Redesign of the internal type system.

src/types.cc

Index: src/types.cc
diff --git a/src/types.cc b/src/types.cc
index af45fa41cb012d02610aa89d8c3218fc5db184cf..c2a814070ef77696ace5d680ed64fc38bb654881 100644
--- a/src/types.cc
+++ b/src/types.cc
@@ -12,22 +12,62 @@ namespace internal {
 
 
 // -----------------------------------------------------------------------------
-// Range-related custom order on doubles.
-// We want -0 to be less than +0.
+// Range-related helper functions.
 
-static bool dle(double x, double y) {
-  return x <= y && (x != 0 || IsMinusZero(x) || !IsMinusZero(y));
+template<class Config>
+typename TypeImpl<Config>::Limits TypeImpl<Config>::intersect(
+    Limits lhs, Limits rhs) {
+  DisallowHeapAllocation no_allocation;
+  Limits result(lhs);
+  if (lhs.min->Number() < rhs.min->Number()) result.min = rhs.min;
+  if (lhs.max->Number() > rhs.max->Number()) result.max = rhs.max;
+  return result;
+}
+
+
+template<class Config>
+typename TypeImpl<Config>::Limits TypeImpl<Config>::union_(
+    Limits lhs, Limits rhs) {
+  DisallowHeapAllocation no_allocation;
+  Limits result(lhs);
+  if (lhs.min->Number() > rhs.min->Number()) result.min = rhs.min;
+  if (lhs.max->Number() < rhs.max->Number()) result.max = rhs.max;
+  return result;
+}
+
+
+template<class Config>
+bool TypeImpl<Config>::overlap(
+    typename TypeImpl<Config>::RangeType* lhs,
+    typename TypeImpl<Config>::RangeType* rhs) {
+  DisallowHeapAllocation no_allocation;
+  typename TypeImpl<Config>::Limits lim = intersect(Limits(lhs), Limits(rhs));
+  return lim.min->Number() <= lim.max->Number();
+}
+
+
+template<class Config>
+bool TypeImpl<Config>::contains(
+    typename TypeImpl<Config>::RangeType* lhs,
+    typename TypeImpl<Config>::RangeType* rhs) {
+  DisallowHeapAllocation no_allocation;
+  return lhs->Min() <= rhs->Min() && rhs->Max() <= lhs->Max();
 }
 
 
-static bool deq(double x, double y) {
-  return dle(x, y) && dle(y, x);
+template<class Config>
+bool TypeImpl<Config>::contains(
+    typename TypeImpl<Config>::RangeType* range, i::Object* val) {
+  DisallowHeapAllocation no_allocation;
+  return IsInteger(val)
+      && range->Min() <= val->Number() && val->Number() <= range->Max();
 }
 
 
 // -----------------------------------------------------------------------------
 // Glb and lub computation.
 
+
 // The largest bitset subsumed by this type.
 template<class Config>
 int TypeImpl<Config>::BitsetType::Glb(TypeImpl* type) {
@@ -36,8 +76,8 @@ int TypeImpl<Config>::BitsetType::Glb(TypeImpl* type) {
     return type->AsBitset();
   } else if (type->IsUnion()) {
     UnionHandle unioned = handle(type->AsUnion());
-    DCHECK(unioned->Wellformed());
-    return unioned->Get(0)->BitsetGlb();  // Other BitsetGlb's are kNone anyway.
+    SLOW_DCHECK(unioned->Wellformed());
+    return unioned->Get(0)->BitsetGlb();  // Shortcut.
   } else {
     return kNone;
   }
@@ -48,65 +88,22 @@ int TypeImpl<Config>::BitsetType::Glb(TypeImpl* type) {
 template<class Config>
 int TypeImpl<Config>::BitsetType::Lub(TypeImpl* type) {
   DisallowHeapAllocation no_allocation;
-  if (type->IsBitset()) {
-    return type->AsBitset();
-  } else if (type->IsUnion()) {
-    UnionHandle unioned = handle(type->AsUnion());
-    int bitset = kNone;
-    for (int i = 0; i < unioned->Length(); ++i) {
-      bitset |= unioned->Get(i)->BitsetLub();
-    }
-    return bitset;
-  } else if (type->IsClass()) {
-    // Little hack to avoid the need for a region for handlification here...
-    return Config::is_class(type) ? Lub(*Config::as_class(type)) :
-        type->AsClass()->Bound(NULL)->AsBitset();
-  } else if (type->IsConstant()) {
-    return type->AsConstant()->Bound()->AsBitset();
-  } else if (type->IsRange()) {
-    return type->AsRange()->Bound()->AsBitset();
-  } else if (type->IsContext()) {
-    return type->AsContext()->Bound()->AsBitset();
-  } else if (type->IsArray()) {
-    return type->AsArray()->Bound()->AsBitset();
-  } else if (type->IsFunction()) {
-    return type->AsFunction()->Bound()->AsBitset();
-  } else {
-    UNREACHABLE();
-    return kNone;
-  }
-}
-
-
-// The smallest bitset subsuming this type, ignoring explicit bounds.
-template<class Config>
-int TypeImpl<Config>::BitsetType::InherentLub(TypeImpl* type) {

[rossberg, 2014/09/10 15:44:14]

I'm glad that we can get rid of this one...

[neis1, 2014/09/11 12:58:12]

Well, it's basically still there.  But we only have one notion of Lub now.

-  DisallowHeapAllocation no_allocation;
-  if (type->IsBitset()) {
-    return type->AsBitset();
-  } else if (type->IsUnion()) {
-    UnionHandle unioned = handle(type->AsUnion());
+  if (type->IsUnion()) {
     int bitset = kNone;
-    for (int i = 0; i < unioned->Length(); ++i) {
-      bitset |= unioned->Get(i)->InherentBitsetLub();
+    for (int i = 0; i < type->AsUnion()->Length(); ++i) {
+      bitset |= type->AsUnion()->Get(i)->BitsetLub();
     }
     return bitset;
-  } else if (type->IsClass()) {
-    return Lub(*type->AsClass()->Map());
-  } else if (type->IsConstant()) {
-    return Lub(*type->AsConstant()->Value());
-  } else if (type->IsRange()) {
-    return Lub(type->AsRange()->Min(), type->AsRange()->Max());
-  } else if (type->IsContext()) {
-    return kInternal & kTaggedPtr;
-  } else if (type->IsArray()) {
-    return kArray;
-  } else if (type->IsFunction()) {
-    return kFunction;
-  } else {
-    UNREACHABLE();
-    return kNone;
   }
+  if (type->IsBitset()) return type->AsBitset();

[rossberg, 2014/09/10 15:44:13]

Put this case first, since it is probably the most common one.

[neis1, 2014/09/11 12:58:12]

Done.

+  if (type->IsClass()) return Lub(*type->AsClass()->Map());
+  if (type->IsConstant()) return Lub(*type->AsConstant()->Value());
+  if (type->IsRange()) return Lub(Limits(type->AsRange()));
+  if (type->IsContext()) return kInternal & kTaggedPtr;
+  if (type->IsArray()) return kArray;
+  if (type->IsFunction()) return kFunction;
+  UNREACHABLE();
+  return kNone;
 }
 
 
@@ -132,19 +129,8 @@ int TypeImpl<Config>::BitsetType::Lub(double value) {
 
 
 template<class Config>
-int TypeImpl<Config>::BitsetType::Lub(double min, double max) {
-  DisallowHeapAllocation no_allocation;
-  DCHECK(dle(min, max));
-  if (deq(min, max)) return BitsetType::Lub(min);  // Singleton range.
-  int bitset = BitsetType::kNumber ^ SEMANTIC(BitsetType::kNaN);
-  if (dle(0, min) || max < 0) bitset ^= SEMANTIC(BitsetType::kMinusZero);
-  return bitset;
-  // TODO(neis): Could refine this further by doing more checks on min/max.
-}
-
-
-template<class Config>
 int TypeImpl<Config>::BitsetType::Lub(int32_t value) {
+  DisallowHeapAllocation no_allocation;
   if (value >= 0x40000000) {
     return i::SmiValuesAre31Bits() ? kOtherUnsigned31 : kUnsignedSmall;
   }
@@ -181,6 +167,7 @@ int TypeImpl<Config>::BitsetType::Lub(i::Map* map) {
     case SHORT_EXTERNAL_STRING_TYPE:
     case SHORT_EXTERNAL_ONE_BYTE_STRING_TYPE:
     case SHORT_EXTERNAL_STRING_WITH_ONE_BYTE_DATA_TYPE:
+      return kOtherString;
     case INTERNALIZED_STRING_TYPE:
     case ONE_BYTE_INTERNALIZED_STRING_TYPE:
     case EXTERNAL_INTERNALIZED_STRING_TYPE:
@@ -189,7 +176,7 @@ int TypeImpl<Config>::BitsetType::Lub(i::Map* map) {
     case SHORT_EXTERNAL_INTERNALIZED_STRING_TYPE:
     case SHORT_EXTERNAL_ONE_BYTE_INTERNALIZED_STRING_TYPE:
     case SHORT_EXTERNAL_INTERNALIZED_STRING_WITH_ONE_BYTE_DATA_TYPE:
-      return kString;
+      return kInternalizedString;
     case SYMBOL_TYPE:
       return kSymbol;
     case ODDBALL_TYPE: {
@@ -261,64 +248,111 @@ int TypeImpl<Config>::BitsetType::Lub(i::Map* map) {
 }
 
 
-// -----------------------------------------------------------------------------
-// Predicates.
+template<class Config>
+double TypeImpl<Config>::BitsetType::Min(int bitset) {
+  DisallowHeapAllocation no_allocation;
+  switch (bitset) {
+    case kUnsignedSmall:
+      return 0;
+    case kOtherSignedSmall:
+      return i::SmiValuesAre31Bits() ? -0x40000000 : kMinInt;
+    case kOtherUnsigned31:  // Only used if SmiValuesAre31Bits().
+      return 0x40000000u;
+    case kOtherUnsigned32:
+      return 0x80000000u;
+    case kOtherSigned32:  // Only used if SmiValuesAre31Bits().
+      return kMinInt;
+    case kOtherNumber:  // The positive integer part of OtherNumber.
+      return kMaxUInt32;

[rossberg, 2014/09/10 15:44:14]

Why not static_cast<double>(kMaxUint32) + 1, and avoid the <= vs < pitfall
below?

[neis1, 2014/09/11 12:58:12]

Right, that's what it should have been in the first place.

+    default:
+      UNREACHABLE();
+      return 0;
+  }
+}
+
 
-// Check this <= that.
 template<class Config>
-bool TypeImpl<Config>::SlowIs(TypeImpl* that) {
+int TypeImpl<Config>::BitsetType::Lub(Limits lim) {

[rossberg, 2014/09/10 15:44:14]

Nit: move this decl closer to the other numeric Lubs

[neis1, 2014/09/11 12:58:12]

I moved the Lub for maps up.  The order now matches the order in the main Lub
function.

   DisallowHeapAllocation no_allocation;
+  double min = lim.min->Number();
+  double max = lim.max->Number();
+  int lub = kNone;
 
-  // Fast path for bitsets.
-  if (this->IsNone()) return true;
-  if (that->IsBitset()) {
-    return BitsetType::Is(BitsetType::Lub(this), that->AsBitset());
+  if (min < Min(kOtherSigned32)) {

[rossberg, 2014/09/10 15:44:13]

Hm, can't this written more concisely using a loop over a little table?

[neis1, 2014/09/11 12:58:12]

I rewrote it and also got rid of the Min() function.

+    lub |= kOtherNumber;
+    if (max < Min(kOtherSigned32)) return lub;
   }
-
-  if (that->IsClass()) {
-    return this->IsClass()
-        && *this->AsClass()->Map() == *that->AsClass()->Map()
-        && ((Config::is_class(that) && Config::is_class(this)) ||
-            BitsetType::New(this->BitsetLub())->Is(
-                BitsetType::New(that->BitsetLub())));
+  if (i::SmiValuesAre31Bits() && min < Min(kOtherSignedSmall)) {
+    lub |= kOtherSigned32;
+    if (max < Min(kOtherSignedSmall)) return lub;
   }
-  if (that->IsConstant()) {
-    return this->IsConstant()
-        && *this->AsConstant()->Value() == *that->AsConstant()->Value()
-        && this->AsConstant()->Bound()->Is(that->AsConstant()->Bound());
+  if (min < Min(kUnsignedSmall)) {
+    lub |= kOtherSignedSmall;
+    if (max < Min(kUnsignedSmall)) return lub;
   }
-  if (that->IsRange()) {
-    return this->IsRange()
-        && this->AsRange()->Bound()->Is(that->AsRange()->Bound())
-        && dle(that->AsRange()->Min(), this->AsRange()->Min())
-        && dle(this->AsRange()->Max(), that->AsRange()->Max());
+  if (min < Min(kOtherUnsigned31)) {
+    lub |= kUnsignedSmall;
+    if (max < Min(kOtherUnsigned31)) return lub;
+  }
+  if (min < Min(kOtherUnsigned32)) {
+    lub |= i::SmiValuesAre31Bits() ? kOtherUnsigned31 : kUnsignedSmall;
+    if (max < Min(kOtherUnsigned32)) return lub;
+  }
+  if (min < Min(kOtherNumber)) {

[rossberg, 2014/09/10 15:44:14]

Shouldn't this be <= ?

[neis1, 2014/09/11 12:58:12]

The <= below should have been < but due to the bug above it was wrong anyway.

+    lub |= kOtherUnsigned32;
+    if (max <= Min(kOtherNumber)) return lub;
+  }
+  return lub | kOtherNumber;
+}
+
+
+// -----------------------------------------------------------------------------
+// Predicates.
+
+
+template<class Config>
+bool TypeImpl<Config>::SimplyEquals(TypeImpl* that) {

[rossberg, 2014/09/10 15:44:14]

Is this not supposed to handle bitsets? If so, add an assertion against this
(and Union, I suppose).

[neis1, 2014/09/11 12:58:12]

Done.

+  DisallowHeapAllocation no_allocation;
+  if (this->IsClass()) {
+    return that->IsClass()
+        && *this->AsClass()->Map() == *that->AsClass()->Map();
   }
-  if (that->IsContext()) {
-    return this->IsContext()
+  if (this->IsConstant()) {
+    return that->IsConstant()
+        && *this->AsConstant()->Value() == *that->AsConstant()->Value();
+  }
+  if (this->IsContext()) {
+    return that->IsContext()
         && this->AsContext()->Outer()->Equals(that->AsContext()->Outer());
   }
-  if (that->IsArray()) {
-    return this->IsArray()
+  if (this->IsArray()) {
+    return that->IsArray()
         && this->AsArray()->Element()->Equals(that->AsArray()->Element());
   }
-  if (that->IsFunction()) {
-    // We currently do not allow for any variance here, in order to keep
-    // Union and Intersect operations simple.
-    if (!this->IsFunction()) return false;
+  if (this->IsFunction()) {
+    if (!that->IsFunction()) return false;
     FunctionType* this_fun = this->AsFunction();
     FunctionType* that_fun = that->AsFunction();
     if (this_fun->Arity() != that_fun->Arity() ||
         !this_fun->Result()->Equals(that_fun->Result()) ||
-        !that_fun->Receiver()->Equals(this_fun->Receiver())) {
+        !this_fun->Receiver()->Equals(that_fun->Receiver())) {
       return false;
     }
     for (int i = 0; i < this_fun->Arity(); ++i) {
-      if (!that_fun->Parameter(i)->Equals(this_fun->Parameter(i))) return false;
+      if (!this_fun->Parameter(i)->Equals(that_fun->Parameter(i))) return false;
     }
     return true;
   }
+  return false;
+}
+
+
+// Check if [this] <= [that].
+template<class Config>
+bool TypeImpl<Config>::SlowIs(TypeImpl* that) {
+  DisallowHeapAllocation no_allocation;
 
-  // (T1 \/ ... \/ Tn) <= T  <=>  (T1 <= T) /\ ... /\ (Tn <= T)
+  // (T1 \/ ... \/ Tn) <= T  if  (T1 <= T) /\ ... /\ (Tn <= T)
   if (this->IsUnion()) {
     UnionHandle unioned = handle(this->AsUnion());
     for (int i = 0; i < unioned->Length(); ++i) {
@@ -327,15 +361,28 @@ bool TypeImpl<Config>::SlowIs(TypeImpl* that) {
     return true;
   }
 
-  // T <= (T1 \/ ... \/ Tn)  <=>  (T <= T1) \/ ... \/ (T <= Tn)
-  // (iff T is not a union)
-  DCHECK(!this->IsUnion() && that->IsUnion());
-  UnionHandle unioned = handle(that->AsUnion());
-  for (int i = 0; i < unioned->Length(); ++i) {
-    if (this->Is(unioned->Get(i))) return true;
-    if (this->IsBitset()) break;  // Fast fail, only first field is a bitset.
+  // T <= (T1 \/ ... \/ Tn)  if  (T <= T1) \/ ... \/ (T <= Tn)
+  if (that->IsUnion()) {
+    UnionHandle unioned = handle(that->AsUnion());
+    for (int i = 0; i < unioned->Length(); ++i) {
+      if (this->Is(unioned->Get(i))) return true;
+      if (this->IsBitset()) return false;  // Shortcut.
+      if (i > 1 && this->IsRange()) return false;  // Shortcut.
+    }
+    return false;
   }
-  return false;
+
+  if (that->IsBitset()) {

[rossberg, 2014/09/10 15:44:14]

Always handle the bitset case first where possible -- it should be fastest.

[neis1, 2014/09/11 12:58:12]

Ok.  I rewrote this slightly.

+    return BitsetType::Is(this->BitsetLub(), that->AsBitset());
+  }
+  if (this->IsBitset()) return this->IsNone();
+  if (this->IsRange()) {
+    return that->IsRange() && contains(that->AsRange(), this->AsRange());
+  }
+  if (this->IsConstant() && that->IsRange()) {
+      return contains(that->AsRange(), *this->AsConstant()->Value());
+  }
+  return this->SimplyEquals(that);
 }
 
 
@@ -359,7 +406,7 @@ bool TypeImpl<Config>::NowIs(TypeImpl* that) {
 }
 
 
-// Check if this contains only (currently) stable classes.
+// Check if [this] contains only (currently) stable classes.
 template<class Config>
 bool TypeImpl<Config>::NowStable() {
   DisallowHeapAllocation no_allocation;
@@ -370,12 +417,12 @@ bool TypeImpl<Config>::NowStable() {
 }
 
 
-// Check this overlaps that.
+// Check if [this] and [that] overlap.
 template<class Config>
 bool TypeImpl<Config>::Maybe(TypeImpl* that) {
   DisallowHeapAllocation no_allocation;
 
-  // (T1 \/ ... \/ Tn) overlaps T <=> (T1 overlaps T) \/ ... \/ (Tn overlaps T)
+  // (T1 \/ ... \/ Tn) overlaps T  if  (T1 overlaps T) \/ ... \/ (Tn overlaps T)
   if (this->IsUnion()) {
     UnionHandle unioned = handle(this->AsUnion());
     for (int i = 0; i < unioned->Length(); ++i) {
@@ -384,68 +431,81 @@ bool TypeImpl<Config>::Maybe(TypeImpl* that) {
     return false;
   }
 
-  // T overlaps (T1 \/ ... \/ Tn) <=> (T overlaps T1) \/ ... \/ (T overlaps Tn)
+  // T overlaps (T1 \/ ... \/ Tn)  if  (T overlaps T1) \/ ... \/ (T overlaps Tn)
+  // (iff T is not a union)

[rossberg, 2014/09/10 15:44:14]

I'm confused...

[neis1, 2014/09/11 12:58:12]

Hehe.  Line 435 is a leftover from older code.

   if (that->IsUnion()) {
-    UnionHandle unioned = handle(that->AsUnion());
-    for (int i = 0; i < unioned->Length(); ++i) {
-      if (this->Maybe(unioned->Get(i))) return true;
+    for (int i = 0; i < that->AsUnion()->Length(); ++i) {
+      if (this->Maybe(that->AsUnion()->Get(i))) return true;
     }
     return false;
   }
 
-  DCHECK(!this->IsUnion() && !that->IsUnion());
-  if (this->IsBitset() || that->IsBitset()) {
-    return BitsetType::IsInhabited(this->BitsetLub() & that->BitsetLub());
-  }
-  if (this->IsClass()) {
-    return that->IsClass()
-        && *this->AsClass()->Map() == *that->AsClass()->Map();
-  }
-  if (this->IsConstant()) {
-    return that->IsConstant()
-        && *this->AsConstant()->Value() == *that->AsConstant()->Value();
-  }
-  if (this->IsContext()) {
-    return this->Equals(that);
-  }
-  if (this->IsArray()) {
-    // There is no variance!
-    return this->Equals(that);
+  if (!BitsetType::IsInhabited(this->BitsetLub() & that->BitsetLub()))
+    return false;
+  if (this->IsBitset() || that->IsBitset()) return true;
+
+  if (this->IsClass() && !that->IsClass()) return true;
+  if (that->IsClass() && !this->IsClass()) return true;
+
+  if (this->IsRange()) {
+    if (that->IsConstant()) {
+      return contains(this->AsRange(), *that->AsConstant()->Value());
+    }
+    return that->IsRange() && overlap(this->AsRange(), that->AsRange());
   }
-  if (this->IsFunction()) {
-    // There is no variance!
-    return this->Equals(that);
+  if (that->IsRange()) {
+    if (this->IsConstant()) {
+      return contains(that->AsRange(), *this->AsConstant()->Value());
+    }
+    return this->IsRange() && overlap(this->AsRange(), that->AsRange());
   }
 
-  return false;
+  return this->SimplyEquals(that);
 }
 
 
-// Check if value is contained in (inhabits) type.
+// Return the range in [this], or [NULL].
 template<class Config>
-bool TypeImpl<Config>::Contains(i::Object* value) {
+typename TypeImpl<Config>::RangeType* TypeImpl<Config>::GetRange() {
   DisallowHeapAllocation no_allocation;
-  if (this->IsRange()) {
-    return value->IsNumber() &&
-           dle(this->AsRange()->Min(), value->Number()) &&
-           dle(value->Number(), this->AsRange()->Max()) &&
-           BitsetType::Is(BitsetType::Lub(value), this->BitsetLub());
+  if (this->IsRange()) return this->AsRange();
+  if (this->IsUnion() && this->AsUnion()->Get(1)->IsRange()) {
+    return this->AsUnion()->Get(1)->AsRange();
   }
+  return NULL;
+}
+
+
+template<class Config>
+bool TypeImpl<Config>::Contains(i::Object* value) {
+  DisallowHeapAllocation no_allocation;
   for (Iterator<i::Object> it = this->Constants(); !it.Done(); it.Advance()) {
     if (*it.Current() == value) return true;
   }
+  if (IsInteger(value)) {
+    RangeType* range = this->GetRange();
+    if (range != NULL && contains(range, value)) return true;
+  }
   return BitsetType::New(BitsetType::Lub(value))->Is(this);
 }
 
 
 template<class Config>
 bool TypeImpl<Config>::UnionType::Wellformed() {
-  DCHECK(this->Length() >= 2);
+  DisallowHeapAllocation no_allocation;
+  // This checks the invariants of the union representation:
+  // 1. There are at least two elements.
+  // 2. At most one element is a bitset, and it must be the first one.
+  // 3. At most one element is a range, and it must be the second one.
+  // 4. No element is itself a union.
+  // 5. No element is a subtype of any other.
+  DCHECK(this->Length() >= 2);  // (1)
   for (int i = 0; i < this->Length(); ++i) {
-    DCHECK(!this->Get(i)->IsUnion());
-    if (i > 0) DCHECK(!this->Get(i)->IsBitset());
+    if (i != 0) DCHECK(!this->Get(i)->IsBitset());  // (2)
+    if (i != 1) DCHECK(!this->Get(i)->IsRange());  // (3)
+    DCHECK(!this->Get(i)->IsUnion());  // (4)
     for (int j = 0; j < this->Length(); ++j) {
-      if (i != j) DCHECK(!this->Get(i)->Is(this->Get(j)));
+      if (i != j) DCHECK(!this->Get(i)->Is(this->Get(j)));  // (5)
     }
   }
   return true;
@@ -455,135 +515,163 @@ bool TypeImpl<Config>::UnionType::Wellformed() {
 // -----------------------------------------------------------------------------
 // Union and intersection
 
+
+static bool AddIsSafe(int x, int y) {
+  return x >= 0 ?
+      y <= std::numeric_limits<int>::max() - x :
+      y >= std::numeric_limits<int>::min() - x;
+}
+
+
 template<class Config>
-typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Rebound(
-    int bitset, Region* region) {
-  TypeHandle bound = BitsetType::New(bitset, region);
-  if (this->IsClass()) {
-    return ClassType::New(this->AsClass()->Map(), bound, region);
-  } else if (this->IsConstant()) {
-    return ConstantType::New(this->AsConstant()->Value(), bound, region);
-  } else if (this->IsRange()) {
-    return RangeType::New(
-        this->AsRange()->Min(), this->AsRange()->Max(), bound, region);
-  } else if (this->IsContext()) {
-    return ContextType::New(this->AsContext()->Outer(), bound, region);
-  } else if (this->IsArray()) {
-    return ArrayType::New(this->AsArray()->Element(), bound, region);
-  } else if (this->IsFunction()) {
-    FunctionHandle function = Config::handle(this->AsFunction());
-    int arity = function->Arity();
-    FunctionHandle type = FunctionType::New(
-        function->Result(), function->Receiver(), bound, arity, region);
-    for (int i = 0; i < arity; ++i) {
-      type->InitParameter(i, function->Parameter(i));
+typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Intersect(
+    TypeHandle type1, TypeHandle type2, Region* region) {
+  int bitset = type1->BitsetGlb() & type2->BitsetGlb();
+  if (!BitsetType::IsInhabited(bitset)) bitset = BitsetType::kNone;
+
+  // Fast case: bit sets.
+  if (type1->IsBitset() && type2->IsBitset()) {
+    return BitsetType::New(bitset, region);
+  }
+
+  // Fast case: top or bottom types.
+  if (type1->IsNone() || type2->IsAny()) return type1;
+  if (type2->IsNone() || type2->IsAny()) return type2;
+
+  // Semi-fast case.
+  if (type1->Is(type2)) return type1;
+  if (type2->Is(type1)) return type2;
+
+  // Slow case: create union.
+  int size1 = type1->IsUnion() ? type1->AsUnion()->Length() : 1;
+  int size2 = type2->IsUnion() ? type2->AsUnion()->Length() : 1;
+  if (!AddIsSafe(size1, size2)) return Any(region);
+  int size = size1 + size2;
+  if (!AddIsSafe(size, 2)) return Any(region);
+  size += 2;
+  UnionHandle result = UnionType::New(size, region);
+  size = 0;
+
+  // Deal with bitsets.
+  result->Set(size++, BitsetType::New(bitset, region));
+
+  // Deal with ranges.
+  TypeHandle range = None(region);
+  RangeType* range1 = type1->GetRange();
+  RangeType* range2 = type2->GetRange();
+  if (range1 != NULL && range2 != NULL) {
+    Limits lim = intersect(Limits(range1), Limits(range2));
+    if (lim.min->Number() <= lim.max->Number()) {
+      range = RangeType::New(lim, region);
     }
-    return type;
   }
-  UNREACHABLE();
-  return TypeHandle();
+  result->Set(size++, range);
+
+  size = IntersectAux(type1, type2, result, size, region);
+  return NormalizeUnion(result, size);
 }
 
 
 template<class Config>
-int TypeImpl<Config>::BoundBy(TypeImpl* that) {
-  DCHECK(!this->IsUnion());
-  if (that->IsUnion()) {
-    UnionType* unioned = that->AsUnion();
-    int length = unioned->Length();
-    int bitset = BitsetType::kNone;
-    for (int i = 0; i < length; ++i) {
-      bitset |= BoundBy(unioned->Get(i)->unhandle());
-    }
-    return bitset;
-  } else if (that->IsClass() && this->IsClass() &&
-      *this->AsClass()->Map() == *that->AsClass()->Map()) {
-    return that->BitsetLub();
-  } else if (that->IsConstant() && this->IsConstant() &&
-      *this->AsConstant()->Value() == *that->AsConstant()->Value()) {
-    return that->AsConstant()->Bound()->AsBitset();
-  } else if (that->IsContext() && this->IsContext() && this->Is(that)) {
-    return that->AsContext()->Bound()->AsBitset();
-  } else if (that->IsArray() && this->IsArray() && this->Is(that)) {
-    return that->AsArray()->Bound()->AsBitset();
-  } else if (that->IsFunction() && this->IsFunction() && this->Is(that)) {
-    return that->AsFunction()->Bound()->AsBitset();
-  }
-  return that->BitsetGlb();
-}
-
-
-template<class Config>
-int TypeImpl<Config>::IndexInUnion(
-    int bound, UnionHandle unioned, int current_size) {
-  DCHECK(!this->IsUnion());
-  for (int i = 0; i < current_size; ++i) {
-    TypeHandle that = unioned->Get(i);
-    if (that->IsBitset()) {
-      if (BitsetType::Is(bound, that->AsBitset())) return i;
-    } else if (that->IsClass() && this->IsClass()) {
-      if (*this->AsClass()->Map() == *that->AsClass()->Map()) return i;
-    } else if (that->IsConstant() && this->IsConstant()) {
-      if (*this->AsConstant()->Value() == *that->AsConstant()->Value())
-        return i;
-    } else if (that->IsContext() && this->IsContext()) {
-      if (this->Is(that)) return i;
-    } else if (that->IsArray() && this->IsArray()) {
-      if (this->Is(that)) return i;
-    } else if (that->IsFunction() && this->IsFunction()) {
-      if (this->Is(that)) return i;
+int TypeImpl<Config>::UpdateRange(
+    RangeHandle range, UnionHandle result, int size, Region* region) {
+  if (range->Is(result->Get(1))) return size;
+  if (!result->Get(1)->Is(range->unhandle())) {
+    range = RangeType::New(union_(
+        Limits(range->AsRange()), Limits(result->Get(1)->AsRange())), region);
+  }
+  result->Set(1, range);
+
+  // Remove any components that just got subsumed.
+  for (int i = 2; i < size; ) {
+    if (result->Get(i)->Is(range->unhandle())) {
+      result->Set(i, result->Get(--size));
+    } else {
+      ++i;
     }
   }
-  return -1;
+  return size;
 }
 
 
-// Get non-bitsets from type, bounded by upper.
-// Store at result starting at index. Returns updated index.
 template<class Config>
-int TypeImpl<Config>::ExtendUnion(
-    UnionHandle result, int size, TypeHandle type,
-    TypeHandle other, bool is_intersect, Region* region) {
-  if (type->IsUnion()) {
-    UnionHandle unioned = handle(type->AsUnion());
-    for (int i = 0; i < unioned->Length(); ++i) {
-      TypeHandle type_i = unioned->Get(i);
-      DCHECK(i == 0 || !(type_i->IsBitset() || type_i->Is(unioned->Get(0))));
-      if (!type_i->IsBitset()) {
-        size = ExtendUnion(result, size, type_i, other, is_intersect, region);
-      }
+int TypeImpl<Config>::IntersectAux(
+    TypeHandle lhs, TypeHandle rhs,
+    UnionHandle result, int size, Region* region) {
+  if (lhs->IsUnion()) {
+    for (int i = 0; i < lhs->AsUnion()->Length(); ++i) {
+      size = IntersectAux(lhs->AsUnion()->Get(i), rhs, result, size, region);
     }
-  } else if (!type->IsBitset()) {
-    DCHECK(type->IsClass() || type->IsConstant() || type->IsRange() ||
-           type->IsContext() || type->IsArray() || type->IsFunction());
-    int inherent_bound = type->InherentBitsetLub();
-    int old_bound = type->BitsetLub();
-    int other_bound = type->BoundBy(other->unhandle()) & inherent_bound;
-    int new_bound =
-        is_intersect ? (old_bound & other_bound) : (old_bound | other_bound);
-    if (new_bound != BitsetType::kNone) {
-      int i = type->IndexInUnion(new_bound, result, size);
-      if (i == -1) {
-        i = size++;
-      } else if (result->Get(i)->IsBitset()) {
-        return size;  // Already fully subsumed.
-      } else {
-        int type_i_bound = result->Get(i)->BitsetLub();
-        new_bound |= type_i_bound;
-        if (new_bound == type_i_bound) return size;
-      }
-      if (new_bound != old_bound) type = type->Rebound(new_bound, region);
-      result->Set(i, type);
+    return size;
+  }
+  if (rhs->IsUnion()) {
+    for (int i = 0; i < rhs->AsUnion()->Length(); ++i) {
+      size = IntersectAux(lhs, rhs->AsUnion()->Get(i), result, size, region);
+    }
+    return size;
+  }
+
+  if (!BitsetType::IsInhabited(lhs->BitsetLub() & rhs->BitsetLub())) {
+    return size;
+  }
+
+  if (lhs->IsBitset()) {
+    if (rhs->IsRange()) {
+      return UpdateRange(
+          Config::template cast<RangeType>(rhs), result, size, region);
+    } else {
+      return AddToUnion(rhs, result, size, region);
     }
   }
+  if (rhs->IsBitset()) {
+    if (lhs->IsRange()) {
+      return UpdateRange(
+          Config::template cast<RangeType>(lhs), result, size, region);
+    } else {
+      return AddToUnion(lhs, result, size, region);
+    }
+  }
+  if (lhs->IsClass() && !rhs->IsClass()) {
+    if (rhs->IsRange()) {
+      return UpdateRange(
+          Config::template cast<RangeType>(rhs), result, size, region);
+    } else {
+      return AddToUnion(rhs, result, size, region);
+    }
+  }
+  if (rhs->IsClass() && !lhs->IsClass()) {
+    if (lhs->IsRange()) {
+      return UpdateRange(
+          Config::template cast<RangeType>(lhs), result, size, region);
+    } else {
+      return AddToUnion(lhs, result, size, region);
+    }
+  }
+  if (lhs->IsRange()) {
+    if (rhs->IsConstant() &&
+        contains(lhs->AsRange(), *rhs->AsConstant()->Value())) {
+      return AddToUnion(rhs, result, size, region);
+    }
+    return size;  // Shortcut.
+  }
+  if (rhs->IsRange()) {
+    if (lhs->IsConstant() &&
+        contains(rhs->AsRange(), *lhs->AsConstant()->Value())) {
+      return AddToUnion(lhs, result, size, region);
+    }
+    return size;  // Shortcut.
+  }
+
+  if (lhs->Is(rhs)) return AddToUnion(lhs, result, size, region);
+  if (rhs->Is(lhs)) return AddToUnion(rhs, result, size, region);
   return size;
 }
 
 
-// Union is O(1) on simple bitsets, but O(n*m) on structured unions.
 template<class Config>
 typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Union(
     TypeHandle type1, TypeHandle type2, Region* region) {
+
   // Fast case: bit sets.
   if (type1->IsBitset() && type2->IsBitset()) {
     return BitsetType::New(type1->AsBitset() | type2->AsBitset(), region);
@@ -593,90 +681,77 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Union(
   if (type1->IsAny() || type2->IsNone()) return type1;
   if (type2->IsAny() || type1->IsNone()) return type2;
 
-  // Semi-fast case: Unioned objects are neither involved nor produced.
-  if (!(type1->IsUnion() || type2->IsUnion())) {
-    if (type1->Is(type2)) return type2;
-    if (type2->Is(type1)) return type1;
-  }
-
-  // Slow case: may need to produce a Unioned object.
-  int size = 0;
-  if (!type1->IsBitset()) {
-    size += (type1->IsUnion() ? type1->AsUnion()->Length() : 1);
-  }
-  if (!type2->IsBitset()) {
-    size += (type2->IsUnion() ? type2->AsUnion()->Length() : 1);
-  }
-  int bitset = type1->BitsetGlb() | type2->BitsetGlb();
-  if (bitset != BitsetType::kNone) ++size;
-  DCHECK(size >= 1);
-
-  UnionHandle unioned = UnionType::New(size, region);
+  // Semi-fast case.
+  if (type1->Is(type2)) return type2;
+  if (type2->Is(type1)) return type1;
+
+  // Slow case: create union.
+  int size1 = type1->IsUnion() ? type1->AsUnion()->Length() : 1;
+  int size2 = type2->IsUnion() ? type2->AsUnion()->Length() : 1;
+  if (!AddIsSafe(size1, size2)) return Any(region);
+  int size = size1 + size2;
+  if (!AddIsSafe(size, 2)) return Any(region);
+  size += 2;
+  UnionHandle result = UnionType::New(size, region);
   size = 0;
-  if (bitset != BitsetType::kNone) {
-    unioned->Set(size++, BitsetType::New(bitset, region));
-  }
-  size = ExtendUnion(unioned, size, type1, type2, false, region);
-  size = ExtendUnion(unioned, size, type2, type1, false, region);
 
-  if (size == 1) {
-    return unioned->Get(0);
-  } else {
-    unioned->Shrink(size);
-    DCHECK(unioned->Wellformed());
-    return unioned;
+  // Deal with bitsets.
+  TypeHandle bitset = BitsetType::New(
+      type1->BitsetGlb() | type2->BitsetGlb(), region);
+  result->Set(size++, bitset);
+
+  // Deal with ranges.
+  TypeHandle range = None(region);
+  RangeType* range1 = type1->GetRange();
+  RangeType* range2 = type2->GetRange();
+  if (range1 != NULL && range2 != NULL) {
+    range = RangeType::New(union_(Limits(range1), Limits(range2)), region);
+  } else if (range1 != NULL) {
+    range = handle(range1);
+  } else if (range2 != NULL) {
+    range = handle(range2);
   }
+  result->Set(size++, range);
+
+  size = AddToUnion(type1, result, size, region);
+  size = AddToUnion(type2, result, size, region);
+  return NormalizeUnion(result, size);
 }
 
 
-// Intersection is O(1) on simple bitsets, but O(n*m) on structured unions.
+// Add [this] to [result] unless [this] is bitset, range, or already subsumed.
+// Return new size of [result].
 template<class Config>
-typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Intersect(
-    TypeHandle type1, TypeHandle type2, Region* region) {
-  // Fast case: bit sets.
-  if (type1->IsBitset() && type2->IsBitset()) {
-    return BitsetType::New(type1->AsBitset() & type2->AsBitset(), region);
-  }
-
-  // Fast case: top or bottom types.
-  if (type1->IsNone() || type2->IsAny()) return type1;
-  if (type2->IsNone() || type1->IsAny()) return type2;
-
-  // Semi-fast case: Unioned objects are neither involved nor produced.
-  if (!(type1->IsUnion() || type2->IsUnion())) {
-    if (type1->Is(type2)) return type1;
-    if (type2->Is(type1)) return type2;
-  }
-
-  // Slow case: may need to produce a Unioned object.
-  int size = 0;
-  if (!type1->IsBitset()) {
-    size += (type1->IsUnion() ? type1->AsUnion()->Length() : 1);
+int TypeImpl<Config>::AddToUnion(
+    TypeHandle type, UnionHandle result, int size, Region* region) {
+  if (type->IsBitset() || type->IsRange()) return size;
+  if (type->IsUnion()) {
+    for (int i = 0; i < type->AsUnion()->Length(); ++i) {
+      size = AddToUnion(type->AsUnion()->Get(i), result, size, region);
+    }
+    return size;
   }
-  if (!type2->IsBitset()) {
-    size += (type2->IsUnion() ? type2->AsUnion()->Length() : 1);
+  for (int i = 0; i < size; ++i) {
+    if (type->Is(result->Get(i))) return size;
   }
-  int bitset = type1->BitsetGlb() & type2->BitsetGlb();
-  if (bitset != BitsetType::kNone) ++size;
-  DCHECK(size >= 1);
+  result->Set(size++, type);
+  return size;
+}
 
-  UnionHandle unioned = UnionType::New(size, region);
-  size = 0;
-  if (bitset != BitsetType::kNone) {
-    unioned->Set(size++, BitsetType::New(bitset, region));
-  }
-  size = ExtendUnion(unioned, size, type1, type2, true, region);
-  size = ExtendUnion(unioned, size, type2, type1, true, region);
 
-  if (size == 0) {
-    return None(region);
-  } else if (size == 1) {
-    return unioned->Get(0);
-  } else {
-    unioned->Shrink(size);
-    DCHECK(unioned->Wellformed());
-    return unioned;
+template<class Config>
+typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::NormalizeUnion(
+    UnionHandle unioned, int size) {
+  DCHECK(size >= 2);
+  // If bitset or range are None, use their positions for different types.
+  if (unioned->Get(0)->IsNone()) unioned->Set(0, unioned->Get(--size));
+  if (size >= 2 && unioned->Get(1)->Is(unioned->Get(0))) {
+    unioned->Set(1, unioned->Get(--size));
   }
+  if (size == 1) return unioned->Get(0);
+  unioned->Shrink(size);
+  SLOW_DCHECK(unioned->Wellformed());
+  return unioned;
 }
 
 
@@ -793,19 +868,15 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Convert(
   if (type->IsBitset()) {
     return BitsetType::New(type->AsBitset(), region);
   } else if (type->IsClass()) {
-    TypeHandle bound = BitsetType::New(type->BitsetLub(), region);
-    return ClassType::New(type->AsClass()->Map(), bound, region);
+    return ClassType::New(type->AsClass()->Map(), region);
   } else if (type->IsConstant()) {
-    TypeHandle bound = Convert<OtherType>(type->AsConstant()->Bound(), region);
-    return ConstantType::New(type->AsConstant()->Value(), bound, region);
+    return ConstantType::New(type->AsConstant()->Value(), region);
   } else if (type->IsRange()) {
-    TypeHandle bound = Convert<OtherType>(type->AsRange()->Bound(), region);
     return RangeType::New(
-        type->AsRange()->Min(), type->AsRange()->Max(), bound, region);
+        type->AsRange()->MinV(), type->AsRange()->MaxV(), region);
   } else if (type->IsContext()) {
-    TypeHandle bound = Convert<OtherType>(type->AsContext()->Bound(), region);
     TypeHandle outer = Convert<OtherType>(type->AsContext()->Outer(), region);
-    return ContextType::New(outer, bound, region);
+    return ContextType::New(outer, region);
   } else if (type->IsUnion()) {
     int length = type->AsUnion()->Length();
     UnionHandle unioned = UnionType::New(length, region);
@@ -816,14 +887,12 @@ typename TypeImpl<Config>::TypeHandle TypeImpl<Config>::Convert(
     return unioned;
   } else if (type->IsArray()) {
     TypeHandle element = Convert<OtherType>(type->AsArray()->Element(), region);
-    TypeHandle bound = Convert<OtherType>(type->AsArray()->Bound(), region);
-    return ArrayType::New(element, bound, region);
+    return ArrayType::New(element, region);
   } else if (type->IsFunction()) {
     TypeHandle res = Convert<OtherType>(type->AsFunction()->Result(), region);
     TypeHandle rcv = Convert<OtherType>(type->AsFunction()->Receiver(), region);
-    TypeHandle bound = Convert<OtherType>(type->AsFunction()->Bound(), region);
     FunctionHandle function = FunctionType::New(
-        res, rcv, bound, type->AsFunction()->Arity(), region);
+        res, rcv, type->AsFunction()->Arity(), region);
     for (int i = 0; i < function->Arity(); ++i) {
       TypeHandle param = Convert<OtherType>(
           type->AsFunction()->Parameter(i), region);
@@ -908,14 +977,10 @@ void TypeImpl<Config>::PrintTo(OStream& os, PrintDimension dim) {  // NOLINT
       os << ")";
     } else if (this->IsConstant()) {
       os << "Constant(" << static_cast<void*>(*this->AsConstant()->Value())
-         << " : ";
-      BitsetType::New(BitsetType::Lub(this))->PrintTo(os, dim);
-      os << ")";
+         << ")";
     } else if (this->IsRange()) {
       os << "Range(" << this->AsRange()->Min()
-         << ".." << this->AsRange()->Max() << " : ";
-      BitsetType::New(BitsetType::Lub(this))->PrintTo(os, dim);
-      os << ")";
+         << ", " << this->AsRange()->Max() << ")";
     } else if (this->IsContext()) {
       os << "Context(";
       this->AsContext()->Outer()->PrintTo(os, dim);
@@ -934,6 +999,7 @@ void TypeImpl<Config>::PrintTo(OStream& os, PrintDimension dim) {  // NOLINT
       AsArray()->Element()->PrintTo(os, dim);
       os << ")";
     } else if (this->IsFunction()) {
+      os << "Function[";
       if (!this->AsFunction()->Receiver()->IsAny()) {
         this->AsFunction()->Receiver()->PrintTo(os, dim);
         os << ".";
@@ -945,6 +1011,7 @@ void TypeImpl<Config>::PrintTo(OStream& os, PrintDimension dim) {  // NOLINT
       }
       os << ")->";
       this->AsFunction()->Result()->PrintTo(os, dim);
+      os << "]";
     } else {
       UNREACHABLE();
     }
@@ -963,6 +1030,12 @@ void TypeImpl<Config>::Print() {
   PrintTo(os);
   os << endl;
 }
+template <class Config>
+void TypeImpl<Config>::BitsetType::Print(int bitset) {
+  OFStream os(stdout);
+  Print(os, bitset);
+  os << endl;
+}
 #endif