NaturalLoops::compute uses i instead of j in one of its internal loops. Should be a simple fix.
Looks like it's more complicated than I thought. Still crashes with this fix.
Added https://bugs.webkit.org/show_bug.cgi?id=118338 to the blocks list since SSA conversion needs Dominators and this bug looks like it might be Dominators-related.
Yeah I borked dominators. Lol. Patch on the way.
(In reply to comment #3)
> Yeah I borked dominators. Lol. Patch on the way.
Notice how I reversed "to" and "from".
Created attachment 206289 [details]
Comment on attachment 206289 [details]
Landed in http://trac.webkit.org/changeset/152481