Bug 1075601 - GVN: Overwrite leader definition if it got discarded. r=sunfish
authorNicolas B. Pierron <nicolas.b.pierron@mozilla.com>
Fri, 03 Oct 2014 14:33:08 +0200
changeset 231904 418296d647693fa0bd1802e39f22c596f41f4a4f
parent 231903 0b063dbaf154328b6cbf3227f7b8e19092874db7
child 231905 93909a51e5edeed38968cc6c06c3af178b8d4742
push id1
push usersledru@mozilla.com
push dateThu, 04 Dec 2014 17:57:20 +0000
reviewerssunfish
bugs1075601
milestone35.0a1
Bug 1075601 - GVN: Overwrite leader definition if it got discarded. r=sunfish
js/src/jit/ValueNumbering.cpp
--- a/js/src/jit/ValueNumbering.cpp
+++ b/js/src/jit/ValueNumbering.cpp
@@ -148,16 +148,17 @@ IsDiscardable(const MDefinition *def)
 }
 
 // Call MDefinition::justReplaceAllUsesWith, and add some GVN-specific asserts.
 static void
 ReplaceAllUsesWith(MDefinition *from, MDefinition *to)
 {
     MOZ_ASSERT(from != to, "GVN shouldn't try to replace a value with itself");
     MOZ_ASSERT(from->type() == to->type(), "Def replacement has different type");
+    MOZ_ASSERT(!to->isDiscarded(), "GVN replaces an instruction by a removed instruction");
 
     // We don't need the extra setting of UseRemoved flags that the regular
     // replaceAllUsesWith does because we do it ourselves.
     from->justReplaceAllUsesWith(to);
 }
 
 // Test whether |succ| is a successor of |block|.
 static bool
@@ -634,17 +635,17 @@ ValueNumberer::leader(MDefinition *def)
     // convention is that congruentTo returns false for node kinds that wish to
     // opt out of redundance elimination.
     // TODO: It'd be nice to clean up that convention (bug 1031406).
     if (!def->isEffectful() && def->congruentTo(def)) {
         // Look for a match.
         VisibleValues::AddPtr p = values_.findLeaderForAdd(def);
         if (p) {
             MDefinition *rep = *p;
-            if (rep->block()->dominates(def->block())) {
+            if (!rep->isDiscarded() && rep->block()->dominates(def->block())) {
                 // We found a dominating congruent value.
                 return rep;
             }
 
             // The congruent value doesn't dominate. It never will again in this
             // dominator tree, so overwrite it.
             values_.overwrite(p, def);
         } else {