Chromium Code Reviews
Help | Chromium Project | Gerrit Changes | Sign in
(4)

Issue 1740123002: [turbofan] Bailout if LoadBuffer typing assumption doesn't hold. (Closed)

Created:
3 years, 6 months ago by Benedikt Meurer
Modified:
3 years, 6 months ago
CC:
v8-reviews_googlegroups.com, titzer
Base URL:
https://chromium.googlesource.com/v8/v8.git@master
Target Ref:
refs/pending/heads/master
Project:
v8
Visibility:
Public.

Description

[turbofan] Bailout if LoadBuffer typing assumption doesn't hold. The LoadBuffer operator that is used for asm.js heap access claims to return only the appropriate typed array type, but out of bounds access could make it return undefined. So far we tried to "repair" the graph later if we see that our assumption was wrong, and for various reasons that worked for some time. But now that wrong type information that is propagated earlier is picked up appropriately and thus we generate wrong code, i.e. we in the repro case we feed NaN into ChangeFloat64Uint32 and thus get 2147483648 instead of 0 (with proper JS truncation). This was always considered a temporary hack until we have a proper asm.js pipeline, but since we still run asm.js through the generic JavaScript pipeline, we have to address this now. Quickfix is to just bailout from the pipeline when we see that the LoadBuffer type was wrong, i.e. the result of LoadBuffer is not properly truncated and thus undefined or NaN would be observable. R=mstarzinger@chromium.org, jarin@chromium.org BUG=chromium:589792 LOG=y Committed: https://crrev.com/58ab990aa8c3aeee38e888c1c33404f4b5a14759 Cr-Commit-Position: refs/heads/master@{#34322}

Patch Set 1 #

Patch Set 2 : Remove outdated cementation tests. #

Patch Set 3 : comment #

Unified diffs Side-by-side diffs Delta from patch set Stats (+43 lines, -143 lines) Patch
M src/compiler/pipeline.cc View 2 chunks +10 lines, -0 lines 0 comments Download
M src/compiler/simplified-lowering.h View 1 2 1 chunk +5 lines, -0 lines 0 comments Download
M src/compiler/simplified-lowering.cc View 1 chunk +8 lines, -0 lines 0 comments Download
M test/cctest/cctest.gyp View 1 1 chunk +0 lines, -1 line 0 comments Download
D test/cctest/compiler/test-run-properties.cc View 1 1 chunk +0 lines, -142 lines 0 comments Download
A test/mjsunit/regress/regress-crbug-589792.js View 1 chunk +20 lines, -0 lines 0 comments Download

Messages

Total messages: 8 (2 generated)
Benedikt Meurer
3 years, 6 months ago (2016-02-26 10:14:51 UTC) #1
Benedikt Meurer
Hey Michi, Jaro, This is the back-mergable quick-fix that Michi suggested. It's the minimal thing ...
3 years, 6 months ago (2016-02-26 10:21:21 UTC) #2
Michael Starzinger
LGTM.
3 years, 6 months ago (2016-02-26 10:45:28 UTC) #3
commit-bot: I haz the power
CQ is trying da patch. Follow status at https://chromium-cq-status.appspot.com/patch-status/1740123002/40001 View timeline at https://chromium-cq-status.appspot.com/patch-timeline/1740123002/40001
3 years, 6 months ago (2016-02-26 10:46:01 UTC) #5
commit-bot: I haz the power
Committed patchset #3 (id:40001)
3 years, 6 months ago (2016-02-26 11:05:28 UTC) #6
commit-bot: I haz the power
3 years, 6 months ago (2016-02-26 11:06:34 UTC) #8
Message was sent while issue was closed.
Patchset 3 (id:??) landed as
https://crrev.com/58ab990aa8c3aeee38e888c1c33404f4b5a14759
Cr-Commit-Position: refs/heads/master@{#34322}

Powered by Google App Engine
This is Rietveld 408576698