The DFG speculative JIT makes use of the isKnownNotNumber() method, which returns true if the GenerationInfo reports that the value is neither an integer nor a double. But that means that it will return true if the GenerationInfo is either DataFormatNone or DataFormatJS, which means that we actually know nothing about the value. This results in poor speculations on ValueAdd in release builds, and assertion falues in debug builds.
Created attachment 107550 [details]
Landed in r95233.