github/electron
1
1
Fork 0
mirror of https://github.com/electron/electron.git synced 2026-04-10 03:01:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: [turbofan] Restrict redundancy elimination from widening types (#18569)

Browse Source
This commit is contained in:
Milan Burda
2019-06-04 10:57:22 +02:00
committed by Cheng Zhao
parent 7d164b3bcd
commit 3d3d97920e
2 changed files with 71 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
patches/common/v8/.patches
View File

@@ -20,3 +20,4 @@ expose_mksnapshot.patch
build-torque-with-x64-toolchain-on-arm.patch
do_not_run_arm_arm64_mksnapshot_binaries.patch
turbofan_fix_wrong_typing_of_speculativesafeintegersubtract.patch
turbofan_restrict_redundancy_elimination_from_widening_types.patch

70
patches/common/v8/turbofan_restrict_redundancy_elimination_from_widening_types.patch Normal file
View File

@@ -0,0 +1,70 @@
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
From: Sigurd Schneider <sigurds@chromium.org>
Date: Mon, 7 Jan 2019 15:11:31 +0100
Subject: [turbofan] Restrict redundancy elimination from widening types
This CL prevents redundancy elimination from widening types, which
can cause problems if the input of a DeadValue (which has type None)
is replaced by an equivalent node that does not have type None. This
can happen because load elimination does not re-type nodes, for
example.
Bug: chromium:919340
Change-Id: I89e872412edbcdc610e70ae160cde56cd045006c
Reviewed-on: https://chromium-review.googlesource.com/c/1397709
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58617}
diff --git a/src/compiler/redundancy-elimination.cc b/src/compiler/redundancy-elimination.cc
index 5ecef0408be4c849cccd695ccb8329ec7f27055e..8cc0501a22132e3c226294c53b047a473a8f9005 100644
--- a/src/compiler/redundancy-elimination.cc
+++ b/src/compiler/redundancy-elimination.cc
@@ -179,11 +179,22 @@ bool CheckSubsumes(Node const* a, Node const* b) {
return true;
}
+bool TypeSubsumes(Node* node, Node* replacement) {
+ if (!NodeProperties::IsTyped(node) || !NodeProperties::IsTyped(replacement)) {
+ // If either node is untyped, we are running during an untyped optimization
+ // phase, and replacement is OK.
+ return true;
+ }
+ Type node_type = NodeProperties::GetType(node);
+ Type replacement_type = NodeProperties::GetType(replacement);
+ return replacement_type.Is(node_type);
+}
+
} // namespace
Node* RedundancyElimination::EffectPathChecks::LookupCheck(Node* node) const {
for (Check const* check = head_; check != nullptr; check = check->next) {
- if (CheckSubsumes(check->node, node)) {
+ if (CheckSubsumes(check->node, node) && TypeSubsumes(node, check->node)) {
DCHECK(!check->node->IsDead());
return check->node;
}
diff --git a/test/mjsunit/regress/regress-919340.js b/test/mjsunit/regress/regress-919340.js
new file mode 100644
index 0000000000000000000000000000000000000000..900bf6fde2f56bc328a17995c18a2fabd3f1023b
--- /dev/null
+++ b/test/mjsunit/regress/regress-919340.js
@@ -0,0 +1,17 @@
+// Copyright 2019 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+var E = 'Σ';
+var PI = 123;
+function f() {
+ print(E = 2, /b/.test(E) || /b/.test(E = 2));
+ ((E = 3) * PI);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();