Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 8c792dd54eb930b30bc3fcb70ecc0f74a6a15252
https://github.com/WebKit/WebKit/commit/8c792dd54eb930b30bc3fcb70ecc0f74a6a15252
Author: Yijia Huang <yijia_hu...@apple.com>
Date: 2024-12-20 (Fri, 20 Dec 2024)
Changed paths:
A JSTests/stress/loop-unrolling-with-one-iteration.js
M Source/JavaScriptCore/dfg/DFGLoopUnrollingPhase.cpp
Log Message:
-----------
[JSC] DFG ASSERTION FAILED: header->predecessors.size() > 1
https://bugs.webkit.org/show_bug.cgi?id=284883
rdar://141688864
Reviewed by Yusuke Suzuki.
The `BlockInsertionSet::execute` function may fail if the
block insertion set is empty. In such cases, it would not
invalidate all analyses that rely on the CFG.
In the loop unrolling phase, we may unroll a loop with only
one iteration. In this scenario, no additional blocks would
be inserted. However, we still need to invalidate the corresponding
CFG analysis, as unrolling a loop with a single iteration
still disrupts the control flow by eliminating the branch
terminal in the loop tail.
* JSTests/stress/loop-unrolling-with-one-iteration.js: Added.
(random):
(ChiSquared):
(predictor_bit.random_bit.ago.ago.0.predictor_bit.random_bit.history.sort):
* Source/JavaScriptCore/dfg/DFGLoopUnrollingPhase.cpp:
(JSC::DFG::LoopUnrollingPhase::unrollLoop):
Canonical link: https://commits.webkit.org/288198@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
_______________________________________________
webkit-changes mailing list
webkit-changes@lists.webkit.org
https://lists.webkit.org/mailman/listinfo/webkit-changes
