Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8215265

C2: range check elimination may allow illegal out of bound access

    Details

    • Subcomponent:
    • Resolved In Build:
      b27
    • Verification:
      Verified

      Backports

        Description

        Following test case:

        import java.util.Arrays;

        public class RangeCheckEliminationScaleNotOne {
            public static void main(String[] args) {
                {
                    int[] array = new int[199];
                    boolean[] flags = new boolean[100];
                    Arrays.fill(flags, true);
                    flags[0] = false;
                    flags[1] = false;
                    for (int i = 0; i < 20_000; i++) {
                        test1(100, array, 0, flags);
                    }
                    boolean ex = false;
                    try {
                        test1(100, array, -5, flags);
                    } catch (ArrayIndexOutOfBoundsException aie) {
                        ex = true;
                    }
                    if (!ex) {
                        throw new RuntimeException("no AIOOB exception");
                    }
                }
            }

            private static int test1(int stop, int[] array, int offset, boolean[] flags) {
                if (array == null) {}
                int res = 0;
                for (int i = 0; i < stop; i++) {
                    if (flags[i]) {
                        res += array[2 * i + offset];
                    }
                }
                return res;
            }
        }

        ran with:

        java -XX:-BackgroundCompilation -XX:-TieredCompilation -XX:-UseOnStackReplacement -XX:CompileOnly=RangeCheckEliminationScaleNotOne::test1 -XX:LoopMaxUnroll=1 -XX:-UseLoopPredicate RangeCheckEliminationScaleNotOne

        either:

        - fails with same error as JDK-8211698

        or with fix suggested:
        https://bugs.openjdk.java.net/browse/JDK-8211698?focusedCommentId=14229219&page=com.atlassian.jira.plugin.system.issuetabpanels%3Acomment-tabpanel#comment-14229219

        - segfaults because of an out of bound access

        Given how old this code is, and while I haven't verified, it's likely to affect all versions since at least 8.

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  roland Roland Westrelin
                  Reporter:
                  roland Roland Westrelin
                • Votes:
                  0 Vote for this issue
                  Watchers:
                  5 Start watching this issue

                  Dates

                  • Created:
                    Updated:
                    Resolved: