stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

7174363: Arrays.copyOfRange leads to VM crash with -Xcomp -server if executed by testing framework

Browse Source 
Arrays.copyOfRange(original, from, to) with from > original.length tries to do a copy with a negative length.

Reviewed-by: kvn, twisti
This commit is contained in:
Roland Westrelin 2012-06-18 09:52:31 +02:00
parent d1191bb4f4
commit 118f552a6e
2 changed files with 56 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
hotspot/src/share/vm/opto/library_call.cpp
View File

@ -3592,8 +3592,10 @@ bool LibraryCallKit::inline_array_copyOf(bool is_copyOfRange) {
}
// Bail out if length is negative.
// ...Not needed, since the new_array will throw the right exception.
//generate_negative_guard(length, bailout, &length);
// Without this the new_array would throw
// NegativeArraySizeException but IllegalArgumentException is what
// should be thrown
generate_negative_guard(length, bailout, &length);
if (bailout->req() > 1) {
PreserveJVMState pjvms(this);
@ -3617,7 +3619,9 @@ bool LibraryCallKit::inline_array_copyOf(bool is_copyOfRange) {
// Extreme case: Arrays.copyOf((Integer[])x, 10, String[].class).
// This will fail a store-check if x contains any non-nulls.
bool disjoint_bases = true;
bool length_never_negative = true;
// if start > orig_length then the length of the copy may be
// negative.
bool length_never_negative = !is_copyOfRange;
generate_arraycopy(TypeAryPtr::OOPS, T_OBJECT,
original, start, newcopy, intcon(0), moved,
disjoint_bases, length_never_negative);

49
hotspot/test/compiler/7174363/Test7174363.java Normal file
View File

@ -0,0 +1,49 @@
/*
* Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*
*/
/**
* @test
* @bug 7174363
* @summary crash with Arrays.copyOfRange(original, from, to) when from > original.length
*
* @run main/othervm -XX:-BackgroundCompilation Test7174363
*/
import java.util.*;
public class Test7174363 {
static Object[] m(Object[] original, int from, int to) {
return Arrays.copyOfRange(original, from, to, Object[].class);
}
static public void main(String[] args) {
Object[] orig = new Object[10];
for (int i = 0; i < 20000; i++) {
try {
m(orig, 15, 20);
} catch(ArrayIndexOutOfBoundsException excp) {}
}
}
}