[BOLT] Improve jump table entry validation for split jump table

[nhuhuan]

Summary

Two main challenges of recovering jump tables are (a) to identify jump
table base, and (b) to find jump table bounds. For (b), we mainly rely
on the key observation: jump table entries are valid indirect intra-ref.
In more specific, keep iterating jump table entry until we find an
invalid one. Furthermore, function splitting optimization breaks a
function into a few fragments, and jump table could point to any of
these fragments. From binary perspective, each fragment is a function
on its own. The main problem is identifying a sibling fragment from
fragment in a different function.

In nonstripped binaries, fortunately, standard compilers use consistent
symbol names, e.g., foo and foo.cold.1 are siblings, and BOLT rely on
this information to support split jump table. However, there is no
regular symbol in stripped binaries, suggesting major improvements in
every step. These improvements also improve processing of non-stripped
binaries. Support of split jump table can be broken down to 4 steps:

1. Decouple sibling analysis (based on symbol) from branch analysis
   • Avoid using incomplete sibling information for nonstripped binaries
2. Decouple disassembly from branch analysis
   • Requirement for (3) and (4)
3. Improve solution for problem (a)
4. Improve solution for problem (b)

This update addresses step (4): restructure jump table entry validation
with ordered properties:

• Bring instruction bounds check earlier (nonstripped/stripped)
• Split function has no more than 2 fragments (stripped)
• Non-overlapping jump table (stripped)
• Sibling validation based on symbol name (nonstripped)

In future update:

• Sibling validation based on LSDA (stripped)
• Cannot target callable fragment entry (nonstripped/stripped)

[Amir]

Thank you for working on this. Can you split out the addition of BC->IsStripped, and the removal of AllowStripped (separate diffs)? This would make this diff more amenable for a review.

[nhuhuan]

Separate the removal of AllowStripped into another diff.

[Amir]

bolt/lib/Core/BinaryContext.cpp

500

Let's move this addition into a separate diff. It would be dependent on BC->IsStripped diff.

bolt/test/X86/jump-table-move-pic.s

2

Please add a comment what this test is about: e.g. "Test -jump-tables=move with stripped/non-stripped binary with split function accessing the jump table, reproduces the unresolved symbol issue due to losing symbols referenced from a jump table"

[nhuhuan]

Based on top of D130034 and D130036

[nhuhuan]

Add description for the test.

[nhuhuan]

Split into several diffs. This diff is about supporting
split jump table in in stripped binaries.

[Amir]

LGTM. Sorry that the review was taking so long.

[nhuhuan]

Fix an issue where split jump table targets are marked as
secondary entry points, but they skipped instruction bounds
check in postProcessEntryPoints().

[Amir]

bolt/lib/Rewrite/RewriteInstance.cpp

2917 ↗

(On Diff #446400)

Can you make a test case for that?

[nhuhuan]

Revert. Move jump table fixes to another diff.

[maksfb]

Change the summary to a narrative format.

bolt/include/bolt/Core/BinaryContext.h

483

483

If you don't expect a pointer parameter to be a nullptr, make it a reference. If you don't expect to change it, make it a const reference.

Add a description of the function and its parameters.

[nhuhuan]

Address Maksim's feedback.

[nhuhuan]

Update comment.

[Amir]

@maksfb: does the updated summary look good?
@nhuhuan: please address one typo. LGTM otherwise.

bolt/lib/Core/BinaryContext.cpp

631–632

As a note for future improvement: instead of partially reconstructing the logic of isValidJumpTableEntry, we may enumerate the checks in isValidJTE and return the check number along with its result.

638

[nhuhuan]

Incorporate debugging messages into isValidJumpTableEntry.
An entry failing isValidJumpTableEntry does not mean the
jump table is invalid. Suppose we have a true jump table
base, it means we found the bounds.

[nhuhuan]

Refine comments. Improve implementation for isValidJumpTableEntry.

[nhuhuan]

Clang-formatted.

[nhuhuan]

Rebase.

[nhuhuan]

Update parent-fragment relation when adding parent to jump table

bolt/include/bolt/Core/BinaryContext.h

public:
   /// one at that location.
   ///
   /// May create an embedded jump table and return its label as the second
   /// element of the pair.
   const MCSymbol *getOrCreateJumpTable(BinaryFunction &Function,
                                        uint64_t Address,
                                        JumpTable::JumpTableType Type);
 
+  bool validJumpTableEntry(uint64_t EntryAddress, BinaryFunction *BF,
+                           BinaryFunction *&TargetBF,
+                           BinaryFunction *ValidExternalTargetBF);
+
   /// Analyze a possible jump table of type \p Type at a given \p Address.
   /// \p BF is a function referencing the jump table.
   /// Return true if the jump table was detected at \p Address, and false
   /// otherwise.
   ///
   /// If \p NextJTAddress is different from zero, it is used as an upper
   /// bound for jump table memory layout.
   ///

bolt/lib/Core/BinaryContext.cpp

if (BF.containsAddress(Address, /*UseMaxSize=*/isAArch64())) {
         return std::make_pair(
             BF.addEntryPointAtOffset(Address - BF.getAddress()), Addend);
       }
     } else {
       addInterproceduralReference(&BF, Address);
     }
   }
 
+  // IMPORTANT:
+  // creating jump table without BranchType == POSSIBLE_PIC_JUMP_TABLE
+  // is dangerous --> False Positive.
+  //              --> Should only be done in BF.processIndirectBranch()
+  //              --> Temporarily keep this code to avoid failing tests
+  // Original purpose:
   // With relocations, catch jump table references outside of the basic block
   // containing the indirect jump.
+  // --> There are binaries where all references are fake jump table.
   if (HasRelocations) {
     const MemoryContentsType MemType = analyzeMemoryAt(Address, BF);
     if (MemType == MemoryContentsType::POSSIBLE_PIC_JUMP_TABLE && IsPCRel) {
       const MCSymbol *Symbol =
           getOrCreateJumpTable(BF, Address, JumpTable::JTT_PIC);
 
       return std::make_pair(Symbol, Addend);
     }
for (StringRef Name : Parent.getNames()) {
     std::string NamePrefix = Regex::escape(NameResolver::restore(Name));
     std::string NameRegex = Twine(NamePrefix, "\\.cold(\\.[0-9]+)?").str();
     if (Fragment.hasRestoredNameRegex(NameRegex))
       return true;
   }
   return false;
 }
 
+bool BinaryContext::validJumpTableEntry(uint64_t EntryAddress,
+                                        BinaryFunction *BF,
+                                        BinaryFunction *&TargetBF,
+                                        BinaryFunction *ValidExternalTargetBF) {
+  TargetBF = getBinaryFunctionContainingAddress(EntryAddress);
+  // Property 1: Entry must target a valid function body
+  if (!TargetBF)
+    return false;
+
+  // Property 2: Entry cannot target invalid instruction bounds
+  if (TargetBF->getState() == BinaryFunction::State::Disassembled &&
+      !TargetBF->getInstructionAtOffset(EntryAddress -
+                                        TargetBF->getAddress())) {
+    LLVM_DEBUG(dbgs() << "FAIL: no instruction at this offset\n");
+    return false;
+  }
+
+  // Property 3: Entry cannot target more than 1 other-fragment
+  if (IsStripped && TargetBF != BF) {
+    // First time, the different fragment target can be any fragment
+    if (ValidExternalTargetBF == nullptr) {
+      ValidExternalTargetBF = TargetBF;
+      TargetBF->IsFragment = true;
+      return registerFragment(*TargetBF, *BF);
+    }
+    // Second time, the different fragment target must be similar
+    return TargetBF == ValidExternalTargetBF;
+  }
+
+  // Property 4: EntryAddress cannot target a callable function --> Pending!
+  // (a) Previously: not allow jump table targeting current function entry
+  // --> Due to the assumption that function entry is always callable target
+  // --> The assumption is not realistic, temporarily relax this property
+  // IMPORTANT:
+  // (b) In future:
+  // --> Implement callable function identification
+  // --> EntryAddress cannot point to function entry
+  // --> EntryAddress can point to a sibling fragment entry
+  if (TargetBF == BF)
+    return EntryAddress != BF->getAddress();
+
+  // Property 5: Non-overlapping jump tables
+  // This property was already enforced in calculating UpperBound
+  // Relax policy for stripped binaries by accept all entries at this point
+  // --> No information about parent-fragment relation
+  if (IsStripped) {
+    TargetBF->IsFragment = true;
+    return registerFragment(*TargetBF, *BF);
+  }
+
+  // Property 6: Perform further check for non-stripped binaries
+  // BF and TargetBF have parent-fragment relation
+  // (a) TargetBF is parent fragment
+  if (BF->isFragment())
+    return registerFragment(*BF, *TargetBF);
+  // (b) BF is parent fragment
+  return TargetBF->isFragment() && registerFragment(*TargetBF, *BF);
+}
+
 bool BinaryContext::analyzeJumpTable(
     const uint64_t Address, const JumpTable::JumpTableType Type,
     BinaryFunction &BF, const uint64_t NextJTAddress,
     JumpTable::AddressesType *EntriesAsAddress) {
   // Is one of the targets __builtin_unreachable?
   bool HasUnreachable = false;
 
   // Number of targets other than __builtin_unreachable.
   uint64_t NumRealEntries = 0;
+  BinaryFunction *ValidExternalTargetBF = nullptr;
 
   auto addEntryAddress = [&](uint64_t EntryAddress) {
     if (EntriesAsAddress)
       EntriesAsAddress->emplace_back(EntryAddress);
   };
 
-  auto doesBelongToFunction = [&](const uint64_t Addr,
-                                  BinaryFunction *TargetBF) -> bool {
-    if (BF.containsAddress(Addr))
-      return true;
-    // Nothing to do if we failed to identify the containing function.
-    if (!TargetBF)
-      return false;
-    // Case 1: check if BF is a fragment and TargetBF is its parent.
-    if (BF.isFragment()) {
-      // Parent function may or may not be already registered.
-      // Set parent link based on function name matching heuristic.
-      return registerFragment(BF, *TargetBF);
-    }
-    // Case 2: check if TargetBF is a fragment and BF is its parent.
-    return TargetBF->isFragment() && registerFragment(*TargetBF, BF);
-  };
-
   ErrorOr<BinarySection &> Section = getSectionForAddress(Address);
   if (!Section)
     return false;
 
   // The upper bound is defined by containing object, section limits, and
   // the next jump table in memory.
   uint64_t UpperBound = Section->getEndAddress();
   const BinaryData *JumpTableBD = getBinaryDataAtAddress(Address);
for (uint64_t EntryAddress = Address; EntryAddress <= UpperBound - EntrySize;
     // __builtin_unreachable() case.
     if (Value == BF.getAddress() + BF.getSize()) {
       addEntryAddress(Value);
       HasUnreachable = true;
       LLVM_DEBUG(dbgs() << "OK: __builtin_unreachable\n");
       continue;
     }
 
-    // Function or one of its fragments.
     BinaryFunction *TargetBF = getBinaryFunctionContainingAddress(Value);
 
-    // We assume that a jump table cannot have function start as an entry.
-    if (!doesBelongToFunction(Value, TargetBF) || Value == BF.getAddress()) {
+    // Verify if Value is a valid jump table entry
+    if (!validJumpTableEntry(Value, &BF, TargetBF, ValidExternalTargetBF)) {
       LLVM_DEBUG({
-        if (!BF.containsAddress(Value)) {
-          dbgs() << "FAIL: function doesn't contain this address\n";
-          if (TargetBF) {
-            dbgs() << "  ! function containing this address: "
-                   << TargetBF->getPrintName() << '\n';
-            if (TargetBF->isFragment())
-              dbgs() << "  ! is a fragment\n";
-            for (BinaryFunction *TargetParent : TargetBF->ParentFragments)
-              dbgs() << "  ! its parent is "
-                     << (TargetParent ? TargetParent->getPrintName() : "(none)")
-                     << '\n';
-          }
-        }
-        if (Value == BF.getAddress())
-          dbgs() << "FAIL: jump table cannot have function start as an entry\n";
+        if (Value == BF.getAddress())
+          dbgs() << "FAIL: jump table cannot have function start as an entry\n";
+        else if (TargetBF == nullptr)
+          dbgs() << "FAIL: jump table targets are not contained in a valid "
+                 << "function\n";
+        else {
+          dbgs() << "FAIL: jump table are invalid:\n";
+          dbgs() << "  ! current function: " << BF.getPrintName() << "\n";
+          dbgs() << "  ! target function: " << TargetBF->getPrintName() << "\n";
+            dbgs() << "  !! is a fragment\n";
+            dbgs() << "  !! its parent is "
       });
       break;
     }
 
-    // Check there's an instruction at this offset.
-    if (TargetBF->getState() == BinaryFunction::State::Disassembled &&
-        !TargetBF->getInstructionAtOffset(Value - TargetBF->getAddress())) {
-      LLVM_DEBUG(dbgs() << "FAIL: no instruction at this offset\n");
-      break;
-    }
-
     ++NumRealEntries;
 
     if (TargetBF != &BF)
       BF.setHasIndirectTargetToSplitFragment(true);
     addEntryAddress(Value);
   }
 
   // It's a jump table if the number of real entries is more than 1, or there's

bolt/lib/Core/BinaryFunction.cpp

for (auto LI = Labels.rbegin(); LI != Labels.rend(); ++LI) {
       auto II = Instructions.find(LI->first);
       if (II != Instructions.end()) {
         Begin = II;
         break;
       }
     }
   }
 
+  // IMPORTANT: analyzeIndirectBranch does not analyze PIC jump table pattern
+  // that cross fragments
+  // --> failed to recognize BranchType
+  // --> miscount jump table parents
+  // Solution:
+  // 1. Lift all instructions in every instruction to MCInst
+  // 2. Build map <MCInst*,MCInst*>: (Branch -> Dest) from all direct branches
+  // 3. Identify indirect BranchType with respect to CFG
+  // 4. Create jump tables
+  // 5. Update map with new indirect branches, including jump tables
+  // 6. If some unclaimed PC-relative relocations in data, repeat from 3->5
   IndirectBranchType BranchType = BC.MIB->analyzeIndirectBranch(
       Instruction, Begin, Instructions.end(), PtrSize, MemLocInstr, BaseRegNum,
       IndexRegNum, DispValue, DispExpr, PCRelBaseInstr);
 
   if (BranchType == IndirectBranchType::UNKNOWN && !MemLocInstr)
     return BranchType;
 
   if (MemLocInstr != &Instruction)
if (JT.Entries.empty()) {
         if (TargetBF->getAddress() != EntryAddress) {
           MCSymbol *Label =
               (HasOneParent && TargetBF == this)
                   ? getOrCreateLocalLabel(JT.EntriesAsAddress[I], true)
                   : TargetBF->addEntryPointAtOffset(EntryAddress -
                                                     TargetBF->getAddress());
           JT.Entries.push_back(Label);
         }
+        // If jump table entry is fragment entry, the label already exists
+        else {
+          MCSymbol *Label = TargetBF->getLabels().at(0);
+          JT.Entries.push_back(Label);
+        }
       }
     }
 
     const uint64_t BDSize =
         BC.getBinaryDataAtAddress(JT.getAddress())->getSize();
     if (!BDSize) {
       BC.setBinaryDataSize(JT.getAddress(), JT.getSize());
     } else {

bolt/test/X86/false-jump-table.s

-# Check that jump table detection does not fail on a false
-# reference to a jump table.
+# There are two conditions of a valid jump table
+# (a) MemType is POSSIBLE_JUMP_TABLE
+# (b) BranchType is POSSIBLE_JUMP_TABLE
+# Only then, in principle, a jump table will be created/accessed.
+
+# This test checks if a jump table is created based solely on MemType.
+# This test may need revision in future.
 
 # REQUIRES: system-linux
 
 # RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown \
 # RUN:   %s -o %t.o
 # RUN: %clang %cflags %t.o -o %t.exe -Wl,-q
 
 # RUN: llvm-bolt %t.exe --print-cfg \

bolt/test/X86/jump-table-move-pic.s

+# Test -jump-tables=move with stripped/non-stripped binary with split function
+# accessing the jump table, reproduces the unresolved symbol issue due to losing
+# symbols referenced from a jump table.
+
+# REQUIRES: system-linux
+
+# RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown %s -o %t.o
+# RUN: %clang %cflags -no-pie %t.o -o %t.exe -Wl,-q
+# RUN: llvm-bolt %t.exe -o %t.out --lite=0 -v=1 --jump-tables=move -print-cfg 2>&1 | FileCheck %s -check-prefix=CHECK-NOSTRIP
+
+
+# CHECK-NOSTRIP-NOT: unclaimed PC-relative relocations left in data
+# CHECK-NOSTRIP: BOLT-INFO: marking main.cold.1 as a fragment of main
+# CHECK-NOSTRIP: Ignoring main.cold.1
+# CHECK-NOSTRIP: Ignoring main
+# CHECK-NOSTRIP: Binary Function "main.cold.1" after building cfg
+# CHECK-NOSTRIP: PIC Jump table JUMP_TABLE for function main.cold.1 at {{.*}} with a total count of 0
+# CHECK-NOSTRIP-NEXT: 0x0000 : [[ENTRY:.+]]
+# CHECK-NOSTRIP-NEXT: 0x0004 : [[ENTRY]]
+
+
+# RUN: cp %t.exe %t.tmp.exe
+# RUN: llvm-strip -s %t.tmp.exe
+# RUN: llvm-bolt %t.tmp.exe -o %t.out --lite=0 -v=1 --jump-tables=move -print-cfg 2>&1 | FileCheck %s -check-prefix=CHECK-STRIP
+
+# CHECK-STRIP-NOT: unclaimed PC-relative relocations left in data
+# CHECK-STRIP: BOLT-INFO: marking [[MAIN:.+]] as a fragment of [[MAIN_COLD:.+]]
+# CHECK-STRIP: Ignoring [[MAIN_COLD]]
+# CHECK-STRIP: Ignoring [[MAIN]]
+# CHECK-STRIP: Binary Function "[[MAIN_COLD]]" after building cfg
+# CHECK-STRIP: PIC Jump table JUMP_TABLE/[[MAIN_COLD]]{{.*}} for function [[MAIN_COLD]] at {{.*}} with a total count of 0
+# CHECK-STRIP-NEXT: 0x0000 : [[ENTRY:.+]]
+# CHECK-STRIP-NEXT: 0x0004 : [[ENTRY]]
+
+  .text
+  .globl main
+  .type main, %function
+  .p2align 2
+main:
+    .cfi_startproc
+    cmpl  $0x67, %edi
+    jne main.cold.1
+LBB0:
+    retq
+    .cfi_endproc
+
+  .globl main.cold.1
+  .type main.cold.1, %function
+  .p2align 2
+main.cold.1:
+    .cfi_startproc
+    leaq  JUMP_TABLE(%rip), %rax
+    movslq  (%rax,%rdx,4), %rcx
+    addq  %rax, %rcx
+    jmpq  *%rcx
+    .cfi_endproc
+
+  .rodata
+  .globl JUMP_TABLE
+JUMP_TABLE:
+  .long LBB0-JUMP_TABLE
+  .long LBB0-JUMP_TABLE

bolt/test/X86/split-func-jump-table-fragment-noparent.s

 # This reproduces a bug with jump table identification where jump table has
-# entries pointing to code in function and its cold fragment.
-# The fragment is only reachable through jump table.
+# entries pointing to code in function and its cold fragment. The fragment is
+# only reachable through jump table.
+# This test verifies support for both stripped and non-stripped binaries.
 
 # REQUIRES: system-linux
 
+
 # RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown %s -o %t.o
-# RUN: llvm-strip --strip-unneeded %t.o
 # RUN: %clang %cflags %t.o -o %t.exe -Wl,-q
-# RUN: llvm-bolt %t.exe -o %t.out --lite=0 -v=1 2>&1 | FileCheck %s
+# RUN: llvm-strip --strip-unneeded %t.exe
+# RUN: llvm-bolt %t.exe -o %t.out --lite=0 -v=1 -print-cfg 2>&1 | FileCheck %s -check-prefix=CHECK-NOSTRIP
+
+# CHECK-NOSTRIP-NOT: unclaimed PC-relative relocations left in data
+# CHECK-NOSTRIP: BOLT-INFO: marking main.cold.1 as a fragment of main
+# CHECK-NOSTRIP: Ignoring main
+# CHECK-NOSTRIP: Ignoring main.cold.1
+# CHECK-NOSTRIP: Binary Function "main" after building cfg
+# CHECK-NOSTRIP: PIC Jump table JUMP_TABLE for function main at {{.*}} with a total count of 0
+# CHECK-NOSTRIP-NEXT: 0x0000 : {{.+}}
+# CHECK-NOSTRIP-NEXT: 0x0004 : [[LBB3:.+]]
+# CHECK-NOSTRIP-NEXT: 0x0008 : {{.*}}main.cold.1{{.*}}
+# CHECK-NOSTRIP-NEXT: 0x000c : [[LBB3]]
+# CHECK-NOSTRIP: Binary Function "main.cold.1" after building cfg
+
+
+# RUN: cp %t.exe %t.tmp.exe
+# RUN: llvm-strip -s %t.tmp.exe
+# RUN: llvm-bolt %t.tmp.exe -o %t.out --lite=0 -v=1 -print-cfg 2>&1 | FileCheck %s -check-prefix=CHECK-STRIP
+
+# CHECK-STRIP-NOT: unclaimed PC-relative relocations left in data
+# CHECK-STRIP: BOLT-INFO: marking [[MAIN_COLD:.+]] as a fragment of [[MAIN:.+]]
+# CHECK-STRIP: Ignoring [[MAIN]]
+# CHECK-STRIP: Ignoring [[MAIN_COLD]]
+# CHECK-STRIP: Binary Function "[[MAIN]]" after building cfg
+# CHECK-STRIP: PIC Jump table JUMP_TABLE/[[MAIN]]{{.*}} for function [[MAIN]] at {{.*}} with a total count of 0
+# CHECK-STRIP-NEXT: 0x0000 : {{.+}}
+# CHECK-STRIP-NEXT: 0x0004 : [[LBB3:.+]]
+# CHECK-STRIP-NEXT: 0x0008 : {{.*}}[[MAIN_COLD]]{{.*}}
+# CHECK-STRIP-NEXT: 0x000c : [[LBB3]]
+# CHECK-STRIP: Binary Function "[[MAIN_COLD]]" after building cfg
 
-# CHECK-NOT: unclaimed PC-relative relocations left in data
-# CHECK: BOLT-INFO: marking main.cold.1 as a fragment of main
   .text
   .globl main
   .type main, %function
   .p2align 2
 main:
 LBB0:
+  .cfi_startproc
   andl $0xf, %ecx
   cmpb $0x4, %cl
   # exit through ret
   ja LBB3
 
 # jump table dispatch, jumping to label indexed by val in %ecx
 LBB1:
   leaq JUMP_TABLE(%rip), %r8
   movzbl %cl, %ecx
   movslq (%r8,%rcx,4), %rax
   addq %rax, %r8
   jmpq *%r8
 
 LBB2:
   xorq %rax, %rax
 LBB3:
   addq $0x8, %rsp
   ret
+  .cfi_endproc
 .size main, .-main
 
 # cold fragment is only reachable through jump table
   .globl main.cold.1
   .type main.cold.1, %function
   .p2align 2
 main.cold.1:
+  .cfi_startproc
   # load bearing nop: pad LBB4 so that it can't be treated
   # as __builtin_unreachable by analyzeJumpTable
   nop
 LBB4:
   callq abort
+.cfi_endproc
 .size main.cold.1, .-main.cold.1
 
   .rodata
 # jmp table, entries must be R_X86_64_PC32 relocs
   .globl JUMP_TABLE
 JUMP_TABLE:
   .long LBB2-JUMP_TABLE
   .long LBB3-JUMP_TABLE
   .long LBB4-JUMP_TABLE
   .long LBB3-JUMP_TABLE

bolt/test/X86/split-func-jump-table-fragment.s

 # This reproduces a bug with jump table identification where jump table has
 # entries pointing to code in function and its cold fragment.
+# This test verifies support for both stripped and non-stripped binaries.
 
 # REQUIRES: system-linux
 
+
+
 # RUN: llvm-mc -filetype=obj -triple x86_64-unknown-unknown %s -o %t.o
-# RUN: llvm-strip --strip-unneeded %t.o
 # RUN: %clang %cflags %t.o -o %t.exe -Wl,-q
-# RUN: llvm-bolt %t.exe -o %t.out --lite=0 -v=1 2>&1 | FileCheck %s
+# RUN: llvm-strip --strip-unneeded %t.exe
+# RUN: llvm-bolt %t.exe -o %t.out --lite=0 -v=1 -print-cfg 2>&1 | FileCheck %s -check-prefix=CHECK-NOSTRIP
+
+# CHECK-NOSTRIP-NOT: unclaimed PC-relative relocations left in data
+# CHECK-NOSTRIP: BOLT-INFO: marking main.cold.1 as a fragment of main
+# CHECK-NOSTRIP: Ignoring main
+# CHECK-NOSTRIP: Ignoring main.cold.1
+# CHECK-NOSTRIP: Binary Function "main" after building cfg
+# CHECK-NOSTRIP: PIC Jump table JUMP_TABLE for function main at {{.*}} with a total count of 0
+# CHECK-NOSTRIP-NEXT: 0x0000 : {{.+}}
+# CHECK-NOSTRIP-NEXT: 0x0004 : [[LBB3:.+]]
+# CHECK-NOSTRIP-NEXT: 0x0008 : {{.*}}main.cold.1{{.*}}
+# CHECK-NOSTRIP-NEXT: 0x000c : [[LBB3]]
+# CHECK-NOSTRIP: Binary Function "main.cold.1" after building cfg
+
+
+
+# RUN: cp %t.exe %t.tmp.exe
+# RUN: llvm-strip -s %t.tmp.exe
+# RUN: llvm-bolt %t.tmp.exe -o %t.out --lite=0 -v=1 -print-cfg 2>&1 | FileCheck %s -check-prefix=CHECK-STRIP
+
+# CHECK-STRIP-NOT: unclaimed PC-relative relocations left in data
+# CHECK-STRIP: BOLT-INFO: marking [[MAIN_COLD:.+]] as a fragment of [[MAIN:.+]]
+# CHECK-STRIP: Ignoring [[MAIN]]
+# CHECK-STRIP: Ignoring [[MAIN_COLD]]
+# CHECK-STRIP: Binary Function "[[MAIN]]" after building cfg
+# CHECK-STRIP: PIC Jump table JUMP_TABLE/[[MAIN]]{{.*}} for function [[MAIN]] at {{.*}} with a total count of 0
+# CHECK-STRIP-NEXT: 0x0000 : {{.+}}
+# CHECK-STRIP-NEXT: 0x0004 : [[LBB3:.+]]
+# CHECK-STRIP-NEXT: 0x0008 : {{.*}}[[MAIN_COLD]]{{.*}}
+# CHECK-STRIP-NEXT: 0x000c : [[LBB3]]
+# CHECK-STRIP: Binary Function "[[MAIN_COLD]]" after building cfg
 
-# CHECK-NOT: unclaimed PC-relative relocations left in data
-# CHECK: BOLT-INFO: marking main.cold.1 as a fragment of main
   .text
   .globl main
   .type main, %function
   .p2align 2
 main:
 LBB0:
+  .cfi_startproc
   andl $0xf, %ecx
   cmpb $0x4, %cl
   # exit through abort in main.cold.1, registers cold fragment the regular way
   ja main.cold.1
 
 # jump table dispatch, jumping to label indexed by val in %ecx
 LBB1:
   leaq JUMP_TABLE(%rip), %r8
   movzbl %cl, %ecx
   movslq (%r8,%rcx,4), %rax
   addq %rax, %r8
   jmpq *%r8
 
 LBB2:
   xorq %rax, %rax
 LBB3:
   addq $0x8, %rsp
   ret
+  .cfi_endproc
 .size main, .-main
 
   .globl main.cold.1
   .type main.cold.1, %function
   .p2align 2
 main.cold.1:
   # load bearing nop: pad LBB4 so that it can't be treated
   # as __builtin_unreachable by analyzeJumpTable
+  .cfi_startproc
   nop
 LBB4:
   callq abort
+  .cfi_endproc
 .size main.cold.1, .-main.cold.1
 
   .rodata
 # jmp table, entries must be R_X86_64_PC32 relocs
   .globl JUMP_TABLE
 JUMP_TABLE:
   .long LBB2-JUMP_TABLE
   .long LBB3-JUMP_TABLE
   .long LBB4-JUMP_TABLE
   .long LBB3-JUMP_TABLE