Revert of Provide a tagged allocation top pointer.

src/compiler/memory-optimizer.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/memory-optimizer.h"
 
 #include "src/compiler/js-graph.h"
 #include "src/compiler/linkage.h"
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties.h"
@@ skipping 128 matching lines @@
       // Update the allocation top with the new object allocation.
       // TODO(bmeurer): Defer writing back top as much as possible.
       Node* top = graph()->NewNode(machine()->IntAdd(), state->top(),
                                    jsgraph()->IntPtrConstant(object_size));
       effect = graph()->NewNode(
           machine()->Store(StoreRepresentation(
               MachineType::PointerRepresentation(), kNoWriteBarrier)),
           top_address, jsgraph()->IntPtrConstant(0), top, effect, control);
 
       // Compute the effective inner allocated address.
-      value = graph()->NewNode(machine()->BitcastWordToTagged(), state->top());
+      value = graph()->NewNode(
+          machine()->BitcastWordToTagged(),
+          graph()->NewNode(machine()->IntAdd(), state->top(),
+                           jsgraph()->IntPtrConstant(kHeapObjectTag)));
 
       // Extend the allocation {group}.
       group->Add(value);
       state = AllocationState::Open(group, state_size, top, zone());
     } else {
       // Setup a mutable reservation size node; will be patched as we fold
       // additional allocations into this new group.
       Node* size = graph()->NewNode(common()->Int32Constant(object_size));
 
       // Load allocation top and limit.
@@ skipping 28 matching lines @@
         Node* target = pretenure == NOT_TENURED
                            ? jsgraph()->AllocateInNewSpaceStubConstant()
                            : jsgraph()->AllocateInOldSpaceStubConstant();
         if (!allocate_operator_.is_set()) {
           CallDescriptor* descriptor =
               Linkage::GetAllocateCallDescriptor(graph()->zone());
           allocate_operator_.set(common()->Call(descriptor));
         }
         vfalse = efalse = graph()->NewNode(allocate_operator_.get(), target,
                                            size, efalse, if_false);
+        vfalse = graph()->NewNode(machine()->IntSub(), vfalse,
+                                  jsgraph()->IntPtrConstant(kHeapObjectTag));
       }
 
       control = graph()->NewNode(common()->Merge(2), if_true, if_false);
       effect = graph()->NewNode(common()->EffectPhi(2), etrue, efalse, control);
       value = graph()->NewNode(
           common()->Phi(MachineType::PointerRepresentation(), 2), vtrue, vfalse,
           control);
 
       // Compute the new top and write it back.
       top = graph()->NewNode(machine()->IntAdd(), value,
                              jsgraph()->IntPtrConstant(object_size));
       effect = graph()->NewNode(
           machine()->Store(StoreRepresentation(
               MachineType::PointerRepresentation(), kNoWriteBarrier)),
           top_address, jsgraph()->IntPtrConstant(0), top, effect, control);
 
       // Compute the initial object address.
-      value = graph()->NewNode(machine()->BitcastWordToTagged(), value);
+      value = graph()->NewNode(
+          machine()->BitcastWordToTagged(),
+          graph()->NewNode(machine()->IntAdd(), value,
+                           jsgraph()->IntPtrConstant(kHeapObjectTag)));
 
       // Start a new allocation group.
       AllocationGroup* group =
           new (zone()) AllocationGroup(value, pretenure, size, zone());
       state = AllocationState::Open(group, object_size, top, zone());
     }
   } else {
     // Load allocation top and limit.
     Node* top = effect =
         graph()->NewNode(machine()->Load(MachineType::Pointer()), top_address,
@@ skipping 15 matching lines @@
         graph()->NewNode(common()->Branch(BranchHint::kTrue), check, control);
 
     Node* if_true = graph()->NewNode(common()->IfTrue(), branch);
     Node* etrue = effect;
     Node* vtrue;
     {
       etrue = graph()->NewNode(
           machine()->Store(StoreRepresentation(
               MachineType::PointerRepresentation(), kNoWriteBarrier)),
           top_address, jsgraph()->IntPtrConstant(0), new_top, etrue, if_true);
-      vtrue = graph()->NewNode(machine()->BitcastWordToTagged(), top);
+      vtrue = graph()->NewNode(
+          machine()->BitcastWordToTagged(),
+          graph()->NewNode(machine()->IntAdd(), top,
+                           jsgraph()->IntPtrConstant(kHeapObjectTag)));
     }
 
     Node* if_false = graph()->NewNode(common()->IfFalse(), branch);
     Node* efalse = effect;
     Node* vfalse;
     {
       Node* target = pretenure == NOT_TENURED
                          ? jsgraph()->AllocateInNewSpaceStubConstant()
                          : jsgraph()->AllocateInOldSpaceStubConstant();
       if (!allocate_operator_.is_set()) {
@@ skipping 214 matching lines @@
   return jsgraph()->common();
 }
 
 MachineOperatorBuilder* MemoryOptimizer::machine() const {
   return jsgraph()->machine();
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8