Thu, 05 Feb 2009 14:43:58 -0800
6799693: Server compiler leads to data corruption when expression throws an Exception
Summary: Use merged memory state for an allocation's slow path.
Reviewed-by: never
1.1 --- a/src/share/vm/opto/graphKit.cpp Thu Feb 05 13:38:52 2009 -0800 1.2 +++ b/src/share/vm/opto/graphKit.cpp Thu Feb 05 14:43:58 2009 -0800 1.3 @@ -2942,16 +2942,10 @@ 1.4 1.5 // Now generate allocation code 1.6 1.7 - // With escape analysis, the entire memory state is needed to be able to 1.8 - // eliminate the allocation. If the allocations cannot be eliminated, this 1.9 - // will be optimized to the raw slice when the allocation is expanded. 1.10 - Node *mem; 1.11 - if (C->do_escape_analysis()) { 1.12 - mem = reset_memory(); 1.13 - set_all_memory(mem); 1.14 - } else { 1.15 - mem = memory(Compile::AliasIdxRaw); 1.16 - } 1.17 + // The entire memory state is needed for slow path of the allocation 1.18 + // since GC and deoptimization can happened. 1.19 + Node *mem = reset_memory(); 1.20 + set_all_memory(mem); // Create new memory state 1.21 1.22 AllocateNode* alloc 1.23 = new (C, AllocateNode::ParmLimit) 1.24 @@ -3088,16 +3082,10 @@ 1.25 1.26 // Now generate allocation code 1.27 1.28 - // With escape analysis, the entire memory state is needed to be able to 1.29 - // eliminate the allocation. If the allocations cannot be eliminated, this 1.30 - // will be optimized to the raw slice when the allocation is expanded. 1.31 - Node *mem; 1.32 - if (C->do_escape_analysis()) { 1.33 - mem = reset_memory(); 1.34 - set_all_memory(mem); 1.35 - } else { 1.36 - mem = memory(Compile::AliasIdxRaw); 1.37 - } 1.38 + // The entire memory state is needed for slow path of the allocation 1.39 + // since GC and deoptimization can happened. 1.40 + Node *mem = reset_memory(); 1.41 + set_all_memory(mem); // Create new memory state 1.42 1.43 // Create the AllocateArrayNode and its result projections 1.44 AllocateArrayNode* alloc
2.1 --- a/src/share/vm/opto/macro.cpp Thu Feb 05 13:38:52 2009 -0800 2.2 +++ b/src/share/vm/opto/macro.cpp Thu Feb 05 14:43:58 2009 -0800 2.3 @@ -952,13 +952,6 @@ 2.4 Node* klass_node = alloc->in(AllocateNode::KlassNode); 2.5 Node* initial_slow_test = alloc->in(AllocateNode::InitialTest); 2.6 2.7 - // With escape analysis, the entire memory state was needed to be able to 2.8 - // eliminate the allocation. Since the allocations cannot be eliminated, 2.9 - // optimize it to the raw slice. 2.10 - if (mem->is_MergeMem()) { 2.11 - mem = mem->as_MergeMem()->memory_at(Compile::AliasIdxRaw); 2.12 - } 2.13 - 2.14 assert(ctrl != NULL, "must have control"); 2.15 // We need a Region and corresponding Phi's to merge the slow-path and fast-path results. 2.16 // they will not be used if "always_slow" is set 2.17 @@ -1016,6 +1009,11 @@ 2.18 Node *slow_mem = mem; // save the current memory state for slow path 2.19 // generate the fast allocation code unless we know that the initial test will always go slow 2.20 if (!always_slow) { 2.21 + // Fast path modifies only raw memory. 2.22 + if (mem->is_MergeMem()) { 2.23 + mem = mem->as_MergeMem()->memory_at(Compile::AliasIdxRaw); 2.24 + } 2.25 + 2.26 Node* eden_top_adr; 2.27 Node* eden_end_adr; 2.28 2.29 @@ -1239,8 +1237,6 @@ 2.30 } 2.31 } 2.32 2.33 - mem = result_phi_rawmem; 2.34 - 2.35 // An allocate node has separate i_o projections for the uses on the control and i_o paths 2.36 // Replace uses of the control i_o projection with result_phi_i_o (unless we are only generating a slow call) 2.37 if (_ioproj_fallthrough == NULL) {
3.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 3.2 +++ b/test/compiler/6795161/Test.java Thu Feb 05 14:43:58 2009 -0800 3.3 @@ -0,0 +1,60 @@ 3.4 +/* 3.5 + * Copyright 2009 Sun Microsystems, Inc. All Rights Reserved. 3.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 3.7 + * 3.8 + * This code is free software; you can redistribute it and/or modify it 3.9 + * under the terms of the GNU General Public License version 2 only, as 3.10 + * published by the Free Software Foundation. 3.11 + * 3.12 + * This code is distributed in the hope that it will be useful, but WITHOUT 3.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 3.14 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 3.15 + * version 2 for more details (a copy is included in the LICENSE file that 3.16 + * accompanied this code). 3.17 + * 3.18 + * You should have received a copy of the GNU General Public License version 3.19 + * 2 along with this work; if not, write to the Free Software Foundation, 3.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 3.21 + * 3.22 + * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, 3.23 + * CA 95054 USA or visit www.sun.com if you need additional information or 3.24 + * have any questions. 3.25 + * 3.26 + */ 3.27 + 3.28 +/* 3.29 + * @test 3.30 + * @bug 6795161 3.31 + * @summary Escape analysis leads to data corruption 3.32 + * @run main/othervm -server -Xcomp -XX:CompileOnly=Test -XX:+DoEscapeAnalysis Test 3.33 + */ 3.34 + 3.35 +class Test_Class_1 { 3.36 + static String var_1; 3.37 + 3.38 + static void badFunc(int size) 3.39 + { 3.40 + try { 3.41 + for (int i = 0; i < 1; (new byte[size-i])[0] = 0, i++) {} 3.42 + } catch (Exception e) { 3.43 + // don't comment it out, it will lead to correct results ;) 3.44 + //System.out.println("Got exception: " + e); 3.45 + } 3.46 + } 3.47 +} 3.48 + 3.49 +public class Test { 3.50 + static String var_1_copy = Test_Class_1.var_1; 3.51 + 3.52 + static byte var_check; 3.53 + 3.54 + public static void main(String[] args) 3.55 + { 3.56 + var_check = 1; 3.57 + 3.58 + Test_Class_1.badFunc(-1); 3.59 + 3.60 + System.out.println("EATester.var_check = " + Test.var_check + " (expected 1)\n"); 3.61 + } 3.62 +} 3.63 +
4.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000 4.2 +++ b/test/compiler/6799693/Test.java Thu Feb 05 14:43:58 2009 -0800 4.3 @@ -0,0 +1,47 @@ 4.4 +/* 4.5 + * Copyright 2009 Sun Microsystems, Inc. All Rights Reserved. 4.6 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4.7 + * 4.8 + * This code is free software; you can redistribute it and/or modify it 4.9 + * under the terms of the GNU General Public License version 2 only, as 4.10 + * published by the Free Software Foundation. 4.11 + * 4.12 + * This code is distributed in the hope that it will be useful, but WITHOUT 4.13 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 4.14 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 4.15 + * version 2 for more details (a copy is included in the LICENSE file that 4.16 + * accompanied this code). 4.17 + * 4.18 + * You should have received a copy of the GNU General Public License version 4.19 + * 2 along with this work; if not, write to the Free Software Foundation, 4.20 + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. 4.21 + * 4.22 + * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, 4.23 + * CA 95054 USA or visit www.sun.com if you need additional information or 4.24 + * have any questions. 4.25 + * 4.26 + */ 4.27 + 4.28 +/* 4.29 + * @test 4.30 + * @bug 6799693 4.31 + * @summary Server compiler leads to data corruption when expression throws an Exception 4.32 + * @run main/othervm -Xcomp -XX:CompileOnly=Test Test 4.33 + */ 4.34 + 4.35 +public class Test { 4.36 + static int var_bad = 1; 4.37 + 4.38 + public static void main(String[] args) 4.39 + { 4.40 + var_bad++; 4.41 + 4.42 + try { 4.43 + for (int i = 0; i < 10; i++) (new byte[((byte)-1 << i)])[0] = 0; 4.44 + } 4.45 + catch (Exception e) { System.out.println("Got " + e); } 4.46 + 4.47 + System.out.println("Test.var_bad = " + var_bad + " (expected 2)\n"); 4.48 + } 4.49 +} 4.50 +