Bug 1175397 - Do not eliminate dead resume point operands after GVN. r=nbp CLOSED TREE

--HG--
extra : amend_source : 7ad4dc79cbdb30453c2d20695efee35bdf3338a7

js/src/jit/Ion.cpp

@@ -1410,7 +1410,50 @@ OptimizeMIR(MIRGenerator* mir)
         if (mir->shouldCancel("Alias analysis"))
             return false;
 
-        if (!mir->compilingAsmJS()) {
+        // We only eliminate dead resume point operands in the first pass
+        // because it is currently unsound to do so after GVN.
+        //
+        // Consider the following example, where def1 dominates, and is
+        // congruent with def4, and use3 dominates, and is congruent with,
+        // use6.
+        //
+        // def1
+        // nop2
+        //   resumepoint def1
+        // use3 def1
+        // def4
+        // nop5
+        //   resumepoint def4
+        // use6 def4
+        // use7 use3 use6
+        //
+        // Assume that use3, use6, and use7 can cause OSI and are
+        // non-effectful. That is, use3 will resume at nop2, and use6 and use7
+        // will resume at nop5.
+        //
+        // After GVN, since def1 =~ def4, we have:
+        //
+        // def4 - replaced with def1 and pruned
+        // use6 - replaced with use3 and pruned
+        // use7 - renumbered to use5
+        //
+        // def1
+        // nop2
+        //   resumepoint def1
+        // use3 def1
+        // nop4
+        //   resumepoint def1
+        // use5 use3 use3
+        //
+        // nop4's resumepoint's operand of def1 is considered dead, because it
+        // is dominated by the last use of def1, use3.
+        //
+        // However, if use5 causes OSI, we will resume at nop4's resume
+        // point. The baseline frame at that point expects the now-pruned def4
+        // to exist. However, since it was replaced with def1 by GVN, and def1
+        // is dead at the point of nop4, the baseline frame incorrectly gets
+        // an optimized out value.
+        if (!mir->compilingAsmJS() && doRepeatOptimizations == 1) {
             // Eliminating dead resume point operands requires basic block
             // instructions to be numbered. Reuse the numbering computed during
             // alias analysis.