Skip to content
Permalink
Browse files
Tail call optimizations lead to crashes on ARM Thumb + Linux
https://bugs.webkit.org/show_bug.cgi?id=150083

Patch by Zan Dobersek <zdobersek@igalia.com> on 2016-04-15
Reviewed by Csaba Osztrogonác.

* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::repatchNearCall): In case of a tail call relink to the
data location of the destination, and not the executable address. This is needed for
the ARM Thumb2 platform where both the source and destination addresses of a jump relink
must not have the bottom bit decorated, as asserted in ARMv7Assembler::relinkJump().
* jit/Repatch.cpp:
(JSC::linkPolymorphicCall): Similarly, when linking a tail call we must link to the
address that has a non-decorated bottom bit, as asserted in ARMv7Assembler::linkJumpAbsolute().

Canonical link: https://commits.webkit.org/174726@main
git-svn-id: https://svn.webkit.org/repository/webkit/trunk@199586 268f45cc-cd09-0410-ab3c-d52691b4dbfc
  • Loading branch information
zdobersek authored and webkit-commit-queue committed Apr 15, 2016
1 parent 18b9361 commit 3bb6804be0da10c7fe3ebdc753e3942e30d5eb25
Showing 3 changed files with 21 additions and 2 deletions.
@@ -1,3 +1,19 @@
2016-04-15 Zan Dobersek <zdobersek@igalia.com>

Tail call optimizations lead to crashes on ARM Thumb + Linux
https://bugs.webkit.org/show_bug.cgi?id=150083

Reviewed by Csaba Osztrogonác.

* assembler/AbstractMacroAssembler.h:
(JSC::AbstractMacroAssembler::repatchNearCall): In case of a tail call relink to the
data location of the destination, and not the executable address. This is needed for
the ARM Thumb2 platform where both the source and destination addresses of a jump relink
must not have the bottom bit decorated, as asserted in ARMv7Assembler::relinkJump().
* jit/Repatch.cpp:
(JSC::linkPolymorphicCall): Similarly, when linking a tail call we must link to the
address that has a non-decorated bottom bit, as asserted in ARMv7Assembler::linkJumpAbsolute().

2016-04-14 Geoffrey Garen <ggaren@apple.com>

Unreviewed, rolling out r199567.
@@ -993,7 +993,7 @@ class AbstractMacroAssembler {
{
switch (nearCall.callMode()) {
case NearCallMode::Tail:
AssemblerType::relinkJump(nearCall.dataLocation(), destination.executableAddress());
AssemblerType::relinkJump(nearCall.dataLocation(), destination.dataLocation());
return;
case NearCallMode::Regular:
AssemblerType::relinkCall(nearCall.dataLocation(), destination.executableAddress());
@@ -926,8 +926,11 @@ void linkPolymorphicCall(

RELEASE_ASSERT(callCases.size() == calls.size());
for (CallToCodePtr callToCodePtr : calls) {
// Tail call special-casing ensures proper linking on ARM Thumb2, where a tail call jumps to an address
// with a non-decorated bottom bit but a normal call calls an address with a decorated bottom bit.
bool isTailCall = callToCodePtr.call.isFlagSet(CCallHelpers::Call::Tail);
patchBuffer.link(
callToCodePtr.call, FunctionPtr(callToCodePtr.codePtr.executableAddress()));
callToCodePtr.call, FunctionPtr(isTailCall ? callToCodePtr.codePtr.dataLocation() : callToCodePtr.codePtr.executableAddress()));
}
if (JITCode::isOptimizingJIT(callerCodeBlock->jitType()))
patchBuffer.link(done, callLinkInfo.callReturnLocation().labelAtOffset(0));

0 comments on commit 3bb6804

Please sign in to comment.