A branch insn must not overwrite the branch target before relocation.

When a branch to label is translated it generates a reloc that is filled in
when the label is translated.  However, when handling an exception and
searching for the pc we abort the translation early and we sometimes
translate the branch but not the corresponding label and so no relocation
is done.  When the block is executed again the branch points to no-where.

It seems tcg/sparc/ is going to suffer from the same issue.


git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@4547 c046a42c-6fe2-441c-8c8c-71466251a162

tcg/arm/tcg-target.c

@@ -78,8 +78,8 @@ static void patch_reloc(uint8_t *code_ptr, int type,
         tcg_abort();
 
     case R_ARM_PC24:
-        *(uint32_t *) code_ptr |=
-                ((value - ((tcg_target_long) code_ptr + 8)) >> 2) & 0xffffff;
+        *(uint32_t *) code_ptr |= (*(uint32_t *) code_ptr & 0xff000000) |
+                (((value - ((tcg_target_long) code_ptr + 8)) >> 2) & 0xffffff);
         break;
     }
 }
@@ -272,6 +272,17 @@ static inline void tcg_out_b(TCGContext *s, int cond, int32_t offset)
                     (((offset - 8) >> 2) & 0x00ffffff));
 }
 
+static inline void tcg_out_b_noaddr(TCGContext *s, int cond)
+{
+#ifdef WORDS_BIGENDIAN
+    tcg_out8(s, (cond << 4) | 0x0a);
+    s->code_ptr += 3;
+#else
+    s->code_ptr += 3;
+    tcg_out8(s, (cond << 4) | 0x0a);
+#endif
+}
+
 static inline void tcg_out_bl(TCGContext *s, int cond, int32_t offset)
 {
     tcg_out32(s, (cond << 28) | 0x0b000000 |
@@ -734,7 +745,7 @@ static inline void tcg_out_goto_label(TCGContext *s, int cond, int label_index)
     } else {
         /* Probably this should be preferred even for COND_AL... */
         tcg_out_reloc(s, s->code_ptr, R_ARM_PC24, label_index, 31337);
-        tcg_out_b(s, cond, 8);
+        tcg_out_b_noaddr(s, cond);
     }
 }