[ptr-compr][turbofan] Support smi-corrupting decompression in TurboFan

Bug: v8:9706
Change-Id: I5779e2fbaec5741cc9b8d44f7f3f721400e70b28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1832174
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64067}

src/compiler/effect-control-linearizer.cc

@@ -1615,7 +1615,7 @@ Node* EffectControlLinearizer::LowerTruncateTaggedToBit(Node* node) {
   __ Bind(&if_smi);
   {
     // If {value} is a Smi, then we only need to check that it's not zero.
-    __ Goto(&done, __ Word32Equal(__ IntPtrEqual(value, __ IntPtrConstant(0)),
+    __ Goto(&done, __ Word32Equal(__ TaggedEqual(value, __ SmiConstant(0)),
                                   __ Int32Constant(0)));
   }
 
@@ -3534,8 +3534,12 @@ Node* EffectControlLinearizer::LowerArgumentsFrame(Node* node) {
   Node* parent_frame =
       __ Load(MachineType::Pointer(), frame,
               __ IntPtrConstant(StandardFrameConstants::kCallerFPOffset));
+  // Load parent frame type as an uncompressed value to avoid corruption
+  // in case it contains a frame type marker. Frame type marker is a pseudo-Smi
+  // containing a StackFrame::Type value shifted left by kSmiTagSize (see
+  // StackFrame::TypeToMarker() for details).
   Node* parent_frame_type = __ Load(
-      MachineType::TypeCompressedTagged(), parent_frame,
+      MachineType::AnyTagged(), parent_frame,
       __ IntPtrConstant(CommonFrameConstants::kContextOrFrameTypeOffset));
 
   __ GotoIf(__ IntPtrEqual(parent_frame_type,

src/compiler/representation-change.cc

@@ -1272,8 +1272,13 @@ Node* RepresentationChanger::GetBitRepresentationFor(
       }
     }
   } else if (output_rep == MachineRepresentation::kTaggedSigned) {
+    if (COMPRESS_POINTERS_BOOL && kUseSmiCorruptingPtrDecompression) {
+      node = jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
+                                         jsgraph()->Int32Constant(0));
+    } else {
       node = jsgraph()->graph()->NewNode(machine()->WordEqual(), node,
                                          jsgraph()->IntPtrConstant(0));
+    }
     return jsgraph()->graph()->NewNode(machine()->Word32Equal(), node,
                                        jsgraph()->Int32Constant(0));
   } else if (output_rep == MachineRepresentation::kCompressed) {

src/compiler/simplified-lowering.cc

@@ -2667,8 +2667,12 @@ class RepresentationSelector {
       case IrOpcode::kReferenceEqual: {
         VisitBinop(node, UseInfo::AnyTagged(), MachineRepresentation::kBit);
         if (lower()) {
+          if (COMPRESS_POINTERS_BOOL && kUseSmiCorruptingPtrDecompression) {
+            NodeProperties::ChangeOp(node, lowering->machine()->Word32Equal());
+          } else {
             NodeProperties::ChangeOp(node, lowering->machine()->WordEqual());
           }
+        }
         return;
       }
       case IrOpcode::kSameValueNumbersOnly: {