[csa] Add assertions to CSA

This adds a bunch of assertions to CSA, mostly about documenting and checking
parameter types.

Drive-by-change: Removed unused function.

BUG=v8:6325

Review-Url: https://codereview.chromium.org/2847923003
Cr-Original-Original-Commit-Position: refs/heads/master@{#45398}
Committed: https://chromium.googlesource.com/v8/v8/+/b14a981496ad1f841683479d2f9188dfa2d6b4bd
Review-Url: https://codereview.chromium.org/2847923003
Cr-Original-Commit-Position: refs/heads/master@{#45443}
Committed: https://chromium.googlesource.com/v8/v8/+/62b0de1ef53816d6dae3fa519a846f942b701dda
Review-Url: https://codereview.chromium.org/2847923003
Cr-Commit-Position: refs/heads/master@{#45607}

src/code-stub-assembler.h

@@ -41,6 +41,7 @@ enum class PrimitiveType { kBoolean, kNumber, kString, kSymbol };
   V(HeapNumberMap, HeapNumberMap)                     \
   V(length_string, LengthString)                      \
   V(ManyClosuresCellMap, ManyClosuresCellMap)         \
+  V(MetaMap, MetaMap)                                 \
   V(MinusZeroValue, MinusZero)                        \
   V(MutableHeapNumberMap, MutableHeapNumberMap)       \
   V(NanValue, Nan)                                    \
@@ -117,6 +118,8 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
     return value;
   }
 
+  Node* MatchesParameterMode(Node* value, ParameterMode mode);
+
 #define PARAMETER_BINOP(OpName, IntPtrOpName, SmiOpName) \
   Node* OpName(Node* a, Node* b, ParameterMode mode) {   \
     if (mode == SMI_PARAMETERS) {                        \
@@ -776,6 +779,7 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsPropertyCell(Node* object);
   Node* IsAccessorInfo(Node* object);
   Node* IsAccessorPair(Node* object);
+  Node* IsAnyHeapNumber(Node* object);
   Node* IsHeapNumber(Node* object);
   Node* IsMutableHeapNumber(Node* object);
   Node* IsName(Node* object);
@@ -788,6 +792,9 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* IsJSArrayInstanceType(Node* instance_type);
   Node* IsJSArray(Node* object);
   Node* IsJSArrayMap(Node* object);
+  Node* IsFixedArray(Node* object);
+  Node* IsFixedArrayWithKindOrEmpty(Node* object, ElementsKind kind);
+  Node* IsFixedArrayWithKind(Node* object, ElementsKind kind);
   Node* IsNativeContext(Node* object);
   Node* IsWeakCell(Node* object);
   Node* IsFixedDoubleArray(Node* object);
@@ -838,16 +845,6 @@ class V8_EXPORT_PRIVATE CodeStubAssembler : public compiler::CodeAssembler {
   Node* StringAdd(Node* context, Node* first, Node* second,
                   AllocationFlags flags = kNone);
 
-  // Unpack the external string, returning a pointer that (offset-wise) looks
-  // like a sequential string.
-  // Note that this pointer is not tagged and does not point to a real
-  // sequential string instance, and may only be used to access the string
-  // data. The pointer is GC-safe as long as a reference to the container
-  // ExternalString is live.
-  // |string| must be an external string. Bailout for short external strings.
-  Node* TryDerefExternalString(Node* const string, Node* const instance_type,
-                               Label* if_bailout);
-
   // Check if |string| is an indirect (thin or flat cons) string type that can
   // be dereferenced by DerefIndirectString.
   void BranchIfCanDerefIndirectString(Node* string, Node* instance_type,

test/mjsunit/mjsunit.status

@@ -625,6 +625,10 @@
   # Slow tests.
   'ignition/regress-599001-verifyheap': [SKIP],
   'regress/regress-2185-2': [SKIP],
+
+  # Crankshaft bug, wrong elements kind: crbug.com/v8/6342
+  'regress/regress-2671': [SKIP],
+  'regress/regress-2671-1': [SKIP],
 }],  # variant == noturbofan_stress
 
 ##############################################################################