Fix ARM64 callgrind stack unwinding

Author: not-matthias

callgrind/bbcc.c

@@ -653,34 +653,38 @@ void CLG_(setup_bbcc)(BB* bb)
   /* Manipulate JmpKind if needed, only using BB specific info */
 
   csp = CLG_(current_call_stack).sp;
-
   /* A return not matching the top call in our callstack is a jump */
   if ( (jmpkind == jk_Return) && (csp >0)) {
       Int csp_up = csp-1;      
       call_entry* top_ce = &(CLG_(current_call_stack).entry[csp_up]);
 
-      /* We have a real return if
-       * - the stack pointer (SP) left the current stack frame, or
-       * - SP has the same value as when reaching the current function
-       *   and the address of this BB is the return address of last call
-       *   (we even allow to leave multiple frames if the SP stays the
-       *    same and we find a matching return address)
-       * The latter condition is needed because on PPC, SP can stay
-       * the same over CALL=b(c)l / RET=b(c)lr boundaries
+      /* We have a real return if the stack pointer (SP) left the
+       * current stack frame.  If the return target matches an older
+       * shadow-stack frame whose entry SP is also outside the current
+       * native frame, unwind all intervening frames.  This happens in
+       * hand-written startup/loader code that can collapse multiple native
+       * frames before returning to a saved link register.
+       *
+       * If SP is unchanged, require the return target to match the recorded
+       * return address.  This is needed because on PPC, SP can stay the same
+       * over CALL=b(c)l / RET=b(c)lr boundaries.
        */
-      if (sp < top_ce->sp) popcount_on_return = 0;
-      else if (top_ce->sp == sp) {
+      if (sp < top_ce->sp) {
+	  popcount_on_return = 0;
+      }
+      else {
+	  Bool sp_changed = top_ce->sp != sp;
 	  while(1) {
 	      if (top_ce->ret_addr == bb_addr(bb)) break;
 	      if (csp_up>0) {
 		  csp_up--;
 		  top_ce = &(CLG_(current_call_stack).entry[csp_up]);
-		  if (top_ce->sp == sp) {
+		  if (top_ce->sp <= sp) {
 		      popcount_on_return++;
-		      continue; 
+		      continue;
 		  }
 	      }
-	      popcount_on_return = 0;
+	      popcount_on_return = sp_changed ? 1 : 0;
 	      break;
 	  }
       }

callgrind/main.c

@@ -1471,8 +1471,17 @@ static
 void zero_state_cost(thread_info* t)
 {
     CLG_(zero_cost)( CLG_(sets).full, CLG_(current_state).cost );
+    CLG_(zero_cost)( CLG_(sets).full, t->lastdump_cost );
 }
 
+static
+void sync_lastdump_cost(thread_info* t)
+{
+    CLG_(copy_cost)( CLG_(sets).full, t->lastdump_cost,
+                     CLG_(current_state).cost );
+}
+
+
 void CLG_(set_instrument_state)(const HChar* reason, Bool state)
 {
   if (CLG_(instrument_state) == state) {
@@ -1486,9 +1495,15 @@ void CLG_(set_instrument_state)(const HChar* reason, Bool state)
 
   VG_(discard_translations_safely)( (Addr)0x1000, ~(SizeT)0xfff, "callgrind");
 
-  /* reset internal state: call stacks, simulator */
+  /* Reset internal state: call stacks, simulator.  Switching collection off
+   * leaves already materialized BBCC/JCC costs for the final dump, but the
+   * live event counter no longer tracks a complete interval after collection
+   * stops inside a BB.  Mark the live counter as already summarized so readers
+   * use the dumped totals instead of a stale/partial header summary.  The next
+   * ON transition starts a fresh interval by clearing both current and
+   * last-dump counters. */
   CLG_(forall_threads)(unwind_thread);
-  CLG_(forall_threads)(zero_state_cost);
+  CLG_(forall_threads)(state ? zero_state_cost : sync_lastdump_cost);
   (*CLG_(cachesim).clear)();
 
   if (VG_(clo_verbosity) > 1)