Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8289148

j.l.foreign.VaList::nextVarg call could throw IndexOutOfBoundsException or even crash the VM

    XMLWordPrintable

Details

    • Bug
    • Resolution: Fixed
    • P3
    • 19
    • 19
    • core-libs

    Backports

      Description

        The following code or similar

                VaList vaList = VaList.make(builder -> builder.addVarg(ValueLayout.JAVA_LONG, 1L), MemorySession.openConfined());
                for (int i = 0; i < 10000; i ++) {
                    System.out.println("nextVarg number " + i);
                    vaList.nextVarg(ValueLayout.JAVA_LONG);
                }

        leads to

        nextVarg number 0
        nextVarg number 1
        nextVarg number 2
        nextVarg number 3
        nextVarg number 4
        Exception in thread "main" java.lang.IndexOutOfBoundsException: Index 0 out of bounds for length -7
        at java.base/jdk.internal.util.Preconditions.outOfBounds(Preconditions.java:100)
        at java.base/jdk.internal.util.Preconditions.outOfBoundsCheckIndex(Preconditions.java:124)
        at java.base/jdk.internal.util.Preconditions.checkIndex(Preconditions.java:448)
        at java.base/java.util.Objects.checkIndex(Objects.java:461)
        at java.base/jdk.internal.foreign.AbstractMemorySegmentImpl.checkBounds(AbstractMemorySegmentImpl.java:397)
        at java.base/jdk.internal.foreign.AbstractMemorySegmentImpl.checkAccess(AbstractMemorySegmentImpl.java:355)
        at java.base/java.lang.invoke.VarHandleSegmentAsLongs.checkAddress(VarHandleSegmentAsLongs.java:81)
        at java.base/java.lang.invoke.VarHandleSegmentAsLongs.get(VarHandleSegmentAsLongs.java:108)
        at java.base/jdk.internal.foreign.abi.aarch64.macos.MacOsAArch64VaList.read(MacOsAArch64VaList.java:121)
        at java.base/jdk.internal.foreign.abi.aarch64.macos.MacOsAArch64VaList.read(MacOsAArch64VaList.java:94)
        at java.base/jdk.internal.foreign.abi.aarch64.macos.MacOsAArch64VaList.nextVarg(MacOsAArch64VaList.java:74)

        On MacOS AArch64 or even to

        openjdk 19-ea 2022-09-20
        OpenJDK Runtime Environment (build 19-ea+28-2110)
        OpenJDK 64-Bit Server VM (build 19-ea+28-2110, mixed mode, sharing)
        nextVarg number 0
        nextVarg number 1
        nextVarg number 2
        nextVarg number 3
        nextVarg number 4
        nextVarg number 5
        nextVarg number 6
        #
        # A fatal error has been detected by the Java Runtime Environment:
        #
        # SIGSEGV (0xb) at pc=0x00007f7ac193094b, pid=2247746, tid=2247750
        #
        # JRE version: OpenJDK Runtime Environment (19.0+28) (build 19-ea+28-2110)
        # Java VM: OpenJDK 64-Bit Server VM (19-ea+28-2110, mixed mode, sharing, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
        # Problematic frame:
        # V [libjvm.so+0xe6e94b] Unsafe_GetLong+0x8b
        #
        # Core dump will be written. Default location: Core dumps may be processed with "/usr/lib/systemd/systemd-coredump %P %u %g %s %t %c %h %e" (or dumping to ..... core.2247746)
        #
        # An error report file with more information is saved as:
        # ..... hs_err_pid2247746.log
        #
        # If you would like to submit a bug report, please visit:
        # https://bugreport.java.com/bugreport/crash.jsp
        #

        On Linux X64

        It looks like at least the specification for
        https://download.java.net/java/early_access/jdk19/docs/api/java.base/java/lang/foreign/VaList.html
        or the #nextVarg methods deserves improvement and clarification - for example mention possibility of IndexOutOfBoundsException


        Attachments

          Issue Links

            Activity

              People

                jvernee Jorn Vernee
                dbessono Dmitry Bessonov
                Votes:
                0 Vote for this issue
                Watchers:
                5 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved: