Reviewers: Kevin Millikin,
Description:
Fix a bug with uninitialized const variables in the optimizing compiler.
We have to check for uninitialized uses before phi-elimination. Otherwise we
may miss such a use and result in using the hole value instead. This
causes a NULL-dereference or assertion failure.
BUG=96989
TEST=mjsunit/compiler/regress-96989.js
Please review this at http://codereview.chromium.org/7974009/
SVN Base: http://v8.googlecode.com/svn/branches/bleeding_edge/
Affected files:
M src/hydrogen.h
M src/hydrogen.cc
A test/mjsunit/compiler/regress-96989.js
Index: src/hydrogen.cc
===================================================================
--- src/hydrogen.cc (revision 9329)
+++ src/hydrogen.cc (working copy)
@@ -859,26 +859,25 @@
HPhi* phi = blocks_[i]->phis()->at(j);
// We don't support phi uses of arguments for now.
if (phi->CheckFlag(HValue::kIsArguments)) return false;
+ // Check for the hole value (from an uninitialized const).
+ for (int k = 0; k < phi->OperandCount(); k++) {
+ if (phi->OperandAt(k) == GetConstantHole()) return false;
+ }
}
}
return true;
}
-bool HGraph::CollectPhis() {
+void HGraph::CollectPhis() {
int block_count = blocks_.length();
phi_list_ = new ZoneList<HPhi*>(block_count);
for (int i = 0; i < block_count; ++i) {
for (int j = 0; j < blocks_[i]->phis()->length(); ++j) {
HPhi* phi = blocks_[i]->phis()->at(j);
phi_list_->Add(phi);
- // Check for the hole value (from an uninitialized const).
- for (int k = 0; k < phi->OperandCount(); k++) {
- if (phi->OperandAt(k) == GetConstantHole()) return false;
- }
}
}
- return true;
}
@@ -2329,16 +2328,13 @@
#endif
graph()->PropagateDeoptimizingMark();
- graph()->EliminateRedundantPhis();
if (!graph()->CheckPhis()) {
- Bailout("Unsupported phi use of arguments object");
+ Bailout("Unsupported phi use (arguments or const)");
return NULL;
}
+ graph()->EliminateRedundantPhis();
if (FLAG_eliminate_dead_phis) graph()->EliminateUnreachablePhis();
- if (!graph()->CollectPhis()) {
- Bailout("Unsupported phi use of uninitialized constant");
- return NULL;
- }
+ graph()->CollectPhis();
HInferRepresentation rep(graph());
rep.Analyze();
Index: src/hydrogen.h
===================================================================
--- src/hydrogen.h (revision 9329)
+++ src/hydrogen.h (working copy)
@@ -241,13 +241,11 @@
void ReplaceCheckedValues();
void PropagateDeoptimizingMark();
- // Returns false if there are phi-uses of the arguments-object
- // which are not supported by the optimizing compiler.
+ // Returns false if there are phi-uses of the arguments-object or an
+ // uninitialized const which are not supported by the optimizing
compiler.
bool CheckPhis();
- // Returns false if there are phi-uses of hole values comming
- // from uninitialized consts.
- bool CollectPhis();
+ void CollectPhis();
Handle<Code> Compile(CompilationInfo* info);
Index: test/mjsunit/compiler/regress-96989.js
===================================================================
--- test/mjsunit/compiler/regress-96989.js (revision 0)
+++ test/mjsunit/compiler/regress-96989.js (revision 0)
@@ -0,0 +1,43 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+// Flags: --allow-natives-syntax
+
+// Test correct handling of uninitialized const.
+
+function test() {
+ for (var i = 41; i < 42; i++) {
+ var c = t ^ i;
+ }
+ const t;
+ return c;
+}
+
+for (var i=0; i<10; i++) test();
+%OptimizeFunctionOnNextCall(test);
+assertEquals(41, test());
Property changes on: test/mjsunit/compiler/regress-96989.js
___________________________________________________________________
Added: svn:eol-style
+ LF
--
v8-dev mailing list
[email protected]
http://groups.google.com/group/v8-dev
