Crash while building SSA (bug 683983, r=cdleary).
authorDavid Anderson <danderson@mozilla.com>
Sat, 10 Sep 2011 19:24:57 -0700
changeset 105253 61cd956864cc6514a23698a77c6629df88315e1e
parent 105252 997030f1b8e3258dc0198e5f155e8b030cb8ef01
child 105254 0c3090046c7aea1f4aaccc7d35ca0866c8f88b77
push id14706
push usereakhgari@mozilla.com
push dateTue, 11 Sep 2012 20:39:52 +0000
treeherdermozilla-inbound@d50bf1edaabe [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewerscdleary
bugs683983
milestone9.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Crash while building SSA (bug 683983, r=cdleary).
js/src/ion/IonBuilder.cpp
--- a/js/src/ion/IonBuilder.cpp
+++ b/js/src/ion/IonBuilder.cpp
@@ -688,36 +688,39 @@ IonBuilder::ControlStatus
 IonBuilder::finishLoop(CFGState &state, MBasicBlock *successor)
 {
     JS_ASSERT(current);
 
     // Compute phis in the loop header and propagate them throughout the loop,
     // including the successor.
     if (!state.loop.entry->setBackedge(current))
         return ControlStatus_Error;
-    successor->inheritPhis(state.loop.entry);
+    if (successor)
+        successor->inheritPhis(state.loop.entry);
 
     if (state.loop.breaks) {
         // Propagate phis placed in the header to individual break exit points.
         DeferredEdge *edge = state.loop.breaks;
         while (edge) {
             edge->block->inheritPhis(state.loop.entry);
             edge = edge->next;
         }
 
         // Create a catch block to join all break exits.
         MBasicBlock *block = createBreakCatchBlock(state.loop.breaks, state.loop.exitpc);
         if (!block)
             return ControlStatus_Error;
 
-        // Finally, create an unconditional edge from the successor to the catch
-        // block.
-        successor->end(MGoto::New(block));
-        if (!block->addPredecessor(successor))
-            return ControlStatus_Error;
+        if (successor) {
+            // Finally, create an unconditional edge from the successor to the
+            // catch block.
+            successor->end(MGoto::New(block));
+            if (!block->addPredecessor(successor))
+                return ControlStatus_Error;
+        }
         successor = block;
     }
 
     current = successor;
 
     // An infinite loop (for (;;) { }) will not have a successor.
     if (!current)
         return ControlStatus_Ended;