[llvm] [JITLink][x86-64] Fix GOTPCRELX call/jmp relaxation to use PC-relative fixup (PR #190179)

[Michael Buch via llvm-commits]

https://github.com/Michael137 updated https://github.com/llvm/llvm-project/pull/190179

>From 9f040b747ccf6e3a8b4985b3c75673056bf28811 Mon Sep 17 00:00:00 2001
From: Yaxing Cai <caiyaxing666 at gmail.com>
Date: Thu, 2 Apr 2026 13:34:32 +0000
Subject: [PATCH] [JITLink][x86-64] Fix GOTPCRELX call/jmp relaxation to use
 PC-relative fixup

The GOTPCRELX optimization that relaxes `call *foo at GOTPCREL(%rip)` to
`addr32 call foo` and `jmp *foo at GOTPCREL(%rip)` to `jmp foo; nop` was
using `Pointer32` (absolute) as the edge kind. Since `e8`/`e9` are
PC-relative instructions, `applyFixup` wrote the absolute address of
the target instead of the PC-relative displacement, producing a garbage
destination address.

This caused SIGSEGV in non-PIE executables when JIT code was mapped far
from the target (e.g., an arena allocator at a high address calling a
symbol in the low 4 GB).

Fix:
- Change the guard from `TargetInRangeForImmU32` (absolute address fits
  in uint32) to `DisplacementInRangeForImmS32` (PC-relative displacement
  fits in int32), matching what `call rel32`/`jmp rel32` actually need.
- Change the edge kind from `Pointer32` to `BranchPCRel32` so
  `applyFixup` writes `Target - (Fixup + 4) + Addend`.

Update the existing test to validate the PC-relative displacement
instead of the absolute address, and add a regression test with JIT code
at 0x7fff00000000 and an extern at 0x00401000 to verify the relaxation
is correctly skipped when the displacement is out of range.
---
 llvm/lib/ExecutionEngine/JITLink/x86_64.cpp   |  4 +-
 .../x86-64/ELF_got_plt_optimizations.s        |  6 ++-
 .../JITLink/x86-64/ELF_gotpcrelx_no_relax.s   | 37 +++++++++++++++++++
 3 files changed, 43 insertions(+), 4 deletions(-)
 create mode 100644 llvm/test/ExecutionEngine/JITLink/x86-64/ELF_gotpcrelx_no_relax.s

diff --git a/llvm/lib/ExecutionEngine/JITLink/x86_64.cpp b/llvm/lib/ExecutionEngine/JITLink/x86_64.cpp
index 9d312a281315a..98f34c0433960 100644
--- a/llvm/lib/ExecutionEngine/JITLink/x86_64.cpp
+++ b/llvm/lib/ExecutionEngine/JITLink/x86_64.cpp
@@ -159,7 +159,7 @@ Error optimizeGOTAndStubAccesses(LinkGraph &G) {
         }
 
         // Transform call/jmp instructions
-        if (Op == 0xff && TargetInRangeForImmU32) {
+        if (Op == 0xff && DisplacementInRangeForImmS32) {
           if (ModRM == 0x15) {
             // ABI says we can convert "call *foo at GOTPCREL(%rip)" to "nop; call
             // foo" But lld convert it to "addr32 call foo, because that makes
@@ -185,7 +185,7 @@ Error optimizeGOTAndStubAccesses(LinkGraph &G) {
               dbgs() << "\n";
             });
           }
-          E.setKind(x86_64::Pointer32);
+          E.setKind(x86_64::BranchPCRel32);
           E.setTarget(GOTTarget);
           continue;
         }
diff --git a/llvm/test/ExecutionEngine/JITLink/x86-64/ELF_got_plt_optimizations.s b/llvm/test/ExecutionEngine/JITLink/x86-64/ELF_got_plt_optimizations.s
index 27ffd580e9a5c..fe8ae5bc5963c 100644
--- a/llvm/test/ExecutionEngine/JITLink/x86-64/ELF_got_plt_optimizations.s
+++ b/llvm/test/ExecutionEngine/JITLink/x86-64/ELF_got_plt_optimizations.s
@@ -22,7 +22,8 @@ main:
 
 # Test optimization of transforming "call *foo at GOTPCREL(%rip)" to "addr call foo"
 # We need check both the target address and the instruction opcodes
-# jitlink-check: decode_operand(test_call_gotpcrelx, 0)[31:0] = extern_in_range32
+# jitlink-check: decode_operand(test_call_gotpcrelx, 0) = \
+# jitlink-check:     extern_in_range32 - next_pc(test_call_gotpcrelx)
 # jitlink-check: *{1}test_call_gotpcrelx = 0x67
 # jitlink-check: *{1}test_call_gotpcrelx+1 = 0xe8
         .globl test_call_gotpcrelx
@@ -36,7 +37,8 @@ test_call_gotpcrelx:
 
 # Test optimization of transforming "jmp *foo at GOTPCREL(%rip)" to "jmp foo ; nop"
 # We need check both the target address and the instruction opcodes
-# jitlink-check: decode_operand(test_call_gotpcrelx, 0)[31:0] = extern_in_range32
+# jitlink-check: decode_operand(test_jmp_gotpcrelx, 0) = \
+# jitlink-check:     extern_in_range32 - next_pc(test_jmp_gotpcrelx)
 # jitlink-check: *{1}test_jmp_gotpcrelx = 0xe9
 # jitlink-check: *{1}test_jmp_gotpcrelx+5 = 0x90
         .globl test_jmp_gotpcrelx
diff --git a/llvm/test/ExecutionEngine/JITLink/x86-64/ELF_gotpcrelx_no_relax.s b/llvm/test/ExecutionEngine/JITLink/x86-64/ELF_gotpcrelx_no_relax.s
new file mode 100644
index 0000000000000..20194b00d6f73
--- /dev/null
+++ b/llvm/test/ExecutionEngine/JITLink/x86-64/ELF_gotpcrelx_no_relax.s
@@ -0,0 +1,37 @@
+# RUN: rm -rf %t && mkdir -p %t
+# RUN: llvm-mc -triple=x86_64-unknown-linux -position-independent \
+# RUN:     -filetype=obj -o %t/gotpcrelx_no_relax.o %s
+# RUN: llvm-jitlink -noexec \
+# RUN:     -slab-allocate 100Kb -slab-address 0x7fff00000000 -slab-page-size 4096 \
+# RUN:     -abs extern_low=0x00401000 \
+# RUN:     -check %s %t/gotpcrelx_no_relax.o
+
+        .text
+        .globl  main
+        .type   main, at function
+main:   retq
+        .size   main, .-main
+
+# When JIT code is at 0x7fff00000000 and extern is at 0x00401000:
+#   - isUInt<32>(0x00401000) = true   -> old code would relax (BUG)
+#   - isInt<32>(displacement) = false -> new code does NOT relax (CORRECT)
+#
+# Verify the call was NOT relaxed -- indirect opcode ff 15 preserved:
+# jitlink-check: *{1}test_call_no_relax = 0xff
+# jitlink-check: *{1}test_call_no_relax+1 = 0x15
+        .globl test_call_no_relax
+        .p2align 4, 0x90
+        .type  test_call_no_relax, at function
+test_call_no_relax:
+        call   *extern_low at GOTPCREL(%rip)
+        .size  test_call_no_relax, .-test_call_no_relax
+
+# Same for jmp -- verify indirect opcode ff 25 preserved:
+# jitlink-check: *{1}test_jmp_no_relax = 0xff
+# jitlink-check: *{1}test_jmp_no_relax+1 = 0x25
+        .globl test_jmp_no_relax
+        .p2align 4, 0x90
+        .type  test_jmp_no_relax, at function
+test_jmp_no_relax:
+        jmp    *extern_low at GOTPCREL(%rip)
+        .size  test_jmp_no_relax, .-test_jmp_no_relax