AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turboshaft] Fix incorrect jumps into loops in Turboshaft's DCE

Browse Source 
Bug: v8:12783
Fixed: chromium:1407342, chromium:1407338
Change-Id: I5081e6f45af36729b8fc8c01e952932c39be9a2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4197347
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85499}
This commit is contained in:
Nico Hartmann 2023-01-26 14:29:13 +01:00 committed by V8 LUCI CQ
parent f2ceafb732
commit 7f756058ab
2 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/compiler/turboshaft/dead-code-elimination-reducer.h
View File

@ -356,6 +356,18 @@ class DeadCodeAnalysis {
<< "\n";
}
// If this is a loop, we reset the control state to avoid jumps into the
// middle of the loop. In particular, this is required to prevent
// introducing new backedges when blocks towards the end of the loop body
// want to jump to a block at the beginning (past the header).
if (block.IsLoop()) {
control_state = ControlState::NotEliminatable();
if constexpr (trace_analysis) {
std::cout << "Block is loop header. Resetting control state: "
<< control_state << "\n";
}
}
// If this block is a merge and we don't have any live phis, it is a
// potential target for branch redirection.
if (block.IsLoopOrMerge()) {

13
src/compiler/turboshaft/optimization-phase.h
View File

@ -317,10 +317,15 @@ class GraphVisitor {
*base::Reversed(input_graph().operations(*input_block)).begin();
if (auto* final_goto = last_op.TryCast<GotoOp>()) {
if (final_goto->destination->IsLoop()) {
Block* new_loop = MapToNewGraph(final_goto->destination->index());
DCHECK(new_loop->IsLoop());
if (new_loop->IsLoop() && new_loop->PredecessorCount() == 1) {
output_graph_.TurnLoopIntoMerge(new_loop);
if (input_block->index() > final_goto->destination->index()) {
Block* new_loop = MapToNewGraph(final_goto->destination->index());
DCHECK(new_loop->IsLoop());
if (new_loop->IsLoop() && new_loop->PredecessorCount() == 1) {
output_graph_.TurnLoopIntoMerge(new_loop);
}
} else {
// We have a forward jump to a loop, rather than a backedge. We
// don't need to do anything.
}
}
}