Fix chaining offset mis-calculation for translations w/ large switch statements.
Bug: 2369821
There are 12 bytes of additional code after the 65th chaining cell. So if a
switch statement with more than that many cases is translated by the JIT, it
will run fine until the next unchaining event, which will patch the wrong code
and lead to all kinds of unexpected crashes.
diff --git a/vm/compiler/CompilerIR.h b/vm/compiler/CompilerIR.h
index 24e9b37..f5178d8 100644
--- a/vm/compiler/CompilerIR.h
+++ b/vm/compiler/CompilerIR.h
@@ -51,7 +51,9 @@
kChainingCellInvokeSingleton,
kChainingCellInvokePredicted,
kChainingCellBackwardBranch,
- kChainingCellLast,
+ kChainingCellGap,
+ /* Don't insert new fields between Gap and Last */
+ kChainingCellLast = kChainingCellGap + 1,
kEntryBlock,
kDalvikByteCode,
kExitBlock,
@@ -61,7 +63,7 @@
typedef struct ChainCellCounts {
union {
- u1 count[kChainingCellLast];
+ u1 count[kChainingCellLast]; /* include one more space for the gap # */
u4 dummyForAlignment;
} u;
} ChainCellCounts;
@@ -149,8 +151,9 @@
bool halveInstCount;
bool executionCount; // Add code to count trace executions
bool hasLoop;
- int numChainingCells[kChainingCellLast];
- LIR *firstChainingLIR[kChainingCellLast];
+ int numChainingCells[kChainingCellGap];
+ LIR *firstChainingLIR[kChainingCellGap];
+ LIR *chainingCellBottom;
struct RegisterPool *regPool;
int optRound; // round number to tell an LIR's age
JitInstructionSetType instructionSet;