Reland "[turbofan] extend type asserts to cover all JS types"

This is a reland of 45227ffd
Differences:
- Handle one more flags conflict in variants.py.
- Disallow %VerifyType without --concurrent-recompilation.

Original change's description:
> [turbofan] extend type asserts to cover all JS types
>
> Extend type assertions to all types covering JavaScript values.
> This is achieved by allocating type representations on the heap using
> newly defined HeapObject subclasses. To allocate these in the compiler,
> we disable concurrent compilation for the --assert-types flag for now.
>
> Fix two type errors that came up with the existing tests:
> 1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
>    OtherObject.
> 2. OperationTyper::NumberToString(Type) can type the result as the
>    HeapConstant Factory::zero_string(). However, NumberToString does
>    not always produce this string. To avoid regressions, the CL keeps
>    the HeapConstant type and changes the runtime and builtin code to
>    always produce the canonical "0" string.
>
> A few tests were failing because they check for truncations to work
> and prevent deoptimization. However, AssertType nodes destroy all
> truncations (which is by design), so these tests are incompatible
> and now disabled for the assert_types variant.
>
> Drive-by fix: a few minor Torque issues that came up.
>
> Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77565}

Change-Id: I5b3c6745c6ad349ff8c2b199d9afdf0a9b5a7392
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247035
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77596}

BUILD.bazel

@@ -836,6 +836,7 @@ filegroup(
         "src/objects/template-objects.tq",
         "src/objects/templates.tq",
         "src/objects/torque-defined-classes.tq",
+        "src/objects/turbofan-types.tq",
         "test/torque/test-torque.tq",
         "third_party/v8/builtins/array-sort.tq",
     ] + select({
@@ -1707,6 +1708,8 @@ filegroup(
         "src/objects/transitions-inl.h",
         "src/objects/transitions.cc",
         "src/objects/transitions.h",
+        "src/objects/turbofan-types-inl.h",
+        "src/objects/turbofan-types.h",
         "src/objects/type-hints.cc",
         "src/objects/type-hints.h",
         "src/objects/value-serializer.cc",

BUILD.gn

@@ -1784,6 +1784,7 @@ torque_files = [
   "src/objects/template-objects.tq",
   "src/objects/templates.tq",
   "src/objects/torque-defined-classes.tq",
+  "src/objects/turbofan-types.tq",
   "test/torque/test-torque.tq",
   "third_party/v8/builtins/array-sort.tq",
 ]
@@ -3253,6 +3254,8 @@ v8_header_set("v8_internal_headers") {
     "src/objects/torque-defined-classes.h",
     "src/objects/transitions-inl.h",
     "src/objects/transitions.h",
+    "src/objects/turbofan-types-inl.h",
+    "src/objects/turbofan-types.h",
     "src/objects/type-hints.h",
     "src/objects/value-serializer.h",
     "src/objects/visitors-inl.h",

src/builtins/base.tq

@@ -1168,7 +1168,7 @@ extern macro Int32Constant(constexpr int31): int31;
 extern macro Int32Constant(constexpr int32): int32;
 extern macro Int64Constant(constexpr int64): int64;
 extern macro Uint64Constant(constexpr uint64): uint64;
-extern macro Float64Constant(constexpr int31): float64;
+extern macro Float64Constant(constexpr int32): float64;
 extern macro Float64Constant(constexpr float64): float64;
 extern macro SmiConstant(constexpr int31): Smi;
 extern macro SmiConstant(constexpr Smi): Smi;
@@ -1799,7 +1799,6 @@ macro Float64IsSomeInfinity(value: float64): bool {
   return value == (Convert<float64>(0) - V8_INFINITY);
 }
 
-@export
 macro IsIntegerOrSomeInfinity(o: Object): bool {
   typeswitch (o) {
     case (Smi): {
@@ -1817,20 +1816,6 @@ macro IsIntegerOrSomeInfinity(o: Object): bool {
   }
 }
 
-builtin CheckNumberInRange(implicit context: Context)(
-    value: Number, min: Number, max: Number, nodeId: Smi): Undefined {
-  if (IsIntegerOrSomeInfinity(value) && min <= value && value <= max) {
-    return Undefined;
-  } else {
-    Print('Range type assertion failed! (value/min/max/nodeId)');
-    Print(value);
-    Print(min);
-    Print(max);
-    Print(nodeId);
-    unreachable;
-  }
-}
-
 // Assert that the objects satisfy SameValue or are both the hole.
 builtin CheckSameObject(implicit context: Context)(
     lhs: Object, rhs: Object): Undefined {

src/builtins/convert.tq

@@ -88,6 +88,9 @@ FromConstexpr<uintptr, constexpr int31>(i: constexpr int31): uintptr {
 FromConstexpr<float64, constexpr int31>(i: constexpr int31): float64 {
   return Float64Constant(i);
 }
+FromConstexpr<float64, constexpr int32>(i: constexpr int32): float64 {
+  return Float64Constant(i);
+}
 FromConstexpr<float64, constexpr float64>(i: constexpr float64): float64 {
   return Float64Constant(i);
 }

src/builtins/number.tq

@@ -75,6 +75,9 @@ macro NumberToStringSmi(x: int32, radix: int32): String labels Slow {
   if (!isNegative) {
     // Fast case where the result is a one character string.
     if (x < radix) {
+      if (x == 0) {
+        return ZeroStringConstant();
+      }
       return StringFromSingleCharCode(ToCharCode(n));
     }
   } else {

src/compiler/add-type-assertions-reducer.cc

@@ -20,6 +20,9 @@ AddTypeAssertionsReducer::~AddTypeAssertionsReducer() = default;
 
 Reduction AddTypeAssertionsReducer::Reduce(Node* node) {
   if (node->opcode() == IrOpcode::kAssertType ||
+      node->opcode() == IrOpcode::kAllocate ||
+      node->opcode() == IrOpcode::kObjectState ||
+      node->opcode() == IrOpcode::kObjectId ||
       node->opcode() == IrOpcode::kPhi || !NodeProperties::IsTyped(node) ||
       visited_.Get(node)) {
     return NoChange();

src/compiler/effect-control-linearizer.cc

@@ -30,6 +30,7 @@
 #include "src/objects/heap-number.h"
 #include "src/objects/oddball.h"
 #include "src/objects/ordered-hash-table.h"
+#include "src/objects/turbofan-types.h"
 
 namespace v8 {
 namespace internal {
@@ -6193,10 +6194,17 @@ Node* EffectControlLinearizer::LowerAssertType(Node* node) {
   Type type = OpParameter<Type>(node->op());
   CHECK(type.CanBeAsserted());
   Node* const input = node->InputAt(0);
-  Node* const min = __ NumberConstant(type.Min());
-  Node* const max = __ NumberConstant(type.Max());
-  CallBuiltin(Builtin::kCheckNumberInRange, node->op()->properties(), input,
-              min, max, __ SmiConstant(node->id()));
+  Node* allocated_type;
+  {
+    DCHECK(isolate()->CurrentLocalHeap()->is_main_thread());
+    base::Optional<UnparkedScope> unparked_scope;
+    if (isolate()->CurrentLocalHeap()->IsParked()) {
+      unparked_scope.emplace(isolate()->main_thread_local_isolate());
+    }
+    allocated_type = __ HeapConstant(type.AllocateOnHeap(factory()));
+  }
+  CallBuiltin(Builtin::kCheckTurbofanType, node->op()->properties(), input,
+              allocated_type, __ SmiConstant(node->id()));
   return input;
 }
 

src/compiler/typer.cc

@@ -1274,7 +1274,7 @@ Type Typer::Visitor::TypeJSCreateStringIterator(Node* node) {
 }
 
 Type Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
-  return Type::OtherObject();
+  return Type::Array();
 }
 
 Type Typer::Visitor::TypeJSCreateObject(Node* node) {

src/compiler/types.cc

@@ -10,6 +10,7 @@
 #include "src/handles/handles-inl.h"
 #include "src/objects/instance-type.h"
 #include "src/objects/objects-inl.h"
+#include "src/objects/turbofan-types.h"
 #include "src/utils/ostreams.h"
 
 namespace v8 {
@@ -1142,6 +1143,40 @@ std::ostream& operator<<(std::ostream& os, Type type) {
   return os;
 }
 
+Handle<TurbofanType> Type::AllocateOnHeap(Factory* factory) {
+  DCHECK(CanBeAsserted());
+  if (IsBitset()) {
+    return factory->NewTurbofanBitsetType(AsBitset(), AllocationType::kYoung);
+  } else if (IsUnion()) {
+    const UnionType* union_type = AsUnion();
+    Handle<TurbofanType> result = union_type->Get(0).AllocateOnHeap(factory);
+    for (int i = 1; i < union_type->Length(); ++i) {
+      result = factory->NewTurbofanUnionType(
+          result, union_type->Get(i).AllocateOnHeap(factory),
+          AllocationType::kYoung);
+    }
+    return result;
+  } else if (IsHeapConstant()) {
+    return factory->NewTurbofanHeapConstantType(AsHeapConstant()->Value(),
+                                                AllocationType::kYoung);
+  } else if (IsOtherNumberConstant()) {
+    return factory->NewTurbofanOtherNumberConstantType(
+        AsOtherNumberConstant()->Value(), AllocationType::kYoung);
+  } else if (IsRange()) {
+    return factory->NewTurbofanRangeType(AsRange()->Min(), AsRange()->Max(),
+                                         AllocationType::kYoung);
+  } else {
+    // Other types are not supported for type assertions.
+    UNREACHABLE();
+  }
+}
+
+#define VERIFY_TORQUE_BITSET_AGREEMENT(Name, _) \
+  STATIC_ASSERT(BitsetType::k##Name == TurbofanTypeBits::k##Name);
+INTERNAL_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT)
+PROPER_ATOMIC_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT)
+#undef VERIFY_TORQUE_BITSET_AGREEMENT
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/types.h

@@ -102,8 +102,7 @@ namespace compiler {
   V(OtherNumber,     1u << 4)  \
   V(OtherString,     1u << 5)  \
 
-#define PROPER_BITSET_TYPE_LIST(V) \
-  V(None,                     0u)        \
+#define PROPER_ATOMIC_BITSET_TYPE_LIST(V) \
   V(Negative31,               1u << 6)   \
   V(Null,                     1u << 7)   \
   V(Undefined,                1u << 8)   \
@@ -131,7 +130,10 @@ namespace compiler {
   /* TODO(v8:10391): Remove this type once all ExternalPointer usages are */ \
   /* sandbox-ready. */                   \
   V(SandboxedExternalPointer, 1u << 31)  \
-  \
+
+#define PROPER_BITSET_TYPE_LIST(V) \
+  V(None,                     0u) \
+  PROPER_ATOMIC_BITSET_TYPE_LIST(V) \
   V(Signed31,                     kUnsigned30 | kNegative31) \
   V(Signed32,                     kSigned31 | kOtherUnsigned31 | \
                                   kOtherSigned32) \
@@ -416,9 +418,8 @@ class V8_EXPORT_PRIVATE Type {
            (Is(Type::PlainNumber()) && Min() == Max());
   }
 
-  bool CanBeAsserted() const {
-    return IsRange() || (Is(Type::Integral32()) && !IsNone());
-  }
+  bool CanBeAsserted() const { return Is(Type::NonInternal()); }
+  Handle<TurbofanType> AllocateOnHeap(Factory* factory);
 
   const HeapConstantType* AsHeapConstant() const;
   const OtherNumberConstantType* AsOtherNumberConstant() const;

src/compiler/verifier.cc

@@ -693,7 +693,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateKeyValueArray:
-      CheckTypeIs(node, Type::OtherObject());
+      CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSCreateObject:
       CheckTypeIs(node, Type::OtherObject());

src/diagnostics/objects-debug.cc

@@ -33,6 +33,7 @@
 #include "src/objects/js-array-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/objects.h"
+#include "src/objects/turbofan-types-inl.h"
 #include "src/roots/roots.h"
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/js-break-iterator-inl.h"

src/flags/flag-definitions.h

@@ -549,6 +549,9 @@ DEFINE_NEG_IMPLICATION(jitless, interpreted_frames_native_stack)
 
 DEFINE_BOOL(assert_types, false,
             "generate runtime type assertions to test the typer")
+// TODO(tebbi): Support allocating types from background thread.
+DEFINE_NEG_IMPLICATION(assert_types, concurrent_recompilation)
+DEFINE_NEG_IMPLICATION(assert_types, concurrent_inlining)
 
 DEFINE_BOOL(trace_compilation_dependencies, false, "trace code dependencies")
 // Depend on --trace-deopt-verbose for reporting dependency invalidations.

src/heap/factory.cc

@@ -3135,10 +3135,15 @@ Handle<String> Factory::HeapNumberToString(Handle<HeapNumber> number,
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  char arr[kNumberToStringBufferSize];
-  base::Vector<char> buffer(arr, arraysize(arr));
-  const char* string = DoubleToCString(value, buffer);
-  Handle<String> result = CharToString(this, string, mode);
+  Handle<String> result;
+  if (value == 0) {
+    result = zero_string();
+  } else {
+    char arr[kNumberToStringBufferSize];
+    base::Vector<char> buffer(arr, arraysize(arr));
+    const char* string = DoubleToCString(value, buffer);
+    result = CharToString(this, string, mode);
+  }
   if (mode != NumberCacheMode::kIgnore) {
     NumberToStringCacheSet(number, hash, result);
   }
@@ -3152,10 +3157,15 @@ inline Handle<String> Factory::SmiToString(Smi number, NumberCacheMode mode) {
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  char arr[kNumberToStringBufferSize];
-  base::Vector<char> buffer(arr, arraysize(arr));
-  const char* string = IntToCString(number.value(), buffer);
-  Handle<String> result = CharToString(this, string, mode);
+  Handle<String> result;
+  if (number == Smi::zero()) {
+    result = zero_string();
+  } else {
+    char arr[kNumberToStringBufferSize];
+    base::Vector<char> buffer(arr, arraysize(arr));
+    const char* string = IntToCString(number.value(), buffer);
+    result = CharToString(this, string, mode);
+  }
   if (mode != NumberCacheMode::kIgnore) {
     NumberToStringCacheSet(handle(number, isolate()), hash, result);
   }

src/heap/setup-heap-internal.cc

@@ -42,6 +42,7 @@
 #include "src/objects/synthetic-module.h"
 #include "src/objects/template-objects-inl.h"
 #include "src/objects/torque-defined-classes-inl.h"
+#include "src/objects/turbofan-types.h"
 #include "src/regexp/regexp.h"
 
 #if V8_ENABLE_WEBASSEMBLY

src/objects/map.tq

@@ -52,6 +52,10 @@ extern class Map extends HeapObject {
     }
   }
 
+  macro IsUndetectable(): bool {
+    return this.bit_field.is_undetectable;
+  }
+
   instance_size_in_words: uint8;
   inobject_properties_start_or_constructor_function_index: uint8;
   used_or_unused_instance_size_in_words: uint8;

src/objects/objects-body-descriptors-inl.h

@@ -24,6 +24,7 @@
 #include "src/objects/synthetic-module.h"
 #include "src/objects/torque-defined-classes-inl.h"
 #include "src/objects/transitions.h"
+#include "src/objects/turbofan-types-inl.h"
 
 #if V8_ENABLE_WEBASSEMBLY
 #include "src/wasm/wasm-objects-inl.h"

src/objects/string.tq

@@ -12,6 +12,10 @@ extern class String extends Name {
         Convert<uint16>(this.map.instance_type));
   }
 
+  macro IsNotInternalized(): bool {
+    return this.StringInstanceType().is_not_internalized;
+  }
+
   const length: int32;
 }
 

src/objects/turbofan-types-inl.h

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_TURBOFAN_TYPES_INL_H_
+#define V8_OBJECTS_TURBOFAN_TYPES_INL_H_
+
+#include "src/heap/heap-write-barrier.h"
+#include "src/objects/turbofan-types.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+#include "torque-generated/src/objects/turbofan-types-tq-inl.inc"
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_TURBOFAN_TYPES_INL_H_

src/objects/turbofan-types.h

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_TURBOFAN_TYPES_H_
+#define V8_OBJECTS_TURBOFAN_TYPES_H_
+
+#include "src/common/globals.h"
+#include "src/objects/heap-object.h"
+#include "torque-generated/bit-fields.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+#include "torque-generated/src/objects/turbofan-types-tq.inc"
+
+class TurbofanTypeBits {
+ public:
+  DEFINE_TORQUE_GENERATED_TURBOFAN_TYPE_BITS()
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_TURBOFAN_TYPES_H_

src/objects/turbofan-types.tq

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/objects/turbofan-types.h"
+
+@export
+@abstract
+class TurbofanType extends HeapObject {
+}
+
+bitfield struct TurbofanTypeBits extends uint32 {
+  _unused_padding_field_1: bool: 1 bit;
+  other_unsigned31: bool: 1 bit;
+  other_unsigned32: bool: 1 bit;
+  other_signed32: bool: 1 bit;
+  other_number: bool: 1 bit;
+  other_string: bool: 1 bit;
+  negative31: bool: 1 bit;
+  null: bool: 1 bit;
+  undefined: bool: 1 bit;
+  boolean: bool: 1 bit;
+  unsigned30: bool: 1 bit;
+  minus_zero: bool: 1 bit;
+  naN: bool: 1 bit;
+  symbol: bool: 1 bit;
+  internalized_string: bool: 1 bit;
+  _unused_padding_field_2: bool: 1 bit;
+  other_callable: bool: 1 bit;
+  other_object: bool: 1 bit;
+  other_undetectable: bool: 1 bit;
+  callable_proxy: bool: 1 bit;
+  other_proxy: bool: 1 bit;
+  function: bool: 1 bit;
+  bound_function: bool: 1 bit;
+  hole: bool: 1 bit;
+  other_internal: bool: 1 bit;
+  external_pointer: bool: 1 bit;
+  array: bool: 1 bit;
+  unsigned_big_int_63: bool: 1 bit;
+  other_unsigned_big_int_64: bool: 1 bit;
+  negative_big_int_63: bool: 1 bit;
+  other_big_int: bool: 1 bit;
+  sandboxed_external_pointer: bool: 1 bit;
+}
+
+@export
+class TurbofanBitsetType extends TurbofanType {
+  bitset: TurbofanTypeBits;
+}
+
+@export
+class TurbofanUnionType extends TurbofanType {
+  type1: TurbofanType;
+  type2: TurbofanType;
+}
+
+@export
+class TurbofanRangeType extends TurbofanType {
+  min: float64;
+  max: float64;
+}
+
+@export
+class TurbofanHeapConstantType extends TurbofanType {
+  constant: HeapObject;
+}
+
+@export
+class TurbofanOtherNumberConstantType extends TurbofanType {
+  constant: float64;
+}
+
+macro IsMinusZero(x: float64): bool {
+  return x == 0 && 1 / x < 0;
+}
+
+macro TestTurbofanBitsetType(value: Object, bitset: TurbofanTypeBits): bool {
+  typeswitch (value) {
+    case (value: Number): {
+      const valueF = Convert<float64>(value);
+      if (IsInteger(value)) {
+        if (IsMinusZero(valueF)) {
+          return bitset.minus_zero;
+        } else if (valueF < Convert<float64>(-0x80000000)) {
+          return bitset.other_number;
+        } else if (valueF < -0x40000000) {
+          return bitset.other_signed32;
+        } else if (valueF < 0) {
+          return bitset.negative31;
+        } else if (valueF < Convert<float64>(0x40000000)) {
+          return bitset.unsigned30;
+        } else if (valueF < 0x80000000) {
+          return bitset.other_unsigned31;
+        } else if (valueF <= 0xffffffff) {
+          return bitset.other_unsigned32;
+        } else {
+          return bitset.other_number;
+        }
+      } else if (Float64IsNaN(valueF)) {
+        return bitset.naN;
+      } else {
+        return bitset.other_number;
+      }
+    }
+    case (Null): {
+      return bitset.null;
+    }
+    case (Undefined): {
+      return bitset.undefined;
+    }
+    case (Boolean): {
+      return bitset.boolean;
+    }
+    case (Symbol): {
+      return bitset.symbol;
+    }
+    case (s: String): {
+      if (s.IsNotInternalized()) {
+        return bitset.other_string;
+      } else {
+        return bitset.internalized_string;
+      }
+    }
+    case (proxy: JSProxy): {
+      return Is<Callable>(proxy) ? bitset.callable_proxy : bitset.other_proxy;
+    }
+    case (JSFunction): {
+      return bitset.function;
+    }
+    case (JSBoundFunction): {
+      return bitset.bound_function;
+    }
+    case (TheHole): {
+      return bitset.hole;
+    }
+    case (JSArray): {
+      return bitset.array;
+    }
+    case (BigInt): {
+      // TODO (tebbi): Distinguish different BigInt types.
+      return bitset.unsigned_big_int_63 | bitset.other_unsigned_big_int_64 |
+          bitset.negative_big_int_63 | bitset.other_big_int;
+    }
+    case (Callable): {
+      return bitset.other_callable;
+    }
+    case (object: JSObject): {
+      if (object.map.IsUndetectable()) {
+        return bitset.other_undetectable;
+      } else {
+        return bitset.other_object;
+      }
+    }
+    case (Object): {
+      return false;
+    }
+  }
+}
+
+builtin TestTurbofanType(implicit context: Context)(
+    value: Object, expectedType: TurbofanType): Boolean {
+  typeswitch (expectedType) {
+    case (t: TurbofanBitsetType): {
+      return Convert<Boolean>(TestTurbofanBitsetType(value, t.bitset));
+    }
+    case (t: TurbofanUnionType): {
+      return Convert<Boolean>(
+          TestTurbofanType(value, t.type1) == True ||
+          TestTurbofanType(value, t.type2) == True);
+    }
+    case (t: TurbofanRangeType): {
+      const value = Cast<Number>(value) otherwise return False;
+      if (!IsIntegerOrSomeInfinity(value)) return False;
+      const valueF = Convert<float64>(value);
+      return Convert<Boolean>(
+          !IsMinusZero(valueF) && t.min <= valueF && valueF <= t.max);
+    }
+    case (t: TurbofanHeapConstantType): {
+      return Convert<Boolean>(TaggedEqual(value, t.constant));
+    }
+    case (t: TurbofanOtherNumberConstantType): {
+      const value =
+          Convert<float64>(Cast<Number>(value) otherwise return False);
+      return Convert<Boolean>(value == t.constant);
+    }
+    case (TurbofanType): {
+      unreachable;
+    }
+  }
+}
+
+builtin CheckTurbofanType(implicit context: Context)(
+    value: Object, expectedType: TurbofanType, nodeId: Smi): Undefined {
+  if (TestTurbofanType(value, expectedType) == True) {
+    return Undefined;
+  }
+
+  Print('Type assertion failed! (value/expectedType/nodeId)');
+  Print(value);
+  Print(expectedType);
+  Print(nodeId);
+  unreachable;
+}

src/runtime/runtime.cc

@@ -222,8 +222,10 @@ bool Runtime::IsAllowListedForFuzzing(FunctionId id) {
     case Runtime::kGetOptimizationStatus:
     case Runtime::kHeapObjectVerify:
     case Runtime::kIsBeingInterpreted:
-    case Runtime::kVerifyType:
       return !FLAG_allow_natives_for_differential_fuzzing;
+    case Runtime::kVerifyType:
+      return !FLAG_allow_natives_for_differential_fuzzing &&
+             !FLAG_concurrent_recompilation;
     case Runtime::kBaselineOsr:
     case Runtime::kCompileBaseline:
       return ENABLE_SPARKPLUG;

src/torque/declarations.cc

@@ -202,9 +202,12 @@ Macro* Declarations::DeclareMacro(
     base::Optional<std::string> external_assembler_name,
     const Signature& signature, base::Optional<Statement*> body,
     base::Optional<std::string> op, bool is_user_defined) {
-  if (TryLookupMacro(name, signature.GetExplicitTypes())) {
-    ReportError("cannot redeclare macro ", name,
-                " with identical explicit parameters");
+  if (Macro* existing_macro =
+          TryLookupMacro(name, signature.GetExplicitTypes())) {
+    if (existing_macro->ParentScope() == CurrentScope::Get()) {
+      ReportError("cannot redeclare macro ", name,
+                  " with identical explicit parameters");
+    }
   }
   Macro* macro;
   if (external_assembler_name) {

src/torque/implementation-visitor.cc

@@ -4205,13 +4205,16 @@ void CppClassGenerator::GenerateClass() {
 }
 
 void CppClassGenerator::GenerateClassCasts() {
-  cpp::Function f("cast");
+  cpp::Class owner({cpp::TemplateParameter("D"), cpp::TemplateParameter("P")},
+                   gen_name_);
+  cpp::Function f(&owner, "cast");
   f.SetFlags(cpp::Function::kV8Inline | cpp::Function::kStatic);
   f.SetReturnType("D");
   f.AddParameter("Object", "object");
 
   // V8_INLINE static D cast(Object)
-  f.PrintInlineDefinition(hdr_, [](std::ostream& stream) {
+  f.PrintDeclaration(hdr_);
+  f.PrintDefinition(inl_, [](std::ostream& stream) {
     stream << "    return D(object.ptr());\n";
   });
   // V8_INLINE static D unchecked_cast(Object)
@@ -4731,9 +4734,10 @@ void ImplementationVisitor::GenerateClassDefinitions(
         factory_impl << "  HeapObject result =\n";
         factory_impl << "    factory()->AllocateRawWithImmortalMap(size, "
                         "allocation_type, map);\n";
-        factory_impl << "    WriteBarrierMode write_barrier_mode =\n"
-                     << "       allocation_type == AllocationType::kYoung\n"
-                     << "       ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n";
+        factory_impl << "  WriteBarrierMode write_barrier_mode =\n"
+                     << "     allocation_type == AllocationType::kYoung\n"
+                     << "     ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n"
+                     << "  USE(write_barrier_mode);\n";
         factory_impl << "  " << type->HandlifiedCppTypeName()
                      << " result_handle(" << type->name()
                      << "::cast(result), factory()->isolate());\n";
@@ -5280,32 +5284,9 @@ void ImplementationVisitor::GenerateExportedMacrosAssembler(
     h_contents << "#include \"src/compiler/code-assembler.h\"\n";
     h_contents << "#include \"src/execution/frames.h\"\n";
     h_contents << "#include \"torque-generated/csa-types.h\"\n";
-    cc_contents << "#include \"src/objects/fixed-array-inl.h\"\n";
-    cc_contents << "#include \"src/objects/free-space.h\"\n";
-    cc_contents << "#include \"src/objects/js-regexp-string-iterator.h\"\n";
-    cc_contents << "#include \"src/objects/js-temporal-objects.h\"\n";
-    cc_contents << "#include \"src/objects/js-weak-refs.h\"\n";
-    cc_contents << "#include \"src/objects/ordered-hash-table.h\"\n";
-    cc_contents << "#include \"src/objects/property-descriptor-object.h\"\n";
-    cc_contents << "#include \"src/objects/stack-frame-info.h\"\n";
-    cc_contents << "#include \"src/objects/swiss-name-dictionary.h\"\n";
-    cc_contents << "#include \"src/objects/synthetic-module.h\"\n";
-    cc_contents << "#include \"src/objects/template-objects.h\"\n";
-    cc_contents << "#include \"src/objects/torque-defined-classes.h\"\n";
-    {
-      IfDefScope intl_scope(cc_contents, "V8_INTL_SUPPORT");
-      cc_contents << "#include \"src/objects/js-break-iterator.h\"\n";
-      cc_contents << "#include \"src/objects/js-collator.h\"\n";
-      cc_contents << "#include \"src/objects/js-date-time-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-display-names.h\"\n";
-      cc_contents << "#include \"src/objects/js-list-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-locale.h\"\n";
-      cc_contents << "#include \"src/objects/js-number-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-plural-rules.h\"\n";
-      cc_contents << "#include \"src/objects/js-relative-time-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-segment-iterator.h\"\n";
-      cc_contents << "#include \"src/objects/js-segmenter.h\"\n";
-      cc_contents << "#include \"src/objects/js-segments.h\"\n";
+
+    for (const std::string& include_path : GlobalContext::CppIncludes()) {
+      cc_contents << "#include " << StringLiteralQuote(include_path) << "\n";
     }
     cc_contents << "#include \"torque-generated/" << file_name << ".h\"\n";
 

src/torque/types.cc

@@ -1137,8 +1137,8 @@ std::tuple<size_t, std::string> Field::GetFieldSizeInformation() const {
     return *optional;
   }
   Error("fields of type ", *name_and_type.type, " are not (yet) supported")
-      .Position(pos);
-  return std::make_tuple(0, "#no size");
+      .Position(pos)
+      .Throw();
 }
 
 size_t Type::AlignmentLog2() const {

test/cctest/cctest.status

@@ -1241,4 +1241,18 @@
   'test-streaming-compilation/AsyncTestIncrementalCaching': [SKIP],
   'test-streaming-compilation/SingleThreadedTestIncrementalCaching': [SKIP],
 }],
+
+##############################################################################
+['variant == assert_types', {
+  # Type assertions add strong pointers, breaking these test.
+  'test-heap/ObjectsInOptimizedCodeAreWeak': [SKIP],
+  'test-heap/ObjectsInEagerlyDeoptimizedCodeAreWeak': [SKIP],
+  'test-heap/NewSpaceObjectsInOptimizedCode': [SKIP],
+  'test-heap/LeakNativeContextViaMapKeyed': [SKIP],
+  'test-heap/CellsInOptimizedCodeAreWeak': [SKIP],
+  # Type assertions only work without concurrent compilation, but this test
+  # always triggers a concurrent compilation.
+  'test-concurrent-shared-function-info/TestConcurrentSharedFunctionInfo': [SKIP],
+}],  # variant == assert_types
+
 ]

test/mjsunit/compiler/diamond-followedby-branch.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --no-assert-types
 
 // Check that the branch elimination replace the redundant branch condition with
 // a phi node, and then the branch is folded in EffectControlLinearizationPhase.

test/mjsunit/compiler/number-ceil.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberCeil propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-comparison-truncations.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --turbo-inlining
+// Flags: --allow-natives-syntax --opt --turbo-inlining --no-assert-types
 
 // Test that SpeculativeNumberEqual[SignedSmall] properly passes the
 // kIdentifyZeros truncation.

test/mjsunit/compiler/number-floor.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberFloor propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-max.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberMax properly passes the kIdentifyZeros truncation.
 (function() {

test/mjsunit/compiler/number-min.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberMin properly passes the kIdentifyZeros truncation.
 (function() {

test/mjsunit/compiler/number-modulus.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --noalways-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
 
 
 // Test that NumberModulus passes kIdentifiesZero to the

test/mjsunit/compiler/number-round.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberRound propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-trunc.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberTrunc propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/verify-type.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt
+// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt --no-concurrent-recompilation
 
 function foo(x) {
   return %VerifyType(x * x);

test/mjsunit/getters-on-elements.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --noalways-opt --opt
+// Flags: --allow-natives-syntax --noalways-opt --opt --no-assert-types
 
 // It's nice to run this in other browsers too.
 var standalone = false;

test/mjsunit/regress/regress-2132.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
 
 function mul(x, y) {
   return (x * y) | 0;

test/mjsunit/shift-for-integer-div.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
 
 function divp4(x) {
   return x / 4;

tools/testrunner/local/variants.py

@@ -62,7 +62,8 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = {
   "slow_path": ["--no-force-slow-path"],
   "stress_concurrent_allocation": ["--single-threaded-gc", "--predictable"],
   "stress_concurrent_inlining": ["--single-threaded", "--predictable",
-                                 "--turboprop", "--lazy-feedback-allocation"],
+                                 "--turboprop", "--lazy-feedback-allocation",
+                                 "--assert-types"],
   "turboprop": ["--stress_concurrent_inlining"],
   # The fast API tests initialize an embedder object that never needs to be
   # serialized to the snapshot, so we don't have a
@@ -81,6 +82,7 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = {
   # There is a negative implication: --perf-prof disables
   # --wasm-write-protect-code-memory.
   "wasm_write_protect_code": ["--perf-prof"],
+  "assert_types": ["--concurrent-recompilation", "--concurrent-inlining", "--stress_concurrent_inlining", "--no-assert-types"],
 }
 
 # Flags that lead to a contradiction under certain build variables.
@@ -108,7 +110,7 @@ INCOMPATIBLE_FLAGS_PER_BUILD_VARIABLE = {
 # The conflicts might be directly contradictory flags or be caused by the
 # implications defined in flag-definitions.h.
 INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
-  "--concurrent-recompilation": ["--predictable"],
+  "--concurrent-recompilation": ["--predictable", "--assert-types"],
   "--gc-interval=*": ["--gc-interval=*"],
   "--optimize-for-size": ["--max-semi-space-size=*"],
   "--stress_concurrent_allocation":