mirrors/JetBrainsRuntime
1
0
Fork 0
mirror of https://github.com/JetBrains/JetBrainsRuntime.git synced 2025-12-06 09:29:38 +01:00
Code Issues Packages Projects Releases Wiki Activity

8272131: PhaseMacroExpand::generate_slow_arraycopy crash when clone null CallProjections.fallthrough_ioproj

Browse Source 
Reviewed-by: neliasso, xliu, thartmann
This commit is contained in:
Hui Shi
2021-08-11 02:00:19 +00:00
parent 148935279d
commit 5350b9901c
2 changed files with 75 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/hotspot/share/opto/macroArrayCopy.cpp
View File

@@ -831,7 +831,9 @@ Node* PhaseMacroExpand::generate_arraycopy(ArrayCopyNode *ac, AllocateArrayNode*
}
_igvn.replace_node(_callprojs.fallthrough_memproj, out_mem);
_igvn.replace_node(_callprojs.fallthrough_ioproj, *io);
if (_callprojs.fallthrough_ioproj != NULL) {
_igvn.replace_node(_callprojs.fallthrough_ioproj, *io);
}
_igvn.replace_node(_callprojs.fallthrough_catchproj, *ctrl);
#ifdef ASSERT
@@ -1095,8 +1097,14 @@ MergeMemNode* PhaseMacroExpand::generate_slow_arraycopy(ArrayCopyNode *ac,
}
transform_later(out_mem);
*io = _callprojs.fallthrough_ioproj->clone();
transform_later(*io);
// When src is negative and arraycopy is before an infinite loop,_callprojs.fallthrough_ioproj
// could be NULL. Skip clone and update NULL fallthrough_ioproj.
if (_callprojs.fallthrough_ioproj != NULL) {
*io = _callprojs.fallthrough_ioproj->clone();
transform_later(*io);
} else {
*io = NULL;
}
return out_mem;
}
@@ -1333,7 +1341,9 @@ void PhaseMacroExpand::expand_arraycopy_node(ArrayCopyNode *ac) {
}
_igvn.replace_node(_callprojs.fallthrough_memproj, merge_mem);
_igvn.replace_node(_callprojs.fallthrough_ioproj, io);
if (_callprojs.fallthrough_ioproj != NULL) {
_igvn.replace_node(_callprojs.fallthrough_ioproj, io);
}
_igvn.replace_node(_callprojs.fallthrough_catchproj, ctrl);
return;
}

61
test/hotspot/jtreg/compiler/arraycopy/TestIllegalArrayCopyBeforeInfiniteLoop.java Normal file
View File

@@ -0,0 +1,61 @@
/*
* Copyright (C) 2021 THL A29 Limited, a Tencent company. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 8272131
* @requires vm.compiler2.enabled
* @summary ArrayCopy with negative index before infinite loop
* @run main/othervm -Xbatch -XX:-TieredCompilation
* -XX:CompileCommand=compileonly,"*TestIllegalArrayCopyBeforeInfiniteLoop::foo"
* compiler.arraycopy.TestIllegalArrayCopyBeforeInfiniteLoop
*/
package compiler.arraycopy;
import java.util.Arrays;
public class TestIllegalArrayCopyBeforeInfiniteLoop {
private static char src[] = new char[10];
private static int count = 0;
private static final int iter = 10_000;
public static void main(String[] args) throws Exception {
for (int i = 0; i < iter; ++i) {
foo();
}
if (count != iter) {
throw new RuntimeException("test failed");
}
}
static void foo() {
try {
Arrays.copyOfRange(src, -1, 128);
do {
} while (true);
} catch (ArrayIndexOutOfBoundsException ex) {
count++;
}
}
}