Fun!
Created attachment 206847 [details] WRONG PATCH
Some notes: - We cannot hoist, or sink, anything that has effects. This means that the easiest way of indicating that something cannot be hoisted is to claim that it side-effects some miscellaneous thing. - Whenever we hoist, we must replace the original node with a Phantom. - We cannot hoist forward-exiting nodes without some additional effort. I believe that what it comes down to is that forward-exiting generally have their NodeExitsForward cleared upon hoist, except for forward-exiting nodes that take bogus state as their input. Those are substantially harder. :-/
Created attachment 207215 [details] work in progress
Created attachment 207218 [details] it might work But I can't test it because the prerequisites haven't landed yet.
Comment on attachment 207218 [details] it might work I didn't mean to set r?, since I haven't even compiled this yet.
Created attachment 207225 [details] it just motioned some loop-invariant code
Comment on attachment 207225 [details] it just motioned some loop-invariant code Once again, I didn't mean to r?. I haven't fully tested it yet.
Created attachment 207226 [details] fixed some stuff I totally forgot about updating the state-at-tail.
Created attachment 207259 [details] the patch
Created attachment 207260 [details] the patch Fix changelog.
Created attachment 207286 [details] the patch Lifted the inner-most loop restriction.
Landed in http://trac.webkit.org/changeset/153033