Fix chaining offset mis-calculation for translations w/ large switch statements.
Bug: 2369821
There are 12 bytes of additional code after the 65th chaining cell. So if a
switch statement with more than that many cases is translated by the JIT, it
will run fine until the next unchaining event, which will patch the wrong code
and lead to all kinds of unexpected crashes.
diff --git a/vm/compiler/codegen/arm/Assemble.c b/vm/compiler/codegen/arm/Assemble.c
index 7444b3e..7c16ff9 100644
--- a/vm/compiler/codegen/arm/Assemble.c
+++ b/vm/compiler/codegen/arm/Assemble.c
@@ -1126,7 +1126,9 @@
* | . .
* | | |
* | +----------------------------+
- * +->| Chaining cell counts | -> 4 bytes, chain cell counts by type
+ * | | Gap for large switch stmt | -> # cases >= MAX_CHAINED_SWITCH_CASES
+ * | +----------------------------+
+ * +->| Chaining cell counts | -> 8 bytes, chain cell counts by type
* +----------------------------+
* | Trace description | -> variable sized
* . .
@@ -1150,6 +1152,7 @@
int i;
ChainCellCounts chainCellCounts;
int descSize = jitTraceDescriptionSize(cUnit->traceDesc);
+ int chainingCellGap;
info->instructionSet = cUnit->instructionSet;
@@ -1175,6 +1178,13 @@
/* Const values have to be word aligned */
offset = (offset + 3) & ~3;
+ /*
+ * Get the gap (# of u4) between the offset of chaining cell count and
+ * the bottom of real chaining cells. If the translation has chaining
+ * cells, the gap is guaranteed to be multiples of 4.
+ */
+ chainingCellGap = (offset - cUnit->chainingCellBottom->offset) >> 2;
+
/* Add space for chain cell counts & trace description */
u4 chainCellOffset = offset;
ArmLIR *chainCellOffsetLIR = (ArmLIR *) cUnit->chainCellOffsetLIR;
@@ -1243,9 +1253,13 @@
gDvmJit.numCompilations++;
/* Install the chaining cell counts */
- for (i=0; i< kChainingCellLast; i++) {
+ for (i=0; i< kChainingCellGap; i++) {
chainCellCounts.u.count[i] = cUnit->numChainingCells[i];
}
+
+ /* Set the gap number in the chaining cell count structure */
+ chainCellCounts.u.count[kChainingCellGap] = chainingCellGap;
+
memcpy((char*)cUnit->baseAddr + chainCellOffset, &chainCellCounts,
sizeof(chainCellCounts));
@@ -1491,7 +1505,7 @@
PredictedChainingCell *predChainCell;
/* Get total count of chain cells */
- for (i = 0, cellSize = 0; i < kChainingCellLast; i++) {
+ for (i = 0, cellSize = 0; i < kChainingCellGap; i++) {
if (i != kChainingCellInvokePredicted) {
cellSize += pChainCellCounts->u.count[i] * 2;
} else {
@@ -1499,11 +1513,15 @@
}
}
+ if (cellSize == 0)
+ return (u4 *) pChainCellCounts;
+
/* Locate the beginning of the chain cell region */
- pStart = pChainCells = ((u4 *) pChainCellCounts) - cellSize;
+ pStart = pChainCells = ((u4 *) pChainCellCounts) - cellSize -
+ pChainCellCounts->u.count[kChainingCellGap];
/* The cells are sorted in order - walk through them and reset */
- for (i = 0; i < kChainingCellLast; i++) {
+ for (i = 0; i < kChainingCellGap; i++) {
int elemSize = 2; /* Most chaining cell has two words */
if (i == kChainingCellInvokePredicted) {
elemSize = 4;