From f7c5f0ccbeecedfd105b0c6db47ddda5ff414b75 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 12 Feb 2019 11:34:58 -0500
Subject: [PATCH] tcg: Diagnose referenced labels that have not been emitted

Currently, a jump to a label that is not defined anywhere will
be emitted not be relocated. This results in a jump to a random
jump target. With tcg debugging, print a diagnostic to the -d op
file and abort.

This could help debug or detect errors like
c2d9644e6d ("target/arm: Fix crash on conditional instruction in an IT block")

Backports commit bef16ab4e641636b4e85c3d863b4257ce0be4e6f from qemu
---
 qemu/tcg/tcg-op.h |  1 +
 qemu/tcg/tcg.c    | 23 +++++++++++++++++++++++
 qemu/tcg/tcg.h    | 12 +++++++++---
 3 files changed, 33 insertions(+), 3 deletions(-)

diff --git a/qemu/tcg/tcg-op.h b/qemu/tcg/tcg-op.h
index 075f2ff2..ce66b9d3 100644
--- a/qemu/tcg/tcg-op.h
+++ b/qemu/tcg/tcg-op.h
@@ -268,6 +268,7 @@ static inline void tcg_gen_op6ii_i64(TCGContext *s, TCGOpcode opc, TCGv_i64 a1,
 
 static inline void gen_set_label(TCGContext *s, TCGLabel *l)
 {
+    l->present = 1;
     tcg_gen_op1(s, INDEX_op_set_label, label_arg(s, l));
 }
 
diff --git a/qemu/tcg/tcg.c b/qemu/tcg/tcg.c
index d60b4ecf..b627baf5 100644
--- a/qemu/tcg/tcg.c
+++ b/qemu/tcg/tcg.c
@@ -254,6 +254,9 @@ TCGLabel *gen_new_label(TCGContext *s)
     TCGLabel ltmp = {0};
     ltmp.id = s->nb_labels++;
     *l = ltmp;
+#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_INSERT_TAIL(&s->labels, l, next);
+#endif
     return l;
 }
 
@@ -516,6 +519,9 @@ void tcg_func_start(TCGContext *s)
 
     QTAILQ_INIT(&s->ops);
     QTAILQ_INIT(&s->free_ops);
+#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_INIT(&s->labels);
+#endif
 }
 
 static inline TCGTemp *tcg_temp_alloc(TCGContext *s)
@@ -3270,6 +3276,23 @@ int tcg_gen_code(TCGContext *s, TranslationBlock *tb)
     }
 #endif
 
+#ifdef CONFIG_DEBUG_TCG
+    /* Ensure all labels referenced have been emitted.  */
+    {
+        TCGLabel *l;
+        bool error = false;
+
+        QSIMPLEQ_FOREACH(l, &s->labels, next) {
+            if (unlikely(!l->present) && l->refs) {
+                qemu_log_mask(CPU_LOG_TB_OP,
+                              "$L%d referenced but not present.\n", l->id);
+                error = true;
+            }
+        }
+        assert(!error);
+    }
+#endif
+
 #ifdef CONFIG_PROFILER
     s->opt_time -= profile_getclock();
 #endif
diff --git a/qemu/tcg/tcg.h b/qemu/tcg/tcg.h
index 2a0259fd..bf4977cb 100644
--- a/qemu/tcg/tcg.h
+++ b/qemu/tcg/tcg.h
@@ -250,16 +250,21 @@ typedef struct TCGRelocation {
     intptr_t addend;
 } TCGRelocation; 
 
-typedef struct TCGLabel {
+typedef struct TCGLabel TCGLabel;
+struct TCGLabel {
+    unsigned present : 1;
     unsigned has_value : 1;
-    unsigned id : 15;
+    unsigned id : 14;
     unsigned refs : 16;
     union {
         uintptr_t value;
         tcg_insn_unit *value_ptr;
         TCGRelocation *first_reloc;
     } u;
-} TCGLabel;
+#ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_ENTRY(TCGLabel) next;
+#endif
+};
 
 typedef struct TCGPool {
     struct TCGPool *next;
@@ -775,6 +780,7 @@ struct TCGContext {
 #endif
 
 #ifdef CONFIG_DEBUG_TCG
+    QSIMPLEQ_HEAD(, TCGLabel) labels;
     int temps_in_use;
     int goto_tb_issue_mask;
 #endif