runtime/jit: relocate caller frame pointers on stack growth

Author: carli2

src/runtime/stack.go

@@ -1042,21 +1042,26 @@ func adjustUserFrame(u *unwinder, adjinfo *adjustinfo) {
 	if pc == 0 {
 		return
 	}
-	base, words, pointerMask, ok := userFramePointerMap(pc, sp)
-	if !ok || words == 0 {
-		return
-	}
-	bytes := words * goarch.PtrSize
 	newLo := adjinfo.old.lo + adjinfo.delta
 	newHi := adjinfo.old.hi + adjinfo.delta
-	if pointerMask == nil || bytes/goarch.PtrSize != words || base < newLo || base+bytes < base || base+bytes > newHi {
-		throw("invalid user frame pointer map")
+	if base, words, pointerMask, ok := userFramePointerMap(pc, sp); ok && words != 0 {
+		bytes := words * goarch.PtrSize
+		if pointerMask == nil || bytes/goarch.PtrSize != words || base < newLo || base+bytes < base || base+bytes > newHi {
+			throw("invalid user frame pointer map")
+		}
+		bits := bitvector{n: int32(words), bytedata: pointerMask}
+		if uintptr(bits.n) != words {
+			throw("user frame pointer map too large")
+		}
+		adjustpointers(unsafe.Pointer(base), &bits, adjinfo, funcInfo{})
 	}
-	bits := bitvector{n: int32(words), bytedata: pointerMask}
-	if uintptr(bits.n) != words {
-		throw("user frame pointer map too large")
+
+	if bpSlot, ok := userFrameCallerBPSlot(pc, sp); ok {
+		if bpSlot < newLo || bpSlot+goarch.PtrSize < bpSlot || bpSlot+goarch.PtrSize > newHi {
+			throw("invalid user frame caller frame pointer")
+		}
+		adjustpointer(adjinfo, unsafe.Pointer(bpSlot))
 	}
-	adjustpointers(unsafe.Pointer(base), &bits, adjinfo, funcInfo{})
 }
 
 // round x up to a power of 2.

src/runtime/userframe.go

@@ -250,21 +250,10 @@ func findUserFrameRegion(pc uintptr) *userFrameRegion {
 
 func userFrameNext(r *userFrameRegion, pc, sp uintptr) (callerPC, callerSP, callerBP uintptr, ok bool) {
 	if m := findUserFrameStackMap(r, pc); m != nil && m.hasUnwind {
-		base := sp + m.unwindBaseOffset
-		if base < sp {
+		base, ok := userFrameUnwindBase(m, sp)
+		if !ok {
 			return 0, 0, 0, false
 		}
-		if m.unwindBaseUsesDelta {
-			deltaAddr := sp + m.unwindBaseDeltaOffset
-			if deltaAddr < sp {
-				return 0, 0, 0, false
-			}
-			delta := *(*uintptr)(unsafe.Pointer(deltaAddr))
-			if base+delta < base {
-				return 0, 0, 0, false
-			}
-			base += delta
-		}
 		callerPCAddr := base + m.callerPCOffset
 		callerSP = base + m.callerSPOffset
 		callerBPAddr := base + m.callerBPOffset
@@ -276,6 +265,44 @@ func userFrameNext(r *userFrameRegion, pc, sp uintptr) (callerPC, callerSP, call
 	return 0, 0, 0, false
 }
 
+func userFrameUnwindBase(m *userFrameStackMap, sp uintptr) (uintptr, bool) {
+	base := sp + m.unwindBaseOffset
+	if base < sp {
+		return 0, false
+	}
+	if m.unwindBaseUsesDelta {
+		deltaAddr := sp + m.unwindBaseDeltaOffset
+		if deltaAddr < sp {
+			return 0, false
+		}
+		delta := *(*uintptr)(unsafe.Pointer(deltaAddr))
+		if base+delta < base {
+			return 0, false
+		}
+		base += delta
+	}
+	return base, true
+}
+
+// userFrameCallerBPSlot returns the address of the saved caller frame pointer.
+// Stack copying must relocate this value even when the user frame has no Go
+// pointers of its own. On amd64, Go function epilogues may use LEAVE, so a
+// stale frame pointer would also restore SP to the old, freed stack.
+//
+//go:nosplit
+func userFrameCallerBPSlot(pc, sp uintptr) (uintptr, bool) {
+	r := findUserFrameRegion(pc)
+	m := findUserFrameStackMap(r, pc)
+	if m == nil || !m.hasUnwind {
+		return 0, false
+	}
+	base, ok := userFrameUnwindBase(m, sp)
+	if !ok || base+m.callerBPOffset < base {
+		return 0, false
+	}
+	return base + m.callerBPOffset, true
+}
+
 // userFramePointerMap resolves one immutable map without calling user code.
 // Looking the region up again keeps unwinder pointer-free.
 //