[lld-macho] Check if DWARF offset is too large for compact unwind

[int3]

Summary

For functions that use DWARF encodings, their compact unwind entry will
contain a hint about the offset of their DWARF entry from the start of
the __eh_frame section. The encoding only has 3 bytes to encode this
hint.

Previously, I neglected to check for overflow (and didn't realize that
the value was merely a hint without needing to be exact.) So for large
__eh_frame sections, the hint would overflow and cause the compact
unwind MODE flag to be corrupted, leading to uncaught exceptions at
runtime.

This diff fixes things by encoding zero as the hint for offsets that are
too large. The unwinder will start a linear search at the hint location
for the matching CFI record. The only requirement is that the hint
points to a valid CFI record start, and the start of the section is
always the start of a CFI record (in well-formed programs).

I'm not adding a test for this because generating the test inputs takes
a bit too much time. However, I have been testing locally with this lit
file, which takes about 15s to run on my machine:

# RUN: rm -rf %t; mkdir %t
# RUN: llvm-mc -filetype=obj -triple=x86_64-apple-macos11.0 %s -o %t/test.o
# RUN: %lld -dylib -lSystem %t/test.o -o %t/test

.subsections_via_symbols
.text
.p2align 2

_f:
  .cfi_startproc
.rept 0x7fffff
  .cfi_escape 0x2e, 0x10
.endr
  ret
  .cfi_endproc

_g:
  .cfi_startproc
  .cfi_escape 0x2e, 0x10
  ret
  .cfi_endproc

[smeenai]

For the test, would it work to put something like

.section __TEXT,__eh_frame
.space 0x1000000

at the start of the file, to push the actual DWARF entry offsets forward?

[int3]

I think both linkers expect the EH frame section to be a contiguous array of CFI entries. Using the .space 1000 thing causes ld64 to crash and LLD to silently drop all subsequent EH frames

[int3]

lld/MachO/UnwindInfoSection.cpp

351

Upon closer inspection I think this only works if the hint points to a valid CFI record start, otherwise the unwinder will just repeatedly fail to parse all CFI entries until the end of the section, then start again from the beginning. So I'm going to encode a zero instead.

I would like to eventually figure out how to build and test against a custom copy of libunwind to verify, but I'd like to get this fix out first. I believe emitting a zero here is safe.

[int3]

update

lld/MachO/UnwindInfoSection.cpp

#define COMPRESSED_SECOND_LEVEL_ENTRIES_MAX                                    \
   ((SECOND_LEVEL_PAGE_BYTES -                                                  \
     sizeof(unwind_info_compressed_second_level_page_header)) /                 \
    sizeof(uint32_t))
 
 #define COMPRESSED_ENTRY_FUNC_OFFSET_BITS 24
 #define COMPRESSED_ENTRY_FUNC_OFFSET_MASK                                      \
   UNWIND_INFO_COMPRESSED_ENTRY_FUNC_OFFSET(~0)
 
+static_assert(static_cast<uint32_t>(UNWIND_X86_64_DWARF_SECTION_OFFSET) ==
+                  static_cast<uint32_t>(UNWIND_ARM64_DWARF_SECTION_OFFSET) &&
+              static_cast<uint32_t>(UNWIND_X86_64_DWARF_SECTION_OFFSET) ==
+                  static_cast<uint32_t>(UNWIND_X86_DWARF_SECTION_OFFSET));
+
+constexpr uint64_t DWARF_SECTION_OFFSET = UNWIND_X86_64_DWARF_SECTION_OFFSET;
+
 // Compact Unwind format is a Mach-O evolution of DWARF Unwind that
 // optimizes space and exception-time lookup.  Most DWARF unwind
 // entries can be replaced with Compact Unwind entries, but the ones
 // that cannot are retained in DWARF form.
 //
 // This comment will address macro-level organization of the pre-link
 // and post-link compact unwind tables. For micro-level organization
 // pertaining to the bitfield layout of the 32-bit compact unwind
parallelFor(0, symbolsVec.size(), [&](size_t i) {
     CompactUnwindEntry &cu = cuEntries[i];
     const Defined *d = symbolsVec[i].second;
     cu.functionAddress = d->getVA();
     if (!d->unwindEntry)
       return;
 
     // If we have DWARF unwind info, create a CU entry that points to it.
     if (d->unwindEntry->getName() == section_names::ehFrame) {
-      cu.encoding = target->modeDwarfEncoding | d->unwindEntry->outSecOff;
+      // The unwinder will look for the DWARF entry starting at the hint,
+      // assuming the hint points to a valid CFI record start. If it
+      // fails to find the record, it proceeds in a linear search through the
+      // contiguous CFI records from the hint until the end of the section.
+      // Ideally, in the case where the offset is too large to be encoded, we
+      // would instead encode the largest possible offset to a valid CFI record,
+      // but since we don't keep track of that, just encode zero -- the start of
+      // the section is always the start of a CFI record.
+      uint64_t dwarfOffsetHint =
+          d->unwindEntry->outSecOff <= DWARF_SECTION_OFFSET
+              ? d->unwindEntry->outSecOff
+              : 0;
+      cu.encoding = target->modeDwarfEncoding | dwarfOffsetHint;
       const FDE &fde = cast<ObjFile>(d->getFile())->fdes[d->unwindEntry];
       cu.functionLength = fde.funcLength;
       cu.personality = fde.personality;
       cu.lsda = fde.lsda;
       return;
     }
 
     assert(d->unwindEntry->getName() == section_names::compactUnwind);