Reland "[torque] introduce JSAny type for user-accessible JavaScript values"

Changes in the reland: Rebased and added a check that JavaScript-linkage
builtins use JSAny in parameters and return type, plus the necessary
cleanups for this test to pass.

Design Doc: https://docs.google.com/document/d/1z6j0pWHnNIfId0v00uWN2HBrGRDJxJfYuCr5K7Kr1xA

This reverts commit 4418a7b9.

Original change's description:
> Revert "[torque] introduce JSAny type for user-accessible JavaScript values"
>
> This reverts commit 79b00555.
>
> Reason for revert: needs more discussion
>
> Original change's description:
> > [torque] introduce JSAny type for user-accessible JavaScript values
> >
> > This CL introduces a JSAny type for user-exposed JavaScript values and
> > a few new types to define it. Especially, it splits Symbol into
> > PrivateSymbol (not exposed) and PublicSymbol (JavaScript exposed
> > symbols).
> >
> > The change is mostly mechanical, but a few things are interesting:
> > - PropertyKey and JSPrimitive were designed to coincide with the spec
> >   notions of IsPropertyKey() and primitive value, respectively.
> > - Since Name is an open type, we define AnyName to be the known
> >   subtypes of Name. This is not too elegant, but by using AnyName
> >   instead of Name, typeswitch can properly conclude something if a
> >   subtype of Name is excluded.
> >
> > Small drive-by changes, which were necessary:
> > - Allow subtyping on label parameters.
> > - Fix the formatting of typeswitch, it was broken with union types
> >   in case types.
> >
> > Bug: v8:7793
> > Change-Id: I14b10507f8cf316ad85e048fe8d53d1df5e0bb13
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735322
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#63114}
>
> TBR=neis@chromium.org,jgruber@chromium.org,tebbi@chromium.org
>
> Change-Id: Ifde7881d74afe407628f40047997339d54cb2424
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:7793
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1741652
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63115}

TBR=neis@chromium.org,jgruber@chromium.org,tebbi@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7793
Change-Id: Icca34e3824f55009b984d9348fd21884400f0081
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1769316
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63395}

src/builtins/arguments.tq

@@ -8,7 +8,7 @@ struct Arguments {
   const length: intptr;
 }
 
-extern operator '[]' macro GetArgumentValue(Arguments, intptr): Object;
+extern operator '[]' macro GetArgumentValue(Arguments, intptr): JSAny;
 
 extern macro GetFrameArguments(FrameWithArguments, intptr): Arguments;
 

src/builtins/array-copywithin.tq

@@ -9,7 +9,7 @@ namespace array_copywithin {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.copyWithin
   transitioning javascript builtin ArrayPrototypeCopyWithin(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     // 1. Let O be ? ToObject(this value).
     const object: JSReceiver = ToObject_Inline(context, receiver);
 
@@ -68,7 +68,7 @@ namespace array_copywithin {
       // d. If fromPresent is true, then.
       if (fromPresent == True) {
         // i. Let fromVal be ? Get(O, fromKey).
-        const fromVal: Object = GetProperty(object, from);
+        const fromVal: JSAny = GetProperty(object, from);
 
         // ii. Perform ? Set(O, toKey, fromVal, true).
         SetProperty(object, to, fromVal);

src/builtins/array-every.tq

@@ -5,15 +5,14 @@
 namespace array {
   transitioning javascript builtin
   ArrayEveryLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object,
-      length: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -27,9 +26,9 @@ namespace array {
 
   transitioning javascript builtin
   ArrayEveryLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object, length: Object,
-      result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+      result: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -53,9 +52,9 @@ namespace array {
   }
 
   transitioning builtin ArrayEveryLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: Object,
-      _array: Object, o: JSReceiver, initialK: Number, length: Number,
-      _initialTo: Object): Object {
+      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
+      _array: JSAny, o: JSReceiver, initialK: Number, length: Number,
+      _initialTo: JSAny): JSAny {
     // 5. Let k be 0.
     // 6. Repeat, while k < len
     for (let k: Number = initialK; k < length; k++) {
@@ -69,10 +68,10 @@ namespace array {
       // 6c. If kPresent is true, then
       if (kPresent == True) {
         // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: Object = GetProperty(o, k);
+        const kValue: JSAny = GetProperty(o, k);
 
         // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
-        const result: Object = Call(context, callbackfn, thisArg, kValue, k, o);
+        const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
 
         // iii. If selected is true, then...
         if (!ToBoolean(result)) {
@@ -86,7 +85,7 @@ namespace array {
   }
 
   transitioning macro FastArrayEvery(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: Object): Object
+      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
       labels Bailout(Smi) {
     let k: Smi = 0;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
@@ -99,8 +98,8 @@ namespace array {
 
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k);
-      const value: Object = fastOW.LoadElementNoHole(k) otherwise continue;
-      const result: Object =
+      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+      const result: JSAny =
           Call(context, callbackfn, thisArg, value, k, fastOW.Get());
       if (!ToBoolean(result)) {
         return False;
@@ -111,8 +110,8 @@ namespace array {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.every
   transitioning javascript builtin
-  ArrayEvery(js-implicit context: Context, receiver: Object)(...arguments):
-      Object {
+  ArrayEvery(js-implicit context: Context, receiver: JSAny)(...arguments):
+      JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.every');
 
@@ -129,7 +128,7 @@ namespace array {
       const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
 
       // Special cases.
       try {

src/builtins/array-filter.tq

@@ -5,15 +5,15 @@
 namespace array_filter {
   transitioning javascript builtin
   ArrayFilterLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, array: Object, initialK: Object,
-      length: Object, initialTo: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+      length: JSAny, initialTo: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -29,10 +29,9 @@ namespace array_filter {
 
   transitioning javascript builtin
   ArrayFilterLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, array: Object, initialK: Object,
-      length: Object, valueK: Object, initialTo: Object,
-      result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+      length: JSAny, valueK: JSAny, initialTo: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -60,9 +59,9 @@ namespace array_filter {
   }
 
   transitioning builtin ArrayFilterLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: Object,
+      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
       array: JSReceiver, o: JSReceiver, initialK: Number, length: Number,
-      initialTo: Number): Object {
+      initialTo: Number): JSAny {
     let to: Number = initialTo;
     // 5. Let k be 0.
     // 6. Repeat, while k < len
@@ -77,10 +76,10 @@ namespace array_filter {
       // 6c. If kPresent is true, then
       if (kPresent == True) {
         // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: Object = GetProperty(o, k);
+        const kValue: JSAny = GetProperty(o, k);
 
         // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
-        const result: Object = Call(context, callbackfn, thisArg, kValue, k, o);
+        const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
 
         // iii. If selected is true, then...
         if (ToBoolean(result)) {
@@ -97,7 +96,7 @@ namespace array_filter {
   }
 
   transitioning macro FastArrayFilter(implicit context: Context)(
-      fastO: FastJSArray, len: Smi, callbackfn: Callable, thisArg: Object,
+      fastO: FastJSArray, len: Smi, callbackfn: Callable, thisArg: JSAny,
       output: FastJSArray) labels Bailout(Number, Number) {
     let k: Smi = 0;
     let to: Smi = 0;
@@ -112,8 +111,8 @@ namespace array_filter {
 
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k, to);
-      const value: Object = fastOW.LoadElementNoHole(k) otherwise continue;
-      const result: Object =
+      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+      const result: JSAny =
           Call(context, callbackfn, thisArg, value, k, fastOW.Get());
       if (ToBoolean(result)) {
         try {
@@ -147,8 +146,8 @@ namespace array_filter {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.filter
   transitioning javascript builtin
-  ArrayFilter(js-implicit context: Context, receiver: Object)(...arguments):
-      Object {
+  ArrayFilter(js-implicit context: Context, receiver: JSAny)(...arguments):
+      JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.filter');
 
@@ -165,7 +164,7 @@ namespace array_filter {
       const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
       let output: JSReceiver;
 
       // Special cases.

src/builtins/array-find.tq

@@ -5,15 +5,14 @@
 namespace array_find {
   transitioning javascript builtin
   ArrayFindLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object,
-      length: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized find implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -26,9 +25,9 @@ namespace array_find {
 
   transitioning javascript builtin
   ArrayFindLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      _callback: Object, _thisArg: Object, _initialK: Object, _length: Object,
-      _result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
+      _result: JSAny): JSAny {
     // This deopt continuation point is never actually called, it just
     // exists to make stack traces correct from a ThrowTypeError if the
     // callback was found to be non-callable.
@@ -40,9 +39,9 @@ namespace array_find {
   // before iteration continues.
   transitioning javascript builtin
   ArrayFindLoopAfterCallbackLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object, length: Object,
-      foundValue: Object, isFound: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+      foundValue: JSAny, isFound: JSAny): JSAny {
     // All continuation points in the optimized find implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -65,8 +64,8 @@ namespace array_find {
   }
 
   transitioning builtin ArrayFindLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: Object,
-      o: JSReceiver, initialK: Number, length: Number): Object {
+      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
+      o: JSReceiver, initialK: Number, length: Number): JSAny {
     // 5. Let k be 0.
     // 6. Repeat, while k < len
     for (let k: Number = initialK; k < length; k++) {
@@ -75,12 +74,11 @@ namespace array_find {
       // side-effect free and HasProperty/GetProperty do the conversion inline.
 
       // 6b. i. Let kValue be ? Get(O, Pk).
-      const value: Object = GetProperty(o, k);
+      const value: JSAny = GetProperty(o, k);
 
       // 6c. Let testResult be ToBoolean(? Call(predicate, T, <<kValue, k,
       // O>>)).
-      const testResult: Object =
-          Call(context, callbackfn, thisArg, value, k, o);
+      const testResult: JSAny = Call(context, callbackfn, thisArg, value, k, o);
 
       // 6d. If testResult is true, return kValue.
       if (ToBoolean(testResult)) {
@@ -93,7 +91,7 @@ namespace array_find {
   }
 
   transitioning macro FastArrayFind(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: Object): Object
+      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
       labels Bailout(Smi) {
     let k: Smi = 0;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
@@ -107,8 +105,8 @@ namespace array_find {
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k);
 
-      const value: Object = fastOW.LoadElementOrUndefined(k);
-      const testResult: Object =
+      const value: JSAny = fastOW.LoadElementOrUndefined(k);
+      const testResult: JSAny =
           Call(context, callbackfn, thisArg, value, k, fastOW.Get());
       if (ToBoolean(testResult)) {
         return value;
@@ -119,8 +117,8 @@ namespace array_find {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.find
   transitioning javascript builtin
-  ArrayPrototypeFind(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  ArrayPrototypeFind(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.find');
 
@@ -138,7 +136,7 @@ namespace array_find {
           Cast<Callable>(arguments[0]) otherwise NotCallableError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
 
       // Special cases.
       try {

src/builtins/array-findindex.tq

@@ -5,15 +5,14 @@
 namespace array_findindex {
   transitioning javascript builtin
   ArrayFindIndexLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object,
-      length: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized findIndex implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -26,9 +25,9 @@ namespace array_findindex {
 
   transitioning javascript builtin
   ArrayFindIndexLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      _callback: Object, _thisArg: Object, _initialK: Object, _length: Object,
-      _result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      _callback: JSAny, _thisArg: JSAny, _initialK: JSAny, _length: JSAny,
+      _result: JSAny): JSAny {
     // This deopt continuation point is never actually called, it just
     // exists to make stack traces correct from a ThrowTypeError if the
     // callback was found to be non-callable.
@@ -40,9 +39,9 @@ namespace array_findindex {
   // before iteration continues.
   transitioning javascript builtin
   ArrayFindIndexLoopAfterCallbackLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object, length: Object,
-      foundValue: Object, isFound: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+      foundValue: JSAny, isFound: JSAny): JSAny {
     // All continuation points in the optimized findIndex implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -66,7 +65,7 @@ namespace array_findindex {
 
   transitioning builtin ArrayFindIndexLoopContinuation(implicit context:
                                                            Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: Object,
+      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
       o: JSReceiver, initialK: Number, length: Number): Number {
     // 5. Let k be 0.
     // 6. Repeat, while k < len
@@ -76,12 +75,11 @@ namespace array_findindex {
       // side-effect free and HasProperty/GetProperty do the conversion inline.
 
       // 6b. i. Let kValue be ? Get(O, Pk).
-      const value: Object = GetProperty(o, k);
+      const value: JSAny = GetProperty(o, k);
 
       // 6c. Let testResult be ToBoolean(? Call(predicate, T, <<kValue, k,
       // O>>)).
-      const testResult: Object =
-          Call(context, callbackfn, thisArg, value, k, o);
+      const testResult: JSAny = Call(context, callbackfn, thisArg, value, k, o);
 
       // 6d. If testResult is true, return k.
       if (ToBoolean(testResult)) {
@@ -94,7 +92,7 @@ namespace array_findindex {
   }
 
   transitioning macro FastArrayFindIndex(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: Object): Number
+      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): Number
       labels Bailout(Smi) {
     let k: Smi = 0;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
@@ -108,8 +106,8 @@ namespace array_findindex {
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k);
 
-      const value: Object = fastOW.LoadElementOrUndefined(k);
-      const testResult: Object =
+      const value: JSAny = fastOW.LoadElementOrUndefined(k);
+      const testResult: JSAny =
           Call(context, callbackfn, thisArg, value, k, fastOW.Get());
       if (ToBoolean(testResult)) {
         return k;
@@ -120,8 +118,8 @@ namespace array_findindex {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.findIndex
   transitioning javascript builtin
-  ArrayPrototypeFindIndex(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  ArrayPrototypeFindIndex(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.findIndex');
 
@@ -139,7 +137,7 @@ namespace array_findindex {
           Cast<Callable>(arguments[0]) otherwise NotCallableError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
 
       // Special cases.
       try {

src/builtins/array-foreach.tq

@@ -5,9 +5,8 @@
 namespace array_foreach {
   transitioning javascript builtin
   ArrayForEachLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object,
-      length: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized forEach implemntation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -23,9 +22,9 @@ namespace array_foreach {
 
   transitioning javascript builtin
   ArrayForEachLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object, length: Object,
-      _result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+      _result: JSAny): JSAny {
     // All continuation points in the optimized forEach implemntation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -40,9 +39,9 @@ namespace array_foreach {
   }
 
   transitioning builtin ArrayForEachLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: Object,
-      _array: Object, o: JSReceiver, initialK: Number, len: Number,
-      _to: Object): Object {
+      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
+      _array: JSAny, o: JSReceiver, initialK: Number, len: Number,
+      _to: JSAny): JSAny {
     // variables {array} and {to} are ignored.
 
     // 5. Let k be 0.
@@ -58,7 +57,7 @@ namespace array_foreach {
       // 6c. If kPresent is true, then
       if (kPresent == True) {
         // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: Object = GetProperty(o, k);
+        const kValue: JSAny = GetProperty(o, k);
 
         // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
         Call(context, callbackfn, thisArg, kValue, k, o);
@@ -70,7 +69,7 @@ namespace array_foreach {
   }
 
   transitioning macro FastArrayForEach(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: Object): Object
+      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
       labels Bailout(Smi) {
     let k: Smi = 0;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
@@ -83,7 +82,7 @@ namespace array_foreach {
 
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k);
-      const value: Object = fastOW.LoadElementNoHole(k)
+      const value: JSAny = fastOW.LoadElementNoHole(k)
           otherwise continue;
       Call(context, callbackfn, thisArg, value, k, fastOW.Get());
     }
@@ -92,8 +91,8 @@ namespace array_foreach {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.foreach
   transitioning javascript builtin
-  ArrayForEach(js-implicit context: Context, receiver: Object)(...arguments):
-      Object {
+  ArrayForEach(js-implicit context: Context, receiver: JSAny)(...arguments):
+      JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.forEach');
 
@@ -110,7 +109,7 @@ namespace array_foreach {
       const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
 
       // Special cases.
       let k: Number = 0;

src/builtins/array-join.tq

@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 namespace array_join {
-  type LoadJoinElementFn = builtin(Context, JSReceiver, Number) => Object;
+  type LoadJoinElementFn = builtin(Context, JSReceiver, Number) => JSAny;
 
   // Fast C call to write a fixed array (see Buffer.fixedArray) to a single
   // string.
@@ -12,12 +12,12 @@ namespace array_join {
       FixedArray, intptr, String, String): String;
 
   transitioning builtin LoadJoinElement<T: type>(
-      context: Context, receiver: JSReceiver, k: Number): Object {
+      context: Context, receiver: JSReceiver, k: Number): JSAny {
     return GetProperty(receiver, k);
   }
 
   transitioning LoadJoinElement<array::DictionaryElements>(
-      context: Context, receiver: JSReceiver, k: Number): Object {
+      context: Context, receiver: JSReceiver, k: Number): JSAny {
     const array: JSArray = UnsafeCast<JSArray>(receiver);
     const dict: NumberDictionary = UnsafeCast<NumberDictionary>(array.elements);
     try {
@@ -33,15 +33,15 @@ namespace array_join {
   }
 
   LoadJoinElement<array::FastSmiOrObjectElements>(
-      context: Context, receiver: JSReceiver, k: Number): Object {
+      context: Context, receiver: JSReceiver, k: Number): JSAny {
     const array: JSArray = UnsafeCast<JSArray>(receiver);
     const fixedArray: FixedArray = UnsafeCast<FixedArray>(array.elements);
     const element: Object = fixedArray.objects[UnsafeCast<Smi>(k)];
-    return element == TheHole ? kEmptyString : element;
+    return element == TheHole ? kEmptyString : UnsafeCast<JSAny>(element);
   }
 
   LoadJoinElement<array::FastDoubleElements>(
-      context: Context, receiver: JSReceiver, k: Number): Object {
+      context: Context, receiver: JSReceiver, k: Number): JSAny {
     const array: JSArray = UnsafeCast<JSArray>(receiver);
     const fixedDoubleArray: FixedDoubleArray =
         UnsafeCast<FixedDoubleArray>(array.elements);
@@ -51,7 +51,7 @@ namespace array_join {
   }
 
   builtin LoadJoinTypedElement<T: type>(
-      context: Context, receiver: JSReceiver, k: Number): Object {
+      context: Context, receiver: JSReceiver, k: Number): JSAny {
     const typedArray: JSTypedArray = UnsafeCast<JSTypedArray>(receiver);
     assert(!IsDetachedBuffer(typedArray.buffer));
     return typed_array::LoadFixedTypedArrayElementAsTagged(
@@ -60,14 +60,14 @@ namespace array_join {
   }
 
   transitioning builtin ConvertToLocaleString(
-      context: Context, element: Object, locales: Object,
-      options: Object): String {
+      context: Context, element: JSAny, locales: JSAny,
+      options: JSAny): String {
     if (IsNullOrUndefined(element)) return kEmptyString;
 
-    const prop: Object = GetProperty(element, 'toLocaleString');
+    const prop: JSAny = GetProperty(element, 'toLocaleString');
     try {
       const callable: Callable = Cast<Callable>(prop) otherwise TypeError;
-      let result: Object;
+      let result: JSAny;
       if (IsNullOrUndefined(locales)) {
         result = Call(context, callable, element);
       } else if (IsNullOrUndefined(options)) {
@@ -257,7 +257,7 @@ namespace array_join {
 
   transitioning macro ArrayJoinImpl<T: type>(implicit context: Context)(
       receiver: JSReceiver, sep: String, lengthNumber: Number,
-      useToLocaleString: constexpr bool, locales: Object, options: Object,
+      useToLocaleString: constexpr bool, locales: JSAny, options: JSAny,
       initialLoadFn: LoadJoinElementFn): String {
     const initialMap: Map = receiver.map;
     const len: uintptr = Convert<uintptr>(lengthNumber);
@@ -283,7 +283,7 @@ namespace array_join {
       }
 
       // b. Let element be ? Get(O, ! ToString(k)).
-      const element: Object = loadFn(context, receiver, Convert<Number>(k++));
+      const element: JSAny = loadFn(context, receiver, Convert<Number>(k++));
 
       // c. If element is undefined or null, let next be the empty String;
       //    otherwise, let next be ? ToString(element).
@@ -300,7 +300,7 @@ namespace array_join {
           case (num: Number): {
             next = NumberToString(num);
           }
-          case (obj: HeapObject): {
+          case (obj: JSAny): {
             if (IsNullOrUndefined(obj)) continue;
             next = ToString(context, obj);
           }
@@ -321,11 +321,11 @@ namespace array_join {
 
   transitioning macro ArrayJoin<T: type>(implicit context: Context)(
       useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
-      lenNumber: Number, locales: Object, options: Object): Object;
+      lenNumber: Number, locales: JSAny, options: JSAny): JSAny;
 
   transitioning ArrayJoin<JSArray>(implicit context: Context)(
       useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
-      lenNumber: Number, locales: Object, options: Object): Object {
+      lenNumber: Number, locales: JSAny, options: JSAny): JSAny {
     const map: Map = receiver.map;
     const kind: ElementsKind = map.elements_kind;
     let loadFn: LoadJoinElementFn;
@@ -372,7 +372,7 @@ namespace array_join {
 
   transitioning ArrayJoin<JSTypedArray>(implicit context: Context)(
       useToLocaleString: constexpr bool, receiver: JSReceiver, sep: String,
-      lenNumber: Number, locales: Object, options: Object): Object {
+      lenNumber: Number, locales: JSAny, options: JSAny): JSAny {
     const map: Map = receiver.map;
     const kind: ElementsKind = map.elements_kind;
     let loadFn: LoadJoinElementFn;
@@ -486,7 +486,7 @@ namespace array_join {
   // Removes a receiver from the stack. The FixedArray will automatically shrink
   // to Heap::kMinJoinStackSize once the stack becomes empty.
   builtin JoinStackPop(implicit context: Context)(
-      stack: FixedArray, receiver: JSReceiver): Object {
+      stack: FixedArray, receiver: JSReceiver): JSAny {
     const len: intptr = stack.length_intptr;
     for (let i: intptr = 0; i < len; i++) {
       if (stack.objects[i] == receiver) {
@@ -526,7 +526,7 @@ namespace array_join {
   transitioning macro CycleProtectedArrayJoin<T: type>(implicit context:
                                                             Context)(
       useToLocaleString: constexpr bool, o: JSReceiver, len: Number,
-      sepObj: Object, locales: Object, options: Object): Object {
+      sepObj: JSAny, locales: JSAny, options: JSAny): JSAny {
     // 3. If separator is undefined, let sep be the single-element String ",".
     // 4. Else, let sep be ? ToString(separator).
     const sep: String =
@@ -536,7 +536,7 @@ namespace array_join {
     // the normal join algorithm.
     if (len > 0 && JoinStackPushInline(o)) {
       try {
-        const result: Object =
+        const result: JSAny =
             ArrayJoin<T>(useToLocaleString, o, sep, len, locales, options);
         JoinStackPopInline(o);
         return result;
@@ -551,9 +551,9 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.join
   transitioning javascript builtin
-  ArrayPrototypeJoin(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
-    const separator: Object = arguments[0];
+  ArrayPrototypeJoin(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
+    const separator: JSAny = arguments[0];
 
     // 1. Let O be ? ToObject(this value).
     const o: JSReceiver = ToObject_Inline(context, receiver);
@@ -571,9 +571,9 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.tolocalestring
   transitioning javascript builtin ArrayPrototypeToLocaleString(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
-    const locales: Object = arguments[0];
-    const options: Object = arguments[1];
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+    const locales: JSAny = arguments[0];
+    const options: JSAny = arguments[1];
 
     // 1. Let O be ? ToObject(this value).
     const o: JSReceiver = ToObject_Inline(context, receiver);
@@ -591,12 +591,12 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.tostring
   transitioning javascript builtin ArrayPrototypeToString(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     // 1. Let array be ? ToObject(this value).
     const array: JSReceiver = ToObject_Inline(context, receiver);
 
     // 2. Let func be ? Get(array, "join").
-    const prop: Object = GetProperty(array, 'join');
+    const prop: JSAny = GetProperty(array, 'join');
     try {
       // 3. If IsCallable(func) is false, let func be the intrinsic function
       //    %ObjProto_toString%.
@@ -612,8 +612,8 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.join
   transitioning javascript builtin TypedArrayPrototypeJoin(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
-    const separator: Object = arguments[0];
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+    const separator: JSAny = arguments[0];
 
     // Spec: ValidateTypedArray is applied to the this value prior to evaluating
     // the algorithm.
@@ -627,9 +627,9 @@ namespace array_join {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.tolocalestring
   transitioning javascript builtin TypedArrayPrototypeToLocaleString(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
-    const locales: Object = arguments[0];
-    const options: Object = arguments[1];
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
+    const locales: JSAny = arguments[0];
+    const options: JSAny = arguments[1];
 
     // Spec: ValidateTypedArray is applied to the this value prior to evaluating
     // the algorithm.

src/builtins/array-lastindexof.tq

@@ -4,20 +4,20 @@
 
 namespace array_lastindexof {
   macro LoadWithHoleCheck<Elements: type>(
-      elements: FixedArrayBase, index: Smi): Object
+      elements: FixedArrayBase, index: Smi): JSAny
       labels IfHole;
 
   LoadWithHoleCheck<FixedArray>(implicit context: Context)(
-      elements: FixedArrayBase, index: Smi): Object
+      elements: FixedArrayBase, index: Smi): JSAny
       labels IfHole {
     const elements: FixedArray = UnsafeCast<FixedArray>(elements);
     const element: Object = elements.objects[index];
     if (element == TheHole) goto IfHole;
-    return element;
+    return UnsafeCast<JSAny>(element);
   }
 
   LoadWithHoleCheck<FixedDoubleArray>(implicit context: Context)(
-      elements: FixedArrayBase, index: Smi): Object
+      elements: FixedArrayBase, index: Smi): JSAny
       labels IfHole {
     const elements: FixedDoubleArray = UnsafeCast<FixedDoubleArray>(elements);
     const element: float64 = LoadDoubleWithHoleCheck(elements, index)
@@ -26,7 +26,7 @@ namespace array_lastindexof {
   }
 
   macro FastArrayLastIndexOf<Elements: type>(
-      context: Context, array: JSArray, from: Smi, searchElement: Object): Smi {
+      context: Context, array: JSArray, from: Smi, searchElement: JSAny): Smi {
     const elements: FixedArrayBase = array.elements;
     let k: Smi = from;
 
@@ -40,7 +40,7 @@ namespace array_lastindexof {
 
     while (k >= 0) {
       try {
-        const element: Object = LoadWithHoleCheck<Elements>(elements, k)
+        const element: JSAny = LoadWithHoleCheck<Elements>(elements, k)
             otherwise Hole;
 
         const same: Boolean = StrictEqual(searchElement, element);
@@ -80,8 +80,8 @@ namespace array_lastindexof {
   }
 
   macro TryFastArrayLastIndexOf(
-      context: Context, receiver: JSReceiver, searchElement: Object,
-      from: Number): Object
+      context: Context, receiver: JSReceiver, searchElement: JSAny,
+      from: Number): JSAny
       labels Slow {
     const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
     const length: Smi = array.length;
@@ -99,8 +99,8 @@ namespace array_lastindexof {
   }
 
   transitioning macro GenericArrayLastIndexOf(
-      context: Context, object: JSReceiver, searchElement: Object,
-      from: Number): Object {
+      context: Context, object: JSReceiver, searchElement: JSAny,
+      from: Number): JSAny {
     let k: Number = from;
 
     // 7. Repeat, while k >= 0.
@@ -111,7 +111,7 @@ namespace array_lastindexof {
       // b. If kPresent is true, then.
       if (kPresent == True) {
         // i. Let elementK be ? Get(O, ! ToString(k)).
-        const element: Object = GetProperty(object, k);
+        const element: JSAny = GetProperty(object, k);
 
         // ii. Let same be the result of performing Strict Equality Comparison
         //     searchElement === elementK.
@@ -131,7 +131,7 @@ namespace array_lastindexof {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.lastIndexOf
   transitioning javascript builtin ArrayPrototypeLastIndexOf(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     // 1. Let O be ? ToObject(this value).
     const object: JSReceiver = ToObject_Inline(context, receiver);
 
@@ -144,7 +144,7 @@ namespace array_lastindexof {
     // Step 4 - 6.
     const from: Number = GetFromIndex(context, length, arguments);
 
-    const searchElement: Object = arguments[0];
+    const searchElement: JSAny = arguments[0];
 
     try {
       return TryFastArrayLastIndexOf(context, object, searchElement, from)

src/builtins/array-map.tq

@@ -5,15 +5,15 @@
 namespace array_map {
   transitioning javascript builtin
   ArrayMapLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, array: Object, initialK: Object,
-      length: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+      length: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -28,9 +28,9 @@ namespace array_map {
 
   transitioning javascript builtin
   ArrayMapLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, array: Object, initialK: Object,
-      length: Object, result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, array: JSAny, initialK: JSAny,
+      length: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized filter implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -57,9 +57,9 @@ namespace array_map {
   }
 
   transitioning builtin ArrayMapLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: Object,
+      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
       array: JSReceiver, o: JSReceiver, initialK: Number,
-      length: Number): Object {
+      length: Number): JSAny {
     // 6. Let k be 0.
     // 7. Repeat, while k < len
     for (let k: Number = initialK; k < length; k++) {
@@ -73,10 +73,10 @@ namespace array_map {
       // 7c. If kPresent is true, then:
       if (kPresent == True) {
         //  i. Let kValue be ? Get(O, Pk).
-        const kValue: Object = GetProperty(o, k);
+        const kValue: JSAny = GetProperty(o, k);
 
         // ii. Let mapped_value be ? Call(callbackfn, T, kValue, k, O).
-        const mappedValue: Object =
+        const mappedValue: JSAny =
             Call(context, callbackfn, thisArg, kValue, k, o);
 
         // iii. Perform ? CreateDataPropertyOrThrow(A, Pk, mapped_value).
@@ -127,12 +127,12 @@ namespace array_map {
             SmiUntag(length), kAllowLargeObjectAllocation);
         a = NewJSArray(map, this.fixedArray);
         for (let i: Smi = 0; i < validLength; i++) {
-          typeswitch (this.fixedArray.objects[i]) {
+          typeswitch (
+              UnsafeCast<(Number | TheHole)>(this.fixedArray.objects[i])) {
             case (n: Number): {
               elements.floats[i] = Convert<float64>(n);
             }
-            case (h: HeapObject): {
-              assert(h == TheHole);
+            case (TheHole): {
             }
           }
         }
@@ -147,7 +147,7 @@ namespace array_map {
       return a;
     }
 
-    StoreResult(implicit context: Context)(index: Smi, result: Object) {
+    StoreResult(implicit context: Context)(index: Smi, result: JSAny) {
       typeswitch (result) {
         case (s: Smi): {
           this.fixedArray.objects[index] = s;
@@ -156,7 +156,7 @@ namespace array_map {
           this.onlySmis = false;
           this.fixedArray.objects[index] = s;
         }
-        case (s: HeapObject): {
+        case (s: JSAnyNotNumber): {
           this.onlySmis = false;
           this.onlyNumbers = false;
           this.fixedArray.objects[index] = s;
@@ -185,7 +185,7 @@ namespace array_map {
 
   transitioning macro FastArrayMap(implicit context: Context)(
       fastO: FastJSArrayForRead, len: Smi, callbackfn: Callable,
-      thisArg: Object): JSArray
+      thisArg: JSAny): JSArray
       labels Bailout(JSArray, Smi) {
     let k: Smi = 0;
     let fastOW = NewFastJSArrayForReadWitness(fastO);
@@ -201,9 +201,9 @@ namespace array_map {
         if (k >= fastOW.Get().length) goto PrepareBailout(k);
 
         try {
-          const value: Object = fastOW.LoadElementNoHole(k)
+          const value: JSAny = fastOW.LoadElementNoHole(k)
               otherwise FoundHole;
-          const result: Object =
+          const result: JSAny =
               Call(context, callbackfn, thisArg, value, k, fastOW.Get());
           vector.StoreResult(k, result);
         }
@@ -224,8 +224,7 @@ namespace array_map {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.map
   transitioning javascript builtin
-  ArrayMap(js-implicit context: Context, receiver: Object)(...arguments):
-      Object {
+  ArrayMap(js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.map');
 
@@ -241,7 +240,7 @@ namespace array_map {
       const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
 
       let array: JSReceiver;
       let k: Number = 0;

src/builtins/array-of.tq

@@ -5,8 +5,7 @@
 namespace array_of {
   // https://tc39.github.io/ecma262/#sec-array.of
   transitioning javascript builtin
-  ArrayOf(js-implicit context: Context, receiver: Object)(...arguments):
-      Object {
+  ArrayOf(js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     // 1. Let len be the actual number of arguments passed to this function.
     const len: Smi = Convert<Smi>(arguments.length);
 
@@ -14,7 +13,7 @@ namespace array_of {
     const items: Arguments = arguments;
 
     // 3. Let C be the this value.
-    const c: Object = receiver;
+    const c: JSAny = receiver;
 
     let a: JSReceiver;
 
@@ -24,7 +23,7 @@ namespace array_of {
         // a. Let A be ? Construct(C, « len »).
         a = Construct(c, len);
       }
-      case (Object): {
+      case (JSAny): {
         // a. Let A be ? ArrayCreate(len).
         a = ArrayCreate(len);
       }
@@ -36,7 +35,7 @@ namespace array_of {
     // 7. Repeat, while k < len
     while (k < len) {
       // a. Let kValue be items[k].
-      const kValue: Object = items[Convert<intptr>(k)];
+      const kValue: JSAny = items[Convert<intptr>(k)];
 
       // b. Let Pk be ! ToString(k).
       // c. Perform ? CreateDataPropertyOrThrow(A, Pk, kValue).

src/builtins/array-reduce-right.tq

@@ -6,13 +6,13 @@ namespace array {
   transitioning javascript builtin
   ArrayReduceRightPreLoopEagerDeoptContinuation(
       js-implicit context: Context,
-      receiver: Object)(callback: Object, length: Object): Object {
+      receiver: JSAny)(callback: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -27,15 +27,15 @@ namespace array {
 
   transitioning javascript builtin
   ArrayReduceRightLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, initialK: Object, length: Object,
-      accumulator: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, initialK: JSAny, length: JSAny,
+      accumulator: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -48,9 +48,8 @@ namespace array {
 
   transitioning javascript builtin
   ArrayReduceRightLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, initialK: Object, length: Object,
-      result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -67,8 +66,9 @@ namespace array {
 
   transitioning builtin ArrayReduceRightLoopContinuation(implicit context:
                                                              Context)(
-      _receiver: JSReceiver, callbackfn: Callable, initialAccumulator: Object,
-      o: JSReceiver, initialK: Number, _length: Number): Object {
+      _receiver: JSReceiver, callbackfn: Callable,
+      initialAccumulator: JSAny | TheHole, o: JSReceiver, initialK: Number,
+      _length: Number): JSAny {
     let accumulator = initialAccumulator;
 
     // 8b and 9. Repeat, while k >= 0
@@ -83,16 +83,20 @@ namespace array {
       // 8b iii and 9c. If kPresent is true, then
       if (present == True) {
         // 8b iii and 9c i. Let kValue be ? Get(O, Pk).
-        const value: Object = GetProperty(o, k);
-
-        if (accumulator == TheHole) {
-          // 8b iii 1.
-          accumulator = value;
-        } else {
-          // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
-          //         <accumulator, kValue, k, O>).
-          accumulator =
-              Call(context, callbackfn, Undefined, accumulator, value, k, o);
+        const value: JSAny = GetProperty(o, k);
+
+        typeswitch (accumulator) {
+          case (TheHole): {
+            // 8b iii 1.
+            accumulator = value;
+          }
+          case (accumulatorNotHole: JSAny): {
+            // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
+            //         <accumulator, kValue, k, O>).
+            accumulator = Call(
+                context, callbackfn, Undefined, accumulatorNotHole, value, k,
+                o);
+          }
         }
       }
 
@@ -102,16 +106,20 @@ namespace array {
     // 8c. if kPresent is false, throw a TypeError exception.
     // If the accumulator is discovered with the sentinel hole value,
     // this means kPresent is false.
-    if (accumulator == TheHole) {
-      ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
+    typeswitch (accumulator) {
+      case (TheHole): {
+        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
+      }
+      case (accumulator: JSAny): {
+        return accumulator;
+      }
     }
-    return accumulator;
   }
 
   transitioning macro FastArrayReduceRight(implicit context: Context)(
       o: JSReceiver, len: Number, callbackfn: Callable,
-      initialAccumulator: Object): Object
-      labels Bailout(Number, Object) {
+      initialAccumulator: JSAny | TheHole): JSAny
+      labels Bailout(Number, JSAny | TheHole) {
     let accumulator = initialAccumulator;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(len - 1, accumulator);
     const fastO = Cast<FastJSArrayForRead>(o)
@@ -125,25 +133,32 @@ namespace array {
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
 
-      const value: Object = fastOW.LoadElementNoHole(k) otherwise continue;
-      if (accumulator == TheHole) {
-        accumulator = value;
-      } else {
-        accumulator = Call(
-            context, callbackfn, Undefined, accumulator, value, k,
-            fastOW.Get());
+      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+      typeswitch (accumulator) {
+        case (TheHole): {
+          accumulator = value;
+        }
+        case (accumulatorNotHole: JSAny): {
+          accumulator = Call(
+              context, callbackfn, Undefined, accumulatorNotHole, value, k,
+              fastOW.Get());
+        }
       }
     }
-    if (accumulator == TheHole) {
-      ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
+    typeswitch (accumulator) {
+      case (TheHole): {
+        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
+      }
+      case (accumulator: JSAny): {
+        return accumulator;
+      }
     }
-    return accumulator;
   }
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.reduceRight
   transitioning javascript builtin
-  ArrayReduceRight(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  ArrayReduceRight(js-implicit context: Context, receiver: JSAny)(...arguments):
+      JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.reduceRight');
 
@@ -163,14 +178,14 @@ namespace array {
       // exception. (This case is handled at the end of
       // ArrayReduceRightLoopContinuation).
 
-      const initialValue: Object =
+      const initialValue: JSAny | TheHole =
           arguments.length > 1 ? arguments[1] : TheHole;
 
       try {
         return FastArrayReduceRight(o, len, callbackfn, initialValue)
             otherwise Bailout;
       }
-      label Bailout(value: Number, accumulator: Object) {
+      label Bailout(value: Number, accumulator: JSAny | TheHole) {
         return ArrayReduceRightLoopContinuation(
             o, callbackfn, accumulator, o, value, len);
       }

src/builtins/array-reduce.tq

@@ -6,13 +6,13 @@ namespace array {
   transitioning javascript builtin
   ArrayReducePreLoopEagerDeoptContinuation(
       js-implicit context: Context,
-      receiver: Object)(callback: Object, length: Object): Object {
+      receiver: JSAny)(callback: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -27,15 +27,15 @@ namespace array {
 
   transitioning javascript builtin
   ArrayReduceLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, initialK: Object, length: Object,
-      accumulator: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, initialK: JSAny, length: JSAny,
+      accumulator: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -48,9 +48,8 @@ namespace array {
 
   transitioning javascript builtin
   ArrayReduceLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, initialK: Object, length: Object,
-      result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, initialK: JSAny, length: JSAny, result: JSAny): JSAny {
     // All continuation points in the optimized every implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -66,8 +65,9 @@ namespace array {
   }
 
   transitioning builtin ArrayReduceLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, initialAccumulator: Object,
-      o: JSReceiver, initialK: Number, length: Number): Object {
+      _receiver: JSReceiver, callbackfn: Callable,
+      initialAccumulator: JSAny | TheHole, o: JSReceiver, initialK: Number,
+      length: Number): JSAny {
     let accumulator = initialAccumulator;
 
     // 8b and 9. Repeat, while k < len
@@ -82,16 +82,20 @@ namespace array {
       // 6c. If kPresent is true, then
       if (present == True) {
         // 6c. i. Let kValue be ? Get(O, Pk).
-        const value: Object = GetProperty(o, k);
-
-        if (accumulator == TheHole) {
-          // 8b.
-          accumulator = value;
-        } else {
-          // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
-          //         <accumulator, kValue, k, O>).
-          accumulator =
-              Call(context, callbackfn, Undefined, accumulator, value, k, o);
+        const value: JSAny = GetProperty(o, k);
+
+        typeswitch (accumulator) {
+          case (TheHole): {
+            // 8b.
+            accumulator = value;
+          }
+          case (accumulatorNotHole: JSAny): {
+            // 9c. ii. Set accumulator to ? Call(callbackfn, undefined,
+            //         <accumulator, kValue, k, O>).
+            accumulator = Call(
+                context, callbackfn, Undefined, accumulatorNotHole, value, k,
+                o);
+          }
         }
       }
 
@@ -101,16 +105,20 @@ namespace array {
     // 8c. if kPresent is false, throw a TypeError exception.
     // If the accumulator is discovered with the sentinel hole value,
     // this means kPresent is false.
-    if (accumulator == TheHole) {
-      ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
+    typeswitch (accumulator) {
+      case (TheHole): {
+        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
+      }
+      case (accumulator: JSAny): {
+        return accumulator;
+      }
     }
-    return accumulator;
   }
 
   transitioning macro FastArrayReduce(implicit context: Context)(
       o: JSReceiver, len: Number, callbackfn: Callable,
-      initialAccumulator: Object): Object
-      labels Bailout(Number, Object) {
+      initialAccumulator: JSAny | TheHole): JSAny
+      labels Bailout(Number, JSAny | TheHole) {
     const k = 0;
     let accumulator = initialAccumulator;
     Cast<Smi>(len) otherwise goto Bailout(k, accumulator);
@@ -125,25 +133,32 @@ namespace array {
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
 
-      const value: Object = fastOW.LoadElementNoHole(k) otherwise continue;
-      if (accumulator == TheHole) {
-        accumulator = value;
-      } else {
-        accumulator = Call(
-            context, callbackfn, Undefined, accumulator, value, k,
-            fastOW.Get());
+      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+      typeswitch (accumulator) {
+        case (TheHole): {
+          accumulator = value;
+        }
+        case (accumulatorNotHole: JSAny): {
+          accumulator = Call(
+              context, callbackfn, Undefined, accumulatorNotHole, value, k,
+              fastOW.Get());
+        }
       }
     }
-    if (accumulator == TheHole) {
-      ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
+    typeswitch (accumulator) {
+      case (TheHole): {
+        ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
+      }
+      case (accumulator: JSAny): {
+        return accumulator;
+      }
     }
-    return accumulator;
   }
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.reduce
   transitioning javascript builtin
-  ArrayReduce(js-implicit context: Context, receiver: Object)(...arguments):
-      Object {
+  ArrayReduce(js-implicit context: Context, receiver: JSAny)(...arguments):
+      JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.reduce');
 
@@ -163,14 +178,14 @@ namespace array {
       // exception. (This case is handled at the end of
       // ArrayReduceLoopContinuation).
 
-      const initialValue: Object =
+      const initialValue: JSAny | TheHole =
           arguments.length > 1 ? arguments[1] : TheHole;
 
       try {
         return FastArrayReduce(o, len, callbackfn, initialValue)
             otherwise Bailout;
       }
-      label Bailout(value: Number, accumulator: Object) {
+      label Bailout(value: Number, accumulator: JSAny | TheHole) {
         return ArrayReduceLoopContinuation(
             o, callbackfn, accumulator, o, value, len);
       }

src/builtins/array-reverse.tq

@@ -12,10 +12,10 @@ namespace array_reverse {
     return UnsafeCast<Smi>(elements.objects[index]);
   }
 
-  LoadElement<array::FastPackedObjectElements, Object>(
-      implicit context: Context)(elements: FixedArrayBase, index: Smi): Object {
+  LoadElement<array::FastPackedObjectElements, JSAny>(
+      implicit context: Context)(elements: FixedArrayBase, index: Smi): JSAny {
     const elements: FixedArray = UnsafeCast<FixedArray>(elements);
-    return elements.objects[index];
+    return UnsafeCast<JSAny>(elements.objects[index]);
   }
 
   LoadElement<array::FastPackedDoubleElements, float64>(
@@ -38,9 +38,9 @@ namespace array_reverse {
     StoreFixedArrayElement(elems, index, value, SKIP_WRITE_BARRIER);
   }
 
-  StoreElement<array::FastPackedObjectElements, Object>(
+  StoreElement<array::FastPackedObjectElements, JSAny>(
       implicit context:
-          Context)(elements: FixedArrayBase, index: Smi, value: Object) {
+          Context)(elements: FixedArrayBase, index: Smi, value: JSAny) {
     const elements: FixedArray = UnsafeCast<FixedArray>(elements);
     elements.objects[index] = value;
   }
@@ -70,8 +70,8 @@ namespace array_reverse {
     }
   }
 
-  transitioning macro GenericArrayReverse(context: Context, receiver: Object):
-      Object {
+  transitioning macro GenericArrayReverse(context: Context, receiver: JSAny):
+      JSAny {
     // 1. Let O be ? ToObject(this value).
     const object: JSReceiver = ToObject_Inline(context, receiver);
 
@@ -89,8 +89,8 @@ namespace array_reverse {
     let upper: Number = length - 1;
 
     while (lower < upper) {
-      let lowerValue: Object = Undefined;
-      let upperValue: Object = Undefined;
+      let lowerValue: JSAny = Undefined;
+      let upperValue: JSAny = Undefined;
 
       // b. Let upperP be ! ToString(upper).
       // c. Let lowerP be ! ToString(lower).
@@ -142,7 +142,7 @@ namespace array_reverse {
     return object;
   }
 
-  macro TryFastPackedArrayReverse(implicit context: Context)(receiver: Object)
+  macro TryFastPackedArrayReverse(implicit context: Context)(receiver: JSAny)
       labels Slow {
     const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
 
@@ -153,7 +153,7 @@ namespace array_reverse {
           array.elements, array.length);
     } else if (kind == PACKED_ELEMENTS) {
       array::EnsureWriteableFastElements(array);
-      FastPackedArrayReverse<array::FastPackedObjectElements, Object>(
+      FastPackedArrayReverse<array::FastPackedObjectElements, JSAny>(
           array.elements, array.length);
     } else if (kind == PACKED_DOUBLE_ELEMENTS) {
       FastPackedArrayReverse<array::FastPackedDoubleElements, float64>(
@@ -165,7 +165,7 @@ namespace array_reverse {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.reverse
   transitioning javascript builtin ArrayPrototypeReverse(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     try {
       TryFastPackedArrayReverse(receiver) otherwise Baseline;
       return receiver;

src/builtins/array-shift.tq

@@ -3,9 +3,9 @@
 // found in the LICENSE file.
 
 namespace array_shift {
-  extern builtin ArrayShift(Context, JSFunction, Object, int32): Object;
+  extern builtin ArrayShift(Context, JSFunction, JSAny, int32): JSAny;
 
-  macro TryFastArrayShift(implicit context: Context)(receiver: Object): Object
+  macro TryFastArrayShift(implicit context: Context)(receiver: JSAny): JSAny
       labels Slow, Runtime {
     const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
     let witness = NewFastJSArrayWitness(array);
@@ -37,7 +37,7 @@ namespace array_shift {
   }
 
   transitioning macro GenericArrayShift(implicit context:
-                                            Context)(receiver: Object): Object {
+                                            Context)(receiver: JSAny): JSAny {
     // 1. Let O be ? ToObject(this value).
     const object: JSReceiver = ToObject_Inline(context, receiver);
 
@@ -70,7 +70,7 @@ namespace array_shift {
       // d. If fromPresent is true, then
       if (fromPresent == True) {
         // i. Let fromVal be ? Get(O, from).
-        const fromValue: Object = GetProperty(object, from);
+        const fromValue: JSAny = GetProperty(object, from);
 
         // ii. Perform ? Set(O, to, fromValue, true).
         SetProperty(object, to, fromValue);
@@ -95,7 +95,7 @@ namespace array_shift {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.shift
   transitioning javascript builtin ArrayPrototypeShift(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     try {
       return TryFastArrayShift(receiver) otherwise Slow, Runtime;
     }

src/builtins/array-slice.tq

@@ -63,9 +63,9 @@ namespace array_slice {
     for (let current: Smi = start; current < to; ++current) {
       const e: Object =
           sloppyElements.objects[current + kSloppyArgumentsParameterMapStart];
-      const newElement: Object = e != TheHole ?
-          argumentsContext[UnsafeCast<Smi>(e)] :
-          unmappedElements.objects[current];
+      const newElement: JSAny = UnsafeCast<JSAny>(
+          e != TheHole ? argumentsContext[UnsafeCast<Smi>(e)] :
+                         unmappedElements.objects[current]);
       // It is safe to skip the write barrier here because resultElements was
       // allocated together with result in a folded allocation.
       // TODO(tebbi): The verification of this fails at the moment due to
@@ -86,7 +86,7 @@ namespace array_slice {
   }
 
   macro HandleFastSlice(
-      context: Context, o: Object, startNumber: Number,
+      context: Context, o: JSAny, startNumber: Number,
       countNumber: Number): JSArray
       labels Bailout {
     const start: Smi = Cast<Smi>(startNumber) otherwise Bailout;
@@ -114,7 +114,7 @@ namespace array_slice {
               otherwise Bailout;
         }
       }
-      case (Object): {
+      case (JSAny): {
       }
     }
     goto Bailout;
@@ -122,15 +122,15 @@ namespace array_slice {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.slice
   transitioning javascript builtin
-  ArrayPrototypeSlice(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  ArrayPrototypeSlice(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // Handle array cloning case if the receiver is a fast array.
     if (arguments.length == 0) {
       typeswitch (receiver) {
         case (a: FastJSArrayForCopy): {
           return CloneFastJSArray(context, a);
         }
-        case (Object): {
+        case (JSAny): {
         }
       }
     }
@@ -142,7 +142,7 @@ namespace array_slice {
     const len: Number = GetLengthProperty(o);
 
     // 3. Let relativeStart be ? ToInteger(start).
-    const start: Object = arguments[0];
+    const start: JSAny = arguments[0];
     const relativeStart: Number = ToInteger_Inline(context, start);
 
     // 4. If relativeStart < 0, let k be max((len + relativeStart), 0);
@@ -152,7 +152,7 @@ namespace array_slice {
 
     // 5. If end is undefined, let relativeEnd be len;
     //    else let relativeEnd be ? ToInteger(end).
-    const end: Object = arguments[1];
+    const end: JSAny = arguments[1];
     const relativeEnd: Number =
         end == Undefined ? len : ToInteger_Inline(context, end);
 
@@ -193,7 +193,7 @@ namespace array_slice {
       // c. If kPresent is true, then
       if (fromPresent == True) {
         // i. Let kValue be ? Get(O, Pk).
-        const kValue: Object = GetProperty(o, pK);
+        const kValue: JSAny = GetProperty(o, pK);
 
         // ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(n), kValue).
         FastCreateDataProperty(a, n, kValue);

src/builtins/array-some.tq

@@ -5,15 +5,14 @@
 namespace array {
   transitioning javascript builtin
   ArraySomeLoopEagerDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object,
-      length: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny): JSAny {
     // All continuation points in the optimized some implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
     //
     // Also, this great mass of casts is necessary because the signature
-    // of Torque javascript builtins requires Object type for all parameters
+    // of Torque javascript builtins requires JSAny type for all parameters
     // other than {context}.
     const jsreceiver = Cast<JSReceiver>(receiver) otherwise unreachable;
     const callbackfn = Cast<Callable>(callback) otherwise unreachable;
@@ -27,9 +26,9 @@ namespace array {
 
   transitioning javascript builtin
   ArraySomeLoopLazyDeoptContinuation(
-      js-implicit context: Context, receiver: Object)(
-      callback: Object, thisArg: Object, initialK: Object, length: Object,
-      result: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(
+      callback: JSAny, thisArg: JSAny, initialK: JSAny, length: JSAny,
+      result: JSAny): JSAny {
     // All continuation points in the optimized some implementation are
     // after the ToObject(O) call that ensures we are dealing with a
     // JSReceiver.
@@ -53,9 +52,9 @@ namespace array {
   }
 
   transitioning builtin ArraySomeLoopContinuation(implicit context: Context)(
-      _receiver: JSReceiver, callbackfn: Callable, thisArg: Object,
-      _array: Object, o: JSReceiver, initialK: Number, length: Number,
-      _initialTo: Object): Object {
+      _receiver: JSReceiver, callbackfn: Callable, thisArg: JSAny,
+      _array: JSAny, o: JSReceiver, initialK: Number, length: Number,
+      _initialTo: JSAny): JSAny {
     // 5. Let k be 0.
     // 6. Repeat, while k < len
     for (let k: Number = initialK; k < length; k++) {
@@ -69,10 +68,10 @@ namespace array {
       // 6c. If kPresent is true, then
       if (kPresent == True) {
         // 6c. i. Let kValue be ? Get(O, Pk).
-        const kValue: Object = GetProperty(o, k);
+        const kValue: JSAny = GetProperty(o, k);
 
         // 6c. ii. Perform ? Call(callbackfn, T, <kValue, k, O>).
-        const result: Object = Call(context, callbackfn, thisArg, kValue, k, o);
+        const result: JSAny = Call(context, callbackfn, thisArg, kValue, k, o);
 
         // iii. If selected is true, then...
         if (ToBoolean(result)) {
@@ -86,7 +85,7 @@ namespace array {
   }
 
   transitioning macro FastArraySome(implicit context: Context)(
-      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: Object): Object
+      o: JSReceiver, len: Number, callbackfn: Callable, thisArg: JSAny): JSAny
       labels Bailout(Smi) {
     let k: Smi = 0;
     const smiLen = Cast<Smi>(len) otherwise goto Bailout(k);
@@ -99,8 +98,8 @@ namespace array {
 
       // Ensure that we haven't walked beyond a possibly updated length.
       if (k >= fastOW.Get().length) goto Bailout(k);
-      const value: Object = fastOW.LoadElementNoHole(k) otherwise continue;
-      const result: Object =
+      const value: JSAny = fastOW.LoadElementNoHole(k) otherwise continue;
+      const result: JSAny =
           Call(context, callbackfn, thisArg, value, k, fastOW.Get());
       if (ToBoolean(result)) {
         return True;
@@ -111,8 +110,8 @@ namespace array {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.some
   transitioning javascript builtin
-  ArraySome(js-implicit context: Context, receiver: Object)(...arguments):
-      Object {
+  ArraySome(js-implicit context: Context, receiver: JSAny)(...arguments):
+      JSAny {
     try {
       RequireObjectCoercible(receiver, 'Array.prototype.some');
 
@@ -129,7 +128,7 @@ namespace array {
       const callbackfn = Cast<Callable>(arguments[0]) otherwise TypeError;
 
       // 4. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments.length > 1 ? arguments[1] : Undefined;
+      const thisArg: JSAny = arguments.length > 1 ? arguments[1] : Undefined;
 
       // Special cases.
       try {

src/builtins/array-splice.tq

@@ -95,7 +95,7 @@ namespace array_splice {
       const typedNewElements: FixedArrayType =
           UnsafeCast<FixedArrayType>(a.elements);
       for (let i: intptr = 2; i < args.length; ++i) {
-        const e: Object = args[i];
+        const e: JSAny = args[i];
         // The argument elements were already validated to be an appropriate
         // {ElementType} to store in {FixedArrayType}.
         typedNewElements[k++] = UnsafeCast<ElementType>(e);
@@ -109,7 +109,7 @@ namespace array_splice {
   transitioning macro FastArraySplice(
       context: Context, args: Arguments, o: JSReceiver,
       originalLengthNumber: Number, actualStartNumber: Number, insertCount: Smi,
-      actualDeleteCountNumber: Number): Object
+      actualDeleteCountNumber: Number): JSAny
       labels Bailout {
     const originalLength: Smi =
         Cast<Smi>(originalLengthNumber) otherwise Bailout;
@@ -132,7 +132,7 @@ namespace array_splice {
 
     const oldElementsKind: ElementsKind = elementsKind;
     for (let i: intptr = 2; i < args.length; ++i) {
-      const e: Object = args[i];
+      const e: JSAny = args[i];
       if (IsFastSmiElementsKind(elementsKind)) {
         if (TaggedIsNotSmi(e)) {
           const heapObject: HeapObject = UnsafeCast<HeapObject>(e);
@@ -166,7 +166,7 @@ namespace array_splice {
     }
 
     if (IsFastSmiOrTaggedElementsKind(elementsKind)) {
-      FastSplice<FixedArray, Object>(
+      FastSplice<FixedArray, JSAny>(
           args, a, length, newLength, actualStart, insertCount,
           actualDeleteCount);
     } else {
@@ -180,7 +180,7 @@ namespace array_splice {
 
   transitioning macro FillDeletedElementsArray(
       context: Context, o: JSReceiver, actualStart: Number,
-      actualDeleteCount: Number, a: JSReceiver): Object {
+      actualDeleteCount: Number, a: JSReceiver): JSAny {
     // 10. Let k be 0.
     let k: Number = 0;
 
@@ -195,7 +195,7 @@ namespace array_splice {
       // c. If fromPresent is true, then
       if (fromPresent == True) {
         // i. Let fromValue be ? Get(O, from).
-        const fromValue: Object = GetProperty(o, from);
+        const fromValue: JSAny = GetProperty(o, from);
 
         // ii. Perform ? CreateDataPropertyOrThrow(A, ! ToString(k), fromValue).
         FastCreateDataProperty(a, k, fromValue);
@@ -231,7 +231,7 @@ namespace array_splice {
       // iv. If fromPresent is true, then
       if (fromPresent == True) {
         // 1. Let fromValue be ? Get(O, from).
-        const fromValue: Object = GetProperty(o, from);
+        const fromValue: JSAny = GetProperty(o, from);
 
         // 2. Perform ? Set(O, to, fromValue, true).
         SetProperty(o, to, fromValue);
@@ -280,7 +280,7 @@ namespace array_splice {
       // iv. If fromPresent is true, then
       if (fromPresent == True) {
         // 1. Let fromValue be ? Get(O, from).
-        const fromValue: Object = GetProperty(o, from);
+        const fromValue: JSAny = GetProperty(o, from);
 
         // 2. Perform ? Set(O, to, fromValue, true).
         SetProperty(o, to, fromValue);
@@ -298,8 +298,7 @@ namespace array_splice {
 
   transitioning macro SlowSplice(
       context: Context, arguments: Arguments, o: JSReceiver, len: Number,
-      actualStart: Number, insertCount: Smi,
-      actualDeleteCount: Number): Object {
+      actualStart: Number, insertCount: Smi, actualDeleteCount: Number): JSAny {
     // 9. Let A be ? ArraySpeciesCreate(O, actualDeleteCount).
     const a: JSReceiver = ArraySpeciesCreate(context, o, actualDeleteCount);
     const itemCount: Number = insertCount;
@@ -332,7 +331,7 @@ namespace array_splice {
     //   element.
     if (arguments.length > 2) {
       for (let i: intptr = 2; i < arguments.length; ++i) {
-        const e: Object = arguments[i];
+        const e: JSAny = arguments[i];
         // b. Perform ? Set(O, ! ToString(k), E, true).
         SetProperty(o, k, e);
 
@@ -350,8 +349,8 @@ namespace array_splice {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.splice
   transitioning javascript builtin
-  ArrayPrototypeSplice(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  ArrayPrototypeSplice(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // 1. Let O be ? ToObject(this value).
     const o: JSReceiver = ToObject(context, receiver);
 
@@ -359,7 +358,7 @@ namespace array_splice {
     const len: Number = GetLengthProperty(o);
 
     // 3. Let relativeStart be ? ToInteger(start).
-    const start: Object = arguments[0];
+    const start: JSAny = arguments[0];
     const relativeStart: Number = ToInteger_Inline(context, start);
 
     // 4. If relativeStart < 0, let actualStart be max((len + relativeStart),
@@ -388,7 +387,7 @@ namespace array_splice {
       // a. Let insertCount be the Number of actual arguments minus 2.
       insertCount = Convert<Smi>(arguments.length) - 2;
       // b. Let dc be ? ToInteger(deleteCount).
-      const deleteCount: Object = arguments[1];
+      const deleteCount: JSAny = arguments[1];
       const dc: Number = ToInteger_Inline(context, deleteCount);
       // c. Let actualDeleteCount be min(max(dc, 0), len - actualStart).
       actualDeleteCount = Min(Max(dc, 0), len - actualStart);

src/builtins/array-unshift.tq

@@ -3,10 +3,10 @@
 // found in the LICENSE file.
 
 namespace array_unshift {
-  extern builtin ArrayUnshift(Context, JSFunction, Object, int32): Object;
+  extern builtin ArrayUnshift(Context, JSFunction, JSAny, int32): JSAny;
 
   transitioning macro GenericArrayUnshift(
-      context: Context, receiver: Object, arguments: Arguments): Number {
+      context: Context, receiver: JSAny, arguments: Arguments): Number {
     // 1. Let O be ? ToObject(this value).
     const object: JSReceiver = ToObject_Inline(context, receiver);
 
@@ -40,7 +40,7 @@ namespace array_unshift {
         // iv. If fromPresent is true, then
         if (fromPresent == True) {
           // 1. Let fromValue be ? Get(O, from).
-          const fromValue: Object = GetProperty(object, from);
+          const fromValue: JSAny = GetProperty(object, from);
 
           // 2. Perform ? Set(O, to, fromValue, true).
           SetProperty(object, to, fromValue);
@@ -78,7 +78,7 @@ namespace array_unshift {
 
   // https://tc39.github.io/ecma262/#sec-array.prototype.unshift
   transitioning javascript builtin ArrayPrototypeUnshift(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     try {
       const array: FastJSArray = Cast<FastJSArray>(receiver) otherwise Slow;
       array::EnsureWriteableFastElements(array);

src/builtins/array.tq

@@ -32,30 +32,15 @@ namespace array {
     assert(array.elements.map != kCOWMap);
   }
 
-  macro IsJSArray(implicit context: Context)(o: Object): bool {
-    typeswitch (o) {
-      case (JSArray): {
-        return true;
-      }
-      case (Object): {
-        return false;
-      }
-    }
-  }
-
-  macro LoadElementOrUndefined(a: FixedArray, i: Smi): Object {
-    const e: Object = a.objects[i];
-    return e == TheHole ? Undefined : e;
+  macro LoadElementOrUndefined(implicit context:
+                                   Context)(a: FixedArray, i: Smi): JSAny {
+    const e = UnsafeCast<(JSAny | TheHole)>(a.objects[i]);
+    return ReplaceTheHoleWithUndefined(e);
   }
 
   macro LoadElementOrUndefined(a: FixedDoubleArray, i: Smi): NumberOrUndefined {
-    try {
-      const f: float64 = LoadDoubleWithHoleCheck(a, i) otherwise IfHole;
-      return AllocateHeapNumberWithValue(f);
-    }
-    label IfHole {
-      return Undefined;
-    }
+    const f: float64 = LoadDoubleWithHoleCheck(a, i) otherwise return Undefined;
+    return AllocateHeapNumberWithValue(f);
   }
 
   macro StoreArrayHole(elements: FixedDoubleArray, k: Smi): void {
@@ -66,5 +51,5 @@ namespace array {
     elements.objects[k] = TheHole;
   }
 
-  extern macro SetPropertyLength(implicit context: Context)(Object, Number);
+  extern macro SetPropertyLength(implicit context: Context)(JSAny, Number);
 }

src/builtins/boolean.tq

@@ -5,8 +5,8 @@
 namespace boolean {
   javascript builtin
   BooleanConstructor(
-      js-implicit context: Context, receiver: Object, newTarget: Object,
-      target: JSFunction)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny, newTarget: JSAny,
+      target: JSFunction)(...arguments): JSAny {
     const value = SelectBooleanConstant(ToBoolean(arguments[0]));
 
     if (newTarget == Undefined) {

src/builtins/collections.tq

@@ -6,7 +6,7 @@
 
 namespace collections {
   @export
-  macro LoadKeyValuePairNoSideEffects(implicit context: Context)(o: Object):
+  macro LoadKeyValuePairNoSideEffects(implicit context: Context)(o: JSAny):
       KeyValuePair labels MayHaveSideEffects {
     typeswitch (o) {
       case (a: FastJSArray): {
@@ -28,7 +28,7 @@ namespace collections {
                                   Undefined
             };
           }
-          case (Object): deferred {
+          case (FixedArrayBase): deferred {
             unreachable;
           }
         }
@@ -36,14 +36,14 @@ namespace collections {
       case (JSReceiver): {
         goto MayHaveSideEffects;
       }
-      case (o: Object): deferred {
+      case (o: JSAny): deferred {
         ThrowTypeError(kIteratorValueNotAnObject, o);
       }
     }
   }
 
   @export
-  transitioning macro LoadKeyValuePair(implicit context: Context)(o: Object):
+  transitioning macro LoadKeyValuePair(implicit context: Context)(o: JSAny):
       KeyValuePair {
     try {
       return LoadKeyValuePairNoSideEffects(o) otherwise Generic;

src/builtins/extras-utils.tq

@@ -3,23 +3,22 @@
 // found in the LICENSE file.
 
 namespace extras_utils {
-  extern runtime CreatePrivateSymbol(Context, Object): HeapObject;
-  extern runtime PromiseMarkAsHandled(Context, Object): Undefined;
-  extern runtime PromiseStatus(Context, Object): Smi;
+  extern runtime CreatePrivateSymbol(Context, JSAny): PrivateSymbol;
+  extern runtime PromiseMarkAsHandled(Context, JSAny): Undefined;
+  extern runtime PromiseStatus(Context, JSAny): Smi;
 
   javascript builtin ExtrasUtilsCreatePrivateSymbol(
-      js-implicit context: Context,
-      receiver: Object)(...arguments): HeapObject {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     return CreatePrivateSymbol(context, arguments[0]);
   }
 
   javascript builtin ExtrasUtilsMarkPromiseAsHandled(
-      js-implicit context: Context, receiver: Object)(...arguments): Undefined {
+      js-implicit context: Context, receiver: JSAny)(...arguments): Undefined {
     return PromiseMarkAsHandled(context, arguments[0]);
   }
 
   javascript builtin ExtrasUtilsPromiseState(
-      js-implicit context: Context, receiver: Object)(...arguments): Smi {
+      js-implicit context: Context, receiver: JSAny)(...arguments): Smi {
     return PromiseStatus(context, arguments[0]);
   }
 }

src/builtins/internal-coverage.tq

@@ -51,7 +51,7 @@ namespace internal_coverage {
   }
 
   builtin IncBlockCounter(implicit context: Context)(
-      function: JSFunction, coverageArraySlotIndex: Smi): Object {
+      function: JSFunction, coverageArraySlotIndex: Smi): Undefined {
     // It's quite possible that a function contains IncBlockCounter bytecodes,
     // but no coverage info exists. This happens e.g. by selecting the
     // best-effort coverage collection mode, which triggers deletion of all

src/builtins/iterator.tq

@@ -11,13 +11,13 @@ namespace iterator {
     object: JSReceiver;
 
     // iteratorRecord.[[NextMethod]]
-    next: Object;
+    next: JSAny;
   }
 
   extern macro IteratorBuiltinsAssembler::GetIteratorMethod(
-      implicit context: Context)(Object): Object;
+      implicit context: Context)(JSAny): JSAny;
   extern macro IteratorBuiltinsAssembler::GetIterator(
-      implicit context: Context)(Object): IteratorRecord;
+      implicit context: Context)(JSAny): IteratorRecord;
 
   extern macro IteratorBuiltinsAssembler::IteratorStep(
       implicit context: Context)(IteratorRecord): JSReceiver
@@ -27,24 +27,24 @@ namespace iterator {
       labels Done;
 
   extern macro IteratorBuiltinsAssembler::IteratorValue(
-      implicit context: Context)(JSReceiver): Object;
+      implicit context: Context)(JSReceiver): JSAny;
   extern macro IteratorBuiltinsAssembler::IteratorValue(
-      implicit context: Context)(JSReceiver, Map): Object;
+      implicit context: Context)(JSReceiver, Map): JSAny;
 
   extern macro IteratorBuiltinsAssembler::IteratorCloseOnException(
-      implicit context: Context)(IteratorRecord, Object): never;
+      implicit context: Context)(IteratorRecord, JSAny): never;
 
   extern macro IteratorBuiltinsAssembler::IterableToList(
-      implicit context: Context)(Object, Object): JSArray;
+      implicit context: Context)(JSAny, JSAny): JSArray;
 
   extern builtin IterableToListMayPreserveHoles(implicit context:
-                                                    Context)(Object, Object);
+                                                    Context)(JSAny, JSAny);
   extern builtin IterableToListWithSymbolLookup(implicit context:
-                                                    Context)(Object);
+                                                    Context)(JSAny);
 
   transitioning builtin GetIteratorWithFeedback(
-      context: Context, receiver: Object, feedbackSlot: Smi,
-      feedback: Undefined | FeedbackVector): Object {
+      context: Context, receiver: JSAny, feedbackSlot: Smi,
+      feedback: Undefined | FeedbackVector): JSAny {
     typeswitch (feedback) {
       case (Undefined): {
         return GetProperty(receiver, IteratorSymbolConstant());

src/builtins/math.tq

@@ -7,7 +7,7 @@ namespace math {
   extern macro Float64Acos(float64): float64;
 
   transitioning javascript builtin
-  MathAcos(js-implicit context: Context)(x: Object): Number {
+  MathAcos(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Acos(value));
   }
@@ -16,7 +16,7 @@ namespace math {
   extern macro Float64Acosh(float64): float64;
 
   transitioning javascript builtin
-  MathAcosh(js-implicit context: Context)(x: Object): Number {
+  MathAcosh(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Acosh(value));
   }
@@ -25,7 +25,7 @@ namespace math {
   extern macro Float64Asin(float64): float64;
 
   transitioning javascript builtin
-  MathAsin(js-implicit context: Context)(x: Object): Number {
+  MathAsin(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Asin(value));
   }
@@ -34,7 +34,7 @@ namespace math {
   extern macro Float64Asinh(float64): float64;
 
   transitioning javascript builtin
-  MathAsinh(js-implicit context: Context)(x: Object): Number {
+  MathAsinh(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Asinh(value));
   }
@@ -43,7 +43,7 @@ namespace math {
   extern macro Float64Atan(float64): float64;
 
   transitioning javascript builtin
-  MathAtan(js-implicit context: Context)(x: Object): Number {
+  MathAtan(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Atan(value));
   }
@@ -52,7 +52,7 @@ namespace math {
   extern macro Float64Atan2(float64, float64): float64;
 
   transitioning javascript builtin
-  MathAtan2(js-implicit context: Context)(y: Object, x: Object): Number {
+  MathAtan2(js-implicit context: Context)(y: JSAny, x: JSAny): Number {
     const yValue = Convert<float64>(ToNumber_Inline(context, y));
     const xValue = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Atan2(yValue, xValue));
@@ -62,7 +62,7 @@ namespace math {
   extern macro Float64Atanh(float64): float64;
 
   transitioning javascript builtin
-  MathAtanh(js-implicit context: Context)(x: Object): Number {
+  MathAtanh(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Atanh(value));
   }
@@ -71,7 +71,7 @@ namespace math {
   extern macro Float64Cbrt(float64): float64;
 
   transitioning javascript builtin
-  MathCbrt(js-implicit context: Context)(x: Object): Number {
+  MathCbrt(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Cbrt(value));
   }
@@ -80,7 +80,7 @@ namespace math {
   extern macro Word32Clz(int32): int32;
 
   transitioning javascript builtin
-  MathClz32(js-implicit context: Context)(x: Object): Number {
+  MathClz32(js-implicit context: Context)(x: JSAny): Number {
     const num = ToNumber_Inline(context, x);
 
     let value: int32;
@@ -100,7 +100,7 @@ namespace math {
   extern macro Float64Cos(float64): float64;
 
   transitioning javascript builtin
-  MathCos(js-implicit context: Context)(x: Object): Number {
+  MathCos(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Cos(value));
   }
@@ -109,7 +109,7 @@ namespace math {
   extern macro Float64Cosh(float64): float64;
 
   transitioning javascript builtin
-  MathCosh(js-implicit context: Context)(x: Object): Number {
+  MathCosh(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Cosh(value));
   }
@@ -118,7 +118,7 @@ namespace math {
   extern macro Float64Exp(float64): float64;
 
   transitioning javascript builtin
-  MathExp(js-implicit context: Context)(x: Object): Number {
+  MathExp(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Exp(value));
   }
@@ -127,14 +127,14 @@ namespace math {
   extern macro Float64Expm1(float64): float64;
 
   transitioning javascript builtin
-  MathExpm1(js-implicit context: Context)(x: Object): Number {
+  MathExpm1(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Expm1(value));
   }
 
   // ES6 #sec-math.fround
   transitioning javascript builtin
-  MathFround(js-implicit context: Context)(x: Object): Number {
+  MathFround(js-implicit context: Context)(x: JSAny): Number {
     const x32 = Convert<float32>(ToNumber_Inline(context, x));
     const x64 = Convert<float64>(x32);
     return Convert<Number>(x64);
@@ -144,7 +144,7 @@ namespace math {
   extern macro Float64Log(float64): float64;
 
   transitioning javascript builtin
-  MathLog(js-implicit context: Context)(x: Object): Number {
+  MathLog(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Log(value));
   }
@@ -153,7 +153,7 @@ namespace math {
   extern macro Float64Log1p(float64): float64;
 
   transitioning javascript builtin
-  MathLog1p(js-implicit context: Context)(x: Object): Number {
+  MathLog1p(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Log1p(value));
   }
@@ -162,7 +162,7 @@ namespace math {
   extern macro Float64Log10(float64): float64;
 
   transitioning javascript builtin
-  MathLog10(js-implicit context: Context)(x: Object): Number {
+  MathLog10(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Log10(value));
   }
@@ -171,7 +171,7 @@ namespace math {
   extern macro Float64Log2(float64): float64;
 
   transitioning javascript builtin
-  MathLog2(js-implicit context: Context)(x: Object): Number {
+  MathLog2(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Log2(value));
   }
@@ -180,14 +180,14 @@ namespace math {
   extern macro Float64Sin(float64): float64;
 
   transitioning javascript builtin
-  MathSin(js-implicit context: Context)(x: Object): Number {
+  MathSin(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Sin(value));
   }
 
   // ES6 #sec-math.sign
   transitioning javascript builtin
-  MathSign(js-implicit context: Context)(x: Object): Number {
+  MathSign(js-implicit context: Context)(x: JSAny): Number {
     const num = ToNumber_Inline(context, x);
     const value = Convert<float64>(num);
 
@@ -204,7 +204,7 @@ namespace math {
   extern macro Float64Sinh(float64): float64;
 
   transitioning javascript builtin
-  MathSinh(js-implicit context: Context)(x: Object): Number {
+  MathSinh(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Sinh(value));
   }
@@ -213,7 +213,7 @@ namespace math {
   extern macro Float64Sqrt(float64): float64;
 
   transitioning javascript builtin
-  MathSqrt(js-implicit context: Context)(x: Object): Number {
+  MathSqrt(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Sqrt(value));
   }
@@ -222,7 +222,7 @@ namespace math {
   extern macro Float64Tan(float64): float64;
 
   transitioning javascript builtin
-  MathTan(js-implicit context: Context)(x: Object): Number {
+  MathTan(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Tan(value));
   }
@@ -231,7 +231,7 @@ namespace math {
   extern macro Float64Tanh(float64): float64;
 
   transitioning javascript builtin
-  MathTanh(js-implicit context: Context)(x: Object): Number {
+  MathTanh(js-implicit context: Context)(x: JSAny): Number {
     const value = Convert<float64>(ToNumber_Inline(context, x));
     return Convert<Number>(Float64Tanh(value));
   }
@@ -240,7 +240,7 @@ namespace math {
 
   // ES6 #sec-math.hypot
   transitioning javascript builtin
-  MathHypot(js-implicit context: Context, receiver: Object)(...arguments):
+  MathHypot(js-implicit context: Context, receiver: JSAny)(...arguments):
       Number {
     const length = arguments.length;
     if (length == 0) {

src/builtins/object-fromentries.tq

@@ -5,7 +5,7 @@
 namespace object {
 
   transitioning macro ObjectFromEntriesFastCase(implicit context: Context)(
-      iterable: Object): JSObject labels IfSlow {
+      iterable: JSAny): JSObject labels IfSlow {
     typeswitch (iterable) {
       case (array: FastJSArrayWithNoCustomIteration): {
         const elements: FixedArray =
@@ -14,7 +14,7 @@ namespace object {
         const result: JSObject = NewJSObject();
 
         for (let k: Smi = 0; k < length; ++k) {
-          const value: Object = array::LoadElementOrUndefined(elements, k);
+          const value: JSAny = array::LoadElementOrUndefined(elements, k);
           const pair: KeyValuePair =
               collections::LoadKeyValuePairNoSideEffects(value)
               otherwise IfSlow;
@@ -26,16 +26,16 @@ namespace object {
         }
         return result;
       }
-      case (Object): {
+      case (JSAny): {
         goto IfSlow;
       }
     }
   }
 
   transitioning javascript builtin
-  ObjectFromEntries(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
-    const iterable: Object = arguments[0];
+  ObjectFromEntries(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
+    const iterable: JSAny = arguments[0];
     try {
       if (IsNullOrUndefined(iterable)) goto Throw;
       return ObjectFromEntriesFastCase(iterable) otherwise IfSlow;
@@ -50,7 +50,7 @@ namespace object {
           const step: JSReceiver =
               iterator::IteratorStep(i, fastIteratorResultMap)
               otherwise return result;
-          const iteratorValue: Object =
+          const iteratorValue: JSAny =
               iterator::IteratorValue(step, fastIteratorResultMap);
           const pair: KeyValuePair =
               collections::LoadKeyValuePair(iteratorValue);

src/builtins/object.tq

@@ -4,31 +4,31 @@
 
 namespace runtime {
   extern transitioning runtime
-  ObjectIsExtensible(implicit context: Context)(Object): Object;
+  ObjectIsExtensible(implicit context: Context)(JSAny): JSAny;
 
   extern transitioning runtime
   JSReceiverPreventExtensionsThrow(implicit context: Context)(JSReceiver):
-      Object;
+      JSAny;
 
   extern transitioning runtime
   JSReceiverPreventExtensionsDontThrow(implicit context: Context)(JSReceiver):
-      Object;
+      JSAny;
 
   extern transitioning runtime
-  JSReceiverGetPrototypeOf(implicit context: Context)(JSReceiver): Object;
+  JSReceiverGetPrototypeOf(implicit context: Context)(JSReceiver): JSAny;
 
   extern transitioning runtime
-  JSReceiverSetPrototypeOfThrow(implicit context: Context)(JSReceiver, Object):
-      Object;
+  JSReceiverSetPrototypeOfThrow(implicit context: Context)(JSReceiver, JSAny):
+      JSAny;
 
   extern transitioning runtime
   JSReceiverSetPrototypeOfDontThrow(implicit context:
-                                        Context)(JSReceiver, Object): Object;
+                                        Context)(JSReceiver, JSAny): JSAny;
 }  // namespace runtime
 
 namespace object {
   transitioning macro
-  ObjectIsExtensible(implicit context: Context)(object: Object): Object {
+  ObjectIsExtensible(implicit context: Context)(object: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::ObjectIsExtensible(objectJSReceiver);
@@ -36,8 +36,8 @@ namespace object {
   }
 
   transitioning macro
-  ObjectPreventExtensionsThrow(implicit context: Context)(object: Object):
-      Object {
+  ObjectPreventExtensionsThrow(implicit context: Context)(object: JSAny):
+      JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::JSReceiverPreventExtensionsThrow(
@@ -47,8 +47,8 @@ namespace object {
   }
 
   transitioning macro
-  ObjectPreventExtensionsDontThrow(implicit context: Context)(object: Object):
-      Object {
+  ObjectPreventExtensionsDontThrow(implicit context: Context)(object: JSAny):
+      JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::JSReceiverPreventExtensionsDontThrow(
@@ -57,14 +57,14 @@ namespace object {
   }
 
   transitioning macro
-  ObjectGetPrototypeOf(implicit context: Context)(object: Object): Object {
+  ObjectGetPrototypeOf(implicit context: Context)(object: JSAny): JSAny {
     const objectJSReceiver: JSReceiver = ToObject_Inline(context, object);
     return object::JSReceiverGetPrototypeOf(objectJSReceiver);
   }
 
   transitioning macro
   JSReceiverGetPrototypeOf(implicit context: Context)(object: JSReceiver):
-      Object {
+      JSAny {
     const objectJSProxy = Cast<JSProxy>(object)
         otherwise return runtime::JSReceiverGetPrototypeOf(object);
     return proxy::ProxyGetPrototypeOf(objectJSProxy);
@@ -72,7 +72,7 @@ namespace object {
 
   transitioning macro
   ObjectSetPrototypeOfThrow(implicit context: Context)(
-      object: Object, proto: Object): Object {
+      object: JSAny, proto: JSReceiver | Null): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return object;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::JSReceiverSetPrototypeOfThrow(
@@ -83,7 +83,7 @@ namespace object {
 
   transitioning macro
   ObjectSetPrototypeOfDontThrow(implicit context: Context)(
-      object: Object, proto: Object): Object {
+      object: JSAny, proto: JSReceiver | Null): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object) otherwise return False;
     const objectJSProxy = Cast<JSProxy>(objectJSReceiver)
         otherwise return runtime::JSReceiverSetPrototypeOfDontThrow(
@@ -95,15 +95,15 @@ namespace object {
 namespace object_isextensible {
   // ES6 section 19.1.2.11 Object.isExtensible ( O )
   transitioning javascript builtin
-  ObjectIsExtensible(js-implicit context: Context)(object: Object): Object {
+  ObjectIsExtensible(js-implicit context: Context)(object: JSAny): JSAny {
     return object::ObjectIsExtensible(object);
   }
 }  // namespace object_isextensible
 
 namespace object_preventextensions {
   // ES6 section 19.1.2.11 Object.isExtensible ( O )
-  transitioning javascript builtin ObjectPreventExtensions(
-      js-implicit context: Context)(object: Object): Object {
+  transitioning javascript builtin
+  ObjectPreventExtensions(js-implicit context: Context)(object: JSAny): JSAny {
     return object::ObjectPreventExtensionsThrow(object);
   }
 }  // namespace object_preventextensions
@@ -111,7 +111,7 @@ namespace object_preventextensions {
 namespace object_getprototypeof {
   // ES6 section 19.1.2.9 Object.getPrototypeOf ( O )
   transitioning javascript builtin
-  ObjectGetPrototypeOf(js-implicit context: Context)(object: Object): Object {
+  ObjectGetPrototypeOf(js-implicit context: Context)(object: JSAny): JSAny {
     return object::ObjectGetPrototypeOf(object);
   }
 }  // namespace object_getprototypeof
@@ -119,7 +119,7 @@ namespace object_getprototypeof {
 namespace object_setprototypeof {
   // ES6 section 19.1.2.21 Object.setPrototypeOf ( O, proto )
   transitioning javascript builtin ObjectSetPrototypeOf(
-      js-implicit context: Context)(object: Object, proto: Object): Object {
+      js-implicit context: Context)(object: JSAny, proto: JSAny): JSAny {
     // 1. Set O to ? RequireObjectCoercible(O).
     RequireObjectCoercible(object, 'Object.setPrototypeOf');
 
@@ -129,9 +129,13 @@ namespace object_setprototypeof {
     // 4. Let status be ? O.[[SetPrototypeOf]](proto).
     // 5. If status is false, throw a TypeError exception.
     // 6. Return O.
-    if (proto == Null || Is<JSReceiver>(proto)) {
-      return object::ObjectSetPrototypeOfThrow(object, proto);
+    typeswitch (proto) {
+      case (proto: JSReceiver | Null): {
+        return object::ObjectSetPrototypeOfThrow(object, proto);
+      }
+      case (JSAny): {
+        ThrowTypeError(kProtoObjectOrNull, proto);
+      }
     }
-    ThrowTypeError(kProtoObjectOrNull, proto);
   }
 }  // namespace object_setprototypeof

src/builtins/proxy-constructor.tq

@@ -10,8 +10,8 @@ namespace proxy {
   // https://tc39.github.io/ecma262/#sec-proxy-constructor
   transitioning javascript builtin
   ProxyConstructor(
-      js-implicit context: Context, receiver: Object,
-      newTarget: Object)(target: Object, handler: Object): JSProxy {
+      js-implicit context: Context, receiver: JSAny,
+      newTarget: JSAny)(target: JSAny, handler: JSAny): JSProxy {
     try {
       // 1. If NewTarget is undefined, throw a TypeError exception.
       if (newTarget == Undefined) {

src/builtins/proxy-delete-property.tq

@@ -10,7 +10,7 @@ namespace proxy {
   // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-delete-p
   transitioning builtin
   ProxyDeleteProperty(implicit context: Context)(
-      proxy: JSProxy, name: Name, languageMode: LanguageMode): Object {
+      proxy: JSProxy, name: PropertyKey, languageMode: LanguageMode): JSAny {
     const kTrapName: constexpr string = 'deleteProperty';
     // Handle deeply nested proxy.
     PerformStackCheck();
@@ -58,7 +58,7 @@ namespace proxy {
       // 15. Return true.
       return True;
     }
-    label TrapUndefined(target: Object) {
+    label TrapUndefined(target: JSAny) {
       // 7.a. Return ? target.[[Delete]](P).
       return DeleteProperty(target, name, languageMode);
     }

src/builtins/proxy-get-property.tq

@@ -7,14 +7,14 @@
 namespace proxy {
 
   extern transitioning builtin GetPropertyWithReceiver(
-      implicit context: Context)(Object, Name, Object, Smi): Object;
+      implicit context: Context)(JSAny, Name, JSAny, Smi): JSAny;
 
   // ES #sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver
   // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-get-p-receiver
   transitioning builtin
   ProxyGetProperty(implicit context: Context)(
-      proxy: JSProxy, name: Name, receiverValue: Object,
-      onNonExistent: Smi): Object {
+      proxy: JSProxy, name: PropertyKey, receiverValue: JSAny,
+      onNonExistent: Smi): JSAny {
     PerformStackCheck();
     // 1. Assert: IsPropertyKey(P) is true.
     assert(TaggedIsNotSmi(name));

src/builtins/proxy-get-prototype-of.tq

@@ -9,7 +9,7 @@ namespace proxy {
   // ES #sec-proxy-object-internal-methods-and-internal-slots-isextensible
   // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
   transitioning builtin
-  ProxyGetPrototypeOf(implicit context: Context)(proxy: JSProxy): Object {
+  ProxyGetPrototypeOf(implicit context: Context)(proxy: JSProxy): JSAny {
     PerformStackCheck();
     const kTrapName: constexpr string = 'getPrototypeOf';
     try {
@@ -39,7 +39,7 @@ namespace proxy {
 
       // 9. Let extensibleTarget be ? IsExtensible(target).
       // 10. If extensibleTarget is true, return handlerProto.
-      const extensibleTarget: Object = object::ObjectIsExtensible(target);
+      const extensibleTarget: JSAny = object::ObjectIsExtensible(target);
       assert(extensibleTarget == True || extensibleTarget == False);
       if (extensibleTarget == True) {
         return handlerProto;
@@ -56,7 +56,7 @@ namespace proxy {
       }
       ThrowTypeError(kProxyGetPrototypeOfNonExtensible);
     }
-    label TrapUndefined(target: Object) {
+    label TrapUndefined(target: JSAny) {
       // 6.a. Return ? target.[[GetPrototypeOf]]().
       return object::ObjectGetPrototypeOf(target);
     }

src/builtins/proxy-has-property.tq

@@ -9,7 +9,7 @@ namespace proxy {
   // ES #sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
   // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-hasproperty-p
   transitioning builtin ProxyHasProperty(implicit context: Context)(
-      proxy: JSProxy, name: Name): Object {
+      proxy: JSProxy, name: PropertyKey): JSAny {
     assert(IsJSProxy(proxy));
 
     PerformStackCheck();
@@ -46,7 +46,7 @@ namespace proxy {
       CheckHasTrapResult(target, proxy, name);
       return False;
     }
-    label TrapUndefined(target: Object) {
+    label TrapUndefined(target: JSAny) {
       // 7.a. Return ? target.[[HasProperty]](P).
       tail HasProperty(target, name);
     }

src/builtins/proxy-is-extensible.tq

@@ -9,7 +9,7 @@ namespace proxy {
   // ES #sec-proxy-object-internal-methods-and-internal-slots-isextensible
   // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-isextensible
   transitioning builtin ProxyIsExtensible(implicit context:
-                                              Context)(proxy: JSProxy): Object {
+                                              Context)(proxy: JSProxy): JSAny {
     PerformStackCheck();
     const kTrapName: constexpr string = 'isExtensible';
     try {
@@ -45,7 +45,7 @@ namespace proxy {
       // 10. Return booleanTrapResult.
       return SelectBooleanConstant(trapResult);
     }
-    label TrapUndefined(target: Object) {
+    label TrapUndefined(target: JSAny) {
       // 6.a. Return ? IsExtensible(target).
       return object::ObjectIsExtensible(target);
     }

src/builtins/proxy-prevent-extensions.tq

@@ -9,8 +9,8 @@ namespace proxy {
   // ES #sec-proxy-object-internal-methods-and-internal-slots-preventextensions
   // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-preventextensions
   transitioning builtin
-  ProxyPreventExtensions(implicit context: Context)(
-      proxy: JSProxy, doThrow: Boolean): Object {
+  ProxyPreventExtensions(implicit context:
+                             Context)(proxy: JSProxy, doThrow: Boolean): JSAny {
     PerformStackCheck();
     const kTrapName: constexpr string = 'preventExtensions';
     try {
@@ -37,7 +37,7 @@ namespace proxy {
       //    8.a. Let extensibleTarget be ? IsExtensible(target).
       //    8.b If extensibleTarget is true, throw a TypeError exception.
       if (ToBoolean(trapResult)) {
-        const extensibleTarget: Object = object::ObjectIsExtensible(target);
+        const extensibleTarget: JSAny = object::ObjectIsExtensible(target);
         assert(extensibleTarget == True || extensibleTarget == False);
         if (extensibleTarget == True) {
           ThrowTypeError(kProxyPreventExtensionsExtensible);
@@ -52,7 +52,7 @@ namespace proxy {
       // 9. Return booleanTrapResult.
       return True;
     }
-    label TrapUndefined(target: Object) {
+    label TrapUndefined(target: JSAny) {
       // 6.a. Return ? target.[[PreventExtensions]]().
       if (doThrow == True) {
         return object::ObjectPreventExtensionsThrow(target);

src/builtins/proxy-revocable.tq

@@ -12,7 +12,7 @@ namespace proxy {
   // Proxy.revocable(target, handler)
   // https://tc39.github.io/ecma262/#sec-proxy.revocable
   transitioning javascript builtin
-  ProxyRevocable(js-implicit context: Context)(target: Object, handler: Object):
+  ProxyRevocable(js-implicit context: Context)(target: JSAny, handler: JSAny):
       JSProxyRevocableResult {
     try {
       const targetJSReceiver =

src/builtins/proxy-set-property.tq

@@ -19,15 +19,21 @@ namespace proxy {
   // https://tc39.github.io/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-set-p-v-receiver
   transitioning builtin
   ProxySetProperty(implicit context: Context)(
-      proxy: JSProxy, name: Name, value: Object,
-      receiverValue: Object): Object {
+      proxy: JSProxy, name: PropertyKey | PrivateSymbol, value: JSAny,
+      receiverValue: JSAny): JSAny {
     // 1. Assert: IsPropertyKey(P) is true.
     assert(TaggedIsNotSmi(name));
     assert(IsName(name));
 
-    if (IsPrivateSymbol(name)) {
-      CallThrowTypeErrorIfStrict(kProxyPrivate);
-      return Undefined;
+    let key: PropertyKey;
+    typeswitch (name) {
+      case (PrivateSymbol): {
+        CallThrowTypeErrorIfStrict(kProxyPrivate);
+        return Undefined;
+      }
+      case (name: PropertyKey): {
+        key = name;
+      }
     }
 
     try {
@@ -61,7 +67,7 @@ namespace proxy {
       //      exception.
       // 12. Return true.
       const trapResult =
-          Call(context, trap, handler, target, name, value, receiverValue);
+          Call(context, trap, handler, target, key, value, receiverValue);
       if (ToBoolean(trapResult)) {
         CheckGetSetTrapResult(target, proxy, name, value, kProxySet);
         return value;

src/builtins/proxy-set-prototype-of.tq

@@ -10,7 +10,7 @@ namespace proxy {
   // https://tc39.es/ecma262/#sec-proxy-object-internal-methods-and-internal-slots-setprototypeof-v
   transitioning builtin
   ProxySetPrototypeOf(implicit context: Context)(
-      proxy: JSProxy, proto: Object, doThrow: Boolean): Object {
+      proxy: JSProxy, proto: Null | JSReceiver, doThrow: Boolean): JSAny {
     PerformStackCheck();
     const kTrapName: constexpr string = 'setPrototypeOf';
     try {
@@ -63,7 +63,7 @@ namespace proxy {
       }
       ThrowTypeError(kProxySetPrototypeOfNonExtensible);
     }
-    label TrapUndefined(target: Object, proto: Object) {
+    label TrapUndefined(target: JSAny, proto: JSReceiver | Null) {
       // 7.a. Return ? target.[[SetPrototypeOf]]().
       if (doThrow == True) {
         return object::ObjectSetPrototypeOfThrow(target, proto);

src/builtins/reflect.tq

@@ -9,15 +9,15 @@ namespace reflect {
 
   // ES6 section 26.1.10 Reflect.isExtensible
   transitioning javascript builtin
-  ReflectIsExtensible(js-implicit context: Context)(object: Object): Object {
+  ReflectIsExtensible(js-implicit context: Context)(object: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.isExtensible');
     return object::ObjectIsExtensible(objectJSReceiver);
   }
 
   // ES6 section 26.1.12 Reflect.preventExtensions
-  transitioning javascript builtin ReflectPreventExtensions(
-      js-implicit context: Context)(object: Object): Object {
+  transitioning javascript builtin
+  ReflectPreventExtensions(js-implicit context: Context)(object: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.preventExtensions');
     return object::ObjectPreventExtensionsDontThrow(objectJSReceiver);
@@ -25,7 +25,7 @@ namespace reflect {
 
   // ES6 section 26.1.8 Reflect.getPrototypeOf
   transitioning javascript builtin
-  ReflectGetPrototypeOf(js-implicit context: Context)(object: Object): Object {
+  ReflectGetPrototypeOf(js-implicit context: Context)(object: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.getPrototypeOf');
     return object::JSReceiverGetPrototypeOf(objectJSReceiver);
@@ -33,40 +33,45 @@ namespace reflect {
 
   // ES6 section 26.1.14 Reflect.setPrototypeOf
   transitioning javascript builtin ReflectSetPrototypeOf(
-      js-implicit context: Context)(object: Object, proto: Object): Object {
+      js-implicit context: Context)(object: JSAny, proto: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.setPrototypeOf');
-    if (proto == Null || Is<JSReceiver>(proto)) {
-      return object::ObjectSetPrototypeOfDontThrow(objectJSReceiver, proto);
+    typeswitch (proto) {
+      case (proto: JSReceiver | Null): {
+        return object::ObjectSetPrototypeOfDontThrow(objectJSReceiver, proto);
+      }
+      case (JSAny): {
+        ThrowTypeError(kProtoObjectOrNull, proto);
+      }
     }
-    ThrowTypeError(kProtoObjectOrNull, proto);
   }
 
-  extern transitioning builtin ToName(implicit context: Context)(Object): Name;
+  extern transitioning builtin ToName(implicit context: Context)(JSAny):
+      AnyName;
   type OnNonExistent constexpr 'OnNonExistent';
   const kReturnUndefined: constexpr OnNonExistent
   generates 'OnNonExistent::kReturnUndefined';
   extern macro SmiConstant(constexpr OnNonExistent): Smi;
   extern transitioning builtin GetPropertyWithReceiver(
-      implicit context: Context)(Object, Name, Object, Smi): Object;
+      implicit context: Context)(JSAny, Name, JSAny, Smi): JSAny;
 
   // ES6 section 26.1.6 Reflect.get
   transitioning javascript builtin
-  ReflectGet(js-implicit context: Context)(...arguments): Object {
+  ReflectGet(js-implicit context: Context)(...arguments): JSAny {
     const length = arguments.length;
-    const object: Object = length > 0 ? arguments[0] : Undefined;
+    const object: JSAny = length > 0 ? arguments[0] : Undefined;
     const objectJSReceiver = Cast<JSReceiver>(object)
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.get');
-    const propertyKey: Object = length > 1 ? arguments[1] : Undefined;
-    const name: Name = ToName(propertyKey);
-    const receiver: Object = length > 2 ? arguments[2] : objectJSReceiver;
+    const propertyKey: JSAny = length > 1 ? arguments[1] : Undefined;
+    const name: AnyName = ToName(propertyKey);
+    const receiver: JSAny = length > 2 ? arguments[2] : objectJSReceiver;
     return GetPropertyWithReceiver(
         objectJSReceiver, name, receiver, SmiConstant(kReturnUndefined));
   }
 
   // ES6 section 26.1.4 Reflect.deleteProperty
   transitioning javascript builtin ReflectDeleteProperty(
-      js-implicit context: Context)(object: Object, key: Object): Object {
+      js-implicit context: Context)(object: JSAny, key: JSAny): JSAny {
     const objectJSReceiver = Cast<JSReceiver>(object)
         otherwise ThrowTypeError(kCalledOnNonObject, 'Reflect.deleteProperty');
     return DeleteProperty(objectJSReceiver, key, kSloppy);

src/builtins/regexp-replace.tq

@@ -53,7 +53,7 @@ namespace regexp {
         // Element represents the matched substring, which is then passed to the
         // replace function.
         case (elString: String): {
-          const replacementObj: Object =
+          const replacementObj: JSAny =
               Call(context, replaceFn, Undefined, elString, matchStart, string);
           const replacement: String = ToString_Inline(context, replacementObj);
           matchesElements.objects[i] = replacement;
@@ -75,7 +75,7 @@ namespace regexp {
 
       // The JSArray is expanded into the function args by Reflect.apply().
       // TODO(jgruber): Remove indirection through Call->ReflectApply.
-      const replacementObj: Object = Call(
+      const replacementObj: JSAny = Call(
           context, GetReflectApply(), Undefined, replaceFn, Undefined, elArray);
 
       // Overwrite the i'th element in the results with the string
@@ -169,7 +169,7 @@ namespace regexp {
   }
 
   transitioning builtin RegExpReplace(implicit context: Context)(
-      regexp: FastJSRegExp, string: String, replaceValue: Object): String {
+      regexp: FastJSRegExp, string: String, replaceValue: JSAny): String {
     // TODO(pwong): Remove assert when all callers (StringPrototypeReplace) are
     // from Torque.
     assert(Is<FastJSRegExp>(regexp));
@@ -181,7 +181,7 @@ namespace regexp {
             RegExpReplaceFastGlobalCallable(regexp, string, replaceFn) :
             StringReplaceNonGlobalRegExpWithFunction(string, regexp, replaceFn);
       }
-      case (Object): {
+      case (JSAny): {
         const stableRegexp: JSRegExp = regexp;
         const replaceString: String = ToString_Inline(context, replaceValue);
 
@@ -205,7 +205,7 @@ namespace regexp {
   }
 
   transitioning javascript builtin RegExpPrototypeReplace(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     const methodName: constexpr string = 'RegExp.prototype.@@replace';
 
     // RegExpPrototypeReplace is a bit of a beast - a summary of dispatch logic:
@@ -226,8 +226,8 @@ namespace regexp {
     //   }
     // }
 
-    const string: Object = arguments[0];
-    const replaceValue: Object = arguments[1];
+    const string: JSAny = arguments[0];
+    const replaceValue: JSAny = arguments[1];
 
     // Let rx be the this value.
     // If Type(rx) is not Object, throw a TypeError exception.

src/builtins/regexp-source.tq

@@ -15,7 +15,7 @@ namespace regexp {
   // ES6 21.2.5.10.
   // ES #sec-get-regexp.prototype.source
   transitioning javascript builtin RegExpPrototypeSourceGetter(
-      js-implicit context: Context, receiver: Object)(): Object {
+      js-implicit context: Context, receiver: JSAny)(): JSAny {
     typeswitch (receiver) {
       case (receiver: JSRegExp): {
         return receiver.source;

src/builtins/regexp-test.tq

@@ -9,7 +9,7 @@ namespace regexp {
   // ES#sec-regexp.prototype.test
   // RegExp.prototype.test ( S )
   transitioning javascript builtin RegExpPrototypeTest(
-      js-implicit context: Context, receiver: Object)(string: String): Object {
+      js-implicit context: Context, receiver: JSAny)(string: JSAny): JSAny {
     const methodName: constexpr string = 'RegExp.prototype.test';
     const receiver = Cast<JSReceiver>(receiver)
         otherwise ThrowTypeError(kIncompatibleMethodReceiver, methodName);

src/builtins/string-endswith.tq

@@ -28,13 +28,13 @@ namespace string {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.endswith
   transitioning javascript builtin StringPrototypeEndsWith(
-      js-implicit context: Context, receiver: Object)(...arguments): Boolean {
-    const searchString: Object = arguments[0];
-    const endPosition: Object = arguments[1];
+      js-implicit context: Context, receiver: JSAny)(...arguments): Boolean {
+    const searchString: JSAny = arguments[0];
+    const endPosition: JSAny = arguments[1];
     const kBuiltinName: constexpr string = 'String.prototype.endsWith';
 
     // 1. Let O be ? RequireObjectCoercible(this value).
-    const object: Object = RequireObjectCoercible(receiver, kBuiltinName);
+    const object: JSAny = RequireObjectCoercible(receiver, kBuiltinName);
 
     // 2. Let S be ? ToString(O).
     const string: String = ToString_Inline(context, object);

src/builtins/string-html.tq

@@ -7,8 +7,8 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-createhtml
   transitioning builtin CreateHTML(implicit context: Context)(
-      receiver: Object, methodName: String, tagName: String, attr: String,
-      attrValue: Object): String {
+      receiver: JSAny, methodName: String, tagName: String, attr: String,
+      attrValue: JSAny): String {
     const tagContents: String = ToThisString(receiver, methodName);
     let result = '<' + tagName;
     if (attr != kEmptyString) {
@@ -22,14 +22,14 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.anchor
   transitioning javascript builtin StringPrototypeAnchor(
-      js-implicit context: Context, receiver: Object)(...arguments): String {
+      js-implicit context: Context, receiver: JSAny)(...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.anchor', 'a', 'name', arguments[0]);
   }
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.big
   transitioning javascript builtin
-  StringPrototypeBig(js-implicit context: Context, receiver: Object)(
+  StringPrototypeBig(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.big', 'big', kEmptyString, kEmptyString);
@@ -37,7 +37,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.blink
   transitioning javascript builtin
-  StringPrototypeBlink(js-implicit context: Context, receiver: Object)(
+  StringPrototypeBlink(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.blink', 'blink', kEmptyString,
@@ -46,7 +46,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.bold
   transitioning javascript builtin
-  StringPrototypeBold(js-implicit context: Context, receiver: Object)(
+  StringPrototypeBold(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.bold', 'b', kEmptyString, kEmptyString);
@@ -54,7 +54,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.fontcolor
   transitioning javascript builtin
-  StringPrototypeFontcolor(js-implicit context: Context, receiver: Object)(
+  StringPrototypeFontcolor(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.fontcolor', 'font', 'color', arguments[0]);
@@ -62,7 +62,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.fontsize
   transitioning javascript builtin
-  StringPrototypeFontsize(js-implicit context: Context, receiver: Object)(
+  StringPrototypeFontsize(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.fontsize', 'font', 'size', arguments[0]);
@@ -70,7 +70,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.fixed
   transitioning javascript builtin
-  StringPrototypeFixed(js-implicit context: Context, receiver: Object)(
+  StringPrototypeFixed(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.fixed', 'tt', kEmptyString, kEmptyString);
@@ -78,7 +78,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.italics
   transitioning javascript builtin
-  StringPrototypeItalics(js-implicit context: Context, receiver: Object)(
+  StringPrototypeItalics(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.italics', 'i', kEmptyString, kEmptyString);
@@ -86,7 +86,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.link
   transitioning javascript builtin
-  StringPrototypeLink(js-implicit context: Context, receiver: Object)(
+  StringPrototypeLink(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.link', 'a', 'href', arguments[0]);
@@ -94,7 +94,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.small
   transitioning javascript builtin
-  StringPrototypeSmall(js-implicit context: Context, receiver: Object)(
+  StringPrototypeSmall(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.small', 'small', kEmptyString,
@@ -103,7 +103,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.strike
   transitioning javascript builtin
-  StringPrototypeStrike(js-implicit context: Context, receiver: Object)(
+  StringPrototypeStrike(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.strike', 'strike', kEmptyString,
@@ -112,7 +112,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.sub
   transitioning javascript builtin
-  StringPrototypeSub(js-implicit context: Context, receiver: Object)(
+  StringPrototypeSub(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.sub', 'sub', kEmptyString, kEmptyString);
@@ -120,7 +120,7 @@ namespace string_html {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.sup
   transitioning javascript builtin
-  StringPrototypeSup(js-implicit context: Context, receiver: Object)(
+  StringPrototypeSup(js-implicit context: Context, receiver: JSAny)(
       ...arguments): String {
     return CreateHTML(
         receiver, 'String.prototype.sup', 'sup', kEmptyString, kEmptyString);

src/builtins/string-iterator.tq

@@ -17,7 +17,7 @@ namespace string_iterator {
 
   // ES6 #sec-string.prototype-@@iterator
   transitioning javascript builtin StringPrototypeIterator(
-      js-implicit context: Context, receiver: Object)(): JSStringIterator {
+      js-implicit context: Context, receiver: JSAny)(): JSStringIterator {
     const name: String =
         ToThisString(receiver, 'String.prototype[Symbol.iterator]');
     const index: Smi = 0;
@@ -26,7 +26,7 @@ namespace string_iterator {
 
   // ES6 #sec-%stringiteratorprototype%.next
   transitioning javascript builtin StringIteratorPrototypeNext(
-      js-implicit context: Context, receiver: Object)(): JSObject {
+      js-implicit context: Context, receiver: JSAny)(): JSObject {
     const iterator = Cast<JSStringIterator>(receiver) otherwise ThrowTypeError(
         kIncompatibleMethodReceiver, 'String Iterator.prototype.next',
         receiver);

src/builtins/string-repeat.tq

@@ -28,7 +28,7 @@ namespace string_repeat {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.repeat
   transitioning javascript builtin StringPrototypeRepeat(
-      js-implicit context: Context, receiver: Object)(count: Object): String {
+      js-implicit context: Context, receiver: JSAny)(count: JSAny): String {
     // 1. Let O be ? RequireObjectCoercible(this value).
     // 2. Let S be ? ToString(O).
     const s: String = ToThisString(receiver, kBuiltinName);

src/builtins/string-slice.tq

@@ -9,7 +9,7 @@ namespace string_slice {
   // ES6 #sec-string.prototype.slice ( start, end )
   // https://tc39.github.io/ecma262/#sec-string.prototype.slice
   transitioning javascript builtin StringPrototypeSlice(
-      js-implicit context: Context, receiver: Object)(...arguments): String {
+      js-implicit context: Context, receiver: JSAny)(...arguments): String {
     // 1. Let O be ? RequireObjectCoercible(this value).
     // 2. Let S be ? ToString(O).
     const string: String = ToThisString(receiver, 'String.prototype.slice');

src/builtins/string-startswith.tq

@@ -10,13 +10,13 @@ namespace string {
 
   // https://tc39.github.io/ecma262/#sec-string.prototype.startswith
   transitioning javascript builtin StringPrototypeStartsWith(
-      js-implicit context: Context, receiver: Object)(...arguments): Boolean {
-    const searchString: Object = arguments[0];
-    const position: Object = arguments[1];
+      js-implicit context: Context, receiver: JSAny)(...arguments): Boolean {
+    const searchString: JSAny = arguments[0];
+    const position: JSAny = arguments[1];
     const kBuiltinName: constexpr string = 'String.prototype.startsWith';
 
     // 1. Let O be ? RequireObjectCoercible(this value).
-    const object: Object = RequireObjectCoercible(receiver, kBuiltinName);
+    const object: JSAny = RequireObjectCoercible(receiver, kBuiltinName);
 
     // 2. Let S be ? ToString(O).
     const string: String = ToString_Inline(context, object);

src/builtins/string-substring.tq

@@ -7,7 +7,7 @@ namespace string_substring {
   extern macro SubString(String, intptr, intptr): String;
 
   transitioning macro ToSmiBetweenZeroAnd(implicit context: Context)(
-      value: Object, limit: Smi): Smi {
+      value: JSAny, limit: Smi): Smi {
     const valueInt: Number =
         ToInteger_Inline(context, value, kTruncateMinusZero);
     typeswitch (valueInt) {
@@ -28,7 +28,7 @@ namespace string_substring {
 
   // ES6 #sec-string.prototype.substring
   transitioning javascript builtin StringPrototypeSubstring(
-      js-implicit context: Context, receiver: Object)(...arguments): String {
+      js-implicit context: Context, receiver: JSAny)(...arguments): String {
     // Check that {receiver} is coercible to Object and convert it to a String.
     const string: String = ToThisString(receiver, 'String.prototype.substring');
     const length = string.length_smi;

src/builtins/string.tq

@@ -7,15 +7,15 @@
 namespace string {
   // ES6 #sec-string.prototype.tostring
   transitioning javascript builtin
-  StringPrototypeToString(js-implicit context: Context, receiver: Object)():
-      Object {
+  StringPrototypeToString(js-implicit context: Context, receiver: JSAny)():
+      JSAny {
     return ToThisValue(receiver, kString, 'String.prototype.toString');
   }
 
   // ES6 #sec-string.prototype.valueof
   transitioning javascript builtin
-  StringPrototypeValueOf(js-implicit context: Context, receiver: Object)():
-      Object {
+  StringPrototypeValueOf(js-implicit context: Context, receiver: JSAny)():
+      JSAny {
     return ToThisValue(receiver, kString, 'String.prototype.valueOf');
   }
 
@@ -53,7 +53,7 @@ namespace string {
   }
 
   transitioning macro GenerateStringAt(implicit context: Context)(
-      receiver: Object, position: Object,
+      receiver: JSAny, position: JSAny,
       methodName: constexpr string): never labels
   IfInBounds(String, intptr, intptr), IfOutOfBounds {
     // Check that {receiver} is coercible to Object and convert it to a String.
@@ -71,8 +71,7 @@ namespace string {
 
   // ES6 #sec-string.prototype.charat
   transitioning javascript builtin StringPrototypeCharAt(
-      js-implicit context: Context,
-      receiver: Object)(position: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(position: JSAny): JSAny {
     try {
       GenerateStringAt(receiver, position, 'String.prototype.charAt')
           otherwise IfInBounds, IfOutOfBounds;
@@ -88,8 +87,7 @@ namespace string {
 
   // ES6 #sec-string.prototype.charcodeat
   transitioning javascript builtin StringPrototypeCharCodeAt(
-      js-implicit context: Context,
-      receiver: Object)(position: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(position: JSAny): JSAny {
     try {
       GenerateStringAt(receiver, position, 'String.prototype.charCodeAt')
           otherwise IfInBounds, IfOutOfBounds;
@@ -105,8 +103,7 @@ namespace string {
 
   // ES6 #sec-string.prototype.codepointat
   transitioning javascript builtin StringPrototypeCodePointAt(
-      js-implicit context: Context,
-      receiver: Object)(position: Object): Object {
+      js-implicit context: Context, receiver: JSAny)(position: JSAny): JSAny {
     try {
       GenerateStringAt(receiver, position, 'String.prototype.codePointAt')
           otherwise IfInBounds, IfOutOfBounds;
@@ -125,7 +122,7 @@ namespace string {
   // ES6 String.prototype.concat(...args)
   // ES6 #sec-string.prototype.concat
   transitioning javascript builtin StringPrototypeConcat(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     // Check that {receiver} is coercible to Object and convert it to a String.
     let string: String = ToThisString(receiver, 'String.prototype.concat');
 
@@ -139,13 +136,13 @@ namespace string {
   }
 
   extern transitioning runtime
-  SymbolDescriptiveString(implicit context: Context)(Object): Object;
+  SymbolDescriptiveString(implicit context: Context)(Symbol): String;
 
   // ES #sec-string-constructor
   // https://tc39.github.io/ecma262/#sec-string-constructor
   transitioning javascript builtin StringConstructor(
-      js-implicit context: Context, receiver: Object, newTarget: Object,
-      target: JSFunction)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny, newTarget: JSAny,
+      target: JSFunction)(...arguments): JSAny {
     const length: intptr = Convert<intptr>(arguments.length);
     let s: String;
     // 1. If no arguments were passed to this function invocation, let s be "".
@@ -160,7 +157,7 @@ namespace string {
           case (value: Symbol): {
             return SymbolDescriptiveString(value);
           }
-          case (Object): {
+          case (JSAny): {
           }
         }
       }
@@ -181,20 +178,12 @@ namespace string {
   }
 
   transitioning builtin StringAddConvertLeft(implicit context: Context)(
-      left: Object, right: String): String {
-    let temp: Object = left;
-    if (Is<JSReceiver>(temp)) {
-      temp = NonPrimitiveToPrimitive_Default(context, temp);
-    }
-    return ToStringImpl(context, temp) + right;
+      left: JSAny, right: String): String {
+    return ToStringImpl(context, ToPrimitiveDefault(left)) + right;
   }
 
   transitioning builtin StringAddConvertRight(implicit context: Context)(
-      left: String, right: Object): String {
-    let temp: Object = right;
-    if (Is<JSReceiver>(temp)) {
-      temp = NonPrimitiveToPrimitive_Default(context, temp);
-    }
-    return left + ToStringImpl(context, temp);
+      left: String, right: JSAny): String {
+    return left + ToStringImpl(context, ToPrimitiveDefault(right));
   }
 }

src/builtins/typed-array-createtypedarray.tq

@@ -122,7 +122,7 @@ namespace typed_array_createtypedarray {
   // 22.2.4.2 TypedArray ( length )
   // ES #sec-typedarray-length
   transitioning macro ConstructByLength(implicit context: Context)(
-      map: Map, length: Object,
+      map: Map, length: JSAny,
       elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
     const convertedLength: Number =
         ToInteger_Inline(context, length, kTruncateMinusZero);
@@ -141,7 +141,7 @@ namespace typed_array_createtypedarray {
   // 22.2.4.4 TypedArray ( object )
   // ES #sec-typedarray-object
   transitioning macro ConstructByArrayLike(implicit context: Context)(
-      map: Map, arrayLike: HeapObject, initialLength: Object,
+      map: Map, arrayLike: HeapObject, initialLength: JSAny,
       elementsInfo: typed_array::TypedArrayElementsInfo,
       bufferConstructor: JSReceiver): JSTypedArray {
     // The caller has looked up length on arrayLike, which is observable.
@@ -178,7 +178,7 @@ namespace typed_array_createtypedarray {
   // ES #sec-typedarray-object
   transitioning macro ConstructByIterable(implicit context: Context)(
       iterable: JSReceiver, iteratorFn: Callable): never
-      labels IfConstructByArrayLike(HeapObject, Object, JSReceiver) {
+      labels IfConstructByArrayLike(JSArray, Number, JSReceiver) {
     const array: JSArray =
         IterableToListMayPreserveHoles(context, iterable, iteratorFn);
     goto IfConstructByArrayLike(array, array.length, GetArrayBufferFunction());
@@ -188,7 +188,7 @@ namespace typed_array_createtypedarray {
   // ES #sec-typedarray-typedarray
   transitioning macro ConstructByTypedArray(implicit context: Context)(
       srcTypedArray: JSTypedArray): never
-      labels IfConstructByArrayLike(HeapObject, Object, JSReceiver) {
+      labels IfConstructByArrayLike(JSTypedArray, Number, JSReceiver) {
     let bufferConstructor: JSReceiver = GetArrayBufferFunction();
     const srcBuffer: JSArrayBuffer = srcTypedArray.buffer;
     // TODO(petermarshall): Throw on detached typedArray.
@@ -210,7 +210,7 @@ namespace typed_array_createtypedarray {
   // 22.2.4.5 TypedArray ( buffer, byteOffset, length )
   // ES #sec-typedarray-buffer-byteoffset-length
   transitioning macro ConstructByArrayBuffer(implicit context: Context)(
-      map: Map, buffer: JSArrayBuffer, byteOffset: Object, length: Object,
+      map: Map, buffer: JSArrayBuffer, byteOffset: JSAny, length: JSAny,
       elementsInfo: typed_array::TypedArrayElementsInfo): JSTypedArray {
     try {
       let offset: uintptr = 0;
@@ -294,7 +294,7 @@ namespace typed_array_createtypedarray {
 
   transitioning macro ConstructByJSReceiver(implicit context:
                                                 Context)(obj: JSReceiver): never
-      labels IfConstructByArrayLike(HeapObject, Object, JSReceiver) {
+      labels IfConstructByArrayLike(JSReceiver, Number, JSReceiver) {
     try {
       const iteratorMethod: Object =
           GetIteratorMethod(obj) otherwise IfIteratorUndefined;
@@ -304,7 +304,7 @@ namespace typed_array_createtypedarray {
           otherwise IfConstructByArrayLike;
     }
     label IfIteratorUndefined {
-      const lengthObj: Object = GetProperty(obj, kLengthString);
+      const lengthObj: JSAny = GetProperty(obj, kLengthString);
       const length: Smi = ToSmiLength(lengthObj)
           otherwise goto IfInvalidLength(lengthObj);
       goto IfConstructByArrayLike(obj, length, GetArrayBufferFunction());
@@ -317,8 +317,8 @@ namespace typed_array_createtypedarray {
   // 22.2.4 The TypedArray Constructors
   // ES #sec-typedarray-constructors
   transitioning builtin CreateTypedArray(
-      context: Context, target: JSFunction, newTarget: JSReceiver, arg1: Object,
-      arg2: Object, arg3: Object): JSTypedArray {
+      context: Context, target: JSFunction, newTarget: JSReceiver, arg1: JSAny,
+      arg2: JSAny, arg3: JSAny): JSTypedArray {
     assert(IsConstructor(target));
     // 4. Let O be ? AllocateTypedArray(constructorName, NewTarget,
     // "%TypedArrayPrototype%").
@@ -345,16 +345,16 @@ namespace typed_array_createtypedarray {
         }
         // The first argument was a number or fell through and is treated as
         // a number. https://tc39.github.io/ecma262/#sec-typedarray-length
-        case (lengthObj: HeapObject): {
+        case (lengthObj: JSAny): {
           goto IfConstructByLength(lengthObj);
         }
       }
     }
-    label IfConstructByLength(length: Object) {
+    label IfConstructByLength(length: JSAny) {
       return ConstructByLength(map, length, elementsInfo);
     }
     label IfConstructByArrayLike(
-        arrayLike: HeapObject, length: Object, bufferConstructor: JSReceiver) {
+        arrayLike: JSReceiver, length: Number, bufferConstructor: JSReceiver) {
       return ConstructByArrayLike(
           map, arrayLike, length, elementsInfo, bufferConstructor);
     }
@@ -362,8 +362,8 @@ namespace typed_array_createtypedarray {
 
   transitioning macro TypedArraySpeciesCreate(implicit context: Context)(
       methodName: constexpr string, numArgs: constexpr int31,
-      exemplar: JSTypedArray, arg0: Object, arg1: Object,
-      arg2: Object): JSTypedArray {
+      exemplar: JSTypedArray, arg0: JSAny, arg1: JSAny,
+      arg2: JSAny): JSTypedArray {
     const defaultConstructor = GetDefaultConstructor(exemplar);
 
     try {
@@ -386,7 +386,7 @@ namespace typed_array_createtypedarray {
 
       // TODO(pwong): Simplify and remove numArgs when varargs are supported in
       // macros.
-      let newObj: Object = Undefined;
+      let newObj: JSAny = Undefined;
       if constexpr (numArgs == 1) {
         newObj = Construct(constructor, arg0);
       } else {

src/builtins/typed-array-every.tq

@@ -9,7 +9,7 @@ namespace typed_array_every {
 
   transitioning macro EveryAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: Object): Boolean {
+      thisArg: JSAny): Boolean {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
     // TODO(v8:4153): Support huge TypedArrays here.
     const length =
@@ -17,7 +17,7 @@ namespace typed_array_every {
     for (let k: Smi = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
-      const value: Object = witness.Load(k);
+      const value: JSAny = witness.Load(k);
       const result =
           Call(context, callbackfn, thisArg, value, k, witness.GetStable());
       if (!ToBoolean(result)) {
@@ -29,8 +29,8 @@ namespace typed_array_every {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
   transitioning javascript builtin
-  TypedArrayPrototypeEvery(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  TypedArrayPrototypeEvery(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg
     try {

src/builtins/typed-array-filter.tq

@@ -10,7 +10,7 @@ namespace typed_array_filter {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.filter
   transitioning javascript builtin TypedArrayPrototypeFilter(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg
     try {
@@ -29,7 +29,7 @@ namespace typed_array_filter {
           otherwise ThrowTypeError(kCalledNonCallable, arguments[0]);
 
       // 5. If thisArg is present, let T be thisArg; else let T be undefined.
-      const thisArg: Object = arguments[1];
+      const thisArg: JSAny = arguments[1];
 
       // 6. Let kept be a new empty List.
       let kept = growable_fixed_array::NewGrowableFixedArray();
@@ -43,11 +43,11 @@ namespace typed_array_filter {
 
         // a. Let Pk be ! ToString(k).
         // b. Let kValue be ? Get(O, Pk).
-        const value: Object = witness.Load(k);
+        const value: JSAny = witness.Load(k);
 
         // c. Let selected be ToBoolean(? Call(callbackfn, T, « kValue, k, O
         // »)).
-        const selected: Object =
+        const selected: JSAny =
             Call(context, callbackfn, thisArg, value, k, witness.GetStable());
 
         // d. If selected is true, then

src/builtins/typed-array-find.tq

@@ -9,7 +9,7 @@ namespace typed_array_find {
 
   transitioning macro FindAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: Object): Object {
+      thisArg: JSAny): JSAny {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
     // TODO(v8:4153): Support huge TypedArrays here.
     const length =
@@ -17,7 +17,7 @@ namespace typed_array_find {
     for (let k: Smi = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
-      const value: Object = witness.Load(k);
+      const value: JSAny = witness.Load(k);
       const result =
           Call(context, callbackfn, thisArg, value, k, witness.GetStable());
       if (ToBoolean(result)) {
@@ -29,8 +29,8 @@ namespace typed_array_find {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.find
   transitioning javascript builtin
-  TypedArrayPrototypeFind(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  TypedArrayPrototypeFind(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg
     try {

src/builtins/typed-array-findindex.tq

@@ -9,7 +9,7 @@ namespace typed_array_findindex {
 
   transitioning macro FindIndexAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: Object): Number {
+      thisArg: JSAny): Number {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
     // TODO(v8:4153): Support huge TypedArrays here.
     const length =
@@ -17,7 +17,7 @@ namespace typed_array_findindex {
     for (let k: Smi = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
-      const value: Object = witness.Load(k);
+      const value: JSAny = witness.Load(k);
       const result =
           Call(context, callbackfn, thisArg, value, k, witness.GetStable());
       if (ToBoolean(result)) {
@@ -29,8 +29,8 @@ namespace typed_array_findindex {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.findIndex
   transitioning javascript builtin
-  TypedArrayPrototypeFindIndex(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  TypedArrayPrototypeFindIndex(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg.
     try {

src/builtins/typed-array-foreach.tq

@@ -9,7 +9,7 @@ namespace typed_array_foreach {
 
   transitioning macro ForEachAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: Object): Object {
+      thisArg: JSAny): Undefined {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
     // TODO(v8:4153): Support huge TypedArrays here.
     const length =
@@ -17,7 +17,7 @@ namespace typed_array_foreach {
     for (let k: Smi = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
-      const value: Object = witness.Load(k);
+      const value: JSAny = witness.Load(k);
       Call(context, callbackfn, thisArg, value, k, witness.GetStable());
     }
     return Undefined;
@@ -25,8 +25,8 @@ namespace typed_array_foreach {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.every
   transitioning javascript builtin
-  TypedArrayPrototypeForEach(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  TypedArrayPrototypeForEach(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): Undefined {
     // arguments[0] = callback
     // arguments[1] = this_arg.
 

src/builtins/typed-array-reduce.tq

@@ -9,7 +9,7 @@ namespace typed_array_reduce {
 
   transitioning macro ReduceAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      initialValue: Object): Object {
+      initialValue: JSAny | TheHole): JSAny {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
     // TODO(v8:4153): Support huge TypedArrays here.
     const length =
@@ -18,25 +18,32 @@ namespace typed_array_reduce {
     for (let k: Smi = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
-      const value: Object = witness.Load(k);
-      if (accumulator == TheHole) {
-        accumulator = value;
-      } else {
-        accumulator = Call(
-            context, callbackfn, Undefined, accumulator, value, k,
-            witness.GetStable());
+      const value: JSAny = witness.Load(k);
+      typeswitch (accumulator) {
+        case (TheHole): {
+          accumulator = value;
+        }
+        case (accumulatorNotHole: JSAny): {
+          accumulator = Call(
+              context, callbackfn, Undefined, accumulatorNotHole, value, k,
+              witness.GetStable());
+        }
       }
     }
-    if (accumulator == TheHole) {
-      ThrowTypeError(kReduceNoInitial, kBuiltinName);
+    typeswitch (accumulator) {
+      case (TheHole): {
+        ThrowTypeError(kReduceNoInitial, kBuiltinName);
+      }
+      case (accumulator: JSAny): {
+        return accumulator;
+      }
     }
-    return accumulator;
   }
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduce
   transitioning javascript builtin
-  TypedArrayPrototypeReduce(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  TypedArrayPrototypeReduce(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = initialValue.
     try {

src/builtins/typed-array-reduceright.tq

@@ -9,7 +9,7 @@ namespace typed_array_reduceright {
 
   transitioning macro ReduceRightAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      initialValue: Object): Object {
+      initialValue: JSAny | TheHole): JSAny {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
     // TODO(v8:4153): Support huge TypedArrays here.
     const length =
@@ -18,25 +18,32 @@ namespace typed_array_reduceright {
     for (let k: Smi = length - 1; k >= 0; k--) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
-      const value: Object = witness.Load(k);
-      if (accumulator == TheHole) {
-        accumulator = value;
-      } else {
-        accumulator = Call(
-            context, callbackfn, Undefined, accumulator, value, k,
-            witness.GetStable());
+      const value: JSAny = witness.Load(k);
+      typeswitch (accumulator) {
+        case (TheHole): {
+          accumulator = value;
+        }
+        case (accumulatorNotHole: JSAny): {
+          accumulator = Call(
+              context, callbackfn, Undefined, accumulatorNotHole, value, k,
+              witness.GetStable());
+        }
       }
     }
-    if (accumulator == TheHole) {
-      ThrowTypeError(kReduceNoInitial, kBuiltinName);
+    typeswitch (accumulator) {
+      case (TheHole): {
+        ThrowTypeError(kReduceNoInitial, kBuiltinName);
+      }
+      case (accumulator: JSAny): {
+        return accumulator;
+      }
     }
-    return accumulator;
   }
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.reduceright
   transitioning javascript builtin
-  TypedArrayPrototypeReduceRight(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+  TypedArrayPrototypeReduceRight(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = initialValue.
     try {

src/builtins/typed-array-slice.tq

@@ -53,7 +53,7 @@ namespace typed_array_slice {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.slice
   transitioning javascript builtin TypedArrayPrototypeSlice(
-      js-implicit context: Context, receiver: Object)(...arguments): Object {
+      js-implicit context: Context, receiver: JSAny)(...arguments): JSAny {
     // arguments[0] = start
     // arguments[1] = end
 

src/builtins/typed-array-some.tq

@@ -9,7 +9,7 @@ namespace typed_array_some {
 
   transitioning macro SomeAllElements(implicit context: Context)(
       array: typed_array::AttachedJSTypedArray, callbackfn: Callable,
-      thisArg: Object): Boolean {
+      thisArg: JSAny): Boolean {
     let witness = typed_array::NewAttachedJSTypedArrayWitness(array);
     // TODO(v8:4153): Support huge TypedArrays here.
     const length =
@@ -17,7 +17,7 @@ namespace typed_array_some {
     for (let k: Smi = 0; k < length; k++) {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
-      const value: Object = witness.Load(k);
+      const value: JSAny = witness.Load(k);
       const result =
           Call(context, callbackfn, thisArg, value, k, witness.GetStable());
       if (ToBoolean(result)) {
@@ -29,8 +29,8 @@ namespace typed_array_some {
 
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.some
   transitioning javascript builtin
-  TypedArrayPrototypeSome(js-implicit context: Context, receiver: Object)(
-      ...arguments): Object {
+  TypedArrayPrototypeSome(js-implicit context: Context, receiver: JSAny)(
+      ...arguments): JSAny {
     // arguments[0] = callback
     // arguments[1] = thisArg.
     try {

src/builtins/typed-array-subarray.tq

@@ -6,7 +6,7 @@ namespace typed_array_subarray {
   // ES %TypedArray%.prototype.subarray
   transitioning javascript builtin TypedArrayPrototypeSubArray(
       js-implicit context: Context,
-      receiver: Object)(...arguments): JSTypedArray {
+      receiver: JSAny)(...arguments): JSTypedArray {
     const methodName: constexpr string = '%TypedArray%.prototype.subarray';
 
     // 1. Let O be the this value.

src/builtins/typed-array.tq

@@ -51,9 +51,9 @@ namespace typed_array {
     sizeLog2: uintptr;
     kind: ElementsKind;
   }
-  extern runtime TypedArraySortFast(Context, Object): JSTypedArray;
+  extern runtime TypedArraySortFast(Context, JSAny): JSTypedArray;
   extern macro TypedArrayBuiltinsAssembler::ValidateTypedArray(
-      Context, Object, constexpr string): JSTypedArray;
+      Context, JSAny, constexpr string): JSTypedArray;
 
   extern macro TypedArrayBuiltinsAssembler::CallCMemcpy(
       RawPtr, RawPtr, uintptr): void;
@@ -72,10 +72,10 @@ namespace typed_array {
   extern macro LoadFixedTypedArrayElementAsTagged(
       RawPtr, Smi, constexpr ElementsKind): Numeric;
   extern macro StoreJSTypedArrayElementFromTagged(
-      Context, JSTypedArray, Smi, Object, constexpr ElementsKind);
+      Context, JSTypedArray, Smi, JSAny, constexpr ElementsKind);
 
-  type LoadFn = builtin(Context, JSTypedArray, Smi) => Object;
-  type StoreFn = builtin(Context, JSTypedArray, Smi, Object) => Object;
+  type LoadFn = builtin(Context, JSTypedArray, Smi) => JSAny;
+  type StoreFn = builtin(Context, JSTypedArray, Smi, JSAny) => JSAny;
 
   // AttachedJSTypedArray guards that the array's buffer is not detached.
   transient type AttachedJSTypedArray extends JSTypedArray;
@@ -100,7 +100,7 @@ namespace typed_array {
       this.unstable = %RawDownCast<AttachedJSTypedArray>(this.stable);
     }
 
-    Load(implicit context: Context)(k: Smi): Object {
+    Load(implicit context: Context)(k: Smi): JSAny {
       const lf: LoadFn = this.loadfn;
       return lf(context, this.unstable, k);
     }
@@ -190,14 +190,14 @@ namespace typed_array {
   }
 
   builtin LoadFixedElement<T: type>(
-      _context: Context, array: JSTypedArray, index: Smi): Object {
+      _context: Context, array: JSTypedArray, index: Smi): JSAny {
     return LoadFixedTypedArrayElementAsTagged(
         array.data_ptr, index, KindForArrayType<T>());
   }
 
   builtin StoreFixedElement<T: type>(
       context: Context, typedArray: JSTypedArray, index: Smi,
-      value: Object): Object {
+      value: JSAny): JSAny {
     StoreJSTypedArrayElementFromTagged(
         context, typedArray, index, value, KindForArrayType<T>());
     return Undefined;
@@ -205,7 +205,7 @@ namespace typed_array {
 
   transitioning macro CallCompare(
       implicit context: Context, array: JSTypedArray,
-      comparefn: Callable)(a: Object, b: Object): Number {
+      comparefn: Callable)(a: JSAny, b: JSAny): Number {
     // a. Let v be ? ToNumber(? Call(comparefn, undefined, x, y)).
     const v: Number =
         ToNumber_Inline(context, Call(context, comparefn, Undefined, a, b));
@@ -238,8 +238,8 @@ namespace typed_array {
         target.objects[targetIndex] = source.objects[left++];
       } else if (left < middle) {
         // If both have elements, we need to compare.
-        const leftElement: Object = source.objects[left];
-        const rightElement: Object = source.objects[right];
+        const leftElement = UnsafeCast<JSAny>(source.objects[left]);
+        const rightElement = UnsafeCast<JSAny>(source.objects[right]);
         if (CallCompare(leftElement, rightElement) <= 0) {
           target.objects[targetIndex] = leftElement;
           left++;
@@ -259,7 +259,7 @@ namespace typed_array {
   transitioning builtin
   TypedArrayMergeSort(
       implicit context: Context, array: JSTypedArray, comparefn: Callable)(
-      source: FixedArray, from: Smi, to: Smi, target: FixedArray): Object {
+      source: FixedArray, from: Smi, to: Smi, target: FixedArray): JSAny {
     assert(to - from > 1);
     const middle: Smi = from + ((to - from) >> 1);
 
@@ -277,17 +277,16 @@ namespace typed_array {
   // https://tc39.github.io/ecma262/#sec-%typedarray%.prototype.sort
   transitioning javascript builtin TypedArrayPrototypeSort(
       js-implicit context: Context,
-      receiver: Object)(...arguments): JSTypedArray {
+      receiver: JSAny)(...arguments): JSTypedArray {
     // 1. If comparefn is not undefined and IsCallable(comparefn) is false,
     //    throw a TypeError exception.
-    const comparefnObj: Object =
-        arguments.length > 0 ? arguments[0] : Undefined;
+    const comparefnObj: JSAny = arguments.length > 0 ? arguments[0] : Undefined;
     if (comparefnObj != Undefined && !TaggedIsCallable(comparefnObj)) {
       ThrowTypeError(kBadSortComparisonFunction, comparefnObj);
     }
 
     // 2. Let obj be the this value.
-    const obj: Object = receiver;
+    const obj: JSAny = receiver;
 
     // 3. Let buffer be ? ValidateTypedArray(obj).
     //    ValidateTypedArray currently returns the array, not the ViewBuffer.
@@ -363,7 +362,7 @@ namespace typed_array {
     const work2: FixedArray = AllocateZeroedFixedArray(Convert<intptr>(len));
 
     for (let i: Smi = 0; i < len; ++i) {
-      const element: Object = loadfn(context, array, i);
+      const element: JSAny = loadfn(context, array, i);
       work1.objects[i] = element;
       work2.objects[i] = element;
     }
@@ -372,7 +371,7 @@ namespace typed_array {
 
     // work1 contains the sorted numbers. Write them back.
     for (let i: Smi = 0; i < len; ++i)
-      storefn(context, array, i, work1.objects[i]);
+      storefn(context, array, i, UnsafeCast<JSAny>(work1.objects[i]));
 
     return array;
   }

src/objects/objects-inl.h

@@ -133,6 +133,13 @@ bool Object::IsNullOrUndefined() const {
 
 bool Object::IsZero() const { return *this == Smi::zero(); }
 
+bool Object::IsPublicSymbol() const {
+  return IsSymbol() && !Symbol::cast(*this).is_private();
+}
+bool Object::IsPrivateSymbol() const {
+  return IsSymbol() && Symbol::cast(*this).is_private();
+}
+
 bool Object::IsNoSharedNameSentinel() const {
   return *this == SharedFunctionInfo::kNoSharedNameSentinel;
 }

src/objects/objects.h

@@ -289,6 +289,8 @@ class Object : public TaggedImpl<HeapObjectReferenceType::STRONG, Address> {
 
   V8_INLINE bool IsZero() const;
   V8_INLINE bool IsNoSharedNameSentinel() const;
+  V8_INLINE bool IsPrivateSymbol() const;
+  V8_INLINE bool IsPublicSymbol() const;
 
   enum class Conversion { kToNumber, kToNumeric };
 

src/torque/constants.h

@@ -28,6 +28,7 @@ static const char* const JS_FUNCTION_TYPE_STRING = "JSFunction";
 static const char* const MAP_TYPE_STRING = "Map";
 static const char* const OBJECT_TYPE_STRING = "Object";
 static const char* const HEAP_OBJECT_TYPE_STRING = "HeapObject";
+static const char* const JSANY_TYPE_STRING = "JSAny";
 static const char* const JSOBJECT_TYPE_STRING = "JSObject";
 static const char* const SMI_TYPE_STRING = "Smi";
 static const char* const TAGGED_TYPE_STRING = "Tagged";

src/torque/declaration-visitor.cc

@@ -69,6 +69,21 @@ Builtin* DeclarationVisitor::CreateBuiltin(BuiltinDeclaration* decl,
           " to be a JavaScript builtin");
   }
 
+  if (javascript) {
+    if (!signature.return_type->IsSubtypeOf(TypeOracle::GetJSAnyType())) {
+      Error("Return type of JavaScript-linkage builtins has to be JSAny.")
+          .Position(decl->return_type->pos);
+    }
+    for (size_t i = signature.implicit_count;
+         i < signature.parameter_types.types.size(); ++i) {
+      const Type* parameter_type = signature.parameter_types.types[i];
+      if (parameter_type != TypeOracle::GetJSAnyType()) {
+        Error("Parameters of JavaScript-linkage builtins have to be JSAny.")
+            .Position(decl->parameters.types[i]->pos);
+      }
+    }
+  }
+
   for (size_t i = 0; i < signature.types().size(); ++i) {
     if (const StructType* type =
             StructType::DynamicCast(signature.types()[i])) {

src/torque/implementation-visitor.cc

@@ -468,13 +468,13 @@ void ImplementationVisitor::Visit(Builtin* builtin) {
                     : "UncheckedCast<Object>(Parameter(Descriptor::kReceiver))")
             << ";\n";
         source_out() << "USE(" << generated_name << ");\n";
-        expected_type = TypeOracle::GetObjectType();
+        expected_type = TypeOracle::GetJSAnyType();
       } else if (param_name == "newTarget") {
         source_out() << "  TNode<Object> " << generated_name
                      << " = UncheckedCast<Object>(Parameter("
                      << "Descriptor::kJSNewTarget));\n";
         source_out() << "USE(" << generated_name << ");\n";
-        expected_type = TypeOracle::GetObjectType();
+        expected_type = TypeOracle::GetJSAnyType();
       } else if (param_name == "target") {
         source_out() << "  TNode<JSFunction> " << generated_name
                      << " = UncheckedCast<JSFunction>(Parameter("
@@ -2264,9 +2264,10 @@ VisitResult ImplementationVisitor::GenerateCall(
         size_t j = 0;
         for (auto t : callable->signature().labels[i].types) {
           const Type* parameter_type = label->parameter_types[j];
-          if (parameter_type != t) {
-            ReportError("mismatch of label parameters (expected ", *t, " got ",
-                        parameter_type, " for parameter ", i + 1, ")");
+          if (!t->IsSubtypeOf(parameter_type)) {
+            ReportError("mismatch of label parameters (label expects ",
+                        *parameter_type, " but macro produces ", *t,
+                        " for parameter ", i + 1, ")");
           }
           j++;
         }

src/torque/instructions.cc

@@ -133,7 +133,7 @@ void CallCsaMacroInstruction::TypeInstruction(Stack<const Type*>* stack,
 
   if (catch_block) {
     Stack<const Type*> catch_stack = *stack;
-    catch_stack.Push(TypeOracle::GetObjectType());
+    catch_stack.Push(TypeOracle::GetJSAnyType());
     (*catch_block)->SetInputTypes(catch_stack);
   }
 
@@ -170,7 +170,7 @@ void CallCsaMacroAndBranchInstruction::TypeInstruction(
 
   if (catch_block) {
     Stack<const Type*> catch_stack = *stack;
-    catch_stack.Push(TypeOracle::GetObjectType());
+    catch_stack.Push(TypeOracle::GetJSAnyType());
     (*catch_block)->SetInputTypes(catch_stack);
   }
 
@@ -201,7 +201,7 @@ void CallBuiltinInstruction::TypeInstruction(Stack<const Type*>* stack,
 
   if (catch_block) {
     Stack<const Type*> catch_stack = *stack;
-    catch_stack.Push(TypeOracle::GetObjectType());
+    catch_stack.Push(TypeOracle::GetJSAnyType());
     (*catch_block)->SetInputTypes(catch_stack);
   }
 
@@ -236,7 +236,7 @@ void CallRuntimeInstruction::TypeInstruction(Stack<const Type*>* stack,
 
   if (catch_block) {
     Stack<const Type*> catch_stack = *stack;
-    catch_stack.Push(TypeOracle::GetObjectType());
+    catch_stack.Push(TypeOracle::GetJSAnyType());
     (*catch_block)->SetInputTypes(catch_stack);
   }
 

src/torque/torque-parser.cc

@@ -1165,7 +1165,7 @@ base::Optional<ParseResult> MakeCatchBlock(ParseResultIterator* child_results) {
   ParameterList parameters;
   parameters.names.push_back(MakeNode<Identifier>(variable));
   parameters.types.push_back(MakeNode<BasicTypeExpression>(
-      std::vector<std::string>{}, "Object", std::vector<TypeExpression*>{}));
+      std::vector<std::string>{}, "JSAny", std::vector<TypeExpression*>{}));
   parameters.has_varargs = false;
   LabelBlock* result = MakeNode<LabelBlock>(
       MakeNode<Identifier>(kCatchLabelName), std::move(parameters), body);

src/torque/type-oracle.h

@@ -144,6 +144,10 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return Get().GetBuiltinType(HEAP_OBJECT_TYPE_STRING);
   }
 
+  static const Type* GetJSAnyType() {
+    return Get().GetBuiltinType(JSANY_TYPE_STRING);
+  }
+
   static const Type* GetJSObjectType() {
     return Get().GetBuiltinType(JSOBJECT_TYPE_STRING);
   }

test/torque/test-torque.tq

@@ -83,11 +83,11 @@ namespace test {
     }
   }
 
-  builtin GenericBuiltinTest<T: type>(_c: Context, _param: T): Object {
+  builtin GenericBuiltinTest<T: type>(_c: Context, _param: T): JSAny {
     return Null;
   }
 
-  GenericBuiltinTest<Object>(_c: Context, param: Object): Object {
+  GenericBuiltinTest<JSAny>(_c: Context, param: JSAny): JSAny {
     return param;
   }
 
@@ -95,8 +95,8 @@ namespace test {
   macro TestBuiltinSpecialization(c: Context) {
     check(GenericBuiltinTest<Smi>(c, 0) == Null);
     check(GenericBuiltinTest<Smi>(c, 1) == Null);
-    check(GenericBuiltinTest<Object>(c, Undefined) == Undefined);
-    check(GenericBuiltinTest<Object>(c, Undefined) == Undefined);
+    check(GenericBuiltinTest<JSAny>(c, Undefined) == Undefined);
+    check(GenericBuiltinTest<JSAny>(c, Undefined) == Undefined);
   }
 
   macro LabelTestHelper4(flag: constexpr bool): never
@@ -202,9 +202,8 @@ namespace test {
 
   @export
   macro TestFunctionPointerToGeneric(c: Context) {
-    const fptr1: builtin(Context, Smi) => Object = GenericBuiltinTest<Smi>;
-    const fptr2: builtin(Context, Object) => Object =
-        GenericBuiltinTest<Object>;
+    const fptr1: builtin(Context, Smi) => JSAny = GenericBuiltinTest<Smi>;
+    const fptr2: builtin(Context, JSAny) => JSAny = GenericBuiltinTest<JSAny>;
 
     check(fptr1(c, 0) == Null);
     check(fptr1(c, 1) == Null);
@@ -212,7 +211,7 @@ namespace test {
     check(fptr2(c, Undefined) == Undefined);
   }
 
-  type ObjectToObject = builtin(Context, Object) => Object;
+  type ObjectToObject = builtin(Context, JSAny) => JSAny;
   @export
   macro TestTypeAlias(x: ObjectToObject): BuiltinPtr {
     return x;
@@ -452,7 +451,7 @@ namespace test {
 
   @export
   macro TestSubtyping(x: Smi) {
-    const _foo: Object = x;
+    const _foo: JSAny = x;
   }
 
   macro IncrementIfSmi<A: type>(x: A): A {
@@ -627,7 +626,7 @@ namespace test {
   @export
   macro TestQualifiedAccess(implicit context: Context)() {
     const s: Smi = 0;
-    check(!array::IsJSArray(s));
+    check(!Is<JSArray>(s));
   }
 
   @export
@@ -685,14 +684,14 @@ namespace test {
   @export
   macro TestIterator(implicit context: Context)(o: JSReceiver, map: Map) {
     try {
-      const t1: Object = iterator::GetIteratorMethod(o);
+      const t1: JSAny = iterator::GetIteratorMethod(o);
       const t2: iterator::IteratorRecord = iterator::GetIterator(o);
 
-      const _t3: Object = iterator::IteratorStep(t2) otherwise Fail;
-      const _t4: Object = iterator::IteratorStep(t2, map) otherwise Fail;
+      const _t3: JSAny = iterator::IteratorStep(t2) otherwise Fail;
+      const _t4: JSAny = iterator::IteratorStep(t2, map) otherwise Fail;
 
-      const t5: Object = iterator::IteratorValue(o);
-      const _t6: Object = iterator::IteratorValue(o, map);
+      const t5: JSAny = iterator::IteratorValue(o);
+      const _t6: JSAny = iterator::IteratorValue(o, map);
 
       const _t7: JSArray = iterator::IterableToList(t1, t1);
 

tools/torque/format-torque.py

@@ -20,18 +20,9 @@ kPercentEscape = r'α';  # Unicode alpha
 def preprocess(input):
   input = re.sub(r'(if\s+)constexpr(\s*\()', r'\1/*COxp*/\2', input)
   input = re.sub(r'(\s+)operator\s*(\'[^\']+\')', r'\1/*_OPE \2*/', input)
-
-  # Mangle typeswitches to look like switch statements with the extra type
-  # information and syntax encoded in comments.
-  input = re.sub(r'(\s+)typeswitch\s*\(', r'\1/*_TYPE*/switch (', input)
-  input = re.sub(r'(\s+)case\s*\(\s*([^\:]+)\s*\)(\s*)\:\s*deferred',
-      r'\1case \2: /*_TSXDEFERRED_*/', input)
-  input = re.sub(r'(\s+)case\s*\(\s*([^\:]+)\s*\)(\s*)\:',
-      r'\1case \2: /*_TSX*/', input)
-  input = re.sub(r'(\s+)case\s*\(\s*([^\s]+)\s*\:\s*([^\:]+)\s*\)(\s*)\:\s*deferred',
-      r'\1case \3: /*_TSVDEFERRED_\2:*/', input)
-  input = re.sub(r'(\s+)case\s*\(\s*([^\s]+)\s*\:\s*([^\:]+)\s*\)(\s*)\:',
-      r'\1case \3: /*_TSV\2:*/', input)
+  input = re.sub(r'\btypeswitch\s*(\([^{]*\))\s{', r' if /*tPsW*/ \1 {', input)
+  input = re.sub(r'\bcase\s*(\([^{]*\))\s*:\s*deferred\s*{', r' if /*cAsEdEfF*/ \1 {', input)
+  input = re.sub(r'\bcase\s*(\([^{]*\))\s*:\s*{', r' if /*cA*/ \1 {', input)
 
   # Add extra space around | operators to fix union types later.
   while True:
@@ -65,15 +56,9 @@ def postprocess(output):
   output = re.sub(r'(\S+)\s*: type([,>])', r'\1: type\2', output)
   output = re.sub(r'(\n\s*)labels( [A-Z])', r'\1    labels\2', output)
   output = re.sub(r'\/\*_OPE \'([^\']+)\'\*\/', r"operator '\1'", output)
-  output = re.sub(r'\/\*_TYPE\*\/(\s*)switch', r'typeswitch', output)
-  output = re.sub(r'case (\w+)\:\s*\/\*_TSXDEFERRED_\*\/',
-      r'case (\1): deferred', output)
-  output = re.sub(r'case (\w+)\:\s*\/\*_TSX\*\/',
-      r'case (\1):', output)
-  output = re.sub(r'case (\w+)\:\s*\/\*_TSVDEFERRED_([^\:]+)\:\*\/',
-      r'case (\2: \1): deferred', output)
-  output = re.sub(r'case (\w+)\:\s*\/\*_TSV([^\:]+)\:\*\/',
-      r'case (\2: \1):', output)
+  output = re.sub(r'\bif\s*\/\*tPsW\*\/', r'typeswitch', output)
+  output = re.sub(r'\bif\s*\/\*cA\*\/\s*(\([^{]*\))\s*{', r'case \1: {', output)
+  output = re.sub(r'\bif\s*\/\*cAsEdEfF\*\/\s*(\([^{]*\))\s*{', r'case \1: deferred {', output)
   output = re.sub(r'\n_GeNeRaTeS00_\s*\/\*([^@]+)@\*\/',
       r"\n    generates '\1'", output)
   output = re.sub(r'_GeNeRaTeS00_\s*\/\*([^@]+)@\*\/',