[in-place weak refs] Cleanup: Add types to CSA::LoadFeedbackVectorSlot callsites.

Bug: v8:7308

Change-Id: I967e036dc584f585dddda0eef480389a33e45bdf
Reviewed-on: https://chromium-review.googlesource.com/1046649Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53103}

src/builtins/builtins-constructor-gen.cc

@@ -308,8 +308,8 @@ Node* ConstructorBuiltinsAssembler::EmitCreateRegExpLiteral(
   Label call_runtime(this, Label::kDeferred), end(this);
 
   VARIABLE(result, MachineRepresentation::kTagged);
-  Node* literal_site =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
+  TNode<Object> literal_site = ToObject(
+      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
   GotoIf(NotHasBoilerplate(literal_site), &call_runtime);
   {
     Node* boilerplate = literal_site;
@@ -353,17 +353,19 @@ Node* ConstructorBuiltinsAssembler::EmitCreateShallowArrayLiteral(
       return_result(this);
   VARIABLE(result, MachineRepresentation::kTagged);
 
-  Node* allocation_site =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
+  TNode<Object> allocation_site = ToObject(
+      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
   GotoIf(NotHasBoilerplate(allocation_site), call_runtime);
 
   Node* boilerplate = LoadAllocationSiteBoilerplate(allocation_site);
-  allocation_site =
-      allocation_site_mode == TRACK_ALLOCATION_SITE ? allocation_site : nullptr;
 
   CSA_ASSERT(this, IsJSArrayMap(LoadMap(boilerplate)));
   ParameterMode mode = OptimalParameterMode();
-  return CloneFastJSArray(context, boilerplate, mode, allocation_site);
+  if (allocation_site_mode == TRACK_ALLOCATION_SITE) {
+    return CloneFastJSArray(context, boilerplate, mode, allocation_site);
+  } else {
+    return CloneFastJSArray(context, boilerplate, mode);
+  }
 }
 
 TF_BUILTIN(CreateShallowArrayLiteral, ConstructorBuiltinsAssembler) {
@@ -390,8 +392,9 @@ Node* ConstructorBuiltinsAssembler::EmitCreateEmptyArrayLiteral(
     Node* feedback_vector, Node* slot, Node* context) {
   // Array literals always have a valid AllocationSite to properly track
   // elements transitions.
-  VARIABLE(allocation_site, MachineRepresentation::kTagged,
-           LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
+  TVARIABLE(Object, allocation_site,
+            ToObject(LoadFeedbackVectorSlot(feedback_vector, slot, 0,
+                                            INTPTR_PARAMETERS)));
 
   Label create_empty_array(this),
       initialize_allocation_site(this, Label::kDeferred), done(this);
@@ -401,15 +404,15 @@ Node* ConstructorBuiltinsAssembler::EmitCreateEmptyArrayLiteral(
   // TODO(cbruni): create the AllocationSite in CSA.
   BIND(&initialize_allocation_site);
   {
-    allocation_site.Bind(
-        CreateAllocationSiteInFeedbackVector(feedback_vector, SmiTag(slot)));
+    allocation_site =
+        CreateAllocationSiteInFeedbackVector(feedback_vector, SmiTag(slot));
     Goto(&create_empty_array);
   }
 
   BIND(&create_empty_array);
-  CSA_ASSERT(this, IsAllocationSite(allocation_site.value()));
+  CSA_ASSERT(this, IsAllocationSite(CAST(allocation_site.value())));
   Node* kind = SmiToInt32(CAST(
-      LoadObjectField(allocation_site.value(),
+      LoadObjectField(CAST(allocation_site.value()),
                       AllocationSite::kTransitionInfoOrBoilerplateOffset)));
   CSA_ASSERT(this, IsFastElementsKind(kind));
   Node* native_context = LoadNativeContext(context);
@@ -437,8 +440,8 @@ TF_BUILTIN(CreateEmptyArrayLiteral, ConstructorBuiltinsAssembler) {
 
 Node* ConstructorBuiltinsAssembler::EmitCreateShallowObjectLiteral(
     Node* feedback_vector, Node* slot, Label* call_runtime) {
-  Node* allocation_site =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
+  TNode<Object> allocation_site = ToObject(
+      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
   GotoIf(NotHasBoilerplate(allocation_site), call_runtime);
 
   Node* boilerplate = LoadAllocationSiteBoilerplate(allocation_site);

src/code-stub-assembler.cc

@@ -8349,8 +8349,9 @@ void CodeStubAssembler::UpdateFeedback(Node* feedback, Node* feedback_vector,
   // This method is used for binary op and compare feedback. These
   // vector nodes are initialized with a smi 0, so we can simply OR
   // our new feedback in place.
-  Node* previous_feedback = LoadFeedbackVectorSlot(feedback_vector, slot_id);
-  Node* combined_feedback = SmiOr(previous_feedback, feedback);
+  TNode<Smi> previous_feedback =
+      CAST(ToObject(LoadFeedbackVectorSlot(feedback_vector, slot_id)));
+  TNode<Smi> combined_feedback = SmiOr(previous_feedback, feedback);
   Label end(this);
 
   GotoIf(SmiEqual(previous_feedback, combined_feedback), &end);
@@ -9082,7 +9083,7 @@ Node* CodeStubAssembler::PageFromAddress(Node* address) {
   return WordAnd(address, IntPtrConstant(~Page::kPageAlignmentMask));
 }
 
-Node* CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
+TNode<AllocationSite> CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
     Node* feedback_vector, Node* slot) {
   Node* size = IntPtrConstant(AllocationSite::kSize);
   Node* site = Allocate(size, CodeStubAssembler::kPretenured);
@@ -9124,7 +9125,7 @@ Node* CodeStubAssembler::CreateAllocationSiteInFeedbackVector(
 
   StoreFeedbackVectorSlot(feedback_vector, slot, site, UPDATE_WRITE_BARRIER, 0,
                           SMI_PARAMETERS);
-  return site;
+  return CAST(site);
 }
 
 Node* CodeStubAssembler::CreateWeakCellInFeedbackVector(Node* feedback_vector,

src/code-stub-assembler.h

@@ -2114,7 +2114,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
                                        Node* value);
 
   // Create a new AllocationSite and install it into a feedback vector.
-  Node* CreateAllocationSiteInFeedbackVector(Node* feedback_vector, Node* slot);
+  TNode<AllocationSite> CreateAllocationSiteInFeedbackVector(
+      Node* feedback_vector, Node* slot);
 
   enum class IndexAdvanceMode { kPre, kPost };
 

src/ic/accessor-assembler.cc

@@ -2763,10 +2763,10 @@ void AccessorAssembler::KeyedLoadICPolymorphicName(const LoadICParameters* p) {
                                        vector, slot, 0, SMI_PARAMETERS))));
 
   // Check if we have a matching handler for the {receiver_map}.
-  Node* array =
-      LoadFeedbackVectorSlot(vector, slot, kPointerSize, SMI_PARAMETERS);
-  HandlePolymorphicCase(receiver_map, CAST(array), &if_handler, &var_handler,
-                        &miss, 1);
+  TNode<WeakFixedArray> array = CAST(ToObject(
+      LoadFeedbackVectorSlot(vector, slot, kPointerSize, SMI_PARAMETERS)));
+  HandlePolymorphicCase(receiver_map, array, &if_handler, &var_handler, &miss,
+                        1);
 
   BIND(&if_handler);
   {
@@ -3030,10 +3030,10 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
       GotoIfNot(WordEqual(feedback, p->name), &miss);
       // If the name comparison succeeded, we know we have a feedback vector
       // with at least one map/handler pair.
-      Node* array = LoadFeedbackVectorSlot(p->vector, p->slot, kPointerSize,
-                                           SMI_PARAMETERS);
-      HandlePolymorphicCase(receiver_map, CAST(array), &if_handler,
-                            &var_handler, &miss, 1);
+      TNode<WeakFixedArray> array = CAST(ToObject(LoadFeedbackVectorSlot(
+          p->vector, p->slot, kPointerSize, SMI_PARAMETERS)));
+      HandlePolymorphicCase(receiver_map, array, &if_handler, &var_handler,
+                            &miss, 1);
     }
   }
   BIND(&miss);
@@ -3151,7 +3151,8 @@ void AccessorAssembler::GenerateLoadIC_Noninlined() {
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
   Node* receiver_map = LoadReceiverMap(receiver);
-  Node* feedback = LoadFeedbackVectorSlot(vector, slot, 0, SMI_PARAMETERS);
+  TNode<Object> feedback =
+      ToObject(LoadFeedbackVectorSlot(vector, slot, 0, SMI_PARAMETERS));
 
   LoadICParameters p(context, receiver, name, slot, vector);
   LoadIC_Noninlined(&p, receiver_map, feedback, &var_handler, &if_handler,

src/interpreter/interpreter-assembler.cc

@@ -703,8 +703,8 @@ void InterpreterAssembler::CallEpilogue() {
 void InterpreterAssembler::IncrementCallCount(Node* feedback_vector,
                                               Node* slot_id) {
   Comment("increment call count");
-  Node* call_count =
-      LoadFeedbackVectorSlot(feedback_vector, slot_id, kPointerSize);
+  TNode<Smi> call_count = CAST(
+      ToObject(LoadFeedbackVectorSlot(feedback_vector, slot_id, kPointerSize)));
   // The lowest {FeedbackNexus::CallCountField::kShift} bits of the call
   // count are used as flags. To increment the call count by 1 we hence
   // have to increment by 1 << {FeedbackNexus::CallCountField::kShift}.
@@ -721,7 +721,8 @@ void InterpreterAssembler::CollectCallableFeedback(Node* target, Node* context,
   Label extra_checks(this, Label::kDeferred), done(this);
 
   // Check if we have monomorphic {target} feedback already.
-  Node* feedback_element = LoadFeedbackVectorSlot(feedback_vector, slot_id);
+  TNode<HeapObject> feedback_element =
+      ToStrongHeapObject(LoadFeedbackVectorSlot(feedback_vector, slot_id));
   Node* feedback_value = LoadWeakCellValueUnchecked(feedback_element);
   Comment("check if monomorphic");
   Node* is_monomorphic = WordEqual(target, feedback_value);
@@ -929,7 +930,8 @@ Node* InterpreterAssembler::Construct(Node* target, Node* context,
   IncrementCallCount(feedback_vector, slot_id);
 
   // Check if we have monomorphic {new_target} feedback already.
-  Node* feedback_element = LoadFeedbackVectorSlot(feedback_vector, slot_id);
+  TNode<HeapObject> feedback_element =
+      CAST(ToObject(LoadFeedbackVectorSlot(feedback_vector, slot_id)));
   Node* feedback_value = LoadWeakCellValueUnchecked(feedback_element);
   Branch(WordEqual(new_target, feedback_value), &construct, &extra_checks);
 
@@ -1108,7 +1110,8 @@ Node* InterpreterAssembler::ConstructWithSpread(Node* target, Node* context,
   IncrementCallCount(feedback_vector, slot_id);
 
   // Check if we have monomorphic {new_target} feedback already.
-  Node* feedback_element = LoadFeedbackVectorSlot(feedback_vector, slot_id);
+  TNode<HeapObject> feedback_element =
+      CAST(ToObject(LoadFeedbackVectorSlot(feedback_vector, slot_id)));
   Node* feedback_value = LoadWeakCellValueUnchecked(feedback_element);
   Branch(WordEqual(new_target, feedback_value), &construct, &extra_checks);
 

src/interpreter/interpreter-generator.cc

@@ -2447,8 +2447,8 @@ IGNITION_HANDLER(CreateEmptyObjectLiteral, InterpreterAssembler) {
 IGNITION_HANDLER(GetTemplateObject, InterpreterAssembler) {
   Node* feedback_vector = LoadFeedbackVector();
   Node* slot = BytecodeOperandIdx(1);
-  Node* cached_value =
-      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS);
+  TNode<Object> cached_value = ToObject(
+      LoadFeedbackVectorSlot(feedback_vector, slot, 0, INTPTR_PARAMETERS));
 
   Label call_runtime(this, Label::kDeferred);
   GotoIf(WordEqual(cached_value, SmiConstant(0)), &call_runtime);
@@ -2478,7 +2478,8 @@ IGNITION_HANDLER(CreateClosure, InterpreterAssembler) {
   Node* context = GetContext();
   Node* slot = BytecodeOperandIdx(1);
   Node* feedback_vector = LoadFeedbackVector();
-  Node* feedback_cell = LoadFeedbackVectorSlot(feedback_vector, slot);
+  TNode<Object> feedback_cell =
+      ToObject(LoadFeedbackVectorSlot(feedback_vector, slot));
 
   Label if_fast(this), if_slow(this, Label::kDeferred);
   Branch(IsSetWord32<CreateClosureFlags::FastNewClosureBit>(flags), &if_fast,