Fix Branch/CondBranch Edge bug: use C++ bridge for in_edges management

SonicField · SonicField · commit 61c319ca49e0 · 2026-04-14T20:15:32.000-07:00
Pure C factories wrote edge.to directly, bypassing Edge::set_to() which
manages BasicBlock::in_edges_ (predecessor tracking). This causes null
in_edge entries → DominatorAnalysis crash at analysis.cpp:524.

Root cause: Edge::set_to() updates target block's in_edges_ set (C++
std::unordered_set), which cannot be done from pure C. Branch and
CondBranch factories must use C++ bridge to call Edge constructor.

Fix: add hir_c_create_branch_cpp and hir_c_create_cond_branch_cpp
in hir_c_api.cpp that use Branch::create/CondBranch::create (proper
Edge initialization via CondBranchBase constructor → set_true_bb →
Edge::set_to → in_edges_.insert).
diff --git a/Python/jit/hir/hir_c_api.cpp b/Python/jit/hir/hir_c_api.cpp
@@ -585,6 +585,21 @@ HirInstr hir_c_create_check_exc(HirFunction func, HirRegister src,
       *static_cast<const FrameState*>(frame_state));
 }
 
+/* ---- Branch/CondBranch factories (C++ bridge for Edge management) ---- */
+
+HirInstr hir_c_create_branch_cpp(void *target_block) {
+  auto* bb = static_cast<BasicBlock*>(target_block);
+  return Branch::create(bb);
+}
+
+HirInstr hir_c_create_cond_branch_cpp(void *cond_reg,
+                                       void *true_block,
+                                       void *false_block) {
+  auto* true_bb = static_cast<BasicBlock*>(true_block);
+  auto* false_bb = static_cast<BasicBlock*>(false_block);
+  return CondBranch::create(as_reg(cond_reg), true_bb, false_bb);
+}
+
 /* ---- Frame state ---- */
 
 void *hir_get_frame_state(HirInstr instr) {
diff --git a/Python/jit/hir/hir_c_api.h b/Python/jit/hir/hir_c_api.h
@@ -158,6 +158,16 @@ HirInstr hir_load_const_bottom_create(HirRegister output);
 /* Create an Assign instruction (copy register). */
 HirInstr hir_assign_create(HirRegister output, HirRegister value);
 
+/* Create a Branch instruction (0 operands, 1 edge).
+ * Uses C++ Edge::set_to for proper in_edges management. */
+HirInstr hir_c_create_branch_cpp(void *target_block);
+
+/* Create a CondBranch instruction (1 operand, 2 edges).
+ * Uses C++ Edge::set_to for proper in_edges management. */
+HirInstr hir_c_create_cond_branch_cpp(void *cond_reg,
+                                       void *true_block,
+                                       void *false_block);
+
 /* ---- Instruction query/mutation (T2-D) ---- */
 
 /* Get the Compare operation kind (CompareOp enum as int).
diff --git a/Python/jit/hir/simplify.cpp b/Python/jit/hir/simplify.cpp
@@ -176,15 +176,19 @@ struct Env {
         &func, src, const_cast<void*>(static_cast<const void*>(&fs)))));
   }
 
-  // Convenience: create + insert a Branch via pure C factory.
+  // Convenience: create + insert a Branch via C++ bridge factory.
+  // Must use C++ bridge (not pure C) because Edge::set_to manages
+  // target block's in_edges_ set.
   Register* emitBranch(BasicBlock* target) {
-    return emitCInstr(static_cast<Instr*>(hir_c_create_branch(target)));
+    return emitCInstr(static_cast<Instr*>(hir_c_create_branch_cpp(target)));
   }
 
-  // Convenience: create + insert a CondBranch via pure C factory.
+  // Convenience: create + insert a CondBranch via C++ bridge factory.
+  // Must use C++ bridge (not pure C) because Edge::set_to manages
+  // target block's in_edges_ set.
   Register* emitCondBranch(Register* cond, BasicBlock* true_bb, BasicBlock* false_bb) {
     return emitCInstr(static_cast<Instr*>(
-        hir_c_create_cond_branch(cond, true_bb, false_bb)));
+        hir_c_create_cond_branch_cpp(cond, true_bb, false_bb)));
   }
 
   // Convenience: create + insert a UseType via pure C factory.
