[cleanup] Add & use more CSA LoadRoot helpers

Forbid using LoadRoot in CSA (with a bailout via CodeAssembler), so that
users are forced to use helper macros for roots, which have statically
known types. Convert all current uses of LoadRoot to use these macros,
introducing new ones where necessary.

Bug: v8:9396
Change-Id: I91214fca6e5ace7554d79605706a8a60117468fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762526
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63398}

src/builtins/base.tq

@@ -1602,9 +1602,6 @@ extern macro LoadBufferObject(RawPtr, constexpr int32): Object;
 extern macro LoadBufferPointer(RawPtr, constexpr int32): RawPtr;
 extern macro LoadBufferSmi(RawPtr, constexpr int32): Smi;
 
-extern macro LoadRoot(constexpr RootIndex): Object;
-extern macro StoreRoot(constexpr RootIndex, Object): Object;
-
 extern runtime StringEqual(Context, String, String): Oddball;
 extern builtin StringLessThan(Context, String, String): Boolean;
 extern macro StringCharCodeAt(String, intptr): int32;
@@ -2646,13 +2643,15 @@ macro UnsafeCast<A: type>(implicit context: Context)(o: Object): A {
   return %RawDownCast<A>(o);
 }
 
-const kFixedArrayMap: Map =
-    %RawDownCast<Map>(LoadRoot(kFixedArrayMapRootIndex));
-const kCOWMap: Map = %RawDownCast<Map>(LoadRoot(kFixedCOWArrayMapRootIndex));
-const kEmptyByteArray: ByteArray =
-    %RawDownCast<ByteArray>(LoadRoot(kEmptyByteArrayRootIndex));
-const kEmptyFixedArray: FixedArray =
-    %RawDownCast<FixedArray>(LoadRoot(kEmptyFixedArrayRootIndex));
+extern macro FixedArrayMapConstant(): Map;
+extern macro FixedCOWArrayMapConstant(): Map;
+extern macro EmptyByteArrayConstant(): ByteArray;
+extern macro EmptyFixedArrayConstant(): FixedArray;
+
+const kFixedArrayMap: Map = FixedArrayMapConstant();
+const kCOWMap: Map = FixedCOWArrayMapConstant();
+const kEmptyByteArray: ByteArray = EmptyByteArrayConstant();
+const kEmptyFixedArray: FixedArray = EmptyFixedArrayConstant();
 
 extern macro IsPrototypeInitialArrayPrototype(implicit context: Context)(Map):
     bool;

src/builtins/builtins-arguments-gen.cc

@@ -40,20 +40,20 @@ ArgumentsBuiltinsAssembler::AllocateArgumentsObject(Node* map,
       empty ? IntPtrConstant(base_size)
             : ElementOffsetFromIndex(element_count, PACKED_ELEMENTS, mode,
                                      base_size + FixedArray::kHeaderSize);
-  TNode<Object> result = Allocate(size);
+  TNode<HeapObject> result = Allocate(size);
   Comment("Initialize arguments object");
   StoreMapNoWriteBarrier(result, map);
-  TNode<Object> empty_fixed_array = LoadRoot(RootIndex::kEmptyFixedArray);
+  TNode<FixedArray> empty_fixed_array = EmptyFixedArrayConstant();
   StoreObjectField(result, JSArray::kPropertiesOrHashOffset, empty_fixed_array);
   Node* smi_arguments_count = ParameterToTagged(arguments_count, mode);
   StoreObjectFieldNoWriteBarrier(result, JSArray::kLengthOffset,
                                  smi_arguments_count);
   Node* arguments = nullptr;
   if (!empty) {
-    arguments = InnerAllocate(CAST(result), elements_offset);
+    arguments = InnerAllocate(result, elements_offset);
     StoreObjectFieldNoWriteBarrier(arguments, FixedArray::kLengthOffset,
                                    smi_arguments_count);
-    TNode<Object> fixed_array_map = LoadRoot(RootIndex::kFixedArrayMap);
+    TNode<Map> fixed_array_map = FixedArrayMapConstant();
     StoreMapNoWriteBarrier(arguments, fixed_array_map);
   }
   Node* parameter_map = nullptr;
@@ -63,8 +63,7 @@ ArgumentsBuiltinsAssembler::AllocateArgumentsObject(Node* map,
     parameter_map = InnerAllocate(CAST(arguments), parameter_map_offset);
     StoreObjectFieldNoWriteBarrier(result, JSArray::kElementsOffset,
                                    parameter_map);
-    Node* sloppy_elements_map =
-        LoadRoot(RootIndex::kSloppyArgumentsElementsMap);
+    Node* sloppy_elements_map = SloppyArgumentsElementsMapConstant();
     StoreMapNoWriteBarrier(parameter_map, sloppy_elements_map);
     parameter_map_count = ParameterToTagged(parameter_map_count, mode);
     StoreObjectFieldNoWriteBarrier(parameter_map, FixedArray::kLengthOffset,
@@ -97,13 +96,14 @@ Node* ArgumentsBuiltinsAssembler::ConstructParametersObjectFromArgs(
   VARIABLE(offset, MachineType::PointerRepresentation());
   offset.Bind(IntPtrConstant(FixedArrayBase::kHeaderSize - kHeapObjectTag));
   VariableList list({&offset}, zone());
-  arguments.ForEach(list,
-                    [this, elements, &offset](Node* arg) {
-                      StoreNoWriteBarrier(MachineRepresentation::kTagged,
-                                          elements, offset.value(), arg);
-                      Increment(&offset, kTaggedSize);
-                    },
-                    first_arg, nullptr, param_mode);
+  arguments.ForEach(
+      list,
+      [this, elements, &offset](Node* arg) {
+        StoreNoWriteBarrier(MachineRepresentation::kTagged, elements,
+                            offset.value(), arg);
+        Increment(&offset, kTaggedSize);
+      },
+      first_arg, nullptr, param_mode);
   return result;
 }
 

src/builtins/builtins-array-gen.cc

@@ -97,7 +97,7 @@ void ArrayBuiltinsAssembler::FillFixedArrayWithSmiZero(TNode<FixedArray> array,
   CSA_ASSERT(this, Word32BinaryNot(IsFixedDoubleArray(array)));
 
   TNode<IntPtrT> length = SmiToIntPtr(smi_length);
-  TNode<WordT> byte_length = TimesTaggedSize(length);
+  TNode<IntPtrT> byte_length = TimesTaggedSize(length);
   CSA_ASSERT(this, UintPtrLessThan(length, byte_length));
 
   static const int32_t fa_base_data_offset =
@@ -326,9 +326,8 @@ TF_BUILTIN(ArrayPrototypePop, CodeStubAssembler) {
 
     // 3) Check that the elements backing store isn't copy-on-write.
     TNode<FixedArrayBase> elements = LoadElements(array_receiver);
-    GotoIf(
-        TaggedEqual(LoadMap(elements), LoadRoot(RootIndex::kFixedCOWArrayMap)),
-        &runtime);
+    GotoIf(TaggedEqual(LoadMap(elements), FixedCOWArrayMapConstant()),
+           &runtime);
 
     TNode<IntPtrT> new_length = IntPtrSub(length, IntPtrConstant(1));
 
@@ -857,7 +856,7 @@ TF_BUILTIN(ArrayIsArray, CodeStubAssembler) {
   Label call_runtime(this), return_true(this), return_false(this);
 
   GotoIf(TaggedIsSmi(object), &return_false);
-  TNode<Int32T> instance_type = LoadInstanceType(CAST(object));
+  TNode<Uint16T> instance_type = LoadInstanceType(CAST(object));
 
   GotoIf(InstanceTypeEqual(instance_type, JS_ARRAY_TYPE), &return_true);
 
@@ -1510,7 +1509,7 @@ TF_BUILTIN(ArrayIteratorPrototypeNext, CodeStubAssembler) {
 
   // Dispatch based on the type of the {array}.
   TNode<Map> array_map = LoadMap(array);
-  TNode<Int32T> array_type = LoadMapInstanceType(array_map);
+  TNode<Uint16T> array_type = LoadMapInstanceType(array_map);
   GotoIf(InstanceTypeEqual(array_type, JS_ARRAY_TYPE), &if_array);
   Branch(InstanceTypeEqual(array_type, JS_TYPED_ARRAY_TYPE), &if_typedarray,
          &if_other);
@@ -1935,7 +1934,7 @@ TF_BUILTIN(ArrayConstructor, ArrayBuiltinsAssembler) {
       SelectConstant<Object>(IsUndefined(new_target), function, new_target);
 
   // Run the native code for the Array function called as a normal function.
-  TNode<Object> no_allocation_site = UndefinedConstant();
+  TNode<Oddball> no_allocation_site = UndefinedConstant();
   TailCallBuiltin(Builtins::kArrayConstructorImpl, context, function,
                   new_target, argc, no_allocation_site);
 }

src/builtins/builtins-call-gen.cc

@@ -292,8 +292,7 @@ void CallOrConstructBuiltinsAssembler::CallOrConstructWithSpread(
 
   // Check that the Array.prototype hasn't been modified in a way that would
   // affect iteration.
-  TNode<PropertyCell> protector_cell =
-      CAST(LoadRoot(RootIndex::kArrayIteratorProtector));
+  TNode<PropertyCell> protector_cell = ArrayIteratorProtectorConstant();
   GotoIf(
       TaggedEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
                   SmiConstant(Isolate::kProtectorInvalid)),
@@ -431,7 +430,7 @@ TNode<JSReceiver> CallOrConstructBuiltinsAssembler::GetCompatibleReceiver(
       //     will be ruled out there).
       //
       var_template = CAST(constructor);
-      TNode<Int32T> template_type = LoadInstanceType(var_template.value());
+      TNode<Uint16T> template_type = LoadInstanceType(var_template.value());
       GotoIf(InstanceTypeEqual(template_type, JS_FUNCTION_TYPE),
              &template_from_closure);
       Branch(InstanceTypeEqual(template_type, MAP_TYPE), &template_map_loop,
@@ -515,7 +514,7 @@ void CallOrConstructBuiltinsAssembler::CallFunctionTemplate(
     GotoIfNot(
         IsSetWord32<Map::IsAccessCheckNeededBit>(LoadMapBitField(receiver_map)),
         &receiver_done);
-    TNode<WordT> function_template_info_flags = LoadAndUntagObjectField(
+    TNode<IntPtrT> function_template_info_flags = LoadAndUntagObjectField(
         function_template_info, FunctionTemplateInfo::kFlagOffset);
     Branch(IsSetWord(function_template_info_flags,
                      1 << FunctionTemplateInfo::kAcceptAnyReceiver),

src/builtins/builtins-collections-gen.cc

@@ -430,7 +430,7 @@ void BaseCollectionsAssembler::GenerateConstructor(
   GotoIf(IsUndefined(new_target), &if_undefined);
 
   TNode<Context> native_context = LoadNativeContext(context);
-  TNode<Object> collection = AllocateJSCollection(
+  TNode<JSObject> collection = AllocateJSCollection(
       context, GetConstructor(variant, native_context), CAST(new_target));
 
   AddConstructorEntries(variant, context, native_context, collection, iterable);
@@ -856,8 +856,7 @@ void CollectionsBuiltinsAssembler::SameValueZeroSmi(
 
 void CollectionsBuiltinsAssembler::BranchIfMapIteratorProtectorValid(
     Label* if_true, Label* if_false) {
-  TNode<HeapObject> protector_cell =
-      CAST(LoadRoot(RootIndex::kMapIteratorProtector));
+  TNode<PropertyCell> protector_cell = MapIteratorProtectorConstant();
   DCHECK(isolate()->heap()->map_iterator_protector().IsPropertyCell());
   Branch(
       TaggedEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
@@ -916,7 +915,7 @@ void BranchIfIterableWithOriginalKeyOrValueMapIterator(
 
 void CollectionsBuiltinsAssembler::BranchIfSetIteratorProtectorValid(
     Label* if_true, Label* if_false) {
-  Node* const protector_cell = LoadRoot(RootIndex::kSetIteratorProtector);
+  Node* const protector_cell = SetIteratorProtectorConstant();
   DCHECK(isolate()->heap()->set_iterator_protector().IsPropertyCell());
   Branch(
       TaggedEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),

src/builtins/builtins-constructor-gen.cc

@@ -109,7 +109,7 @@ TF_BUILTIN(FastNewClosure, ConstructorBuiltinsAssembler) {
   // Create a new closure from the given function info in new space
   TNode<IntPtrT> instance_size_in_bytes =
       TimesTaggedSize(LoadMapInstanceSizeInWords(function_map));
-  TNode<Object> result = Allocate(instance_size_in_bytes);
+  TNode<HeapObject> result = Allocate(instance_size_in_bytes);
   StoreMapNoWriteBarrier(result, function_map);
   InitializeJSObjectBodyNoSlackTracking(result, function_map,
                                         instance_size_in_bytes,
@@ -260,7 +260,7 @@ Node* ConstructorBuiltinsAssembler::EmitFastNewFunctionContext(
                                  Context::kNativeContextOffset, native_context);
 
   // Initialize the varrest of the slots to undefined.
-  TNode<HeapObject> undefined = UndefinedConstant();
+  TNode<Oddball> undefined = UndefinedConstant();
   TNode<IntPtrT> start_offset = IntPtrConstant(Context::kTodoHeaderSize);
   CodeStubAssembler::VariableList vars(0, zone());
   BuildFastLoop(
@@ -690,7 +690,7 @@ TF_BUILTIN(ObjectConstructor, ConstructorBuiltinsAssembler) {
 // ES #sec-number-constructor
 TF_BUILTIN(NumberConstructor, ConstructorBuiltinsAssembler) {
   Node* context = Parameter(Descriptor::kContext);
-  TNode<WordT> argc =
+  TNode<IntPtrT> argc =
       ChangeInt32ToIntPtr(Parameter(Descriptor::kJSActualArgumentsCount));
   CodeStubArguments args(this, argc);
 

src/builtins/builtins-date-gen.cc

@@ -194,11 +194,11 @@ TF_BUILTIN(DatePrototypeToPrimitive, CodeStubAssembler) {
       hint_is_invalid(this, Label::kDeferred);
 
   // Fast cases for internalized strings.
-  TNode<Object> number_string = LoadRoot(RootIndex::knumber_string);
+  TNode<String> number_string = numberStringConstant();
   GotoIf(TaggedEqual(hint, number_string), &hint_is_number);
-  TNode<Object> default_string = LoadRoot(RootIndex::kdefault_string);
+  TNode<String> default_string = DefaultStringConstant();
   GotoIf(TaggedEqual(hint, default_string), &hint_is_string);
-  TNode<Object> string_string = LoadRoot(RootIndex::kstring_string);
+  TNode<String> string_string = StringStringConstant();
   GotoIf(TaggedEqual(hint, string_string), &hint_is_string);
 
   // Slow-case with actual string comparisons.

src/builtins/builtins-function-gen.cc

@@ -63,8 +63,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
     const int length_index = JSFunction::kLengthDescriptorIndex;
     TNode<Name> maybe_length =
         LoadKeyByDescriptorEntry(descriptors, length_index);
-    GotoIf(TaggedNotEqual(maybe_length, LoadRoot(RootIndex::klength_string)),
-           &slow);
+    GotoIf(TaggedNotEqual(maybe_length, LengthStringConstant()), &slow);
 
     TNode<Object> maybe_length_accessor =
         LoadValueByDescriptorEntry(descriptors, length_index);
@@ -74,8 +73,7 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
 
     const int name_index = JSFunction::kNameDescriptorIndex;
     TNode<Name> maybe_name = LoadKeyByDescriptorEntry(descriptors, name_index);
-    GotoIf(TaggedNotEqual(maybe_name, LoadRoot(RootIndex::kname_string)),
-           &slow);
+    GotoIf(TaggedNotEqual(maybe_name, NameStringConstant()), &slow);
 
     TNode<Object> maybe_name_accessor =
         LoadValueByDescriptorEntry(descriptors, name_index);
@@ -110,8 +108,8 @@ TF_BUILTIN(FastFunctionPrototypeBind, CodeStubAssembler) {
 
   // Verify that __proto__ matches that of a the target bound function.
   Comment("Verify that __proto__ matches target bound function");
-  TNode<Object> prototype = LoadMapPrototype(receiver_map);
-  TNode<Object> expected_prototype =
+  TNode<HeapObject> prototype = LoadMapPrototype(receiver_map);
+  TNode<HeapObject> expected_prototype =
       LoadMapPrototype(bound_function_map.value());
   GotoIf(TaggedNotEqual(prototype, expected_prototype), &slow);
 

src/builtins/builtins-handler-gen.cc

@@ -180,7 +180,7 @@ void HandlerBuiltinsAssembler::DispatchForElementsKindTransition(
   STATIC_ASSERT(arraysize(combined_elements_kinds) ==
                 arraysize(elements_kind_labels));
 
-  TNode<Word32T> combined_elements_kind =
+  TNode<Int32T> combined_elements_kind =
       Word32Or(Word32Shl(from_kind, Int32Constant(kBitsPerByte)), to_kind);
 
   Switch(combined_elements_kind, &if_unknown_type, combined_elements_kinds,

src/builtins/builtins-internal-gen.cc

@@ -496,7 +496,7 @@ class DeletePropertyBaseAssembler : public AccessorAssembler {
     GotoIf(IsSetWord32(details, PropertyDetails::kAttributesDontDeleteMask),
            dont_delete);
     // Overwrite the entry itself (see NameDictionary::SetEntry).
-    TNode<HeapObject> filler = TheHoleConstant();
+    TNode<Oddball> filler = TheHoleConstant();
     DCHECK(RootsTable::IsImmortalImmovable(RootIndex::kTheHoleValue));
     StoreFixedArrayElement(properties, key_index, filler, SKIP_WRITE_BARRIER);
     StoreValueByKeyIndex<NameDictionary>(properties, key_index, filler,
@@ -539,7 +539,7 @@ TF_BUILTIN(DeleteProperty, DeletePropertyBaseAssembler) {
 
   GotoIf(TaggedIsSmi(receiver), &slow);
   TNode<Map> receiver_map = LoadMap(CAST(receiver));
-  TNode<Int32T> instance_type = LoadMapInstanceType(receiver_map);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
   GotoIf(InstanceTypeEqual(instance_type, JS_PROXY_TYPE), &if_proxy);
   GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &slow);
   TryToName(key, &if_index, &var_index, &if_unique_name, &var_unique, &slow,
@@ -632,7 +632,7 @@ class SetOrCopyDataPropertiesAssembler : public CodeStubAssembler {
     // Otherwise check if {source} is a proper JSObject, and if not, defer
     // to testing for non-empty strings below.
     TNode<Map> source_map = LoadMap(CAST(source));
-    TNode<Int32T> source_instance_type = LoadMapInstanceType(source_map);
+    TNode<Uint16T> source_instance_type = LoadMapInstanceType(source_map);
     GotoIfNot(IsJSObjectInstanceType(source_instance_type),
               &if_sourcenotjsobject);
 

src/builtins/builtins-microtask-queue-gen.cc

@@ -123,7 +123,7 @@ void MicrotaskQueueBuiltinsAssembler::RunSingleMicrotask(
   StoreRoot(RootIndex::kCurrentMicrotask, microtask);
   TNode<IntPtrT> saved_entered_context_count = GetEnteredContextCount();
   TNode<Map> microtask_map = LoadMap(microtask);
-  TNode<Int32T> microtask_type = LoadMapInstanceType(microtask_map);
+  TNode<Uint16T> microtask_type = LoadMapInstanceType(microtask_map);
 
   VARIABLE(var_exception, MachineRepresentation::kTagged, TheHoleConstant());
   Label if_exception(this, Label::kDeferred);

src/builtins/builtins-object-gen.cc

@@ -378,7 +378,7 @@ TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
   BIND(&if_objectisnotsmi);
 
   Node* map = LoadMap(object);
-  TNode<Int32T> instance_type = LoadMapInstanceType(map);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(map);
 
   {
     VARIABLE(var_index, MachineType::PointerRepresentation());
@@ -477,7 +477,7 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
   GotoIf(TaggedIsSmi(object), &if_slow);
   Node* object_map = LoadMap(object);
   Node* object_bit_field3 = LoadMapBitField3(object_map);
-  TNode<WordT> object_enum_length =
+  TNode<UintPtrT> object_enum_length =
       DecodeWordFromWord32<Map::EnumLengthBits>(object_bit_field3);
   GotoIf(
       WordEqual(object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel)),
@@ -562,7 +562,7 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
   // has any elements.
   GotoIf(TaggedIsSmi(object), &if_slow);
   Node* object_map = LoadMap(object);
-  TNode<Int32T> instance_type = LoadMapInstanceType(object_map);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(object_map);
   GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &if_slow);
   Node* object_elements = LoadElements(object);
   GotoIf(IsEmptyFixedArray(object_elements), &if_empty_elements);
@@ -572,14 +572,14 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
   // Check if the {object} has a usable enum cache.
   BIND(&if_empty_elements);
   Node* object_bit_field3 = LoadMapBitField3(object_map);
-  TNode<WordT> object_enum_length =
+  TNode<UintPtrT> object_enum_length =
       DecodeWordFromWord32<Map::EnumLengthBits>(object_bit_field3);
   GotoIf(
       WordEqual(object_enum_length, IntPtrConstant(kInvalidEnumCacheSentinel)),
       &try_fast);
 
   // Check whether all own properties are enumerable.
-  TNode<WordT> number_descriptors =
+  TNode<UintPtrT> number_descriptors =
       DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(object_bit_field3);
   GotoIfNot(WordEqual(object_enum_length, number_descriptors), &if_slow);
 
@@ -783,13 +783,13 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
 
   BIND(&if_arguments);
   {
-    var_default.Bind(LoadRoot(RootIndex::karguments_to_string));
+    var_default.Bind(ArgumentsToStringConstant());
     Goto(&checkstringtag);
   }
 
   BIND(&if_array);
   {
-    var_default.Bind(LoadRoot(RootIndex::karray_to_string));
+    var_default.Bind(ArrayToStringConstant());
     Goto(&checkstringtag);
   }
 
@@ -802,26 +802,26 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         boolean_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     Node* boolean_prototype =
         LoadObjectField(boolean_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(LoadRoot(RootIndex::kboolean_to_string));
+    var_default.Bind(BooleanToStringConstant());
     var_holder.Bind(boolean_prototype);
     Goto(&checkstringtag);
   }
 
   BIND(&if_date);
   {
-    var_default.Bind(LoadRoot(RootIndex::kdate_to_string));
+    var_default.Bind(DateToStringConstant());
     Goto(&checkstringtag);
   }
 
   BIND(&if_error);
   {
-    var_default.Bind(LoadRoot(RootIndex::kerror_to_string));
+    var_default.Bind(ErrorToStringConstant());
     Goto(&checkstringtag);
   }
 
   BIND(&if_function);
   {
-    var_default.Bind(LoadRoot(RootIndex::kfunction_to_string));
+    var_default.Bind(FunctionToStringConstant());
     Goto(&checkstringtag);
   }
 
@@ -834,7 +834,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         number_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     Node* number_prototype =
         LoadObjectField(number_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(LoadRoot(RootIndex::knumber_to_string));
+    var_default.Bind(NumberToStringConstant());
     var_holder.Bind(number_prototype);
     Goto(&checkstringtag);
   }
@@ -842,7 +842,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   BIND(&if_object);
   {
     CSA_ASSERT(this, IsJSReceiver(receiver));
-    var_default.Bind(LoadRoot(RootIndex::kobject_to_string));
+    var_default.Bind(ObjectToStringConstant());
     Goto(&checkstringtag);
   }
 
@@ -857,10 +857,10 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     GotoIf(IsSymbolMap(receiver_map), &if_symbol);
     GotoIf(IsUndefined(receiver), &return_undefined);
     CSA_ASSERT(this, IsNull(receiver));
-    Return(LoadRoot(RootIndex::knull_to_string));
+    Return(NullToStringConstant());
 
     BIND(&return_undefined);
-    Return(LoadRoot(RootIndex::kundefined_to_string));
+    Return(UndefinedToStringConstant());
   }
 
   BIND(&if_proxy);
@@ -873,13 +873,12 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     Node* receiver_is_array =
         CallRuntime(Runtime::kArrayIsArray, context, receiver);
     TNode<String> builtin_tag = Select<String>(
-        IsTrue(receiver_is_array),
-        [=] { return CAST(LoadRoot(RootIndex::kArray_string)); },
+        IsTrue(receiver_is_array), [=] { return ArrayStringConstant(); },
         [=] {
           return Select<String>(
               IsCallableMap(receiver_map),
-              [=] { return CAST(LoadRoot(RootIndex::kFunction_string)); },
-              [=] { return CAST(LoadRoot(RootIndex::kObject_string)); });
+              [=] { return FunctionStringConstant(); },
+              [=] { return ObjectStringConstant(); });
         });
 
     // Lookup the @@toStringTag property on the {receiver}.
@@ -900,7 +899,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
 
   BIND(&if_regexp);
   {
-    var_default.Bind(LoadRoot(RootIndex::kregexp_to_string));
+    var_default.Bind(RegexpToStringConstant());
     Goto(&checkstringtag);
   }
 
@@ -913,7 +912,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         string_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     Node* string_prototype =
         LoadObjectField(string_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(LoadRoot(RootIndex::kstring_to_string));
+    var_default.Bind(StringToStringConstant());
     var_holder.Bind(string_prototype);
     Goto(&checkstringtag);
   }
@@ -927,7 +926,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         symbol_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     Node* symbol_prototype =
         LoadObjectField(symbol_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(LoadRoot(RootIndex::kobject_to_string));
+    var_default.Bind(ObjectToStringConstant());
     var_holder.Bind(symbol_prototype);
     Goto(&checkstringtag);
   }
@@ -941,7 +940,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         bigint_constructor, JSFunction::kPrototypeOrInitialMapOffset);
     Node* bigint_prototype =
         LoadObjectField(bigint_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(LoadRoot(RootIndex::kobject_to_string));
+    var_default.Bind(ObjectToStringConstant());
     var_holder.Bind(bigint_prototype);
     Goto(&checkstringtag);
   }
@@ -972,31 +971,31 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
 
     BIND(&if_value_is_number);
     {
-      var_default.Bind(LoadRoot(RootIndex::knumber_to_string));
+      var_default.Bind(NumberToStringConstant());
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_boolean);
     {
-      var_default.Bind(LoadRoot(RootIndex::kboolean_to_string));
+      var_default.Bind(BooleanToStringConstant());
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_string);
     {
-      var_default.Bind(LoadRoot(RootIndex::kstring_to_string));
+      var_default.Bind(StringToStringConstant());
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_bigint);
     {
-      var_default.Bind(LoadRoot(RootIndex::kobject_to_string));
+      var_default.Bind(ObjectToStringConstant());
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_symbol);
     {
-      var_default.Bind(LoadRoot(RootIndex::kobject_to_string));
+      var_default.Bind(ObjectToStringConstant());
       Goto(&checkstringtag);
     }
   }
@@ -1024,7 +1023,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     BIND(&return_generic);
     {
       Node* tag = GetProperty(context, ToObject(context, receiver),
-                              LoadRoot(RootIndex::kto_string_tag_symbol));
+                              ToStringTagSymbolConstant());
       GotoIf(TaggedIsSmi(tag), &return_default);
       GotoIfNot(IsString(tag), &return_default);
       ReturnToStringFormat(context, tag);
@@ -1137,9 +1136,9 @@ TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
     Node* properties_map = LoadMap(CAST(properties));
     GotoIf(IsSpecialReceiverMap(properties_map), &call_runtime);
     // Stay on the fast path only if there are no elements.
-    GotoIfNot(TaggedEqual(LoadElements(CAST(properties)),
-                          LoadRoot(RootIndex::kEmptyFixedArray)),
-              &call_runtime);
+    GotoIfNot(
+        TaggedEqual(LoadElements(CAST(properties)), EmptyFixedArrayConstant()),
+        &call_runtime);
     // Handle dictionary objects or fast objects with properties in runtime.
     Node* bit_field3 = LoadMapBitField3(properties_map);
     GotoIf(IsSetWord32<Map::IsDictionaryMapBit>(bit_field3), &call_runtime);
@@ -1348,7 +1347,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
       call_runtime(this, Label::kDeferred),
       return_undefined(this, Label::kDeferred), if_notunique_name(this);
   Node* map = LoadMap(object);
-  TNode<Int32T> instance_type = LoadMapInstanceType(map);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(map);
   GotoIf(IsSpecialReceiverInstanceType(instance_type), &call_runtime);
   {
     VARIABLE(var_index, MachineType::PointerRepresentation(),

src/builtins/builtins-promise-gen.cc

@@ -137,7 +137,7 @@ void PromiseBuiltinsAssembler::ExtractHandlerContext(Node* handler,
     };
     static_assert(arraysize(case_values) == arraysize(case_labels), "");
     TNode<Map> handler_map = LoadMap(var_handler.value());
-    TNode<Int32T> handler_type = LoadMapInstanceType(handler_map);
+    TNode<Uint16T> handler_type = LoadMapInstanceType(handler_map);
     Switch(handler_type, &done, case_values, case_labels,
            arraysize(case_labels));
 
@@ -426,7 +426,7 @@ void PromiseBuiltinsAssembler::PerformPromiseThen(
 
     BIND(&if_fulfilled);
     {
-      var_map.Bind(LoadRoot(RootIndex::kPromiseFulfillReactionJobTaskMap));
+      var_map.Bind(PromiseFulfillReactionJobTaskMapConstant());
       var_handler.Bind(on_fulfilled);
 
       Label use_fallback(this, Label::kDeferred), done(this);
@@ -445,7 +445,7 @@ void PromiseBuiltinsAssembler::PerformPromiseThen(
     BIND(&if_rejected);
     {
       CSA_ASSERT(this, IsPromiseStatus(status, v8::Promise::kRejected));
-      var_map.Bind(LoadRoot(RootIndex::kPromiseRejectReactionJobTaskMap));
+      var_map.Bind(PromiseRejectReactionJobTaskMapConstant());
       var_handler.Bind(on_rejected);
 
       Label use_fallback(this, Label::kDeferred), done(this);
@@ -531,16 +531,6 @@ Node* PromiseBuiltinsAssembler::AllocatePromiseReactionJobTask(
   return microtask;
 }
 
-Node* PromiseBuiltinsAssembler::AllocatePromiseReactionJobTask(
-    RootIndex map_root_index, Node* context, Node* argument, Node* handler,
-    Node* promise_or_capability) {
-  DCHECK(map_root_index == RootIndex::kPromiseFulfillReactionJobTaskMap ||
-         map_root_index == RootIndex::kPromiseRejectReactionJobTaskMap);
-  Node* const map = LoadRoot(map_root_index);
-  return AllocatePromiseReactionJobTask(map, context, argument, handler,
-                                        promise_or_capability);
-}
-
 Node* PromiseBuiltinsAssembler::AllocatePromiseResolveThenableJobTask(
     Node* promise_to_resolve, Node* then, Node* thenable, Node* context) {
   Node* const microtask = Allocate(PromiseResolveThenableJobTask::kSize);
@@ -574,8 +564,7 @@ Node* PromiseBuiltinsAssembler::TriggerPromiseReactions(
     // PromiseReaction instances and not actual JavaScript values (which
     // would indicate that we're rejecting or resolving an already settled
     // promise), see https://crbug.com/931640 for details on this.
-    TNode<Map> promise_reaction_map =
-        CAST(LoadRoot(RootIndex::kPromiseReactionMap));
+    TNode<Map> promise_reaction_map = PromiseReactionMapConstant();
 
     Label loop(this, {&var_current, &var_reversed}), done_loop(this);
     Goto(&loop);
@@ -1014,7 +1003,7 @@ TF_BUILTIN(PromiseConstructor, PromiseBuiltinsAssembler) {
   BIND(&if_targetismodified);
   {
     ConstructorBuiltinsAssembler constructor_assembler(this->state());
-    TNode<Object> instance = constructor_assembler.EmitFastNewObject(
+    TNode<JSObject> instance = constructor_assembler.EmitFastNewObject(
         context, promise_fun, CAST(new_target));
     PromiseInit(instance);
     var_result.Bind(instance);
@@ -1150,7 +1139,7 @@ TF_BUILTIN(PromisePrototypeThen, PromiseBuiltinsAssembler) {
       native_context, promise_map, &fast_promise_capability, &slow_constructor);
 
   BIND(&slow_constructor);
-  TNode<Object> constructor =
+  TNode<JSReceiver> constructor =
       SpeciesConstructor(native_context, promise, promise_fun);
   Branch(TaggedEqual(constructor, promise_fun), &fast_promise_capability,
          &slow_promise_capability);

src/builtins/builtins-promise-gen.h

@@ -35,9 +35,6 @@ class V8_EXPORT_PRIVATE PromiseBuiltinsAssembler : public CodeStubAssembler {
   Node* AllocatePromiseReaction(Node* next, Node* promise_or_capability,
                                 Node* fulfill_handler, Node* reject_handler);
 
-  Node* AllocatePromiseReactionJobTask(RootIndex map_root_index, Node* context,
-                                       Node* argument, Node* handler,
-                                       Node* promise_or_capability);
   Node* AllocatePromiseReactionJobTask(Node* map, Node* context, Node* argument,
                                        Node* handler,
                                        Node* promise_or_capability);

src/builtins/builtins-proxy-gen.cc

@@ -437,7 +437,7 @@ void ProxiesCodeStubAssembler::CheckDeleteTrapResult(TNode<Context> context,
 
   // 10. Let targetDesc be ? target.[[GetOwnProperty]](P).
   GotoIfNot(IsUniqueNameNoIndex(name), &check_in_runtime);
-  TNode<Int32T> instance_type = LoadInstanceType(target);
+  TNode<Uint16T> instance_type = LoadInstanceType(target);
   TryGetOwnProperty(context, target, target, target_map, instance_type, name,
                     &if_found_value, &var_value, &var_details, &var_raw_value,
                     &check_passed, &check_in_runtime, kReturnAccessorPair);

src/builtins/builtins-regexp-gen.cc

@@ -132,7 +132,7 @@ void RegExpBuiltinsAssembler::FastStoreLastIndex(TNode<JSRegExp> regexp,
 void RegExpBuiltinsAssembler::SlowStoreLastIndex(SloppyTNode<Context> context,
                                                  SloppyTNode<Object> regexp,
                                                  SloppyTNode<Number> value) {
-  TNode<Name> name = HeapConstant(isolate()->factory()->lastIndex_string());
+  TNode<String> name = HeapConstant(isolate()->factory()->lastIndex_string());
   SetPropertyStrict(context, regexp, name, value);
 }
 
@@ -375,7 +375,9 @@ TNode<HeapObject> RegExpBuiltinsAssembler::RegExpExecInternal(
           data, IntPtrConstant(JSRegExp::kTagIndex));
 
       int32_t values[] = {
-          JSRegExp::IRREGEXP, JSRegExp::ATOM, JSRegExp::NOT_COMPILED,
+          JSRegExp::IRREGEXP,
+          JSRegExp::ATOM,
+          JSRegExp::NOT_COMPILED,
       };
       Label* labels[] = {&next, &atom, &runtime};
 
@@ -911,7 +913,7 @@ TNode<BoolT> RegExpBuiltinsAssembler::IsReceiverInitialRegExpPrototype(
       LoadContextElement(native_context, Context::REGEXP_FUNCTION_INDEX);
   Node* const initial_map =
       LoadObjectField(regexp_fun, JSFunction::kPrototypeOrInitialMapOffset);
-  TNode<Object> const initial_prototype = LoadMapPrototype(initial_map);
+  TNode<HeapObject> const initial_prototype = LoadMapPrototype(initial_map);
   return TaggedEqual(receiver, initial_prototype);
 }
 
@@ -2150,7 +2152,7 @@ TNode<Object> RegExpMatchAllAssembler::CreateRegExpStringIterator(
   // 4. Let iterator be ObjectCreate(%RegExpStringIteratorPrototype%, «
   // [[IteratingRegExp]], [[IteratedString]], [[Global]], [[Unicode]],
   // [[Done]] »).
-  TNode<Object> iterator = Allocate(JSRegExpStringIterator::kSize);
+  TNode<HeapObject> iterator = Allocate(JSRegExpStringIterator::kSize);
   StoreMapNoWriteBarrier(iterator, map);
   StoreObjectFieldRoot(iterator,
                        JSRegExpStringIterator::kPropertiesOrHashOffset,
@@ -2179,9 +2181,9 @@ TNode<Object> RegExpMatchAllAssembler::CreateRegExpStringIterator(
   // 7. Set iterator.[[Global]] to global.
   // 8. Set iterator.[[Unicode]] to fullUnicode.
   // 9. Set iterator.[[Done]] to false.
-  TNode<Word32T> global_flag =
+  TNode<Int32T> global_flag =
       Word32Shl(global, Int32Constant(JSRegExpStringIterator::kGlobalBit));
-  TNode<Word32T> unicode_flag = Word32Shl(
+  TNode<Int32T> unicode_flag = Word32Shl(
       full_unicode, Int32Constant(JSRegExpStringIterator::kUnicodeBit));
   TNode<Word32T> iterator_flags = Word32Or(global_flag, unicode_flag);
   StoreObjectFieldNoWriteBarrier(iterator, JSRegExpStringIterator::kFlagsOffset,

src/builtins/builtins-string-gen.cc

@@ -323,7 +323,7 @@ void StringBuiltinsAssembler::GenerateStringRelationalComparison(
 
   // Combine the instance types into a single 16-bit value, so we can check
   // both of them at once.
-  TNode<Word32T> both_instance_types = Word32Or(
+  TNode<Int32T> both_instance_types = Word32Or(
       lhs_instance_type, Word32Shl(rhs_instance_type, Int32Constant(8)));
 
   // Check that both {lhs} and {rhs} are flat one-byte strings.
@@ -1476,7 +1476,7 @@ TNode<JSArray> StringBuiltinsAssembler::StringToArray(
       fill_thehole_and_call_runtime(this, Label::kDeferred);
   TVARIABLE(JSArray, result_array);
 
-  TNode<Int32T> instance_type = LoadInstanceType(subject_string);
+  TNode<Uint16T> instance_type = LoadInstanceType(subject_string);
   GotoIfNot(IsOneByteStringInstanceType(instance_type), &call_runtime);
 
   // Try to use cached one byte characters.
@@ -1495,7 +1495,7 @@ TNode<JSArray> StringBuiltinsAssembler::StringToArray(
     TNode<RawPtrT> string_data =
         to_direct.PointerToData(&fill_thehole_and_call_runtime);
     TNode<IntPtrT> string_data_offset = to_direct.offset();
-    TNode<Object> cache = LoadRoot(RootIndex::kSingleCharacterStringCache);
+    TNode<FixedArray> cache = SingleCharacterStringCacheConstant();
 
     BuildFastLoop(
         IntPtrConstant(0), length,
@@ -1508,7 +1508,7 @@ TNode<JSArray> StringBuiltinsAssembler::StringToArray(
               UncheckedCast<Int32T>(Load(MachineType::Uint8(), string_data,
                                          IntPtrAdd(index, string_data_offset)));
           Node* code_index = ChangeUint32ToWord(char_code);
-          TNode<Object> entry = LoadFixedArrayElement(CAST(cache), code_index);
+          TNode<Object> entry = LoadFixedArrayElement(cache, code_index);
 
           // If we cannot find a char in the cache, fill the hole for the fixed
           // array, and call runtime.
@@ -1995,8 +1995,7 @@ void StringBuiltinsAssembler::BranchIfStringPrimitiveWithNoCustomIteration(
 
   // Check that the String iterator hasn't been modified in a way that would
   // affect iteration.
-  TNode<PropertyCell> protector_cell =
-      CAST(LoadRoot(RootIndex::kStringIteratorProtector));
+  TNode<PropertyCell> protector_cell = StringIteratorProtectorConstant();
   DCHECK(isolate()->heap()->string_iterator_protector().IsPropertyCell());
   Branch(
       TaggedEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),

src/builtins/builtins-typed-array-gen.cc

@@ -38,8 +38,7 @@ TNode<JSArrayBuffer> TypedArrayBuiltinsAssembler::AllocateEmptyOnHeapBuffer(
   TNode<Context> native_context = LoadNativeContext(context);
   TNode<Map> map =
       CAST(LoadContextElement(native_context, Context::ARRAY_BUFFER_MAP_INDEX));
-  TNode<FixedArray> empty_fixed_array =
-      CAST(LoadRoot(RootIndex::kEmptyFixedArray));
+  TNode<FixedArray> empty_fixed_array = EmptyFixedArrayConstant();
 
   TNode<JSArrayBuffer> buffer = UncheckedCast<JSArrayBuffer>(
       Allocate(JSArrayBuffer::kSizeWithEmbedderFields));
@@ -221,7 +220,7 @@ TypedArrayBuiltinsAssembler::GetTypedArrayElementsInfo(TNode<Map> map) {
 TNode<JSFunction> TypedArrayBuiltinsAssembler::GetDefaultConstructor(
     TNode<Context> context, TNode<JSTypedArray> exemplar) {
   TVARIABLE(IntPtrT, context_slot);
-  TNode<Word32T> elements_kind = LoadElementsKind(exemplar);
+  TNode<Int32T> elements_kind = LoadElementsKind(exemplar);
 
   DispatchTypedArrayByElementsKind(
       elements_kind,
@@ -322,8 +321,8 @@ void TypedArrayBuiltinsAssembler::SetTypedArraySource(
   TNode<RawPtrT> target_data_ptr = LoadJSTypedArrayBackingStore(target);
   TNode<RawPtrT> source_data_ptr = LoadJSTypedArrayBackingStore(source);
 
-  TNode<Word32T> source_el_kind = LoadElementsKind(source);
-  TNode<Word32T> target_el_kind = LoadElementsKind(target);
+  TNode<Int32T> source_el_kind = LoadElementsKind(source);
+  TNode<Int32T> target_el_kind = LoadElementsKind(target);
 
   TNode<IntPtrT> source_el_size = GetTypedArrayElementSize(source_el_kind);
   TNode<IntPtrT> target_el_size = GetTypedArrayElementSize(target_el_kind);
@@ -727,7 +726,7 @@ TF_BUILTIN(TypedArrayOf, TypedArrayBuiltinsAssembler) {
   TNode<JSTypedArray> new_typed_array = TypedArrayCreateByLength(
       context, receiver, SmiTag(length), "%TypedArray%.of");
 
-  TNode<Word32T> elements_kind = LoadElementsKind(new_typed_array);
+  TNode<Int32T> elements_kind = LoadElementsKind(new_typed_array);
 
   // 6. Let k be 0.
   // 7. Repeat, while k < len
@@ -864,8 +863,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
         &check_iterator);
     // Check that the ArrayIterator prototype's "next" method hasn't been
     // overridden
-    TNode<PropertyCell> protector_cell =
-        CAST(LoadRoot(RootIndex::kArrayIteratorProtector));
+    TNode<PropertyCell> protector_cell = ArrayIteratorProtectorConstant();
     GotoIfNot(
         TaggedEqual(LoadObjectField(protector_cell, PropertyCell::kValueOffset),
                     SmiConstant(Isolate::kProtectorValid)),
@@ -895,7 +893,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
 
     // This is not a spec'd limit, so it doesn't particularly matter when we
     // throw the range error for typed array length > MaxSmi.
-    TNode<Object> raw_length = LoadJSArrayLength(values);
+    TNode<UnionT<Smi, HeapNumber>> raw_length = LoadJSArrayLength(values);
     GotoIfNot(TaggedIsSmi(raw_length), &if_length_not_smi);
 
     final_length = CAST(raw_length);
@@ -949,7 +947,7 @@ TF_BUILTIN(TypedArrayFrom, TypedArrayBuiltinsAssembler) {
   }
 
   BIND(&slow_path);
-  TNode<Word32T> elements_kind = LoadElementsKind(target_obj.value());
+  TNode<Int32T> elements_kind = LoadElementsKind(target_obj.value());
 
   // 7e/13 : Copy the elements
   BuildFastLoop(

src/compiler/code-assembler.cc

@@ -300,10 +300,6 @@ TNode<Float64T> CodeAssembler::Float64Constant(double value) {
   return UncheckedCast<Float64T>(raw_assembler()->Float64Constant(value));
 }
 
-TNode<HeapNumber> CodeAssembler::NaNConstant() {
-  return UncheckedCast<HeapNumber>(LoadRoot(RootIndex::kNanValue));
-}
-
 bool CodeAssembler::ToInt32Constant(Node* node, int32_t* out_value) {
   {
     Int64Matcher m(node);

src/compiler/code-assembler.h

@@ -843,7 +843,6 @@ class V8_EXPORT_PRIVATE CodeAssembler {
   TNode<Oddball> BooleanConstant(bool value);
   TNode<ExternalReference> ExternalConstant(ExternalReference address);
   TNode<Float64T> Float64Constant(double value);
-  TNode<HeapNumber> NaNConstant();
   TNode<BoolT> Int32TrueConstant() {
     return ReinterpretCast<BoolT>(Int32Constant(1));
   }

src/ic/keyed-store-generic.cc

@@ -185,7 +185,7 @@ void KeyedStoreGenericAssembler::BranchIfPrototypesHaveNonFastElements(
     GotoIf(IsNull(prototype), only_fast_elements);
     Node* prototype_map = LoadMap(prototype);
     var_map.Bind(prototype_map);
-    TNode<Int32T> instance_type = LoadMapInstanceType(prototype_map);
+    TNode<Uint16T> instance_type = LoadMapInstanceType(prototype_map);
     GotoIf(IsCustomElementsReceiverInstanceType(instance_type),
            non_fast_elements);
     TNode<Int32T> elements_kind = LoadMapElementsKind(prototype_map);
@@ -326,7 +326,7 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
 
   Label check_double_elements(this), check_cow_elements(this);
   TNode<Map> elements_map = LoadMap(elements);
-  GotoIf(TaggedNotEqual(elements_map, LoadRoot(RootIndex::kFixedArrayMap)),
+  GotoIf(TaggedNotEqual(elements_map, FixedArrayMapConstant()),
          &check_double_elements);
 
   // FixedArray backing store -> Smi or object elements.
@@ -388,7 +388,7 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
     {
       Label transition_to_double(this), transition_to_object(this);
       Node* native_context = LoadNativeContext(context);
-      Branch(TaggedEqual(LoadMap(value), LoadRoot(RootIndex::kHeapNumberMap)),
+      Branch(TaggedEqual(LoadMap(value), HeapNumberMapConstant()),
              &transition_to_double, &transition_to_object);
       BIND(&transition_to_double);
       {
@@ -428,8 +428,7 @@ void KeyedStoreGenericAssembler::StoreElementWithCapacity(
   }
 
   BIND(&check_double_elements);
-  TNode<Object> fixed_double_array_map =
-      LoadRoot(RootIndex::kFixedDoubleArrayMap);
+  TNode<Map> fixed_double_array_map = FixedDoubleArrayMapConstant();
   GotoIf(TaggedNotEqual(elements_map, fixed_double_array_map),
          &check_cow_elements);
   // FixedDoubleArray backing store -> double elements.
@@ -977,7 +976,7 @@ void KeyedStoreGenericAssembler::KeyedStoreGeneric(
 
   GotoIf(TaggedIsSmi(receiver), &slow);
   TNode<Map> receiver_map = LoadMap(CAST(receiver));
-  TNode<Int32T> instance_type = LoadMapInstanceType(receiver_map);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &slow);
@@ -1058,7 +1057,7 @@ void KeyedStoreGenericAssembler::StoreIC_NoFeedback() {
 
   GotoIf(TaggedIsSmi(receiver), &miss);
   TNode<Map> receiver_map = LoadMap(receiver);
-  TNode<Int32T> instance_type = LoadMapInstanceType(receiver_map);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(IsSpecialReceiverInstanceType(instance_type), &miss);

src/interpreter/interpreter-assembler.cc

@@ -974,7 +974,7 @@ Node* InterpreterAssembler::Construct(SloppyTNode<Object> target, Node* context,
       // Check if it is uninitialized.
       Comment("check if uninitialized");
       Node* is_uninitialized =
-          TaggedEqual(feedback, LoadRoot(RootIndex::kuninitialized_symbol));
+          TaggedEqual(feedback, UninitializedSymbolConstant());
       Branch(is_uninitialized, &initialize, &mark_megamorphic);
     }
 
@@ -1140,7 +1140,7 @@ Node* InterpreterAssembler::ConstructWithSpread(Node* target, Node* context,
       // Check if it is uninitialized.
       Comment("check if uninitialized");
       Node* is_uninitialized =
-          TaggedEqual(feedback, LoadRoot(RootIndex::kuninitialized_symbol));
+          TaggedEqual(feedback, UninitializedSymbolConstant());
       Branch(is_uninitialized, &initialize, &mark_megamorphic);
     }
 
@@ -1710,8 +1710,7 @@ Node* InterpreterAssembler::ImportRegisterFile(
         IntPtrSub(IntPtrConstant(Register(0).ToOperand()), index);
     StoreRegister(value, reg_index);
 
-    StoreFixedArrayElement(array, array_index,
-                           LoadRoot(RootIndex::kStaleRegister));
+    StoreFixedArrayElement(array, array_index, StaleRegisterConstant());
 
     var_index = IntPtrAdd(index, IntPtrConstant(1));
     Goto(&loop);

src/interpreter/interpreter-generator.cc

@@ -2039,7 +2039,7 @@ IGNITION_HANDLER(TestTypeOf, InterpreterAssembler) {
     Comment("IfFunction");
     GotoIf(TaggedIsSmi(object), &if_false);
     // Check if callable bit is set and not undetectable.
-    TNode<Word32T> map_bitfield = LoadMapBitField(LoadMap(CAST(object)));
+    TNode<Int32T> map_bitfield = LoadMapBitField(LoadMap(CAST(object)));
     TNode<Word32T> callable_undetectable =
         Word32And(map_bitfield, Int32Constant(Map::IsUndetectableBit::kMask |
                                               Map::IsCallableBit::kMask));
@@ -2058,7 +2058,7 @@ IGNITION_HANDLER(TestTypeOf, InterpreterAssembler) {
     // Check if the object is a receiver type and is not undefined or callable.
     TNode<Map> map = LoadMap(CAST(object));
     GotoIfNot(IsJSReceiverMap(map), &if_false);
-    TNode<Word32T> map_bitfield = LoadMapBitField(map);
+    TNode<Int32T> map_bitfield = LoadMapBitField(map);
     TNode<Word32T> callable_undetectable =
         Word32And(map_bitfield, Int32Constant(Map::IsUndetectableBit::kMask |
                                               Map::IsCallableBit::kMask));
@@ -2671,8 +2671,9 @@ IGNITION_HANDLER(CreateClosure, InterpreterAssembler) {
   Node* slot = BytecodeOperandIdx(1);
 
   Label if_undefined(this);
-  TNode<FixedArray> feedback_cell_array = LoadClosureFeedbackArray(
-      CAST(LoadRegister(Register::function_closure())));
+  TNode<ClosureFeedbackCellArray> feedback_cell_array =
+      LoadClosureFeedbackArray(
+          CAST(LoadRegister(Register::function_closure())));
   TNode<FeedbackCell> feedback_cell =
       CAST(LoadFixedArrayElement(feedback_cell_array, slot));
 

test/cctest/test-code-stub-assembler.cc

@@ -1609,19 +1609,19 @@ TEST(TryLookupElement) {
     CHECK_NOT_FOUND(object, 42);
   }
 
-// TODO(ishell): uncomment once NO_ELEMENTS kind is supported.
-//  {
-//    Handle<Map> map = Map::Create(isolate, 0);
-//    map->set_elements_kind(NO_ELEMENTS);
-//    Handle<JSObject> object = factory->NewJSObjectFromMap(map);
-//    CHECK_EQ(NO_ELEMENTS, object->map()->elements_kind());
-//
-//    CHECK_NOT_FOUND(object, 0);
-//    CHECK_NOT_FOUND(object, 1);
-//    CHECK_NOT_FOUND(object, 7);
-//    CHECK_NOT_FOUND(object, 13);
-//    CHECK_NOT_FOUND(object, 42);
-//  }
+  // TODO(ishell): uncomment once NO_ELEMENTS kind is supported.
+  //  {
+  //    Handle<Map> map = Map::Create(isolate, 0);
+  //    map->set_elements_kind(NO_ELEMENTS);
+  //    Handle<JSObject> object = factory->NewJSObjectFromMap(map);
+  //    CHECK_EQ(NO_ELEMENTS, object->map()->elements_kind());
+  //
+  //    CHECK_NOT_FOUND(object, 0);
+  //    CHECK_NOT_FOUND(object, 1);
+  //    CHECK_NOT_FOUND(object, 7);
+  //    CHECK_NOT_FOUND(object, 13);
+  //    CHECK_NOT_FOUND(object, 42);
+  //  }
 
 #undef CHECK_FOUND
 #undef CHECK_NOT_FOUND
@@ -2537,7 +2537,7 @@ TEST(CreatePromiseGetCapabilitiesExecutorContext) {
   Node* const context = m.Parameter(kNumParams + 2);
   TNode<Context> const native_context = m.LoadNativeContext(context);
 
-  TNode<Object> const map = m.LoadRoot(RootIndex::kPromiseCapabilityMap);
+  TNode<Map> const map = m.PromiseCapabilityMapConstant();
   Node* const capability = m.AllocateStruct(map);
   m.StoreObjectFieldNoWriteBarrier(
       capability, PromiseCapability::kPromiseOffset, m.UndefinedConstant());

test/unittests/compiler/code-assembler-unittest.cc

@@ -51,7 +51,7 @@ TARGET_TEST_F(CodeAssemblerTest, IntPtrAdd) {
   {
     TNode<IntPtrT> a = m.IntPtrConstant(22);
     TNode<IntPtrT> b = m.IntPtrConstant(33);
-    TNode<WordT> c = m.IntPtrAdd(a, b);
+    TNode<IntPtrT> c = m.IntPtrAdd(a, b);
     EXPECT_THAT(c, IsIntPtrConstant(55));
   }
 }
@@ -76,7 +76,7 @@ TARGET_TEST_F(CodeAssemblerTest, IntPtrSub) {
   {
     TNode<IntPtrT> a = m.IntPtrConstant(100);
     TNode<IntPtrT> b = m.IntPtrConstant(1);
-    TNode<WordT> c = m.IntPtrSub(a, b);
+    TNode<IntPtrT> c = m.IntPtrSub(a, b);
     EXPECT_THAT(c, IsIntPtrConstant(99));
   }
 }
@@ -108,7 +108,7 @@ TARGET_TEST_F(CodeAssemblerTest, IntPtrMul) {
   {
     TNode<IntPtrT> a = m.IntPtrConstant(100);
     TNode<IntPtrT> b = m.IntPtrConstant(5);
-    TNode<WordT> c = m.IntPtrMul(a, b);
+    TNode<IntPtrT> c = m.IntPtrMul(a, b);
     EXPECT_THAT(c, IsIntPtrConstant(500));
   }
   // x * 2^CONST  => x << CONST
@@ -204,13 +204,13 @@ TARGET_TEST_F(CodeAssemblerTest, WordShr) {
   // +CONST_a >> CONST_b  => CONST_c
   {
     TNode<IntPtrT> a = m.IntPtrConstant(4096);
-    TNode<WordT> shr = m.WordShr(a, 2);
+    TNode<IntPtrT> shr = m.WordShr(a, 2);
     EXPECT_THAT(shr, IsIntPtrConstant(1024));
   }
   // -CONST_a >> CONST_b  => CONST_c
   {
     TNode<IntPtrT> a = m.IntPtrConstant(-1234);
-    TNode<WordT> shr = m.WordShr(a, 2);
+    TNode<IntPtrT> shr = m.WordShr(a, 2);
     EXPECT_THAT(shr, IsIntPtrConstant(static_cast<uintptr_t>(-1234) >> 2));
   }
 }
@@ -232,13 +232,13 @@ TARGET_TEST_F(CodeAssemblerTest, WordSar) {
   // +CONST_a >>> CONST_b  => CONST_c
   {
     TNode<IntPtrT> a = m.IntPtrConstant(4096);
-    TNode<WordT> sar = m.WordSar(a, m.IntPtrConstant(2));
+    TNode<IntPtrT> sar = m.WordSar(a, m.IntPtrConstant(2));
     EXPECT_THAT(sar, IsIntPtrConstant(1024));
   }
   // -CONST_a >>> CONST_b  => CONST_c
   {
     TNode<IntPtrT> a = m.IntPtrConstant(-1234);
-    TNode<WordT> sar = m.WordSar(a, m.IntPtrConstant(2));
+    TNode<IntPtrT> sar = m.WordSar(a, m.IntPtrConstant(2));
     EXPECT_THAT(sar, IsIntPtrConstant(static_cast<intptr_t>(-1234) >> 2));
   }
 }
@@ -282,7 +282,7 @@ TARGET_TEST_F(CodeAssemblerTest, WordAnd) {
   // CONST_a & CONST_b  => CONST_c
   {
     TNode<IntPtrT> a = m.IntPtrConstant(3);
-    TNode<WordT> b = m.WordAnd(a, m.IntPtrConstant(7));
+    TNode<IntPtrT> b = m.WordAnd(a, m.IntPtrConstant(7));
     EXPECT_THAT(b, IsIntPtrConstant(3));
   }
 }