[turbofan] Fix ASAN bug in escape analysis

src/compiler/escape-analysis.cc

 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "src/compiler/escape-analysis.h"
 
 #include "src/base/flags.h"
 #include "src/bootstrapper.h"
 #include "src/compilation-dependencies.h"
 #include "src/compiler/common-operator.h"
@@ skipping 372 matching lines @@
         } else {
           GetFields(cache->objects(), cache->fields(), i);
           if (cache->fields().size() == cache->objects().size()) {
             Node* rep = mergeObject->GetField(i);
             if (!rep || !mergeObject->IsCreatedPhi(i)) {
               cache->fields().push_back(control);
               Node* phi =
                   graph->NewNode(common->Phi(MachineRepresentation::kTagged, 2),
                                  static_cast<int>(cache->fields().size()),
                                  &cache->fields().front());
-              if (mergeObject->SetField(i, phi, true)) {
-                if (FLAG_trace_turbo_escape) {
-                  PrintF("    Creating Phi #%d as merge of", phi->id());
-                  for (size_t i = 0; i + 1 < cache->fields().size(); i++) {
-                    PrintF(" #%d (%s)", cache->fields()[i]->id(),
-                           cache->fields()[i]->op()->mnemonic());
-                  }
-                  PrintF("\n");
+              DCHECK(mergeObject->SetField(i, phi, true));
+              if (FLAG_trace_turbo_escape) {
+                PrintF("    Creating Phi #%d as merge of", phi->id());
+                for (size_t i = 0; i + 1 < cache->fields().size(); i++) {
+                  PrintF(" #%d (%s)", cache->fields()[i]->id(),
+                         cache->fields()[i]->op()->mnemonic());
                 }
-                changed = true;
+                PrintF("\n");
               }
+              changed = true;
             } else {
               DCHECK(rep->opcode() == IrOpcode::kPhi);
               for (size_t n = 0; n < cache->fields().size(); ++n) {
                 Node* old =
                     NodeProperties::GetValueInput(rep, static_cast<int>(n));
                 if (old != cache->fields()[n]) {
                   changed = true;
                   NodeProperties::ReplaceValueInput(rep, cache->fields()[n],
                                                     static_cast<int>(n));
                 }
@@ skipping 23 matching lines @@
 
 
 // ------------------------------EscapeStatusAnalysis---------------------------
 
 
 EscapeStatusAnalysis::EscapeStatusAnalysis(EscapeAnalysis* object_analysis,
                                            Graph* graph, Zone* zone)
     : object_analysis_(object_analysis),
       graph_(graph),
       zone_(zone),
-      info_(zone),
-      queue_(zone) {
-  info_.resize(graph->NodeCount());
-}
+      info_(graph->NodeCount(), kUnknown, zone),
+      queue_(zone) {}
 
 
 EscapeStatusAnalysis::~EscapeStatusAnalysis() {}
 
 
 bool EscapeStatusAnalysis::HasEntry(Node* node) {
   return info_[node->id()] != kUnknown;
 }
 
 
 bool EscapeStatusAnalysis::IsVirtual(Node* node) {
-  if (node->id() >= info_.size()) {
-    return false;

[sigurds, 2015/12/17 10:16:32]

I'm removing this check here, because the class has the invariant that info_ has
entries for all nodes in the graph (even phis that get created by the analysis).

-  }
   return info_[node->id()] == kVirtual;
 }
 
 
 bool EscapeStatusAnalysis::IsEscaped(Node* node) {
   return info_[node->id()] == kEscaped;
 }
 
 
 bool EscapeStatusAnalysis::IsAllocation(Node* node) {
   return node->opcode() == IrOpcode::kAllocate ||
          node->opcode() == IrOpcode::kFinishRegion;
 }
 
 
 bool EscapeStatusAnalysis::SetEscaped(Node* node) {
   bool changed = info_[node->id()] != kEscaped;
   info_[node->id()] = kEscaped;
   return changed;
 }
 
 
+void EscapeStatusAnalysis::Resize() {
+  info_.resize(graph()->NodeCount(), kUnknown);
+}
+
+
+size_t EscapeStatusAnalysis::size() { return info_.size(); }
+
+
 void EscapeStatusAnalysis::Run() {
-  info_.resize(graph()->NodeCount());
+  Resize();
   ZoneVector<bool> visited(zone());
   visited.resize(graph()->NodeCount());
   queue_.push_back(graph()->end());
   while (!queue_.empty()) {
     Node* node = queue_.front();
     queue_.pop_front();
     Process(node);
     if (!visited[node->id()]) {
       RevisitInputs(node);
     }
@@ skipping 461 matching lines @@
   changed = mergeState->MergeFrom(&cache_, zone(), graph(), common(),
                                   NodeProperties::GetControlInput(node)) ||
             changed;
 
   if (FLAG_trace_turbo_escape) {
     PrintF("Merge %s the node.\n", changed ? "changed" : "did not change");
   }
 
   if (changed) {
     mergeState->LastChangedAt(node);
+    escape_status_.Resize();
   }
   return changed;
 }
 
 
 void EscapeAnalysis::ProcessAllocation(Node* node) {
   DCHECK_EQ(node->opcode(), IrOpcode::kAllocate);
   ForwardVirtualState(node);
 
   // Check if we have already processed this node.
@@ skipping 85 matching lines @@
   Node* node = nullptr;
   while (replacement(id)) {
     node = replacement(id);
     id = node->id();
   }
   return node;
 }
 
 
 bool EscapeAnalysis::IsVirtual(Node* node) {
+  if (node->id() >= escape_status_.size()) {
+    return false;

[sigurds, 2015/12/17 10:16:32]

IsVirtual and IsEscaped below are public methods that may get called after the
graph has been further modified, hence the check is needed here.

+  }
   return escape_status_.IsVirtual(node);
 }
 
 
 bool EscapeAnalysis::IsEscaped(Node* node) {
+  if (node->id() >= escape_status_.size()) {
+    return false;
+  }
   return escape_status_.IsEscaped(node);
 }
 
 
 bool EscapeAnalysis::SetEscaped(Node* node) {
   return escape_status_.SetEscaped(node);
 }
 
 
 VirtualObject* EscapeAnalysis::GetVirtualObject(Node* at, NodeId id) {
@@ skipping 36 matching lines @@
   GetVirtualObjects(state, inputs, cache_.objects());
   if (cache_.objects().size() == inputs.size()) {
     GetFields(cache_.objects(), cache_.fields(), offset);
     if (cache_.fields().size() == cache_.objects().size()) {
       Node* rep = replacement(node);
       if (!rep || !IsEquivalentPhi(rep, cache_.fields())) {
         cache_.fields().push_back(NodeProperties::GetControlInput(from));
         Node* phi = graph()->NewNode(
             common()->Phi(MachineRepresentation::kTagged, 2),
             static_cast<int>(cache_.fields().size()), &cache_.fields().front());
+        escape_status_.Resize();
         SetReplacement(node, phi);
         state->LastChangedAt(node);
         if (FLAG_trace_turbo_escape) {
           PrintF(" got phi created.\n");
         }
       } else if (FLAG_trace_turbo_escape) {
         PrintF(" has already phi #%d.\n", rep->id());
       }
     } else if (FLAG_trace_turbo_escape) {
       PrintF(" has incomplete field info.\n");
@@ skipping 159 matching lines @@
     }
   }
   for (size_t n = 0; n < object_states.size(); n++) {
     DebugPrintState(object_states[n]);
   }
 }
 
 }  // namespace compiler
 }  // namespace internal
 }  // namespace v8