Patch forthcoming.
Created attachment 283854 [details] the patch
Created attachment 283855 [details] performance It's cheap to disable CSE for MultiGetByOffset, probably because B3 also does CSE and can handle the CFG constructs inside MultiGetByOffset.
Comment on attachment 283854 [details] the patch r=me
Created attachment 283870 [details] patch for landing
Landed in https://trac.webkit.org/changeset/203336