Skip to content

Commit c923d39

Browse files
maksfblinsinan1995
andauthored
[BOLT] Fix ValidateMemRefs pass (#94406)
In ValidateMemRefs pass, when we validate references in the form of `Symbol + Addend`, we should check `Symbol` not `Symbol + Addend` against aliasing a jump table. Recommitting with a modified test case: #88838 Co-authored-by: sinan <sinan.lin@linux.alibaba.com>
1 parent 330e8a7 commit c923d39

File tree

2 files changed

+67
-4
lines changed

2 files changed

+67
-4
lines changed

bolt/lib/Passes/ValidateMemRefs.cpp

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -29,8 +29,7 @@ bool ValidateMemRefs::checkAndFixJTReference(BinaryFunction &BF, MCInst &Inst,
2929
if (!BD)
3030
return false;
3131

32-
const uint64_t TargetAddress = BD->getAddress() + Offset;
33-
JumpTable *JT = BC.getJumpTableContainingAddress(TargetAddress);
32+
JumpTable *JT = BC.getJumpTableContainingAddress(BD->getAddress());
3433
if (!JT)
3534
return false;
3635

@@ -43,8 +42,9 @@ bool ValidateMemRefs::checkAndFixJTReference(BinaryFunction &BF, MCInst &Inst,
4342
// the jump table label with a regular rodata reference. Get a
4443
// non-JT reference by fetching the symbol 1 byte before the JT
4544
// label.
46-
MCSymbol *NewSym = BC.getOrCreateGlobalSymbol(TargetAddress - 1, "DATAat");
47-
BC.MIB->setOperandToSymbolRef(Inst, OperandNum, NewSym, 1, &*BC.Ctx, 0);
45+
MCSymbol *NewSym = BC.getOrCreateGlobalSymbol(BD->getAddress() - 1, "DATAat");
46+
BC.MIB->setOperandToSymbolRef(Inst, OperandNum, NewSym, Offset + 1, &*BC.Ctx,
47+
0);
4848
LLVM_DEBUG(dbgs() << "BOLT-DEBUG: replaced reference @" << BF.getPrintName()
4949
<< " from " << BD->getName() << " to " << NewSym->getName()
5050
<< " + 1\n");
Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
## If the operand references a symbol that differs from the jump table label,
2+
## no reference updating is required even if its target address resides within
3+
## the jump table's range.
4+
## In this test case, consider the second instruction within the main function,
5+
## where the address resulting from 'c + 17' corresponds to one byte beyond the
6+
## address of the .LJTI2_0 jump table label. However, this operand represents
7+
## an offset calculation related to the global variable 'c' and should remain
8+
## unaffected by the jump table.
9+
10+
# REQUIRES: system-linux
11+
12+
# RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown %s -o %t.o
13+
# RUN: %clang -no-pie %t.o -o %t.exe -Wl,-q
14+
# RUN: llvm-bolt --funcs=main,foo/1 %t.exe -o %t.exe.bolt --print-normalized \
15+
# RUN: 2>&1 | FileCheck %s
16+
17+
.text
18+
.globl main
19+
.type main,@function
20+
main:
21+
# CHECK: Binary Function "main"
22+
pushq %rbp
23+
movq %rsp, %rbp
24+
movq $-16, %rax
25+
movl c+17(%rax), %edx
26+
# CHECK: movl c+17(%rax), %edx
27+
cmpl $255, %edx
28+
je .LCorrect
29+
movl $1, %eax
30+
popq %rbp
31+
ret
32+
.LCorrect:
33+
movl $0, %eax
34+
popq %rbp
35+
ret
36+
37+
.p2align 4, 0x90
38+
.type foo,@function
39+
foo:
40+
# CHECK: Binary Function "foo
41+
movq $0, %rax
42+
jmpq *.LJTI2_0(,%rax,8)
43+
# CHECK: jmpq *{{.*}} # JUMPTABLE
44+
addl $-36, %eax
45+
.LBB2_2:
46+
addl $-16, %eax
47+
retq
48+
.section .rodata,"a",@progbits
49+
.type c,@object
50+
.data
51+
.globl c
52+
.p2align 4, 0x0
53+
c:
54+
.byte 1
55+
.byte 0xff
56+
.zero 14
57+
.size c, 16
58+
.LJTI2_0:
59+
.quad .LBB2_2
60+
.quad .LBB2_2
61+
.quad .LBB2_2
62+
.quad .LBB2_2
63+

0 commit comments

Comments
 (0)