676999 - IonMonkey: Ensure phi length == numPredecessors().

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Sean Stangl [:sstangl]]

Attachment: Test case.

The attached test case is represented by a graph (attached on next comment) wherein the terminal block has 3 predecessors (from the while, the break, and the other break) but its phi(y:undefined, y:x) node joins only two values, because we eliminate redundant phi entries. This causes us to index past the MPhi array bounds, when one of the predecessors attempts to peek into the phi.

Comment 1

[Sean Stangl [:sstangl]]

Attachment: Incorrect graph, before patch.

Comment 2

[Sean Stangl [:sstangl]]

Attachment: Correct graph, after patch.

Comment 3

[Sean Stangl [:sstangl]]

Attachment: Don't eliminate redundant arguments to phi nodes.

This patch does not result in the generation of extraneous phi nodes, since the phi must have already been created in the first place for there to be redundancies.

Comment 4

[David Anderson [:dvander] - inactive, e-mail if emergency]

Comment on attachment 551212 [details] [diff] [review]
Don't eliminate redundant arguments to phi nodes.

Review of attachment 551212 [details] [diff] [review]:
-----------------------------------------------------------------

Ah, I had completely misunderstood what you were referring to when you explained this bug to me. Yeah, this was totally wrong.

Comment 5

[Sean Stangl [:sstangl]]

http://hg.mozilla.org/projects/ionmonkey/rev/8e87a05785d6