Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8066103

C2's range check smearing allows out of bound array accesses

    Details

    • Type: Bug
    • Status: Closed
    • Priority: P2
    • Resolution: Fixed
    • Affects Version/s: 7u71, 8u40, 9
    • Fix Version/s: 9
    • Component/s: hotspot
    • Labels:
      None
    • Subcomponent:
    • Resolved In Build:
      b44
    • Verification:
      Verified

      Backports

        Description

        This test fails when m1 is compiled by C2 because C2's range check smearing changes the array bound check of the first access to test only for lowest constant values of all array accesses.

        public class TestRangeCheckSmearing {

            static int m1(int[] array, int i, boolean allaccesses) {
                int res = 0;
                res += array[i+4];
                if (allaccesses) {
                    res += array[i+3];
                    res += array[i+2];
                    res += array[i+1];
                }
                return res;
            }

            static public void main(String[] args) {
                int[] array = new int[10];
                
                for (int i = 0; i < 20000; i++) {
                    m1(array, 0, (i % 2) == 0);
                }
                boolean exception = false;
                try {
                    m1(array, 8, false);
                } catch(ArrayIndexOutOfBoundsException aioob) {
                    exception = true;
                    System.out.println("ArrayIndexOutOfBoundsException thrown for m1");
                }
                if (!exception) {
                    throw new RuntimeException("ArrayIndexOutOfBoundsException not throw");
                }
            }
        }

        ILW=H(may crash the VM) L (most bad array access will hit somewhere in the heap, has gone unnoticed for a long time) H(none)

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  roland Roland Westrelin
                  Reporter:
                  roland Roland Westrelin
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  3 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: