Shared check parts: a heap check of an object an earlier check already tested skips the null test, and right after a check of the same object reuses the upper it loaded (docs/perf.md item 17).

A check test lower; jz; cmp lower, ptr; jb; mov -16(lower), up; sub $Size, up; cmp up, ptr; ja (split bounds, local selection) has two parts that depend only on the object: the null test of its lower and the load of its upper. A capability's lower never changes, so once a check of one lower has passed, the null test of any later check of that lower is dead. Its upper does change, when the object is freed (free sets upper = lower), so a loaded upper is reused only while nothing could have freed the object, and only while the register still holds it. Every check stays where it was, with the same tests otherwise, failure label, pointer and lower.

Facts

R is a lower root: a single-definition temporary (parameter, phi or instruction) reached from the checked pointer through single-definition flights' lower donors (ir.pl's lower_chain/3). Every name on the way has one definition, so at any point they all dominate, the pointer's lower is R's current one (docs/m7.md, round 4's dominance argument). A pointer with no such root has no fact.

Transfer, merge and invalidators

• A full check of class R skips its null test under testedR, then adds testedR, and sets upperR if its access is transparent, otherwise no upper.
• A transparent instruction keeps both facts; any other instruction clears upper. tested has no invalidator: it is a fact about a value. Functions with setjmp are left alone.
• A block starts with the tested facts at the end of its immediate dominator (--share=null and upper; block starts empty), and no upper.
• Transparent (share_transparent/1): arithmetic, comparisons, conversions, flights, scalar raw accesses and raw pointer loads (fused, reused or renewed). Everything else clears upper: calls, allocations, getters, pointer stores (ensure-aux may exit), cas, atomic pointer accesses, fences, va_arg, ABI actions and fixed asm.
• At the machine level (shared_uppers/2) defReg, Size is cleared by any line that writes Reg, a label, a call, an unconditional jump, a fence, a locked instruction, and any line amd64_contract does not audit. A conditional jump keeps it on its fall-through.

An upper is reused only when both levels agree. Under upperR the check emits the placeholder upper_reuser9, Size, and every check with Size =< 16 marks upper_defReg, Size after computing it; Reg is %r9 for a check whose upper a later one reuses (flight arithmetic between two checks writes %rdx; only calls, pointer stores and cas write %r9) and %rdx, the reference's, otherwise. The machine pass turns each placeholder into the adjustment from the earlier size, or back into the load where def does not hold, and deletes the markers.

--share=none|block|null|upper (NANOFIL_SHARE) selects this; the default is none. Only the split bounds with local selection share.