Commit 022e1a5f authored by Benedikt Meurer's avatar Benedikt Meurer Committed by Commit Bot

[turbofan] Properly deal with killed nodes in LoadElimination.

Depending on visitation order the LoadElimination might be find memoized
nodes in its state tables that were killed by other reducers in the mean
time. The LoadElimination must just ignore those stale entries.

Bug: chromium:820820
Change-Id: Ia62e401ff77da547ed215a14074e70aeb5c3a766
Reviewed-on: https://chromium-review.googlesource.com/958843Reviewed-by: 's avatarJaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51892}
parent ce14aec1
......@@ -329,6 +329,7 @@ void LoadElimination::AbstractElements::Print() const {
Node* LoadElimination::AbstractField::Lookup(Node* object) const {
for (auto pair : info_for_node_) {
if (pair.first->IsDead()) continue;
if (MustAlias(object, pair.first)) return pair.second.value;
}
return nullptr;
......@@ -364,6 +365,7 @@ LoadElimination::AbstractField const* LoadElimination::AbstractField::Kill(
const AliasStateInfo& alias_info, MaybeHandle<Name> name,
Zone* zone) const {
for (auto pair : this->info_for_node_) {
if (pair.first->IsDead()) continue;
if (alias_info.MayAlias(pair.first)) {
AbstractField* that = new (zone) AbstractField(zone);
for (auto pair : this->info_for_node_) {
......
......@@ -159,6 +159,7 @@ class V8_EXPORT_PRIVATE LoadElimination final
for (auto this_it : this->info_for_node_) {
Node* this_object = this_it.first;
Field this_second = this_it.second;
if (this_object->IsDead()) continue;
auto that_it = that->info_for_node_.find(this_object);
if (that_it != that->info_for_node_.end() &&
that_it->second == this_second) {
......
// Copyright 2018 the V8 project authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
// Flags: --allow-natives-syntax
function* generator() {
yield undefined;
}
function bar(x) {
const objects = [];
for (let obj of generator()) {
}
return objects[0];
}
function foo() {
try { undefined[0] = bar(); } catch (e) { }
Math.min(bar(), bar(), bar());
}
foo();
foo();
%OptimizeFunctionOnNextCall(foo);
foo();
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment