1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
/*
* Copyright (c) 2024, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
/**
* @test
* @bug 8320308
* @summary Unsafe::getShortUnaligned with base null hidden behind CheckCastPP nodes
* @library /test/lib
* @modules java.base/jdk.internal.misc
* @run main/othervm -Xbatch -XX:CompileCommand=quiet -XX:TypeProfileLevel=222
* -XX:+IgnoreUnrecognizedVMOptions -XX:+AlwaysIncrementalInline
* -XX:CompileCommand=compileonly,compiler.parsing.TestUnsafeArrayAccessWithNullBase::test*
* -XX:-TieredCompilation compiler.parsing.TestUnsafeArrayAccessWithNullBase
* @run main compiler.parsing.TestUnsafeArrayAccessWithNullBase
*/
package compiler.parsing;
import java.lang.reflect.*;
import jdk.internal.misc.Unsafe;
public class TestUnsafeArrayAccessWithNullBase {
/*
Trigger bug when handling Unsafe.getShortUnaligned with null checks and inlined methods.
The bug appears when the method is incrementally inlined and optimized based on the argument profile information.
Warmup Phase: By warming up with non-null values, the argument profile for the helper methods records non-null types.
- insert CheckCastPP: speculative=byte[int:>=0] for return of getSmall/getLarge
- insert CheckCastPP: speculative=byte[int:>=0] for argument `Object array` in helperSmall/helperLarge
Trigger Phase: Calling test causes LibraryCallKit::inline_unsafe_access(..) for Unsafe::getShortUnaligned to fail:
Reason: UNSAFE.getShortUnaligned(array, offset) is called with array=null,
but ConP null is now hidden by two CheckCastPP with speculative=byte[int:>=0] in the graph
*/
private static final Unsafe UNSAFE = Unsafe.getUnsafe();
private static final Object byteArray = new byte[1_050_000];
public static Object getLarge(boolean useNull) {
return useNull ? null : byteArray;
}
public static Object getSmall(boolean useNull) {
return useNull ? null : new byte[10];
}
// use a helper to delay inlining of UNSAFE.getShortUnaligned
public static int helperLarge(Object array, boolean run) {
// offset >= os::vm_page_size(): LibraryCallKit::classify_unsafe_addr returns Type::AnyPtr
return run ? UNSAFE.getShortUnaligned(array, 1_049_000) : 0; // after warmup CheckCastPP: speculative=byte[int:>=0]
}
public static int accessLargeArray(boolean useNull, boolean run) {
Object array = getLarge(useNull); // after warmup CheckCastPP: speculative=byte[int:>=0]
// getLarge() ensures null is only visible after helperLarge was (incrementally) inlined
return helperLarge(array, run);
}
// use a helper to delay inlining of UNSAFE.getShortUnaligned
// warmup adds argument profile information for array: CheckCastPP with type non null
public static int helperSmall(Object array, boolean run) {
// 0 <= offset < os::vm_page_size(): LibraryCallKit::classify_unsafe_addr returns Type::OopPtr
return run ? UNSAFE.getShortUnaligned(array, 1) : 0; // after warmup CheckCastPP: speculative=byte[int:>=0]
}
public static int accessSmallArray(boolean useNull, boolean run) {
Object array = getSmall(useNull); // after warmup CheckCastPP: speculative=byte[int:>=0]
return helperSmall(array, run);
}
public static int test1(boolean run) {
return accessLargeArray(true, run);
}
public static int test2(boolean run) {
return accessSmallArray(true, run);
}
public static void main(String[] args) {
// Warmup to collect speculative types
for (int i = 0; i < 10_000; i++) {
accessLargeArray(false, true);
accessSmallArray(false, true);
}
// Trigger Compilation
for (int i = 0; i < 10_000; ++i) {
test1(false);
test2(false);
}
}
}
|
