[turbofan] Rename BitcastTaggedSignedToWord to BitcastTaggedToWordForTagAndSmiBits

... to precisely express which guarantees does this operator provide.

Drive-by-fix: use it for other tag-checking predicates in CSA.

Bug: v8:9396
Change-Id: Ifee22922ac02ec8866038be1a97625a32638d521
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795504
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63681}

src/codegen/code-stub-assembler.cc

@@ -710,7 +710,7 @@ TNode<Float64T> CodeStubAssembler::Float64Trunc(SloppyTNode<Float64T> x) {
 TNode<BoolT> CodeStubAssembler::IsValidSmi(TNode<Smi> smi) {
   if (SmiValuesAre32Bits() && kSystemPointerSize == kInt64Size) {
     // Check that the Smi value is zero in the lower bits.
-    TNode<IntPtrT> value = BitcastTaggedSignedToWord(smi);
+    TNode<IntPtrT> value = BitcastTaggedToWordForTagAndSmiBits(smi);
     return Word32Equal(Int32Constant(0), TruncateIntPtrToInt32(value));
   }
   return Int32TrueConstant();
@@ -760,8 +760,8 @@ TNode<IntPtrT> CodeStubAssembler::SmiUntag(SloppyTNode<Smi> value) {
   if (ToIntPtrConstant(value, &constant_value)) {
     return IntPtrConstant(constant_value >> (kSmiShiftSize + kSmiTagSize));
   }
-  return Signed(
-      WordSar(BitcastTaggedSignedToWord(value), SmiShiftBitsConstant()));
+  return Signed(WordSar(BitcastTaggedToWordForTagAndSmiBits(value),
+                        SmiShiftBitsConstant()));
 }
 
 TNode<Int32T> CodeStubAssembler::SmiToInt32(SloppyTNode<Smi> value) {
@@ -811,13 +811,13 @@ TNode<Smi> CodeStubAssembler::TrySmiAdd(TNode<Smi> lhs, TNode<Smi> rhs,
                                         Label* if_overflow) {
   if (SmiValuesAre32Bits()) {
     return BitcastWordToTaggedSigned(
-        TryIntPtrAdd(BitcastTaggedSignedToWord(lhs),
-                     BitcastTaggedSignedToWord(rhs), if_overflow));
+        TryIntPtrAdd(BitcastTaggedToWordForTagAndSmiBits(lhs),
+                     BitcastTaggedToWordForTagAndSmiBits(rhs), if_overflow));
   } else {
     DCHECK(SmiValuesAre31Bits());
     TNode<PairT<Int32T, BoolT>> pair = Int32AddWithOverflow(
-        TruncateIntPtrToInt32(BitcastTaggedSignedToWord(lhs)),
-        TruncateIntPtrToInt32(BitcastTaggedSignedToWord(rhs)));
+        TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(lhs)),
+        TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(rhs)));
     TNode<BoolT> overflow = Projection<1>(pair);
     GotoIf(overflow, if_overflow);
     TNode<Int32T> result = Projection<0>(pair);
@@ -828,8 +828,9 @@ TNode<Smi> CodeStubAssembler::TrySmiAdd(TNode<Smi> lhs, TNode<Smi> rhs,
 TNode<Smi> CodeStubAssembler::TrySmiSub(TNode<Smi> lhs, TNode<Smi> rhs,
                                         Label* if_overflow) {
   if (SmiValuesAre32Bits()) {
-    TNode<PairT<IntPtrT, BoolT>> pair = IntPtrSubWithOverflow(
-        BitcastTaggedSignedToWord(lhs), BitcastTaggedSignedToWord(rhs));
+    TNode<PairT<IntPtrT, BoolT>> pair =
+        IntPtrSubWithOverflow(BitcastTaggedToWordForTagAndSmiBits(lhs),
+                              BitcastTaggedToWordForTagAndSmiBits(rhs));
     TNode<BoolT> overflow = Projection<1>(pair);
     GotoIf(overflow, if_overflow);
     TNode<IntPtrT> result = Projection<0>(pair);
@@ -837,8 +838,8 @@ TNode<Smi> CodeStubAssembler::TrySmiSub(TNode<Smi> lhs, TNode<Smi> rhs,
   } else {
     DCHECK(SmiValuesAre31Bits());
     TNode<PairT<Int32T, BoolT>> pair = Int32SubWithOverflow(
-        TruncateIntPtrToInt32(BitcastTaggedSignedToWord(lhs)),
-        TruncateIntPtrToInt32(BitcastTaggedSignedToWord(rhs)));
+        TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(lhs)),
+        TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(rhs)));
     TNode<BoolT> overflow = Projection<1>(pair);
     GotoIf(overflow, if_overflow);
     TNode<Int32T> result = Projection<0>(pair);
@@ -1120,41 +1121,27 @@ TNode<Int32T> CodeStubAssembler::TruncateIntPtrToInt32(
   return ReinterpretCast<Int32T>(value);
 }
 
-TNode<BoolT> CodeStubAssembler::TaggedIsSmi(SloppyTNode<Object> a) {
-  STATIC_ASSERT(kSmiTagMask < kMaxUInt32);
-  return Word32Equal(Word32And(TruncateIntPtrToInt32(BitcastTaggedToWord(a)),
-                               Int32Constant(kSmiTagMask)),
-                     Int32Constant(0));
-}
-
 TNode<BoolT> CodeStubAssembler::TaggedIsSmi(TNode<MaybeObject> a) {
   STATIC_ASSERT(kSmiTagMask < kMaxUInt32);
   return Word32Equal(
-      Word32And(TruncateIntPtrToInt32(BitcastMaybeObjectToWord(a)),
+      Word32And(TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(a)),
                 Int32Constant(kSmiTagMask)),
       Int32Constant(0));
 }
 
-TNode<BoolT> CodeStubAssembler::TaggedIsNotSmi(SloppyTNode<Object> a) {
-  // Although BitcastTaggedSignedToWord is generally unsafe on HeapObjects, we
-  // can nonetheless use it to inspect the Smi tag. The assumption here is that
-  // the GC will not exchange Smis for HeapObjects or vice-versa.
-  TNode<IntPtrT> a_bitcast = BitcastTaggedSignedToWord(UncheckedCast<Smi>(a));
-  STATIC_ASSERT(kSmiTagMask < kMaxUInt32);
-  return Word32NotEqual(
-      Word32And(TruncateIntPtrToInt32(a_bitcast), Int32Constant(kSmiTagMask)),
-      Int32Constant(0));
+TNode<BoolT> CodeStubAssembler::TaggedIsNotSmi(TNode<MaybeObject> a) {
+  return Word32BinaryNot(TaggedIsSmi(a));
 }
 
 TNode<BoolT> CodeStubAssembler::TaggedIsPositiveSmi(SloppyTNode<Object> a) {
 #if defined(V8_HOST_ARCH_32_BIT) || defined(V8_31BIT_SMIS_ON_64BIT_ARCH)
   return Word32Equal(
       Word32And(
-          TruncateIntPtrToInt32(BitcastTaggedToWord(a)),
+          TruncateIntPtrToInt32(BitcastTaggedToWordForTagAndSmiBits(a)),
           Uint32Constant(kSmiTagMask | static_cast<int32_t>(kSmiSignMask))),
       Int32Constant(0));
 #else
-  return WordEqual(WordAnd(BitcastTaggedToWord(a),
+  return WordEqual(WordAnd(BitcastTaggedToWordForTagAndSmiBits(a),
                            IntPtrConstant(kSmiTagMask | kSmiSignMask)),
                    IntPtrConstant(0));
 #endif
@@ -2025,11 +2012,7 @@ void CodeStubAssembler::DispatchMaybeObject(TNode<MaybeObject> maybe_object,
 
   GotoIf(IsCleared(maybe_object), if_cleared);
 
-  GotoIf(Word32Equal(Word32And(TruncateIntPtrToInt32(
-                                   BitcastMaybeObjectToWord(maybe_object)),
-                               Int32Constant(kHeapObjectTagMask)),
-                     Int32Constant(kHeapObjectTag)),
-         &inner_if_strong);
+  GotoIf(IsStrong(maybe_object), &inner_if_strong);
 
   *extracted =
       BitcastWordToTagged(WordAnd(BitcastMaybeObjectToWord(maybe_object),
@@ -2046,10 +2029,10 @@ void CodeStubAssembler::DispatchMaybeObject(TNode<MaybeObject> maybe_object,
 }
 
 TNode<BoolT> CodeStubAssembler::IsStrong(TNode<MaybeObject> value) {
-  return Word32Equal(
-      Word32And(TruncateIntPtrToInt32(BitcastMaybeObjectToWord(value)),
-                Int32Constant(kHeapObjectTagMask)),
-      Int32Constant(kHeapObjectTag));
+  return Word32Equal(Word32And(TruncateIntPtrToInt32(
+                                   BitcastTaggedToWordForTagAndSmiBits(value)),
+                               Int32Constant(kHeapObjectTagMask)),
+                     Int32Constant(kHeapObjectTag));
 }
 
 TNode<HeapObject> CodeStubAssembler::GetHeapObjectIfStrong(
@@ -2059,10 +2042,10 @@ TNode<HeapObject> CodeStubAssembler::GetHeapObjectIfStrong(
 }
 
 TNode<BoolT> CodeStubAssembler::IsWeakOrCleared(TNode<MaybeObject> value) {
-  return Word32Equal(
-      Word32And(TruncateIntPtrToInt32(BitcastMaybeObjectToWord(value)),
-                Int32Constant(kHeapObjectTagMask)),
-      Int32Constant(kWeakHeapObjectTag));
+  return Word32Equal(Word32And(TruncateIntPtrToInt32(
+                                   BitcastTaggedToWordForTagAndSmiBits(value)),
+                               Int32Constant(kHeapObjectTagMask)),
+                     Int32Constant(kWeakHeapObjectTag));
 }
 
 TNode<BoolT> CodeStubAssembler::IsCleared(TNode<MaybeObject> value) {
@@ -10246,7 +10229,7 @@ TNode<IntPtrT> CodeStubAssembler::ElementOffsetFromIndex(Node* index_node,
     Smi smi_index;
     constant_index = ToSmiConstant(index_node, &smi_index);
     if (constant_index) index = smi_index.value();
-    index_node = BitcastTaggedSignedToWord(index_node);
+    index_node = BitcastTaggedToWordForTagAndSmiBits(index_node);
   } else {
     DCHECK(mode == INTPTR_PARAMETERS);
     constant_index = ToIntPtrConstant(index_node, &index);
@@ -13775,8 +13758,10 @@ TNode<Code> CodeStubAssembler::LoadBuiltin(TNode<Smi> builtin_id) {
   int index_shift = kSystemPointerSizeLog2 - kSmiShiftBits;
   TNode<WordT> table_index =
       index_shift >= 0
-          ? WordShl(BitcastTaggedSignedToWord(builtin_id), index_shift)
-          : WordSar(BitcastTaggedSignedToWord(builtin_id), -index_shift);
+          ? WordShl(BitcastTaggedToWordForTagAndSmiBits(builtin_id),
+                    index_shift)
+          : WordSar(BitcastTaggedToWordForTagAndSmiBits(builtin_id),
+                    -index_shift);
 
   return CAST(
       Load(MachineType::TaggedPointer(),

src/compiler/backend/instruction-selector.cc

@@ -1502,7 +1502,7 @@ void InstructionSelector::VisitNode(Node* node) {
     case IrOpcode::kUint64Mod:
       return MarkAsWord64(node), VisitUint64Mod(node);
     case IrOpcode::kBitcastTaggedToWord:
-    case IrOpcode::kBitcastTaggedSignedToWord:
+    case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits:
       return MarkAsRepresentation(MachineType::PointerRepresentation(), node),
              VisitBitcastTaggedToWord(node);
     case IrOpcode::kBitcastWordToTagged:

src/compiler/code-assembler.h

@@ -263,6 +263,8 @@ struct UnionT {
                 "union types are only possible for tagged values");
 };
 
+using AnyTaggedT = UnionT<Object, MaybeObject>;
+
 using Number = UnionT<Smi, HeapNumber>;
 using Numeric = UnionT<Number, BigInt>;
 
@@ -631,7 +633,7 @@ TNode<Float64T> Float64Add(TNode<Float64T> a, TNode<Float64T> b);
   V(Float64ExtractLowWord32, Uint32T, Float64T)                \
   V(Float64ExtractHighWord32, Uint32T, Float64T)               \
   V(BitcastTaggedToWord, IntPtrT, Object)                      \
-  V(BitcastTaggedSignedToWord, IntPtrT, Smi)                   \
+  V(BitcastTaggedToWordForTagAndSmiBits, IntPtrT, AnyTaggedT)  \
   V(BitcastMaybeObjectToWord, IntPtrT, MaybeObject)            \
   V(BitcastWordToTagged, Object, WordT)                        \
   V(BitcastWordToTaggedSigned, Smi, WordT)                     \
@@ -1247,7 +1249,7 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   template <class Dummy = void>
   TNode<IntPtrT> BitcastTaggedToWord(TNode<Smi> node) {
     static_assert(sizeof(Dummy) < 0,
-                  "Should use BitcastTaggedSignedToWord instead.");
+                  "Should use BitcastTaggedToWordForTagAndSmiBits instead.");
   }
 
   // Changes a double to an inptr_t for pointer arithmetic outside of Smi range.

src/compiler/graph-assembler.cc

@@ -232,10 +232,10 @@ Node* GraphAssembler::BitcastTaggedToWord(Node* value) {
                               current_effect_, current_control_);
 }
 
-Node* GraphAssembler::BitcastTaggedSignedToWord(Node* value) {
+Node* GraphAssembler::BitcastTaggedToWordForTagAndSmiBits(Node* value) {
   return current_effect_ =
-             graph()->NewNode(machine()->BitcastTaggedSignedToWord(), value,
-                              current_effect_, current_control_);
+             graph()->NewNode(machine()->BitcastTaggedToWordForTagAndSmiBits(),
+                              value, current_effect_, current_control_);
 }
 
 Node* GraphAssembler::Word32PoisonOnSpeculation(Node* value) {

src/compiler/graph-assembler.h

@@ -233,7 +233,7 @@ class GraphAssembler {
   Node* ToNumber(Node* value);
   Node* BitcastWordToTagged(Node* value);
   Node* BitcastTaggedToWord(Node* value);
-  Node* BitcastTaggedSignedToWord(Node* value);
+  Node* BitcastTaggedToWordForTagAndSmiBits(Node* value);
   Node* Allocate(AllocationType allocation, Node* size);
   Node* LoadField(FieldAccess const&, Node* object);
   Node* LoadElement(ElementAccess const&, Node* object, Node* index);

src/compiler/machine-graph-verifier.cc

@@ -241,7 +241,7 @@ class MachineRepresentationInferrer {
                 MachineType::PointerRepresentation();
             break;
           case IrOpcode::kBitcastTaggedToWord:
-          case IrOpcode::kBitcastTaggedSignedToWord:
+          case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits:
             representation_vector_[node->id()] =
                 MachineType::PointerRepresentation();
             break;
@@ -437,7 +437,7 @@ class MachineRepresentationChecker {
                                             MachineRepresentation::kWord64);
             break;
           case IrOpcode::kBitcastTaggedToWord:
-          case IrOpcode::kBitcastTaggedSignedToWord:
+          case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits:
           case IrOpcode::kTaggedPoisonOnSpeculation:
             CheckValueInputIsTagged(node, 0);
             break;

src/compiler/machine-operator-reducer.cc

@@ -681,7 +681,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
       Int64Matcher m(node->InputAt(0));
       if (m.HasValue()) return ReplaceInt32(static_cast<int32_t>(m.Value()));
       if (m.IsChangeInt32ToInt64()) return Replace(m.node()->InputAt(0));
-      if (m.IsBitcastTaggedSignedToWord()) {
+      if (m.IsBitcastTaggedToWordForTagAndSmiBits()) {
         Int64Matcher n(m.node()->InputAt(0));
         if (n.IsChangeCompressedToTagged()) {
           DCHECK(machine()->Is64() && SmiValuesAre31Bits());
@@ -725,7 +725,7 @@ Reduction MachineOperatorReducer::Reduce(Node* node) {
     case IrOpcode::kFloat64RoundDown:
       return ReduceFloat64RoundDown(node);
     case IrOpcode::kBitcastTaggedToWord:
-    case IrOpcode::kBitcastTaggedSignedToWord: {
+    case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits: {
       NodeMatcher m(node->InputAt(0));
       if (m.IsBitcastWordToTaggedSigned()) {
         RelaxEffectsAndControls(node);

src/compiler/machine-operator.cc

@@ -146,7 +146,7 @@ MachineType AtomicOpType(Operator const* op) {
   V(Word64Clz, Operator::kNoProperties, 1, 0, 1)                              \
   V(Word32ReverseBytes, Operator::kNoProperties, 1, 0, 1)                     \
   V(Word64ReverseBytes, Operator::kNoProperties, 1, 0, 1)                     \
-  V(BitcastTaggedSignedToWord, Operator::kNoProperties, 1, 0, 1)              \
+  V(BitcastTaggedToWordForTagAndSmiBits, Operator::kNoProperties, 1, 0, 1)    \
   V(BitcastWordToTaggedSigned, Operator::kNoProperties, 1, 0, 1)              \
   V(BitcastWord32ToCompressedSigned, Operator::kNoProperties, 1, 0, 1)        \
   V(BitcastCompressedSignedToWord32, Operator::kNoProperties, 1, 0, 1)        \

src/compiler/machine-operator.h

@@ -301,8 +301,13 @@ class V8_EXPORT_PRIVATE MachineOperatorBuilder final
   // This operator reinterprets the bits of a tagged pointer as a word.
   const Operator* BitcastTaggedToWord();
 
-  // This operator reinterprets the bits of a Smi as a word.
-  const Operator* BitcastTaggedSignedToWord();
+  // This operator reinterprets the bits of a tagged value as a word preserving
+  // non-pointer bits (all the bits that are not modified by GC):
+  // 1) smi tag
+  // 2) weak tag
+  // 3) smi payload if the tagged value is a smi.
+  // Note, that it's illegal to "look" at the pointer bits of non-smi values.
+  const Operator* BitcastTaggedToWordForTagAndSmiBits();
 
   // This operator reinterprets the bits of a tagged MaybeObject pointer as
   // word.

src/compiler/opcodes.h

@@ -671,7 +671,7 @@
   V(Word64ReverseBytes)                     \
   V(Int64AbsWithOverflow)                   \
   V(BitcastTaggedToWord)                    \
-  V(BitcastTaggedSignedToWord)              \
+  V(BitcastTaggedToWordForTagAndSmiBits)    \
   V(BitcastWordToTagged)                    \
   V(BitcastWordToTaggedSigned)              \
   V(BitcastWord32ToCompressedSigned)        \

src/compiler/raw-machine-assembler.h

@@ -736,8 +736,8 @@ class V8_EXPORT_PRIVATE RawMachineAssembler {
   Node* BitcastTaggedToWord(Node* a) {
       return AddNode(machine()->BitcastTaggedToWord(), a);
   }
-  Node* BitcastTaggedSignedToWord(Node* a) {
-    return AddNode(machine()->BitcastTaggedSignedToWord(), a);
+  Node* BitcastTaggedToWordForTagAndSmiBits(Node* a) {
+    return AddNode(machine()->BitcastTaggedToWordForTagAndSmiBits(), a);
   }
   Node* BitcastMaybeObjectToWord(Node* a) {
       return AddNode(machine()->BitcastMaybeObjectToWord(), a);

src/compiler/verifier.cc

@@ -1801,7 +1801,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kBitcastInt32ToFloat32:
     case IrOpcode::kBitcastInt64ToFloat64:
     case IrOpcode::kBitcastTaggedToWord:
-    case IrOpcode::kBitcastTaggedSignedToWord:
+    case IrOpcode::kBitcastTaggedToWordForTagAndSmiBits:
     case IrOpcode::kBitcastWordToTagged:
     case IrOpcode::kBitcastWordToTaggedSigned:
     case IrOpcode::kBitcastWord32ToCompressedSigned: