src/share/vm/opto/macroArrayCopy.cpp
Index Unified diffs Context diffs Sdiffs Patch New Old Previous File Next File hotspot Sdiff src/share/vm/opto

src/share/vm/opto/macroArrayCopy.cpp

Print this page
rev 6950 : 8055910: closed/java/util/Collections/CheckedCollections.java failed with ClassCastException not thrown
Summary: missing subtype check for Arrays.copyOf intrinsic
Reviewed-by:


 489         mem->set_memory_at(alias_idx, done_mem);
 490       }
 491     }
 492   }
 493 
 494   BasicType copy_type = basic_elem_type;
 495   assert(basic_elem_type != T_ARRAY, "caller must fix this");
 496   if (!(*ctrl)->is_top() && copy_type == T_OBJECT) {
 497     // If src and dest have compatible element types, we can copy bits.
 498     // Types S[] and D[] are compatible if D is a supertype of S.
 499     //
 500     // If they are not, we will use checked_oop_disjoint_arraycopy,
 501     // which performs a fast optimistic per-oop check, and backs off
 502     // further to JVM_ArrayCopy on the first per-oop check that fails.
 503     // (Actually, we don't move raw bits only; the GC requires card marks.)
 504 
 505     // Get the klass* for both src and dest
 506     Node* src_klass  = ac->in(ArrayCopyNode::SrcKlass);
 507     Node* dest_klass = ac->in(ArrayCopyNode::DestKlass);
 508 


 509     // Generate the subtype check.
 510     // This might fold up statically, or then again it might not.
 511     //
 512     // Non-static example:  Copying List<String>.elements to a new String[].
 513     // The backing store for a List<String> is always an Object[],
 514     // but its elements are always type String, if the generic types
 515     // are correct at the source level.
 516     //
 517     // Test S[] against D[], not S against D, because (probably)
 518     // the secondary supertype cache is less busy for S[] than S.
 519     // This usually only matters when D is an interface.
 520     Node* not_subtype_ctrl = ac->is_arraycopy_notest() ? top() : Phase::gen_subtype_check(src_klass, dest_klass, ctrl, mem, &_igvn);
 521     // Plug failing path into checked_oop_disjoint_arraycopy
 522     if (not_subtype_ctrl != top()) {
 523       Node* local_ctrl = not_subtype_ctrl;
 524       MergeMemNode* local_mem = MergeMemNode::make(mem);
 525       transform_later(local_mem);
 526 
 527       // (At this point we can assume disjoint_bases, since types differ.)
 528       int ek_offset = in_bytes(ObjArrayKlass::element_klass_offset());


1192   if (!ac->is_arraycopy_notest()) {
1193     // (3) operands must not be null
1194     // We currently perform our null checks with the null_check routine.
1195     // This means that the null exceptions will be reported in the caller
1196     // rather than (correctly) reported inside of the native arraycopy call.
1197     // This should be corrected, given time.  We do our null check with the
1198     // stack pointer restored.
1199     // null checks done library_call.cpp
1200 
1201     // (4) src_offset must not be negative.
1202     generate_negative_guard(&ctrl, src_offset, slow_region);
1203 
1204     // (5) dest_offset must not be negative.
1205     generate_negative_guard(&ctrl, dest_offset, slow_region);
1206 
1207     // (6) length must not be negative (moved to generate_arraycopy()).
1208     // generate_negative_guard(length, slow_region);
1209 
1210     // (7) src_offset + length must not exceed length of src.
1211     Node* alen = ac->in(ArrayCopyNode::SrcLen);

1212     generate_limit_guard(&ctrl,
1213                          src_offset, length,
1214                          alen,
1215                          slow_region);
1216 
1217     // (8) dest_offset + length must not exceed length of dest.
1218     alen = ac->in(ArrayCopyNode::DestLen);

1219     generate_limit_guard(&ctrl,
1220                          dest_offset, length,
1221                          alen,
1222                          slow_region);
1223 
1224     // (9) each element of an oop array must be assignable
1225     // The generate_arraycopy subroutine checks this.
1226   }
1227   // This is where the memory effects are placed:
1228   const TypePtr* adr_type = TypeAryPtr::get_array_body_type(dest_elem);
1229   generate_arraycopy(ac, alloc, &ctrl, merge_mem, &io,
1230                      adr_type, dest_elem,
1231                      src, src_offset, dest, dest_offset, length,
1232                      false, false, slow_region);
1233 }


 489         mem->set_memory_at(alias_idx, done_mem);
 490       }
 491     }
 492   }
 493 
 494   BasicType copy_type = basic_elem_type;
 495   assert(basic_elem_type != T_ARRAY, "caller must fix this");
 496   if (!(*ctrl)->is_top() && copy_type == T_OBJECT) {
 497     // If src and dest have compatible element types, we can copy bits.
 498     // Types S[] and D[] are compatible if D is a supertype of S.
 499     //
 500     // If they are not, we will use checked_oop_disjoint_arraycopy,
 501     // which performs a fast optimistic per-oop check, and backs off
 502     // further to JVM_ArrayCopy on the first per-oop check that fails.
 503     // (Actually, we don't move raw bits only; the GC requires card marks.)
 504 
 505     // Get the klass* for both src and dest
 506     Node* src_klass  = ac->in(ArrayCopyNode::SrcKlass);
 507     Node* dest_klass = ac->in(ArrayCopyNode::DestKlass);
 508 
 509     assert(src_klass != NULL && dest_klass != NULL, "should have klasses");
 510 
 511     // Generate the subtype check.
 512     // This might fold up statically, or then again it might not.
 513     //
 514     // Non-static example:  Copying List<String>.elements to a new String[].
 515     // The backing store for a List<String> is always an Object[],
 516     // but its elements are always type String, if the generic types
 517     // are correct at the source level.
 518     //
 519     // Test S[] against D[], not S against D, because (probably)
 520     // the secondary supertype cache is less busy for S[] than S.
 521     // This usually only matters when D is an interface.
 522     Node* not_subtype_ctrl = ac->is_arraycopy_notest() ? top() : Phase::gen_subtype_check(src_klass, dest_klass, ctrl, mem, &_igvn);
 523     // Plug failing path into checked_oop_disjoint_arraycopy
 524     if (not_subtype_ctrl != top()) {
 525       Node* local_ctrl = not_subtype_ctrl;
 526       MergeMemNode* local_mem = MergeMemNode::make(mem);
 527       transform_later(local_mem);
 528 
 529       // (At this point we can assume disjoint_bases, since types differ.)
 530       int ek_offset = in_bytes(ObjArrayKlass::element_klass_offset());


1194   if (!ac->is_arraycopy_notest()) {
1195     // (3) operands must not be null
1196     // We currently perform our null checks with the null_check routine.
1197     // This means that the null exceptions will be reported in the caller
1198     // rather than (correctly) reported inside of the native arraycopy call.
1199     // This should be corrected, given time.  We do our null check with the
1200     // stack pointer restored.
1201     // null checks done library_call.cpp
1202 
1203     // (4) src_offset must not be negative.
1204     generate_negative_guard(&ctrl, src_offset, slow_region);
1205 
1206     // (5) dest_offset must not be negative.
1207     generate_negative_guard(&ctrl, dest_offset, slow_region);
1208 
1209     // (6) length must not be negative (moved to generate_arraycopy()).
1210     // generate_negative_guard(length, slow_region);
1211 
1212     // (7) src_offset + length must not exceed length of src.
1213     Node* alen = ac->in(ArrayCopyNode::SrcLen);
1214     assert(alen != NULL, "need src len");
1215     generate_limit_guard(&ctrl,
1216                          src_offset, length,
1217                          alen,
1218                          slow_region);
1219 
1220     // (8) dest_offset + length must not exceed length of dest.
1221     alen = ac->in(ArrayCopyNode::DestLen);
1222     assert(alen != NULL, "need dest len");
1223     generate_limit_guard(&ctrl,
1224                          dest_offset, length,
1225                          alen,
1226                          slow_region);
1227 
1228     // (9) each element of an oop array must be assignable
1229     // The generate_arraycopy subroutine checks this.
1230   }
1231   // This is where the memory effects are placed:
1232   const TypePtr* adr_type = TypeAryPtr::get_array_body_type(dest_elem);
1233   generate_arraycopy(ac, alloc, &ctrl, merge_mem, &io,
1234                      adr_type, dest_elem,
1235                      src, src_offset, dest, dest_offset, length,
1236                      false, false, slow_region);
1237 }
src/share/vm/opto/macroArrayCopy.cpp
Index Unified diffs Context diffs Sdiffs Patch New Old Previous File Next File