Re: [PATCH v4 13/23] perf annotate-arm64: Track return type after call instructions

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing invalidation of DWARF lifetime tracking when a caller-saved return register is updated with a function's return type.
--

--- Patch [13]: [PATCH v4 13/23] perf annotate-arm64: Track return type after call instructions ---
commit 001dcc403f6841490dc601cf7b406aa4f0f30321
Author: Tengda Wu <[email protected]>

perf annotate-arm64: Track return type after call instructions

This commit enables data type profiling to track function return values in
arm64 annotations by looking up the DWARF return type of called functions.

> diff --git a/tools/perf/util/annotate-arch/annotate-arm64.c b/tools/perf/util/annotate-arch/annotate-arm64.c
> index 44daa0176e512..acff14ca01e00 100644
> --- a/tools/perf/util/annotate-arch/annotate-arm64.c
> +++ b/tools/perf/util/annotate-arch/annotate-arm64.c

[ ... ]

> @@ -395,6 +397,20 @@ static void update_insn_state_arm64(struct type_state *state,
>  				continue;
>  			invalidate_reg_state(reg);
>  		}
> +
> +		/* Update register with the return type (if any) */
> +		if (call_name && die_find_func_rettype(cu_die, call_name, &type_die)) {
> +			tsr = &state->regs[state->ret_reg];
> +			tsr->copied_from = -1;
> +			tsr->type = type_die;
> +			tsr->kind = TSR_KIND_TYPE;
> +			tsr->offset = 0;
> +			tsr->ok = true;

[Severity: Medium]
Does this code need to clear the existing dynamic lifetime tracking fields
(such as lifetime_active and lifetime_end) before updating the return
register?

If the return register (e.g., x0) previously held a variable with an active
DWARF lifetime that spanned across this call, failing to call
invalidate_reg_state() or manually clear those fields could leave stale
lifetime flags in the register state.

If a subsequent function call occurs before that original lifetime ends, and
it does not return a known type, the return register might skip invalidation
due to the stale lifetime flag. This could erroneously preserve the first
call's return type and corrupt the data type profiling statistics.

> +
> +			pr_debug_dtp("call [%x] return -> reg%d",
> +				     insn_offset, state->ret_reg);
> +			pr_debug_type_name(&type_die, tsr->kind);
> +		}
>  		return;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=13