Bug 1117165 - IonMonkey: After replacing an instruction and deleting it, check whether the replacement has been deleted too. r=nbp

This commit is contained in:
Dan Gohman 2015-02-06 10:54:32 -08:00
parent d716f4edca
commit 4ca1845f77

View File

@ -749,6 +749,7 @@ ValueNumberer::visitDefinition(MDefinition *def)
JitSpew(JitSpew_GVN, " Folded %s%u to %s%u",
def->opName(), def->id(), sim->opName(), sim->id());
#endif
MOZ_ASSERT(!sim->isDiscarded());
ReplaceAllUsesWith(def, sim);
// The node's foldsTo said |def| can be replaced by |rep|. If |def| is a
@ -759,7 +760,13 @@ ValueNumberer::visitDefinition(MDefinition *def)
if (DeadIfUnused(def)) {
if (!discardDefsRecursively(def))
return false;
// If that ended up discarding |sim|, then we're done here.
if (sim->isDiscarded())
return true;
}
// Otherwise, procede to optimize with |sim| in place of |def|.
def = sim;
}