[turbofan] extend type asserts to cover all JS types

Extend type assertions to all types covering JavaScript values.
This is achieved by allocating type representations on the heap using
newly defined HeapObject subclasses. To allocate these in the compiler,
we disable concurrent compilation for the --assert-types flag for now.

Fix two type errors that came up with the existing tests:
1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
   OtherObject.
2. OperationTyper::NumberToString(Type) can type the result as the
   HeapConstant Factory::zero_string(). However, NumberToString does
   not always produce this string. To avoid regressions, the CL keeps
   the HeapConstant type and changes the runtime and builtin code to
   always produce the canonical "0" string.

A few tests were failing because they check for truncations to work
and prevent deoptimization. However, AssertType nodes destroy all
truncations (which is by design), so these tests are incompatible
and now disabled for the assert_types variant.

Drive-by fix: a few minor Torque issues that came up.

Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77565}

BUILD.bazel

@@ -836,6 +836,7 @@ filegroup(
         "src/objects/template-objects.tq",
         "src/objects/templates.tq",
         "src/objects/torque-defined-classes.tq",
+        "src/objects/turbofan-types.tq",
         "test/torque/test-torque.tq",
         "third_party/v8/builtins/array-sort.tq",
     ] + select({
@@ -1707,6 +1708,8 @@ filegroup(
         "src/objects/transitions-inl.h",
         "src/objects/transitions.cc",
         "src/objects/transitions.h",
+        "src/objects/turbofan-types-inl.h",
+        "src/objects/turbofan-types.h",
         "src/objects/type-hints.cc",
         "src/objects/type-hints.h",
         "src/objects/value-serializer.cc",

BUILD.gn

@@ -1784,6 +1784,7 @@ torque_files = [
   "src/objects/template-objects.tq",
   "src/objects/templates.tq",
   "src/objects/torque-defined-classes.tq",
+  "src/objects/turbofan-types.tq",
   "test/torque/test-torque.tq",
   "third_party/v8/builtins/array-sort.tq",
 ]
@@ -3253,6 +3254,8 @@ v8_header_set("v8_internal_headers") {
     "src/objects/torque-defined-classes.h",
     "src/objects/transitions-inl.h",
     "src/objects/transitions.h",
+    "src/objects/turbofan-types-inl.h",
+    "src/objects/turbofan-types.h",
     "src/objects/type-hints.h",
     "src/objects/value-serializer.h",
     "src/objects/visitors-inl.h",

src/builtins/base.tq

@@ -1168,7 +1168,7 @@ extern macro Int32Constant(constexpr int31): int31;
 extern macro Int32Constant(constexpr int32): int32;
 extern macro Int64Constant(constexpr int64): int64;
 extern macro Uint64Constant(constexpr uint64): uint64;
-extern macro Float64Constant(constexpr int31): float64;
+extern macro Float64Constant(constexpr int32): float64;
 extern macro Float64Constant(constexpr float64): float64;
 extern macro SmiConstant(constexpr int31): Smi;
 extern macro SmiConstant(constexpr Smi): Smi;
@@ -1799,7 +1799,6 @@ macro Float64IsSomeInfinity(value: float64): bool {
   return value == (Convert<float64>(0) - V8_INFINITY);
 }
 
-@export
 macro IsIntegerOrSomeInfinity(o: Object): bool {
   typeswitch (o) {
     case (Smi): {
@@ -1817,20 +1816,6 @@ macro IsIntegerOrSomeInfinity(o: Object): bool {
   }
 }
 
-builtin CheckNumberInRange(implicit context: Context)(
-    value: Number, min: Number, max: Number, nodeId: Smi): Undefined {
-  if (IsIntegerOrSomeInfinity(value) && min <= value && value <= max) {
-    return Undefined;
-  } else {
-    Print('Range type assertion failed! (value/min/max/nodeId)');
-    Print(value);
-    Print(min);
-    Print(max);
-    Print(nodeId);
-    unreachable;
-  }
-}
-
 // Assert that the objects satisfy SameValue or are both the hole.
 builtin CheckSameObject(implicit context: Context)(
     lhs: Object, rhs: Object): Undefined {

src/builtins/convert.tq

@@ -88,6 +88,9 @@ FromConstexpr<uintptr, constexpr int31>(i: constexpr int31): uintptr {
 FromConstexpr<float64, constexpr int31>(i: constexpr int31): float64 {
   return Float64Constant(i);
 }
+FromConstexpr<float64, constexpr int32>(i: constexpr int32): float64 {
+  return Float64Constant(i);
+}
 FromConstexpr<float64, constexpr float64>(i: constexpr float64): float64 {
   return Float64Constant(i);
 }

src/builtins/number.tq

@@ -75,6 +75,9 @@ macro NumberToStringSmi(x: int32, radix: int32): String labels Slow {
   if (!isNegative) {
     // Fast case where the result is a one character string.
     if (x < radix) {
+      if (x == 0) {
+        return ZeroStringConstant();
+      }
       return StringFromSingleCharCode(ToCharCode(n));
     }
   } else {

src/compiler/add-type-assertions-reducer.cc

@@ -20,6 +20,9 @@ AddTypeAssertionsReducer::~AddTypeAssertionsReducer() = default;
 
 Reduction AddTypeAssertionsReducer::Reduce(Node* node) {
   if (node->opcode() == IrOpcode::kAssertType ||
+      node->opcode() == IrOpcode::kAllocate ||
+      node->opcode() == IrOpcode::kObjectState ||
+      node->opcode() == IrOpcode::kObjectId ||
       node->opcode() == IrOpcode::kPhi || !NodeProperties::IsTyped(node) ||
       visited_.Get(node)) {
     return NoChange();

src/compiler/effect-control-linearizer.cc

@@ -30,6 +30,7 @@
 #include "src/objects/heap-number.h"
 #include "src/objects/oddball.h"
 #include "src/objects/ordered-hash-table.h"
+#include "src/objects/turbofan-types.h"
 
 namespace v8 {
 namespace internal {
@@ -6193,10 +6194,17 @@ Node* EffectControlLinearizer::LowerAssertType(Node* node) {
   Type type = OpParameter<Type>(node->op());
   CHECK(type.CanBeAsserted());
   Node* const input = node->InputAt(0);
-  Node* const min = __ NumberConstant(type.Min());
-  Node* const max = __ NumberConstant(type.Max());
-  CallBuiltin(Builtin::kCheckNumberInRange, node->op()->properties(), input,
-              min, max, __ SmiConstant(node->id()));
+  Node* allocated_type;
+  {
+    DCHECK(isolate()->CurrentLocalHeap()->is_main_thread());
+    base::Optional<UnparkedScope> unparked_scope;
+    if (isolate()->CurrentLocalHeap()->IsParked()) {
+      unparked_scope.emplace(isolate()->main_thread_local_isolate());
+    }
+    allocated_type = __ HeapConstant(type.AllocateOnHeap(factory()));
+  }
+  CallBuiltin(Builtin::kCheckTurbofanType, node->op()->properties(), input,
+              allocated_type, __ SmiConstant(node->id()));
   return input;
 }
 

src/compiler/typer.cc

@@ -1274,7 +1274,7 @@ Type Typer::Visitor::TypeJSCreateStringIterator(Node* node) {
 }
 
 Type Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
-  return Type::OtherObject();
+  return Type::Array();
 }
 
 Type Typer::Visitor::TypeJSCreateObject(Node* node) {

src/compiler/types.cc

@@ -10,6 +10,7 @@
 #include "src/handles/handles-inl.h"
 #include "src/objects/instance-type.h"
 #include "src/objects/objects-inl.h"
+#include "src/objects/turbofan-types.h"
 #include "src/utils/ostreams.h"
 
 namespace v8 {
@@ -1142,6 +1143,40 @@ std::ostream& operator<<(std::ostream& os, Type type) {
   return os;
 }
 
+Handle<TurbofanType> Type::AllocateOnHeap(Factory* factory) {
+  DCHECK(CanBeAsserted());
+  if (IsBitset()) {
+    return factory->NewTurbofanBitsetType(AsBitset(), AllocationType::kYoung);
+  } else if (IsUnion()) {
+    const UnionType* union_type = AsUnion();
+    Handle<TurbofanType> result = union_type->Get(0).AllocateOnHeap(factory);
+    for (int i = 1; i < union_type->Length(); ++i) {
+      result = factory->NewTurbofanUnionType(
+          result, union_type->Get(i).AllocateOnHeap(factory),
+          AllocationType::kYoung);
+    }
+    return result;
+  } else if (IsHeapConstant()) {
+    return factory->NewTurbofanHeapConstantType(AsHeapConstant()->Value(),
+                                                AllocationType::kYoung);
+  } else if (IsOtherNumberConstant()) {
+    return factory->NewTurbofanOtherNumberConstantType(
+        AsOtherNumberConstant()->Value(), AllocationType::kYoung);
+  } else if (IsRange()) {
+    return factory->NewTurbofanRangeType(AsRange()->Min(), AsRange()->Max(),
+                                         AllocationType::kYoung);
+  } else {
+    // Other types are not supported for type assertions.
+    UNREACHABLE();
+  }
+}
+
+#define VERIFY_TORQUE_BITSET_AGREEMENT(Name, _) \
+  STATIC_ASSERT(BitsetType::k##Name == TurbofanTypeBits::k##Name);
+INTERNAL_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT)
+PROPER_ATOMIC_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT)
+#undef VERIFY_TORQUE_BITSET_AGREEMENT
+
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/types.h

@@ -102,8 +102,7 @@ namespace compiler {
   V(OtherNumber,     1u << 4)  \
   V(OtherString,     1u << 5)  \
 
-#define PROPER_BITSET_TYPE_LIST(V) \
-  V(None,                     0u)        \
+#define PROPER_ATOMIC_BITSET_TYPE_LIST(V) \
   V(Negative31,               1u << 6)   \
   V(Null,                     1u << 7)   \
   V(Undefined,                1u << 8)   \
@@ -131,7 +130,10 @@ namespace compiler {
   /* TODO(v8:10391): Remove this type once all ExternalPointer usages are */ \
   /* sandbox-ready. */                   \
   V(SandboxedExternalPointer, 1u << 31)  \
-  \
+
+#define PROPER_BITSET_TYPE_LIST(V) \
+  V(None,                     0u) \
+  PROPER_ATOMIC_BITSET_TYPE_LIST(V) \
   V(Signed31,                     kUnsigned30 | kNegative31) \
   V(Signed32,                     kSigned31 | kOtherUnsigned31 | \
                                   kOtherSigned32) \
@@ -416,9 +418,8 @@ class V8_EXPORT_PRIVATE Type {
            (Is(Type::PlainNumber()) && Min() == Max());
   }
 
-  bool CanBeAsserted() const {
-    return IsRange() || (Is(Type::Integral32()) && !IsNone());
-  }
+  bool CanBeAsserted() const { return Is(Type::NonInternal()); }
+  Handle<TurbofanType> AllocateOnHeap(Factory* factory);
 
   const HeapConstantType* AsHeapConstant() const;
   const OtherNumberConstantType* AsOtherNumberConstant() const;

src/compiler/verifier.cc

@@ -693,7 +693,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateKeyValueArray:
-      CheckTypeIs(node, Type::OtherObject());
+      CheckTypeIs(node, Type::Array());
       break;
     case IrOpcode::kJSCreateObject:
       CheckTypeIs(node, Type::OtherObject());

src/diagnostics/objects-debug.cc

@@ -33,6 +33,7 @@
 #include "src/objects/js-array-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/objects.h"
+#include "src/objects/turbofan-types-inl.h"
 #include "src/roots/roots.h"
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/js-break-iterator-inl.h"

src/flags/flag-definitions.h

@@ -549,6 +549,9 @@ DEFINE_NEG_IMPLICATION(jitless, interpreted_frames_native_stack)
 
 DEFINE_BOOL(assert_types, false,
             "generate runtime type assertions to test the typer")
+// TODO(tebbi): Support allocating types from background thread.
+DEFINE_NEG_IMPLICATION(assert_types, concurrent_recompilation)
+DEFINE_NEG_IMPLICATION(assert_types, concurrent_inlining)
 
 DEFINE_BOOL(trace_compilation_dependencies, false, "trace code dependencies")
 // Depend on --trace-deopt-verbose for reporting dependency invalidations.

src/heap/factory.cc

@@ -3119,10 +3119,15 @@ Handle<String> Factory::HeapNumberToString(Handle<HeapNumber> number,
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  char arr[kNumberToStringBufferSize];
-  base::Vector<char> buffer(arr, arraysize(arr));
-  const char* string = DoubleToCString(value, buffer);
-  Handle<String> result = CharToString(this, string, mode);
+  Handle<String> result;
+  if (value == 0) {
+    result = zero_string();
+  } else {
+    char arr[kNumberToStringBufferSize];
+    base::Vector<char> buffer(arr, arraysize(arr));
+    const char* string = DoubleToCString(value, buffer);
+    result = CharToString(this, string, mode);
+  }
   if (mode != NumberCacheMode::kIgnore) {
     NumberToStringCacheSet(number, hash, result);
   }
@@ -3136,10 +3141,15 @@ inline Handle<String> Factory::SmiToString(Smi number, NumberCacheMode mode) {
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  char arr[kNumberToStringBufferSize];
-  base::Vector<char> buffer(arr, arraysize(arr));
-  const char* string = IntToCString(number.value(), buffer);
-  Handle<String> result = CharToString(this, string, mode);
+  Handle<String> result;
+  if (number == Smi::zero()) {
+    result = zero_string();
+  } else {
+    char arr[kNumberToStringBufferSize];
+    base::Vector<char> buffer(arr, arraysize(arr));
+    const char* string = IntToCString(number.value(), buffer);
+    result = CharToString(this, string, mode);
+  }
   if (mode != NumberCacheMode::kIgnore) {
     NumberToStringCacheSet(handle(number, isolate()), hash, result);
   }

src/heap/setup-heap-internal.cc

@@ -42,6 +42,7 @@
 #include "src/objects/synthetic-module.h"
 #include "src/objects/template-objects-inl.h"
 #include "src/objects/torque-defined-classes-inl.h"
+#include "src/objects/turbofan-types.h"
 #include "src/regexp/regexp.h"
 
 #if V8_ENABLE_WEBASSEMBLY

src/objects/map.tq

@@ -52,6 +52,10 @@ extern class Map extends HeapObject {
     }
   }
 
+  macro IsUndetectable(): bool {
+    return this.bit_field.is_undetectable;
+  }
+
   instance_size_in_words: uint8;
   inobject_properties_start_or_constructor_function_index: uint8;
   used_or_unused_instance_size_in_words: uint8;

src/objects/objects-body-descriptors-inl.h

@@ -24,6 +24,7 @@
 #include "src/objects/synthetic-module.h"
 #include "src/objects/torque-defined-classes-inl.h"
 #include "src/objects/transitions.h"
+#include "src/objects/turbofan-types-inl.h"
 
 #if V8_ENABLE_WEBASSEMBLY
 #include "src/wasm/wasm-objects-inl.h"

src/objects/string.tq

@@ -12,6 +12,10 @@ extern class String extends Name {
         Convert<uint16>(this.map.instance_type));
   }
 
+  macro IsNotInternalized(): bool {
+    return this.StringInstanceType().is_not_internalized;
+  }
+
   const length: int32;
 }
 

src/objects/turbofan-types-inl.h

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_TURBOFAN_TYPES_INL_H_
+#define V8_OBJECTS_TURBOFAN_TYPES_INL_H_
+
+#include "src/heap/heap-write-barrier.h"
+#include "src/objects/turbofan-types.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+#include "torque-generated/src/objects/turbofan-types-tq-inl.inc"
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_TURBOFAN_TYPES_INL_H_

src/objects/turbofan-types.h

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef V8_OBJECTS_TURBOFAN_TYPES_H_
+#define V8_OBJECTS_TURBOFAN_TYPES_H_
+
+#include "src/common/globals.h"
+#include "src/objects/heap-object.h"
+#include "torque-generated/bit-fields.h"
+
+// Has to be the last include (doesn't have include guards):
+#include "src/objects/object-macros.h"
+
+namespace v8 {
+namespace internal {
+
+#include "torque-generated/src/objects/turbofan-types-tq.inc"
+
+class TurbofanTypeBits {
+ public:
+  DEFINE_TORQUE_GENERATED_TURBOFAN_TYPE_BITS()
+};
+
+}  // namespace internal
+}  // namespace v8
+
+#include "src/objects/object-macros-undef.h"
+
+#endif  // V8_OBJECTS_TURBOFAN_TYPES_H_

src/objects/turbofan-types.tq

+// Copyright 2021 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "src/objects/turbofan-types.h"
+
+@export
+@abstract
+class TurbofanType extends HeapObject {
+}
+
+bitfield struct TurbofanTypeBits extends uint32 {
+  _unused_padding_field_1: bool: 1 bit;
+  other_unsigned31: bool: 1 bit;
+  other_unsigned32: bool: 1 bit;
+  other_signed32: bool: 1 bit;
+  other_number: bool: 1 bit;
+  other_string: bool: 1 bit;
+  negative31: bool: 1 bit;
+  null: bool: 1 bit;
+  undefined: bool: 1 bit;
+  boolean: bool: 1 bit;
+  unsigned30: bool: 1 bit;
+  minus_zero: bool: 1 bit;
+  naN: bool: 1 bit;
+  symbol: bool: 1 bit;
+  internalized_string: bool: 1 bit;
+  _unused_padding_field_2: bool: 1 bit;
+  other_callable: bool: 1 bit;
+  other_object: bool: 1 bit;
+  other_undetectable: bool: 1 bit;
+  callable_proxy: bool: 1 bit;
+  other_proxy: bool: 1 bit;
+  function: bool: 1 bit;
+  bound_function: bool: 1 bit;
+  hole: bool: 1 bit;
+  other_internal: bool: 1 bit;
+  external_pointer: bool: 1 bit;
+  array: bool: 1 bit;
+  unsigned_big_int_63: bool: 1 bit;
+  other_unsigned_big_int_64: bool: 1 bit;
+  negative_big_int_63: bool: 1 bit;
+  other_big_int: bool: 1 bit;
+  sandboxed_external_pointer: bool: 1 bit;
+}
+
+@export
+class TurbofanBitsetType extends TurbofanType {
+  bitset: TurbofanTypeBits;
+}
+
+@export
+class TurbofanUnionType extends TurbofanType {
+  type1: TurbofanType;
+  type2: TurbofanType;
+}
+
+@export
+class TurbofanRangeType extends TurbofanType {
+  min: float64;
+  max: float64;
+}
+
+@export
+class TurbofanHeapConstantType extends TurbofanType {
+  constant: HeapObject;
+}
+
+@export
+class TurbofanOtherNumberConstantType extends TurbofanType {
+  constant: float64;
+}
+
+macro IsMinusZero(x: float64): bool {
+  return x == 0 && 1 / x < 0;
+}
+
+macro TestTurbofanBitsetType(value: Object, bitset: TurbofanTypeBits): bool {
+  typeswitch (value) {
+    case (value: Number): {
+      const valueF = Convert<float64>(value);
+      if (IsInteger(value)) {
+        if (IsMinusZero(valueF)) {
+          return bitset.minus_zero;
+        } else if (valueF < Convert<float64>(-0x80000000)) {
+          return bitset.other_number;
+        } else if (valueF < -0x40000000) {
+          return bitset.other_signed32;
+        } else if (valueF < 0) {
+          return bitset.negative31;
+        } else if (valueF < Convert<float64>(0x40000000)) {
+          return bitset.unsigned30;
+        } else if (valueF < 0x80000000) {
+          return bitset.other_unsigned31;
+        } else if (valueF <= 0xffffffff) {
+          return bitset.other_unsigned32;
+        } else {
+          return bitset.other_number;
+        }
+      } else if (Float64IsNaN(valueF)) {
+        return bitset.naN;
+      } else {
+        return bitset.other_number;
+      }
+    }
+    case (Null): {
+      return bitset.null;
+    }
+    case (Undefined): {
+      return bitset.undefined;
+    }
+    case (Boolean): {
+      return bitset.boolean;
+    }
+    case (Symbol): {
+      return bitset.symbol;
+    }
+    case (s: String): {
+      if (s.IsNotInternalized()) {
+        return bitset.other_string;
+      } else {
+        return bitset.internalized_string;
+      }
+    }
+    case (proxy: JSProxy): {
+      return Is<Callable>(proxy) ? bitset.callable_proxy : bitset.other_proxy;
+    }
+    case (JSFunction): {
+      return bitset.function;
+    }
+    case (JSBoundFunction): {
+      return bitset.bound_function;
+    }
+    case (TheHole): {
+      return bitset.hole;
+    }
+    case (JSArray): {
+      return bitset.array;
+    }
+    case (BigInt): {
+      // TODO (tebbi): Distinguish different BigInt types.
+      return bitset.unsigned_big_int_63 | bitset.other_unsigned_big_int_64 |
+          bitset.negative_big_int_63 | bitset.other_big_int;
+    }
+    case (Callable): {
+      return bitset.other_callable;
+    }
+    case (object: JSObject): {
+      if (object.map.IsUndetectable()) {
+        return bitset.other_undetectable;
+      } else {
+        return bitset.other_object;
+      }
+    }
+    case (Object): {
+      return false;
+    }
+  }
+}
+
+builtin TestTurbofanType(implicit context: Context)(
+    value: Object, expectedType: TurbofanType): Boolean {
+  typeswitch (expectedType) {
+    case (t: TurbofanBitsetType): {
+      return Convert<Boolean>(TestTurbofanBitsetType(value, t.bitset));
+    }
+    case (t: TurbofanUnionType): {
+      return Convert<Boolean>(
+          TestTurbofanType(value, t.type1) == True ||
+          TestTurbofanType(value, t.type2) == True);
+    }
+    case (t: TurbofanRangeType): {
+      const value = Cast<Number>(value) otherwise return False;
+      if (!IsIntegerOrSomeInfinity(value)) return False;
+      const valueF = Convert<float64>(value);
+      return Convert<Boolean>(
+          !IsMinusZero(valueF) && t.min <= valueF && valueF <= t.max);
+    }
+    case (t: TurbofanHeapConstantType): {
+      return Convert<Boolean>(TaggedEqual(value, t.constant));
+    }
+    case (t: TurbofanOtherNumberConstantType): {
+      const value =
+          Convert<float64>(Cast<Number>(value) otherwise return False);
+      return Convert<Boolean>(value == t.constant);
+    }
+    case (TurbofanType): {
+      unreachable;
+    }
+  }
+}
+
+builtin CheckTurbofanType(implicit context: Context)(
+    value: Object, expectedType: TurbofanType, nodeId: Smi): Undefined {
+  if (TestTurbofanType(value, expectedType) == True) {
+    return Undefined;
+  }
+
+  Print('Type assertion failed! (value/expectedType/nodeId)');
+  Print(value);
+  Print(expectedType);
+  Print(nodeId);
+  unreachable;
+}

src/torque/declarations.cc

@@ -202,9 +202,12 @@ Macro* Declarations::DeclareMacro(
     base::Optional<std::string> external_assembler_name,
     const Signature& signature, base::Optional<Statement*> body,
     base::Optional<std::string> op, bool is_user_defined) {
-  if (TryLookupMacro(name, signature.GetExplicitTypes())) {
-    ReportError("cannot redeclare macro ", name,
-                " with identical explicit parameters");
+  if (Macro* existing_macro =
+          TryLookupMacro(name, signature.GetExplicitTypes())) {
+    if (existing_macro->ParentScope() == CurrentScope::Get()) {
+      ReportError("cannot redeclare macro ", name,
+                  " with identical explicit parameters");
+    }
   }
   Macro* macro;
   if (external_assembler_name) {

src/torque/implementation-visitor.cc

@@ -4205,13 +4205,16 @@ void CppClassGenerator::GenerateClass() {
 }
 
 void CppClassGenerator::GenerateClassCasts() {
-  cpp::Function f("cast");
+  cpp::Class owner({cpp::TemplateParameter("D"), cpp::TemplateParameter("P")},
+                   gen_name_);
+  cpp::Function f(&owner, "cast");
   f.SetFlags(cpp::Function::kV8Inline | cpp::Function::kStatic);
   f.SetReturnType("D");
   f.AddParameter("Object", "object");
 
   // V8_INLINE static D cast(Object)
-  f.PrintInlineDefinition(hdr_, [](std::ostream& stream) {
+  f.PrintDeclaration(hdr_);
+  f.PrintDefinition(inl_, [](std::ostream& stream) {
     stream << "    return D(object.ptr());\n";
   });
   // V8_INLINE static D unchecked_cast(Object)
@@ -4731,9 +4734,10 @@ void ImplementationVisitor::GenerateClassDefinitions(
         factory_impl << "  HeapObject result =\n";
         factory_impl << "    factory()->AllocateRawWithImmortalMap(size, "
                         "allocation_type, map);\n";
-        factory_impl << "    WriteBarrierMode write_barrier_mode =\n"
-                     << "       allocation_type == AllocationType::kYoung\n"
-                     << "       ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n";
+        factory_impl << "  WriteBarrierMode write_barrier_mode =\n"
+                     << "     allocation_type == AllocationType::kYoung\n"
+                     << "     ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n"
+                     << "  USE(write_barrier_mode);\n";
         factory_impl << "  " << type->HandlifiedCppTypeName()
                      << " result_handle(" << type->name()
                      << "::cast(result), factory()->isolate());\n";
@@ -5280,32 +5284,9 @@ void ImplementationVisitor::GenerateExportedMacrosAssembler(
     h_contents << "#include \"src/compiler/code-assembler.h\"\n";
     h_contents << "#include \"src/execution/frames.h\"\n";
     h_contents << "#include \"torque-generated/csa-types.h\"\n";
-    cc_contents << "#include \"src/objects/fixed-array-inl.h\"\n";
-    cc_contents << "#include \"src/objects/free-space.h\"\n";
-    cc_contents << "#include \"src/objects/js-regexp-string-iterator.h\"\n";
-    cc_contents << "#include \"src/objects/js-temporal-objects.h\"\n";
-    cc_contents << "#include \"src/objects/js-weak-refs.h\"\n";
-    cc_contents << "#include \"src/objects/ordered-hash-table.h\"\n";
-    cc_contents << "#include \"src/objects/property-descriptor-object.h\"\n";
-    cc_contents << "#include \"src/objects/stack-frame-info.h\"\n";
-    cc_contents << "#include \"src/objects/swiss-name-dictionary.h\"\n";
-    cc_contents << "#include \"src/objects/synthetic-module.h\"\n";
-    cc_contents << "#include \"src/objects/template-objects.h\"\n";
-    cc_contents << "#include \"src/objects/torque-defined-classes.h\"\n";
-    {
-      IfDefScope intl_scope(cc_contents, "V8_INTL_SUPPORT");
-      cc_contents << "#include \"src/objects/js-break-iterator.h\"\n";
-      cc_contents << "#include \"src/objects/js-collator.h\"\n";
-      cc_contents << "#include \"src/objects/js-date-time-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-display-names.h\"\n";
-      cc_contents << "#include \"src/objects/js-list-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-locale.h\"\n";
-      cc_contents << "#include \"src/objects/js-number-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-plural-rules.h\"\n";
-      cc_contents << "#include \"src/objects/js-relative-time-format.h\"\n";
-      cc_contents << "#include \"src/objects/js-segment-iterator.h\"\n";
-      cc_contents << "#include \"src/objects/js-segmenter.h\"\n";
-      cc_contents << "#include \"src/objects/js-segments.h\"\n";
+
+    for (const std::string& include_path : GlobalContext::CppIncludes()) {
+      cc_contents << "#include " << StringLiteralQuote(include_path) << "\n";
     }
     cc_contents << "#include \"torque-generated/" << file_name << ".h\"\n";
 

src/torque/types.cc

@@ -1137,8 +1137,8 @@ std::tuple<size_t, std::string> Field::GetFieldSizeInformation() const {
     return *optional;
   }
   Error("fields of type ", *name_and_type.type, " are not (yet) supported")
-      .Position(pos);
-  return std::make_tuple(0, "#no size");
+      .Position(pos)
+      .Throw();
 }
 
 size_t Type::AlignmentLog2() const {

test/cctest/cctest.status

@@ -1241,4 +1241,18 @@
   'test-streaming-compilation/AsyncTestIncrementalCaching': [SKIP],
   'test-streaming-compilation/SingleThreadedTestIncrementalCaching': [SKIP],
 }],
+
+##############################################################################
+['variant == assert_types', {
+  # Type assertions add strong pointers, breaking these test.
+  'test-heap/ObjectsInOptimizedCodeAreWeak': [SKIP],
+  'test-heap/ObjectsInEagerlyDeoptimizedCodeAreWeak': [SKIP],
+  'test-heap/NewSpaceObjectsInOptimizedCode': [SKIP],
+  'test-heap/LeakNativeContextViaMapKeyed': [SKIP],
+  'test-heap/CellsInOptimizedCodeAreWeak': [SKIP],
+  # Type assertions only work without concurrent compilation, but this test
+  # always triggers a concurrent compilation.
+  'test-concurrent-shared-function-info/TestConcurrentSharedFunctionInfo': [SKIP],
+}],  # variant == assert_types
+
 ]

test/mjsunit/compiler/diamond-followedby-branch.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --no-assert-types
 
 // Check that the branch elimination replace the redundant branch condition with
 // a phi node, and then the branch is folded in EffectControlLinearizationPhase.

test/mjsunit/compiler/number-ceil.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberCeil propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-comparison-truncations.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --turbo-inlining
+// Flags: --allow-natives-syntax --opt --turbo-inlining --no-assert-types
 
 // Test that SpeculativeNumberEqual[SignedSmall] properly passes the
 // kIdentifyZeros truncation.

test/mjsunit/compiler/number-floor.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberFloor propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-max.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberMax properly passes the kIdentifyZeros truncation.
 (function() {

test/mjsunit/compiler/number-min.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberMin properly passes the kIdentifyZeros truncation.
 (function() {

test/mjsunit/compiler/number-modulus.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --noalways-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
 
 
 // Test that NumberModulus passes kIdentifiesZero to the

test/mjsunit/compiler/number-round.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberRound propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-trunc.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --no-assert-types
 
 // Test that NumberTrunc propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/verify-type.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt
+// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt --no-concurrent-recompilation
 
 function foo(x) {
   return %VerifyType(x * x);

test/mjsunit/getters-on-elements.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --noalways-opt --opt
+// Flags: --allow-natives-syntax --noalways-opt --opt --no-assert-types
 
 // It's nice to run this in other browsers too.
 var standalone = false;

test/mjsunit/regress/regress-2132.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
 
 function mul(x, y) {
   return (x * y) | 0;

test/mjsunit/shift-for-integer-div.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt
+// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
 
 function divp4(x) {
   return x / 4;

tools/testrunner/local/variants.py

@@ -62,7 +62,8 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = {
   "slow_path": ["--no-force-slow-path"],
   "stress_concurrent_allocation": ["--single-threaded-gc", "--predictable"],
   "stress_concurrent_inlining": ["--single-threaded", "--predictable",
-                                 "--turboprop", "--lazy-feedback-allocation"],
+                                 "--turboprop", "--lazy-feedback-allocation",
+                                 "--assert-types"],
   "turboprop": ["--stress_concurrent_inlining"],
   # The fast API tests initialize an embedder object that never needs to be
   # serialized to the snapshot, so we don't have a
@@ -81,6 +82,7 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = {
   # There is a negative implication: --perf-prof disables
   # --wasm-write-protect-code-memory.
   "wasm_write_protect_code": ["--perf-prof"],
+  "assert_types": ["--concurrent-recompilation", "--concurrent-inlining", "--stress_concurrent_inlining", "--no-assert-types"],
 }
 
 # Flags that lead to a contradiction under certain build variables.