https://bugs.webkit.org/show_bug.cgi?id=121116

Reviewed by Oliver Hunt.
        
SpecInt48 will mean that we have something that would be a double if it was a JSValue,
but it's profitable to represent it as something other than a double.
        
SpecInt48AsDouble means that it has a value that could have been represented like
SpecInt48, but we're making a heuristic decision not to do it.

* bytecode/SpeculatedType.h:
(JSC::isInt48Speculation):
* dfg/DFGAbstractInterpreterInlines.h:
(JSC::DFG::::executeEffects):
(JSC::DFG::::clobberCapturedVars):
* dfg/DFGAbstractValue.cpp:
(JSC::DFG::AbstractValue::filter):
* dfg/DFGAbstractValue.h:
(JSC::DFG::AbstractValue::makeHeapTop):
(JSC::DFG::AbstractValue::makeBytecodeTop):
(JSC::DFG::AbstractValue::isHeapTop):
(JSC::DFG::AbstractValue::heapTop):
(JSC::DFG::AbstractValue::validateType):
(JSC::DFG::AbstractValue::validate):
(JSC::DFG::AbstractValue::makeTop):
* dfg/DFGInPlaceAbstractState.cpp:
(JSC::DFG::InPlaceAbstractState::initialize):
* dfg/DFGJITCompiler.h:
(JSC::DFG::JITCompiler::noticeOSREntry):
* dfg/DFGUseKind.h:
(JSC::DFG::typeFilterFor):



git-svn-id: http://svn.webkit.org/repository/webkit/trunk@155480 268f45cc-cd09-0410-ab3c-d52691b4dbfc