Bug 865153 - Remove resume point uses in dead blocks when restarting loop processing, r=h4writer.

js/src/ion/IonBuilder.cpp

@@ -1741,8 +1741,10 @@ IonBuilder::restartLoop(CFGState state)
     // of the appropriate type and incoming edges to preserve.
     graph().removeBlocksAfter(header);
 
-    // Remove all instructions from the header itself.
+    // Remove all instructions from the header itself, and all resume points
+    // except the entry resume point.
     header->discardAllInstructions();
+    header->discardAllResumePoints(/* discardEntry = */ false);
     header->setStackDepth(header->getPredecessor(0)->stackDepth());
 
     popCfgStack();

js/src/ion/MIR.cpp

@@ -1674,6 +1674,7 @@ MResumePoint::MResumePoint(MBasicBlock *block, jsbytecode *pc, MResumePoint *cal
     instruction_(NULL),
     mode_(mode)
 {
+    block->addResumePoint(this);
 }
 
 void

js/src/ion/MIR.h

@@ -101,6 +101,9 @@ class MUse : public TempObject, public InlineListNode<MUse>
         JS_ASSERT(producer_ != NULL);
         return producer_;
     }
+    bool hasProducer() const {
+        return producer_ != NULL;
+    }
     MNode *consumer() const {
         JS_ASSERT(consumer_ != NULL);
         return consumer_;
@@ -7171,7 +7174,7 @@ class MParNewDenseArray : public MBinaryInstruction
 // A resume point contains the information needed to reconstruct the interpreter
 // state from a position in the JIT. See the big comment near resumeAfter() in
 // IonBuilder.cpp.
-class MResumePoint : public MNode
+class MResumePoint : public MNode, public InlineForwardListNode<MResumePoint>
 {
   public:
     enum Mode {
@@ -7207,6 +7210,11 @@ class MResumePoint : public MNode
         operand->addUse(&operands_[index]);
     }
 
+    void clearOperand(size_t index) {
+        JS_ASSERT(index < stackDepth_);
+        operands_[index].set(NULL, this, index);
+    }
+
     MUse *getUseFor(size_t index) {
         return &operands_[index];
     }
@@ -7251,6 +7259,13 @@ class MResumePoint : public MNode
     Mode mode() const {
         return mode_;
     }
+
+    void discardUses() {
+        for (size_t i = 0; i < stackDepth_; i++) {
+            if (operands_[i].hasProducer())
+                operands_[i].producer()->removeUse(&operands_[i]);
+        }
+    }
 };
 
 /*

js/src/ion/MIRGraph.cpp

@@ -78,6 +78,7 @@ MIRGraph::removeBlocksAfter(MBasicBlock *start)
             osrBlock_ = NULL;
         block->discardAllInstructions();
         block->discardAllPhis();
+        block->discardAllResumePoints();
         block->markAsDead();
         removeBlock(block);
     }
@@ -292,6 +293,13 @@ MBasicBlock::inherit(MBasicBlock *pred, uint32_t popped)
             for (size_t i = 0; i < stackDepth(); i++)
                 entryResumePoint()->setOperand(i, getSlot(i));
         }
+    } else if (entryResumePoint()) {
+        /*
+         * Don't leave the operands uninitialized for the caller, as it may not
+         * initialize them later on.
+         */
+        for (size_t i = 0; i < stackDepth(); i++)
+            entryResumePoint()->clearOperand(i);
     }
 
     return true;
@@ -638,6 +646,20 @@ MBasicBlock::discardAllPhis()
         (*pred)->setSuccessorWithPhis(NULL, 0);
 }
 
+void
+MBasicBlock::discardAllResumePoints(bool discardEntry)
+{
+    for (MResumePointIterator iter = resumePointsBegin(); iter != resumePointsEnd(); ) {
+        MResumePoint *rp = *iter;
+        if (rp == entryResumePoint() && !discardEntry) {
+            iter++;
+        } else {
+            rp->discardUses();
+            iter = resumePoints_.removeAt(iter);
+        }
+    }
+}
+
 void
 MBasicBlock::insertBefore(MInstruction *at, MInstruction *ins)
 {

js/src/ion/MIRGraph.h

@@ -26,6 +26,7 @@ class MDefinitionIterator;
 typedef InlineListIterator<MInstruction> MInstructionIterator;
 typedef InlineListReverseIterator<MInstruction> MInstructionReverseIterator;
 typedef InlineForwardListIterator<MPhi> MPhiIterator;
+typedef InlineForwardListIterator<MResumePoint> MResumePointIterator;
 
 class LBlock;
 
@@ -156,6 +157,11 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
     // Adds a phi instruction, but does not set successorWithPhis.
     void addPhi(MPhi *phi);
 
+    // Adds a resume point to this block.
+    void addResumePoint(MResumePoint *resume) {
+        resumePoints_.pushFront(resume);
+    }
+
     // Adds a predecessor. Every predecessor must have the same exit stack
     // depth as the entry state to this block. Adding a predecessor
     // automatically creates phi nodes and rewrites uses as needed.
@@ -217,6 +223,7 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
     MDefinitionIterator discardDefAt(MDefinitionIterator &iter);
     void discardAllInstructions();
     void discardAllPhis();
+    void discardAllResumePoints(bool discardEntry = true);
 
     // Discards a phi instruction and updates predecessor successorWithPhis.
     MPhiIterator discardPhiAt(MPhiIterator &at);
@@ -250,6 +257,7 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
     }
 
     uint32_t domIndex() const {
+        JS_ASSERT(!isDead());
         return domIndex_;
     }
     void setDomIndex(uint32_t d) {
@@ -271,6 +279,12 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
     bool phisEmpty() const {
         return phis_.empty();
     }
+    MResumePointIterator resumePointsBegin() const {
+        return resumePoints_.begin();
+    }
+    MResumePointIterator resumePointsEnd() const {
+        return resumePoints_.end();
+    }
     MInstructionIterator begin() {
         return instructions_.begin();
     }
@@ -453,6 +467,7 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
     InlineList<MInstruction> instructions_;
     Vector<MBasicBlock *, 1, IonAllocPolicy> predecessors_;
     InlineForwardList<MPhi> phis_;
+    InlineForwardList<MResumePoint> resumePoints_;
     FixedList<MDefinition *> slots_;
     uint32_t stackPosition_;
     MControlInstruction *lastIns_;