[stubs] Fixing issues found by machine graph verifier in code stubs.

src/code-stub-assembler.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 #include "src/code-stub-assembler.h"
 #include "src/code-factory.h"
 #include "src/frames-inl.h"
 #include "src/frames.h"
 
 namespace v8 {
 namespace internal {
@@ skipping 420 matching lines @@
 
 Node* CodeStubAssembler::SmiToWord32(Node* value) {
   Node* result = SmiUntag(value);
   return TruncateWordToWord32(result);
 }
 
 Node* CodeStubAssembler::SmiToFloat64(Node* value) {
   return ChangeInt32ToFloat64(SmiToWord32(value));
 }
 
-Node* CodeStubAssembler::SmiAdd(Node* a, Node* b) {
-  return BitcastWordToTaggedSigned(
-      IntPtrAdd(BitcastTaggedToWord(a), BitcastTaggedToWord(b)));
-}
-
-Node* CodeStubAssembler::SmiSub(Node* a, Node* b) {
-  return BitcastWordToTaggedSigned(
-      IntPtrSub(BitcastTaggedToWord(a), BitcastTaggedToWord(b)));
-}
-
-Node* CodeStubAssembler::SmiEqual(Node* a, Node* b) {
-  return WordEqual(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-}
-
-Node* CodeStubAssembler::SmiAbove(Node* a, Node* b) {
-  return UintPtrGreaterThan(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-}
-
-Node* CodeStubAssembler::SmiAboveOrEqual(Node* a, Node* b) {
-  return UintPtrGreaterThanOrEqual(BitcastTaggedToWord(a),
-                                   BitcastTaggedToWord(b));
-}
-
-Node* CodeStubAssembler::SmiBelow(Node* a, Node* b) {
-  return UintPtrLessThan(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-}
-
-Node* CodeStubAssembler::SmiLessThan(Node* a, Node* b) {
-  return IntPtrLessThan(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-}
-
-Node* CodeStubAssembler::SmiLessThanOrEqual(Node* a, Node* b) {
-  return IntPtrLessThanOrEqual(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-}
-
-Node* CodeStubAssembler::SmiGreaterThan(Node* a, Node* b) {
-  return IntPtrGreaterThan(BitcastTaggedToWord(a), BitcastTaggedToWord(b));
-}
-
 Node* CodeStubAssembler::SmiMax(Node* a, Node* b) {
   return SelectTaggedConstant(SmiLessThan(a, b), b, a);
 }
 
 Node* CodeStubAssembler::SmiMin(Node* a, Node* b) {
   return SelectTaggedConstant(SmiLessThan(a, b), a, b);
 }
 
 Node* CodeStubAssembler::SmiMod(Node* a, Node* b) {
   Variable var_result(this, MachineRepresentation::kTagged);
@@ skipping 1286 matching lines @@
 
 Node* CodeStubAssembler::NewConsString(Node* context, Node* length, Node* left,
                                        Node* right, AllocationFlags flags) {
   CSA_ASSERT(this, TaggedIsSmi(length));
   // Added string can be a cons string.
   Comment("Allocating ConsString");
   Node* left_instance_type = LoadInstanceType(left);
   Node* right_instance_type = LoadInstanceType(right);
 
   // Compute intersection and difference of instance types.
-  Node* anded_instance_types = WordAnd(left_instance_type, right_instance_type);
-  Node* xored_instance_types = WordXor(left_instance_type, right_instance_type);
+  Node* anded_instance_types =
+      Word32And(left_instance_type, right_instance_type);
+  Node* xored_instance_types =
+      Word32Xor(left_instance_type, right_instance_type);
 
   // We create a one-byte cons string if
   // 1. both strings are one-byte, or
   // 2. at least one of the strings is two-byte, but happens to contain only
   //    one-byte characters.
   // To do this, we check
   // 1. if both strings are one-byte, or if the one-byte data hint is set in
   //    both strings, or
   // 2. if one of the strings has the one-byte data hint set and the other
   //    string is one-byte.
   STATIC_ASSERT(kOneByteStringTag != 0);
   STATIC_ASSERT(kOneByteDataHintTag != 0);
   Label one_byte_map(this);
   Label two_byte_map(this);
   Variable result(this, MachineRepresentation::kTagged);
   Label done(this, &result);
-  GotoIf(WordNotEqual(
-             WordAnd(anded_instance_types,
-                     IntPtrConstant(kStringEncodingMask | kOneByteDataHintTag)),
-             IntPtrConstant(0)),
+  GotoIf(Word32NotEqual(Word32And(anded_instance_types,
+                                  Int32Constant(kStringEncodingMask |
+                                                kOneByteDataHintTag)),
+                        Int32Constant(0)),
          &one_byte_map);
-  Branch(WordNotEqual(WordAnd(xored_instance_types,
-                              IntPtrConstant(kStringEncodingMask |
-                                             kOneByteDataHintMask)),
-                      IntPtrConstant(kOneByteStringTag | kOneByteDataHintTag)),
+  Branch(Word32NotEqual(Word32And(xored_instance_types,
+                                  Int32Constant(kStringEncodingMask |
+                                                kOneByteDataHintMask)),
+                        Int32Constant(kOneByteStringTag | kOneByteDataHintTag)),
          &two_byte_map, &one_byte_map);
 
   Bind(&one_byte_map);
   Comment("One-byte ConsString");
   result.Bind(AllocateOneByteConsString(length, left, right, flags));
   Goto(&done);
 
   Bind(&two_byte_map);
   Comment("Two-byte ConsString");
   result.Bind(AllocateTwoByteConsString(length, left, right, flags));
@@ skipping 531 matching lines @@
       } else {
         value = LoadHeapNumberValue(value);
       }
     }
     return value;
   }
 }
 
 Node* CodeStubAssembler::CalculateNewElementsCapacity(Node* old_capacity,
                                                       ParameterMode mode) {
+  if (mode == SMI_PARAMETERS) {
+    old_capacity = BitcastTaggedToWord(old_capacity);
+  }
   Node* half_old_capacity = WordShr(old_capacity, IntPtrConstant(1));
   Node* new_capacity = IntPtrAdd(half_old_capacity, old_capacity);
-  Node* unconditioned_result =
-      IntPtrAdd(new_capacity, IntPtrOrSmiConstant(16, mode));
-  if (mode == INTEGER_PARAMETERS || mode == INTPTR_PARAMETERS) {
+  Node* unconditioned_result = IntPtrAdd(new_capacity, IntPtrConstant(16));
+  if (mode == SMI_PARAMETERS) {
+    return SmiAnd(BitcastWordToTaggedSigned(unconditioned_result),
+                  SmiConstant(-1));
+  } else {
     return unconditioned_result;
-  } else {
-    int const kSmiShiftBits = kSmiShiftSize + kSmiTagSize;
-    return WordAnd(unconditioned_result,
-                   IntPtrConstant(static_cast<size_t>(-1) << kSmiShiftBits));
   }
 }
 
 Node* CodeStubAssembler::TryGrowElementsCapacity(Node* object, Node* elements,
                                                  ElementsKind kind, Node* key,
                                                  Label* bailout) {
   Node* capacity = LoadFixedArrayBaseLength(elements);
 
   ParameterMode mode = OptimalParameterMode();
   capacity = UntagParameter(capacity, mode);
   key = UntagParameter(key, mode);
 
   return TryGrowElementsCapacity(object, elements, kind, key, capacity, mode,
                                  bailout);
 }
 
 Node* CodeStubAssembler::TryGrowElementsCapacity(Node* object, Node* elements,
                                                  ElementsKind kind, Node* key,
                                                  Node* capacity,
                                                  ParameterMode mode,
                                                  Label* bailout) {
   Comment("TryGrowElementsCapacity");
 
   // If the gap growth is too big, fall back to the runtime.
   Node* max_gap = IntPtrOrSmiConstant(JSObject::kMaxGap, mode);
-  Node* max_capacity = IntPtrAdd(capacity, max_gap);
-  GotoIf(UintPtrGreaterThanOrEqual(key, max_capacity), bailout);
+  Node* max_capacity = IntPtrOrSmiAdd(capacity, max_gap, mode);
+  GotoIf(UintPtrOrSmiGreaterThanOrEqual(key, max_capacity, mode), bailout);
 
   // Calculate the capacity of the new backing store.
   Node* new_capacity = CalculateNewElementsCapacity(
-      IntPtrAdd(key, IntPtrOrSmiConstant(1, mode)), mode);
+      IntPtrOrSmiAdd(key, IntPtrOrSmiConstant(1, mode), mode), mode);
   return GrowElementsCapacity(object, elements, kind, kind, capacity,
                               new_capacity, mode, bailout);
 }
 
 Node* CodeStubAssembler::GrowElementsCapacity(
     Node* object, Node* elements, ElementsKind from_kind, ElementsKind to_kind,
     Node* capacity, Node* new_capacity, ParameterMode mode, Label* bailout) {
   Comment("[ GrowElementsCapacity");
   // If size of the allocation for the new capacity doesn't fit in a page
   // that we can bump-pointer allocate from, fall back to the runtime.
   int max_size = FixedArrayBase::GetMaxLengthForNewSpaceAllocation(to_kind);
-  GotoIf(UintPtrGreaterThanOrEqual(new_capacity,
-                                   IntPtrOrSmiConstant(max_size, mode)),
+  GotoIf(UintPtrOrSmiGreaterThanOrEqual(
+             new_capacity, IntPtrOrSmiConstant(max_size, mode), mode),
          bailout);
 
   // Allocate the new backing store.
   Node* new_elements = AllocateFixedArray(to_kind, new_capacity, mode);
 
   // Copy the elements from the old elements store to the new.
   // The size-check above guarantees that the |new_elements| is allocated
   // in new space so we can skip the write barrier.
   CopyFixedArrayElements(from_kind, elements, to_kind, new_elements, capacity,
                          new_capacity, SKIP_WRITE_BARRIER, mode);
@@ skipping 171 matching lines @@
       Goto(&if_join);
     } else {
       Node* pair = Int32AddWithOverflow(value32, value32);
       Node* overflow = Projection(1, pair);
       Label if_overflow(this, Label::kDeferred), if_notoverflow(this);
       Branch(overflow, &if_overflow, &if_notoverflow);
       Bind(&if_overflow);
       Goto(&if_valueisheapnumber);
       Bind(&if_notoverflow);
       {
-        Node* result = Projection(0, pair);
+        Node* result = BitcastWordToTaggedSigned(Projection(0, pair));
         var_result.Bind(result);
         Goto(&if_join);
       }
     }
   }
   Bind(&if_valueisheapnumber);
   {
     Node* result = AllocateHeapNumberWithValue(value);
     var_result.Bind(result);
     Goto(&if_join);
@@ skipping 882 matching lines @@
   Bind(&check_right);
   Node* right_length = LoadStringLength(right);
   GotoIf(WordNotEqual(IntPtrConstant(0), right_length), &cons);
   result.Bind(left);
   Goto(&done_native);
 
   Bind(&cons);
   CSA_ASSERT(this, TaggedIsSmi(left_length));
   CSA_ASSERT(this, TaggedIsSmi(right_length));
   Node* new_length = SmiAdd(left_length, right_length);
-  GotoIf(UintPtrGreaterThanOrEqual(
-             new_length, SmiConstant(Smi::FromInt(String::kMaxLength))),
+  GotoIf(SmiAboveOrEqual(new_length, SmiConstant(String::kMaxLength)),
          &runtime);
 
-  GotoIf(IntPtrLessThan(new_length,
-                        SmiConstant(Smi::FromInt(ConsString::kMinLength))),
+  GotoIf(SmiLessThan(new_length, SmiConstant(ConsString::kMinLength)),
          &non_cons);
 
   result.Bind(NewConsString(context, new_length, left, right, flags));
   Goto(&done_native);
 
   Bind(&non_cons);
 
   Comment("Full string concatenate");
   Node* left_instance_type = LoadInstanceType(left);
   Node* right_instance_type = LoadInstanceType(right);
   // Compute intersection and difference of instance types.
 
-  Node* ored_instance_types = WordOr(left_instance_type, right_instance_type);
-  Node* xored_instance_types = WordXor(left_instance_type, right_instance_type);
+  Node* ored_instance_types = Word32Or(left_instance_type, right_instance_type);
+  Node* xored_instance_types =
+      Word32Xor(left_instance_type, right_instance_type);
 
   // Check if both strings have the same encoding and both are sequential.
-  GotoIf(WordNotEqual(
-             WordAnd(xored_instance_types, IntPtrConstant(kStringEncodingMask)),
-             IntPtrConstant(0)),
+  GotoIf(Word32NotEqual(Word32And(xored_instance_types,
+                                  Int32Constant(kStringEncodingMask)),
+                        Int32Constant(0)),
          &runtime);
-  GotoIf(WordNotEqual(WordAnd(ored_instance_types,
-                              IntPtrConstant(kStringRepresentationMask)),
-                      IntPtrConstant(0)),
+  GotoIf(Word32NotEqual(Word32And(ored_instance_types,
+                                  Int32Constant(kStringRepresentationMask)),
+                        Int32Constant(0)),
          &runtime);
 
   Label two_byte(this);
-  GotoIf(WordEqual(
-             WordAnd(ored_instance_types, IntPtrConstant(kStringEncodingMask)),
-             IntPtrConstant(kTwoByteStringTag)),
+  GotoIf(Word32Equal(
+             Word32And(ored_instance_types, Int32Constant(kStringEncodingMask)),
+             Int32Constant(kTwoByteStringTag)),
          &two_byte);
   // One-byte sequential string case
   Node* new_string =
       AllocateSeqOneByteString(context, new_length, SMI_PARAMETERS);
   CopyStringCharacters(left, new_string, SmiConstant(Smi::kZero),
                        SmiConstant(Smi::kZero), left_length,
                        String::ONE_BYTE_ENCODING, String::ONE_BYTE_ENCODING,
                        SMI_PARAMETERS);
   CopyStringCharacters(right, new_string, SmiConstant(Smi::kZero), left_length,
                        right_length, String::ONE_BYTE_ENCODING,
@@ skipping 180 matching lines @@
   Variable result(this, MachineRepresentation::kTagged);
   Label runtime(this, Label::kDeferred);
   Label smi(this);
   Label done(this, &result);
 
   // Load the number string cache.
   Node* number_string_cache = LoadRoot(Heap::kNumberStringCacheRootIndex);
 
   // Make the hash mask from the length of the number string cache. It
   // contains two elements (number and string) for each cache entry.
-  Node* mask = LoadFixedArrayBaseLength(number_string_cache);
+  // TODO(ishell): cleanup mask handling.
+  Node* mask =
+      BitcastTaggedToWord(LoadFixedArrayBaseLength(number_string_cache));
   Node* one = IntPtrConstant(1);
   mask = IntPtrSub(mask, one);
 
   GotoIf(TaggedIsSmi(argument), &smi);
 
   // Argument isn't smi, check to see if it's a heap-number.
   Node* map = LoadMap(argument);
   GotoUnless(IsHeapNumberMap(map), &runtime);
 
   // Make a hash from the two 32-bit values of the double.
   Node* low =
       LoadObjectField(argument, HeapNumber::kValueOffset, MachineType::Int32());
   Node* high = LoadObjectField(argument, HeapNumber::kValueOffset + kIntSize,
                                MachineType::Int32());
   Node* hash = Word32Xor(low, high);
-  if (Is64()) hash = ChangeInt32ToInt64(hash);
+  hash = ChangeInt32ToIntPtr(hash);
   hash = WordShl(hash, one);
-  Node* index = WordAnd(hash, SmiToWord(mask));
+  Node* index = WordAnd(hash, SmiUntag(BitcastWordToTagged(mask)));
 
   // Cache entry's key must be a heap number
   Node* number_key =
       LoadFixedArrayElement(number_string_cache, index, 0, INTPTR_PARAMETERS);
   GotoIf(TaggedIsSmi(number_key), &runtime);
   map = LoadMap(number_key);
   GotoUnless(IsHeapNumberMap(map), &runtime);
 
   // Cache entry's key must match the heap number value we're looking for.
   Node* low_compare = LoadObjectField(number_key, HeapNumber::kValueOffset,
                                       MachineType::Int32());
   Node* high_compare = LoadObjectField(
       number_key, HeapNumber::kValueOffset + kIntSize, MachineType::Int32());
-  GotoUnless(WordEqual(low, low_compare), &runtime);
-  GotoUnless(WordEqual(high, high_compare), &runtime);
+  GotoUnless(Word32Equal(low, low_compare), &runtime);
+  GotoUnless(Word32Equal(high, high_compare), &runtime);
 
   // Heap number match, return value fro cache entry.
   IncrementCounter(isolate()->counters()->number_to_string_native(), 1);
   result.Bind(LoadFixedArrayElement(number_string_cache, index, kPointerSize,
                                     INTPTR_PARAMETERS));
   Goto(&done);
 
   Bind(&runtime);
   {
     // No cache entry, go to the runtime.
     result.Bind(CallRuntime(Runtime::kNumberToString, context, argument));
   }
   Goto(&done);
 
   Bind(&smi);
   {
     // Load the smi key, make sure it matches the smi we're looking for.
-    Node* smi_index = WordAnd(WordShl(argument, one), mask);
+    Node* smi_index = BitcastWordToTagged(
+        WordAnd(WordShl(BitcastTaggedToWord(argument), one), mask));
     Node* smi_key = LoadFixedArrayElement(number_string_cache, smi_index, 0,
                                           SMI_PARAMETERS);
     GotoIf(WordNotEqual(smi_key, argument), &runtime);
 
     // Smi match, return value from cache entry.
     IncrementCounter(isolate()->counters()->number_to_string_native(), 1);
     result.Bind(LoadFixedArrayElement(number_string_cache, smi_index,
                                       kPointerSize, SMI_PARAMETERS));
     Goto(&done);
   }
@@ skipping 783 matching lines @@
       (NameDictionary::kEntryValueIndex - NameDictionary::kEntryKeyIndex) *
       kPointerSize;
   StoreFixedArrayElement(dictionary, index, value, UPDATE_WRITE_BARRIER,
                          kNameToValueOffset, INTPTR_PARAMETERS);
 
   // Prepare details of the new property.
   Variable var_details(this, MachineRepresentation::kTaggedSigned);
   const int kInitialIndex = 0;
   PropertyDetails d(NONE, DATA, kInitialIndex, PropertyCellType::kNoCell);
   enum_index =
-      WordShl(enum_index, PropertyDetails::DictionaryStorageField::kShift);
+      SmiShl(enum_index, PropertyDetails::DictionaryStorageField::kShift);
   STATIC_ASSERT(kInitialIndex == 0);
-  var_details.Bind(WordOr(SmiConstant(d.AsSmi()), enum_index));
+  var_details.Bind(SmiOr(SmiConstant(d.AsSmi()), enum_index));
 
   // Private names must be marked non-enumerable.
   Label not_private(this, &var_details);
   GotoUnless(IsSymbolMap(LoadMap(name)), &not_private);
   Node* flags = SmiToWord32(LoadObjectField(name, Symbol::kFlagsOffset));
   const int kPrivateMask = 1 << Symbol::kPrivateBit;
   GotoUnless(IsSetWord32(flags, kPrivateMask), &not_private);
   Node* dont_enum =
-      WordShl(SmiConstant(DONT_ENUM), PropertyDetails::AttributesField::kShift);
-  var_details.Bind(WordOr(var_details.value(), dont_enum));
+      SmiShl(SmiConstant(DONT_ENUM), PropertyDetails::AttributesField::kShift);
+  var_details.Bind(SmiOr(var_details.value(), dont_enum));
   Goto(&not_private);
   Bind(&not_private);
 
   // Finally, store the details.
   const int kNameToDetailsOffset =
       (NameDictionary::kEntryDetailsIndex - NameDictionary::kEntryKeyIndex) *
       kPointerSize;
   StoreFixedArrayElement(dictionary, index, var_details.value(),
                          SKIP_WRITE_BARRIER, kNameToDetailsOffset,
                          INTPTR_PARAMETERS);
 }
 
 template <>
 void CodeStubAssembler::InsertEntry<GlobalDictionary>(Node* dictionary,
                                                       Node* key, Node* value,
                                                       Node* index,
                                                       Node* enum_index) {
   UNIMPLEMENTED();
 }
 
 template <class Dictionary>
 void CodeStubAssembler::Add(Node* dictionary, Node* key, Node* value,
                             Label* bailout) {
   Node* capacity = GetCapacity<Dictionary>(dictionary);
   Node* nof = GetNumberOfElements<Dictionary>(dictionary);
   Node* new_nof = SmiAdd(nof, SmiConstant(1));
   // Require 33% to still be free after adding additional_elements.
   // Computing "x + (x >> 1)" on a Smi x does not return a valid Smi!
   // But that's OK here because it's only used for a comparison.
-  Node* required_capacity_pseudo_smi = SmiAdd(new_nof, WordShr(new_nof, 1));
-  GotoIf(UintPtrLessThan(capacity, required_capacity_pseudo_smi), bailout);
+  Node* required_capacity_pseudo_smi = SmiAdd(new_nof, SmiShr(new_nof, 1));
+  GotoIf(SmiBelow(capacity, required_capacity_pseudo_smi), bailout);
   // Require rehashing if more than 50% of free elements are deleted elements.
   Node* deleted = GetNumberOfDeletedElements<Dictionary>(dictionary);
-  CSA_ASSERT(this, UintPtrGreaterThan(capacity, new_nof));
-  Node* half_of_free_elements = WordShr(SmiSub(capacity, new_nof), 1);
-  GotoIf(UintPtrGreaterThan(deleted, half_of_free_elements), bailout);
+  CSA_ASSERT(this, SmiAbove(capacity, new_nof));
+  Node* half_of_free_elements = SmiShr(SmiSub(capacity, new_nof), 1);
+  GotoIf(SmiAbove(deleted, half_of_free_elements), bailout);
   Node* enum_index = nullptr;
   if (Dictionary::kIsEnumerable) {
     enum_index = GetNextEnumerationIndex<Dictionary>(dictionary);
     Node* new_enum_index = SmiAdd(enum_index, SmiConstant(1));
     Node* max_enum_index =
         SmiConstant(PropertyDetails::DictionaryStorageField::kMax);
-    GotoIf(UintPtrGreaterThan(new_enum_index, max_enum_index), bailout);
+    GotoIf(SmiAbove(new_enum_index, max_enum_index), bailout);
 
     // No more bailouts after this point.
     // Operations from here on can have side effects.
 
     SetNextEnumerationIndex<Dictionary>(dictionary, new_enum_index);
   } else {
     USE(enum_index);
   }
   SetNumberOfElements<Dictionary>(dictionary, new_nof);
 
@@ skipping 131 matching lines @@
   DCHECK_EQ(MachineRepresentation::kTagged, var_value->rep());
   Comment("[ LoadPropertyFromFastObject");
 
   const int name_to_details_offset =
       (DescriptorArray::kDescriptorDetails - DescriptorArray::kDescriptorKey) *
       kPointerSize;
   const int name_to_value_offset =
       (DescriptorArray::kDescriptorValue - DescriptorArray::kDescriptorKey) *
       kPointerSize;
 
-  Node* details = LoadAndUntagToWord32FixedArrayElement(descriptors, name_index,
-                                                        name_to_details_offset);
+  Node* details = LoadAndUntagToWord32FixedArrayElement(
+      descriptors, name_index, name_to_details_offset, INTPTR_PARAMETERS);
   var_details->Bind(details);
 
   Node* location = DecodeWord32<PropertyDetails::LocationField>(details);
 
   Label if_in_field(this), if_in_descriptor(this), done(this);
   Branch(Word32Equal(location, Int32Constant(kField)), &if_in_field,
          &if_in_descriptor);
   Bind(&if_in_field);
   {
     Node* field_index =
@@ skipping 63 matching lines @@
     Bind(&rebox_double);
     {
       Comment("rebox_double");
       Node* heap_number = AllocateHeapNumberWithValue(var_double_value.value());
       var_value->Bind(heap_number);
       Goto(&done);
     }
   }
   Bind(&if_in_descriptor);
   {
-    Node* value =
-        LoadFixedArrayElement(descriptors, name_index, name_to_value_offset);
+    Node* value = LoadFixedArrayElement(
+        descriptors, name_index, name_to_value_offset, INTPTR_PARAMETERS);
     var_value->Bind(value);
     Goto(&done);
   }
   Bind(&done);
 
   Comment("] LoadPropertyFromFastObject");
 }
 
 void CodeStubAssembler::LoadPropertyFromNameDictionary(Node* dictionary,
                                                        Node* name_index,
                                                        Variable* var_details,
                                                        Variable* var_value) {
   Comment("LoadPropertyFromNameDictionary");
   CSA_ASSERT(this, IsDictionary(dictionary));
   const int name_to_details_offset =
       (NameDictionary::kEntryDetailsIndex - NameDictionary::kEntryKeyIndex) *
       kPointerSize;
   const int name_to_value_offset =
       (NameDictionary::kEntryValueIndex - NameDictionary::kEntryKeyIndex) *
       kPointerSize;
 
-  Node* details = LoadAndUntagToWord32FixedArrayElement(dictionary, name_index,
-                                                        name_to_details_offset);
+  Node* details = LoadAndUntagToWord32FixedArrayElement(
+      dictionary, name_index, name_to_details_offset, INTPTR_PARAMETERS);
 
   var_details->Bind(details);
   var_value->Bind(LoadFixedArrayElement(
       dictionary, name_index, name_to_value_offset, INTPTR_PARAMETERS));
 
   Comment("] LoadPropertyFromNameDictionary");
 }
 
 void CodeStubAssembler::LoadPropertyFromGlobalDictionary(Node* dictionary,
                                                          Node* name_index,
@@ skipping 1152 matching lines @@
   Label no_memento_found(this);
   Label top_check(this), map_check(this);
 
   Node* new_space_top_address = ExternalConstant(
       ExternalReference::new_space_allocation_top_address(isolate()));
   const int kMementoMapOffset = JSArray::kSize;
   const int kMementoLastWordOffset =
       kMementoMapOffset + AllocationMemento::kSize - kPointerSize;
 
   // Bail out if the object is not in new space.
-  Node* object_page = PageFromAddress(object);
+  Node* object_word = BitcastTaggedToWord(object);
+  Node* object_page = PageFromAddress(object_word);
   {
     Node* page_flags = Load(MachineType::IntPtr(), object_page,
                             IntPtrConstant(Page::kFlagsOffset));
     GotoIf(WordEqual(WordAnd(page_flags,
                              IntPtrConstant(MemoryChunk::kIsInNewSpaceMask)),
                      IntPtrConstant(0)),
            &no_memento_found);
   }
 
   Node* memento_last_word = IntPtrAdd(
-      object, IntPtrConstant(kMementoLastWordOffset - kHeapObjectTag));
+      object_word, IntPtrConstant(kMementoLastWordOffset - kHeapObjectTag));
   Node* memento_last_word_page = PageFromAddress(memento_last_word);
 
   Node* new_space_top = Load(MachineType::Pointer(), new_space_top_address);
   Node* new_space_top_page = PageFromAddress(new_space_top);
 
   // If the object is in new space, we need to check whether respective
   // potential memento object is on the same page as the current top.
   GotoIf(WordEqual(memento_last_word_page, new_space_top_page), &top_check);
 
   // The object is on a different page than allocation top. Bail out if the
@@ skipping 2126 matching lines @@
 
 Node* CodeStubAssembler::IsDebugActive() {
   Node* is_debug_active = Load(
       MachineType::Uint8(),
       ExternalConstant(ExternalReference::debug_is_active_address(isolate())));
   return WordNotEqual(is_debug_active, Int32Constant(0));
 }
 
 }  // namespace internal
 }  // namespace v8