Version 3.19.17.

src/hydrogen.cc

 // Copyright 2012 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
 //
 //     * Redistributions of source code must retain the above copyright
 //       notice, this list of conditions and the following disclaimer.
 //     * Redistributions in binary form must reproduce the above
 //       copyright notice, this list of conditions and the following
 //       disclaimer in the documentation and/or other materials provided
@@ skipping 691 matching lines @@
       merge_block_(NULL) {
   continuation->Continue(&first_true_block_,
                          &first_false_block_,
                          &position_);
 }
 
 
 HInstruction* HGraphBuilder::IfBuilder::IfCompare(
     HValue* left,
     HValue* right,
-    Token::Value token) {
+    Token::Value token,
+    Representation input_representation) {
   HCompareIDAndBranch* compare =
       new(zone()) HCompareIDAndBranch(left, right, token);
+  compare->set_observed_input_representation(input_representation,
+                                             input_representation);
+  compare->AssumeRepresentation(input_representation);
   AddCompare(compare);
   return compare;
 }
 
 
 HInstruction* HGraphBuilder::IfBuilder::IfCompareMap(HValue* left,
                                                      Handle<Map> map) {
   HCompareMap* compare =
       new(zone()) HCompareMap(left, map, first_true_block_, first_false_block_);
   AddCompare(compare);
@@ skipping 268 matching lines @@
   HBoundsCheck* result = new(graph()->zone()) HBoundsCheck(index, length);
   AddInstruction(result);
   return result;
 }
 
 
 HReturn* HGraphBuilder::AddReturn(HValue* value) {
   HValue* context = environment()->LookupContext();
   int num_parameters = graph()->info()->num_parameters();
   HValue* params = AddInstruction(new(graph()->zone())
-      HConstant(num_parameters));
+      HConstant(num_parameters, Representation::Integer32()));
   HReturn* return_instruction = new(graph()->zone())
       HReturn(value, context, params);
   current_block()->FinishExit(return_instruction);
   return return_instruction;
 }
 
 
 HBasicBlock* HGraphBuilder::CreateBasicBlock(HEnvironment* env) {
   HBasicBlock* b = graph()->CreateBasicBlock();
   b->SetInitialEnvironment(env);
@@ skipping 144 matching lines @@
 
   environment()->Push(new_elements);
   capacity_checker.Else();
 
   environment()->Push(elements);
   capacity_checker.End();
 
   if (is_js_array) {
     HValue* new_length = AddInstruction(
         HAdd::New(zone, context, length, graph_->GetConstant1()));
+    new_length->AssumeRepresentation(Representation::Integer32());
     new_length->ClearFlag(HValue::kCanOverflow);
 
     Representation representation = IsFastElementsKind(kind)
         ? Representation::Smi() : Representation::Tagged();
     AddStore(object, HObjectAccess::ForArrayLength(), new_length,
         representation);
   }
 
   length_checker.Else();
 
@@ skipping 152 matching lines @@
 }
 
 
 HValue* HGraphBuilder::BuildAllocateElements(HValue* context,
                                              ElementsKind kind,
                                              HValue* capacity) {
   Zone* zone = this->zone();
 
   int elements_size = IsFastDoubleElementsKind(kind)
       ? kDoubleSize : kPointerSize;
-  HConstant* elements_size_value = new(zone) HConstant(elements_size);
+  HConstant* elements_size_value =
+      new(zone) HConstant(elements_size, Representation::Integer32());
   AddInstruction(elements_size_value);
   HValue* mul = AddInstruction(
                     HMul::New(zone, context, capacity, elements_size_value));
+  mul->AssumeRepresentation(Representation::Integer32());
   mul->ClearFlag(HValue::kCanOverflow);
 
-  HConstant* header_size = new(zone) HConstant(FixedArray::kHeaderSize);
+  HConstant* header_size =
+      new(zone) HConstant(FixedArray::kHeaderSize, Representation::Integer32());
   AddInstruction(header_size);
   HValue* total_size = AddInstruction(
                            HAdd::New(zone, context, mul, header_size));
+  total_size->AssumeRepresentation(Representation::Integer32());
   total_size->ClearFlag(HValue::kCanOverflow);
 
   HAllocate::Flags flags = HAllocate::DefaultFlags(kind);
   if (isolate()->heap()->ShouldGloballyPretenure()) {
     // TODO(hpayer): When pretenuring can be internalized, flags can become
     // private to HAllocate.
     if (IsFastDoubleElementsKind(kind)) {
       flags = static_cast<HAllocate::Flags>(
           flags | HAllocate::CAN_ALLOCATE_IN_OLD_DATA_SPACE);
     } else {
@@ skipping 37 matching lines @@
 
 HInnerAllocatedObject* HGraphBuilder::BuildJSArrayHeader(HValue* array,
     HValue* array_map,
     AllocationSiteMode mode,
     HValue* allocation_site_payload,
     HValue* length_field) {
 
   AddStore(array, HObjectAccess::ForMap(), array_map);
 
   HConstant* empty_fixed_array =
-      new(zone()) HConstant(isolate()->factory()->empty_fixed_array());
+      new(zone()) HConstant(
+          Handle<FixedArray>(isolate()->heap()->empty_fixed_array()),
+          Representation::Tagged());
   AddInstruction(empty_fixed_array);
 
   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
   AddStore(array, access, empty_fixed_array);
   AddStore(array, HObjectAccess::ForArrayLength(), length_field);
 
   if (mode == TRACK_ALLOCATION_SITE) {
     BuildCreateAllocationSiteInfo(array,
                                   JSArray::kSize,
                                   allocation_site_payload);
@@ skipping 18 matching lines @@
   return AddLoad(object, HObjectAccess::ForElementsPointer(), typecheck);
 }
 
 
 HValue* HGraphBuilder::BuildNewElementsCapacity(HValue* context,
                                                 HValue* old_capacity) {
   Zone* zone = this->zone();
   HValue* half_old_capacity =
       AddInstruction(HShr::New(zone, context, old_capacity,
                                graph_->GetConstant1()));
+  half_old_capacity->AssumeRepresentation(Representation::Integer32());
   half_old_capacity->ClearFlag(HValue::kCanOverflow);
 
   HValue* new_capacity = AddInstruction(
       HAdd::New(zone, context, half_old_capacity, old_capacity));
+  new_capacity->AssumeRepresentation(Representation::Integer32());
   new_capacity->ClearFlag(HValue::kCanOverflow);
 
-  HValue* min_growth = AddInstruction(new(zone) HConstant(16));
+  HValue* min_growth =
+      AddInstruction(new(zone) HConstant(16, Representation::Integer32()));
 
   new_capacity = AddInstruction(
       HAdd::New(zone, context, new_capacity, min_growth));
+  new_capacity->AssumeRepresentation(Representation::Integer32());
   new_capacity->ClearFlag(HValue::kCanOverflow);
 
   return new_capacity;
 }
 
 
 void HGraphBuilder::BuildNewSpaceArrayCheck(HValue* length, ElementsKind kind) {
   Zone* zone = this->zone();
   Heap* heap = isolate()->heap();
   int element_size = IsFastDoubleElementsKind(kind) ? kDoubleSize
@@ skipping 35 matching lines @@
                                               ElementsKind elements_kind,
                                               HValue* from,
                                               HValue* to) {
   // Fast elements kinds need to be initialized in case statements below cause
   // a garbage collection.
   Factory* factory = isolate()->factory();
 
   double nan_double = FixedDoubleArray::hole_nan_as_double();
   Zone* zone = this->zone();
   HValue* hole = IsFastSmiOrObjectElementsKind(elements_kind)
-      ? AddInstruction(new(zone) HConstant(factory->the_hole_value()))
-      : AddInstruction(new(zone) HConstant(nan_double));
+      ? AddInstruction(new(zone) HConstant(factory->the_hole_value(),
+                                           Representation::Tagged()))
+      : AddInstruction(new(zone) HConstant(nan_double,
+                                           Representation::Double()));
 
   // Special loop unfolding case
   static const int kLoopUnfoldLimit = 4;
   bool unfold_loop = false;
   int initial_capacity = JSArray::kPreallocatedArrayElements;
   if (from->IsConstant() && to->IsConstant() &&
       initial_capacity <= kLoopUnfoldLimit) {
     HConstant* constant_from = HConstant::cast(from);
     HConstant* constant_to = HConstant::cast(to);
 
@@ skipping 92 matching lines @@
   int elems_offset = size;
   if (length > 0) {
     size += IsFastDoubleElementsKind(kind)
         ? FixedDoubleArray::SizeFor(length)
         : FixedArray::SizeFor(length);
   }
 
   HAllocate::Flags allocate_flags = HAllocate::DefaultFlags(kind);
   // Allocate both the JS array and the elements array in one big
   // allocation. This avoids multiple limit checks.
-  HValue* size_in_bytes = AddInstruction(new(zone) HConstant(size));
+  HValue* size_in_bytes =
+      AddInstruction(new(zone) HConstant(size, Representation::Integer32()));
   HInstruction* object =
       AddInstruction(new(zone) HAllocate(context,
                                          size_in_bytes,
                                          HType::JSObject(),
                                          allocate_flags));
 
   // Copy the JS array part.
   for (int i = 0; i < JSArray::kSize; i += kPointerSize) {
     if ((i != JSArray::kElementsOffset) || (length == 0)) {
       HObjectAccess access = HObjectAccess::ForJSArrayOffset(i);
@@ skipping 102 matching lines @@
       HGlobalObject(context));
   HObjectAccess access = HObjectAccess::ForJSObjectOffset(
       GlobalObject::kNativeContextOffset);
   return AddLoad(global_object, access);
 }
 
 
 HInstruction* HGraphBuilder::BuildGetArrayFunction(HValue* context) {
   HInstruction* native_context = BuildGetNativeContext(context);
   HInstruction* index = AddInstruction(new(zone())
-      HConstant(Context::ARRAY_FUNCTION_INDEX));
+      HConstant(Context::ARRAY_FUNCTION_INDEX, Representation::Integer32()));
 
   return AddInstruction(new (zone())
       HLoadKeyed(native_context, index, NULL, FAST_ELEMENTS));
 }
 
 
 HGraphBuilder::JSArrayBuilder::JSArrayBuilder(HGraphBuilder* builder,
                                               ElementsKind kind,
                                               HValue* allocation_site_payload,
                                               bool disable_allocation_sites) :
@@ skipping 15 matching lines @@
     mode_(DONT_TRACK_ALLOCATION_SITE),
     allocation_site_payload_(NULL),
     constructor_function_(constructor_function) {
 }
 
 
 HValue* HGraphBuilder::JSArrayBuilder::EmitMapCode(HValue* context) {
   HInstruction* native_context = builder()->BuildGetNativeContext(context);
 
   HInstruction* index = builder()->AddInstruction(new(zone())
-      HConstant(Context::JS_ARRAY_MAPS_INDEX));
+      HConstant(Context::JS_ARRAY_MAPS_INDEX, Representation::Integer32()));
 
   HInstruction* map_array = builder()->AddInstruction(new(zone())
       HLoadKeyed(native_context, index, NULL, FAST_ELEMENTS));
 
   HInstruction* kind_index = builder()->AddInstruction(new(zone())
-      HConstant(kind_));
+      HConstant(kind_, Representation::Integer32()));
 
   return builder()->AddInstruction(new(zone())
       HLoadKeyed(map_array, kind_index, NULL, FAST_ELEMENTS));
 }
 
 
 HValue* HGraphBuilder::JSArrayBuilder::EmitInternalMapCode() {
   // Find the map near the constructor function
   HObjectAccess access = HObjectAccess::ForPrototypeOrInitialMap();
   return AddInstruction(
@@ skipping 12 matching lines @@
   if (mode_ == TRACK_ALLOCATION_SITE) {
     base_size += AllocationSiteInfo::kSize;
   }
 
   if (IsFastDoubleElementsKind(kind_)) {
     base_size += FixedDoubleArray::kHeaderSize;
   } else {
     base_size += FixedArray::kHeaderSize;
   }
 
-  HInstruction* elements_size_value = new(zone()) HConstant(elements_size());
+  HInstruction* elements_size_value = new(zone())
+      HConstant(elements_size(), Representation::Integer32());
   AddInstruction(elements_size_value);
   HInstruction* mul = HMul::New(zone(), context, length_node,
                                 elements_size_value);
+  mul->AssumeRepresentation(Representation::Integer32());
   mul->ClearFlag(HValue::kCanOverflow);
   AddInstruction(mul);
 
-  HInstruction* base = new(zone()) HConstant(base_size);
+  HInstruction* base = new(zone()) HConstant(base_size,
+                                             Representation::Integer32());
   AddInstruction(base);
   HInstruction* total_size = HAdd::New(zone(), context, base, mul);
+  total_size->AssumeRepresentation(Representation::Integer32());
   total_size->ClearFlag(HValue::kCanOverflow);
   AddInstruction(total_size);
   return total_size;
 }
 
 
 HValue* HGraphBuilder::JSArrayBuilder::EstablishEmptyArrayAllocationSize() {
   int base_size = JSArray::kSize;
   if (mode_ == TRACK_ALLOCATION_SITE) {
     base_size += AllocationSiteInfo::kSize;
   }
 
   base_size += IsFastDoubleElementsKind(kind_)
       ? FixedDoubleArray::SizeFor(initial_capacity())
       : FixedArray::SizeFor(initial_capacity());
 
-  HConstant* array_size = new(zone()) HConstant(base_size);
+  HConstant* array_size =
+      new(zone()) HConstant(base_size, Representation::Integer32());
   AddInstruction(array_size);
   return array_size;
 }
 
 
 HValue* HGraphBuilder::JSArrayBuilder::AllocateEmptyArray() {
   HValue* size_in_bytes = EstablishEmptyArrayAllocationSize();
-  HConstant* capacity = new(zone()) HConstant(initial_capacity());
+  HConstant* capacity =
+      new(zone()) HConstant(initial_capacity(), Representation::Integer32());
   AddInstruction(capacity);
   return AllocateArray(size_in_bytes,
                        capacity,
                        builder()->graph()->GetConstant0(),
                        true);
 }
 
 
 HValue* HGraphBuilder::JSArrayBuilder::AllocateArray(HValue* capacity,
                                                      HValue* length_field,
@@ skipping 57 matching lines @@
                                         Representation representation) {
   HLoadNamedField *instr =
       new(zone()) HLoadNamedField(object, access, typecheck, representation);
   AddInstruction(instr);
   return instr;
 }
 
 
 HStoreNamedField* HGraphBuilder::AddStoreMapConstant(HValue *object,
                                                      Handle<Map> map) {
-  HValue* constant = AddInstruction(new(zone()) HConstant(map));
+  HValue* constant =
+      AddInstruction(new(zone()) HConstant(map, Representation::Tagged()));
   HStoreNamedField *instr =
       new(zone()) HStoreNamedField(object, HObjectAccess::ForMap(), constant);
   AddInstruction(instr);
   return instr;
 }
 
 
 HOptimizedGraphBuilder::HOptimizedGraphBuilder(CompilationInfo* info)
     : HGraphBuilder(info),
       function_state_(NULL),
@@ skipping 1568 matching lines @@
 FunctionState::FunctionState(HOptimizedGraphBuilder* owner,
                              CompilationInfo* info,
                              InliningKind inlining_kind)
     : owner_(owner),
       compilation_info_(info),
       call_context_(NULL),
       inlining_kind_(inlining_kind),
       function_return_(NULL),
       test_context_(NULL),
       entry_(NULL),
-      arguments_object_(NULL),
       arguments_elements_(NULL),
       outer_(owner->function_state()) {
   if (outer_ != NULL) {
     // State for an inline function.
     if (owner->ast_context()->IsTest()) {
       HBasicBlock* if_true = owner->graph()->CreateBasicBlock();
       HBasicBlock* if_false = owner->graph()->CreateBasicBlock();
       if_true->MarkAsInlineReturnTarget(owner->current_block());
       if_false->MarkAsInlineReturnTarget(owner->current_block());
       TestContext* outer_test_context = TestContext::cast(owner->ast_context());
@@ skipping 1127 matching lines @@
 
   while (!arguments.is_empty()) {
     AddInstruction(new(zone()) HPushArgument(arguments.RemoveLast()));
   }
   return call;
 }
 
 
 void HOptimizedGraphBuilder::SetUpScope(Scope* scope) {
   HConstant* undefined_constant = new(zone()) HConstant(
-      isolate()->factory()->undefined_value());
+      isolate()->factory()->undefined_value(), Representation::Tagged());
   AddInstruction(undefined_constant);
   graph()->set_undefined_constant(undefined_constant);
 
-  // Create an arguments object containing the initial parameters.  Set the
-  // initial values of parameters including "this" having parameter index 0.
+  HArgumentsObject* object = new(zone()) HArgumentsObject;
+  AddInstruction(object);
+  graph()->SetArgumentsObject(object);
+
+  // Set the initial values of parameters including "this".  "This" has
+  // parameter index 0.
   ASSERT_EQ(scope->num_parameters() + 1, environment()->parameter_count());
-  HArgumentsObject* arguments_object =
-      new(zone()) HArgumentsObject(environment()->parameter_count(), zone());
+
   for (int i = 0; i < environment()->parameter_count(); ++i) {
     HInstruction* parameter = AddInstruction(new(zone()) HParameter(i));
-    arguments_object->AddArgument(parameter, zone());
     environment()->Bind(i, parameter);
   }
-  AddInstruction(arguments_object);
-  graph()->SetArgumentsObject(arguments_object);
 
   // First special is HContext.
   HInstruction* context = AddInstruction(new(zone()) HContext);
   environment()->BindContext(context);
 
   // Initialize specials and locals to undefined.
   for (int i = environment()->parameter_count() + 1;
        i < environment()->length();
        ++i) {
     environment()->Bind(i, undefined_constant);
@@ skipping 303 matching lines @@
     if (stmt->switch_type() == SwitchStatement::SMI_SWITCH) {
       if (!clause->compare_type()->Is(Type::Integer31())) {
         AddSoftDeoptimize();
       }
 
       HCompareIDAndBranch* compare_ =
           new(zone()) HCompareIDAndBranch(tag_value,
                                           label_value,
                                           Token::EQ_STRICT);
       compare_->set_observed_input_representation(
-          Representation::Smi(), Representation::Smi());
+          Representation::Integer32(), Representation::Integer32());
       compare = compare_;
     } else {
       compare = new(zone()) HStringCompareAndBranch(context, tag_value,
                                                     label_value,
                                                     Token::EQ_STRICT);
     }
 
     compare->SetSuccessorAt(0, body_block);
     compare->SetSuccessorAt(1, next_test_block);
     current_block()->Finish(compare);
@@ skipping 344 matching lines @@
   set_current_block(loop_entry);
   if (osr_entry) graph()->set_osr_loop_entry(loop_entry);
 
   HValue* index = environment()->ExpressionStackAt(0);
   HValue* limit = environment()->ExpressionStackAt(1);
 
   // Check that we still have more keys.
   HCompareIDAndBranch* compare_index =
       new(zone()) HCompareIDAndBranch(index, limit, Token::LT);
   compare_index->set_observed_input_representation(
-      Representation::Smi(), Representation::Smi());
+      Representation::Integer32(), Representation::Integer32());
 
   HBasicBlock* loop_body = graph()->CreateBasicBlock();
   HBasicBlock* loop_successor = graph()->CreateBasicBlock();
 
   compare_index->SetSuccessorAt(0, loop_body);
   compare_index->SetSuccessorAt(1, loop_successor);
   current_block()->Finish(compare_index);
 
   set_current_block(loop_successor);
   Drop(5);
@@ skipping 201 matching lines @@
     case Variable::UNALLOCATED: {
       if (IsLexicalVariableMode(variable->mode())) {
         // TODO(rossberg): should this be an ASSERT?
         return Bailout("reference to global lexical variable");
       }
       // Handle known global constants like 'undefined' specially to avoid a
       // load from a global cell for them.
       Handle<Object> constant_value =
           isolate()->factory()->GlobalConstantFor(variable->name());
       if (!constant_value.is_null()) {
-        HConstant* instr = new(zone()) HConstant(constant_value);
+        HConstant* instr =
+            new(zone()) HConstant(constant_value, Representation::Tagged());
         return ast_context()->ReturnInstruction(instr, expr->id());
       }
 
       LookupResult lookup(isolate());
       GlobalPropertyAccess type =
           LookupGlobalProperty(variable, &lookup, false);
 
       if (type == kUseCell &&
           current_info()->global_object()->IsAccessCheckNeeded()) {
         type = kUseGeneric;
@@ skipping 39 matching lines @@
     case Variable::LOOKUP:
       return Bailout("reference to a variable which requires dynamic lookup");
   }
 }
 
 
 void HOptimizedGraphBuilder::VisitLiteral(Literal* expr) {
   ASSERT(!HasStackOverflow());
   ASSERT(current_block() != NULL);
   ASSERT(current_block()->HasPredecessor());
-  HConstant* instr = new(zone()) HConstant(expr->handle());
+  HConstant* instr =
+      new(zone()) HConstant(expr->handle(), Representation::None());
   return ast_context()->ReturnInstruction(instr, expr->id());
 }
 
 
 void HOptimizedGraphBuilder::VisitRegExpLiteral(RegExpLiteral* expr) {
   ASSERT(!HasStackOverflow());
   ASSERT(current_block() != NULL);
   ASSERT(current_block()->HasPredecessor());
   Handle<JSFunction> closure = function_state()->compilation_info()->closure();
   Handle<FixedArray> literals(closure->literals());
@@ skipping 204 matching lines @@
     NoObservableSideEffectsScope no_effects(this);
     Handle<FixedArray> closure_literals(closure->literals(), isolate());
     Handle<FixedArray> constant_properties = expr->constant_properties();
     int literal_index = expr->literal_index();
     int flags = expr->fast_elements()
         ? ObjectLiteral::kFastElements : ObjectLiteral::kNoFlags;
     flags |= expr->has_function()
         ? ObjectLiteral::kHasFunction : ObjectLiteral::kNoFlags;
 
     AddInstruction(new(zone()) HPushArgument(AddInstruction(
-        new(zone()) HConstant(closure_literals))));
+        new(zone()) HConstant(closure_literals, Representation::Tagged()))));
     AddInstruction(new(zone()) HPushArgument(AddInstruction(
-        new(zone()) HConstant(literal_index))));
+        new(zone()) HConstant(literal_index, Representation::Tagged()))));
     AddInstruction(new(zone()) HPushArgument(AddInstruction(
-        new(zone()) HConstant(constant_properties))));
+        new(zone()) HConstant(constant_properties, Representation::Tagged()))));
     AddInstruction(new(zone()) HPushArgument(AddInstruction(
-        new(zone()) HConstant(flags))));
+        new(zone()) HConstant(flags, Representation::Tagged()))));
 
     Runtime::FunctionId function_id =
         (expr->depth() > 1 || expr->may_store_doubles())
         ? Runtime::kCreateObjectLiteral : Runtime::kCreateObjectLiteralShallow;
     literal = AddInstruction(
         new(zone()) HCallRuntime(context,
                                  isolate()->factory()->empty_string(),
                                  Runtime::FunctionForId(function_id),
                                  4));
   }
@@ skipping 137 matching lines @@
     // TODO(mstarzinger): The following check and deopt is actually obsolete
     // but test cases for the tick processor fails because profile differs.
 
     // Deopt if the array literal boilerplate ElementsKind is of a type
     // different than the expected one. The check isn't necessary if the
     // boilerplate has already been converted to TERMINAL_FAST_ELEMENTS_KIND.
     if (CanTransitionToMoreGeneralFastElementsKind(
             boilerplate_elements_kind, true)) {
       IfBuilder builder(this);
       HValue* boilerplate = AddInstruction(new(zone())
-          HConstant(original_boilerplate_object));
+          HConstant(original_boilerplate_object, Representation::Tagged()));
       HValue* elements_kind = AddInstruction(new(zone())
           HElementsKind(boilerplate));
       HValue* expected_kind = AddInstruction(new(zone())
-          HConstant(boilerplate_elements_kind));
+          HConstant(boilerplate_elements_kind, Representation::Integer32()));
       builder.IfCompare(elements_kind, expected_kind, Token::EQ);
       builder.Then();
       builder.ElseDeopt();
     }
 
     AddInstruction(new(zone()) HPushArgument(AddInstruction(
-        new(zone()) HConstant(literals))));
+        new(zone()) HConstant(literals, Representation::Tagged()))));
     AddInstruction(new(zone()) HPushArgument(AddInstruction(
-        new(zone()) HConstant(literal_index))));
+        new(zone()) HConstant(literal_index, Representation::Tagged()))));
     AddInstruction(new(zone()) HPushArgument(AddInstruction(
-        new(zone()) HConstant(constants))));
+        new(zone()) HConstant(constants, Representation::Tagged()))));
 
     Runtime::FunctionId function_id = (expr->depth() > 1)
         ? Runtime::kCreateArrayLiteral : Runtime::kCreateArrayLiteralShallow;
     literal = AddInstruction(
         new(zone()) HCallRuntime(context,
                                  isolate()->factory()->empty_string(),
                                  Runtime::FunctionForId(function_id),
                                  3));
   }
 
   // The array is expected in the bailout environment during computation
   // of the property values and is the value of the entire expression.
   Push(literal);
-  // The literal index is on the stack, too.
-  Push(AddInstruction(new(zone()) HConstant(expr->literal_index())));
 
   HInstruction* elements = NULL;
 
   for (int i = 0; i < length; i++) {
     Expression* subexpr = subexprs->at(i);
     // If the subexpression is a literal or a simple materialized literal it
     // is already set in the cloned array.
     if (CompileTimeValue::IsCompileTimeValue(subexpr)) continue;
 
     CHECK_ALIVE(VisitForValue(subexpr));
@@ skipping 17 matching lines @@
             value,
             boilerplate_elements_kind));
         break;
       default:
         UNREACHABLE();
         break;
     }
 
     AddSimulate(expr->GetIdForElement(i));
   }
-
-  Drop(1);  // array literal index
   return ast_context()->ReturnValue(Pop());
 }
 
 
 // Sets the lookup result and returns true if the load/store can be inlined.
 static bool ComputeLoadStoreField(Handle<Map> type,
                                   Handle<String> name,
                                   LookupResult* lookup,
                                   bool is_store) {
   if (type->has_named_interceptor()) {
@@ skipping 83 matching lines @@
   HObjectAccess field_access = HObjectAccess::ForField(map, lookup, name);
   Representation representation = ComputeLoadStoreRepresentation(map, lookup);
   bool transition_to_field = lookup->IsTransitionToField(*map);
 
   HStoreNamedField *instr;
   if (FLAG_track_double_fields && representation.IsDouble()) {
     if (transition_to_field) {
       // The store requires a mutable HeapNumber to be allocated.
       NoObservableSideEffectsScope no_side_effects(this);
       HInstruction* heap_number_size = AddInstruction(new(zone()) HConstant(
-          HeapNumber::kSize));
+          HeapNumber::kSize, Representation::Integer32()));
       HInstruction* double_box = AddInstruction(new(zone()) HAllocate(
           environment()->LookupContext(), heap_number_size,
           HType::HeapNumber(), HAllocate::CAN_ALLOCATE_IN_NEW_SPACE));
       AddStoreMapConstant(double_box, isolate()->factory()->heap_number_map());
       AddStore(double_box, HObjectAccess::ForHeapNumberValue(),
           value, Representation::Double());
       instr = new(zone()) HStoreNamedField(object, field_access, double_box);
     } else {
       // Already holds a HeapNumber; load the box and write its value field.
       HInstruction* double_box = AddLoad(object, field_access);
@@ skipping 55 matching lines @@
   if (ComputeLoadStoreField(map, name, &lookup, true)) {
     AddCheckMapsWithTransitions(object, map);
     return BuildStoreNamedField(object, name, value, map, &lookup);
   }
 
   // No luck, do a generic store.
   return BuildStoreNamedGeneric(object, name, value);
 }
 
 
-HInstruction* HOptimizedGraphBuilder::TryLoadPolymorphicAsMonomorphic(
+bool HOptimizedGraphBuilder::HandlePolymorphicArrayLengthLoad(
     Property* expr,
     HValue* object,
     SmallMapList* types,
     Handle<String> name) {
+  if (!name->Equals(isolate()->heap()->length_string())) return false;
+
+  for (int i = 0; i < types->length(); i++) {
+    if (types->at(i)->instance_type() != JS_ARRAY_TYPE) return false;
+  }
+
+  BuildCheckNonSmi(object);
+
+  HInstruction* typecheck =
+      AddInstruction(HCheckMaps::New(object, types, zone()));
+  HInstruction* instr = new(zone())
+      HLoadNamedField(object, HObjectAccess::ForArrayLength(), typecheck);
+
+  instr->set_position(expr->position());
+  ast_context()->ReturnInstruction(instr, expr->id());
+  return true;
+}
+
+
+void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(Property* expr,
+    HValue* object,
+    SmallMapList* types,
+    Handle<String> name) {
+
+  if (HandlePolymorphicArrayLengthLoad(expr, object, types, name))
+    return;
+
+  BuildCheckNonSmi(object);
+
   // Use monomorphic load if property lookup results in the same field index
   // for all maps. Requires special map check on the set of all handled maps.
+  HInstruction* instr = NULL;
   LookupResult lookup(isolate());
   int count;
   Representation representation = Representation::None();
   HObjectAccess access = HObjectAccess::ForMap();  // initial value unused.
   for (count = 0;
        count < types->length() && count < kMaxLoadPolymorphism;
        ++count) {
     Handle<Map> map = types->at(count);
     if (!ComputeLoadStoreField(map, name, &lookup, false)) break;
 
@@ skipping 10 matching lines @@
       break;
     } else if (access.offset() != new_access.offset()) {
       // Offsets did not match.
       break;
     } else if (access.IsInobject() != new_access.IsInobject()) {
       // In-objectness did not match.
       break;
     }
   }
 
-  if (count != types->length()) return NULL;
-
-  // Everything matched; can use monomorphic load.
-  BuildCheckNonSmi(object);
-  AddInstruction(HCheckMaps::New(object, types, zone()));
-  return BuildLoadNamedField(object, access, representation);
-}
-
-
-void HOptimizedGraphBuilder::HandlePolymorphicLoadNamedField(
-    Property* expr,
-    HValue* object,
-    SmallMapList* types,
-    Handle<String> name) {
-  HInstruction* instr = TryLoadPolymorphicAsMonomorphic(
-      expr, object, types, name);
-  if (instr == NULL) {
+  if (count == types->length()) {
+    // Everything matched; can use monomorphic load.
+    AddInstruction(HCheckMaps::New(object, types, zone()));
+    instr = BuildLoadNamedField(object, access, representation);
+  } else {
     // Something did not match; must use a polymorphic load.
-    BuildCheckNonSmi(object);
     HValue* context = environment()->LookupContext();
     instr = new(zone()) HLoadNamedFieldPolymorphic(
         context, object, types, name, zone());
   }
 
   instr->set_position(expr->position());
   return ast_context()->ReturnInstruction(instr, expr->id());
 }
 
 
@@ skipping 274 matching lines @@
     return ast_context()->ReturnValue(Pop());
 
   } else if (prop != NULL) {
     if (prop->key()->IsPropertyName()) {
       // Named property.
       CHECK_ALIVE(VisitForValue(prop->obj()));
       HValue* object = Top();
 
       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       Handle<Map> map;
-      HInstruction* load = NULL;
-      SmallMapList* types = prop->GetReceiverTypes();
+      HInstruction* load;
       bool monomorphic = prop->IsMonomorphic();
       if (monomorphic) {
-        map = types->first();
+        map = prop->GetReceiverTypes()->first();
         // We can't generate code for a monomorphic dict mode load so
         // just pretend it is not monomorphic.
         if (map->is_dictionary_map()) monomorphic = false;
       }
       if (monomorphic) {
         Handle<JSFunction> getter;
         Handle<JSObject> holder;
         if (LookupGetter(map, name, &getter, &holder)) {
           load = BuildCallGetter(object, map, getter, holder);
         } else {
           load = BuildLoadNamedMonomorphic(object, name, prop, map);
         }
-      } else if (types != NULL && types->length() > 1) {
-        load = TryLoadPolymorphicAsMonomorphic(prop, object, types, name);
+      } else {
+        load = BuildLoadNamedGeneric(object, name, prop);
       }
-      if (load == NULL) load = BuildLoadNamedGeneric(object, name, prop);
       PushAndAdd(load);
       if (load->HasObservableSideEffects()) {
         AddSimulate(prop->LoadId(), REMOVABLE_SIMULATE);
       }
 
       CHECK_ALIVE(VisitForValue(expr->value()));
       HValue* right = Pop();
       HValue* left = Pop();
 
       HInstruction* instr = BuildBinaryOperation(operation, left, right);
@@ skipping 245 matching lines @@
   return field;
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildLoadNamedGeneric(
     HValue* object,
     Handle<String> name,
     Property* expr) {
   if (expr->IsUninitialized()) {
     AddSoftDeoptimize();
-  } else {
-    // OS::DebugBreak();
   }
   HValue* context = environment()->LookupContext();
   return new(zone()) HLoadNamedGeneric(context, object, name);
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildCallGetter(
     HValue* object,
     Handle<Map> map,
     Handle<JSFunction> getter,
@@ skipping 27 matching lines @@
     AddCheckMap(object, map);
     return BuildLoadNamedField(object,
         HObjectAccess::ForField(map, &lookup, name),
         ComputeLoadStoreRepresentation(map, &lookup));
   }
 
   // Handle a load of a constant known function.
   if (lookup.IsConstantFunction()) {
     AddCheckMap(object, map);
     Handle<JSFunction> function(lookup.GetConstantFunctionFromMap(*map));
-    return new(zone()) HConstant(function);
+    return new(zone()) HConstant(function, Representation::Tagged());
   }
 
   // Handle a load from a known field somewhere in the prototype chain.
   LookupInPrototypes(map, name, &lookup);
   if (lookup.IsField()) {
     Handle<JSObject> prototype(JSObject::cast(map->prototype()));
     Handle<JSObject> holder(lookup.holder());
     Handle<Map> holder_map(holder->map());
     AddCheckMap(object, map);
     AddInstruction(new(zone()) HCheckPrototypeMaps(
         prototype, holder, zone(), top_info()));
-    HValue* holder_value = AddInstruction(new(zone()) HConstant(holder));
+    HValue* holder_value = AddInstruction(new(zone())
+        HConstant(holder, Representation::Tagged()));
     return BuildLoadNamedField(holder_value,
         HObjectAccess::ForField(holder_map, &lookup, name),
         ComputeLoadStoreRepresentation(map, &lookup));
   }
 
   // Handle a load of a constant function somewhere in the prototype chain.
   if (lookup.IsConstantFunction()) {
     Handle<JSObject> prototype(JSObject::cast(map->prototype()));
     Handle<JSObject> holder(lookup.holder());
     Handle<Map> holder_map(holder->map());
     AddCheckMap(object, map);
     AddInstruction(new(zone()) HCheckPrototypeMaps(
         prototype, holder, zone(), top_info()));
     Handle<JSFunction> function(lookup.GetConstantFunctionFromMap(*holder_map));
-    return new(zone()) HConstant(function);
+    return new(zone()) HConstant(function, Representation::Tagged());
   }
 
   // No luck, do a generic load.
   return BuildLoadNamedGeneric(object, name, expr);
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildLoadKeyedGeneric(HValue* object,
                                                             HValue* key) {
   HValue* context = environment()->LookupContext();
@@ skipping 366 matching lines @@
 void HOptimizedGraphBuilder::EnsureArgumentsArePushedForAccess() {
   // Outermost function already has arguments on the stack.
   if (function_state()->outer() == NULL) return;
 
   if (function_state()->arguments_pushed()) return;
 
   // Push arguments when entering inlined function.
   HEnterInlined* entry = function_state()->entry();
   entry->set_arguments_pushed();
 
-  HArgumentsObject* arguments = entry->arguments_object();
-  const ZoneList<HValue*>* arguments_values = arguments->arguments_values();
+  ZoneList<HValue*>* arguments_values = entry->arguments_values();
 
   HInstruction* insert_after = entry;
   for (int i = 0; i < arguments_values->length(); i++) {
     HValue* argument = arguments_values->at(i);
     HInstruction* push_argument = new(zone()) HPushArgument(argument);
     push_argument->InsertAfter(insert_after);
     insert_after = push_argument;
   }
 
   HArgumentsElements* arguments_elements =
@@ skipping 572 matching lines @@
                                      undefined,
                                      function_state()->inlining_kind(),
                                      undefined_receiver);
 #ifdef V8_TARGET_ARCH_IA32
   // IA32 only, overwrite the caller's context in the deoptimization
   // environment with the correct one.
   //
   // TODO(kmillikin): implement the same inlining on other platforms so we
   // can remove the unsightly ifdefs in this function.
   HConstant* context =
-      new(zone()) HConstant(Handle<Context>(target->context()));
+      new(zone()) HConstant(Handle<Context>(target->context()),
+                            Representation::Tagged());
   AddInstruction(context);
   inner_env->BindContext(context);
 #endif
 
   AddSimulate(return_id);
   current_block()->UpdateEnvironment(inner_env);
-  HArgumentsObject* arguments_object = NULL;
+  ZoneList<HValue*>* arguments_values = NULL;
 
-  // If the function uses arguments object create and bind one, also copy
-  // current arguments values to use them for materialization.
+  // If the function uses arguments copy current arguments values
+  // to use them for materialization.
   if (function->scope()->arguments() != NULL) {
-    ASSERT(function->scope()->arguments()->IsStackAllocated());
     HEnvironment* arguments_env = inner_env->arguments_environment();
     int arguments_count = arguments_env->parameter_count();
-    arguments_object = new(zone()) HArgumentsObject(arguments_count, zone());
-    inner_env->Bind(function->scope()->arguments(), arguments_object);
+    arguments_values = new(zone()) ZoneList<HValue*>(arguments_count, zone());
     for (int i = 0; i < arguments_count; i++) {
-      arguments_object->AddArgument(arguments_env->Lookup(i), zone());
+      arguments_values->Add(arguments_env->Lookup(i), zone());
     }
-    AddInstruction(arguments_object);
   }
 
   HEnterInlined* enter_inlined =
       new(zone()) HEnterInlined(target,
                                 arguments_count,
                                 function,
                                 function_state()->inlining_kind(),
                                 function->scope()->arguments(),
-                                arguments_object,
+                                arguments_values,
                                 undefined_receiver,
                                 zone());
   function_state()->set_entry(enter_inlined);
   AddInstruction(enter_inlined);
 
+  // If the function uses arguments object create and bind one.
+  if (function->scope()->arguments() != NULL) {
+    ASSERT(function->scope()->arguments()->IsStackAllocated());
+    inner_env->Bind(function->scope()->arguments(),
+                    graph()->GetArgumentsObject());
+  }
+
+
   VisitDeclarations(target_info.scope()->declarations());
   VisitStatements(function->body());
   if (HasStackOverflow()) {
     // Bail out if the inline function did, as we cannot residualize a call
     // instead.
     TraceInline(target, caller, "inline graph construction failed");
     target_shared->DisableOptimization("inlining bailed out");
     inline_bailout_ = true;
     delete target_state;
     return true;
@@ skipping 285 matching lines @@
         Pop();  // Pop receiver.
         HValue* context = environment()->LookupContext();
         HInstruction* result = NULL;
         // Use sqrt() if exponent is 0.5 or -0.5.
         if (right->IsConstant() && HConstant::cast(right)->HasDoubleValue()) {
           double exponent = HConstant::cast(right)->DoubleValue();
           if (exponent == 0.5) {
             result =
                 HUnaryMathOperation::New(zone(), context, left, kMathPowHalf);
           } else if (exponent == -0.5) {
-            HValue* one = graph()->GetConstant1();
+            HConstant* double_one = new(zone()) HConstant(
+                1, Representation::Double());
+            AddInstruction(double_one);
             HInstruction* sqrt =
                 HUnaryMathOperation::New(zone(), context, left, kMathPowHalf);
             AddInstruction(sqrt);
             // MathPowHalf doesn't have side effects so there's no need for
             // an environment simulation here.
             ASSERT(!sqrt->HasObservableSideEffects());
-            result = HDiv::New(zone(), context, one, sqrt);
+            result = HDiv::New(zone(), context, double_one, sqrt);
           } else if (exponent == 2.0) {
             result = HMul::New(zone(), context, left, left);
           }
         } else if (right->EqualsInteger32Constant(2)) {
           result = HMul::New(zone(), context, left, left);
         }
 
         if (result == NULL) {
           result = HPower::New(zone(), left, right);
         }
@@ skipping 96 matching lines @@
         new(zone()) HApplyArguments(function,
                                     wrapped_receiver,
                                     length,
                                     elements);
     result->set_position(expr->position());
     ast_context()->ReturnInstruction(result, expr->id());
     return true;
   } else {
     // We are inside inlined function and we know exactly what is inside
     // arguments object. But we need to be able to materialize at deopt.
+    // TODO(mstarzinger): For now we just ensure arguments are pushed
+    // right after HEnterInlined, but we could be smarter about this.
+    EnsureArgumentsArePushedForAccess();
     ASSERT_EQ(environment()->arguments_environment()->parameter_count(),
-              function_state()->entry()->arguments_object()->arguments_count());
-    HArgumentsObject* args = function_state()->entry()->arguments_object();
-    const ZoneList<HValue*>* arguments_values = args->arguments_values();
+              function_state()->entry()->arguments_values()->length());
+    HEnterInlined* entry = function_state()->entry();
+    ZoneList<HValue*>* arguments_values = entry->arguments_values();
     int arguments_count = arguments_values->length();
     PushAndAdd(new(zone()) HWrapReceiver(receiver, function));
     for (int i = 1; i < arguments_count; i++) {
       Push(arguments_values->at(i));
     }
 
     Handle<JSFunction> known_function;
     if (function->IsConstant()) {
       HConstant* constant_function = HConstant::cast(function);
       known_function = Handle<JSFunction>::cast(constant_function->handle());
@@ skipping 325 matching lines @@
     }
 
     // Calculate instance size from initial map of constructor.
     ASSERT(constructor->has_initial_map());
     Handle<Map> initial_map(constructor->initial_map());
     int instance_size = initial_map->instance_size();
     ASSERT(initial_map->InitialPropertiesLength() == 0);
 
     // Allocate an instance of the implicit receiver object.
     HValue* size_in_bytes =
-        AddInstruction(new(zone()) HConstant(instance_size));
+        AddInstruction(new(zone()) HConstant(instance_size,
+            Representation::Integer32()));
 
     HAllocate::Flags flags = HAllocate::DefaultFlags();
     if (FLAG_pretenuring_call_new &&
         isolate()->heap()->ShouldGloballyPretenure()) {
       flags = static_cast<HAllocate::Flags>(
           flags | HAllocate::CAN_ALLOCATE_IN_OLD_POINTER_SPACE);
     }
 
     HInstruction* receiver =
         AddInstruction(new(zone()) HAllocate(context,
                                              size_in_bytes,
                                              HType::JSObject(),
                                              flags));
     HAllocate::cast(receiver)->set_known_initial_map(initial_map);
 
     // Load the initial map from the constructor.
     HValue* constructor_value =
-        AddInstruction(new(zone()) HConstant(constructor));
+        AddInstruction(new(zone()) HConstant(constructor,
+            Representation::Tagged()));
     HValue* initial_map_value =
         AddLoad(constructor_value, HObjectAccess::ForJSObjectOffset(
             JSFunction::kPrototypeOrInitialMapOffset));
 
     // Initialize map and fields of the newly allocated object.
     { NoObservableSideEffectsScope no_effects(this);
       ASSERT(initial_map->instance_type() == JS_OBJECT_TYPE);
       AddStore(receiver,
                HObjectAccess::ForJSObjectOffset(JSObject::kMapOffset),
                initial_map_value);
       HValue* empty_fixed_array =
-          AddInstruction(new(zone()) HConstant(factory->empty_fixed_array()));
+          AddInstruction(new(zone()) HConstant(factory->empty_fixed_array(),
+              Representation::Tagged()));
       AddStore(receiver,
                HObjectAccess::ForJSObjectOffset(JSObject::kPropertiesOffset),
                empty_fixed_array);
       AddStore(receiver,
                HObjectAccess::ForJSObjectOffset(JSObject::kElementsOffset),
                empty_fixed_array);
       if (initial_map->inobject_properties() != 0) {
         HConstant* undefined = graph()->GetConstantUndefined();
         for (int i = 0; i < initial_map->inobject_properties(); i++) {
           int property_offset = JSObject::kHeaderSize + i * kPointerSize;
@@ skipping 375 matching lines @@
 
     if (prop->key()->IsPropertyName()) {
       // Named property.
       if (returns_original_input) Push(graph()->GetConstantUndefined());
 
       CHECK_ALIVE(VisitForValue(prop->obj()));
       HValue* object = Top();
 
       Handle<String> name = prop->key()->AsLiteral()->AsPropertyName();
       Handle<Map> map;
-      HInstruction* load = NULL;
+      HInstruction* load;
       bool monomorphic = prop->IsMonomorphic();
-      SmallMapList* types = prop->GetReceiverTypes();
       if (monomorphic) {
-        map = types->first();
+        map = prop->GetReceiverTypes()->first();
         if (map->is_dictionary_map()) monomorphic = false;
       }
       if (monomorphic) {
         Handle<JSFunction> getter;
         Handle<JSObject> holder;
         if (LookupGetter(map, name, &getter, &holder)) {
           load = BuildCallGetter(object, map, getter, holder);
         } else {
           load = BuildLoadNamedMonomorphic(object, name, prop, map);
         }
-      } else if (types != NULL && types->length() > 1) {
-        load = TryLoadPolymorphicAsMonomorphic(prop, object, types, name);
+      } else {
+        load = BuildLoadNamedGeneric(object, name, prop);
       }
-      if (load == NULL) load = BuildLoadNamedGeneric(object, name, prop);
       PushAndAdd(load);
       if (load->HasObservableSideEffects()) {
         AddSimulate(prop->LoadId(), REMOVABLE_SIMULATE);
       }
 
       after = BuildIncrement(returns_original_input, expr);
       input = Pop();
 
       HInstruction* store;
       if (!monomorphic || map->is_observed()) {
@@ skipping 67 matching lines @@
     HValue* context,
     HValue* string,
     HValue* index) {
   if (string->IsConstant() && index->IsConstant()) {
     HConstant* c_string = HConstant::cast(string);
     HConstant* c_index = HConstant::cast(index);
     if (c_string->HasStringValue() && c_index->HasNumberValue()) {
       int32_t i = c_index->NumberValueAsInteger32();
       Handle<String> s = c_string->StringValue();
       if (i < 0 || i >= s->length()) {
-        return new(zone()) HConstant(OS::nan_value());
+        return new(zone()) HConstant(OS::nan_value(), Representation::Double());
       }
       return new(zone()) HConstant(s->Get(i));
     }
   }
   BuildCheckNonSmi(string);
   AddInstruction(HCheckInstanceType::NewIsString(string, zone()));
   HInstruction* length = HStringLength::New(zone(), string);
   AddInstruction(length);
   HInstruction* checked_index = AddBoundsCheck(index, length);
   return new(zone()) HStringCharCodeAt(context, string, checked_index);
@@ skipping 294 matching lines @@
   HValue* left = Pop();
   HInstruction* instr = BuildBinaryOperation(expr, left, right);
   instr->set_position(expr->position());
   return ast_context()->ReturnInstruction(instr, expr->id());
 }
 
 
 // TODO(rossberg): this should die eventually.
 Representation HOptimizedGraphBuilder::ToRepresentation(TypeInfo info) {
   if (info.IsUninitialized()) return Representation::None();
-  // TODO(verwaest): Return Smi rather than Integer32.
   if (info.IsSmi()) return Representation::Integer32();
   if (info.IsInteger32()) return Representation::Integer32();
   if (info.IsDouble()) return Representation::Double();
   if (info.IsNumber()) return Representation::Double();
   return Representation::Tagged();
 }
 
 
 Representation HOptimizedGraphBuilder::ToRepresentation(Handle<Type> type) {
   if (type->Is(Type::None())) return Representation::None();
@@ skipping 213 matching lines @@
     return ast_context()->ReturnControl(result, expr->id());
   } else {
     if (combined_rep.IsTagged() || combined_rep.IsNone()) {
       HCompareGeneric* result =
           new(zone()) HCompareGeneric(context, left, right, op);
       result->set_observed_input_representation(1, left_rep);
       result->set_observed_input_representation(2, right_rep);
       result->set_position(expr->position());
       return ast_context()->ReturnInstruction(result, expr->id());
     } else {
-      // TODO(verwaest): Remove once ToRepresentation properly returns Smi when
-      // the IC measures Smi.
-      if (left_type->Is(Type::Integer31())) left_rep = Representation::Smi();
-      if (right_type->Is(Type::Integer31())) right_rep = Representation::Smi();
       HCompareIDAndBranch* result =
           new(zone()) HCompareIDAndBranch(left, right, op);
       result->set_observed_input_representation(left_rep, right_rep);
       result->set_position(expr->position());
       return ast_context()->ReturnControl(result, expr->id());
     }
   }
 }
 
 
@@ skipping 20 matching lines @@
   BuildCompareNil(value, type, expr->position(), &continuation);
   return ast_context()->ReturnContinuation(&continuation, expr->id());
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildThisFunction() {
   // If we share optimized code between different closures, the
   // this-function is not a constant, except inside an inlined body.
   if (function_state()->outer() != NULL) {
       return new(zone()) HConstant(
-          function_state()->compilation_info()->closure());
+          function_state()->compilation_info()->closure(),
+          Representation::Tagged());
   } else {
       return new(zone()) HThisFunction;
   }
 }
 
 
 HInstruction* HOptimizedGraphBuilder::BuildFastLiteral(
     HValue* context,
     Handle<JSObject> boilerplate_object,
     Handle<JSObject> original_boilerplate_object,
     int data_size,
     int pointer_size,
     AllocationSiteMode mode) {
   Zone* zone = this->zone();
   int total_size = data_size + pointer_size;
 
   NoObservableSideEffectsScope no_effects(this);
 
   HAllocate::Flags flags = HAllocate::CAN_ALLOCATE_IN_NEW_SPACE;
   // TODO(hpayer): add support for old data space
   if (isolate()->heap()->ShouldGloballyPretenure() &&
       data_size == 0) {
     flags = static_cast<HAllocate::Flags>(
         flags | HAllocate::CAN_ALLOCATE_IN_OLD_POINTER_SPACE);
   }
 
-  HValue* size_in_bytes = AddInstruction(new(zone) HConstant(total_size));
+  HValue* size_in_bytes =
+      AddInstruction(new(zone) HConstant(total_size,
+          Representation::Integer32()));
   HInstruction* result =
       AddInstruction(new(zone) HAllocate(context,
                                          size_in_bytes,
                                          HType::JSObject(),
                                          flags));
   int offset = 0;
   BuildEmitDeepCopy(boilerplate_object, original_boilerplate_object, result,
                     &offset, mode);
   return result;
 }
@@ skipping 36 matching lines @@
       AddInstruction(new(zone) HInnerAllocatedObject(target, object_offset));
   BuildEmitInObjectProperties(boilerplate_object, original_boilerplate_object,
       object_properties, target, offset);
 
   // Create allocation site info.
   if (mode == TRACK_ALLOCATION_SITE &&
       boilerplate_object->map()->CanTrackAllocationSite()) {
     elements_offset += AllocationSiteInfo::kSize;
     *offset += AllocationSiteInfo::kSize;
     HInstruction* original_boilerplate = AddInstruction(new(zone) HConstant(
-        original_boilerplate_object));
+        original_boilerplate_object, Representation::Tagged()));
     BuildCreateAllocationSiteInfo(target, JSArray::kSize, original_boilerplate);
   }
 }
 
 
 HValue* HOptimizedGraphBuilder::BuildEmitObjectHeader(
     Handle<JSObject> boilerplate_object,
     HInstruction* target,
     int object_offset,
     int elements_offset,
     int elements_size) {
   ASSERT(boilerplate_object->properties()->length() == 0);
   Zone* zone = this->zone();
   HValue* result = NULL;
 
   HValue* object_header =
       AddInstruction(new(zone) HInnerAllocatedObject(target, object_offset));
   Handle<Map> boilerplate_object_map(boilerplate_object->map());
   AddStoreMapConstant(object_header, boilerplate_object_map);
 
   HInstruction* elements;
   if (elements_size == 0) {
     Handle<Object> elements_field =
         Handle<Object>(boilerplate_object->elements(), isolate());
-    elements = AddInstruction(new(zone) HConstant(elements_field));
+    elements = AddInstruction(new(zone) HConstant(
+        elements_field, Representation::Tagged()));
   } else {
     elements = AddInstruction(new(zone) HInnerAllocatedObject(
         target, elements_offset));
     result = elements;
   }
   AddStore(object_header, HObjectAccess::ForElementsPointer(), elements);
 
   Handle<Object> properties_field =
       Handle<Object>(boilerplate_object->properties(), isolate());
   ASSERT(*properties_field == isolate()->heap()->empty_fixed_array());
   HInstruction* properties = AddInstruction(new(zone) HConstant(
-      properties_field));
+      properties_field, Representation::None()));
   HObjectAccess access = HObjectAccess::ForPropertiesPointer();
   AddStore(object_header, access, properties);
 
   if (boilerplate_object->IsJSArray()) {
     Handle<JSArray> boilerplate_array =
         Handle<JSArray>::cast(boilerplate_object);
     Handle<Object> length_field =
         Handle<Object>(boilerplate_array->length(), isolate());
-    HInstruction* length = AddInstruction(new(zone) HConstant(length_field));
+    HInstruction* length = AddInstruction(new(zone) HConstant(
+        length_field, Representation::None()));
 
     ASSERT(boilerplate_array->length()->IsSmi());
     Representation representation =
         IsFastElementsKind(boilerplate_array->GetElementsKind())
         ? Representation::Smi() : Representation::Tagged();
     AddStore(object_header, HObjectAccess::ForArrayLength(),
         length, representation);
   }
 
   return result;
@@ skipping 35 matching lines @@
               isolate()));
       HInstruction* value_instruction =
           AddInstruction(new(zone) HInnerAllocatedObject(target, *offset));
 
       AddStore(object_properties, access, value_instruction);
 
       BuildEmitDeepCopy(value_object, original_value_object, target,
           offset, DONT_TRACK_ALLOCATION_SITE);
     } else {
       Representation representation = details.representation();
-      HInstruction* value_instruction =
-          AddInstruction(new(zone) HConstant(value));
+      HInstruction* value_instruction = AddInstruction(new(zone) HConstant(
+          value, Representation::Tagged()));
 
       if (representation.IsDouble()) {
         // Allocate a HeapNumber box and store the value into it.
         HInstruction* double_box =
             AddInstruction(new(zone) HInnerAllocatedObject(target, *offset));
         AddStoreMapConstant(double_box,
             isolate()->factory()->heap_number_map());
         AddStore(double_box, HObjectAccess::ForHeapNumberValue(),
             value_instruction, Representation::Double());
         value_instruction = double_box;
         *offset += HeapNumber::kSize;
       }
 
       AddStore(object_properties, access, value_instruction);
     }
   }
 
   int inobject_properties = boilerplate_object->map()->inobject_properties();
   HInstruction* value_instruction = AddInstruction(new(zone)
-      HConstant(isolate()->factory()->one_pointer_filler_map()));
+      HConstant(isolate()->factory()->one_pointer_filler_map(),
+          Representation::Tagged()));
   for (int i = copied_fields; i < inobject_properties; i++) {
     ASSERT(boilerplate_object->IsJSObject());
     int property_offset = boilerplate_object->GetInObjectPropertyOffset(i);
     HObjectAccess access = HObjectAccess::ForJSObjectOffset(property_offset);
     AddStore(object_properties, access, value_instruction);
   }
 }
 
 
 void HOptimizedGraphBuilder::BuildEmitElements(
@@ skipping 21 matching lines @@
     UNREACHABLE();
   }
 }
 
 
 void HOptimizedGraphBuilder::BuildEmitFixedDoubleArray(
     Handle<FixedArrayBase> elements,
     ElementsKind kind,
     HValue* object_elements) {
   Zone* zone = this->zone();
-  HInstruction* boilerplate_elements =
-      AddInstruction(new(zone) HConstant(elements));
+  HInstruction* boilerplate_elements = AddInstruction(new(zone) HConstant(
+      elements, Representation::Tagged()));
   int elements_length = elements->length();
   for (int i = 0; i < elements_length; i++) {
     HValue* key_constant = AddInstruction(new(zone) HConstant(i));
     HInstruction* value_instruction =
         AddInstruction(new(zone) HLoadKeyed(
             boilerplate_elements, key_constant, NULL, kind, ALLOW_RETURN_HOLE));
     HInstruction* store = AddInstruction(new(zone) HStoreKeyed(
         object_elements, key_constant, value_instruction, kind));
     store->SetFlag(HValue::kAllowUndefinedAsNaN);
   }
 }
 
 
 void HOptimizedGraphBuilder::BuildEmitFixedArray(
     Handle<FixedArrayBase> elements,
     Handle<FixedArrayBase> original_elements,
     ElementsKind kind,
     HValue* object_elements,
     HInstruction* target,
     int* offset) {
   Zone* zone = this->zone();
-  HInstruction* boilerplate_elements =
-      AddInstruction(new(zone) HConstant(elements));
+  HInstruction* boilerplate_elements = AddInstruction(new(zone) HConstant(
+      elements, Representation::Tagged()));
   int elements_length = elements->length();
   Handle<FixedArray> fast_elements = Handle<FixedArray>::cast(elements);
   Handle<FixedArray> original_fast_elements =
       Handle<FixedArray>::cast(original_elements);
   for (int i = 0; i < elements_length; i++) {
     Handle<Object> value(fast_elements->get(i), isolate());
     HValue* key_constant = AddInstruction(new(zone) HConstant(i));
     if (value->IsJSObject()) {
       Handle<JSObject> value_object = Handle<JSObject>::cast(value);
       Handle<JSObject> original_value_object = Handle<JSObject>::cast(
@@ skipping 748 matching lines @@
 
 HEnvironment::HEnvironment(HEnvironment* outer,
                            Handle<JSFunction> closure,
                            FrameType frame_type,
                            int arguments,
                            Zone* zone)
     : closure_(closure),
       values_(arguments, zone),
       frame_type_(frame_type),
       parameter_count_(arguments),
-      specials_count_(0),
       local_count_(0),
       outer_(outer),
       entry_(NULL),
       pop_count_(0),
       push_count_(0),
       ast_id_(BailoutId::None()),
       zone_(zone) {
 }
 
 
@@ skipping 595 matching lines @@
     }
   }
 
 #ifdef DEBUG
   if (graph_ != NULL) graph_->Verify(false);  // No full verify.
   if (allocator_ != NULL) allocator_->Verify();
 #endif
 }
 
 } }  // namespace v8::internal