RFR: 8356184: C2 MemorySegment: long RangeCheck with ConvI2L(iv + invar) prevents RCE
Kerem Kat
krk at openjdk.org
Fri Jan 23 19:31:49 UTC 2026
`MemorySegment` bounds checks use long arithmetic, but when accessing with an int loop variable plus an int invariant offset, the pattern `ConvI2L(iv + invar)` was not recognized by Range Check Elimination. This prevented RCE and consequently blocked vectorization for common `MemorySegment` access patterns.
The fix teaches `is_scaled_iv_plus_offset` to recognize linear int expressions inside `ConvI2L`. A new `short_offset` flag signals that the offset is part of int arithmetic (not added separately in long), requiring the range to be clamped at `max_jint + 1` to correctly handle potential int overflow. This also removes pre-existing dead code where an `exp_bt != bt` check was intended to bail out on such patterns but never actually executed.
With this change, `MemorySegment` loops using int invariant offsets now benefit from RCE and vectorization, matching the behavior already supported for long invariant offsets.
void process(MemorySegment segment, int offset, int size) {
for (int i = 0; i < size; i++) {
long addr = i + offset; // ConvI2L(AddI(iv, offset)) was not recognized
segment.set(JAVA_BYTE, addr, (byte) 0);
}
}
-------------
Commit messages:
- 8356184: C2 MemorySegment: long RangeCheck with ConvI2L(iv + invar) prevents RCE
Changes: https://git.openjdk.org/jdk/pull/29392/files
Webrev: https://webrevs.openjdk.org/?repo=jdk&pr=29392&range=00
Issue: https://bugs.openjdk.org/browse/JDK-8356184
Stats: 112 lines in 4 files changed: 82 ins; 5 del; 25 mod
Patch: https://git.openjdk.org/jdk/pull/29392.diff
Fetch: git fetch https://git.openjdk.org/jdk.git pull/29392/head:pull/29392
PR: https://git.openjdk.org/jdk/pull/29392
More information about the hotspot-compiler-dev
mailing list