...
Created attachment 446579 [details] WIP
Created attachment 446822 [details] WIP
<rdar://problem/86552957>
Created attachment 447398 [details] patch
Comment on attachment 447398 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=447398&action=review r=me too. > Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp:198 > + if (WasmAddressValue* wasmAddress = value->as<WasmAddressValue>()) > + data.m_wasmAddressesAtTail.add(wasmAddress->child(0), wasmAddress); Let's avoid adding this if data.writesPinned is already true. > Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp:261 > + if (WasmAddressValue* wasmAddress = m_value->as<WasmAddressValue>()) { > + processWasmAddressValue(wasmAddress); > + return; > + } Ditto.
Comment on attachment 447398 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=447398&action=review >> Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp:198 >> + data.m_wasmAddressesAtTail.add(wasmAddress->child(0), wasmAddress); > > Let's avoid adding this if data.writesPinned is already true. Ah, I misunderstood. This is tracking wasm addresses which are still valid.
Comment on attachment 447398 [details] patch View in context: https://bugs.webkit.org/attachment.cgi?id=447398&action=review >> Source/JavaScriptCore/b3/B3EliminateCommonSubexpressions.cpp:198 >> + data.m_wasmAddressesAtTail.add(wasmAddress->child(0), wasmAddress); > > Let's avoid adding this if data.writesPinned is already true. This is still useful because you could still CSE with values that come *after* writes pinned.
Created attachment 447399 [details] patch for landing
Created attachment 447400 [details] patch for landing
Created attachment 447401 [details] patch for landing
Committed r287203 (245370@main): <https://commits.webkit.org/245370@main> All reviewed patches have been landed. Closing bug and clearing flags on attachment 447401 [details].