Skip to content

Commit 064fb34

Browse files
wesleywiserwesleywiser
committed
Fix X86 Target overflows
1 parent 4c3577b commit 064fb34

File tree

4 files changed

+103
-18
lines changed

4 files changed

+103
-18
lines changed

‎llvm/lib/Target/X86/X86FrameLowering.cpp

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
#include "llvm/CodeGen/MachineInstrBuilder.h"
2525
#include "llvm/CodeGen/MachineModuleInfo.h"
2626
#include "llvm/CodeGen/MachineRegisterInfo.h"
27+
#include "llvm/CodeGen/RegisterScavenging.h"
2728
#include "llvm/CodeGen/WinEHFuncInfo.h"
2829
#include "llvm/IR/DataLayout.h"
2930
#include "llvm/IR/EHPersonalities.h"
@@ -2616,7 +2617,7 @@ StackOffset X86FrameLowering::getFrameIndexReference(const MachineFunction &MF,
26162617
// object.
26172618
// We need to factor in additional offsets applied during the prologue to the
26182619
// frame, base, and stack pointer depending on which is used.
2619-
int Offset = MFI.getObjectOffset(FI) - getOffsetOfLocalArea();
2620+
int64_t Offset = MFI.getObjectOffset(FI) - getOffsetOfLocalArea();
26202621
const X86MachineFunctionInfo *X86FI = MF.getInfo<X86MachineFunctionInfo>();
26212622
unsigned CSSize = X86FI->getCalleeSavedFrameSize();
26222623
uint64_t StackSize = MFI.getStackSize();
@@ -4140,6 +4141,14 @@ void X86FrameLowering::processFunctionBeforeFrameFinalized(
41404141
// emitPrologue if it gets called and emits CFI.
41414142
MF.setHasWinCFI(false);
41424143

4144+
MachineFrameInfo &MFI = MF.getFrameInfo();
4145+
// If the frame is big enough that we might need to scavenge a register to
4146+
// handle huge offsets, reserve a stack slot for that now.
4147+
if (!isInt<32>(MFI.estimateStackSize(MF))) {
4148+
int FI = MFI.CreateStackObject(SlotSize, Align(SlotSize), false);
4149+
RS->addScavengingFrameIndex(FI);
4150+
}
4151+
41434152
// If we are using Windows x64 CFI, ensure that the stack is always 8 byte
41444153
// aligned. The format doesn't support misaligned stack adjustments.
41454154
if (MF.getTarget().getMCAsmInfo()->usesWindowsCFI())

‎llvm/lib/Target/X86/X86RegisterInfo.cpp

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
//===----------------------------------------------------------------------===//
1414

1515
#include "X86RegisterInfo.h"
16+
#include "MCTargetDesc/X86BaseInfo.h"
1617
#include "X86FrameLowering.h"
1718
#include "X86MachineFunctionInfo.h"
1819
#include "X86Subtarget.h"
@@ -24,6 +25,7 @@
2425
#include "llvm/CodeGen/MachineFunction.h"
2526
#include "llvm/CodeGen/MachineFunctionPass.h"
2627
#include "llvm/CodeGen/MachineRegisterInfo.h"
28+
#include "llvm/CodeGen/RegisterScavenging.h"
2729
#include "llvm/CodeGen/TargetFrameLowering.h"
2830
#include "llvm/CodeGen/TargetInstrInfo.h"
2931
#include "llvm/CodeGen/TileShapeInfo.h"
@@ -905,7 +907,7 @@ X86RegisterInfo::eliminateFrameIndex(MachineBasicBlock::iterator II,
905907
int FrameIndex = MI.getOperand(FIOperandNum).getIndex();
906908

907909
// Determine base register and offset.
908-
int FIOffset;
910+
int64_t FIOffset;
909911
Register BasePtr;
910912
if (MI.isReturn()) {
911913
assert((!hasStackRealignment(MF) ||
@@ -956,10 +958,34 @@ X86RegisterInfo::eliminateFrameIndex(MachineBasicBlock::iterator II,
956958
}
957959

958960
if (MI.getOperand(FIOperandNum+3).isImm()) {
959-
// Offset is a 32-bit integer.
960-
int Imm = (int)(MI.getOperand(FIOperandNum + 3).getImm());
961-
int Offset = FIOffset + Imm;
962-
assert((!Is64Bit || isInt<32>((long long)FIOffset + Imm)) &&
961+
int64_t Imm = MI.getOperand(FIOperandNum + 3).getImm();
962+
int64_t Offset = FIOffset + Imm;
963+
bool FitsIn32Bits = isInt<32>(Offset);
964+
// If the offset will not fit in a 32-bit displacement,
965+
// then for 64-bit targets, scavenge a register to hold it.
966+
// Otherwise, for 32-bit targets, this is a bug!
967+
if (Is64Bit && !FitsIn32Bits) {
968+
assert(RS && "RegisterScavenger was NULL");
969+
const X86InstrInfo *TII = MF.getSubtarget<X86Subtarget>().getInstrInfo();
970+
const DebugLoc &DL = MI.getDebugLoc();
971+
972+
RS->enterBasicBlockEnd(MBB);
973+
RS->backward(std::next(II));
974+
975+
Register ScratchReg = RS->scavengeRegisterBackwards(
976+
X86::GR64RegClass, II, /*RestoreAfter=*/false, /*SPAdj=*/0,
977+
/*AllowSpill=*/true);
978+
assert(ScratchReg != 0 && "scratch reg was 0");
979+
RS->setRegUsed(ScratchReg);
980+
981+
BuildMI(MBB, II, DL, TII->get(X86::MOV64ri), ScratchReg).addImm(Offset);
982+
983+
MI.getOperand(FIOperandNum + 3).setImm(0);
984+
MI.getOperand(FIOperandNum + 2).setReg(ScratchReg);
985+
986+
return false;
987+
}
988+
assert((Is64Bit || FitsIn32Bits) &&
963989
"Requesting 64-bit offset in 32-bit immediate!");
964990
if (Offset != 0 || !tryOptimizeLEAtoMOV(II))
965991
MI.getOperand(FIOperandNum + 3).ChangeToImmediate(Offset);

‎llvm/test/CodeGen/X86/huge-stack.ll

Lines changed: 61 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,70 @@
55
define void @foo() unnamed_addr #0 {
66
; CHECK-LABEL: foo:
77
; CHECK: # %bb.0:
8-
; CHECK-NEXT: movabsq $8589934462, %rax # imm = 0x1FFFFFF7E
8+
; CHECK-NEXT: movabsq $8589934472, %rax # imm = 0x1FFFFFF88
99
; CHECK-NEXT: subq %rax, %rsp
10-
; CHECK-NEXT: .cfi_def_cfa_offset 8589934470
11-
; CHECK-NEXT: movb $42, -129(%rsp)
12-
; CHECK-NEXT: movb $43, -128(%rsp)
13-
; CHECK-NEXT: movabsq $8589934462, %rax # imm = 0x1FFFFFF7E
10+
; CHECK-NEXT: .cfi_def_cfa_offset 8589934480
11+
; CHECK-NEXT: movabsq $4294967177, %rax # imm = 0xFFFFFF89
12+
; CHECK-NEXT: movb $42, (%rsp,%rax)
13+
; CHECK-NEXT: movb $43, -118(%rsp)
14+
; CHECK-NEXT: movabsq $8589934472, %rax # imm = 0x1FFFFFF88
1415
; CHECK-NEXT: addq %rax, %rsp
1516
; CHECK-NEXT: .cfi_def_cfa_offset 8
1617
; CHECK-NEXT: retq
17-
%1 = alloca %large, align 1
18-
%2 = alloca %large, align 1
19-
%3 = getelementptr inbounds %large, ptr %1, i64 0, i64 0
20-
store i8 42, ptr %3, align 1
21-
%4 = getelementptr inbounds %large, ptr %2, i64 0, i64 0
22-
store i8 43, ptr %4, align 1
18+
%large1 = alloca %large, align 1
19+
%large2 = alloca %large, align 1
20+
%ptrLarge1 = getelementptr inbounds %large, ptr %large1, i64 0, i64 0
21+
store i8 42, ptr %ptrLarge1, align 1
22+
%ptrLarge2 = getelementptr inbounds %large, ptr %large2, i64 0, i64 0
23+
store i8 43, ptr %ptrLarge2, align 1
2324
ret void
2425
}
26+
27+
declare ptr @baz(ptr, ptr, ptr, ptr)
28+
29+
define ptr @scavenge_spill() unnamed_addr #0 {
30+
; CHECK-LABEL: scavenge_spill:
31+
; CHECK: # %bb.0:
32+
; CHECK-NEXT: movabsq $25769803816, %rax # imm = 0x600000028
33+
; CHECK-NEXT: subq %rax, %rsp
34+
; CHECK-NEXT: .cfi_def_cfa_offset 25769803824
35+
; CHECK-NEXT: movabsq $21474836521, %rax # imm = 0x500000029
36+
; CHECK-NEXT: leaq (%rsp,%rax), %rdi
37+
; CHECK-NEXT: movabsq $17179869226, %rax # imm = 0x40000002A
38+
; CHECK-NEXT: leaq (%rsp,%rax), %rsi
39+
; CHECK-NEXT: movq %rsi, {{[-0-9]+}}(%r{{[sb]}}p) # 8-byte Spill
40+
; CHECK-NEXT: movabsq $12884901931, %rax # imm = 0x30000002B
41+
; CHECK-NEXT: leaq (%rsp,%rax), %rdx
42+
; CHECK-NEXT: movq %rdx, {{[-0-9]+}}(%r{{[sb]}}p) # 8-byte Spill
43+
; CHECK-NEXT: movabsq $8589934636, %rax # imm = 0x20000002C
44+
; CHECK-NEXT: leaq (%rsp,%rax), %rcx
45+
; CHECK-NEXT: movq %rcx, {{[-0-9]+}}(%r{{[sb]}}p) # 8-byte Spill
46+
; CHECK-NEXT: callq baz@PLT
47+
; CHECK-NEXT: movq {{[-0-9]+}}(%r{{[sb]}}p), %rsi # 8-byte Reload
48+
; CHECK-NEXT: movq {{[-0-9]+}}(%r{{[sb]}}p), %rdx # 8-byte Reload
49+
; CHECK-NEXT: movq {{[-0-9]+}}(%r{{[sb]}}p), %rcx # 8-byte Reload
50+
; CHECK-NEXT: movq %rax, {{[-0-9]+}}(%r{{[sb]}}p) # 8-byte Spill
51+
; CHECK-NEXT: leaq 46(%rsp), %rdi
52+
; CHECK-NEXT: callq baz@PLT
53+
; CHECK-NEXT: # kill: def $rcx killed $rax
54+
; CHECK-NEXT: movq {{[-0-9]+}}(%r{{[sb]}}p), %rax # 8-byte Reload
55+
; CHECK-NEXT: movabsq $25769803816, %rcx # imm = 0x600000028
56+
; CHECK-NEXT: addq %rcx, %rsp
57+
; CHECK-NEXT: .cfi_def_cfa_offset 8
58+
; CHECK-NEXT: retq
59+
%large1 = alloca %large, align 1
60+
%ptrLarge1 = getelementptr inbounds %large, ptr %large1, i64 0, i64 0
61+
%large2 = alloca %large, align 1
62+
%ptrLarge2 = getelementptr inbounds %large, ptr %large2, i64 0, i64 0
63+
%large3 = alloca %large, align 1
64+
%ptrLarge3 = getelementptr inbounds %large, ptr %large3, i64 0, i64 0
65+
%large4 = alloca %large, align 1
66+
%ptrLarge4 = getelementptr inbounds %large, ptr %large4, i64 0, i64 0
67+
%large5 = alloca %large, align 1
68+
%ptrLarge5 = getelementptr inbounds %large, ptr %large5, i64 0, i64 0
69+
%ret1 = call ptr @baz(ptr %ptrLarge1, ptr %ptrLarge2, ptr %ptrLarge3, ptr %ptrLarge4)
70+
%large6 = alloca %large, align 1
71+
%ptrLarge6 = getelementptr inbounds %large, ptr %large6, i64 0, i64 0
72+
%ret2 = call ptr @baz(ptr %ptrLarge6, ptr %ptrLarge2, ptr %ptrLarge3, ptr %ptrLarge4)
73+
ret ptr %ret1
74+
}

‎llvm/test/CodeGen/X86/win64-stackprobe-overflow.ll

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,5 @@ start:
1010
attributes #0 = { nonlazybind uwtable "probe-stack"="probe_stack" "target-cpu"="x86-64" }
1111

1212
; CHECK-LABEL: foo:
13-
; CHECK: movabsq $4294967304, %rax
13+
; CHECK: movabsq $4294967312, %rax
1414
; CHECK-NEXT: callq probe_stack

0 commit comments

Comments
 (0)