The code is this: ``` case GetByOffset: { Node* candidate = node->child2().node(); if (!isEliminatedAllocation(candidate)) break; if (node->child2()->op() != PhantomClonedArguments) break; ... ``` But, if it's an elimination candidate, the only child node GetByOffset handles is ClonedArguments. This should totally be an assert. We're clearly doing something wrong if we don't transform this node when its child is an eliminated allocation.
Created attachment 334491 [details] patch
Comment on attachment 334491 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=334491&action=review r=me > Source/JavaScriptCore/dfg/DFGArgumentsEliminationPhase.cpp:711 > + ASSERT(node->child2()->op() == PhantomClonedArguments); Let's use `ASSERT(candidate->op() == PhantomClonedArguments)`.
Created attachment 334495 [details] patch for landing
Comment on attachment 334495 [details] patch for landing Clearing flags on attachment: 334495 Committed r228952: <https://trac.webkit.org/changeset/228952>
All reviewed patches have been landed. Closing bug.
<rdar://problem/37830816>