Right now we tell the JIT the JSValueType, but there are lots of cases in which we could do better. Some examples: 1) If the return value is always a typed array of a particular type, it would be nice to tell the JIT that so it doesn't have to type-barrier and check that it has a typed array. 2) If the return value is always object or null, it might be nice to tell the JIT that too (instead of just claiming "any value"). Not sure what this would help offhand, actually, except maybe not having to check the typetag if null and object use the same typetag. 3) If the return value is always a Node, it might be nice to tell the JIT that (though TI doesn't really work that way, so it's not clear what we can do along these lines).

https://bugzilla.mozilla.org/show_bug.cgi?id=1472046 Move all DOM bugs that haven’t been updated in more than 3 years and has no one currently assigned to P5. If you have questions, please contact :mdaly.