Am 19.06.2012 04:31, schrieb Scott Wood:
If tci_out_label is called in the context of tcg_gen_code_search_pc, we
could be overwriting an already patched relocation with zero -- and not
repatch it because the set_label is past search_pc, causing a QEMU crash
when it tries to branch to a zero label.
Not writing anything to the relocation area seems to be in line with what
other backends do from the couple I looked at (x86, ppc).
Thanks, this might fix a crash which I have seen from time to time.
I'll run tests as soon as possible.
Could you please also look at the other backends?
I saw from git history that ppc once had the same bug.
The sparc backend (and maybe others) might still have it.
Regards,
Stefan W.
Signed-off-by: Scott Wood<scottw...@freescale.com>
---
tcg/tci/tcg-target.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/tcg/tci/tcg-target.c b/tcg/tci/tcg-target.c
index 453f187..3c6b0f5 100644
--- a/tcg/tci/tcg-target.c
+++ b/tcg/tci/tcg-target.c
@@ -487,7 +487,7 @@ static void tci_out_label(TCGContext *s, TCGArg arg)
assert(label->u.value);
} else {
tcg_out_reloc(s, s->code_ptr, sizeof(tcg_target_ulong), arg, 0);
- tcg_out_i(s, 0);
+ s->code_ptr += sizeof(tcg_target_ulong);
}
}
