| Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
|---|---|---|---|---|---|---|
| JDK-8098642 | emb-9 | Roland Westrelin | P3 | Resolved | Fixed | team |
| JDK-8087255 | 8u65 | Roland Westrelin | P3 | Resolved | Fixed | b01 |
| JDK-8085808 | 8u60 | Roland Westrelin | P3 | Resolved | Fixed | b19 |
| JDK-8137657 | emb-8u65 | Unassigned | P3 | Resolved | Fixed | b01 |
| JDK-8129655 | emb-8u60 | Roland Westrelin | P3 | Resolved | Fixed | b19 |
In this example:
static void test1(int[] a, boolean[] flags, boolean flag, long j) {
for (int i = 0; i < 10; i++) {
if (flags[i]) {
if (flag) {
long address = (j << 2) + UNSAFE.ARRAY_INT_BASE_OFFSET;
int v = UNSAFE.getInt(a, address);
val = v;
}
}
}
}
the load's control is set to the true branch of if (flag). if (flag) is loop invariant and can be moved out of the loop. Because Node::depends_only_on_test() returns true for loads, the load keeps the true branch of if(flag) as a control and can execute independently of the test if (flags[i]).
ILW=H(crash) L(never seen) M(disable unsafe intrinsics)=P3
static void test1(int[] a, boolean[] flags, boolean flag, long j) {
for (int i = 0; i < 10; i++) {
if (flags[i]) {
if (flag) {
long address = (j << 2) + UNSAFE.ARRAY_INT_BASE_OFFSET;
int v = UNSAFE.getInt(a, address);
val = v;
}
}
}
}
the load's control is set to the true branch of if (flag). if (flag) is loop invariant and can be moved out of the loop. Because Node::depends_only_on_test() returns true for loads, the load keeps the true branch of if(flag) as a control and can execute independently of the test if (flags[i]).
ILW=H(crash) L(never seen) M(disable unsafe intrinsics)=P3
- backported by
-
JDK-8085808 Unsafe load can loose control dependency and cause crash
-
- Resolved
-
-
-
- Resolved
-
-
-
- Resolved
-
-
-
- Resolved
-
-
-
- Resolved
-