[CSA] Type CodeStubAssembler::Is* methods

Bug: v8:7570
Change-Id: I74b482b670ce0e78dca012cbe8d9c2f65fdae5b9
Reviewed-on: https://chromium-review.googlesource.com/1030554
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52846}

src/builtins/base.tq

@@ -290,7 +290,8 @@ macro HasPropertyObject(
   }
 }
 
-extern macro IsCallable(Object): bit;
+extern macro IsCallable(HeapObject): bit;
+extern macro TaggedIsCallable(Object): bit;
 extern macro IsDetachedBuffer(JSArrayBuffer): bit;
 
 type ParameterMode;

src/builtins/builtins-array-gen.cc

@@ -1305,7 +1305,7 @@ TF_BUILTIN(ArrayPrototypeSlice, ArrayPrototypeSliceCodeStubAssembler) {
       load_arguments_length(this);
 
   GotoIf(TaggedIsSmi(receiver), &generic_length);
-  GotoIfNot(IsJSArray(receiver), &check_arguments_length);
+  GotoIfNot(IsJSArray(CAST(receiver)), &check_arguments_length);
 
   TNode<JSArray> array_receiver = CAST(receiver);
   o = array_receiver;
@@ -1852,7 +1852,7 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
     TVARIABLE(Object, array);
     Label is_constructor(this), is_not_constructor(this), done(this);
     GotoIf(TaggedIsSmi(receiver), &is_not_constructor);
-    Branch(IsConstructor(receiver), &is_constructor, &is_not_constructor);
+    Branch(IsConstructor(CAST(receiver)), &is_constructor, &is_not_constructor);
 
     BIND(&is_constructor);
     {
@@ -1885,7 +1885,7 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
     Label is_constructor(this), is_not_constructor(this), done(this);
     CSA_ASSERT(this, IsNumberNormalized(length));
     GotoIf(TaggedIsSmi(receiver), &is_not_constructor);
-    Branch(IsConstructor(receiver), &is_constructor, &is_not_constructor);
+    Branch(IsConstructor(CAST(receiver)), &is_constructor, &is_not_constructor);
 
     BIND(&is_constructor);
     {
@@ -1996,7 +1996,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
     Label no_error(this), error(this);
     GotoIf(IsUndefined(map_function), &no_error);
     GotoIf(TaggedIsSmi(map_function), &error);
-    Branch(IsCallable(map_function), &no_error, &error);
+    Branch(IsCallable(CAST(map_function)), &no_error, &error);
 
     BIND(&error);
     ThrowTypeError(context, MessageTemplate::kCalledNonCallable, map_function);
@@ -2033,7 +2033,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
     {
       Label get_method_not_callable(this, Label::kDeferred), next(this);
       GotoIf(TaggedIsSmi(iterator_method), &get_method_not_callable);
-      GotoIfNot(IsCallable(iterator_method), &get_method_not_callable);
+      GotoIfNot(IsCallable(CAST(iterator_method)), &get_method_not_callable);
       Goto(&next);
 
       BIND(&get_method_not_callable);
@@ -2073,7 +2073,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
         Label next(this);
         GotoIf(IsUndefined(map_function), &next);
 
-        CSA_ASSERT(this, IsCallable(map_function));
+        CSA_ASSERT(this, IsCallable(CAST(map_function)));
         Node* v = CallJS(CodeFactory::Call(isolate()), context, map_function,
                          this_arg, value.value(), index.value());
         GotoIfException(v, &on_exception, &var_exception);
@@ -2149,7 +2149,7 @@ TF_BUILTIN(ArrayFrom, ArrayPopulatorAssembler) {
         Label next(this);
         GotoIf(IsUndefined(map_function), &next);
 
-        CSA_ASSERT(this, IsCallable(map_function));
+        CSA_ASSERT(this, IsCallable(CAST(map_function)));
         value = CAST(CallJS(CodeFactory::Call(isolate()), context, map_function,
                             this_arg, value.value(), index.value()));
         Goto(&next);
@@ -3191,7 +3191,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
                 &return_not_found);
       Node* element_k = LoadFixedArrayElement(elements, index_var.value());
       GotoIf(TaggedIsSmi(element_k), &continue_loop);
-      GotoIfNot(IsHeapNumber(element_k), &continue_loop);
+      GotoIfNot(IsHeapNumber(CAST(element_k)), &continue_loop);
       BranchIfFloat64IsNaN(LoadHeapNumberValue(element_k), &return_found,
                            &continue_loop);
 
@@ -3243,7 +3243,7 @@ void ArrayIncludesIndexofAssembler::GenerateSmiOrObject(
     Node* element_k = LoadFixedArrayElement(elements, index_var.value());
     Label continue_loop(this);
     GotoIf(TaggedIsSmi(element_k), &continue_loop);
-    GotoIfNot(IsBigInt(element_k), &continue_loop);
+    GotoIfNot(IsBigInt(CAST(element_k)), &continue_loop);
     TNode<Object> result = CallRuntime(Runtime::kBigIntEqualToBigInt, context,
                                        search_element, element_k);
     Branch(WordEqual(result, TrueConstant()), &return_found, &continue_loop);
@@ -3548,7 +3548,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
   // If O does not have all of the internal slots of an Array Iterator Instance
   // (22.1.5.3), throw a TypeError exception
   GotoIf(TaggedIsSmi(iterator), &throw_bad_receiver);
-  GotoIfNot(IsJSArrayIterator(iterator), &throw_bad_receiver);
+  GotoIfNot(IsJSArrayIterator(CAST(iterator)), &throw_bad_receiver);
 
   // Let a be O.[[IteratedObject]].
   Node* array =

src/builtins/builtins-proxy-gen.cc

@@ -17,7 +17,7 @@ void ProxiesCodeStubAssembler::GotoIfRevokedProxy(Node* object,
                                                   Label* if_proxy_revoked) {
   Label proxy_not_revoked(this);
   GotoIfNot(IsJSProxy(object), &proxy_not_revoked);
-  Branch(IsJSReceiver(LoadObjectField(object, JSProxy::kHandlerOffset)),
+  Branch(IsJSReceiver(CAST(LoadObjectField(object, JSProxy::kHandlerOffset))),
          &proxy_not_revoked, if_proxy_revoked);
   BIND(&proxy_not_revoked);
 }

src/builtins/builtins-regexp-gen.cc

@@ -906,7 +906,7 @@ void RegExpBuiltinsAssembler::BranchIfFastRegExp(Node* const context,
 
   Node* const initial_proto_initial_map =
       LoadContextElement(native_context, Context::REGEXP_PROTOTYPE_MAP_INDEX);
-  Node* const proto_map = LoadMap(CAST(LoadMapPrototype(map)));
+  Node* const proto_map = LoadMap(LoadMapPrototype(map));
   Node* const proto_has_initialmap =
       WordEqual(proto_map, initial_proto_initial_map);
 
@@ -3151,8 +3151,8 @@ TF_BUILTIN(RegExpStringIteratorPrototypeNext, RegExpStringIteratorAssembler) {
   // 1. Let O be the this value.
   // 2. If Type(O) is not Object, throw a TypeError exception.
   GotoIf(TaggedIsSmi(maybe_receiver), &throw_bad_receiver);
-  GotoIfNot(IsJSReceiver(maybe_receiver), &throw_bad_receiver);
   TNode<HeapObject> receiver = CAST(maybe_receiver);
+  GotoIfNot(IsJSReceiver(receiver), &throw_bad_receiver);
 
   // 3. If O does not have all of the internal slots of a RegExp String Iterator
   // Object Instance (see 5.3), throw a TypeError exception.

src/builtins/builtins-string-gen.cc

@@ -1045,7 +1045,7 @@ void StringBuiltinsAssembler::MaybeCallFunctionAtSymbol(
         LoadContextElement(native_context, Context::STRING_FUNCTION_INDEX);
     Node* const initial_map =
         LoadObjectField(string_fun, JSFunction::kPrototypeOrInitialMapOffset);
-    Node* const proto_map = LoadMap(CAST(LoadMapPrototype(initial_map)));
+    Node* const proto_map = LoadMap(LoadMapPrototype(initial_map));
 
     Branch(WordEqual(proto_map, initial_proto_initial_map), &out, &next);
 
@@ -1519,8 +1519,8 @@ TF_BUILTIN(StringPrototypeMatchAll, StringBuiltinsAssembler) {
     auto if_regexp_call = [&] {
       // MaybeCallFunctionAtSymbol guarantees fast path is chosen only if
       // maybe_regexp is a fast regexp and receiver is a string.
-      CSA_ASSERT(this, IsString(receiver));
       var_receiver_string = CAST(receiver);
+      CSA_ASSERT(this, IsString(var_receiver_string.value()));
       var_is_fast_regexp = Int32TrueConstant();
       Goto(&return_match_all_iterator);
     };
@@ -1904,7 +1904,7 @@ TF_BUILTIN(StringPrototypeSubstr, StringBuiltinsAssembler) {
     // two cases according to the spec: if it is negative, "" is returned; if
     // it is positive, then length is set to {string_length} - {start}.
 
-    CSA_ASSERT(this, IsHeapNumber(var_length.value()));
+    CSA_ASSERT(this, IsHeapNumber(CAST(var_length.value())));
 
     Label if_isnegative(this), if_ispositive(this);
     TNode<Float64T> const float_zero = Float64Constant(0.);

src/builtins/builtins-typed-array-gen.cc

@@ -625,10 +625,10 @@ void TypedArrayBuiltinsAssembler::ConstructByArrayLike(
 
 void TypedArrayBuiltinsAssembler::ConstructByIterable(
     TNode<Context> context, TNode<JSTypedArray> holder,
-    TNode<JSReceiver> iterable, TNode<Object> iterator_fn,
+    TNode<JSReceiver> iterable, TNode<JSReceiver> iterator_fn,
     TNode<Smi> element_size) {
-  CSA_ASSERT(this, IsCallable(iterator_fn));
   Label fast_path(this), slow_path(this), done(this);
+  CSA_ASSERT(this, IsCallable(iterator_fn));
 
   TNode<JSArray> array_like = CAST(
       CallBuiltin(Builtins::kIterableToList, context, iterable, iterator_fn));
@@ -669,9 +669,10 @@ TF_BUILTIN(CreateTypedArray, TypedArrayBuiltinsAssembler) {
       SmiTag(GetTypedArrayElementSize(LoadElementsKind(result)));
 
   GotoIf(TaggedIsSmi(arg1), &if_arg1isnumber);
-  GotoIf(IsJSArrayBuffer(arg1), &if_arg1isbuffer);
-  GotoIf(IsJSTypedArray(arg1), &if_arg1istypedarray);
-  GotoIf(IsJSReceiver(arg1), &if_arg1isreceiver);
+  TNode<HeapObject> arg1_heap_object = UncheckedCast<HeapObject>(arg1);
+  GotoIf(IsJSArrayBuffer(arg1_heap_object), &if_arg1isbuffer);
+  GotoIf(IsJSTypedArray(arg1_heap_object), &if_arg1istypedarray);
+  GotoIf(IsJSReceiver(arg1_heap_object), &if_arg1isreceiver);
   Goto(&if_arg1isnumber);
 
   // https://tc39.github.io/ecma262/#sec-typedarray-buffer-byteoffset-length
@@ -685,7 +686,7 @@ TF_BUILTIN(CreateTypedArray, TypedArrayBuiltinsAssembler) {
   // https://tc39.github.io/ecma262/#sec-typedarray-typedarray
   BIND(&if_arg1istypedarray);
   {
-    TNode<JSTypedArray> typed_array = CAST(arg1);
+    TNode<JSTypedArray> typed_array = CAST(arg1_heap_object);
     ConstructByTypedArray(context, result, typed_array, element_size);
     Goto(&return_result);
   }
@@ -695,18 +696,19 @@ TF_BUILTIN(CreateTypedArray, TypedArrayBuiltinsAssembler) {
   {
     Label if_iteratorundefined(this), if_iteratornotcallable(this);
     // Get iterator symbol
-    TNode<Object> iteratorFn =
-        CAST(GetMethod(context, arg1, isolate()->factory()->iterator_symbol(),
-                       &if_iteratorundefined));
+    TNode<Object> iteratorFn = CAST(GetMethod(
+        context, arg1_heap_object, isolate()->factory()->iterator_symbol(),
+        &if_iteratorundefined));
     GotoIf(TaggedIsSmi(iteratorFn), &if_iteratornotcallable);
-    GotoIfNot(IsCallable(iteratorFn), &if_iteratornotcallable);
+    GotoIfNot(IsCallable(CAST(iteratorFn)), &if_iteratornotcallable);
 
-    ConstructByIterable(context, result, CAST(arg1), iteratorFn, element_size);
+    ConstructByIterable(context, result, CAST(arg1_heap_object),
+                        CAST(iteratorFn), element_size);
     Goto(&return_result);
 
     BIND(&if_iteratorundefined);
     {
-      TNode<HeapObject> array_like = CAST(arg1);
+      TNode<HeapObject> array_like = arg1_heap_object;
       TNode<Object> initial_length =
           GetProperty(context, arg1, LengthStringConstant());
 
@@ -914,9 +916,8 @@ TNode<JSTypedArray> TypedArrayBuiltinsAssembler::SpeciesCreateByLength(
   CSA_ASSERT(this, TaggedIsPositiveSmi(len));
 
   // Let constructor be ? SpeciesConstructor(exemplar, defaultConstructor).
-  TNode<Object> constructor = TypedArraySpeciesConstructor(context, exemplar);
-  CSA_ASSERT(this, IsJSFunction(constructor));
-
+  TNode<JSFunction> constructor =
+      CAST(TypedArraySpeciesConstructor(context, exemplar));
   return CreateByLength(context, constructor, len, method_name);
 }
 
@@ -1204,7 +1205,7 @@ TNode<BoolT> TypedArrayBuiltinsAssembler::NumberIsNaN(TNode<Number> value) {
 
   BIND(&is_heapnumber);
   {
-    CSA_ASSERT(this, IsHeapNumber(value));
+    CSA_ASSERT(this, IsHeapNumber(CAST(value)));
 
     TNode<Float64T> value_f = LoadHeapNumberValue(CAST(value));
     result = Float64NotEqual(value_f, value_f);
@@ -1230,7 +1231,7 @@ TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
   // Check the receiver is a typed array.
   TNode<Object> receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &if_receiver_is_not_typedarray);
-  GotoIfNot(IsJSTypedArray(receiver), &if_receiver_is_not_typedarray);
+  GotoIfNot(IsJSTypedArray(CAST(receiver)), &if_receiver_is_not_typedarray);
 
   // Normalize offset argument (using ToInteger) and handle heap number cases.
   TNode<Object> offset = args.GetOptionalArgumentValue(1, SmiConstant(0));
@@ -1256,7 +1257,7 @@ TF_BUILTIN(TypedArrayPrototypeSet, TypedArrayBuiltinsAssembler) {
   Label call_runtime(this);
   TNode<Object> source = args.GetOptionalArgumentValue(0);
   GotoIf(TaggedIsSmi(source), &call_runtime);
-  GotoIf(IsJSTypedArray(source), &if_source_is_typed_array);
+  GotoIf(IsJSTypedArray(CAST(source)), &if_source_is_typed_array);
   BranchIfFastJSArray(source, context, &if_source_is_fast_jsarray,
                       &call_runtime);
 
@@ -1535,7 +1536,7 @@ void TypedArrayBuiltinsAssembler::GenerateTypedArrayPrototypeIterationMethod(
   Label throw_bad_receiver(this, Label::kDeferred);
 
   GotoIf(TaggedIsSmi(receiver), &throw_bad_receiver);
-  GotoIfNot(IsJSTypedArray(receiver), &throw_bad_receiver);
+  GotoIfNot(IsJSTypedArray(CAST(receiver)), &throw_bad_receiver);
 
   // Check if the {receiver}'s JSArrayBuffer was neutered.
   Node* receiver_buffer =
@@ -1596,7 +1597,7 @@ TF_BUILTIN(TypedArrayOf, TypedArrayBuiltinsAssembler) {
   // 4. If IsConstructor(C) is false, throw a TypeError exception.
   TNode<Object> receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
-  GotoIfNot(IsConstructor(receiver), &if_not_constructor);
+  GotoIfNot(IsConstructor(CAST(receiver)), &if_not_constructor);
 
   // 5. Let newObj be ? TypedArrayCreate(C, len).
   TNode<JSTypedArray> new_typed_array =
@@ -1742,7 +1743,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
   // 2. If IsConstructor(C) is false, throw a TypeError exception.
   TNode<Object> receiver = args.GetReceiver();
   GotoIf(TaggedIsSmi(receiver), &if_not_constructor);
-  GotoIfNot(IsConstructor(receiver), &if_not_constructor);
+  GotoIfNot(IsConstructor(CAST(receiver)), &if_not_constructor);
 
   // 3. If mapfn is present and mapfn is not undefined, then
   TNode<Object> map_fn = args.GetOptionalArgumentValue(1);
@@ -1753,7 +1754,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
   //  b. Let mapping be true.
   // 4. Else, let mapping be false.
   GotoIf(TaggedIsSmi(map_fn), &if_map_fn_not_callable);
-  GotoIfNot(IsCallable(map_fn), &if_map_fn_not_callable);
+  GotoIfNot(IsCallable(CAST(map_fn)), &if_map_fn_not_callable);
   mapping = Int32TrueConstant();
   Goto(&check_iterator);
 
@@ -1776,7 +1777,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
         CAST(GetMethod(context, source, isolate()->factory()->iterator_symbol(),
                        &from_array_like));
     GotoIf(TaggedIsSmi(iterator_fn), &if_iterator_fn_not_callable);
-    GotoIfNot(IsCallable(iterator_fn), &if_iterator_fn_not_callable);
+    GotoIfNot(IsCallable(CAST(iterator_fn)), &if_iterator_fn_not_callable);
 
     // We are using the iterator.
     Label if_length_not_smi(this, Label::kDeferred);
@@ -1923,7 +1924,7 @@ TF_BUILTIN(TypedArrayPrototypeFilter, TypedArrayBuiltinsAssembler) {
   // 4. If IsCallable(callbackfn) is false, throw a TypeError exception.
   TNode<Object> callbackfn = args.GetOptionalArgumentValue(0);
   GotoIf(TaggedIsSmi(callbackfn), &if_callback_not_callable);
-  GotoIfNot(IsCallable(callbackfn), &if_callback_not_callable);
+  GotoIfNot(IsCallable(CAST(callbackfn)), &if_callback_not_callable);
 
   // 5. If thisArg is present, let T be thisArg; else let T be undefined.
   TNode<Object> this_arg = args.GetOptionalArgumentValue(1);

src/builtins/builtins-typed-array-gen.h

@@ -45,7 +45,8 @@ class TypedArrayBuiltinsAssembler : public CodeStubAssembler {
                             TNode<JSReceiver> buffer_constructor);
   void ConstructByIterable(TNode<Context> context, TNode<JSTypedArray> holder,
                            TNode<JSReceiver> iterable,
-                           TNode<Object> iterator_fn, TNode<Smi> element_size);
+                           TNode<JSReceiver> iterator_fn,
+                           TNode<Smi> element_size);
 
   void SetupTypedArray(TNode<JSTypedArray> holder, TNode<Smi> length,
                        TNode<Number> byte_offset, TNode<Number> byte_length);

src/builtins/typed-array.tq

@@ -269,8 +269,7 @@ module typed_array {
     // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
     //    throw a TypeError exception.
     let comparefn_obj: Object = arguments.length > 0 ? arguments[0] : undefined;
-    if (comparefn_obj != undefined &&
-        (TaggedIsSmi(comparefn_obj) || !IsCallable(comparefn_obj))) {
+    if (comparefn_obj != undefined && !TaggedIsCallable(comparefn_obj)) {
       ThrowTypeError(context, kBadSortComparisonFunction, comparefn_obj);
     }
 

src/interpreter/interpreter-assembler.cc

@@ -1654,7 +1654,8 @@ Node* InterpreterAssembler::ImportRegisterFile(
     Node* reg_index = IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
     StoreRegister(value, reg_index);
 
-    StoreFixedArrayElement(array, index, StaleRegisterConstant());
+    StoreFixedArrayElement(array, index,
+                           LoadRoot(Heap::kStaleRegisterRootIndex));
 
     var_index.Bind(IntPtrAdd(index, IntPtrConstant(1)));
     Goto(&loop);