Better typing and type verification

- Extend verifier to check types of JS and Simplified nodes.
- Untyped nodes now contain NULL as types, enforcing hard failure.
- Typer immediately installs itself as a decorator; remove explicit decorator installation.
- Decorator eagerly types all nodes that have typed inputs
  (subsumes typing of constant cache, removing its typing
  side-channel and various spurious dependencies on the typer).
- Cut down typer interface to prevent inconsistently typed graphs.
- Remove verification from start, since it caused too much trouble
  with semi-wellformed nodes.
- Fix a couple of bugs on the way that got uncovered.

To do: verifying machine operators. Also, various conditions in the
verifier are currently commented out, because they don't yet hold.

BUG=
R=jarin@chromium.org,titzer@chromium.org

Review URL: https://codereview.chromium.org/658543002

git-svn-id: https://v8.googlecode.com/svn/branches/bleeding_edge@24626 ce2b1a6d-e550-0410-aec6-3dcde31c8c00

src/compiler/generic-node-inl.h

@@ -23,7 +23,8 @@ GenericNode<B, S>::GenericNode(GenericGraphBase* graph, int input_count)
       use_count_(0),
       first_use_(NULL),
       last_use_(NULL) {
-  inputs_.static_ = reinterpret_cast<Input*>(this + 1), AssignUniqueID(graph);
+  inputs_.static_ = reinterpret_cast<Input*>(this + 1);
+  AssignUniqueID(graph);
 }
 
 template <class B, class S>

src/compiler/graph-builder.cc

@@ -167,7 +167,7 @@ Node* StructuredGraphBuilder::NewPhi(int count, Node* input, Node* control) {
   Node** buffer = local_zone()->NewArray<Node*>(count + 1);
   MemsetPointer(buffer, input, count);
   buffer[count] = control;
-  return graph()->NewNode(phi_op, count + 1, buffer);
+  return graph()->NewNode(phi_op, count + 1, buffer, true);
 }
 
 
@@ -178,7 +178,7 @@ Node* StructuredGraphBuilder::NewEffectPhi(int count, Node* input,
   Node** buffer = local_zone()->NewArray<Node*>(count + 1);
   MemsetPointer(buffer, input, count);
   buffer[count] = control;
-  return graph()->NewNode(phi_op, count + 1, buffer);
+  return graph()->NewNode(phi_op, count + 1, buffer, true);
 }
 
 

src/compiler/graph-visualizer.cc

@@ -299,7 +299,7 @@ void GraphVisualizer::AnnotateNode(Node* node) {
   }
   os_ << "}";
 
-  if (FLAG_trace_turbo_types && !NodeProperties::IsControl(node)) {
+  if (FLAG_trace_turbo_types && NodeProperties::IsTyped(node)) {
     Bounds bounds = NodeProperties::GetBounds(node);
     std::ostringstream upper;
     bounds.upper->PrintTo(upper);

src/compiler/graph.cc

@@ -21,14 +21,20 @@ namespace compiler {
 Graph::Graph(Zone* zone) : GenericGraph<Node>(zone), decorators_(zone) {}
 
 
-Node* Graph::NewNode(const Operator* op, int input_count, Node** inputs) {
-  DCHECK_LE(op->InputCount(), input_count);
-  Node* result = Node::New(this, input_count, inputs);
-  result->Initialize(op);
+void Graph::Decorate(Node* node) {
   for (ZoneVector<GraphDecorator*>::iterator i = decorators_.begin();
        i != decorators_.end(); ++i) {
-    (*i)->Decorate(result);
+    (*i)->Decorate(node);
   }
+}
+
+
+Node* Graph::NewNode(
+    const Operator* op, int input_count, Node** inputs, bool incomplete) {
+  DCHECK_LE(op->InputCount(), input_count);
+  Node* result = Node::New(this, input_count, inputs);
+  result->Initialize(op);
+  if (!incomplete) Decorate(result);
   return result;
 }
 

src/compiler/graph.h

@@ -25,7 +25,8 @@ class Graph : public GenericGraph<Node> {
   explicit Graph(Zone* zone);
 
   // Base implementation used by all factory methods.
-  Node* NewNode(const Operator* op, int input_count, Node** inputs);
+  Node* NewNode(const Operator* op, int input_count, Node** inputs,
+                bool incomplete = false);
 
   // Factories for nodes with static input counts.
   Node* NewNode(const Operator* op) {
@@ -64,6 +65,8 @@ class Graph : public GenericGraph<Node> {
   template <class Visitor>
   void VisitNodeInputsFromEnd(Visitor* visitor);
 
+  void Decorate(Node* node);
+
   void AddDecorator(GraphDecorator* decorator) {
     decorators_.push_back(decorator);
   }

src/compiler/js-graph.cc

@@ -12,14 +12,7 @@ namespace compiler {
 
 Node* JSGraph::ImmovableHeapConstant(Handle<HeapObject> object) {
   Unique<HeapObject> unique = Unique<HeapObject>::CreateImmovable(object);
-  return NewNode(common()->HeapConstant(unique));
-}
-
-
-Node* JSGraph::NewNode(const Operator* op) {
-  Node* node = graph()->NewNode(op);
-  typer_->Init(node);
-  return node;
+  return graph()->NewNode(common()->HeapConstant(unique));
 }
 
 
@@ -95,7 +88,7 @@ Node* JSGraph::NaNConstant() {
 
 Node* JSGraph::HeapConstant(Unique<HeapObject> value) {
   // TODO(turbofan): canonicalize heap constants using Unique<T>
-  return NewNode(common()->HeapConstant(value));
+  return graph()->NewNode(common()->HeapConstant(value));
 }
 
 
@@ -151,7 +144,7 @@ Node* JSGraph::Constant(int32_t value) {
 Node* JSGraph::Int32Constant(int32_t value) {
   Node** loc = cache_.FindInt32Constant(value);
   if (*loc == NULL) {
-    *loc = NewNode(common()->Int32Constant(value));
+    *loc = graph()->NewNode(common()->Int32Constant(value));
   }
   return *loc;
 }
@@ -160,7 +153,7 @@ Node* JSGraph::Int32Constant(int32_t value) {
 Node* JSGraph::Int64Constant(int64_t value) {
   Node** loc = cache_.FindInt64Constant(value);
   if (*loc == NULL) {
-    *loc = NewNode(common()->Int64Constant(value));
+    *loc = graph()->NewNode(common()->Int64Constant(value));
   }
   return *loc;
 }
@@ -169,7 +162,7 @@ Node* JSGraph::Int64Constant(int64_t value) {
 Node* JSGraph::NumberConstant(double value) {
   Node** loc = cache_.FindNumberConstant(value);
   if (*loc == NULL) {
-    *loc = NewNode(common()->NumberConstant(value));
+    *loc = graph()->NewNode(common()->NumberConstant(value));
   }
   return *loc;
 }
@@ -177,14 +170,14 @@ Node* JSGraph::NumberConstant(double value) {
 
 Node* JSGraph::Float32Constant(float value) {
   // TODO(turbofan): cache float32 constants.
-  return NewNode(common()->Float32Constant(value));
+  return graph()->NewNode(common()->Float32Constant(value));
 }
 
 
 Node* JSGraph::Float64Constant(double value) {
   Node** loc = cache_.FindFloat64Constant(value);
   if (*loc == NULL) {
-    *loc = NewNode(common()->Float64Constant(value));
+    *loc = graph()->NewNode(common()->Float64Constant(value));
   }
   return *loc;
 }
@@ -193,7 +186,7 @@ Node* JSGraph::Float64Constant(double value) {
 Node* JSGraph::ExternalConstant(ExternalReference reference) {
   Node** loc = cache_.FindExternalConstant(reference);
   if (*loc == NULL) {
-    *loc = NewNode(common()->ExternalConstant(reference));
+    *loc = graph()->NewNode(common()->ExternalConstant(reference));
   }
   return *loc;
 }

src/compiler/js-graph.h

@@ -24,12 +24,10 @@ class Typer;
 class JSGraph : public ZoneObject {
  public:
   JSGraph(Graph* graph, CommonOperatorBuilder* common,
-          JSOperatorBuilder* javascript, Typer* typer,
-          MachineOperatorBuilder* machine)
+          JSOperatorBuilder* javascript, MachineOperatorBuilder* machine)
       : graph_(graph),
         common_(common),
         javascript_(javascript),
-        typer_(typer),
         machine_(machine),
         cache_(zone()) {}
 
@@ -109,7 +107,6 @@ class JSGraph : public ZoneObject {
   Graph* graph_;
   CommonOperatorBuilder* common_;
   JSOperatorBuilder* javascript_;
-  Typer* typer_;
   MachineOperatorBuilder* machine_;
 
   SetOncePointer<Node> c_entry_stub_constant_;
@@ -126,7 +123,6 @@ class JSGraph : public ZoneObject {
 
   Node* ImmovableHeapConstant(Handle<HeapObject> value);
   Node* NumberConstant(double value);
-  Node* NewNode(const Operator* op);
 
   Factory* factory() { return isolate()->factory(); }
 };

src/compiler/js-inlining.cc

@@ -410,8 +410,7 @@ void JSInliner::TryInlineCall(Node* call_node) {
   }
 
   Graph graph(info.zone());
-  Typer typer(info.zone());
-  JSGraph jsgraph(&graph, jsgraph_->common(), jsgraph_->javascript(), &typer,
+  JSGraph jsgraph(&graph, jsgraph_->common(), jsgraph_->javascript(),
                   jsgraph_->machine());
 
   AstGraphBuilder graph_builder(&info, &jsgraph);

src/compiler/js-typed-lowering.cc

@@ -602,11 +602,12 @@ static Reduction ReplaceWithReduction(Node* node, Reduction reduction) {
 Reduction JSTypedLowering::Reduce(Node* node) {
   // Check if the output type is a singleton.  In that case we already know the
   // result value and can simply replace the node unless there are effects.
-  if (node->bounds().upper->IsConstant() &&
+  if (NodeProperties::IsTyped(node) &&
+      NodeProperties::GetBounds(node).upper->IsConstant() &&
       !IrOpcode::IsLeafOpcode(node->opcode()) &&
       !OperatorProperties::HasEffectOutput(node->op())) {
     return ReplaceEagerly(node, jsgraph()->Constant(
-        node->bounds().upper->AsConstant()->Value()));
+        NodeProperties::GetBounds(node).upper->AsConstant()->Value()));
     // TODO(neis): Extend this to Range(x,x), NaN, MinusZero, ...?
   }
   switch (node->opcode()) {

src/compiler/node-properties-inl.h

@@ -198,12 +198,30 @@ inline void NodeProperties::ReplaceWithValue(Node* node, Node* value,
 // -----------------------------------------------------------------------------
 // Type Bounds.
 
-inline Bounds NodeProperties::GetBounds(Node* node) { return node->bounds(); }
+inline bool NodeProperties::IsTyped(Node* node) {
+  Bounds bounds = node->bounds();
+  DCHECK((bounds.lower == NULL) == (bounds.upper == NULL));
+  return bounds.upper != NULL;
+}
+
+inline Bounds NodeProperties::GetBounds(Node* node) {
+  DCHECK(IsTyped(node));
+  return node->bounds();
+}
 
 inline void NodeProperties::SetBounds(Node* node, Bounds b) {
+  DCHECK(b.lower != NULL && b.upper != NULL);
   node->set_bounds(b);
 }
 
+inline bool NodeProperties::AllValueInputsAreTyped(Node* node) {
+  int input_count = OperatorProperties::GetValueInputCount(node->op());
+  for (int i = 0; i < input_count; ++i) {
+    if (!IsTyped(GetValueInput(node, i))) return false;
+  }
+  return true;
+}
+
 
 }
 }

src/compiler/node-properties.h

@@ -40,8 +40,10 @@ class NodeProperties {
   static inline void ReplaceWithValue(Node* node, Node* value,
                                       Node* effect = NULL);
 
+  static inline bool IsTyped(Node* node);
   static inline Bounds GetBounds(Node* node);
   static inline void SetBounds(Node* node, Bounds bounds);
+  static inline bool AllValueInputsAreTyped(Node* node);
 
   static inline int FirstValueIndex(Node* node);
   static inline int FirstContextIndex(Node* node);

src/compiler/node.h

@@ -31,14 +31,13 @@ class NodeData {
     return static_cast<IrOpcode::Value>(op_->opcode());
   }
 
-  Bounds bounds() { return bounds_; }
-
  protected:
   const Operator* op_;
   Bounds bounds_;
-  explicit NodeData(Zone* zone) : bounds_(Bounds(Type::None(zone))) {}
+  explicit NodeData(Zone* zone) {}
 
   friend class NodeProperties;
+  Bounds bounds() { return bounds_; }
   void set_bounds(Bounds b) { bounds_ = b; }
 };
 

src/compiler/pipeline.cc

@@ -105,7 +105,8 @@ void Pipeline::OpenTurboCfgFile(std::ofstream* stream) {
 }
 
 
-void Pipeline::VerifyAndPrintGraph(Graph* graph, const char* phase) {
+void Pipeline::VerifyAndPrintGraph(
+    Graph* graph, const char* phase, bool untyped) {
   if (FLAG_trace_turbo) {
     char buffer[256];
     Vector<char> filename(buffer, sizeof(buffer));
@@ -143,7 +144,10 @@ void Pipeline::VerifyAndPrintGraph(Graph* graph, const char* phase) {
     os << "-- " << phase << " graph printed to file " << filename.start()
        << "\n";
   }
-  if (VerifyGraphs()) Verifier::Run(graph);
+  if (VerifyGraphs()) {
+    Verifier::Run(graph,
+        FLAG_turbo_types && !untyped ? Verifier::TYPED : Verifier::UNTYPED);
+  }
 }
 
 
@@ -231,11 +235,11 @@ Handle<Code> Pipeline::GenerateCode() {
   // TODO(turbofan): there is no need to type anything during initial graph
   // construction.  This is currently only needed for the node cache, which the
   // typer could sweep over later.
-  Typer typer(zone());
+  Typer typer(&graph, info()->context());
   MachineOperatorBuilder machine;
   CommonOperatorBuilder common(zone());
   JSOperatorBuilder javascript(zone());
-  JSGraph jsgraph(&graph, &common, &javascript, &typer, &machine);
+  JSGraph jsgraph(&graph, &common, &javascript, &machine);
   Node* context_node;
   {
     PhaseStats graph_builder_stats(info(), PhaseStats::CREATE_GRAPH,
@@ -257,7 +261,7 @@ Handle<Code> Pipeline::GenerateCode() {
     graph_reducer.ReduceGraph();
   }
 
-  VerifyAndPrintGraph(&graph, "Initial untyped");
+  VerifyAndPrintGraph(&graph, "Initial untyped", true);
 
   if (info()->is_context_specializing()) {
     SourcePositionTable::Scope pos(&source_positions,
@@ -265,7 +269,7 @@ Handle<Code> Pipeline::GenerateCode() {
     // Specialize the code to the context as aggressively as possible.
     JSContextSpecializer spec(info(), &jsgraph, context_node);
     spec.SpecializeToContext();
-    VerifyAndPrintGraph(&graph, "Context specialized");
+    VerifyAndPrintGraph(&graph, "Context specialized", true);
   }
 
   if (info()->is_inlining_enabled()) {
@@ -273,7 +277,7 @@ Handle<Code> Pipeline::GenerateCode() {
                                    SourcePosition::Unknown());
     JSInliner inliner(info(), &jsgraph);
     inliner.Inline();
-    VerifyAndPrintGraph(&graph, "Inlined");
+    VerifyAndPrintGraph(&graph, "Inlined", true);
   }
 
   // Print a replay of the initial graph.
@@ -288,11 +292,9 @@ Handle<Code> Pipeline::GenerateCode() {
     {
       // Type the graph.
       PhaseStats typer_stats(info(), PhaseStats::CREATE_GRAPH, "typer");
-      typer.Run(&graph, info()->context());
+      typer.Run();
       VerifyAndPrintGraph(&graph, "Typed");
     }
-    // All new nodes must be typed.
-    typer.DecorateGraph(&graph);
     {
       // Lower JSOperators where we can determine types.
       PhaseStats lowering_stats(info(), PhaseStats::CREATE_GRAPH,
@@ -336,7 +338,8 @@ Handle<Code> Pipeline::GenerateCode() {
       graph_reducer.AddReducer(&mach_reducer);
       graph_reducer.ReduceGraph();
 
-      VerifyAndPrintGraph(&graph, "Lowered changes");
+      // TODO(jarin, rossberg): Remove UNTYPED once machine typing works.
+      VerifyAndPrintGraph(&graph, "Lowered changes", true);
     }
   }
 
@@ -351,7 +354,8 @@ Handle<Code> Pipeline::GenerateCode() {
     graph_reducer.AddReducer(&lowering);
     graph_reducer.ReduceGraph();
 
-    VerifyAndPrintGraph(&graph, "Lowered generic");
+    // TODO(jarin, rossberg): Remove UNTYPED once machine typing works.
+    VerifyAndPrintGraph(&graph, "Lowered generic", true);
   }
 
   source_positions.RemoveDecorator();
@@ -396,7 +400,8 @@ Handle<Code> Pipeline::GenerateCodeForMachineGraph(Linkage* linkage,
                                                    Schedule* schedule) {
   CHECK(SupportedBackend());
   if (schedule == NULL) {
-    VerifyAndPrintGraph(graph, "Machine");
+    // TODO(rossberg): Should this really be untyped?
+    VerifyAndPrintGraph(graph, "Machine", true);
     schedule = ComputeSchedule(graph);
   }
   TraceSchedule(schedule);

src/compiler/pipeline.h

@@ -58,7 +58,8 @@ class Pipeline {
                                     const SourcePositionTable* positions,
                                     const InstructionSequence* instructions);
   void PrintAllocator(const char* phase, const RegisterAllocator* allocator);
-  void VerifyAndPrintGraph(Graph* graph, const char* phase);
+  void VerifyAndPrintGraph(Graph* graph, const char* phase,
+                           bool untyped = false);
   Handle<Code> GenerateCode(Linkage* linkage, Graph* graph, Schedule* schedule,
                             SourcePositionTable* source_positions);
 };

src/compiler/schedule.cc

@@ -274,7 +274,7 @@ std::ostream& operator<<(std::ostream& os, const Schedule& s) {
          ++j) {
       Node* node = *j;
       os << "  " << *node;
-      if (!NodeProperties::IsControl(node)) {
+      if (NodeProperties::IsTyped(node)) {
         Bounds bounds = NodeProperties::GetBounds(node);
         os << " : ";
         bounds.lower->PrintTo(os);

src/compiler/typer.cc

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "src/bootstrapper.h"
 #include "src/compiler/graph-inl.h"
 #include "src/compiler/js-operator.h"
 #include "src/compiler/node.h"
@@ -14,7 +15,19 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-Typer::Typer(Zone* zone) : zone_(zone) {
+class Typer::Decorator : public GraphDecorator {
+ public:
+  explicit Decorator(Typer* typer) : typer_(typer) {}
+  virtual void Decorate(Node* node);
+
+ private:
+  Typer* typer_;
+};
+
+
+Typer::Typer(Graph* graph, MaybeHandle<Context> context)
+    : graph_(graph), context_(context), decorator_(NULL) {
+  Zone* zone = this->zone();
   Factory* f = zone->isolate()->factory();
 
   Handle<Object> zero = f->NewNumber(0);
@@ -97,13 +110,20 @@ Typer::Typer(Zone* zone) : zone_(zone) {
   uint32_array_fun_ = Type::Function(uint32_array, arg1, arg2, arg3, zone);
   float32_array_fun_ = Type::Function(float32_array, arg1, arg2, arg3, zone);
   float64_array_fun_ = Type::Function(float64_array, arg1, arg2, arg3, zone);
+
+  decorator_ = new (zone) Decorator(this);
+  graph_->AddDecorator(decorator_);
+}
+
+
+Typer::~Typer() {
+  graph_->RemoveDecorator(decorator_);
 }
 
 
 class Typer::Visitor : public NullNodeVisitor {
  public:
-  Visitor(Typer* typer, MaybeHandle<Context> context)
-      : typer_(typer), context_(context) {}
+  explicit Visitor(Typer* typer) : typer_(typer) {}
 
   Bounds TypeNode(Node* node) {
     switch (node->opcode()) {
@@ -142,22 +162,28 @@ class Typer::Visitor : public NullNodeVisitor {
   VALUE_OP_LIST(DECLARE_METHOD)
 #undef DECLARE_METHOD
 
-  static Bounds OperandType(Node* node, int i) {
-    return NodeProperties::GetBounds(NodeProperties::GetValueInput(node, i));
+  Bounds BoundsOrNone(Node* node) {
+    return NodeProperties::IsTyped(node)
+        ? NodeProperties::GetBounds(node) : Bounds(Type::None(zone()));
   }
 
-  static Type* ContextType(Node* node) {
-    Bounds result =
-        NodeProperties::GetBounds(NodeProperties::GetContextInput(node));
+  Bounds Operand(Node* node, int i) {
+    Node* operand_node = NodeProperties::GetValueInput(node, i);
+    return BoundsOrNone(operand_node);
+  }
+
+  Bounds ContextOperand(Node* node) {
+    Bounds result = BoundsOrNone(NodeProperties::GetContextInput(node));
     DCHECK(result.upper->Maybe(Type::Internal()));
     // TODO(rossberg): More precisely, instead of the above assertion, we should
     // back-propagate the constraint that it has to be a subtype of Internal.
-    return result.upper;
+    return result;
   }
 
   Zone* zone() { return typer_->zone(); }
   Isolate* isolate() { return typer_->isolate(); }
-  MaybeHandle<Context> context() { return context_; }
+  Graph* graph() { return typer_->graph(); }
+  MaybeHandle<Context> context() { return typer_->context(); }
 
  private:
   Typer* typer_;
@@ -198,24 +224,17 @@ class Typer::Visitor : public NullNodeVisitor {
 
 class Typer::RunVisitor : public Typer::Visitor {
  public:
-  RunVisitor(Typer* typer, MaybeHandle<Context> context)
-      : Visitor(typer, context),
+  explicit RunVisitor(Typer* typer)
+      : Visitor(typer),
         redo(NodeSet::key_compare(), NodeSet::allocator_type(typer->zone())) {}
 
   GenericGraphVisit::Control Post(Node* node) {
-    if (OperatorProperties::HasValueOutput(node->op())) {
+    if (OperatorProperties::HasValueOutput(node->op()) &&
+        !NodeProperties::IsTyped(node)) {
       Bounds bounds = TypeNode(node);
       NodeProperties::SetBounds(node, bounds);
       // Remember incompletely typed nodes for least fixpoint iteration.
-      int arity = OperatorProperties::GetValueInputCount(node->op());
-      for (int i = 0; i < arity; ++i) {
-        // TODO(rossberg): change once IsTyped is available.
-        // if (!NodeProperties::IsTyped(NodeProperties::GetValueInput(node, i)))
-        if (OperandType(node, i).upper->Is(Type::None())) {
-          redo.insert(node);
-          break;
-        }
-      }
+      if (!NodeProperties::AllValueInputsAreTyped(node)) redo.insert(node);
     }
     return GenericGraphVisit::CONTINUE;
   }
@@ -226,8 +245,7 @@ class Typer::RunVisitor : public Typer::Visitor {
 
 class Typer::NarrowVisitor : public Typer::Visitor {
  public:
-  NarrowVisitor(Typer* typer, MaybeHandle<Context> context)
-      : Visitor(typer, context) {}
+  explicit NarrowVisitor(Typer* typer) : Visitor(typer) {}
 
   GenericGraphVisit::Control Pre(Node* node) {
     if (OperatorProperties::HasValueOutput(node->op())) {
@@ -251,16 +269,15 @@ class Typer::NarrowVisitor : public Typer::Visitor {
 
 class Typer::WidenVisitor : public Typer::Visitor {
  public:
-  WidenVisitor(Typer* typer, MaybeHandle<Context> context)
-      : Visitor(typer, context) {}
+  explicit WidenVisitor(Typer* typer) : Visitor(typer) {}
 
   GenericGraphVisit::Control Pre(Node* node) {
     if (OperatorProperties::HasValueOutput(node->op())) {
-      Bounds previous = NodeProperties::GetBounds(node);
+      Bounds previous = BoundsOrNone(node);
       Bounds bounds = TypeNode(node);
       DCHECK(previous.lower->Is(bounds.lower));
       DCHECK(previous.upper->Is(bounds.upper));
-      NodeProperties::SetBounds(node, bounds);  // TODO(rossberg): Either?
+      NodeProperties::SetBounds(node, bounds);
       // Stop when nothing changed (but allow re-entry in case it does later).
       return bounds.Narrows(previous)
           ? GenericGraphVisit::DEFER : GenericGraphVisit::REENTER;
@@ -275,34 +292,38 @@ class Typer::WidenVisitor : public Typer::Visitor {
 };
 
 
-void Typer::Run(Graph* graph, MaybeHandle<Context> context) {
-  RunVisitor typing(this, context);
-  graph->VisitNodeInputsFromEnd(&typing);
+void Typer::Run() {
+  RunVisitor typing(this);
+  graph_->VisitNodeInputsFromEnd(&typing);
   // Find least fixpoint.
-  for (NodeSetIter i = typing.redo.begin(); i != typing.redo.end(); ++i) {
-    Widen(graph, *i, context);
+  WidenVisitor widen(this);
+  for (NodeSetIter it = typing.redo.begin(); it != typing.redo.end(); ++it) {
+    graph_->VisitNodeUsesFrom(*it, &widen);
   }
 }
 
 
-void Typer::Narrow(Graph* graph, Node* start, MaybeHandle<Context> context) {
-  NarrowVisitor typing(this, context);
-  graph->VisitNodeUsesFrom(start, &typing);
-}
-
-
-void Typer::Widen(Graph* graph, Node* start, MaybeHandle<Context> context) {
-  WidenVisitor typing(this, context);
-  graph->VisitNodeUsesFrom(start, &typing);
+void Typer::Narrow(Node* start) {
+  NarrowVisitor typing(this);
+  graph_->VisitNodeUsesFrom(start, &typing);
 }
 
 
-void Typer::Init(Node* node) {
+void Typer::Decorator::Decorate(Node* node) {
   if (OperatorProperties::HasValueOutput(node->op())) {
-    Visitor typing(this, MaybeHandle<Context>());
+    // Only eagerly type-decorate nodes with known input types.
+    // Other cases will generally require a proper fixpoint iteration with Run.
+    bool is_typed = NodeProperties::IsTyped(node);
+    if (is_typed || NodeProperties::AllValueInputsAreTyped(node)) {
+      Visitor typing(typer_);
       Bounds bounds = typing.TypeNode(node);
+      if (is_typed) {
+        bounds =
+          Bounds::Both(bounds, NodeProperties::GetBounds(node), typer_->zone());
+      }
       NodeProperties::SetBounds(node, bounds);
     }
+  }
 }
 
 
@@ -314,7 +335,7 @@ void Typer::Init(Node* node) {
 
 
 Bounds Typer::Visitor::TypeUnaryOp(Node* node, UnaryTyperFun f) {
-  Bounds input = OperandType(node, 0);
+  Bounds input = Operand(node, 0);
   Type* upper = input.upper->Is(Type::None())
       ? Type::None()
       : f(input.upper, typer_);
@@ -329,8 +350,8 @@ Bounds Typer::Visitor::TypeUnaryOp(Node* node, UnaryTyperFun f) {
 
 
 Bounds Typer::Visitor::TypeBinaryOp(Node* node, BinaryTyperFun f) {
-  Bounds left = OperandType(node, 0);
-  Bounds right = OperandType(node, 1);
+  Bounds left = Operand(node, 0);
+  Bounds right = Operand(node, 1);
   Type* upper = left.upper->Is(Type::None()) || right.upper->Is(Type::None())
       ? Type::None()
       : f(left.upper, right.upper, typer_);
@@ -419,7 +440,7 @@ Type* Typer::Visitor::NumberToUint32(Type* type, Typer* t) {
 
 
 Bounds Typer::Visitor::TypeStart(Node* node) {
-  return Bounds(Type::Internal());
+  return Bounds(Type::None(zone()), Type::Internal(zone()));
 }
 
 
@@ -471,15 +492,15 @@ Bounds Typer::Visitor::TypeHeapConstant(Node* node) {
 
 
 Bounds Typer::Visitor::TypeExternalConstant(Node* node) {
-  return Bounds(Type::Internal());
+  return Bounds(Type::None(zone()), Type::Internal(zone()));
 }
 
 
 Bounds Typer::Visitor::TypePhi(Node* node) {
   int arity = OperatorProperties::GetValueInputCount(node->op());
-  Bounds bounds = OperandType(node, 0);
+  Bounds bounds = Operand(node, 0);
   for (int i = 1; i < arity; ++i) {
-    bounds = Bounds::Either(bounds, OperandType(node, i), zone());
+    bounds = Bounds::Either(bounds, Operand(node, i), zone());
   }
   return bounds;
 }
@@ -498,18 +519,18 @@ Bounds Typer::Visitor::TypeValueEffect(Node* node) {
 
 
 Bounds Typer::Visitor::TypeFinish(Node* node) {
-  return OperandType(node, 0);
+  return Operand(node, 0);
 }
 
 
 Bounds Typer::Visitor::TypeFrameState(Node* node) {
   // TODO(rossberg): Ideally FrameState wouldn't have a value output.
-  return Bounds(Type::Internal());
+  return Bounds(Type::None(zone()), Type::Internal(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeStateValues(Node* node) {
-  return Bounds(Type::Internal());
+  return Bounds(Type::None(zone()), Type::Internal(zone()));
 }
 
 
@@ -807,7 +828,7 @@ Bounds Typer::Visitor::TypeJSUnaryNot(Node* node) {
 
 
 Bounds Typer::Visitor::TypeJSTypeOf(Node* node) {
-  return Bounds(Type::InternalizedString());
+  return Bounds(Type::None(zone()), Type::InternalizedString(zone()));
 }
 
 
@@ -815,12 +836,12 @@ Bounds Typer::Visitor::TypeJSTypeOf(Node* node) {
 
 
 Bounds Typer::Visitor::TypeJSToBoolean(Node* node) {
-  return TypeUnaryOp(node, ToBoolean);
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSToNumber(Node* node) {
-  return TypeUnaryOp(node, ToNumber);
+  return Bounds(Type::None(zone()), Type::Number(zone()));
 }
 
 
@@ -880,17 +901,17 @@ Bounds Typer::Visitor::TypeJSStoreNamed(Node* node) {
 
 
 Bounds Typer::Visitor::TypeJSDeleteProperty(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSHasProperty(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSInstanceOf(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
@@ -898,7 +919,7 @@ Bounds Typer::Visitor::TypeJSInstanceOf(Node* node) {
 
 
 Bounds Typer::Visitor::TypeJSLoadContext(Node* node) {
-  Bounds outer = OperandType(node, 0);
+  Bounds outer = Operand(node, 0);
   DCHECK(outer.upper->Maybe(Type::Internal()));
   // TODO(rossberg): More precisely, instead of the above assertion, we should
   // back-propagate the constraint that it has to be a subtype of Internal.
@@ -943,39 +964,39 @@ Bounds Typer::Visitor::TypeJSStoreContext(Node* node) {
 
 
 Bounds Typer::Visitor::TypeJSCreateFunctionContext(Node* node) {
-  Type* outer = ContextType(node);
-  return Bounds(Type::Context(outer, zone()));
+  Bounds outer = ContextOperand(node);
+  return Bounds(Type::Context(outer.upper, zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSCreateCatchContext(Node* node) {
-  Type* outer = ContextType(node);
-  return Bounds(Type::Context(outer, zone()));
+  Bounds outer = ContextOperand(node);
+  return Bounds(Type::Context(outer.upper, zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSCreateWithContext(Node* node) {
-  Type* outer = ContextType(node);
-  return Bounds(Type::Context(outer, zone()));
+  Bounds outer = ContextOperand(node);
+  return Bounds(Type::Context(outer.upper, zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSCreateBlockContext(Node* node) {
-  Type* outer = ContextType(node);
-  return Bounds(Type::Context(outer, zone()));
+  Bounds outer = ContextOperand(node);
+  return Bounds(Type::Context(outer.upper, zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSCreateModuleContext(Node* node) {
   // TODO(rossberg): this is probably incorrect
-  Type* outer = ContextType(node);
-  return Bounds(Type::Context(outer, zone()));
+  Bounds outer = ContextOperand(node);
+  return Bounds(Type::Context(outer.upper, zone()));
 }
 
 
 Bounds Typer::Visitor::TypeJSCreateGlobalContext(Node* node) {
-  Type* outer = ContextType(node);
-  return Bounds(Type::Context(outer, zone()));
+  Bounds outer = ContextOperand(node);
+  return Bounds(Type::Context(outer.upper, zone()));
 }
 
 
@@ -1016,52 +1037,52 @@ Bounds Typer::Visitor::TypeJSDebugger(Node* node) {
 
 
 Bounds Typer::Visitor::TypeBooleanNot(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeBooleanToNumber(Node* node) {
-  return Bounds(Type::Number());
+  return Bounds(Type::None(zone()), Type::Number(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberEqual(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberLessThan(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberLessThanOrEqual(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberAdd(Node* node) {
-  return Bounds(Type::Number());
+  return Bounds(Type::None(zone()), Type::Number(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberSubtract(Node* node) {
-  return Bounds(Type::Number());
+  return Bounds(Type::None(zone()), Type::Number(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberMultiply(Node* node) {
-  return Bounds(Type::Number());
+  return Bounds(Type::None(zone()), Type::Number(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberDivide(Node* node) {
-  return Bounds(Type::Number());
+  return Bounds(Type::None(zone()), Type::Number(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeNumberModulus(Node* node) {
-  return Bounds(Type::Number());
+  return Bounds(Type::None(zone()), Type::Number(zone()));
 }
 
 
@@ -1076,27 +1097,27 @@ Bounds Typer::Visitor::TypeNumberToUint32(Node* node) {
 
 
 Bounds Typer::Visitor::TypeReferenceEqual(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeStringEqual(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeStringLessThan(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeStringLessThanOrEqual(Node* node) {
-  return Bounds(Type::Boolean());
+  return Bounds(Type::None(zone()), Type::Boolean(zone()));
 }
 
 
 Bounds Typer::Visitor::TypeStringAdd(Node* node) {
-  return Bounds(Type::String());
+  return Bounds(Type::None(zone()), Type::String(zone()));
 }
 
 
@@ -1112,7 +1133,7 @@ static Type* ChangeRepresentation(Type* type, Type* rep, Zone* zone) {
 
 
 Bounds Typer::Visitor::TypeChangeTaggedToInt32(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): DCHECK(arg.upper->Is(Type::Signed32()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::UntaggedInt32(), zone()),
@@ -1121,7 +1142,7 @@ Bounds Typer::Visitor::TypeChangeTaggedToInt32(Node* node) {
 
 
 Bounds Typer::Visitor::TypeChangeTaggedToUint32(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): DCHECK(arg.upper->Is(Type::Unsigned32()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::UntaggedInt32(), zone()),
@@ -1130,7 +1151,7 @@ Bounds Typer::Visitor::TypeChangeTaggedToUint32(Node* node) {
 
 
 Bounds Typer::Visitor::TypeChangeTaggedToFloat64(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): DCHECK(arg.upper->Is(Type::Number()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::UntaggedFloat64(), zone()),
@@ -1139,7 +1160,7 @@ Bounds Typer::Visitor::TypeChangeTaggedToFloat64(Node* node) {
 
 
 Bounds Typer::Visitor::TypeChangeInt32ToTagged(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): DCHECK(arg.upper->Is(Type::Signed32()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::Tagged(), zone()),
@@ -1148,7 +1169,7 @@ Bounds Typer::Visitor::TypeChangeInt32ToTagged(Node* node) {
 
 
 Bounds Typer::Visitor::TypeChangeUint32ToTagged(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): DCHECK(arg.upper->Is(Type::Unsigned32()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::Tagged(), zone()),
@@ -1157,7 +1178,7 @@ Bounds Typer::Visitor::TypeChangeUint32ToTagged(Node* node) {
 
 
 Bounds Typer::Visitor::TypeChangeFloat64ToTagged(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): CHECK(arg.upper->Is(Type::Number()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::Tagged(), zone()),
@@ -1166,7 +1187,7 @@ Bounds Typer::Visitor::TypeChangeFloat64ToTagged(Node* node) {
 
 
 Bounds Typer::Visitor::TypeChangeBoolToBit(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): DCHECK(arg.upper->Is(Type::Boolean()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::UntaggedInt1(), zone()),
@@ -1175,7 +1196,7 @@ Bounds Typer::Visitor::TypeChangeBoolToBit(Node* node) {
 
 
 Bounds Typer::Visitor::TypeChangeBitToBool(Node* node) {
-  Bounds arg = OperandType(node, 0);
+  Bounds arg = Operand(node, 0);
   // TODO(neis): DCHECK(arg.upper->Is(Type::Boolean()));
   return Bounds(
       ChangeRepresentation(arg.lower, Type::TaggedPtr(), zone()),
@@ -1207,7 +1228,6 @@ Bounds Typer::Visitor::TypeStoreElement(Node* node) {
 
 // Machine operators.
 
-
 Bounds Typer::Visitor::TypeLoad(Node* node) {
   return Bounds::Unbounded(zone());
 }
@@ -1599,25 +1619,6 @@ Type* Typer::Visitor::TypeConstant(Handle<Object> value) {
   return Type::Constant(value, zone());
 }
 
-
-namespace {
-
-class TyperDecorator : public GraphDecorator {
- public:
-  explicit TyperDecorator(Typer* typer) : typer_(typer) {}
-  virtual void Decorate(Node* node) { typer_->Init(node); }
-
- private:
-  Typer* typer_;
-};
-
-}
-
-
-void Typer::DecorateGraph(Graph* graph) {
-  graph->AddDecorator(new (zone()) TyperDecorator(this));
-}
-
 }
 }
 }  // namespace v8::internal::compiler

src/compiler/typer.h

@@ -17,23 +17,27 @@ namespace compiler {
 
 class Typer {
  public:
-  explicit Typer(Zone* zone);
+  explicit Typer(Graph* graph, MaybeHandle<Context> context);
+  ~Typer();
 
-  void Init(Node* node);
-  void Run(Graph* graph, MaybeHandle<Context> context);
-  void Narrow(Graph* graph, Node* node, MaybeHandle<Context> context);
-  void Widen(Graph* graph, Node* node, MaybeHandle<Context> context);
+  void Run();
+  void Narrow(Node* node);
 
-  void DecorateGraph(Graph* graph);
-
-  Zone* zone() { return zone_; }
-  Isolate* isolate() { return zone_->isolate(); }
+  Graph* graph() { return graph_; }
+  MaybeHandle<Context> context() { return context_; }
+  Zone* zone() { return graph_->zone(); }
+  Isolate* isolate() { return zone()->isolate(); }
 
  private:
   class Visitor;
   class RunVisitor;
   class NarrowVisitor;
   class WidenVisitor;
+  class Decorator;
+
+  Graph* graph_;
+  MaybeHandle<Context> context_;
+  Decorator* decorator_;
 
   Zone* zone_;
   Type* negative_signed32;

src/compiler/verifier.cc

@@ -18,6 +18,7 @@
 #include "src/compiler/opcodes.h"
 #include "src/compiler/operator.h"
 #include "src/compiler/schedule.h"
+#include "src/compiler/simplified-operator.h"
 #include "src/data-flow.h"
 
 namespace v8 {
@@ -45,18 +46,32 @@ static bool IsUseDefChainLinkPresent(Node* def, Node* use) {
 
 class Verifier::Visitor : public NullNodeVisitor {
  public:
-  explicit Visitor(Zone* zone)
-      : reached_from_start(NodeSet::key_compare(),
-                           NodeSet::allocator_type(zone)),
-        reached_from_end(NodeSet::key_compare(),
-                         NodeSet::allocator_type(zone)) {}
+  Visitor(Zone* z, Typing typed) : zone(z), typing(typed) {}
 
   // Fulfills the PreNodeCallback interface.
   GenericGraphVisit::Control Pre(Node* node);
 
-  bool from_start;
-  NodeSet reached_from_start;
-  NodeSet reached_from_end;
+  Zone* zone;
+  Typing typing;
+
+ private:
+  // TODO(rossberg): Get rid of these once we got rid of NodeProperties.
+  Bounds bounds(Node* node) {
+    return NodeProperties::GetBounds(node);
+  }
+  Node* Operand(Node* node, int i = 0) {
+    return NodeProperties::GetValueInput(node, i);
+  }
+  FieldAccess Field(Node* node) {
+    DCHECK(node->opcode() == IrOpcode::kLoadField ||
+           node->opcode() == IrOpcode::kStoreField);
+    return OpParameter<FieldAccess>(node);
+  }
+  ElementAccess Element(Node* node) {
+    DCHECK(node->opcode() == IrOpcode::kLoadElement ||
+           node->opcode() == IrOpcode::kStoreElement);
+    return OpParameter<ElementAccess>(node);
+  }
 };
 
 
@@ -126,16 +141,24 @@ GenericGraphVisit::Control Verifier::Visitor::Pre(Node* node) {
     }
   }
 
+  if (typing == TYPED) {
     switch (node->opcode()) {
+      // Control operators
+      // -----------------
       case IrOpcode::kStart:
         // Start has no inputs.
         CHECK_EQ(0, input_count);
+        // Type is a tuple.
+        // TODO(rossberg): Multiple outputs are currently typed as Internal.
+        CHECK(bounds(node).upper->Is(Type::Internal()));
         break;
       case IrOpcode::kEnd:
         // End has no outputs.
         CHECK(!OperatorProperties::HasValueOutput(node->op()));
         CHECK(!OperatorProperties::HasEffectOutput(node->op()));
         CHECK(!OperatorProperties::HasControlOutput(node->op()));
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
         break;
       case IrOpcode::kDead:
         // Dead is never connected to the graph.
@@ -143,31 +166,43 @@ GenericGraphVisit::Control Verifier::Visitor::Pre(Node* node) {
       case IrOpcode::kBranch: {
         // Branch uses are IfTrue and IfFalse.
         Node::Uses uses = node->uses();
-      bool got_true = false, got_false = false;
+        bool count_true = 0, count_false = 0;
         for (Node::Uses::iterator it = uses.begin(); it != uses.end(); ++it) {
-        CHECK(((*it)->opcode() == IrOpcode::kIfTrue && !got_true) ||
-              ((*it)->opcode() == IrOpcode::kIfFalse && !got_false));
-        if ((*it)->opcode() == IrOpcode::kIfTrue) got_true = true;
-        if ((*it)->opcode() == IrOpcode::kIfFalse) got_false = true;
-      }
-      // TODO(rossberg): Currently fails for various tests.
-      // CHECK(got_true && got_false);
+          CHECK((*it)->opcode() == IrOpcode::kIfTrue ||
+                (*it)->opcode() == IrOpcode::kIfFalse);
+          if ((*it)->opcode() == IrOpcode::kIfTrue) ++count_true;
+          if ((*it)->opcode() == IrOpcode::kIfFalse) ++count_false;
+        }
+        CHECK(count_true == 1 && count_false == 1);
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
         break;
       }
       case IrOpcode::kIfTrue:
       case IrOpcode::kIfFalse:
         CHECK_EQ(IrOpcode::kBranch,
                  NodeProperties::GetControlInput(node, 0)->opcode());
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
         break;
       case IrOpcode::kLoop:
       case IrOpcode::kMerge:
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
         break;
       case IrOpcode::kReturn:
         // TODO(rossberg): check successor is End
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
         break;
       case IrOpcode::kThrow:
         // TODO(rossberg): what are the constraints on these?
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
         break;
+
+      // Common operators
+      // ----------------
       case IrOpcode::kParameter: {
         // Parameters have the start node as inputs.
         CHECK_EQ(1, input_count);
@@ -177,24 +212,64 @@ GenericGraphVisit::Control Verifier::Visitor::Pre(Node* node) {
         int index = OpParameter<int>(node);
         Node* input = NodeProperties::GetValueInput(node, 0);
         // Currently, parameter indices start at -1 instead of 0.
-      CHECK_GT(OperatorProperties::GetValueOutputCount(input->op()), index + 1);
+        CHECK_GT(
+            OperatorProperties::GetValueOutputCount(input->op()), index + 1);
+        // Type can be anything.
+        CHECK(bounds(node).upper->Is(Type::Any()));
         break;
       }
-    case IrOpcode::kInt32Constant:
-    case IrOpcode::kInt64Constant:
+      case IrOpcode::kInt32Constant:  // TODO(rossberg): rename Word32Constant?
+        // Constants have no inputs.
+        CHECK_EQ(0, input_count);
+        // Type is a 32 bit integer, signed or unsigned.
+        CHECK(bounds(node).upper->Is(Type::Integral32()));
+        break;
+      case IrOpcode::kInt64Constant:  // Close enough...
+      case IrOpcode::kFloat32Constant:
       case IrOpcode::kFloat64Constant:
-    case IrOpcode::kExternalConstant:
       case IrOpcode::kNumberConstant:
+        // Constants have no inputs.
+        CHECK_EQ(0, input_count);
+        // Type is a number.
+        CHECK(bounds(node).upper->Is(Type::Number()));
+        break;
       case IrOpcode::kHeapConstant:
         // Constants have no inputs.
         CHECK_EQ(0, input_count);
+        // Type can be anything represented as a heap pointer.
+        CHECK(bounds(node).upper->Is(Type::TaggedPtr()));
+        break;
+      case IrOpcode::kExternalConstant:
+        // Constants have no inputs.
+        CHECK_EQ(0, input_count);
+        // Type is considered internal.
+        CHECK(bounds(node).upper->Is(Type::Internal()));
+        break;
+      case IrOpcode::kProjection: {
+        // Projection has an input that produces enough values.
+        int index = OpParameter<int>(node->op());
+        Node* input = NodeProperties::GetValueInput(node, 0);
+        CHECK_GT(OperatorProperties::GetValueOutputCount(input->op()), index);
+        // Type can be anything.
+        // TODO(rossberg): Introduce tuple types for this.
+        CHECK(bounds(node).upper->Is(Type::Any()));
         break;
+      }
       case IrOpcode::kPhi: {
         // Phi input count matches parent control node.
         CHECK_EQ(1, control_count);
         Node* control = NodeProperties::GetControlInput(node, 0);
         CHECK_EQ(value_count,
                  OperatorProperties::GetControlInputCount(control->op()));
+        // Type must be subsumed by all input types.
+        // TODO(rossberg): for now at least, narrowing does not really hold.
+        /*
+        for (int i = 0; i < value_count; ++i) {
+          // TODO(rossberg, jarin): Figure out what to do about lower bounds.
+          // CHECK(bounds(node).lower->Is(bounds(Operand(node, i)).lower));
+          CHECK(bounds(Operand(node, i)).upper->Is(bounds(node).upper));
+        }
+        */
         break;
       }
       case IrOpcode::kEffectPhi: {
@@ -205,54 +280,390 @@ GenericGraphVisit::Control Verifier::Visitor::Pre(Node* node) {
                  OperatorProperties::GetControlInputCount(control->op()));
         break;
       }
+      case IrOpcode::kValueEffect:
+        // TODO(rossberg): what are the constraints on these?
+        break;
+      case IrOpcode::kFinish: {
+        // TODO(rossberg): what are the constraints on these?
+        // Type must be subsumed by input type.
+        CHECK(bounds(Operand(node)).lower->Is(bounds(node).lower));
+        CHECK(bounds(Operand(node)).upper->Is(bounds(node).upper));
+        break;
+      }
       case IrOpcode::kFrameState:
         // TODO(jarin): what are the constraints on these?
         break;
+      case IrOpcode::kStateValues:
+        // TODO(jarin): what are the constraints on these?
+        break;
       case IrOpcode::kCall:
         // TODO(rossberg): what are the constraints on these?
         break;
-    case IrOpcode::kProjection: {
-      // Projection has an input that produces enough values.
-      size_t index = OpParameter<size_t>(node);
-      Node* input = NodeProperties::GetValueInput(node, 0);
-      CHECK_GT(OperatorProperties::GetValueOutputCount(input->op()),
-               static_cast<int>(index));
+
+      // JavaScript operators
+      // --------------------
+      case IrOpcode::kJSEqual:
+      case IrOpcode::kJSNotEqual:
+      case IrOpcode::kJSStrictEqual:
+      case IrOpcode::kJSStrictNotEqual:
+      case IrOpcode::kJSLessThan:
+      case IrOpcode::kJSGreaterThan:
+      case IrOpcode::kJSLessThanOrEqual:
+      case IrOpcode::kJSGreaterThanOrEqual:
+      case IrOpcode::kJSUnaryNot:
+        // Type is Boolean.
+        CHECK(bounds(node).upper->Is(Type::Boolean()));
+        break;
+
+      case IrOpcode::kJSBitwiseOr:
+      case IrOpcode::kJSBitwiseXor:
+      case IrOpcode::kJSBitwiseAnd:
+      case IrOpcode::kJSShiftLeft:
+      case IrOpcode::kJSShiftRight:
+      case IrOpcode::kJSShiftRightLogical:
+        // Type is 32 bit integral.
+        CHECK(bounds(node).upper->Is(Type::Integral32()));
+        break;
+      case IrOpcode::kJSAdd:
+        // Type is Number or String.
+        CHECK(bounds(node).upper->Is(Type::NumberOrString()));
+        break;
+      case IrOpcode::kJSSubtract:
+      case IrOpcode::kJSMultiply:
+      case IrOpcode::kJSDivide:
+      case IrOpcode::kJSModulus:
+        // Type is Number.
+        CHECK(bounds(node).upper->Is(Type::Number()));
+        break;
+
+      case IrOpcode::kJSToBoolean:
+        // Type is Boolean.
+        CHECK(bounds(node).upper->Is(Type::Boolean()));
+        break;
+      case IrOpcode::kJSToNumber:
+        // Type is Number.
+        CHECK(bounds(node).upper->Is(Type::Number()));
+        break;
+      case IrOpcode::kJSToString:
+        // Type is String.
+        CHECK(bounds(node).upper->Is(Type::String()));
+        break;
+      case IrOpcode::kJSToName:
+        // Type is Name.
+        CHECK(bounds(node).upper->Is(Type::Name()));
+        break;
+      case IrOpcode::kJSToObject:
+        // Type is Receiver.
+        CHECK(bounds(node).upper->Is(Type::Receiver()));
+        break;
+
+      case IrOpcode::kJSCreate:
+        // Type is Object.
+        CHECK(bounds(node).upper->Is(Type::Object()));
+        break;
+      case IrOpcode::kJSLoadProperty:
+      case IrOpcode::kJSLoadNamed:
+        // Type can be anything.
+        CHECK(bounds(node).upper->Is(Type::Any()));
+        break;
+      case IrOpcode::kJSStoreProperty:
+      case IrOpcode::kJSStoreNamed:
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
+        break;
+      case IrOpcode::kJSDeleteProperty:
+      case IrOpcode::kJSHasProperty:
+      case IrOpcode::kJSInstanceOf:
+        // Type is Boolean.
+        CHECK(bounds(node).upper->Is(Type::Boolean()));
+        break;
+      case IrOpcode::kJSTypeOf:
+        // Type is String.
+        CHECK(bounds(node).upper->Is(Type::String()));
+        break;
+
+      case IrOpcode::kJSLoadContext:
+        // Type can be anything.
+        CHECK(bounds(node).upper->Is(Type::Any()));
+        break;
+      case IrOpcode::kJSStoreContext:
+        // Type is empty.
+        CHECK(!NodeProperties::IsTyped(node));
+        break;
+      case IrOpcode::kJSCreateFunctionContext:
+      case IrOpcode::kJSCreateCatchContext:
+      case IrOpcode::kJSCreateWithContext:
+      case IrOpcode::kJSCreateBlockContext:
+      case IrOpcode::kJSCreateModuleContext:
+      case IrOpcode::kJSCreateGlobalContext: {
+        // Type is Context, and operand is Internal.
+        Bounds outer = bounds(NodeProperties::GetContextInput(node));
+        // TODO(rossberg): This should really be Is(Internal), but the typer
+        // currently can't do backwards propagation.
+        CHECK(outer.upper->Maybe(Type::Internal()));
+        CHECK(bounds(node).upper->IsContext());
         break;
       }
-    default:
-      // TODO(rossberg): Check other node kinds.
+
+      case IrOpcode::kJSCallConstruct:
+        // Type is Receiver.
+        CHECK(bounds(node).upper->Is(Type::Receiver()));
+        break;
+      case IrOpcode::kJSCallFunction:
+      case IrOpcode::kJSCallRuntime:
+      case IrOpcode::kJSYield:
+      case IrOpcode::kJSDebugger:
+        // Type can be anything.
+        CHECK(bounds(node).upper->Is(Type::Any()));
+        break;
+
+      // Simplified operators
+      // -------------------------------
+      case IrOpcode::kBooleanNot:
+        // Boolean -> Boolean
+        CHECK(bounds(Operand(node)).upper->Is(Type::Boolean()));
+        CHECK(bounds(node).upper->Is(Type::Boolean()));
+        break;
+      case IrOpcode::kBooleanToNumber:
+        // Boolean -> Number
+        CHECK(bounds(Operand(node)).upper->Is(Type::Boolean()));
+        CHECK(bounds(node).upper->Is(Type::Number()));
+        break;
+      case IrOpcode::kNumberEqual:
+      case IrOpcode::kNumberLessThan:
+      case IrOpcode::kNumberLessThanOrEqual:
+        // (Number, Number) -> Boolean
+        CHECK(bounds(Operand(node, 0)).upper->Is(Type::Number()));
+        CHECK(bounds(Operand(node, 1)).upper->Is(Type::Number()));
+        CHECK(bounds(node).upper->Is(Type::Boolean()));
+        break;
+      case IrOpcode::kNumberAdd:
+      case IrOpcode::kNumberSubtract:
+      case IrOpcode::kNumberMultiply:
+      case IrOpcode::kNumberDivide:
+      case IrOpcode::kNumberModulus:
+        // (Number, Number) -> Number
+        CHECK(bounds(Operand(node, 0)).upper->Is(Type::Number()));
+        CHECK(bounds(Operand(node, 1)).upper->Is(Type::Number()));
+        // TODO(rossberg): activate once we retype after opcode changes.
+        // CHECK(bounds(node).upper->Is(Type::Number()));
+        break;
+      case IrOpcode::kNumberToInt32:
+        // Number -> Signed32
+        CHECK(bounds(Operand(node)).upper->Is(Type::Number()));
+        CHECK(bounds(node).upper->Is(Type::Signed32()));
+        break;
+      case IrOpcode::kNumberToUint32:
+        // Number -> Unsigned32
+        CHECK(bounds(Operand(node)).upper->Is(Type::Number()));
+        CHECK(bounds(node).upper->Is(Type::Unsigned32()));
+        break;
+      case IrOpcode::kStringEqual:
+      case IrOpcode::kStringLessThan:
+      case IrOpcode::kStringLessThanOrEqual:
+        // (String, String) -> Boolean
+        CHECK(bounds(Operand(node, 0)).upper->Is(Type::String()));
+        CHECK(bounds(Operand(node, 1)).upper->Is(Type::String()));
+        CHECK(bounds(node).upper->Is(Type::Boolean()));
+        break;
+      case IrOpcode::kStringAdd:
+        // (String, String) -> String
+        CHECK(bounds(Operand(node, 0)).upper->Is(Type::String()));
+        CHECK(bounds(Operand(node, 1)).upper->Is(Type::String()));
+        CHECK(bounds(node).upper->Is(Type::String()));
+        break;
+      case IrOpcode::kReferenceEqual: {
+        // (Unique, Any) -> Boolean  and
+        // (Any, Unique) -> Boolean
+        CHECK(bounds(Operand(node, 0)).upper->Is(Type::Unique()) ||
+              bounds(Operand(node, 1)).upper->Is(Type::Unique()));
+        CHECK(bounds(node).upper->Is(Type::Boolean()));
         break;
       }
 
-  if (from_start) {
-    reached_from_start.insert(node);
-  } else {
-    reached_from_end.insert(node);
+      case IrOpcode::kChangeTaggedToInt32: {
+        // Signed32 /\ Tagged -> Signed32 /\ UntaggedInt32
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Signed32(), Type::Tagged());
+        // Type* to = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+      case IrOpcode::kChangeTaggedToUint32: {
+        // Unsigned32 /\ Tagged -> Unsigned32 /\ UntaggedInt32
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Unsigned32(), Type::Tagged());
+        // Type* to = Type::Intersect(Type::Unsigned32(), Type::UntaggedInt32());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+      case IrOpcode::kChangeTaggedToFloat64: {
+        // Number /\ Tagged -> Number /\ UntaggedFloat64
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Number(), Type::Tagged());
+        // Type* to = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+      case IrOpcode::kChangeInt32ToTagged: {
+        // Signed32 /\ UntaggedInt32 -> Signed32 /\ Tagged
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Signed32(), Type::UntaggedInt32());
+        // Type* to = Type::Intersect(Type::Signed32(), Type::Tagged());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+      case IrOpcode::kChangeUint32ToTagged: {
+        // Unsigned32 /\ UntaggedInt32 -> Unsigned32 /\ Tagged
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Unsigned32(), Type::UntaggedInt32());
+        // Type* to = Type::Intersect(Type::Unsigned32(), Type::Tagged());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+      case IrOpcode::kChangeFloat64ToTagged: {
+        // Number /\ UntaggedFloat64 -> Number /\ Tagged
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Number(), Type::UntaggedFloat64());
+        // Type* to = Type::Intersect(Type::Number(), Type::Tagged());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+      case IrOpcode::kChangeBoolToBit: {
+        // Boolean /\ TaggedPtr -> Boolean /\ UntaggedInt1
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
+        // Type* to = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+      case IrOpcode::kChangeBitToBool: {
+        // Boolean /\ UntaggedInt1 -> Boolean /\ TaggedPtr
+        // TODO(neis): Activate once ChangeRepresentation works in typer.
+        // Type* from = Type::Intersect(Type::Boolean(), Type::UntaggedInt1());
+        // Type* to = Type::Intersect(Type::Boolean(), Type::TaggedPtr());
+        // CHECK(bounds(Operand(node)).upper->Is(from));
+        // CHECK(bounds(node).upper->Is(to));
+        break;
+      }
+
+      case IrOpcode::kLoadField:
+        // Object -> fieldtype
+        // TODO(rossberg): activate once machine ops are typed.
+        // CHECK(bounds(Operand(node)).upper->Is(Type::Object()));
+        // CHECK(bounds(node).upper->Is(Field(node).type));
+        break;
+      case IrOpcode::kLoadElement:
+        // Object -> elementtype
+        // TODO(rossberg): activate once machine ops are typed.
+        // CHECK(bounds(Operand(node)).upper->Is(Type::Object()));
+        // CHECK(bounds(node).upper->Is(Element(node).type));
+        break;
+      case IrOpcode::kStoreField:
+        // (Object, fieldtype) -> _|_
+        // TODO(rossberg): activate once machine ops are typed.
+        // CHECK(bounds(Operand(node, 0)).upper->Is(Type::Object()));
+        // CHECK(bounds(Operand(node, 1)).upper->Is(Field(node).type));
+        CHECK(!NodeProperties::IsTyped(node));
+        break;
+      case IrOpcode::kStoreElement:
+        // (Object, elementtype) -> _|_
+        // TODO(rossberg): activate once machine ops are typed.
+        // CHECK(bounds(Operand(node, 0)).upper->Is(Type::Object()));
+        // CHECK(bounds(Operand(node, 1)).upper->Is(Element(node).type));
+        CHECK(!NodeProperties::IsTyped(node));
+        break;
+
+      // Machine operators
+      // -----------------------
+      case IrOpcode::kLoad:
+      case IrOpcode::kStore:
+      case IrOpcode::kWord32And:
+      case IrOpcode::kWord32Or:
+      case IrOpcode::kWord32Xor:
+      case IrOpcode::kWord32Shl:
+      case IrOpcode::kWord32Shr:
+      case IrOpcode::kWord32Sar:
+      case IrOpcode::kWord32Ror:
+      case IrOpcode::kWord32Equal:
+      case IrOpcode::kWord64And:
+      case IrOpcode::kWord64Or:
+      case IrOpcode::kWord64Xor:
+      case IrOpcode::kWord64Shl:
+      case IrOpcode::kWord64Shr:
+      case IrOpcode::kWord64Sar:
+      case IrOpcode::kWord64Ror:
+      case IrOpcode::kWord64Equal:
+      case IrOpcode::kInt32Add:
+      case IrOpcode::kInt32AddWithOverflow:
+      case IrOpcode::kInt32Sub:
+      case IrOpcode::kInt32SubWithOverflow:
+      case IrOpcode::kInt32Mul:
+      case IrOpcode::kInt32MulHigh:
+      case IrOpcode::kInt32Div:
+      case IrOpcode::kInt32Mod:
+      case IrOpcode::kInt32LessThan:
+      case IrOpcode::kInt32LessThanOrEqual:
+      case IrOpcode::kUint32Div:
+      case IrOpcode::kUint32Mod:
+      case IrOpcode::kUint32LessThan:
+      case IrOpcode::kUint32LessThanOrEqual:
+      case IrOpcode::kInt64Add:
+      case IrOpcode::kInt64Sub:
+      case IrOpcode::kInt64Mul:
+      case IrOpcode::kInt64Div:
+      case IrOpcode::kInt64Mod:
+      case IrOpcode::kInt64LessThan:
+      case IrOpcode::kInt64LessThanOrEqual:
+      case IrOpcode::kUint64Div:
+      case IrOpcode::kUint64Mod:
+      case IrOpcode::kUint64LessThan:
+      case IrOpcode::kFloat64Add:
+      case IrOpcode::kFloat64Sub:
+      case IrOpcode::kFloat64Mul:
+      case IrOpcode::kFloat64Div:
+      case IrOpcode::kFloat64Mod:
+      case IrOpcode::kFloat64Sqrt:
+      case IrOpcode::kFloat64Equal:
+      case IrOpcode::kFloat64LessThan:
+      case IrOpcode::kFloat64LessThanOrEqual:
+      case IrOpcode::kTruncateInt64ToInt32:
+      case IrOpcode::kTruncateFloat64ToFloat32:
+      case IrOpcode::kTruncateFloat64ToInt32:
+      case IrOpcode::kChangeInt32ToInt64:
+      case IrOpcode::kChangeUint32ToUint64:
+      case IrOpcode::kChangeInt32ToFloat64:
+      case IrOpcode::kChangeUint32ToFloat64:
+      case IrOpcode::kChangeFloat32ToFloat64:
+      case IrOpcode::kChangeFloat64ToInt32:
+      case IrOpcode::kChangeFloat64ToUint32:
+      case IrOpcode::kLoadStackPointer:
+        // TODO(rossberg): Check.
+        break;
+    }
   }
 
   return GenericGraphVisit::CONTINUE;
 }
 
 
-void Verifier::Run(Graph* graph) {
-  Visitor visitor(graph->zone());
-
+void Verifier::Run(Graph* graph, Typing typing) {
+  Visitor visitor(graph->zone(), typing);
   CHECK_NE(NULL, graph->start());
-  visitor.from_start = true;
-  graph->VisitNodeUsesFromStart(&visitor);
   CHECK_NE(NULL, graph->end());
-  visitor.from_start = false;
   graph->VisitNodeInputsFromEnd(&visitor);
-
-  // All control nodes reachable from end are reachable from start.
-  for (NodeSet::iterator it = visitor.reached_from_end.begin();
-       it != visitor.reached_from_end.end(); ++it) {
-    CHECK(!NodeProperties::IsControl(*it) ||
-          visitor.reached_from_start.count(*it));
-  }
 }
 
 
+// -----------------------------------------------------------------------------
+
 static bool HasDominatingDef(Schedule* schedule, Node* node,
                              BasicBlock* container, BasicBlock* use_block,
                              int use_pos) {

src/compiler/verifier.h

@@ -18,7 +18,9 @@ class Schedule;
 // each node, etc.
 class Verifier {
  public:
-  static void Run(Graph* graph);
+  enum Typing { TYPED, UNTYPED };
+
+  static void Run(Graph* graph, Typing typing = TYPED);
 
  private:
   class Visitor;

src/types-inl.h

@@ -54,6 +54,13 @@ bool TypeImpl<Config>::NowContains(i::Object* value) {
 // -----------------------------------------------------------------------------
 // ZoneTypeConfig
 
+// static
+template<class T>
+T* ZoneTypeConfig::null_handle() {
+  return NULL;
+}
+
+
 // static
 template<class T>
 T* ZoneTypeConfig::handle(T* type) {
@@ -197,6 +204,13 @@ void ZoneTypeConfig::struct_set_value(
 // -----------------------------------------------------------------------------
 // HeapTypeConfig
 
+// static
+template<class T>
+i::Handle<T> HeapTypeConfig::null_handle() {
+  return i::Handle<T>();
+}
+
+
 // static
 template<class T>
 i::Handle<T> HeapTypeConfig::handle(T* type) {

src/types.cc

@@ -247,6 +247,7 @@ TypeImpl<Config>::BitsetType::Lub(i::Map* map) {
     case SHARED_FUNCTION_INFO_TYPE:
     case ACCESSOR_PAIR_TYPE:
     case FIXED_ARRAY_TYPE:
+    case BYTE_ARRAY_TYPE:
     case FOREIGN_TYPE:
     case CODE_TYPE:
       return kInternal & kTaggedPtr;
@@ -436,6 +437,7 @@ bool TypeImpl<Config>::SlowIs(TypeImpl* that) {
             Contains(that->AsRange(), *this->AsConstant()->Value()));
   }
   if (this->IsRange()) return false;
+
   return this->SimplyEquals(that);
 }
 

src/types.h

@@ -219,8 +219,9 @@ namespace internal {
   V(Detectable,          kDetectableReceiver | kNumber | kName) \
   V(Object,              kDetectableObject | kUndetectable) \
   V(Receiver,            kObject | kProxy) \
-  V(NonNumber,           kBoolean | kName | kNull | kReceiver | \
-                         kUndefined | kInternal) \
+  V(Unique,              kBoolean | kUniqueName | kNull | kUndefined | \
+                         kReceiver) \
+  V(NonNumber,           kUnique | kString | kInternal) \
   V(Any,                 0xfffffffeu)
 
 /*
@@ -265,6 +266,7 @@ namespace internal {
 //   typedef Struct;
 //   typedef Region;
 //   template<class> struct Handle { typedef type; }  // No template typedefs...
+//   template<class T> static Handle<T>::type null_handle();
 //   template<class T> static Handle<T>::type handle(T* t);  // !is_bitset(t)
 //   template<class T> static Handle<T>::type cast(Handle<Type>::type);
 //   static bool is_bitset(Type*);
@@ -375,6 +377,12 @@ class TypeImpl : public Config::Base {
 
   static TypeHandle Union(TypeHandle type1, TypeHandle type2, Region* reg);
   static TypeHandle Intersect(TypeHandle type1, TypeHandle type2, Region* reg);
+  static TypeImpl* Union(TypeImpl* type1, TypeImpl* type2) {
+    return BitsetType::New(type1->AsBitset() | type2->AsBitset());
+  }
+  static TypeImpl* Intersect(TypeImpl* type1, TypeImpl* type2) {
+    return BitsetType::New(type1->AsBitset() & type2->AsBitset());
+  }
 
   static TypeHandle Of(double value, Region* region) {
     return Config::from_bitset(BitsetType::Lub(value), region);
@@ -912,6 +920,7 @@ struct ZoneTypeConfig {
   typedef i::Zone Region;
   template<class T> struct Handle { typedef T* type; };
 
+  template<class T> static inline T* null_handle();
   template<class T> static inline T* handle(T* type);
   template<class T> static inline T* cast(Type* type);
 
@@ -954,6 +963,7 @@ struct HeapTypeConfig {
   typedef i::Isolate Region;
   template<class T> struct Handle { typedef i::Handle<T> type; };
 
+  template<class T> static inline i::Handle<T> null_handle();
   template<class T> static inline i::Handle<T> handle(T* type);
   template<class T> static inline i::Handle<T> cast(i::Handle<Type> type);
 
@@ -1002,7 +1012,9 @@ struct BoundsImpl {
   TypeHandle lower;
   TypeHandle upper;
 
-  BoundsImpl() {}
+  BoundsImpl() :  // Make sure accessing uninitialized bounds crashes big-time.
+    lower(Config::template null_handle<Type>()),
+    upper(Config::template null_handle<Type>()) {}
   explicit BoundsImpl(TypeHandle t) : lower(t), upper(t) {}
   BoundsImpl(TypeHandle l, TypeHandle u) : lower(l), upper(u) {
     DCHECK(lower->Is(upper));

test/cctest/compiler/test-changes-lowering.cc

@@ -10,7 +10,7 @@
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/pipeline.h"
-#include "src/compiler/typer.h"
+#include "src/compiler/simplified-lowering.h"
 #include "src/compiler/verifier.h"
 #include "src/execution.h"
 #include "src/globals.h"
@@ -31,13 +31,10 @@ class ChangesLoweringTester : public GraphBuilderTester<ReturnType> {
  public:
   explicit ChangesLoweringTester(MachineType p0 = kMachNone)
       : GraphBuilderTester<ReturnType>(p0),
-        typer(this->zone()),
         javascript(this->zone()),
-        jsgraph(this->graph(), this->common(), &javascript, &typer,
-                this->machine()),
+        jsgraph(this->graph(), this->common(), &javascript, this->machine()),
         function(Handle<JSFunction>::null()) {}
 
-  Typer typer;
   JSOperatorBuilder javascript;
   JSGraph jsgraph;
   Handle<JSFunction> function;
@@ -133,7 +130,7 @@ class ChangesLoweringTester : public GraphBuilderTester<ReturnType> {
     GraphReducer reducer(this->graph());
     reducer.AddReducer(&lowering);
     reducer.ReduceNode(change);
-    Verifier::Run(this->graph());
+    Verifier::Run(this->graph(), Verifier::UNTYPED);
   }
 
   Factory* factory() { return this->isolate()->factory(); }

test/cctest/compiler/test-js-constant-cache.cc

@@ -20,7 +20,7 @@ class JSCacheTesterHelper {
       : main_graph_(zone),
         main_common_(zone),
         main_javascript_(zone),
-        main_typer_(zone),
+        main_typer_(&main_graph_, MaybeHandle<Context>()),
         main_machine_() {}
   Graph main_graph_;
   CommonOperatorBuilder main_common_;
@@ -36,8 +36,12 @@ class JSConstantCacheTester : public HandleAndZoneScope,
  public:
   JSConstantCacheTester()
       : JSCacheTesterHelper(main_zone()),
-        JSGraph(&main_graph_, &main_common_, &main_javascript_, &main_typer_,
-                &main_machine_) {}
+        JSGraph(&main_graph_, &main_common_, &main_javascript_,
+                &main_machine_) {
+    main_graph_.SetStart(main_graph_.NewNode(common()->Start(0)));
+    main_graph_.SetEnd(main_graph_.NewNode(common()->End()));
+    main_typer_.Run();
+  }
 
   Type* upper(Node* node) { return NodeProperties::GetBounds(node).upper; }
 

test/cctest/compiler/test-js-context-specialization.cc

@@ -7,7 +7,6 @@
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/source-position.h"
-#include "src/compiler/typer.h"
 #include "test/cctest/cctest.h"
 #include "test/cctest/compiler/function-tester.h"
 #include "test/cctest/compiler/graph-builder-tester.h"
@@ -24,8 +23,7 @@ class ContextSpecializationTester : public HandleAndZoneScope,
         javascript_(main_zone()),
         machine_(),
         simplified_(main_zone()),
-        typer_(main_zone()),
-        jsgraph_(graph(), common(), &javascript_, &typer_, &machine_),
+        jsgraph_(graph(), common(), &javascript_, &machine_),
         info_(main_isolate(), main_zone()) {}
 
   Factory* factory() { return main_isolate()->factory(); }
@@ -40,7 +38,6 @@ class ContextSpecializationTester : public HandleAndZoneScope,
   JSOperatorBuilder javascript_;
   MachineOperatorBuilder machine_;
   SimplifiedOperatorBuilder simplified_;
-  Typer typer_;
   JSGraph jsgraph_;
   CompilationInfo info_;
 };

test/cctest/compiler/test-js-typed-lowering.cc

@@ -24,11 +24,11 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
         simplified(main_zone()),
         common(main_zone()),
         graph(main_zone()),
-        typer(main_zone()),
+        typer(&graph, MaybeHandle<Context>()),
         context_node(NULL) {
-    typer.DecorateGraph(&graph);
-    Node* s = graph.NewNode(common.Start(num_parameters));
-    graph.SetStart(s);
+    graph.SetStart(graph.NewNode(common.Start(num_parameters)));
+    graph.SetEnd(graph.NewNode(common.End()));
+    typer.Run();
   }
 
   Isolate* isolate;
@@ -74,7 +74,7 @@ class JSTypedLoweringTester : public HandleAndZoneScope {
   }
 
   Node* reduce(Node* node) {
-    JSGraph jsgraph(&graph, &common, &javascript, &typer, &machine);
+    JSGraph jsgraph(&graph, &common, &javascript, &machine);
     JSTypedLowering reducer(&jsgraph);
     Reduction reduction = reducer.Reduce(node);
     if (reduction.Changed()) return reduction.replacement();

test/cctest/compiler/test-machine-operator-reducer.cc

@@ -57,8 +57,8 @@ class ReducerTester : public HandleAndZoneScope {
         common(main_zone()),
         graph(main_zone()),
         javascript(main_zone()),
-        typer(main_zone()),
-        jsgraph(&graph, &common, &javascript, &typer, &machine),
+        typer(&graph, MaybeHandle<Context>()),
+        jsgraph(&graph, &common, &javascript, &machine),
         maxuint32(Constant<int32_t>(kMaxUInt32)) {
     Node* s = graph.NewNode(common.Start(num_parameters));
     graph.SetStart(s);

test/cctest/compiler/test-representation-change.cc

@@ -11,7 +11,6 @@
 
 #include "src/compiler/node-matchers.h"
 #include "src/compiler/representation-change.h"
-#include "src/compiler/typer.h"
 
 using namespace v8::internal;
 using namespace v8::internal::compiler;
@@ -25,16 +24,13 @@ class RepresentationChangerTester : public HandleAndZoneScope,
  public:
   explicit RepresentationChangerTester(int num_parameters = 0)
       : GraphAndBuilders(main_zone()),
-        typer_(main_zone()),
         javascript_(main_zone()),
-        jsgraph_(main_graph_, &main_common_, &javascript_, &typer_,
-                 &main_machine_),
+        jsgraph_(main_graph_, &main_common_, &javascript_, &main_machine_),
         changer_(&jsgraph_, &main_simplified_, main_isolate()) {
     Node* s = graph()->NewNode(common()->Start(num_parameters));
     graph()->SetStart(s);
   }
 
-  Typer typer_;
   JSOperatorBuilder javascript_;
   JSGraph jsgraph_;
   RepresentationChanger changer_;

test/cctest/compiler/test-simplified-lowering.cc

@@ -37,10 +37,9 @@ class SimplifiedLoweringTester : public GraphBuilderTester<ReturnType> {
                            MachineType p3 = kMachNone,
                            MachineType p4 = kMachNone)
       : GraphBuilderTester<ReturnType>(p0, p1, p2, p3, p4),
-        typer(this->zone()),
+        typer(this->graph(), MaybeHandle<Context>()),
         javascript(this->zone()),
-        jsgraph(this->graph(), this->common(), &javascript, &typer,
-                this->machine()),
+        jsgraph(this->graph(), this->common(), &javascript, this->machine()),
         lowering(&jsgraph) {}
 
   Typer typer;
@@ -50,12 +49,13 @@ class SimplifiedLoweringTester : public GraphBuilderTester<ReturnType> {
 
   void LowerAllNodes() {
     this->End();
+    typer.Run();
     lowering.LowerAllNodes();
   }
 
   void LowerAllNodesAndLowerChanges() {
     this->End();
-    typer.Run(jsgraph.graph(), MaybeHandle<Context>());
+    typer.Run();
     lowering.LowerAllNodes();
 
     Zone* zone = this->zone();
@@ -674,9 +674,9 @@ class TestingGraph : public HandleAndZoneScope, public GraphAndBuilders {
   explicit TestingGraph(Type* p0_type, Type* p1_type = Type::None(),
                         Type* p2_type = Type::None())
       : GraphAndBuilders(main_zone()),
-        typer(main_zone()),
+        typer(graph(), MaybeHandle<Context>()),
         javascript(main_zone()),
-        jsgraph(graph(), common(), &javascript, &typer, machine()) {
+        jsgraph(graph(), common(), &javascript, machine()) {
     start = graph()->NewNode(common()->Start(2));
     graph()->SetStart(start);
     ret =
@@ -686,6 +686,7 @@ class TestingGraph : public HandleAndZoneScope, public GraphAndBuilders {
     p0 = graph()->NewNode(common()->Parameter(0), start);
     p1 = graph()->NewNode(common()->Parameter(1), start);
     p2 = graph()->NewNode(common()->Parameter(2), start);
+    typer.Run();
     NodeProperties::SetBounds(p0, Bounds(p0_type));
     NodeProperties::SetBounds(p1, Bounds(p1_type));
     NodeProperties::SetBounds(p2, Bounds(p2_type));
@@ -706,8 +707,7 @@ class TestingGraph : public HandleAndZoneScope, public GraphAndBuilders {
   }
 
   void Lower() {
-    SimplifiedLowering lowering(&jsgraph);
-    lowering.LowerAllNodes();
+    SimplifiedLowering(&jsgraph).LowerAllNodes();
   }
 
   // Inserts the node as the return value of the graph.
@@ -1540,10 +1540,11 @@ TEST(UpdatePhi) {
   TestingGraph t(Type::Any(), Type::Signed32());
   static const MachineType kMachineTypes[] = {kMachInt32, kMachUint32,
                                               kMachFloat64};
+  Type* kTypes[] = {Type::Signed32(), Type::Unsigned32(), Type::Number()};
 
   for (size_t i = 0; i < arraysize(kMachineTypes); i++) {
     FieldAccess access = {kTaggedBase, FixedArrayBase::kHeaderSize,
-                          Handle<Name>::null(), Type::Any(), kMachineTypes[i]};
+                          Handle<Name>::null(), kTypes[i], kMachineTypes[i]};
 
     Node* load0 =
         t.graph()->NewNode(t.simplified()->LoadField(access), t.p0, t.start);

test/cctest/compiler/test-typer.cc

@@ -26,7 +26,7 @@ class TyperTester : public HandleAndZoneScope, public GraphAndBuilders {
  public:
   TyperTester()
       : GraphAndBuilders(main_zone()),
-        typer_(main_zone()),
+        typer_(graph(), MaybeHandle<Context>()),
         javascript_(main_zone()) {
     Node* s = graph()->NewNode(common()->Start(3));
     graph()->SetStart(s);
@@ -79,7 +79,6 @@ class TyperTester : public HandleAndZoneScope, public GraphAndBuilders {
     NodeProperties::SetBounds(p1, Bounds(rhs));
     Node* n = graph()->NewNode(
         op, p0, p1, context_node_, graph()->start(), graph()->start());
-    typer_.Init(n);
     return NodeProperties::GetBounds(n).upper;
   }
 

test/unittests/compiler/change-lowering-unittest.cc

@@ -6,7 +6,6 @@
 #include "src/compiler/js-graph.h"
 #include "src/compiler/node-properties-inl.h"
 #include "src/compiler/simplified-operator.h"
-#include "src/compiler/typer.h"
 #include "test/unittests/compiler/compiler-test-utils.h"
 #include "test/unittests/compiler/graph-unittest.h"
 #include "testing/gmock-support.h"
@@ -65,10 +64,9 @@ class ChangeLoweringTest : public GraphTest {
   }
 
   Reduction Reduce(Node* node) {
-    Typer typer(zone());
     MachineOperatorBuilder machine(WordRepresentation());
     JSOperatorBuilder javascript(zone());
-    JSGraph jsgraph(graph(), common(), &javascript, &typer, &machine);
+    JSGraph jsgraph(graph(), common(), &javascript, &machine);
     CompilationInfo info(isolate(), zone());
     Linkage linkage(&info);
     ChangeLowering reducer(&jsgraph, &linkage);

test/unittests/compiler/graph-unittest.h

@@ -8,6 +8,7 @@
 #include "src/compiler/common-operator.h"
 #include "src/compiler/graph.h"
 #include "src/compiler/machine-operator.h"
+#include "src/compiler/typer.h"
 #include "test/unittests/test-utils.h"
 #include "testing/gmock/include/gmock/gmock.h"
 
@@ -64,6 +65,20 @@ class GraphTest : public TestWithContext, public TestWithZone {
 };
 
 
+class TypedGraphTest : public GraphTest {
+ public:
+  explicit TypedGraphTest(int parameters = 1)
+      : GraphTest(parameters),
+        typer_(graph(), MaybeHandle<Context>()) {}
+
+ protected:
+  Typer* typer() { return &typer_; }
+
+ private:
+  Typer typer_;
+};
+
+
 Matcher<Node*> IsBranch(const Matcher<Node*>& value_matcher,
                         const Matcher<Node*>& control_matcher);
 Matcher<Node*> IsMerge(const Matcher<Node*>& control0_matcher,

test/unittests/compiler/js-builtin-reducer-unittest.cc

@@ -16,15 +16,14 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-class JSBuiltinReducerTest : public GraphTest {
+class JSBuiltinReducerTest : public TypedGraphTest {
  public:
   JSBuiltinReducerTest() : javascript_(zone()) {}
 
  protected:
   Reduction Reduce(Node* node) {
-    Typer typer(zone());
     MachineOperatorBuilder machine;
-    JSGraph jsgraph(graph(), common(), javascript(), &typer, &machine);
+    JSGraph jsgraph(graph(), common(), javascript(), &machine);
     JSBuiltinReducer reducer(&jsgraph);
     return reducer.Reduce(node);
   }

test/unittests/compiler/js-typed-lowering-unittest.cc

@@ -31,16 +31,15 @@ const StrictMode kStrictModes[] = {SLOPPY, STRICT};
 }  // namespace
 
 
-class JSTypedLoweringTest : public GraphTest {
+class JSTypedLoweringTest : public TypedGraphTest {
  public:
-  JSTypedLoweringTest() : GraphTest(3), javascript_(zone()) {}
+  JSTypedLoweringTest() : TypedGraphTest(3), javascript_(zone()) {}
   virtual ~JSTypedLoweringTest() {}
 
  protected:
   Reduction Reduce(Node* node) {
-    Typer typer(zone());
     MachineOperatorBuilder machine;
-    JSGraph jsgraph(graph(), common(), javascript(), &typer, &machine);
+    JSGraph jsgraph(graph(), common(), javascript(), &machine);
     JSTypedLowering reducer(&jsgraph);
     return reducer.Reduce(node);
   }

test/unittests/compiler/machine-operator-reducer-unittest.cc

@@ -18,16 +18,15 @@ namespace v8 {
 namespace internal {
 namespace compiler {
 
-class MachineOperatorReducerTest : public GraphTest {
+class MachineOperatorReducerTest : public TypedGraphTest {
  public:
   explicit MachineOperatorReducerTest(int num_parameters = 2)
-      : GraphTest(num_parameters) {}
+      : TypedGraphTest(num_parameters) {}
 
  protected:
   Reduction Reduce(Node* node) {
-    Typer typer(zone());
     JSOperatorBuilder javascript(zone());
-    JSGraph jsgraph(graph(), common(), &javascript, &typer, &machine_);
+    JSGraph jsgraph(graph(), common(), &javascript, &machine_);
     MachineOperatorReducer reducer(&jsgraph);
     return reducer.Reduce(node);
   }

test/unittests/compiler/simplified-operator-reducer-unittest.cc

@@ -5,7 +5,6 @@
 #include "src/compiler/js-graph.h"
 #include "src/compiler/simplified-operator.h"
 #include "src/compiler/simplified-operator-reducer.h"
-#include "src/compiler/typer.h"
 #include "src/conversions.h"
 #include "test/unittests/compiler/graph-unittest.h"
 
@@ -21,10 +20,9 @@ class SimplifiedOperatorReducerTest : public GraphTest {
 
  protected:
   Reduction Reduce(Node* node) {
-    Typer typer(zone());
     MachineOperatorBuilder machine;
     JSOperatorBuilder javascript(zone());
-    JSGraph jsgraph(graph(), common(), &javascript, &typer, &machine);
+    JSGraph jsgraph(graph(), common(), &javascript, &machine);
     SimplifiedOperatorReducer reducer(&jsgraph);
     return reducer.Reduce(node);
   }