers, formal_parameter_count);
 
   // Return the generator's input_or_debug_pos in the accumulator.

test/cctest/compiler/test-code-generator.cc

@@ -83,8 +83,8 @@ Handle<Code> BuildSetupFunction(Isolate* isolate,
   // First allocate the FixedArray which will hold the final results. Here we
   // should take care of all allocations, meaning we allocate HeapNumbers and
   // FixedArrays representing Simd128 values.
-  Node* state_out = __ AllocateFixedArray(PACKED_ELEMENTS,
-                                          __ IntPtrConstant(parameters.size()));
+  TNode<FixedArray> state_out = __ AllocateFixedArray(
+      PACKED_ELEMENTS, __ IntPtrConstant(parameters.size()));
   for (int i = 0; i < static_cast<int>(parameters.size()); i++) {
     switch (parameters[i].representation()) {
       case MachineRepresentation::kTagged:
@@ -94,7 +94,7 @@ Handle<Code> BuildSetupFunction(Isolate* isolate,
         __ StoreFixedArrayElement(state_out, i, __ AllocateHeapNumber());
         break;
       case MachineRepresentation::kSimd128: {
-        Node* vector =
+        TNode<FixedArray> vector =
             __ AllocateFixedArray(PACKED_SMI_ELEMENTS, __ IntPtrConstant(4));
         for (int lane = 0; lane < 4; lane++) {
           __ StoreFixedArrayElement(vector, lane, __ SmiConstant(0));
@@ -109,7 +109,7 @@ Handle<Code> BuildSetupFunction(Isolate* isolate,
   }
   params.push_back(state_out);
   // Then take each element of the initial state and pass them as arguments.
-  Node* state_in = __ Parameter(1);
+  TNode<FixedArray> state_in = __ Cast(__ Parameter(1));
   for (int i = 0; i < static_cast<int>(parameters.size()); i++) {
     Node* element = __ LoadFixedArrayElement(state_in, __ IntPtrConstant(i));
     // Unbox all elements before passing them as arguments.
@@ -197,7 +197,7 @@ Handle<Code> BuildTeardownFunction(Isolate* isolate,
                                    std::vector<AllocatedOperand> parameters) {
   CodeAssemblerTester tester(isolate, call_descriptor, "teardown");
   CodeStubAssembler assembler(tester.state());
-  Node* result_array = __ Parameter(1);
+  TNode<FixedArray> result_array = __ Cast(__ Parameter(1));
   for (int i = 0; i < static_cast<int>(parameters.size()); i++) {
     // The first argument is not used and the second is "result_array".
     Node* param = __ Parameter(i + 2);
@@ -216,7 +216,8 @@ Handle<Code> BuildTeardownFunction(Isolate* isolate,
             param, MachineRepresentation::kFloat64);
         break;
       case MachineRepresentation::kSimd128: {
-        Node* vector = __ LoadFixedArrayElement(result_array, i);
+        TNode<FixedArray> vector =
+            __ Cast(__ LoadFixedArrayElement(result_array, i));
         for (int lane = 0; lane < 4; lane++) {
           Node* lane_value =
               __ SmiFromInt32(tester.raw_assembler_for_testing()->AddNode(

test/cctest/test-code-stub-assembler.cc

@@ -2379,7 +2379,7 @@ TEST(CreatePromiseResolvingFunctions) {
   std::tie(resolve, reject) = m.CreatePromiseResolvingFunctions(
       promise, m.BooleanConstant(false), native_context);
   Node* const kSize = m.IntPtrConstant(2);
-  Node* const arr = m.AllocateFixedArray(PACKED_ELEMENTS, kSize);
+  TNode<FixedArray> const arr = m.AllocateFixedArray(PACKED_ELEMENTS, kSize);
   m.StoreFixedArrayElement(arr, 0, resolve);
   m.StoreFixedArrayElement(arr, 1, reject);
   m.Return(arr);