[sandbox] Remove SandboxedExternalPointer turbofan type

This type is no longer required: all ExternalPointers are now
sandboxified in turbofan, so we use that type instead.

Bug: v8:10391
Change-Id: Ia2bd261bfe3cfd5c7d9c350ba0e553e57a596a42
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3359632Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#78802}

src/compiler/access-builder.cc

@@ -756,8 +756,7 @@ FieldAccess AccessBuilder::ForExternalStringResourceData() {
       ExternalString::kResourceDataOffset,
       Handle<Name>(),
       MaybeHandle<Map>(),
-      V8_SANDBOXED_EXTERNAL_POINTERS_BOOL ? Type::SandboxedExternalPointer()
-                                          : Type::ExternalPointer(),
+      Type::ExternalPointer(),
       MachineType::Pointer(),
       kNoWriteBarrier,
       ConstFieldInfo::None(),

src/compiler/memory-lowering.cc

@@ -472,30 +472,27 @@ Reduction MemoryLowering::ReduceLoadField(Node* node) {
   node->InsertInput(graph_zone(), 1, offset);
   MachineType type = access.machine_type;
   if (V8_SANDBOXED_EXTERNAL_POINTERS_BOOL &&
-      access.type.Is(Type::SandboxedExternalPointer())) {
+      access.type.Is(Type::ExternalPointer())) {
     // External pointer table indices are stored as 32-bit numbers
     type = MachineType::Uint32();
   }
 
   if (type.IsMapWord()) {
-    DCHECK(!access.type.Is(Type::SandboxedExternalPointer()));
+    DCHECK(!access.type.Is(Type::ExternalPointer()));
     return ReduceLoadMap(node);
   }
 
   NodeProperties::ChangeOp(node, machine()->Load(type));
 
-  if (V8_SANDBOXED_EXTERNAL_POINTERS_BOOL &&
-      access.type.Is(Type::SandboxedExternalPointer())) {
 #ifdef V8_SANDBOXED_EXTERNAL_POINTERS
+  if (access.type.Is(Type::ExternalPointer())) {
     ExternalPointerTag tag = access.external_pointer_tag;
-#else
-    ExternalPointerTag tag = kExternalPointerNullTag;
-#endif
+    DCHECK_NE(kExternalPointerNullTag, tag);
     node = DecodeExternalPointer(node, tag);
     return Replace(node);
-  } else {
-    DCHECK(!access.type.Is(Type::SandboxedExternalPointer()));
   }
+#endif
+
   return Changed(node);
 }
 
@@ -542,8 +539,7 @@ Reduction MemoryLowering::ReduceStoreField(Node* node,
   FieldAccess const& access = FieldAccessOf(node->op());
   // External pointer must never be stored by optimized code.
   DCHECK_IMPLIES(V8_SANDBOXED_EXTERNAL_POINTERS_BOOL,
-                 !access.type.Is(Type::ExternalPointer()) &&
-                     !access.type.Is(Type::SandboxedExternalPointer()));
+                 !access.type.Is(Type::ExternalPointer()));
   // SandboxedPointers are not currently stored by optimized code.
   DCHECK(!access.type.Is(Type::SandboxedPointer()));
   MachineType machine_type = access.machine_type;

src/compiler/simplified-lowering.cc

@@ -1074,7 +1074,6 @@ class RepresentationSelector {
     } else if (type.Is(Type::BigInt()) && use.IsUsedAsWord64()) {
       return MachineRepresentation::kWord64;
     } else if (type.Is(Type::ExternalPointer()) ||
-               type.Is(Type::SandboxedExternalPointer()) ||
                type.Is(Type::SandboxedPointer())) {
       return MachineType::PointerRepresentation();
     }

src/compiler/types.h

@@ -133,10 +133,7 @@ namespace compiler {
 // We split the macro list into two parts because the Torque equivalent in
 // turbofan-types.tq uses two 32bit bitfield structs.
 #define PROPER_ATOMIC_BITSET_TYPE_HIGH_LIST(V) \
-  /* TODO(v8:10391): Remove this type once all ExternalPointer usages are */ \
-  /* sandbox-ready. */                     \
-  V(SandboxedExternalPointer, uint64_t{1} << 32)  \
-  V(SandboxedPointer,         uint64_t{1} << 33)
+  V(SandboxedPointer,         uint64_t{1} << 32)
 
 #define PROPER_BITSET_TYPE_LIST(V) \
   V(None,                     uint64_t{0}) \
@@ -210,7 +207,6 @@ namespace compiler {
   V(Unique,                       kBoolean | kUniqueName | kNull | \
                                   kUndefined | kHole | kReceiver) \
   V(Internal,                     kHole | kExternalPointer | \
-                                  kSandboxedExternalPointer | \
                                   kSandboxedPointer | kOtherInternal) \
   V(NonInternal,                  kPrimitive | kReceiver) \
   V(NonBigInt,                    kNonBigIntPrimitive | kReceiver) \

src/objects/turbofan-types.tq

@@ -48,7 +48,6 @@ bitfield struct TurbofanTypeLowBits extends uint32 {
 }
 
 bitfield struct TurbofanTypeHighBits extends uint32 {
-  sandboxed_external_pointer: bool: 1 bit;
   sandboxed_pointer: bool: 1 bit;
 }