[upstream]art-test 530-checker-loops2 c1 jit SIGSEGV

[sendaoYan]

test command:

java -Xcomp -XX:TieredStopAtLevel=1 Main 

result:

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f123d43ad97, pid=1631317, tid=1631318
#
# JRE version: OpenJDK Runtime Environment (Alibaba Dragonwell Standard Edition)-17.0.6.0.6+9-GA (17.0.6+9) (build 17.0.6+9)
# Java VM: OpenJDK 64-Bit Server VM (Alibaba Dragonwell Standard Edition)-17.0.6.0.6+9-GA (17.0.6+9, compiled mode, emulated-client, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# J 443 c1 Main.hiddenInfiniteOOB()V (53 bytes) @ 0x00007f123d43ad97 [0x00007f123d43aca0+0x00000000000000f7]
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /home/yansendao/tmp/core.1631317)
#
# An error report file with more information is saved as:
# /home/yansendao/tmp/hs_err_pid1631317.log
Compiled method (c1)     155  443       1       Main::hiddenInfiniteOOB (53 bytes)
 total in heap  [0x00007f123d43ab10,0x00007f123d43af28] = 1048
 relocation     [0x00007f123d43ac70,0x00007f123d43aca0] = 48
 main code      [0x00007f123d43aca0,0x00007f123d43ae40] = 416
 stub code      [0x00007f123d43ae40,0x00007f123d43ae70] = 48
 oops           [0x00007f123d43ae70,0x00007f123d43ae78] = 8
 metadata       [0x00007f123d43ae78,0x00007f123d43ae80] = 8
 scopes data    [0x00007f123d43ae80,0x00007f123d43aec0] = 64
 scopes pcs     [0x00007f123d43aec0,0x00007f123d43af20] = 96
 dependencies   [0x00007f123d43af20,0x00007f123d43af28] = 8
#
# If you would like to submit a bug report, please visit:
#   mailto:dragonwell_use@googlegroups.com
#
Aborted (core dumped)

hs_err_pid1631317.log

jdk22 run also SIGSEGV:

hs_err_pid1631276.log
Main.java.txt

creduce.sh.txt

裁剪结果：

class Main {
  static int b;
  static void c() {
    int[] a = {};
    for (int f = -1;; f++)
      for (int d = 4; d < 2147483646 * f - 3; d++)
        b = a[d + 4];
  }
  public static void main(String[] args) {
    try {
      c();
    } catch (ArrayIndexOutOfBoundsException e) {
    }
  }
}

[y1yang0]

I confirm this is an upstream bug, filed https://bugs.openjdk.org/browse/JDK-8311010