commit 100dbe0d8d5b419bc3727e5b8a07e995351fe129
author Elliott Hughes <enh@google.com> Tue Jul 17 16:31:30 2012 -0700
committer Elliott Hughes <enh@google.com> Tue Jul 17 18:01:36 2012 -0700
tree eea52a6bad73b0df43bf44ba16a510957542aa8d
parent 319206f324bd937bc1d661dec2082413e41cf8e5

Avoid sign extension in packed-switch.

This code (at least in the ARM version) is trying to assign to r0 and r1
from C by returning a 64-bit result. The mistaken use of signed integers
for pointers can lead to sign extension if the JIT code cache is at a
sufficiently high address.

Bug: 6799823
Bug: 6703991

(cherry-pick from 2d0c1c2dbe44458ebb199c47ce1047f266db5349.)

Change-Id: I79e72228b60e195272d11899ac69bb4a76b7402f

vm/compiler/codegen/mips/CodegenDriver.cpp

diff --git a/vm/compiler/codegen/mips/CodegenDriver.cpp b/vm/compiler/codegen/mips/CodegenDriver.cpp
index 3dd95ae..c7757fe 100644
--- a/vm/compiler/codegen/mips/CodegenDriver.cpp
+++ b/vm/compiler/codegen/mips/CodegenDriver.cpp
@@ -428,7 +428,7 @@
                  size, rlObj.sRegLow);
     HEAP_ACCESS_SHADOW(false);
     if (isVolatile) {
-	    dvmCompilerGenMemBarrier(cUnit, 0);
+        dvmCompilerGenMemBarrier(cUnit, 0);
     }
 
     storeValue(cUnit, rlDest, rlResult);
@@ -450,7 +450,7 @@
                  NULL);/* null object? */
 
     if (isVolatile) {
-	dvmCompilerGenMemBarrier(cUnit, 0);
+        dvmCompilerGenMemBarrier(cUnit, 0);
     }
     HEAP_ACCESS_SHADOW(true);
     storeBaseDisp(cUnit, rlObj.lowReg, fieldOffset, rlSrc.lowReg, size);
@@ -1553,7 +1553,7 @@
     }
     switch (dalvikOpcode) {
         case OP_RETURN_VOID_BARRIER:
-	    dvmCompilerGenMemBarrier(cUnit, 0);
+            dvmCompilerGenMemBarrier(cUnit, 0);
             // Intentional fallthrough
         case OP_RETURN_VOID:
             genReturnCommon(cUnit,mir);
@@ -2935,14 +2935,14 @@
  * chaining cell for case default [16 bytes]
  * noChain exit
  */
-static s8 findPackedSwitchIndex(const u2* switchData, int testVal)
+static u8 findPackedSwitchIndex(const u2* switchData, int testVal)
 {
     int size;
     int firstKey;
     const int *entries;
     int index;
     int jumpIndex;
-    int caseDPCOffset = 0;
+    uintptr_t caseDPCOffset = 0;
 
     /*
      * Packed switch data format:
@@ -2984,11 +2984,11 @@
         jumpIndex = index;
     }
 
-    return (((s8) caseDPCOffset) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
+    return (((u8) caseDPCOffset) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
 }
 
 /* See comments for findPackedSwitchIndex */
-static s8 findSparseSwitchIndex(const u2* switchData, int testVal)
+static u8 findSparseSwitchIndex(const u2* switchData, int testVal)
 {
     int size;
     const int *keys;
@@ -3035,7 +3035,7 @@
             /* MAX_CHAINED_SWITCH_CASES + 1 is the start of the overflow case */
             int jumpIndex = (i < MAX_CHAINED_SWITCH_CASES) ?
                            i : MAX_CHAINED_SWITCH_CASES + 1;
-            return (((s8) entries[i]) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
+            return (((u8) entries[i]) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
 #else
         int k = (unsigned int)keys[i] >> 16 | keys[i] << 16;
         if (k == testVal) {
@@ -3043,7 +3043,7 @@
             int jumpIndex = (i < MAX_CHAINED_SWITCH_CASES) ?
                            i : MAX_CHAINED_SWITCH_CASES + 1;
             int temp = (unsigned int)entries[i] >> 16 | entries[i] << 16;
-            return (((s8) temp) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
+            return (((u8) temp) << 32) | (u8) (jumpIndex * CHAIN_CELL_NORMAL_SIZE + 20);
 #endif
         } else if (k > testVal) {
             break;