Bug 1820858 - [hazards] Post-loop point should have pre-loop point as predecessor. It is not enough to eventually reach the point through the loop, because of dominator analyses. r=jonco

Differential Revision: https://phabricator.services.mozilla.com/D171898

js/src/devtools/rootAnalysis/CFG.js

@@ -194,9 +194,8 @@ function BFS_upwards(start_body, start_ppoint, bodies, visitor,
                 // Don't continue to predecessors here without going through
                 // the loop. (The points in this body that enter the loop will
                 // be traversed when we reach the entry point of the loop.)
-            } else {
-                work.push([body, edge.Index[0], edge, value]);
             }
+            work.push([body, edge.Index[0], edge, value]);
         }
 
         // Check for hitting the entry point of a loop body.

js/src/devtools/rootAnalysis/t/hazards/source.cpp

@@ -533,6 +533,18 @@ Cell* refptr_test9() {
   return ref_safe9;
 }
 
+Cell* refptr_test10() {
+  static Cell cell;
+  RefPtr<float> v10;
+  Cell* ref_unsafe10 = &cell;
+  // The destructor has a backwards path that skips the loop body.
+  v10.assign_with_AddRef(&somefloat);
+  while (flipcoin()) {
+    v10.forget();
+  }
+  return ref_unsafe10;
+}
+
 std::pair<bool, AutoCheckCannotGC> pair_returning_function() {
   return std::make_pair(true, AutoCheckCannotGC());
 }

js/src/devtools/rootAnalysis/t/hazards/test.py

@@ -113,6 +113,7 @@ assert "Cell* refptr_test6()" in haz_functions
 assert "Cell* refptr_test7()" in haz_functions
 assert "Cell* refptr_test8()" in haz_functions
 assert "Cell* refptr_test9()" not in haz_functions
+assert "Cell* refptr_test10()" in haz_functions
 
 # aggr_init tests.