AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[TurboFan] investigate a crash in GenerateDeoptimizationData

Browse Source 
We know the array CodeGenerator::deoptimization_literals_ is corrupted
somehow. Additional checks in place to validate.

Bug: chromium:1027130
Change-Id: Ie0146003f096d24e67aeb382372bca8472548c2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182636
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67641}
This commit is contained in:
Mike Stanton 2020-05-07 09:52:21 +02:00 committed by Commit Bot
parent d64bcab369
commit ee0c1b0e4d
2 changed files with 20 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/compiler/backend/code-generator.cc
View File

@ -996,8 +996,10 @@ void CodeGenerator::RecordCallPosition(Instruction* instr) {
}
int CodeGenerator::DefineDeoptimizationLiteral(DeoptimizationLiteral literal) {
literal.Validate();
int result = static_cast<int>(deoptimization_literals_.size());
for (unsigned i = 0; i < deoptimization_literals_.size(); ++i) {
deoptimization_literals_[i].Validate();
if (deoptimization_literals_[i] == literal) return i;
}
deoptimization_literals_.push_back(literal);
@ -1349,6 +1351,7 @@ OutOfLineCode::OutOfLineCode(CodeGenerator* gen)
OutOfLineCode::~OutOfLineCode() = default;
Handle<Object> DeoptimizationLiteral::Reify(Isolate* isolate) const {
Validate();
switch (kind_) {
case DeoptimizationLiteralKind::kObject: {
return object_;
@ -1359,6 +1362,9 @@ Handle<Object> DeoptimizationLiteral::Reify(Isolate* isolate) const {
case DeoptimizationLiteralKind::kString: {
return string_->AllocateStringConstant(isolate);
}
case DeoptimizationLiteralKind::kInvalid: {
UNREACHABLE();
}
}
UNREACHABLE();
}

17
src/compiler/backend/code-generator.h
View File

@ -51,12 +51,16 @@ class InstructionOperandIterator {
size_t pos_;
};
enum class DeoptimizationLiteralKind { kObject, kNumber, kString };
enum class DeoptimizationLiteralKind { kObject, kNumber, kString, kInvalid };
// Either a non-null Handle<Object>, a double or a StringConstantBase.
class DeoptimizationLiteral {
public:
DeoptimizationLiteral() : object_(), number_(0), string_(nullptr) {}
DeoptimizationLiteral()
: kind_(DeoptimizationLiteralKind::kInvalid),
object_(),
number_(0),
string_(nullptr) {}
explicit DeoptimizationLiteral(Handle<Object> object)
: kind_(DeoptimizationLiteralKind::kObject), object_(object) {
CHECK(!object_.is_null());
@ -77,7 +81,14 @@ class DeoptimizationLiteral {
Handle<Object> Reify(Isolate* isolate) const;
DeoptimizationLiteralKind kind() const { return kind_; }
void Validate() const {
CHECK_NE(kind_, DeoptimizationLiteralKind::kInvalid);
}
DeoptimizationLiteralKind kind() const {
Validate();
return kind_;
}
private:
DeoptimizationLiteralKind kind_;