Skip to content

Conversation

bnoordhuis
Copy link
Member

@bnoordhuis bnoordhuis commented Jan 25, 2020

Original commit message:

Apply duct-tape to load elimination

Load elimination is running together with to dead code elimination,
the latter of which might eliminate allocations (in particular
FinishRegion nodes). These are treated as alias nodes by load
elimination, and load elimination does not immediatelly learn that
a node has been disconnected. This causes load elimination to access
the inputs of dead code eliminated nodes while resolving renames,
which causes nullptr dereferences.

This CL modifies load elimination to not resolve to a nullptr alias
but simply stop before that.

Change-Id: If4cef061c7c0e25f353727c9e27f790439b0beb5
Bug: chromium:906406
Reviewed-on: https://chromium-review.googlesource.com/c/1346491
Commit-Queue: Sigurd Schneider <[email protected]>
Reviewed-by: Jaroslav Sevcik <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57688}

Fixes: #31484
V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/2819/

@bnoordhuis bnoordhuis requested a review from targos January 25, 2020 10:40
@nodejs-github-bot nodejs-github-bot added v10.x v8 engine Issues and PRs related to the V8 dependency. labels Jan 25, 2020
@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

@bnoordhuis
Copy link
Member Author

The reporter of #31484 tried out this patch but he's unfortunately still seeing the crash. This PR fixes a crash though - the V8 regression test crashes without the fix and passes with.

I'll update the commit log.

Original commit message:

    Apply duct-tape to load elimination

    Load elimination is running together with to dead code elimination,
    the latter of which might eliminate allocations (in particular
    FinishRegion nodes). These are treated as alias nodes by load
    elimination, and load elimination does not immediatelly learn that
    a node has been disconnected. This causes load elimination to access
    the inputs of dead code eliminated nodes while resolving renames,
    which causes nullptr dereferences.

    This CL modifies load elimination to not resolve to a nullptr alias
    but simply stop before that.

    Change-Id: If4cef061c7c0e25f353727c9e27f790439b0beb5
    Bug: chromium:906406
    Reviewed-on: https://chromium-review.googlesource.com/c/1346491
    Commit-Queue: Sigurd Schneider <[email protected]>
    Reviewed-by: Jaroslav Sevcik <[email protected]>
    Cr-Commit-Position: refs/heads/master@{nodejs#57688}
@bnoordhuis
Copy link
Member Author

Closing in favor of #31613. I reviewed load-elimination.cc and there were more places that had the same bug.

@bnoordhuis bnoordhuis closed this Feb 2, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
v8 engine Issues and PRs related to the V8 dependency.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants