JitCache: Fix potentially dangling pointer to fast block map. #12150
Conversation
… memory region whose pages are only allocated on first access.
Whenever JitBaseBlockCache::Clear() got called, it threw away the memory mapping for the fast block map and created a new one. This new mapping typically got mapped at the same address at the old one, but this is not guaranteed. The pointer to the mapping gets embedded in the generated dispatcher code in Jit64AsmRoutineManager::Generate(), which is only called once on game boot, so if the new mapping ended up at a different address than the old one, the pointer in the ASM pointed at garbage, leading to a crash. This fixes the issue by guaranteeing that the new mapping is mapped at the same address.
AdmiralCurtiss
force-pushed
the
fast-block-cache-fix
branch
from
830c47c
to
f1c1c6d
Compare
|
Someone needs to test if the Linux and Android implementations work as expected. Boot a game, play for a minute, then do something that causes a JIT cache flush (saving and then reloading a savestate should do it) and see if anything breaks. |
|
I can test that to see what happens. |
AdmiralCurtiss
changed the title
|
@AdmiralCurtiss @JosJuice I have bisected crashes on launch of all games with both opengl/vulkan and jit and interpreter back to this commit. For reference, commit Please revert as soon as possible. Confirmed on mulitple systems (all ARM64 Linux) edit: for clarity, dolphin itself fully crashes, the game does not just fail to launch. |
|
CC: @JMC47 since I forgot to in the intial post ^ |
|
^ Please test if #12173 fixes it. |
Whenever JitBaseBlockCache::Clear() got called, it threw away the memory mapping for the fast block map and created a new one. This new mapping typically got mapped at the same address at the old one, but this is not guaranteed. The pointer to the mapping gets embedded in the generated dispatcher code in Jit64AsmRoutineManager::Generate(), which is only called once on game boot, so if the new mapping ended up at a different address than the old one, the pointer in the ASM pointed at garbage, leading to a crash.
This fixes the issue by guaranteeing that the new mapping is mapped at the same address.
@krnlyng You might be interested in this.