Avoid sign extension in packed-switch.
This code (at least in the ARM version) is trying to assign to r0 and r1
from C by returning a 64-bit result. The mistaken use of signed integers
for pointers can lead to sign extension if the JIT code cache is at a
sufficiently high address.
Bug: 6799823
Bug: 6703991
(cherry-pick from 2d0c1c2dbe44458ebb199c47ce1047f266db5349.)
Change-Id: I79e72228b60e195272d11899ac69bb4a76b7402f
diff --git a/vm/compiler/codegen/mips/CalloutHelper.h b/vm/compiler/codegen/mips/CalloutHelper.h
index 6e2343d..8534361 100644
--- a/vm/compiler/codegen/mips/CalloutHelper.h
+++ b/vm/compiler/codegen/mips/CalloutHelper.h
@@ -84,13 +84,6 @@
const ClassObject *clazz);
/*
- * Switch dispatch offset calculation for OP_PACKED_SWITCH & OP_SPARSE_SWITCH
- * Used in CodegenDriver.c
- * static s8 findPackedSwitchIndex(const u2* switchData, int testVal, int pc);
- * static s8 findSparseSwitchIndex(const u2* switchData, int testVal, int pc);
- */
-
-/*
* Resolve interface callsites - OP_INVOKE_INTERFACE & OP_INVOKE_INTERFACE_RANGE
*
* Originally declared in mterp/common/FindInterface.h and only comment it here
diff --git a/vm/compiler/codegen/mips/CodegenDriver.cpp b/vm/compiler/codegen/mips/CodegenDriver.cpp
index 3dd95ae..c7757fe 100644
--- a/vm/compiler/codegen/mips/CodegenDriver.cpp
+++ b/vm/compiler/codegen/mips/CodegenDriver.cpp
@@ -428,7 +428,7 @@
size, rlObj.sRegLow);
HEAP_ACCESS_SHADOW(false);
if (isVolatile) {
- dvmCompilerGenMemBarrier(cUnit, 0);
+ dvmCompilerGenMemBarrier(cUnit, 0);
}
storeValue(cUnit, rlDest, rlResult);
@@ -450,7 +450,7 @@
NULL);/* null object? */
if (isVolatile) {
- dvmCompilerGenMemBarrier(cUnit, 0);
+ dvmCompilerGenMemBarrier(cUnit, 0);
}
HEAP_ACCESS_SHADOW(true);
storeBaseDisp(cUnit, rlObj.lowReg, fieldOffset, rlSrc.lowReg, size);
@@ -1553,7 +1553,7 @@
}
switch (dalvikOpcode) {
case OP_RETURN_VOID_BARRIER:
- dvmCompilerGenMemBarrier(cUnit, 0);
+ dvmCompilerGenMemBarrier(cUnit, 0);
// Intentional fallthrough
case OP_RETURN_VOID:
genReturnCommon(cUnit,mir);
@@ -2935,14 +2935,14 @@
* chaining cell for case default [16 bytes]
* noChain exit
*/
-static s8 findPackedSwitchIndex(const u2* switchData, int testVal)
+static u8 findPackedSwitchIndex(const u2* switchData, int testVal)
{
int size;
int firstKey;
const int *entries;
int index;
int jumpIndex;
- int caseDPCOffset = 0;
+ uintptr_t caseDPCOffset = 0;
/*
* Packed switch data format:
@@ -2984,11 +2984,11 @@
jumpIndex = index;
}
- return (((s8) caseDPCOffset) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
+ return (((u8) caseDPCOffset) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
}
/* See comments for findPackedSwitchIndex */
-static s8 findSparseSwitchIndex(const u2* switchData, int testVal)
+static u8 findSparseSwitchIndex(const u2* switchData, int testVal)
{
int size;
const int *keys;
@@ -3035,7 +3035,7 @@
/* MAX_CHAINED_SWITCH_CASES + 1 is the start of the overflow case */
int jumpIndex = (i < MAX_CHAINED_SWITCH_CASES) ?
i : MAX_CHAINED_SWITCH_CASES + 1;
- return (((s8) entries[i]) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
+ return (((u8) entries[i]) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
#else
int k = (unsigned int)keys[i] >> 16 | keys[i] << 16;
if (k == testVal) {
@@ -3043,7 +3043,7 @@
int jumpIndex = (i < MAX_CHAINED_SWITCH_CASES) ?
i : MAX_CHAINED_SWITCH_CASES + 1;
int temp = (unsigned int)entries[i] >> 16 | entries[i] << 16;
- return (((s8) temp) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
+ return (((u8) temp) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
#endif
} else if (k > testVal) {
break;