Bug 1259911: Only add predecessors to the join block once; r=sunfish

MozReview-Commit-ID: A660ASYGb4l

--HG--
extra : rebase_source : 5980168bbba1a5a99212aebcb34d97b4018d1489

js/src/asmjs/WasmIonCompile.cpp

@@ -1351,18 +1351,30 @@ class FunctionCompiler
 
         MBasicBlock* join = nullptr;
         MControlInstruction* ins = patches[0].ins;
-        if (!newBlock(ins->block(), &join))
+        MBasicBlock* pred = ins->block();
+        if (!newBlock(pred, &join))
             return false;
 
+        pred->mark();
         ins->replaceSuccessor(patches[0].index, join);
 
         for (size_t i = 1; i < patches.length(); i++) {
             ins = patches[i].ins;
-            if (!join->addPredecessor(alloc(), ins->block()))
-                return false;
+
+            pred = ins->block();
+            if (!pred->isMarked()) {
+                if (!join->addPredecessor(alloc(), pred))
+                    return false;
+                pred->mark();
+            }
+
             ins->replaceSuccessor(patches[i].index, join);
         }
 
+        MOZ_ASSERT_IF(curBlock_, !curBlock_->isMarked());
+        for (uint32_t i = 0; i < join->numPredecessors(); i++)
+            join->getPredecessor(i)->unmark();
+
         if (curBlock_ && !goToExistingBlock(curBlock_, join))
             return false;
         curBlock_ = join;

js/src/jit-test/tests/wasm/random-control-flow.js

@@ -11,6 +11,11 @@ wasmEvalText(`(module (func $func$0
   )
 )`);
 
+wasmEvalText(`(module (func
+      (loop $out $in (br_table $out $out $in (i32.const 0)))
+  )
+)`);
+
 wasmEvalText(`(module (func
   (select
     (block