RESOLVED FIXED 181877
Kill ArithNegate's ArithProfile assert inside BytecodeParser 
https://bugs.webkit.org/show_bug.cgi?id=181877
Summary Kill ArithNegate's ArithProfile assert inside BytecodeParser
Saam Barati
Reported 2018-01-19 13:12:11 PST
We assert that op_negate's result ArithProfile only produces number. It's logically true that negate only produces a number. However, the DFG may incorrectly pick this ArithProfile when doing OSR exit profiling. So we'll end up profiling something that's likely the input to negate. I think we just need to kill this assert and live with the possibility of this happening since Graph::methodOfGettingAValueProfileFor is entirely heuristic based causing it to be imprecise.
Attachments
patch (4.16 KB, patch)
2018-01-19 13:24 PST, Saam Barati 		no flags
DetailsFormatted DiffDiff
View All Add attachment proposed patch, testcase, etc.
Saam Barati
Comment 1 2018-01-19 13:19:40 PST
<rdar://problem/36630552>
Saam Barati
Comment 2 2018-01-19 13:24:27 PST
Created attachment 331780 [details] patch
Mark Lam
Comment 3 2018-01-19 13:30:07 PST
Comment on attachment 331780 [details] patch r=me
WebKit Commit Bot
Comment 4 2018-01-19 14:30:49 PST
Comment on attachment 331780 [details] patch Clearing flags on attachment: 331780 Committed r227236: <https://trac.webkit.org/changeset/227236>
WebKit Commit Bot
Comment 5 2018-01-19 14:30:50 PST
All reviewed patches have been landed. Closing bug.
Note You need to log in before you can comment on or make changes to this bug.