8257624: C2: PhaseMacroExpand::eliminate_macro_nodes() crashes on out…

…-of-bounds access into macro node array Reviewed-by: neliasso, kvn
openjdk · Dec 4, 2020 · fbdc187 · fbdc187 · openjdk-notifier · Dec 4, 2020
1 parent fd6756e
commit fbdc187
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/src/hotspot/share/opto/macro.cpp b/src/hotspot/share/opto/macro.cpp
@@ -2564,7 +2564,10 @@ void PhaseMacroExpand::eliminate_macro_nodes() {
   while (progress) {
     progress = false;
     for (int i = C->macro_count(); i > 0; i--) {
-      Node * n = C->macro_node(i-1);
+      if (i > C->macro_count()) {
+        i = C->macro_count(); // more than 1 element can be eliminated at once
+      }
+      Node* n = C->macro_node(i-1);
       bool success = false;
       DEBUG_ONLY(int old_macro_count = C->macro_count();)
       if (n->is_AbstractLock()) {
@@ -2580,7 +2583,10 @@ void PhaseMacroExpand::eliminate_macro_nodes() {
   while (progress) {
     progress = false;
     for (int i = C->macro_count(); i > 0; i--) {
-      Node * n = C->macro_node(i-1);
+      if (i > C->macro_count()) {
+        i = C->macro_count(); // more than 1 element can be eliminated at once
+      }
+      Node* n = C->macro_node(i-1);
       bool success = false;
       DEBUG_ONLY(int old_macro_count = C->macro_count();)
       switch (n->class_id()) {