Revert "Reland "[turbofan] Support additional operators in SLVerifier""

This reverts commit 066d0233.

Reason for revert: Failing on GPU bots, e.g. https://ci.chromium.org/ui/p/v8/builders/ci/Mac%20V8%20FYI%20Release%20(Intel)/17647/overview

Original change's description:
> Reland "[turbofan] Support additional operators in SLVerifier"
>
> This is a reland of commit dec4bb06
>
> Original change's description:
> > [turbofan] Support additional operators in SLVerifier
> >
> > This CL extends SimplifiedLoweringVerifier by a few additional operators.
> >
> > It fixes the missing type on a LoadElement node generated during
> > js-typed-lowering, that was detected by the verifier.
> >
> > Bug: v8:12619
> > Change-Id: I14e3ece15f6a90e6906c140696dcd2e6b74a2527
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557510
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#80014}
>
> Bug: v8:12619
> Change-Id: If3cb6efe2005c41118f37b39b0209195b3e63a38
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3702330
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81125}

Bug: v8:12619
Change-Id: I0869f3abd634026a4ac852eebe186e6ccc7c3e31
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3705380
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81149}

src/compiler/access-builder.cc

@@ -1092,16 +1092,6 @@ ElementAccess AccessBuilder::ForTypedArrayElement(ExternalArrayType type,
   UNREACHABLE();
 }
 
-// static
-ElementAccess AccessBuilder::ForJSForInCacheArrayElement(ForInMode mode) {
-  ElementAccess access = {
-      kTaggedBase, FixedArray::kHeaderSize,
-      (mode == ForInMode::kGeneric ? Type::String()
-                                   : Type::InternalizedString()),
-      MachineType::AnyTagged(), kFullWriteBarrier};
-  return access;
-}
-
 // static
 FieldAccess AccessBuilder::ForHashTableBaseNumberOfElements() {
   FieldAccess access = {

src/compiler/access-builder.h

@@ -6,7 +6,6 @@
 #define V8_COMPILER_ACCESS_BUILDER_H_
 
 #include "src/base/compiler-specific.h"
-#include "src/compiler/js-operator.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/write-barrier-kind.h"
 #include "src/objects/elements-kind.h"
@@ -321,9 +320,6 @@ class V8_EXPORT_PRIVATE AccessBuilder final
   static ElementAccess ForTypedArrayElement(ExternalArrayType type,
                                             bool is_external);
 
-  // Provides access to the for-in cache array.
-  static ElementAccess ForJSForInCacheArrayElement(ForInMode mode);
-
   // Provides access to HashTable fields.
   static FieldAccess ForHashTableBaseNumberOfElements();
   static FieldAccess ForHashTableBaseNumberOfDeletedElement();

src/compiler/js-typed-lowering.cc

@@ -1873,17 +1873,16 @@ Reduction JSTypedLowering::ReduceJSForInNext(Node* node) {
       node->ReplaceInput(2, effect);
       node->ReplaceInput(3, control);
       node->TrimInputCount(4);
-      ElementAccess access =
-          AccessBuilder::ForJSForInCacheArrayElement(n.Parameters().mode());
-      NodeProperties::ChangeOp(node, simplified()->LoadElement(access));
-      NodeProperties::SetType(node, access.type);
+      NodeProperties::ChangeOp(
+          node,
+          simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()));
+      NodeProperties::SetType(node, Type::InternalizedString());
       break;
     }
     case ForInMode::kGeneric: {
       // Load the next {key} from the {cache_array}.
       Node* key = effect = graph()->NewNode(
-          simplified()->LoadElement(AccessBuilder::ForJSForInCacheArrayElement(
-              n.Parameters().mode())),
+          simplified()->LoadElement(AccessBuilder::ForFixedArrayElement()),
           cache_array, index, effect, control);
 
       // Check if the expected map still matches that of the {receiver}.

src/compiler/simplified-lowering.cc

@@ -1317,12 +1317,11 @@ class RepresentationSelector {
       return MachineType(rep, MachineSemantic::kInt64);
     }
     MachineType machine_type(rep, DeoptValueSemanticOf(type));
-    DCHECK_IMPLIES(
-        machine_type.representation() == MachineRepresentation::kWord32,
-        machine_type.semantic() == MachineSemantic::kInt32 ||
-            machine_type.semantic() == MachineSemantic::kUint32);
-    DCHECK_IMPLIES(machine_type.representation() == MachineRepresentation::kBit,
-                   type.Is(Type::Boolean()));
+    DCHECK(machine_type.representation() != MachineRepresentation::kWord32 ||
+           machine_type.semantic() == MachineSemantic::kInt32 ||
+           machine_type.semantic() == MachineSemantic::kUint32);
+    DCHECK(machine_type.representation() != MachineRepresentation::kBit ||
+           type.Is(Type::Boolean()));
     return machine_type;
   }