66 lines · plain
1## This reproduces a bug with converting an unknown control flow jump table with2## entries pointing to code in function and its cold fragment.3 4# REQUIRES: system-linux5 6# RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown %s -o %t.o7# RUN: llvm-strip --strip-unneeded %t.o8# RUN: %clang %cflags %t.o -o %t.exe -Wl,-q9# RUN: llvm-bolt %t.exe -o %t.out --lite=0 -v=1 --strict=1 -print-cfg \10# RUN: -print-only=main 2>&1 | FileCheck %s11 12# CHECK: BOLT-INFO: marking main.cold.1 as a fragment of main13# CHECK: Binary Function "main" after building cfg14# CHECK: Unknown CF : true15# CHECK: jmpq *%r8 # UNKNOWN CONTROL FLOW16# CHECK: PIC Jump table JUMP_TABLE for function main17# CHECK-NEXT: 0x0000 : .Ltmp018# CHECK-NEXT: 0x0004 : .Ltmp119# CHECK-NEXT: 0x0008 : __ENTRY_main.cold.120# CHECK-NEXT: 0x000c : .Ltmp121 .text22 .globl main23 .type main, %function24 .p2align 225main:26LBB0:27 leaq JUMP_TABLE(%rip), %r828 andl $0xf, %ecx29 cmpb $0x4, %cl30 ## exit through abort in main.cold.1, registers cold fragment the regular way31 ja main.cold.132 33## jump table dispatch, jumping to label indexed by val in %ecx34LBB1:35 movzbl %cl, %ecx36 movslq (%r8,%rcx,4), %rax37 addq %rax, %r838 jmpq *%r839 40LBB2:41 xorq %rax, %rax42LBB3:43 addq $0x8, %rsp44 ret45.size main, .-main46 47 .globl main.cold.148 .type main.cold.1, %function49 .p2align 250main.cold.1:51 ## load bearing nop: pad LBB4 so that it can't be treated52 ## as __builtin_unreachable by analyzeJumpTable53 nop54LBB4:55 callq abort56.size main.cold.1, .-main.cold.157 58 .rodata59## jmp table, entries must be R_X86_64_PC32 relocs60 .globl JUMP_TABLE61JUMP_TABLE:62 .long LBB2-JUMP_TABLE63 .long LBB3-JUMP_TABLE64 .long LBB4-JUMP_TABLE65 .long LBB3-JUMP_TABLE66