[compiler] Fix `slot` type for unary op builtins

The `slot` parameter is expected to be a UintPtr.

Bug: v8:8888
Change-Id: Ia1137cd5af3d3aa0b00e9bf194661067c37332b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2215047
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68005}

src/compiler/js-generic-lowering.cc

@@ -153,7 +153,7 @@ void JSGenericLowering::ReplaceUnaryOpWithBuiltinCall(
   if (CollectFeedbackInGenericLowering() && p.feedback().IsValid()) {
     Callable callable = Builtins::CallableFor(isolate(), builtin_with_feedback);
     Node* feedback_vector = jsgraph()->HeapConstant(p.feedback().vector);
-    Node* slot = jsgraph()->Int32Constant(p.feedback().slot.ToInt());
+    Node* slot = jsgraph()->UintPtrConstant(p.feedback().slot.ToInt());
     const CallInterfaceDescriptor& descriptor = callable.descriptor();
     auto call_descriptor = Linkage::GetStubCallDescriptor(
         zone(), descriptor, descriptor.GetStackParameterCount(), flags,

src/compiler/machine-graph.cc

@@ -32,6 +32,11 @@ Node* MachineGraph::IntPtrConstant(intptr_t value) {
                            : Int64Constant(static_cast<int64_t>(value));
 }
 
+Node* MachineGraph::UintPtrConstant(uintptr_t value) {
+  return machine()->Is32() ? Uint32Constant(static_cast<uint32_t>(value))
+                           : Uint64Constant(static_cast<uint64_t>(value));
+}
+
 Node* MachineGraph::TaggedIndexConstant(intptr_t value) {
   int32_t value32 = static_cast<int32_t>(value);
   Node** loc = cache_.FindTaggedIndexConstant(value32);

src/compiler/machine-graph.h

@@ -43,6 +43,7 @@ class V8_EXPORT_PRIVATE MachineGraph : public NON_EXPORTED_BASE(ZoneObject) {
   // TODO(turbofan): Code using Int32Constant/Int64Constant to store pointer
   // constants is probably not serializable.
   Node* IntPtrConstant(intptr_t value);
+  Node* UintPtrConstant(uintptr_t value);
 
   Node* TaggedIndexConstant(intptr_t value);