Version 6.6.346.19 (cherry-pick)
Merged 221173eaa222a23041f00f02ad9da812d1027e49
[turbofan] handle DeadValue in JSCreateArguments lowering
R=jarin@chromium.org
Bug: chromium:819311, v8:7536
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I76b1c0d067cca47abb92e2f14b516e6414c6a86a
Reviewed-on: https://chromium-review.googlesource.com/991473
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#37}
Cr-Branched-From: d500271571b92cb18dcd7b15885b51e8f437d640-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b635f8761df7c89eb4e8ec9c1a6ebee184-refs/heads/master@{#51624}diff --git a/include/v8-version.h b/include/v8-version.h
index 54946a2..9d71092 100644
--- a/include/v8-version.h
+++ b/include/v8-version.h
@@ -11,7 +11,7 @@
#define V8_MAJOR_VERSION 6
#define V8_MINOR_VERSION 6
#define V8_BUILD_NUMBER 346
-#define V8_PATCH_LEVEL 18
+#define V8_PATCH_LEVEL 19
// Use 1 for candidates and 0 otherwise.
// (Boolean macro values are not supported by all preprocessors.)
diff --git a/src/compiler/js-create-lowering.cc b/src/compiler/js-create-lowering.cc
index f8ada90..f535b52 100644
--- a/src/compiler/js-create-lowering.cc
+++ b/src/compiler/js-create-lowering.cc
@@ -350,6 +350,13 @@
// whether there conceptually is an arguments adaptor frame in the call
// chain.
Node* const args_state = GetArgumentsFrameState(frame_state);
+ if (args_state->InputAt(kFrameStateParametersInput)->opcode() ==
+ IrOpcode::kDeadValue) {
+ // This protects against an incompletely propagated DeadValue node.
+ // If the FrameState has a DeadValue input, then this node will be
+ // pruned anyway.
+ return NoChange();
+ }
FrameStateInfo args_state_info = OpParameter<FrameStateInfo>(args_state);
// Prepare element backing store to be used by arguments object.
bool has_aliased_arguments = false;
@@ -383,6 +390,13 @@
// whether there conceptually is an arguments adaptor frame in the call
// chain.
Node* const args_state = GetArgumentsFrameState(frame_state);
+ if (args_state->InputAt(kFrameStateParametersInput)->opcode() ==
+ IrOpcode::kDeadValue) {
+ // This protects against an incompletely propagated DeadValue node.
+ // If the FrameState has a DeadValue input, then this node will be
+ // pruned anyway.
+ return NoChange();
+ }
FrameStateInfo args_state_info = OpParameter<FrameStateInfo>(args_state);
// Prepare element backing store to be used by arguments object.
Node* const elements = AllocateArguments(effect, control, args_state);
@@ -412,6 +426,13 @@
// whether there conceptually is an arguments adaptor frame in the call
// chain.
Node* const args_state = GetArgumentsFrameState(frame_state);
+ if (args_state->InputAt(kFrameStateParametersInput)->opcode() ==
+ IrOpcode::kDeadValue) {
+ // This protects against an incompletely propagated DeadValue node.
+ // If the FrameState has a DeadValue input, then this node will be
+ // pruned anyway.
+ return NoChange();
+ }
FrameStateInfo args_state_info = OpParameter<FrameStateInfo>(args_state);
// Prepare element backing store to be used by the rest array.
Node* const elements =
