ArgumentsEliminationPhase has a branch on GetByOffset that should be an assert

[Saam Barati]

The code is this:

```

                case GetByOffset: {
                    Node* candidate = node->child2().node();
                    if (!isEliminatedAllocation(candidate))
                        break;

                    if (node->child2()->op() != PhantomClonedArguments)
                        break;
                    ...
```

But, if it's an elimination candidate, the only child node GetByOffset handles is ClonedArguments. This should totally be an assert. We're clearly doing something wrong if we don't transform this node when its child is an eliminated allocation.

[Saam Barati]

Created attachment 334491 [details]
patch

[Yusuke Suzuki]

Comment on attachment 334491 [details]
patch

View in context: https://bugs.webkit.org/attachment.cgi?id=334491&action=review

r=me

> Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp:711
> +                    ASSERT(node->child2()->op() == PhantomClonedArguments);

Let's use `ASSERT(candidate->op() == PhantomClonedArguments)`.

[Saam Barati]

Created attachment 334495 [details]
patch for landing

[WebKit Commit Bot]

Comment on attachment 334495 [details]
patch for landing

Clearing flags on attachment: 334495

Committed r228952: <https://trac.webkit.org/changeset/228952>

[WebKit Commit Bot]

All reviewed patches have been landed.  Closing bug.

[Radar WebKit Bug Importer]

<rdar://problem/37830816>