RFR: 8373021: aarch64: MacroAssembler::arrays_equals reads out of bounds
Cesar Soares Lucas
cslucas at openjdk.org
Fri Jan 23 17:58:57 UTC 2026
On Fri, 23 Jan 2026 14:31:36 GMT, Roman Kennke <rkennke at openjdk.org> wrote:
>> Please review this PR to add back array-length comparison to AArch64 array-equals intrinsic.
>>
>> [JDK-8331098](https://bugs.openjdk.org/browse/JDK-8331098) removed the direct comparison of both arrays' length but doing so will cause the code to index out of bounds of the array payload. The root cause of the problem is: 1) the main comparison loops only compare the array lengths (indirectly) after reading at least 16 bytes from _both_ arrays; 2) only the length of the first array, `a1`, is checked before the main comparison loop. Consequently, we code may read past the end of the array payload if the second array is shorter than 16 bytes. The result of indexing out of the array bounds is dependent on where the array is allocated and what comes after it: the VM may crash because of segment violation if the object is at the end of the heap (or Eden?) and there is no padding after the object or it can cause the array comparison to be incorrect.
>>
>> Testing:
>>
>> - [x] tier1 (+CCP)
>> - [x] tier1 (-CCP)
>> - [x] tier2 (+CCP)
>> - [x] tier2 (-CCP)
>
> Looks good, thank you!
Thank you for reviewing @rkennke @theRealAph
-------------
PR Comment: https://git.openjdk.org/jdk/pull/29372#issuecomment-3791519719
More information about the hotspot-dev
mailing list