RFR: 8366062: [ubsan] add non-zero offset to nullptr in cds/archiveBuilder.cpp [v6]

[Afshin Zafari]

On Tue, 21 Oct 2025 13:38:05 GMT, Afshin Zafari <azafari at openjdk.org> wrote:

>> src/hotspot/share/cds/archiveBuilder.cpp line 1047:
>> 
>>> 1045: address ArchiveBuilder::offset_to_buffered_address(u4 offset) const {
>>> 1046:   // As zero is allowed for _requested_static_archive_bottom, use integer arithmetic to avoid UB pointer arithmetic.
>>> 1047:   address requested_addr = (address)((uintptr_t)_requested_static_archive_bottom + offset);
>> 
>> We should avoid this problem altogether with this:
>> 
>> 
>> - address requested_addr = _requested_static_archive_bottom + offset;
>> - address buffered_addr = requested_addr - _buffer_to_requested_delta;
>> - address buffered_addr = _buffer_bottom + offset;
>
> The error for this is: 
> 
> ----------System.err:(41/4910)----------
> TEST FAILED: Error processing option SharedBaseAddress with valid value '-server -XX:+UseG1GC -XX:+UnlockDiagnosticVMOptions -XX:SharedArchiveFile=TestOptionsWithRanges.jsa -Xshare:dump -XX:SharedBaseAddress=0'! JVM exited with unexpected error code = 134 [0x86]
> stdout content[]
> stderr content[/Users/afshin/scratch/8366062_ubsan_nullptr_plus_nz_offset/src/hotspot/share/cds/archiveBuilder.cpp:1036:61: runtime error: applying non-zero offset 3723624 to null pointer
>     #0 0x10930c0a4 in ArchiveBuilder::offset_to_buffered_address(unsigned int) const archiveBuilder.cpp:1036
>     #1 0x1095ce694 in RunTimeClassInfo::enum_klass_static_fields_addr() const runTimeClassInfo.hpp:163
>     #2 0x10a9337b4 in RunTimeClassInfo::init(DumpTimeClassInfo&) runTimeClassInfo.cpp:75
>     #3 0x10ab2af34 in CopySharedClassInfoToArchive::do_entry(InstanceKlass*, DumpTimeClassInfo&) systemDictionaryShared.cpp:1296
>     #4 0x10ab2abb4 in void DumpTimeSharedClassTable::iterate_all_live_classes<void DumpTimeSharedClassTable::iterate_all_live_classes<CopySharedClassInfoToArchive>(CopySharedClassInfoToArchive*) const::'lambda'(InstanceKlass*, DumpTimeClassInfo&)>(CopySharedClassInfoToArchive) const::'lambda'(InstanceKlass*, DumpTimeClassInfo&)::operator()(InstanceKlass*, DumpTimeClassInfo&) const dumpTimeClassInfo.inline.hpp:51
>     #5 0x10ab2a9f4 in void HashTableBase<FixedHashTableStorage<15889u, InstanceKlass*, DumpTimeClassInfo>, InstanceKlass*, DumpTimeClassInfo, (AnyObj::allocation_type)2, (MemTag)13, &unsigned int DumpTimeSharedClassTable_hash<InstanceKlass>(InstanceKlass* const&), &bool primitive_equals<InstanceKlass*>(InstanceKlass const&, InstanceKlass const&)>::iterate<void HashTableBase<FixedHashTableStorage<15889u, InstanceKlass*, DumpTimeClassInfo>, InstanceKlass*, DumpTimeClassInfo, (AnyObj::allocation_type)2, (MemTag)13, &unsigned int DumpTimeSharedClassTable_hash<InstanceKlass>(InstanceKlass* const&), &bool primitive_equals<InstanceKlass*>(InstanceKlass const&, InstanceKlass const&)>::iterate_all<void DumpTimeSharedClassTable::iterate_all_live_classes<void DumpTimeSharedClassTable::iterate_all_live_classes<CopySharedClassInfoToArchive>(InstanceKlass*) const::'lambda'(InstanceKlass*, DumpTimeClassInfo&)>(InstanceKlass) const::'lambda'(InstanceKlass*, DumpTimeClassInfo&)>(InstanceKlass) cons
 t::'lambda'(InstanceKlass*&, DumpTimeClassInfo&)>(InstanceKlass) const hashTable.hpp:273
>     #6 0x10ab2a914 in void DumpTime...

You may already noticed that the root of all these UB complains is the option `-XX:SharedBaseAddress` as zero which is a corner case.

-------------

PR Review Comment: https://git.openjdk.org/jdk/pull/26983#discussion_r2448357081