1/*
2 * Copyright (C) 2011-2017 Apple Inc. All rights reserved.
3 *
4 * Redistribution and use in source and binary forms, with or without
5 * modification, are permitted provided that the following conditions
6 * are met:
7 *
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 3. Neither the name of Apple Inc. ("Apple") nor the names of
14 * its contributors may be used to endorse or promote products derived
15 * from this software without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
18 * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
19 * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
20 * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
21 * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
22 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
23 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
24 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29#pragma once
30
31#include "CPU.h"
32#include "JSCJSValue.h"
33#include "TypedArrayType.h"
34#include <wtf/PrintStream.h>
35
36namespace JSC {
37
38class Structure;
39
40typedef uint64_t SpeculatedType;
41static const SpeculatedType SpecNone = 0; // We don't know anything yet.
42static const SpeculatedType SpecFinalObject = 1ull << 0; // It's definitely a JSFinalObject.
43static const SpeculatedType SpecArray = 1ull << 1; // It's definitely a JSArray.
44static const SpeculatedType SpecFunctionWithDefaultHasInstance = 1ull << 2; // It's definitely a JSFunction that has its ImplementsDefaultHasInstance type info flags bit set.
45static const SpeculatedType SpecFunctionWithNonDefaultHasInstance = 1ull << 3; // It's definitely a JSFunction that does not have its ImplementsDefaultHasInstance type info flags bit set.
46static const SpeculatedType SpecFunction = SpecFunctionWithDefaultHasInstance | SpecFunctionWithNonDefaultHasInstance; // It's definitely a JSFunction.
47static const SpeculatedType SpecInt8Array = 1ull << 4; // It's definitely an Int8Array or one of its subclasses.
48static const SpeculatedType SpecInt16Array = 1ull << 5; // It's definitely an Int16Array or one of its subclasses.
49static const SpeculatedType SpecInt32Array = 1ull << 6; // It's definitely an Int32Array or one of its subclasses.
50static const SpeculatedType SpecUint8Array = 1ull << 7; // It's definitely an Uint8Array or one of its subclasses.
51static const SpeculatedType SpecUint8ClampedArray = 1ull << 8; // It's definitely an Uint8ClampedArray or one of its subclasses.
52static const SpeculatedType SpecUint16Array = 1ull << 9; // It's definitely an Uint16Array or one of its subclasses.
53static const SpeculatedType SpecUint32Array = 1ull << 10; // It's definitely an Uint32Array or one of its subclasses.
54static const SpeculatedType SpecFloat32Array = 1ull << 11; // It's definitely an Uint16Array or one of its subclasses.
55static const SpeculatedType SpecFloat64Array = 1ull << 12; // It's definitely an Uint16Array or one of its subclasses.
56static const SpeculatedType SpecTypedArrayView = SpecInt8Array | SpecInt16Array | SpecInt32Array | SpecUint8Array | SpecUint8ClampedArray | SpecUint16Array | SpecUint32Array | SpecFloat32Array | SpecFloat64Array;
57static const SpeculatedType SpecDirectArguments = 1ull << 13; // It's definitely a DirectArguments object.
58static const SpeculatedType SpecScopedArguments = 1ull << 14; // It's definitely a ScopedArguments object.
59static const SpeculatedType SpecStringObject = 1ull << 15; // It's definitely a StringObject.
60static const SpeculatedType SpecRegExpObject = 1ull << 16; // It's definitely a RegExpObject (and not any subclass of RegExpObject).
61static const SpeculatedType SpecMapObject = 1ull << 17; // It's definitely a Map object or one of its subclasses.
62static const SpeculatedType SpecSetObject = 1ull << 18; // It's definitely a Set object or one of its subclasses.
63static const SpeculatedType SpecWeakMapObject = 1ull << 19; // It's definitely a WeakMap object or one of its subclasses.
64static const SpeculatedType SpecWeakSetObject = 1ull << 20; // It's definitely a WeakSet object or one of its subclasses.
65static const SpeculatedType SpecProxyObject = 1ull << 21; // It's definitely a Proxy object or one of its subclasses.
66static const SpeculatedType SpecDerivedArray = 1ull << 22; // It's definitely a DerivedArray object.
67static const SpeculatedType SpecObjectOther = 1ull << 23; // It's definitely an object but not JSFinalObject, JSArray, or JSFunction.
68static const SpeculatedType SpecStringIdent = 1ull << 24; // It's definitely a JSString, and it's an identifier.
69static const SpeculatedType SpecStringVar = 1ull << 25; // It's definitely a JSString, and it's not an identifier.
70static const SpeculatedType SpecString = SpecStringIdent | SpecStringVar; // It's definitely a JSString.
71static const SpeculatedType SpecSymbol = 1ull << 26; // It's definitely a Symbol.
72static const SpeculatedType SpecCellOther = 1ull << 27; // It's definitely a JSCell but not a subclass of JSObject and definitely not a JSString, BigInt, or Symbol.
73static const SpeculatedType SpecBoolInt32 = 1ull << 28; // It's definitely an Int32 with value 0 or 1.
74static const SpeculatedType SpecNonBoolInt32 = 1ull << 29; // It's definitely an Int32 with value other than 0 or 1.
75static const SpeculatedType SpecInt32Only = SpecBoolInt32 | SpecNonBoolInt32; // It's definitely an Int32.
76
77static const SpeculatedType SpecInt32AsInt52 = 1ull << 30; // It's an Int52 and it can fit in an int32.
78static const SpeculatedType SpecNonInt32AsInt52 = 1ull << 31; // It's an Int52 and it can't fit in an int32.
79static const SpeculatedType SpecInt52Any = SpecInt32AsInt52 | SpecNonInt32AsInt52; // It's any kind of Int52.
80
81static const SpeculatedType SpecAnyIntAsDouble = 1ull << 32; // It's definitely an Int52 and it's inside a double.
82static const SpeculatedType SpecNonIntAsDouble = 1ull << 33; // It's definitely not an Int52 but it's a real number and it's a double.
83static const SpeculatedType SpecDoubleReal = SpecNonIntAsDouble | SpecAnyIntAsDouble; // It's definitely a non-NaN double.
84static const SpeculatedType SpecDoublePureNaN = 1ull << 34; // It's definitely a NaN that is safe to tag (i.e. pure).
85static const SpeculatedType SpecDoubleImpureNaN = 1ull << 35; // It's definitely a NaN that is unsafe to tag (i.e. impure).
86static const SpeculatedType SpecDoubleNaN = SpecDoublePureNaN | SpecDoubleImpureNaN; // It's definitely some kind of NaN.
87static const SpeculatedType SpecBytecodeDouble = SpecDoubleReal | SpecDoublePureNaN; // It's either a non-NaN or a NaN double, but it's definitely not impure NaN.
88static const SpeculatedType SpecFullDouble = SpecDoubleReal | SpecDoubleNaN; // It's either a non-NaN or a NaN double.
89static const SpeculatedType SpecBytecodeRealNumber = SpecInt32Only | SpecDoubleReal; // It's either an Int32 or a DoubleReal.
90static const SpeculatedType SpecFullRealNumber = SpecInt32Only | SpecInt52Any | SpecDoubleReal; // It's either an Int32 or a DoubleReal, or an Int52.
91static const SpeculatedType SpecBytecodeNumber = SpecInt32Only | SpecBytecodeDouble; // It's either an Int32 or a Double, and the Double cannot be an impure NaN.
92static const SpeculatedType SpecIntAnyFormat = SpecInt52Any | SpecInt32Only | SpecAnyIntAsDouble;
93
94static const SpeculatedType SpecFullNumber = SpecIntAnyFormat | SpecFullDouble; // It's either an Int32, Int52, or a Double, and the Double can be impure NaN.
95static const SpeculatedType SpecBoolean = 1ull << 36; // It's definitely a Boolean.
96static const SpeculatedType SpecOther = 1ull << 37; // It's definitely either Null or Undefined.
97static const SpeculatedType SpecMisc = SpecBoolean | SpecOther; // It's definitely either a boolean, Null, or Undefined.
98static const SpeculatedType SpecEmpty = 1ull << 38; // It's definitely an empty value marker.
99static const SpeculatedType SpecBigInt = 1ull << 39; // It's definitely a BigInt.
100static const SpeculatedType SpecDataViewObject = 1ull << 40; // It's definitely a JSDataView.
101static const SpeculatedType SpecPrimitive = SpecString | SpecSymbol | SpecBytecodeNumber | SpecMisc | SpecBigInt; // It's any non-Object JSValue.
102static const SpeculatedType SpecObject = SpecFinalObject | SpecArray | SpecFunction | SpecTypedArrayView | SpecDirectArguments | SpecScopedArguments | SpecStringObject | SpecRegExpObject | SpecMapObject | SpecSetObject | SpecWeakMapObject | SpecWeakSetObject | SpecProxyObject | SpecDerivedArray | SpecObjectOther | SpecDataViewObject; // Bitmask used for testing for any kind of object prediction.
103static const SpeculatedType SpecCell = SpecObject | SpecString | SpecSymbol | SpecCellOther | SpecBigInt; // It's definitely a JSCell.
104static const SpeculatedType SpecHeapTop = SpecCell | SpecBytecodeNumber | SpecMisc; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN.
105static const SpeculatedType SpecBytecodeTop = SpecHeapTop | SpecEmpty; // It can be any of the above, except for SpecInt52Only and SpecDoubleImpureNaN. Corresponds to what could be found in a bytecode local.
106static const SpeculatedType SpecFullTop = SpecBytecodeTop | SpecFullNumber; // It can be anything that bytecode could see plus exotic encodings of numbers.
107
108// SpecCellCheck is the type set representing the values that can flow through a cell check.
109// On 64-bit platforms, the empty value passes a cell check. Also, ~SpecCellCheck is the type
110// set that representing the values that flow through when testing that something is not a cell.
111static const SpeculatedType SpecCellCheck = is64Bit() ? (SpecCell | SpecEmpty) : SpecCell;
112
113typedef bool (*SpeculatedTypeChecker)(SpeculatedType);
114
115// Dummy prediction checker, only useful if someone insists on requiring a prediction checker.
116inline bool isAnySpeculation(SpeculatedType)
117{
118 return true;
119}
120
121inline bool isCellSpeculation(SpeculatedType value)
122{
123 return !!(value & SpecCell) && !(value & ~SpecCell);
124}
125
126inline bool isCellOrOtherSpeculation(SpeculatedType value)
127{
128 return !!value && !(value & ~(SpecCell | SpecOther));
129}
130
131inline bool isNotCellSpeculation(SpeculatedType value)
132{
133 return !(value & SpecCellCheck) && value;
134}
135
136inline bool isObjectSpeculation(SpeculatedType value)
137{
138 return !!(value & SpecObject) && !(value & ~SpecObject);
139}
140
141inline bool isObjectOrOtherSpeculation(SpeculatedType value)
142{
143 return !!(value & (SpecObject | SpecOther)) && !(value & ~(SpecObject | SpecOther));
144}
145
146inline bool isFinalObjectSpeculation(SpeculatedType value)
147{
148 return value == SpecFinalObject;
149}
150
151inline bool isFinalObjectOrOtherSpeculation(SpeculatedType value)
152{
153 return !!(value & (SpecFinalObject | SpecOther)) && !(value & ~(SpecFinalObject | SpecOther));
154}
155
156inline bool isStringIdentSpeculation(SpeculatedType value)
157{
158 return value == SpecStringIdent;
159}
160
161inline bool isNotStringVarSpeculation(SpeculatedType value)
162{
163 return !(value & SpecStringVar);
164}
165
166inline bool isStringSpeculation(SpeculatedType value)
167{
168 return !!value && (value & SpecString) == value;
169}
170
171inline bool isNotStringSpeculation(SpeculatedType value)
172{
173 return value && !(value & SpecString);
174}
175
176inline bool isStringOrOtherSpeculation(SpeculatedType value)
177{
178 return !!value && (value & (SpecString | SpecOther)) == value;
179}
180
181inline bool isSymbolSpeculation(SpeculatedType value)
182{
183 return value == SpecSymbol;
184}
185
186inline bool isBigIntSpeculation(SpeculatedType value)
187{
188 return value == SpecBigInt;
189}
190
191inline bool isArraySpeculation(SpeculatedType value)
192{
193 return value == SpecArray;
194}
195
196inline bool isFunctionSpeculation(SpeculatedType value)
197{
198 return value == SpecFunction;
199}
200
201inline bool isProxyObjectSpeculation(SpeculatedType value)
202{
203 return value == SpecProxyObject;
204}
205
206inline bool isDerivedArraySpeculation(SpeculatedType value)
207{
208 return value == SpecDerivedArray;
209}
210
211inline bool isInt8ArraySpeculation(SpeculatedType value)
212{
213 return value == SpecInt8Array;
214}
215
216inline bool isInt16ArraySpeculation(SpeculatedType value)
217{
218 return value == SpecInt16Array;
219}
220
221inline bool isInt32ArraySpeculation(SpeculatedType value)
222{
223 return value == SpecInt32Array;
224}
225
226inline bool isUint8ArraySpeculation(SpeculatedType value)
227{
228 return value == SpecUint8Array;
229}
230
231inline bool isUint8ClampedArraySpeculation(SpeculatedType value)
232{
233 return value == SpecUint8ClampedArray;
234}
235
236inline bool isUint16ArraySpeculation(SpeculatedType value)
237{
238 return value == SpecUint16Array;
239}
240
241inline bool isUint32ArraySpeculation(SpeculatedType value)
242{
243 return value == SpecUint32Array;
244}
245
246inline bool isFloat32ArraySpeculation(SpeculatedType value)
247{
248 return value == SpecFloat32Array;
249}
250
251inline bool isFloat64ArraySpeculation(SpeculatedType value)
252{
253 return value == SpecFloat64Array;
254}
255
256inline bool isDirectArgumentsSpeculation(SpeculatedType value)
257{
258 return value == SpecDirectArguments;
259}
260
261inline bool isScopedArgumentsSpeculation(SpeculatedType value)
262{
263 return value == SpecScopedArguments;
264}
265
266inline bool isActionableIntMutableArraySpeculation(SpeculatedType value)
267{
268 return isInt8ArraySpeculation(value)
269 || isInt16ArraySpeculation(value)
270 || isInt32ArraySpeculation(value)
271 || isUint8ArraySpeculation(value)
272 || isUint8ClampedArraySpeculation(value)
273 || isUint16ArraySpeculation(value)
274 || isUint32ArraySpeculation(value);
275}
276
277inline bool isActionableFloatMutableArraySpeculation(SpeculatedType value)
278{
279 return isFloat32ArraySpeculation(value)
280 || isFloat64ArraySpeculation(value);
281}
282
283inline bool isActionableTypedMutableArraySpeculation(SpeculatedType value)
284{
285 return isActionableIntMutableArraySpeculation(value)
286 || isActionableFloatMutableArraySpeculation(value);
287}
288
289inline bool isActionableMutableArraySpeculation(SpeculatedType value)
290{
291 return isArraySpeculation(value)
292 || isActionableTypedMutableArraySpeculation(value);
293}
294
295inline bool isActionableArraySpeculation(SpeculatedType value)
296{
297 return isStringSpeculation(value)
298 || isDirectArgumentsSpeculation(value)
299 || isScopedArgumentsSpeculation(value)
300 || isActionableMutableArraySpeculation(value);
301}
302
303inline bool isArrayOrOtherSpeculation(SpeculatedType value)
304{
305 return !!(value & (SpecArray | SpecOther)) && !(value & ~(SpecArray | SpecOther));
306}
307
308inline bool isStringObjectSpeculation(SpeculatedType value)
309{
310 return value == SpecStringObject;
311}
312
313inline bool isStringOrStringObjectSpeculation(SpeculatedType value)
314{
315 return !!value && !(value & ~(SpecString | SpecStringObject));
316}
317
318inline bool isRegExpObjectSpeculation(SpeculatedType value)
319{
320 return value == SpecRegExpObject;
321}
322
323inline bool isBoolInt32Speculation(SpeculatedType value)
324{
325 return value == SpecBoolInt32;
326}
327
328inline bool isInt32Speculation(SpeculatedType value)
329{
330 return value && !(value & ~SpecInt32Only);
331}
332
333inline bool isNotInt32Speculation(SpeculatedType value)
334{
335 return value && !(value & SpecInt32Only);
336}
337
338inline bool isInt32OrBooleanSpeculation(SpeculatedType value)
339{
340 return value && !(value & ~(SpecBoolean | SpecInt32Only));
341}
342
343inline bool isInt32SpeculationForArithmetic(SpeculatedType value)
344{
345 return !(value & (SpecFullDouble | SpecNonInt32AsInt52));
346}
347
348inline bool isInt32OrBooleanSpeculationForArithmetic(SpeculatedType value)
349{
350 return !(value & (SpecFullDouble | SpecNonInt32AsInt52));
351}
352
353inline bool isInt32OrBooleanSpeculationExpectingDefined(SpeculatedType value)
354{
355 return isInt32OrBooleanSpeculation(value & ~SpecOther);
356}
357
358inline bool isAnyInt52Speculation(SpeculatedType value)
359{
360 return !!value && (value & SpecInt52Any) == value;
361}
362
363inline bool isInt32OrInt52Speculation(SpeculatedType value)
364{
365 return !!value && (value & (SpecInt32Only | SpecInt52Any)) == value;
366}
367
368inline bool isIntAnyFormat(SpeculatedType value)
369{
370 return !!value && (value & SpecIntAnyFormat) == value;
371}
372
373inline bool isAnyIntAsDoubleSpeculation(SpeculatedType value)
374{
375 return value == SpecAnyIntAsDouble;
376}
377
378inline bool isDoubleRealSpeculation(SpeculatedType value)
379{
380 return !!value && (value & SpecDoubleReal) == value;
381}
382
383inline bool isDoubleSpeculation(SpeculatedType value)
384{
385 return !!value && (value & SpecFullDouble) == value;
386}
387
388inline bool isDoubleSpeculationForArithmetic(SpeculatedType value)
389{
390 return !!(value & SpecFullDouble);
391}
392
393inline bool isBytecodeRealNumberSpeculation(SpeculatedType value)
394{
395 return !!(value & SpecBytecodeRealNumber) && !(value & ~SpecBytecodeRealNumber);
396}
397
398inline bool isFullRealNumberSpeculation(SpeculatedType value)
399{
400 return !!(value & SpecFullRealNumber) && !(value & ~SpecFullRealNumber);
401}
402
403inline bool isBytecodeNumberSpeculation(SpeculatedType value)
404{
405 return !!(value & SpecBytecodeNumber) && !(value & ~SpecBytecodeNumber);
406}
407
408inline bool isFullNumberSpeculation(SpeculatedType value)
409{
410 return !!(value & SpecFullNumber) && !(value & ~SpecFullNumber);
411}
412
413inline bool isFullNumberOrBooleanSpeculation(SpeculatedType value)
414{
415 return value && !(value & ~(SpecFullNumber | SpecBoolean));
416}
417
418inline bool isFullNumberOrBooleanSpeculationExpectingDefined(SpeculatedType value)
419{
420 return isFullNumberOrBooleanSpeculation(value & ~SpecOther);
421}
422
423inline bool isBooleanSpeculation(SpeculatedType value)
424{
425 return value == SpecBoolean;
426}
427
428inline bool isNotBooleanSpeculation(SpeculatedType value)
429{
430 return value && !(value & SpecBoolean);
431}
432
433inline bool isOtherSpeculation(SpeculatedType value)
434{
435 return value == SpecOther;
436}
437
438inline bool isMiscSpeculation(SpeculatedType value)
439{
440 return !!value && !(value & ~SpecMisc);
441}
442
443inline bool isOtherOrEmptySpeculation(SpeculatedType value)
444{
445 return !value || value == SpecOther;
446}
447
448inline bool isEmptySpeculation(SpeculatedType value)
449{
450 return value == SpecEmpty;
451}
452
453inline bool isUntypedSpeculationForArithmetic(SpeculatedType value)
454{
455 return !!(value & ~(SpecFullNumber | SpecBoolean));
456}
457
458inline bool isUntypedSpeculationForBitOps(SpeculatedType value)
459{
460 return !!(value & ~(SpecFullNumber | SpecBoolean | SpecOther));
461}
462
463void dumpSpeculation(PrintStream&, SpeculatedType);
464void dumpSpeculationAbbreviated(PrintStream&, SpeculatedType);
465
466MAKE_PRINT_ADAPTOR(SpeculationDump, SpeculatedType, dumpSpeculation);
467MAKE_PRINT_ADAPTOR(AbbreviatedSpeculationDump, SpeculatedType, dumpSpeculationAbbreviated);
468
469// Merge two predictions. Note that currently this just does left | right. It may
470// seem tempting to do so directly, but you would be doing so at your own peril,
471// since the merging protocol SpeculatedType may change at any time (and has already
472// changed several times in its history).
473inline SpeculatedType mergeSpeculations(SpeculatedType left, SpeculatedType right)
474{
475 return left | right;
476}
477
478template<typename T>
479inline bool mergeSpeculation(T& left, SpeculatedType right)
480{
481 SpeculatedType newSpeculation = static_cast<T>(mergeSpeculations(static_cast<SpeculatedType>(left), right));
482 bool result = newSpeculation != static_cast<SpeculatedType>(left);
483 left = newSpeculation;
484 return result;
485}
486
487inline bool speculationChecked(SpeculatedType actual, SpeculatedType desired)
488{
489 return (actual | desired) == desired;
490}
491
492SpeculatedType speculationFromClassInfo(const ClassInfo*);
493SpeculatedType speculationFromStructure(Structure*);
494SpeculatedType speculationFromCell(JSCell*);
495JS_EXPORT_PRIVATE SpeculatedType speculationFromValue(JSValue);
496// If it's an anyInt(), it'll return speculated types from the Int52 lattice.
497// Otherwise, it'll return types from the JSValue lattice.
498JS_EXPORT_PRIVATE SpeculatedType int52AwareSpeculationFromValue(JSValue);
499SpeculatedType speculationFromJSType(JSType);
500
501SpeculatedType speculationFromTypedArrayType(TypedArrayType); // only valid for typed views.
502TypedArrayType typedArrayTypeFromSpeculation(SpeculatedType);
503
504SpeculatedType leastUpperBoundOfStrictlyEquivalentSpeculations(SpeculatedType);
505
506bool valuesCouldBeEqual(SpeculatedType, SpeculatedType);
507
508// Precise computation of the type of the result of a double computation after we
509// already know that the inputs are doubles and that the result must be a double. Use
510// the closest one of these that applies.
511SpeculatedType typeOfDoubleSum(SpeculatedType, SpeculatedType);
512SpeculatedType typeOfDoubleDifference(SpeculatedType, SpeculatedType);
513SpeculatedType typeOfDoubleProduct(SpeculatedType, SpeculatedType);
514SpeculatedType typeOfDoubleQuotient(SpeculatedType, SpeculatedType);
515SpeculatedType typeOfDoubleMinMax(SpeculatedType, SpeculatedType);
516SpeculatedType typeOfDoubleNegation(SpeculatedType);
517SpeculatedType typeOfDoubleAbs(SpeculatedType);
518SpeculatedType typeOfDoubleRounding(SpeculatedType);
519SpeculatedType typeOfDoublePow(SpeculatedType, SpeculatedType);
520
521// This conservatively models the behavior of arbitrary double operations.
522SpeculatedType typeOfDoubleBinaryOp(SpeculatedType, SpeculatedType);
523SpeculatedType typeOfDoubleUnaryOp(SpeculatedType);
524
525// This is mostly for debugging so we can fill profiles from strings.
526SpeculatedType speculationFromString(const char*);
527
528} // namespace JSC
529