Bug 1263794 - IonMonkey: Crash when iterating graph and finding a nullptr MDefinition, r=jandem
authorHannes Verschore <hv1989@gmail.com>
Wed, 13 Apr 2016 10:04:01 -0400
changeset 330903 beb7e5d6538b4ccf13db9d282075f99eaf23b2ca
parent 330902 4b36ba6198154815e958ebeb1e08ce631e36bbb6
child 330904 14af533af3819e9c26e57f0458784b07a82e92b2
push id6048
push userkmoir@mozilla.com
push dateMon, 06 Jun 2016 19:02:08 +0000
treeherdermozilla-beta@46d72a56c57d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjandem
bugs1263794
milestone48.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1263794 - IonMonkey: Crash when iterating graph and finding a nullptr MDefinition, r=jandem
js/src/jit/IonAnalysis.cpp
--- a/js/src/jit/IonAnalysis.cpp
+++ b/js/src/jit/IonAnalysis.cpp
@@ -1826,16 +1826,19 @@ jit::ApplyTypeInformation(MIRGenerator* 
     return true;
 }
 
 bool
 jit::MakeMRegExpHoistable(MIRGraph& graph)
 {
     for (ReversePostorderIterator block(graph.rpoBegin()); block != graph.rpoEnd(); block++) {
         for (MDefinitionIterator iter(*block); iter; iter++) {
+            if (!*iter)
+                MOZ_CRASH("confirm bug 1263794.");
+
             if (!iter->isRegExp())
                 continue;
 
             MRegExp* regexp = iter->toRegExp();
 
             // Test if MRegExp is hoistable by looking at all uses.
             bool hoistable = true;
             for (MUseIterator i = regexp->usesBegin(); i != regexp->usesEnd(); i++) {