We assert that op_negate's result ArithProfile only produces number. It's logically true that negate only produces a number. However, the DFG may incorrectly pick this ArithProfile when doing OSR exit profiling. So we'll end up profiling something that's likely the input to negate. I think we just need to kill this assert and live with the possibility of this happening since Graph::methodOfGettingAValueProfileFor is entirely heuristic based causing it to be imprecise.
<rdar://problem/36630552>
Created attachment 331780 [details] patch
Comment on attachment 331780 [details] patch r=me
Comment on attachment 331780 [details] patch Clearing flags on attachment: 331780 Committed r227236: <https://trac.webkit.org/changeset/227236>
All reviewed patches have been landed. Closing bug.