Skip to content

Can address overflow in RhpNewFast? #105949

@huoyaoyuan

Description

@huoyaoyuan

Currently in fast allocation helper for NativeAOT, the asm routines are using alloc_ptr + BaseSize > alloc_limit:

;;
;; eax: base size
;; rcx: MethodTable pointer
;; rdx: Thread pointer
;;
mov rax, [rdx + OFFSETOF__Thread__m_alloc_context__alloc_ptr]
add r8, rax
cmp r8, [rdx + OFFSETOF__Thread__m_alloc_context__alloc_limit]
ja RhpNewFast_RarePath

The portable implementation in coreclr is using size > alloc_limit - alloc_ptr:

if (size > static_cast<SIZE_T>(allocContext->alloc_limit - allocPtr))
{
// Tail call to the slow helper
return HCCALL1(JIT_New, typeHnd_);
}

The nativeaot way can potentially overflow if the pointers are close to upper limit of uint32 or uint64 space. However, it saves an arithmetic operation, since alloc_ptr + BaseSize will be always used as the new alloc_ptr.

Which one should be preferred? Can the nativeaot routine be rewritten into C like coreclr?

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    No status

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions