[turbofan] Fix handling of OsrLoopEntry in ControlReducer::ConnectNTL()

R=jarin@chromium.org
LOG=Y
BUG=chromium:485908

Review URL: https://codereview.chromium.org/1138463004

Cr-Commit-Position: refs/heads/master@{#28323}

diff --git a/src/compiler/control-reducer.cc b/src/compiler/control-reducer.cc
index 6f7ffb3..6910e6c 100644 (file)
--- a/src/compiler/control-reducer.cc
+++ b/src/compiler/control-reducer.cc
@@ -90,11 +90,10 @@ class ControlReducerImpl final : public AdvancedReducer {
       bool pop = true;
       while (fw_stack.back().second != node->use_edges().end()) {
         Edge edge = *(fw_stack.back().second);
+        Node* succ = edge.from();
         if (NodeProperties::IsControlEdge(edge) &&
-            edge.from()->op()->ControlOutputCount() > 0) {
+            succ->op()->ControlOutputCount() > 0) {
           // Only walk control edges to control nodes.
-          Node* succ = edge.from();
-
           if (marked.IsOnStack(succ) && !marked.IsReachableFromEnd(succ)) {
             // {succ} is on stack and not reachable from end.
             Node* added = ConnectNTL(succ);
@@ -112,11 +111,14 @@ class ControlReducerImpl final : public AdvancedReducer {
           }
           if (!marked.IsReachableFromStart(succ)) {
             // {succ} is not yet reached from start.
-            marked.Push(succ);
             marked.SetReachableFromStart(succ);
-            fw_stack.push_back(FwIter(succ, succ->use_edges().begin()));
-            pop = false;  // "recurse" into successor control node.
-            break;
+            if (succ->opcode() != IrOpcode::kOsrLoopEntry) {
+              // Skip OsrLoopEntry; forms a confusing irredducible loop.
+              marked.Push(succ);
+              fw_stack.push_back(FwIter(succ, succ->use_edges().begin()));
+              pop = false;  // "recurse" into successor control node.
+              break;
+            }
           }
         }
         ++fw_stack.back().second;

diff --git a/test/mjsunit/regress/regress-469605b.js b/test/mjsunit/regress/regress-469605b.js
new file mode 100644 (file)
index 0000000..de17676
--- /dev/null
+++ b/test/mjsunit/regress/regress-469605b.js
@@ -0,0 +1,26 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function counter() {
+  var i = 10000;
+  return function() {
+    if (i-- > 0) return i;
+    throw "done";
+  }
+}
+
+
+var f = (function() {
+  "use asm";
+  return function f(i, c1, c2) {
+    i = i|0;
+    do {
+      if (i > 0) { while (0 ? this : this) { c1(); } }
+      else c2();
+    } while (true);
+  }
+})();
+
+assertThrows(function() { f(0, counter(), counter()); });
+assertThrows(function() { f(1, counter(), counter()); });