Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[v10.x] deps: V8: backport f27ac28 #28061

Closed
wants to merge 1 commit into from

Conversation

@targos
Copy link
Member

commented Jun 4, 2019

Fixes: #27107

Original commit message:

[turbofan] Pin pure unreachable values to effect chain (in rep selection)

Currently, if we lower to a pure computation that is unreachable because
of some runtime check, we just rename it with DeadValue. This is
problematic if the pure computation gets later eliminated - that allows
the DeadValue node float above the check that makes it dead. As we
conservatively lower DeadValues to debug-break (i.e., crash), we
might induce crash where we should not.

With this CL, whenever we lower an impossible effectful node (i.e., with
Type::None) to a pure node in simplified lowering, we insert an
Unreachable node there (pinned to the effect chain) and mark the
impossible node dead (and make it depend on the Unreachable node).

Bug: chromium:910838
Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2
Reviewed-on: https://chromium-review.googlesource.com/c/1365274
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58066}

Refs: v8/v8@f27ac28

deps: V8: backport f27ac28
Original commit message:

    [turbofan] Pin pure unreachable values to effect chain (in rep selection)

    Currently, if we lower to a pure computation that is unreachable because
    of some runtime check, we just rename it with DeadValue. This is
    problematic if the pure computation gets later eliminated - that allows
    the DeadValue node float above the check that makes it dead. As we
    conservatively lower DeadValues to debug-break (i.e., crash), we
    might induce crash where we should not.

    With this CL, whenever we lower an impossible effectful node (i.e., with
    Type::None) to a pure node in simplified lowering, we insert an
    Unreachable node there (pinned to the effect chain) and mark the
    impossible node dead (and make it depend on the Unreachable node).

    Bug: chromium:910838
    Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2
    Reviewed-on: https://chromium-review.googlesource.com/c/1365274
    Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#58066}

Refs: v8/v8@f27ac28
@gireeshpunathil
Copy link
Member

left a comment

RSLGTM

@nodejs-github-bot

This comment has been minimized.

@mhdawson
Copy link
Member

left a comment

RSLGTM

BethGriggs added a commit that referenced this pull request Jun 6, 2019
deps: V8: backport f27ac28
Original commit message:

    [turbofan] Pin pure unreachable values to effect chain (in rep selection)

    Currently, if we lower to a pure computation that is unreachable because
    of some runtime check, we just rename it with DeadValue. This is
    problematic if the pure computation gets later eliminated - that allows
    the DeadValue node float above the check that makes it dead. As we
    conservatively lower DeadValues to debug-break (i.e., crash), we
    might induce crash where we should not.

    With this CL, whenever we lower an impossible effectful node (i.e., with
    Type::None) to a pure node in simplified lowering, we insert an
    Unreachable node there (pinned to the effect chain) and mark the
    impossible node dead (and make it depend on the Unreachable node).

    Bug: chromium:910838
    Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2
    Reviewed-on: https://chromium-review.googlesource.com/c/1365274
    Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
    Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
    Cr-Commit-Position: refs/heads/master@{#58066}

Refs: v8/v8@f27ac28

PR-URL: #28061
Fixes: #27107
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
@BethGriggs

This comment has been minimized.

Copy link
Member

commented Jun 6, 2019

Landed on v10.x-staging

@BethGriggs BethGriggs closed this Jun 6, 2019

@targos targos deleted the targos:fix-27107 branch Jul 4, 2019

@BethGriggs BethGriggs referenced this pull request Jul 17, 2019
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
5 participants
You can’t perform that action at this time.