From 311322beb96c5475fd7030fcd2f6e7ff14918853 Mon Sep 17 00:00:00 2001 From: Andy Ayers Date: Thu, 7 Jun 2018 23:16:56 -0700 Subject: [PATCH] JIT: Fix bug in finally cloning caused by unsound callfinally reordering (#18348) We need to make sure that if we reorder a callfinally during finally cloning that the callfinally is actually the one being targeted by the last block in the try range. Closes #18332. Linked issue has some more detailed notes. --- src/jit/flowgraph.cpp | 49 ++++++++++++------- .../JitBlue/GitHub_18332/GitHub_18332.cs | 56 ++++++++++++++++++++++ .../JitBlue/GitHub_18332/GitHub_18332.csproj | 34 +++++++++++++ 3 files changed, 122 insertions(+), 17 deletions(-) create mode 100644 tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.cs create mode 100644 tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.csproj diff --git a/src/jit/flowgraph.cpp b/src/jit/flowgraph.cpp index 544fdc3..3d5c37b 100644 --- a/src/jit/flowgraph.cpp +++ b/src/jit/flowgraph.cpp @@ -24492,32 +24492,44 @@ void Compiler::fgCloneFinally() // We better have found at least one call finally. assert(firstCallFinallyBlock != nullptr); - // If there is more than one callfinally, move the one we are - // going to retarget to be first in the callfinally range. + // If there is more than one callfinally, we'd like to move + // the one we are going to retarget to be first in the callfinally, + // but only if it's targeted by the last block in the try range. if (firstCallFinallyBlock != normalCallFinallyBlock) { - JITDUMP("Moving callfinally BB%02u to be first in line, before BB%02u\n", normalCallFinallyBlock->bbNum, - firstCallFinallyBlock->bbNum); - - BasicBlock* const firstToMove = normalCallFinallyBlock; - BasicBlock* const lastToMove = normalCallFinallyBlock->bbNext; BasicBlock* const placeToMoveAfter = firstCallFinallyBlock->bbPrev; - fgUnlinkRange(firstToMove, lastToMove); - fgMoveBlocksAfter(firstToMove, lastToMove, placeToMoveAfter); + if ((placeToMoveAfter->bbJumpKind == BBJ_ALWAYS) && + (placeToMoveAfter->bbJumpDest == normalCallFinallyBlock)) + { + JITDUMP("Moving callfinally BB%02u to be first in line, before BB%02u\n", + normalCallFinallyBlock->bbNum, firstCallFinallyBlock->bbNum); + + BasicBlock* const firstToMove = normalCallFinallyBlock; + BasicBlock* const lastToMove = normalCallFinallyBlock->bbNext; + + fgUnlinkRange(firstToMove, lastToMove); + fgMoveBlocksAfter(firstToMove, lastToMove, placeToMoveAfter); #ifdef DEBUG - // Sanity checks - fgDebugCheckBBlist(false, false); - fgVerifyHandlerTab(); + // Sanity checks + fgDebugCheckBBlist(false, false); + fgVerifyHandlerTab(); #endif // DEBUG - assert(nextBlock == lastBlock->bbNext); + assert(nextBlock == lastBlock->bbNext); - // Update where the callfinally range begins, since we might - // have altered this with callfinally rearrangement, and/or - // the range begin might have been pretty loose to begin with. - firstCallFinallyRangeBlock = normalCallFinallyBlock; + // Update where the callfinally range begins, since we might + // have altered this with callfinally rearrangement, and/or + // the range begin might have been pretty loose to begin with. + firstCallFinallyRangeBlock = normalCallFinallyBlock; + } + else + { + JITDUMP("Can't move callfinally BB%02u to be first in line" + " -- last finally block BB%02u doesn't jump to it\n", + normalCallFinallyBlock->bbNum, placeToMoveAfter->bbNum); + } } } @@ -24690,6 +24702,9 @@ void Compiler::fgCloneFinally() { // We can't retarget this call since it // returns somewhere else. + JITDUMP("Can't retarget callfinally in BB%02u as it jumps to BB%02u, not BB%02u\n", + currentBlock->bbNum, postTryFinallyBlock->bbNum, normalCallFinallyReturn->bbNum); + retargetedAllCalls = false; } } diff --git a/tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.cs b/tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.cs new file mode 100644 index 0000000..57d6239 --- /dev/null +++ b/tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.cs @@ -0,0 +1,56 @@ +// Licensed to the .NET Foundation under one or more agreements. +// The .NET Foundation licenses this file to you under the MIT license. +// See the LICENSE file in the project root for more information. + +using System; +using System.Collections.Generic; + +internal class Foo : IDisposable +{ + public void Dispose() + { + } +} + +class GitHub_18332 +{ + // In Aargh there is a finally with two distinct exit paths. + // Finally cloning may choose the non-fall through ("wibble") exit + // path to clone, and then will try to incorrectly arrange for + // that path to become the fall through. + public static string Aargh() + { + using (var foo = new Foo()) + { + foreach (var i in new List()) + { + try + { + Console.WriteLine("here"); + } + catch (Exception) + { + return "wibble"; + } + } + + foreach (var i in new List()) + { + } + } + + return "wobble"; + } + + public static int Main(string[] args) + { + string expected = "wobble"; + string actual = Aargh(); + if (actual != expected) + { + Console.WriteLine($"FAIL: Aargh() returns '{actual}' expected '{expected}'"); + return 0; + } + return 100; + } +} diff --git a/tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.csproj b/tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.csproj new file mode 100644 index 0000000..c776f7d --- /dev/null +++ b/tests/src/JIT/Regression/JitBlue/GitHub_18332/GitHub_18332.csproj @@ -0,0 +1,34 @@ + + + + + Debug + AnyCPU + $(MSBuildProjectName) + 2.0 + {95DFC527-4DC1-495E-97D7-E94EE1F7140D} + Exe + {786C830F-07A1-408B-BD7F-6EE04809D6DB};{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC} + ..\..\ + + + + + + + False + + + + + True + + + + + + + + + + \ No newline at end of file -- 2.7.4