That's because the NodeMayOverflowInBaseline and NodeMayOverflowInDFG flags only indicates potential overflowing of Int32 values. We'll be adding overflow profiling for Int52 values later, and we should disambiguate between the 2 types.
Created attachment 267912 [details] proposed patch.
Comment on attachment 267912 [details] proposed patch. Clearing flags on attachment: 267912 Committed r194423: <http://trac.webkit.org/changeset/194423>
All reviewed patches have been landed. Closing bug.