...
Created attachment 431859 [details] Patch
Comment on attachment 431859 [details] Patch View in context: https://bugs.webkit.org/attachment.cgi?id=431859&action=review looks good you should probably remove your comments before we land this though. > Source/JavaScriptCore/b3/B3LowerToAir.cpp:2589 > + if (m_locked.contains(v->child(0)) || m_locked.contains(v->child(1))) // <---- keep this? Why? Per offline discussion, we need this in case we have a pattern that matches against the Mul(Something(...), Something(...)). > Source/JavaScriptCore/b3/B3LowerToAir.cpp:2604 > + if (m_locked.contains(v->child(0))) // <---- keep this? Why? Ditto. e.g. SExt32(Something(...)) > Source/JavaScriptCore/b3/testb3_2.cpp:1221 > + Value* addValue = root->appendNew<Value>(proc, Sub, Origin(), aValue, mulValue); nit: should probably be subValue.
Created attachment 431882 [details] Patch
Comment on attachment 431882 [details] Patch r=me.
Committed r279075 (238995@main): <https://commits.webkit.org/238995@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 431882 [details].