Skip to content

Commit b28637b

Browse files
sigurdschneiderCommit Bot
authored and
Commit Bot
committed
[turbofan] Apply duct-tape to load elimination
Load elimination is running together with to dead code elimination, the latter of which might eliminate allocations (in particular FinishRegion nodes). These are treated as alias nodes by load elimination, and load elimination does not immediatelly learn that a node has been disconnected. This causes load elimination to access the inputs of dead code eliminated nodes while resolving renames, which causes nullptr dereferences. This CL modifies load elimination to not resolve to a nullptr alias but simply stop before that. Change-Id: If4cef061c7c0e25f353727c9e27f790439b0beb5 Bug: chromium:906406 Reviewed-on: https://chromium-review.googlesource.com/c/1346491 Commit-Queue: Sigurd Schneider <sigurds@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#57688}
1 parent 1a36ac0 commit b28637b

File tree

2 files changed

+8
-1
lines changed

2 files changed

+8
-1
lines changed

src/compiler/load-elimination.cc

+1-1
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ bool IsRename(Node* node) {
2222
case IrOpcode::kCheckHeapObject:
2323
case IrOpcode::kFinishRegion:
2424
case IrOpcode::kTypeGuard:
25-
return true;
25+
return !node->IsDead();
2626
default:
2727
return false;
2828
}
+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
// Copyright 2018 the V8 project authors. All rights reserved.
2+
// Use of this source code is governed by a BSD-style license that can be
3+
// found in the LICENSE file.
4+
5+
for (x = 0; x < 10000; ++x) {
6+
[(x) => x, [, 4294967295].find((x) => x), , 2].includes('x', -0);
7+
}

0 commit comments

Comments
 (0)