[CSA][cleanup] TNodify builtins-object-gen

Also TNodify:
 - LoadJSPrimitiveWrapperValue
 - GetSuperConstructor
 - InstanceOf

BUG=v8:6949,v8:9396

Change-Id: I4b39b418cdf01bd72e35441f037d16ede9c89ce9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1803639
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63791}

src/builtins/builtins-handler-gen.cc

@@ -48,8 +48,8 @@ TF_BUILTIN(LoadIC_StringLength, CodeStubAssembler) {
 }
 
 TF_BUILTIN(LoadIC_StringWrapperLength, CodeStubAssembler) {
-  Node* value = Parameter(Descriptor::kReceiver);
-  Node* string = LoadJSPrimitiveWrapperValue(value);
+  TNode<JSPrimitiveWrapper> value = CAST(Parameter(Descriptor::kReceiver));
+  TNode<String> string = CAST(LoadJSPrimitiveWrapperValue(value));
   Return(LoadStringLengthAsSmi(string));
 }
 

src/builtins/builtins-object-gen.cc

@@ -22,27 +22,35 @@ namespace internal {
 // -----------------------------------------------------------------------------
 // ES6 section 19.1 Object Objects
 
-using Node = compiler::Node;
-
 class ObjectBuiltinsAssembler : public CodeStubAssembler {
  public:
   explicit ObjectBuiltinsAssembler(compiler::CodeAssemblerState* state)
       : CodeStubAssembler(state) {}
 
  protected:
-  void ReturnToStringFormat(Node* context, Node* string);
+  void ReturnToStringFormat(TNode<Context> context, TNode<String> string);
   void AddToDictionaryIf(TNode<BoolT> condition,
                          TNode<NameDictionary> name_dictionary,
                          Handle<Name> name, TNode<Object> value,
                          Label* bailout);
-  Node* FromPropertyDescriptor(Node* context, Node* desc);
-  Node* FromPropertyDetails(Node* context, Node* raw_value, Node* details,
-                            Label* if_bailout);
-  Node* ConstructAccessorDescriptor(Node* context, Node* getter, Node* setter,
-                                    Node* enumerable, Node* configurable);
-  Node* ConstructDataDescriptor(Node* context, Node* value, Node* writable,
-                                Node* enumerable, Node* configurable);
-  Node* GetAccessorOrUndefined(Node* accessor, Label* if_bailout);
+  TNode<JSObject> FromPropertyDescriptor(TNode<Context> context,
+                                         TNode<FixedArray> desc);
+  TNode<JSObject> FromPropertyDetails(TNode<Context> context,
+                                      TNode<Object> raw_value,
+                                      TNode<Word32T> details,
+                                      Label* if_bailout);
+  TNode<JSObject> ConstructAccessorDescriptor(TNode<Context> context,
+                                              TNode<Object> getter,
+                                              TNode<Object> setter,
+                                              TNode<BoolT> enumerable,
+                                              TNode<BoolT> configurable);
+  TNode<JSObject> ConstructDataDescriptor(TNode<Context> context,
+                                          TNode<Object> value,
+                                          TNode<BoolT> writable,
+                                          TNode<BoolT> enumerable,
+                                          TNode<BoolT> configurable);
+  TNode<HeapObject> GetAccessorOrUndefined(TNode<HeapObject> accessor,
+                                           Label* if_bailout);
 };
 
 class ObjectEntriesValuesBuiltinsAssembler : public ObjectBuiltinsAssembler {
@@ -77,8 +85,8 @@ class ObjectEntriesValuesBuiltinsAssembler : public ObjectBuiltinsAssembler {
       TNode<IntPtrT> size, TNode<Map> array_map, Label* if_empty);
 };
 
-void ObjectBuiltinsAssembler::ReturnToStringFormat(Node* context,
-                                                   Node* string) {
+void ObjectBuiltinsAssembler::ReturnToStringFormat(TNode<Context> context,
+                                                   TNode<String> string) {
   TNode<String> lhs = StringConstant("[object ");
   TNode<String> rhs = StringConstant("]");
 
@@ -88,11 +96,9 @@ void ObjectBuiltinsAssembler::ReturnToStringFormat(Node* context,
                   rhs));
 }
 
-Node* ObjectBuiltinsAssembler::ConstructAccessorDescriptor(Node* context,
-                                                           Node* getter,
-                                                           Node* setter,
-                                                           Node* enumerable,
-                                                           Node* configurable) {
+TNode<JSObject> ObjectBuiltinsAssembler::ConstructAccessorDescriptor(
+    TNode<Context> context, TNode<Object> getter, TNode<Object> setter,
+    TNode<BoolT> enumerable, TNode<BoolT> configurable) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<Map> map = CAST(LoadContextElement(
       native_context, Context::ACCESSOR_PROPERTY_DESCRIPTOR_MAP_INDEX));
@@ -112,11 +118,9 @@ Node* ObjectBuiltinsAssembler::ConstructAccessorDescriptor(Node* context,
   return js_desc;
 }
 
-Node* ObjectBuiltinsAssembler::ConstructDataDescriptor(Node* context,
-                                                       Node* value,
-                                                       Node* writable,
-                                                       Node* enumerable,
-                                                       Node* configurable) {
+TNode<JSObject> ObjectBuiltinsAssembler::ConstructDataDescriptor(
+    TNode<Context> context, TNode<Object> value, TNode<BoolT> writable,
+    TNode<BoolT> enumerable, TNode<BoolT> configurable) {
   TNode<NativeContext> native_context = LoadNativeContext(context);
   TNode<Map> map = CAST(LoadContextElement(
       native_context, Context::DATA_PROPERTY_DESCRIPTOR_MAP_INDEX));
@@ -258,10 +262,10 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
 
     TVARIABLE(IntPtrT, var_result_index, IntPtrConstant(0));
     TVARIABLE(IntPtrT, var_descriptor_number, IntPtrConstant(0));
-    Variable* vars[] = {&var_descriptor_number, &var_result_index};
+    VariableList vars({&var_descriptor_number, &var_result_index}, zone());
     // Let desc be ? O.[[GetOwnProperty]](key).
     TNode<DescriptorArray> descriptors = LoadMapDescriptors(map);
-    Label loop(this, 2, vars), after_loop(this), next_descriptor(this);
+    Label loop(this, vars), after_loop(this), next_descriptor(this);
     Branch(IntPtrEqual(var_descriptor_number.value(), object_enum_length),
            &after_loop, &loop);
 
@@ -307,8 +311,8 @@ TNode<JSArray> ObjectEntriesValuesBuiltinsAssembler::FastGetOwnValuesOrEntries(
 
       if (collect_type == CollectType::kEntries) {
         // Let entry be CreateArrayFromList(« key, value »).
-        Node* array = nullptr;
-        Node* elements = nullptr;
+        TNode<JSArray> array;
+        TNode<FixedArrayBase> elements;
         std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
             PACKED_ELEMENTS, array_map, SmiConstant(2), {}, IntPtrConstant(2));
         StoreFixedArrayElement(CAST(elements), 0, next_key, SKIP_WRITE_BARRIER);
@@ -363,9 +367,9 @@ TF_BUILTIN(ObjectPrototypeToLocaleString, CodeStubAssembler) {
 }
 
 TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
-  Node* object = Parameter(Descriptor::kReceiver);
-  Node* key = Parameter(Descriptor::kKey);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> object = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Object> key = CAST(Parameter(Descriptor::kKey));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Label call_runtime(this), return_true(this), return_false(this),
       to_primitive(this);
@@ -376,12 +380,12 @@ TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
   Branch(TaggedIsSmi(object), &to_primitive, &if_objectisnotsmi);
   BIND(&if_objectisnotsmi);
 
-  TNode<Map> map = LoadMap(object);
+  TNode<Map> map = LoadMap(CAST(object));
   TNode<Uint16T> instance_type = LoadMapInstanceType(map);
 
   {
-    VARIABLE(var_index, MachineType::PointerRepresentation());
-    VARIABLE(var_unique, MachineRepresentation::kTagged);
+    TVARIABLE(IntPtrT, var_index);
+    TVARIABLE(Object, var_unique);  // TODO(6949): Should be Name.
 
     Label if_index(this), if_unique_name(this), if_notunique_name(this);
     TryToName(key, &if_index, &var_index, &if_unique_name, &var_unique,
@@ -419,7 +423,7 @@ TF_BUILTIN(ObjectPrototypeHasOwnProperty, ObjectBuiltinsAssembler) {
   }
   BIND(&to_primitive);
   GotoIf(IsNumber(key), &return_false);
-  Branch(IsName(key), &return_false, &call_runtime);
+  Branch(IsName(CAST(key)), &return_false, &call_runtime);
 
   BIND(&return_true);
   Return(TrueConstant());
@@ -464,17 +468,18 @@ TF_BUILTIN(ObjectAssign, ObjectBuiltinsAssembler) {
 
 // ES #sec-object.keys
 TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  VARIABLE(var_length, MachineRepresentation::kTagged);
-  VARIABLE(var_elements, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, var_length);
+  TVARIABLE(FixedArrayBase, var_elements);
   Label if_empty(this, Label::kDeferred), if_empty_elements(this),
       if_fast(this), if_slow(this, Label::kDeferred), if_join(this);
 
   // Check if the {object} has a usable enum cache.
   GotoIf(TaggedIsSmi(object), &if_slow);
-  TNode<Map> object_map = LoadMap(object);
+
+  TNode<Map> object_map = LoadMap(CAST(object));
   TNode<Uint32T> object_bit_field3 = LoadMapBitField3(object_map);
   TNode<UintPtrT> object_enum_length =
       DecodeWordFromWord32<Map::EnumLengthBits>(object_bit_field3);
@@ -484,7 +489,7 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
 
   // Ensure that the {object} doesn't have any elements.
   CSA_ASSERT(this, IsJSObjectMap(object_map));
-  TNode<FixedArrayBase> object_elements = LoadElements(object);
+  TNode<FixedArrayBase> object_elements = LoadElements(CAST(object));
   GotoIf(IsEmptyFixedArray(object_elements), &if_empty_elements);
   Branch(IsEmptySlowElementDictionary(object_elements), &if_empty_elements,
          &if_slow);
@@ -497,14 +502,14 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
   {
     // The {object} has a usable enum cache, use that.
     TNode<DescriptorArray> object_descriptors = LoadMapDescriptors(object_map);
-    TNode<EnumCache> object_enum_cache = CAST(
-        LoadObjectField(object_descriptors, DescriptorArray::kEnumCacheOffset));
+    TNode<EnumCache> object_enum_cache = LoadObjectField<EnumCache>(
+        object_descriptors, DescriptorArray::kEnumCacheOffset);
     TNode<Object> object_enum_keys =
         LoadObjectField(object_enum_cache, EnumCache::kKeysOffset);
 
     // Allocate a JSArray and copy the elements from the {object_enum_keys}.
-    Node* array = nullptr;
-    Node* elements = nullptr;
+    TNode<JSArray> array;
+    TNode<FixedArrayBase> elements;
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<Map> array_map =
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
@@ -520,8 +525,8 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
   BIND(&if_empty);
   {
     // The {object} doesn't have any enumerable keys.
-    var_length.Bind(SmiConstant(0));
-    var_elements.Bind(EmptyFixedArrayConstant());
+    var_length = SmiConstant(0);
+    var_elements = EmptyFixedArrayConstant();
     Goto(&if_join);
   }
 
@@ -530,8 +535,8 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
     // Let the runtime compute the elements.
     TNode<FixedArray> elements =
         CAST(CallRuntime(Runtime::kObjectKeys, context, object));
-    var_length.Bind(LoadObjectField(elements, FixedArray::kLengthOffset));
-    var_elements.Bind(elements);
+    var_length = LoadObjectField<Smi>(elements, FixedArray::kLengthOffset);
+    var_elements = elements;
     Goto(&if_join);
   }
 
@@ -541,19 +546,19 @@ TF_BUILTIN(ObjectKeys, ObjectBuiltinsAssembler) {
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<Map> array_map =
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
-    TNode<JSArray> array = AllocateJSArray(
-        array_map, CAST(var_elements.value()), CAST(var_length.value()));
+    TNode<JSArray> array =
+        AllocateJSArray(array_map, var_elements.value(), var_length.value());
     Return(array);
   }
 }
 
 // ES #sec-object.getOwnPropertyNames
 TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  VARIABLE(var_length, MachineRepresentation::kTagged);
-  VARIABLE(var_elements, MachineRepresentation::kTagged);
+  TVARIABLE(Smi, var_length);
+  TVARIABLE(FixedArrayBase, var_elements);
   Label if_empty(this, Label::kDeferred), if_empty_elements(this),
       if_fast(this), try_fast(this, Label::kDeferred),
       if_slow(this, Label::kDeferred), if_join(this);
@@ -561,10 +566,11 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
   // Take the slow path if the {object} IsCustomElementsReceiverInstanceType or
   // has any elements.
   GotoIf(TaggedIsSmi(object), &if_slow);
-  TNode<Map> object_map = LoadMap(object);
+
+  TNode<Map> object_map = LoadMap(CAST(object));
   TNode<Uint16T> instance_type = LoadMapInstanceType(object_map);
   GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &if_slow);
-  TNode<FixedArrayBase> object_elements = LoadElements(object);
+  TNode<FixedArrayBase> object_elements = LoadElements(CAST(object));
   GotoIf(IsEmptyFixedArray(object_elements), &if_empty_elements);
   Branch(IsEmptySlowElementDictionary(object_elements), &if_empty_elements,
          &if_slow);
@@ -597,12 +603,12 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
         LoadObjectField(object_enum_cache, EnumCache::kKeysOffset);
 
     // Allocate a JSArray and copy the elements from the {object_enum_keys}.
-    Node* array = nullptr;
-    Node* elements = nullptr;
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<Map> array_map =
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
     TNode<Smi> array_length = SmiTag(Signed(object_enum_length));
+    TNode<JSArray> array;
+    TNode<FixedArrayBase> elements;
     std::tie(array, elements) = AllocateUninitializedJSArrayWithElements(
         PACKED_ELEMENTS, array_map, array_length, {}, object_enum_length,
         INTPTR_PARAMETERS);
@@ -616,16 +622,16 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
     // Let the runtime compute the elements and try initializing enum cache.
     TNode<FixedArray> elements = CAST(CallRuntime(
         Runtime::kObjectGetOwnPropertyNamesTryFast, context, object));
-    var_length.Bind(LoadObjectField(elements, FixedArray::kLengthOffset));
-    var_elements.Bind(elements);
+    var_length = LoadObjectField<Smi>(elements, FixedArray::kLengthOffset);
+    var_elements = elements;
     Goto(&if_join);
   }
 
   BIND(&if_empty);
   {
     // The {object} doesn't have any enumerable keys.
-    var_length.Bind(SmiConstant(0));
-    var_elements.Bind(EmptyFixedArrayConstant());
+    var_length = SmiConstant(0);
+    var_elements = EmptyFixedArrayConstant();
     Goto(&if_join);
   }
 
@@ -634,8 +640,8 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
     // Let the runtime compute the elements.
     TNode<FixedArray> elements =
         CAST(CallRuntime(Runtime::kObjectGetOwnPropertyNames, context, object));
-    var_length.Bind(LoadObjectField(elements, FixedArray::kLengthOffset));
-    var_elements.Bind(elements);
+    var_length = LoadObjectField<Smi>(elements, FixedArray::kLengthOffset);
+    var_elements = elements;
     Goto(&if_join);
   }
 
@@ -645,8 +651,8 @@ TF_BUILTIN(ObjectGetOwnPropertyNames, ObjectBuiltinsAssembler) {
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<Map> array_map =
         LoadJSArrayElementsMap(PACKED_ELEMENTS, native_context);
-    TNode<JSArray> array = AllocateJSArray(
-        array_map, CAST(var_elements.value()), CAST(var_length.value()));
+    TNode<JSArray> array =
+        AllocateJSArray(array_map, var_elements.value(), var_length.value());
     Return(array);
   }
 }
@@ -732,14 +738,18 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
       if_regexp(this), if_string(this), if_symbol(this, Label::kDeferred),
       if_value(this), if_bigint(this, Label::kDeferred);
 
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
+
+  TVARIABLE(String, var_default);
+  TVARIABLE(HeapObject, var_holder);
 
   // This is arranged to check the likely cases first.
-  VARIABLE(var_default, MachineRepresentation::kTagged);
-  VARIABLE(var_holder, MachineRepresentation::kTagged, receiver);
   GotoIf(TaggedIsSmi(receiver), &if_number);
-  TNode<Map> receiver_map = LoadMap(receiver);
+
+  TNode<HeapObject> reciever_heap_object = CAST(receiver);
+  TNode<Map> receiver_map = LoadMap(reciever_heap_object);
+  var_holder = reciever_heap_object;
   TNode<Uint16T> receiver_instance_type = LoadMapInstanceType(receiver_map);
   GotoIf(IsPrimitiveInstanceType(receiver_instance_type), &if_primitive);
   const struct {
@@ -770,30 +780,31 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
   BIND(&if_apiobject);
   {
     // Lookup the @@toStringTag property on the {receiver}.
-    VARIABLE(var_tag, MachineRepresentation::kTagged,
-             GetProperty(context, receiver,
-                         isolate()->factory()->to_string_tag_symbol()));
+    TVARIABLE(Object, var_tag,
+              GetProperty(context, receiver,
+                          isolate()->factory()->to_string_tag_symbol()));
     Label if_tagisnotstring(this), if_tagisstring(this);
     GotoIf(TaggedIsSmi(var_tag.value()), &if_tagisnotstring);
-    Branch(IsString(var_tag.value()), &if_tagisstring, &if_tagisnotstring);
+    Branch(IsString(CAST(var_tag.value())), &if_tagisstring,
+           &if_tagisnotstring);
     BIND(&if_tagisnotstring);
     {
-      var_tag.Bind(CallRuntime(Runtime::kClassOf, context, receiver));
+      var_tag = CallRuntime(Runtime::kClassOf, context, receiver);
       Goto(&if_tagisstring);
     }
     BIND(&if_tagisstring);
-    ReturnToStringFormat(context, var_tag.value());
+    ReturnToStringFormat(context, CAST(var_tag.value()));
   }
 
   BIND(&if_arguments);
   {
-    var_default.Bind(ArgumentsToStringConstant());
+    var_default = ArgumentsToStringConstant();
     Goto(&checkstringtag);
   }
 
   BIND(&if_array);
   {
-    var_default.Bind(ArrayToStringConstant());
+    var_default = ArrayToStringConstant();
     Goto(&checkstringtag);
   }
 
@@ -802,30 +813,30 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<JSFunction> boolean_constructor = CAST(
         LoadContextElement(native_context, Context::BOOLEAN_FUNCTION_INDEX));
-    TNode<Map> boolean_initial_map = CAST(LoadObjectField(
-        boolean_constructor, JSFunction::kPrototypeOrInitialMapOffset));
-    TNode<Object> boolean_prototype =
-        LoadObjectField(boolean_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(BooleanToStringConstant());
-    var_holder.Bind(boolean_prototype);
+    TNode<Map> boolean_initial_map = LoadObjectField<Map>(
+        boolean_constructor, JSFunction::kPrototypeOrInitialMapOffset);
+    TNode<HeapObject> boolean_prototype =
+        LoadObjectField<HeapObject>(boolean_initial_map, Map::kPrototypeOffset);
+    var_default = BooleanToStringConstant();
+    var_holder = boolean_prototype;
     Goto(&checkstringtag);
   }
 
   BIND(&if_date);
   {
-    var_default.Bind(DateToStringConstant());
+    var_default = DateToStringConstant();
     Goto(&checkstringtag);
   }
 
   BIND(&if_error);
   {
-    var_default.Bind(ErrorToStringConstant());
+    var_default = ErrorToStringConstant();
     Goto(&checkstringtag);
   }
 
   BIND(&if_function);
   {
-    var_default.Bind(FunctionToStringConstant());
+    var_default = FunctionToStringConstant();
     Goto(&checkstringtag);
   }
 
@@ -834,19 +845,19 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<JSFunction> number_constructor = CAST(
         LoadContextElement(native_context, Context::NUMBER_FUNCTION_INDEX));
-    TNode<Map> number_initial_map = CAST(LoadObjectField(
-        number_constructor, JSFunction::kPrototypeOrInitialMapOffset));
-    TNode<Object> number_prototype =
-        LoadObjectField(number_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(NumberToStringConstant());
-    var_holder.Bind(number_prototype);
+    TNode<Map> number_initial_map = LoadObjectField<Map>(
+        number_constructor, JSFunction::kPrototypeOrInitialMapOffset);
+    TNode<HeapObject> number_prototype =
+        LoadObjectField<HeapObject>(number_initial_map, Map::kPrototypeOffset);
+    var_default = NumberToStringConstant();
+    var_holder = number_prototype;
     Goto(&checkstringtag);
   }
 
   BIND(&if_object);
   {
-    CSA_ASSERT(this, IsJSReceiver(receiver));
-    var_default.Bind(ObjectToStringConstant());
+    CSA_ASSERT(this, IsJSReceiver(CAST(receiver)));
+    var_default = ObjectToStringConstant();
     Goto(&checkstringtag);
   }
 
@@ -886,24 +897,25 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         });
 
     // Lookup the @@toStringTag property on the {receiver}.
-    VARIABLE(var_tag, MachineRepresentation::kTagged,
-             GetProperty(context, receiver,
-                         isolate()->factory()->to_string_tag_symbol()));
+    TVARIABLE(Object, var_tag,
+              GetProperty(context, receiver,
+                          isolate()->factory()->to_string_tag_symbol()));
     Label if_tagisnotstring(this), if_tagisstring(this);
     GotoIf(TaggedIsSmi(var_tag.value()), &if_tagisnotstring);
-    Branch(IsString(var_tag.value()), &if_tagisstring, &if_tagisnotstring);
+    Branch(IsString(CAST(var_tag.value())), &if_tagisstring,
+           &if_tagisnotstring);
     BIND(&if_tagisnotstring);
     {
-      var_tag.Bind(builtin_tag);
+      var_tag = builtin_tag;
       Goto(&if_tagisstring);
     }
     BIND(&if_tagisstring);
-    ReturnToStringFormat(context, var_tag.value());
+    ReturnToStringFormat(context, CAST(var_tag.value()));
   }
 
   BIND(&if_regexp);
   {
-    var_default.Bind(RegexpToStringConstant());
+    var_default = RegexpToStringConstant();
     Goto(&checkstringtag);
   }
 
@@ -912,12 +924,12 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<JSFunction> string_constructor = CAST(
         LoadContextElement(native_context, Context::STRING_FUNCTION_INDEX));
-    TNode<Map> string_initial_map = CAST(LoadObjectField(
-        string_constructor, JSFunction::kPrototypeOrInitialMapOffset));
-    TNode<Object> string_prototype =
-        LoadObjectField(string_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(StringToStringConstant());
-    var_holder.Bind(string_prototype);
+    TNode<Map> string_initial_map = LoadObjectField<Map>(
+        string_constructor, JSFunction::kPrototypeOrInitialMapOffset);
+    TNode<HeapObject> string_prototype =
+        LoadObjectField<HeapObject>(string_initial_map, Map::kPrototypeOffset);
+    var_default = StringToStringConstant();
+    var_holder = string_prototype;
     Goto(&checkstringtag);
   }
 
@@ -926,12 +938,12 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<JSFunction> symbol_constructor = CAST(
         LoadContextElement(native_context, Context::SYMBOL_FUNCTION_INDEX));
-    TNode<Map> symbol_initial_map = CAST(LoadObjectField(
-        symbol_constructor, JSFunction::kPrototypeOrInitialMapOffset));
-    TNode<Object> symbol_prototype =
-        LoadObjectField(symbol_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(ObjectToStringConstant());
-    var_holder.Bind(symbol_prototype);
+    TNode<Map> symbol_initial_map = LoadObjectField<Map>(
+        symbol_constructor, JSFunction::kPrototypeOrInitialMapOffset);
+    TNode<HeapObject> symbol_prototype =
+        LoadObjectField<HeapObject>(symbol_initial_map, Map::kPrototypeOffset);
+    var_default = ObjectToStringConstant();
+    var_holder = symbol_prototype;
     Goto(&checkstringtag);
   }
 
@@ -940,12 +952,12 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     TNode<NativeContext> native_context = LoadNativeContext(context);
     TNode<JSFunction> bigint_constructor = CAST(
         LoadContextElement(native_context, Context::BIGINT_FUNCTION_INDEX));
-    TNode<Map> bigint_initial_map = CAST(LoadObjectField(
-        bigint_constructor, JSFunction::kPrototypeOrInitialMapOffset));
-    TNode<Object> bigint_prototype =
-        LoadObjectField(bigint_initial_map, Map::kPrototypeOffset);
-    var_default.Bind(ObjectToStringConstant());
-    var_holder.Bind(bigint_prototype);
+    TNode<Map> bigint_initial_map = LoadObjectField<Map>(
+        bigint_constructor, JSFunction::kPrototypeOrInitialMapOffset);
+    TNode<HeapObject> bigint_prototype =
+        LoadObjectField<HeapObject>(bigint_initial_map, Map::kPrototypeOffset);
+    var_default = ObjectToStringConstant();
+    var_holder = bigint_prototype;
     Goto(&checkstringtag);
   }
 
@@ -957,12 +969,13 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
         if_value_is_bigint(this, Label::kDeferred),
         if_value_is_string(this, Label::kDeferred);
 
-    Node* receiver_value = LoadJSPrimitiveWrapperValue(receiver);
+    TNode<Object> receiver_value =
+        LoadJSPrimitiveWrapperValue(CAST(reciever_heap_object));
     // We need to start with the object to see if the value was a subclass
     // which might have interesting properties.
-    var_holder.Bind(receiver);
+    var_holder = reciever_heap_object;
     GotoIf(TaggedIsSmi(receiver_value), &if_value_is_number);
-    TNode<Map> receiver_value_map = LoadMap(receiver_value);
+    TNode<Map> receiver_value_map = LoadMap(CAST(receiver_value));
     GotoIf(IsHeapNumberMap(receiver_value_map), &if_value_is_number);
     GotoIf(IsBooleanMap(receiver_value_map), &if_value_is_boolean);
     GotoIf(IsSymbolMap(receiver_value_map), &if_value_is_symbol);
@@ -975,31 +988,31 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
 
     BIND(&if_value_is_number);
     {
-      var_default.Bind(NumberToStringConstant());
+      var_default = NumberToStringConstant();
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_boolean);
     {
-      var_default.Bind(BooleanToStringConstant());
+      var_default = BooleanToStringConstant();
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_string);
     {
-      var_default.Bind(StringToStringConstant());
+      var_default = StringToStringConstant();
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_bigint);
     {
-      var_default.Bind(ObjectToStringConstant());
+      var_default = ObjectToStringConstant();
       Goto(&checkstringtag);
     }
 
     BIND(&if_value_is_symbol);
     {
-      var_default.Bind(ObjectToStringConstant());
+      var_default = ObjectToStringConstant();
       Goto(&checkstringtag);
     }
   }
@@ -1014,13 +1027,13 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
     Goto(&loop);
     BIND(&loop);
     {
-      Node* holder = var_holder.value();
+      TNode<HeapObject> holder = var_holder.value();
       GotoIf(IsNull(holder), &return_default);
       TNode<Map> holder_map = LoadMap(holder);
       TNode<Uint32T> holder_bit_field3 = LoadMapBitField3(holder_map);
       GotoIf(IsSetWord32<Map::MayHaveInterestingSymbolsBit>(holder_bit_field3),
              &return_generic);
-      var_holder.Bind(LoadMapPrototype(holder_map));
+      var_holder = LoadMapPrototype(holder_map);
       Goto(&loop);
     }
 
@@ -1030,7 +1043,7 @@ TF_BUILTIN(ObjectToString, ObjectBuiltinsAssembler) {
                                       ToStringTagSymbolConstant());
       GotoIf(TaggedIsSmi(tag), &return_default);
       GotoIfNot(IsString(CAST(tag)), &return_default);
-      ReturnToStringFormat(context, tag);
+      ReturnToStringFormat(context, CAST(tag));
     }
 
     BIND(&return_default);
@@ -1059,28 +1072,28 @@ TF_BUILTIN(CreateObjectWithoutProperties, ObjectBuiltinsAssembler) {
     BranchIfJSReceiver(prototype, &prototype_jsreceiver, &call_runtime);
   }
 
-  VARIABLE(map, MachineRepresentation::kTagged);
-  VARIABLE(properties, MachineRepresentation::kTagged);
+  TVARIABLE(Map, map);
+  TVARIABLE(HeapObject, properties);
   Label instantiate_map(this);
 
   BIND(&prototype_null);
   {
     Comment("Prototype is null");
-    map.Bind(LoadContextElement(native_context,
-                                Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
-    properties.Bind(AllocateNameDictionary(NameDictionary::kInitialCapacity));
+    map = CAST(LoadContextElement(
+        native_context, Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
+    properties = AllocateNameDictionary(NameDictionary::kInitialCapacity);
     Goto(&instantiate_map);
   }
 
   BIND(&prototype_jsreceiver);
   {
     Comment("Prototype is JSReceiver");
-    properties.Bind(EmptyFixedArrayConstant());
+    properties = EmptyFixedArrayConstant();
     TNode<HeapObject> object_function = CAST(
         LoadContextElement(native_context, Context::OBJECT_FUNCTION_INDEX));
-    TNode<Object> object_function_map = LoadObjectField(
+    TNode<Map> object_function_map = LoadObjectField<Map>(
         object_function, JSFunction::kPrototypeOrInitialMapOffset);
-    map.Bind(object_function_map);
+    map = object_function_map;
     GotoIf(TaggedEqual(prototype, LoadMapPrototype(map.value())),
            &instantiate_map);
     Comment("Try loading the prototype info");
@@ -1089,7 +1102,7 @@ TF_BUILTIN(CreateObjectWithoutProperties, ObjectBuiltinsAssembler) {
     TNode<MaybeObject> maybe_map = LoadMaybeWeakObjectField(
         prototype_info, PrototypeInfo::kObjectCreateMapOffset);
     GotoIf(IsStrongReferenceTo(maybe_map, UndefinedConstant()), &call_runtime);
-    map.Bind(GetHeapObjectAssumeWeak(maybe_map, &call_runtime));
+    map = CAST(GetHeapObjectAssumeWeak(maybe_map, &call_runtime));
     Goto(&instantiate_map);
   }
 
@@ -1154,28 +1167,28 @@ TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
   // Create a new object with the given prototype.
   BIND(&no_properties);
   {
-    VARIABLE(map, MachineRepresentation::kTagged);
-    VARIABLE(properties, MachineRepresentation::kTagged);
+    TVARIABLE(Map, map);
+    TVARIABLE(HeapObject, properties);
     Label non_null_proto(this), instantiate_map(this), good(this);
 
     Branch(IsNull(prototype), &good, &non_null_proto);
 
     BIND(&good);
     {
-      map.Bind(LoadContextElement(
+      map = CAST(LoadContextElement(
           context, Context::SLOW_OBJECT_WITH_NULL_PROTOTYPE_MAP));
-      properties.Bind(AllocateNameDictionary(NameDictionary::kInitialCapacity));
+      properties = AllocateNameDictionary(NameDictionary::kInitialCapacity);
       Goto(&instantiate_map);
     }
 
     BIND(&non_null_proto);
     {
-      properties.Bind(EmptyFixedArrayConstant());
+      properties = EmptyFixedArrayConstant();
       TNode<HeapObject> object_function =
           CAST(LoadContextElement(context, Context::OBJECT_FUNCTION_INDEX));
-      TNode<Object> object_function_map = LoadObjectField(
+      TNode<Map> object_function_map = LoadObjectField<Map>(
           object_function, JSFunction::kPrototypeOrInitialMapOffset);
-      map.Bind(object_function_map);
+      map = object_function_map;
       GotoIf(TaggedEqual(prototype, LoadMapPrototype(map.value())),
              &instantiate_map);
       // Try loading the prototype info.
@@ -1186,7 +1199,7 @@ TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
           prototype_info, PrototypeInfo::kObjectCreateMapOffset);
       GotoIf(IsStrongReferenceTo(maybe_map, UndefinedConstant()),
              &call_runtime);
-      map.Bind(GetHeapObjectAssumeWeak(maybe_map, &call_runtime));
+      map = CAST(GetHeapObjectAssumeWeak(maybe_map, &call_runtime));
       Goto(&instantiate_map);
     }
 
@@ -1208,8 +1221,8 @@ TF_BUILTIN(ObjectCreate, ObjectBuiltinsAssembler) {
 
 // ES #sec-object.is
 TF_BUILTIN(ObjectIs, ObjectBuiltinsAssembler) {
-  Node* const left = Parameter(Descriptor::kLeft);
-  Node* const right = Parameter(Descriptor::kRight);
+  TNode<Object> const left = CAST(Parameter(Descriptor::kLeft));
+  TNode<Object> const right = CAST(Parameter(Descriptor::kRight));
 
   Label return_true(this), return_false(this);
   BranchIfSameValue(left, right, &return_true, &return_false);
@@ -1222,9 +1235,9 @@ TF_BUILTIN(ObjectIs, ObjectBuiltinsAssembler) {
 }
 
 TF_BUILTIN(CreateIterResultObject, ObjectBuiltinsAssembler) {
-  Node* const value = Parameter(Descriptor::kValue);
-  Node* const done = Parameter(Descriptor::kDone);
-  Node* const context = Parameter(Descriptor::kContext);
+  TNode<Object> const value = CAST(Parameter(Descriptor::kValue));
+  TNode<Oddball> const done = CAST(Parameter(Descriptor::kDone));
+  TNode<Context> const context = CAST(Parameter(Descriptor::kContext));
 
   TNode<NativeContext> const native_context = LoadNativeContext(context);
   TNode<Map> const map = CAST(
@@ -1239,17 +1252,17 @@ TF_BUILTIN(CreateIterResultObject, ObjectBuiltinsAssembler) {
 }
 
 TF_BUILTIN(HasProperty, ObjectBuiltinsAssembler) {
-  Node* key = Parameter(Descriptor::kKey);
-  Node* object = Parameter(Descriptor::kObject);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> key = CAST(Parameter(Descriptor::kKey));
+  TNode<Object> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Return(HasProperty(context, object, key, kHasProperty));
 }
 
 TF_BUILTIN(InstanceOf, ObjectBuiltinsAssembler) {
-  Node* object = Parameter(Descriptor::kLeft);
-  Node* callable = Parameter(Descriptor::kRight);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Object> object = CAST(Parameter(Descriptor::kLeft));
+  TNode<Object> callable = CAST(Parameter(Descriptor::kRight));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Return(InstanceOf(object, callable, context));
 }
@@ -1264,28 +1277,28 @@ TF_BUILTIN(OrdinaryHasInstance, ObjectBuiltinsAssembler) {
 }
 
 TF_BUILTIN(GetSuperConstructor, ObjectBuiltinsAssembler) {
-  Node* object = Parameter(Descriptor::kObject);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSFunction> object = CAST(Parameter(Descriptor::kObject));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   Return(GetSuperConstructor(context, object));
 }
 
 TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
-  Node* closure = Parameter(Descriptor::kClosure);
-  Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<JSFunction> closure = CAST(Parameter(Descriptor::kClosure));
+  TNode<Object> receiver = CAST(Parameter(Descriptor::kReceiver));
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
   // Get the initial map from the function, jumping to the runtime if we don't
   // have one.
   Label done(this), runtime(this);
   GotoIfNot(IsFunctionWithPrototypeSlotMap(LoadMap(closure)), &runtime);
-  TNode<HeapObject> maybe_map =
-      CAST(LoadObjectField(closure, JSFunction::kPrototypeOrInitialMapOffset));
+  TNode<HeapObject> maybe_map = LoadObjectField<HeapObject>(
+      closure, JSFunction::kPrototypeOrInitialMapOffset);
   GotoIf(DoesntHaveInstanceType(maybe_map, MAP_TYPE), &runtime);
   TNode<Map> map = CAST(maybe_map);
 
-  TNode<SharedFunctionInfo> shared =
-      CAST(LoadObjectField(closure, JSFunction::kSharedFunctionInfoOffset));
+  TNode<SharedFunctionInfo> shared = LoadObjectField<SharedFunctionInfo>(
+      closure, JSFunction::kSharedFunctionInfoOffset);
   TNode<BytecodeArray> bytecode_array =
       LoadSharedFunctionInfoBytecodeArray(shared);
 
@@ -1340,7 +1353,7 @@ TF_BUILTIN(CreateGeneratorObject, ObjectBuiltinsAssembler) {
 TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
   TNode<Int32T> argc =
       UncheckedCast<Int32T>(Parameter(Descriptor::kJSActualArgumentsCount));
-  Node* context = Parameter(Descriptor::kContext);
+  TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   CSA_ASSERT(this, IsUndefined(Parameter(Descriptor::kJSNewTarget)));
 
   CodeStubArguments args(this, argc);
@@ -1348,7 +1361,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
   TNode<Object> key = args.GetOptionalArgumentValue(1);
 
   // 1. Let obj be ? ToObject(O).
-  TNode<JSReceiver> object = ToObject_Inline(CAST(context), object_input);
+  TNode<JSReceiver> object = ToObject_Inline(context, object_input);
 
   // 2. Let key be ? ToPropertyKey(P).
   key = CallBuiltin(Builtins::kToName, context, key);
@@ -1361,9 +1374,8 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
   TNode<Uint16T> instance_type = LoadMapInstanceType(map);
   GotoIf(IsSpecialReceiverInstanceType(instance_type), &call_runtime);
   {
-    VARIABLE(var_index, MachineType::PointerRepresentation(),
-             IntPtrConstant(0));
-    VARIABLE(var_name, MachineRepresentation::kTagged);
+    TVARIABLE(IntPtrT, var_index, IntPtrConstant(0));
+    TVARIABLE(Object, var_name);  // TODO(6949) Should be Name
 
     TryToName(key, &if_keyisindex, &var_index, &if_iskeyunique, &var_name,
               &call_runtime, &if_notunique_name);
@@ -1386,9 +1398,9 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
     {
       Label if_found_value(this), return_empty(this), if_not_found(this);
 
-      VARIABLE(var_value, MachineRepresentation::kTagged);
-      VARIABLE(var_details, MachineRepresentation::kWord32);
-      VARIABLE(var_raw_value, MachineRepresentation::kTagged);
+      TVARIABLE(Object, var_value);
+      TVARIABLE(Word32T, var_details);
+      TVARIABLE(Object, var_raw_value);
 
       TryGetOwnProperty(context, object, object, map, instance_type,
                         var_name.value(), &if_found_value, &var_value,
@@ -1396,13 +1408,13 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
                         &if_not_found, kReturnAccessorPair);
 
       BIND(&if_found_value);
-      // 4. Return FromPropertyDescriptor(desc).
-      Node* js_desc = FromPropertyDetails(context, var_value.value(),
-                                          var_details.value(), &call_runtime);
+      // 4. Return FromPropertyDetails(desc).
+      TNode<JSObject> js_desc = FromPropertyDetails(
+          context, var_value.value(), var_details.value(), &call_runtime);
       args.PopAndReturn(js_desc);
 
       BIND(&return_empty);
-      var_value.Bind(UndefinedConstant());
+      var_value = UndefinedConstant();
       args.PopAndReturn(UndefinedConstant());
 
       BIND(&if_not_found);
@@ -1423,7 +1435,7 @@ TF_BUILTIN(ObjectGetOwnPropertyDescriptor, ObjectBuiltinsAssembler) {
     TNode<FixedArray> desc_array = CAST(desc);
 
     // 4. Return FromPropertyDescriptor(desc).
-    Node* js_desc = FromPropertyDescriptor(context, desc_array);
+    TNode<JSObject> js_desc = FromPropertyDescriptor(context, desc_array);
     args.PopAndReturn(js_desc);
   }
   BIND(&return_undefined);
@@ -1442,9 +1454,9 @@ void ObjectBuiltinsAssembler::AddToDictionaryIf(
   BIND(&done);
 }
 
-Node* ObjectBuiltinsAssembler::FromPropertyDescriptor(Node* context,
-                                                      Node* desc) {
-  VARIABLE(js_descriptor, MachineRepresentation::kTagged);
+TNode<JSObject> ObjectBuiltinsAssembler::FromPropertyDescriptor(
+    TNode<Context> context, TNode<FixedArray> desc) {
+  TVARIABLE(JSObject, js_descriptor);
 
   TNode<Int32T> flags = LoadAndUntagToWord32ObjectField(
       desc, PropertyDescriptorObject::kFlagsOffset);
@@ -1467,21 +1479,21 @@ Node* ObjectBuiltinsAssembler::FromPropertyDescriptor(Node* context,
 
   BIND(&if_accessor_desc);
   {
-    js_descriptor.Bind(ConstructAccessorDescriptor(
+    js_descriptor = ConstructAccessorDescriptor(
         context, LoadObjectField(desc, PropertyDescriptorObject::kGetOffset),
         LoadObjectField(desc, PropertyDescriptorObject::kSetOffset),
         IsSetWord32<PropertyDescriptorObject::IsEnumerableBit>(flags),
-        IsSetWord32<PropertyDescriptorObject::IsConfigurableBit>(flags)));
+        IsSetWord32<PropertyDescriptorObject::IsConfigurableBit>(flags));
     Goto(&return_desc);
   }
 
   BIND(&if_data_desc);
   {
-    js_descriptor.Bind(ConstructDataDescriptor(
+    js_descriptor = ConstructDataDescriptor(
         context, LoadObjectField(desc, PropertyDescriptorObject::kValueOffset),
         IsSetWord32<PropertyDescriptorObject::IsWritableBit>(flags),
         IsSetWord32<PropertyDescriptorObject::IsEnumerableBit>(flags),
-        IsSetWord32<PropertyDescriptorObject::IsConfigurableBit>(flags)));
+        IsSetWord32<PropertyDescriptorObject::IsConfigurableBit>(flags));
     Goto(&return_desc);
   }
 
@@ -1531,7 +1543,7 @@ Node* ObjectBuiltinsAssembler::FromPropertyDescriptor(Node* context,
             IsSetWord32<PropertyDescriptorObject::IsConfigurableBit>(flags)),
         &bailout);
 
-    js_descriptor.Bind(js_desc);
+    js_descriptor = js_desc;
     Goto(&return_desc);
 
     BIND(&bailout);
@@ -1543,36 +1555,36 @@ Node* ObjectBuiltinsAssembler::FromPropertyDescriptor(Node* context,
   return js_descriptor.value();
 }
 
-Node* ObjectBuiltinsAssembler::FromPropertyDetails(Node* context,
-                                                   Node* raw_value,
-                                                   Node* details,
-                                                   Label* if_bailout) {
-  VARIABLE(js_descriptor, MachineRepresentation::kTagged);
+TNode<JSObject> ObjectBuiltinsAssembler::FromPropertyDetails(
+    TNode<Context> context, TNode<Object> raw_value, TNode<Word32T> details,
+    Label* if_bailout) {
+  TVARIABLE(JSObject, js_descriptor);
 
   Label if_accessor_desc(this), if_data_desc(this), return_desc(this);
   BranchIfAccessorPair(raw_value, &if_accessor_desc, &if_data_desc);
 
   BIND(&if_accessor_desc);
   {
-    TNode<Object> getter =
-        LoadObjectField(raw_value, AccessorPair::kGetterOffset);
-    TNode<Object> setter =
-        LoadObjectField(raw_value, AccessorPair::kSetterOffset);
-    js_descriptor.Bind(ConstructAccessorDescriptor(
+    TNode<AccessorPair> accessor_pair_value = CAST(raw_value);
+    TNode<HeapObject> getter = LoadObjectField<HeapObject>(
+        accessor_pair_value, AccessorPair::kGetterOffset);
+    TNode<HeapObject> setter = LoadObjectField<HeapObject>(
+        accessor_pair_value, AccessorPair::kSetterOffset);
+    js_descriptor = ConstructAccessorDescriptor(
         context, GetAccessorOrUndefined(getter, if_bailout),
         GetAccessorOrUndefined(setter, if_bailout),
         IsNotSetWord32(details, PropertyDetails::kAttributesDontEnumMask),
-        IsNotSetWord32(details, PropertyDetails::kAttributesDontDeleteMask)));
+        IsNotSetWord32(details, PropertyDetails::kAttributesDontDeleteMask));
     Goto(&return_desc);
   }
 
   BIND(&if_data_desc);
   {
-    js_descriptor.Bind(ConstructDataDescriptor(
+    js_descriptor = ConstructDataDescriptor(
         context, raw_value,
         IsNotSetWord32(details, PropertyDetails::kAttributesReadOnlyMask),
         IsNotSetWord32(details, PropertyDetails::kAttributesDontEnumMask),
-        IsNotSetWord32(details, PropertyDetails::kAttributesDontDeleteMask)));
+        IsNotSetWord32(details, PropertyDetails::kAttributesDontDeleteMask));
     Goto(&return_desc);
   }
 
@@ -1580,20 +1592,20 @@ Node* ObjectBuiltinsAssembler::FromPropertyDetails(Node* context,
   return js_descriptor.value();
 }
 
-Node* ObjectBuiltinsAssembler::GetAccessorOrUndefined(Node* accessor,
-                                                      Label* if_bailout) {
+TNode<HeapObject> ObjectBuiltinsAssembler::GetAccessorOrUndefined(
+    TNode<HeapObject> accessor, Label* if_bailout) {
   Label bind_undefined(this, Label::kDeferred), return_result(this);
-  VARIABLE(result, MachineRepresentation::kTagged);
+  TVARIABLE(HeapObject, result);
 
   GotoIf(IsNull(accessor), &bind_undefined);
-  result.Bind(accessor);
+  result = accessor;
   TNode<Map> map = LoadMap(accessor);
   // TODO(ishell): probe template instantiations cache.
   GotoIf(IsFunctionTemplateInfoMap(map), if_bailout);
   Goto(&return_result);
 
   BIND(&bind_undefined);
-  result.Bind(UndefinedConstant());
+  result = UndefinedConstant();
   Goto(&return_result);
 
   BIND(&return_result);

src/codegen/code-stub-assembler.cc

@@ -1218,7 +1218,8 @@ void CodeStubAssembler::BranchIfPrototypesHaveNoElements(
       GotoIfNot(
           InstanceTypeEqual(prototype_instance_type, JS_PRIMITIVE_WRAPPER_TYPE),
           possibly_elements);
-      Node* prototype_value = LoadJSPrimitiveWrapperValue(prototype);
+      TNode<Object> prototype_value =
+          LoadJSPrimitiveWrapperValue(CAST(prototype));
       Branch(IsEmptyString(prototype_value), &if_notcustom, possibly_elements);
     }
 
@@ -2004,8 +2005,8 @@ Node* CodeStubAssembler::PointerToSeqStringData(Node* seq_string) {
       IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag));
 }
 
-Node* CodeStubAssembler::LoadJSPrimitiveWrapperValue(Node* object) {
-  CSA_ASSERT(this, IsJSPrimitiveWrapper(object));
+TNode<Object> CodeStubAssembler::LoadJSPrimitiveWrapperValue(
+    TNode<JSPrimitiveWrapper> object) {
   return LoadObjectField(object, JSPrimitiveWrapper::kValueOffset);
 }
 
@@ -9731,10 +9732,11 @@ TNode<Object> CodeStubAssembler::CallGetterIfAccessor(
       GotoIfNot(IsLengthString(
                     LoadObjectField(accessor_info, AccessorInfo::kNameOffset)),
                 if_bailout);
-      Node* receiver_value = LoadJSPrimitiveWrapperValue(receiver);
+      TNode<Object> receiver_value =
+          LoadJSPrimitiveWrapperValue(CAST(receiver));
       GotoIfNot(TaggedIsNotSmi(receiver_value), if_bailout);
-      GotoIfNot(IsString(receiver_value), if_bailout);
-      var_value.Bind(LoadStringLengthAsSmi(receiver_value));
+      GotoIfNot(IsString(CAST(receiver_value)), if_bailout);
+      var_value.Bind(LoadStringLengthAsSmi(CAST(receiver_value)));
       Goto(&done);
     }
   }
@@ -9922,18 +9924,14 @@ void CodeStubAssembler::TryLookupElement(Node* object, Node* map,
   }
   BIND(&if_isfaststringwrapper);
   {
-    CSA_ASSERT(this, HasInstanceType(object, JS_PRIMITIVE_WRAPPER_TYPE));
-    Node* string = LoadJSPrimitiveWrapperValue(object);
-    CSA_ASSERT(this, IsString(string));
+    TNode<String> string = CAST(LoadJSPrimitiveWrapperValue(CAST(object)));
     TNode<IntPtrT> length = LoadStringLengthAsWord(string);
     GotoIf(UintPtrLessThan(intptr_index, length), if_found);
     Goto(&if_isobjectorsmi);
   }
   BIND(&if_isslowstringwrapper);
   {
-    CSA_ASSERT(this, HasInstanceType(object, JS_PRIMITIVE_WRAPPER_TYPE));
-    Node* string = LoadJSPrimitiveWrapperValue(object);
-    CSA_ASSERT(this, IsString(string));
+    TNode<String> string = CAST(LoadJSPrimitiveWrapperValue(CAST(object)));
     TNode<IntPtrT> length = LoadStringLengthAsWord(string);
     GotoIf(UintPtrLessThan(intptr_index, length), if_found);
     Goto(&if_isdictionary);
@@ -13085,7 +13083,7 @@ TNode<String> CodeStubAssembler::Typeof(SloppyTNode<Object> value) {
 }
 
 TNode<Object> CodeStubAssembler::GetSuperConstructor(
-    SloppyTNode<Context> context, SloppyTNode<JSFunction> active_function) {
+    TNode<Context> context, TNode<JSFunction> active_function) {
   Label is_not_constructor(this, Label::kDeferred), out(this);
   TVARIABLE(Object, result);
 
@@ -13148,9 +13146,10 @@ TNode<JSReceiver> CodeStubAssembler::SpeciesConstructor(
   return var_result.value();
 }
 
-Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
-                                    Node* context) {
-  VARIABLE(var_result, MachineRepresentation::kTagged);
+TNode<Oddball> CodeStubAssembler::InstanceOf(TNode<Object> object,
+                                             TNode<Object> callable,
+                                             TNode<Context> context) {
+  TVARIABLE(Oddball, var_result);
   Label if_notcallable(this, Label::kDeferred),
       if_notreceiver(this, Label::kDeferred), if_otherhandler(this),
       if_nohandler(this, Label::kDeferred), return_true(this),
@@ -13158,7 +13157,7 @@ Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
 
   // Ensure that the {callable} is actually a JSReceiver.
   GotoIf(TaggedIsSmi(callable), &if_notreceiver);
-  GotoIfNot(IsJSReceiver(callable), &if_notreceiver);
+  GotoIfNot(IsJSReceiver(CAST(callable)), &if_notreceiver);
 
   // Load the @@hasInstance property from {callable}.
   TNode<Object> inst_of_handler =
@@ -13176,8 +13175,8 @@ Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
     // Call to Function.prototype[@@hasInstance] directly.
     Callable builtin(BUILTIN_CODE(isolate(), FunctionPrototypeHasInstance),
                      CallTrampolineDescriptor{});
-    Node* result = CallJS(builtin, context, inst_of_handler, callable, object);
-    var_result.Bind(result);
+    var_result =
+        CAST(CallJS(builtin, context, inst_of_handler, callable, object));
     Goto(&return_result);
   }
 
@@ -13199,12 +13198,11 @@ Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
   BIND(&if_nohandler);
   {
     // Ensure that the {callable} is actually Callable.
-    GotoIfNot(IsCallable(callable), &if_notcallable);
+    GotoIfNot(IsCallable(CAST(callable)), &if_notcallable);
 
     // Use the OrdinaryHasInstance algorithm.
-    TNode<Object> result =
-        CallBuiltin(Builtins::kOrdinaryHasInstance, context, callable, object);
-    var_result.Bind(result);
+    var_result = CAST(
+        CallBuiltin(Builtins::kOrdinaryHasInstance, context, callable, object));
     Goto(&return_result);
   }
 
@@ -13215,11 +13213,11 @@ Node* CodeStubAssembler::InstanceOf(Node* object, Node* callable,
   { ThrowTypeError(context, MessageTemplate::kNonObjectInInstanceOfCheck); }
 
   BIND(&return_true);
-  var_result.Bind(TrueConstant());
+  var_result = TrueConstant();
   Goto(&return_result);
 
   BIND(&return_false);
-  var_result.Bind(FalseConstant());
+  var_result = FalseConstant();
   Goto(&return_result);
 
   BIND(&return_result);

src/codegen/code-stub-assembler.h

@@ -1198,7 +1198,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
   // Loads a pointer to the sequential String char array.
   Node* PointerToSeqStringData(Node* seq_string);
   // Load value field of a JSPrimitiveWrapper object.
-  Node* LoadJSPrimitiveWrapperValue(Node* object);
+  TNode<Object> LoadJSPrimitiveWrapperValue(TNode<JSPrimitiveWrapper> object);
 
   // Figures out whether the value of maybe_object is:
   // - a SMI (jump to "if_smi", "extracted" will be the SMI value)
@@ -3497,14 +3497,15 @@ class V8_EXPORT_PRIVATE CodeStubAssembler
 
   TNode<String> Typeof(SloppyTNode<Object> value);
 
-  TNode<Object> GetSuperConstructor(SloppyTNode<Context> context,
-                                    SloppyTNode<JSFunction> active_function);
+  TNode<Object> GetSuperConstructor(TNode<Context> context,
+                                    TNode<JSFunction> active_function);
 
   TNode<JSReceiver> SpeciesConstructor(
       SloppyTNode<Context> context, SloppyTNode<Object> object,
       SloppyTNode<JSReceiver> default_constructor);
 
-  Node* InstanceOf(Node* object, Node* callable, Node* context);
+  TNode<Oddball> InstanceOf(TNode<Object> object, TNode<Object> callable,
+                            TNode<Context> context);
 
   // Debug helpers
   Node* IsDebugActive();

src/ic/keyed-store-generic.cc

@@ -16,8 +16,6 @@
 namespace v8 {
 namespace internal {
 
-using Node = compiler::Node;
-
 enum class StoreMode { kOrdinary, kInLiteral };
 
 class KeyedStoreGenericAssembler : public AccessorAssembler {