[OpenJDK 2D-Dev] RFR 8144828: Marlin renderer causes unaligned write accesses

[Laurent Bourgès]

Jim,

You are theoretical right !
However it needs a 2Gb row = px_bbox1 - px0 ! That's only possible if you
allocate an image with a single row (MAX_INT) and the shape covers that
full range !

Do you really want me to fix that impossible case ? using 3L (and -4L).

Laurent

Le 7 déc. 2015 22:15, "Jim Graham" <james.graham at oracle.com> a écrit :
>
> pos and needSize are longs.  px_bbox1 and px0 are positive ints with
px_bbox1 known to be greater than px0 so the subtraction should not be able
to overflow an int.  But, now that we are adding 3, is it possible for that
calculation to overflow?  Would it be better to protect against that by
using 3L (and -4L) even though these are theoretical issues? (The result of
that calculation gets cast to long before adding it to pos anyway.)
>
>                         ...jim
>
>
> On 12/7/15 8:34 AM, Laurent Bourgès wrote:
>>
>> Hi,
>>
>> Please review the following (critical) bug fix that ensures (4 bytes)
>> aligned memory accesses (Unsafe) in MarlinCache:
>>
>> bug: https://bugs.openjdk.java.net/browse/JDK-8144828
>> webrev: http://cr.openjdk.java.net/~lbourges/marlin/marlin-8144828.0/
>>
>> Changes:
>> - added MarlinConst.doCheckUnsafe (false by default) to manually check
>> addresses
>> - MarlinCache: align needed bytes in copyAARowNoRLE() as the same
>> off-heap block is also used by copyAARowRLE_WithBlockFlags() which store
>> RLE entries as integer:
>>
>> + // determine need array size:
>> + // for RLE encoding, position must be aligned to 4 bytes (int):
>> + // align - 1 = 3 so add +3 and round-off by mask ~3 = -4
>> + final long needSize = pos + ((px_bbox1 - px0 + 3) & -4);
>>
>> I did not tested on the sparc platform as I do not have one !
>> But it tested the patch on my linux 64 (intel).
>>
>> Best regards,
>> Laurent
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.openjdk.java.net/pipermail/2d-dev/attachments/20151207/013e6d41/attachment.html>