8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA #18472

dlunde · 2024-03-25T13:28:32Z

Issue Summary

The library intrinsic _copyOfRange does not add a guard for start indices that are larger than the length of the source arrays. Macro expansion of ArrayCopy nodes later adds such a guard, but in certain situations escape analysis may result in removing the ArrayCopy node before it is expanded. The result is incorrect behavior of the compiled program (as the missing guard may have relevant side effects, such as throwing an exception).

Changeset

Add the missing guard (start index <= source array length).
Add a regression test.

Testing

GitHub Actions
tier1 to tier5 on windows-x64, linux-x64, linux-aarch64, macosx-x64, and macosx-aarch64.

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA (Bug - P3)

Reviewers

Tobias Hartmann (@TobiHartmann - Reviewer) ⚠️ Review applies to 47cfe37d
Vladimir Kozlov (@vnkozlov - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk.git pull/18472/head:pull/18472
$ git checkout pull/18472

Update a local copy of the PR:
$ git checkout pull/18472
$ git pull https://git.openjdk.org/jdk.git pull/18472/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 18472

View PR using the GUI difftool:
$ git pr show -t 18472

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/18472.diff

Webrev

Link to Webrev Comment

bridgekeeper · 2024-03-25T13:29:27Z

👋 Welcome back dlunden! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2024-03-25T13:30:13Z

@dlunde This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA

Reviewed-by: thartmann, kvn

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 116 new commits pushed to the master branch:

2b79c22: 8327505: Test com/sun/jmx/remote/NotificationMarshalVersions/TestSerializationMismatch.java fails
47f33a5: 8327986: ASAN reports use-after-free in DirectivesParserTest.empty_object_vm
d580bcf: 8329178: Clean up jdk.accessibility native compilation
4fa77a2: 8329096: G1: Change the type of G1BlockOffsetTable::_offset_base to uint8_t*
3eb1d05: 8328986: Deprecate UseRTM* flags for removal
0cb0b5d: 8327875: ChoiceFormat should advise throwing UnsupportedOperationException for unused methods
e3588bb: 8328819: Remove applet usage from JFileChooser tests bug6698013
cc5b9c6: 8328227: Remove applet usage from JColorChooser tests Test4887836
892b8bb: 8329189: runtime/stack/Stack016.java fails on libgraal
05854fd: 8329163: C2: possible overflow in PhaseIdealLoop::extract_long_range_checks()
... and 106 more: https://git.openjdk.org/jdk/compare/481473efce9f51a497e26002c6da52b0ddc9ea8f...master

As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

As you do not have Committer status in this project an existing Committer must agree to sponsor your change. Possible candidates are the reviewers of this PR (@TobiHartmann, @vnkozlov) but any other Committer may sponsor as well.

➡️ To flag this PR as ready for integration with the above commit message, type /integrate in a new comment. (Afterwards, your sponsor types /sponsor in a new comment to perform the integration).

openjdk · 2024-03-25T13:30:44Z

@dlunde The following label will be automatically applied to this pull request:

hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

mlbridge · 2024-03-25T13:33:33Z

Webrevs

01: Full - Incremental (2fe44dda)
00: Full (47cfe37d)

TobiHartmann

That looks good to me.

dlunde · 2024-03-25T14:44:45Z

src/hotspot/share/opto/library_call.cpp

@@ -4391,7 +4393,7 @@ bool LibraryCallKit::inline_array_copyOf(bool is_copyOfRange) {
      if (!stopped()) {
        newcopy = new_array(klass_node, length, 0);  // no arguments to push

-        ArrayCopyNode* ac = ArrayCopyNode::make(this, true, original, start, newcopy, intcon(0), moved, true, false,
+        ArrayCopyNode* ac = ArrayCopyNode::make(this, true, original, start, newcopy, intcon(0), moved, true, true,


Note: we can now specify true for the argument has_negative_length_guard.

dlunde · 2024-03-25T14:46:54Z

src/hotspot/share/opto/macroArrayCopy.cpp

@@ -1266,7 +1266,7 @@ void PhaseMacroExpand::expand_arraycopy_node(ArrayCopyNode *ac) {
    generate_arraycopy(ac, alloc, &ctrl, merge_mem, &io,
                       adr_type, T_OBJECT,
                       src, src_offset, dest, dest_offset, length,
-                       true, !ac->is_copyofrange());


We cannot use this anymore, since we then ignore the has_negative_length_guard for copyOfRange (and generate the negative length guard twice).

vnkozlov · 2024-03-25T16:50:36Z

src/hotspot/share/opto/library_call.cpp

    generate_negative_guard(start, bailout, &start);
-    generate_negative_guard(end,   bailout, &end);


I think we need this check to avoid underflow in integer expression (end - start): (min_int - 1) == max_int

OK, I see. Thanks, I readded the end guard.

vnkozlov

Looks good.

dlunde · 2024-03-28T09:28:14Z

Thanks for the reviews @TobiHartmann and @vnkozlov. Please sponsor!

/integrate

openjdk · 2024-03-28T09:29:03Z

@dlunde
Your change (at version 2fe44dd) is now ready to be sponsored by a Committer.

TobiHartmann · 2024-04-03T05:49:49Z

/sponsor

openjdk · 2024-04-03T05:50:44Z

Going to push as commit 92f5c0b.
Since your change was applied there have been 167 commits pushed to the master branch:

866e7b6: 8329174: update CodeBuffer layout in comment after constants section moved
f88f31d: 8328137: PreserveAllAnnotations can cause failure of class retransformation
021ed6a: 8328648: Remove applet usage from JFileChooser tests bug4150029
3057dde: 8329421: Native methods can not be selectively printed
db15914: 8328753: Open source few Undecorated Frame tests
925d829: 8329013: StackOverflowError when starting Apache Tomcat with signed jar
dd5d7d0: 8327002: (fs) java/nio/file/Files/CopyMoveVariations.java should be able to test across file systems
6ae1cf1: 8329368: Generational ZGC: Remove the unnecessary friend classes in ZAllocator
7eb78e3: 8320676: Manual printer tests have no Pass/Fail buttons, instructions close set 1
5ac067f: 8329289: Unify SetupJdkExecutable and SetupJdkLibrary
... and 157 more: https://git.openjdk.org/jdk/compare/481473efce9f51a497e26002c6da52b0ddc9ea8f...master

Your commit was automatically rebased without conflicts.

openjdk · 2024-04-03T05:50:52Z

@TobiHartmann @dlunde Pushed as commit 92f5c0b.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

dlunde added 2 commits March 22, 2024 10:16

Fix

74e97a0

Grammar fix

47cfe37

openjdk bot changed the title ~~8323682~~ 8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA Mar 25, 2024

openjdk bot added the rfr Pull request is ready for review label Mar 25, 2024

openjdk bot added the hotspot-compiler hotspot-compiler-dev@openjdk.org label Mar 25, 2024

TobiHartmann approved these changes Mar 25, 2024

View reviewed changes

openjdk bot added the ready Pull request is ready to be integrated label Mar 25, 2024

dlunde commented Mar 25, 2024

View reviewed changes

vnkozlov reviewed Mar 25, 2024

View reviewed changes

Readd negative end check

2fe44dd

vnkozlov approved these changes Mar 26, 2024

View reviewed changes

openjdk bot added the sponsor Pull request is ready to be sponsored label Mar 28, 2024

openjdk bot added the integrated Pull request has been integrated label Apr 3, 2024

openjdk bot closed this Apr 3, 2024

openjdk bot removed ready Pull request is ready to be integrated rfr Pull request is ready for review sponsor Pull request is ready to be sponsored labels Apr 3, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA #18472

8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA #18472

Uh oh!

dlunde commented Mar 25, 2024 •

edited by openjdk bot

Loading

Uh oh!

bridgekeeper bot commented Mar 25, 2024

Uh oh!

openjdk bot commented Mar 25, 2024 •

edited

Loading

Uh oh!

openjdk bot commented Mar 25, 2024

Uh oh!

mlbridge bot commented Mar 25, 2024 •

edited

Loading

Uh oh!

TobiHartmann left a comment

Uh oh!

dlunde Mar 25, 2024

Uh oh!

dlunde Mar 25, 2024

Uh oh!

vnkozlov Mar 25, 2024

Uh oh!

dlunde Mar 26, 2024

Uh oh!

vnkozlov left a comment

Uh oh!

dlunde commented Mar 28, 2024

Uh oh!

openjdk bot commented Mar 28, 2024

Uh oh!

TobiHartmann commented Apr 3, 2024

Uh oh!

openjdk bot commented Apr 3, 2024

Uh oh!

openjdk bot commented Apr 3, 2024

Uh oh!

Uh oh!

		generate_negative_guard(start, bailout, &start);
		generate_negative_guard(end, bailout, &end);

8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA #18472

8323682: C2: guard check is not generated in Arrays.copyOfRange intrinsic when allocation is eliminated by EA #18472

Uh oh!

Conversation

dlunde commented Mar 25, 2024 • edited by openjdk bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue Summary

Changeset

Testing

Progress

Issue

Reviewers

Reviewing

Webrev

Uh oh!

bridgekeeper bot commented Mar 25, 2024

Uh oh!

openjdk bot commented Mar 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openjdk bot commented Mar 25, 2024

Uh oh!

mlbridge bot commented Mar 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Webrevs

Uh oh!

TobiHartmann left a comment

Choose a reason for hiding this comment

Uh oh!

dlunde Mar 25, 2024

Choose a reason for hiding this comment

Uh oh!

dlunde Mar 25, 2024

Choose a reason for hiding this comment

Uh oh!

vnkozlov Mar 25, 2024

Choose a reason for hiding this comment

Uh oh!

dlunde Mar 26, 2024

Choose a reason for hiding this comment

Uh oh!

vnkozlov left a comment

Choose a reason for hiding this comment

Uh oh!

dlunde commented Mar 28, 2024

Uh oh!

openjdk bot commented Mar 28, 2024

Uh oh!

TobiHartmann commented Apr 3, 2024

Uh oh!

openjdk bot commented Apr 3, 2024

Uh oh!

openjdk bot commented Apr 3, 2024

Uh oh!

Uh oh!

dlunde commented Mar 25, 2024 •

edited by openjdk bot

Loading

openjdk bot commented Mar 25, 2024 •

edited

Loading

mlbridge bot commented Mar 25, 2024 •

edited

Loading