From 7e98658e31156ec71db8b9822cd5abe0e618f51f Mon Sep 17 00:00:00 2001
From: titzer <titzer@chromium.org>
Date: Fri, 9 Jan 2015 04:27:59 -0800
Subject: [PATCH] [turbofan] Fix control reducer for degenerate cases of
 self-loop branches.

R=jarin@chromium.org
BUG=chromium:447526

Review URL: https://codereview.chromium.org/828823006

Cr-Commit-Position: refs/heads/master@{#26009}
---
 src/compiler/control-reducer.cc        |  3 +++
 test/mjsunit/regress/regress-447526.js | 25 +++++++++++++++++++++++++
 2 files changed, 28 insertions(+)
 create mode 100644 test/mjsunit/regress/regress-447526.js

diff --git a/src/compiler/control-reducer.cc b/src/compiler/control-reducer.cc
index bc619bc..b17e59d 100644
--- a/src/compiler/control-reducer.cc
+++ b/src/compiler/control-reducer.cc
@@ -282,6 +282,7 @@ class ControlReducerImpl {
 
     // Recurse on an input if necessary.
     for (Node* const input : node->inputs()) {
+      CHECK_NE(NULL, input);
       if (Recurse(input)) return;
     }
 
@@ -496,10 +497,12 @@ class ControlReducerImpl {
         TRACE(("  IfTrue: #%d:%s\n", use->id(), use->op()->mnemonic()));
         edge.UpdateTo(NULL);
         ReplaceNode(use, (result == kTrue) ? control : dead());
+        control = NodeProperties::GetControlInput(node);  // Could change!
       } else if (use->opcode() == IrOpcode::kIfFalse) {
         TRACE(("  IfFalse: #%d:%s\n", use->id(), use->op()->mnemonic()));
         edge.UpdateTo(NULL);
         ReplaceNode(use, (result == kTrue) ? dead() : control);
+        control = NodeProperties::GetControlInput(node);  // Could change!
       }
     }
     return control;
diff --git a/test/mjsunit/regress/regress-447526.js b/test/mjsunit/regress/regress-447526.js
new file mode 100644
index 0000000..9f9396f
--- /dev/null
+++ b/test/mjsunit/regress/regress-447526.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar() {
+  throw "done";
+}
+
+function foo() {
+  var i;
+  while (i) {
+    while (i) {
+}
+    i++;
+  }
+  while (true) {
+    bar();
+  }
+}
+
+
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(foo);
-- 
2.7.4