• Leszek Swirski's avatar
    [maglev] Fix lifetime extension of generator values · dd6fa2d1
    Leszek Swirski authored
    Loop used value lifetimes extension extends the lifetime of anything
    used inside of a loop but defined outside of it, to make sure that it is
    considered 'live' for the entire body of the loop (this is so that we
    don't e.g. clobber their stack slots with stack slot reuse).
    
    The implementation works on the principle that a) basic blocks are
    topologically sorted by forward control flow, and b) loops are
    irreducible. This means that basic blocks between a loop header and the
    jump to that loop header are inside the loop, and nodes whose id
    preceeds the loop header's id must be before the loop.
    
    Generator resumes break this irreducibility by jumping into the middle
    of loops. This is principally not a problem for the above lifetime
    extension, it just means that the loop's used nodes will overapproximate
    and include these generator nodes. However, there was an implicit
    additional assumption that the node must be loadable by the loop end, to
    extend its lifetime. This fails for the generator resume case, because
    it's possible that the node didn't make it into any loop merge state,
    e.g. because the resume would immediately deopt or return, e.g.
    
                     Start
                     /   \
                    /   GeneratorResume
                    |         |
                    v         |
               .>Loop header  |
              |     |         |
              |   Branch      |
              |   |    |      |
              |   |  Suspend  |
              |   |           |
              |   |  Resume <-'
              |   |    |
              |   |  Return
              |   v
              `--JumpLoop
    
    Here the Resume will get the accumulator from the generator and the
    Return will use it, which will be seen as an out-of-loop use of the
    generator, but the generator was never reachable from the "real" loop
    body.
    
    At the end of the day, since there are no actual uses of the generator
    value in the loop body, the lifetime extension does no harm; all that
    fails is a DCHECK that the values loop lifetime extension extends are
    actually loadable. So, we can relax this DCHECK for this specific
    generator edge case, by checking for whether the JumpLoop is reachable
    from the generator resume.
    
    Bug: v8:7700
    Change-Id: Iec4db2aee5b8812de61c3afb9004c8be3982baa2
    Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3890975
    Auto-Submit: Leszek Swirski <leszeks@chromium.org>
    Reviewed-by: 's avatarJakob Linke <jgruber@chromium.org>
    Commit-Queue: Jakob Linke <jgruber@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#83144}
    dd6fa2d1
Name
Last commit
Last update
..
api Loading commit data...
asmjs Loading commit data...
ast Loading commit data...
base Loading commit data...
baseline Loading commit data...
bigint Loading commit data...
builtins Loading commit data...
codegen Loading commit data...
common Loading commit data...
compiler Loading commit data...
compiler-dispatcher Loading commit data...
d8 Loading commit data...
date Loading commit data...
debug Loading commit data...
deoptimizer Loading commit data...
diagnostics Loading commit data...
execution Loading commit data...
extensions Loading commit data...
flags Loading commit data...
handles Loading commit data...
heap Loading commit data...
ic Loading commit data...
init Loading commit data...
inspector Loading commit data...
interpreter Loading commit data...
json Loading commit data...
libplatform Loading commit data...
libsampler Loading commit data...
logging Loading commit data...
maglev Loading commit data...
numbers Loading commit data...
objects Loading commit data...
parsing Loading commit data...
profiler Loading commit data...
protobuf Loading commit data...
regexp Loading commit data...
roots Loading commit data...
runtime Loading commit data...
sandbox Loading commit data...
sanitizer Loading commit data...
snapshot Loading commit data...
strings Loading commit data...
tasks Loading commit data...
temporal Loading commit data...
third_party Loading commit data...
torque Loading commit data...
tracing Loading commit data...
trap-handler Loading commit data...
utils Loading commit data...
wasm Loading commit data...
web-snapshot Loading commit data...
zone Loading commit data...
DEPS Loading commit data...
DIR_METADATA Loading commit data...
OWNERS Loading commit data...