I don't think that the current trySub() lowering handles this. We could handle it either using a second pattern match rule, or by recognizing the zero immediate inside trySub().
Created attachment 264750 [details] the patch
Comment on attachment 264750 [details] the patch View in context: https://bugs.webkit.org/attachment.cgi?id=264750&action=review > Source/JavaScriptCore/b3/B3LoweringMatcher.patterns:40 > +StoreSubLoad = Store(Sub(left, right), address) Aw, crap.
Landed in http://trac.webkit.org/changeset/191996