[torque] Remove some uses of @noVerifier

Implemented verifiers for the following classes:
- ExternalString
- FixedArrayBase
- JSCollection
- JSCollectionIterator
- JSWeakCollection
- Name
- SeqString
- Struct

Removed the following class definitions from Torque, because they're
just JSObject instances with particular starting maps, as discussed in
https://crrev.com/c/v8/v8/+/1619146/6/src/builtins/base.tq#459 :
- JSAccessorPropertyDescriptor
- JSDataPropertyDescriptor
- JSIteratorResult

Following similar logic, removed the Torque definition of
WasmExceptionPackage because it's just an error object that happens to
have a couple of private-symbol properties.

The following classes should not be defined in Torque because they're
just a starting state for JSObject, but I'm leaving them for now because
existing Torque code requires them:
- JSArgumentsObjectWithLength
- JSProxyRevocableResult

Bug: v8:9311
Change-Id: I0336b6be7d02e48e4a8a0f660e24d2c2fa5f5e34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1637448
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61970}

src/builtins/base.tq

@@ -90,7 +90,6 @@ type BigInt extends HeapObject generates 'TNode<BigInt>';
 type Numeric = Number | BigInt;
 
 @abstract
-@noVerifier
 extern class Name extends HeapObject {
   hash_field: int32;
 }
@@ -111,7 +110,6 @@ extern class ConsString extends String {
 }
 
 @abstract
-@noVerifier
 extern class ExternalString extends String {
   resource: RawPtr;
   resource_data: RawPtr;
@@ -124,7 +122,6 @@ extern class InternalizedString extends String {}
 
 // TODO(v8:8983): Add declaration for variable-sized region.
 @abstract
-@noVerifier
 extern class SeqString extends String {
 }
 extern class SeqOneByteString extends SeqString {}
@@ -141,7 +138,6 @@ extern class ThinString extends String { actual: String; }
 type NaN extends HeapNumber;
 
 @abstract
-@noVerifier
 @generatePrint
 @generateCppClass
 extern class Struct extends HeapObject {
@@ -171,7 +167,6 @@ type DirectString extends String;
 type RootIndex generates 'TNode<Int32T>' constexpr 'RootIndex';
 
 @abstract
-@noVerifier
 @generateCppClass
 extern class FixedArrayBase extends HeapObject {
   length: Smi;
@@ -341,6 +336,7 @@ extern class JSProxy extends JSReceiver {
   handler: Object;
 }
 
+// Just a starting shape for JSObject; properties can move after initialization.
 @noVerifier
 extern class JSProxyRevocableResult extends JSObject {
   proxy: Object;
@@ -363,11 +359,15 @@ extern class JSGlobalProxy extends JSObject { native_context: Object; }
 extern class JSValue extends JSObject { value: Object; }
 
 extern class JSArgumentsObject extends JSObject {}
+
+// Just a starting shape for JSObject; properties can move after initialization.
 @noVerifier
 @hasSameInstanceTypeAsParent
 extern class JSArgumentsObjectWithLength extends JSArgumentsObject {
   length: Object;
 }
+
+// Just a starting shape for JSObject; properties can move after initialization.
 @hasSameInstanceTypeAsParent
 extern class JSSloppyArgumentsObject extends JSArgumentsObjectWithLength {
   callee: Object;
@@ -451,14 +451,12 @@ extern class CallHandlerInfo extends Struct {
 type JSModuleNamespace extends JSObject;
 
 @abstract
-@noVerifier
 extern class JSWeakCollection extends JSObject {
   table: Object;
 }
 extern class JSWeakSet extends JSWeakCollection {}
 extern class JSWeakMap extends JSWeakCollection {}
 
-@noVerifier
 extern class JSCollectionIterator extends JSObject {
   table: Object;
   index: Object;
@@ -651,16 +649,7 @@ extern class JSTypedArray extends JSArrayBufferView {
   base_pointer: ByteArray | Smi;
 }
 
-@noVerifier
-extern class JSAccessorPropertyDescriptor extends JSObject {
-  get: Object;
-  set: Object;
-  enumerable: Object;
-  configurable: Object;
-}
-
 @abstract
-@noVerifier
 extern class JSCollection extends JSObject {
   table: Object;
 }
@@ -694,14 +683,6 @@ extern class JSStringIterator extends JSObject {
   next_index: Smi;
 }
 
-@noVerifier
-extern class JSDataPropertyDescriptor extends JSObject {
-  value: Object;
-  writable: Object;
-  enumerable: Object;
-  configurable: Object;
-}
-
 @abstract
 extern class TemplateInfo extends Struct {
   tag: Object;
@@ -1173,22 +1154,8 @@ extern class JSRegExp extends JSObject {
   flags: Smi | Undefined;
 }
 
-@noVerifier
-extern class JSIteratorResult extends JSObject {
-  value: Object;
-  done: Boolean;
-}
-
-macro NewJSIteratorResult(implicit context: Context)(
-    value: Object, done: Boolean): JSIteratorResult {
-  return new JSIteratorResult{
-    map: GetIteratorResultMap(),
-    properties_or_hash: kEmptyFixedArray,
-    elements: kEmptyFixedArray,
-    value,
-    done
-  };
-}
+extern transitioning macro AllocateJSIteratorResult(implicit context: Context)(
+    Object, Boolean): JSObject;
 
 // Note: Although a condition for a FastJSRegExp is having a positive smi
 // lastIndex (see RegExpBuiltinsAssembler::BranchIfFastRegExp), it is possible
@@ -1332,10 +1299,6 @@ extern class WasmExceptionObject extends JSObject {
   exception_tag: HeapObject;
 }
 
-@noVerifier
-extern class WasmExceptionPackage extends JSReceiver {
-}
-
 type WasmExportedFunction extends JSFunction;
 
 extern class AsmWasmData extends Struct {

src/builtins/string-iterator.tq

@@ -26,7 +26,7 @@ namespace string_iterator {
 
   // ES6 #sec-%stringiteratorprototype%.next
   transitioning javascript builtin StringIteratorPrototypeNext(
-      implicit context: Context)(receiver: Object): JSIteratorResult {
+      implicit context: Context)(receiver: Object): JSObject {
     const iterator = Cast<JSStringIterator>(receiver) otherwise ThrowTypeError(
         kIncompatibleMethodReceiver, 'String Iterator.prototype.next',
         receiver);
@@ -34,13 +34,13 @@ namespace string_iterator {
     const position: intptr = SmiUntag(iterator.next_index);
     const length: intptr = string.length_intptr;
     if (position >= length) {
-      return NewJSIteratorResult(Undefined, True);
+      return AllocateJSIteratorResult(Undefined, True);
     }
     // Move to next codepoint.
     const encoding = UTF16;
     const ch = string::LoadSurrogatePairAt(string, length, position, encoding);
     const value: String = string::StringFromSingleCodePoint(ch, encoding);
     iterator.next_index = SmiTag(position + value.length_intptr);
-    return NewJSIteratorResult(value, False);
+    return AllocateJSIteratorResult(value, False);
   }
 }

src/diagnostics/objects-debug.cc

@@ -153,6 +153,10 @@ void HeapObject::HeapObjectVerify(Isolate* isolate) {
       SlicedString::cast(*this).SlicedStringVerify(isolate);
     } else if (IsThinString()) {
       ThinString::cast(*this).ThinStringVerify(isolate);
+    } else if (IsSeqString()) {
+      SeqString::cast(*this).SeqStringVerify(isolate);
+    } else if (IsExternalString()) {
+      ExternalString::cast(*this).ExternalStringVerify(isolate);
     } else {
       String::cast(*this).StringVerify(isolate);
     }
@@ -703,6 +707,10 @@ void EmbedderDataArray::EmbedderDataArrayVerify(Isolate* isolate) {
   }
 }
 
+USE_TORQUE_VERIFIER(Struct)
+
+USE_TORQUE_VERIFIER(FixedArrayBase)
+
 USE_TORQUE_VERIFIER(FixedArray)
 
 void WeakFixedArray::WeakFixedArrayVerify(Isolate* isolate) {
@@ -954,6 +962,8 @@ void JSMessageObject::JSMessageObjectVerify(Isolate* isolate) {
   VerifySmiField(kErrorLevelOffset);
 }
 
+USE_TORQUE_VERIFIER(Name)
+
 void String::StringVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::StringVerify(*this, isolate);
   CHECK(length() >= 0 && length() <= Smi::kMaxValue);
@@ -988,6 +998,10 @@ void SlicedString::SlicedStringVerify(Isolate* isolate) {
   CHECK_GE(this->length(), SlicedString::kMinLength);
 }
 
+USE_TORQUE_VERIFIER(SeqString)
+
+USE_TORQUE_VERIFIER(ExternalString)
+
 void JSBoundFunction::JSBoundFunctionVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::JSBoundFunctionVerify(*this, isolate);
   CHECK(IsCallable());
@@ -1212,32 +1226,32 @@ void JSArray::JSArrayVerify(Isolate* isolate) {
   }
 }
 
+USE_TORQUE_VERIFIER(JSCollection)
+
 void JSSet::JSSetVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::JSSetVerify(*this, isolate);
-  VerifyHeapPointer(isolate, table());
   CHECK(table().IsOrderedHashSet() || table().IsUndefined(isolate));
   // TODO(arv): Verify OrderedHashTable too.
 }
 
 void JSMap::JSMapVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::JSMapVerify(*this, isolate);
-  VerifyHeapPointer(isolate, table());
   CHECK(table().IsOrderedHashMap() || table().IsUndefined(isolate));
   // TODO(arv): Verify OrderedHashTable too.
 }
 
+USE_TORQUE_VERIFIER(JSCollectionIterator)
+
 void JSSetIterator::JSSetIteratorVerify(Isolate* isolate) {
   CHECK(IsJSSetIterator());
-  JSObjectVerify(isolate);
-  VerifyHeapPointer(isolate, table());
+  JSCollectionIteratorVerify(isolate);
   CHECK(table().IsOrderedHashSet());
   CHECK(index().IsSmi());
 }
 
 void JSMapIterator::JSMapIteratorVerify(Isolate* isolate) {
   CHECK(IsJSMapIterator());
-  JSObjectVerify(isolate);
-  VerifyHeapPointer(isolate, table());
+  JSCollectionIteratorVerify(isolate);
   CHECK(table().IsOrderedHashMap());
   CHECK(index().IsSmi());
 }
@@ -1312,7 +1326,6 @@ void FinalizationGroupCleanupJobTask::FinalizationGroupCleanupJobTaskVerify(
 
 void JSWeakMap::JSWeakMapVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::JSWeakMapVerify(*this, isolate);
-  VerifyHeapPointer(isolate, table());
   CHECK(table().IsEphemeronHashTable() || table().IsUndefined(isolate));
 }
 
@@ -1343,9 +1356,10 @@ void JSStringIterator::JSStringIteratorVerify(Isolate* isolate) {
 
 USE_TORQUE_VERIFIER(JSAsyncFromSyncIterator)
 
+USE_TORQUE_VERIFIER(JSWeakCollection)
+
 void JSWeakSet::JSWeakSetVerify(Isolate* isolate) {
   TorqueGeneratedClassVerifiers::JSWeakSetVerify(*this, isolate);
-  VerifyHeapPointer(isolate, table());
   CHECK(table().IsEphemeronHashTable() || table().IsUndefined(isolate));
 }
 

src/objects/fixed-array.h

@@ -82,6 +82,7 @@ class FixedArrayBase : public HeapObject {
   inline Object unchecked_synchronized_length() const;
 
   DECL_CAST(FixedArrayBase)
+  DECL_VERIFIER(FixedArrayBase)
 
   static int GetMaxLengthForNewSpaceAllocation(ElementsKind kind);
 

src/objects/js-collection-iterator.h

@@ -25,6 +25,7 @@ class JSCollectionIterator : public JSObject {
   DECL_ACCESSORS(index, Object)
 
   void JSCollectionIteratorPrint(std::ostream& os, const char* name);
+  DECL_VERIFIER(JSCollectionIterator)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
                                 TORQUE_GENERATED_JSCOLLECTION_ITERATOR_FIELDS)

src/objects/js-collection.h

@@ -30,6 +30,8 @@ class JSCollection : public JSObject {
 
   static const int kAddFunctionDescriptorIndex = 3;
 
+  DECL_VERIFIER(JSCollection)
+
   OBJECT_CONSTRUCTORS(JSCollection, JSObject);
 };
 
@@ -114,6 +116,8 @@ class JSWeakCollection : public JSObject {
   static Handle<JSArray> GetEntries(Handle<JSWeakCollection> holder,
                                     int max_entries);
 
+  DECL_VERIFIER(JSWeakCollection)
+
   DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
                                 TORQUE_GENERATED_JSWEAK_COLLECTION_FIELDS)
 

src/objects/js-objects.h

@@ -835,9 +835,17 @@ class JSObject : public JSReceiver {
 class JSAccessorPropertyDescriptor : public JSObject {
  public:
   // Layout description.
-  DEFINE_FIELD_OFFSET_CONSTANTS(
-      JSObject::kHeaderSize,
-      TORQUE_GENERATED_JSACCESSOR_PROPERTY_DESCRIPTOR_FIELDS)
+#define JS_ACCESSOR_PROPERTY_DESCRIPTOR_FIELDS(V) \
+  V(kGetOffset, kTaggedSize)                      \
+  V(kSetOffset, kTaggedSize)                      \
+  V(kEnumerableOffset, kTaggedSize)               \
+  V(kConfigurableOffset, kTaggedSize)             \
+  /* Total size. */                               \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
+                                JS_ACCESSOR_PROPERTY_DESCRIPTOR_FIELDS)
+#undef JS_ACCESSOR_PROPERTY_DESCRIPTOR_FIELDS
 
   // Indices of in-object properties.
   static const int kGetIndex = 0;
@@ -855,8 +863,18 @@ class JSAccessorPropertyDescriptor : public JSObject {
 // FromPropertyDescriptor function for regular data properties.
 class JSDataPropertyDescriptor : public JSObject {
  public:
-  DEFINE_FIELD_OFFSET_CONSTANTS(
-      JSObject::kHeaderSize, TORQUE_GENERATED_JSDATA_PROPERTY_DESCRIPTOR_FIELDS)
+  // Layout description.
+#define JS_DATA_PROPERTY_DESCRIPTOR_FIELDS(V) \
+  V(kValueOffset, kTaggedSize)                \
+  V(kWritableOffset, kTaggedSize)             \
+  V(kEnumerableOffset, kTaggedSize)           \
+  V(kConfigurableOffset, kTaggedSize)         \
+  /* Total size. */                           \
+  V(kSize, 0)
+
+  DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
+                                JS_DATA_PROPERTY_DESCRIPTOR_FIELDS)
+#undef JS_DATA_PROPERTY_DESCRIPTOR_FIELDS
 
   // Indices of in-object properties.
   static const int kValueIndex = 0;
@@ -870,7 +888,7 @@ class JSDataPropertyDescriptor : public JSObject {
 
 // JSIteratorResult is just a JSObject with a specific initial map.
 // This initial map adds in-object properties for "done" and "value",
-// as specified by ES6 section 25.1.1.3 The IteratorResult Interface
+// as specified by ES6 section 25.1.1.3 The IteratorResult Interface.
 class JSIteratorResult : public JSObject {
  public:
   DECL_ACCESSORS(value, Object)
@@ -878,8 +896,15 @@ class JSIteratorResult : public JSObject {
   DECL_ACCESSORS(done, Object)
 
   // Layout description.
+#define JS_ITERATOR_RESULT_FIELDS(V) \
+  V(kValueOffset, kTaggedSize)       \
+  V(kDoneOffset, kTaggedSize)        \
+  /* Total size. */                  \
+  V(kSize, 0)
+
   DEFINE_FIELD_OFFSET_CONSTANTS(JSObject::kHeaderSize,
-                                TORQUE_GENERATED_JSITERATOR_RESULT_FIELDS)
+                                JS_ITERATOR_RESULT_FIELDS)
+#undef JS_ITERATOR_RESULT_FIELDS
 
   // Indices of in-object properties.
   static const int kValueIndex = 0;

src/objects/name.h

@@ -67,6 +67,7 @@ class Name : public HeapObject {
   DECL_PRINTER(Name)
   void NameShortPrint();
   int NameShortPrint(Vector<char> str);
+  DECL_VERIFIER(Name)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(HeapObject::kHeaderSize,
                                 TORQUE_GENERATED_NAME_FIELDS)

src/objects/object-list-macros.h

@@ -134,6 +134,7 @@ class ZoneForwardList;
   V(JSAsyncGeneratorObject)                    \
   V(JSBoundFunction)                           \
   V(JSCollection)                              \
+  V(JSCollectionIterator)                      \
   V(JSContextExtensionObject)                  \
   V(JSDataView)                                \
   V(JSDate)                                    \

src/objects/objects-inl.h

@@ -309,6 +309,10 @@ bool HeapObject::IsJSArrayBufferView() const {
   return IsJSDataView() || IsJSTypedArray();
 }
 
+bool HeapObject::IsJSCollectionIterator() const {
+  return IsJSMapIterator() || IsJSSetIterator();
+}
+
 bool HeapObject::IsStringSet() const { return IsHashTable(); }
 
 bool HeapObject::IsObjectHashSet() const { return IsHashTable(); }

src/objects/string.h

@@ -480,6 +480,7 @@ class SubStringRange {
 class SeqString : public String {
  public:
   DECL_CAST(SeqString)
+  DECL_VERIFIER(SeqString)
 
   // Truncate the string in-place if possible and return the result.
   // In case of new_length == 0, the empty string is returned without
@@ -705,6 +706,7 @@ class SlicedString : public String {
 class ExternalString : public String {
  public:
   DECL_CAST(ExternalString)
+  DECL_VERIFIER(ExternalString)
 
   DEFINE_FIELD_OFFSET_CONSTANTS(String::kHeaderSize,
                                 TORQUE_GENERATED_EXTERNAL_STRING_FIELDS)

src/objects/struct.h

@@ -22,6 +22,7 @@ class Struct : public TorqueGeneratedStruct<Struct, HeapObject> {
  public:
   inline void InitializeBody(int object_size);
   void BriefPrintDetails(std::ostream& os);
+  DECL_VERIFIER(Struct)
 
   TQ_OBJECT_CONSTRUCTORS(Struct)
 };