From f4938f931944029cfbac5daec56f6594c7f06354 Mon Sep 17 00:00:00 2001
From: Marty Rosenberg <mrosenberg@mozilla.com>
Date: Fri, 16 Nov 2012 09:12:49 -0500
Subject: [PATCH] Rather than just infinite looping, or abort compilation on
 would-be iloops (bug 803470, r=dvander)

---
 js/src/ion/RangeAnalysis.cpp | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/js/src/ion/RangeAnalysis.cpp b/js/src/ion/RangeAnalysis.cpp
index 934a4a5de46b..19b229232639 100644
--- a/js/src/ion/RangeAnalysis.cpp
+++ b/js/src/ion/RangeAnalysis.cpp
@@ -495,7 +495,9 @@ PopFromWorklist(MDefinitionVector &worklist)
 bool
 RangeAnalysis::analyze()
 {
+    int numBlocks = 0;
     for (PostorderIterator i(graph_.poBegin()); i != graph_.poEnd(); i++) {
+        numBlocks++;
         MBasicBlock *curBlock = *i;
         if (!curBlock->isLoopHeader())
             continue;
@@ -531,6 +533,8 @@ RangeAnalysis::analyze()
             }
         }
         iters++;
+        if (iters >= numBlocks * 100)
+            return false;
     }
     // Cleanup (in case we stopped due to MAX_ITERS)
     for(size_t i = 0; i < worklist.length(); i++)