Skip to content

Commit 1cbdcc9

Browse files
GoeLinGoeLin
committed
8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument
Reviewed-by: roland Backport-of: 52324b55fb7be2cd1ba9e843ece93375ac23649c
1 parent b3d6981 commit 1cbdcc9

File tree

2 files changed

+85
-24
lines changed

2 files changed

+85
-24
lines changed

‎src/hotspot/share/opto/library_call.cpp

+27-24
Original file line numberDiff line numberDiff line change
@@ -1496,10 +1496,13 @@ bool LibraryCallKit::inline_string_copy(bool compress) {
14961496
AllocateArrayNode* alloc = tightly_coupled_allocation(dst, NULL);
14971497

14981498
// Figure out the size and type of the elements we will be copying.
1499-
const Type* src_type = src->Value(&_gvn);
1500-
const Type* dst_type = dst->Value(&_gvn);
1501-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
1502-
BasicType dst_elem = dst_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
1499+
const TypeAryPtr* src_type = src->Value(&_gvn)->isa_aryptr();
1500+
const TypeAryPtr* dst_type = dst->Value(&_gvn)->isa_aryptr();
1501+
if (src_type == NULL || dst_type == NULL) {
1502+
return false;
1503+
}
1504+
BasicType src_elem = src_type->klass()->as_array_klass()->element_type()->basic_type();
1505+
BasicType dst_elem = dst_type->klass()->as_array_klass()->element_type()->basic_type();
15031506
assert((compress && dst_elem == T_BYTE && (src_elem == T_BYTE || src_elem == T_CHAR)) ||
15041507
(!compress && src_elem == T_BYTE && (dst_elem == T_BYTE || dst_elem == T_CHAR)),
15051508
"Unsupported array types for inline_string_copy");
@@ -5018,8 +5021,8 @@ bool LibraryCallKit::inline_encodeISOArray() {
50185021
}
50195022

50205023
// Figure out the size and type of the elements we will be copying.
5021-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5022-
BasicType dst_elem = dst_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5024+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
5025+
BasicType dst_elem = top_dest->klass()->as_array_klass()->element_type()->basic_type();
50235026
if (!((src_elem == T_CHAR) || (src_elem== T_BYTE)) || dst_elem != T_BYTE) {
50245027
return false;
50255028
}
@@ -5072,8 +5075,8 @@ bool LibraryCallKit::inline_multiplyToLen() {
50725075
return false;
50735076
}
50745077

5075-
BasicType x_elem = x_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5076-
BasicType y_elem = y_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5078+
BasicType x_elem = top_x->klass()->as_array_klass()->element_type()->basic_type();
5079+
BasicType y_elem = top_y->klass()->as_array_klass()->element_type()->basic_type();
50775080
if (x_elem != T_INT || y_elem != T_INT) {
50785081
return false;
50795082
}
@@ -5180,8 +5183,8 @@ bool LibraryCallKit::inline_squareToLen() {
51805183
return false;
51815184
}
51825185

5183-
BasicType x_elem = x_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5184-
BasicType z_elem = z_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5186+
BasicType x_elem = top_x->klass()->as_array_klass()->element_type()->basic_type();
5187+
BasicType z_elem = top_z->klass()->as_array_klass()->element_type()->basic_type();
51855188
if (x_elem != T_INT || z_elem != T_INT) {
51865189
return false;
51875190
}
@@ -5229,8 +5232,8 @@ bool LibraryCallKit::inline_mulAdd() {
52295232
return false;
52305233
}
52315234

5232-
BasicType out_elem = out_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5233-
BasicType in_elem = in_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5235+
BasicType out_elem = top_out->klass()->as_array_klass()->element_type()->basic_type();
5236+
BasicType in_elem = top_in->klass()->as_array_klass()->element_type()->basic_type();
52345237
if (out_elem != T_INT || in_elem != T_INT) {
52355238
return false;
52365239
}
@@ -5284,10 +5287,10 @@ bool LibraryCallKit::inline_montgomeryMultiply() {
52845287
return false;
52855288
}
52865289

5287-
BasicType a_elem = a_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5288-
BasicType b_elem = b_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5289-
BasicType n_elem = n_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5290-
BasicType m_elem = m_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5290+
BasicType a_elem = top_a->klass()->as_array_klass()->element_type()->basic_type();
5291+
BasicType b_elem = top_b->klass()->as_array_klass()->element_type()->basic_type();
5292+
BasicType n_elem = top_n->klass()->as_array_klass()->element_type()->basic_type();
5293+
BasicType m_elem = top_m->klass()->as_array_klass()->element_type()->basic_type();
52915294
if (a_elem != T_INT || b_elem != T_INT || n_elem != T_INT || m_elem != T_INT) {
52925295
return false;
52935296
}
@@ -5340,9 +5343,9 @@ bool LibraryCallKit::inline_montgomerySquare() {
53405343
return false;
53415344
}
53425345

5343-
BasicType a_elem = a_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5344-
BasicType n_elem = n_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5345-
BasicType m_elem = m_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5346+
BasicType a_elem = top_a->klass()->as_array_klass()->element_type()->basic_type();
5347+
BasicType n_elem = top_n->klass()->as_array_klass()->element_type()->basic_type();
5348+
BasicType m_elem = top_m->klass()->as_array_klass()->element_type()->basic_type();
53465349
if (a_elem != T_INT || n_elem != T_INT || m_elem != T_INT) {
53475350
return false;
53485351
}
@@ -5465,7 +5468,7 @@ bool LibraryCallKit::inline_updateBytesCRC32() {
54655468
}
54665469

54675470
// Figure out the size and type of the elements we will be copying.
5468-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5471+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
54695472
if (src_elem != T_BYTE) {
54705473
return false;
54715474
}
@@ -5554,7 +5557,7 @@ bool LibraryCallKit::inline_updateBytesCRC32C() {
55545557
}
55555558

55565559
// Figure out the size and type of the elements we will be copying.
5557-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5560+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
55585561
if (src_elem != T_BYTE) {
55595562
return false;
55605563
}
@@ -5647,7 +5650,7 @@ bool LibraryCallKit::inline_updateBytesAdler32() {
56475650
}
56485651

56495652
// Figure out the size and type of the elements we will be copying.
5650-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5653+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
56515654
if (src_elem != T_BYTE) {
56525655
return false;
56535656
}
@@ -6462,7 +6465,7 @@ bool LibraryCallKit::inline_sha_implCompress(vmIntrinsics::ID id) {
64626465
return false;
64636466
}
64646467
// Figure out the size and type of the elements we will be copying.
6465-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
6468+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
64666469
if (src_elem != T_BYTE) {
64676470
return false;
64686471
}
@@ -6532,7 +6535,7 @@ bool LibraryCallKit::inline_digestBase_implCompressMB(int predicate) {
65326535
return false;
65336536
}
65346537
// Figure out the size and type of the elements we will be copying.
6535-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
6538+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
65366539
if (src_elem != T_BYTE) {
65376540
return false;
65386541
}

‎test/hotspot/jtreg/compiler/intrinsics/string/TestCopyValueOf.java

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/*
2+
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
26+
/*
27+
* @test
28+
* @bug 8300079
29+
* @summary Verify that String.copyValueOf properly handles null input with intrinsified helper methods.
30+
* @run main/othervm -XX:-TieredCompilation -Xcomp
31+
* -XX:CompileCommand=compileonly,compiler.intrinsics.string.TestCopyValueOf::test
32+
* -XX:CompileCommand=dontinline,java.lang.String::rangeCheck
33+
* compiler.intrinsics.string.TestCopyValueOf
34+
*/
35+
36+
package compiler.intrinsics.string;
37+
38+
public class TestCopyValueOf {
39+
40+
public static boolean test() {
41+
try {
42+
String.copyValueOf(null, 42, 43);
43+
} catch (NullPointerException e) {
44+
return true;
45+
}
46+
return false;
47+
}
48+
49+
public static void main(String[] args) {
50+
// Warmup
51+
char data[] = {42};
52+
String.copyValueOf(data, 0, 1);
53+
54+
if (!test()) {
55+
throw new RuntimeException("Unexpected result");
56+
}
57+
}
58+
}

0 commit comments

Comments
 (0)