AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turboshaft] Fix a crash in BranchEliminationReducer

Browse Source 
This CL allows GetPredecessorIndex gracefully fail when an indirect
predecessor of the current block is passed as an argument.

Bug: chromium:1408354
Change-Id: I5eaab6c6905839e5833faea5c4b0540e4a63699b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4191773
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85478}
This commit is contained in:
Maya Lekova 2023-01-25 14:46:27 +01:00 committed by V8 LUCI CQ
parent 20a954f4bc
commit 930b17be77
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/compiler/turboshaft/graph.h
View File

@ -312,6 +312,7 @@ class Block : public RandomAccessStackDominatorNode<Block> {
}
// Returns the index of {target} in the predecessors of the current Block.
// If {target} is not a direct predecessor, returns -1.
int GetPredecessorIndex(const Block* target) const {
int pred_count = 0;
int pred_reverse_index = -1;
@ -323,7 +324,9 @@ class Block : public RandomAccessStackDominatorNode<Block> {
}
pred_count++;
}
DCHECK_NE(pred_reverse_index, -1);
if (pred_reverse_index == -1) {
return -1;
}
return pred_count - pred_reverse_index - 1;
}