Running LayoutTests/svg/in-html/sizing/svg-inline.html produces a scenario where we see a division of a constant by another constant: (lldb) p leftOperand (JSC::SnippetOperand) $0 = { m_resultType = (m_type = '\x05') m_type = ConstInt32 m_val = (int32Val = 600, doubleVal = 6.0841863318852727E-310, rawBits = 123145302311512) } (lldb) p rightOperand (JSC::SnippetOperand) $1 = { m_resultType = (m_type = '\x05') m_type = ConstInt32 m_val = (int32Val = 100, doubleVal = 6.0841863318605694E-310, rawBits = 123145302311012) } The DFG should have folded this into a constant int 6.
<rdar://problem/23804458>
Please postpone this work until we have a complete story for prediction propagation from snippets. And when you do implement this please make sure that you do it in the abstract interpreter and that the snippets continue to work even if they see constant inputs. We do not guarantee complete constant folding as a prerequisite for code generation.