AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[Liftoff] Correctly unuse Labels

Browse Source 
On Liftoff bailout, instead of binding all unbound labels (to avoid
triggering DCHECKS in their destructor), just Unuse them.

R=mstarzinger@chromium.org

Bug: chromium:924843
Change-Id: Icf581bca06eaa7369ab2bbd5d805112289d6a801
Reviewed-on: https://chromium-review.googlesource.com/c/1442645
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59172}
This commit is contained in:
Clemens Hammacher 2019-01-29 15:04:04 +01:00 committed by Commit Bot
parent b1224b7091
commit 3af3c9d100
2 changed files with 29 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/wasm/baseline/liftoff-compiler.cc
View File

@ -174,7 +174,7 @@ class LiftoffCompiler {
compilation_zone_(compilation_zone),
safepoint_table_builder_(compilation_zone_) {}
~LiftoffCompiler() { BindUnboundLabels(nullptr); }
~LiftoffCompiler() { UnuseLabels(nullptr); }
bool ok() const { return ok_; }
@ -199,7 +199,7 @@ class LiftoffCompiler {
TRACE("unsupported: %s\n", reason);
decoder->errorf(decoder->pc_offset(), "unsupported liftoff operation: %s",
reason);
BindUnboundLabels(decoder);
UnuseLabels(decoder);
}
bool DidAssemblerBailout(FullDecoder* decoder) {
@ -225,23 +225,21 @@ class LiftoffCompiler {
return safepoint_table_builder_.GetCodeOffset();
}
void BindUnboundLabels(FullDecoder* decoder) {
void UnuseLabels(FullDecoder* decoder) {
#ifdef DEBUG
// Bind all labels now, otherwise their destructor will fire a DCHECK error
auto Unuse = [](Label* label) {
label->Unuse();
label->UnuseNear();
};
// Unuse all labels now, otherwise their destructor will fire a DCHECK error
// if they where referenced before.
uint32_t control_depth = decoder ? decoder->control_depth() : 0;
for (uint32_t i = 0; i < control_depth; ++i) {
Control* c = decoder->control_at(i);
Label* label = c->label.get();
if (!label->is_bound()) __ bind(label);
if (c->else_state) {
Label* else_label = c->else_state->label.get();
if (!else_label->is_bound()) __ bind(else_label);
}
}
for (auto& ool : out_of_line_code_) {
if (!ool.label.get()->is_bound()) __ bind(ool.label.get());
Unuse(c->label.get());
if (c->else_state) Unuse(c->else_state->label.get());
}
for (auto& ool : out_of_line_code_) Unuse(ool.label.get());
#endif
}
@ -451,7 +449,7 @@ class LiftoffCompiler {
void OnFirstError(FullDecoder* decoder) {
ok_ = false;
BindUnboundLabels(decoder);
UnuseLabels(decoder);
asm_.AbortCompilation();
}

17
test/mjsunit/regress/wasm/regress-924843.js Normal file
View File

@ -0,0 +1,17 @@
// Copyright 2019 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
load('test/mjsunit/wasm/wasm-constants.js');
load('test/mjsunit/wasm/wasm-module-builder.js');
const builder = new WasmModuleBuilder();
const sig = builder.addType(makeSig([kWasmI32, kWasmI32, kWasmI32], [kWasmI32]));
builder.addFunction(undefined, sig)
.addBody([
kExprGetLocal, 2,
kExprIf, kWasmStmt,
kExprBlock, kWasmStmt
]);
builder.addExport('main', 0);
assertThrows(() => builder.instantiate(), WebAssembly.CompileError);