Consider the following code: x = o.f; y = x + 1; Where there are no further uses of x or y. If x was an object, then x + 1 would result in a call to x.valueOf(), which could have side effects. Currently if the DFG speculates that x is a number, then it will dead-code-eliminate x + 1 along with the check that x is a number - so a future execution of this code where o.f results in an object with a valueOf() method will result in the valueOf() method not being called, which is wrong. <rdar://problem/11258183>
Created attachment 138430 [details] the patch
Regression test?
(In reply to comment #2) > Regression test? Already got one with Oliver's rs.
Landed in http://trac.webkit.org/changeset/114956