Bug 151997 – DFG should reduce division of a constant by a constant.

• Status: ASSIGNED
• Component: JavaScriptCore

[Mark Lam]

Running LayoutTests/svg/in-html/sizing/svg-inline.html produces a scenario where we see a division of a constant by another constant:

    (lldb) p leftOperand
    (JSC::SnippetOperand) $0 = {
      m_resultType = (m_type = '\x05')
      m_type = ConstInt32
      m_val = (int32Val = 600, doubleVal = 6.0841863318852727E-310, rawBits = 123145302311512)
    }
    (lldb) p rightOperand
    (JSC::SnippetOperand) $1 = {
      m_resultType = (m_type = '\x05')
      m_type = ConstInt32
      m_val = (int32Val = 100, doubleVal = 6.0841863318605694E-310, rawBits = 123145302311012)
    }

The DFG should have folded this into a constant int 6.

[Radar WebKit Bug Importer]

<rdar://problem/23804458>

[Filip Pizlo]

Please postpone this work until we have a complete story for prediction propagation from snippets. And when you do implement this please make sure that you do it in the abstract interpreter and that the snippets continue to work even if they see constant inputs. We do not guarantee complete constant folding as a prerequisite for code generation.