Bug 1063653 - Add testcase. r=bhackett

js/src/jit-test/tests/ion/bug1063653.js

@@ -0,0 +1,10 @@
+
+function g(x) {
+    return (0 > (Math.max(x, x) || x))
+}
+function f() {
+    return g(g() >> 0)
+}
+for (var k = 0; k < 1; ++k) {
+    f();
+}

js/src/jit/IonAnalysis.cpp

@@ -43,6 +43,12 @@ SplitCriticalEdgesForBlock(MIRGraph &graph, MBasicBlock *block)
         graph.insertBlockAfter(block, split);
         split->end(MGoto::New(graph.alloc(), target));
 
+        // The entry resume point won't properly reflect state at the start of
+        // the split edge, so remove it.  Split edges start out empty, but might
+        // have fallible code moved into them later.  Rather than immediately
+        // figure out a valid resume point and pc we can use for the split edge,
+        // we wait until lowering (see LIRGenerator::visitBlock), where this
+        // will be easier.
         if (MResumePoint *rp = split->entryResumePoint()) {
             rp->releaseUses();
             split->clearEntryResumePoint();

js/src/jit/Lowering.cpp

@@ -3969,6 +3969,11 @@ LIRGenerator::visitBlock(MBasicBlock *block)
     if (!visitInstruction(block->lastIns()))
         return false;
 
+    // If we have a resume point check that all the following blocks have one,
+    // otherwise reuse the last resume point as the entry resume point of the
+    // basic block.  This is used to handle fallible code which is moved/added
+    // into split edge blocks, which do not have resume points.  See
+    // SplitCriticalEdgesForBlock.
     if (lastResumePoint_) {
         for (size_t s = 0; s < block->numSuccessors(); s++) {
             MBasicBlock *succ = block->getSuccessor(s);