[Webkit-unassigned] [Bug 68127] New: DFG JIT should not speculate integer if the value is always going to be used as a double anyway

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=68127

           Summary: DFG JIT should not speculate integer if the value is
                    always going to be used as a double anyway
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: JavaScriptCore
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: fpizlo at apple.com


The DFG JIT will speculate that a value is an integer if the prediction logic tells us so.  But this is dangerously unnecessary if the value will always be used as a double.  For example, if o.f is predicted integer but is always used as o.f * 1.5, then there is no point to speculating that o.f is an integer because even if we do, we still have to convert it to a double.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.