https://chromium.googlesource.com/v8/v8/+/f7cc70de2b41c2d1feb4b14f0d60e851f71953d0commit f7cc70de2b41c2d1feb4b14f0d60e851f71953d0
Author: Leszek Swirski <
les...@chromium.org>
Date: Thu Apr 21 12:20:07 2022
[maglev] Fix dead predecessors after EmitUnconditionalDeopt
Fixes the iteration after emitting an unconditional deopt to kill all
Jumps along the way, not just ones preceeding a merge point. This fixes
several issues:
a) That Jump may be to a not yet created merge point, in which case we
were getting a nullptr deref.
b) Not-yet created merge points would not be detected as merge points,
so we'd skip over them and miss killing the control node before
them.
c) We weren't reducing predecessor counts, so even after fixing the
nullptr deref above, merge states created later would have the wrong
predecessor count.
Now, we check bytecode targets (including fallthrough for non-returning
bytecodes) on for every bytecode, and skip over both not-yet created
merges, and loop merges that have no predecessors other than the loop
jump itself.
As part of this, the dead predecessor merging is changed; instead of
setting the predecessor to nullptr, we drop the predecessor count by
one, and trim any Phis' input counts.
Bug: v8:7700
Change-Id: I904c82df7c5dd44d7637e07f6750b35e7e219284
Reviewed-on:
https://chromium-review.googlesource.com/c/v8/v8/+/3599470Reviewed-by: Victor Gomes <
victo...@chromium.org>
Commit-Queue: Leszek Swirski <
les...@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80083}
[modify]
https://crrev.com/f7cc70de2b41c2d1feb4b14f0d60e851f71953d0/src/maglev/maglev-interpreter-frame-state.h[modify]
https://crrev.com/f7cc70de2b41c2d1feb4b14f0d60e851f71953d0/src/maglev/maglev-graph-builder.h[modify]
https://crrev.com/f7cc70de2b41c2d1feb4b14f0d60e851f71953d0/src/maglev/maglev-ir.h[modify]
https://crrev.com/f7cc70de2b41c2d1feb4b14f0d60e851f71953d0/src/maglev/maglev-graph-builder.cc