[torque] Address remaining usages of @noVerifier in base.tq

For every @noVerifier in base.tq, this change either removes it or
ensures that it has some annotation explaining why it can't be removed.
The @noVerifier usages that can't be removed fall into the following
categories:
1. Classes that don't have their own instance types and therefore have
   no meaningful way to do an Is...() check
2. Fields that might not exist
3. Fields that are waiting for MaybeObject support in Torque

Bug: v8:9311
Change-Id: Id452d4151ec07347ae96a9b5f3b26e2ac8065d31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1659134Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62263}

src/builtins/array-join.tq

@@ -37,7 +37,7 @@ namespace array_join {
     const array: JSArray = UnsafeCast<JSArray>(receiver);
     const fixedArray: FixedArray = UnsafeCast<FixedArray>(array.elements);
     const element: Object = fixedArray.objects[UnsafeCast<Smi>(k)];
-    return element == Hole ? kEmptyString : element;
+    return element == TheHole ? kEmptyString : element;
   }
 
   LoadJoinElement<array::FastDoubleElements>(
@@ -448,7 +448,7 @@ namespace array_join {
       const previouslyVisited: Object = stack.objects[i];
 
       // Add `receiver` to the first open slot
-      if (previouslyVisited == Hole) {
+      if (previouslyVisited == TheHole) {
         stack.objects[i] = receiver;
         return True;
       }
@@ -473,7 +473,7 @@ namespace array_join {
     try {
       const stack: FixedArray = LoadJoinStack()
           otherwise IfUninitialized;
-      if (stack.objects[0] == Hole) {
+      if (stack.objects[0] == TheHole) {
         stack.objects[0] = receiver;
       } else if (JoinStackPush(stack, receiver) == False)
         deferred {
@@ -504,7 +504,7 @@ namespace array_join {
             SetJoinStack(newStack);
           }
         else {
-          stack.objects[i] = Hole;
+          stack.objects[i] = TheHole;
         }
         return Undefined;
       }
@@ -521,7 +521,7 @@ namespace array_join {
     // Builtin call was not nested (receiver is the first entry) and
     // did not contain other nested arrays that expanded the stack.
     if (stack.objects[0] == receiver && len == kMinJoinStackSize) {
-      StoreFixedArrayElement(stack, 0, Hole, SKIP_WRITE_BARRIER);
+      StoreFixedArrayElement(stack, 0, TheHole, SKIP_WRITE_BARRIER);
     } else
       deferred {
         JoinStackPop(stack, receiver);

src/builtins/array-lastindexof.tq

@@ -12,7 +12,7 @@ namespace array_lastindexof {
       labels IfHole {
     const elements: FixedArray = UnsafeCast<FixedArray>(elements);
     const element: Object = elements.objects[index];
-    if (element == Hole) goto IfHole;
+    if (element == TheHole) goto IfHole;
     return element;
   }
 

src/builtins/array-map.tq

@@ -132,7 +132,7 @@ namespace array_map {
               elements.floats[i] = Convert<float64>(n);
             }
             case (h: HeapObject): {
-              assert(h == Hole);
+              assert(h == TheHole);
             }
           }
         }

src/builtins/array-reduce-right.tq

@@ -22,7 +22,7 @@ namespace array {
     // the hole. The continuation stub will search for the initial non-hole
     // element, rightly throwing an exception if not found.
     return ArrayReduceRightLoopContinuation(
-        jsreceiver, callbackfn, Hole, jsreceiver, 0, numberLength);
+        jsreceiver, callbackfn, TheHole, jsreceiver, 0, numberLength);
   }
 
   transitioning javascript builtin
@@ -85,7 +85,7 @@ namespace array {
         // 8b iii and 9c i. Let kValue be ? Get(O, Pk).
         const value: Object = GetProperty(o, k);
 
-        if (accumulator == Hole) {
+        if (accumulator == TheHole) {
           // 8b iii 1.
           accumulator = value;
         } else {
@@ -102,7 +102,7 @@ namespace array {
     // 8c. if kPresent is false, throw a TypeError exception.
     // If the accumulator is discovered with the sentinel hole value,
     // this means kPresent is false.
-    if (accumulator == Hole) {
+    if (accumulator == TheHole) {
       ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
     }
     return accumulator;
@@ -126,7 +126,7 @@ namespace array {
       if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
 
       const value: Object = fastOW.LoadElementNoHole(k) otherwise continue;
-      if (accumulator == Hole) {
+      if (accumulator == TheHole) {
         accumulator = value;
       } else {
         accumulator = Call(
@@ -134,7 +134,7 @@ namespace array {
             fastOW.Get());
       }
     }
-    if (accumulator == Hole) {
+    if (accumulator == TheHole) {
       ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduceRight');
     }
     return accumulator;
@@ -165,7 +165,8 @@ namespace array {
       // exception. (This case is handled at the end of
       // ArrayReduceRightLoopContinuation).
 
-      const initialValue: Object = arguments.length > 1 ? arguments[1] : Hole;
+      const initialValue: Object =
+          arguments.length > 1 ? arguments[1] : TheHole;
 
       try {
         return FastArrayReduceRight(o, len, callbackfn, initialValue)

src/builtins/array-reduce.tq

@@ -22,7 +22,7 @@ namespace array {
     // the hole. The continuation stub will search for the initial non-hole
     // element, rightly throwing an exception if not found.
     return ArrayReduceLoopContinuation(
-        jsreceiver, callbackfn, Hole, jsreceiver, 0, numberLength);
+        jsreceiver, callbackfn, TheHole, jsreceiver, 0, numberLength);
   }
 
   transitioning javascript builtin
@@ -84,7 +84,7 @@ namespace array {
         // 6c. i. Let kValue be ? Get(O, Pk).
         const value: Object = GetProperty(o, k);
 
-        if (accumulator == Hole) {
+        if (accumulator == TheHole) {
           // 8b.
           accumulator = value;
         } else {
@@ -101,7 +101,7 @@ namespace array {
     // 8c. if kPresent is false, throw a TypeError exception.
     // If the accumulator is discovered with the sentinel hole value,
     // this means kPresent is false.
-    if (accumulator == Hole) {
+    if (accumulator == TheHole) {
       ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
     }
     return accumulator;
@@ -126,7 +126,7 @@ namespace array {
       if (k >= fastOW.Get().length) goto Bailout(k, accumulator);
 
       const value: Object = fastOW.LoadElementNoHole(k) otherwise continue;
-      if (accumulator == Hole) {
+      if (accumulator == TheHole) {
         accumulator = value;
       } else {
         accumulator = Call(
@@ -134,7 +134,7 @@ namespace array {
             fastOW.Get());
       }
     }
-    if (accumulator == Hole) {
+    if (accumulator == TheHole) {
       ThrowTypeError(kReduceNoInitial, 'Array.prototype.reduce');
     }
     return accumulator;
@@ -165,7 +165,8 @@ namespace array {
       // exception. (This case is handled at the end of
       // ArrayReduceLoopContinuation).
 
-      const initialValue: Object = arguments.length > 1 ? arguments[1] : Hole;
+      const initialValue: Object =
+          arguments.length > 1 ? arguments[1] : TheHole;
 
       try {
         return FastArrayReduce(o, len, callbackfn, initialValue)

src/builtins/array-slice.tq

@@ -63,7 +63,7 @@ namespace array_slice {
     for (let current: Smi = start; current < to; ++current) {
       const e: Object =
           sloppyElements.objects[current + kSloppyArgumentsParameterMapStart];
-      const newElement: Object = e != Hole ?
+      const newElement: Object = e != TheHole ?
           argumentsContext[UnsafeCast<Smi>(e)] :
           unmappedElements.objects[current];
       // It is safe to skip the write barrier here because resultElements was

src/builtins/array.tq

@@ -45,7 +45,7 @@ namespace array {
 
   macro LoadElementOrUndefined(a: FixedArray, i: Smi): Object {
     const e: Object = a.objects[i];
-    return e == Hole ? Undefined : e;
+    return e == TheHole ? Undefined : e;
   }
 
   macro LoadElementOrUndefined(a: FixedDoubleArray, i: Smi): NumberOrUndefined {
@@ -63,7 +63,7 @@ namespace array {
   }
 
   macro StoreArrayHole(elements: FixedArray, k: Smi): void {
-    elements.objects[k] = Hole;
+    elements.objects[k] = TheHole;
   }
 
   extern macro SetPropertyLength(implicit context: Context)(Object, Number);

src/builtins/base.tq

@@ -32,6 +32,9 @@ type PositiveSmi extends Smi;
 // The Smi value zero, which is often used as null for HeapObject types.
 type Zero extends PositiveSmi;
 
+// A value with the size of Tagged which may contain arbitrary data.
+type Uninitialized extends Tagged;
+
 @abstract
 extern class HeapObject extends Tagged {
   map: Map;
@@ -210,6 +213,8 @@ extern class Map extends HeapObject {
   @ifnot(V8_DOUBLE_FIELDS_UNBOXING) layout_descriptor: void;
   dependent_code: DependentCode;
   prototype_validity_cell: Smi | Cell;
+  // TODO(v8:9108): Misusing "weak" keyword; type should be
+  //     Map | Weak<Map> | TransitionArray | PrototypeInfo | Smi.
   weak transitions_or_prototype_info: Map | TransitionArray |
       PrototypeInfo | Smi;
 }
@@ -276,9 +281,8 @@ intrinsic
 }
 
 @abstract
-@noVerifier
 extern class JSReceiver extends HeapObject {
-  properties_or_hash: FixedArrayBase | Smi;
+  properties_or_hash: FixedArrayBase | PropertyArray | Smi;
 }
 
 type Constructor extends JSReceiver;
@@ -286,7 +290,7 @@ type Constructor extends JSReceiver;
 @abstract
 @dirtyInstantiatedAbstractClass
 extern class JSObject extends JSReceiver {
-  @noVerifier elements: FixedArrayBase;
+  elements: FixedArrayBase;
 }
 
 macro NewJSObject(implicit context: Context)(): JSObject {
@@ -332,6 +336,8 @@ extern class JSFunction extends JSObject {
   context: Context;
   feedback_cell: FeedbackCell;
   weak code: Code;
+
+  // Space for the following field may or may not be allocated.
   @noVerifier weak prototype_or_initial_map: JSReceiver | Map;
 }
 
@@ -377,6 +383,7 @@ extern class JSSloppyArgumentsObject extends JSArgumentsObjectWithLength {
   callee: Object;
 }
 
+// Just a starting shape for JSObject; properties can move after initialization.
 @hasSameInstanceTypeAsParent
 @noVerifier
 extern class JSStrictArgumentsObject extends JSArgumentsObjectWithLength {
@@ -460,7 +467,7 @@ extern class Module extends Struct {
   dfs_ancestor_index: Smi;
   exception: Object;
   script: Script;
-  @noVerifier import_meta: Hole | JSObject;
+  import_meta: TheHole | JSObject;
 }
 
 @abstract
@@ -513,6 +520,7 @@ extern class PrototypeInfo extends Struct {
   prototype_users: WeakArrayList | Zero;
   registry_slot: Smi;
   validity_cell: Object;
+  // TODO(v8:9108): Should be Weak<Map> | Undefined.
   @noVerifier object_create_map: Map | Undefined;
   bit_field: Smi;
 }
@@ -537,7 +545,7 @@ extern class Script extends Struct {
 
 extern class EmbedderDataArray extends HeapObject { length: Smi; }
 
-type ScopeInfo extends Object generates 'TNode<ScopeInfo>';
+type ScopeInfo extends HeapObject generates 'TNode<ScopeInfo>';
 
 extern class PreparseData extends HeapObject {
   // TODO(v8:8983): Add declaration for variable-sized region.
@@ -570,9 +578,12 @@ extern class JSBoundFunction extends JSObject {
   bound_arguments: FixedArray;
 }
 
-// Specialized types. The following two type definitions don't correspond to
+// Specialized types. The following three type definitions don't correspond to
 // actual C++ classes, but have Is... methods that check additional constraints.
 
+// A Foreign object whose raw pointer is not allowed to be null.
+type NonNullForeign extends Foreign;
+
 // A function built with InstantiateFunction for the public API.
 type CallableApiObject extends HeapObject;
 
@@ -591,7 +602,7 @@ type NumberDictionary extends HeapObject
 
 extern class FreeSpace extends HeapObject {
   size: Smi;
-  @noVerifier next: FreeSpace;
+  next: FreeSpace | Uninitialized;
 }
 
 // %RawDownCast should *never* be used anywhere in Torque code except for
@@ -773,13 +784,13 @@ const UTF32:
 extern class Foreign extends HeapObject { foreign_address: RawPtr; }
 
 extern class InterceptorInfo extends Struct {
-  @noVerifier getter: Foreign | Zero;
-  @noVerifier setter: Foreign | Zero;
-  @noVerifier query: Foreign | Zero;
-  @noVerifier descriptor: Foreign | Zero;
-  @noVerifier deleter: Foreign | Zero;
-  @noVerifier enumerator: Foreign | Zero;
-  @noVerifier definer: Foreign | Zero;
+  getter: NonNullForeign | Zero | Undefined;
+  setter: NonNullForeign | Zero | Undefined;
+  query: NonNullForeign | Zero | Undefined;
+  descriptor: NonNullForeign | Zero | Undefined;
+  deleter: NonNullForeign | Zero | Undefined;
+  enumerator: NonNullForeign | Zero | Undefined;
+  definer: NonNullForeign | Zero | Undefined;
   data: Object;
   flags: Smi;
 }
@@ -803,6 +814,9 @@ extern class Cell extends HeapObject { value: Object; }
 extern class DataHandler extends Struct {
   smi_handler: Smi | Code;
   validity_cell: Smi | Cell;
+
+  // Space for the following fields may or may not be allocated.
+  // TODO(v8:9108): Misusing "weak" keyword; should be MaybeObject.
   @noVerifier weak data_1: Object;
   @noVerifier weak data_2: Object;
   @noVerifier weak data_3: Object;
@@ -1078,7 +1092,7 @@ const kExternalPointerForOnHeapArray: constexpr RawPtr
 const kNameDictionaryInitialCapacity:
     constexpr int32 generates 'NameDictionary::kInitialCapacity';
 
-type Hole extends Oddball;
+type TheHole extends Oddball;
 type Null extends Oddball;
 type Undefined extends Oddball;
 type True extends Oddball;
@@ -1088,7 +1102,7 @@ type Boolean = True | False;
 
 type NumberOrUndefined = Number | Undefined;
 
-extern macro TheHoleConstant(): Hole;
+extern macro TheHoleConstant(): TheHole;
 extern macro NullConstant(): Null;
 extern macro UndefinedConstant(): Undefined;
 extern macro TrueConstant(): True;
@@ -1099,7 +1113,7 @@ extern macro EmptyStringConstant(): EmptyString;
 extern macro LengthStringConstant(): String;
 extern macro NanConstant(): NaN;
 
-const Hole: Hole = TheHoleConstant();
+const TheHole: TheHole = TheHoleConstant();
 const Null: Null = NullConstant();
 const Undefined: Undefined = UndefinedConstant();
 const True: True = TrueConstant();
@@ -1240,9 +1254,9 @@ extern class AccessorInfo extends Struct {
   name: Object;
   flags: Smi;
   expected_receiver_type: Object;
-  setter: Foreign | Zero;
-  getter: Foreign | Zero;
-  js_getter: Foreign | Zero;
+  setter: NonNullForeign | Zero;
+  getter: NonNullForeign | Zero;
+  js_getter: NonNullForeign | Zero;
   data: Object;
 }
 
@@ -2589,7 +2603,7 @@ LoadElementNoHole<FixedArray>(implicit context: Context)(
     const elements: FixedArray =
         Cast<FixedArray>(a.elements) otherwise Unexpected;
     const e: Object = elements.objects[index];
-    if (e == Hole) {
+    if (e == TheHole) {
       goto IfHole;
     }
     return e;
@@ -2650,7 +2664,7 @@ struct FastJSArrayWitness {
     } else {
       const elements = Cast<FixedArray>(this.unstable.elements)
           otherwise unreachable;
-      StoreFixedArrayElement(elements, k, Hole);
+      StoreFixedArrayElement(elements, k, TheHole);
     }
   }
 

src/builtins/typed-array-reduce.tq

@@ -19,7 +19,7 @@ namespace typed_array_reduce {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: Object = witness.Load(k);
-      if (accumulator == Hole) {
+      if (accumulator == TheHole) {
         accumulator = value;
       } else {
         accumulator = Call(
@@ -27,7 +27,7 @@ namespace typed_array_reduce {
             witness.GetStable());
       }
     }
-    if (accumulator == Hole) {
+    if (accumulator == TheHole) {
       ThrowTypeError(kReduceNoInitial, kBuiltinName);
     }
     return accumulator;
@@ -45,7 +45,7 @@ namespace typed_array_reduce {
       const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
       const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const initialValue = arguments.length >= 2 ? arguments[1] : Hole;
+      const initialValue = arguments.length >= 2 ? arguments[1] : TheHole;
       return ReduceAllElements(uarray, callbackfn, initialValue);
     }
     label NotCallable deferred {

src/builtins/typed-array-reduceright.tq

@@ -19,7 +19,7 @@ namespace typed_array_reduceright {
       // BUG(4895): We should throw on detached buffers rather than simply exit.
       witness.Recheck() otherwise break;
       const value: Object = witness.Load(k);
-      if (accumulator == Hole) {
+      if (accumulator == TheHole) {
         accumulator = value;
       } else {
         accumulator = Call(
@@ -27,7 +27,7 @@ namespace typed_array_reduceright {
             witness.GetStable());
       }
     }
-    if (accumulator == Hole) {
+    if (accumulator == TheHole) {
       ThrowTypeError(kReduceNoInitial, kBuiltinName);
     }
     return accumulator;
@@ -45,7 +45,7 @@ namespace typed_array_reduceright {
       const uarray = typed_array::EnsureAttached(array) otherwise IsDetached;
 
       const callbackfn = Cast<Callable>(arguments[0]) otherwise NotCallable;
-      const initialValue = arguments.length >= 2 ? arguments[1] : Hole;
+      const initialValue = arguments.length >= 2 ? arguments[1] : TheHole;
 
       return ReduceRightAllElements(uarray, callbackfn, initialValue);
     }

src/diagnostics/objects-debug.cc

@@ -127,13 +127,6 @@ void MaybeObject::VerifyMaybeObjectPointer(Isolate* isolate, MaybeObject p) {
   }
 }
 
-namespace {
-void VerifyForeignPointer(Isolate* isolate, HeapObject host, Object foreign) {
-  host.VerifyPointer(isolate, foreign);
-  CHECK(foreign.IsUndefined(isolate) || Foreign::IsNormalized(foreign));
-}
-}  // namespace
-
 void Smi::SmiVerify(Isolate* isolate) {
   CHECK(IsSmi());
   CHECK(!IsCallable());
@@ -524,6 +517,8 @@ void FeedbackVector::FeedbackVectorVerify(Isolate* isolate) {
   CHECK(code->IsSmi() || code->IsWeakOrCleared());
 }
 
+USE_TORQUE_VERIFIER(JSReceiver)
+
 bool JSObject::ElementsAreSafeToExamine() const {
   // If a GC was caused while constructing this object, the elements
   // pointer may point to a one pointer filler map.
@@ -1569,8 +1564,6 @@ void Module::ModuleVerify(Isolate* isolate) {
 
   CHECK_EQ(requested_modules().length(), info().module_requests().length());
 
-  CHECK(import_meta().IsTheHole(isolate) || import_meta().IsJSObject());
-
   CHECK_NE(hash(), 0);
 }
 
@@ -1702,12 +1695,7 @@ void StoreHandler::StoreHandlerVerify(Isolate* isolate) {
   // TODO(ishell): check handler integrity
 }
 
-void AccessorInfo::AccessorInfoVerify(Isolate* isolate) {
-  TorqueGeneratedClassVerifiers::AccessorInfoVerify(*this, isolate);
-  VerifyForeignPointer(isolate, *this, getter());
-  VerifyForeignPointer(isolate, *this, setter());
-  VerifyForeignPointer(isolate, *this, js_getter());
-}
+USE_TORQUE_VERIFIER(AccessorInfo)
 
 USE_TORQUE_VERIFIER(AccessorPair)
 
@@ -1722,16 +1710,7 @@ void CallHandlerInfo::CallHandlerInfoVerify(Isolate* isolate) {
                      .next_call_side_effect_free_call_handler_info_map());
 }
 
-void InterceptorInfo::InterceptorInfoVerify(Isolate* isolate) {
-  TorqueGeneratedClassVerifiers::InterceptorInfoVerify(*this, isolate);
-  VerifyForeignPointer(isolate, *this, getter());
-  VerifyForeignPointer(isolate, *this, setter());
-  VerifyForeignPointer(isolate, *this, query());
-  VerifyForeignPointer(isolate, *this, descriptor());
-  VerifyForeignPointer(isolate, *this, deleter());
-  VerifyForeignPointer(isolate, *this, enumerator());
-  VerifyForeignPointer(isolate, *this, definer());
-}
+USE_TORQUE_VERIFIER(InterceptorInfo)
 
 USE_TORQUE_VERIFIER(TemplateInfo)
 

src/objects/js-objects.h

@@ -68,6 +68,7 @@ class JSReceiver : public HeapObject {
   static void DeleteNormalizedProperty(Handle<JSReceiver> object, int entry);
 
   DECL_CAST(JSReceiver)
+  DECL_VERIFIER(JSReceiver)
 
   // ES6 section 7.1.1 ToPrimitive
   V8_WARN_UNUSED_RESULT static MaybeHandle<Object> ToPrimitive(

src/objects/object-list-macros.h

@@ -253,7 +253,8 @@ class ZoneForwardList;
 // represent some specialization in terms of additional constraints.
 #define HEAP_OBJECT_SPECIALIZED_TYPE_LIST(V) \
   V(CallableApiObject)                       \
-  V(CallableJSProxy)
+  V(CallableJSProxy)                         \
+  V(NonNullForeign)
 
 #define HEAP_OBJECT_TYPE_LIST(V)    \
   HEAP_OBJECT_ORDINARY_TYPE_LIST(V) \

src/objects/objects-inl.h

@@ -163,6 +163,10 @@ bool HeapObject::IsCallableApiObject() const {
          (type == JS_API_OBJECT_TYPE || type == JS_SPECIAL_API_OBJECT_TYPE);
 }
 
+bool HeapObject::IsNonNullForeign() const {
+  return IsForeign() && Foreign::cast(*this).foreign_address() != kNullAddress;
+}
+
 bool HeapObject::IsConstructor() const { return map().is_constructor(); }
 
 bool HeapObject::IsModuleInfo() const {

src/torque/constants.h

@@ -29,6 +29,7 @@ static const char* const HEAP_OBJECT_TYPE_STRING = "HeapObject";
 static const char* const JSOBJECT_TYPE_STRING = "JSObject";
 static const char* const SMI_TYPE_STRING = "Smi";
 static const char* const TAGGED_TYPE_STRING = "Tagged";
+static const char* const UNINITIALIZED_TYPE_STRING = "Uninitialized";
 static const char* const RAWPTR_TYPE_STRING = "RawPtr";
 static const char* const CONST_STRING_TYPE_STRING = "constexpr string";
 static const char* const STRING_TYPE_STRING = "String";

src/torque/implementation-visitor.cc

@@ -3357,8 +3357,10 @@ void GenerateClassFieldVerifier(const std::string& class_name,
   if (!f.generate_verify) return;
   const Type* field_type = f.name_and_type.type;
 
-  // We only verify tagged types, not raw numbers or pointers.
-  if (!field_type->IsSubtypeOf(TypeOracle::GetTaggedType())) return;
+  // We only verify tagged types, not raw numbers or pointers. Note that this
+  // must check against GetObjectType not GetTaggedType, because Uninitialized
+  // is a Tagged but should not be verified.
+  if (!field_type->IsSubtypeOf(TypeOracle::GetObjectType())) return;
 
   if (f.index) {
     if ((*f.index)->name_and_type.type != TypeOracle::GetSmiType()) {

src/torque/type-oracle.h

@@ -135,6 +135,10 @@ class TypeOracle : public ContextualClass<TypeOracle> {
     return Get().GetBuiltinType(TAGGED_TYPE_STRING);
   }
 
+  static const Type* GetUninitializedType() {
+    return Get().GetBuiltinType(UNINITIALIZED_TYPE_STRING);
+  }
+
   static const Type* GetSmiType() {
     return Get().GetBuiltinType(SMI_TYPE_STRING);
   }

src/torque/type-visitor.cc

@@ -57,6 +57,12 @@ const AbstractType* TypeVisitor::ComputeType(AbstractTypeDeclaration* decl) {
   const Type* parent_type = nullptr;
   if (decl->extends) {
     parent_type = Declarations::LookupType(*decl->extends);
+    if (parent_type->IsUnionType()) {
+      // UnionType::IsSupertypeOf requires that types can only extend from non-
+      // union types in order to work correctly.
+      ReportError("type \"", decl->name->value,
+                  "\" cannot extend a type union");
+    }
   }
 
   if (generates == "" && parent_type) {

src/torque/utils.cc

@@ -156,7 +156,7 @@ bool ContainsUpperCase(const std::string& s) {
 // keywords, e.g.: 'True', 'Undefined', etc.
 // These do not need to follow the default naming convention for constants.
 bool IsKeywordLikeName(const std::string& s) {
-  static const char* const keyword_like_constants[]{"True", "False", "Hole",
+  static const char* const keyword_like_constants[]{"True", "False", "TheHole",
                                                     "Null", "Undefined"};
 
   return std::find(std::begin(keyword_like_constants),

test/torque/test-torque.tq

@@ -867,7 +867,7 @@ namespace test {
   struct TestIterator {
     Next(): Object labels NoMore {
       if (this.count-- == 0) goto NoMore;
-      return Hole;
+      return TheHole;
     }
     count: Smi;
   }
@@ -947,8 +947,8 @@ namespace test {
   macro TestRedundantArrayElementCheck(implicit context: Context)(): Smi {
     const a = kEmptyFixedArray;
     for (let i: Smi = 0; i < a.length; i++) {
-      if (a.objects[i] == Hole) {
-        if (a.objects[i] == Hole) {
+      if (a.objects[i] == TheHole) {
+        if (a.objects[i] == TheHole) {
           return -1;
         } else {
           StaticAssert(false);

test/unittests/torque/torque-unittest.cc

@@ -160,12 +160,10 @@ TEST(Torque, TypeDeclarationOrder) {
     type Baztype = Foo | FooType;
 
     @abstract
-    @noVerifier
     extern class Foo extends HeapObject {
       fooField: FooType;
     }
 
-    @noVerifier
     extern class Bar extends Foo {
       barField: Bartype;
       bazfield: Baztype;
@@ -181,7 +179,6 @@ TEST(Torque, ConditionalFields) {
   // This class should throw alignment errors if @if decorators aren't
   // working.
   ExpectSuccessfulCompilation(R"(
-  @noVerifier
   extern class PreprocessingTest extends HeapObject {
     @if(FALSE_FOR_TESTING) a: int8;
     @if(TRUE_FOR_TESTING) a: int16;
@@ -194,7 +191,6 @@ TEST(Torque, ConditionalFields) {
   }
   )");
   ExpectFailingCompilation(R"(
-  @noVerifier
   extern class PreprocessingTest extends HeapObject {
     @if(TRUE_FOR_TESTING) a: int8;
     @if(FALSE_FOR_TESTING) a: int16;

third_party/v8/builtins/array-sort.tq

@@ -230,7 +230,7 @@ namespace array {
   transitioning builtin Load<ElementsAccessor: type>(
       context: Context, sortState: SortState, index: Smi): Object {
     const receiver = sortState.receiver;
-    if (!HasProperty_Inline(receiver, index)) return Hole;
+    if (!HasProperty_Inline(receiver, index)) return TheHole;
     return GetProperty(receiver, index);
   }
 
@@ -257,7 +257,7 @@ namespace array {
       return AllocateHeapNumberWithValue(value);
     }
     label IfHole {
-      return Hole;
+      return TheHole;
     }
   }
 
@@ -308,7 +308,7 @@ namespace array {
 
     const object = UnsafeCast<JSObject>(sortState.receiver);
     const elements = UnsafeCast<FixedArray>(object.elements);
-    elements.objects[index] = Hole;
+    elements.objects[index] = TheHole;
     return kSuccess;
   }
 
@@ -318,7 +318,7 @@ namespace array {
 
     const object = UnsafeCast<JSObject>(sortState.receiver);
     const elements = UnsafeCast<FixedArray>(object.elements);
-    elements.objects[index] = Hole;
+    elements.objects[index] = TheHole;
     return kSuccess;
   }
 
@@ -1297,7 +1297,7 @@ namespace array {
     for (let i: Smi = 0; i < receiverLength; ++i) {
       const element: Object = loadFn(context, sortState, i);
 
-      if (element == Hole) {
+      if (element == TheHole) {
         // Do nothing for holes. The result is that elements are
         // compacted at the front of the work array.
       } else if (element == Undefined) {
@@ -1330,7 +1330,7 @@ namespace array {
     //   1. Copy the sorted elements from the workarray to the receiver.
     //   2. Add {nOfUndefined} undefineds to the receiver.
     //   3. Depending on the backing store either delete properties or
-    //      set them to the Hole up to {sortState.sortLength}.
+    //      set them to the TheHole up to {sortState.sortLength}.
     let index: Smi = 0;
     for (; index < numberOfNonUndefined; ++index) {
       storeFn(context, sortState, index, workArray.objects[index]);

tools/torque/vim-torque/syntax/torque.vim

@@ -20,7 +20,7 @@ syn region  torqueComment	   start="/\*"  end="\*/" contains=@Spell
 syn region  torqueStringS	   start=+'+  skip=+\\\\\|\\'+  end=+'\|$+
 
 syn keyword torqueAssert assert check debug unreachable
-syn keyword torqueAtom True False Undefined Hole Null
+syn keyword torqueAtom True False Undefined TheHole Null
 syn keyword torqueBoolean true false
 syn keyword torqueBranch break continue goto
 syn keyword torqueConditional if else typeswitch otherwise