Integrated: 8257624: C2: PhaseMacroExpand::eliminate_macro_nodes() crashes on out-of-bounds access into macro node array

[Vladimir Ivanov]

On Wed, 2 Dec 2020 19:13:31 GMT, Vladimir Ivanov <vlivanov at openjdk.org> wrote:

> Elimination of a single macro node may trigger removal of some other macro nodes (e.g., see `PhaseMacroExpand::process_users_of_allocation()`  which can eliminate `AllocateCopy` if it is a user of `Allocate` node being scalar replaced). But `PhaseMacroExpand::eliminate_macro_nodes()` doesn't take it into account: it iterates over the array backwards one by one and if it is unfortunate to eliminate multiple elements when it is at the very end of the array, it crashes on an out-of-bounds access.
> 
> The fix is to adjust current position on every iteration. If there are multiple elements removed, current position can point at an element which is already processed, but that's benign.
> 
> Testing:
> - [x] failing tests
> - [x] hs-tier-1-6 w/ -XX:+AlwaysIncrementalInline

This pull request has now been integrated.

Changeset: fbdc1877
Author:    Vladimir Ivanov <vlivanov at openjdk.org>
URL:       https://git.openjdk.java.net/jdk/commit/fbdc1877
Stats:     8 lines in 1 file changed: 6 ins; 0 del; 2 mod

8257624: C2: PhaseMacroExpand::eliminate_macro_nodes() crashes on out-of-bounds access into macro node array

Reviewed-by: neliasso, kvn

-------------

PR: https://git.openjdk.java.net/jdk/pull/1572