[stubs] Enable graph verification for builtins.

src/builtins/builtins-regexp.cc

 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/builtins/builtins-utils.h"
 #include "src/builtins/builtins.h"
 #include "src/code-factory.h"
 #include "src/code-stub-assembler.h"
 #include "src/regexp/jsregexp.h"
 #include "src/regexp/regexp-utils.h"
@@ skipping 165 matching lines @@
   var_to_cursor.Bind(IntPtrConstant(1));
 
   Variable* vars[] = {&var_from_cursor, &var_to_cursor};
   Label loop(this, 2, vars);
 
   Goto(&loop);
   Bind(&loop);
   {
     Node* const from_cursor = var_from_cursor.value();
     Node* const to_cursor = var_to_cursor.value();
-    Node* const start = LoadFixedArrayElement(match_info, from_cursor);
+    Node* const start =
+        LoadFixedArrayElement(match_info, from_cursor, 0, INTPTR_PARAMETERS);
 
     Label next_iter(this);
     GotoIf(SmiEqual(start, SmiConstant(Smi::FromInt(-1))), &next_iter);
 
     Node* const from_cursor_plus1 = IntPtrAdd(from_cursor, IntPtrConstant(1));
-    Node* const end = LoadFixedArrayElement(match_info, from_cursor_plus1);
+    Node* const end = LoadFixedArrayElement(match_info, from_cursor_plus1, 0,
+                                            INTPTR_PARAMETERS);
 
     Node* const capture = SubString(context, string, start, end);
-    StoreFixedArrayElement(result_elements, to_cursor, capture);
+    StoreFixedArrayElement(result_elements, to_cursor, capture,
+                           UPDATE_WRITE_BARRIER, 0, INTPTR_PARAMETERS);
     Goto(&next_iter);
 
     Bind(&next_iter);
     var_from_cursor.Bind(IntPtrAdd(from_cursor, IntPtrConstant(2)));
     var_to_cursor.Bind(IntPtrAdd(to_cursor, IntPtrConstant(1)));
     Branch(UintPtrLessThan(var_from_cursor.value(), limit), &loop, &out);
   }
 
   Bind(&out);
   return result;
@@ skipping 353 matching lines @@
     Node* const flags_intptr = var_flags.value();
 
     Variable var_offset(this, MachineType::PointerRepresentation());
     var_offset.Bind(
         IntPtrConstant(SeqOneByteString::kHeaderSize - kHeapObjectTag));
 
 #define CASE_FOR_FLAG(FLAG, CHAR)                              \
   do {                                                         \
     Label next(this);                                          \
     GotoUnless(IsSetWord(flags_intptr, FLAG), &next);          \
-    Node* const value = IntPtrConstant(CHAR);                  \
+    Node* const value = Int32Constant(CHAR);                   \
     StoreNoWriteBarrier(MachineRepresentation::kWord8, result, \
                         var_offset.value(), value);            \
     var_offset.Bind(IntPtrAdd(var_offset.value(), int_one));   \
     Goto(&next);                                               \
     Bind(&next);                                               \
   } while (false)
 
     CASE_FOR_FLAG(JSRegExp::kGlobal, 'g');
     CASE_FOR_FLAG(JSRegExp::kIgnoreCase, 'i');
     CASE_FOR_FLAG(JSRegExp::kMultiline, 'm');
     CASE_FOR_FLAG(JSRegExp::kUnicode, 'u');
     CASE_FOR_FLAG(JSRegExp::kSticky, 'y');
 #undef CASE_FOR_FLAG
 
     return result;
   }
 }
 
 // ES#sec-isregexp IsRegExp ( argument )
 Node* RegExpBuiltinsAssembler::IsRegExp(Node* const context,
                                         Node* const maybe_receiver) {
   Label out(this), if_isregexp(this);
 
-  Variable var_result(this, MachineType::PointerRepresentation());
-  var_result.Bind(IntPtrConstant(0));
+  Variable var_result(this, MachineRepresentation::kWord32);
+  var_result.Bind(Int32Constant(0));
 
   GotoIf(TaggedIsSmi(maybe_receiver), &out);
   GotoUnless(IsJSReceiver(maybe_receiver), &out);
 
   Node* const receiver = maybe_receiver;
 
   // Check @@match.
   {
     Callable getproperty_callable = CodeFactory::GetProperty(isolate());
     Node* const name = HeapConstant(isolate()->factory()->match_symbol());
     Node* const value = CallStub(getproperty_callable, context, receiver, name);
 
     Label match_isundefined(this), match_isnotundefined(this);
     Branch(IsUndefined(value), &match_isundefined, &match_isnotundefined);
 
     Bind(&match_isundefined);
     Branch(HasInstanceType(receiver, JS_REGEXP_TYPE), &if_isregexp, &out);
 
     Bind(&match_isnotundefined);
     BranchIfToBooleanIsTrue(value, &if_isregexp, &out);
   }
 
   Bind(&if_isregexp);
-  var_result.Bind(IntPtrConstant(1));
+  var_result.Bind(Int32Constant(1));
   Goto(&out);
 
   Bind(&out);
   return var_result.value();
 }
 
 // ES#sec-regexpinitialize
 // Runtime Semantics: RegExpInitialize ( obj, pattern, flags )
 Node* RegExpBuiltinsAssembler::RegExpInitialize(Node* const context,
                                                 Node* const regexp,
@@ skipping 326 matching lines @@
   Node* const receiver = Parameter(0);
   Return(receiver);
 }
 
 // Fast-path implementation for flag checks on an unmodified JSRegExp instance.
 Node* RegExpBuiltinsAssembler::FastFlagGetter(Node* const regexp,
                                               JSRegExp::Flag flag) {
   Node* const smi_zero = SmiConstant(Smi::kZero);
   Node* const flags = LoadObjectField(regexp, JSRegExp::kFlagsOffset);
   Node* const mask = SmiConstant(Smi::FromInt(flag));
-  Node* const is_flag_set = WordNotEqual(WordAnd(flags, mask), smi_zero);
+  Node* const is_flag_set = WordNotEqual(SmiAnd(flags, mask), smi_zero);
 
   return is_flag_set;
 }
 
 // Load through the GetProperty stub.
 Node* RegExpBuiltinsAssembler::SlowFlagGetter(Node* const context,
                                               Node* const regexp,
                                               JSRegExp::Flag flag) {
   Factory* factory = isolate()->factory();
 
   Label out(this);
-  Variable var_result(this, MachineType::PointerRepresentation());
+  Variable var_result(this, MachineRepresentation::kWord32);
 
   Node* name;
 
   switch (flag) {
     case JSRegExp::kGlobal:
       name = HeapConstant(factory->global_string());
       break;
     case JSRegExp::kIgnoreCase:
       name = HeapConstant(factory->ignoreCase_string());
       break;
@@ skipping 11 matching lines @@
   }
 
   Callable getproperty_callable = CodeFactory::GetProperty(isolate());
   Node* const value = CallStub(getproperty_callable, context, regexp, name);
 
   Label if_true(this), if_false(this);
   BranchIfToBooleanIsTrue(value, &if_true, &if_false);
 
   Bind(&if_true);
   {
-    var_result.Bind(IntPtrConstant(1));
+    var_result.Bind(Int32Constant(1));
     Goto(&out);
   }
 
   Bind(&if_false);
   {
-    var_result.Bind(IntPtrConstant(0));
+    var_result.Bind(Int32Constant(0));
     Goto(&out);
   }
 
   Bind(&out);
   return var_result.value();
 }
 
 Node* RegExpBuiltinsAssembler::FlagGetter(Node* const context,
                                           Node* const regexp,
                                           JSRegExp::Flag flag,
@@ skipping 1216 matching lines @@
       Bind(&if_isstring);
       {
         CSA_ASSERT(this, IsStringInstanceType(LoadInstanceType(elem)));
 
         Callable call_callable = CodeFactory::Call(isolate);
         Node* const replacement_obj =
             CallJS(call_callable, context, replace_callable, undefined, elem,
                    var_match_start.value(), string);
 
         Node* const replacement_str = ToString(context, replacement_obj);
-        StoreFixedArrayElement(res_elems, i, replacement_str);
+        StoreFixedArrayElement(res_elems, i, replacement_str,
+                               UPDATE_WRITE_BARRIER, 0, mode);
 
         Node* const elem_length = LoadStringLength(elem);
         Node* const new_match_start =
             SmiAdd(var_match_start.value(), elem_length);
         var_match_start.Bind(new_match_start);
 
         Goto(&loop_epilogue);
       }
 
       Bind(&loop_epilogue);
@@ skipping 169 matching lines @@
 }
 
 // ES#sec-regexp.prototype-@@replace
 // RegExp.prototype [ @@replace ] ( string, replaceValue )
 TF_BUILTIN(RegExpPrototypeReplace, RegExpBuiltinsAssembler) {
   Node* const maybe_receiver = Parameter(0);
   Node* const maybe_string = Parameter(1);
   Node* const replace_value = Parameter(2);
   Node* const context = Parameter(5);
 
-  Node* const int_zero = IntPtrConstant(0);
-
   // Ensure {maybe_receiver} is a JSReceiver.
   Node* const map = ThrowIfNotJSReceiver(
       context, maybe_receiver, MessageTemplate::kIncompatibleMethodReceiver,
       "RegExp.prototype.@@replace");
   Node* const receiver = maybe_receiver;
 
   // Convert {maybe_string} to a String.
   Callable tostring_callable = CodeFactory::ToString(isolate());
   Node* const string = CallStub(tostring_callable, context, maybe_string);
 
@@ skipping 11 matching lines @@
 
   Node* const replace_value_map = LoadMap(replace_value);
   Branch(IsCallableMap(replace_value_map), &if_iscallable, &checkreplacestring);
 
   // 3. Does ToString({replace_value}) contain '$'?
   Bind(&checkreplacestring);
   {
     Node* const replace_string =
         CallStub(tostring_callable, context, replace_value);
 
-    Node* const dollar_char = IntPtrConstant('$');
+    Node* const dollar_char = Int32Constant('$');
     Node* const smi_minusone = SmiConstant(Smi::FromInt(-1));
     GotoUnless(SmiEqual(StringIndexOfChar(context, replace_string, dollar_char,
-                                          int_zero),
+                                          SmiConstant(0)),
                         smi_minusone),
                &runtime);
 
     Return(
         ReplaceSimpleStringFastPath(context, regexp, string, replace_string));
   }
 
   // {regexp} is unmodified and {replace_value} is callable.
   Bind(&if_iscallable);
   {
@@ skipping 55 matching lines @@
   Bind(&if_matched);
   {
     Node* result =
         ConstructNewResultFromMatchInfo(context, match_indices, string);
     Return(result);
   }
 }
 
 }  // namespace internal
 }  // namespace v8