Skip to content

[v10.x] deps: V8: backport f27ac28

Rodrigo Muino Tomonari requested to merge github/fork/targos/fix-27107 into v10.x-staging

Fixes: https://github.com/nodejs/node/issues/27107

Original commit message:

[turbofan] Pin pure unreachable values to effect chain (in rep selection)

Currently, if we lower to a pure computation that is unreachable because
of some runtime check, we just rename it with DeadValue. This is
problematic if the pure computation gets later eliminated - that allows
the DeadValue node float above the check that makes it dead. As we
conservatively lower DeadValues to debug-break (i.e., crash), we
might induce crash where we should not.

With this CL, whenever we lower an impossible effectful node (i.e., with
Type::None) to a pure node in simplified lowering, we insert an
Unreachable node there (pinned to the effect chain) and mark the
impossible node dead (and make it depend on the Unreachable node).

Bug: chromium:910838
Change-Id: I218991c79b9e283a9dd5beb4d3f0c4664be76cb2
Reviewed-on: https://chromium-review.googlesource.com/c/1365274
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58066}

Refs: https://github.com/v8/v8/commit/f27ac2806c585d8b1e61ac16d78a2a396d536669

Merge request reports