v8: fix load elimination liveness checks

This commit back-ports the implementations of IsRename() and MayAlias() from the upstream 8.0 branch wholesale. Fixes several bugs where V8's load elimination pass considered values to be alive when they weren't. Fixes: #31484 PR-URL: #31613 Reviewed-By: James M Snell <[email protected]> Reviewed-By: Beth Griggs <[email protected]>

Author: bnoordhuis

deps/v8/src/compiler/load-elimination.cc

@@ -21,7 +21,7 @@ bool IsRename(Node* node){
 switch (node->opcode()){
 case IrOpcode::kFinishRegion:
 case IrOpcode::kTypeGuard:
-returntrue;
+return!node->IsDead();
 default:
 returnfalse;
  }
@@ -35,12 +35,14 @@ Node* ResolveRenames(Node* node){
 }
 
 boolMayAlias(Node* a, Node* b){
-if (a == b) returntrue;
-if (!NodeProperties::GetType(a).Maybe(NodeProperties::GetType(b))){
-returnfalse;
- }
-switch (b->opcode()){
-case IrOpcode::kAllocate:{
+if (a != b){
+if (!NodeProperties::GetType(a).Maybe(NodeProperties::GetType(b))){
+returnfalse;
+ } elseif (IsRename(b)){
+returnMayAlias(a, b->InputAt(0));
+ } elseif (IsRename(a)){
+returnMayAlias(a->InputAt(0), b);
+ } elseif (b->opcode() == IrOpcode::kAllocate){
 switch (a->opcode()){
 case IrOpcode::kAllocate:
 case IrOpcode::kHeapConstant:
@@ -49,30 +51,15 @@ bool MayAlias(Node* a, Node* b){
 default:
 break;
  }
-break;
- }
-case IrOpcode::kFinishRegion:
-case IrOpcode::kTypeGuard:
-returnMayAlias(a, b->InputAt(0));
-default:
-break;
- }
-switch (a->opcode()){
-case IrOpcode::kAllocate:{
+ } elseif (a->opcode() == IrOpcode::kAllocate){
 switch (b->opcode()){
 case IrOpcode::kHeapConstant:
 case IrOpcode::kParameter:
 returnfalse;
 default:
 break;
  }
-break;
  }
-case IrOpcode::kFinishRegion:
-case IrOpcode::kTypeGuard:
-returnMayAlias(a->InputAt(0), b);
-default:
-break;
  }
 returntrue;
 }

deps/v8/test/mjsunit/regress/regress-906406.js

@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for(x=0;x<10000;++x){
+[(x)=>x,[,4294967295].find((x)=>x),,2].includes('x',-0);
+}