deps: update V8 to 7.8.279.9

PR-URL: https://github.com/nodejs/node/pull/29694
Reviewed-By: Colin Ihrig <cjihrig@gmail.com>
Reviewed-By: Anna Henningsen <anna@addaleax.net>
Reviewed-By: Gus Caplan <me@gus.host>
Reviewed-By: Jiawen Geng <technicalcute@gmail.com>
Reviewed-By: Michaël Zasso <targos@protonmail.com>
Reviewed-By: Tobias Nießen <tniessen@tnie.de>
Reviewed-By: Ujjwal Sharma <usharma1998@gmail.com>

1 files changed, 400 insertions, 403 deletions

diff --git a/deps/v8/src/ic/accessor-assembler.cc b/deps/v8/src/ic/accessor-assembler.cc
index 7aebf857a2..f9efcba05f 100644
--- a/deps/v8/src/ic/accessor-assembler.cc
+++ b/deps/v8/src/ic/accessor-assembler.cc
@@ -35,7 +35,7 @@ TNode<MaybeObject> AccessorAssembler::LoadHandlerDataField(
     SloppyTNode<DataHandler> handler, int data_index) {
 #ifdef DEBUG
   TNode<Map> handler_map = LoadMap(handler);
-  TNode<Int32T> instance_type = LoadMapInstanceType(handler_map);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(handler_map);
 #endif
   CSA_ASSERT(this,
              Word32Or(InstanceTypeEqual(instance_type, LOAD_HANDLER_TYPE),
@@ -78,7 +78,8 @@ TNode<MaybeObject> AccessorAssembler::TryMonomorphicCase(
   // Adding |header_size| with a separate IntPtrAdd rather than passing it
   // into ElementOffsetFromIndex() allows it to be folded into a single
   // [base, index, offset] indirect memory access on x64.
-  Node* offset = ElementOffsetFromIndex(slot, HOLEY_ELEMENTS, SMI_PARAMETERS);
+  TNode<IntPtrT> offset =
+      ElementOffsetFromIndex(slot, HOLEY_ELEMENTS, SMI_PARAMETERS);
   TNode<MaybeObject> feedback = ReinterpretCast<MaybeObject>(
       Load(MachineType::AnyTagged(), vector,
            IntPtrAdd(offset, IntPtrConstant(header_size))));
@@ -207,7 +208,7 @@ void AccessorAssembler::HandleLoadAccessor(
 
   CSA_ASSERT(this, IsWeakOrCleared(maybe_context));
   CSA_CHECK(this, IsNotCleared(maybe_context));
-  TNode<Object> context = GetHeapObjectAssumeWeak(maybe_context);
+  TNode<HeapObject> context = GetHeapObjectAssumeWeak(maybe_context);
 
   TNode<Foreign> foreign = CAST(
       LoadObjectField(call_handler_info, CallHandlerInfo::kJsCallbackOffset));
@@ -241,8 +242,9 @@ void AccessorAssembler::HandleLoadField(Node* holder, Node* handler_word,
                                         Label* rebox_double,
                                         ExitPoint* exit_point) {
   Comment("field_load");
-  Node* index = DecodeWord<LoadHandler::FieldIndexBits>(handler_word);
-  Node* offset = IntPtrMul(index, IntPtrConstant(kTaggedSize));
+  TNode<IntPtrT> index =
+      Signed(DecodeWord<LoadHandler::FieldIndexBits>(handler_word));
+  TNode<IntPtrT> offset = IntPtrMul(index, IntPtrConstant(kTaggedSize));
 
   Label inobject(this), out_of_object(this);
   Branch(IsSetWord<LoadHandler::IsInobjectBits>(handler_word), &inobject,
@@ -259,8 +261,8 @@ void AccessorAssembler::HandleLoadField(Node* holder, Node* handler_word,
       var_double_value->Bind(
           LoadObjectField(holder, offset, MachineType::Float64()));
     } else {
-      Node* mutable_heap_number = LoadObjectField(holder, offset);
-      var_double_value->Bind(LoadHeapNumberValue(mutable_heap_number));
+      TNode<HeapNumber> heap_number = CAST(LoadObjectField(holder, offset));
+      var_double_value->Bind(LoadHeapNumberValue(heap_number));
     }
     Goto(rebox_double);
   }
@@ -268,13 +270,13 @@ void AccessorAssembler::HandleLoadField(Node* holder, Node* handler_word,
   BIND(&out_of_object);
   {
     Label is_double(this);
-    Node* properties = LoadFastProperties(holder);
-    Node* value = LoadObjectField(properties, offset);
+    TNode<HeapObject> properties = LoadFastProperties(holder);
+    TNode<Object> value = LoadObjectField(properties, offset);
     GotoIf(IsSetWord<LoadHandler::IsDoubleBits>(handler_word), &is_double);
     exit_point->Return(value);
 
     BIND(&is_double);
-    var_double_value->Bind(LoadHeapNumberValue(value));
+    var_double_value->Bind(LoadHeapNumberValue(CAST(value)));
     Goto(rebox_double);
   }
 }
@@ -298,9 +300,10 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
   VARIABLE(var_double_value, MachineRepresentation::kFloat64);
   Label rebox_double(this, &var_double_value);
 
-  TNode<WordT> handler_word = SmiUntag(smi_handler);
+  TNode<IntPtrT> handler_word = SmiUntag(smi_handler);
   TNode<IntPtrT> handler_kind =
       Signed(DecodeWord<LoadHandler::KindBits>(handler_word));
+
   if (support_elements == kSupportElements) {
     Label if_element(this), if_indexed_string(this), if_property(this);
     GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kElement)),
@@ -319,10 +322,10 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
 
     BIND(&if_element);
     Comment("element_load");
-    Node* intptr_index = TryToIntptr(p->name(), miss);
-    Node* is_jsarray_condition =
+    TNode<IntPtrT> intptr_index = TryToIntptr(p->name(), miss);
+    TNode<BoolT> is_jsarray_condition =
         IsSetWord<LoadHandler::IsJsArrayBits>(handler_word);
-    Node* elements_kind =
+    TNode<Uint32T> elements_kind =
         DecodeWord32FromWord<LoadHandler::ElementsKindBits>(handler_word);
     Label if_hole(this), unimplemented_elements_kind(this),
         if_oob(this, Label::kDeferred);
@@ -345,7 +348,7 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
       Label return_undefined(this);
 
       // Check if we're allowed to handle OOB accesses.
-      Node* allow_out_of_bounds =
+      TNode<BoolT> allow_out_of_bounds =
           IsSetWord<LoadHandler::AllowOutOfBoundsBits>(handler_word);
       GotoIfNot(allow_out_of_bounds, miss);
 
@@ -385,15 +388,15 @@ void AccessorAssembler::HandleLoadICSmiHandlerCase(
         Label if_oob(this, Label::kDeferred);
 
         Comment("indexed string");
-        Node* intptr_index = TryToIntptr(p->name(), miss);
-        Node* length = LoadStringLengthAsWord(holder);
+        TNode<IntPtrT> intptr_index = TryToIntptr(p->name(), miss);
+        TNode<IntPtrT> length = LoadStringLengthAsWord(holder);
         GotoIf(UintPtrGreaterThanOrEqual(intptr_index, length), &if_oob);
         TNode<Int32T> code = StringCharCodeAt(holder, intptr_index);
         TNode<String> result = StringFromSingleCharCode(code);
         Return(result);
 
         BIND(&if_oob);
-        Node* allow_out_of_bounds =
+        TNode<BoolT> allow_out_of_bounds =
             IsSetWord<LoadHandler::AllowOutOfBoundsBits>(handler_word);
         GotoIfNot(allow_out_of_bounds, miss);
         GotoIf(IsNoElementsProtectorCellInvalid(), miss);
@@ -426,9 +429,11 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
       module_export(this, Label::kDeferred), proxy(this, Label::kDeferred),
       native_data_property(this, Label::kDeferred),
       api_getter(this, Label::kDeferred);
+
   GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kField)), &field);
 
-  GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kConstant)),
+  GotoIf(WordEqual(handler_kind,
+                   IntPtrConstant(LoadHandler::kConstantFromPrototype)),
          &constant);
 
   GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kNonExistent)),
@@ -476,11 +481,7 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
   BIND(&constant);
   {
     Comment("constant_load");
-    TNode<IntPtrT> descriptor =
-        Signed(DecodeWord<LoadHandler::DescriptorBits>(handler_word));
-    Node* value = LoadDescriptorValue(LoadMap(holder), descriptor);
-
-    exit_point->Return(value);
+    exit_point->Return(holder);
   }
 
   BIND(&normal);
@@ -497,8 +498,9 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
       VARIABLE(var_value, MachineRepresentation::kTagged);
       LoadPropertyFromNameDictionary(properties, var_name_index.value(),
                                      &var_details, &var_value);
-      Node* value = CallGetterIfAccessor(var_value.value(), var_details.value(),
-                                         p->context(), p->receiver(), miss);
+      TNode<Object> value =
+          CallGetterIfAccessor(var_value.value(), var_details.value(),
+                               p->context(), p->receiver(), miss);
       exit_point->Return(value);
     }
   }
@@ -508,9 +510,10 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
     Comment("accessor_load");
     TNode<IntPtrT> descriptor =
         Signed(DecodeWord<LoadHandler::DescriptorBits>(handler_word));
-    Node* accessor_pair = LoadDescriptorValue(LoadMap(holder), descriptor);
-    CSA_ASSERT(this, IsAccessorPair(accessor_pair));
-    Node* getter = LoadObjectField(accessor_pair, AccessorPair::kGetterOffset);
+    TNode<AccessorPair> accessor_pair =
+        CAST(LoadDescriptorValue(LoadMap(holder), descriptor));
+    TNode<Object> getter =
+        LoadObjectField(accessor_pair, AccessorPair::kGetterOffset);
     CSA_ASSERT(this, Word32BinaryNot(IsTheHole(getter)));
 
     Callable callable = CodeFactory::Call(isolate());
@@ -567,8 +570,8 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
   {
     CSA_ASSERT(this, IsPropertyCell(holder));
     // Ensure the property cell doesn't contain the hole.
-    Node* value = LoadObjectField(holder, PropertyCell::kValueOffset);
-    Node* details = LoadAndUntagToWord32ObjectField(
+    TNode<Object> value = LoadObjectField(holder, PropertyCell::kValueOffset);
+    TNode<Int32T> details = LoadAndUntagToWord32ObjectField(
         holder, PropertyCell::kPropertyDetailsRawOffset);
     GotoIf(IsTheHole(value), miss);
 
@@ -587,15 +590,15 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
   BIND(&module_export);
   {
     Comment("module export");
-    Node* index = DecodeWord<LoadHandler::ExportsIndexBits>(handler_word);
+    TNode<UintPtrT> index =
+        DecodeWord<LoadHandler::ExportsIndexBits>(handler_word);
     Node* module =
         LoadObjectField(p->receiver(), JSModuleNamespace::kModuleOffset,
                         MachineType::TaggedPointer());
     TNode<ObjectHashTable> exports = CAST(LoadObjectField(
         module, Module::kExportsOffset, MachineType::TaggedPointer()));
-    Node* cell = LoadFixedArrayElement(exports, index);
+    TNode<Cell> cell = CAST(LoadFixedArrayElement(exports, index));
     // The handler is only installed for exports that exist.
-    CSA_ASSERT(this, IsCell(cell));
     Node* value = LoadCellValue(cell);
     Label is_the_hole(this, Label::kDeferred);
     GotoIf(IsTheHole(value), &is_the_hole);
@@ -603,7 +606,7 @@ void AccessorAssembler::HandleLoadICSmiHandlerLoadNamedCase(
 
     BIND(&is_the_hole);
     {
-      Node* message = SmiConstant(MessageTemplate::kNotDefined);
+      TNode<Smi> message = SmiConstant(MessageTemplate::kNotDefined);
       exit_point->ReturnCallRuntime(Runtime::kThrowReferenceError, p->context(),
                                     message, p->name());
     }
@@ -622,7 +625,8 @@ void AccessorAssembler::HandleLoadICSmiHandlerHasNamedCase(
   GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kField)),
          &return_true);
 
-  GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kConstant)),
+  GotoIf(WordEqual(handler_kind,
+                   IntPtrConstant(LoadHandler::kConstantFromPrototype)),
          &return_true);
 
   GotoIf(WordEqual(handler_kind, IntPtrConstant(LoadHandler::kNonExistent)),
@@ -686,7 +690,7 @@ void AccessorAssembler::HandleLoadICSmiHandlerHasNamedCase(
   {
     CSA_ASSERT(this, IsPropertyCell(holder));
     // Ensure the property cell doesn't contain the hole.
-    Node* value = LoadObjectField(holder, PropertyCell::kValueOffset);
+    TNode<Object> value = LoadObjectField(holder, PropertyCell::kValueOffset);
     GotoIf(IsTheHole(value), miss);
 
     exit_point->Return(TrueConstant());
@@ -719,7 +723,7 @@ Node* AccessorAssembler::HandleProtoHandler(
   // Check prototype validity cell.
   //
   {
-    Node* maybe_validity_cell =
+    TNode<Object> maybe_validity_cell =
         LoadObjectField(handler, ICHandler::kValidityCellOffset);
     CheckPrototypeValidityCell(maybe_validity_cell, miss);
   }
@@ -728,20 +732,18 @@ Node* AccessorAssembler::HandleProtoHandler(
   // Check smi handler bits.
   //
   {
-    Node* smi_or_code_handler =
+    TNode<Object> smi_or_code_handler =
         LoadObjectField(handler, ICHandler::kSmiHandlerOffset);
     if (on_code_handler) {
       Label if_smi_handler(this);
       GotoIf(TaggedIsSmi(smi_or_code_handler), &if_smi_handler);
 
-      CSA_ASSERT(this, IsCodeMap(LoadMap(smi_or_code_handler)));
+      CSA_ASSERT(this, IsCodeMap(LoadMap(CAST(smi_or_code_handler))));
       on_code_handler(smi_or_code_handler);
 
       BIND(&if_smi_handler);
-    } else {
-      CSA_ASSERT(this, TaggedIsSmi(smi_or_code_handler));
     }
-    Node* handler_flags = SmiUntag(smi_or_code_handler);
+    TNode<IntPtrT> handler_flags = SmiUntag(CAST(smi_or_code_handler));
 
     // Lookup on receiver and access checks are not necessary for global ICs
     // because in the former case the validity cell check guards modifications
@@ -767,8 +769,8 @@ Node* AccessorAssembler::HandleProtoHandler(
       {
         TNode<MaybeObject> data2 = LoadHandlerDataField(handler, 2);
         CSA_ASSERT(this, IsWeakOrCleared(data2));
-        TNode<Object> expected_native_context =
-            GetHeapObjectAssumeWeak(data2, miss);
+        TNode<Context> expected_native_context =
+            CAST(GetHeapObjectAssumeWeak(data2, miss));
         EmitAccessCheck(expected_native_context, p->context(), p->receiver(),
                         &done, miss);
       }
@@ -824,7 +826,7 @@ void AccessorAssembler::HandleLoadICProtoHandler(
           VARIABLE(var_value, MachineRepresentation::kTagged);
           LoadPropertyFromNameDictionary(properties, name_index, &var_details,
                                          &var_value);
-          Node* value =
+          TNode<Object> value =
               CallGetterIfAccessor(var_value.value(), var_details.value(),
                                    p->context(), p->receiver(), miss);
           exit_point->Return(value);
@@ -832,21 +834,38 @@ void AccessorAssembler::HandleLoadICProtoHandler(
       },
       miss, ic_mode);
 
-  TNode<MaybeObject> maybe_holder = LoadHandlerDataField(handler, 1);
+  TNode<MaybeObject> maybe_holder_or_constant =
+      LoadHandlerDataField(handler, 1);
 
-  Label load_from_cached_holder(this), done(this);
+  Label load_from_cached_holder(this), is_smi(this), done(this);
 
-  Branch(IsStrongReferenceTo(maybe_holder, NullConstant()), &done,
+  GotoIf(TaggedIsSmi(maybe_holder_or_constant), &is_smi);
+  Branch(IsStrongReferenceTo(maybe_holder_or_constant, NullConstant()), &done,
          &load_from_cached_holder);
 
-  BIND(&load_from_cached_holder);
+  BIND(&is_smi);
   {
-    // For regular holders, having passed the receiver map check and the
-    // validity cell check implies that |holder| is alive. However, for global
-    // object receivers, |maybe_holder| may be cleared.
-    CSA_ASSERT(this, IsWeakOrCleared(maybe_holder));
-    Node* holder = GetHeapObjectAssumeWeak(maybe_holder, miss);
+    CSA_ASSERT(
+        this,
+        WordEqual(
+            Signed(DecodeWord<LoadHandler::KindBits>(SmiUntag(smi_handler))),
+            IntPtrConstant(LoadHandler::kConstantFromPrototype)));
+    if (access_mode == LoadAccessMode::kHas) {
+      exit_point->Return(TrueConstant());
+    } else {
+      exit_point->Return(maybe_holder_or_constant);
+    }
+  }
 
+  BIND(&load_from_cached_holder);
+  {
+    // For regular holders, having passed the receiver map check and
+    // the validity cell check implies that |holder| is
+    // alive. However, for global object receivers, |maybe_holder| may
+    // be cleared.
+    CSA_ASSERT(this, IsWeakOrCleared(maybe_holder_or_constant));
+    TNode<HeapObject> holder =
+        GetHeapObjectAssumeWeak(maybe_holder_or_constant, miss);
     var_holder->Bind(holder);
     Goto(&done);
   }
@@ -858,22 +877,22 @@ void AccessorAssembler::HandleLoadICProtoHandler(
   }
 }
 
-void AccessorAssembler::EmitAccessCheck(Node* expected_native_context,
-                                        Node* context, Node* receiver,
+void AccessorAssembler::EmitAccessCheck(TNode<Context> expected_native_context,
+                                        TNode<Context> context, Node* receiver,
                                         Label* can_access, Label* miss) {
   CSA_ASSERT(this, IsNativeContext(expected_native_context));
 
-  Node* native_context = LoadNativeContext(context);
-  GotoIf(WordEqual(expected_native_context, native_context), can_access);
+  TNode<Context> native_context = LoadNativeContext(context);
+  GotoIf(TaggedEqual(expected_native_context, native_context), can_access);
   // If the receiver is not a JSGlobalProxy then we miss.
   GotoIfNot(IsJSGlobalProxy(receiver), miss);
   // For JSGlobalProxy receiver try to compare security tokens of current
   // and expected native contexts.
-  Node* expected_token = LoadContextElement(expected_native_context,
-                                            Context::SECURITY_TOKEN_INDEX);
-  Node* current_token =
+  TNode<Object> expected_token = LoadContextElement(
+      expected_native_context, Context::SECURITY_TOKEN_INDEX);
+  TNode<Object> current_token =
       LoadContextElement(native_context, Context::SECURITY_TOKEN_INDEX);
-  Branch(WordEqual(expected_token, current_token), can_access, miss);
+  Branch(TaggedEqual(expected_token, current_token), can_access, miss);
 }
 
 void AccessorAssembler::JumpIfDataProperty(Node* details, Label* writable,
@@ -886,7 +905,7 @@ void AccessorAssembler::JumpIfDataProperty(Node* details, Label* writable,
     CSA_ASSERT(this, IsNotSetWord32(details,
                                     PropertyDetails::kAttributesReadOnlyMask));
   }
-  Node* kind = DecodeWord32<PropertyDetails::KindField>(details);
+  TNode<Uint32T> kind = DecodeWord32<PropertyDetails::KindField>(details);
   GotoIf(Word32Equal(kind, Int32Constant(kData)), writable);
   // Fall through if it's an accessor property.
 }
@@ -896,8 +915,8 @@ void AccessorAssembler::HandleStoreICNativeDataProperty(
   Comment("native_data_property_store");
   TNode<IntPtrT> descriptor =
       Signed(DecodeWord<StoreHandler::DescriptorBits>(handler_word));
-  Node* accessor_info = LoadDescriptorValue(LoadMap(holder), descriptor);
-  CSA_CHECK(this, IsAccessorInfo(accessor_info));
+  TNode<AccessorInfo> accessor_info =
+      CAST(LoadDescriptorValue(LoadMap(holder), descriptor));
 
   TailCallRuntime(Runtime::kStoreCallbackProperty, p->context(), p->receiver(),
                   holder, accessor_info, p->name(), p->value());
@@ -917,7 +936,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
   BIND(&if_smi_handler);
   {
     Node* holder = p->receiver();
-    Node* handler_word = SmiUntag(CAST(handler));
+    TNode<IntPtrT> handler_word = SmiUntag(CAST(handler));
 
     Label if_fast_smi(this), if_proxy(this);
 
@@ -925,7 +944,8 @@ void AccessorAssembler::HandleStoreICHandlerCase(
     STATIC_ASSERT(StoreHandler::kNormal + 1 == StoreHandler::kProxy);
     STATIC_ASSERT(StoreHandler::kProxy + 1 == StoreHandler::kKindsNumber);
 
-    Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
+    TNode<UintPtrT> handler_kind =
+        DecodeWord<StoreHandler::KindBits>(handler_word);
     GotoIf(IntPtrLessThan(handler_kind,
                           IntPtrConstant(StoreHandler::kGlobalProxy)),
            &if_fast_smi);
@@ -941,7 +961,7 @@ void AccessorAssembler::HandleStoreICHandlerCase(
         properties, CAST(p->name()), &dictionary_found, &var_name_index, miss);
     BIND(&dictionary_found);
     {
-      Node* details = LoadDetailsByKeyIndex<NameDictionary>(
+      TNode<Uint32T> details = LoadDetailsByKeyIndex<NameDictionary>(
           properties, var_name_index.value());
       // Check that the property is a writable data property (no accessor).
       const int kTypeAndReadOnlyMask = PropertyDetails::KindField::kMask |
@@ -956,7 +976,8 @@ void AccessorAssembler::HandleStoreICHandlerCase(
 
     BIND(&if_fast_smi);
     {
-      Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
+      TNode<UintPtrT> handler_kind =
+          DecodeWord<StoreHandler::KindBits>(handler_word);
 
       Label data(this), accessor(this), native_data_property(this);
       GotoIf(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kAccessor)),
@@ -1034,7 +1055,7 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
     StoreTransitionMapFlags flags) {
   DCHECK_EQ(0, flags & ~kStoreTransitionMapFlagsMask);
   if (flags & kCheckPrototypeValidity) {
-    Node* maybe_validity_cell =
+    TNode<Object> maybe_validity_cell =
         LoadObjectField(transition_map, Map::kPrototypeValidityCellOffset);
     CheckPrototypeValidityCell(maybe_validity_cell, miss);
   }
@@ -1044,21 +1065,22 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
   GotoIf(IsSetWord32<Map::IsDeprecatedBit>(bitfield3), miss);
 
   // Load last descriptor details.
-  Node* nof = DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
+  TNode<UintPtrT> nof =
+      DecodeWordFromWord32<Map::NumberOfOwnDescriptorsBits>(bitfield3);
   CSA_ASSERT(this, WordNotEqual(nof, IntPtrConstant(0)));
   TNode<DescriptorArray> descriptors = LoadMapDescriptors(transition_map);
 
-  Node* factor = IntPtrConstant(DescriptorArray::kEntrySize);
+  TNode<IntPtrT> factor = IntPtrConstant(DescriptorArray::kEntrySize);
   TNode<IntPtrT> last_key_index = UncheckedCast<IntPtrT>(IntPtrAdd(
       IntPtrConstant(DescriptorArray::ToKeyIndex(-1)), IntPtrMul(nof, factor)));
   if (flags & kValidateTransitionHandler) {
     TNode<Name> key = LoadKeyByKeyIndex(descriptors, last_key_index);
-    GotoIf(WordNotEqual(key, p->name()), miss);
+    GotoIf(TaggedNotEqual(key, p->name()), miss);
   } else {
-    CSA_ASSERT(this, WordEqual(LoadKeyByKeyIndex(descriptors, last_key_index),
-                               p->name()));
+    CSA_ASSERT(this, TaggedEqual(LoadKeyByKeyIndex(descriptors, last_key_index),
+                                 p->name()));
   }
-  Node* details = LoadDetailsByKeyIndex(descriptors, last_key_index);
+  TNode<Uint32T> details = LoadDetailsByKeyIndex(descriptors, last_key_index);
   if (flags & kValidateTransitionHandler) {
     // Follow transitions only in the following cases:
     // 1) name is a non-private symbol and attributes equal to NONE,
@@ -1077,7 +1099,7 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
     // DontEnum attribute is allowed only for private symbols and vice versa.
     Branch(Word32Equal(
                IsSetWord32(details, PropertyDetails::kAttributesDontEnumMask),
-               IsPrivateSymbol(p->name())),
+               IsPrivateSymbol(CAST(p->name()))),
            &attributes_ok, miss);
 
     BIND(&attributes_ok);
@@ -1089,7 +1111,8 @@ void AccessorAssembler::HandleStoreICTransitionMapHandlerCase(
 }
 
 void AccessorAssembler::CheckFieldType(TNode<DescriptorArray> descriptors,
-                                       Node* name_index, Node* representation,
+                                       Node* name_index,
+                                       TNode<Word32T> representation,
                                        Node* value, Label* bailout) {
   Label r_smi(this), r_double(this), r_heapobject(this), all_fine(this);
   // Ignore FLAG_track_fields etc. and always emit code for all checks,
@@ -1114,12 +1137,7 @@ void AccessorAssembler::CheckFieldType(TNode<DescriptorArray> descriptors,
   BIND(&r_double);
   {
     GotoIf(TaggedIsSmi(value), &all_fine);
-    Node* value_map = LoadMap(value);
-    // While supporting mutable HeapNumbers would be straightforward, such
-    // objects should not end up here anyway.
-    CSA_ASSERT(this, WordNotEqual(value_map,
-                                  LoadRoot(RootIndex::kMutableHeapNumberMap)));
-    Branch(IsHeapNumberMap(value_map), &all_fine, bailout);
+    Branch(IsHeapNumber(value), &all_fine, bailout);
   }
 
   BIND(&r_heapobject);
@@ -1144,7 +1162,7 @@ void AccessorAssembler::CheckFieldType(TNode<DescriptorArray> descriptors,
     TNode<Map> field_type_map =
         CAST(GetHeapObjectAssumeWeak(field_type, bailout));
     // FieldType::Class(...) performs a map check.
-    Branch(WordEqual(LoadMap(value), field_type_map), &all_fine, bailout);
+    Branch(TaggedEqual(LoadMap(value), field_type_map), &all_fine, bailout);
   }
 
   BIND(&all_fine);
@@ -1157,8 +1175,8 @@ TNode<BoolT> AccessorAssembler::IsPropertyDetailsConst(Node* details) {
 
 void AccessorAssembler::OverwriteExistingFastDataProperty(
     Node* object, Node* object_map, Node* descriptors,
-    Node* descriptor_name_index, Node* details, Node* value, Label* slow,
-    bool do_transitioning_store) {
+    Node* descriptor_name_index, Node* details, TNode<Object> value,
+    Label* slow, bool do_transitioning_store) {
   Label done(this), if_field(this), if_descriptor(this);
 
   CSA_ASSERT(this,
@@ -1171,17 +1189,19 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
 
   BIND(&if_field);
   {
-    Node* representation =
+    TNode<Uint32T> representation =
         DecodeWord32<PropertyDetails::RepresentationField>(details);
 
     CheckFieldType(CAST(descriptors), descriptor_name_index, representation,
                    value, slow);
 
-    Node* field_index =
+    TNode<UintPtrT> field_index =
         DecodeWordFromWord32<PropertyDetails::FieldIndexField>(details);
-    field_index = IntPtrAdd(field_index,
-                            LoadMapInobjectPropertiesStartInWords(object_map));
-    Node* instance_size_in_words = LoadMapInstanceSizeInWords(object_map);
+    field_index = Unsigned(
+        IntPtrAdd(field_index,
+                  Unsigned(LoadMapInobjectPropertiesStartInWords(object_map))));
+    TNode<IntPtrT> instance_size_in_words =
+        LoadMapInstanceSizeInWords(object_map);
 
     Label inobject(this), backing_store(this);
     Branch(UintPtrLessThan(field_index, instance_size_in_words), &inobject,
@@ -1212,19 +1232,19 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
                                          MachineRepresentation::kFloat64);
         } else {
           if (do_transitioning_store) {
-            Node* mutable_heap_number =
-                AllocateMutableHeapNumberWithValue(double_value);
+            TNode<HeapNumber> heap_number =
+                AllocateHeapNumberWithValue(double_value);
             StoreMap(object, object_map);
-            StoreObjectField(object, field_offset, mutable_heap_number);
+            StoreObjectField(object, field_offset, heap_number);
           } else {
-            Node* mutable_heap_number = LoadObjectField(object, field_offset);
+            TNode<HeapNumber> heap_number =
+                CAST(LoadObjectField(object, field_offset));
             Label if_mutable(this);
             GotoIfNot(IsPropertyDetailsConst(details), &if_mutable);
-            TNode<Float64T> current_value =
-                LoadHeapNumberValue(mutable_heap_number);
+            TNode<Float64T> current_value = LoadHeapNumberValue(heap_number);
             BranchIfSameNumberValue(current_value, double_value, &done, slow);
             BIND(&if_mutable);
-            StoreHeapNumberValue(mutable_heap_number, double_value);
+            StoreHeapNumberValue(heap_number, double_value);
           }
         }
         Goto(&done);
@@ -1250,8 +1270,8 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
 
     BIND(&backing_store);
     {
-      Node* backing_store_index =
-          IntPtrSub(field_index, instance_size_in_words);
+      TNode<IntPtrT> backing_store_index =
+          Signed(IntPtrSub(field_index, instance_size_in_words));
 
       if (do_transitioning_store) {
         // Allocate mutable heap number before extending properties backing
@@ -1264,10 +1284,10 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
                                 Int32Constant(Representation::kDouble)),
                  &cont);
           {
-            Node* double_value = ChangeNumberToFloat64(CAST(value));
-            Node* mutable_heap_number =
-                AllocateMutableHeapNumberWithValue(double_value);
-            var_value.Bind(mutable_heap_number);
+            TNode<Float64T> double_value = ChangeNumberToFloat64(CAST(value));
+            TNode<HeapNumber> heap_number =
+                AllocateHeapNumberWithValue(double_value);
+            var_value.Bind(heap_number);
             Goto(&cont);
           }
           BIND(&cont);
@@ -1288,18 +1308,17 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
             &double_rep, &tagged_rep);
         BIND(&double_rep);
         {
-          Node* mutable_heap_number =
-              LoadPropertyArrayElement(properties, backing_store_index);
+          TNode<HeapNumber> heap_number =
+              CAST(LoadPropertyArrayElement(properties, backing_store_index));
           TNode<Float64T> double_value = ChangeNumberToFloat64(CAST(value));
 
           Label if_mutable(this);
           GotoIfNot(IsPropertyDetailsConst(details), &if_mutable);
-          TNode<Float64T> current_value =
-              LoadHeapNumberValue(mutable_heap_number);
+          TNode<Float64T> current_value = LoadHeapNumberValue(heap_number);
           BranchIfSameNumberValue(current_value, double_value, &done, slow);
 
           BIND(&if_mutable);
-          StoreHeapNumberValue(mutable_heap_number, double_value);
+          StoreHeapNumberValue(heap_number, double_value);
           Goto(&done);
         }
         BIND(&tagged_rep);
@@ -1322,9 +1341,9 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
   BIND(&if_descriptor);
   {
     // Check that constant matches value.
-    Node* constant = LoadValueByKeyIndex(
+    TNode<Object> constant = LoadValueByKeyIndex(
         CAST(descriptors), UncheckedCast<IntPtrT>(descriptor_name_index));
-    GotoIf(WordNotEqual(value, constant), slow);
+    GotoIf(TaggedNotEqual(value, constant), slow);
 
     if (do_transitioning_store) {
       StoreMap(object, object_map);
@@ -1334,15 +1353,17 @@ void AccessorAssembler::OverwriteExistingFastDataProperty(
   BIND(&done);
 }
 
-void AccessorAssembler::CheckPrototypeValidityCell(Node* maybe_validity_cell,
-                                                   Label* miss) {
+void AccessorAssembler::CheckPrototypeValidityCell(
+    TNode<Object> maybe_validity_cell, Label* miss) {
   Label done(this);
-  GotoIf(WordEqual(maybe_validity_cell, SmiConstant(Map::kPrototypeChainValid)),
-         &done);
+  GotoIf(
+      TaggedEqual(maybe_validity_cell, SmiConstant(Map::kPrototypeChainValid)),
+      &done);
   CSA_ASSERT(this, TaggedIsNotSmi(maybe_validity_cell));
 
-  Node* cell_value = LoadObjectField(maybe_validity_cell, Cell::kValueOffset);
-  Branch(WordEqual(cell_value, SmiConstant(Map::kPrototypeChainValid)), &done,
+  TNode<Object> cell_value =
+      LoadObjectField(CAST(maybe_validity_cell), Cell::kValueOffset);
+  Branch(TaggedEqual(cell_value, SmiConstant(Map::kPrototypeChainValid)), &done,
          miss);
 
   BIND(&done);
@@ -1353,9 +1374,11 @@ void AccessorAssembler::HandleStoreAccessor(const StoreICParameters* p,
   Comment("accessor_store");
   TNode<IntPtrT> descriptor =
       Signed(DecodeWord<StoreHandler::DescriptorBits>(handler_word));
-  Node* accessor_pair = LoadDescriptorValue(LoadMap(holder), descriptor);
+  TNode<HeapObject> accessor_pair =
+      CAST(LoadDescriptorValue(LoadMap(holder), descriptor));
   CSA_ASSERT(this, IsAccessorPair(accessor_pair));
-  Node* setter = LoadObjectField(accessor_pair, AccessorPair::kSetterOffset);
+  TNode<Object> setter =
+      LoadObjectField(accessor_pair, AccessorPair::kSetterOffset);
   CSA_ASSERT(this, Word32BinaryNot(IsTheHole(setter)));
 
   Callable callable = CodeFactory::Call(isolate());
@@ -1402,7 +1425,7 @@ void AccessorAssembler::HandleStoreICProtoHandler(
       p, handler, on_code_handler,
       // on_found_on_receiver
       [=](Node* properties, Node* name_index) {
-        Node* details =
+        TNode<Uint32T> details =
             LoadDetailsByKeyIndex<NameDictionary>(properties, name_index);
         // Check that the property is a writable data property (no accessor).
         const int kTypeAndReadOnlyMask =
@@ -1422,15 +1445,16 @@ void AccessorAssembler::HandleStoreICProtoHandler(
         if_accessor(this), if_native_data_property(this);
 
     CSA_ASSERT(this, TaggedIsSmi(smi_handler));
-    Node* handler_word = SmiUntag(smi_handler);
+    TNode<IntPtrT> handler_word = SmiUntag(smi_handler);
 
-    Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
+    TNode<UintPtrT> handler_kind =
+        DecodeWord<StoreHandler::KindBits>(handler_word);
     GotoIf(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kNormal)),
            &if_add_normal);
 
     TNode<MaybeObject> maybe_holder = LoadHandlerDataField(handler, 1);
     CSA_ASSERT(this, IsWeakOrCleared(maybe_holder));
-    TNode<Object> holder = GetHeapObjectAssumeWeak(maybe_holder, miss);
+    TNode<HeapObject> holder = GetHeapObjectAssumeWeak(maybe_holder, miss);
 
     GotoIf(WordEqual(handler_kind, IntPtrConstant(StoreHandler::kGlobalProxy)),
            &if_store_global_proxy);
@@ -1497,11 +1521,11 @@ void AccessorAssembler::HandleStoreICProtoHandler(
           IsCleared(maybe_context), [=] { return SmiConstant(0); },
           [=] { return GetHeapObjectAssumeWeak(maybe_context); });
 
-      Node* foreign = LoadObjectField(call_handler_info,
-                                      CallHandlerInfo::kJsCallbackOffset);
+      TNode<Foreign> foreign = CAST(LoadObjectField(
+          call_handler_info, CallHandlerInfo::kJsCallbackOffset));
       Node* callback = LoadObjectField(foreign, Foreign::kForeignAddressOffset,
                                        MachineType::Pointer());
-      Node* data =
+      TNode<Object> data =
           LoadObjectField(call_handler_info, CallHandlerInfo::kDataOffset);
 
       VARIABLE(api_holder, MachineRepresentation::kTagged, p->receiver());
@@ -1560,7 +1584,8 @@ void AccessorAssembler::HandleStoreToProxy(const StoreICParameters* p,
     TailCallRuntime(Runtime::kSetPropertyWithReceiver, p->context(), proxy,
                     p->name(), p->value(), p->receiver());
   } else {
-    Node* name = CallBuiltin(Builtins::kToName, p->context(), p->name());
+    TNode<Object> name =
+        CallBuiltin(Builtins::kToName, p->context(), p->name());
     TailCallBuiltin(Builtins::kProxySetProperty, p->context(), proxy, name,
                     p->value(), p->receiver());
   }
@@ -1571,7 +1596,8 @@ void AccessorAssembler::HandleStoreICSmiHandlerCase(Node* handler_word,
                                                     Label* miss) {
   Comment("field store");
 #ifdef DEBUG
-  Node* handler_kind = DecodeWord<StoreHandler::KindBits>(handler_word);
+  TNode<UintPtrT> handler_kind =
+      DecodeWord<StoreHandler::KindBits>(handler_word);
   CSA_ASSERT(
       this,
       Word32Or(
@@ -1579,7 +1605,7 @@ void AccessorAssembler::HandleStoreICSmiHandlerCase(Node* handler_word,
           WordEqual(handler_kind, IntPtrConstant(StoreHandler::kConstField))));
 #endif
 
-  Node* field_representation =
+  TNode<UintPtrT> field_representation =
       DecodeWord<StoreHandler::FieldRepresentationBits>(handler_word);
 
   Label if_smi_field(this), if_double_field(this), if_heap_object_field(this),
@@ -1674,8 +1700,9 @@ Node* AccessorAssembler::PrepareValueForStore(Node* handler_word, Node* holder,
     GotoIf(TaggedIsSmi(maybe_field_type), &done);
     // Check that value type matches the field type.
     {
-      Node* field_type = GetHeapObjectAssumeWeak(maybe_field_type, bailout);
-      Branch(WordEqual(LoadMap(value), field_type), &done, bailout);
+      TNode<HeapObject> field_type =
+          GetHeapObjectAssumeWeak(maybe_field_type, bailout);
+      Branch(TaggedEqual(LoadMap(CAST(value)), field_type), &done, bailout);
     }
     BIND(&done);
 
@@ -1700,7 +1727,8 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
   VARIABLE(var_encoded_hash, MachineRepresentation::kWord32);
   VARIABLE(var_length, ParameterRepresentation(mode));
 
-  Node* properties = LoadObjectField(object, JSObject::kPropertiesOrHashOffset);
+  TNode<Object> properties =
+      LoadObjectField(object, JSObject::kPropertiesOrHashOffset);
   var_properties.Bind(properties);
 
   Label if_smi_hash(this), if_property_array(this), extend_store(this);
@@ -1708,8 +1736,8 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
 
   BIND(&if_smi_hash);
   {
-    Node* hash = SmiToInt32(properties);
-    Node* encoded_hash =
+    TNode<Int32T> hash = SmiToInt32(CAST(properties));
+    TNode<Word32T> encoded_hash =
         Word32Shl(hash, Int32Constant(PropertyArray::HashField::kShift));
     var_encoded_hash.Bind(encoded_hash);
     var_length.Bind(IntPtrOrSmiConstant(0, mode));
@@ -1719,11 +1747,11 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
 
   BIND(&if_property_array);
   {
-    Node* length_and_hash_int32 = LoadAndUntagToWord32ObjectField(
+    TNode<Int32T> length_and_hash_int32 = LoadAndUntagToWord32ObjectField(
         var_properties.value(), PropertyArray::kLengthAndHashOffset);
     var_encoded_hash.Bind(Word32And(
         length_and_hash_int32, Int32Constant(PropertyArray::HashField::kMask)));
-    Node* length_intptr = ChangeInt32ToIntPtr(
+    TNode<IntPtrT> length_intptr = ChangeInt32ToIntPtr(
         Word32And(length_and_hash_int32,
                   Int32Constant(PropertyArray::LengthField::kMask)));
     Node* length = IntPtrToParameter(length_intptr, mode);
@@ -1771,10 +1799,10 @@ Node* AccessorAssembler::ExtendPropertiesBackingStore(Node* object,
 
     // TODO(gsathya): Clean up the type conversions by creating smarter
     // helpers that do the correct op based on the mode.
-    Node* new_capacity_int32 =
+    TNode<Int32T> new_capacity_int32 =
         TruncateIntPtrToInt32(ParameterToIntPtr(new_capacity, mode));
-    Node* new_length_and_hash_int32 =
-        Word32Or(var_encoded_hash.value(), new_capacity_int32);
+    TNode<Int32T> new_length_and_hash_int32 =
+        Signed(Word32Or(var_encoded_hash.value(), new_capacity_int32));
     StoreObjectField(new_properties, PropertyArray::kLengthAndHashOffset,
                      SmiFromInt32(new_length_and_hash_int32));
     StoreObjectField(object, JSObject::kPropertiesOrHashOffset, new_properties);
@@ -1795,7 +1823,8 @@ void AccessorAssembler::StoreNamedField(Node* handler_word, Node* object,
     property_storage = LoadFastProperties(object);
   }
 
-  Node* index = DecodeWord<StoreHandler::FieldIndexBits>(handler_word);
+  TNode<UintPtrT> index =
+      DecodeWord<StoreHandler::FieldIndexBits>(handler_word);
   TNode<IntPtrT> offset = Signed(TimesTaggedSize(index));
   if (representation.IsDouble()) {
     if (!FLAG_unbox_double_fields || !is_inobject) {
@@ -1818,8 +1847,9 @@ void AccessorAssembler::StoreNamedField(Node* handler_word, Node* object,
       BranchIfSameNumberValue(current_value, UncheckedCast<Float64T>(value),
                               &const_checked, bailout);
     } else {
-      Node* current_value = LoadObjectField(property_storage, offset);
-      Branch(WordEqual(current_value, value), &const_checked, bailout);
+      TNode<Object> current_value = LoadObjectField(property_storage, offset);
+      Branch(TaggedEqual(current_value, UncheckedCast<Object>(value)),
+             &const_checked, bailout);
     }
   }
 
@@ -1859,42 +1889,44 @@ void AccessorAssembler::EmitFastElementsBoundsCheck(Node* object,
 }
 
 void AccessorAssembler::EmitElementLoad(
-    Node* object, Node* elements_kind, SloppyTNode<IntPtrT> intptr_index,
-    Node* is_jsarray_condition, Label* if_hole, Label* rebox_double,
-    Variable* var_double_value, Label* unimplemented_elements_kind,
-    Label* out_of_bounds, Label* miss, ExitPoint* exit_point,
-    LoadAccessMode access_mode) {
+    Node* object, TNode<Word32T> elements_kind,
+    SloppyTNode<IntPtrT> intptr_index, Node* is_jsarray_condition,
+    Label* if_hole, Label* rebox_double, Variable* var_double_value,
+    Label* unimplemented_elements_kind, Label* out_of_bounds, Label* miss,
+    ExitPoint* exit_point, LoadAccessMode access_mode) {
   Label if_typed_array(this), if_fast(this), if_fast_packed(this),
       if_fast_holey(this), if_fast_double(this), if_fast_holey_double(this),
       if_nonfast(this), if_dictionary(this);
-  Branch(
-      Int32GreaterThan(elements_kind, Int32Constant(LAST_FROZEN_ELEMENTS_KIND)),
-      &if_nonfast, &if_fast);
+  Branch(Int32GreaterThan(elements_kind,
+                          Int32Constant(LAST_ANY_NONEXTENSIBLE_ELEMENTS_KIND)),
+         &if_nonfast, &if_fast);
 
   BIND(&if_fast);
   {
     TNode<FixedArrayBase> elements = LoadJSObjectElements(CAST(object));
     EmitFastElementsBoundsCheck(object, elements, intptr_index,
                                 is_jsarray_condition, out_of_bounds);
-    int32_t kinds[] = {// Handled by if_fast_packed.
-                       PACKED_SMI_ELEMENTS, PACKED_ELEMENTS,
-                       PACKED_SEALED_ELEMENTS, PACKED_FROZEN_ELEMENTS,
-                       // Handled by if_fast_holey.
-                       HOLEY_SMI_ELEMENTS, HOLEY_ELEMENTS,
-                       HOLEY_FROZEN_ELEMENTS, HOLEY_SEALED_ELEMENTS,
-                       // Handled by if_fast_double.
-                       PACKED_DOUBLE_ELEMENTS,
-                       // Handled by if_fast_holey_double.
-                       HOLEY_DOUBLE_ELEMENTS};
-    Label* labels[] = {
-        // FAST_{SMI,}_ELEMENTS
-        &if_fast_packed, &if_fast_packed, &if_fast_packed, &if_fast_packed,
-        // FAST_HOLEY_{SMI,}_ELEMENTS
-        &if_fast_holey, &if_fast_holey, &if_fast_holey, &if_fast_holey,
-        // PACKED_DOUBLE_ELEMENTS
-        &if_fast_double,
-        // HOLEY_DOUBLE_ELEMENTS
-        &if_fast_holey_double};
+    int32_t kinds[] = {
+        // Handled by if_fast_packed.
+        PACKED_SMI_ELEMENTS, PACKED_ELEMENTS, PACKED_NONEXTENSIBLE_ELEMENTS,
+        PACKED_SEALED_ELEMENTS, PACKED_FROZEN_ELEMENTS,
+        // Handled by if_fast_holey.
+        HOLEY_SMI_ELEMENTS, HOLEY_ELEMENTS, HOLEY_NONEXTENSIBLE_ELEMENTS,
+        HOLEY_FROZEN_ELEMENTS, HOLEY_SEALED_ELEMENTS,
+        // Handled by if_fast_double.
+        PACKED_DOUBLE_ELEMENTS,
+        // Handled by if_fast_holey_double.
+        HOLEY_DOUBLE_ELEMENTS};
+    Label* labels[] = {// FAST_{SMI,}_ELEMENTS
+                       &if_fast_packed, &if_fast_packed, &if_fast_packed,
+                       &if_fast_packed, &if_fast_packed,
+                       // FAST_HOLEY_{SMI,}_ELEMENTS
+                       &if_fast_holey, &if_fast_holey, &if_fast_holey,
+                       &if_fast_holey, &if_fast_holey,
+                       // PACKED_DOUBLE_ELEMENTS
+                       &if_fast_double,
+                       // HOLEY_DOUBLE_ELEMENTS
+                       &if_fast_holey_double};
     Switch(elements_kind, unimplemented_elements_kind, kinds, labels,
            arraysize(kinds));
 
@@ -1910,8 +1942,9 @@ void AccessorAssembler::EmitElementLoad(
     BIND(&if_fast_holey);
     {
       Comment("fast holey elements");
-      Node* element = UnsafeLoadFixedArrayElement(CAST(elements), intptr_index);
-      GotoIf(WordEqual(element, TheHoleConstant()), if_hole);
+      TNode<Object> element =
+          UnsafeLoadFixedArrayElement(CAST(elements), intptr_index);
+      GotoIf(TaggedEqual(element, TheHoleConstant()), if_hole);
       exit_point->Return(access_mode == LoadAccessMode::kHas ? TrueConstant()
                                                              : element);
     }
@@ -1931,9 +1964,9 @@ void AccessorAssembler::EmitElementLoad(
     BIND(&if_fast_holey_double);
     {
       Comment("holey double elements");
-      Node* value = LoadFixedDoubleArrayElement(CAST(elements), intptr_index,
-                                                MachineType::Float64(), 0,
-                                                INTPTR_PARAMETERS, if_hole);
+      TNode<Float64T> value = LoadFixedDoubleArrayElement(
+          CAST(elements), intptr_index, MachineType::Float64(), 0,
+          INTPTR_PARAMETERS, if_hole);
       if (access_mode == LoadAccessMode::kHas) {
         exit_point->Return(TrueConstant());
       } else {
@@ -2020,35 +2053,35 @@ void AccessorAssembler::EmitElementLoad(
         BIND(&uint16_elements);
         {
           Comment("UINT16_ELEMENTS");
-          Node* index = WordShl(intptr_index, IntPtrConstant(1));
+          TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(1));
           Node* element = Load(MachineType::Uint16(), backing_store, index);
           exit_point->Return(SmiFromInt32(element));
         }
         BIND(&int16_elements);
         {
           Comment("INT16_ELEMENTS");
-          Node* index = WordShl(intptr_index, IntPtrConstant(1));
+          TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(1));
           Node* element = Load(MachineType::Int16(), backing_store, index);
           exit_point->Return(SmiFromInt32(element));
         }
         BIND(&uint32_elements);
         {
           Comment("UINT32_ELEMENTS");
-          Node* index = WordShl(intptr_index, IntPtrConstant(2));
+          TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(2));
           Node* element = Load(MachineType::Uint32(), backing_store, index);
           exit_point->Return(ChangeUint32ToTagged(element));
         }
         BIND(&int32_elements);
         {
           Comment("INT32_ELEMENTS");
-          Node* index = WordShl(intptr_index, IntPtrConstant(2));
+          TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(2));
           Node* element = Load(MachineType::Int32(), backing_store, index);
           exit_point->Return(ChangeInt32ToTagged(element));
         }
         BIND(&float32_elements);
         {
           Comment("FLOAT32_ELEMENTS");
-          Node* index = WordShl(intptr_index, IntPtrConstant(2));
+          TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(2));
           Node* element = Load(MachineType::Float32(), backing_store, index);
           var_double_value->Bind(ChangeFloat32ToFloat64(element));
           Goto(rebox_double);
@@ -2056,7 +2089,7 @@ void AccessorAssembler::EmitElementLoad(
         BIND(&float64_elements);
         {
           Comment("FLOAT64_ELEMENTS");
-          Node* index = WordShl(intptr_index, IntPtrConstant(3));
+          TNode<IntPtrT> index = WordShl(intptr_index, IntPtrConstant(3));
           Node* element = Load(MachineType::Float64(), backing_store, index);
           var_double_value->Bind(element);
           Goto(rebox_double);
@@ -2105,12 +2138,12 @@ void AccessorAssembler::InvalidateValidityCellIfPrototype(Node* map,
 
   BIND(&is_prototype);
   {
-    Node* maybe_prototype_info =
+    TNode<Object> maybe_prototype_info =
         LoadObjectField(map, Map::kTransitionsOrPrototypeInfoOffset);
     // If there's no prototype info then there's nothing to invalidate.
     GotoIf(TaggedIsSmi(maybe_prototype_info), &cont);
 
-    Node* function = ExternalConstant(
+    TNode<ExternalReference> function = ExternalConstant(
         ExternalReference::invalidate_prototype_chains_function());
     CallCFunction(function, MachineType::AnyTagged(),
                   std::make_pair(MachineType::AnyTagged(), map));
@@ -2130,8 +2163,9 @@ void AccessorAssembler::GenericElementLoad(Node* receiver, Node* receiver_map,
   // Receivers requiring non-standard element accesses (interceptors, access
   // checks, strings and string wrappers, proxies) are handled in the runtime.
   GotoIf(IsCustomElementsReceiverInstanceType(instance_type), &if_custom);
-  Node* elements_kind = LoadMapElementsKind(receiver_map);
-  Node* is_jsarray_condition = InstanceTypeEqual(instance_type, JS_ARRAY_TYPE);
+  TNode<Int32T> elements_kind = LoadMapElementsKind(receiver_map);
+  TNode<BoolT> is_jsarray_condition =
+      InstanceTypeEqual(instance_type, JS_ARRAY_TYPE);
   VARIABLE(var_double_value, MachineRepresentation::kFloat64);
   Label rebox_double(this, &var_double_value);
 
@@ -2192,12 +2226,14 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
   VARIABLE(var_details, MachineRepresentation::kWord32);
   VARIABLE(var_value, MachineRepresentation::kTagged);
 
+  TNode<Name> name = CAST(p->name());
+
   // Receivers requiring non-standard accesses (interceptors, access
   // checks, strings and string wrappers) are handled in the runtime.
   GotoIf(IsSpecialReceiverInstanceType(instance_type), &special_receiver);
 
   // Check if the receiver has fast or slow properties.
-  Node* bitfield3 = LoadMapBitField3(receiver_map);
+  TNode<Uint32T> bitfield3 = LoadMapBitField3(receiver_map);
   GotoIf(IsSetWord32<Map::IsDictionaryMapBit>(bitfield3),
          &if_property_dictionary);
 
@@ -2209,7 +2245,7 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
   TVARIABLE(IntPtrT, var_name_index);
   Label* notfound = use_stub_cache == kUseStubCache ? &try_stub_cache
                                                     : &lookup_prototype_chain;
-  DescriptorLookup(p->name(), descriptors, bitfield3, &if_descriptor_found,
+  DescriptorLookup(name, descriptors, bitfield3, &if_descriptor_found,
                    &var_name_index, notfound);
 
   BIND(&if_descriptor_found);
@@ -2226,13 +2262,13 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
     // When there is no feedback vector don't use stub cache.
     GotoIfNot(IsUndefined(p->vector()), &stub_cache);
     // Fall back to the slow path for private symbols.
-    Branch(IsPrivateSymbol(p->name()), slow, &lookup_prototype_chain);
+    Branch(IsPrivateSymbol(name), slow, &lookup_prototype_chain);
 
     BIND(&stub_cache);
     Comment("stub cache probe for fast property load");
     TVARIABLE(MaybeObject, var_handler);
     Label found_handler(this, &var_handler), stub_cache_miss(this);
-    TryProbeStubCache(isolate()->load_stub_cache(), receiver, p->name(),
+    TryProbeStubCache(isolate()->load_stub_cache(), receiver, name,
                       &found_handler, &var_handler, &stub_cache_miss);
     BIND(&found_handler);
     {
@@ -2247,7 +2283,7 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
       // chain. If it doesn't, then there's no point in missing.
       Comment("KeyedLoadGeneric_miss");
       TailCallRuntime(Runtime::kKeyedLoadIC_Miss, p->context(), p->receiver(),
-                      p->name(), p->slot(), p->vector());
+                      name, p->slot(), p->vector());
     }
   }
 
@@ -2260,8 +2296,8 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
     TVARIABLE(IntPtrT, var_name_index);
     Label dictionary_found(this, &var_name_index);
     TNode<NameDictionary> properties = CAST(LoadSlowProperties(receiver));
-    NameDictionaryLookup<NameDictionary>(properties, CAST(p->name()),
-                                         &dictionary_found, &var_name_index,
+    NameDictionaryLookup<NameDictionary>(properties, name, &dictionary_found,
+                                         &var_name_index,
                                          &lookup_prototype_chain);
     BIND(&dictionary_found);
     {
@@ -2273,8 +2309,8 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
 
   BIND(&if_found_on_receiver);
   {
-    Node* value = CallGetterIfAccessor(var_value.value(), var_details.value(),
-                                       p->context(), receiver, slow);
+    TNode<Object> value = CallGetterIfAccessor(
+        var_value.value(), var_details.value(), p->context(), receiver, slow);
     IncrementCounter(isolate()->counters()->ic_keyed_load_generic_symbol(), 1);
     Return(value);
   }
@@ -2289,7 +2325,7 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
 
     var_holder_map.Bind(receiver_map);
     var_holder_instance_type.Bind(instance_type);
-    GotoIf(IsPrivateSymbol(p->name()), &is_private_symbol);
+    GotoIf(IsPrivateSymbol(name), &is_private_symbol);
 
     Goto(&loop);
     BIND(&loop);
@@ -2298,16 +2334,16 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
       GotoIf(InstanceTypeEqual(var_holder_instance_type.value(),
                                JS_TYPED_ARRAY_TYPE),
              slow);
-      Node* proto = LoadMapPrototype(var_holder_map.value());
-      GotoIf(WordEqual(proto, NullConstant()), &return_undefined);
-      Node* proto_map = LoadMap(proto);
-      Node* proto_instance_type = LoadMapInstanceType(proto_map);
+      TNode<HeapObject> proto = LoadMapPrototype(var_holder_map.value());
+      GotoIf(TaggedEqual(proto, NullConstant()), &return_undefined);
+      TNode<Map> proto_map = LoadMap(proto);
+      TNode<Uint16T> proto_instance_type = LoadMapInstanceType(proto_map);
       var_holder_map.Bind(proto_map);
       var_holder_instance_type.Bind(proto_instance_type);
       Label next_proto(this), return_value(this, &var_value), goto_slow(this);
       TryGetOwnProperty(p->context(), receiver, proto, proto_map,
-                        proto_instance_type, p->name(), &return_value,
-                        &var_value, &next_proto, &goto_slow);
+                        proto_instance_type, name, &return_value, &var_value,
+                        &next_proto, &goto_slow);
 
       // This trampoline and the next are required to appease Turbofan's
       // variable merging.
@@ -2323,12 +2359,12 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
 
     BIND(&is_private_symbol);
     {
-      CSA_ASSERT(this, IsPrivateSymbol(p->name()));
+      CSA_ASSERT(this, IsPrivateSymbol(name));
 
       // For private names that don't exist on the receiver, we bail
       // to the runtime to throw. For private symbols, we just return
       // undefined.
-      Branch(IsPrivateName(p->name()), slow, &return_undefined);
+      Branch(IsPrivateName(CAST(name)), slow, &return_undefined);
     }
 
     BIND(&return_undefined);
@@ -2341,11 +2377,11 @@ void AccessorAssembler::GenericPropertyLoad(Node* receiver, Node* receiver_map,
     GotoIfNot(InstanceTypeEqual(instance_type, JS_PROXY_TYPE), slow);
 
     // Private field/symbol lookup is not supported.
-    GotoIf(IsPrivateSymbol(p->name()), slow);
+    GotoIf(IsPrivateSymbol(name), slow);
 
     direct_exit.ReturnCallStub(
         Builtins::CallableFor(isolate(), Builtins::kProxyGetProperty),
-        p->context(), receiver /*holder is the same as receiver*/, p->name(),
+        p->context(), receiver /*holder is the same as receiver*/, name,
         receiver, SmiConstant(OnNonExistent::kReturnUndefined));
   }
 }
@@ -2361,7 +2397,7 @@ Node* AccessorAssembler::StubCachePrimaryOffset(Node* name, Node* map) {
   // See v8::internal::StubCache::PrimaryOffset().
   STATIC_ASSERT(StubCache::kCacheIndexShift == Name::kHashShift);
   // Compute the hash of the name (use entire hash field).
-  Node* hash_field = LoadNameHashField(name);
+  TNode<Uint32T> hash_field = LoadNameHashField(name);
   CSA_ASSERT(this,
              Word32Equal(Word32And(hash_field,
                                    Int32Constant(Name::kHashNotComputedMask)),
@@ -2370,12 +2406,12 @@ Node* AccessorAssembler::StubCachePrimaryOffset(Node* name, Node* map) {
   // Using only the low bits in 64-bit mode is unlikely to increase the
   // risk of collision even if the heap is spread over an area larger than
   // 4Gb (and not at all if it isn't).
-  Node* map_word = BitcastTaggedToWord(map);
+  TNode<IntPtrT> map_word = BitcastTaggedToWord(map);
 
-  Node* map32 = TruncateIntPtrToInt32(UncheckedCast<IntPtrT>(
+  TNode<Int32T> map32 = TruncateIntPtrToInt32(UncheckedCast<IntPtrT>(
       WordXor(map_word, WordShr(map_word, StubCache::kMapKeyShift))));
   // Base the offset on a simple combination of name and map.
-  Node* hash = Int32Add(hash_field, map32);
+  TNode<Word32T> hash = Int32Add(hash_field, map32);
   uint32_t mask = (StubCache::kPrimaryTableSize - 1)
                   << StubCache::kCacheIndexShift;
   return ChangeUint32ToWord(Word32And(hash, Int32Constant(mask)));
@@ -2385,8 +2421,8 @@ Node* AccessorAssembler::StubCacheSecondaryOffset(Node* name, Node* seed) {
   // See v8::internal::StubCache::SecondaryOffset().
 
   // Use the seed from the primary cache in the secondary cache.
-  Node* name32 = TruncateIntPtrToInt32(BitcastTaggedToWord(name));
-  Node* hash = Int32Sub(TruncateIntPtrToInt32(seed), name32);
+  TNode<Int32T> name32 = TruncateIntPtrToInt32(BitcastTaggedToWord(name));
+  TNode<Word32T> hash = Int32Sub(TruncateIntPtrToInt32(seed), name32);
   hash = Int32Add(hash, Int32Constant(StubCache::kSecondaryMagic));
   int32_t mask = (StubCache::kSecondaryTableSize - 1)
                  << StubCache::kCacheIndexShift;
@@ -2395,7 +2431,7 @@ Node* AccessorAssembler::StubCacheSecondaryOffset(Node* name, Node* seed) {
 
 void AccessorAssembler::TryProbeStubCacheTable(
     StubCache* stub_cache, StubCacheTable table_id, Node* entry_offset,
-    Node* name, Node* map, Label* if_handler,
+    TNode<Object> name, TNode<Map> map, Label* if_handler,
     TVariable<MaybeObject>* var_handler, Label* if_miss) {
   StubCache::Table table = static_cast<StubCache::Table>(table_id);
   // The {table_offset} holds the entry offset times four (due to masking
@@ -2403,19 +2439,20 @@ void AccessorAssembler::TryProbeStubCacheTable(
   const int kMultiplier = sizeof(StubCache::Entry) >> Name::kHashShift;
   entry_offset = IntPtrMul(entry_offset, IntPtrConstant(kMultiplier));
 
-  Node* key_base = ExternalConstant(
+  TNode<ExternalReference> key_base = ExternalConstant(
       ExternalReference::Create(stub_cache->key_reference(table)));
 
   // Check that the key in the entry matches the name.
   DCHECK_EQ(0, offsetof(StubCache::Entry, key));
-  Node* cached_key = Load(MachineType::TaggedPointer(), key_base, entry_offset);
-  GotoIf(WordNotEqual(name, cached_key), if_miss);
+  TNode<HeapObject> cached_key =
+      CAST(Load(MachineType::TaggedPointer(), key_base, entry_offset));
+  GotoIf(TaggedNotEqual(name, cached_key), if_miss);
 
   // Check that the map in the entry matches.
-  Node* cached_map = Load(
-      MachineType::TaggedPointer(), key_base,
+  TNode<Object> cached_map = Load<Object>(
+      key_base,
       IntPtrAdd(entry_offset, IntPtrConstant(offsetof(StubCache::Entry, map))));
-  GotoIf(WordNotEqual(map, cached_map), if_miss);
+  GotoIf(TaggedNotEqual(map, cached_map), if_miss);
 
   TNode<MaybeObject> handler = ReinterpretCast<MaybeObject>(
       Load(MachineType::AnyTagged(), key_base,
@@ -2428,7 +2465,7 @@ void AccessorAssembler::TryProbeStubCacheTable(
 }
 
 void AccessorAssembler::TryProbeStubCache(StubCache* stub_cache, Node* receiver,
-                                          Node* name, Label* if_handler,
+                                          TNode<Object> name, Label* if_handler,
                                           TVariable<MaybeObject>* var_handler,
                                           Label* if_miss) {
   Label try_secondary(this), miss(this);
@@ -2439,7 +2476,7 @@ void AccessorAssembler::TryProbeStubCache(StubCache* stub_cache, Node* receiver,
   // Check that the {receiver} isn't a smi.
   GotoIf(TaggedIsSmi(receiver), &miss);
 
-  Node* receiver_map = LoadMap(receiver);
+  TNode<Map> receiver_map = LoadMap(receiver);
 
   // Probe the primary table.
   Node* primary_offset = StubCachePrimaryOffset(name, receiver_map);
@@ -2477,7 +2514,7 @@ void AccessorAssembler::LoadIC_BytecodeHandler(const LazyLoadICParameters* p,
   Label stub_call(this, Label::kDeferred), miss(this, Label::kDeferred),
       no_feedback(this, Label::kDeferred);
 
-  Node* recv_map = LoadReceiverMap(p->receiver());
+  TNode<Map> recv_map = LoadReceiverMap(p->receiver());
   GotoIf(IsDeprecatedMap(recv_map), &miss);
 
   GotoIf(IsUndefined(p->vector()), &no_feedback);
@@ -2513,7 +2550,7 @@ void AccessorAssembler::LoadIC_BytecodeHandler(const LazyLoadICParameters* p,
     // Call into the stub that implements the non-inlined parts of LoadIC.
     Callable ic =
         Builtins::CallableFor(isolate(), Builtins::kLoadIC_Noninlined);
-    Node* code_target = HeapConstant(ic.code());
+    TNode<Code> code_target = HeapConstant(ic.code());
     exit_point->ReturnCallStub(ic.descriptor(), code_target, p->context(),
                                p->receiver(), p->name(), p->slot(),
                                p->vector());
@@ -2524,8 +2561,8 @@ void AccessorAssembler::LoadIC_BytecodeHandler(const LazyLoadICParameters* p,
     Comment("LoadIC_BytecodeHandler_nofeedback");
     // Call into the stub that implements the non-inlined parts of LoadIC.
     exit_point->ReturnCallStub(
-        Builtins::CallableFor(isolate(), Builtins::kLoadIC_Uninitialized),
-        p->context(), p->receiver(), p->name(), p->slot(), p->vector());
+        Builtins::CallableFor(isolate(), Builtins::kLoadIC_NoFeedback),
+        p->context(), p->receiver(), p->name(), p->slot());
   }
 
   BIND(&miss);
@@ -2547,7 +2584,7 @@ void AccessorAssembler::LoadIC(const LoadICParameters* p) {
   Label if_handler(this, &var_handler), non_inlined(this, Label::kDeferred),
       try_polymorphic(this), miss(this, Label::kDeferred);
 
-  Node* receiver_map = LoadReceiverMap(p->receiver());
+  TNode<Map> receiver_map = LoadReceiverMap(p->receiver());
   GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
   // Check monomorphic case.
@@ -2584,58 +2621,34 @@ void AccessorAssembler::LoadIC(const LoadICParameters* p) {
 }
 
 void AccessorAssembler::LoadIC_Noninlined(const LoadICParameters* p,
-                                          Node* receiver_map,
+                                          TNode<Map> receiver_map,
                                           TNode<HeapObject> feedback,
                                           TVariable<MaybeObject>* var_handler,
                                           Label* if_handler, Label* miss,
                                           ExitPoint* exit_point) {
-  Label try_uninitialized(this, Label::kDeferred);
-
   // Neither deprecated map nor monomorphic. These cases are handled in the
   // bytecode handler.
   CSA_ASSERT(this, Word32BinaryNot(IsDeprecatedMap(receiver_map)));
-  CSA_ASSERT(this, WordNotEqual(receiver_map, feedback));
+  CSA_ASSERT(this, TaggedNotEqual(receiver_map, feedback));
   CSA_ASSERT(this, Word32BinaryNot(IsWeakFixedArrayMap(LoadMap(feedback))));
   DCHECK_EQ(MachineRepresentation::kTagged, var_handler->rep());
 
   {
     // Check megamorphic case.
-    GotoIfNot(WordEqual(feedback, LoadRoot(RootIndex::kmegamorphic_symbol)),
-              &try_uninitialized);
+    GotoIfNot(TaggedEqual(feedback, MegamorphicSymbolConstant()), miss);
 
     TryProbeStubCache(isolate()->load_stub_cache(), p->receiver(), p->name(),
                       if_handler, var_handler, miss);
   }
-
-  BIND(&try_uninitialized);
-  {
-    // Check uninitialized case.
-    GotoIfNot(WordEqual(feedback, LoadRoot(RootIndex::kuninitialized_symbol)),
-              miss);
-    exit_point->ReturnCallStub(
-        Builtins::CallableFor(isolate(), Builtins::kLoadIC_Uninitialized),
-        p->context(), p->receiver(), p->name(), p->slot(), p->vector());
-  }
 }
 
-void AccessorAssembler::LoadIC_Uninitialized(const LoadICParameters* p) {
-  Label miss(this, Label::kDeferred),
-      check_function_prototype(this);
+void AccessorAssembler::LoadIC_NoFeedback(const LoadICParameters* p) {
+  Label miss(this, Label::kDeferred);
   Node* receiver = p->receiver();
   GotoIf(TaggedIsSmi(receiver), &miss);
-  Node* receiver_map = LoadMap(receiver);
-  Node* instance_type = LoadMapInstanceType(receiver_map);
-
-  GotoIf(IsUndefined(p->vector()), &check_function_prototype);
-  // Optimistically write the state transition to the vector.
-  StoreFeedbackVectorSlot(p->vector(), p->slot(),
-                          LoadRoot(RootIndex::kpremonomorphic_symbol),
-                          SKIP_WRITE_BARRIER, 0, SMI_PARAMETERS);
-  StoreWeakReferenceInFeedbackVector(p->vector(), p->slot(), receiver_map,
-                                     kTaggedSize, SMI_PARAMETERS);
-  Goto(&check_function_prototype);
+  TNode<Map> receiver_map = LoadMap(receiver);
+  TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
 
-  BIND(&check_function_prototype);
   {
     // Special case for Function.prototype load, because it's very common
     // for ICs that are only executed once (MyFunc.prototype.foo = ...).
@@ -2644,9 +2657,9 @@ void AccessorAssembler::LoadIC_Uninitialized(const LoadICParameters* p) {
               &not_function_prototype);
     GotoIfNot(IsPrototypeString(p->name()), &not_function_prototype);
 
-    GotoIfPrototypeRequiresRuntimeLookup(CAST(receiver), CAST(receiver_map),
+    GotoIfPrototypeRequiresRuntimeLookup(CAST(receiver), receiver_map,
                                          &not_function_prototype);
-    Return(LoadJSFunctionPrototype(receiver, &miss));
+    Return(LoadJSFunctionPrototype(CAST(receiver), &miss));
     BIND(&not_function_prototype);
   }
 
@@ -2655,15 +2668,6 @@ void AccessorAssembler::LoadIC_Uninitialized(const LoadICParameters* p) {
 
   BIND(&miss);
   {
-    Label call_runtime(this, Label::kDeferred);
-    GotoIf(IsUndefined(p->vector()), &call_runtime);
-    // Undo the optimistic state transition.
-    StoreFeedbackVectorSlot(p->vector(), p->slot(),
-                            LoadRoot(RootIndex::kuninitialized_symbol),
-                            SKIP_WRITE_BARRIER, 0, SMI_PARAMETERS);
-    Goto(&call_runtime);
-
-    BIND(&call_runtime);
     TailCallRuntime(Runtime::kLoadIC_Miss, p->context(), p->receiver(),
                     p->name(), p->slot(), p->vector());
   }
@@ -2715,7 +2719,7 @@ void AccessorAssembler::LoadGlobalIC_TryPropertyCellCase(
         CAST(GetHeapObjectAssumeWeak(maybe_weak_ref, try_handler));
     TNode<Object> value =
         LoadObjectField(property_cell, PropertyCell::kValueOffset);
-    GotoIf(WordEqual(value, TheHoleConstant()), miss);
+    GotoIf(TaggedEqual(value, TheHoleConstant()), miss);
     exit_point->Return(value);
   }
 
@@ -2746,7 +2750,7 @@ void AccessorAssembler::LoadGlobalIC_TryHandlerCase(
   TNode<MaybeObject> feedback_element =
       LoadFeedbackVectorSlot(vector, slot, kTaggedSize, slot_mode);
   TNode<Object> handler = CAST(feedback_element);
-  GotoIf(WordEqual(handler, LoadRoot(RootIndex::kuninitialized_symbol)), miss);
+  GotoIf(TaggedEqual(handler, UninitializedSymbolConstant()), miss);
 
   OnNonExistent on_nonexistent = typeof_mode == NOT_INSIDE_TYPEOF
                                      ? OnNonExistent::kThrowReferenceError
@@ -2756,7 +2760,8 @@ void AccessorAssembler::LoadGlobalIC_TryHandlerCase(
   TNode<Context> native_context = LoadNativeContext(context);
   TNode<JSGlobalProxy> receiver =
       CAST(LoadContextElement(native_context, Context::GLOBAL_PROXY_INDEX));
-  Node* holder = LoadContextElement(native_context, Context::EXTENSION_INDEX);
+  TNode<Object> holder =
+      LoadContextElement(native_context, Context::EXTENSION_INDEX);
 
   LazyLoadICParameters p([=] { return context; }, receiver, lazy_name,
                          ParameterToTagged(slot, slot_mode), vector, holder);
@@ -2772,10 +2777,11 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p,
   TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), try_polymorphic(this, Label::kDeferred),
       try_megamorphic(this, Label::kDeferred),
+      try_uninitialized(this, Label::kDeferred),
       try_polymorphic_name(this, Label::kDeferred),
       miss(this, Label::kDeferred), generic(this, Label::kDeferred);
 
-  Node* receiver_map = LoadReceiverMap(p->receiver());
+  TNode<Map> receiver_map = LoadReceiverMap(p->receiver());
   GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
   GotoIf(IsUndefined(p->vector()), &generic);
@@ -2807,8 +2813,8 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p,
   {
     // Check megamorphic case.
     Comment("KeyedLoadIC_try_megamorphic");
-    Branch(WordEqual(strong_feedback, LoadRoot(RootIndex::kmegamorphic_symbol)),
-           &generic, &try_polymorphic_name);
+    Branch(TaggedEqual(strong_feedback, MegamorphicSymbolConstant()), &generic,
+           &try_uninitialized);
   }
 
   BIND(&generic);
@@ -2821,42 +2827,49 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p,
                     p->vector());
   }
 
+  BIND(&try_uninitialized);
+  {
+    // Check uninitialized case.
+    Comment("KeyedLoadIC_try_uninitialized");
+    Branch(TaggedEqual(strong_feedback, UninitializedSymbolConstant()), &miss,
+           &try_polymorphic_name);
+  }
+
   BIND(&try_polymorphic_name);
   {
     // We might have a name in feedback, and a weak fixed array in the next
     // slot.
-    Node* name = p->name();
     Comment("KeyedLoadIC_try_polymorphic_name");
-    VARIABLE(var_name, MachineRepresentation::kTagged, name);
-    VARIABLE(var_index, MachineType::PointerRepresentation());
+    TVARIABLE(Object, var_name, p->name());
+    TVARIABLE(IntPtrT, var_index);
     Label if_polymorphic_name(this, &var_name), if_internalized(this),
         if_notinternalized(this, Label::kDeferred);
 
     // Fast-case: The recorded {feedback} matches the {name}.
-    GotoIf(WordEqual(strong_feedback, name), &if_polymorphic_name);
+    GotoIf(TaggedEqual(strong_feedback, p->name()), &if_polymorphic_name);
 
     // Try to internalize the {name} if it isn't already.
-    TryToName(name, &miss, &var_index, &if_internalized, &var_name, &miss,
+    TryToName(p->name(), &miss, &var_index, &if_internalized, &var_name, &miss,
               &if_notinternalized);
 
     BIND(&if_internalized);
     {
       // The {var_name} now contains a unique name.
-      Branch(WordEqual(strong_feedback, var_name.value()), &if_polymorphic_name,
-             &miss);
+      Branch(TaggedEqual(strong_feedback, var_name.value()),
+             &if_polymorphic_name, &miss);
     }
 
     BIND(&if_notinternalized);
     {
       // Try to internalize the {name}.
-      Node* function = ExternalConstant(
+      TNode<ExternalReference> function = ExternalConstant(
           ExternalReference::try_internalize_string_function());
-      Node* const isolate_ptr =
+      TNode<ExternalReference> const isolate_ptr =
           ExternalConstant(ExternalReference::isolate_address(isolate()));
-      var_name.Bind(
+      var_name = CAST(
           CallCFunction(function, MachineType::AnyTagged(),
                         std::make_pair(MachineType::Pointer(), isolate_ptr),
-                        std::make_pair(MachineType::AnyTagged(), name)));
+                        std::make_pair(MachineType::AnyTagged(), p->name())));
       Goto(&if_internalized);
     }
 
@@ -2864,11 +2877,10 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p,
     {
       // If the name comparison succeeded, we know we have a weak fixed array
       // with at least one map/handler pair.
-      Node* name = var_name.value();
       TailCallBuiltin(access_mode == LoadAccessMode::kLoad
                           ? Builtins::kKeyedLoadIC_PolymorphicName
                           : Builtins::kKeyedHasIC_PolymorphicName,
-                      p->context(), p->receiver(), name, p->slot(),
+                      p->context(), p->receiver(), var_name.value(), p->slot(),
                       p->vector());
     }
   }
@@ -2884,8 +2896,8 @@ void AccessorAssembler::KeyedLoadIC(const LoadICParameters* p,
 }
 
 void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
-  VARIABLE(var_index, MachineType::PointerRepresentation());
-  VARIABLE(var_unique, MachineRepresentation::kTagged, p->name());
+  TVARIABLE(IntPtrT, var_index);
+  TVARIABLE(Object, var_unique, p->name());
   Label if_index(this), if_unique_name(this), if_notunique(this),
       if_other(this, Label::kDeferred), if_runtime(this, Label::kDeferred);
 
@@ -2898,16 +2910,17 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
 
   BIND(&if_other);
   {
-    Node* name = CallBuiltin(Builtins::kToName, p->context(), p->name());
-    var_unique.Bind(name);
+    TNode<Name> name =
+        CAST(CallBuiltin(Builtins::kToName, p->context(), p->name()));
+    var_unique = name;
     TryToName(name, &if_index, &var_index, &if_unique_name, &var_unique,
               &if_runtime, &if_notunique);
   }
 
   BIND(&if_index);
   {
-    Node* receiver_map = LoadMap(receiver);
-    Node* instance_type = LoadMapInstanceType(receiver_map);
+    TNode<Map> receiver_map = LoadMap(receiver);
+    TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
     GenericElementLoad(receiver, receiver_map, instance_type, var_index.value(),
                        &if_runtime);
   }
@@ -2915,8 +2928,8 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
   BIND(&if_unique_name);
   {
     LoadICParameters pp(p, var_unique.value());
-    Node* receiver_map = LoadMap(receiver);
-    Node* instance_type = LoadMapInstanceType(receiver_map);
+    TNode<Map> receiver_map = LoadMap(receiver);
+    TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
     GenericPropertyLoad(receiver, receiver_map, instance_type, &pp,
                         &if_runtime);
   }
@@ -2941,8 +2954,8 @@ void AccessorAssembler::KeyedLoadICGeneric(const LoadICParameters* p) {
         // with this have shown that it causes too much traffic on the stub
         // cache. We may want to re-evaluate that in the future.
         LoadICParameters pp(p, var_unique.value());
-        Node* receiver_map = LoadMap(receiver);
-        Node* instance_type = LoadMapInstanceType(receiver_map);
+        TNode<Map> receiver_map = LoadMap(receiver);
+        TNode<Uint16T> instance_type = LoadMapInstanceType(receiver_map);
         GenericPropertyLoad(receiver, receiver_map, instance_type, &pp,
                             &if_runtime, kDontUseStubCache);
       }
@@ -2967,8 +2980,8 @@ void AccessorAssembler::KeyedLoadICPolymorphicName(const LoadICParameters* p,
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
   Node* receiver = p->receiver();
-  Node* receiver_map = LoadReceiverMap(receiver);
-  Node* name = p->name();
+  TNode<Map> receiver_map = LoadReceiverMap(receiver);
+  TNode<Name> name = CAST(p->name());
   Node* vector = p->vector();
   Node* slot = p->slot();
   TNode<Context> context = p->context();
@@ -2976,10 +2989,11 @@ void AccessorAssembler::KeyedLoadICPolymorphicName(const LoadICParameters* p,
   // When we get here, we know that the {name} matches the recorded
   // feedback name in the {vector} and can safely be used for the
   // LoadIC handler logic below.
-  CSA_ASSERT(this, IsName(name));
   CSA_ASSERT(this, Word32BinaryNot(IsDeprecatedMap(receiver_map)));
-  CSA_ASSERT(this, WordEqual(name, CAST(LoadFeedbackVectorSlot(
-                                       vector, slot, 0, SMI_PARAMETERS))));
+  CSA_ASSERT(this,
+             TaggedEqual(
+                 name, LoadFeedbackVectorSlot(vector, slot, 0, SMI_PARAMETERS)),
+             name, vector);
 
   // Check if we have a matching handler for the {receiver_map}.
   TNode<MaybeObject> feedback_element =
@@ -3014,11 +3028,10 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
   Label if_handler(this, &var_handler),
       if_handler_from_stub_cache(this, &var_handler, Label::kDeferred),
       try_polymorphic(this, Label::kDeferred),
-      try_megamorphic(this, Label::kDeferred),
-      try_uninitialized(this, Label::kDeferred), miss(this, Label::kDeferred),
+      try_megamorphic(this, Label::kDeferred), miss(this, Label::kDeferred),
       no_feedback(this, Label::kDeferred);
 
-  Node* receiver_map = LoadReceiverMap(p->receiver());
+  TNode<Map> receiver_map = LoadReceiverMap(p->receiver());
   GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
   GotoIf(IsUndefined(p->vector()), &no_feedback);
@@ -3047,26 +3060,16 @@ void AccessorAssembler::StoreIC(const StoreICParameters* p) {
   BIND(&try_megamorphic);
   {
     // Check megamorphic case.
-    GotoIfNot(
-        WordEqual(strong_feedback, LoadRoot(RootIndex::kmegamorphic_symbol)),
-        &try_uninitialized);
+    GotoIfNot(TaggedEqual(strong_feedback, MegamorphicSymbolConstant()), &miss);
 
     TryProbeStubCache(isolate()->store_stub_cache(), p->receiver(), p->name(),
                       &if_handler, &var_handler, &miss);
   }
-  BIND(&try_uninitialized);
-  {
-    // Check uninitialized case.
-    Branch(
-        WordEqual(strong_feedback, LoadRoot(RootIndex::kuninitialized_symbol)),
-        &no_feedback, &miss);
-  }
 
   BIND(&no_feedback);
   {
-    TailCallBuiltin(Builtins::kStoreIC_Uninitialized, p->context(),
-                    p->receiver(), p->name(), p->value(), p->slot(),
-                    p->vector());
+    TailCallBuiltin(Builtins::kStoreIC_NoFeedback, p->context(), p->receiver(),
+                    p->name(), p->value(), p->slot());
   }
 
   BIND(&miss);
@@ -3085,9 +3088,11 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
   BIND(&if_heapobject);
   {
     Label try_handler(this), miss(this, Label::kDeferred);
-    GotoIf(
-        WordEqual(maybe_weak_ref, LoadRoot(RootIndex::kpremonomorphic_symbol)),
-        &miss);
+    // We use pre-monomorphic state for global stores that run into
+    // interceptors because the property doesn't exist yet. Using
+    // pre-monomorphic state gives it a chance to find more information the
+    // second time.
+    GotoIf(TaggedEqual(maybe_weak_ref, PremonomorphicSymbolConstant()), &miss);
 
     CSA_ASSERT(this, IsWeakOrCleared(maybe_weak_ref));
     TNode<PropertyCell> property_cell =
@@ -3103,11 +3108,10 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
       TNode<MaybeObject> handler = LoadFeedbackVectorSlot(
           pp->vector(), pp->slot(), kTaggedSize, SMI_PARAMETERS);
 
-      GotoIf(WordEqual(handler, LoadRoot(RootIndex::kuninitialized_symbol)),
-             &miss);
+      GotoIf(TaggedEqual(handler, UninitializedSymbolConstant()), &miss);
 
       DCHECK_NULL(pp->receiver());
-      Node* native_context = LoadNativeContext(pp->context());
+      TNode<Context> native_context = LoadNativeContext(pp->context());
       StoreICParameters p(
           pp->context(),
           LoadContextElement(native_context, Context::GLOBAL_PROXY_INDEX),
@@ -3139,7 +3143,7 @@ void AccessorAssembler::StoreGlobalIC(const StoreICParameters* pp) {
 }
 
 void AccessorAssembler::StoreGlobalIC_PropertyCellCase(Node* property_cell,
-                                                       Node* value,
+                                                       TNode<Object> value,
                                                        ExitPoint* exit_point,
                                                        Label* miss) {
   Comment("StoreGlobalIC_TryPropertyCellCase");
@@ -3148,16 +3152,17 @@ void AccessorAssembler::StoreGlobalIC_PropertyCellCase(Node* property_cell,
   // Load the payload of the global parameter cell. A hole indicates that
   // the cell has been invalidated and that the store must be handled by the
   // runtime.
-  Node* cell_contents =
+  TNode<Object> cell_contents =
       LoadObjectField(property_cell, PropertyCell::kValueOffset);
-  Node* details = LoadAndUntagToWord32ObjectField(
+  TNode<Int32T> details = LoadAndUntagToWord32ObjectField(
       property_cell, PropertyCell::kPropertyDetailsRawOffset);
   GotoIf(IsSetWord32(details, PropertyDetails::kAttributesReadOnlyMask), miss);
   CSA_ASSERT(this,
              Word32Equal(DecodeWord32<PropertyDetails::KindField>(details),
                          Int32Constant(kData)));
 
-  Node* type = DecodeWord32<PropertyDetails::PropertyCellTypeField>(details);
+  TNode<Uint32T> type =
+      DecodeWord32<PropertyDetails::PropertyCellTypeField>(details);
 
   Label constant(this), store(this), not_smi(this);
 
@@ -3183,9 +3188,9 @@ void AccessorAssembler::StoreGlobalIC_PropertyCellCase(Node* property_cell,
   BIND(&not_smi);
   {
     GotoIf(TaggedIsSmi(value), miss);
-    Node* expected_map = LoadMap(cell_contents);
-    Node* map = LoadMap(value);
-    GotoIfNot(WordEqual(expected_map, map), miss);
+    TNode<Map> expected_map = LoadMap(CAST(cell_contents));
+    TNode<Map> map = LoadMap(CAST(value));
+    GotoIfNot(TaggedEqual(expected_map, map), miss);
     Goto(&store);
   }
 
@@ -3197,7 +3202,7 @@ void AccessorAssembler::StoreGlobalIC_PropertyCellCase(Node* property_cell,
 
   BIND(&constant);
   {
-    GotoIfNot(WordEqual(cell_contents, value), miss);
+    GotoIfNot(TaggedEqual(cell_contents, value), miss);
     exit_point->Return(value);
   }
 }
@@ -3213,7 +3218,7 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
         no_feedback(this, Label::kDeferred),
         try_polymorphic_name(this, Label::kDeferred);
 
-    Node* receiver_map = LoadReceiverMap(p->receiver());
+    TNode<Map> receiver_map = LoadReceiverMap(p->receiver());
     GotoIf(IsDeprecatedMap(receiver_map), &miss);
 
     GotoIf(IsUndefined(p->vector()), &no_feedback);
@@ -3244,9 +3249,8 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
     {
       // Check megamorphic case.
       Comment("KeyedStoreIC_try_megamorphic");
-      Branch(
-          WordEqual(strong_feedback, LoadRoot(RootIndex::kmegamorphic_symbol)),
-          &no_feedback, &try_polymorphic_name);
+      Branch(TaggedEqual(strong_feedback, MegamorphicSymbolConstant()),
+             &no_feedback, &try_polymorphic_name);
     }
 
     BIND(&no_feedback);
@@ -3259,7 +3263,7 @@ void AccessorAssembler::KeyedStoreIC(const StoreICParameters* p) {
     {
       // We might have a name in feedback, and a fixed array in the next slot.
       Comment("KeyedStoreIC_try_polymorphic_name");
-      GotoIfNot(WordEqual(strong_feedback, p->name()), &miss);
+      GotoIfNot(TaggedEqual(strong_feedback, p->name()), &miss);
       // If the name comparison succeeded, we know we have a feedback vector
       // with at least one map/handler pair.
       TNode<MaybeObject> feedback_element = LoadFeedbackVectorSlot(
@@ -3286,7 +3290,7 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
         try_polymorphic(this, Label::kDeferred),
         try_megamorphic(this, Label::kDeferred);
 
-    Node* array_map = LoadReceiverMap(p->receiver());
+    TNode<Map> array_map = LoadReceiverMap(p->receiver());
     GotoIf(IsDeprecatedMap(array_map), &miss);
 
     GotoIf(IsUndefined(p->vector()), &miss);
@@ -3314,8 +3318,8 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
         TNode<Map> transition_map =
             CAST(GetHeapObjectAssumeWeak(maybe_transition_map, &miss));
         GotoIf(IsDeprecatedMap(transition_map), &miss);
-        Node* code = LoadObjectField(handler, StoreHandler::kSmiHandlerOffset);
-        CSA_ASSERT(this, IsCode(code));
+        TNode<Code> code =
+            CAST(LoadObjectField(handler, StoreHandler::kSmiHandlerOffset));
         TailCallStub(StoreTransitionDescriptor{}, code, p->context(),
                      p->receiver(), p->name(), transition_map, p->value(),
                      p->slot(), p->vector());
@@ -3335,14 +3339,12 @@ void AccessorAssembler::StoreInArrayLiteralIC(const StoreICParameters* p) {
     BIND(&try_megamorphic);
     {
       Comment("StoreInArrayLiteralIC_try_megamorphic");
-      CSA_ASSERT(this,
-                 Word32Or(WordEqual(strong_feedback,
-                                    LoadRoot(RootIndex::kuninitialized_symbol)),
-                          WordEqual(strong_feedback,
-                                    LoadRoot(RootIndex::kmegamorphic_symbol))));
-      GotoIfNot(
-          WordEqual(strong_feedback, LoadRoot(RootIndex::kmegamorphic_symbol)),
-          &miss);
+      CSA_ASSERT(
+          this,
+          Word32Or(TaggedEqual(strong_feedback, UninitializedSymbolConstant()),
+                   TaggedEqual(strong_feedback, MegamorphicSymbolConstant())));
+      GotoIfNot(TaggedEqual(strong_feedback, MegamorphicSymbolConstant()),
+                &miss);
       TailCallRuntime(Runtime::kStoreInArrayLiteralIC_Slow, p->context(),
                       p->value(), p->receiver(), p->name());
     }
@@ -3363,7 +3365,7 @@ void AccessorAssembler::GenerateLoadIC() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3376,7 +3378,7 @@ void AccessorAssembler::GenerateLoadIC_Megamorphic() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3390,7 +3392,7 @@ void AccessorAssembler::GenerateLoadIC_Megamorphic() {
 
   BIND(&if_handler);
   LazyLoadICParameters p([=] { return context; }, receiver,
-                         [=] { return CAST(name); }, slot, vector);
+                         [=] { return name; }, slot, vector);
   HandleLoadICHandlerCase(&p, CAST(var_handler.value()), &miss, &direct_exit);
 
   BIND(&miss);
@@ -3402,7 +3404,7 @@ void AccessorAssembler::GenerateLoadIC_Noninlined() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3411,7 +3413,7 @@ void AccessorAssembler::GenerateLoadIC_Noninlined() {
   TVARIABLE(MaybeObject, var_handler);
   Label if_handler(this, &var_handler), miss(this, Label::kDeferred);
 
-  Node* receiver_map = LoadReceiverMap(receiver);
+  TNode<Map> receiver_map = LoadReceiverMap(receiver);
   TNode<MaybeObject> feedback_element =
       LoadFeedbackVectorSlot(vector, slot, 0, SMI_PARAMETERS);
   TNode<HeapObject> feedback = CAST(feedback_element);
@@ -3432,27 +3434,26 @@ void AccessorAssembler::GenerateLoadIC_Noninlined() {
                                 slot, vector);
 }
 
-void AccessorAssembler::GenerateLoadIC_Uninitialized() {
-  using Descriptor = LoadWithVectorDescriptor;
+void AccessorAssembler::GenerateLoadIC_NoFeedback() {
+  using Descriptor = LoadDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
-  Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
 
-  LoadICParameters p(context, receiver, name, slot, vector);
-  LoadIC_Uninitialized(&p);
+  LoadICParameters p(context, receiver, name, slot, UndefinedConstant());
+  LoadIC_NoFeedback(&p);
 }
 
 void AccessorAssembler::GenerateLoadICTrampoline() {
   using Descriptor = LoadDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   TailCallBuiltin(Builtins::kLoadIC, context, receiver, name, slot, vector);
 }
@@ -3461,10 +3462,10 @@ void AccessorAssembler::GenerateLoadICTrampoline_Megamorphic() {
   using Descriptor = LoadDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   TailCallBuiltin(Builtins::kLoadIC_Megamorphic, context, receiver, name, slot,
                   vector);
@@ -3473,7 +3474,7 @@ void AccessorAssembler::GenerateLoadICTrampoline_Megamorphic() {
 void AccessorAssembler::GenerateLoadGlobalIC(TypeofMode typeof_mode) {
   using Descriptor = LoadGlobalWithVectorDescriptor;
 
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Name> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3484,16 +3485,16 @@ void AccessorAssembler::GenerateLoadGlobalIC(TypeofMode typeof_mode) {
       // lazy_context
       [=] { return context; },
       // lazy_name
-      [=] { return CAST(name); }, typeof_mode, &direct_exit);
+      [=] { return name; }, typeof_mode, &direct_exit);
 }
 
 void AccessorAssembler::GenerateLoadGlobalICTrampoline(TypeofMode typeof_mode) {
   using Descriptor = LoadGlobalDescriptor;
 
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   Callable callable =
       CodeFactory::LoadGlobalICInOptimizedCode(isolate(), typeof_mode);
@@ -3504,7 +3505,7 @@ void AccessorAssembler::GenerateKeyedLoadIC() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3517,7 +3518,7 @@ void AccessorAssembler::GenerateKeyedLoadIC_Megamorphic() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3530,10 +3531,10 @@ void AccessorAssembler::GenerateKeyedLoadICTrampoline() {
   using Descriptor = LoadDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   TailCallBuiltin(Builtins::kKeyedLoadIC, context, receiver, name, slot,
                   vector);
@@ -3543,10 +3544,10 @@ void AccessorAssembler::GenerateKeyedLoadICTrampoline_Megamorphic() {
   using Descriptor = LoadDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   TailCallBuiltin(Builtins::kKeyedLoadIC_Megamorphic, context, receiver, name,
                   slot, vector);
@@ -3556,7 +3557,7 @@ void AccessorAssembler::GenerateKeyedLoadIC_PolymorphicName() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3568,7 +3569,7 @@ void AccessorAssembler::GenerateKeyedLoadIC_PolymorphicName() {
 void AccessorAssembler::GenerateStoreGlobalIC() {
   using Descriptor = StoreGlobalWithVectorDescriptor;
 
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* value = Parameter(Descriptor::kValue);
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
@@ -3581,11 +3582,11 @@ void AccessorAssembler::GenerateStoreGlobalIC() {
 void AccessorAssembler::GenerateStoreGlobalICTrampoline() {
   using Descriptor = StoreGlobalDescriptor;
 
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* value = Parameter(Descriptor::kValue);
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   TailCallBuiltin(Builtins::kStoreGlobalIC, context, name, value, slot, vector);
 }
@@ -3594,7 +3595,7 @@ void AccessorAssembler::GenerateStoreIC() {
   using Descriptor = StoreWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* value = Parameter(Descriptor::kValue);
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
@@ -3608,11 +3609,11 @@ void AccessorAssembler::GenerateStoreICTrampoline() {
   using Descriptor = StoreDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* value = Parameter(Descriptor::kValue);
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   TailCallBuiltin(Builtins::kStoreIC, context, receiver, name, value, slot,
                   vector);
@@ -3622,7 +3623,7 @@ void AccessorAssembler::GenerateKeyedStoreIC() {
   using Descriptor = StoreWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* value = Parameter(Descriptor::kValue);
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
@@ -3636,11 +3637,11 @@ void AccessorAssembler::GenerateKeyedStoreICTrampoline() {
   using Descriptor = StoreDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* value = Parameter(Descriptor::kValue);
   Node* slot = Parameter(Descriptor::kSlot);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
-  Node* vector = LoadFeedbackVectorForStub();
+  TNode<FeedbackVector> vector = LoadFeedbackVectorForStub();
 
   TailCallBuiltin(Builtins::kKeyedStoreIC, context, receiver, name, value, slot,
                   vector);
@@ -3650,7 +3651,7 @@ void AccessorAssembler::GenerateStoreInArrayLiteralIC() {
   using Descriptor = StoreWithVectorDescriptor;
 
   Node* array = Parameter(Descriptor::kReceiver);
-  Node* index = Parameter(Descriptor::kName);
+  TNode<Object> index = CAST(Parameter(Descriptor::kName));
   Node* value = Parameter(Descriptor::kValue);
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
@@ -3798,8 +3799,8 @@ void AccessorAssembler::GenerateCloneObjectIC() {
     TNode<IntPtrT> field_offset_difference =
         TimesTaggedSize(IntPtrSub(result_start, source_start));
 
-    // Just copy the fields as raw data (pretending that there are no
-    // MutableHeapNumbers). This doesn't need write barriers.
+    // Just copy the fields as raw data (pretending that there are no mutable
+    // HeapNumbers). This doesn't need write barriers.
     BuildFastLoop(
         source_start, source_size,
         [=](Node* field_index) {
@@ -3813,7 +3814,7 @@ void AccessorAssembler::GenerateCloneObjectIC() {
         },
         1, INTPTR_PARAMETERS, IndexAdvanceMode::kPost);
 
-    // If MutableHeapNumbers can occur, we need to go through the {object}
+    // If mutable HeapNumbers can occur, we need to go through the {object}
     // again here and properly clone them. We use a second loop here to
     // ensure that the GC (and heap verifier) always sees properly initialized
     // objects, i.e. never hits undefined values in double fields.
@@ -3827,11 +3828,10 @@ void AccessorAssembler::GenerateCloneObjectIC() {
             TNode<Object> field = LoadObjectField(object, result_offset);
             Label if_done(this), if_mutableheapnumber(this, Label::kDeferred);
             GotoIf(TaggedIsSmi(field), &if_done);
-            Branch(IsMutableHeapNumber(CAST(field)), &if_mutableheapnumber,
-                   &if_done);
+            Branch(IsHeapNumber(CAST(field)), &if_mutableheapnumber, &if_done);
             BIND(&if_mutableheapnumber);
             {
-              TNode<Object> value = AllocateMutableHeapNumberWithValue(
+              TNode<HeapNumber> value = AllocateHeapNumberWithValue(
                   LoadHeapNumberValue(UncheckedCast<HeapNumber>(field)));
               StoreObjectField(object, result_offset, value);
               Goto(&if_done);
@@ -3856,14 +3856,11 @@ void AccessorAssembler::GenerateCloneObjectIC() {
   BIND(&try_megamorphic);
   {
     Comment("CloneObjectIC_try_megamorphic");
-    CSA_ASSERT(this,
-               Word32Or(WordEqual(strong_feedback,
-                                  LoadRoot(RootIndex::kuninitialized_symbol)),
-                        WordEqual(strong_feedback,
-                                  LoadRoot(RootIndex::kmegamorphic_symbol))));
-    GotoIfNot(
-        WordEqual(strong_feedback, LoadRoot(RootIndex::kmegamorphic_symbol)),
-        &miss);
+    CSA_ASSERT(
+        this,
+        Word32Or(TaggedEqual(strong_feedback, UninitializedSymbolConstant()),
+                 TaggedEqual(strong_feedback, MegamorphicSymbolConstant())));
+    GotoIfNot(TaggedEqual(strong_feedback, MegamorphicSymbolConstant()), &miss);
     Goto(&slow);
   }
 
@@ -3876,8 +3873,8 @@ void AccessorAssembler::GenerateCloneObjectIC() {
   BIND(&miss);
   {
     Comment("CloneObjectIC_miss");
-    Node* map_or_result = CallRuntime(Runtime::kCloneObjectIC_Miss, context,
-                                      source, flags, slot, vector);
+    TNode<HeapObject> map_or_result = CAST(CallRuntime(
+        Runtime::kCloneObjectIC_Miss, context, source, flags, slot, vector));
     var_handler = UncheckedCast<MaybeObject>(map_or_result);
     GotoIf(IsMap(map_or_result), &if_handler);
     CSA_ASSERT(this, IsJSObject(map_or_result));
@@ -3889,7 +3886,7 @@ void AccessorAssembler::GenerateKeyedHasIC() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
@@ -3902,7 +3899,7 @@ void AccessorAssembler::GenerateKeyedHasIC_Megamorphic() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));
   // TODO(magardn): implement HasProperty handling in KeyedLoadICGeneric
   Return(HasProperty(context, receiver, name,
@@ -3913,7 +3910,7 @@ void AccessorAssembler::GenerateKeyedHasIC_PolymorphicName() {
   using Descriptor = LoadWithVectorDescriptor;
 
   Node* receiver = Parameter(Descriptor::kReceiver);
-  Node* name = Parameter(Descriptor::kName);
+  TNode<Object> name = CAST(Parameter(Descriptor::kName));
   Node* slot = Parameter(Descriptor::kSlot);
   Node* vector = Parameter(Descriptor::kVector);
   TNode<Context> context = CAST(Parameter(Descriptor::kContext));