[stubs] Fixing issues found by machine graph verifier in code stubs.

BUG=

Review-Url: https://codereview.chromium.org/2568713002
Cr-Commit-Position: refs/heads/master@{#41651}

src/builtins/builtins-internal.cc

@@ -75,8 +75,8 @@ void Builtins::Generate_CopyFastSmiOrObjectElements(
   int max_elements = FixedArrayBase::GetMaxLengthForNewSpaceAllocation(kind);
   Label if_newspace(&assembler), if_oldspace(&assembler);
   assembler.Branch(
-      assembler.UintPtrLessThan(
-          length, assembler.IntPtrOrSmiConstant(max_elements, mode)),
+      assembler.UintPtrOrSmiLessThan(
+          length, assembler.IntPtrOrSmiConstant(max_elements, mode), mode),
       &if_newspace, &if_oldspace);
 
   assembler.Bind(&if_newspace);

src/builtins/builtins-number.cc

@@ -1228,23 +1228,23 @@ TF_BUILTIN(Divide, CodeStubAssembler) {
         Label bailout(this);
 
         // Do floating point division if {divisor} is zero.
-        GotoIf(WordEqual(divisor, IntPtrConstant(0)), &bailout);
+        GotoIf(SmiEqual(divisor, SmiConstant(0)), &bailout);
 
         // Do floating point division {dividend} is zero and {divisor} is
         // negative.
         Label dividend_is_zero(this), dividend_is_not_zero(this);
-        Branch(WordEqual(dividend, IntPtrConstant(0)), &dividend_is_zero,
+        Branch(SmiEqual(dividend, SmiConstant(0)), &dividend_is_zero,
                &dividend_is_not_zero);
 
         Bind(&dividend_is_zero);
         {
-          GotoIf(IntPtrLessThan(divisor, IntPtrConstant(0)), &bailout);
+          GotoIf(SmiLessThan(divisor, SmiConstant(0)), &bailout);
           Goto(&dividend_is_not_zero);
         }
         Bind(&dividend_is_not_zero);
 
-        Node* untagged_divisor = SmiUntag(divisor);
-        Node* untagged_dividend = SmiUntag(dividend);
+        Node* untagged_divisor = SmiToWord32(divisor);
+        Node* untagged_dividend = SmiToWord32(dividend);
 
         // Do floating point division if {dividend} is kMinInt (or kMinInt - 1
         // if the Smi size is 31) and {divisor} is -1.
@@ -1269,7 +1269,7 @@ TF_BUILTIN(Divide, CodeStubAssembler) {
         Node* truncated = Int32Mul(untagged_result, untagged_divisor);
         // Do floating point division if the remainder is not 0.
         GotoIf(Word32NotEqual(untagged_dividend, truncated), &bailout);
-        var_result.Bind(SmiTag(untagged_result));
+        var_result.Bind(SmiFromWord32(untagged_result));
         Goto(&end);
 
         // Bailout: convert {dividend} and {divisor} to double and do double

src/builtins/builtins.cc

@@ -108,7 +108,14 @@ Code* BuildWithCodeStubAssemblerCS(Isolate* isolate,
   DCHECK_LE(0, descriptor.GetRegisterParameterCount());
   compiler::CodeAssemblerState state(isolate, &zone, descriptor, flags, name);
   generator(&state);
+
+  // TODO(ishell): remove this when code stub assembler graphs verification
+  // is enabled for all stubs.
+  bool saved_csa_verify = FLAG_csa_verify;
+  // Enable verification only in mksnapshot.
+  FLAG_csa_verify = DEBUG_BOOL && FLAG_startup_blob != nullptr;
   Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
+  FLAG_csa_verify = saved_csa_verify;
   PostBuildProfileAndTracing(isolate, *code, name);
   return *code;
 }

src/code-stub-assembler.h

@@ -95,27 +95,27 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return value;
   }
 
-#define PARAMETER_BINARY_OPERATION(OpName, IntPtrOpName, SmiOpName, \
-                                   Int32OpName)                     \
-  Node* OpName(Node* value1, Node* value2, ParameterMode mode) {    \
-    if (mode == SMI_PARAMETERS) {                                   \
-      return SmiOpName(value1, value2);                             \
-    } else if (mode == INTPTR_PARAMETERS) {                         \
-      return IntPtrOpName(value1, value2);                          \
-    } else {                                                        \
-      DCHECK_EQ(INTEGER_PARAMETERS, mode);                          \
-      return Int32OpName(value1, value2);                           \
-    }                                                               \
+#define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName, Int32OpName) \
+  Node* OpName(Node* a, Node* b, ParameterMode mode) {                \
+    if (mode == SMI_PARAMETERS) {                                     \
+      return SmiOpName(a, b);                                         \
+    } else if (mode == INTPTR_PARAMETERS) {                           \
+      return IntPtrOpName(a, b);                                      \
+    } else {                                                          \
+      DCHECK_EQ(INTEGER_PARAMETERS, mode);                            \
+      return Int32OpName(a, b);                                       \
+    }                                                                 \
   }
-  PARAMETER_BINARY_OPERATION(IntPtrOrSmiAdd, IntPtrAdd, SmiAdd, Int32Add)
-  PARAMETER_BINARY_OPERATION(IntPtrOrSmiLessThan, IntPtrLessThan, SmiLessThan,
-                             Int32LessThan)
-  PARAMETER_BINARY_OPERATION(IntPtrOrSmiGreaterThan, IntPtrGreaterThan,
-                             SmiGreaterThan, Int32GreaterThan)
-  PARAMETER_BINARY_OPERATION(UintPtrOrSmiLessThan, UintPtrLessThan, SmiBelow,
-                             Uint32LessThan)
-
-#undef PARAMETER_BINARY_OPERATION
+  PARAMETER_BINOP(IntPtrOrSmiAdd, IntPtrAdd, SmiAdd, Int32Add)
+  PARAMETER_BINOP(IntPtrOrSmiLessThan, IntPtrLessThan, SmiLessThan,
+                  Int32LessThan)
+  PARAMETER_BINOP(IntPtrOrSmiGreaterThan, IntPtrGreaterThan, SmiGreaterThan,
+                  Int32GreaterThan)
+  PARAMETER_BINOP(UintPtrOrSmiLessThan, UintPtrLessThan, SmiBelow,
+                  Uint32LessThan)
+  PARAMETER_BINOP(UintPtrOrSmiGreaterThanOrEqual, UintPtrGreaterThanOrEqual,
+                  SmiAboveOrEqual, Uint32GreaterThanOrEqual)
+#undef PARAMETER_BINOP
 
   Node* NoContextConstant();
 #define HEAP_CONSTANT_ACCESSOR(rootName, name) Node* name##Constant();
@@ -157,25 +157,46 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* SmiToWord32(Node* value);
 
   // Smi operations.
-  Node* SmiAdd(Node* a, Node* b);
-  Node* SmiSub(Node* a, Node* b);
-  Node* SmiEqual(Node* a, Node* b);
-  Node* SmiAbove(Node* a, Node* b);
-  Node* SmiAboveOrEqual(Node* a, Node* b);
-  Node* SmiBelow(Node* a, Node* b);
-  Node* SmiLessThan(Node* a, Node* b);
-  Node* SmiLessThanOrEqual(Node* a, Node* b);
-  Node* SmiGreaterThan(Node* a, Node* b);
+#define SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName)                  \
+  Node* SmiOpName(Node* a, Node* b) {                                  \
+    return BitcastWordToTaggedSigned(                                  \
+        IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b))); \
+  }
+  SMI_ARITHMETIC_BINOP(SmiAdd, IntPtrAdd)
+  SMI_ARITHMETIC_BINOP(SmiSub, IntPtrSub)
+  SMI_ARITHMETIC_BINOP(SmiAnd, WordAnd)
+  SMI_ARITHMETIC_BINOP(SmiOr, WordOr)
+
+#define SMI_SHIFT_OP(SmiOpName, IntPtrOpName)         \
+  Node* SmiOpName(Node* a, int shift) {               \
+    return BitcastWordToTaggedSigned(                 \
+        IntPtrOpName(BitcastTaggedToWord(a), shift)); \
+  }                                                   \
+  SMI_ARITHMETIC_BINOP(SmiOpName, IntPtrOpName)
+
+  SMI_SHIFT_OP(SmiShl, WordShl)
+  SMI_SHIFT_OP(SmiShr, WordShr)
+#undef SMI_SHIFT_OP
+#undef SMI_ARITHMETIC_BINOP
+
+#define SMI_COMPARISON_OP(SmiOpName, IntPtrOpName)                       \
+  Node* SmiOpName(Node* a, Node* b) {                                    \
+    return IntPtrOpName(BitcastTaggedToWord(a), BitcastTaggedToWord(b)); \
+  }
+  SMI_COMPARISON_OP(SmiEqual, WordEqual)
+  SMI_COMPARISON_OP(SmiAbove, UintPtrGreaterThan)
+  SMI_COMPARISON_OP(SmiAboveOrEqual, UintPtrGreaterThanOrEqual)
+  SMI_COMPARISON_OP(SmiBelow, UintPtrLessThan)
+  SMI_COMPARISON_OP(SmiLessThan, IntPtrLessThan)
+  SMI_COMPARISON_OP(SmiLessThanOrEqual, IntPtrLessThanOrEqual)
+  SMI_COMPARISON_OP(SmiGreaterThan, IntPtrGreaterThan)
+#undef SMI_COMPARISON_OP
   Node* SmiMax(Node* a, Node* b);
   Node* SmiMin(Node* a, Node* b);
   // Computes a % b for Smi inputs a and b; result is not necessarily a Smi.
   Node* SmiMod(Node* a, Node* b);
   // Computes a * b for Smi inputs a and b; result is not necessarily a Smi.
   Node* SmiMul(Node* a, Node* b);
-  Node* SmiOr(Node* a, Node* b) {
-    return BitcastWordToTaggedSigned(
-        WordOr(BitcastTaggedToWord(a), BitcastTaggedToWord(b)));
-  }
 
   // Smi | HeapNumber operations.
   Node* NumberInc(Node* value);
@@ -708,6 +729,13 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return DecodeWord<T>(ChangeUint32ToWord(word32));
   }
 
+  // Returns a node that contains a decoded (unsigned!) value of a bit
+  // field |T| in |word|. Returns result as an uint32 node.
+  template <typename T>
+  Node* DecodeWord32FromWord(Node* word) {
+    return TruncateWordToWord32(DecodeWord<T>(word));
+  }
+
   // Decodes an unsigned (!) value from |word32| to an uint32 node.
   Node* DecodeWord32(Node* word32, uint32_t shift, uint32_t mask);
 
@@ -861,7 +889,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                         Label* if_not_found, Label* if_bailout);
 
   // This is a type of a lookup in holder generator function. In case of a
-  // property lookup the {key} is guaranteed to be a unique name and in case of
+  // property lookup the {key} is guaranteed to be an unique name and in case of
   // element lookup the key is an Int32 index.
   typedef std::function<void(Node* receiver, Node* holder, Node* map,
                              Node* instance_type, Node* key, Label* next_holder,

src/code-stubs.cc

@@ -437,7 +437,15 @@ Handle<Code> TurboFanCodeStub::GenerateCode() {
   compiler::CodeAssemblerState state(isolate(), &zone, descriptor,
                                      GetCodeFlags(), name);
   GenerateAssembly(&state);
-  return compiler::CodeAssembler::GenerateCode(&state);
+
+  // TODO(ishell): remove this when code stub assembler graphs verification
+  // is enabled for all stubs.
+  bool saved_csa_verify = FLAG_csa_verify;
+  // Enable verification only in mksnapshot.
+  FLAG_csa_verify = DEBUG_BOOL && FLAG_startup_blob != nullptr;
+  Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
+  FLAG_csa_verify = saved_csa_verify;
+  return code;
 }
 
 #define ACCESSOR_ASSEMBLER(Name)                                       \

src/ic/accessor-assembler.cc

@@ -197,7 +197,7 @@ void AccessorAssemblerImpl::HandleLoadICSmiHandlerCase(
     Node* is_jsarray_condition =
         IsSetWord<LoadHandler::IsJsArrayBits>(handler_word);
     Node* elements_kind =
-        DecodeWord<LoadHandler::ElementsKindBits>(handler_word);
+        DecodeWord32FromWord<LoadHandler::ElementsKindBits>(handler_word);
     Label if_hole(this), unimplemented_elements_kind(this);
     Label* out_of_bounds = miss;
     EmitElementLoad(holder, elements, elements_kind, intptr_index,
@@ -782,7 +782,7 @@ void AccessorAssemblerImpl::EmitElementLoad(
       if_fast_double(this), if_fast_holey_double(this), if_nonfast(this),
       if_dictionary(this);
   GotoIf(
-      IntPtrGreaterThan(elements_kind, IntPtrConstant(LAST_FAST_ELEMENTS_KIND)),
+      Int32GreaterThan(elements_kind, Int32Constant(LAST_FAST_ELEMENTS_KIND)),
       &if_nonfast);
 
   EmitFastElementsBoundsCheck(object, elements, intptr_index,
@@ -803,8 +803,8 @@ void AccessorAssemblerImpl::EmitElementLoad(
                      &if_fast_double,
                      // FAST_HOLEY_DOUBLE_ELEMENTS
                      &if_fast_holey_double};
-  Switch(TruncateWordToWord32(elements_kind), unimplemented_elements_kind,
-         kinds, labels, arraysize(kinds));
+  Switch(elements_kind, unimplemented_elements_kind, kinds, labels,
+         arraysize(kinds));
 
   Bind(&if_fast_packed);
   {
@@ -842,11 +842,11 @@ void AccessorAssemblerImpl::EmitElementLoad(
   Bind(&if_nonfast);
   {
     STATIC_ASSERT(LAST_ELEMENTS_KIND == LAST_FIXED_TYPED_ARRAY_ELEMENTS_KIND);
-    GotoIf(IntPtrGreaterThanOrEqual(
+    GotoIf(Int32GreaterThanOrEqual(
                elements_kind,
-               IntPtrConstant(FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND)),
+               Int32Constant(FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND)),
            &if_typed_array);
-    GotoIf(IntPtrEqual(elements_kind, IntPtrConstant(DICTIONARY_ELEMENTS)),
+    GotoIf(Word32Equal(elements_kind, Int32Constant(DICTIONARY_ELEMENTS)),
            &if_dictionary);
     Goto(unimplemented_elements_kind);
   }
@@ -913,8 +913,8 @@ void AccessorAssemblerImpl::EmitElementLoad(
         FIRST_FIXED_TYPED_ARRAY_ELEMENTS_KIND + 1;
     DCHECK_EQ(kTypedElementsKindCount, arraysize(elements_kinds));
     DCHECK_EQ(kTypedElementsKindCount, arraysize(elements_kind_labels));
-    Switch(TruncateWordToWord32(elements_kind), miss, elements_kinds,
-           elements_kind_labels, kTypedElementsKindCount);
+    Switch(elements_kind, miss, elements_kinds, elements_kind_labels,
+           kTypedElementsKindCount);
     Bind(&uint8_elements);
     {
       Comment("UINT8_ELEMENTS");  // Handles UINT8_CLAMPED_ELEMENTS too.
@@ -1397,8 +1397,9 @@ void AccessorAssemblerImpl::KeyedLoadICGeneric(const LoadICParameters* p) {
     const int32_t kMaxLinear = 210;
     Label stub_cache(this);
     Node* bitfield3 = LoadMapBitField3(receiver_map);
-    Node* nof = DecodeWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
-    GotoIf(Uint32LessThan(Int32Constant(kMaxLinear), nof), &stub_cache);
+    Node* nof =
+        DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
+    GotoIf(UintPtrLessThan(IntPtrConstant(kMaxLinear), nof), &stub_cache);
     Node* descriptors = LoadMapDescriptors(receiver_map);
     Variable var_name_index(this, MachineType::PointerRepresentation());
     Label if_descriptor_found(this);

src/ic/keyed-store-generic.cc

@@ -118,7 +118,7 @@ void KeyedStoreGenericAssembler::TryRewriteElements(
     TrapAllocationMemento(receiver, bailout);
   }
   Label perform_transition(this), check_holey_map(this);
-  Variable var_target_map(this, MachineType::PointerRepresentation());
+  Variable var_target_map(this, MachineRepresentation::kTagged);
   // Check if the receiver has the default |from_kind| map.
   {
     Node* packed_map =
@@ -534,7 +534,7 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
                                           DescriptorArray::kDescriptorKey) *
                                          kPointerSize;
         Node* details = LoadAndUntagToWord32FixedArrayElement(
-            descriptors, name_index, kNameToDetailsOffset);
+            descriptors, name_index, kNameToDetailsOffset, INTPTR_PARAMETERS);
         JumpIfDataProperty(details, &ok_to_write, readonly);
 
         // Accessor case.
@@ -553,15 +553,15 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
                                           NameDictionary::kEntryKeyIndex) *
                                          kPointerSize;
         Node* details = LoadAndUntagToWord32FixedArrayElement(
-            dictionary, entry, kNameToDetailsOffset);
+            dictionary, entry, kNameToDetailsOffset, INTPTR_PARAMETERS);
         JumpIfDataProperty(details, &ok_to_write, readonly);
 
         // Accessor case.
         const int kNameToValueOffset = (NameDictionary::kEntryValueIndex -
                                         NameDictionary::kEntryKeyIndex) *
                                        kPointerSize;
-        var_accessor_pair->Bind(
-            LoadFixedArrayElement(dictionary, entry, kNameToValueOffset));
+        var_accessor_pair->Bind(LoadFixedArrayElement(
+            dictionary, entry, kNameToValueOffset, INTPTR_PARAMETERS));
         var_accessor_holder->Bind(holder);
         Goto(accessor);
       }
@@ -574,8 +574,8 @@ void KeyedStoreGenericAssembler::LookupPropertyOnPrototypeChain(
                                         GlobalDictionary::kEntryKeyIndex) *
                                        kPointerSize;
 
-        Node* property_cell =
-            LoadFixedArrayElement(dictionary, entry, kNameToValueOffset);
+        Node* property_cell = LoadFixedArrayElement(
+            dictionary, entry, kNameToValueOffset, INTPTR_PARAMETERS);
 
         Node* value =
             LoadObjectField(property_cell, PropertyCell::kValueOffset);
@@ -641,15 +641,17 @@ void KeyedStoreGenericAssembler::EmitGenericPropertyStore(
                                         NameDictionary::kEntryKeyIndex) *
                                        kPointerSize;
       Node* details = LoadAndUntagToWord32FixedArrayElement(
-          properties, var_name_index.value(), kNameToDetailsOffset);
+          properties, var_name_index.value(), kNameToDetailsOffset,
+          INTPTR_PARAMETERS);
       JumpIfDataProperty(details, &overwrite, &readonly);
 
       // Accessor case.
       const int kNameToValueOffset =
           (NameDictionary::kEntryValueIndex - NameDictionary::kEntryKeyIndex) *
           kPointerSize;
-      var_accessor_pair.Bind(LoadFixedArrayElement(
-          properties, var_name_index.value(), kNameToValueOffset));
+      var_accessor_pair.Bind(
+          LoadFixedArrayElement(properties, var_name_index.value(),
+                                kNameToValueOffset, INTPTR_PARAMETERS));
       var_accessor_holder.Bind(receiver);
       Goto(&accessor);