From d9624c58995b312099f2fac3ed3fa7aac7df9ad4 Mon Sep 17 00:00:00 2001
From: Shu-yu Guo <shu@rfrn.org>
Date: Thu, 18 Apr 2013 17:42:01 -0700
Subject: [PATCH] Bug 859255 - Fix stitching up of parallel bailout basic
 blocks. (r=dvander)

---
 js/src/ion/MIRGraph.cpp              | 16 ++++++++++------
 js/src/ion/MIRGraph.h                |  3 ++-
 js/src/ion/ParallelArrayAnalysis.cpp |  8 ++------
 3 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/js/src/ion/MIRGraph.cpp b/js/src/ion/MIRGraph.cpp
index 5e797430c8e..62ef06044b9 100644
--- a/js/src/ion/MIRGraph.cpp
+++ b/js/src/ion/MIRGraph.cpp
@@ -161,17 +161,21 @@ MBasicBlock::NewSplitEdge(MIRGraph &graph, CompileInfo &info, MBasicBlock *pred)
 
 MBasicBlock *
 MBasicBlock::NewParBailout(MIRGraph &graph, CompileInfo &info,
-                           MBasicBlock *pred, jsbytecode *entryPc)
+                           MBasicBlock *pred, jsbytecode *entryPc,
+                           MResumePoint *resumePoint)
 {
-    MBasicBlock *block = MBasicBlock::New(graph, info, pred, entryPc, NORMAL);
-    if (!block)
+    MBasicBlock *block = new MBasicBlock(graph, info, entryPc, NORMAL);
+
+    resumePoint->block_ = block;
+    block->entryResumePoint_ = resumePoint;
+
+    if (!block->init())
         return NULL;
 
-    MParBailout *bailout = new MParBailout();
-    if (!bailout)
+    if (!block->addPredecessorWithoutPhis(pred))
         return NULL;
 
-    block->end(bailout);
+    block->end(new MParBailout());
     return block;
 }
 
diff --git a/js/src/ion/MIRGraph.h b/js/src/ion/MIRGraph.h
index e1bbb3e5024..cdbc5117301 100644
--- a/js/src/ion/MIRGraph.h
+++ b/js/src/ion/MIRGraph.h
@@ -75,7 +75,8 @@ class MBasicBlock : public TempObject, public InlineListNode<MBasicBlock>
                                              MBasicBlock *pred, jsbytecode *entryPc);
     static MBasicBlock *NewSplitEdge(MIRGraph &graph, CompileInfo &info, MBasicBlock *pred);
     static MBasicBlock *NewParBailout(MIRGraph &graph, CompileInfo &info,
-                                      MBasicBlock *pred, jsbytecode *entryPc);
+                                      MBasicBlock *pred, jsbytecode *entryPc,
+                                      MResumePoint *resumePoint);
 
     bool dominates(MBasicBlock *other);
 
diff --git a/js/src/ion/ParallelArrayAnalysis.cpp b/js/src/ion/ParallelArrayAnalysis.cpp
index 1866153297d..3fc4ca223ab 100644
--- a/js/src/ion/ParallelArrayAnalysis.cpp
+++ b/js/src/ion/ParallelArrayAnalysis.cpp
@@ -508,11 +508,6 @@ ParallelArrayVisitor::convertToBailout(MBasicBlock *block, MInstruction *ins)
     // This block is no longer reachable.
     block->unmark();
 
-    // Determine the best PC to use for the bailouts we'll be creating.
-    jsbytecode *pc = block->pc();
-    if (!pc)
-        pc = block->pc();
-
     // Create a bailout block for each predecessor.  In principle, we
     // only need one bailout block--in fact, only one per graph! But I
     // found this approach easier to implement given the design of the
@@ -528,7 +523,8 @@ ParallelArrayVisitor::convertToBailout(MBasicBlock *block, MInstruction *ins)
             continue;
 
         // create bailout block to insert on this edge
-        MBasicBlock *bailBlock = MBasicBlock::NewParBailout(graph_, pred->info(), pred, pc);
+        MBasicBlock *bailBlock = MBasicBlock::NewParBailout(graph_, block->info(), pred,
+                                                            block->pc(), block->entryResumePoint());
         if (!bailBlock)
             return false;