Bug 1117165 - IonMonkey: After replacing an instruction and deleting it, check whether the replacement has been deleted too. r=nbp, a=sledru
authorDan Gohman <sunfish@mozilla.com>
Fri, 06 Feb 2015 10:54:32 -0800
changeset 249664 6719a2a150860e316a67fdd1783deb8648044f52
parent 249663 f8f587ceebcbc2e534d6904c22a189b780f45c5f
child 249665 bfd779b9caceda47293d5b1bd9d117271e64ba53
push id4489
push userraliiev@mozilla.com
push dateMon, 23 Feb 2015 15:17:55 +0000
treeherdermozilla-beta@fd7c3dc24146 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersnbp, sledru
bugs1117165
milestone37.0a2
Bug 1117165 - IonMonkey: After replacing an instruction and deleting it, check whether the replacement has been deleted too. r=nbp, a=sledru
js/src/jit/ValueNumbering.cpp
--- a/js/src/jit/ValueNumbering.cpp
+++ b/js/src/jit/ValueNumbering.cpp
@@ -744,27 +744,34 @@ ValueNumberer::visitDefinition(MDefiniti
         // If |sim| doesn't belong to a block, insert it next to |def|.
         if (sim->block() == nullptr)
             def->block()->insertAfter(def->toInstruction(), sim->toInstruction());
 
 #ifdef DEBUG
         JitSpew(JitSpew_GVN, "      Folded %s%u to %s%u",
                 def->opName(), def->id(), sim->opName(), sim->id());
 #endif
+        MOZ_ASSERT(!sim->isDiscarded());
         ReplaceAllUsesWith(def, sim);
 
         // The node's foldsTo said |def| can be replaced by |rep|. If |def| is a
         // guard, then either |rep| is also a guard, or a guard isn't actually
         // needed, so we can clear |def|'s guard flag and let it be discarded.
         def->setNotGuardUnchecked();
 
         if (DeadIfUnused(def)) {
             if (!discardDefsRecursively(def))
                 return false;
+
+            // If that ended up discarding |sim|, then we're done here.
+            if (sim->isDiscarded())
+                return true;
         }
+
+        // Otherwise, procede to optimize with |sim| in place of |def|.
         def = sim;
     }
 
     // Now that foldsTo is done, re-enable the original dependency. Even though
     // it may be pointing into a discarded block, it's still valid for the
     // purposes of detecting congruent loads.
     if (dep != nullptr)
         def->setDependency(dep);