A lot more details here: https://webkit.org/blog/10308/speculation-in-javascriptcore/