1 files changed, 34 insertions, 90 deletions

diff --git a/chromium/v8/src/compiler/access-builder.cc b/chromium/v8/src/compiler/access-builder.cc
index a369de48859..7a72be80284 100644
--- a/chromium/v8/src/compiler/access-builder.cc
+++ b/chromium/v8/src/compiler/access-builder.cc
@@ -32,18 +32,6 @@ FieldAccess AccessBuilder::ForExternalTaggedValue() {
 }
 
 // static
-FieldAccess AccessBuilder::ForExternalUint8Value() {
-  FieldAccess access = {kUntaggedBase,
-                        0,
-                        MaybeHandle<Name>(),
-                        MaybeHandle<Map>(),
-                        TypeCache::Get()->kUint8,
-                        MachineType::Uint8(),
-                        kNoWriteBarrier};
-  return access;
-}
-
-// static
 FieldAccess AccessBuilder::ForMap() {
   FieldAccess access = {
       kTaggedBase,           HeapObject::kMapOffset,
@@ -94,9 +82,19 @@ FieldAccess AccessBuilder::ForBigIntLeastSignificantDigit64() {
 // static
 FieldAccess AccessBuilder::ForJSObjectPropertiesOrHash() {
   FieldAccess access = {
+      kTaggedBase,         JSObject::kPropertiesOrHashOffset,
+      MaybeHandle<Name>(), MaybeHandle<Map>(),
+      Type::Any(),         MachineType::TypeCompressedTagged(),
+      kFullWriteBarrier,   LoadSensitivity::kCritical};
+  return access;
+}
+
+// static
+FieldAccess AccessBuilder::ForJSObjectPropertiesOrHashKnownPointer() {
+  FieldAccess access = {
       kTaggedBase,          JSObject::kPropertiesOrHashOffset,
       MaybeHandle<Name>(),  MaybeHandle<Map>(),
-      Type::Any(),          MachineType::TypeCompressedTagged(),
+      Type::Any(),          MachineType::TypeCompressedTaggedPointer(),
       kPointerWriteBarrier, LoadSensitivity::kCritical};
   return access;
 }
@@ -172,8 +170,8 @@ FieldAccess AccessBuilder::ForJSFunctionPrototypeOrInitialMap() {
   FieldAccess access = {
       kTaggedBase,         JSFunction::kPrototypeOrInitialMapOffset,
       MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::Any(),         MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
+      Type::Any(),         MachineType::TypeCompressedTaggedPointer(),
+      kPointerWriteBarrier};
   return access;
 }
 
@@ -182,7 +180,7 @@ FieldAccess AccessBuilder::ForJSFunctionContext() {
   FieldAccess access = {
       kTaggedBase,         JSFunction::kContextOffset,
       MaybeHandle<Name>(), MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTagged(),
+      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -304,7 +302,7 @@ FieldAccess AccessBuilder::ForJSGeneratorObjectParametersAndRegisters() {
   FieldAccess access = {
       kTaggedBase,         JSGeneratorObject::kParametersAndRegistersOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTagged(),
+      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
       kPointerWriteBarrier};
   return access;
 }
@@ -325,7 +323,7 @@ FieldAccess AccessBuilder::ForJSAsyncFunctionObjectPromise() {
       kTaggedBase,         JSAsyncFunctionObject::kPromiseOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
       Type::OtherObject(), MachineType::TypeCompressedTaggedPointer(),
-      kFullWriteBarrier};
+      kPointerWriteBarrier};
   return access;
 }
 
@@ -357,29 +355,20 @@ FieldAccess AccessBuilder::ForJSArrayLength(ElementsKind elements_kind) {
                         Handle<Name>(),
                         MaybeHandle<Map>(),
                         type_cache->kJSArrayLengthType,
-                        MachineType::TypeCompressedTaggedSigned(),
+                        MachineType::TypeCompressedTagged(),
                         kFullWriteBarrier};
   if (IsDoubleElementsKind(elements_kind)) {
     access.type = type_cache->kFixedDoubleArrayLengthType;
+    access.machine_type = MachineType::TypeCompressedTaggedSigned();
     access.write_barrier_kind = kNoWriteBarrier;
   } else if (IsFastElementsKind(elements_kind)) {
     access.type = type_cache->kFixedArrayLengthType;
+    access.machine_type = MachineType::TypeCompressedTaggedSigned();
     access.write_barrier_kind = kNoWriteBarrier;
   }
   return access;
 }
 
-
-// static
-FieldAccess AccessBuilder::ForJSArrayBufferBackingStore() {
-  FieldAccess access = {
-      kTaggedBase,           JSArrayBuffer::kBackingStoreOffset,
-      MaybeHandle<Name>(),   MaybeHandle<Map>(),
-      Type::OtherInternal(), MachineType::Pointer(),
-      kNoWriteBarrier};
-  return access;
-}
-
 // static
 FieldAccess AccessBuilder::ForJSArrayBufferBitField() {
   FieldAccess access = {
@@ -441,7 +430,7 @@ FieldAccess AccessBuilder::ForJSTypedArrayBasePointer() {
       kTaggedBase,           JSTypedArray::kBasePointerOffset,
       MaybeHandle<Name>(),   MaybeHandle<Map>(),
       Type::OtherInternal(), MachineType::TypeCompressedTagged(),
-      kPointerWriteBarrier,  LoadSensitivity::kCritical};
+      kFullWriteBarrier,     LoadSensitivity::kCritical};
   return access;
 }
 
@@ -747,20 +736,6 @@ FieldAccess AccessBuilder::ForExternalStringResourceData() {
 }
 
 // static
-ElementAccess AccessBuilder::ForExternalOneByteStringCharacter() {
-  ElementAccess access = {kUntaggedBase, 0, TypeCache::Get()->kUint8,
-                          MachineType::Uint8(), kNoWriteBarrier};
-  return access;
-}
-
-// static
-ElementAccess AccessBuilder::ForExternalTwoByteStringCharacter() {
-  ElementAccess access = {kUntaggedBase, 0, TypeCache::Get()->kUint16,
-                          MachineType::Uint16(), kNoWriteBarrier};
-  return access;
-}
-
-// static
 ElementAccess AccessBuilder::ForSeqOneByteStringCharacter() {
   ElementAccess access = {kTaggedBase, SeqOneByteString::kHeaderSize,
                           TypeCache::Get()->kUint8, MachineType::Uint8(),
@@ -777,26 +752,6 @@ ElementAccess AccessBuilder::ForSeqTwoByteStringCharacter() {
 }
 
 // static
-FieldAccess AccessBuilder::ForJSGlobalObjectGlobalProxy() {
-  FieldAccess access = {
-      kTaggedBase,         JSGlobalObject::kGlobalProxyOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Receiver(),    MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
-  return access;
-}
-
-// static
-FieldAccess AccessBuilder::ForJSGlobalObjectNativeContext() {
-  FieldAccess access = {
-      kTaggedBase,         JSGlobalObject::kNativeContextOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::Internal(),    MachineType::TypeCompressedTaggedPointer(),
-      kPointerWriteBarrier};
-  return access;
-}
-
-// static
 FieldAccess AccessBuilder::ForJSGlobalProxyNativeContext() {
   FieldAccess access = {
       kTaggedBase,         JSGlobalProxy::kNativeContextOffset,
@@ -865,17 +820,6 @@ FieldAccess AccessBuilder::ForJSStringIteratorIndex() {
 }
 
 // static
-FieldAccess AccessBuilder::ForValue() {
-  FieldAccess access = {
-      kTaggedBase,         JSPrimitiveWrapper::kValueOffset,
-      Handle<Name>(),      MaybeHandle<Map>(),
-      Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kFullWriteBarrier};
-  return access;
-}
-
-
-// static
 FieldAccess AccessBuilder::ForArgumentsLength() {
   FieldAccess access = {
       kTaggedBase,         JSArgumentsObjectWithLength::kLengthOffset,
@@ -892,7 +836,7 @@ FieldAccess AccessBuilder::ForArgumentsCallee() {
       kTaggedBase,         JSSloppyArgumentsObject::kCalleeOffset,
       Handle<Name>(),      MaybeHandle<Map>(),
       Type::NonInternal(), MachineType::TypeCompressedTagged(),
-      kPointerWriteBarrier};
+      kFullWriteBarrier};
   return access;
 }
 
@@ -931,6 +875,19 @@ FieldAccess AccessBuilder::ForContextSlot(size_t index) {
 }
 
 // static
+FieldAccess AccessBuilder::ForContextSlotKnownPointer(size_t index) {
+  int offset = Context::OffsetOfElementAt(static_cast<int>(index));
+  DCHECK_EQ(offset,
+            Context::SlotOffset(static_cast<int>(index)) + kHeapObjectTag);
+  FieldAccess access = {
+      kTaggedBase,         offset,
+      Handle<Name>(),      MaybeHandle<Map>(),
+      Type::Any(),         MachineType::TypeCompressedTaggedPointer(),
+      kPointerWriteBarrier};
+  return access;
+}
+
+// static
 ElementAccess AccessBuilder::ForFixedArrayElement() {
   ElementAccess access = {kTaggedBase, FixedArray::kHeaderSize, Type::Any(),
                           MachineType::TypeCompressedTagged(),
@@ -1189,19 +1146,6 @@ ElementAccess AccessBuilder::ForOrderedHashMapEntryValue() {
 }
 
 // static
-FieldAccess AccessBuilder::ForDictionaryMaxNumberKey() {
-  FieldAccess access = {
-      kTaggedBase,
-      FixedArray::OffsetOfElementAt(NumberDictionary::kMaxNumberKeyIndex),
-      MaybeHandle<Name>(),
-      MaybeHandle<Map>(),
-      Type::Any(),
-      MachineType::TypeCompressedTagged(),
-      kNoWriteBarrier};
-  return access;
-}
-
-// static
 FieldAccess AccessBuilder::ForDictionaryNextEnumerationIndex() {
   FieldAccess access = {
       kTaggedBase,