This fixes a B3 post-dominator miscomputation that could let loop-invariant code motion (LICM) hoist a control-dependent memory access out of a loop. B3 computes post-dominators via BackwardsGraph, which reverses the CFG and gives a synthetic reverse root a successor for every terminal block AND every back-edge source (latch). The correctness of LICM (and other control-equivalence consumers) depends on the resulting post-dominator relation. Consider a loop whose header has two latches: ‘success’ (which can also exit the loop) and ‘failure’ (an exit-less latch that just jumps back to the header). Control can stay in the loop forever by repeatedly taking the exit-less ‘failure’ latch without ever reaching ‘success’. Therefore ‘success’ must NOT post-dominate the header or the loop entry.

Pre-patch, if an exit-less back-edge source like ‘failure’ was omitted from the synthetic reverse root’s successors, then in the reversed CFG the header was reachable only through ‘success’, so ‘success’ FALSELY post-dominated the header (and the loop entry). B3 LICM would then treat a read guarded by the ‘success’ path as always-executed and hoist that control-dependent read out of the loop, so it runs unconditionally (even when control never legitimately reaches it) — an invalid/out-of-bounds read (bad hoisting).

The fix ensures every back-edge source, including exit-less latches, is a successor of the synthetic reverse root in BackwardsGraph so post-dominance is computed correctly and LICM does not hoist the control-dependent access. The added B3 unit test (testBackwardsDominatorsWithMultipleBackEdges) builds exactly this two-latch loop and asserts ‘success’ does not post-dominate the header/root. (The source change is in B3’s BackwardsGraph/BackwardsDominators; this diff shows the authoritative test that documents the property, per its comment.)

A JIT miscompilation in the WebContent process: incorrect post-dominance let LICM hoist a control-dependent (guarded) memory access so it executes unconditionally — an out-of-bounds/invalid read. The advisory rates it a crash; bad-hoisting bugs can be shaped into controlled OOB reads.