Bug 1070258 - IonMonkey: Assert that resume points are dominated by their operands r=nbp
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1973,16 +1973,30 @@ jit::AssertGraphCoherency(MIRGraph &grap
#ifdef DEBUG
if (!js_JitOptions.checkGraphConsistency)
return;
AssertBasicGraphCoherency(graph);
AssertReversePostorder(graph);
#endif
}
+static void
+AssertResumePointDominatedByOperands(MResumePoint *resume)
+{
+#ifdef DEBUG
+ for (size_t i = 0, e = resume->numOperands(); i < e; ++i) {
+ MDefinition *op = resume->getOperand(i);
+ if (op->type() == MIRType_MagicOptimizedArguments)
+ continue;
+ MOZ_ASSERT(op->block()->dominates(resume->block()),
+ "Resume point is not dominated by its operands");
+ }
+#endif
+}
+
void
jit::AssertExtendedGraphCoherency(MIRGraph &graph)
{
// Checks the basic GraphCoherency but also other conditions that
// do not hold immediately (such as the fact that critical edges
// are split)
#ifdef DEBUG
@@ -2057,17 +2071,25 @@ jit::AssertExtendedGraphCoherency(MIRGra
MInstructionIterator opIter = block->begin(op->toInstruction());
do {
++opIter;
MOZ_ASSERT(opIter != block->end(),
"Operand in same block as instruction does not precede");
} while (*opIter != ins);
}
}
+ if (MResumePoint *resume = ins->resumePoint())
+ AssertResumePointDominatedByOperands(resume);
}
+
+ // Verify that the block resume points are dominated by their operands.
+ if (MResumePoint *resume = block->entryResumePoint())
+ AssertResumePointDominatedByOperands(resume);
+ if (MResumePoint *resume = block->outerResumePoint())
+ AssertResumePointDominatedByOperands(resume);
}
#endif
}
struct BoundsCheckInfo
{
MBoundsCheck *check;