Revert of [turbofan] Set proper representation for initial arguments length....

Revert of [turbofan] Set proper representation for initial arguments length. (patchset #1 id:1 of https://codereview.chromium.org/2810333004/ )

Reason for revert:
Field representation is not preserved

Original issue's description:
> [turbofan] Set proper representation for initial arguments length.
>
> The JSArgumentsObject::length representation is initially Smi, so we can
> record that on the initial map and use it to optimize the accesses in
> TurboFan based on that. Similar for JSSloppyArgumentsObject::caller.
>
> BUG=v8:6262
> R=yangguo@chromium.org
>
> Review-Url: https://codereview.chromium.org/2810333004
> Cr-Commit-Position: refs/heads/master@{#44644}
> Committed: https://chromium.googlesource.com/v8/v8/+/5eec7df9b319e5b7a8158d82825d61e90a7cfe33

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:6262

Review-Url: https://codereview.chromium.org/2825323002
Cr-Commit-Position: refs/heads/master@{#44893}

src/bootstrapper.cc

@@ -3072,13 +3072,13 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     {  // length
       Descriptor d = Descriptor::DataField(
           factory->length_string(), JSSloppyArgumentsObject::kLengthIndex,
-          DONT_ENUM, Representation::Smi());
+          DONT_ENUM, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // callee
       Descriptor d = Descriptor::DataField(
           factory->callee_string(), JSSloppyArgumentsObject::kCalleeIndex,
-          DONT_ENUM, Representation::HeapObject());
+          DONT_ENUM, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     // @@iterator method is added later.
@@ -3129,7 +3129,7 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
     {  // length
       Descriptor d = Descriptor::DataField(
           factory->length_string(), JSStrictArgumentsObject::kLengthIndex,
-          DONT_ENUM, Representation::Smi());
+          DONT_ENUM, Representation::Tagged());
       map->AppendDescriptor(&d);
     }
     {  // callee

src/compiler/access-builder.cc

@@ -716,8 +716,8 @@ FieldAccess AccessBuilder::ForValue() {
 FieldAccess AccessBuilder::ForArgumentsLength() {
   FieldAccess access = {kTaggedBase,         JSArgumentsObject::kLengthOffset,
                         Handle<Name>(),      MaybeHandle<Map>(),
-                        Type::SignedSmall(), MachineType::TaggedSigned(),
-                        kNoWriteBarrier};
+                        Type::NonInternal(), MachineType::AnyTagged(),
+                        kFullWriteBarrier};
   return access;
 }
 

test/mjsunit/arguments.js

@@ -271,3 +271,17 @@ assertEquals(117, arg_set(0xFFFFFFFF));
   assertEquals(undefined, args[key]);
   assertEquals(2, args.length);
 })();
+
+(function testSloppyArgumentsLengthMapChange() {
+  function f(a) { return arguments };
+  let args1 = f(1);
+  let args2 = f(1,2);
+  assertTrue(%HaveSameMap(args1, args2));
+  // Changing the length type doesn't causes a map transition.
+  args2.length = 12;
+  assertTrue(%HaveSameMap(args1, args2));
+  args2.length = 12.0;
+  assertTrue(%HaveSameMap(args1, args2));
+  args2.length = "aa"
+  assertTrue(%HaveSameMap(args1, args2));
+})();