[stubs] Enable graph verification for builtins.

... and fix the inconsistencies.

BUG=

Review-Url: https://codereview.chromium.org/2573573004
Cr-Commit-Position: refs/heads/master@{#41690}

src/builtins/builtins-array.cc

@@ -225,9 +225,7 @@ void Builtins::Generate_FastArrayPush(compiler::CodeAssemblerState* state) {
     // to figure out whether the length property is still writable.
     assembler.Comment(
         "Disallow pushing onto arrays in dictionary named property mode");
-    Node* bit_field3 = assembler.LoadMapBitField3(map);
-    assembler.GotoIf(assembler.IsSetWord32<Map::DictionaryMap>(bit_field3),
-                     &runtime);
+    assembler.GotoIf(assembler.IsDictionaryMap(map), &runtime);
 
     // Check whether the length property is writable. The length property is the
     // only default named property on arrays. It's nonconfigurable, hence is
@@ -237,15 +235,15 @@ void Builtins::Generate_FastArrayPush(compiler::CodeAssemblerState* state) {
         descriptors, DescriptorArray::ToDetailsIndex(0));
     mask = READ_ONLY << PropertyDetails::AttributesField::kShift;
     Node* mask_node = assembler.SmiConstant(mask);
-    test = assembler.WordAnd(details, mask_node);
+    test = assembler.SmiAnd(details, mask_node);
     assembler.GotoIf(assembler.WordEqual(test, mask_node), &runtime);
 
     arg_index.Bind(assembler.IntPtrConstant(0));
     kind = assembler.DecodeWord32<Map::ElementsKindBits>(bit_field2);
 
     assembler.GotoIf(
-        assembler.IntPtrGreaterThan(
-            kind, assembler.IntPtrConstant(FAST_HOLEY_SMI_ELEMENTS)),
+        assembler.Int32GreaterThan(
+            kind, assembler.Int32Constant(FAST_HOLEY_SMI_ELEMENTS)),
         &object_push_pre);
 
     Node* new_length = assembler.BuildAppendJSArray(
@@ -273,8 +271,8 @@ void Builtins::Generate_FastArrayPush(compiler::CodeAssemblerState* state) {
 
   assembler.Bind(&object_push_pre);
   {
-    assembler.Branch(assembler.IntPtrGreaterThan(
-                         kind, assembler.IntPtrConstant(FAST_HOLEY_ELEMENTS)),
+    assembler.Branch(assembler.Int32GreaterThan(
+                         kind, assembler.Int32Constant(FAST_HOLEY_ELEMENTS)),
                      &double_push, &object_push);
   }
 
@@ -2202,7 +2200,7 @@ void Builtins::Generate_ArrayIndexOf(compiler::CodeAssemblerState* state) {
   }
 
   assembler.Bind(&return_found);
-  assembler.Return(assembler.ChangeInt32ToTagged(index_var.value()));
+  assembler.Return(assembler.SmiTag(index_var.value()));
 
   assembler.Bind(&return_not_found);
   assembler.Return(assembler.NumberConstant(-1));
@@ -2339,10 +2337,9 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
     assembler.GotoUnless(assembler.SmiBelow(index, length), &set_done);
 
     Node* one = assembler.SmiConstant(Smi::FromInt(1));
-    assembler.StoreObjectFieldNoWriteBarrier(
-        iterator, JSArrayIterator::kNextIndexOffset,
-        assembler.IntPtrAdd(assembler.BitcastTaggedToWord(index),
-                            assembler.BitcastTaggedToWord(one)));
+    assembler.StoreObjectFieldNoWriteBarrier(iterator,
+                                             JSArrayIterator::kNextIndexOffset,
+                                             assembler.SmiAdd(index, one));
 
     var_done.Bind(assembler.FalseConstant());
     Node* elements = assembler.LoadElements(array);
@@ -2566,19 +2563,20 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
 
       assembler.GotoUnless(assembler.SmiBelow(index, length), &set_done);
 
-      Node* one = assembler.SmiConstant(Smi::FromInt(1));
+      Node* one = assembler.SmiConstant(1);
       assembler.StoreObjectFieldNoWriteBarrier(
           iterator, JSArrayIterator::kNextIndexOffset,
-          assembler.IntPtrAdd(assembler.BitcastTaggedToWord(index),
-                              assembler.BitcastTaggedToWord(one)));
+          assembler.SmiAdd(index, one));
       var_done.Bind(assembler.FalseConstant());
 
       Node* elements = assembler.LoadElements(array);
       Node* base_ptr = assembler.LoadObjectField(
           elements, FixedTypedArrayBase::kBasePointerOffset);
       Node* external_ptr = assembler.LoadObjectField(
-          elements, FixedTypedArrayBase::kExternalPointerOffset);
-      Node* data_ptr = assembler.IntPtrAdd(base_ptr, external_ptr);
+          elements, FixedTypedArrayBase::kExternalPointerOffset,
+          MachineType::Pointer());
+      Node* data_ptr = assembler.IntPtrAdd(
+          assembler.BitcastTaggedToWord(base_ptr), external_ptr);
 
       static int32_t kInstanceType[] = {
           JS_TYPED_ARRAY_KEY_ITERATOR_TYPE,
@@ -2624,7 +2622,7 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
       {
         Node* value_uint8 = assembler.LoadFixedTypedArrayElement(
             data_ptr, index, UINT8_ELEMENTS, CodeStubAssembler::SMI_PARAMETERS);
-        var_value.Bind(assembler.SmiFromWord(value_uint8));
+        var_value.Bind(assembler.SmiFromWord32(value_uint8));
         assembler.Goto(&allocate_entry_if_needed);
       }
 
@@ -2632,7 +2630,7 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
       {
         Node* value_int8 = assembler.LoadFixedTypedArrayElement(
             data_ptr, index, INT8_ELEMENTS, CodeStubAssembler::SMI_PARAMETERS);
-        var_value.Bind(assembler.SmiFromWord(value_int8));
+        var_value.Bind(assembler.SmiFromWord32(value_int8));
         assembler.Goto(&allocate_entry_if_needed);
       }
 
@@ -2641,7 +2639,7 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
         Node* value_uint16 = assembler.LoadFixedTypedArrayElement(
             data_ptr, index, UINT16_ELEMENTS,
             CodeStubAssembler::SMI_PARAMETERS);
-        var_value.Bind(assembler.SmiFromWord(value_uint16));
+        var_value.Bind(assembler.SmiFromWord32(value_uint16));
         assembler.Goto(&allocate_entry_if_needed);
       }
 
@@ -2649,7 +2647,7 @@ void Builtins::Generate_ArrayIteratorPrototypeNext(
       {
         Node* value_int16 = assembler.LoadFixedTypedArrayElement(
             data_ptr, index, INT16_ELEMENTS, CodeStubAssembler::SMI_PARAMETERS);
-        var_value.Bind(assembler.SmiFromWord(value_int16));
+        var_value.Bind(assembler.SmiFromWord32(value_int16));
         assembler.Goto(&allocate_entry_if_needed);
       }
 

src/builtins/builtins-date.cc

@@ -953,7 +953,7 @@ void Generate_DatePrototype_GetField(CodeStubAssembler* assembler,
     Node* function = assembler->ExternalConstant(
         ExternalReference::get_date_field_function(assembler->isolate()));
     Node* result = assembler->CallCFunction2(
-        MachineType::AnyTagged(), MachineType::Pointer(),
+        MachineType::AnyTagged(), MachineType::AnyTagged(),
         MachineType::AnyTagged(), function, receiver, field_index_smi);
     assembler->Return(result);
   }

src/builtins/builtins-function.cc

@@ -367,10 +367,10 @@ void Builtins::Generate_FastFunctionPrototypeBind(
   Label empty_arguments(&assembler);
   Label arguments_done(&assembler, &argument_array);
   assembler.GotoIf(
-      assembler.UintPtrLessThanOrEqual(argc, assembler.IntPtrConstant(1)),
+      assembler.Uint32LessThanOrEqual(argc, assembler.Int32Constant(1)),
       &empty_arguments);
-  Node* elements_length =
-      assembler.IntPtrSub(argc, assembler.IntPtrConstant(1));
+  Node* elements_length = assembler.ChangeUint32ToWord(
+      assembler.Int32Sub(argc, assembler.Int32Constant(1)));
   Node* elements = assembler.AllocateFixedArray(
       FAST_ELEMENTS, elements_length, CodeStubAssembler::INTPTR_PARAMETERS);
   Variable index(&assembler, MachineType::PointerRepresentation());
@@ -398,7 +398,7 @@ void Builtins::Generate_FastFunctionPrototypeBind(
   Variable bound_receiver(&assembler, MachineRepresentation::kTagged);
   Label has_receiver(&assembler);
   Label receiver_done(&assembler, &bound_receiver);
-  assembler.GotoIf(assembler.WordNotEqual(argc, assembler.IntPtrConstant(0)),
+  assembler.GotoIf(assembler.Word32NotEqual(argc, assembler.Int32Constant(0)),
                    &has_receiver);
   bound_receiver.Bind(assembler.UndefinedConstant());
   assembler.Goto(&receiver_done);

src/builtins/builtins-internal.cc

@@ -67,7 +67,7 @@ void Builtins::Generate_CopyFastSmiOrObjectElements(
   Node* source = assembler.LoadObjectField(object, JSObject::kElementsOffset);
 
   CodeStubAssembler::ParameterMode mode = assembler.OptimalParameterMode();
-  Node* length = assembler.UntagParameter(
+  Node* length = assembler.TaggedToParameter(
       assembler.LoadFixedArrayBaseLength(source), mode);
 
   // Check if we can allocate in new space.

src/builtins/builtins-promise.cc

@@ -272,7 +272,8 @@ compiler::Node* PromiseHasHandler(CodeStubAssembler* a,
 void PromiseSetHasHandler(CodeStubAssembler* a, compiler::Node* promise) {
   typedef compiler::Node Node;
 
-  Node* const flags = a->LoadObjectField(promise, JSPromise::kFlagsOffset);
+  Node* const flags =
+      a->SmiUntag(a->LoadObjectField(promise, JSPromise::kFlagsOffset));
   Node* const new_flags =
       a->WordOr(flags, a->IntPtrConstant(1 << JSPromise::kHasHandlerBit));
   a->StoreObjectField(promise, JSPromise::kFlagsOffset, a->SmiTag(new_flags));
@@ -345,10 +346,10 @@ void AppendPromiseCallback(CodeStubAssembler* a, int offset,
   Node* elements = a->LoadObjectField(promise, offset);
   Node* length = a->LoadFixedArrayBaseLength(elements);
   CodeStubAssembler::ParameterMode mode = a->OptimalParameterMode();
-  length = a->UntagParameter(length, mode);
+  length = a->TaggedToParameter(length, mode);
 
   Node* delta = a->IntPtrOrSmiConstant(1, mode);
-  Node* new_capacity = a->IntPtrAdd(length, delta);
+  Node* new_capacity = a->IntPtrOrSmiAdd(length, delta, mode);
 
   const ElementsKind kind = FAST_ELEMENTS;
   const WriteBarrierMode barrier_mode = UPDATE_WRITE_BARRIER;

src/builtins/builtins-regexp.cc

@@ -183,16 +183,19 @@ Node* RegExpBuiltinsAssembler::ConstructNewResultFromMatchInfo(Node* context,
   {
     Node* const from_cursor = var_from_cursor.value();
     Node* const to_cursor = var_to_cursor.value();
-    Node* const start = LoadFixedArrayElement(match_info, from_cursor);
+    Node* const start =
+        LoadFixedArrayElement(match_info, from_cursor, 0, INTPTR_PARAMETERS);
 
     Label next_iter(this);
     GotoIf(SmiEqual(start, SmiConstant(Smi::FromInt(-1))), &next_iter);
 
     Node* const from_cursor_plus1 = IntPtrAdd(from_cursor, IntPtrConstant(1));
-    Node* const end = LoadFixedArrayElement(match_info, from_cursor_plus1);
+    Node* const end = LoadFixedArrayElement(match_info, from_cursor_plus1, 0,
+                                            INTPTR_PARAMETERS);
 
     Node* const capture = SubString(context, string, start, end);
-    StoreFixedArrayElement(result_elements, to_cursor, capture);
+    StoreFixedArrayElement(result_elements, to_cursor, capture,
+                           UPDATE_WRITE_BARRIER, 0, INTPTR_PARAMETERS);
     Goto(&next_iter);
 
     Bind(&next_iter);
@@ -566,7 +569,7 @@ Node* RegExpBuiltinsAssembler::FlagsGetter(Node* const context,
   do {                                                         \
     Label next(this);                                          \
     GotoUnless(IsSetWord(flags_intptr, FLAG), &next);          \
-    Node* const value = IntPtrConstant(CHAR);                  \
+    Node* const value = Int32Constant(CHAR);                   \
     StoreNoWriteBarrier(MachineRepresentation::kWord8, result, \
                         var_offset.value(), value);            \
     var_offset.Bind(IntPtrAdd(var_offset.value(), int_one));   \
@@ -590,8 +593,8 @@ Node* RegExpBuiltinsAssembler::IsRegExp(Node* const context,
                                         Node* const maybe_receiver) {
   Label out(this), if_isregexp(this);
 
-  Variable var_result(this, MachineType::PointerRepresentation());
-  var_result.Bind(IntPtrConstant(0));
+  Variable var_result(this, MachineRepresentation::kWord32);
+  var_result.Bind(Int32Constant(0));
 
   GotoIf(TaggedIsSmi(maybe_receiver), &out);
   GotoUnless(IsJSReceiver(maybe_receiver), &out);
@@ -615,7 +618,7 @@ Node* RegExpBuiltinsAssembler::IsRegExp(Node* const context,
   }
 
   Bind(&if_isregexp);
-  var_result.Bind(IntPtrConstant(1));
+  var_result.Bind(Int32Constant(1));
   Goto(&out);
 
   Bind(&out);
@@ -962,7 +965,7 @@ Node* RegExpBuiltinsAssembler::FastFlagGetter(Node* const regexp,
   Node* const smi_zero = SmiConstant(Smi::kZero);
   Node* const flags = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
   Node* const mask = SmiConstant(Smi::FromInt(flag));
-  Node* const is_flag_set = WordNotEqual(WordAnd(flags, mask), smi_zero);
+  Node* const is_flag_set = WordNotEqual(SmiAnd(flags, mask), smi_zero);
 
   return is_flag_set;
 }
@@ -974,7 +977,7 @@ Node* RegExpBuiltinsAssembler::SlowFlagGetter(Node* const context,
   Factory* factory = isolate()->factory();
 
   Label out(this);
-  Variable var_result(this, MachineType::PointerRepresentation());
+  Variable var_result(this, MachineRepresentation::kWord32);
 
   Node* name;
 
@@ -1006,13 +1009,13 @@ Node* RegExpBuiltinsAssembler::SlowFlagGetter(Node* const context,
 
   Bind(&if_true);
   {
-    var_result.Bind(IntPtrConstant(1));
+    var_result.Bind(Int32Constant(1));
     Goto(&out);
   }
 
   Bind(&if_false);
   {
-    var_result.Bind(IntPtrConstant(0));
+    var_result.Bind(Int32Constant(0));
     Goto(&out);
   }
 
@@ -2249,7 +2252,8 @@ Node* RegExpBuiltinsAssembler::ReplaceGlobalCallableFastPath(
                    var_match_start.value(), string);
 
         Node* const replacement_str = ToString(context, replacement_obj);
-        StoreFixedArrayElement(res_elems, i, replacement_str);
+        StoreFixedArrayElement(res_elems, i, replacement_str,
+                               UPDATE_WRITE_BARRIER, 0, mode);
 
         Node* const elem_length = LoadStringLength(elem);
         Node* const new_match_start =
@@ -2439,8 +2443,6 @@ TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
   Node* const replace_value = Parameter(2);
   Node* const context = Parameter(5);
 
-  Node* const int_zero = IntPtrConstant(0);
-
   // Ensure {maybe_receiver} is a JSReceiver.
   Node* const map = ThrowIfNotJSReceiver(
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
@@ -2472,10 +2474,10 @@ TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
     Node* const replace_string =
         CallStub(tostring_callable, context, replace_value);
 
-    Node* const dollar_char = IntPtrConstant('$');
+    Node* const dollar_char = Int32Constant('$');
     Node* const smi_minusone = SmiConstant(Smi::FromInt(-1));
     GotoUnless(SmiEqual(StringIndexOfChar(context, replace_string, dollar_char,
-                                          int_zero),
+                                          SmiConstant(0)),
                         smi_minusone),
                &runtime);
 

src/builtins/builtins-sharedarraybuffer.cc

@@ -43,8 +43,8 @@ void ValidateSharedTypedArray(CodeStubAssembler* a, compiler::Node* tagged,
 
   // Fail if the array's instance type is not JSTypedArray.
   a->Bind(&not_smi);
-  a->Branch(a->WordEqual(a->LoadInstanceType(tagged),
-                         a->Int32Constant(JS_TYPED_ARRAY_TYPE)),
+  a->Branch(a->Word32Equal(a->LoadInstanceType(tagged),
+                           a->Int32Constant(JS_TYPED_ARRAY_TYPE)),
             &is_typed_array, &not_typed_array);
   a->Bind(&not_typed_array);
   a->Goto(&invalid);
@@ -88,7 +88,8 @@ void ValidateSharedTypedArray(CodeStubAssembler* a, compiler::Node* tagged,
   Node* byte_offset = a->ChangeUint32ToWord(a->TruncateTaggedToWord32(
       context,
       a->LoadObjectField(tagged, JSArrayBufferView::kByteOffsetOffset)));
-  *out_backing_store = a->IntPtrAdd(backing_store, byte_offset);
+  *out_backing_store =
+      a->IntPtrAdd(a->BitcastTaggedToWord(backing_store), byte_offset);
 }
 
 // https://tc39.github.io/ecmascript_sharedmem/shmem.html#Atomics.ValidateAtomicAccess
@@ -144,8 +145,8 @@ void ValidateAtomicIndex(CodeStubAssembler* a, compiler::Node* index_word,
   CodeStubAssembler::Label if_inbounds(a), if_notinbounds(a);
   // TODO(jkummerow): Use unsigned comparison instead of "i<0 || i>length".
   a->Branch(
-      a->WordOr(a->Int32LessThan(index_word, a->Int32Constant(0)),
-                a->Int32GreaterThanOrEqual(index_word, array_length_word)),
+      a->Word32Or(a->Int32LessThan(index_word, a->Int32Constant(0)),
+                  a->Int32GreaterThanOrEqual(index_word, array_length_word)),
       &if_notinbounds, &if_inbounds);
   a->Bind(&if_notinbounds);
   a->Return(
@@ -185,20 +186,20 @@ void Builtins::Generate_AtomicsLoad(compiler::CodeAssemblerState* state) {
            arraysize(case_labels));
 
   a.Bind(&i8);
-  a.Return(
-      a.SmiTag(a.AtomicLoad(MachineType::Int8(), backing_store, index_word)));
+  a.Return(a.SmiFromWord32(
+      a.AtomicLoad(MachineType::Int8(), backing_store, index_word)));
 
   a.Bind(&u8);
-  a.Return(
-      a.SmiTag(a.AtomicLoad(MachineType::Uint8(), backing_store, index_word)));
+  a.Return(a.SmiFromWord32(
+      a.AtomicLoad(MachineType::Uint8(), backing_store, index_word)));
 
   a.Bind(&i16);
-  a.Return(a.SmiTag(a.AtomicLoad(MachineType::Int16(), backing_store,
-                                 a.WordShl(index_word, 1))));
+  a.Return(a.SmiFromWord32(a.AtomicLoad(MachineType::Int16(), backing_store,
+                                        a.WordShl(index_word, 1))));
 
   a.Bind(&u16);
-  a.Return(a.SmiTag(a.AtomicLoad(MachineType::Uint16(), backing_store,
-                                 a.WordShl(index_word, 1))));
+  a.Return(a.SmiFromWord32(a.AtomicLoad(MachineType::Uint16(), backing_store,
+                                        a.WordShl(index_word, 1))));
 
   a.Bind(&i32);
   a.Return(a.ChangeInt32ToTagged(a.AtomicLoad(
@@ -210,7 +211,7 @@ void Builtins::Generate_AtomicsLoad(compiler::CodeAssemblerState* state) {
 
   // This shouldn't happen, we've already validated the type.
   a.Bind(&other);
-  a.Return(a.Int32Constant(0));
+  a.Return(a.SmiConstant(0));
 }
 
 void Builtins::Generate_AtomicsStore(compiler::CodeAssemblerState* state) {
@@ -262,7 +263,7 @@ void Builtins::Generate_AtomicsStore(compiler::CodeAssemblerState* state) {
 
   // This shouldn't happen, we've already validated the type.
   a.Bind(&other);
-  a.Return(a.Int32Constant(0));
+  a.Return(a.SmiConstant(0));
 }
 
 }  // namespace internal

src/builtins/builtins-string.cc

@@ -434,11 +434,12 @@ void Builtins::Generate_StringFromCharCode(
   typedef CodeStubAssembler::Variable Variable;
   CodeStubAssembler assembler(state);
 
-  Node* argc = assembler.ChangeInt32ToIntPtr(
-      assembler.Parameter(BuiltinDescriptor::kArgumentsCount));
+  Node* argc = assembler.Parameter(BuiltinDescriptor::kArgumentsCount);
   Node* context = assembler.Parameter(BuiltinDescriptor::kContext);
 
   CodeStubArguments arguments(&assembler, argc);
+  // From now on use word-size argc value.
+  argc = arguments.GetLength();
 
   // Check if we have exactly one argument (plus the implicit receiver), i.e.
   // if the parent frame is not an arguments adaptor frame.
@@ -1312,7 +1313,7 @@ compiler::Node* LoadSurrogatePairInternal(CodeStubAssembler* assembler,
   typedef CodeStubAssembler::Variable Variable;
   Label handle_surrogate_pair(assembler), return_result(assembler);
   Variable var_result(assembler, MachineRepresentation::kWord32);
-  Variable var_trail(assembler, MachineRepresentation::kWord16);
+  Variable var_trail(assembler, MachineRepresentation::kWord32);
   var_result.Bind(assembler->StringCharCodeAt(string, index));
   var_trail.Bind(assembler->Int32Constant(0));
 
@@ -1350,12 +1351,12 @@ compiler::Node* LoadSurrogatePairInternal(CodeStubAssembler* assembler,
 
     switch (encoding) {
       case UnicodeEncoding::UTF16:
-        var_result.Bind(assembler->WordOr(
+        var_result.Bind(assembler->Word32Or(
 // Need to swap the order for big-endian platforms
 #if V8_TARGET_BIG_ENDIAN
-            assembler->WordShl(lead, assembler->Int32Constant(16)), trail));
+            assembler->Word32Shl(lead, assembler->Int32Constant(16)), trail));
 #else
-            assembler->WordShl(trail, assembler->Int32Constant(16)), lead));
+            assembler->Word32Shl(trail, assembler->Int32Constant(16)), lead));
 #endif
         break;
 
@@ -1410,8 +1411,8 @@ void Builtins::Generate_StringIteratorPrototypeNext(
 
   assembler.GotoIf(assembler.TaggedIsSmi(iterator), &throw_bad_receiver);
   assembler.GotoUnless(
-      assembler.WordEqual(assembler.LoadInstanceType(iterator),
-                          assembler.Int32Constant(JS_STRING_ITERATOR_TYPE)),
+      assembler.Word32Equal(assembler.LoadInstanceType(iterator),
+                            assembler.Int32Constant(JS_STRING_ITERATOR_TYPE)),
       &throw_bad_receiver);
 
   Node* string =

src/builtins/builtins.cc

@@ -89,7 +89,8 @@ Code* BuildWithCodeStubAssemblerJS(Isolate* isolate,
   compiler::CodeAssemblerState state(isolate, &zone, argc_with_recv, flags,
                                      name);
   generator(&state);
-  Handle<Code> code = compiler::CodeAssembler::GenerateCode(&state);
+  Handle<Code> code =
+      compiler::CodeAssembler::GenerateCode(&state, FLAG_csa_verify);
   PostBuildProfileAndTracing(isolate, *code, name);
   return *code;
 }

src/code-stub-assembler.h

@@ -85,16 +85,26 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                : MachineRepresentation::kTaggedSigned;
   }
 
-  Node* UntagParameter(Node* value, ParameterMode mode) {
-    if (mode != SMI_PARAMETERS) value = SmiUntag(value);
+  Node* ParameterToWord(Node* value, ParameterMode mode) {
+    if (mode == SMI_PARAMETERS) value = SmiUntag(value);
+    return value;
+  }
+
+  Node* WordToParameter(Node* value, ParameterMode mode) {
+    if (mode == SMI_PARAMETERS) value = SmiTag(value);
     return value;
   }
 
-  Node* TagParameter(Node* value, ParameterMode mode) {
+  Node* ParameterToTagged(Node* value, ParameterMode mode) {
     if (mode != SMI_PARAMETERS) value = SmiTag(value);
     return value;
   }
 
+  Node* TaggedToParameter(Node* value, ParameterMode mode) {
+    if (mode != SMI_PARAMETERS) value = SmiUntag(value);
+    return value;
+  }
+
 #define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName, Int32OpName) \
   Node* OpName(Node* a, Node* b, ParameterMode mode) {                \
     if (mode == SMI_PARAMETERS) {                                     \
@@ -111,6 +121,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                   Int32LessThan)
   PARAMETER_BINOP(IntPtrOrSmiGreaterThan, IntPtrGreaterThan, SmiGreaterThan,
                   Int32GreaterThan)
+  PARAMETER_BINOP(IntPtrOrSmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual,
+                  SmiGreaterThanOrEqual, Int32GreaterThanOrEqual)
   PARAMETER_BINOP(UintPtrOrSmiLessThan, UintPtrLessThan, SmiBelow,
                   Uint32LessThan)
   PARAMETER_BINOP(UintPtrOrSmiGreaterThanOrEqual, UintPtrGreaterThanOrEqual,
@@ -190,6 +202,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   SMI_COMPARISON_OP(SmiLessThan, IntPtrLessThan)
   SMI_COMPARISON_OP(SmiLessThanOrEqual, IntPtrLessThanOrEqual)
   SMI_COMPARISON_OP(SmiGreaterThan, IntPtrGreaterThan)
+  SMI_COMPARISON_OP(SmiGreaterThanOrEqual, IntPtrGreaterThanOrEqual)
 #undef SMI_COMPARISON_OP
   Node* SmiMax(Node* a, Node* b);
   Node* SmiMin(Node* a, Node* b);
@@ -759,13 +772,12 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   // Returns true if any of the |T|'s bits in given |word| are set.
   template <typename T>
   Node* IsSetWord(Node* word) {
-    return WordNotEqual(WordAnd(word, IntPtrConstant(T::kMask)),
-                        IntPtrConstant(0));
+    return IsSetWord(word, T::kMask);
   }
 
   // Returns true if any of the mask's bits in given |word| are set.
   Node* IsSetWord(Node* word, uint32_t mask) {
-    return WordNotEqual(WordAnd(word, Int32Constant(mask)), Int32Constant(0));
+    return WordNotEqual(WordAnd(word, IntPtrConstant(mask)), IntPtrConstant(0));
   }
 
   void SetCounter(StatsCounter* counter, int value);
@@ -1141,11 +1153,9 @@ class CodeStubArguments {
  public:
   typedef compiler::Node Node;
 
-  // |argc| specifies the number of arguments passed to the builtin excluding
-  // the receiver.
-  CodeStubArguments(CodeStubAssembler* assembler, Node* argc,
-                    CodeStubAssembler::ParameterMode mode =
-                        CodeStubAssembler::INTPTR_PARAMETERS);
+  // |argc| is an uint32 value which specifies the number of arguments passed
+  // to the builtin excluding the receiver.
+  CodeStubArguments(CodeStubAssembler* assembler, Node* argc);
 
   Node* GetReceiver() const;
 

src/code-stubs.cc

@@ -2742,7 +2742,7 @@ compiler::Node* NonEmptyShallowClone(CodeStubAssembler* assembler,
   ParameterMode param_mode = assembler->OptimalParameterMode();
 
   Node* length = assembler->LoadJSArrayLength(boilerplate);
-  capacity = assembler->UntagParameter(capacity, param_mode);
+  capacity = assembler->TaggedToParameter(capacity, param_mode);
 
   Node *array, *elements;
   std::tie(array, elements) =
@@ -2760,7 +2760,7 @@ compiler::Node* NonEmptyShallowClone(CodeStubAssembler* assembler,
         assembler->LoadObjectField(boilerplate_elements, offset));
   }
 
-  length = assembler->UntagParameter(length, param_mode);
+  length = assembler->TaggedToParameter(length, param_mode);
 
   assembler->Comment("copy boilerplate elements");
   assembler->CopyFixedArrayElements(kind, boilerplate_elements, elements,

src/compiler/instruction-selector.cc

@@ -1984,7 +1984,8 @@ void InstructionSelector::VisitReturn(Node* ret) {
   DCHECK_GE(input_count, 1);
   auto value_locations = zone()->NewArray<InstructionOperand>(input_count);
   Node* pop_count = ret->InputAt(0);
-  value_locations[0] = pop_count->opcode() == IrOpcode::kInt32Constant
+  value_locations[0] = (pop_count->opcode() == IrOpcode::kInt32Constant ||
+                        pop_count->opcode() == IrOpcode::kInt64Constant)
                            ? g.UseImmediate(pop_count)
                            : g.UseRegister(pop_count);
   for (int i = 1; i < input_count; ++i) {

src/compiler/machine-graph-verifier.cc

@@ -30,6 +30,10 @@ class MachineRepresentationInferrer {
     Run();
   }
 
+  CallDescriptor* call_descriptor() const {
+    return linkage_->GetIncomingDescriptor();
+  }
+
   MachineRepresentation GetRepresentation(Node const* node) const {
     return representation_vector_.at(node->id());
   }
@@ -94,6 +98,11 @@ class MachineRepresentationInferrer {
                 linkage_->GetParameterType(ParameterIndexOf(node->op()))
                     .representation();
             break;
+          case IrOpcode::kReturn: {
+            representation_vector_[node->id()] = PromoteRepresentation(
+                linkage_->GetReturnType().representation());
+            break;
+          }
           case IrOpcode::kProjection: {
             representation_vector_[node->id()] = GetProjectionType(node);
           } break;
@@ -136,6 +145,9 @@ class MachineRepresentationInferrer {
             break;
           }
           case IrOpcode::kAtomicStore:
+            representation_vector_[node->id()] =
+                PromoteRepresentation(AtomicStoreRepresentationOf(node->op()));
+            break;
           case IrOpcode::kStore:
           case IrOpcode::kProtectedStore:
             representation_vector_[node->id()] = PromoteRepresentation(
@@ -456,6 +468,11 @@ class MachineRepresentationChecker {
                   CheckValueInputIsTagged(node, i);
                 }
                 break;
+              case MachineRepresentation::kWord32:
+                for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
+                  CheckValueInputForInt32Op(node, i);
+                }
+                break;
               default:
                 for (int i = 0; i < node->op()->ValueInputCount(); ++i) {
                   CheckValueInputRepresentationIs(
@@ -468,10 +485,33 @@ class MachineRepresentationChecker {
           case IrOpcode::kSwitch:
             CheckValueInputForInt32Op(node, 0);
             break;
-          case IrOpcode::kReturn:
-            // TODO(epertoso): use the linkage to determine which tipe we
-            // should have here.
+          case IrOpcode::kReturn: {
+            // TODO(ishell): enable once the pop count parameter type becomes
+            // MachineType::PointerRepresentation(). Currently it's int32 or
+            // word-size.
+            // CheckValueInputRepresentationIs(
+            //     node, 0, MachineType::PointerRepresentation());  // Pop count
+            size_t return_count = inferrer_->call_descriptor()->ReturnCount();
+            for (size_t i = 0; i < return_count; i++) {
+              MachineType type = inferrer_->call_descriptor()->GetReturnType(i);
+              int input_index = static_cast<int>(i + 1);
+              switch (type.representation()) {
+                case MachineRepresentation::kTagged:
+                case MachineRepresentation::kTaggedPointer:
+                case MachineRepresentation::kTaggedSigned:
+                  CheckValueInputIsTagged(node, input_index);
+                  break;
+                case MachineRepresentation::kWord32:
+                  CheckValueInputForInt32Op(node, input_index);
+                  break;
+                default:
+                  CheckValueInputRepresentationIs(
+                      node, 2, inferrer_->GetRepresentation(node));
+              }
+              break;
+            }
             break;
+          }
           case IrOpcode::kTypedStateValues:
           case IrOpcode::kFrameState:
             break;

src/ic/accessor-assembler.cc

@@ -879,9 +879,7 @@ void AccessorAssemblerImpl::EmitElementLoad(
     Comment("typed elements");
     // Check if buffer has been neutered.
     Node* buffer = LoadObjectField(object, JSArrayBufferView::kBufferOffset);
-    Node* bitfield = LoadObjectField(buffer, JSArrayBuffer::kBitFieldOffset,
-                                     MachineType::Uint32());
-    GotoIf(IsSetWord32<JSArrayBuffer::WasNeutered>(bitfield), miss);
+    GotoIf(IsDetachedBuffer(buffer), miss);
 
     // Bounds check.
     Node* length =
@@ -893,9 +891,9 @@ void AccessorAssemblerImpl::EmitElementLoad(
         LoadObjectField(elements, FixedTypedArrayBase::kExternalPointerOffset,
                         MachineType::Pointer());
     Node* base_pointer =
-        LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset,
-                        MachineType::Pointer());
-    Node* backing_store = IntPtrAdd(external_pointer, base_pointer);
+        LoadObjectField(elements, FixedTypedArrayBase::kBasePointerOffset);
+    Node* backing_store =
+        IntPtrAdd(external_pointer, BitcastTaggedToWord(base_pointer));
 
     Label uint8_elements(this), int8_elements(this), uint16_elements(this),
         int16_elements(this), uint32_elements(this), int32_elements(this),

src/interface-descriptors.cc

@@ -402,9 +402,9 @@ void CallFunctionWithFeedbackAndVectorDescriptor::InitializePlatformIndependent(
 
 void BuiltinDescriptor::InitializePlatformIndependent(
     CallInterfaceDescriptorData* data) {
-  MachineType machine_types[] = {MachineType::AnyTagged(),
-                                 MachineType::AnyTagged(),
-                                 MachineType::Pointer()};
+  // kTarget, kNewTarget, kArgumentsCount
+  MachineType machine_types[] = {
+      MachineType::AnyTagged(), MachineType::AnyTagged(), MachineType::Int32()};
   data->InitializePlatformIndependent(arraysize(machine_types), 0,
                                       machine_types);
 }

src/interface-descriptors.h

@@ -616,6 +616,7 @@ SIMD128_TYPES(SIMD128_ALLOC_DESC)
 
 class BuiltinDescriptor : public CallInterfaceDescriptor {
  public:
+  // TODO(ishell): Where is kFunction??
   DEFINE_PARAMETERS(kNewTarget, kArgumentsCount)
   DECLARE_DESCRIPTOR_WITH_CUSTOM_FUNCTION_TYPE(BuiltinDescriptor,
                                                CallInterfaceDescriptor)