blob: d81c23370bc624fae98b6c1e0fbd85abf6c88b9d [file] [log] [blame]
# In this test case, we reproduce the behavior seen in gcc where the
# base address of a data object is decremented by some number and lands
# inside a jump table from another function.
# REQUIRES: system-linux
# RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown %s -o %t.o
# RUN: llvm-strip --strip-unneeded %t.o
# RUN: %clang %cflags -no-pie -nostartfiles -nostdlib -lc %t.o -o %t.exe -Wl,-q
# RUN: llvm-bolt %t.exe -o %t.exe.bolt --relocs=1 --lite=0 \
# RUN: --reorder-blocks=reverse -jump-tables=move
# RUN: %t.exe.bolt 1 2 3
.file "jt-symbol-disambiguation-2.s"
# ----
# Func foo contains a jump table whose start is colocated with a
# symbol marking the end of a data table
# ----
.globl foo
.type foo, @function
xor %rax,%rax
and $0x3,%rdi
leaq .JT1(%rip), %rax
movslq (%rax, %rdi, 4), %rdi
addq %rax, %rdi
jmpq *%rdi
movl $0x1,%eax
jmp .LBB5
movl $0x2,%eax
jmp .LBB5
movl $0x3,%eax
jmp .LBB5
movl $0x4,%eax
.size foo, .-foo
# ----
# Func _start scans an object with indexed access using %rax * 8 as an
# index. However, %rax is known to be at least one, so the compiler
# loads the pointer for the base address as object - 8 instead of just
# object.
# ----
.globl _start
.type _start, @function
movq (%rsp), %rdi
callq foo
xorq %rbx, %rbx
leaq .object-8(%rip), %rsi # indexed access base address
movq $1, %rax # start index
cmpq $4, %rax
je .LBB7
addq (%rsi,%rax,8), %rbx
incq %rax # ++iterator
jmp .LBB6
cmpq $1368, %rbx # check .object contents integrity
jne .LBB_BAD
xor %rdi, %rdi
callq exit@PLT
leaq .message, %rdi
callq puts@PLT
movq $1, %rdi
callq exit@PLT
.size _start, .-_start
# ----
# Data section
# ----
.section .rodata,"a",@progbits
.p2align 3
.long .LBB1 - .JT1
.long .LBB2 - .JT1
.long .LBB3 - .JT1
.long .LBB4 - .JT1
.quad 123
.quad 456
.quad 789
.asciz "RUNTIME ASSERTION FAILURE: references in test binary are corrupt after BOLT"