RFR: 8257624: C2: PhaseMacroExpand::eliminate_macro_nodes() crashes on out-of-bounds access into macro node array

Vladimir Ivanov vlivanov at openjdk.java.net
Fri Dec 4 09:39:56 UTC 2020


On Wed, 2 Dec 2020 22:52:24 GMT, Vladimir Kozlov <kvn at openjdk.org> wrote:

>> Elimination of a single macro node may trigger removal of some other macro nodes (e.g., see `PhaseMacroExpand::process_users_of_allocation()`  which can eliminate `AllocateCopy` if it is a user of `Allocate` node being scalar replaced). But `PhaseMacroExpand::eliminate_macro_nodes()` doesn't take it into account: it iterates over the array backwards one by one and if it is unfortunate to eliminate multiple elements when it is at the very end of the array, it crashes on an out-of-bounds access.
>> 
>> The fix is to adjust current position on every iteration. If there are multiple elements removed, current position can point at an element which is already processed, but that's benign.
>> 
>> Testing:
>> - [x] failing tests
>> - [x] hs-tier-1-6 w/ -XX:+AlwaysIncrementalInline
>
> Marked as reviewed by kvn (Reviewer).

Thanks for the reviews, Nils and Vladimir.

-------------

PR: https://git.openjdk.java.net/jdk/pull/1572


More information about the hotspot-compiler-dev mailing list