Subzero: Add a flag to mock up bounds checking on unsafe references.

Subzero: Add a flag to mock up bounds checking on unsafe references.

The idea is that, before each load or store operation, we add a couple of compares/branches against the load/store address, one for the lower bound and one for the upper bound.  The conditional branches would be to an error throwing routine, and would never be taken in practice.  The compares might be against an immediate or a global location.  So a load of [reg] will mock-expand to this:

  cmp reg, 0
  je label
  cmp reg, 1
  je label
label:
  mov xxx, [reg]

We also make address mode inference less aggressive, because for a load of e.g. [eax+4*ecx], we can't compare that address expression against anything in any instruction, so we would have to reconstruct the address and undo at least part of the address mode inference.

The bounds-check mock is added for loads, stores, and rmw operations (with an exclusion for stores to the stack for out-arg pushes).  There are probably a small handful of other cases that are missing the bounds check, but if we add the transformation inside legalize(), which is the most obvious place, we may add extra bounds checks because sometimes legalize() is called twice on the same operand.

BUG= none
R=ascull@google.com

Committed: https://gerrit.chromium.org/gerrit/gitweb?p=native_client/pnacl-subzero.git;a=commit;h=ad2989b6e497f6237a3ae66ae3cfbcceaa99d4f5

[Jim Stichnoth, 2015-09-15 04:33:35]

stichnot@chromium.org changed reviewers:
+ ascull@google.com, jpp@chromium.org

[Jim Stichnoth, 2015-09-15 05:01:27]

Measured across spec2k (geomean), adding the bounds check drops performance by
about 15%.

Just restricting the address mode inference, without adding the bounds checks as
well, drops performance by 5%.

So the 2 cmp/br per load/store adds 10%, and the weaker address mode inference
adds 5%.

[ascull, 2015-09-15 16:27:20]

lgtm

That counteracts the register allocation improvements!

To improve performance do you think it would be possible to set `base` to the
lowerbound and have the actual target address in `offset` and `index`? That way
you would only need to do one test for the upper bound but it would also require
the addresses to all be relative which may be tricky(?).

[Jim Stichnoth, 2015-09-15 17:21:47]

Committed patchset #4 (id:60001) manually as
ad2989b6e497f6237a3ae66ae3cfbcceaa99d4f5 (presubmit successful).