commit f57c99fc31a76642d34941ec844da9de570334b3
author Alexander Markov <alexmarkov@google.com> Fri May 29 16:34:45 2020 +0000
committer commit-bot@chromium.org <commit-bot@chromium.org> Fri May 29 16:34:45 2020 +0000
tree 4579debfdd49f96b3b1e5a7ebdfd9b10eabe9de4
parent 6a551f8d54c4accd410b709de09a2f5b1c76ef60

[vm/compiler] Fix crash in inliner when receiver is dead

Fixes https://github.com/dart-lang/sdk/issues/42065

Change-Id: Ib66163a41a13f02cfa9df9bcb1cf505e934fea93
Reviewed-on: https://dart-review.googlesource.com/c/sdk/+/149370
Reviewed-by: Martin Kustermann <kustermann@google.com>
Commit-Queue: Alexander Markov <alexmarkov@google.com>

runtime/tests/vm/dart/regress_42065_test.dart

diff --git a/runtime/tests/vm/dart/regress_42065_test.dart b/runtime/tests/vm/dart/regress_42065_test.dart
new file mode 100644
index 0000000..28079af
--- /dev/null
+++ b/runtime/tests/vm/dart/regress_42065_test.dart
@@ -0,0 +1,22 @@
+// Copyright (c) 2020, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+// Verifies that compiler doesn't crash while inlining recognized method
+// when receiver is a dead code.
+// Regression test for https://github.com/dart-lang/sdk/issues/42065.
+
+import "package:expect/expect.dart";
+
+List<int> foo0(int par1) {
+  if (par1 >= 39) {
+    return <int>[];
+  }
+  throw 'hi';
+}
+
+main() {
+  Expect.throws(() {
+    (foo0(0)).add(42);
+  }, (e) => e == 'hi');
+}

runtime/vm/compiler/backend/inliner.cc

diff --git a/runtime/vm/compiler/backend/inliner.cc b/runtime/vm/compiler/backend/inliner.cc
index 58c4c88..25c3e44 100644
--- a/runtime/vm/compiler/backend/inliner.cc
+++ b/runtime/vm/compiler/backend/inliner.cc
@@ -3658,6 +3658,13 @@
     Definition** result,
     SpeculativeInliningPolicy* policy,
     FlowGraphInliner::ExactnessInfo* exactness) {
+  if (receiver_cid == kNeverCid) {
+    // Receiver was defined in dead code and was replaced by the sentinel.
+    // Original receiver cid is lost, so don't try to inline recognized
+    // methods.
+    return false;
+  }
+
   const bool can_speculate = policy->IsAllowedForInlining(call->deopt_id());
 
   const MethodRecognizer::Kind kind = target.recognized_kind();

runtime/vm/compiler/frontend/flow_graph_builder.cc

diff --git a/runtime/vm/compiler/frontend/flow_graph_builder.cc b/runtime/vm/compiler/frontend/flow_graph_builder.cc
index 4a13620..95fc854 100644
--- a/runtime/vm/compiler/frontend/flow_graph_builder.cc
+++ b/runtime/vm/compiler/frontend/flow_graph_builder.cc
@@ -273,9 +273,9 @@
     call_->previous()->AppendInstruction(branch);
     call_block->set_last_instruction(branch);
 
-    // Replace uses of the return value with null to maintain valid
-    // SSA form - even though the rest of the caller is unreachable.
-    call_->ReplaceUsesWith(caller_graph_->constant_null());
+    // Replace uses of the return value with sentinel constant to maintain
+    // valid SSA form - even though the rest of the caller is unreachable.
+    call_->ReplaceUsesWith(caller_graph_->GetConstant(Object::sentinel()));
 
     // Update dominator tree.
     for (intptr_t i = 0, n = callee_entry->dominated_blocks().length(); i < n;