Skip to content

Conversation

@bnoordhuis
Copy link
Member

@bnoordhuisbnoordhuis commented Jan 25, 2020

Original commit message:

Apply duct-tape to load elimination Load elimination is running together with to dead code elimination, the latter of which might eliminate allocations (in particular FinishRegion nodes). These are treated as alias nodes by load elimination, and load elimination does not immediatelly learn that a node has been disconnected. This causes load elimination to access the inputs of dead code eliminated nodes while resolving renames, which causes nullptr dereferences. This CL modifies load elimination to not resolve to a nullptr alias but simply stop before that. Change-Id: If4cef061c7c0e25f353727c9e27f790439b0beb5 Bug: chromium:906406 Reviewed-on: https://chromium-review.googlesource.com/c/1346491 Commit-Queue: Sigurd Schneider <[email protected]> Reviewed-by: Jaroslav Sevcik <[email protected]> Cr-Commit-Position: refs/heads/master@{#57688} 

Fixes: #31484
V8 CI: https://ci.nodejs.org/job/node-test-commit-v8-linux/2819/

@nodejs-github-botnodejs-github-bot added v10.x v8 engine Issues and PRs related to the V8 dependency. labels Jan 25, 2020
@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

@nodejs-github-bot
Copy link
Collaborator

@bnoordhuis
Copy link
MemberAuthor

The reporter of #31484 tried out this patch but he's unfortunately still seeing the crash. This PR fixes a crash though - the V8 regression test crashes without the fix and passes with.

I'll update the commit log.

Original commit message: Apply duct-tape to load elimination Load elimination is running together with to dead code elimination, the latter of which might eliminate allocations (in particular FinishRegion nodes). These are treated as alias nodes by load elimination, and load elimination does not immediatelly learn that a node has been disconnected. This causes load elimination to access the inputs of dead code eliminated nodes while resolving renames, which causes nullptr dereferences. This CL modifies load elimination to not resolve to a nullptr alias but simply stop before that. Change-Id: If4cef061c7c0e25f353727c9e27f790439b0beb5 Bug: chromium:906406 Reviewed-on: https://chromium-review.googlesource.com/c/1346491 Commit-Queue: Sigurd Schneider <[email protected]> Reviewed-by: Jaroslav Sevcik <[email protected]> Cr-Commit-Position: refs/heads/master@{nodejs#57688}
@bnoordhuis
Copy link
MemberAuthor

Closing in favor of #31613. I reviewed load-elimination.cc and there were more places that had the same bug.

Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

v8 engineIssues and PRs related to the V8 dependency.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants

@bnoordhuis@nodejs-github-bot@addaleax@devnexen@sigurdschneider