[turbofan] escape analysis: patch for wrong deopt info
Bug: chromium:713367 Change-Id: I3f5960f5b2da22c6468ca5a5ea9dc847b30c7fc7 Reviewed-on: https://chromium-review.googlesource.com/486360 Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org> Cr-Commit-Position: refs/heads/master@{#44862}
This commit is contained in:
parent
d049239ca6
commit
f431b597bf
@ -635,6 +635,11 @@ void EscapeStatusAnalysis::ResizeStatusVector() {
|
||||
size_t EscapeStatusAnalysis::GetStatusVectorSize() { return status_.size(); }
|
||||
|
||||
void EscapeStatusAnalysis::RunStatusAnalysis() {
|
||||
// TODO(tebbi): This checks for faulty VirtualObject states, which can happen
|
||||
// due to bug https://bugs.chromium.org/p/v8/issues/detail?id=6302. As a
|
||||
// workaround, we set everything to escaped if such a faulty state was
|
||||
// detected.
|
||||
bool all_objects_complete = object_analysis_->AllObjectsComplete();
|
||||
ResizeStatusVector();
|
||||
while (!status_stack_.empty()) {
|
||||
Node* node = status_stack_.back();
|
||||
@ -642,6 +647,7 @@ void EscapeStatusAnalysis::RunStatusAnalysis() {
|
||||
status_[node->id()] &= ~kOnStack;
|
||||
Process(node);
|
||||
status_[node->id()] |= kVisited;
|
||||
if (!all_objects_complete) SetEscaped(node);
|
||||
}
|
||||
}
|
||||
|
||||
@ -992,6 +998,25 @@ bool EscapeStatusAnalysis::IsNotReachable(Node* node) {
|
||||
return aliases_[node->id()] == kNotReachable;
|
||||
}
|
||||
|
||||
bool EscapeAnalysis::AllObjectsComplete() {
|
||||
for (VirtualState* state : virtual_states_) {
|
||||
if (state) {
|
||||
for (size_t i = 0; i < state->size(); ++i) {
|
||||
if (VirtualObject* object = state->VirtualObjectFromAlias(i)) {
|
||||
if (!object->AllFieldsClear()) {
|
||||
for (size_t i = 0; i < object->field_count(); ++i) {
|
||||
if (object->GetField(i) == nullptr) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
return true;
|
||||
}
|
||||
|
||||
void EscapeAnalysis::RunObjectAnalysis() {
|
||||
virtual_states_.resize(graph()->NodeCount());
|
||||
ZoneDeque<Node*> queue(zone());
|
||||
@ -1035,6 +1060,7 @@ void EscapeAnalysis::RunObjectAnalysis() {
|
||||
danglers.clear();
|
||||
}
|
||||
}
|
||||
|
||||
#ifdef DEBUG
|
||||
if (FLAG_trace_turbo_escape) {
|
||||
DebugPrint();
|
||||
@ -1700,6 +1726,8 @@ Node* EscapeAnalysis::GetOrCreateObjectState(Node* effect, Node* node) {
|
||||
for (size_t i = 0; i < vobj->field_count(); ++i) {
|
||||
if (Node* field = vobj->GetField(i)) {
|
||||
cache_->fields().push_back(ResolveReplacement(field));
|
||||
} else {
|
||||
return nullptr;
|
||||
}
|
||||
}
|
||||
int input_count = static_cast<int>(cache_->fields().size());
|
||||
|
@ -37,6 +37,7 @@ class V8_EXPORT_PRIVATE EscapeAnalysis {
|
||||
bool IsCyclicObjectState(Node* effect, Node* node);
|
||||
bool ExistsVirtualAllocate();
|
||||
bool SetReplacement(Node* node, Node* rep);
|
||||
bool AllObjectsComplete();
|
||||
|
||||
private:
|
||||
void RunObjectAnalysis();
|
||||
|
30
test/mjsunit/compiler/regress-713367.js
Normal file
30
test/mjsunit/compiler/regress-713367.js
Normal file
@ -0,0 +1,30 @@
|
||||
// Copyright 2017 the V8 project authors. All rights reserved.
|
||||
// Use of this source code is governed by a BSD-style license that can be
|
||||
// found in the LICENSE file.
|
||||
|
||||
// Flags: --allow-natives-syntax --turbo --turbo-escape
|
||||
|
||||
var mp = Object.getPrototypeOf(0);
|
||||
|
||||
function getRandomProperty(v) {
|
||||
var properties;
|
||||
if (mp) { properties = Object.getOwnPropertyNames(mp); }
|
||||
if (properties.includes("constructor") && v.constructor.hasOwnProperty()) {; }
|
||||
if (properties.length == 0) { return "0"; }
|
||||
return properties[NaN];
|
||||
}
|
||||
|
||||
var c = 0;
|
||||
|
||||
function f() {
|
||||
c++;
|
||||
if (c === 3) %OptimizeFunctionOnNextCall(f);
|
||||
if (c > 4) throw 42;
|
||||
for (var x of ["x"]) {
|
||||
getRandomProperty(0) ;
|
||||
f();
|
||||
%_DeoptimizeNow();
|
||||
}
|
||||
}
|
||||
|
||||
assertThrowsEquals(f, 42);
|
Loading…
Reference in New Issue
Block a user