- Every null check site has a record of whether a null was ever seen.
- Similar points can be made about other low-level checks.
- Every call site with a receiver has a record of which types were encountered (up to 2-3 types).
- There is also a type profile for every checkcast, instanceof, and aastore. (Helps with generics.)
- Every call site and branch point has a record of execution counts.