Bug 181877 - Kill ArithNegate's ArithProfile assert inside BytecodeParser
Summary: Kill ArithNegate's ArithProfile assert inside BytecodeParser
Status: RESOLVED FIXED
Alias: None
Product: WebKit
Classification: Unclassified
Component: JavaScriptCore (show other bugs)
Version: WebKit Nightly Build
Hardware: Unspecified Unspecified
: P2 Normal
Assignee: Saam Barati
URL:
Keywords: InRadar
Depends on:
Blocks:
 
Reported: 2018-01-19 13:12 PST by Saam Barati
Modified: 2018-01-19 14:30 PST (History)
13 users (show)

See Also:

Attachments
patch (4.16 KB, patch)
2018-01-19 13:24 PST, Saam Barati 		no flags Details | Formatted Diff | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Saam Barati 2018-01-19 13:12:11 PST 
We assert that op_negate's result ArithProfile only produces number. It's logically true that negate only produces a number. However, the DFG may incorrectly pick this ArithProfile when doing OSR exit profiling. So we'll end up profiling something that's likely the input to negate. I think we just need to kill this assert and live with the possibility of this happening since Graph::methodOfGettingAValueProfileFor is entirely heuristic based causing it to be imprecise.
Comment 1 Saam Barati 2018-01-19 13:19:40 PST 
<rdar://problem/36630552>
Comment 2 Saam Barati 2018-01-19 13:24:27 PST 
Created attachment 331780 [details]
patch
Comment 3 Mark Lam 2018-01-19 13:30:07 PST 
Comment on attachment 331780 [details]
patch

r=me
Comment 4 WebKit Commit Bot 2018-01-19 14:30:49 PST 
Comment on attachment 331780 [details]
patch

Clearing flags on attachment: 331780

Committed r227236: <https://trac.webkit.org/changeset/227236>
Comment 5 WebKit Commit Bot 2018-01-19 14:30:50 PST 
All reviewed patches have been landed.  Closing bug.