diff options
| author | Richard Henderson <richard.henderson@linaro.org> | 2018-06-14 19:57:03 -1000 |
|---|---|---|
| committer | Richard Henderson <richard.henderson@linaro.org> | 2018-06-15 09:39:53 -1000 |
| commit | 9f754620651d3432114f4bb89c7f12cbea814b3e (patch) | |
| tree | 7450e7708caa0ef187fc4fb66d62695e33a2c82b /tcg/i386 | |
| parent | 0ac20318ce16f4de288969b2007ef5a654176058 (diff) | |
| download | qemu-9f754620651d3432114f4bb89c7f12cbea814b3e.zip qemu-9f754620651d3432114f4bb89c7f12cbea814b3e.tar.gz qemu-9f754620651d3432114f4bb89c7f12cbea814b3e.tar.bz2 | |
tcg: Reduce max TB opcode count
Also, assert that we don't overflow any of two different offsets into
the TB. Both unwind and goto_tb both record a uint16_t for later use.
This fixes an arm-softmmu test case utilizing NEON in which there is
a TB generated that runs to 7800 opcodes, and compiles to 96k on an
x86_64 host. This overflows the 16-bit offset in which we record the
goto_tb reset offset. Because of that overflow, we install a jump
destination that goes to neverland. Boom.
With this reduced op count, the same TB compiles to about 48k for
aarch64, ppc64le, and x86_64 hosts, and neither assertion fires.
Cc: qemu-stable@nongnu.org
Reported-by: "Jason A. Donenfeld" <Jason@zx2c4.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Diffstat (limited to 'tcg/i386')
| -rw-r--r-- | tcg/i386/tcg-target.inc.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tcg/i386/tcg-target.inc.c b/tcg/i386/tcg-target.inc.c index 0d0ff52..e87b0d4 100644 --- a/tcg/i386/tcg-target.inc.c +++ b/tcg/i386/tcg-target.inc.c @@ -2245,7 +2245,7 @@ static inline void tcg_out_op(TCGContext *s, TCGOpcode opc, tcg_out_modrm_offset(s, OPC_GRP5, EXT5_JMPN_Ev, -1, (intptr_t)(s->tb_jmp_target_addr + a0)); } - s->tb_jmp_reset_offset[a0] = tcg_current_code_size(s); + set_jmp_reset_offset(s, a0); break; case INDEX_op_goto_ptr: /* jmp to the given host address (could be epilogue) */ |