CFGSimplificationPhase should de-dupe jettisonedBlocks
authorsbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Jun 2018 19:04:10 +0000 (19:04 +0000)
committersbarati@apple.com <sbarati@apple.com@268f45cc-cd09-0410-ab3c-d52691b4dbfc>
Wed, 13 Jun 2018 19:04:10 +0000 (19:04 +0000)
commit6149772e1270fcb2d88650a44ac1080503da0cb9
treeab92c8c84bc6b309c687b836eaa91cd9480ecab4
parente73b5de9977e03d0a3fc5d044700956b658a351e
CFGSimplificationPhase should de-dupe jettisonedBlocks
https://bugs.webkit.org/show_bug.cgi?id=186583

Reviewed by Filip Pizlo.

When making the predecessors list unique in r232741, it revealed a bug inside
of CFG simplification, where we try to remove the same predecessor more than
once from a blocks predecessors list. We built the list of blocks to remove
from the list of successors, which is not unique, causing us to try to remove
the same predecessor more than once. The solution here is to just add to this
list of blocks to remove only if the block is not already in the list.

* dfg/DFGCFGSimplificationPhase.cpp:
(JSC::DFG::CFGSimplificationPhase::run):

git-svn-id: https://svn.webkit.org/repository/webkit/trunk@232800 268f45cc-cd09-0410-ab3c-d52691b4dbfc
Source/JavaScriptCore/ChangeLog
Source/JavaScriptCore/dfg/DFGCFGSimplificationPhase.cpp