[CSA][cleanup] Finish TNodifying EmitXXX methods in builtins constructor gen

TNodified:
 * EmitCreateShallowArrayLiteral
 * EmitCreateShallowObjectLiteral

Also propagated the TNodification of AllocationSite. Previously it was
used a lot with nullptr, and that changed to {}.

Bug: v8:6949, v8:9396
Change-Id: I8ed04d2d346f5960bba23a233c3dd244ad7f122a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1795346
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63725}

src/builtins/builtins-array-gen.cc

@@ -273,8 +273,8 @@ void ArrayBuiltinsAssembler::GenerateArraySpeciesCreate(TNode<Number> len) {
       GetHoleyElementsKind(GetInitialFastElementsKind());
   TNode<NativeContext> native_context = LoadNativeContext(context());
   TNode<Map> array_map = LoadJSArrayElementsMap(elements_kind, native_context);
-  a_.Bind(AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, len, CAST(len),
-                          nullptr, CodeStubAssembler::SMI_PARAMETERS,
+  a_.Bind(AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, len, CAST(len), {},
+                          CodeStubAssembler::SMI_PARAMETERS,
                           kAllowLargeObjectAllocation));
 
   Goto(&done);
@@ -515,11 +515,10 @@ TF_BUILTIN(ArrayPrototypePush, CodeStubAssembler) {
 TF_BUILTIN(ExtractFastJSArray, ArrayBuiltinsAssembler) {
   ParameterMode mode = OptimalParameterMode();
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* array = Parameter(Descriptor::kSource);
+  TNode<JSArray> array = CAST(Parameter(Descriptor::kSource));
   Node* begin = TaggedToParameter(Parameter(Descriptor::kBegin), mode);
   Node* count = TaggedToParameter(Parameter(Descriptor::kCount), mode);
 
-  CSA_ASSERT(this, IsJSArray(array));
   CSA_ASSERT(this, Word32BinaryNot(IsNoElementsProtectorCellInvalid()));
 
   Return(ExtractFastJSArray(context, array, begin, count, mode));
@@ -555,7 +554,7 @@ TF_BUILTIN(CloneFastJSArrayFillingHoles, ArrayBuiltinsAssembler) {
                       Word32BinaryNot(IsNoElementsProtectorCellInvalid())));
 
   ParameterMode mode = OptimalParameterMode();
-  Return(CloneFastJSArray(context, array, mode, nullptr,
+  Return(CloneFastJSArray(context, array, mode, {},
                           HoleConversionMode::kConvertToUndefined));
 }
 
@@ -584,9 +583,9 @@ class ArrayPopulatorAssembler : public CodeStubAssembler {
       TNode<Map> array_map = CAST(LoadContextElement(
           context, Context::JS_ARRAY_PACKED_SMI_ELEMENTS_MAP_INDEX));
 
-      array = AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, SmiConstant(0),
-                              SmiConstant(0), nullptr,
-                              ParameterMode::SMI_PARAMETERS);
+      array =
+          AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, SmiConstant(0),
+                          SmiConstant(0), {}, ParameterMode::SMI_PARAMETERS);
       Goto(&done);
     }
 
@@ -2162,7 +2161,8 @@ void ArrayBuiltinsAssembler::GenerateConstructor(
   {
     TNode<JSArray> array = AllocateJSArray(
         elements_kind, CAST(array_map), array_size, CAST(array_size),
-        mode == DONT_TRACK_ALLOCATION_SITE ? nullptr : allocation_site,
+        mode == DONT_TRACK_ALLOCATION_SITE ? TNode<AllocationSite>()
+                                           : CAST(allocation_site),
         CodeStubAssembler::SMI_PARAMETERS);
     Return(array);
   }
@@ -2181,8 +2181,9 @@ void ArrayBuiltinsAssembler::GenerateArrayNoArgumentConstructor(
       Parameter(Descriptor::kFunction), JSFunction::kContextOffset));
   bool track_allocation_site =
       AllocationSite::ShouldTrack(kind) && mode != DISABLE_ALLOCATION_SITES;
-  Node* allocation_site =
-      track_allocation_site ? Parameter(Descriptor::kAllocationSite) : nullptr;
+  TNode<AllocationSite> allocation_site =
+      track_allocation_site ? CAST(Parameter(Descriptor::kAllocationSite))
+                            : TNode<AllocationSite>();
   TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
   TNode<JSArray> array = AllocateJSArray(
       kind, array_map, IntPtrConstant(JSArray::kPreallocatedArrayElements),

src/builtins/builtins-array-gen.h

@@ -107,20 +107,20 @@ class ArrayBuiltinsAssembler : public CodeStubAssembler {
       TNode<JSFunction> target, TNode<HeapObject> allocation_site_or_undefined,
       TNode<Int32T> argc);
 
-  void GenerateDispatchToArrayStub(
-      TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
-      AllocationSiteOverrideMode mode,
-      TNode<AllocationSite> allocation_site = TNode<AllocationSite>());
+  void GenerateDispatchToArrayStub(TNode<Context> context,
+                                   TNode<JSFunction> target, TNode<Int32T> argc,
+                                   AllocationSiteOverrideMode mode,
+                                   TNode<AllocationSite> allocation_site = {});
 
   void CreateArrayDispatchNoArgument(
       TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
       AllocationSiteOverrideMode mode,
-      TNode<AllocationSite> allocation_site = TNode<AllocationSite>());
+      TNode<AllocationSite> allocation_site = {});
 
   void CreateArrayDispatchSingleArgument(
       TNode<Context> context, TNode<JSFunction> target, TNode<Int32T> argc,
       AllocationSiteOverrideMode mode,
-      TNode<AllocationSite> allocation_site = TNode<AllocationSite>());
+      TNode<AllocationSite> allocation_site = {});
 
   void GenerateConstructor(Node* context, Node* array_function, Node* array_map,
                            Node* array_size, Node* allocation_site,

src/builtins/builtins-collections-gen.cc

@@ -996,7 +996,7 @@ TNode<JSArray> CollectionsBuiltinsAssembler::MapIteratorToList(
   TNode<Map> array_map =
       LoadJSArrayElementsMap(kind, LoadNativeContext(context));
   TNode<JSArray> array =
-      AllocateJSArray(kind, array_map, size, SmiTag(size), nullptr,
+      AllocateJSArray(kind, array_map, size, SmiTag(size), {},
                       INTPTR_PARAMETERS, kAllowLargeObjectAllocation);
   TNode<FixedArray> elements = CAST(LoadElements(array));
 
@@ -1109,7 +1109,7 @@ TNode<JSArray> CollectionsBuiltinsAssembler::SetOrSetIteratorToList(
   TNode<Map> array_map =
       LoadJSArrayElementsMap(kind, LoadNativeContext(context));
   TNode<JSArray> array =
-      AllocateJSArray(kind, array_map, size, SmiTag(size), nullptr,
+      AllocateJSArray(kind, array_map, size, SmiTag(size), {},
                       INTPTR_PARAMETERS, kAllowLargeObjectAllocation);
   TNode<FixedArray> elements = CAST(LoadElements(array));
 

src/builtins/builtins-constructor-gen.cc

@@ -338,12 +338,12 @@ TF_BUILTIN(CreateRegExpLiteral, ConstructorBuiltinsAssembler) {
   Return(result);
 }
 
-Node* ConstructorBuiltinsAssembler::EmitCreateShallowArrayLiteral(
-    Node* feedback_vector, Node* slot, Node* context, Label* call_runtime,
+TNode<JSArray> ConstructorBuiltinsAssembler::EmitCreateShallowArrayLiteral(
+    TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot,
+    TNode<Context> context, Label* call_runtime,
     AllocationSiteMode allocation_site_mode) {
   Label zero_capacity(this), cow_elements(this), fast_elements(this),
       return_result(this);
-  VARIABLE(result, MachineRepresentation::kTagged);
 
   TNode<Object> maybe_allocation_site =
       CAST(LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
@@ -361,10 +361,11 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowArrayLiteral(
 }
 
 TF_BUILTIN(CreateShallowArrayLiteral, ConstructorBuiltinsAssembler) {
-  Node* feedback_vector = Parameter(Descriptor::kFeedbackVector);
-  TNode<IntPtrT> slot = SmiUntag(Parameter(Descriptor::kSlot));
+  TNode<FeedbackVector> feedback_vector =
+      CAST(Parameter(Descriptor::kFeedbackVector));
+  TNode<UintPtrT> slot = Unsigned(SmiUntag(Parameter(Descriptor::kSlot)));
   Node* constant_elements = Parameter(Descriptor::kConstantElements);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   Label call_runtime(this, Label::kDeferred);
   Return(EmitCreateShallowArrayLiteral(feedback_vector, slot, context,
                                        &call_runtime,
@@ -376,7 +377,8 @@ TF_BUILTIN(CreateShallowArrayLiteral, ConstructorBuiltinsAssembler) {
     int const flags =
         AggregateLiteral::kDisableMementos | AggregateLiteral::kIsShallow;
     Return(CallRuntime(Runtime::kCreateArrayLiteral, context, feedback_vector,
-                       SmiTag(slot), constant_elements, SmiConstant(flags)));
+                       SmiTag(Signed(slot)), constant_elements,
+                       SmiConstant(flags)));
   }
 }
 
@@ -431,8 +433,9 @@ TF_BUILTIN(CreateEmptyArrayLiteral, ConstructorBuiltinsAssembler) {
   Return(result);
 }
 
-Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
-    Node* feedback_vector, Node* slot, Label* call_runtime) {
+TNode<HeapObject> ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
+    TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot,
+    Label* call_runtime) {
   TNode<Object> maybe_allocation_site =
       CAST(LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
   GotoIf(NotHasBoilerplate(maybe_allocation_site), call_runtime);
@@ -442,7 +445,7 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
   TNode<Map> boilerplate_map = LoadMap(boilerplate);
   CSA_ASSERT(this, IsJSObjectMap(boilerplate_map));
 
-  VARIABLE(var_properties, MachineRepresentation::kTagged);
+  TVARIABLE(FixedArray, var_properties);
   {
     TNode<Uint32T> bit_field_3 = LoadMapBitField3(boilerplate_map);
     GotoIf(IsSetWord32<Map::IsDeprecatedBit>(bit_field_3), call_runtime);
@@ -453,8 +456,8 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
     BIND(&if_dictionary);
     {
       Comment("Copy dictionary properties");
-      var_properties.Bind(CopyNameDictionary(
-          CAST(LoadSlowProperties(boilerplate)), call_runtime));
+      var_properties = CopyNameDictionary(CAST(LoadSlowProperties(boilerplate)),
+                                          call_runtime);
       // Slow objects have no in-object properties.
       Goto(&done);
     }
@@ -464,13 +467,13 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
       TNode<HeapObject> boilerplate_properties =
           LoadFastProperties(boilerplate);
       GotoIfNot(IsEmptyFixedArray(boilerplate_properties), call_runtime);
-      var_properties.Bind(EmptyFixedArrayConstant());
+      var_properties = EmptyFixedArrayConstant();
       Goto(&done);
     }
     BIND(&done);
   }
 
-  VARIABLE(var_elements, MachineRepresentation::kTagged);
+  TVARIABLE(FixedArrayBase, var_elements);
   {
     // Copy the elements backing store, assuming that it's flat.
     Label if_empty_fixed_array(this), if_copy_elements(this), done(this);
@@ -479,7 +482,7 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
            &if_copy_elements);
 
     BIND(&if_empty_fixed_array);
-    var_elements.Bind(boilerplate_elements);
+    var_elements = boilerplate_elements;
     Goto(&done);
 
     BIND(&if_copy_elements);
@@ -489,7 +492,7 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
     flags |= ExtractFixedArrayFlag::kAllFixedArrays;
     flags |= ExtractFixedArrayFlag::kNewSpaceAllocationOnly;
     flags |= ExtractFixedArrayFlag::kDontCopyCOW;
-    var_elements.Bind(CloneFixedArray(boilerplate_elements, flags));
+    var_elements = CloneFixedArray(boilerplate_elements, flags);
     Goto(&done);
     BIND(&done);
   }
@@ -571,7 +574,7 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
       Comment("Copy in-object properties slow");
       BuildFastLoop(
           offset.value(), instance_size,
-          [=](Node* offset) {
+          [=](SloppyTNode<IntPtrT> offset) {
             // TODO(ishell): value decompression is not necessary here.
             TNode<Object> field = LoadObjectField(boilerplate, offset);
             StoreObjectFieldNoWriteBarrier(copy, offset, field);
@@ -580,7 +583,7 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
       Comment("Copy mutable HeapNumber values");
       BuildFastLoop(
           offset.value(), instance_size,
-          [=](Node* offset) {
+          [=](SloppyTNode<IntPtrT> offset) {
             TNode<Object> field = LoadObjectField(copy, offset);
             Label copy_heap_number(this, Label::kDeferred), continue_loop(this);
             // We only have to clone complex field values.
@@ -609,19 +612,20 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
 
 TF_BUILTIN(CreateShallowObjectLiteral, ConstructorBuiltinsAssembler) {
   Label call_runtime(this);
-  Node* feedback_vector = Parameter(Descriptor::kFeedbackVector);
-  TNode<IntPtrT> slot = SmiUntag(Parameter(Descriptor::kSlot));
-  Node* copy =
+  TNode<FeedbackVector> feedback_vector =
+      CAST(Parameter(Descriptor::kFeedbackVector));
+  TNode<UintPtrT> slot = Unsigned(SmiUntag(Parameter(Descriptor::kSlot)));
+  TNode<HeapObject> copy =
       EmitCreateShallowObjectLiteral(feedback_vector, slot, &call_runtime);
   Return(copy);
 
   BIND(&call_runtime);
-  Node* object_boilerplate_description =
-      Parameter(Descriptor::kObjectBoilerplateDescription);
-  Node* flags = Parameter(Descriptor::kFlags);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<ObjectBoilerplateDescription> object_boilerplate_description =
+      CAST(Parameter(Descriptor::kObjectBoilerplateDescription));
+  TNode<Smi> flags = CAST(Parameter(Descriptor::kFlags));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   TailCallRuntime(Runtime::kCreateObjectLiteral, context, feedback_vector,
-                  SmiTag(slot), object_boilerplate_description, flags);
+                  SmiTag(Signed(slot)), object_boilerplate_description, flags);
 }
 
 // Used by the CreateEmptyObjectLiteral bytecode and the Object constructor.

src/builtins/builtins-constructor-gen.h

@@ -23,16 +23,19 @@ class ConstructorBuiltinsAssembler : public CodeStubAssembler {
   TNode<JSRegExp> EmitCreateRegExpLiteral(
       TNode<HeapObject> maybe_feedback_vector, TNode<UintPtrT> slot,
       TNode<Object> pattern, TNode<Smi> flags, TNode<Context> context);
-  Node* EmitCreateShallowArrayLiteral(Node* feedback_vector, Node* slot,
-                                      Node* context, Label* call_runtime,
-                                      AllocationSiteMode allocation_site_mode);
+
+  TNode<JSArray> EmitCreateShallowArrayLiteral(
+      TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot,
+      TNode<Context> context, Label* call_runtime,
+      AllocationSiteMode allocation_site_mode);
 
   TNode<JSArray> EmitCreateEmptyArrayLiteral(
       TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot,
       TNode<Context> context);
 
-  Node* EmitCreateShallowObjectLiteral(Node* feedback_vector, Node* slot,
-                                       Label* call_runtime);
+  TNode<HeapObject> EmitCreateShallowObjectLiteral(
+      TNode<FeedbackVector> feedback_vector, TNode<UintPtrT> slot,
+      Label* call_runtime);
   TNode<JSObject> EmitCreateEmptyObjectLiteral(TNode<Context> context);
 
   TNode<JSObject> EmitFastNewObject(SloppyTNode<Context> context,

src/builtins/builtins-internal-gen.cc

@@ -29,12 +29,14 @@ void Builtins::Generate_StackCheck(MacroAssembler* masm) {
 // TurboFan support builtins.
 
 TF_BUILTIN(CopyFastSmiOrObjectElements, CodeStubAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
+  TNode<JSObject> js_object = CAST(Parameter(Descriptor::kObject));
 
   // Load the {object}s elements.
-  TNode<Object> source = LoadObjectField(object, JSObject::kElementsOffset);
-  Node* target = CloneFixedArray(source, ExtractFixedArrayFlag::kFixedArrays);
-  StoreObjectField(object, JSObject::kElementsOffset, target);
+  TNode<FixedArrayBase> source =
+      CAST(LoadObjectField(js_object, JSObject::kElementsOffset));
+  TNode<FixedArrayBase> target =
+      CloneFixedArray(source, ExtractFixedArrayFlag::kFixedArrays);
+  StoreObjectField(js_object, JSObject::kElementsOffset, target);
   Return(target);
 }
 

src/builtins/builtins-object-gen.cc

@@ -310,8 +310,7 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
         Node* array = nullptr;
         Node* elements = nullptr;
         std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-            PACKED_ELEMENTS, array_map, SmiConstant(2), nullptr,
-            IntPtrConstant(2));
+            PACKED_ELEMENTS, array_map, SmiConstant(2), {}, IntPtrConstant(2));
         StoreFixedArrayElement(CAST(elements), 0, next_key, SKIP_WRITE_BARRIER);
         StoreFixedArrayElement(CAST(elements), 1, value, SKIP_WRITE_BARRIER);
         value = TNode<JSArray>::UncheckedCast(array);
@@ -511,7 +510,7 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
     TNode<Smi> array_length = SmiTag(Signed(object_enum_length));
     std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-        PACKED_ELEMENTS, array_map, array_length, nullptr, object_enum_length,
+        PACKED_ELEMENTS, array_map, array_length, {}, object_enum_length,
         INTPTR_PARAMETERS);
     CopyFixedArrayElements(PACKED_ELEMENTS, object_enum_keys, elements,
                            object_enum_length, SKIP_WRITE_BARRIER);
@@ -605,7 +604,7 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
     TNode<Smi> array_length = SmiTag(Signed(object_enum_length));
     std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-        PACKED_ELEMENTS, array_map, array_length, nullptr, object_enum_length,
+        PACKED_ELEMENTS, array_map, array_length, {}, object_enum_length,
         INTPTR_PARAMETERS);
     CopyFixedArrayElements(PACKED_ELEMENTS, object_enum_keys, elements,
                            object_enum_length, SKIP_WRITE_BARRIER);

src/builtins/builtins-regexp-gen.cc

@@ -89,9 +89,8 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
   const ElementsKind elements_kind = PACKED_ELEMENTS;
   TNode<Map> map = CAST(LoadContextElement(LoadNativeContext(context),
                                            Context::REGEXP_RESULT_MAP_INDEX));
-  Node* no_allocation_site = nullptr;
+  TNode<AllocationSite> no_allocation_site = {};
   TNode<IntPtrT> length_intptr = SmiUntag(length);
-  TNode<IntPtrT> capacity = length_intptr;
 
   // Note: The returned `elements` may be in young large object space, but
   // `array` is guaranteed to be in new space so we could skip write barriers
@@ -99,7 +98,7 @@ TNode<JSRegExpResult> RegExpBuiltinsAssembler::AllocateRegExpResult(
   TNode<JSArray> array;
   TNode<FixedArrayBase> elements;
   std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
-      elements_kind, map, length, no_allocation_site, capacity,
+      elements_kind, map, length, no_allocation_site, length_intptr,
       INTPTR_PARAMETERS, kAllowLargeObjectAllocation, JSRegExpResult::kSize);
 
   // Finish result initialization.
@@ -2055,7 +2054,7 @@ void RegExpBuiltinsAssembler::RegExpPrototypeSplitBody(TNode<Context> context,
   const ElementsKind kind = PACKED_ELEMENTS;
   const ParameterMode mode = CodeStubAssembler::INTPTR_PARAMETERS;
 
-  Node* const allocation_site = nullptr;
+  TNode<AllocationSite> allocation_site = {};
   TNode<NativeContext> const native_context = LoadNativeContext(context);
   TNode<Map> array_map = LoadJSArrayElementsMap(kind, native_context);
 

src/codegen/code-stub-assembler.cc

@@ -4108,12 +4108,12 @@ TNode<BoolT> CodeStubAssembler::IsValidFastJSArrayCapacity(
 
 TNode<JSArray> CodeStubAssembler::AllocateJSArray(
     TNode<Map> array_map, TNode<FixedArrayBase> elements, TNode<Smi> length,
-    Node* allocation_site, int array_header_size) {
+    TNode<AllocationSite> allocation_site, int array_header_size) {
   Comment("begin allocation of JSArray passing in elements");
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
 
   int base_size = array_header_size;
-  if (allocation_site != nullptr) {
+  if (!allocation_site.is_null()) {
     base_size += AllocationMemento::kSize;
   }
 
@@ -4127,8 +4127,9 @@ TNode<JSArray> CodeStubAssembler::AllocateJSArray(
 std::pair<TNode<JSArray>, TNode<FixedArrayBase>>
 CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
     ElementsKind kind, TNode<Map> array_map, TNode<Smi> length,
-    Node* allocation_site, Node* capacity, ParameterMode capacity_mode,
-    AllocationFlags allocation_flags, int array_header_size) {
+    TNode<AllocationSite> allocation_site, Node* capacity,
+    ParameterMode capacity_mode, AllocationFlags allocation_flags,
+    int array_header_size) {
   Comment("begin allocation of JSArray with elements");
   CHECK_EQ(allocation_flags & ~kAllowLargeObjectAllocation, 0);
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
@@ -4165,7 +4166,9 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
   BIND(&nonempty);
   {
     int base_size = array_header_size;
-    if (allocation_site != nullptr) base_size += AllocationMemento::kSize;
+    if (!allocation_site.is_null()) {
+      base_size += AllocationMemento::kSize;
+    }
 
     const int elements_offset = base_size;
 
@@ -4238,8 +4241,8 @@ CodeStubAssembler::AllocateUninitializedJSArrayWithElements(
 }
 
 TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
-    TNode<Map> array_map, TNode<Smi> length, Node* allocation_site,
-    TNode<IntPtrT> size_in_bytes) {
+    TNode<Map> array_map, TNode<Smi> length,
+    TNode<AllocationSite> allocation_site, TNode<IntPtrT> size_in_bytes) {
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
 
   // Allocate space for the JSArray and the elements FixedArray in one go.
@@ -4250,7 +4253,7 @@ TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
   StoreObjectFieldRoot(array, JSArray::kPropertiesOrHashOffset,
                        RootIndex::kEmptyFixedArray);
 
-  if (allocation_site != nullptr) {
+  if (!allocation_site.is_null()) {
     InitializeAllocationMemento(array, IntPtrConstant(JSArray::kSize),
                                 allocation_site);
   }
@@ -4260,7 +4263,7 @@ TNode<JSArray> CodeStubAssembler::AllocateUninitializedJSArray(
 
 TNode<JSArray> CodeStubAssembler::AllocateJSArray(
     ElementsKind kind, TNode<Map> array_map, Node* capacity, TNode<Smi> length,
-    Node* allocation_site, ParameterMode capacity_mode,
+    TNode<AllocationSite> allocation_site, ParameterMode capacity_mode,
     AllocationFlags allocation_flags) {
   CSA_SLOW_ASSERT(this, TaggedIsPositiveSmi(length));
   CSA_SLOW_ASSERT(this, MatchesParameterMode(capacity, capacity_mode));
@@ -4289,10 +4292,9 @@ TNode<JSArray> CodeStubAssembler::AllocateJSArray(
   return array;
 }
 
-Node* CodeStubAssembler::ExtractFastJSArray(Node* context, Node* array,
-                                            Node* begin, Node* count,
-                                            ParameterMode mode, Node* capacity,
-                                            Node* allocation_site) {
+Node* CodeStubAssembler::ExtractFastJSArray(
+    TNode<Context> context, TNode<JSArray> array, Node* begin, Node* count,
+    ParameterMode mode, Node* capacity, TNode<AllocationSite> allocation_site) {
   TNode<Map> original_array_map = LoadMap(array);
   TNode<Int32T> elements_kind = LoadMapElementsKind(original_array_map);
 
@@ -4309,18 +4311,16 @@ Node* CodeStubAssembler::ExtractFastJSArray(Node* context, Node* array,
   return result;
 }
 
-Node* CodeStubAssembler::CloneFastJSArray(Node* context, Node* array,
-                                          ParameterMode mode,
-                                          Node* allocation_site,
-                                          HoleConversionMode convert_holes) {
+TNode<JSArray> CodeStubAssembler::CloneFastJSArray(
+    TNode<Context> context, TNode<JSArray> array, ParameterMode mode,
+    TNode<AllocationSite> allocation_site, HoleConversionMode convert_holes) {
   // TODO(dhai): we should be able to assert IsFastJSArray(array) here, but this
   // function is also used to copy boilerplates even when the no-elements
   // protector is invalid. This function should be renamed to reflect its uses.
-  CSA_ASSERT(this, IsJSArray(array));
 
   TNode<Number> length = LoadJSArrayLength(array);
-  Node* new_elements = nullptr;
-  VARIABLE(var_new_elements, MachineRepresentation::kTagged);
+  TNode<FixedArrayBase> new_elements;
+  TVARIABLE(FixedArrayBase, var_new_elements);
   TVARIABLE(Int32T, var_elements_kind, LoadMapElementsKind(LoadMap(array)));
 
   Label allocate_jsarray(this), holey_extract(this),
@@ -4340,7 +4340,7 @@ Node* CodeStubAssembler::CloneFastJSArray(Node* context, Node* array,
                         TaggedToParameter(CAST(length), mode), nullptr,
                         ExtractFixedArrayFlag::kAllFixedArraysDontCopyCOW, mode,
                         nullptr, var_elements_kind.value());
-  var_new_elements.Bind(new_elements);
+  var_new_elements = new_elements;
   Goto(&allocate_jsarray);
 
   if (need_conversion) {
@@ -4357,7 +4357,7 @@ Node* CodeStubAssembler::CloneFastJSArray(Node* context, Node* array,
         LoadElements(array), IntPtrOrSmiConstant(0, mode),
         TaggedToParameter(CAST(length), mode), nullptr,
         ExtractFixedArrayFlag::kAllFixedArrays, mode, &var_holes_converted);
-    var_new_elements.Bind(new_elements);
+    var_new_elements = new_elements;
     // If the array type didn't change, use the original elements kind.
     GotoIfNot(var_holes_converted.value(), &allocate_jsarray);
     // Otherwise use PACKED_ELEMENTS for the target's elements kind.
@@ -4383,8 +4383,8 @@ Node* CodeStubAssembler::CloneFastJSArray(Node* context, Node* array,
   TNode<Map> array_map =
       LoadJSArrayElementsMap(var_elements_kind.value(), native_context);
 
-  TNode<JSArray> result = AllocateJSArray(
-      array_map, CAST(var_new_elements.value()), CAST(length), allocation_site);
+  TNode<JSArray> result = AllocateJSArray(array_map, var_new_elements.value(),
+                                          CAST(length), allocation_site);
   return result;
 }
 
@@ -14111,9 +14111,8 @@ TNode<JSArray> CodeStubAssembler::ArrayCreate(TNode<Context> context,
   // TODO(delphick): Consider using
   // AllocateUninitializedJSArrayWithElements to avoid initializing an
   // array and then writing over it.
-  array =
-      AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, length, SmiConstant(0),
-                      nullptr, ParameterMode::SMI_PARAMETERS);
+  array = AllocateJSArray(PACKED_SMI_ELEMENTS, array_map, length,
+                          SmiConstant(0), {}, ParameterMode::SMI_PARAMETERS);
   Goto(&done);
 
   BIND(&done);

src/codegen/code-stub-assembler.h

@@ -1792,7 +1792,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   std::pair<TNode<JSArray>, TNode<FixedArrayBase>>
   AllocateUninitializedJSArrayWithElements(
       ElementsKind kind, TNode<Map> array_map, TNode<Smi> length,
-      Node* allocation_site, Node* capacity,
+      TNode<AllocationSite> allocation_site, Node* capacity,
       ParameterMode capacity_mode = INTPTR_PARAMETERS,
       AllocationFlags allocation_flags = kNone,
       int array_header_size = JSArray::kSize);
@@ -1801,20 +1801,20 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // The ParameterMode argument is only used for the capacity parameter.
   TNode<JSArray> AllocateJSArray(
       ElementsKind kind, TNode<Map> array_map, Node* capacity,
-      TNode<Smi> length, Node* allocation_site = nullptr,
+      TNode<Smi> length, TNode<AllocationSite> allocation_site = {},
       ParameterMode capacity_mode = INTPTR_PARAMETERS,
       AllocationFlags allocation_flags = kNone);
 
   TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
                                  TNode<Smi> capacity, TNode<Smi> length) {
-    return AllocateJSArray(kind, array_map, capacity, length, nullptr,
+    return AllocateJSArray(kind, array_map, capacity, length, {},
                            SMI_PARAMETERS);
   }
 
   TNode<JSArray> AllocateJSArray(ElementsKind kind, TNode<Map> array_map,
                                  TNode<IntPtrT> capacity, TNode<Smi> length,
                                  AllocationFlags allocation_flags = kNone) {
-    return AllocateJSArray(kind, array_map, capacity, length, nullptr,
+    return AllocateJSArray(kind, array_map, capacity, length, {},
                            INTPTR_PARAMETERS, allocation_flags);
   }
 
@@ -1822,7 +1822,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   TNode<JSArray> AllocateJSArray(TNode<Map> array_map,
                                  TNode<FixedArrayBase> elements,
                                  TNode<Smi> length,
-                                 Node* allocation_site = nullptr,
+                                 TNode<AllocationSite> allocation_site = {},
                                  int array_header_size = JSArray::kSize);
 
   enum class HoleConversionMode { kDontConvert, kConvertToUndefined };
@@ -1836,15 +1836,17 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // If |convert_holes| is set kDontConvert, holes are also copied to the
   // resulting array, who will have the same elements kind as |array|. The
   // function generates significantly less code in this case.
-  Node* CloneFastJSArray(
-      Node* context, Node* array, ParameterMode mode = INTPTR_PARAMETERS,
-      Node* allocation_site = nullptr,
+  TNode<JSArray> CloneFastJSArray(
+      TNode<Context> context, TNode<JSArray> array,
+      ParameterMode mode = INTPTR_PARAMETERS,
+      TNode<AllocationSite> allocation_site = {},
       HoleConversionMode convert_holes = HoleConversionMode::kDontConvert);
 
-  Node* ExtractFastJSArray(Node* context, Node* array, Node* begin, Node* count,
+  Node* ExtractFastJSArray(TNode<Context> context, TNode<JSArray> array,
+                           Node* begin, Node* count,
                            ParameterMode mode = INTPTR_PARAMETERS,
                            Node* capacity = nullptr,
-                           Node* allocation_site = nullptr);
+                           TNode<AllocationSite> allocation_site = {});
 
   TNode<FixedArrayBase> AllocateFixedArray(
       ElementsKind kind, Node* capacity, ParameterMode mode = INTPTR_PARAMETERS,
@@ -2200,9 +2202,10 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // kAllFixedArrays, the generated code is more compact and efficient if the
   // caller can specify whether only FixedArrays or FixedDoubleArrays will be
   // passed as the |source| parameter.
-  Node* CloneFixedArray(Node* source,
-                        ExtractFixedArrayFlags flags =
-                            ExtractFixedArrayFlag::kAllFixedArraysDontCopyCOW) {
+  TNode<FixedArrayBase> CloneFixedArray(
+      TNode<FixedArrayBase> source,
+      ExtractFixedArrayFlags flags =
+          ExtractFixedArrayFlag::kAllFixedArraysDontCopyCOW) {
     ParameterMode mode = OptimalParameterMode();
     return ExtractFixedArray(source, IntPtrOrSmiConstant(0, mode), nullptr,
                              nullptr, flags, mode);
@@ -3740,10 +3743,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   // Allocate and return a JSArray of given total size in bytes with header
   // fields initialized.
-  TNode<JSArray> AllocateUninitializedJSArray(TNode<Map> array_map,
-                                              TNode<Smi> length,
-                                              Node* allocation_site,
-                                              TNode<IntPtrT> size_in_bytes);
+  TNode<JSArray> AllocateUninitializedJSArray(
+      TNode<Map> array_map, TNode<Smi> length,
+      TNode<AllocationSite> allocation_site, TNode<IntPtrT> size_in_bytes);
 
   TNode<BoolT> IsValidSmi(TNode<Smi> smi);
   Node* SmiShiftBitsConstant();

src/codegen/tnode.h

@@ -335,6 +335,8 @@ class TNode {
     return *this;
   }
 
+  bool is_null() { return node_ == nullptr; }
+
   operator compiler::Node*() const { return node_; }
 
   static TNode UncheckedCast(compiler::Node* node) { return TNode(node); }

src/interpreter/interpreter-generator.cc

@@ -2486,8 +2486,8 @@ IGNITION_HANDLER(CreateArrayLiteral, InterpreterAssembler) {
   BIND(&fast_shallow_clone);
   {
     ConstructorBuiltinsAssembler constructor_assembler(state());
-    Node* result = constructor_assembler.EmitCreateShallowArrayLiteral(
-        feedback_vector, slot_id, context, &call_runtime,
+    TNode<JSArray> result = constructor_assembler.EmitCreateShallowArrayLiteral(
+        CAST(feedback_vector), slot_id, context, &call_runtime,
         TRACK_ALLOCATION_SITE);
     SetAccumulator(result);
     Dispatch();
@@ -2531,7 +2531,7 @@ IGNITION_HANDLER(CreateEmptyArrayLiteral, InterpreterAssembler) {
                                                   LoadNativeContext(context));
     result =
         AllocateJSArray(GetInitialFastElementsKind(), array_map, SmiConstant(0),
-                        SmiConstant(0), nullptr, ParameterMode::SMI_PARAMETERS);
+                        SmiConstant(0), {}, ParameterMode::SMI_PARAMETERS);
     Goto(&end);
   }
 
@@ -2575,8 +2575,9 @@ IGNITION_HANDLER(CreateObjectLiteral, InterpreterAssembler) {
   {
     // If we can do a fast clone do the fast-path in CreateShallowObjectLiteral.
     ConstructorBuiltinsAssembler constructor_assembler(state());
-    Node* result = constructor_assembler.EmitCreateShallowObjectLiteral(
-        feedback_vector, slot_id, &if_not_fast_clone);
+    TNode<HeapObject> result =
+        constructor_assembler.EmitCreateShallowObjectLiteral(
+            CAST(feedback_vector), slot_id, &if_not_fast_clone);
     SetAccumulator(result);
     Dispatch();
   }

test/cctest/test-code-stub-assembler.cc

@@ -3178,7 +3178,7 @@ TEST(CloneEmptyFixedArray) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   {
     CodeStubAssembler m(asm_tester.state());
-    m.Return(m.CloneFixedArray(m.Parameter(0)));
+    m.Return(m.CloneFixedArray(m.CAST(m.Parameter(0))));
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
@@ -3195,7 +3195,7 @@ TEST(CloneFixedArray) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   {
     CodeStubAssembler m(asm_tester.state());
-    m.Return(m.CloneFixedArray(m.Parameter(0)));
+    m.Return(m.CloneFixedArray(m.CAST(m.Parameter(0))));
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);
 
@@ -3217,7 +3217,7 @@ TEST(CloneFixedArrayCOW) {
   CodeAssemblerTester asm_tester(isolate, kNumParams);
   {
     CodeStubAssembler m(asm_tester.state());
-    m.Return(m.CloneFixedArray(m.Parameter(0)));
+    m.Return(m.CloneFixedArray(m.CAST(m.Parameter(0))));
   }
   FunctionTester ft(asm_tester.GenerateCode(), kNumParams);