Skip to content
Permalink
Browse files
8267904: C2 crash when compile negative Arrays.copyOf length after loop
Reviewed-by: roland, kvn
  • Loading branch information
Hui Shi authored and DamonFool committed Jun 7, 2021
1 parent 95ddf7d commit b05fa02e7413fdcc40969645309e3e9d4442c78d
Showing 4 changed files with 98 additions and 3 deletions.
@@ -1758,7 +1758,7 @@ Node *AllocateArrayNode::make_ideal_length(const TypeOopPtr* oop_type, PhaseTran
InitializeNode* init = initialization();
assert(init != NULL, "initialization not found");
length = new CastIINode(length, narrow_length_type);
length->set_req(0, init->proj_out_or_null(0));
length->set_req(TypeFunc::Control, init->proj_out_or_null(TypeFunc::Control));
}
}

@@ -3971,8 +3971,7 @@ Node* GraphKit::new_array(Node* klass_node, // array klass (maybe variable)
if (map()->find_edge(length) >= 0) {
Node* ccast = alloc->make_ideal_length(ary_type, &_gvn);
if (ccast != length) {
_gvn.set_type_bottom(ccast);
record_for_igvn(ccast);
ccast = _gvn.transform(ccast);
replace_in_map(length, ccast);
}
}
@@ -4443,6 +4443,30 @@ void LibraryCallKit::arraycopy_move_allocation_here(AllocateArrayNode* alloc, No
Node* alloc_mem = alloc->in(TypeFunc::Memory);
C->gvn_replace_by(callprojs.fallthrough_ioproj, alloc->in(TypeFunc::I_O));
C->gvn_replace_by(init->proj_out(TypeFunc::Memory), alloc_mem);

// The CastIINode created in GraphKit::new_array (in AllocateArrayNode::make_ideal_length) must stay below
// the allocation (i.e. is only valid if the allocation succeeds):
// 1) replace CastIINode with AllocateArrayNode's length here
// 2) Create CastIINode again once allocation has moved (see below) at the end of this method
Node* init_control = init->proj_out(TypeFunc::Control);
Node* alloc_length = alloc->Ideal_length();
#ifdef ASSERT
Node* prev_cast = NULL;
#endif
for (uint i = 0; i < init_control->outcnt(); i++) {
Node *init_out = init_control->raw_out(i);
if (init_out->is_CastII() && init_out->in(0) == init_control && init_out->in(1) == alloc_length) {
#ifdef ASSERT
if (prev_cast == NULL) {
prev_cast = init_out;
assert(_gvn.hash_find(prev_cast) != NULL, "not found");
} else {
assert(_gvn.hash_find(prev_cast) == _gvn.hash_find(init_out), "not equal CastIINode");
}
#endif
C->gvn_replace_by(init_out, alloc_length);
}
}
C->gvn_replace_by(init->proj_out(TypeFunc::Control), alloc->in(0));

// move the allocation here (after the guards)
@@ -4474,6 +4498,18 @@ void LibraryCallKit::arraycopy_move_allocation_here(AllocateArrayNode* alloc, No
dest->set_req(0, control());
Node* destx = _gvn.transform(dest);
assert(destx == dest, "where has the allocation result gone?");

// Cast length on remaining path to be as narrow as possible
// previous CastNode inserted when creating AllocateArrayNode
// is removed in early step in LibraryCallKit::inline_arraycopy
Node* length = alloc->in(AllocateNode::ALength);
if (map()->find_edge(length) >= 0) {
Node* ccast = alloc->make_ideal_length(ary_type, &_gvn);
if (ccast != length) {
ccast = _gvn.transform(ccast);
replace_in_map(length, ccast);
}
}
}
}

@@ -0,0 +1,60 @@
/*
* Copyright (C) 2021 THL A29 Limited, a Tencent company. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/

/**
* @test
* @bug 8267904
* @requires vm.compiler2.enabled
* @summary C2 inline array_copy move CastIINode(Array Length) before allocation cause crash.
* @run main/othervm compiler.c2.TestNegativeArrayCopyAfterLoop
*/

package compiler.c2;
import java.util.Arrays;

class test {
public static int exp_count = 0;
public int in1 = -4096;
test (){
try {
short sha4[] = new short[1012];
for (int i = 0; i < sha4.length; i++) {
sha4[i] = 9;
}
Arrays.copyOf(sha4, in1);
} catch (Exception ex) {
exp_count++;
}
}
}

public class TestNegativeArrayCopyAfterLoop {
public static void main(String[] args) {
for (int i = 0; i < 20000; i++) {
new test();
}
if (test.exp_count == 20000) {
System.out.println("TEST PASSED");
}
}
}

0 comments on commit b05fa02

Please sign in to comment.