The following loop in PhaseCFG::implicit_null_check() is guaranteed to run for exactly one iteration, and could be simplified accordingly:

      // mach use (faulting) trying to hoist
      // n might be blocker to hoisting
      while( b != block ) {
        ...
        b = get_block_for_node(b->pred(1)); // Move up to predecessor block
      }

The reason is that, before the loop, 'block' (the null-check block) is guaranteed to be the direct predecessor of 'b' (the memory operation block). This invariant follows from earlier code in the same function, which ensures that 'block' is the immediate dominator of 'b' if 'b's memory operation is a store (for clarity, 'b' refers here to the memory operation block, instead of the original 'cb'):

    // Check ctrl input to see if the null-check dominates the memory op
    Block *b = get_block_for_node(mach);
    b = b->_idom; // Always hoist at least 1 block
    if( !was_store ) { // Stores can be hoisted only one block
      ...
      }
    }
    if( b != block ) continue;

Due to the null-check shape of 'block' (where its successors cannot re-join), the fact that 'block' is the immediate dominator of 'b' implies 'block' is also the direct predecessor of 'b'.