[release/9.0-staging] JIT: Include more edges in BlockDominancePreds to avoid a JIT crash#110568
Merged
jakobbotsch merged 6 commits intorelease/9.0-stagingfrom Dec 20, 2024
Merged
Conversation
Because of spurious flow it is possible that the preds of the try-begin block are not the only blocks that can dominate a handler. We handled this possibility, but only for finally/fault blocks that can directly have these edges. However, even other handler blocks can be reachable through spurious paths that involves finally/fault blocks, and in these cases returning the preds of the try-begin block is not enough to compute the right dominator statically.
ghost
added
the
area-CodeGen-coreclr
Contributor
|
Tagging subscribers to this area: @JulieLeeMSFT, @jakobbotsch |
jakobbotsch
changed the title
BlockDominancePredsBlockDominancePreds to avoid a JIT crash
Open
3 tasks
jeffschwMSFT
approved these changes
Dec 10, 2024
Member
jeffschwMSFT
left a comment
jeffschwMSFT
left a comment
There was a problem hiding this comment.
lgtm. please get a code review. we will take for consideration in 9.0.x
jeffschwMSFT
added
the
Servicing-consider
AndyAyersMS
approved these changes
Dec 10, 2024
jeffschwMSFT
added
Servicing-approved
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #110531 to release/9.0-staging
/cc @jakobbotsch
Customer Impact
Certain patterns of exception handling (involving nested filters, try-finally and try-catch) can cause the JIT to crash when the method is jitted with optimizations enabled. Reported by customer in #109981.
The problem occurs when:
See the added test case for a C# example.
In this case the JIT computes a wrong dominator block for the catch-handler (2), which later causes a null pointer dereference.
Regression
The issue was introduced in #94672.
Testing
Added a test case that hits the crash without the fix. Also verified the fix on the customer's test case.
Risk
Low.