[MC][WebAssembly] Fix crash when relocation addend underflows U32

[sbc100]

Summary

For the object file writer we need to allow the underflow (ar write
zero), but for the final linker output we should probably generate an
error (I've left that as a TODO for now).

Fixes: https://github.com/llvm/llvm-project/issues/54012

[sbc100]

• more testing

[sbc100]

• cleanup

[dschuff]

lld/wasm/InputChunks.cpp

119–122

Would this be the place to put the underflow check? If so, maybe a TODO here as well as in the test?

[sbc100]

• TODO

lld/test/wasm/reloc-addend.s

 # RUN: llvm-mc -filetype=obj -triple=wasm32-unknown-unknown -o %t.o %s
 # RUN: wasm-ld -r -o %t.wasm %t.o
 # RUN: obj2yaml %t.wasm | FileCheck %s
+# RUN: llvm-objdump --disassemble-symbols=_start --no-show-raw-insn --no-leading-addr %t.wasm | FileCheck %s --check-prefixes DIS
 
 .hidden foo
 .hidden bar
 .globl  foo
 .globl  bar
 
 # Similar to what would be generated from: `int foo[76]`
   .section  .bss.foo,"",@

 
 # Check that negative addends also work here
   .section  .data.negative_addend,"",@
   .p2align  2
 negative_addend:
   .int32  foo-16
   .size negative_addend, 4
 
+.globl _start
+.section .text,"",@
+_start:
+  .functype _start () -> ()
+  i32.const 0
+  i32.load foo + 10
+  drop
+  i32.const 0
+  i32.load foo - 10
+  drop
+  i32.const 0
+  # This will underflow because i32.load (and the
+  # corresponding relocation type) take an unsgiend (U32)
+  # immediate.
+  i32.load foo - 2048
+  drop
+  end_function
+
+# CHECK:       - Type:            CODE
+# CHECK-NEXT:    Relocations:
+# CHECK-NEXT:      - Type:            R_WASM_MEMORY_ADDR_LEB
+# CHECK-NEXT:        Index:           0
+# CHECK-NEXT:        Offset:          0x7
+# CHECK-NEXT:        Addend:          10
+# CHECK-NEXT:      - Type:            R_WASM_MEMORY_ADDR_LEB
+# CHECK-NEXT:        Index:           0
+# CHECK-NEXT:        Offset:          0x11
+# CHECK-NEXT:        Addend:          -10
+# CHECK-NEXT:      - Type:            R_WASM_MEMORY_ADDR_LEB
+# CHECK-NEXT:        Index:           0
+# CHECK-NEXT:        Offset:          0x1B
+# CHECK-NEXT:        Addend:          -2048
+
 # CHECK:        - Type:            DATA
 # CHECK-NEXT:     Relocations:
 # CHECK-NEXT:       - Type:            R_WASM_MEMORY_ADDR_I32
 # CHECK-NEXT:         Index:           0
 # CHECK-NEXT:         Offset:          0x6
 # CHECK-NEXT:         Addend:          64
 # CHECK-NEXT:       - Type:            R_WASM_MEMORY_ADDR_I32
 # CHECK-NEXT:         Index:           0
 # CHECK-NEXT:         Offset:          0xF
 # CHECK-NEXT:         Addend:          -16
+
+# DIS: <_start>:
+# DIS-EMPTY:
+# DIS-NEXT:    i32.const 0
+# DIS-NEXT:    i32.load 26
+# DIS-NEXT:    drop
+# DIS-NEXT:    i32.const 0
+# DIS-NEXT:    i32.load 6
+# DIS-NEXT:    drop
+# DIS-NEXT:    i32.const 0
+# TODO(sbc): We should probably error here rather than allowing u32 to wrap
+# DIS-NEXT:    i32.load 4294965264
+# DIS-NEXT:    drop
+# DIS-NEXT:    end

lld/wasm/InputChunks.cpp

void InputChunk::relocate(uint8_t *buf) const {
 
   for (const WasmRelocation &rel : relocations) {
     uint8_t *loc = buf + rel.Offset - inputSectionOffset;
     LLVM_DEBUG(dbgs() << "apply reloc: type=" << relocTypeToString(rel.Type));
     if (rel.Type != R_WASM_TYPE_INDEX_LEB)
       LLVM_DEBUG(dbgs() << " sym=" << file->getSymbols()[rel.Index]->getName());
     LLVM_DEBUG(dbgs() << " addend=" << rel.Addend << " index=" << rel.Index
                       << " offset=" << rel.Offset << "\n");
-    auto value = file->calcNewValue(rel, tombstone, this);
+    // TODO(sbc): Check that the value is within the range of the
+    // relocation type below.  Most likely we must error out here
+    // if its not with range.
+    uint64_t value = file->calcNewValue(rel, tombstone, this);
 
     switch (rel.Type) {
     case R_WASM_TYPE_INDEX_LEB:
     case R_WASM_FUNCTION_INDEX_LEB:
     case R_WASM_GLOBAL_INDEX_LEB:
     case R_WASM_TAG_INDEX_LEB:
     case R_WASM_MEMORY_ADDR_LEB:
     case R_WASM_TABLE_NUMBER_LEB:
-      encodeULEB128(value, loc, 5);
+      encodeULEB128(static_cast<uint32_t>(value), loc, 5);
       break;
     case R_WASM_MEMORY_ADDR_LEB64:
       encodeULEB128(value, loc, 10);
       break;
     case R_WASM_TABLE_INDEX_SLEB:
     case R_WASM_TABLE_INDEX_REL_SLEB:
     case R_WASM_MEMORY_ADDR_SLEB:
     case R_WASM_MEMORY_ADDR_REL_SLEB:

lld/wasm/InputFiles.h

public:
   void parse(bool ignoreComdats = false);
 
   // Returns the underlying wasm file.
   const WasmObjectFile *getWasmObj() const { return wasmObj.get(); }
 
   uint32_t calcNewIndex(const WasmRelocation &reloc) const;
   uint64_t calcNewValue(const WasmRelocation &reloc, uint64_t tombstone,
                         const InputChunk *chunk) const;
-  uint64_t calcNewAddend(const WasmRelocation &reloc) const;
+  int64_t calcNewAddend(const WasmRelocation &reloc) const;
   Symbol *getSymbol(const WasmRelocation &reloc) const {
     return symbols[reloc.Index];
   };
 
   const WasmSection *codeSection = nullptr;
   const WasmSection *dataSection = nullptr;
 
   // Maps input type indices to output type indices

lld/wasm/InputFiles.cpp

uint32_t ObjFile::calcNewIndex(const WasmRelocation &reloc) const {
   const Symbol *sym = symbols[reloc.Index];
   if (auto *ss = dyn_cast<SectionSymbol>(sym))
     sym = ss->getOutputSectionSymbol();
   return sym->getOutputSymbolIndex();
 }
 
 // Relocations can contain addend for combined sections. This function takes a
 // relocation and returns updated addend by offset in the output section.
-uint64_t ObjFile::calcNewAddend(const WasmRelocation &reloc) const {
+int64_t ObjFile::calcNewAddend(const WasmRelocation &reloc) const {
   switch (reloc.Type) {
   case R_WASM_MEMORY_ADDR_LEB:
   case R_WASM_MEMORY_ADDR_LEB64:
   case R_WASM_MEMORY_ADDR_SLEB64:
   case R_WASM_MEMORY_ADDR_SLEB:
   case R_WASM_MEMORY_ADDR_REL_SLEB:
   case R_WASM_MEMORY_ADDR_REL_SLEB64:
   case R_WASM_MEMORY_ADDR_I32:

llvm/lib/MC/WasmObjectWriter.cpp

 
 #if !defined(NDEBUG)
 raw_ostream &operator<<(raw_ostream &OS, const WasmRelocationEntry &Rel) {
   Rel.print(OS);
   return OS;
 }
 #endif
 
-// Write X as an (unsigned) LEB value at offset Offset in Stream, padded
+// Write Value as an (unsigned) LEB value at offset Offset in Stream, padded
 // to allow patching.
-template <int W>
-void writePatchableLEB(raw_pwrite_stream &Stream, uint64_t X, uint64_t Offset) {
+template <typename T, int W>
+void writePatchableULEB(raw_pwrite_stream &Stream, T Value, uint64_t Offset) {
   uint8_t Buffer[W];
-  unsigned SizeLen = encodeULEB128(X, Buffer, W);
+  unsigned SizeLen = encodeULEB128(Value, Buffer, W);
   assert(SizeLen == W);
   Stream.pwrite((char *)Buffer, SizeLen, Offset);
 }
 
-// Write X as an signed LEB value at offset Offset in Stream, padded
+// Write Value as an signed LEB value at offset Offset in Stream, padded
 // to allow patching.
-template <int W>
-void writePatchableSLEB(raw_pwrite_stream &Stream, int64_t X, uint64_t Offset) {
+template <typename T, int W>
+void writePatchableSLEB(raw_pwrite_stream &Stream, T Value, uint64_t Offset) {
   uint8_t Buffer[W];
-  unsigned SizeLen = encodeSLEB128(X, Buffer, W);
+  unsigned SizeLen = encodeSLEB128(Value, Buffer, W);
   assert(SizeLen == W);
   Stream.pwrite((char *)Buffer, SizeLen, Offset);
 }
 
-// Write X as a plain integer value at offset Offset in Stream.
-static void patchI32(raw_pwrite_stream &Stream, uint32_t X, uint64_t Offset) {
+static void writePatchableU32(raw_pwrite_stream &Stream, uint32_t Value,
+                              uint64_t Offset) {
+  writePatchableULEB<uint32_t, 5>(Stream, Value, Offset);
+}
+
+static void writePatchableS32(raw_pwrite_stream &Stream, int32_t Value,
+                              uint64_t Offset) {
+  writePatchableSLEB<int32_t, 5>(Stream, Value, Offset);
+}
+
+static void writePatchableU64(raw_pwrite_stream &Stream, uint64_t Value,
+                              uint64_t Offset) {
+  writePatchableSLEB<uint64_t, 10>(Stream, Value, Offset);
+}
+
+static void writePatchableS64(raw_pwrite_stream &Stream, int64_t Value,
+                              uint64_t Offset) {
+  writePatchableSLEB<int64_t, 10>(Stream, Value, Offset);
+}
+
+// Write Value as a plain integer value at offset Offset in Stream.
+static void patchI32(raw_pwrite_stream &Stream, uint32_t Value,
+                     uint64_t Offset) {
   uint8_t Buffer[4];
-  support::endian::write32le(Buffer, X);
+  support::endian::write32le(Buffer, Value);
   Stream.pwrite((char *)Buffer, sizeof(Buffer), Offset);
 }
 
-static void patchI64(raw_pwrite_stream &Stream, uint64_t X, uint64_t Offset) {
+static void patchI64(raw_pwrite_stream &Stream, uint64_t Value,
+                     uint64_t Offset) {
   uint8_t Buffer[8];
-  support::endian::write64le(Buffer, X);
+  support::endian::write64le(Buffer, Value);
   Stream.pwrite((char *)Buffer, sizeof(Buffer), Offset);
 }
 
 bool isDwoSection(const MCSection &Sec) {
   return Sec.getName().endswith(".dwo");
 }
 
 class WasmObjectWriter : public MCObjectWriter {
void WasmObjectWriter::endSection(SectionBookkeeping &Section) {
   Size -= Section.PayloadOffset;
   if (uint32_t(Size) != Size)
     report_fatal_error("section size does not fit in a uint32_t");
 
   LLVM_DEBUG(dbgs() << "endSection size=" << Size << "\n");
 
   // Write the final section size to the payload_len field, which follows
   // the section id byte.
-  writePatchableLEB<5>(static_cast<raw_pwrite_stream &>(W->OS), Size,
-                       Section.SizeOffset);
+  writePatchableU32(static_cast<raw_pwrite_stream &>(W->OS), Size,
 }
 
 // Emit the Wasm header.
 void WasmObjectWriter::writeHeader(const MCAssembler &Asm) {
   W->OS.write(wasm::WasmMagic, sizeof(wasm::WasmMagic));
   W->write<uint32_t>(wasm::WasmVersion);
 }
 
void WasmObjectWriter::applyRelocations(
     const MCAsmLayout &Layout) {
   auto &Stream = static_cast<raw_pwrite_stream &>(W->OS);
   for (const WasmRelocationEntry &RelEntry : Relocations) {
     uint64_t Offset = ContentsOffset +
                       RelEntry.FixupSection->getSectionOffset() +
                       RelEntry.Offset;
 
     LLVM_DEBUG(dbgs() << "applyRelocation: " << RelEntry << "\n");
-    auto Value = getProvisionalValue(RelEntry, Layout);
+    uint64_t Value = getProvisionalValue(RelEntry, Layout);
 
     switch (RelEntry.Type) {
     case wasm::R_WASM_FUNCTION_INDEX_LEB:
     case wasm::R_WASM_TYPE_INDEX_LEB:
     case wasm::R_WASM_GLOBAL_INDEX_LEB:
     case wasm::R_WASM_MEMORY_ADDR_LEB:
     case wasm::R_WASM_TAG_INDEX_LEB:
     case wasm::R_WASM_TABLE_NUMBER_LEB:
-      writePatchableLEB<5>(Stream, Value, Offset);
+      writePatchableU32(Stream, Value, Offset);
       break;
     case wasm::R_WASM_MEMORY_ADDR_LEB64:
-      writePatchableLEB<10>(Stream, Value, Offset);
+      writePatchableU64(Stream, Value, Offset);
       break;
     case wasm::R_WASM_TABLE_INDEX_I32:
     case wasm::R_WASM_MEMORY_ADDR_I32:
     case wasm::R_WASM_FUNCTION_OFFSET_I32:
     case wasm::R_WASM_SECTION_OFFSET_I32:
     case wasm::R_WASM_GLOBAL_INDEX_I32:
     case wasm::R_WASM_MEMORY_ADDR_LOCREL_I32:
       patchI32(Stream, Value, Offset);
       break;
     case wasm::R_WASM_TABLE_INDEX_I64:
     case wasm::R_WASM_MEMORY_ADDR_I64:
     case wasm::R_WASM_FUNCTION_OFFSET_I64:
       patchI64(Stream, Value, Offset);
       break;
     case wasm::R_WASM_TABLE_INDEX_SLEB:
     case wasm::R_WASM_TABLE_INDEX_REL_SLEB:
     case wasm::R_WASM_MEMORY_ADDR_SLEB:
     case wasm::R_WASM_MEMORY_ADDR_REL_SLEB:
     case wasm::R_WASM_MEMORY_ADDR_TLS_SLEB:
-      writePatchableSLEB<5>(Stream, Value, Offset);
+      writePatchableS32(Stream, Value, Offset);
       break;
     case wasm::R_WASM_TABLE_INDEX_SLEB64:
     case wasm::R_WASM_TABLE_INDEX_REL_SLEB64:
     case wasm::R_WASM_MEMORY_ADDR_SLEB64:
     case wasm::R_WASM_MEMORY_ADDR_REL_SLEB64:
     case wasm::R_WASM_MEMORY_ADDR_TLS_SLEB64:
-      writePatchableSLEB<10>(Stream, Value, Offset);
+      writePatchableS64(Stream, Value, Offset);
       break;
     default:
       llvm_unreachable("invalid relocation type");
     }
   }
 }
 
 void WasmObjectWriter::writeTypeSection(

llvm/test/MC/WebAssembly/reloc-code.s

 # RUN: llvm-mc -triple=wasm32-unknown-unknown -filetype=obj %s -o - | llvm-readobj -r --expand-relocs - | FileCheck %s
 # RUN: llvm-mc -triple=wasm32-unknown-unknown -mattr=+reference-types -filetype=obj %s -o - | llvm-readobj -r --expand-relocs - | FileCheck --check-prefix=REF %s
 
 # External functions
 .functype c () -> (i32)
 .functype d () -> (i32)
 
 .globl  f1
 .globl  a
 .globl  b
 
 f1:
   .functype f1 () -> (i32)
 
   # Call functions at `a` and `b` indirectly.
   i32.const 0
-  i32.load  a
+  i32.load  a - 10
   call_indirect  () -> (i64)
   drop
 
   i32.const 0
-  i32.load  b
+  i32.load  b + 20
   call_indirect  () -> (i32)
   drop
 
   # Call functions `c` and `d` directly
   call  c
   drop
   call  d
   end_function

 
 # CHECK: Format: WASM
 # CHECK: Relocations [
 # CHECK-NEXT:   Section (5) CODE {
 # CHECK-NEXT:     Relocation {
 # CHECK-NEXT:       Type: R_WASM_MEMORY_ADDR_LEB (3)
 # CHECK-NEXT:       Offset: 0x7
 # CHECK-NEXT:       Symbol: a
-# CHECK-NEXT:       Addend: 0
+# CHECK-NEXT:       Addend: -10
 # CHECK-NEXT:     }
 # CHECK-NEXT:     Relocation {
 # CHECK-NEXT:       Type: R_WASM_TYPE_INDEX_LEB (6)
 # CHECK-NEXT:       Offset: 0xD
 # CHECK-NEXT:       Index: 0x1
 # CHECK-NEXT:     }
 # CHECK-NEXT:     Relocation {
 # CHECK-NEXT:       Type: R_WASM_MEMORY_ADDR_LEB (3)
 # CHECK-NEXT:       Offset: 0x18
 # CHECK-NEXT:       Symbol: b
-# CHECK-NEXT:       Addend: 0
+# CHECK-NEXT:       Addend: 20
 # CHECK-NEXT:     }
 # CHECK-NEXT:     Relocation {
 # CHECK-NEXT:       Type: R_WASM_TYPE_INDEX_LEB (6)
 # CHECK-NEXT:       Offset: 0x1E
 # CHECK-NEXT:       Index: 0x0
 # CHECK-NEXT:     }
 # CHECK-NEXT:     Relocation {
 # CHECK-NEXT:       Type: R_WASM_FUNCTION_INDEX_LEB (0)

 
 # REF: Format: WASM
 # REF: Relocations [
 # REF-NEXT:   Section (5) CODE {
 # REF-NEXT:     Relocation {
 # REF-NEXT:       Type: R_WASM_MEMORY_ADDR_LEB (3)
 # REF-NEXT:       Offset: 0x7
 # REF-NEXT:       Symbol: a
-# REF-NEXT:       Addend: 0
+# REF-NEXT:       Addend: -10
 # REF-NEXT:     }
 # REF-NEXT:     Relocation {
 # REF-NEXT:       Type: R_WASM_TYPE_INDEX_LEB (6)
 # REF-NEXT:       Offset: 0xD
 # REF-NEXT:       Index: 0x1
 # REF-NEXT:     }
 # REF-NEXT:     Relocation {
 # REF-NEXT:       Type: R_WASM_TABLE_NUMBER_LEB (20)
 # REF-NEXT:       Offset: 0x12
 # REF-NEXT:       Symbol: __indirect_function_table
 # REF-NEXT:     }
 # REF-NEXT:     Relocation {
 # REF-NEXT:       Type: R_WASM_MEMORY_ADDR_LEB (3)
 # REF-NEXT:       Offset: 0x1C
 # REF-NEXT:       Symbol: b
-# REF-NEXT:       Addend: 0
+# REF-NEXT:       Addend: 20
 # REF-NEXT:     }
 # REF-NEXT:     Relocation {
 # REF-NEXT:       Type: R_WASM_TYPE_INDEX_LEB (6)
 # REF-NEXT:       Offset: 0x22
 # REF-NEXT:       Index: 0x0
 # REF-NEXT:     }
 # REF-NEXT:     Relocation {
 # REF-NEXT:       Type: R_WASM_TABLE_NUMBER_LEB (20)