AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Properly filter dead checks in LoadElimination.

Browse Source 
Depending on the visitation order of the graph, we can have a dead
ArrayBufferWasNeutered check in the state table. This can only happen
when ArrayBuffers have been neutered in the isolate and there are loops
involved where the LoadEliminationPhase triggers revisitation in the
GraphReducer framework. With the most recent fix to the revisit queue
the original repro case no longer works, since it requires us to visit
an ArrayBufferWasNeutered node after a dominating one was killed.

Bug: chromium:741022
Change-Id: I3644bcf0ff7795289cc27d177ab5f6af32238a43
Reviewed-on: https://chromium-review.googlesource.com/579974
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46806}
This commit is contained in:
Benedikt Meurer 2017-07-21 05:38:34 +02:00 committed by Commit Bot
parent edc0eede74
commit 95fdc090ab
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/compiler/load-elimination.cc
View File

@ -146,7 +146,7 @@ bool IsCompatibleCheck(Node const* a, Node const* b) {
Node* LoadElimination::AbstractChecks::Lookup(Node* node) const {
for (Node* const check : nodes_) {
if (check && IsCompatibleCheck(check, node)) {
if (check && !check->IsDead() && IsCompatibleCheck(check, node)) {
return check;
}
}