-
Bug
-
Resolution: Fixed
-
P3
-
17, 21, 23, 24, 25
-
b18
This is motivated by JDK-8275202. The pass that it adds can eliminate the range check in:
int[] array = new int[arraySize];
if (j <= arraySize) {
if (i >= 0) {
if (i < j) {
int v = array[i];
If during some subsequent IGVN, i constant folds to some value that's positive but out of bounds, the array access won't be reachable anymore but IGVN can't constant fold the condition that leads to the array access. Because the range check was eliminated however, the range check CastII becomes dead which can lead to a broken graph.
What this proposes is that when the CastII becomes dead, C2 makes the paths that use the dead node dead as well.
int[] array = new int[arraySize];
if (j <= arraySize) {
if (i >= 0) {
if (i < j) {
int v = array[i];
If during some subsequent IGVN, i constant folds to some value that's positive but out of bounds, the array access won't be reachable anymore but IGVN can't constant fold the condition that leads to the array access. Because the range check was eliminated however, the range check CastII becomes dead which can lead to a broken graph.
What this proposes is that when the CastII becomes dead, C2 makes the paths that use the dead node dead as well.
- causes
-
JDK-8355230 Crash in fuzzer tests: assert(n != nullptr) failed: must not be null
-
- Open
-
- relates to
-
JDK-8355635 Do not collect C strings in C2 scratch buffer
-
- Resolved
-
- links to
-
Commit(master) openjdk/jdk/bcac42aa
-
Review(master) openjdk/jdk/23468