Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
In #44635, we observe that occasionally a call to
view(::SubArray, ::Colon, ...)
dispatches to thewrong function. The post-inlining IR is in relevant part:
Here we expect the
isa
at%8
to always be [1]. However,we seemingly observe the result that the branch is not taken
and we instead end up in the fallback
to_index
, which (correctly)complains that the colon should have been dereferenced to
an index.
After some investigation of the relevant rr trace, what turns out
to happen here is that the va tuple we compute in codegen gets
garbage collected before the call to
emit_isa
, causing a use-after-freeread, which happens to make
emit_isa
think that the isa conditionis impossible, causing it to fold the branch away.
The fix is to simply add the relevant GC root. It's a bit unfortunate that this
wasn't caught by the GC verifier. It would have in principle been capable of doing
so, but it is currently disabled for C++ sources. It would be worth revisiting
this in the future to see if it can't be made to work.
Fixes #44635.
[1] The specialization heuristics decided to widen
Colon
toFunction
,which doesn't make much sense here, but regardless, it shouldn't
crash.