Fix ARM/ARM64 hijacking in tail calls (#16039)
authorJan Vorlicek <janvorli@microsoft.com>
Wed, 14 Feb 2018 09:15:19 +0000 (10:15 +0100)
committerGitHub <noreply@github.com>
Wed, 14 Feb 2018 09:15:19 +0000 (10:15 +0100)
commit4fb985121e782822f45e5a92f251fb7b4382b016
tree0cba62126474ad82bb55d60092342c0c3b87f32f
parent27af160a1d969c373894f1895c48fa43022f4aaa
Fix ARM/ARM64 hijacking in tail calls (#16039)

* Fix ARM/ARM64 hijacking in tail calls

This change fixes an issue that can happen when a function that has tail
calls is hijacked. There are two potential issues:

1. When a function that tail calls another one is hijacked, the LR may be
stored at a different location in the stack frame of the tail call
target.
So just by performing tail call, the hijacked location becomes invalid and
unhijacking would corrupt stack by writing to that location.

2. There is a small window after the caller pops LR from the stack in its
epilog and before the tail called function pushes LR in its prolog when
the hijacked return address would not be not on the stack and so we would
not be able to unhijack.

The fix is to prevent hijacking of functions that contain tail calls.

* Enable the tailcall hijacking test for ARM64

The test JIT/Methodical/tailcall_v4/hijacking should be passing now on
ARM64.
18 files changed:
src/gcdump/gcdumpnonx86.cpp
src/gcinfo/gcinfodumper.cpp
src/gcinfo/gcinfoencoder.cpp
src/inc/eetwain.h
src/inc/gcinfodecoder.h
src/inc/gcinfoencoder.h
src/jit/codegencommon.cpp
src/jit/codegeninterface.h
src/jit/compiler.h
src/jit/gcencode.cpp
src/jit/legacynonjit/CMakeLists.txt
src/vm/eetwain.cpp
src/vm/gcinfodecoder.cpp
src/vm/stackwalk.cpp
src/vm/stackwalk.h
src/vm/threadsuspend.cpp
tests/arm64/Tests.lst
tests/testsFailingOnArm64.txt