Skip to content

Commit 0a74c4e

Browse files
committed
Fix JIT buffer overrun for Vector256<T> on ARM64.
1 parent 3b68eb3 commit 0a74c4e

File tree

8 files changed

+7
-19
lines changed

8 files changed

+7
-19
lines changed

src/coreclr/src/jit/compiler.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1738,6 +1738,10 @@ struct fgArgTabEntry
17381738
#else
17391739
unsigned int regSize = 1;
17401740
#endif
1741+
1742+
if (numRegs > MAX_ARG_REG_COUNT)
1743+
NO_WAY("Multireg argument exceeds the maximum length");
1744+
17411745
for (unsigned int regIndex = 1; regIndex < numRegs; regIndex++)
17421746
{
17431747
argReg = (regNumber)(argReg + regSize);

src/coreclr/src/tools/Common/Compiler/VectorFieldLayoutAlgorithm.cs

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,6 @@ public override ValueTypeShapeCharacteristics ComputeValueTypeShapeCharacteristi
9696
{
9797
8 => ValueTypeShapeCharacteristics.Vector64Aggregate,
9898
16 => ValueTypeShapeCharacteristics.Vector128Aggregate,
99-
32 => ValueTypeShapeCharacteristics.Vector256Aggregate,
10099
_ => ValueTypeShapeCharacteristics.None
101100
};
102101
}
@@ -107,9 +106,7 @@ public static bool IsVectorType(DefType type)
107106
{
108107
return type.IsIntrinsic &&
109108
type.Namespace == "System.Runtime.Intrinsics" &&
110-
(type.Name == "Vector64`1" ||
111-
type.Name == "Vector128`1" ||
112-
type.Name == "Vector256`1") &&
109+
((type.Name == "Vector64`1") || (type.Name == "Vector128`1")) &&
113110
type.Instantiation[0].IsPrimitive;
114111
}
115112
}

src/coreclr/src/tools/Common/JitInterface/CorInfoImpl.cs

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2206,15 +2206,14 @@ private CorInfoType getHFAType(CORINFO_CLASS_STRUCT_* hClass)
22062206
var type = (DefType)HandleToObject(hClass);
22072207

22082208
// For 8-byte vectors return CORINFO_TYPE_DOUBLE, which is mapped by JIT to SIMD8.
2209-
// Otherwise, return CORINFO_TYPE_VALUECLASS, which is mapped by JIT to SIMD16.
2209+
// For 16-byte vectors return CORINFO_TYPE_VALUECLASS, which is mapped by JIT to SIMD16.
22102210
// See MethodTable::GetHFAType and Compiler::GetHfaType.
22112211
return (type.ValueTypeShapeCharacteristics & ValueTypeShapeCharacteristics.AggregateMask) switch
22122212
{
22132213
ValueTypeShapeCharacteristics.Float32Aggregate => CorInfoType.CORINFO_TYPE_FLOAT,
22142214
ValueTypeShapeCharacteristics.Float64Aggregate => CorInfoType.CORINFO_TYPE_DOUBLE,
22152215
ValueTypeShapeCharacteristics.Vector64Aggregate => CorInfoType.CORINFO_TYPE_DOUBLE,
22162216
ValueTypeShapeCharacteristics.Vector128Aggregate => CorInfoType.CORINFO_TYPE_VALUECLASS,
2217-
ValueTypeShapeCharacteristics.Vector256Aggregate => CorInfoType.CORINFO_TYPE_VALUECLASS,
22182217
_ => CorInfoType.CORINFO_TYPE_UNDEF
22192218
};
22202219
}

src/coreclr/src/tools/Common/TypeSystem/Common/DefType.FieldLayout.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -321,7 +321,6 @@ public int GetHomogeneousAggregateElementSize()
321321
ValueTypeShapeCharacteristics.Float64Aggregate => 8,
322322
ValueTypeShapeCharacteristics.Vector64Aggregate => 8,
323323
ValueTypeShapeCharacteristics.Vector128Aggregate => 16,
324-
ValueTypeShapeCharacteristics.Vector256Aggregate => 16,
325324
_ => throw new InvalidOperationException()
326325
};
327326
}

src/coreclr/src/tools/Common/TypeSystem/Common/FieldLayoutAlgorithm.cs

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -132,11 +132,6 @@ public enum ValueTypeShapeCharacteristics
132132
/// </summary>
133133
Vector128Aggregate = 0x08,
134134

135-
/// <summary>
136-
/// The type is an aggregate of 256-bit short-vector values.
137-
/// </summary>
138-
Vector256Aggregate = 0x10,
139-
140135
/// <summary>
141136
/// The mask for homogeneous aggregates of floating-point values.
142137
/// </summary>
@@ -145,7 +140,7 @@ public enum ValueTypeShapeCharacteristics
145140
/// <summary>
146141
/// The mask for homogeneous aggregates of short-vector values.
147142
/// </summary>
148-
ShortVectorAggregateMask = Vector64Aggregate | Vector128Aggregate | Vector256Aggregate,
143+
ShortVectorAggregateMask = Vector64Aggregate | Vector128Aggregate,
149144

150145
/// <summary>
151146
/// The mask for homogeneous aggregates.

src/coreclr/src/tools/Common/TypeSystem/Common/MetadataFieldLayoutAlgorithm.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -906,7 +906,6 @@ private ValueTypeShapeCharacteristics ComputeHomogeneousAggregateCharacteristic(
906906
ValueTypeShapeCharacteristics.Float64Aggregate => 8,
907907
ValueTypeShapeCharacteristics.Vector64Aggregate => 8,
908908
ValueTypeShapeCharacteristics.Vector128Aggregate => 16,
909-
ValueTypeShapeCharacteristics.Vector256Aggregate => 32,
910909
_ => throw new ArgumentOutOfRangeException()
911910
};
912911

src/coreclr/src/tools/crossgen2/ILCompiler.ReadyToRun/Compiler/DependencyAnalysis/ReadyToRun/TypeFixupSignature.cs

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,6 @@ private static void EncodeTypeLayout(ObjectDataSignatureBuilder dataBuilder, Typ
8888
ValueTypeShapeCharacteristics.Vector64Aggregate => CorElementType.ELEMENT_TYPE_R8,
8989
// See MethodTable::GetHFAType
9090
ValueTypeShapeCharacteristics.Vector128Aggregate => CorElementType.ELEMENT_TYPE_VALUETYPE,
91-
ValueTypeShapeCharacteristics.Vector256Aggregate => CorElementType.ELEMENT_TYPE_VALUETYPE,
9291
_ => CorElementType.Invalid
9392
};
9493
dataBuilder.EmitUInt((uint)elementType);

src/coreclr/src/vm/class.cpp

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1195,10 +1195,6 @@ int MethodTable::GetVectorSize()
11951195
{
11961196
vectorSize = 16;
11971197
}
1198-
else if (strcmp(className, "Vector256`1") == 0)
1199-
{
1200-
vectorSize = 32;
1201-
}
12021198
else if (strcmp(className, "Vector64`1") == 0)
12031199
{
12041200
vectorSize = 8;

0 commit comments

Comments
 (0)