[turbofan] Move simplified alloc, load and store lowering to change lowering.

This is necessary to allow more optimizations to take place between
the representation inference and change lowering. Perhaps we want
to rename SimplifiedLowering -> RepresentationInference and
ChangeLowering -> SimplifiedLowering.

Review URL: https://codereview.chromium.org/1439473003

Cr-Commit-Position: refs/heads/master@{#31976}

src/compiler/change-lowering.cc

@@ -4,12 +4,14 @@
 
 #include "src/compiler/change-lowering.h"
 
+#include "src/address-map.h"
 #include "src/code-factory.h"
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/machine-operator.h"
 #include "src/compiler/node-properties.h"
 #include "src/compiler/operator-properties.h"
+#include "src/compiler/simplified-operator.h"
 
 namespace v8 {
 namespace internal {
@@ -37,6 +39,16 @@ Reduction ChangeLowering::Reduce(Node* node) {
       return ChangeTaggedToUI32(node->InputAt(0), control, kUnsigned);
     case IrOpcode::kChangeUint32ToTagged:
       return ChangeUint32ToTagged(node->InputAt(0), control);
+    case IrOpcode::kLoadField:
+      return LoadField(node);
+    case IrOpcode::kStoreField:
+      return StoreField(node);
+    case IrOpcode::kLoadElement:
+      return LoadElement(node);
+    case IrOpcode::kStoreElement:
+      return StoreElement(node);
+    case IrOpcode::kAllocate:
+      return Allocate(node);
     default:
       return NoChange();
   }
@@ -407,6 +419,153 @@ Reduction ChangeLowering::ChangeUint32ToTagged(Node* value, Node* control) {
 }
 
 
+namespace {
+
+WriteBarrierKind ComputeWriteBarrierKind(BaseTaggedness base_is_tagged,
+                                         MachineType representation,
+                                         Type* field_type, Type* input_type) {
+  if (field_type->Is(Type::TaggedSigned()) ||
+      input_type->Is(Type::TaggedSigned())) {
+    // Write barriers are only for writes of heap objects.
+    return kNoWriteBarrier;
+  }
+  if (input_type->Is(Type::BooleanOrNullOrUndefined())) {
+    // Write barriers are not necessary when storing true, false, null or
+    // undefined, because these special oddballs are always in the root set.
+    return kNoWriteBarrier;
+  }
+  if (base_is_tagged == kTaggedBase &&
+      RepresentationOf(representation) == kRepTagged) {
+    if (input_type->IsConstant() &&
+        input_type->AsConstant()->Value()->IsHeapObject()) {
+      Handle<HeapObject> input =
+          Handle<HeapObject>::cast(input_type->AsConstant()->Value());
+      if (input->IsMap()) {
+        // Write barriers for storing maps are cheaper.
+        return kMapWriteBarrier;
+      }
+      Isolate* const isolate = input->GetIsolate();
+      RootIndexMap root_index_map(isolate);
+      int root_index = root_index_map.Lookup(*input);
+      if (root_index != RootIndexMap::kInvalidRootIndex &&
+          isolate->heap()->RootIsImmortalImmovable(root_index)) {
+        // Write barriers are unnecessary for immortal immovable roots.
+        return kNoWriteBarrier;
+      }
+    }
+    if (field_type->Is(Type::TaggedPointer()) ||
+        input_type->Is(Type::TaggedPointer())) {
+      // Write barriers for heap objects don't need a Smi check.
+      return kPointerWriteBarrier;
+    }
+    // Write barriers are only for writes into heap objects (i.e. tagged base).
+    return kFullWriteBarrier;
+  }
+  return kNoWriteBarrier;
+}
+
+}  // namespace
+
+
+Reduction ChangeLowering::LoadField(Node* node) {
+  const FieldAccess& access = FieldAccessOf(node->op());
+  Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
+  node->InsertInput(graph()->zone(), 1, offset);
+  NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
+  return Changed(node);
+}
+
+
+Reduction ChangeLowering::StoreField(Node* node) {
+  const FieldAccess& access = FieldAccessOf(node->op());
+  Type* type = NodeProperties::GetType(node->InputAt(1));
+  WriteBarrierKind kind = ComputeWriteBarrierKind(
+      access.base_is_tagged, access.machine_type, access.type, type);
+  Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
+  node->InsertInput(graph()->zone(), 1, offset);
+  NodeProperties::ChangeOp(
+      node, machine()->Store(StoreRepresentation(access.machine_type, kind)));
+  return Changed(node);
+}
+
+
+Node* ChangeLowering::ComputeIndex(const ElementAccess& access,
+                                   Node* const key) {
+  Node* index = key;
+  const int element_size_shift = ElementSizeLog2Of(access.machine_type);
+  if (element_size_shift) {
+    index = graph()->NewNode(machine()->Word32Shl(), index,
+                             jsgraph()->Int32Constant(element_size_shift));
+  }
+  const int fixed_offset = access.header_size - access.tag();
+  if (fixed_offset) {
+    index = graph()->NewNode(machine()->Int32Add(), index,
+                             jsgraph()->Int32Constant(fixed_offset));
+  }
+  if (machine()->Is64()) {
+    // TODO(turbofan): This is probably only correct for typed arrays, and only
+    // if the typed arrays are at most 2GiB in size, which happens to match
+    // exactly our current situation.
+    index = graph()->NewNode(machine()->ChangeUint32ToUint64(), index);
+  }
+  return index;
+}
+
+
+Reduction ChangeLowering::LoadElement(Node* node) {
+  const ElementAccess& access = ElementAccessOf(node->op());
+  node->ReplaceInput(1, ComputeIndex(access, node->InputAt(1)));
+  NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
+  return Changed(node);
+}
+
+
+Reduction ChangeLowering::StoreElement(Node* node) {
+  const ElementAccess& access = ElementAccessOf(node->op());
+  Type* type = NodeProperties::GetType(node->InputAt(2));
+  node->ReplaceInput(1, ComputeIndex(access, node->InputAt(1)));
+  NodeProperties::ChangeOp(
+      node,
+      machine()->Store(StoreRepresentation(
+          access.machine_type,
+          ComputeWriteBarrierKind(access.base_is_tagged, access.machine_type,
+                                  access.type, type))));
+  return Changed(node);
+}
+
+
+Reduction ChangeLowering::Allocate(Node* node) {
+  PretenureFlag pretenure = OpParameter<PretenureFlag>(node->op());
+  if (pretenure == NOT_TENURED) {
+    Callable callable = CodeFactory::AllocateInNewSpace(isolate());
+    Node* target = jsgraph()->HeapConstant(callable.code());
+    CallDescriptor* descriptor = Linkage::GetStubCallDescriptor(
+        isolate(), jsgraph()->zone(), callable.descriptor(), 0,
+        CallDescriptor::kNoFlags, Operator::kNoThrow);
+    const Operator* op = common()->Call(descriptor);
+    node->InsertInput(graph()->zone(), 0, target);
+    node->InsertInput(graph()->zone(), 2, jsgraph()->NoContextConstant());
+    NodeProperties::ChangeOp(node, op);
+  } else {
+    DCHECK_EQ(TENURED, pretenure);
+    AllocationSpace space = OLD_SPACE;
+    Runtime::FunctionId f = Runtime::kAllocateInTargetSpace;
+    Operator::Properties props = node->op()->properties();
+    CallDescriptor* desc =
+        Linkage::GetRuntimeCallDescriptor(jsgraph()->zone(), f, 2, props);
+    ExternalReference ref(f, jsgraph()->isolate());
+    int32_t flags = AllocateTargetSpace::encode(space);
+    node->InsertInput(graph()->zone(), 0, jsgraph()->CEntryStubConstant(1));
+    node->InsertInput(graph()->zone(), 2, jsgraph()->SmiConstant(flags));
+    node->InsertInput(graph()->zone(), 3, jsgraph()->ExternalConstant(ref));
+    node->InsertInput(graph()->zone(), 4, jsgraph()->Int32Constant(2));
+    node->InsertInput(graph()->zone(), 5, jsgraph()->NoContextConstant());
+    NodeProperties::ChangeOp(node, common()->Call(desc));
+  }
+  return Changed(node);
+}
+
+
 Isolate* ChangeLowering::isolate() const { return jsgraph()->isolate(); }
 
 

src/compiler/change-lowering.h

@@ -13,6 +13,7 @@ namespace compiler {
 
 // Forward declarations.
 class CommonOperatorBuilder;
+struct ElementAccess;
 class JSGraph;
 class Linkage;
 class MachineOperatorBuilder;
@@ -49,6 +50,13 @@ class ChangeLowering final : public Reducer {
                                Signedness signedness);
   Reduction ChangeUint32ToTagged(Node* value, Node* control);
 
+  Reduction LoadField(Node* node);
+  Reduction StoreField(Node* node);
+  Reduction LoadElement(Node* node);
+  Reduction StoreElement(Node* node);
+  Reduction Allocate(Node* node);
+
+  Node* ComputeIndex(const ElementAccess& access, Node* const key);
   Graph* graph() const;
   Isolate* isolate() const;
   JSGraph* jsgraph() const { return jsgraph_; }

src/compiler/simplified-lowering.cc

@@ -6,7 +6,6 @@
 
 #include <limits>
 
-#include "src/address-map.h"
 #include "src/base/bits.h"
 #include "src/code-factory.h"
 #include "src/compiler/common-operator.h"
@@ -820,7 +819,6 @@ class RepresentationSelector {
         ProcessInput(node, 0, kMachAnyTagged);
         ProcessRemainingInputs(node, 1);
         SetOutput(node, kMachAnyTagged);
-        if (lower()) lowering->DoAllocate(node);
         break;
       }
       case IrOpcode::kLoadField: {
@@ -828,7 +826,6 @@ class RepresentationSelector {
         ProcessInput(node, 0, changer_->TypeForBasePointer(access));
         ProcessRemainingInputs(node, 1);
         SetOutput(node, access.machine_type);
-        if (lower()) lowering->DoLoadField(node);
         break;
       }
       case IrOpcode::kStoreField: {
@@ -837,7 +834,6 @@ class RepresentationSelector {
         ProcessInput(node, 1, access.machine_type);
         ProcessRemainingInputs(node, 2);
         SetOutput(node, 0);
-        if (lower()) lowering->DoStoreField(node);
         break;
       }
       case IrOpcode::kLoadBuffer: {
@@ -883,7 +879,6 @@ class RepresentationSelector {
         ProcessInput(node, 1, kMachInt32);                            // index
         ProcessRemainingInputs(node, 2);
         SetOutput(node, access.machine_type);
-        if (lower()) lowering->DoLoadElement(node);
         break;
       }
       case IrOpcode::kStoreElement: {
@@ -893,7 +888,6 @@ class RepresentationSelector {
         ProcessInput(node, 2, access.machine_type);                   // value
         ProcessRemainingInputs(node, 3);
         SetOutput(node, 0);
-        if (lower()) lowering->DoStoreElement(node);
         break;
       }
       case IrOpcode::kObjectIsNumber: {
@@ -1142,128 +1136,6 @@ void SimplifiedLowering::LowerAllNodes() {
 }
 
 
-namespace {
-
-WriteBarrierKind ComputeWriteBarrierKind(BaseTaggedness base_is_tagged,
-                                         MachineType representation,
-                                         Type* field_type, Type* input_type) {
-  if (field_type->Is(Type::TaggedSigned()) ||
-      input_type->Is(Type::TaggedSigned())) {
-    // Write barriers are only for writes of heap objects.
-    return kNoWriteBarrier;
-  }
-  if (input_type->Is(Type::BooleanOrNullOrUndefined())) {
-    // Write barriers are not necessary when storing true, false, null or
-    // undefined, because these special oddballs are always in the root set.
-    return kNoWriteBarrier;
-  }
-  if (base_is_tagged == kTaggedBase &&
-      RepresentationOf(representation) == kRepTagged) {
-    if (input_type->IsConstant() &&
-        input_type->AsConstant()->Value()->IsHeapObject()) {
-      Handle<HeapObject> input =
-          Handle<HeapObject>::cast(input_type->AsConstant()->Value());
-      if (input->IsMap()) {
-        // Write barriers for storing maps are cheaper.
-        return kMapWriteBarrier;
-      }
-      Isolate* const isolate = input->GetIsolate();
-      RootIndexMap root_index_map(isolate);
-      int root_index = root_index_map.Lookup(*input);
-      if (root_index != RootIndexMap::kInvalidRootIndex &&
-          isolate->heap()->RootIsImmortalImmovable(root_index)) {
-        // Write barriers are unnecessary for immortal immovable roots.
-        return kNoWriteBarrier;
-      }
-    }
-    if (field_type->Is(Type::TaggedPointer()) ||
-        input_type->Is(Type::TaggedPointer())) {
-      // Write barriers for heap objects don't need a Smi check.
-      return kPointerWriteBarrier;
-    }
-    // Write barriers are only for writes into heap objects (i.e. tagged base).
-    return kFullWriteBarrier;
-  }
-  return kNoWriteBarrier;
-}
-
-}  // namespace
-
-
-void SimplifiedLowering::DoAllocate(Node* node) {
-  PretenureFlag pretenure = OpParameter<PretenureFlag>(node->op());
-  if (pretenure == NOT_TENURED) {
-    Callable callable = CodeFactory::AllocateInNewSpace(isolate());
-    Node* target = jsgraph()->HeapConstant(callable.code());
-    CallDescriptor* descriptor = Linkage::GetStubCallDescriptor(
-        isolate(), jsgraph()->zone(), callable.descriptor(), 0,
-        CallDescriptor::kNoFlags, Operator::kNoThrow);
-    const Operator* op = common()->Call(descriptor);
-    node->InsertInput(graph()->zone(), 0, target);
-    node->InsertInput(graph()->zone(), 2, jsgraph()->NoContextConstant());
-    NodeProperties::ChangeOp(node, op);
-  } else {
-    DCHECK_EQ(TENURED, pretenure);
-    AllocationSpace space = OLD_SPACE;
-    Runtime::FunctionId f = Runtime::kAllocateInTargetSpace;
-    Operator::Properties props = node->op()->properties();
-    CallDescriptor* desc =
-        Linkage::GetRuntimeCallDescriptor(zone(), f, 2, props);
-    ExternalReference ref(f, jsgraph()->isolate());
-    int32_t flags = AllocateTargetSpace::encode(space);
-    node->InsertInput(graph()->zone(), 0, jsgraph()->CEntryStubConstant(1));
-    node->InsertInput(graph()->zone(), 2, jsgraph()->SmiConstant(flags));
-    node->InsertInput(graph()->zone(), 3, jsgraph()->ExternalConstant(ref));
-    node->InsertInput(graph()->zone(), 4, jsgraph()->Int32Constant(2));
-    node->InsertInput(graph()->zone(), 5, jsgraph()->NoContextConstant());
-    NodeProperties::ChangeOp(node, common()->Call(desc));
-  }
-}
-
-
-void SimplifiedLowering::DoLoadField(Node* node) {
-  const FieldAccess& access = FieldAccessOf(node->op());
-  Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
-  node->InsertInput(graph()->zone(), 1, offset);
-  NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
-}
-
-
-void SimplifiedLowering::DoStoreField(Node* node) {
-  const FieldAccess& access = FieldAccessOf(node->op());
-  Type* type = NodeProperties::GetType(node->InputAt(1));
-  WriteBarrierKind kind = ComputeWriteBarrierKind(
-      access.base_is_tagged, access.machine_type, access.type, type);
-  Node* offset = jsgraph()->IntPtrConstant(access.offset - access.tag());
-  node->InsertInput(graph()->zone(), 1, offset);
-  NodeProperties::ChangeOp(
-      node, machine()->Store(StoreRepresentation(access.machine_type, kind)));
-}
-
-
-Node* SimplifiedLowering::ComputeIndex(const ElementAccess& access,
-                                       Node* const key) {
-  Node* index = key;
-  const int element_size_shift = ElementSizeLog2Of(access.machine_type);
-  if (element_size_shift) {
-    index = graph()->NewNode(machine()->Word32Shl(), index,
-                             jsgraph()->Int32Constant(element_size_shift));
-  }
-  const int fixed_offset = access.header_size - access.tag();
-  if (fixed_offset) {
-    index = graph()->NewNode(machine()->Int32Add(), index,
-                             jsgraph()->Int32Constant(fixed_offset));
-  }
-  if (machine()->Is64()) {
-    // TODO(turbofan): This is probably only correct for typed arrays, and only
-    // if the typed arrays are at most 2GiB in size, which happens to match
-    // exactly our current situation.
-    index = graph()->NewNode(machine()->ChangeUint32ToUint64(), index);
-  }
-  return index;
-}
-
-
 void SimplifiedLowering::DoLoadBuffer(Node* node, MachineType output_type,
                                       RepresentationChanger* changer) {
   DCHECK_EQ(IrOpcode::kLoadBuffer, node->opcode());
@@ -1329,26 +1201,6 @@ void SimplifiedLowering::DoStoreBuffer(Node* node) {
 }
 
 
-void SimplifiedLowering::DoLoadElement(Node* node) {
-  const ElementAccess& access = ElementAccessOf(node->op());
-  node->ReplaceInput(1, ComputeIndex(access, node->InputAt(1)));
-  NodeProperties::ChangeOp(node, machine()->Load(access.machine_type));
-}
-
-
-void SimplifiedLowering::DoStoreElement(Node* node) {
-  const ElementAccess& access = ElementAccessOf(node->op());
-  Type* type = NodeProperties::GetType(node->InputAt(2));
-  node->ReplaceInput(1, ComputeIndex(access, node->InputAt(1)));
-  NodeProperties::ChangeOp(
-      node,
-      machine()->Store(StoreRepresentation(
-          access.machine_type,
-          ComputeWriteBarrierKind(access.base_is_tagged, access.machine_type,
-                                  access.type, type))));
-}
-
-
 void SimplifiedLowering::DoObjectIsNumber(Node* node) {
   Node* input = NodeProperties::GetValueInput(node, 0);
   // TODO(bmeurer): Optimize somewhat based on input type.

src/compiler/simplified-lowering.h

@@ -26,17 +26,11 @@ class SimplifiedLowering final {
 
   void LowerAllNodes();
 
-  // TODO(titzer): These are exposed for direct testing. Use a friend class.
-  void DoAllocate(Node* node);
-  void DoLoadField(Node* node);
-  void DoStoreField(Node* node);
   // TODO(turbofan): The output_type can be removed once the result of the
   // representation analysis is stored in the node bounds.
   void DoLoadBuffer(Node* node, MachineType output_type,
                     RepresentationChanger* changer);
   void DoStoreBuffer(Node* node);
-  void DoLoadElement(Node* node);
-  void DoStoreElement(Node* node);
   void DoObjectIsNumber(Node* node);
   void DoObjectIsSmi(Node* node);
   void DoShift(Node* node, Operator const* op);
@@ -56,7 +50,6 @@ class SimplifiedLowering final {
   // position information via the SourcePositionWrapper like all other reducers.
   SourcePositionTable* source_positions_;
 
-  Node* ComputeIndex(const ElementAccess& access, Node* const key);
   Node* StringComparison(Node* node);
   Node* Int32Div(Node* const node);
   Node* Int32Mod(Node* const node);

test/unittests/compiler/change-lowering-unittest.cc

@@ -177,6 +177,161 @@ TARGET_TEST_P(ChangeLoweringCommonTest, ChangeTaggedToUint32WithTaggedPointer) {
 }
 
 
+TARGET_TEST_P(ChangeLoweringCommonTest, StoreFieldSmi) {
+  FieldAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize,
+                        Handle<Name>::null(), Type::Any(), kMachAnyTagged};
+  Node* p0 = Parameter(Type::TaggedPointer());
+  Node* p1 = Parameter(Type::TaggedSigned());
+  Node* store = graph()->NewNode(simplified()->StoreField(access), p0, p1,
+                                 graph()->start(), graph()->start());
+  Reduction r = Reduce(store);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(),
+              IsStore(StoreRepresentation(kMachAnyTagged, kNoWriteBarrier), p0,
+                      IsIntPtrConstant(access.offset - access.tag()), p1,
+                      graph()->start(), graph()->start()));
+}
+
+
+TARGET_TEST_P(ChangeLoweringCommonTest, StoreFieldTagged) {
+  FieldAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize,
+                        Handle<Name>::null(), Type::Any(), kMachAnyTagged};
+  Node* p0 = Parameter(Type::TaggedPointer());
+  Node* p1 = Parameter(Type::Tagged());
+  Node* store = graph()->NewNode(simplified()->StoreField(access), p0, p1,
+                                 graph()->start(), graph()->start());
+  Reduction r = Reduce(store);
+
+  ASSERT_TRUE(r.Changed());
+  EXPECT_THAT(r.replacement(),
+              IsStore(StoreRepresentation(kMachAnyTagged, kFullWriteBarrier),
+                      p0, IsIntPtrConstant(access.offset - access.tag()), p1,
+                      graph()->start(), graph()->start()));
+}
+
+
+TARGET_TEST_P(ChangeLoweringCommonTest, LoadField) {
+  FieldAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize,
+                        Handle<Name>::null(), Type::Any(), kMachAnyTagged};
+  Node* p0 = Parameter(Type::TaggedPointer());
+  Node* load = graph()->NewNode(simplified()->LoadField(access), p0,
+                                graph()->start(), graph()->start());
+  Reduction r = Reduce(load);
+
+  ASSERT_TRUE(r.Changed());
+  Matcher<Node*> index_match = IsIntPtrConstant(access.offset - access.tag());
+  EXPECT_THAT(
+      r.replacement(),
+      IsLoad(kMachAnyTagged, p0, IsIntPtrConstant(access.offset - access.tag()),
+             graph()->start(), graph()->start()));
+}
+
+
+TARGET_TEST_P(ChangeLoweringCommonTest, StoreElementTagged) {
+  ElementAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize, Type::Any(),
+                          kMachAnyTagged};
+  Node* p0 = Parameter(Type::TaggedPointer());
+  Node* p1 = Parameter(Type::Signed32());
+  Node* p2 = Parameter(Type::Tagged());
+  Node* store = graph()->NewNode(simplified()->StoreElement(access), p0, p1, p2,
+                                 graph()->start(), graph()->start());
+  Reduction r = Reduce(store);
+
+  const int element_size_shift = ElementSizeLog2Of(access.machine_type);
+  ASSERT_TRUE(r.Changed());
+  Matcher<Node*> index_match =
+      IsInt32Add(IsWord32Shl(p1, IsInt32Constant(element_size_shift)),
+                 IsInt32Constant(access.header_size - access.tag()));
+  if (!Is32()) {
+    index_match = IsChangeUint32ToUint64(index_match);
+  }
+
+  EXPECT_THAT(r.replacement(),
+              IsStore(StoreRepresentation(kMachAnyTagged, kFullWriteBarrier),
+                      p0, index_match, p2, graph()->start(), graph()->start()));
+}
+
+
+TARGET_TEST_P(ChangeLoweringCommonTest, StoreElementUint8) {
+  ElementAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize,
+                          Type::Signed32(), kMachUint8};
+  Node* p0 = Parameter(Type::TaggedPointer());
+  Node* p1 = Parameter(Type::Signed32());
+  Node* p2 = Parameter(Type::Signed32());
+  Node* store = graph()->NewNode(simplified()->StoreElement(access), p0, p1, p2,
+                                 graph()->start(), graph()->start());
+  Reduction r = Reduce(store);
+
+  ASSERT_TRUE(r.Changed());
+  Matcher<Node*> index_match =
+      IsInt32Add(p1, IsInt32Constant(access.header_size - access.tag()));
+  if (!Is32()) {
+    index_match = IsChangeUint32ToUint64(index_match);
+  }
+
+  EXPECT_THAT(r.replacement(),
+              IsStore(StoreRepresentation(kMachUint8, kNoWriteBarrier), p0,
+                      index_match, p2, graph()->start(), graph()->start()));
+}
+
+
+TARGET_TEST_P(ChangeLoweringCommonTest, LoadElementTagged) {
+  ElementAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize, Type::Any(),
+                          kMachAnyTagged};
+  Node* p0 = Parameter(Type::TaggedPointer());
+  Node* p1 = Parameter(Type::Signed32());
+  Node* load = graph()->NewNode(simplified()->LoadElement(access), p0, p1,
+                                graph()->start(), graph()->start());
+  Reduction r = Reduce(load);
+
+  const int element_size_shift = ElementSizeLog2Of(access.machine_type);
+  ASSERT_TRUE(r.Changed());
+  Matcher<Node*> index_match =
+      IsInt32Add(IsWord32Shl(p1, IsInt32Constant(element_size_shift)),
+                 IsInt32Constant(access.header_size - access.tag()));
+  if (!Is32()) {
+    index_match = IsChangeUint32ToUint64(index_match);
+  }
+
+  EXPECT_THAT(r.replacement(), IsLoad(kMachAnyTagged, p0, index_match,
+                                      graph()->start(), graph()->start()));
+}
+
+
+TARGET_TEST_P(ChangeLoweringCommonTest, LoadElementInt8) {
+  ElementAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize,
+                          Type::Signed32(), kMachInt8};
+  Node* p0 = Parameter(Type::TaggedPointer());
+  Node* p1 = Parameter(Type::Signed32());
+  Node* load = graph()->NewNode(simplified()->LoadElement(access), p0, p1,
+                                graph()->start(), graph()->start());
+  Reduction r = Reduce(load);
+
+  ASSERT_TRUE(r.Changed());
+  Matcher<Node*> index_match =
+      IsInt32Add(p1, IsInt32Constant(access.header_size - access.tag()));
+  if (!Is32()) {
+    index_match = IsChangeUint32ToUint64(index_match);
+  }
+
+  EXPECT_THAT(r.replacement(), IsLoad(kMachInt8, p0, index_match,
+                                      graph()->start(), graph()->start()));
+}
+
+
+TARGET_TEST_P(ChangeLoweringCommonTest, Allocate) {
+  Node* p0 = Parameter(Type::Signed32());
+  Node* alloc = graph()->NewNode(simplified()->Allocate(TENURED), p0,
+                                 graph()->start(), graph()->start());
+  Reduction r = Reduce(alloc);
+
+  // Only check that we lowered, but do not specify the exact form since
+  // this is subject to change.
+  ASSERT_TRUE(r.Changed());
+}
+
+
 INSTANTIATE_TEST_CASE_P(ChangeLoweringTest, ChangeLoweringCommonTest,
                         ::testing::Values(kRepWord32, kRepWord64));