AuroraMiddleware/v8
1
0
Fork 0
Code Issues 2 Pull Requests Releases Wiki Activity

[turbofan] Do not optimize Trap with siblings inside If

Browse Source 
Trying to optimize in such case breaks down the optimization, as we
end up with potentially non-eliminatable nodes that depend on the dead
IfTrue/IfFalse node.
Drive-by: Clean up dead nodes with {Kill()}.

Bug: v8:11510, chromium:1255354

Change-Id: Ia89fe6c243974c3c2abac6ad80bd4677a935f637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3200073
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77211}
This commit is contained in:
Manos Koukoutos 2021-10-04 06:14:17 +00:00 committed by V8 LUCI CQ
parent 131c0055c9
commit efd42d689f
2 changed files with 34 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/compiler/branch-elimination.cc
View File

@ -222,6 +222,7 @@ bool BranchElimination::TryPullTrapIntoMerge(Node* node) {
merge->ReplaceInput(i, new_merge_inputs[i]);
}
ReplaceWithValue(node, dead(), dead(), merge);
node->Kill();
Revisit(merge);
return true;
@ -252,8 +253,8 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
if (from_input.LookupCondition(condition, &previous_branch,
&condition_value)) {
if (condition_value == trapping_condition) {
// Special case: Trap directly inside a branch. Replace the branch with
// the trap.
// Special case: Trap directly inside a branch without sibling nodes.
// Replace the branch with the trap.
// condition control condition control
// | \ / \ /
// | Branch TrapIf
@ -265,7 +266,8 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
// <subgraph1> <subgraph1>
// (and symmetrically for TrapUnless.)
if ((control_input->opcode() == IrOpcode::kIfTrue ||
control_input->opcode() == IrOpcode::kIfFalse)) {
control_input->opcode() == IrOpcode::kIfFalse) &&
control_input->UseCount() == 1) {
Node* branch = NodeProperties::GetControlInput(control_input);
DCHECK_EQ(branch->opcode(), IrOpcode::kBranch);
if (condition == NodeProperties::GetValueInput(branch, 0)) {
@ -279,6 +281,9 @@ Reduction BranchElimination::ReduceTrapConditional(Node* node) {
NodeProperties::GetControlInput(branch));
ReplaceWithValue(node, dead(), dead(), dead());
ReplaceWithValue(other_if_branch, node, node, node);
other_if_branch->Kill();
control_input->Kill();
branch->Kill();
return Changed(node);
}
}

26
test/mjsunit/regress/wasm/regress-1255354.js Normal file
View File

@ -0,0 +1,26 @@
// Copyright 2021 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
//
// Flags: --no-liftoff
load("test/mjsunit/wasm/wasm-module-builder.js");
var builder = new WasmModuleBuilder();
builder.addMemory(1, 1, /* exported = */ false);
builder.addFunction("main", kSig_i_i).addBody([
kExprLocalGet, 0,
kExprIf, kWasmI32,
kExprLocalGet, 0,
kExprElse,
kExprI32Const, 42, // value
kExprI32Const, 0, // index
kExprI32StoreMem, 0, 0,
kExprI32Const, 11,
kExprLocalGet, 0,
kExprI32DivS,
kExprEnd
]).exportFunc();
var instance = builder.instantiate({});