RFR(XS) 8132904: Type checking verifier fails to reject assignment from array to an interface

[harold seigel]

Hi Jiangli,

Thanks for looking at the change.

The case where 'this' is Object gets handled by this code:

    bool VerificationType::is_reference_assignable_from(
         const VerificationType& from, ClassVerifier* context,
         bool from_field_is_protected, TRAPS) const {
       instanceKlassHandle klass = context->current_class();
                 ...
       } else if (is_object()) {
         // We need check the class hierarchy to check assignability
         if (name() == vmSymbols::java_lang_Object()) {
           // any object or array is assignable to java.lang.Object
           return true;
         }
             ...

Thanks, Harold

On 9/17/2015 2:32 PM, Jiangli Zhou wrote:
> Hi Harold,
>
> I have a question rather than comment. What about the case of 'this_class == SystemDictionary::SystemDictionary::Object_klass()’? Array is a subtype of Object as well.
>
> Thanks,
> Jiangli
>
>> On Sep 17, 2015, at 11:03 AM, harold seigel <harold.seigel at oracle.com> wrote:
>>
>> Hi,
>>
>> Please review this small change to fix bug 8132904.  The new verifier implementation in HotSpot should not allow an arbitrary array type to be assignable to an arbitrary interface type.  The special cases of Cloneable, and Serializable are clearly called out in the spec.  This fix disallows assignability of an array to interface type unless it's one of the Cloneable or Serializable special cases.
>>
>> Open webrev: http://cr.openjdk.java.net/~hseigel/bug_8132904/
>>
>> JBS Bug: https://bugs.openjdk.java.net/browse/JDK-8132904
>>
>> The fix was tested with JCK Lang, VM, and API java_lang tests, the UTE quick and split verifier tests, and the hotspot, JDK vm, java/io, java/lang, and java/util JTreg tests, the JCK tests that are currently excluded because of this bug, and the test case in the bug report.
>>
>> This scenario will be tested by JCK-9.  So there's no regression test in this webrev.
>>
>> Thanks, Harold