Steps towards unification of number bitset and range types.

- New invariant on union types: if the union has a range then the number
  bits in the bitset must be cleared.

- Various tweaks in intersection and union to satisfy the invariant.

- Exposed and used representation bits in range types (and the Limits
  helper class).

- Implemented Glb for ranges so that the Is predicate handles
  ranges correctly.

- Change typer weakening so that it does not rely on GetRange.
  However, the code still seems to be a bit fragile.

- Removed the Smi types from the type system core, instead introduced
  Signed31, Unsigned30 and created constructors for Small(Un)Signed
  that point to the right type for the architecture.

- Punched a hole in the config to be able to get to the isolate so
  that it is possible to allocate heap numbers for newly created
  ranges.

Patch by jarin@chromium.prg, original review here:
https://codereview.chromium.org/795713003/

TBR=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/837723006

Cr-Commit-Position: refs/heads/master@{#26197}

src/compiler/change-lowering.cc

@@ -163,7 +163,7 @@ Reduction ChangeLowering::ChangeInt32ToTagged(Node* value, Node* control) {
         machine()->Word64Shl(),
         graph()->NewNode(machine()->ChangeInt32ToInt64(), value),
         SmiShiftBitsConstant()));
-  } else if (NodeProperties::GetBounds(value).upper->Is(Type::SignedSmall())) {
+  } else if (NodeProperties::GetBounds(value).upper->Is(Type::Signed31())) {
     return Replace(
         graph()->NewNode(machine()->WordShl(), value, SmiShiftBitsConstant()));
   }

src/compiler/typer.cc

@@ -888,12 +888,12 @@ Type* Typer::Visitor::JSBitwiseXorTyper(Type* lhs, Type* rhs, Typer* t) {
   double rmax = rhs->Max();
   if ((lmin >= 0 && rmin >= 0) || (lmax < 0 && rmax < 0)) {
     // Xor-ing negative or non-negative values results in a non-negative value.
-    return Type::NonNegativeSigned32();
+    return Type::Unsigned31();
   }
   if ((lmax < 0 && rmin >= 0) || (lmin >= 0 && rmax < 0)) {
     // Xor-ing a negative and a non-negative value results in a negative value.
     // TODO(jarin) Use a range here.
-    return Type::NegativeSigned32();
+    return Type::Negative32();
   }
   return Type::Signed32();
 }
@@ -1258,9 +1258,22 @@ Bounds Typer::Visitor::TypeJSLoadNamed(Node* node) {
 // in the graph. In the current implementation, we are
 // increasing the limits to the closest power of two.
 Type* Typer::Visitor::Weaken(Type* current_type, Type* previous_type) {
-  Type::RangeType* previous = previous_type->GetRange();
-  Type::RangeType* current = current_type->GetRange();
-  if (previous != NULL && current != NULL) {
+  // If the types have nothing to do with integers, return the types.
+  if (!current_type->Maybe(typer_->integer) ||
+      !previous_type->Maybe(typer_->integer)) {
+    return current_type;
+  }
+
+  Type* previous_number =
+      Type::Intersect(previous_type, typer_->integer, zone());
+  Type* current_number = Type::Intersect(current_type, typer_->integer, zone());
+  if (!current_number->IsRange() || !previous_number->IsRange()) {
+    return current_type;
+  }
+
+  Type::RangeType* previous = previous_number->AsRange();
+  Type::RangeType* current = current_number->AsRange();
+
   double current_min = current->Min()->Number();
   Handle<Object> new_min = current->Min();
 
@@ -1293,8 +1306,6 @@ Type* Typer::Visitor::Weaken(Type* current_type, Type* previous_type) {
   return Type::Union(current_type,
                      Type::Range(new_min, new_max, typer_->zone()),
                      typer_->zone());
-  }
-  return current_type;
 }
 
 

src/types-inl.h

@@ -16,6 +16,20 @@ namespace internal {
 // -----------------------------------------------------------------------------
 // TypeImpl
 
+template <class Config>
+typename TypeImpl<Config>::bitset
+TypeImpl<Config>::BitsetType::SignedSmall() {
+  return i::SmiValuesAre31Bits() ? kSigned31 : kSigned32;
+}
+
+
+template <class Config>
+typename TypeImpl<Config>::bitset
+TypeImpl<Config>::BitsetType::UnsignedSmall() {
+  return i::SmiValuesAre31Bits() ? kUnsigned30 : kUnsigned31;
+}
+
+
 template<class Config>
 TypeImpl<Config>* TypeImpl<Config>::cast(typename Config::Base* object) {
   TypeImpl* t = static_cast<TypeImpl*>(object);
@@ -201,6 +215,9 @@ void ZoneTypeConfig::struct_set_value(
 }
 
 
+// static
+i::Isolate* ZoneTypeConfig::isolate(Zone* zone) { return zone->isolate(); }
+
 // -----------------------------------------------------------------------------
 // HeapTypeConfig
 
@@ -348,6 +365,8 @@ void HeapTypeConfig::struct_set_value(
   structure->set(i + 1, *x);
 }
 
+// static
+i::Isolate* HeapTypeConfig::isolate(Isolate* isolate) { return isolate; }
 } }  // namespace v8::internal
 
 #endif  // V8_TYPES_INL_H_

src/types.cc

@@ -28,17 +28,31 @@ typename TypeImpl<Config>::Limits TypeImpl<Config>::Intersect(
   Limits result(lhs);
   if (lhs.min->Number() < rhs.min->Number()) result.min = rhs.min;
   if (lhs.max->Number() > rhs.max->Number()) result.max = rhs.max;
+  result.representation = lhs.representation & rhs.representation;
   return result;
 }
 
 
-template<class Config>
-typename TypeImpl<Config>::Limits TypeImpl<Config>::Union(
-    Limits lhs, Limits rhs) {
+template <class Config>
+bool TypeImpl<Config>::IsEmpty(Limits lim) {
+  return lim.representation == BitsetType::kNone ||
+         lim.min->Number() > lim.max->Number();
+}
+
+
+template <class Config>
+typename TypeImpl<Config>::Limits TypeImpl<Config>::Union(Limits lhs,
+                                                          Limits rhs) {
   DisallowHeapAllocation no_allocation;
+  // Handle the case of empty operand, so that we do not stretch
+  // the limits/representations for them.
+  if (IsEmpty(lhs)) return rhs;
+  if (IsEmpty(rhs)) return lhs;
+
   Limits result(lhs);
   if (lhs.min->Number() > rhs.min->Number()) result.min = rhs.min;
   if (lhs.max->Number() < rhs.max->Number()) result.max = rhs.max;
+  result.representation = lhs.representation | rhs.representation;
   return result;
 }
 
@@ -49,7 +63,8 @@ bool TypeImpl<Config>::Overlap(
     typename TypeImpl<Config>::RangeType* rhs) {
   DisallowHeapAllocation no_allocation;
   typename TypeImpl<Config>::Limits lim = Intersect(Limits(lhs), Limits(rhs));
-  return lim.min->Number() <= lim.max->Number();
+  return lim.min->Number() <= lim.max->Number() &&
+         lim.representation != BitsetType::kNone;
 }
 
 
@@ -58,8 +73,19 @@ bool TypeImpl<Config>::Contains(
     typename TypeImpl<Config>::RangeType* lhs,
     typename TypeImpl<Config>::RangeType* rhs) {
   DisallowHeapAllocation no_allocation;
-  return lhs->Min()->Number() <= rhs->Min()->Number()
-      && rhs->Max()->Number() <= lhs->Max()->Number();
+  return rhs->Bound()->Is(lhs->Bound()) &&
+         lhs->Min()->Number() <= rhs->Min()->Number() &&
+         rhs->Max()->Number() <= lhs->Max()->Number();
+}
+
+
+template <class Config>
+bool TypeImpl<Config>::Contains(typename TypeImpl<Config>::RangeType* lhs,
+                                typename TypeImpl<Config>::ConstantType* rhs) {
+  DisallowHeapAllocation no_allocation;
+  return IsInteger(*rhs->Value()) && rhs->Bound()->Is(lhs->Bound()) &&
+         lhs->Min()->Number() <= rhs->Value()->Number() &&
+         rhs->Value()->Number() <= lhs->Max()->Number();
 }
 
 
@@ -67,9 +93,10 @@ template<class Config>
 bool TypeImpl<Config>::Contains(
     typename TypeImpl<Config>::RangeType* range, i::Object* val) {
   DisallowHeapAllocation no_allocation;
-  return IsInteger(val)
-      && range->Min()->Number() <= val->Number()
-      && val->Number() <= range->Max()->Number();
+  return IsInteger(val) &&
+         BitsetType::Is(BitsetType::Lub(val), range->Bound()->AsBitset()) &&
+         range->Min()->Number() <= val->Number() &&
+         val->Number() <= range->Max()->Number();
 }
 
 
@@ -125,9 +152,18 @@ TypeImpl<Config>::BitsetType::Glb(TypeImpl* type) {
     return type->AsBitset();
   } else if (type->IsUnion()) {
     SLOW_DCHECK(type->AsUnion()->Wellformed());
-    return type->AsUnion()->Get(0)->BitsetGlb();  // Shortcut.
-    // (The remaining BitsetGlb's are None anyway).
+    return type->AsUnion()->Get(0)->BitsetGlb() |
+           type->AsUnion()->Get(1)->BitsetGlb();  // Shortcut.
+  } else if (type->IsRange()) {
+    bitset glb = SEMANTIC(BitsetType::Glb(type->AsRange()->Min()->Number(),
+                                          type->AsRange()->Max()->Number()));
+    if (glb == 0) {
+      return kNone;
+    } else {
+      return glb | REPRESENTATION(type->BitsetLub());
+    }
   } else {
+    // (The remaining BitsetGlb's are None anyway).
     return kNone;
   }
 }
@@ -152,7 +188,7 @@ TypeImpl<Config>::BitsetType::Lub(TypeImpl* type) {
         type->AsClass()->Bound(NULL)->AsBitset();
   }
   if (type->IsConstant()) return type->AsConstant()->Bound()->AsBitset();
-  if (type->IsRange()) return type->AsRange()->BitsetLub();
+  if (type->IsRange()) return type->AsRange()->Bound()->AsBitset();
   if (type->IsContext()) return kInternal & kTaggedPointer;
   if (type->IsArray()) return kArray;
   if (type->IsFunction()) return kOtherObject;  // TODO(rossberg): kFunction
@@ -284,29 +320,33 @@ TypeImpl<Config>::BitsetType::Lub(double value) {
 }
 
 
-// Minimum values of regular numeric bitsets when SmiValuesAre31Bits.
+// Minimum values of regular numeric bitsets.
 template <class Config>
-const typename TypeImpl<Config>::BitsetType::BitsetMin
-    TypeImpl<Config>::BitsetType::BitsetMins31[] = {
-        {kOtherNumber, -V8_INFINITY},
-        {kOtherSigned32, kMinInt},
-        {kNegativeSignedSmall, -0x40000000},
-        {kUnsignedSmall, 0},
-        {kOtherUnsigned31, 0x40000000},
-        {kOtherUnsigned32, 0x80000000},
-        {kOtherNumber, static_cast<double>(kMaxUInt32) + 1}};
-
-
-// Minimum values of regular numeric bitsets when SmiValuesAre32Bits.
-// OtherSigned32 and OtherUnsigned31 are empty (see the diagrams in types.h).
+const typename TypeImpl<Config>::BitsetType::Boundary
+    TypeImpl<Config>::BitsetType::BoundariesArray[] = {
+  {kPlainNumber, -V8_INFINITY},
+  {kNegative32, kMinInt},
+  {kNegative31, -0x40000000},
+  {kUnsigned30, 0},
+  {kUnsigned31, 0x40000000},
+  {kUnsigned32, 0x80000000},
+  {kPlainNumber, static_cast<double>(kMaxUInt32) + 1}
+};
+
+
 template <class Config>
-const typename TypeImpl<Config>::BitsetType::BitsetMin
-    TypeImpl<Config>::BitsetType::BitsetMins32[] = {
-        {kOtherNumber, -V8_INFINITY},
-        {kNegativeSignedSmall, kMinInt},
-        {kUnsignedSmall, 0},
-        {kOtherUnsigned32, 0x80000000},
-        {kOtherNumber, static_cast<double>(kMaxUInt32) + 1}};
+const typename TypeImpl<Config>::BitsetType::Boundary*
+TypeImpl<Config>::BitsetType::Boundaries() {
+  return BoundariesArray;
+}
+
+
+template <class Config>
+size_t TypeImpl<Config>::BitsetType::BoundariesSize() {
+  // Windows doesn't like arraysize here.
+  // return arraysize(BoundariesArray);
+  return 7;
+}
 
 
 template<class Config>
@@ -314,30 +354,71 @@ typename TypeImpl<Config>::bitset
 TypeImpl<Config>::BitsetType::Lub(double min, double max) {
   DisallowHeapAllocation no_allocation;
   int lub = kNone;
-  const BitsetMin* mins = BitsetMins();
+  const Boundary* mins = Boundaries();
 
   // Make sure the min-max range touches 0, so we are guaranteed no holes
   // in unions of valid bitsets.
   if (max < -1) max = -1;
   if (min > 0) min = 0;
 
-  for (size_t i = 1; i < BitsetMinsSize(); ++i) {
+  for (size_t i = 1; i < BoundariesSize(); ++i) {
     if (min < mins[i].min) {
       lub |= mins[i-1].bits;
       if (max < mins[i].min) return lub;
     }
   }
-  return lub |= mins[BitsetMinsSize()-1].bits;
+  return lub |= mins[BoundariesSize() - 1].bits;
 }
 
 
-template<class Config>
+template <class Config>
+typename TypeImpl<Config>::bitset TypeImpl<Config>::BitsetType::NumberBits(
+    bitset bits) {
+  return SEMANTIC(bits & kPlainNumber);
+}
+
+
+template <class Config>
+void TypeImpl<Config>::BitsetType::CheckNumberBits(bitset bits) {
+  // Check that the bitset does not contain any holes in number ranges.
+  bitset number_bits = NumberBits(bits);
+  if (number_bits != 0) {
+    bitset lub = SEMANTIC(Lub(Min(number_bits), Max(number_bits)));
+    CHECK(lub == number_bits);
+  }
+}
+
+template <class Config>
+typename TypeImpl<Config>::bitset TypeImpl<Config>::BitsetType::Glb(
+    double min, double max) {
+  DisallowHeapAllocation no_allocation;
+  int glb = kNone;
+  const Boundary* mins = Boundaries();
+
+  // If the range does not touch 0, the bound is empty.
+  if (max < -1 || min > 0) return glb;
+
+  for (size_t i = 1; i + 1 < BoundariesSize(); ++i) {
+    if (min <= mins[i].min) {
+      if (max + 1 < mins[i + 1].min) break;
+      glb |= mins[i].bits;
+    }
+  }
+  // OtherNumber also contains float numbers, so it can never be
+  // in the greatest lower bound. (There is also the small trouble
+  // of kOtherNumber having a range hole, which we can conveniently
+  // ignore here.)
+  return glb & ~(SEMANTIC(kOtherNumber));
+}
+
+
+template <class Config>
 double TypeImpl<Config>::BitsetType::Min(bitset bits) {
   DisallowHeapAllocation no_allocation;
   DCHECK(Is(bits, kNumber));
-  const BitsetMin* mins = BitsetMins();
+  const Boundary* mins = Boundaries();
   bool mz = SEMANTIC(bits & kMinusZero);
-  for (size_t i = 0; i < BitsetMinsSize(); ++i) {
+  for (size_t i = 0; i < BoundariesSize(); ++i) {
     if (Is(SEMANTIC(mins[i].bits), bits)) {
       return mz ? std::min(0.0, mins[i].min) : mins[i].min;
     }
@@ -351,12 +432,12 @@ template<class Config>
 double TypeImpl<Config>::BitsetType::Max(bitset bits) {
   DisallowHeapAllocation no_allocation;
   DCHECK(Is(bits, kNumber));
-  const BitsetMin* mins = BitsetMins();
+  const Boundary* mins = Boundaries();
   bool mz = SEMANTIC(bits & kMinusZero);
-  if (BitsetType::Is(mins[BitsetMinsSize()-1].bits, bits)) {
+  if (BitsetType::Is(SEMANTIC(mins[BoundariesSize() - 1].bits), bits)) {
     return +V8_INFINITY;
   }
-  for (size_t i = BitsetMinsSize()-1; i-- > 0; ) {
+  for (size_t i = BoundariesSize() - 1; i-- > 0;) {
     if (Is(SEMANTIC(mins[i].bits), bits)) {
       return mz ?
           std::max(0.0, mins[i+1].min - 1) : mins[i+1].min - 1;
@@ -439,9 +520,9 @@ bool TypeImpl<Config>::SlowIs(TypeImpl* that) {
   }
 
   if (that->IsRange()) {
-    return (this->IsRange() && Contains(that->AsRange(), this->AsRange()))
-        || (this->IsConstant() &&
-            Contains(that->AsRange(), *this->AsConstant()->Value()));
+    return (this->IsRange() && Contains(that->AsRange(), this->AsRange())) ||
+           (this->IsConstant() &&
+            Contains(that->AsRange(), this->AsConstant()));
   }
   if (this->IsRange()) return false;
 
@@ -503,23 +584,38 @@ bool TypeImpl<Config>::Maybe(TypeImpl* that) {
 
   if (!BitsetType::IsInhabited(this->BitsetLub() & that->BitsetLub()))
     return false;
-  if (this->IsBitset() || that->IsBitset()) return true;
+
+  if (this->IsBitset() && that->IsBitset()) return true;
 
   if (this->IsClass() != that->IsClass()) return true;
 
   if (this->IsRange()) {
     if (that->IsConstant()) {
-      return Contains(this->AsRange(), *that->AsConstant()->Value());
-    }
-    return that->IsRange() && Overlap(this->AsRange(), that->AsRange());
+      return Contains(this->AsRange(), that->AsConstant());
     }
     if (that->IsRange()) {
-    if (this->IsConstant()) {
-      return Contains(that->AsRange(), *this->AsConstant()->Value());
+      return Overlap(this->AsRange(), that->AsRange());
+    }
+    if (that->IsBitset()) {
+      bitset number_bits = BitsetType::NumberBits(that->AsBitset());
+      if (number_bits == BitsetType::kNone) {
+        return false;
+      }
+      if ((REPRESENTATION(that->AsBitset()) &
+           REPRESENTATION(this->BitsetLub())) == BitsetType::kNone) {
+        return false;
       }
-    return this->IsRange() && Overlap(this->AsRange(), that->AsRange());
+      double min = std::max(BitsetType::Min(number_bits), this->Min());
+      double max = std::min(BitsetType::Max(number_bits), this->Max());
+      return min <= max;
+    }
+  }
+  if (that->IsRange()) {
+    return that->Maybe(this);  // This case is handled above.
   }
 
+  if (this->IsBitset() || that->IsBitset()) return true;
+
   return this->SimplyEquals(that);
 }
 
@@ -560,7 +656,14 @@ bool TypeImpl<Config>::UnionType::Wellformed() {
   //    (even when the first element is not a bitset).
   // 4. No element is itself a union.
   // 5. No element is a subtype of any other.
+  // 6. If there is a range, then the bitset type does not contain
+  //    plain number bits.
   DCHECK(this->Length() >= 2);  // (1)
+
+  bitset number_bits = this->Get(0)->IsBitset()
+      ? BitsetType::NumberBits(this->Get(0)->AsBitset()) : 0;
+  USE(number_bits);
+
   for (int i = 0; i < this->Length(); ++i) {
     if (i != 0) DCHECK(!this->Get(i)->IsBitset());  // (2)
     if (i != 1) DCHECK(!this->Get(i)->IsRange());   // (3)
@@ -569,6 +672,7 @@ bool TypeImpl<Config>::UnionType::Wellformed() {
       if (i != j) DCHECK(!this->Get(i)->Is(this->Get(j)));  // (5)
     }
   }
+  DCHECK(!this->Get(1)->IsRange() || (number_bits == 0));  // (6)
   return true;
 }
 
@@ -615,20 +719,25 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Intersect(
 
   // Deal with bitsets.
   result->Set(size++, BitsetType::New(bits, region));
+  // Insert a placeholder for the range.
+  result->Set(size++, None(region));
 
-  // Deal with ranges.
-  TypeHandle range = None(region);
-  RangeType* range1 = type1->GetRange();
-  RangeType* range2 = type2->GetRange();
-  if (range1 != NULL && range2 != NULL) {
-    Limits lim = Intersect(Limits(range1), Limits(range2));
-    if (lim.min->Number() <= lim.max->Number()) {
-      range = RangeType::New(lim, region);
+  Limits lims = Limits::Empty(region);
+  size = IntersectAux(type1, type2, result, size, &lims, region);
+
+  // If the range is not empty, then insert it into the union and
+  // remove the number bits from the bitset.
+  if (!IsEmpty(lims)) {
+    UpdateRange(RangeType::New(lims, region), result, size, region);
+
+    // Remove the number bits.
+    bitset number_bits = BitsetType::NumberBits(bits);
+    bits &= ~number_bits;
+    if (SEMANTIC(bits) == BitsetType::kNone) {
+      bits = BitsetType::kNone;
     }
+    result->Set(0, BitsetType::New(bits, region));
   }
-  result->Set(size++, range);
-
-  size = IntersectAux(type1, type2, result, size, region);
   return NormalizeUnion(result, size);
 }
 
@@ -657,19 +766,51 @@ int TypeImpl<Config>::UpdateRange(
 }
 
 
-template<class Config>
-int TypeImpl<Config>::IntersectAux(
-    TypeHandle lhs, TypeHandle rhs,
-    UnionHandle result, int size, Region* region) {
+template <class Config>
+typename TypeImpl<Config>::Limits TypeImpl<Config>::ToLimits(bitset bits,
+                                                             Region* region) {
+  bitset representation = REPRESENTATION(bits);
+  bitset number_bits = BitsetType::NumberBits(bits);
+
+  if (representation == BitsetType::kNone && number_bits == BitsetType::kNone) {
+    return Limits::Empty(region);
+  }
+
+  double bitset_min = BitsetType::Min(number_bits);
+  double bitset_max = BitsetType::Max(number_bits);
+
+  // TODO(jarin) Get rid of the heap numbers.
+  i::Factory* f = Config::isolate(region)->factory();
+
+  return Limits(f->NewNumber(bitset_min), f->NewNumber(bitset_max),
+                representation);
+}
+
+
+template <class Config>
+typename TypeImpl<Config>::Limits TypeImpl<Config>::IntersectRangeAndBitset(
+    TypeHandle range, TypeHandle bitset, Region* region) {
+  Limits range_lims(range->AsRange());
+  Limits bitset_lims = ToLimits(bitset->AsBitset(), region);
+  return Intersect(range_lims, bitset_lims);
+}
+
+
+template <class Config>
+int TypeImpl<Config>::IntersectAux(TypeHandle lhs, TypeHandle rhs,
+                                   UnionHandle result, int size, Limits* lims,
+                                   Region* region) {
   if (lhs->IsUnion()) {
     for (int i = 0, n = lhs->AsUnion()->Length(); i < n; ++i) {
-      size = IntersectAux(lhs->AsUnion()->Get(i), rhs, result, size, region);
+      size =
+          IntersectAux(lhs->AsUnion()->Get(i), rhs, result, size, lims, region);
     }
     return size;
   }
   if (rhs->IsUnion()) {
     for (int i = 0, n = rhs->AsUnion()->Length(); i < n; ++i) {
-      size = IntersectAux(lhs, rhs->AsUnion()->Get(i), result, size, region);
+      size =
+          IntersectAux(lhs, rhs->AsUnion()->Get(i), result, size, lims, region);
     }
     return size;
   }
@@ -679,23 +820,41 @@ int TypeImpl<Config>::IntersectAux(
   }
 
   if (lhs->IsRange()) {
-    if (rhs->IsBitset() || rhs->IsClass()) {
-      return UpdateRange(
-          Config::template cast<RangeType>(lhs), result, size, region);
+    if (rhs->IsBitset()) {
+      Limits lim = IntersectRangeAndBitset(lhs, rhs, region);
+
+      if (!IsEmpty(lim)) {
+        *lims = Union(lim, *lims);
       }
-    if (rhs->IsConstant() &&
-        Contains(lhs->AsRange(), *rhs->AsConstant()->Value())) {
+      return size;
+    }
+    if (rhs->IsClass()) {
+      *lims = Union(Limits(lhs->AsRange()), *lims);
+    }
+    if (rhs->IsConstant() && Contains(lhs->AsRange(), rhs->AsConstant())) {
       return AddToUnion(rhs, result, size, region);
     }
+    if (rhs->IsRange()) {
+      Limits lim = Intersect(Limits(lhs->AsRange()), Limits(rhs->AsRange()));
+      if (!IsEmpty(lim)) {
+        *lims = Union(lim, *lims);
+      }
+    }
     return size;
   }
   if (rhs->IsRange()) {
-    if (lhs->IsBitset() || lhs->IsClass()) {
-      return UpdateRange(
-          Config::template cast<RangeType>(rhs), result, size, region);
+    if (lhs->IsBitset()) {
+      Limits lim = IntersectRangeAndBitset(rhs, lhs, region);
+
+      if (!IsEmpty(lim)) {
+        *lims = Union(lim, *lims);
       }
-    if (lhs->IsConstant() &&
-        Contains(rhs->AsRange(), *lhs->AsConstant()->Value())) {
+      return size;
+    }
+    if (lhs->IsClass()) {
+      *lims = Union(Limits(rhs->AsRange()), *lims);
+    }
+    if (lhs->IsConstant() && Contains(rhs->AsRange(), lhs->AsConstant())) {
       return AddToUnion(lhs, result, size, region);
     }
     return size;
@@ -714,6 +873,65 @@ int TypeImpl<Config>::IntersectAux(
 }
 
 
+// Make sure that we produce a well-formed range and bitset:
+// If the range is non-empty, the number bits in the bitset should be
+// clear. Moreover, if we have a canonical range (such as Signed32(),
+// we want to produce a bitset rather than a range.
+template <class Config>
+typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::NormalizeRangeAndBitset(
+    RangeHandle range, bitset* bits, Region* region) {
+  // Fast path: If the bitset does not mention numbers, we can just keep the
+  // range.
+  bitset number_bits = BitsetType::NumberBits(*bits);
+  if (number_bits == 0) {
+    return range;
+  }
+
+  // If the range is contained within the bitset, return an empty range
+  // (but make sure we take the representation).
+  bitset range_lub = range->BitsetLub();
+  if (BitsetType::Is(BitsetType::NumberBits(range_lub), *bits)) {
+    *bits |= range_lub;
+    return None(region);
+  }
+
+  // Slow path: reconcile the bitset range and the range.
+  double bitset_min = BitsetType::Min(number_bits);
+  double bitset_max = BitsetType::Max(number_bits);
+
+  i::Handle<i::Object> range_min_obj = range->Min();
+  i::Handle<i::Object> range_max_obj = range->Max();
+  double range_min = range_min_obj->Number();
+  double range_max = range_max_obj->Number();
+
+  bitset range_representation = REPRESENTATION(range->BitsetLub());
+  bitset bits_representation = REPRESENTATION(*bits);
+  bitset representation =
+      (bits_representation | range_representation) & BitsetType::kNumber;
+
+  // Remove the number bits from the bitset, they would just confuse us now.
+  *bits &= ~number_bits;
+  if (bits_representation == *bits) {
+    *bits = BitsetType::kNone;
+  }
+
+  if (representation == range_representation && range_min <= bitset_min &&
+      range_max >= bitset_max) {
+    // Bitset is contained within the range, just return the range.
+    return range;
+  }
+
+  if (bitset_min < range_min) {
+    range_min_obj = Config::isolate(region)->factory()->NewNumber(bitset_min);
+  }
+  if (bitset_max > range_max) {
+    range_max_obj = Config::isolate(region)->factory()->NewNumber(bitset_max);
+  }
+  return RangeType::New(range_min_obj, range_max_obj,
+                        BitsetType::New(representation, region), region);
+}
+
+
 template<class Config>
 typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Union(
     TypeHandle type1, TypeHandle type2, Region* region) {
@@ -741,22 +959,24 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Union(
   UnionHandle result = UnionType::New(size, region);
   size = 0;
 
-  // Deal with bitsets.
-  TypeHandle bits = BitsetType::New(
-      type1->BitsetGlb() | type2->BitsetGlb(), region);
-  result->Set(size++, bits);
+  // Compute the new bitset.
+  bitset new_bitset = type1->BitsetGlb() | type2->BitsetGlb();
 
   // Deal with ranges.
   TypeHandle range = None(region);
   RangeType* range1 = type1->GetRange();
   RangeType* range2 = type2->GetRange();
   if (range1 != NULL && range2 != NULL) {
-    range = RangeType::New(Union(Limits(range1), Limits(range2)), region);
+    Limits lims = Union(Limits(range1), Limits(range2));
+    RangeHandle union_range = RangeType::New(lims, region);
+    range = NormalizeRangeAndBitset(union_range, &new_bitset, region);
   } else if (range1 != NULL) {
-    range = handle(range1);
+    range = NormalizeRangeAndBitset(handle(range1), &new_bitset, region);
   } else if (range2 != NULL) {
-    range = handle(range2);
+    range = NormalizeRangeAndBitset(handle(range2), &new_bitset, region);
   }
+  TypeHandle bits = BitsetType::New(new_bitset, region);
+  result->Set(size++, bits);
   result->Set(size++, range);
 
   size = AddToUnion(type1, result, size, region);
@@ -919,7 +1139,8 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Convert(
     return ConstantType::New(type->AsConstant()->Value(), region);
   } else if (type->IsRange()) {
     return RangeType::New(
-        type->AsRange()->Min(), type->AsRange()->Max(), region);
+        type->AsRange()->Min(), type->AsRange()->Max(),
+        BitsetType::New(REPRESENTATION(type->BitsetLub()), region), region);
   } else if (type->IsContext()) {
     TypeHandle outer = Convert<OtherType>(type->AsContext()->Outer(), region);
     return ContextType::New(outer, region);
@@ -985,6 +1206,7 @@ void TypeImpl<Config>::BitsetType::Print(std::ostream& os,  // NOLINT
     return;
   }
 
+  // clang-format off
   static const bitset named_bitsets[] = {
 #define BITSET_CONSTANT(type, value) REPRESENTATION(k##type),
     REPRESENTATION_BITSET_TYPE_LIST(BITSET_CONSTANT)
@@ -995,6 +1217,7 @@ void TypeImpl<Config>::BitsetType::Print(std::ostream& os,  // NOLINT
     SEMANTIC_BITSET_TYPE_LIST(BITSET_CONSTANT)
 #undef BITSET_CONSTANT
   };
+  // clang-format on
 
   bool is_first = true;
   os << "(";

src/types.h

@@ -153,6 +153,8 @@ namespace internal {
 // -----------------------------------------------------------------------------
 // Values for bitset types
 
+// clang-format off
+
 #define MASK_BITSET_TYPE_LIST(V) \
   V(Representation, 0xfff00000u) \
   V(Semantic,       0x000ffffeu)
@@ -195,11 +197,11 @@ namespace internal {
   V(OtherNumber,     1u << 4 | REPRESENTATION(kTagged | kUntaggedNumber))
 
 #define SEMANTIC_BITSET_TYPE_LIST(V) \
-  V(NegativeSignedSmall, 1u << 5  | REPRESENTATION(kTagged | kUntaggedNumber)) \
+  V(Negative31,          1u << 5  | REPRESENTATION(kTagged | kUntaggedNumber)) \
   V(Null,                1u << 6  | REPRESENTATION(kTaggedPointer)) \
   V(Undefined,           1u << 7  | REPRESENTATION(kTaggedPointer)) \
   V(Boolean,             1u << 8  | REPRESENTATION(kTaggedPointer)) \
-  V(UnsignedSmall,       1u << 9  | REPRESENTATION(kTagged | kUntaggedNumber)) \
+  V(Unsigned30,          1u << 9  | REPRESENTATION(kTagged | kUntaggedNumber)) \
   V(MinusZero,           1u << 10 | REPRESENTATION(kTagged | kUntaggedNumber)) \
   V(NaN,                 1u << 11 | REPRESENTATION(kTagged | kUntaggedNumber)) \
   V(Symbol,              1u << 12 | REPRESENTATION(kTaggedPointer)) \
@@ -211,11 +213,11 @@ namespace internal {
   V(Proxy,               1u << 18 | REPRESENTATION(kTaggedPointer)) \
   V(Internal,            1u << 19 | REPRESENTATION(kTagged | kUntagged)) \
   \
-  V(SignedSmall,         kUnsignedSmall | kNegativeSignedSmall) \
-  V(Signed32,            kSignedSmall | kOtherUnsigned31 | kOtherSigned32) \
-  V(NegativeSigned32,    kNegativeSignedSmall | kOtherSigned32) \
-  V(NonNegativeSigned32, kUnsignedSmall | kOtherUnsigned31) \
-  V(Unsigned32,          kUnsignedSmall | kOtherUnsigned31 | kOtherUnsigned32) \
+  V(Signed31,            kUnsigned30 | kNegative31) \
+  V(Signed32,            kSigned31 | kOtherUnsigned31 | kOtherSigned32) \
+  V(Negative32,          kNegative31 | kOtherSigned32) \
+  V(Unsigned31,          kUnsigned30 | kOtherUnsigned31) \
+  V(Unsigned32,          kUnsigned30 | kOtherUnsigned31 | kOtherUnsigned32) \
   V(Integral32,          kSigned32 | kUnsigned32) \
   V(PlainNumber,         kIntegral32 | kOtherNumber) \
   V(OrderedNumber,       kPlainNumber | kMinusZero) \
@@ -237,29 +239,17 @@ namespace internal {
   V(NonNumber,           kUnique | kString | kInternal) \
   V(Any,                 0xfffffffeu)
 
+// clang-format on
 
 /*
  * The following diagrams show how integers (in the mathematical sense) are
  * divided among the different atomic numerical types.
  *
- * If SmiValuesAre31Bits():
- *
- *   ON    OS32     OSS     US     OU31    OU32     ON
+ *   ON    OS32     N31     U30     OU31    OU32     ON
  * ______[_______[_______[_______[_______[_______[_______
  *     -2^31   -2^30     0      2^30    2^31    2^32
  *
- * Otherwise:
- *
- *   ON         OSS             US         OU32     ON
- * ______[_______________[_______________[_______[_______
- *     -2^31             0              2^31    2^32
- *
- *
  * E.g., OtherUnsigned32 (OU32) covers all integers from 2^31 to 2^32-1.
- *
- * NOTE: OtherSigned32 (OS32) and OU31 (OtherUnsigned31) are empty if Smis are
- *       32-bit wide.  They should thus never be used directly, only indirectly
- *       via e.g. Number.
  */
 
 #define PROPER_BITSET_TYPE_LIST(V) \
@@ -305,6 +295,7 @@ namespace internal {
 //   static i::Handle<V> struct_get_value(Handle<Struct>::type, int);
 //   template<class V>
 //   static void struct_set_value(Handle<Struct>::type, int, i::Handle<V>);
+//   static i::Isolate* isolate(Region* region);
 // }
 template<class Config>
 class TypeImpl : public Config::Base {
@@ -345,6 +336,19 @@ class TypeImpl : public Config::Base {
   PROPER_BITSET_TYPE_LIST(DEFINE_TYPE_CONSTRUCTOR)
   #undef DEFINE_TYPE_CONSTRUCTOR
 
+  static TypeImpl* SignedSmall() {
+    return BitsetType::New(BitsetType::SignedSmall());
+  }
+  static TypeHandle SignedSmall(Region* region) {
+    return BitsetType::New(BitsetType::SignedSmall(), region);
+  }
+  static TypeImpl* UnsignedSmall() {
+    return BitsetType::New(BitsetType::UnsignedSmall());
+  }
+  static TypeHandle UnsignedSmall(Region* region) {
+    return BitsetType::New(BitsetType::UnsignedSmall(), region);
+  }
+
   static TypeHandle Class(i::Handle<i::Map> map, Region* region) {
     return ClassType::New(map, region);
   }
@@ -353,7 +357,11 @@ class TypeImpl : public Config::Base {
   }
   static TypeHandle Range(
       i::Handle<i::Object> min, i::Handle<i::Object> max, Region* region) {
-    return RangeType::New(min, max, region);
+    return RangeType::New(
+        min, max, BitsetType::New(REPRESENTATION(BitsetType::kTagged |
+                                                 BitsetType::kUntaggedNumber),
+                                  region),
+        region);
   }
   static TypeHandle Context(TypeHandle outer, Region* region) {
     return ContextType::New(outer, region);
@@ -560,31 +568,48 @@ class TypeImpl : public Config::Base {
   struct Limits {
     i::Handle<i::Object> min;
     i::Handle<i::Object> max;
-    Limits(i::Handle<i::Object> min, i::Handle<i::Object> max) :
-      min(min), max(max) {}
-    explicit Limits(RangeType* range) :
-      min(range->Min()), max(range->Max()) {}
+    bitset representation;
+    Limits(i::Handle<i::Object> min, i::Handle<i::Object> max,
+           bitset representation)
+        : min(min), max(max), representation(representation) {}
+    explicit Limits(RangeType* range)
+        : min(range->Min()),
+          max(range->Max()),
+          representation(REPRESENTATION(range->Bound()->AsBitset())) {}
+    static Limits Empty(Region* region) {
+      i::Factory* f = Config::isolate(region)->factory();
+      i::Handle<i::Object> min = f->NewNumber(1);
+      i::Handle<i::Object> max = f->NewNumber(0);
+      return Limits(min, max, BitsetType::kNone);
+    }
   };
 
+  static bool IsEmpty(Limits lim);
   static Limits Intersect(Limits lhs, Limits rhs);
   static Limits Union(Limits lhs, Limits rhs);
   static bool Overlap(RangeType* lhs, RangeType* rhs);
   static bool Contains(RangeType* lhs, RangeType* rhs);
+  static bool Contains(RangeType* range, ConstantType* constant);
   static bool Contains(RangeType* range, i::Object* val);
 
   static int UpdateRange(
       RangeHandle type, UnionHandle result, int size, Region* region);
 
+  static Limits IntersectRangeAndBitset(TypeHandle range, TypeHandle bits,
+                                        Region* region);
+  static Limits ToLimits(bitset bits, Region* region);
+
   bool SimplyEquals(TypeImpl* that);
   template<class TypeHandle>
   bool SimplyEquals(TypeHandle that) { return this->SimplyEquals(*that); }
 
   static int AddToUnion(
       TypeHandle type, UnionHandle result, int size, Region* region);
-  static int IntersectAux(
-      TypeHandle type, TypeHandle other,
-      UnionHandle result, int size, Region* region);
+  static int IntersectAux(TypeHandle type, TypeHandle other, UnionHandle result,
+                          int size, Limits* limits, Region* region);
   static TypeHandle NormalizeUnion(UnionHandle unioned, int size);
+  static TypeHandle NormalizeRangeAndBitset(RangeHandle range, bitset* bits,
+                                            Region* region);
 };
 
 
@@ -603,28 +628,17 @@ class TypeImpl<Config>::BitsetType : public TypeImpl<Config> {
     kUnusedEOL = 0
   };
 
+  static bitset SignedSmall();
+  static bitset UnsignedSmall();
+
   bitset Bitset() { return Config::as_bitset(this); }
 
   static TypeImpl* New(bitset bits) {
-    DCHECK(bits == kNone || IsInhabited(bits));
-
-    if (FLAG_enable_slow_asserts) {
-      // Check that the bitset does not contain any holes in number ranges.
-      bitset mask = kSemantic;
-      if (!i::SmiValuesAre31Bits()) {
-        mask &= ~(kOtherUnsigned31 | kOtherSigned32);
-      }
-      bitset number_bits = bits & kPlainNumber & mask;
-      if (number_bits != 0) {
-        bitset lub = Lub(Min(number_bits), Max(number_bits)) & mask;
-        CHECK(lub == number_bits);
-      }
-    }
-
+    if (FLAG_enable_slow_asserts) CheckNumberBits(bits);
     return Config::from_bitset(bits);
   }
   static TypeHandle New(bitset bits, Region* region) {
-    DCHECK(bits == kNone || IsInhabited(bits));
+    if (FLAG_enable_slow_asserts) CheckNumberBits(bits);
     return Config::from_bitset(bits, region);
   }
   // TODO(neis): Eventually allow again for types with empty semantics
@@ -642,6 +656,7 @@ class TypeImpl<Config>::BitsetType : public TypeImpl<Config> {
   static double Max(bitset);
 
   static bitset Glb(TypeImpl* type);  // greatest lower bound that's a bitset
+  static bitset Glb(double min, double max);
   static bitset Lub(TypeImpl* type);  // least upper bound that's a bitset
   static bitset Lub(i::Map* map);
   static bitset Lub(i::Object* value);
@@ -654,21 +669,18 @@ class TypeImpl<Config>::BitsetType : public TypeImpl<Config> {
   static void Print(bitset);
 #endif
 
+  static bitset NumberBits(bitset bits);
+
  private:
-  struct BitsetMin{
+  struct Boundary {
     bitset bits;
     double min;
   };
-  static const BitsetMin BitsetMins31[];
-  static const BitsetMin BitsetMins32[];
-  static const BitsetMin* BitsetMins() {
-    return i::SmiValuesAre31Bits() ? BitsetMins31 : BitsetMins32;
-  }
-  static size_t BitsetMinsSize() {
-    return i::SmiValuesAre31Bits() ? 7 : 5;
-    /* arraysize(BitsetMins31) : arraysize(BitsetMins32); */
-    // Using arraysize here doesn't compile on Windows.
-  }
+  static const Boundary BoundariesArray[];
+  static inline const Boundary* Boundaries();
+  static inline size_t BoundariesSize();
+
+  static void CheckNumberBits(bitset bits);
 };
 
 
@@ -815,25 +827,31 @@ class TypeImpl<Config>::ConstantType : public StructuralType {
 template<class Config>
 class TypeImpl<Config>::RangeType : public StructuralType {
  public:
-  int BitsetLub() { return this->Get(0)->AsBitset(); }
+  TypeHandle Bound() { return this->Get(0); }
   i::Handle<i::Object> Min() { return this->template GetValue<i::Object>(1); }
   i::Handle<i::Object> Max() { return this->template GetValue<i::Object>(2); }
 
-  static RangeHandle New(
-      i::Handle<i::Object> min, i::Handle<i::Object> max, Region* region) {
+  static RangeHandle New(i::Handle<i::Object> min, i::Handle<i::Object> max,
+                         TypeHandle representation, Region* region) {
     DCHECK(IsInteger(min->Number()) && IsInteger(max->Number()));
     DCHECK(min->Number() <= max->Number());
+    bitset representation_bits = representation->AsBitset();
+    DCHECK(REPRESENTATION(representation_bits) == representation_bits);
+
     RangeHandle type = Config::template cast<RangeType>(
         StructuralType::New(StructuralType::kRangeTag, 3, region));
-    type->Set(0, BitsetType::New(
-        BitsetType::Lub(min->Number(), max->Number()), region));
+
+    bitset bits = SEMANTIC(BitsetType::Lub(min->Number(), max->Number())) |
+                  representation_bits;
+    type->Set(0, BitsetType::New(bits, region));
     type->SetValue(1, min);
     type->SetValue(2, max);
     return type;
   }
 
   static RangeHandle New(Limits lim, Region* region) {
-    return New(lim.min, lim.max, region);
+    return New(lim.min, lim.max, BitsetType::New(lim.representation, region),
+               region);
   }
 
   static RangeType* cast(TypeImpl* type) {
@@ -982,6 +1000,7 @@ struct ZoneTypeConfig {
   static inline i::Handle<V> struct_get_value(Struct* structure, int i);
   template<class V> static inline void struct_set_value(
       Struct* structure, int i, i::Handle<V> x);
+  static inline i::Isolate* isolate(Zone* zone);
 };
 
 typedef TypeImpl<ZoneTypeConfig> Type;
@@ -1030,6 +1049,7 @@ struct HeapTypeConfig {
   template<class V>
   static inline void struct_set_value(
       i::Handle<Struct> structure, int i, i::Handle<V> x);
+  static inline i::Isolate* isolate(Isolate* isolate);
 };
 
 typedef TypeImpl<HeapTypeConfig> HeapType;

test/cctest/compiler/test-js-typed-lowering.cc

@@ -176,20 +176,17 @@ static Type* kStringTypes[] = {Type::InternalizedString(), Type::OtherString(),
                                Type::String()};
 
 
-static Type* kInt32Types[] = {
-    Type::UnsignedSmall(),       Type::NegativeSigned32(),
-    Type::NonNegativeSigned32(), Type::SignedSmall(),
+static Type* kInt32Types[] = {Type::UnsignedSmall(), Type::Negative32(),
+                              Type::Unsigned31(),    Type::SignedSmall(),
                               Type::Signed32(),      Type::Unsigned32(),
                               Type::Integral32()};
 
 
 static Type* kNumberTypes[] = {
-    Type::UnsignedSmall(),       Type::NegativeSigned32(),
-    Type::NonNegativeSigned32(), Type::SignedSmall(),
-    Type::Signed32(),            Type::Unsigned32(),
-    Type::Integral32(),          Type::MinusZero(),
-    Type::NaN(),                 Type::OrderedNumber(),
-    Type::PlainNumber(),         Type::Number()};
+    Type::UnsignedSmall(), Type::Negative32(),  Type::Unsigned31(),
+    Type::SignedSmall(),   Type::Signed32(),    Type::Unsigned32(),
+    Type::Integral32(),    Type::MinusZero(),   Type::NaN(),
+    Type::OrderedNumber(), Type::PlainNumber(), Type::Number()};
 
 
 static Type* kJSTypes[] = {Type::Undefined(), Type::Null(),   Type::Boolean(),
@@ -316,12 +313,11 @@ class JSBitwiseShiftTypedLoweringTester : public JSTypedLoweringTester {
 TEST(Int32BitwiseShifts) {
   JSBitwiseShiftTypedLoweringTester R;
 
-  Type* types[] = {Type::SignedSmall(),      Type::UnsignedSmall(),
-                   Type::NegativeSigned32(), Type::NonNegativeSigned32(),
-                   Type::Unsigned32(),       Type::Signed32(),
-                   Type::MinusZero(),        Type::NaN(),
-                   Type::Undefined(),        Type::Null(),
-                   Type::Boolean(),          Type::Number(),
+  Type* types[] = {
+      Type::SignedSmall(), Type::UnsignedSmall(), Type::Negative32(),
+      Type::Unsigned31(),  Type::Unsigned32(),    Type::Signed32(),
+      Type::MinusZero(),   Type::NaN(),           Type::Undefined(),
+      Type::Null(),        Type::Boolean(),       Type::Number(),
       Type::PlainNumber(), Type::String()};
 
   for (size_t i = 0; i < arraysize(types); ++i) {

test/cctest/test-types.cc

@@ -136,6 +136,14 @@ struct Tests : Rep {
     }
   }
 
+  void CheckSubOrEqual(TypeHandle type1, TypeHandle type2) {
+    CHECK(type1->Is(type2));
+    if (this->IsBitset(type1) && this->IsBitset(type2)) {
+      CHECK((this->AsBitset(type1) | this->AsBitset(type2))
+            == this->AsBitset(type2));
+    }
+  }
+
   void CheckUnordered(TypeHandle type1, TypeHandle type2) {
     CHECK(!type1->Is(type2));
     CHECK(!type2->Is(type1));
@@ -294,39 +302,33 @@ struct Tests : Rep {
     CHECK(T.Constant(fac->NewNumber(0))->Is(T.UnsignedSmall));
     CHECK(T.Constant(fac->NewNumber(1))->Is(T.UnsignedSmall));
     CHECK(T.Constant(fac->NewNumber(0x3fffffff))->Is(T.UnsignedSmall));
-    CHECK(T.Constant(fac->NewNumber(-1))->Is(T.NegativeSignedSmall));
-    CHECK(T.Constant(fac->NewNumber(-0x3fffffff))->Is(T.NegativeSignedSmall));
-    CHECK(T.Constant(fac->NewNumber(-0x40000000))->Is(T.NegativeSignedSmall));
+    CHECK(T.Constant(fac->NewNumber(-1))->Is(T.Negative31));
+    CHECK(T.Constant(fac->NewNumber(-0x3fffffff))->Is(T.Negative31));
+    CHECK(T.Constant(fac->NewNumber(-0x40000000))->Is(T.Negative31));
+    CHECK(T.Constant(fac->NewNumber(0x40000000))->Is(T.Unsigned31));
+    CHECK(!T.Constant(fac->NewNumber(0x40000000))->Is(T.Unsigned30));
+    CHECK(T.Constant(fac->NewNumber(0x7fffffff))->Is(T.Unsigned31));
+    CHECK(!T.Constant(fac->NewNumber(0x7fffffff))->Is(T.Unsigned30));
+    CHECK(T.Constant(fac->NewNumber(-0x40000001))->Is(T.Negative32));
+    CHECK(!T.Constant(fac->NewNumber(-0x40000001))->Is(T.Negative31));
+    CHECK(T.Constant(fac->NewNumber(-0x7fffffff))->Is(T.Negative32));
+    CHECK(!T.Constant(fac->NewNumber(-0x7fffffff - 1))->Is(T.Negative31));
     if (SmiValuesAre31Bits()) {
-      CHECK(T.Constant(fac->NewNumber(0x40000000))->Is(T.NonNegativeSigned32));
       CHECK(!T.Constant(fac->NewNumber(0x40000000))->Is(T.UnsignedSmall));
-      CHECK(T.Constant(fac->NewNumber(0x7fffffff))->Is(T.NonNegativeSigned32));
       CHECK(!T.Constant(fac->NewNumber(0x7fffffff))->Is(T.UnsignedSmall));
-      CHECK(T.Constant(fac->NewNumber(-0x40000001))->Is(T.NegativeSigned32));
-      CHECK(
-          !T.Constant(fac->NewNumber(-0x40000001))->Is(T.NegativeSignedSmall));
-      CHECK(T.Constant(fac->NewNumber(-0x7fffffff))->Is(T.NegativeSigned32));
-      CHECK(!T.Constant(fac->NewNumber(-0x7fffffff - 1))
-                 ->Is(T.NegativeSignedSmall));
+      CHECK(!T.Constant(fac->NewNumber(-0x40000001))->Is(T.SignedSmall));
+      CHECK(!T.Constant(fac->NewNumber(-0x7fffffff - 1))->Is(T.SignedSmall));
     } else {
       CHECK(SmiValuesAre32Bits());
       CHECK(T.Constant(fac->NewNumber(0x40000000))->Is(T.UnsignedSmall));
       CHECK(T.Constant(fac->NewNumber(0x7fffffff))->Is(T.UnsignedSmall));
-      CHECK(T.Constant(fac->NewNumber(0x40000000))->Is(T.NonNegativeSigned32));
-      CHECK(T.Constant(fac->NewNumber(0x7fffffff))->Is(T.NonNegativeSigned32));
-      CHECK(T.Constant(fac->NewNumber(-0x40000001))->Is(T.NegativeSignedSmall));
-      CHECK(T.Constant(fac->NewNumber(-0x7fffffff))->Is(T.NegativeSignedSmall));
-      CHECK(T.Constant(fac->NewNumber(-0x7fffffff - 1))
-                ->Is(T.NegativeSignedSmall));
-      CHECK(T.Constant(fac->NewNumber(-0x40000001))->Is(T.NegativeSigned32));
-      CHECK(T.Constant(fac->NewNumber(-0x7fffffff))->Is(T.NegativeSigned32));
-      CHECK(
-          T.Constant(fac->NewNumber(-0x7fffffff - 1))->Is(T.NegativeSigned32));
+      CHECK(T.Constant(fac->NewNumber(-0x40000001))->Is(T.SignedSmall));
+      CHECK(T.Constant(fac->NewNumber(-0x7fffffff - 1))->Is(T.SignedSmall));
     }
     CHECK(T.Constant(fac->NewNumber(0x80000000u))->Is(T.Unsigned32));
-    CHECK(!T.Constant(fac->NewNumber(0x80000000u))->Is(T.NonNegativeSigned32));
+    CHECK(!T.Constant(fac->NewNumber(0x80000000u))->Is(T.Unsigned31));
     CHECK(T.Constant(fac->NewNumber(0xffffffffu))->Is(T.Unsigned32));
-    CHECK(!T.Constant(fac->NewNumber(0xffffffffu))->Is(T.NonNegativeSigned32));
+    CHECK(!T.Constant(fac->NewNumber(0xffffffffu))->Is(T.Unsigned31));
     CHECK(T.Constant(fac->NewNumber(0xffffffffu + 1.0))->Is(T.PlainNumber));
     CHECK(!T.Constant(fac->NewNumber(0xffffffffu + 1.0))->Is(T.Integral32));
     CHECK(T.Constant(fac->NewNumber(-0x7fffffff - 2.0))->Is(T.PlainNumber));
@@ -796,6 +798,7 @@ struct Tests : Rep {
               (type1->IsClass() && type2->IsClass()) ||
               (type1->IsConstant() && type2->IsConstant()) ||
               (type1->IsConstant() && type2->IsRange()) ||
+              (this->IsBitset(type1) && type2->IsRange()) ||
               (type1->IsRange() && type2->IsRange()) ||
               (type1->IsContext() && type2->IsContext()) ||
               (type1->IsArray() && type2->IsArray()) ||
@@ -934,7 +937,7 @@ struct Tests : Rep {
 
     CheckSub(T.SignedSmall, T.Number);
     CheckSub(T.Signed32, T.Number);
-    CheckSub(T.SignedSmall, T.Signed32);
+    CheckSubOrEqual(T.SignedSmall, T.Signed32);
     CheckUnordered(T.SignedSmall, T.MinusZero);
     CheckUnordered(T.Signed32, T.Unsigned32);
 
@@ -1478,8 +1481,8 @@ struct Tests : Rep {
     CheckDisjoint(T.Union(T.NumberFunction1, T.String), T.Number);
 
     // Bitset-class
-    CheckSub(
-        T.Union(T.ObjectClass, T.SignedSmall), T.Union(T.Object, T.Number));
+    CheckSub(T.Union(T.ObjectClass, T.SignedSmall),
+             T.Union(T.Object, T.Number));
     CheckSub(T.Union(T.ObjectClass, T.Array), T.Object);
     CheckUnordered(T.Union(T.ObjectClass, T.String), T.Array);
     CheckOverlap(T.Union(T.ObjectClass, T.String), T.Object);
@@ -1549,9 +1552,7 @@ struct Tests : Rep {
             T.Union(T.ObjectConstant2, T.ObjectConstant1),
             T.Union(T.ObjectConstant1, T.ObjectConstant2)),
         T.Union(T.ObjectConstant2, T.ObjectConstant1));
-    CheckEqual(
-        T.Union(
-            T.Union(T.Number, T.ArrayClass),
+    CheckEqual(T.Union(T.Union(T.Number, T.ArrayClass),
                        T.Union(T.SignedSmall, T.Array)),
                T.Union(T.Number, T.Array));
   }
@@ -1767,9 +1768,7 @@ struct Tests : Rep {
                 ->IsInhabited());  // !!!
 
     // Union-union
-    CheckEqual(
-        T.Intersect(
-            T.Union(T.Number, T.ArrayClass),
+    CheckEqual(T.Intersect(T.Union(T.Number, T.ArrayClass),
                            T.Union(T.SignedSmall, T.Array)),
                T.Union(T.SignedSmall, T.ArrayClass));
     CheckEqual(

test/cctest/types-fuzz.h

@@ -45,6 +45,9 @@ class Types {
     PROPER_BITSET_TYPE_LIST(DECLARE_TYPE)
     #undef DECLARE_TYPE
 
+    SignedSmall = Type::SignedSmall(region);
+    UnsignedSmall = Type::UnsignedSmall(region);
+
     object_map = isolate->factory()->NewMap(
         JS_OBJECT_TYPE, JSObject::kHeaderSize);
     array_map = isolate->factory()->NewMap(
@@ -130,6 +133,8 @@ class Types {
   #define DECLARE_TYPE(name, value) TypeHandle name;
   PROPER_BITSET_TYPE_LIST(DECLARE_TYPE)
   #undef DECLARE_TYPE
+  TypeHandle SignedSmall;
+  TypeHandle UnsignedSmall;
 
   TypeHandle ObjectClass;
   TypeHandle ArrayClass;

test/unittests/compiler/change-lowering-unittest.cc

@@ -211,7 +211,7 @@ TARGET_TEST_F(ChangeLowering32Test, ChangeInt32ToTagged) {
 TARGET_TEST_F(ChangeLowering32Test, ChangeInt32ToTaggedSmall) {
   Node* val = Parameter(0);
   Node* node = graph()->NewNode(simplified()->ChangeInt32ToTagged(), val);
-  NodeProperties::SetBounds(val, Bounds(Type::None(), Type::SignedSmall()));
+  NodeProperties::SetBounds(val, Bounds(Type::None(), Type::Signed31()));
   Reduction reduction = Reduce(node);
   ASSERT_TRUE(reduction.Changed());
 

test/unittests/compiler/js-builtin-reducer-unittest.cc

@@ -53,12 +53,10 @@ namespace {
 
 // TODO(mstarzinger): Find a common place and unify with test-js-typed-lowering.
 Type* const kNumberTypes[] = {
-    Type::UnsignedSmall(),       Type::NegativeSigned32(),
-    Type::NonNegativeSigned32(), Type::SignedSmall(),
-    Type::Signed32(),            Type::Unsigned32(),
-    Type::Integral32(),          Type::MinusZero(),
-    Type::NaN(),                 Type::OrderedNumber(),
-    Type::PlainNumber(),         Type::Number()};
+    Type::UnsignedSmall(), Type::Negative32(),  Type::Unsigned31(),
+    Type::SignedSmall(),   Type::Signed32(),    Type::Unsigned32(),
+    Type::Integral32(),    Type::MinusZero(),   Type::NaN(),
+    Type::OrderedNumber(), Type::PlainNumber(), Type::Number()};
 
 }  // namespace