Revert "[turbofan] extend type asserts to cover all JS types"

This reverts commit 45227ffd.

Reason for revert: Breaks on gc_stress mode, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/35988/overview

Original change's description:
> [turbofan] extend type asserts to cover all JS types
>
> Extend type assertions to all types covering JavaScript values.
> This is achieved by allocating type representations on the heap using
> newly defined HeapObject subclasses. To allocate these in the compiler,
> we disable concurrent compilation for the --assert-types flag for now.
>
> Fix two type errors that came up with the existing tests:
> 1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
>    OtherObject.
> 2. OperationTyper::NumberToString(Type) can type the result as the
>    HeapConstant Factory::zero_string(). However, NumberToString does
>    not always produce this string. To avoid regressions, the CL keeps
>    the HeapConstant type and changes the runtime and builtin code to
>    always produce the canonical "0" string.
>
> A few tests were failing because they check for truncations to work
> and prevent deoptimization. However, AssertType nodes destroy all
> truncations (which is by design), so these tests are incompatible
> and now disabled for the assert_types variant.
>
> Drive-by fix: a few minor Torque issues that came up.
>
> Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77565}

Change-Id: Ia779a11fc811846194c7a8d1e40b372b265e7ea4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247034
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Owners-Override: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77566}

BUILD.bazel

@@ -836,7 +836,6 @@ filegroup(
         "src/objects/template-objects.tq",
         "src/objects/templates.tq",
         "src/objects/torque-defined-classes.tq",
-        "src/objects/turbofan-types.tq",
         "test/torque/test-torque.tq",
         "third_party/v8/builtins/array-sort.tq",
     ] + select({
@@ -1708,8 +1707,6 @@ filegroup(
         "src/objects/transitions-inl.h",
         "src/objects/transitions.cc",
         "src/objects/transitions.h",
-        "src/objects/turbofan-types-inl.h",
-        "src/objects/turbofan-types.h",
         "src/objects/type-hints.cc",
         "src/objects/type-hints.h",
         "src/objects/value-serializer.cc",

BUILD.gn

@@ -1784,7 +1784,6 @@ torque_files = [
   "src/objects/template-objects.tq",
   "src/objects/templates.tq",
   "src/objects/torque-defined-classes.tq",
-  "src/objects/turbofan-types.tq",
   "test/torque/test-torque.tq",
   "third_party/v8/builtins/array-sort.tq",
 ]
@@ -3254,8 +3253,6 @@ v8_header_set("v8_internal_headers") {
     "src/objects/torque-defined-classes.h",
     "src/objects/transitions-inl.h",
     "src/objects/transitions.h",
-    "src/objects/turbofan-types-inl.h",
-    "src/objects/turbofan-types.h",
     "src/objects/type-hints.h",
     "src/objects/value-serializer.h",
     "src/objects/visitors-inl.h",

src/builtins/base.tq

@@ -1168,7 +1168,7 @@ extern macro Int32Constant(constexpr int31): int31;
 extern macro Int32Constant(constexpr int32): int32;
 extern macro Int64Constant(constexpr int64): int64;
 extern macro Uint64Constant(constexpr uint64): uint64;
-extern macro Float64Constant(constexpr int32): float64;
+extern macro Float64Constant(constexpr int31): float64;
 extern macro Float64Constant(constexpr float64): float64;
 extern macro SmiConstant(constexpr int31): Smi;
 extern macro SmiConstant(constexpr Smi): Smi;
@@ -1799,6 +1799,7 @@ macro Float64IsSomeInfinity(value: float64): bool {
   return value == (Convert<float64>(0) - V8_INFINITY);
 }
 
+@export
 macro IsIntegerOrSomeInfinity(o: Object): bool {
   typeswitch (o) {
     case (Smi): {
@@ -1816,6 +1817,20 @@ macro IsIntegerOrSomeInfinity(o: Object): bool {
   }
 }
 
+builtin CheckNumberInRange(implicit context: Context)(
+    value: Number, min: Number, max: Number, nodeId: Smi): Undefined {
+  if (IsIntegerOrSomeInfinity(value) && min <= value && value <= max) {
+    return Undefined;
+  } else {
+    Print('Range type assertion failed! (value/min/max/nodeId)');
+    Print(value);
+    Print(min);
+    Print(max);
+    Print(nodeId);
+    unreachable;
+  }
+}
+
 // Assert that the objects satisfy SameValue or are both the hole.
 builtin CheckSameObject(implicit context: Context)(
     lhs: Object, rhs: Object): Undefined {

src/builtins/convert.tq

@@ -88,9 +88,6 @@ FromConstexpr<uintptr, constexpr int31>(i: constexpr int31): uintptr {
 FromConstexpr<float64, constexpr int31>(i: constexpr int31): float64 {
   return Float64Constant(i);
 }
-FromConstexpr<float64, constexpr int32>(i: constexpr int32): float64 {
-  return Float64Constant(i);
-}
 FromConstexpr<float64, constexpr float64>(i: constexpr float64): float64 {
   return Float64Constant(i);
 }

src/builtins/number.tq

@@ -75,9 +75,6 @@ macro NumberToStringSmi(x: int32, radix: int32): String labels Slow {
   if (!isNegative) {
     // Fast case where the result is a one character string.
     if (x < radix) {
-      if (x == 0) {
-        return ZeroStringConstant();
-      }
       return StringFromSingleCharCode(ToCharCode(n));
     }
   } else {

src/compiler/add-type-assertions-reducer.cc

@@ -20,9 +20,6 @@ AddTypeAssertionsReducer::~AddTypeAssertionsReducer() = default;
 
 Reduction AddTypeAssertionsReducer::Reduce(Node* node) {
   if (node->opcode() == IrOpcode::kAssertType ||
-      node->opcode() == IrOpcode::kAllocate ||
-      node->opcode() == IrOpcode::kObjectState ||
-      node->opcode() == IrOpcode::kObjectId ||
       node->opcode() == IrOpcode::kPhi || !NodeProperties::IsTyped(node) ||
       visited_.Get(node)) {
     return NoChange();

src/compiler/effect-control-linearizer.cc

@@ -30,7 +30,6 @@
 #include "src/objects/heap-number.h"
 #include "src/objects/oddball.h"
 #include "src/objects/ordered-hash-table.h"
-#include "src/objects/turbofan-types.h"
 
 namespace v8 {
 namespace internal {
@@ -6194,17 +6193,10 @@ Node* EffectControlLinearizer::LowerAssertType(Node* node) {
   Type type = OpParameter<Type>(node->op());
   CHECK(type.CanBeAsserted());
   Node* const input = node->InputAt(0);
-  Node* allocated_type;
-  {
-    DCHECK(isolate()->CurrentLocalHeap()->is_main_thread());
-    base::Optional<UnparkedScope> unparked_scope;
-    if (isolate()->CurrentLocalHeap()->IsParked()) {
-      unparked_scope.emplace(isolate()->main_thread_local_isolate());
-    }
-    allocated_type = __ HeapConstant(type.AllocateOnHeap(factory()));
-  }
-  CallBuiltin(Builtin::kCheckTurbofanType, node->op()->properties(), input,
-              allocated_type, __ SmiConstant(node->id()));
+  Node* const min = __ NumberConstant(type.Min());
+  Node* const max = __ NumberConstant(type.Max());
+  CallBuiltin(Builtin::kCheckNumberInRange, node->op()->properties(), input,
+              min, max, __ SmiConstant(node->id()));
   return input;
 }
 

src/compiler/typer.cc

@@ -1274,7 +1274,7 @@ Type Typer::Visitor::TypeJSCreateStringIterator(Node* node) {
 }
 
 Type Typer::Visitor::TypeJSCreateKeyValueArray(Node* node) {
-  return Type::Array();
+  return Type::OtherObject();
 }
 
 Type Typer::Visitor::TypeJSCreateObject(Node* node) {

src/compiler/types.cc

@@ -10,7 +10,6 @@
 #include "src/handles/handles-inl.h"
 #include "src/objects/instance-type.h"
 #include "src/objects/objects-inl.h"
-#include "src/objects/turbofan-types.h"
 #include "src/utils/ostreams.h"
 
 namespace v8 {
@@ -1143,40 +1142,6 @@ std::ostream& operator<<(std::ostream& os, Type type) {
   return os;
 }
 
-Handle<TurbofanType> Type::AllocateOnHeap(Factory* factory) {
-  DCHECK(CanBeAsserted());
-  if (IsBitset()) {
-    return factory->NewTurbofanBitsetType(AsBitset(), AllocationType::kYoung);
-  } else if (IsUnion()) {
-    const UnionType* union_type = AsUnion();
-    Handle<TurbofanType> result = union_type->Get(0).AllocateOnHeap(factory);
-    for (int i = 1; i < union_type->Length(); ++i) {
-      result = factory->NewTurbofanUnionType(
-          result, union_type->Get(i).AllocateOnHeap(factory),
-          AllocationType::kYoung);
-    }
-    return result;
-  } else if (IsHeapConstant()) {
-    return factory->NewTurbofanHeapConstantType(AsHeapConstant()->Value(),
-                                                AllocationType::kYoung);
-  } else if (IsOtherNumberConstant()) {
-    return factory->NewTurbofanOtherNumberConstantType(
-        AsOtherNumberConstant()->Value(), AllocationType::kYoung);
-  } else if (IsRange()) {
-    return factory->NewTurbofanRangeType(AsRange()->Min(), AsRange()->Max(),
-                                         AllocationType::kYoung);
-  } else {
-    // Other types are not supported for type assertions.
-    UNREACHABLE();
-  }
-}
-
-#define VERIFY_TORQUE_BITSET_AGREEMENT(Name, _) \
-  STATIC_ASSERT(BitsetType::k##Name == TurbofanTypeBits::k##Name);
-INTERNAL_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT)
-PROPER_ATOMIC_BITSET_TYPE_LIST(VERIFY_TORQUE_BITSET_AGREEMENT)
-#undef VERIFY_TORQUE_BITSET_AGREEMENT
-
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8

src/compiler/types.h

@@ -102,7 +102,8 @@ namespace compiler {
   V(OtherNumber,     1u << 4)  \
   V(OtherString,     1u << 5)  \
 
-#define PROPER_ATOMIC_BITSET_TYPE_LIST(V) \
+#define PROPER_BITSET_TYPE_LIST(V) \
+  V(None,                     0u)        \
   V(Negative31,               1u << 6)   \
   V(Null,                     1u << 7)   \
   V(Undefined,                1u << 8)   \
@@ -130,10 +131,7 @@ namespace compiler {
   /* TODO(v8:10391): Remove this type once all ExternalPointer usages are */ \
   /* sandbox-ready. */                   \
   V(SandboxedExternalPointer, 1u << 31)  \
-
-#define PROPER_BITSET_TYPE_LIST(V) \
-  V(None,                     0u) \
-  PROPER_ATOMIC_BITSET_TYPE_LIST(V) \
+  \
   V(Signed31,                     kUnsigned30 | kNegative31) \
   V(Signed32,                     kSigned31 | kOtherUnsigned31 | \
                                   kOtherSigned32) \
@@ -418,8 +416,9 @@ class V8_EXPORT_PRIVATE Type {
            (Is(Type::PlainNumber()) && Min() == Max());
   }
 
-  bool CanBeAsserted() const { return Is(Type::NonInternal()); }
-  Handle<TurbofanType> AllocateOnHeap(Factory* factory);
+  bool CanBeAsserted() const {
+    return IsRange() || (Is(Type::Integral32()) && !IsNone());
+  }
 
   const HeapConstantType* AsHeapConstant() const;
   const OtherNumberConstantType* AsOtherNumberConstant() const;

src/compiler/verifier.cc

@@ -693,7 +693,7 @@ void Verifier::Visitor::Check(Node* node, const AllNodes& all) {
       CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateKeyValueArray:
-      CheckTypeIs(node, Type::Array());
+      CheckTypeIs(node, Type::OtherObject());
       break;
     case IrOpcode::kJSCreateObject:
       CheckTypeIs(node, Type::OtherObject());

src/diagnostics/objects-debug.cc

@@ -33,7 +33,6 @@
 #include "src/objects/js-array-inl.h"
 #include "src/objects/objects-inl.h"
 #include "src/objects/objects.h"
-#include "src/objects/turbofan-types-inl.h"
 #include "src/roots/roots.h"
 #ifdef V8_INTL_SUPPORT
 #include "src/objects/js-break-iterator-inl.h"

src/flags/flag-definitions.h

@@ -549,9 +549,6 @@ DEFINE_NEG_IMPLICATION(jitless, interpreted_frames_native_stack)
 
 DEFINE_BOOL(assert_types, false,
             "generate runtime type assertions to test the typer")
-// TODO(tebbi): Support allocating types from background thread.
-DEFINE_NEG_IMPLICATION(assert_types, concurrent_recompilation)
-DEFINE_NEG_IMPLICATION(assert_types, concurrent_inlining)
 
 DEFINE_BOOL(trace_compilation_dependencies, false, "trace code dependencies")
 // Depend on --trace-deopt-verbose for reporting dependency invalidations.

src/heap/factory.cc

@@ -3119,15 +3119,10 @@ Handle<String> Factory::HeapNumberToString(Handle<HeapNumber> number,
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  Handle<String> result;
-  if (value == 0) {
-    result = zero_string();
-  } else {
-    char arr[kNumberToStringBufferSize];
-    base::Vector<char> buffer(arr, arraysize(arr));
-    const char* string = DoubleToCString(value, buffer);
-    result = CharToString(this, string, mode);
-  }
+  char arr[kNumberToStringBufferSize];
+  base::Vector<char> buffer(arr, arraysize(arr));
+  const char* string = DoubleToCString(value, buffer);
+  Handle<String> result = CharToString(this, string, mode);
   if (mode != NumberCacheMode::kIgnore) {
     NumberToStringCacheSet(number, hash, result);
   }
@@ -3141,15 +3136,10 @@ inline Handle<String> Factory::SmiToString(Smi number, NumberCacheMode mode) {
     if (!cached->IsUndefined(isolate())) return Handle<String>::cast(cached);
   }
 
-  Handle<String> result;
-  if (number == Smi::zero()) {
-    result = zero_string();
-  } else {
-    char arr[kNumberToStringBufferSize];
-    base::Vector<char> buffer(arr, arraysize(arr));
-    const char* string = IntToCString(number.value(), buffer);
-    result = CharToString(this, string, mode);
-  }
+  char arr[kNumberToStringBufferSize];
+  base::Vector<char> buffer(arr, arraysize(arr));
+  const char* string = IntToCString(number.value(), buffer);
+  Handle<String> result = CharToString(this, string, mode);
   if (mode != NumberCacheMode::kIgnore) {
     NumberToStringCacheSet(handle(number, isolate()), hash, result);
   }

src/heap/setup-heap-internal.cc

@@ -42,7 +42,6 @@
 #include "src/objects/synthetic-module.h"
 #include "src/objects/template-objects-inl.h"
 #include "src/objects/torque-defined-classes-inl.h"
-#include "src/objects/turbofan-types.h"
 #include "src/regexp/regexp.h"
 
 #if V8_ENABLE_WEBASSEMBLY

src/objects/map.tq

@@ -52,10 +52,6 @@ extern class Map extends HeapObject {
     }
   }
 
-  macro IsUndetectable(): bool {
-    return this.bit_field.is_undetectable;
-  }
-
   instance_size_in_words: uint8;
   inobject_properties_start_or_constructor_function_index: uint8;
   used_or_unused_instance_size_in_words: uint8;

src/objects/objects-body-descriptors-inl.h

@@ -24,7 +24,6 @@
 #include "src/objects/synthetic-module.h"
 #include "src/objects/torque-defined-classes-inl.h"
 #include "src/objects/transitions.h"
-#include "src/objects/turbofan-types-inl.h"
 
 #if V8_ENABLE_WEBASSEMBLY
 #include "src/wasm/wasm-objects-inl.h"

src/objects/string.tq

@@ -12,10 +12,6 @@ extern class String extends Name {
         Convert<uint16>(this.map.instance_type));
   }
 
-  macro IsNotInternalized(): bool {
-    return this.StringInstanceType().is_not_internalized;
-  }
-
   const length: int32;
 }
 

src/objects/turbofan-types-inl.h

-// Copyright 2021 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_OBJECTS_TURBOFAN_TYPES_INL_H_
-#define V8_OBJECTS_TURBOFAN_TYPES_INL_H_
-
-#include "src/heap/heap-write-barrier.h"
-#include "src/objects/turbofan-types.h"
-
-// Has to be the last include (doesn't have include guards):
-#include "src/objects/object-macros.h"
-
-namespace v8 {
-namespace internal {
-
-#include "torque-generated/src/objects/turbofan-types-tq-inl.inc"
-
-}  // namespace internal
-}  // namespace v8
-
-#include "src/objects/object-macros-undef.h"
-
-#endif  // V8_OBJECTS_TURBOFAN_TYPES_INL_H_

src/objects/turbofan-types.h

-// Copyright 2021 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#ifndef V8_OBJECTS_TURBOFAN_TYPES_H_
-#define V8_OBJECTS_TURBOFAN_TYPES_H_
-
-#include "src/common/globals.h"
-#include "src/objects/heap-object.h"
-#include "torque-generated/bit-fields.h"
-
-// Has to be the last include (doesn't have include guards):
-#include "src/objects/object-macros.h"
-
-namespace v8 {
-namespace internal {
-
-#include "torque-generated/src/objects/turbofan-types-tq.inc"
-
-class TurbofanTypeBits {
- public:
-  DEFINE_TORQUE_GENERATED_TURBOFAN_TYPE_BITS()
-};
-
-}  // namespace internal
-}  // namespace v8
-
-#include "src/objects/object-macros-undef.h"
-
-#endif  // V8_OBJECTS_TURBOFAN_TYPES_H_

src/objects/turbofan-types.tq

-// Copyright 2021 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "src/objects/turbofan-types.h"
-
-@export
-@abstract
-class TurbofanType extends HeapObject {
-}
-
-bitfield struct TurbofanTypeBits extends uint32 {
-  _unused_padding_field_1: bool: 1 bit;
-  other_unsigned31: bool: 1 bit;
-  other_unsigned32: bool: 1 bit;
-  other_signed32: bool: 1 bit;
-  other_number: bool: 1 bit;
-  other_string: bool: 1 bit;
-  negative31: bool: 1 bit;
-  null: bool: 1 bit;
-  undefined: bool: 1 bit;
-  boolean: bool: 1 bit;
-  unsigned30: bool: 1 bit;
-  minus_zero: bool: 1 bit;
-  naN: bool: 1 bit;
-  symbol: bool: 1 bit;
-  internalized_string: bool: 1 bit;
-  _unused_padding_field_2: bool: 1 bit;
-  other_callable: bool: 1 bit;
-  other_object: bool: 1 bit;
-  other_undetectable: bool: 1 bit;
-  callable_proxy: bool: 1 bit;
-  other_proxy: bool: 1 bit;
-  function: bool: 1 bit;
-  bound_function: bool: 1 bit;
-  hole: bool: 1 bit;
-  other_internal: bool: 1 bit;
-  external_pointer: bool: 1 bit;
-  array: bool: 1 bit;
-  unsigned_big_int_63: bool: 1 bit;
-  other_unsigned_big_int_64: bool: 1 bit;
-  negative_big_int_63: bool: 1 bit;
-  other_big_int: bool: 1 bit;
-  sandboxed_external_pointer: bool: 1 bit;
-}
-
-@export
-class TurbofanBitsetType extends TurbofanType {
-  bitset: TurbofanTypeBits;
-}
-
-@export
-class TurbofanUnionType extends TurbofanType {
-  type1: TurbofanType;
-  type2: TurbofanType;
-}
-
-@export
-class TurbofanRangeType extends TurbofanType {
-  min: float64;
-  max: float64;
-}
-
-@export
-class TurbofanHeapConstantType extends TurbofanType {
-  constant: HeapObject;
-}
-
-@export
-class TurbofanOtherNumberConstantType extends TurbofanType {
-  constant: float64;
-}
-
-macro IsMinusZero(x: float64): bool {
-  return x == 0 && 1 / x < 0;
-}
-
-macro TestTurbofanBitsetType(value: Object, bitset: TurbofanTypeBits): bool {
-  typeswitch (value) {
-    case (value: Number): {
-      const valueF = Convert<float64>(value);
-      if (IsInteger(value)) {
-        if (IsMinusZero(valueF)) {
-          return bitset.minus_zero;
-        } else if (valueF < Convert<float64>(-0x80000000)) {
-          return bitset.other_number;
-        } else if (valueF < -0x40000000) {
-          return bitset.other_signed32;
-        } else if (valueF < 0) {
-          return bitset.negative31;
-        } else if (valueF < Convert<float64>(0x40000000)) {
-          return bitset.unsigned30;
-        } else if (valueF < 0x80000000) {
-          return bitset.other_unsigned31;
-        } else if (valueF <= 0xffffffff) {
-          return bitset.other_unsigned32;
-        } else {
-          return bitset.other_number;
-        }
-      } else if (Float64IsNaN(valueF)) {
-        return bitset.naN;
-      } else {
-        return bitset.other_number;
-      }
-    }
-    case (Null): {
-      return bitset.null;
-    }
-    case (Undefined): {
-      return bitset.undefined;
-    }
-    case (Boolean): {
-      return bitset.boolean;
-    }
-    case (Symbol): {
-      return bitset.symbol;
-    }
-    case (s: String): {
-      if (s.IsNotInternalized()) {
-        return bitset.other_string;
-      } else {
-        return bitset.internalized_string;
-      }
-    }
-    case (proxy: JSProxy): {
-      return Is<Callable>(proxy) ? bitset.callable_proxy : bitset.other_proxy;
-    }
-    case (JSFunction): {
-      return bitset.function;
-    }
-    case (JSBoundFunction): {
-      return bitset.bound_function;
-    }
-    case (TheHole): {
-      return bitset.hole;
-    }
-    case (JSArray): {
-      return bitset.array;
-    }
-    case (BigInt): {
-      // TODO (tebbi): Distinguish different BigInt types.
-      return bitset.unsigned_big_int_63 | bitset.other_unsigned_big_int_64 |
-          bitset.negative_big_int_63 | bitset.other_big_int;
-    }
-    case (Callable): {
-      return bitset.other_callable;
-    }
-    case (object: JSObject): {
-      if (object.map.IsUndetectable()) {
-        return bitset.other_undetectable;
-      } else {
-        return bitset.other_object;
-      }
-    }
-    case (Object): {
-      return false;
-    }
-  }
-}
-
-builtin TestTurbofanType(implicit context: Context)(
-    value: Object, expectedType: TurbofanType): Boolean {
-  typeswitch (expectedType) {
-    case (t: TurbofanBitsetType): {
-      return Convert<Boolean>(TestTurbofanBitsetType(value, t.bitset));
-    }
-    case (t: TurbofanUnionType): {
-      return Convert<Boolean>(
-          TestTurbofanType(value, t.type1) == True ||
-          TestTurbofanType(value, t.type2) == True);
-    }
-    case (t: TurbofanRangeType): {
-      const value = Cast<Number>(value) otherwise return False;
-      if (!IsIntegerOrSomeInfinity(value)) return False;
-      const valueF = Convert<float64>(value);
-      return Convert<Boolean>(
-          !IsMinusZero(valueF) && t.min <= valueF && valueF <= t.max);
-    }
-    case (t: TurbofanHeapConstantType): {
-      return Convert<Boolean>(TaggedEqual(value, t.constant));
-    }
-    case (t: TurbofanOtherNumberConstantType): {
-      const value =
-          Convert<float64>(Cast<Number>(value) otherwise return False);
-      return Convert<Boolean>(value == t.constant);
-    }
-    case (TurbofanType): {
-      unreachable;
-    }
-  }
-}
-
-builtin CheckTurbofanType(implicit context: Context)(
-    value: Object, expectedType: TurbofanType, nodeId: Smi): Undefined {
-  if (TestTurbofanType(value, expectedType) == True) {
-    return Undefined;
-  }
-
-  Print('Type assertion failed! (value/expectedType/nodeId)');
-  Print(value);
-  Print(expectedType);
-  Print(nodeId);
-  unreachable;
-}

src/torque/declarations.cc

@@ -202,12 +202,9 @@ Macro* Declarations::DeclareMacro(
     base::Optional<std::string> external_assembler_name,
     const Signature& signature, base::Optional<Statement*> body,
     base::Optional<std::string> op, bool is_user_defined) {
-  if (Macro* existing_macro =
-          TryLookupMacro(name, signature.GetExplicitTypes())) {
-    if (existing_macro->ParentScope() == CurrentScope::Get()) {
-      ReportError("cannot redeclare macro ", name,
-                  " with identical explicit parameters");
-    }
+  if (TryLookupMacro(name, signature.GetExplicitTypes())) {
+    ReportError("cannot redeclare macro ", name,
+                " with identical explicit parameters");
   }
   Macro* macro;
   if (external_assembler_name) {

src/torque/implementation-visitor.cc

@@ -4205,16 +4205,13 @@ void CppClassGenerator::GenerateClass() {
 }
 
 void CppClassGenerator::GenerateClassCasts() {
-  cpp::Class owner({cpp::TemplateParameter("D"), cpp::TemplateParameter("P")},
-                   gen_name_);
-  cpp::Function f(&owner, "cast");
+  cpp::Function f("cast");
   f.SetFlags(cpp::Function::kV8Inline | cpp::Function::kStatic);
   f.SetReturnType("D");
   f.AddParameter("Object", "object");
 
   // V8_INLINE static D cast(Object)
-  f.PrintDeclaration(hdr_);
-  f.PrintDefinition(inl_, [](std::ostream& stream) {
+  f.PrintInlineDefinition(hdr_, [](std::ostream& stream) {
     stream << "    return D(object.ptr());\n";
   });
   // V8_INLINE static D unchecked_cast(Object)
@@ -4734,10 +4731,9 @@ void ImplementationVisitor::GenerateClassDefinitions(
         factory_impl << "  HeapObject result =\n";
         factory_impl << "    factory()->AllocateRawWithImmortalMap(size, "
                         "allocation_type, map);\n";
-        factory_impl << "  WriteBarrierMode write_barrier_mode =\n"
-                     << "     allocation_type == AllocationType::kYoung\n"
-                     << "     ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n"
-                     << "  USE(write_barrier_mode);\n";
+        factory_impl << "    WriteBarrierMode write_barrier_mode =\n"
+                     << "       allocation_type == AllocationType::kYoung\n"
+                     << "       ? SKIP_WRITE_BARRIER : UPDATE_WRITE_BARRIER;\n";
         factory_impl << "  " << type->HandlifiedCppTypeName()
                      << " result_handle(" << type->name()
                      << "::cast(result), factory()->isolate());\n";
@@ -5284,9 +5280,32 @@ void ImplementationVisitor::GenerateExportedMacrosAssembler(
     h_contents << "#include \"src/compiler/code-assembler.h\"\n";
     h_contents << "#include \"src/execution/frames.h\"\n";
     h_contents << "#include \"torque-generated/csa-types.h\"\n";
-
-    for (const std::string& include_path : GlobalContext::CppIncludes()) {
-      cc_contents << "#include " << StringLiteralQuote(include_path) << "\n";
+    cc_contents << "#include \"src/objects/fixed-array-inl.h\"\n";
+    cc_contents << "#include \"src/objects/free-space.h\"\n";
+    cc_contents << "#include \"src/objects/js-regexp-string-iterator.h\"\n";
+    cc_contents << "#include \"src/objects/js-temporal-objects.h\"\n";
+    cc_contents << "#include \"src/objects/js-weak-refs.h\"\n";
+    cc_contents << "#include \"src/objects/ordered-hash-table.h\"\n";
+    cc_contents << "#include \"src/objects/property-descriptor-object.h\"\n";
+    cc_contents << "#include \"src/objects/stack-frame-info.h\"\n";
+    cc_contents << "#include \"src/objects/swiss-name-dictionary.h\"\n";
+    cc_contents << "#include \"src/objects/synthetic-module.h\"\n";
+    cc_contents << "#include \"src/objects/template-objects.h\"\n";
+    cc_contents << "#include \"src/objects/torque-defined-classes.h\"\n";
+    {
+      IfDefScope intl_scope(cc_contents, "V8_INTL_SUPPORT");
+      cc_contents << "#include \"src/objects/js-break-iterator.h\"\n";
+      cc_contents << "#include \"src/objects/js-collator.h\"\n";
+      cc_contents << "#include \"src/objects/js-date-time-format.h\"\n";
+      cc_contents << "#include \"src/objects/js-display-names.h\"\n";
+      cc_contents << "#include \"src/objects/js-list-format.h\"\n";
+      cc_contents << "#include \"src/objects/js-locale.h\"\n";
+      cc_contents << "#include \"src/objects/js-number-format.h\"\n";
+      cc_contents << "#include \"src/objects/js-plural-rules.h\"\n";
+      cc_contents << "#include \"src/objects/js-relative-time-format.h\"\n";
+      cc_contents << "#include \"src/objects/js-segment-iterator.h\"\n";
+      cc_contents << "#include \"src/objects/js-segmenter.h\"\n";
+      cc_contents << "#include \"src/objects/js-segments.h\"\n";
     }
     cc_contents << "#include \"torque-generated/" << file_name << ".h\"\n";
 

src/torque/types.cc

@@ -1137,8 +1137,8 @@ std::tuple<size_t, std::string> Field::GetFieldSizeInformation() const {
     return *optional;
   }
   Error("fields of type ", *name_and_type.type, " are not (yet) supported")
-      .Position(pos)
-      .Throw();
+      .Position(pos);
+  return std::make_tuple(0, "#no size");
 }
 
 size_t Type::AlignmentLog2() const {

test/cctest/cctest.status

@@ -1241,18 +1241,4 @@
   'test-streaming-compilation/AsyncTestIncrementalCaching': [SKIP],
   'test-streaming-compilation/SingleThreadedTestIncrementalCaching': [SKIP],
 }],
-
-##############################################################################
-['variant == assert_types', {
-  # Type assertions add strong pointers, breaking these test.
-  'test-heap/ObjectsInOptimizedCodeAreWeak': [SKIP],
-  'test-heap/ObjectsInEagerlyDeoptimizedCodeAreWeak': [SKIP],
-  'test-heap/NewSpaceObjectsInOptimizedCode': [SKIP],
-  'test-heap/LeakNativeContextViaMapKeyed': [SKIP],
-  'test-heap/CellsInOptimizedCodeAreWeak': [SKIP],
-  # Type assertions only work without concurrent compilation, but this test
-  # always triggers a concurrent compilation.
-  'test-concurrent-shared-function-info/TestConcurrentSharedFunctionInfo': [SKIP],
-}],  # variant == assert_types
-
 ]

test/mjsunit/compiler/diamond-followedby-branch.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-assert-types
+// Flags: --allow-natives-syntax
 
 // Check that the branch elimination replace the redundant branch condition with
 // a phi node, and then the branch is folded in EffectControlLinearizationPhase.

test/mjsunit/compiler/number-ceil.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-assert-types
+// Flags: --allow-natives-syntax --opt
 
 // Test that NumberCeil propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-comparison-truncations.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --turbo-inlining --no-assert-types
+// Flags: --allow-natives-syntax --opt --turbo-inlining
 
 // Test that SpeculativeNumberEqual[SignedSmall] properly passes the
 // kIdentifyZeros truncation.

test/mjsunit/compiler/number-floor.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-assert-types
+// Flags: --allow-natives-syntax --opt
 
 // Test that NumberFloor propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-max.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-assert-types
+// Flags: --allow-natives-syntax --opt
 
 // Test that NumberMax properly passes the kIdentifyZeros truncation.
 (function() {

test/mjsunit/compiler/number-min.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-assert-types
+// Flags: --allow-natives-syntax --opt
 
 // Test that NumberMin properly passes the kIdentifyZeros truncation.
 (function() {

test/mjsunit/compiler/number-modulus.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
+// Flags: --allow-natives-syntax --opt --noalways-opt
 
 
 // Test that NumberModulus passes kIdentifiesZero to the

test/mjsunit/compiler/number-round.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-assert-types
+// Flags: --allow-natives-syntax --opt
 
 // Test that NumberRound propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/number-trunc.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --opt --no-assert-types
+// Flags: --allow-natives-syntax --opt
 
 // Test that NumberTrunc propagates kIdentifyZeros truncations.
 (function() {

test/mjsunit/compiler/verify-type.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt --no-concurrent-recompilation
+// Flags: --allow-natives-syntax --no-stress-opt --no-always-opt
 
 function foo(x) {
   return %VerifyType(x * x);

test/mjsunit/getters-on-elements.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --noalways-opt --opt --no-assert-types
+// Flags: --allow-natives-syntax --noalways-opt --opt
 
 // It's nice to run this in other browsers too.
 var standalone = false;

test/mjsunit/regress/regress-2132.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
+// Flags: --allow-natives-syntax --opt --no-always-opt
 
 function mul(x, y) {
   return (x * y) | 0;

test/mjsunit/shift-for-integer-div.js

@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --opt --no-always-opt --no-assert-types
+// Flags: --allow-natives-syntax --opt --no-always-opt
 
 function divp4(x) {
   return x / 4;

tools/testrunner/local/variants.py

@@ -62,8 +62,7 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = {
   "slow_path": ["--no-force-slow-path"],
   "stress_concurrent_allocation": ["--single-threaded-gc", "--predictable"],
   "stress_concurrent_inlining": ["--single-threaded", "--predictable",
-                                 "--turboprop", "--lazy-feedback-allocation",
-                                 "--assert-types"],
+                                 "--turboprop", "--lazy-feedback-allocation"],
   "turboprop": ["--stress_concurrent_inlining"],
   # The fast API tests initialize an embedder object that never needs to be
   # serialized to the snapshot, so we don't have a
@@ -82,7 +81,6 @@ INCOMPATIBLE_FLAGS_PER_VARIANT = {
   # There is a negative implication: --perf-prof disables
   # --wasm-write-protect-code-memory.
   "wasm_write_protect_code": ["--perf-prof"],
-  "assert_types": ["--concurrent-recompilation", "--concurrent-inlining", "--stress_concurrent_inlining", "--no-assert-types"],
 }
 
 # Flags that lead to a contradiction under certain build variables.