Skip to content

[v10.x] deps: V8: backport f27ac28 - #28061

Closed
targos wants to merge 1 commit into
nodejs:v10.x-stagingfrom
targos:fix-27107
Closed

[v10.x] deps: V8: backport f27ac28#28061
targos wants to merge 1 commit into
nodejs:v10.x-stagingfrom
targos:fix-27107

Conversation

@targos

Copy link
Copy Markdown
Member

Fixes: #27107

Original commit message:

[turbofan] Pin pure unreachable values to effect chain (in rep selection)
Currently, if we lower to a pure computation that is unreachable because
of some runtime check, we just rename it with DeadValue. This is
problematic if the pure computation gets later eliminated - that allows
the DeadValue node float above the check that makes it dead. As we
conservatively lower DeadValues to debug-break (i.e., crash), we
might induce crash where we should not.
With this CL, whenever we lower an impossible effectful node (i.e., with
Type::None) to a pure node in simplified lowering, we insert an
Unreachable node there (pinned to the effect chain) and mark the
impossible node dead (and make it depend on the Unreachable node).
Bug: chromium:910838
Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2
Reviewed-on: https://chromium-review.googlesource.com/c/1365274
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58066}

Refs: v8/v8@f27ac28

Original commit message:
[turbofan] Pin pure unreachable values to effect chain (in rep selection)
Currently, if we lower to a pure computation that is unreachable because
of some runtime check, we just rename it with DeadValue. This is
problematic if the pure computation gets later eliminated - that allows
the DeadValue node float above the check that makes it dead. As we
conservatively lower DeadValues to debug-break (i.e., crash), we
might induce crash where we should not.
With this CL, whenever we lower an impossible effectful node (i.e., with
Type::None) to a pure node in simplified lowering, we insert an
Unreachable node there (pinned to the effect chain) and mark the
impossible node dead (and make it depend on the Unreachable node).
Bug: chromium:910838
Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2
Reviewed-on: https://chromium-review.googlesource.com/c/1365274
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{nodejs#58066}
Refs: v8/v8@f27ac28
@nodejs-github-bot

nodejs-github-bot commented Jun 4, 2019

Copy link
Copy Markdown
Collaborator

@targostargos added v10.x v8 engine Issues and PRs related to the V8 dependency. labels Jun 4, 2019

@gireeshpunathilgireeshpunathil left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RSLGTM

@nodejs-github-bot

Copy link
Copy Markdown
Collaborator

@mhdawsonmhdawson left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

RSLGTM

BethGriggs pushed a commit that referenced this pull request Jun 6, 2019
Original commit message:
[turbofan] Pin pure unreachable values to effect chain (in rep selection)
Currently, if we lower to a pure computation that is unreachable because
of some runtime check, we just rename it with DeadValue. This is
problematic if the pure computation gets later eliminated - that allows
the DeadValue node float above the check that makes it dead. As we
conservatively lower DeadValues to debug-break (i.e., crash), we
might induce crash where we should not.
With this CL, whenever we lower an impossible effectful node (i.e., with
Type::None) to a pure node in simplified lowering, we insert an
Unreachable node there (pinned to the effect chain) and mark the
impossible node dead (and make it depend on the Unreachable node).
Bug: chromium:910838
Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2
Reviewed-on: https://chromium-review.googlesource.com/c/1365274
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58066}
Refs: v8/v8@f27ac28
PR-URL: #28061Fixes: #27107
Reviewed-By: Gireesh Punathil <gpunathi@in.ibm.com>
Reviewed-By: Beth Griggs <Bethany.Griggs@uk.ibm.com>
Reviewed-By: Michael Dawson <michael_dawson@ca.ibm.com>
@BethGriggs

Copy link
Copy Markdown
Member

Landed on v10.x-staging

@targos
targos deleted the fix-27107 branch July 4, 2019 19:00
@BethGriggsBethGriggs mentioned this pull request Jul 17, 2019
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v8 engineIssues and PRs related to the V8 dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants

@targos@nodejs-github-bot@BethGriggs@gireeshpunathil@mhdawson