Bug 181877

Summary: Kill ArithNegate's ArithProfile assert inside BytecodeParser
Product: WebKit Reporter: Saam Barati <saam>
Component: JavaScriptCoreAssignee: Saam Barati <saam>
Status: RESOLVED FIXED    
Severity: Normal CC: benjamin, commit-queue, fpizlo, ggaren, gskachkov, jfbastien, keith_miller, mark.lam, msaboff, rmorisset, ticaiolima, webkit-bug-importer, ysuzuki
Priority: P2 Keywords: InRadar
Version: WebKit Nightly Build   
Hardware: Unspecified   
OS: Unspecified   
Attachments:
Description Flags
patch none

Saam Barati
Reported 2018-01-19 13:12:11 PST
We assert that op_negate's result ArithProfile only produces number. It's logically true that negate only produces a number. However, the DFG may incorrectly pick this ArithProfile when doing OSR exit profiling. So we'll end up profiling something that's likely the input to negate. I think we just need to kill this assert and live with the possibility of this happening since Graph::methodOfGettingAValueProfileFor is entirely heuristic based causing it to be imprecise.
Attachments
patch (4.16 KB, patch)
2018-01-19 13:24 PST, Saam Barati 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2018-01-19 13:19:40 PST
<rdar://problem/36630552>
Saam Barati
Comment 2 2018-01-19 13:24:27 PST
Created attachment 331780 [details] patch
Mark Lam
Comment 3 2018-01-19 13:30:07 PST
Comment on attachment 331780 [details] patch r=me
WebKit Commit Bot
Comment 4 2018-01-19 14:30:49 PST
Comment on attachment 331780 [details] patch Clearing flags on attachment: 331780 Committed r227236: <https://trac.webkit.org/changeset/227236>
WebKit Commit Bot
Comment 5 2018-01-19 14:30:50 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.