[ptr-compr] Fix compressing stores in CSA/builtins

... and also loads of off-heap tagged values.

Bug: v8:7703
Change-Id: I0dd15ecda76cc35fe5f2f51a7103937a7ac238dc
Reviewed-on: https://chromium-review.googlesource.com/c/1459639
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59468}

src/builtins/builtins-internal-gen.cc

@@ -217,15 +217,16 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
     return Load(MachineType::Uint8(), is_marking_addr);
   }
 
-  Node* IsPageFlagSet(Node* object, int mask) {
-    Node* page = WordAnd(object, IntPtrConstant(~kPageAlignmentMask));
-    Node* flags = Load(MachineType::Pointer(), page,
-                       IntPtrConstant(MemoryChunk::kFlagsOffset));
+  TNode<BoolT> IsPageFlagSet(TNode<IntPtrT> object, int mask) {
+    TNode<IntPtrT> page = PageFromAddress(object);
+    TNode<IntPtrT> flags =
+        UncheckedCast<IntPtrT>(Load(MachineType::Pointer(), page,
+                                    IntPtrConstant(MemoryChunk::kFlagsOffset)));
     return WordNotEqual(WordAnd(flags, IntPtrConstant(mask)),
                         IntPtrConstant(0));
   }
 
-  Node* IsWhite(Node* object) {
+  TNode<BoolT> IsWhite(TNode<IntPtrT> object) {
     DCHECK_EQ(strcmp(Marking::kWhiteBitPattern, "00"), 0);
     Node* cell;
     Node* mask;
@@ -237,8 +238,8 @@ class RecordWriteCodeStubAssembler : public CodeStubAssembler {
                        Int32Constant(0));
   }
 
-  void GetMarkBit(Node* object, Node** cell, Node** mask) {
-    Node* page = WordAnd(object, IntPtrConstant(~kPageAlignmentMask));
+  void GetMarkBit(TNode<IntPtrT> object, Node** cell, Node** mask) {
+    TNode<IntPtrT> page = PageFromAddress(object);
     Node* bitmap = Load(MachineType::Pointer(), page,
                         IntPtrConstant(MemoryChunk::kMarkBitmapOffset));
 
@@ -366,21 +367,24 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
     // `kPointersToHereAreInterestingMask` in
     // `src/compiler/<arch>/code-generator-<arch>.cc` before calling this stub,
     // which serves as the cross generation checking.
-    Node* slot = Parameter(Descriptor::kSlot);
+    TNode<IntPtrT> slot = UncheckedCast<IntPtrT>(Parameter(Descriptor::kSlot));
     Branch(IsMarking(), &test_old_to_young_flags, &store_buffer_exit);
 
     BIND(&test_old_to_young_flags);
     {
-      Node* value = Load(MachineType::Pointer(), slot);
+      // TODO(ishell): do a new-space range check instead.
+      TNode<IntPtrT> value =
+          BitcastTaggedToWord(Load(MachineType::TaggedPointer(), slot));
 
       // TODO(albertnetymk): Try to cache the page flag for value and object,
       // instead of calling IsPageFlagSet each time.
-      Node* value_is_young =
+      TNode<BoolT> value_is_young =
           IsPageFlagSet(value, MemoryChunk::kIsInYoungGenerationMask);
       GotoIfNot(value_is_young, &incremental_wb);
 
-      Node* object = BitcastTaggedToWord(Parameter(Descriptor::kObject));
-      Node* object_is_young =
+      TNode<IntPtrT> object =
+          BitcastTaggedToWord(Parameter(Descriptor::kObject));
+      TNode<BoolT> object_is_young =
           IsPageFlagSet(object, MemoryChunk::kIsInYoungGenerationMask);
       Branch(object_is_young, &incremental_wb, &store_buffer_incremental_wb);
     }
@@ -407,8 +411,9 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
   {
     Label call_incremental_wb(this);
 
-    Node* slot = Parameter(Descriptor::kSlot);
-    Node* value = Load(MachineType::Pointer(), slot);
+    TNode<IntPtrT> slot = UncheckedCast<IntPtrT>(Parameter(Descriptor::kSlot));
+    TNode<IntPtrT> value =
+        BitcastTaggedToWord(Load(MachineType::TaggedPointer(), slot));
 
     // There are two cases we need to call incremental write barrier.
     // 1) value_is_white
@@ -419,7 +424,7 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
     GotoIfNot(IsPageFlagSet(value, MemoryChunk::kEvacuationCandidateMask),
               &exit);
 
-    Node* object = BitcastTaggedToWord(Parameter(Descriptor::kObject));
+    TNode<IntPtrT> object = BitcastTaggedToWord(Parameter(Descriptor::kObject));
     Branch(
         IsPageFlagSet(object, MemoryChunk::kSkipEvacuationSlotsRecordingMask),
         &exit, &call_incremental_wb);
@@ -431,7 +436,8 @@ TF_BUILTIN(RecordWrite, RecordWriteCodeStubAssembler) {
       Node* isolate_constant =
           ExternalConstant(ExternalReference::isolate_address(isolate()));
       Node* fp_mode = Parameter(Descriptor::kFPMode);
-      Node* object = BitcastTaggedToWord(Parameter(Descriptor::kObject));
+      TNode<IntPtrT> object =
+          BitcastTaggedToWord(Parameter(Descriptor::kObject));
       CallCFunction3WithCallerSavedRegistersMode(
           MachineType::Int32(), MachineType::Pointer(), MachineType::Pointer(),
           MachineType::Pointer(), function, object, slot, isolate_constant,

src/builtins/builtins-microtask-queue-gen.cc

@@ -326,15 +326,13 @@ void MicrotaskQueueBuiltinsAssembler::IncrementFinishedMicrotaskCount(
 
 TNode<Context> MicrotaskQueueBuiltinsAssembler::GetCurrentContext() {
   auto ref = ExternalReference::Create(kContextAddress, isolate());
-  return TNode<Context>::UncheckedCast(
-      Load(MachineType::AnyTagged(), ExternalConstant(ref)));
+  return TNode<Context>::UncheckedCast(LoadFullTagged(ExternalConstant(ref)));
 }
 
 void MicrotaskQueueBuiltinsAssembler::SetCurrentContext(
     TNode<Context> context) {
   auto ref = ExternalReference::Create(kContextAddress, isolate());
-  StoreNoWriteBarrier(MachineRepresentation::kTagged, ExternalConstant(ref),
-                      context);
+  StoreFullTaggedNoWriteBarrier(ExternalConstant(ref), context);
 }
 
 TNode<IntPtrT> MicrotaskQueueBuiltinsAssembler::GetEnteredContextCount() {
@@ -378,23 +376,22 @@ void MicrotaskQueueBuiltinsAssembler::EnterMicrotaskContext(
         IntPtrConstant(HandleScopeImplementer::kEnteredContextsOffset +
                        ContextStack::kDataOffset);
     Node* data = Load(MachineType::Pointer(), hsi, data_offset);
-    StoreNoWriteBarrier(MachineType::Pointer().representation(), data,
-                        TimesSystemPointerSize(size),
-                        BitcastTaggedToWord(native_context));
+    StoreFullTaggedNoWriteBarrier(data, TimesSystemPointerSize(size),
+                                  native_context);
 
     TNode<IntPtrT> new_size = IntPtrAdd(size, IntPtrConstant(1));
-    StoreNoWriteBarrier(MachineType::IntPtr().representation(), hsi,
-                        size_offset, new_size);
+    StoreNoWriteBarrier(MachineType::PointerRepresentation(), hsi, size_offset,
+                        new_size);
 
     using FlagStack = DetachableVector<int8_t>;
     TNode<IntPtrT> flag_data_offset =
         IntPtrConstant(HandleScopeImplementer::kIsMicrotaskContextOffset +
                        FlagStack::kDataOffset);
     Node* flag_data = Load(MachineType::Pointer(), hsi, flag_data_offset);
-    StoreNoWriteBarrier(MachineType::Int8().representation(), flag_data, size,
+    StoreNoWriteBarrier(MachineRepresentation::kWord8, flag_data, size,
                         BoolConstant(true));
     StoreNoWriteBarrier(
-        MachineType::IntPtr().representation(), hsi,
+        MachineType::PointerRepresentation(), hsi,
         IntPtrConstant(HandleScopeImplementer::kIsMicrotaskContextOffset +
                        FlagStack::kSizeOffset),
         new_size);
@@ -432,12 +429,12 @@ void MicrotaskQueueBuiltinsAssembler::RewindEnteredContext(
   CSA_ASSERT(this, IntPtrLessThanOrEqual(saved_entered_context_count, size));
 #endif
 
-  StoreNoWriteBarrier(MachineType::IntPtr().representation(), hsi, size_offset,
+  StoreNoWriteBarrier(MachineType::PointerRepresentation(), hsi, size_offset,
                       saved_entered_context_count);
 
   using FlagStack = DetachableVector<int8_t>;
   StoreNoWriteBarrier(
-      MachineType::IntPtr().representation(), hsi,
+      MachineType::PointerRepresentation(), hsi,
       IntPtrConstant(HandleScopeImplementer::kIsMicrotaskContextOffset +
                      FlagStack::kSizeOffset),
       saved_entered_context_count);

src/code-stub-assembler.cc

@@ -1444,7 +1444,8 @@ TNode<Float64T> CodeStubAssembler::LoadHeapNumberValue(
 }
 
 TNode<Map> CodeStubAssembler::LoadMap(SloppyTNode<HeapObject> object) {
-  return UncheckedCast<Map>(LoadObjectField(object, HeapObject::kMapOffset));
+  return UncheckedCast<Map>(LoadObjectField(object, HeapObject::kMapOffset,
+                                            MachineType::TaggedPointer()));
 }
 
 TNode<Int32T> CodeStubAssembler::LoadInstanceType(
@@ -10877,7 +10878,7 @@ TNode<AllocationSite> CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
   // an initial write barrier backed store makes this pointer strong until the
   // next GC, and allocation sites are designed to survive several GCs anyway.
   StoreObjectField(site, AllocationSite::kWeakNextOffset, next_site);
-  StoreNoWriteBarrier(MachineRepresentation::kTagged, site_list, site);
+  StoreFullTaggedNoWriteBarrier(site_list, site);
 
   StoreFeedbackVectorSlot(feedback_vector, slot, site, UPDATE_WRITE_BARRIER, 0,
                           SMI_PARAMETERS);
@@ -13180,36 +13181,34 @@ CodeStubArguments::CodeStubArguments(
       arguments_(),
       fp_(fp != nullptr ? fp : assembler_->LoadFramePointer()) {
   Node* offset = assembler_->ElementOffsetFromIndex(
-      argc_, PACKED_ELEMENTS, param_mode,
+      argc_, SYSTEM_POINTER_ELEMENTS, param_mode,
       (StandardFrameConstants::kFixedSlotCountAboveFp - 1) *
           kSystemPointerSize);
-  arguments_ = assembler_->UncheckedCast<RawPtr<Object>>(
-      assembler_->IntPtrAdd(fp_, offset));
+  arguments_ =
+      assembler_->UncheckedCast<WordT>(assembler_->IntPtrAdd(fp_, offset));
 }
 
 TNode<Object> CodeStubArguments::GetReceiver() const {
   DCHECK_EQ(receiver_mode_, ReceiverMode::kHasReceiver);
-  return assembler_->UncheckedCast<Object>(
-      assembler_->Load(MachineType::AnyTagged(), arguments_,
-                       assembler_->IntPtrConstant(kSystemPointerSize)));
+  return assembler_->UncheckedCast<Object>(assembler_->LoadFullTagged(
+      arguments_, assembler_->IntPtrConstant(kSystemPointerSize)));
 }
 
 void CodeStubArguments::SetReceiver(TNode<Object> object) const {
   DCHECK_EQ(receiver_mode_, ReceiverMode::kHasReceiver);
-  assembler_->StoreNoWriteBarrier(
-      MachineRepresentation::kTagged, arguments_,
-      assembler_->IntPtrConstant(kSystemPointerSize), object);
+  assembler_->StoreFullTaggedNoWriteBarrier(
+      arguments_, assembler_->IntPtrConstant(kSystemPointerSize), object);
 }
 
-TNode<RawPtr<Object>> CodeStubArguments::AtIndexPtr(
+TNode<WordT> CodeStubArguments::AtIndexPtr(
     Node* index, CodeStubAssembler::ParameterMode mode) const {
   typedef compiler::Node Node;
   Node* negated_index = assembler_->IntPtrOrSmiSub(
       assembler_->IntPtrOrSmiConstant(0, mode), index, mode);
-  Node* offset = assembler_->ElementOffsetFromIndex(negated_index,
-                                                    PACKED_ELEMENTS, mode, 0);
-  return assembler_->UncheckedCast<RawPtr<Object>>(assembler_->IntPtrAdd(
-      assembler_->UncheckedCast<IntPtrT>(arguments_), offset));
+  Node* offset = assembler_->ElementOffsetFromIndex(
+      negated_index, SYSTEM_POINTER_ELEMENTS, mode, 0);
+  return assembler_->IntPtrAdd(assembler_->UncheckedCast<IntPtrT>(arguments_),
+                               offset);
 }
 
 TNode<Object> CodeStubArguments::AtIndex(
@@ -13218,7 +13217,7 @@ TNode<Object> CodeStubArguments::AtIndex(
   CSA_ASSERT(assembler_,
              assembler_->UintPtrOrSmiLessThan(index, GetLength(mode), mode));
   return assembler_->UncheckedCast<Object>(
-      assembler_->Load(MachineType::AnyTagged(), AtIndexPtr(index, mode)));
+      assembler_->LoadFullTagged(AtIndexPtr(index, mode)));
 }
 
 TNode<Object> CodeStubArguments::AtIndex(int index) const {

src/code-stub-assembler.h

@@ -3417,8 +3417,9 @@ class CodeStubArguments {
   // further with passing all the JS arguments as is.
   void SetReceiver(TNode<Object> object) const;
 
-  TNode<RawPtr<Object>> AtIndexPtr(
-      Node* index, CodeStubAssembler::ParameterMode mode =
+  // Computes address of the index'th argument.
+  TNode<WordT> AtIndexPtr(Node* index,
+                          CodeStubAssembler::ParameterMode mode =
                               CodeStubAssembler::INTPTR_PARAMETERS) const;
 
   // |index| is zero-based and does not include the receiver
@@ -3476,7 +3477,7 @@ class CodeStubArguments {
   CodeStubAssembler::ParameterMode argc_mode_;
   ReceiverMode receiver_mode_;
   Node* argc_;
-  TNode<RawPtr<Object>> arguments_;
+  TNode<WordT> arguments_;
   Node* fp_;
 };
 

src/compiler/code-assembler.cc

@@ -951,6 +951,18 @@ Node* CodeAssembler::Load(MachineType rep, Node* base, Node* offset,
   return raw_assembler()->Load(rep, base, offset, needs_poisoning);
 }
 
+Node* CodeAssembler::LoadFullTagged(Node* base,
+                                    LoadSensitivity needs_poisoning) {
+  return BitcastWordToTagged(
+      Load(MachineType::Pointer(), base, needs_poisoning));
+}
+
+Node* CodeAssembler::LoadFullTagged(Node* base, Node* offset,
+                                    LoadSensitivity needs_poisoning) {
+  return BitcastWordToTagged(
+      Load(MachineType::Pointer(), base, offset, needs_poisoning));
+}
+
 Node* CodeAssembler::AtomicLoad(MachineType rep, Node* base, Node* offset) {
   return raw_assembler()->AtomicLoad(rep, base, offset);
 }
@@ -972,7 +984,7 @@ TNode<Object> CodeAssembler::LoadRoot(RootIndex root_index) {
       ExternalConstant(ExternalReference::isolate_root(isolate()));
   int offset = IsolateData::root_slot_offset(root_index);
   return UncheckedCast<Object>(
-      Load(MachineType::AnyTagged(), isolate_root, IntPtrConstant(offset)));
+      LoadFullTagged(isolate_root, IntPtrConstant(offset)));
 }
 
 Node* CodeAssembler::Store(Node* base, Node* value) {
@@ -1007,6 +1019,18 @@ Node* CodeAssembler::StoreNoWriteBarrier(MachineRepresentation rep, Node* base,
   return raw_assembler()->Store(rep, base, offset, value, kNoWriteBarrier);
 }
 
+Node* CodeAssembler::StoreFullTaggedNoWriteBarrier(Node* base,
+                                                   Node* tagged_value) {
+  return StoreNoWriteBarrier(MachineType::PointerRepresentation(), base,
+                             BitcastTaggedToWord(tagged_value));
+}
+
+Node* CodeAssembler::StoreFullTaggedNoWriteBarrier(Node* base, Node* offset,
+                                                   Node* tagged_value) {
+  return StoreNoWriteBarrier(MachineType::PointerRepresentation(), base, offset,
+                             BitcastTaggedToWord(tagged_value));
+}
+
 Node* CodeAssembler::AtomicStore(MachineRepresentation rep, Node* base,
                                  Node* offset, Node* value, Node* value_high) {
   return raw_assembler()->AtomicStore(rep, base, offset, value, value_high);
@@ -1041,8 +1065,8 @@ Node* CodeAssembler::StoreRoot(RootIndex root_index, Node* value) {
   Node* isolate_root =
       ExternalConstant(ExternalReference::isolate_root(isolate()));
   int offset = IsolateData::root_slot_offset(root_index);
-  return StoreNoWriteBarrier(MachineRepresentation::kTagged, isolate_root,
-                             IntPtrConstant(offset), value);
+  return StoreFullTaggedNoWriteBarrier(isolate_root, IntPtrConstant(offset),
+                                       value);
 }
 
 Node* CodeAssembler::Retain(Node* value) {

src/compiler/code-assembler.h

@@ -917,6 +917,13 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   Node* Load(MachineType rep, Node* base, Node* offset,
              LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
   Node* AtomicLoad(MachineType rep, Node* base, Node* offset);
+  // Load uncompressed tagged value from (most likely off JS heap) memory
+  // location.
+  Node* LoadFullTagged(
+      Node* base, LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
+  Node* LoadFullTagged(
+      Node* base, Node* offset,
+      LoadSensitivity needs_poisoning = LoadSensitivity::kSafe);
 
   // Load a value from the root array.
   TNode<Object> LoadRoot(RootIndex root_index);
@@ -927,6 +934,12 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   Node* StoreNoWriteBarrier(MachineRepresentation rep, Node* base, Node* value);
   Node* StoreNoWriteBarrier(MachineRepresentation rep, Node* base, Node* offset,
                             Node* value);
+  // Stores uncompressed tagged value to (most likely off JS heap) memory
+  // location without write barrier.
+  Node* StoreFullTaggedNoWriteBarrier(Node* base, Node* tagged_value);
+  Node* StoreFullTaggedNoWriteBarrier(Node* base, Node* offset,
+                                      Node* tagged_value);
+
   // Optimized memory operations that map to Turbofan simplified nodes.
   TNode<HeapObject> OptimizedAllocate(TNode<IntPtrT> size,
                                       PretenureFlag pretenure);

src/elements.cc

@@ -460,8 +460,13 @@ static void SortIndices(
             [isolate](Tagged_t elementA, Tagged_t elementB) {
               // TODO(ishell): revisit the code below
               STATIC_ASSERT(kTaggedSize == kSystemPointerSize);
+#ifdef V8_COMPRESS_POINTERS
+              Object a(DecompressTaggedAny(isolate->isolate_root(), elementA));
+              Object b(DecompressTaggedAny(isolate->isolate_root(), elementB));
+#else
               Object a(elementA);
               Object b(elementB);
+#endif
               if (a->IsSmi() || !a->IsUndefined(isolate)) {
                 if (!b->IsSmi() && b->IsUndefined(isolate)) {
                   return true;

src/interpreter/interpreter-assembler.cc

@@ -236,12 +236,13 @@ Node* InterpreterAssembler::RegisterFrameOffset(Node* index) {
 }
 
 Node* InterpreterAssembler::LoadRegister(Node* reg_index) {
-  return Load(MachineType::AnyTagged(), GetInterpretedFramePointer(),
-              RegisterFrameOffset(reg_index), LoadSensitivity::kCritical);
+  return LoadFullTagged(GetInterpretedFramePointer(),
+                        RegisterFrameOffset(reg_index),
+                        LoadSensitivity::kCritical);
 }
 
 Node* InterpreterAssembler::LoadRegister(Register reg) {
-  return Load(MachineType::AnyTagged(), GetInterpretedFramePointer(),
+  return LoadFullTagged(GetInterpretedFramePointer(),
                         IntPtrConstant(reg.ToOperand() * kSystemPointerSize));
 }
 
@@ -282,7 +283,7 @@ Node* InterpreterAssembler::LoadRegisterFromRegisterList(
     const RegListNodePair& reg_list, int index) {
   Node* location = RegisterLocationInRegisterList(reg_list, index);
   // Location is already poisoned on speculation, so no need to poison here.
-  return Load(MachineType::AnyTagged(), location);
+  return LoadFullTagged(location);
 }
 
 Node* InterpreterAssembler::RegisterLocationInRegisterList(
@@ -296,14 +297,13 @@ Node* InterpreterAssembler::RegisterLocationInRegisterList(
 }
 
 void InterpreterAssembler::StoreRegister(Node* value, Register reg) {
-  StoreNoWriteBarrier(
-      MachineRepresentation::kTagged, GetInterpretedFramePointer(),
+  StoreFullTaggedNoWriteBarrier(
+      GetInterpretedFramePointer(),
       IntPtrConstant(reg.ToOperand() * kSystemPointerSize), value);
 }
 
 void InterpreterAssembler::StoreRegister(Node* value, Node* reg_index) {
-  StoreNoWriteBarrier(MachineRepresentation::kTagged,
-                      GetInterpretedFramePointer(),
+  StoreFullTaggedNoWriteBarrier(GetInterpretedFramePointer(),
                                 RegisterFrameOffset(reg_index), value);
 }
 

src/interpreter/interpreter-generator.cc

@@ -2897,8 +2897,7 @@ IGNITION_HANDLER(SetPendingMessage, InterpreterAssembler) {
       ExternalReference::address_of_pending_message_obj(isolate()));
   Node* previous_message = Load(MachineType::TaggedPointer(), pending_message);
   Node* new_message = GetAccumulator();
-  StoreNoWriteBarrier(MachineRepresentation::kTaggedPointer, pending_message,
-                      new_message);
+  StoreFullTaggedNoWriteBarrier(pending_message, new_message);
   SetAccumulator(previous_message);
   Dispatch();
 }

src/objects/slots-inl.h

@@ -111,7 +111,11 @@ void FullHeapObjectSlot::StoreHeapObject(HeapObject value) const {
 inline void MemsetTagged(ObjectSlot start, Object value, size_t counter) {
   // TODO(ishell): revisit this implementation, maybe use "rep stosl"
   STATIC_ASSERT(kTaggedSize == kSystemPointerSize);
-  MemsetPointer(start.location(), value.ptr(), counter);
+  Address raw_value = value.ptr();
+#ifdef V8_COMPRESS_POINTERS
+  raw_value = CompressTagged(raw_value);
+#endif
+  MemsetPointer(start.location(), raw_value, counter);
 }
 
 // Sets |counter| number of kSystemPointerSize-sized values starting at |start|

test/unittests/interpreter/interpreter-assembler-unittest.cc

@@ -291,10 +291,10 @@ InterpreterAssemblerTest::InterpreterAssemblerForTest::IsLoadRegisterOperand(
     int offset, OperandSize operand_size) {
   Matcher<compiler::Node*> reg_operand = IsChangeInt32ToIntPtr(
       IsSignedOperand(offset, operand_size, LoadSensitivity::kSafe));
-  return IsLoad(
-      MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
-      c::IsWordShl(reg_operand, c::IsIntPtrConstant(kPointerSizeLog2)),
-      LoadSensitivity::kCritical);
+  return IsBitcastWordToTagged(IsLoad(
+      MachineType::Pointer(), c::IsLoadParentFramePointer(),
+      c::IsWordShl(reg_operand, c::IsIntPtrConstant(kSystemPointerSizeLog2)),
+      LoadSensitivity::kCritical));
 }
 
 TARGET_TEST_F(InterpreterAssemblerTest, Jump) {
@@ -418,9 +418,10 @@ TARGET_TEST_F(InterpreterAssemblerTest, GetContext) {
     InterpreterAssemblerForTest m(&state, bytecode);
     EXPECT_THAT(
         m.GetContext(),
-        m.IsLoad(MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
+        IsBitcastWordToTagged(m.IsLoad(
+            MachineType::Pointer(), c::IsLoadParentFramePointer(),
             c::IsIntPtrConstant(Register::current_context().ToOperand() *
-                                     kPointerSize)));
+                                kSystemPointerSize))));
   }
 }
 
@@ -533,10 +534,10 @@ TARGET_TEST_F(InterpreterAssemblerTest, LoadFeedbackVector) {
     InterpreterAssemblerForTest m(&state, bytecode);
     Node* feedback_vector = m.LoadFeedbackVector();
 
-    Matcher<Node*> load_function_matcher =
-        m.IsLoad(MachineType::AnyTagged(), c::IsLoadParentFramePointer(),
+    Matcher<Node*> load_function_matcher = IsBitcastWordToTagged(
+        m.IsLoad(MachineType::Pointer(), c::IsLoadParentFramePointer(),
                  c::IsIntPtrConstant(Register::function_closure().ToOperand() *
-                                     kPointerSize));
+                                     kSystemPointerSize)));
     Matcher<Node*> load_vector_cell_matcher = m.IsLoad(
         MachineType::AnyTagged(), load_function_matcher,
         c::IsIntPtrConstant(JSFunction::kFeedbackCellOffset - kHeapObjectTag));