Revert "[CSA][cleanup] TNodify some methods related to prototype and property lookup"

This reverts commit 82111e22.

Reason for revert: Speculative revert, could be causing timeouts - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20debug/17567

Original change's description:
> [CSA][cleanup] TNodify some methods related to prototype and property lookup
> 
> This is a CL in a string of CLs that aims to TNodify CSA. In particular,
> there were some loads that were done in AnyTagged instead of
> TaggedPointer. TNode-ifying them brings improvement in pointer
> compression since we are able to decompress using the Pointer
> decompression.
> 
> TNodified:
>  * LoadJSFunctionPrototype
>  * TryPrototypeChainLookup
>  * OrdinaryHasInstance
> 
> Also TNodified loads regarding:
>  * FeedbackCell::kValueOffset
>  * HeapObject::kMapOffset
>  * JSFunction::kSharedFunctionInfoOffset
>  * JSFunction::kFeedbackCellOffset
>  * Map::kInstanceTypeOffset
>  * Map::kInstanceDescriptorsOffset
>  * Map::kPrototypeOffset
> 
> Drive-by cleanup: StoreJSArrayLength and StoreElements were unused.
> 
> Bug: v8:6949, v8:9396
> Change-Id: I89697b5c02490906be1eee63cf3d9e60a1094d48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1755844
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63216}

TBR=rmcilroy@chromium.org,solanes@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6949, v8:9396
Change-Id: Ib6ae8fe86a598ed1066894595565e1162cf7dd1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758310Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63233}

src/builtins/builtins-handler-gen.cc

@@ -403,7 +403,7 @@ TF_BUILTIN(LoadIC_FunctionPrototype, CodeStubAssembler) {
   Node* context = Parameter(Descriptor::kContext);
 
   Label miss(this, Label::kDeferred);
-  Return(LoadJSFunctionPrototype(CAST(receiver), &miss));
+  Return(LoadJSFunctionPrototype(receiver, &miss));
 
   BIND(&miss);
   TailCallRuntime(Runtime::kLoadIC_Miss, context, receiver, name, slot, vector);

src/codegen/code-stub-assembler.cc

@@ -1464,7 +1464,8 @@ TNode<Map> CodeStubAssembler::GetStructMap(InstanceType instance_type) {
 }
 
 TNode<Map> CodeStubAssembler::LoadMap(SloppyTNode<HeapObject> object) {
-  return LoadObjectField<Map>(object, HeapObject::kMapOffset);
+  return UncheckedCast<Map>(LoadObjectField(object, HeapObject::kMapOffset,
+                                            MachineType::TaggedPointer()));
 }
 
 TNode<Uint16T> CodeStubAssembler::LoadInstanceType(
@@ -1619,7 +1620,8 @@ TNode<Uint32T> CodeStubAssembler::LoadMapBitField3(SloppyTNode<Map> map) {
 }
 
 TNode<Uint16T> CodeStubAssembler::LoadMapInstanceType(SloppyTNode<Map> map) {
-  return LoadObjectField<Uint16T>(map, Map::kInstanceTypeOffset);
+  return UncheckedCast<Uint16T>(
+      LoadObjectField(map, Map::kInstanceTypeOffset, MachineType::Uint16()));
 }
 
 TNode<Int32T> CodeStubAssembler::LoadMapElementsKind(SloppyTNode<Map> map) {
@@ -1636,12 +1638,12 @@ TNode<Int32T> CodeStubAssembler::LoadElementsKind(
 TNode<DescriptorArray> CodeStubAssembler::LoadMapDescriptors(
     SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
-  return LoadObjectField<DescriptorArray>(map, Map::kInstanceDescriptorsOffset);
+  return CAST(LoadObjectField(map, Map::kInstanceDescriptorsOffset));
 }
 
 TNode<HeapObject> CodeStubAssembler::LoadMapPrototype(SloppyTNode<Map> map) {
   CSA_SLOW_ASSERT(this, IsMap(map));
-  return LoadObjectField<HeapObject>(map, Map::kPrototypeOffset);
+  return CAST(LoadObjectField(map, Map::kPrototypeOffset));
 }
 
 TNode<PrototypeInfo> CodeStubAssembler::LoadMapPrototypeInfo(
@@ -2653,8 +2655,7 @@ TNode<Map> CodeStubAssembler::LoadJSArrayElementsMap(
 TNode<BoolT> CodeStubAssembler::IsGeneratorFunction(
     TNode<JSFunction> function) {
   TNode<SharedFunctionInfo> const shared_function_info =
-      LoadObjectField<SharedFunctionInfo>(
-          function, JSFunction::kSharedFunctionInfoOffset);
+      CAST(LoadObjectField(function, JSFunction::kSharedFunctionInfoOffset));
 
   TNode<Uint32T> const function_kind =
       DecodeWord32<SharedFunctionInfo::FunctionKindBits>(LoadObjectField(
@@ -2694,20 +2695,22 @@ void CodeStubAssembler::GotoIfPrototypeRequiresRuntimeLookup(
          runtime);
 }
 
-Node* CodeStubAssembler::LoadJSFunctionPrototype(TNode<JSFunction> function,
+Node* CodeStubAssembler::LoadJSFunctionPrototype(Node* function,
                                                  Label* if_bailout) {
+  CSA_ASSERT(this, TaggedIsNotSmi(function));
+  CSA_ASSERT(this, IsJSFunction(function));
   CSA_ASSERT(this, IsFunctionWithPrototypeSlotMap(LoadMap(function)));
   CSA_ASSERT(this, IsClearWord32<Map::HasNonInstancePrototypeBit>(
                        LoadMapBitField(LoadMap(function))));
-  TNode<HeapObject> proto_or_map = LoadObjectField<HeapObject>(
-      function, JSFunction::kPrototypeOrInitialMapOffset);
+  Node* proto_or_map =
+      LoadObjectField(function, JSFunction::kPrototypeOrInitialMapOffset);
   GotoIf(IsTheHole(proto_or_map), if_bailout);
 
-  TVARIABLE(HeapObject, var_result, proto_or_map);
+  VARIABLE(var_result, MachineRepresentation::kTagged, proto_or_map);
   Label done(this, &var_result);
   GotoIfNot(IsMap(proto_or_map), &done);
 
-  var_result = LoadMapPrototype(CAST(proto_or_map));
+  var_result.Bind(LoadMapPrototype(proto_or_map));
   Goto(&done);
 
   BIND(&done);
@@ -2822,6 +2825,16 @@ void CodeStubAssembler::StoreObjectFieldRoot(Node* object, int offset,
   }
 }
 
+void CodeStubAssembler::StoreJSArrayLength(TNode<JSArray> array,
+                                           TNode<Smi> length) {
+  StoreObjectFieldNoWriteBarrier(array, JSArray::kLengthOffset, length);
+}
+
+void CodeStubAssembler::StoreElements(TNode<Object> object,
+                                      TNode<FixedArrayBase> elements) {
+  StoreObjectField(object, JSObject::kElementsOffset, elements);
+}
+
 void CodeStubAssembler::StoreFixedArrayOrPropertyArrayElement(
     Node* object, Node* index_node, Node* value, WriteBarrierMode barrier_mode,
     int additional_offset, ParameterMode parameter_mode) {
@@ -9596,7 +9609,7 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
 
       GotoIfPrototypeRequiresRuntimeLookup(CAST(receiver), CAST(receiver_map),
                                            if_bailout);
-      var_value.Bind(LoadJSFunctionPrototype(CAST(receiver), if_bailout));
+      var_value.Bind(LoadJSFunctionPrototype(receiver, if_bailout));
       Goto(&done);
     }
 
@@ -9867,8 +9880,8 @@ void CodeStubAssembler::TryPrototypeChainLookup(
   GotoIf(TaggedIsSmi(receiver), if_bailout);
   CSA_ASSERT(this, TaggedIsNotSmi(object));
 
-  TNode<Map> map = LoadMap(object);
-  TNode<Int32T> instance_type = LoadMapInstanceType(map);
+  Node* map = LoadMap(object);
+  Node* instance_type = LoadMapInstanceType(map);
   {
     Label if_objectisreceiver(this);
     STATIC_ASSERT(LAST_JS_RECEIVER_TYPE == LAST_TYPE);
@@ -9889,18 +9902,19 @@ void CodeStubAssembler::TryPrototypeChainLookup(
 
   BIND(&if_iskeyunique);
   {
-    TVARIABLE(HeapObject, var_holder, CAST(object));
-    TVARIABLE(Map, var_holder_map, map);
-    TVARIABLE(Int32T, var_holder_instance_type, instance_type);
+    VARIABLE(var_holder, MachineRepresentation::kTagged, object);
+    VARIABLE(var_holder_map, MachineRepresentation::kTagged, map);
+    VARIABLE(var_holder_instance_type, MachineRepresentation::kWord32,
+             instance_type);
 
-    VariableList merged_variables(
-        {&var_holder, &var_holder_map, &var_holder_instance_type}, zone());
-    Label loop(this, merged_variables);
+    Variable* merged_variables[] = {&var_holder, &var_holder_map,
+                                    &var_holder_instance_type};
+    Label loop(this, arraysize(merged_variables), merged_variables);
     Goto(&loop);
     BIND(&loop);
     {
       Node* holder_map = var_holder_map.value();
-      TNode<Int32T> holder_instance_type = var_holder_instance_type.value();
+      Node* holder_instance_type = var_holder_instance_type.value();
 
       Label next_proto(this), check_integer_indexed_exotic(this);
       lookup_property_in_holder(receiver, var_holder.value(), holder_map,
@@ -9919,28 +9933,29 @@ void CodeStubAssembler::TryPrototypeChainLookup(
 
       BIND(&next_proto);
 
-      TNode<HeapObject> proto = LoadMapPrototype(holder_map);
+      Node* proto = LoadMapPrototype(holder_map);
 
       GotoIf(IsNull(proto), if_end);
 
-      TNode<Map> map = LoadMap(proto);
-      TNode<Int32T> instance_type = LoadMapInstanceType(map);
+      Node* map = LoadMap(proto);
+      Node* instance_type = LoadMapInstanceType(map);
 
-      var_holder = proto;
-      var_holder_map = map;
-      var_holder_instance_type = instance_type;
+      var_holder.Bind(proto);
+      var_holder_map.Bind(map);
+      var_holder_instance_type.Bind(instance_type);
       Goto(&loop);
     }
   }
   BIND(&if_keyisindex);
   {
-    TVARIABLE(HeapObject, var_holder, CAST(object));
-    TVARIABLE(Map, var_holder_map, map);
-    TVARIABLE(Int32T, var_holder_instance_type, instance_type);
+    VARIABLE(var_holder, MachineRepresentation::kTagged, object);
+    VARIABLE(var_holder_map, MachineRepresentation::kTagged, map);
+    VARIABLE(var_holder_instance_type, MachineRepresentation::kWord32,
+             instance_type);
 
-    VariableList merged_variables(
-        {&var_holder, &var_holder_map, &var_holder_instance_type}, zone());
-    Label loop(this, merged_variables);
+    Variable* merged_variables[] = {&var_holder, &var_holder_map,
+                                    &var_holder_instance_type};
+    Label loop(this, arraysize(merged_variables), merged_variables);
     Goto(&loop);
     BIND(&loop);
     {
@@ -9951,16 +9966,16 @@ void CodeStubAssembler::TryPrototypeChainLookup(
                                var_index.value(), &next_proto, if_bailout);
       BIND(&next_proto);
 
-      TNode<HeapObject> proto = LoadMapPrototype(var_holder_map.value());
+      Node* proto = LoadMapPrototype(var_holder_map.value());
 
       GotoIf(IsNull(proto), if_end);
 
-      TNode<Map> map = LoadMap(proto);
-      TNode<Int32T> instance_type = LoadMapInstanceType(map);
+      Node* map = LoadMap(proto);
+      Node* instance_type = LoadMapInstanceType(map);
 
-      var_holder = proto;
-      var_holder_map = map;
-      var_holder_instance_type = instance_type;
+      var_holder.Bind(proto);
+      var_holder_map.Bind(map);
+      var_holder_instance_type.Bind(instance_type);
       Goto(&loop);
     }
   }
@@ -10044,27 +10059,28 @@ Node* CodeStubAssembler::OrdinaryHasInstance(Node* context, Node* callable,
   GotoIf(TaggedIsSmi(callable), &return_runtime);
 
   // Load map of {callable}.
-  TNode<Map> callable_map = LoadMap(callable);
+  Node* callable_map = LoadMap(callable);
 
   // Goto runtime if {callable} is not a JSFunction.
-  TNode<Uint16T> callable_instance_type = LoadMapInstanceType(callable_map);
+  Node* callable_instance_type = LoadMapInstanceType(callable_map);
   GotoIfNot(InstanceTypeEqual(callable_instance_type, JS_FUNCTION_TYPE),
             &return_runtime);
 
-  GotoIfPrototypeRequiresRuntimeLookup(CAST(callable), callable_map,
+  GotoIfPrototypeRequiresRuntimeLookup(CAST(callable), CAST(callable_map),
                                        &return_runtime);
 
   // Get the "prototype" (or initial map) of the {callable}.
-  TNode<HeapObject> callable_prototype = LoadObjectField<HeapObject>(
-      CAST(callable), JSFunction::kPrototypeOrInitialMapOffset);
+  Node* callable_prototype =
+      LoadObjectField(callable, JSFunction::kPrototypeOrInitialMapOffset);
   {
     Label no_initial_map(this), walk_prototype_chain(this);
-    TVARIABLE(HeapObject, var_callable_prototype, callable_prototype);
+    VARIABLE(var_callable_prototype, MachineRepresentation::kTagged,
+             callable_prototype);
 
     // Resolve the "prototype" if the {callable} has an initial map.
     GotoIfNot(IsMap(callable_prototype), &no_initial_map);
-    var_callable_prototype =
-        LoadObjectField<HeapObject>(callable_prototype, Map::kPrototypeOffset);
+    var_callable_prototype.Bind(
+        LoadObjectField(callable_prototype, Map::kPrototypeOffset));
     Goto(&walk_prototype_chain);
 
     BIND(&no_initial_map);
@@ -10142,8 +10158,8 @@ TNode<BoolT> CodeStubAssembler::IsOffsetInBounds(SloppyTNode<IntPtrT> offset,
 TNode<HeapObject> CodeStubAssembler::LoadFeedbackCellValue(
     SloppyTNode<JSFunction> closure) {
   TNode<FeedbackCell> feedback_cell =
-      LoadObjectField<FeedbackCell>(closure, JSFunction::kFeedbackCellOffset);
-  return LoadObjectField<HeapObject>(feedback_cell, FeedbackCell::kValueOffset);
+      CAST(LoadObjectField(closure, JSFunction::kFeedbackCellOffset));
+  return CAST(LoadObjectField(feedback_cell, FeedbackCell::kValueOffset));
 }
 
 TNode<HeapObject> CodeStubAssembler::LoadFeedbackVector(

src/codegen/code-stub-assembler.h

@@ -1289,7 +1289,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   void GotoIfPrototypeRequiresRuntimeLookup(TNode<JSFunction> function,
                                             TNode<Map> map, Label* runtime);
   // Load the "prototype" property of a JSFunction.
-  Node* LoadJSFunctionPrototype(TNode<JSFunction> function, Label* if_bailout);
+  Node* LoadJSFunctionPrototype(Node* function, Label* if_bailout);
 
   TNode<BytecodeArray> LoadSharedFunctionInfoBytecodeArray(
       SloppyTNode<SharedFunctionInfo> shared);
@@ -1372,6 +1372,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
                                   CheckBounds::kDebugOnly);
   }
 
+  void StoreJSArrayLength(TNode<JSArray> array, TNode<Smi> length);
+  void StoreElements(TNode<Object> object, TNode<FixedArrayBase> elements);
+
   void StoreFixedArrayOrPropertyArrayElement(
       Node* array, Node* index, Node* value,
       WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER,

src/ic/accessor-assembler.cc

@@ -2298,10 +2298,10 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
       GotoIf(InstanceTypeEqual(var_holder_instance_type.value(),
                                JS_TYPED_ARRAY_TYPE),
              slow);
-      TNode<HeapObject> proto = LoadMapPrototype(var_holder_map.value());
+      Node* proto = LoadMapPrototype(var_holder_map.value());
       GotoIf(WordEqual(proto, NullConstant()), &return_undefined);
-      TNode<Map> proto_map = LoadMap(proto);
-      TNode<Uint16T> proto_instance_type = LoadMapInstanceType(proto_map);
+      Node* proto_map = LoadMap(proto);
+      Node* proto_instance_type = LoadMapInstanceType(proto_map);
       var_holder_map.Bind(proto_map);
       var_holder_instance_type.Bind(proto_instance_type);
       Label next_proto(this), return_value(this, &var_value), goto_slow(this);
@@ -2623,7 +2623,7 @@ void AccessorAssembler::LoadIC_NoFeedback(const LoadICParameters* p) {
 
     GotoIfPrototypeRequiresRuntimeLookup(CAST(receiver), CAST(receiver_map),
                                          &not_function_prototype);
-    Return(LoadJSFunctionPrototype(CAST(receiver), &miss));
+    Return(LoadJSFunctionPrototype(receiver, &miss));
     BIND(&not_function_prototype);
   }
 

src/interpreter/interpreter-assembler.cc

@@ -1246,7 +1246,7 @@ void InterpreterAssembler::UpdateInterruptBudget(Node* weight, bool backward) {
   Label load_budget_from_bytecode(this), load_budget_done(this);
   TNode<JSFunction> function = CAST(LoadRegister(Register::function_closure()));
   TNode<FeedbackCell> feedback_cell =
-      LoadObjectField<FeedbackCell>(function, JSFunction::kFeedbackCellOffset);
+      CAST(LoadObjectField(function, JSFunction::kFeedbackCellOffset));
   TNode<Int32T> old_budget = LoadObjectField<Int32T>(
       feedback_cell, FeedbackCell::kInterruptBudgetOffset);
 

test/unittests/compiler/node-test-utils.cc

@@ -2204,7 +2204,6 @@ IS_UNOP_MATCHER(ChangeInt32ToInt64)
 IS_UNOP_MATCHER(ChangeUint32ToFloat64)
 IS_UNOP_MATCHER(ChangeUint32ToUint64)
 IS_UNOP_MATCHER(ChangeCompressedToTagged)
-IS_UNOP_MATCHER(ChangeCompressedPointerToTaggedPointer)
 IS_UNOP_MATCHER(TruncateFloat64ToFloat32)
 IS_UNOP_MATCHER(TruncateInt64ToInt32)
 IS_UNOP_MATCHER(Float32Abs)

test/unittests/compiler/node-test-utils.h

@@ -427,8 +427,6 @@ Matcher<Node*> IsChangeInt32ToInt64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeUint32ToFloat64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeUint32ToUint64(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsChangeCompressedToTagged(const Matcher<Node*>& input_matcher);
-Matcher<Node*> IsChangeCompressedPointerToTaggedPointer(
-    const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsTruncateFloat64ToFloat32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsTruncateInt64ToInt32(const Matcher<Node*>& input_matcher);
 Matcher<Node*> IsFloat32Abs(const Matcher<Node*>& input_matcher);

test/unittests/interpreter/interpreter-assembler-unittest.cc

@@ -601,22 +601,21 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadFeedbackVector) {
                  c::IsIntPtrConstant(Register::function_closure().ToOperand() *
                                      kSystemPointerSize)));
 #ifdef V8_COMPRESS_POINTERS
-    Matcher<Node*> load_vector_cell_matcher =
-        IsChangeCompressedPointerToTaggedPointer(m.IsLoadFromObject(
-            MachineType::CompressedPointer(), load_function_matcher,
-            c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset -
-                                kHeapObjectTag)));
+    Matcher<Node*> load_vector_cell_matcher = IsChangeCompressedToTagged(
+        m.IsLoadFromObject(MachineType::AnyCompressed(), load_function_matcher,
+                           c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset -
+                                               kHeapObjectTag)));
     EXPECT_THAT(load_feedback_vector,
-                IsChangeCompressedPointerToTaggedPointer(m.IsLoadFromObject(
-                    MachineType::CompressedPointer(), load_vector_cell_matcher,
+                IsChangeCompressedToTagged(m.IsLoadFromObject(
+                    MachineType::AnyCompressed(), load_vector_cell_matcher,
                     c::IsIntPtrConstant(Cell::kValueOffset - kHeapObjectTag))));
 #else
     Matcher<Node*> load_vector_cell_matcher = m.IsLoadFromObject(
-        MachineType::TaggedPointer(), load_function_matcher,
+        MachineType::AnyTagged(), load_function_matcher,
         c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset - kHeapObjectTag));
     EXPECT_THAT(load_feedback_vector,
                 m.IsLoadFromObject(
-                    MachineType::TaggedPointer(), load_vector_cell_matcher,
+                    MachineType::AnyTagged(), load_vector_cell_matcher,
                     c::IsIntPtrConstant(Cell::kValueOffset - kHeapObjectTag)));
 #endif
   }