[JSC] Remove ValueProfile from tail calls

https://bugs.webkit.org/show_bug.cgi?id=259471 rdar://112820068 Reviewed by Keith Miller. This patch removes ValueProfile from tail calls since they are never used effectively (because of tail calls!). * Source/JavaScriptCore/bytecode/BytecodeList.rb: * Source/JavaScriptCore/bytecode/CodeBlock.cpp: (JSC::CodeBlock::finishCreation): * Source/JavaScriptCore/bytecode/Opcode.h: * Source/JavaScriptCore/jit/JITCall.cpp: (JSC::JIT::compileOpCall): * Source/JavaScriptCore/llint/LowLevelInterpreter.asm: * Source/JavaScriptCore/llint/LowLevelInterpreter32_64.asm: * Source/JavaScriptCore/llint/LowLevelInterpreter64.asm: Canonical link: https://commits.webkit.org/266328@main
WebKit · Jul 26, 2023 · 92d9b98 · 92d9b98
1 parent aeb697f
commit 92d9b98
Show file tree

Hide file tree

Showing 36 changed files with 162 additions and 97 deletions.
diff --git a/JSTests/stress/arith-abs-on-various-types.js b/JSTests/stress/arith-abs-on-various-types.js
@@ -77,6 +77,7 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesAbs) > 3)
         throw "We should have detected abs() was polymorphic and generated a generic version.";
 }

diff --git a/JSTests/stress/arith-acos-on-various-types.js b/JSTests/stress/arith-acos-on-various-types.js
@@ -74,7 +74,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesACos) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesACos) > 3)
         throw "We should have detected acos() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-acosh-on-various-types.js b/JSTests/stress/arith-acosh-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesACosh) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesACosh) > 3)
         throw "We should have detected acosh() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-asin-on-various-types.js b/JSTests/stress/arith-asin-on-various-types.js
@@ -74,7 +74,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesASin) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesASin) > 3)
         throw "We should have detected asin() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-asinh-on-various-types.js b/JSTests/stress/arith-asinh-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesASinh) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesASinh) > 3)
         throw "We should have detected asinh() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-atan-on-various-types.js b/JSTests/stress/arith-atan-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesATan) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesATan) > 3)
         throw "We should have detected atan() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-atanh-on-various-types.js b/JSTests/stress/arith-atanh-on-various-types.js
@@ -74,7 +74,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesATanh) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesATanh) > 3)
         throw "We should have detected atanh() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-cbrt-on-various-types.js b/JSTests/stress/arith-cbrt-on-various-types.js
@@ -75,7 +75,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesCbrt) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesCbrt) > 3)
         throw "We should have detected cbrt() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-ceil-on-various-types.js b/JSTests/stress/arith-ceil-on-various-types.js
@@ -90,6 +90,7 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesCeil) > 3)
         throw "We should have detected ceil() was polymorphic and generated a generic version.";
 }
@@ -111,6 +112,7 @@ function testAllTypesWithoutNegativeZeroCall() {
                 throw "Failed testAllTypesWithoutNegativeZeroCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesCeil) > 3)
         throw "We should have detected ceil() was polymorphic and generated a generic version.";
 }

diff --git a/JSTests/stress/arith-clz32-on-various-types.js b/JSTests/stress/arith-clz32-on-various-types.js
@@ -71,7 +71,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesClz32) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesClz32) > 3)
         throw "We should have detected clz32() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-cos-on-various-types.js b/JSTests/stress/arith-cos-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesCos) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesCos) > 3)
         throw "We should have detected cos() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-cosh-on-various-types.js b/JSTests/stress/arith-cosh-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesCosh) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesCosh) > 3)
         throw "We should have detected cosh() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-expm1-on-various-types.js b/JSTests/stress/arith-expm1-on-various-types.js
@@ -74,7 +74,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesExpm1) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesExpm1) > 3)
         throw "We should have detected expm1() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-floor-on-various-types.js b/JSTests/stress/arith-floor-on-various-types.js
@@ -90,6 +90,7 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesFloor) > 3)
         throw "We should have detected floor() was polymorphic and generated a generic version.";
 }

diff --git a/JSTests/stress/arith-fround-on-various-types.js b/JSTests/stress/arith-fround-on-various-types.js
@@ -75,7 +75,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesFround) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesFround) > 3)
         throw "We should have detected fround() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-log-on-various-types.js b/JSTests/stress/arith-log-on-various-types.js
@@ -76,7 +76,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesLog) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesLog) > 3)
         throw "We should have detected log() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-log10-on-various-types.js b/JSTests/stress/arith-log10-on-various-types.js
@@ -74,7 +74,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesLog10) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesLog10) > 3)
         throw "We should have detected log10() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-log2-on-various-types.js b/JSTests/stress/arith-log2-on-various-types.js
@@ -74,7 +74,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesLog2) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesLog2) > 3)
         throw "We should have detected log2() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-negate-on-various-types.js b/JSTests/stress/arith-negate-on-various-types.js
@@ -69,6 +69,7 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesNegate) > 3)
         throw "We should have detected negate was polymorphic and generated a generic version.";
 }

diff --git a/JSTests/stress/arith-round-on-various-types.js b/JSTests/stress/arith-round-on-various-types.js
@@ -90,6 +90,7 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesRound) > 3)
         throw "We should have detected round() was polymorphic and generated a generic version.";
 }
@@ -111,6 +112,7 @@ function testAllTypesWithoutNegativeZeroCall() {
                 throw "Failed testAllTypesWithoutNegativeZeroCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesRound) > 3)
         throw "We should have detected round() was polymorphic and generated a generic version.";
 }

diff --git a/JSTests/stress/arith-sin-on-various-types.js b/JSTests/stress/arith-sin-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesSin) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesSin) > 3)
         throw "We should have detected sin() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-sinh-on-various-types.js b/JSTests/stress/arith-sinh-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesSinh) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesSinh) > 3)
         throw "We should have detected sinh() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-sqrt-on-various-types.js b/JSTests/stress/arith-sqrt-on-various-types.js
@@ -71,7 +71,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesSqrt) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesSqrt) > 3)
         throw "We should have detected sqrt() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-tan-on-various-types.js b/JSTests/stress/arith-tan-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesTan) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesTan) > 3)
         throw "We should have detected tan() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-tanh-on-various-types.js b/JSTests/stress/arith-tanh-on-various-types.js
@@ -73,7 +73,8 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
-    if (numberOfDFGCompiles(opaqueAllTypesTanh) > 2)
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
+    if (numberOfDFGCompiles(opaqueAllTypesTanh) > 3)
         throw "We should have detected tanh() was polymorphic and generated a generic version.";
 }
 testAllTypesCall();

diff --git a/JSTests/stress/arith-trunc-on-various-types.js b/JSTests/stress/arith-trunc-on-various-types.js
@@ -90,6 +90,7 @@ function testAllTypesCall() {
                 throw "Failed testAllTypesCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesTrunc) > 3)
         throw "We should have detected trunc() was polymorphic and generated a generic version.";
 }
@@ -111,6 +112,7 @@ function testAllTypesWithoutNegativeZeroCall() {
                 throw "Failed testAllTypesWithoutNegativeZeroCall for input " + testCaseInput[0] + " expected " + testCaseInput[1] + " got " + output;
         }
     }
+    // Because DoubleRep has three UseKinds we could pick before getting to the generic version
     if (numberOfDFGCompiles(opaqueAllTypesTrunc) > 3)
         throw "We should have detected trunc() was polymorphic and generated a generic version.";
 }

diff --git a/Source/JavaScriptCore/bytecode/BytecodeList.rb b/Source/JavaScriptCore/bytecode/BytecodeList.rb
@@ -97,7 +97,6 @@
     },
     metadata: {
         callLinkInfo: BaselineCallLinkInfo,
-        profile: ValueProfile,
     },
     tmps: {
         argCountIncludingThis: unsigned
@@ -302,7 +301,6 @@
     metadata: {
         callLinkInfo: BaselineCallLinkInfo,
         arrayProfile: ArrayProfile,
-        profile: ValueProfile,
     }
 
 op :call_direct_eval,
@@ -331,7 +329,6 @@
     },
     metadata: {
         callLinkInfo: BaselineCallLinkInfo,
-        profile: ValueProfile,
     }
 
 op_group :CreateInternalFieldObjectOp,

diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.cpp b/Source/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -523,14 +523,14 @@ bool CodeBlock::finishCreation(VM& vm, ScriptExecutable* ownerExecutable, Unlink
         LINK(OpProfileControlFlow)
 
         LINK(OpCall, callLinkInfo, profile)
-        LINK(OpTailCall, callLinkInfo, profile)
+        LINK(OpTailCall, callLinkInfo)
         LINK(OpCallDirectEval, callLinkInfo, profile)
         LINK(OpConstruct, callLinkInfo, profile)
         LINK(OpIteratorOpen, callLinkInfo)
         LINK(OpIteratorNext, callLinkInfo)
         LINK(OpCallVarargs, callLinkInfo, profile)
-        LINK(OpTailCallVarargs, callLinkInfo, profile)
-        LINK(OpTailCallForwardArguments, callLinkInfo, profile)
+        LINK(OpTailCallVarargs, callLinkInfo)
+        LINK(OpTailCallForwardArguments, callLinkInfo)
         LINK(OpConstructVarargs, callLinkInfo, profile)
 
         case op_new_array_with_species: {

diff --git a/Source/JavaScriptCore/bytecode/CodeBlock.h b/Source/JavaScriptCore/bytecode/CodeBlock.h
@@ -409,6 +409,7 @@ class CodeBlock : public JSCell {
         return result;
     }
 
+    ValueProfile* tryGetValueProfileForBytecodeIndex(BytecodeIndex);
     ValueProfile& valueProfileForBytecodeIndex(BytecodeIndex);
     SpeculatedType valueProfilePredictionForBytecodeIndex(const ConcurrentJSLocker&, BytecodeIndex);
 
@@ -905,7 +906,6 @@ class CodeBlock : public JSCell {
 
     unsigned numberOfNonArgumentValueProfiles() { return totalNumberOfValueProfiles() - numberOfArgumentValueProfiles(); }
     unsigned totalNumberOfValueProfiles() { return m_unlinkedCode->numberOfValueProfiles(); }
-    ValueProfile* tryGetValueProfileForBytecodeIndex(BytecodeIndex);
 
     Seconds timeSinceCreation()
     {

diff --git a/Source/JavaScriptCore/bytecode/Opcode.h b/Source/JavaScriptCore/bytecode/Opcode.h
@@ -100,8 +100,6 @@ static constexpr unsigned bitWidthForMaxBytecodeStructLength = WTF::getMSBSetCon
 
 #define FOR_EACH_OPCODE_WITH_VALUE_PROFILE(macro) \
     macro(OpCallVarargs) \
-    macro(OpTailCallVarargs) \
-    macro(OpTailCallForwardArguments) \
     macro(OpConstructVarargs) \
     macro(OpGetByVal) \
     macro(OpEnumeratorGetByVal) \
@@ -119,7 +117,6 @@ static constexpr unsigned bitWidthForMaxBytecodeStructLength = WTF::getMSBSetCon
     macro(OpGetInternalField) \
     macro(OpToThis) \
     macro(OpCall) \
-    macro(OpTailCall) \
     macro(OpCallDirectEval) \
     macro(OpConstruct) \
     macro(OpGetFromScope) \

diff --git a/Source/JavaScriptCore/dfg/DFGGraph.cpp b/Source/JavaScriptCore/dfg/DFGGraph.cpp
@@ -1751,8 +1751,32 @@ MethodOfGettingAValueProfile Graph::methodOfGettingAValueProfileFor(Node* curren
                     return MethodOfGettingAValueProfile::lazyOperandValueProfile(node->origin.semantic, node->operand());
             }
 
-            if (node->hasHeapPrediction())
-                return MethodOfGettingAValueProfile::bytecodeValueProfile(node->origin.semantic);
+            if (node->hasHeapPrediction()) {
+                auto instruction = profiledBlock->instructions().at(node->origin.semantic.bytecodeIndex());
+                OpcodeID opcodeID = instruction->opcodeID();
+                switch (opcodeID) {
+                case op_tail_call:
+                case op_tail_call_varargs:
+                case op_tail_call_forward_arguments: {
+                    InlineCallFrame* inlineCallFrame = node->origin.semantic.inlineCallFrame();
+                    if (!inlineCallFrame)
+                        return { }; // TailCall in the outermost function.
+
+                    CodeOrigin* codeOrigin = inlineCallFrame->getCallerSkippingTailCalls();
+                    if (!codeOrigin)
+                        return { };
+
+                    CodeBlock* callerBlock = baselineCodeBlockFor(*codeOrigin);
+                    auto* valueProfile = callerBlock->tryGetValueProfileForBytecodeIndex(codeOrigin->bytecodeIndex());
+                    if (!valueProfile)
+                        return { };
+
+                    return MethodOfGettingAValueProfile::bytecodeValueProfile(*codeOrigin);
+                }
+                default:
+                    return MethodOfGettingAValueProfile::bytecodeValueProfile(node->origin.semantic);
+                }
+            }
 
             if (profiledBlock->hasBaselineJITProfiling()) {
                 if (profiledBlock->binaryArithProfileForBytecodeIndex(node->origin.semantic.bytecodeIndex()))

diff --git a/Source/JavaScriptCore/dfg/DFGNode.h b/Source/JavaScriptCore/dfg/DFGNode.h
@@ -1902,7 +1902,6 @@ struct Node {
     bool hasHeapPrediction()
     {
         switch (op()) {
-        case ArithAbs:
         case ArithRound:
         case ArithFloor:
         case ArithCeil: