DFG JIT always speculates that ValueAdd is a numerical addition even when there is evidence to the contrary. This causes all uses of "+" for string concatenation to fall off the speculative path.
Created attachment 107095 [details] the patch
Comment on attachment 107095 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=107095&action=review r=me > Source/JavaScriptCore/wtf/Platform.h:968 > -#define ENABLE_TIERED_COMPILATION 0 > +#define ENABLE_TIERED_COMPILATION 1 Oops?
Comment on attachment 107095 [details] the patch Attachment 107095 [details] did not pass qt-ews (qt): Output: http://queues.webkit.org/results/9649142
(In reply to comment #2) > (From update of attachment 107095 [details]) > View in context: https://bugs.webkit.org/attachment.cgi?id=107095&action=review > > r=me > > > Source/JavaScriptCore/wtf/Platform.h:968 > > -#define ENABLE_TIERED_COMPILATION 0 > > +#define ENABLE_TIERED_COMPILATION 1 > > Oops? Oops indeed!
Created attachment 107103 [details] the patch - disable tiering Will wait for bots before committing.
It's probably best to land this after the OSR patches land. Leaving it up here until then.
Landed in r95147.