AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turboshaft] Fix a crash in branch elimination

Browse Source 
The current reduction of blocks that are branch targets with a known
condition assumes that this is the first time we're seeing the given
condition with the given value. That's no longer the case, so updating
the expectation accordingly.

Bug: chromium:1399627
Change-Id: Id84d80a38801cf6178b476e62160d616b948d8d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096984
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84780}
This commit is contained in:
Maya Lekova 2022-12-12 14:25:58 +01:00 committed by V8 LUCI CQ
parent d1d100d4ef
commit 10ae2e4a59
2 changed files with 21 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/compiler/turboshaft/branch-elimination-reducer.h
View File

@ -205,7 +205,9 @@ class BranchEliminationReducer : public Next {
if (const BranchOp* branch = op.TryCast<BranchOp>()) {
DCHECK_EQ(new_block, any_of(branch->if_true, branch->if_false));
bool condition_value = branch->if_true == new_block;
known_conditions_.InsertNewKey(branch->condition(), condition_value);
if (!known_conditions_.Contains(branch->condition())) {
known_conditions_.InsertNewKey(branch->condition(), condition_value);
}
}
}
}

18
test/mjsunit/compiler/regress-crbug-1399627.js Normal file
View File

@ -0,0 +1,18 @@
// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
function foo(arr, value) {
if (arr !== value) throw new Error('bad value: ' + arr);
}
function slice_array(arr) {
return arr.slice();
}
for (var i = 0; i < 1e5; ++i) {
var arr = [];
var sliced = slice_array(arr);
foo(arr !== sliced, true);
try {
foo(sliced.length);
} catch (e) {}
}