Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8066103

C2's range check smearing allows out of bound array accesses

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Fixed
    • Icon: P2 P2
    • 9
    • 7u71, 8u40, 9
    • hotspot
    • None
    • b44
    • Verified

        This test fails when m1 is compiled by C2 because C2's range check smearing changes the array bound check of the first access to test only for lowest constant values of all array accesses.

        public class TestRangeCheckSmearing {

            static int m1(int[] array, int i, boolean allaccesses) {
                int res = 0;
                res += array[i+4];
                if (allaccesses) {
                    res += array[i+3];
                    res += array[i+2];
                    res += array[i+1];
                }
                return res;
            }

            static public void main(String[] args) {
                int[] array = new int[10];
                
                for (int i = 0; i < 20000; i++) {
                    m1(array, 0, (i % 2) == 0);
                }
                boolean exception = false;
                try {
                    m1(array, 8, false);
                } catch(ArrayIndexOutOfBoundsException aioob) {
                    exception = true;
                    System.out.println("ArrayIndexOutOfBoundsException thrown for m1");
                }
                if (!exception) {
                    throw new RuntimeException("ArrayIndexOutOfBoundsException not throw");
                }
            }
        }

        ILW=H(may crash the VM) L (most bad array access will hit somewhere in the heap, has gone unnoticed for a long time) H(none)

              roland Roland Westrelin
              roland Roland Westrelin
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: