AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] handle dead effect-phi control op in InferReceiverMaps

Browse Source 
Add an early exit if the control op is Dead to prevent failing the
DCHECK.

BUG=chromium:797596, v8:5940, v8:3018
R=bmeurer@chromium.org, jarin@chromium.org

Change-Id: I6090380ea69c3205740b6c7a41d7c066d18d6a9f
Reviewed-on: https://chromium-review.googlesource.com/844978
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50312}
This commit is contained in:
Caitlin Potter 2017-12-27 16:40:47 -05:00 committed by Commit Bot
parent 013e86b838
commit 007f90ba9b
2 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/compiler/node-properties.cc
View File

@ -464,7 +464,8 @@ NodeProperties::InferReceiverMapsResult NodeProperties::InferReceiverMaps(
case IrOpcode::kEffectPhi: {
Node* control = GetControlInput(effect);
if (control->opcode() != IrOpcode::kLoop) {
DCHECK_EQ(IrOpcode::kMerge, control->opcode());
DCHECK(control->opcode() == IrOpcode::kDead ||
control->opcode() == IrOpcode::kMerge);
return kNoReceiverMaps;
}

30
test/mjsunit/compiler/regress-797596.js Normal file
View File

@ -0,0 +1,30 @@
// Copyright 2017 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --expose-gc --allow-natives-syntax
var notCallable;
function inferReceiverMapsInDeadCode() {
var obj = { func() {} };
gc();
function wrappedCode() { try { code(); } catch (e) {} }
function code() {
obj.a;
try {
Object.defineProperty(obj, "func", { get() {} });
} catch (neverCaught) {}
for (var i = 0; i < 1; i++) {
try {
notCallable(arguments[i]);
} catch (alwaysCaught) {}
}
}
wrappedCode();
try {
%OptimizeFunctionOnNextCall(wrappedCode);
wrappedCode();
} catch (e) {}
}
inferReceiverMapsInDeadCode();
inferReceiverMapsInDeadCode();
inferReceiverMapsInDeadCode();