[turbofan] Support additional operators in SLVerifier

This CL extends SimplifiedLoweringVerifier by a few additional operators.

It fixes the missing type on a LoadElement node generated during
js-typed-lowering, that was detected by the verifier.

Bug: v8:12619
Change-Id: I14e3ece15f6a90e6906c140696dcd2e6b74a2527
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557510Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80014}

src/compiler/access-builder.cc

@@ -1092,6 +1092,16 @@ ElementAccess AccessBuilder::ForTypedArrayElement(ExternalArrayType type,
   UNREACHABLE();
 }
 
+// static
+ElementAccess AccessBuilder::ForJSForInCacheArrayElement(ForInMode mode) {
+  ElementAccess access = {
+      kTaggedBase, FixedArray::kHeaderSize,
+      (mode == ForInMode::kGeneric ? Type::String()
+                                   : Type::InternalizedString()),
+      MachineType::AnyTagged(), kFullWriteBarrier};
+  return access;
+}
+
 // static
 FieldAccess AccessBuilder::ForHashTableBaseNumberOfElements() {
   FieldAccess access = {

src/compiler/access-builder.h

@@ -6,6 +6,7 @@
 #define V8_COMPILER_ACCESS_BUILDER_H_
 
 #include "src/base/compiler-specific.h"
+#include "src/compiler/js-operator.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/write-barrier-kind.h"
 #include "src/objects/elements-kind.h"
@@ -320,6 +321,9 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   static ElementAccess ForTypedArrayElement(ExternalArrayType type,
                                             bool is_external);
 
+  // Provides access to the for-in cache array.
+  static ElementAccess ForJSForInCacheArrayElement(ForInMode mode);
+
   // Provides access to HashTable fields.
   static FieldAccess ForHashTableBaseNumberOfElements();
   static FieldAccess ForHashTableBaseNumberOfDeletedElement();

src/compiler/js-typed-lowering.cc

@@ -1874,16 +1874,17 @@ Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
       node->ReplaceInput(2, effect);
       node->ReplaceInput(3, control);
       node->TrimInputCount(4);
-      NodeProperties::ChangeOp(
-          node,
-          simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()));
-      NodeProperties::SetType(node, Type::InternalizedString());
+      ElementAccess access =
+          AccessBuilder::ForJSForInCacheArrayElement(n.Parameters().mode());
+      NodeProperties::ChangeOp(node, simplified()->LoadElement(access));
+      NodeProperties::SetType(node, access.type);
       break;
     }
     case ForInMode::kGeneric: {
       // Load the next {key} from the {cache_array}.
       Node* key = effect = graph()->NewNode(
-          simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()),
+          simplified()->LoadElement(AccessBuilder::ForJSForInCacheArrayElement(
+              n.Parameters().mode())),
           cache_array, index, effect, control);
 
       // Check if the expected map still matches that of the {receiver}.

src/compiler/simplified-lowering.cc

@@ -1306,11 +1306,12 @@ class RepresentationSelector {
       return MachineType(rep, MachineSemantic::kInt64);
     }
     MachineType machine_type(rep, DeoptValueSemanticOf(type));
-    DCHECK(machine_type.representation() != MachineRepresentation::kWord32 ||
-           machine_type.semantic() == MachineSemantic::kInt32 ||
-           machine_type.semantic() == MachineSemantic::kUint32);
-    DCHECK(machine_type.representation() != MachineRepresentation::kBit ||
-           type.Is(Type::Boolean()));
+    DCHECK_IMPLIES(
+        machine_type.representation() == MachineRepresentation::kWord32,
+        machine_type.semantic() == MachineSemantic::kInt32 ||
+            machine_type.semantic() == MachineSemantic::kUint32);
+    DCHECK_IMPLIES(machine_type.representation() == MachineRepresentation::kBit,
+                   type.Is(Type::Boolean()));
     return machine_type;
   }