869529 - IonMonkey: LiveRangeAllocator assumes there always exists a block after the osrBlock (in post-order)

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Kannan Vijayan [:djvj]]

Found this helping track down dromaeo oranges for patch to bug 865059.

LiveRangeAllocator::buildLivenessInfo uses a worklist of blocks in a loop to iterate through.  When iterating to the next block in this list, it skips osrBlocks.  However, it assumes that if the next block is an osrBlock, then the list contains at least one more non-osr block.

This seems not to be the a valid assumption.  At least, brian's scriptAnalysis patch in bug 865059 seems to trigger situations where this implicit assumption is no longer true.

Before this fix, I was able to reproduce some crashes on dromaeo_css with the original patch for bug 865059 applied.  After this issue is fixed, it doesn't show up, at least in debug builds.  Will test more.

Comment 1

[Kannan Vijayan [:djvj]]

Attachment: Fix.

Comment 2

[Kannan Vijayan [:djvj]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0a50d67075be

Comment 3

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/mozilla-central/rev/0a50d67075be