AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Fix optimization of traps after if-nodes

Browse Source 
A TrapUnless after an IfTrue, and conversely, a TrapIf after an IfFalse,
should not optimize away the respective Branch node.

Bug: v8:12624
Change-Id: I250b2f84c38295ca35e440589901ed5a58bb4e75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3500303
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79349}
This commit is contained in:
Manos Koukoutos 2022-03-02 08:49:54 +00:00 committed by V8 LUCI CQ
parent 4db43bfa2f
commit 2ba409389c
2 changed files with 55 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/compiler/branch-elimination.cc
View File

@ -265,8 +265,10 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
// | |
// <subgraph1> <subgraph1>
// (and symmetrically for TrapUnless.)
if ((control_input->opcode() == IrOpcode::kIfTrue ||
control_input->opcode() == IrOpcode::kIfFalse) &&
if (((trapping_condition &&
control_input->opcode() == IrOpcode::kIfTrue) ||
(!trapping_condition &&
control_input->opcode() == IrOpcode::kIfFalse)) &&
control_input->UseCount() == 1) {
Node* branch = NodeProperties::GetControlInput(control_input);
DCHECK_EQ(branch->opcode(), IrOpcode::kBranch);

51
test/mjsunit/regress/wasm/regress-12624.js Normal file
View File

@ -0,0 +1,51 @@
// Copyright 2022 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --experimental-wasm-gc --no-liftoff
// Under certain conditions, the following subgraph was not optimized correctly:
// cond
// | \
// | Branch
// | / \
// | IfTrue IfFalse
// | |
// TrapUnless
d8.file.execute("test/mjsunit/wasm/wasm-module-builder.js");
var builder = new WasmModuleBuilder();
builder.addGlobal(kWasmI32, true, WasmInitExpr.I32Const(1));
builder.addFunction("main", kSig_i_i)
.addBody([
kExprLocalGet, 0,
kExprIf, kWasmI32,
kExprUnreachable,
kExprElse,
kExprLoop, kWasmVoid,
kExprBlock, kWasmVoid,
kExprLocalGet, 0,
kExprIf, kWasmVoid,
kExprLocalGet, 0,
kExprBrIf, 1,
kExprI32Const, 7,
kExprLocalSet, 0,
kExprEnd,
kExprGlobalGet, 0,
kExprIf, kWasmVoid,
kExprI32Const, 0, kExprReturn,
kExprEnd,
kExprBr, 1,
kExprEnd,
kExprEnd,
kExprI32Const, 0,
kExprEnd,
kExprLocalGet, 0,
kExprI32DivU])
.exportFunc();
let instance = builder.instantiate();
assertEquals(0, instance.exports.main(0));