[turbofan] Reintroduce LoadMessage/StoreMessage simplified operators

We are going to change again Tagged to not mean 'Full Tagged'. Then,
we have to reintroduce these operators.

These allow to write a tagged uncompressed pointer even if pointer
compression is enabled.

This CL is basically a revert of
https://chromium-review.googlesource.com/c/v8/v8/+/1593301.

Bug: v8:7703
Change-Id: Ic1c66690b6bc74f697c9f5bf6d3ff45bb764c268
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817612Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63949}

src/compiler/access-builder.cc

@@ -23,10 +23,9 @@ namespace internal {
 namespace compiler {
 
 // static
-FieldAccess AccessBuilder::ForExternalTaggedValue() {
-  FieldAccess access = {kUntaggedBase,       0,
-                        MaybeHandle<Name>(), MaybeHandle<Map>(),
-                        Type::Any(),         MachineType::AnyTagged(),
+FieldAccess AccessBuilder::ForExternalIntPtr() {
+  FieldAccess access = {kUntaggedBase,      0,           MaybeHandle<Name>(),
+                        MaybeHandle<Map>(), Type::Any(), MachineType::IntPtr(),
                         kNoWriteBarrier};
   return access;
 }
@@ -109,7 +108,6 @@ FieldAccess AccessBuilder::ForJSObjectElements() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForJSObjectInObjectProperty(const MapRef& map,
                                                        int index) {
@@ -185,7 +183,6 @@ FieldAccess AccessBuilder::ForJSFunctionContext() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForJSFunctionSharedFunctionInfo() {
   FieldAccess access = {
@@ -296,7 +293,6 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectInputOrDebugPos() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForJSGeneratorObjectParametersAndRegisters() {
   FieldAccess access = {
@@ -478,7 +474,6 @@ FieldAccess AccessBuilder::ForJSDateField(JSDate::FieldIndex index) {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForJSIteratorResultDone() {
   FieldAccess access = {
@@ -489,7 +484,6 @@ FieldAccess AccessBuilder::ForJSIteratorResultDone() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForJSIteratorResultValue() {
   FieldAccess access = {
@@ -540,7 +534,6 @@ FieldAccess AccessBuilder::ForJSRegExpSource() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForFixedArrayLength() {
   FieldAccess access = {kTaggedBase,
@@ -600,7 +593,6 @@ FieldAccess AccessBuilder::ForMapBitField3() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForMapDescriptors() {
   FieldAccess access = {
@@ -611,7 +603,6 @@ FieldAccess AccessBuilder::ForMapDescriptors() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForMapInstanceType() {
   FieldAccess access = {
@@ -621,7 +612,6 @@ FieldAccess AccessBuilder::ForMapInstanceType() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForMapPrototype() {
   FieldAccess access = {
@@ -829,7 +819,6 @@ FieldAccess AccessBuilder::ForArgumentsLength() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForArgumentsCallee() {
   FieldAccess access = {
@@ -840,7 +829,6 @@ FieldAccess AccessBuilder::ForArgumentsCallee() {
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForFixedArraySlot(
     size_t index, WriteBarrierKind write_barrier_kind) {
@@ -852,7 +840,6 @@ FieldAccess AccessBuilder::ForFixedArraySlot(
   return access;
 }
 
-
 // static
 FieldAccess AccessBuilder::ForCellValue() {
   FieldAccess access = {kTaggedBase,       Cell::kValueOffset,

src/compiler/access-builder.h

@@ -24,11 +24,8 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   // ===========================================================================
   // Access to external values (based on external references).
 
-  // Provides access to a tagged field identified by an external reference.
-  static FieldAccess ForExternalTaggedValue();
-
-  // Provides access to an uint8 field identified by an external reference.
-  static FieldAccess ForExternalUint8Value();
+  // Provides access to an IntPtr field identified by an external reference.
+  static FieldAccess ForExternalIntPtr();
 
   // ===========================================================================
   // Access to heap object fields and elements (based on tagged pointer).

src/compiler/effect-control-linearizer.cc

@@ -187,8 +187,10 @@ class EffectControlLinearizer {
   Node* LowerMaybeGrowFastElements(Node* node, Node* frame_state);
   void LowerTransitionElementsKind(Node* node);
   Node* LowerLoadFieldByIndex(Node* node);
+  Node* LowerLoadMessage(Node* node);
   Node* LowerLoadTypedElement(Node* node);
   Node* LowerLoadDataViewElement(Node* node);
+  void LowerStoreMessage(Node* node);
   void LowerStoreTypedElement(Node* node);
   void LowerStoreDataViewElement(Node* node);
   void LowerStoreSignedSmallElement(Node* node);
@@ -1245,6 +1247,12 @@ bool EffectControlLinearizer::TryWireInStateEffect(Node* node,
     case IrOpcode::kTransitionElementsKind:
       LowerTransitionElementsKind(node);
       break;
+    case IrOpcode::kLoadMessage:
+      result = LowerLoadMessage(node);
+      break;
+    case IrOpcode::kStoreMessage:
+      LowerStoreMessage(node);
+      break;
     case IrOpcode::kLoadFieldByIndex:
       result = LowerLoadFieldByIndex(node);
       break;
@@ -4748,6 +4756,20 @@ void EffectControlLinearizer::LowerTransitionElementsKind(Node* node) {
   __ Bind(&done);
 }
 
+Node* EffectControlLinearizer::LowerLoadMessage(Node* node) {
+  Node* offset = node->InputAt(0);
+  Node* object_pattern =
+      __ LoadField(AccessBuilder::ForExternalIntPtr(), offset);
+  return __ BitcastWordToTagged(object_pattern);
+}
+
+void EffectControlLinearizer::LowerStoreMessage(Node* node) {
+  Node* offset = node->InputAt(0);
+  Node* object = node->InputAt(1);
+  Node* object_pattern = __ BitcastTaggedToWord(object);
+  __ StoreField(AccessBuilder::ForExternalIntPtr(), offset, object_pattern);
+}
+
 Node* EffectControlLinearizer::LowerLoadFieldByIndex(Node* node) {
   Node* object = node->InputAt(0);
   Node* index = node->InputAt(1);

src/compiler/js-typed-lowering.cc

@@ -2025,8 +2025,7 @@ Reduction JSTypedLowering::ReduceJSLoadMessage(Node* node) {
   ExternalReference const ref =
       ExternalReference::address_of_pending_message_obj(isolate());
   node->ReplaceInput(0, jsgraph()->ExternalConstant(ref));
-  NodeProperties::ChangeOp(
-      node, simplified()->LoadField(AccessBuilder::ForExternalTaggedValue()));
+  NodeProperties::ChangeOp(node, simplified()->LoadMessage());
   return Changed(node);
 }
 
@@ -2037,8 +2036,7 @@ Reduction JSTypedLowering::ReduceJSStoreMessage(Node* node) {
   Node* value = NodeProperties::GetValueInput(node, 0);
   node->ReplaceInput(0, jsgraph()->ExternalConstant(ref));
   node->ReplaceInput(1, value);
-  NodeProperties::ChangeOp(
-      node, simplified()->StoreField(AccessBuilder::ForExternalTaggedValue()));
+  NodeProperties::ChangeOp(node, simplified()->StoreMessage());
   return Changed(node);
 }
 

src/compiler/opcodes.h

@@ -425,11 +425,13 @@
   V(LoadFieldByIndex)                   \
   V(LoadField)                          \
   V(LoadElement)                        \
+  V(LoadMessage)                        \
   V(LoadTypedElement)                   \
   V(LoadFromObject)                     \
   V(LoadDataViewElement)                \
   V(StoreField)                         \
   V(StoreElement)                       \
+  V(StoreMessage)                       \
   V(StoreTypedElement)                  \
   V(StoreToObject)                      \
   V(StoreDataViewElement)               \

src/compiler/simplified-lowering.cc

@@ -2894,6 +2894,18 @@ class RepresentationSelector {
         SetOutput(node, MachineRepresentation::kTaggedPointer);
         return;
       }
+      case IrOpcode::kLoadMessage: {
+        if (truncation.IsUnused()) return VisitUnused(node);
+        VisitUnop(node, UseInfo::Word(), MachineRepresentation::kTagged);
+        return;
+      }
+      case IrOpcode::kStoreMessage: {
+        ProcessInput(node, 0, UseInfo::Word());
+        ProcessInput(node, 1, UseInfo::AnyTagged());
+        ProcessRemainingInputs(node, 2);
+        SetOutput(node, MachineRepresentation::kNone);
+        return;
+      }
       case IrOpcode::kLoadFieldByIndex: {
         if (truncation.IsUnused()) return VisitUnused(node);
         VisitBinop(node, UseInfo::AnyTagged(), UseInfo::TruncatingWord32(),

src/compiler/simplified-operator.cc

@@ -1754,6 +1754,20 @@ SPECULATIVE_NUMBER_BINOP_LIST(SPECULATIVE_NUMBER_BINOP)
 ACCESS_OP_LIST(ACCESS)
 #undef ACCESS
 
+const Operator* SimplifiedOperatorBuilder::LoadMessage() {
+  return new (zone())
+      Operator(IrOpcode::kLoadMessage,
+               Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoWrite,
+               "LoadMessage", 1, 1, 1, 1, 1, 0);
+}
+
+const Operator* SimplifiedOperatorBuilder::StoreMessage() {
+  return new (zone())
+      Operator(IrOpcode::kStoreMessage,
+               Operator::kNoDeopt | Operator::kNoThrow | Operator::kNoRead,
+               "StoreMessage", 2, 1, 1, 0, 1, 0);
+}
+
 const Operator* SimplifiedOperatorBuilder::TransitionAndStoreElement(
     Handle<Map> double_map, Handle<Map> fast_map) {
   TransitionAndStoreElementParameters parameters(double_map, fast_map);

src/compiler/simplified-operator.h

@@ -876,6 +876,9 @@ class V8_EXPORT_PRIVATE SimplifiedOperatorBuilder final
       Type type, AllocationType allocation = AllocationType::kYoung,
       AllowLargeObjects allow_large_objects = AllowLargeObjects::kFalse);
 
+  const Operator* LoadMessage();
+  const Operator* StoreMessage();
+
   const Operator* LoadFieldByIndex();
   const Operator* LoadField(FieldAccess const&);
   const Operator* StoreField(FieldAccess const&);

src/compiler/typer.cc

@@ -2192,6 +2192,8 @@ Type Typer::Visitor::TypeLoadField(Node* node) {
   return FieldAccessOf(node->op()).type;
 }
 
+Type Typer::Visitor::TypeLoadMessage(Node* node) { return Type::Any(); }
+
 Type Typer::Visitor::TypeLoadElement(Node* node) {
   return ElementAccessOf(node->op()).type;
 }
@@ -2222,6 +2224,8 @@ Type Typer::Visitor::TypeLoadDataViewElement(Node* node) {
 
 Type Typer::Visitor::TypeStoreField(Node* node) { UNREACHABLE(); }
 
+Type Typer::Visitor::TypeStoreMessage(Node* node) { UNREACHABLE(); }
+
 Type Typer::Visitor::TypeStoreElement(Node* node) { UNREACHABLE(); }
 
 Type Typer::Visitor::TypeStoreToObject(Node* node) { UNREACHABLE(); }

src/compiler/verifier.cc

@@ -1594,6 +1594,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::NonInternal());
       break;
     case IrOpcode::kLoadField:
+    case IrOpcode::kLoadMessage:
       // Object -> fieldtype
       // TODO(rossberg): activate once machine ops are typed.
       // CheckValueInputIs(node, 0, Type::Object());
@@ -1613,6 +1614,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
     case IrOpcode::kLoadDataViewElement:
       break;
     case IrOpcode::kStoreField:
+    case IrOpcode::kStoreMessage:
       // (Object, fieldtype) -> _|_
       // TODO(rossberg): activate once machine ops are typed.
       // CheckValueInputIs(node, 0, Type::Object());