1/*
2 * Copyright (C) 2011-2019 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29#pragma once
30
31#include "CPU.h"
32#include "JSCJSValue.h"
33#include "TypedArrayType.h"
34#include <wtf/PrintStream.h>
35
36namespace JSC {
37
38class Structure;
39
40typedef uint64_t SpeculatedType;
41static constexpr SpeculatedType SpecNone = 0; // We don't know anything yet.
42static constexpr SpeculatedType SpecFinalObject = 1ull << 0; // It's definitely a JSFinalObject.
43static constexpr SpeculatedType SpecArray = 1ull << 1; // It's definitely a JSArray.
44static constexpr SpeculatedType SpecFunctionWithDefaultHasInstance = 1ull << 2; // It's definitely a JSFunction that has its ImplementsDefaultHasInstance type info flags bit set.
45static constexpr SpeculatedType SpecFunctionWithNonDefaultHasInstance = 1ull << 3; // It's definitely a JSFunction that does not have its ImplementsDefaultHasInstance type info flags bit set.
46static constexpr SpeculatedType SpecFunction = SpecFunctionWithDefaultHasInstance | SpecFunctionWithNonDefaultHasInstance; // It's definitely a JSFunction.
47static constexpr SpeculatedType SpecInt8Array = 1ull << 4; // It's definitely an Int8Array or one of its subclasses.
48static constexpr SpeculatedType SpecInt16Array = 1ull << 5; // It's definitely an Int16Array or one of its subclasses.
49static constexpr SpeculatedType SpecInt32Array = 1ull << 6; // It's definitely an Int32Array or one of its subclasses.
50static constexpr SpeculatedType SpecUint8Array = 1ull << 7; // It's definitely an Uint8Array or one of its subclasses.
51static constexpr SpeculatedType SpecUint8ClampedArray = 1ull << 8; // It's definitely an Uint8ClampedArray or one of its subclasses.
52static constexpr SpeculatedType SpecUint16Array = 1ull << 9; // It's definitely an Uint16Array or one of its subclasses.
53static constexpr SpeculatedType SpecUint32Array = 1ull << 10; // It's definitely an Uint32Array or one of its subclasses.
54static constexpr SpeculatedType SpecFloat32Array = 1ull << 11; // It's definitely an Uint16Array or one of its subclasses.
55static constexpr SpeculatedType SpecFloat64Array = 1ull << 12; // It's definitely an Uint16Array or one of its subclasses.
56static constexpr SpeculatedType SpecTypedArrayView = SpecInt8Array | SpecInt16Array | SpecInt32Array | SpecUint8Array | SpecUint8ClampedArray | SpecUint16Array | SpecUint32Array | SpecFloat32Array | SpecFloat64Array;
57static constexpr SpeculatedType SpecDirectArguments = 1ull << 13; // It's definitely a DirectArguments object.
58static constexpr SpeculatedType SpecScopedArguments = 1ull << 14; // It's definitely a ScopedArguments object.
59static constexpr SpeculatedType SpecStringObject = 1ull << 15; // It's definitely a StringObject.
60static constexpr SpeculatedType SpecRegExpObject = 1ull << 16; // It's definitely a RegExpObject (and not any subclass of RegExpObject).
61static constexpr SpeculatedType SpecDateObject = 1ull << 17; // It's definitely a Date object or one of its subclasses.
62static constexpr SpeculatedType SpecPromiseObject = 1ull << 18; // It's definitely a Promise object or one of its subclasses.
63static constexpr SpeculatedType SpecMapObject = 1ull << 19; // It's definitely a Map object or one of its subclasses.
64static constexpr SpeculatedType SpecSetObject = 1ull << 20; // It's definitely a Set object or one of its subclasses.
65static constexpr SpeculatedType SpecWeakMapObject = 1ull << 21; // It's definitely a WeakMap object or one of its subclasses.
66static constexpr SpeculatedType SpecWeakSetObject = 1ull << 22; // It's definitely a WeakSet object or one of its subclasses.
67static constexpr SpeculatedType SpecProxyObject = 1ull << 23; // It's definitely a Proxy object or one of its subclasses.
68static constexpr SpeculatedType SpecDerivedArray = 1ull << 24; // It's definitely a DerivedArray object.
69static constexpr SpeculatedType SpecObjectOther = 1ull << 25; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction.
70static constexpr SpeculatedType SpecStringIdent = 1ull << 26; // It's definitely a JSString, and it's an identifier.
71static constexpr SpeculatedType SpecStringVar = 1ull << 27; // It's definitely a JSString, and it's not an identifier.
72static constexpr SpeculatedType SpecString = SpecStringIdent | SpecStringVar; // It's definitely a JSString.
73static constexpr SpeculatedType SpecSymbol = 1ull << 28; // It's definitely a Symbol.
74static constexpr SpeculatedType SpecCellOther = 1ull << 29; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString, BigInt, or Symbol.
75static constexpr SpeculatedType SpecBoolInt32 = 1ull << 30; // It's definitely an Int32 with value 0 or 1.
76static constexpr SpeculatedType SpecNonBoolInt32 = 1ull << 31; // It's definitely an Int32 with value other than 0 or 1.
77static constexpr SpeculatedType SpecInt32Only = SpecBoolInt32 | SpecNonBoolInt32; // It's definitely an Int32.
78
79static constexpr SpeculatedType SpecInt32AsInt52 = 1ull << 32; // It's an Int52 and it can fit in an int32.
80static constexpr SpeculatedType SpecNonInt32AsInt52 = 1ull << 33; // It's an Int52 and it can't fit in an int32.
81static constexpr SpeculatedType SpecInt52Any = SpecInt32AsInt52 | SpecNonInt32AsInt52; // It's any kind of Int52.
82
83static constexpr SpeculatedType SpecAnyIntAsDouble = 1ull << 34; // It's definitely an Int52 and it's inside a double.
84static constexpr SpeculatedType SpecNonIntAsDouble = 1ull << 35; // It's definitely not an Int52 but it's a real number and it's a double.
85static constexpr SpeculatedType SpecDoubleReal = SpecNonIntAsDouble | SpecAnyIntAsDouble; // It's definitely a non-NaN double.
86static constexpr SpeculatedType SpecDoublePureNaN = 1ull << 36; // It's definitely a NaN that is safe to tag (i.e. pure).
87static constexpr SpeculatedType SpecDoubleImpureNaN = 1ull << 37; // It's definitely a NaN that is unsafe to tag (i.e. impure).
88static constexpr SpeculatedType SpecDoubleNaN = SpecDoublePureNaN | SpecDoubleImpureNaN; // It's definitely some kind of NaN.
89static constexpr SpeculatedType SpecBytecodeDouble = SpecDoubleReal | SpecDoublePureNaN; // It's either a non-NaN or a NaN double, but it's definitely not impure NaN.
90static constexpr SpeculatedType SpecFullDouble = SpecDoubleReal | SpecDoubleNaN; // It's either a non-NaN or a NaN double.
91static constexpr SpeculatedType SpecBytecodeRealNumber = SpecInt32Only | SpecDoubleReal; // It's either an Int32 or a DoubleReal.
92static constexpr SpeculatedType SpecFullRealNumber = SpecInt32Only | SpecInt52Any | SpecDoubleReal; // It's either an Int32 or a DoubleReal, or an Int52.
93static constexpr SpeculatedType SpecBytecodeNumber = SpecInt32Only | SpecBytecodeDouble; // It's either an Int32 or a Double, and the Double cannot be an impure NaN.
94static constexpr SpeculatedType SpecIntAnyFormat = SpecInt52Any | SpecInt32Only | SpecAnyIntAsDouble;
95
96static constexpr SpeculatedType SpecFullNumber = SpecIntAnyFormat | SpecFullDouble; // It's either an Int32, Int52, or a Double, and the Double can be impure NaN.
97static constexpr SpeculatedType SpecBoolean = 1ull << 38; // It's definitely a Boolean.
98static constexpr SpeculatedType SpecOther = 1ull << 39; // It's definitely either Null or Undefined.
99static constexpr SpeculatedType SpecMisc = SpecBoolean | SpecOther; // It's definitely either a boolean, Null, or Undefined.
100static constexpr SpeculatedType SpecEmpty = 1ull << 40; // It's definitely an empty value marker.
101static constexpr SpeculatedType SpecBigInt = 1ull << 41; // It's definitely a BigInt.
102static constexpr SpeculatedType SpecDataViewObject = 1ull << 42; // It's definitely a JSDataView.
103static constexpr SpeculatedType SpecPrimitive = SpecString | SpecSymbol | SpecBytecodeNumber | SpecMisc | SpecBigInt; // It's any non-Object JSValue.
104static constexpr SpeculatedType SpecObject = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecDateObject | SpecPromiseObject | SpecMapObject | SpecSetObject | SpecWeakMapObject | SpecWeakSetObject | SpecProxyObject | SpecDerivedArray | SpecObjectOther | SpecDataViewObject; // Bitmask used for testing for any kind of object prediction.
105static constexpr SpeculatedType SpecCell = SpecObject | SpecString | SpecSymbol | SpecCellOther | SpecBigInt; // It's definitely a JSCell.
106static constexpr SpeculatedType SpecHeapTop = SpecCell | SpecBytecodeNumber | SpecMisc; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN.
107static constexpr SpeculatedType SpecBytecodeTop = SpecHeapTop | SpecEmpty; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. Corresponds to what could be found in a bytecode local.
108static constexpr SpeculatedType SpecFullTop = SpecBytecodeTop | SpecFullNumber; // It can be anything that bytecode could see plus exotic encodings of numbers.
109
110// SpecCellCheck is the type set representing the values that can flow through a cell check.
111// On 64-bit platforms, the empty value passes a cell check. Also, ~SpecCellCheck is the type
112// set that representing the values that flow through when testing that something is not a cell.
113static constexpr SpeculatedType SpecCellCheck = is64Bit() ? (SpecCell | SpecEmpty) : SpecCell;
114
115typedef bool (*SpeculatedTypeChecker)(SpeculatedType);
116
117// Dummy prediction checker, only useful if someone insists on requiring a prediction checker.
118inline bool isAnySpeculation(SpeculatedType)
119{
120 return true;
121}
122
123inline bool isCellSpeculation(SpeculatedType value)
124{
125 return !!(value & SpecCell) && !(value & ~SpecCell);
126}
127
128inline bool isCellOrOtherSpeculation(SpeculatedType value)
129{
130 return !!value && !(value & ~(SpecCell | SpecOther));
131}
132
133inline bool isNotCellSpeculation(SpeculatedType value)
134{
135 return !(value & SpecCellCheck) && value;
136}
137
138inline bool isObjectSpeculation(SpeculatedType value)
139{
140 return !!(value & SpecObject) && !(value & ~SpecObject);
141}
142
143inline bool isObjectOrOtherSpeculation(SpeculatedType value)
144{
145 return !!(value & (SpecObject | SpecOther)) && !(value & ~(SpecObject | SpecOther));
146}
147
148inline bool isFinalObjectSpeculation(SpeculatedType value)
149{
150 return value == SpecFinalObject;
151}
152
153inline bool isFinalObjectOrOtherSpeculation(SpeculatedType value)
154{
155 return !!(value & (SpecFinalObject | SpecOther)) && !(value & ~(SpecFinalObject | SpecOther));
156}
157
158inline bool isStringIdentSpeculation(SpeculatedType value)
159{
160 return value == SpecStringIdent;
161}
162
163inline bool isNotStringVarSpeculation(SpeculatedType value)
164{
165 return !(value & SpecStringVar);
166}
167
168inline bool isStringSpeculation(SpeculatedType value)
169{
170 return !!value && (value & SpecString) == value;
171}
172
173inline bool isNotStringSpeculation(SpeculatedType value)
174{
175 return value && !(value & SpecString);
176}
177
178inline bool isStringOrOtherSpeculation(SpeculatedType value)
179{
180 return !!value && (value & (SpecString | SpecOther)) == value;
181}
182
183inline bool isSymbolSpeculation(SpeculatedType value)
184{
185 return value == SpecSymbol;
186}
187
188inline bool isBigIntSpeculation(SpeculatedType value)
189{
190 return value == SpecBigInt;
191}
192
193inline bool isArraySpeculation(SpeculatedType value)
194{
195 return value == SpecArray;
196}
197
198inline bool isFunctionSpeculation(SpeculatedType value)
199{
200 return value == SpecFunction;
201}
202
203inline bool isProxyObjectSpeculation(SpeculatedType value)
204{
205 return value == SpecProxyObject;
206}
207
208inline bool isDerivedArraySpeculation(SpeculatedType value)
209{
210 return value == SpecDerivedArray;
211}
212
213inline bool isInt8ArraySpeculation(SpeculatedType value)
214{
215 return value == SpecInt8Array;
216}
217
218inline bool isInt16ArraySpeculation(SpeculatedType value)
219{
220 return value == SpecInt16Array;
221}
222
223inline bool isInt32ArraySpeculation(SpeculatedType value)
224{
225 return value == SpecInt32Array;
226}
227
228inline bool isUint8ArraySpeculation(SpeculatedType value)
229{
230 return value == SpecUint8Array;
231}
232
233inline bool isUint8ClampedArraySpeculation(SpeculatedType value)
234{
235 return value == SpecUint8ClampedArray;
236}
237
238inline bool isUint16ArraySpeculation(SpeculatedType value)
239{
240 return value == SpecUint16Array;
241}
242
243inline bool isUint32ArraySpeculation(SpeculatedType value)
244{
245 return value == SpecUint32Array;
246}
247
248inline bool isFloat32ArraySpeculation(SpeculatedType value)
249{
250 return value == SpecFloat32Array;
251}
252
253inline bool isFloat64ArraySpeculation(SpeculatedType value)
254{
255 return value == SpecFloat64Array;
256}
257
258inline bool isDirectArgumentsSpeculation(SpeculatedType value)
259{
260 return value == SpecDirectArguments;
261}
262
263inline bool isScopedArgumentsSpeculation(SpeculatedType value)
264{
265 return value == SpecScopedArguments;
266}
267
268inline bool isActionableIntMutableArraySpeculation(SpeculatedType value)
269{
270 return isInt8ArraySpeculation(value)
271 || isInt16ArraySpeculation(value)
272 || isInt32ArraySpeculation(value)
273 || isUint8ArraySpeculation(value)
274 || isUint8ClampedArraySpeculation(value)
275 || isUint16ArraySpeculation(value)
276 || isUint32ArraySpeculation(value);
277}
278
279inline bool isActionableFloatMutableArraySpeculation(SpeculatedType value)
280{
281 return isFloat32ArraySpeculation(value)
282 || isFloat64ArraySpeculation(value);
283}
284
285inline bool isActionableTypedMutableArraySpeculation(SpeculatedType value)
286{
287 return isActionableIntMutableArraySpeculation(value)
288 || isActionableFloatMutableArraySpeculation(value);
289}
290
291inline bool isActionableMutableArraySpeculation(SpeculatedType value)
292{
293 return isArraySpeculation(value)
294 || isActionableTypedMutableArraySpeculation(value);
295}
296
297inline bool isActionableArraySpeculation(SpeculatedType value)
298{
299 return isStringSpeculation(value)
300 || isDirectArgumentsSpeculation(value)
301 || isScopedArgumentsSpeculation(value)
302 || isActionableMutableArraySpeculation(value);
303}
304
305inline bool isArrayOrOtherSpeculation(SpeculatedType value)
306{
307 return !!(value & (SpecArray | SpecOther)) && !(value & ~(SpecArray | SpecOther));
308}
309
310inline bool isStringObjectSpeculation(SpeculatedType value)
311{
312 return value == SpecStringObject;
313}
314
315inline bool isStringOrStringObjectSpeculation(SpeculatedType value)
316{
317 return !!value && !(value & ~(SpecString | SpecStringObject));
318}
319
320inline bool isRegExpObjectSpeculation(SpeculatedType value)
321{
322 return value == SpecRegExpObject;
323}
324
325inline bool isBoolInt32Speculation(SpeculatedType value)
326{
327 return value == SpecBoolInt32;
328}
329
330inline bool isInt32Speculation(SpeculatedType value)
331{
332 return value && !(value & ~SpecInt32Only);
333}
334
335inline bool isNotInt32Speculation(SpeculatedType value)
336{
337 return value && !(value & SpecInt32Only);
338}
339
340inline bool isInt32OrBooleanSpeculation(SpeculatedType value)
341{
342 return value && !(value & ~(SpecBoolean | SpecInt32Only));
343}
344
345inline bool isInt32SpeculationForArithmetic(SpeculatedType value)
346{
347 return !(value & (SpecFullDouble | SpecNonInt32AsInt52 | SpecBigInt));
348}
349
350inline bool isInt32OrBooleanSpeculationForArithmetic(SpeculatedType value)
351{
352 return !(value & (SpecFullDouble | SpecNonInt32AsInt52 | SpecBigInt));
353}
354
355inline bool isInt32OrBooleanSpeculationExpectingDefined(SpeculatedType value)
356{
357 return isInt32OrBooleanSpeculation(value & ~SpecOther);
358}
359
360inline bool isAnyInt52Speculation(SpeculatedType value)
361{
362 return !!value && (value & SpecInt52Any) == value;
363}
364
365inline bool isInt32OrInt52Speculation(SpeculatedType value)
366{
367 return !!value && (value & (SpecInt32Only | SpecInt52Any)) == value;
368}
369
370inline bool isIntAnyFormat(SpeculatedType value)
371{
372 return !!value && (value & SpecIntAnyFormat) == value;
373}
374
375inline bool isAnyIntAsDoubleSpeculation(SpeculatedType value)
376{
377 return value == SpecAnyIntAsDouble;
378}
379
380inline bool isDoubleRealSpeculation(SpeculatedType value)
381{
382 return !!value && (value & SpecDoubleReal) == value;
383}
384
385inline bool isDoubleSpeculation(SpeculatedType value)
386{
387 return !!value && (value & SpecFullDouble) == value;
388}
389
390inline bool isDoubleSpeculationForArithmetic(SpeculatedType value)
391{
392 return !!(value & SpecFullDouble);
393}
394
395inline bool isBytecodeRealNumberSpeculation(SpeculatedType value)
396{
397 return !!(value & SpecBytecodeRealNumber) && !(value & ~SpecBytecodeRealNumber);
398}
399
400inline bool isFullRealNumberSpeculation(SpeculatedType value)
401{
402 return !!(value & SpecFullRealNumber) && !(value & ~SpecFullRealNumber);
403}
404
405inline bool isBytecodeNumberSpeculation(SpeculatedType value)
406{
407 return !!(value & SpecBytecodeNumber) && !(value & ~SpecBytecodeNumber);
408}
409
410inline bool isFullNumberSpeculation(SpeculatedType value)
411{
412 return !!(value & SpecFullNumber) && !(value & ~SpecFullNumber);
413}
414
415inline bool isFullNumberOrBooleanSpeculation(SpeculatedType value)
416{
417 return value && !(value & ~(SpecFullNumber | SpecBoolean));
418}
419
420inline bool isFullNumberOrBooleanSpeculationExpectingDefined(SpeculatedType value)
421{
422 return isFullNumberOrBooleanSpeculation(value & ~SpecOther);
423}
424
425inline bool isBooleanSpeculation(SpeculatedType value)
426{
427 return value == SpecBoolean;
428}
429
430inline bool isNotBooleanSpeculation(SpeculatedType value)
431{
432 return value && !(value & SpecBoolean);
433}
434
435inline bool isOtherSpeculation(SpeculatedType value)
436{
437 return value == SpecOther;
438}
439
440inline bool isMiscSpeculation(SpeculatedType value)
441{
442 return !!value && !(value & ~SpecMisc);
443}
444
445inline bool isOtherOrEmptySpeculation(SpeculatedType value)
446{
447 return !value || value == SpecOther;
448}
449
450inline bool isEmptySpeculation(SpeculatedType value)
451{
452 return value == SpecEmpty;
453}
454
455inline bool isUntypedSpeculationForArithmetic(SpeculatedType value)
456{
457 return !!(value & ~(SpecFullNumber | SpecBoolean));
458}
459
460inline bool isUntypedSpeculationForBitOps(SpeculatedType value)
461{
462 return !!(value & ~(SpecFullNumber | SpecBoolean | SpecOther));
463}
464
465void dumpSpeculation(PrintStream&, SpeculatedType);
466void dumpSpeculationAbbreviated(PrintStream&, SpeculatedType);
467
468MAKE_PRINT_ADAPTOR(SpeculationDump, SpeculatedType, dumpSpeculation);
469MAKE_PRINT_ADAPTOR(AbbreviatedSpeculationDump, SpeculatedType, dumpSpeculationAbbreviated);
470
471// Merge two predictions. Note that currently this just does left | right. It may
472// seem tempting to do so directly, but you would be doing so at your own peril,
473// since the merging protocol SpeculatedType may change at any time (and has already
474// changed several times in its history).
475inline SpeculatedType mergeSpeculations(SpeculatedType left, SpeculatedType right)
476{
477 return left | right;
478}
479
480template<typename T>
481inline bool mergeSpeculation(T& left, SpeculatedType right)
482{
483 SpeculatedType newSpeculation = static_cast<T>(mergeSpeculations(static_cast<SpeculatedType>(left), right));
484 bool result = newSpeculation != static_cast<SpeculatedType>(left);
485 left = newSpeculation;
486 return result;
487}
488
489inline bool speculationChecked(SpeculatedType actual, SpeculatedType desired)
490{
491 return (actual | desired) == desired;
492}
493
494SpeculatedType speculationFromClassInfo(const ClassInfo*);
495SpeculatedType speculationFromStructure(Structure*);
496SpeculatedType speculationFromCell(JSCell*);
497JS_EXPORT_PRIVATE SpeculatedType speculationFromValue(JSValue);
498// If it's an anyInt(), it'll return speculated types from the Int52 lattice.
499// Otherwise, it'll return types from the JSValue lattice.
500JS_EXPORT_PRIVATE SpeculatedType int52AwareSpeculationFromValue(JSValue);
501Optional<SpeculatedType> speculationFromJSType(JSType);
502
503SpeculatedType speculationFromTypedArrayType(TypedArrayType); // only valid for typed views.
504TypedArrayType typedArrayTypeFromSpeculation(SpeculatedType);
505
506SpeculatedType leastUpperBoundOfStrictlyEquivalentSpeculations(SpeculatedType);
507
508bool valuesCouldBeEqual(SpeculatedType, SpeculatedType);
509
510// Precise computation of the type of the result of a double computation after we
511// already know that the inputs are doubles and that the result must be a double. Use
512// the closest one of these that applies.
513SpeculatedType typeOfDoubleSum(SpeculatedType, SpeculatedType);
514SpeculatedType typeOfDoubleDifference(SpeculatedType, SpeculatedType);
515SpeculatedType typeOfDoubleIncOrDec(SpeculatedType);
516SpeculatedType typeOfDoubleProduct(SpeculatedType, SpeculatedType);
517SpeculatedType typeOfDoubleQuotient(SpeculatedType, SpeculatedType);
518SpeculatedType typeOfDoubleMinMax(SpeculatedType, SpeculatedType);
519SpeculatedType typeOfDoubleNegation(SpeculatedType);
520SpeculatedType typeOfDoubleAbs(SpeculatedType);
521SpeculatedType typeOfDoubleRounding(SpeculatedType);
522SpeculatedType typeOfDoublePow(SpeculatedType, SpeculatedType);
523
524// This conservatively models the behavior of arbitrary double operations.
525SpeculatedType typeOfDoubleBinaryOp(SpeculatedType, SpeculatedType);
526SpeculatedType typeOfDoubleUnaryOp(SpeculatedType);
527
528// This is mostly for debugging so we can fill profiles from strings.
529SpeculatedType speculationFromString(const char*);
530
531} // namespace JSC
532