-
-
Notifications
You must be signed in to change notification settings - Fork 34.4k
The JIT's patch_aarch64_33rx relocation isn't safe #146128
Copy link
Copy link
Open
Labels
3.13bugs and security fixesbugs and security fixesdeferred-blockerinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)topic-JITtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
Metadata
Metadata
Assignees
Labels
3.13bugs and security fixesbugs and security fixesdeferred-blockerinterpreter-core(Objects, Python, Grammar, and Parser dirs)(Objects, Python, Grammar, and Parser dirs)topic-JITtype-crashA hard crash of the interpreter, possibly with a core dumpA hard crash of the interpreter, possibly with a core dump
We can't just combine
patch_aarch64_21randpatch_aarch64_12into one relaxed relocation without a deeper understanding of the control flow, unfortunately. The issue is that the code can can jump into the middle of the two instructions involved in the relocation, and the combined relaxation changes the meaning of that.This happens with
_IS_NONEon debug 3.13 builds for AArch64 Linux, so it's a legitimate concern. We just dodged the bullet because_IS_NONEis never actually emitted (we turn it into a guard).I think the best course of action is to remove the
patch_aarch64_33rxfrom3.13,3.14, andmain. Something like this probably belongs in the textual assembly optimization pass, since we actually reason about control flow there.I'll open the PRs to remove the bug first. If somebody (perhaps from Arm @diegorusso @markshannon?) can prove this relaxation is valuable and wants to add it back on
mainin that earlier pass, then feel free to do so.Linked PRs