Bug 181877 - Kill ArithNegate's ArithProfile assert inside BytecodeParser
Summary: Kill ArithNegate's ArithProfile assert inside BytecodeParser
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
Keywords: InRadar
Depends on:
Reported: 2018-01-19 13:12 PST by Saam Barati
Modified: 2018-01-19 14:30 PST (History)
13 users (show)

See Also:

patch (4.16 KB, patch)
2018-01-19 13:24 PST, Saam Barati
no flags Details | Formatted Diff | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2018-01-19 13:12:11 PST
We assert that op_negate's result ArithProfile only produces number. It's logically true that negate only produces a number. However, the DFG may incorrectly pick this ArithProfile when doing OSR exit profiling. So we'll end up profiling something that's likely the input to negate. I think we just need to kill this assert and live with the possibility of this happening since Graph::methodOfGettingAValueProfileFor is entirely heuristic based causing it to be imprecise.
Comment 1 Saam Barati 2018-01-19 13:19:40 PST
Comment 2 Saam Barati 2018-01-19 13:24:27 PST
Created attachment 331780 [details]
Comment 3 Mark Lam 2018-01-19 13:30:07 PST
Comment on attachment 331780 [details]

Comment 4 WebKit Commit Bot 2018-01-19 14:30:49 PST
Comment on attachment 331780 [details]

Clearing flags on attachment: 331780

Committed r227236: <https://trac.webkit.org/changeset/227236>
Comment 5 WebKit Commit Bot 2018-01-19 14:30:50 PST
All reviewed patches have been landed.  Closing bug.