[webkit-changes] [WebKit/WebKit] 8c792d: [JSC] DFG ASSERTION FAILED: header->predecessors.s...

[Yijia Huang]

  Branch: refs/heads/main
  Home:   https://github.com/WebKit/WebKit
  Commit: 8c792dd54eb930b30bc3fcb70ecc0f74a6a15252
      https://github.com/WebKit/WebKit/commit/8c792dd54eb930b30bc3fcb70ecc0f74a6a15252
  Author: Yijia Huang <yijia_huang at apple.com>
  Date:   2024-12-20 (Fri, 20 Dec 2024)

  Changed paths:
    A JSTests/stress/loop-unrolling-with-one-iteration.js
    M Source/JavaScriptCore/dfg/DFGLoopUnrollingPhase.cpp

  Log Message:
  -----------
  [JSC] DFG ASSERTION FAILED: header->predecessors.size() > 1
https://bugs.webkit.org/show_bug.cgi?id=284883
rdar://141688864

Reviewed by Yusuke Suzuki.

The `BlockInsertionSet::execute` function may fail if the
block insertion set is empty. In such cases, it would not
invalidate all analyses that rely on the CFG.

In the loop unrolling phase, we may unroll a loop with only
one iteration. In this scenario, no additional blocks would
be inserted. However, we still need to invalidate the corresponding
CFG analysis, as unrolling a loop with a single iteration
still disrupts the control flow by eliminating the branch
terminal in the loop tail.

* JSTests/stress/loop-unrolling-with-one-iteration.js: Added.
(random):
(ChiSquared):
(predictor_bit.random_bit.ago.ago.0.predictor_bit.random_bit.history.sort):
* Source/JavaScriptCore/dfg/DFGLoopUnrollingPhase.cpp:
(JSC::DFG::LoopUnrollingPhase::unrollLoop):

Canonical link: https://commits.webkit.org/288198@main



To unsubscribe from these emails, change your notification settings at https://github.com/WebKit/WebKit/settings/notifications