Skip to content

Commit 52324b5

Browse files
GoeLinGoeLin
committed
8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument
Reviewed-by: mdoerr Backport-of: 45e4e00981ef8b4bf143afce0889698319273c1d
1 parent ac823d3 commit 52324b5

File tree

2 files changed

+87
-26
lines changed

2 files changed

+87
-26
lines changed

‎src/hotspot/share/opto/library_call.cpp

+29-26
Original file line numberDiff line numberDiff line change
@@ -1288,10 +1288,13 @@ bool LibraryCallKit::inline_string_copy(bool compress) {
12881288
AllocateArrayNode* alloc = tightly_coupled_allocation(dst);
12891289

12901290
// Figure out the size and type of the elements we will be copying.
1291-
const Type* src_type = src->Value(&_gvn);
1292-
const Type* dst_type = dst->Value(&_gvn);
1293-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
1294-
BasicType dst_elem = dst_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
1291+
const TypeAryPtr* src_type = src->Value(&_gvn)->isa_aryptr();
1292+
const TypeAryPtr* dst_type = dst->Value(&_gvn)->isa_aryptr();
1293+
if (src_type == nullptr || dst_type == nullptr) {
1294+
return false;
1295+
}
1296+
BasicType src_elem = src_type->klass()->as_array_klass()->element_type()->basic_type();
1297+
BasicType dst_elem = dst_type->klass()->as_array_klass()->element_type()->basic_type();
12951298
assert((compress && dst_elem == T_BYTE && (src_elem == T_BYTE || src_elem == T_CHAR)) ||
12961299
(!compress && src_elem == T_BYTE && (dst_elem == T_BYTE || dst_elem == T_CHAR)),
12971300
"Unsupported array types for inline_string_copy");
@@ -4943,8 +4946,8 @@ bool LibraryCallKit::inline_encodeISOArray(bool ascii) {
49434946
}
49444947

49454948
// Figure out the size and type of the elements we will be copying.
4946-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
4947-
BasicType dst_elem = dst_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
4949+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
4950+
BasicType dst_elem = top_dest->klass()->as_array_klass()->element_type()->basic_type();
49484951
if (!((src_elem == T_CHAR) || (src_elem== T_BYTE)) || dst_elem != T_BYTE) {
49494952
return false;
49504953
}
@@ -4997,8 +5000,8 @@ bool LibraryCallKit::inline_multiplyToLen() {
49975000
return false;
49985001
}
49995002

5000-
BasicType x_elem = x_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5001-
BasicType y_elem = y_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5003+
BasicType x_elem = top_x->klass()->as_array_klass()->element_type()->basic_type();
5004+
BasicType y_elem = top_y->klass()->as_array_klass()->element_type()->basic_type();
50025005
if (x_elem != T_INT || y_elem != T_INT) {
50035006
return false;
50045007
}
@@ -5105,8 +5108,8 @@ bool LibraryCallKit::inline_squareToLen() {
51055108
return false;
51065109
}
51075110

5108-
BasicType x_elem = x_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5109-
BasicType z_elem = z_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5111+
BasicType x_elem = top_x->klass()->as_array_klass()->element_type()->basic_type();
5112+
BasicType z_elem = top_z->klass()->as_array_klass()->element_type()->basic_type();
51105113
if (x_elem != T_INT || z_elem != T_INT) {
51115114
return false;
51125115
}
@@ -5154,8 +5157,8 @@ bool LibraryCallKit::inline_mulAdd() {
51545157
return false;
51555158
}
51565159

5157-
BasicType out_elem = out_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5158-
BasicType in_elem = in_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5160+
BasicType out_elem = top_out->klass()->as_array_klass()->element_type()->basic_type();
5161+
BasicType in_elem = top_in->klass()->as_array_klass()->element_type()->basic_type();
51595162
if (out_elem != T_INT || in_elem != T_INT) {
51605163
return false;
51615164
}
@@ -5209,10 +5212,10 @@ bool LibraryCallKit::inline_montgomeryMultiply() {
52095212
return false;
52105213
}
52115214

5212-
BasicType a_elem = a_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5213-
BasicType b_elem = b_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5214-
BasicType n_elem = n_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5215-
BasicType m_elem = m_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5215+
BasicType a_elem = top_a->klass()->as_array_klass()->element_type()->basic_type();
5216+
BasicType b_elem = top_b->klass()->as_array_klass()->element_type()->basic_type();
5217+
BasicType n_elem = top_n->klass()->as_array_klass()->element_type()->basic_type();
5218+
BasicType m_elem = top_m->klass()->as_array_klass()->element_type()->basic_type();
52165219
if (a_elem != T_INT || b_elem != T_INT || n_elem != T_INT || m_elem != T_INT) {
52175220
return false;
52185221
}
@@ -5265,9 +5268,9 @@ bool LibraryCallKit::inline_montgomerySquare() {
52655268
return false;
52665269
}
52675270

5268-
BasicType a_elem = a_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5269-
BasicType n_elem = n_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5270-
BasicType m_elem = m_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5271+
BasicType a_elem = top_a->klass()->as_array_klass()->element_type()->basic_type();
5272+
BasicType n_elem = top_n->klass()->as_array_klass()->element_type()->basic_type();
5273+
BasicType m_elem = top_m->klass()->as_array_klass()->element_type()->basic_type();
52715274
if (a_elem != T_INT || n_elem != T_INT || m_elem != T_INT) {
52725275
return false;
52735276
}
@@ -5317,8 +5320,8 @@ bool LibraryCallKit::inline_bigIntegerShift(bool isRightShift) {
53175320
return false;
53185321
}
53195322

5320-
BasicType newArr_elem = newArr_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5321-
BasicType oldArr_elem = oldArr_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5323+
BasicType newArr_elem = top_newArr->klass()->as_array_klass()->element_type()->basic_type();
5324+
BasicType oldArr_elem = top_oldArr->klass()->as_array_klass()->element_type()->basic_type();
53225325
if (newArr_elem != T_INT || oldArr_elem != T_INT) {
53235326
return false;
53245327
}
@@ -5531,7 +5534,7 @@ bool LibraryCallKit::inline_updateBytesCRC32() {
55315534
}
55325535

55335536
// Figure out the size and type of the elements we will be copying.
5534-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5537+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
55355538
if (src_elem != T_BYTE) {
55365539
return false;
55375540
}
@@ -5620,7 +5623,7 @@ bool LibraryCallKit::inline_updateBytesCRC32C() {
56205623
}
56215624

56225625
// Figure out the size and type of the elements we will be copying.
5623-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5626+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
56245627
if (src_elem != T_BYTE) {
56255628
return false;
56265629
}
@@ -5713,7 +5716,7 @@ bool LibraryCallKit::inline_updateBytesAdler32() {
57135716
}
57145717

57155718
// Figure out the size and type of the elements we will be copying.
5716-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
5719+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
57175720
if (src_elem != T_BYTE) {
57185721
return false;
57195722
}
@@ -6550,7 +6553,7 @@ bool LibraryCallKit::inline_digestBase_implCompress(vmIntrinsics::ID id) {
65506553
return false;
65516554
}
65526555
// Figure out the size and type of the elements we will be copying.
6553-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
6556+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
65546557
if (src_elem != T_BYTE) {
65556558
return false;
65566559
}
@@ -6642,7 +6645,7 @@ bool LibraryCallKit::inline_digestBase_implCompressMB(int predicate) {
66426645
return false;
66436646
}
66446647
// Figure out the size and type of the elements we will be copying.
6645-
BasicType src_elem = src_type->isa_aryptr()->klass()->as_array_klass()->element_type()->basic_type();
6648+
BasicType src_elem = top_src->klass()->as_array_klass()->element_type()->basic_type();
66466649
if (src_elem != T_BYTE) {
66476650
return false;
66486651
}

‎test/hotspot/jtreg/compiler/intrinsics/string/TestCopyValueOf.java

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/*
2+
* Copyright (c) 2023, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
26+
/*
27+
* @test
28+
* @bug 8300079
29+
* @summary Verify that String.copyValueOf properly handles null input with intrinsified helper methods.
30+
* @run main/othervm -XX:-TieredCompilation -Xcomp
31+
* -XX:CompileCommand=compileonly,compiler.intrinsics.string.TestCopyValueOf::test
32+
* -XX:CompileCommand=dontinline,java.lang.String::rangeCheck
33+
* compiler.intrinsics.string.TestCopyValueOf
34+
*/
35+
36+
package compiler.intrinsics.string;
37+
38+
public class TestCopyValueOf {
39+
40+
public static boolean test() {
41+
try {
42+
String.copyValueOf(null, 42, 43);
43+
} catch (NullPointerException e) {
44+
return true;
45+
}
46+
return false;
47+
}
48+
49+
public static void main(String[] args) {
50+
// Warmup
51+
char data[] = {42};
52+
String.copyValueOf(data, 0, 1);
53+
54+
if (!test()) {
55+
throw new RuntimeException("Unexpected result");
56+
}
57+
}
58+
}

0 commit comments

Comments
 (0)