[Webkit-unassigned] [Bug 65949] New: DFG JIT does not speculative integers as aggressively as it should

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=65949

           Summary: DFG JIT does not speculative integers as aggressively
                    as it should
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


The DFG JIT assumes that values are doubles unless it has reason to speculate integer.  But it does not do so transitively.  For example, it will successfull speculate that x is an integer here:

var x = … stuff …
var tmp = array[x];

But not here:

var x = … stuff …
var tmp = array[x * 2];

This is because the attempt to predict that "x * 2" is a no-op, since the prediction code has no way of propagating the prediction past the multiply.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.