Bug 143781 – Optimizing JITs should add calls to valueOf() for children of Arith* nodes when a number is expected

• Status: ASSIGNED
• Component: JavaScriptCore

[Michael Saboff]

Consider the code below where we take two Date objects and want to get the elapsed time since some start time:

var start = new Date;
…
var now = new Date;

var milliSecondDelta = now - start;

When this code is compiled in the DFG, the subtraction (ArithSub node) expects the two operands to be some kind of number format.  Instead they are objects.  Currently the DFG will OSR exit with a BadType and the baseline JIT will handle the subtraction.  Other Arith* nodes have the same type of issue.  It makes more sense for the DFG to notice the incoming edges are not numeric and to invoke valueOf() if the edges are Objects.  In addition to the slow call, we’d still need to perform speculation checks that the return result was a number.

rdar://problem/20506972