8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument #12112

TobiHartmann · 2023-01-20T11:57:45Z

The StringUTF16.compress variant of LibraryCallKit::inline_string_copy does not properly handle a constant null src argument that can happen when the char[] data argument of String::copyValueOf is null:

jdk/src/java.base/share/classes/java/lang/String.java

Lines 4284 to 4285 in 7bf0d14

    
           public static String copyValueOf(char[] data, int offset, int count) { 
        
               return new String(data, offset, count);

->

jdk/src/java.base/share/classes/java/lang/String.java

Lines 301 to 302 in 7bf0d14

    
           public String(char[] value, int offset, int count) { 
        
               this(value, offset, count, rangeCheck(value, offset, count));

->

jdk/src/java.base/share/classes/java/lang/String.java

Lines 4504 to 4511 in 7bf0d14

    
           String(char[] value, int off, int len, Void sig) { 
        
               if (len == 0) { 
        
                   this.value = "".value; 
        
                   this.coder = "".coder; 
        
                   return; 
        
               } 
        
               if (COMPACT_STRINGS) { 
        
                   byte[] val = StringUTF16.compress(value, off, len);

Although the intrinsified code is never executed because we throw a NullPointerException from (non-inlined) rangeCheck, we need to make sure a constant null is properly handled.

I manually inspected similar C2 intrinsics and found another potential issue in LibraryCallKit::inline_mulAdd where we should call must_be_not_null on in as well (even if it might not be possible with current code, let's better be safe than sorry).

All the other changes are simple refactorings for better readability.

Thanks,
Tobias

Progress

Change must be properly reviewed (1 review required, with at least 1 Reviewer)
Change must not contain extraneous whitespace
Commit message must refer to an issue

Issue

JDK-8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument

Reviewers

Roland Westrelin (@rwestrel - Reviewer) ⚠️ Review applies to fa80e23a
Christian Hagedorn (@chhagedorn - Reviewer)
Vladimir Kozlov (@vnkozlov - Reviewer)

Reviewing

Using git

Checkout this PR locally:
$ git fetch https://git.openjdk.org/jdk pull/12112/head:pull/12112
$ git checkout pull/12112

Update a local copy of the PR:
$ git checkout pull/12112
$ git pull https://git.openjdk.org/jdk pull/12112/head

Using Skara CLI tools

Checkout this PR locally:
$ git pr checkout 12112

View PR using the GUI difftool:
$ git pr show -t 12112

Using diff file

Download this PR as a diff file:
https://git.openjdk.org/jdk/pull/12112.diff

…t NULL src argument

bridgekeeper · 2023-01-20T11:59:03Z

👋 Welcome back thartmann! A progress list of the required criteria for merging this PR into master will be added to the body of your pull request. There are additional pull request commands available for use with this pull request.

openjdk · 2023-01-20T12:02:26Z

@TobiHartmann The following label will be automatically applied to this pull request:

hotspot-compiler

When this pull request is ready to be reviewed, an "RFR" email will be sent to the corresponding mailing list. If you would like to change these labels, use the /label pull request command.

rwestrel

Looks good to me.

openjdk · 2023-01-20T12:04:08Z

@TobiHartmann This change now passes all automated pre-integration checks.

ℹ️ This project also has non-automated pre-integration requirements. Please see the file CONTRIBUTING.md for details.

After integration, the commit message for the final commit will be:

8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument

Reviewed-by: roland, chagedorn, kvn

You can use pull request commands such as /summary, /contributor and /issue to adjust it as needed.

At the time when this comment was updated there had been 8 new commits pushed to the master branch:

facd415: 8297757: VarHandles.getStaticFieldFromBaseAndOffset should get the receiver type from VarHandle
e803855: 8299863: URLFromURITest.java should import org.junit.jupiter.api.Test
92d8326: 8299827: Add resolved IP address in connection exception for sockets
c6d5600: 8038146: Clarify Map.Entry's connection to the underlying map
b2d3622: 8299896: Reduce enum values of HtmlLinkInfo.Kind
623ba5b: 8300653: G1EvacInfo should use common naming scheme for collection set
97c611d: 8289748: C2 compiled code crashes with SIGFPE with -XX:+StressLCM and -XX:+StressGCM
4562b40: 8300682: InstanceKlassMiscStatus is a bad name

Please see this link for an up-to-date comparison between the source branch of this pull request and the master branch.
As there are no conflicts, your changes will automatically be rebased on top of these commits when integrating. If you prefer to avoid this automatic rebasing, please check the documentation for the /integrate command for further details.

➡️ To integrate this PR with the above commit message to the master branch, type /integrate in a new comment.

TobiHartmann · 2023-01-20T12:06:13Z

Thanks for the review, Roland!

TobiHartmann · 2023-01-20T12:11:11Z

Being paranoid, I double-checked my refactoring and noticed several Value calls with a wrong receiver. Turns out that has always been wrong. I fixed it.

mlbridge · 2023-01-20T12:14:14Z

Webrevs

00: Full (219b34aa)

chhagedorn

Looks good!

chhagedorn · 2023-01-20T12:23:59Z

src/hotspot/share/opto/library_call.cpp

-  const Type* n_type = a->Value(&_gvn);
-  const TypeAryPtr* top_n = n_type->isa_aryptr();
-  const Type* m_type = a->Value(&_gvn);


Good catch!

TobiHartmann · 2023-01-20T12:32:57Z

Thanks, Christian!

vnkozlov

Looks good.

TobiHartmann · 2023-01-23T05:57:23Z

Thanks, Vladimir!

TobiHartmann · 2023-01-23T06:01:48Z

/integrate

openjdk · 2023-01-23T06:08:18Z

Going to push as commit 45e4e00.
Since your change was applied there have been 22 commits pushed to the master branch:

030b071: 8300207: Add a pre-check for the number of canonical equivalent permutations in j.u.r.Pattern
7ced08d: 8300638: Tier1 IR Test failure after JDK-8298632 on macosx-x64-debug
3ea4eac: 8300817: The build is broken after JDK-8294693
cbfc069: 8300731: Avoid unnecessary array fill after creation in PaletteBuilder
67b1c89: 8294693: Add Collections.shuffle overload that accepts RandomGenerator interface
c8dd758: 8300260: Remove metaprogramming/isSame.hpp
a6c2a2a: 8300692: GCC 12 reports some compiler warnings in bundled freetype
bb42e61: 8300493: Use ArraysSupport.vectorizedHashCode in j.u.zip.ZipCoder
06394ee: 8300590: [JVMCI] BytecodeFrame.equals is broken
5331a3e: 8298908: Instrument Metaspace for ASan
... and 12 more: https://git.openjdk.org/jdk/compare/26410c180b88b4342217fdad63f1221786d8c37b...master

Your commit was automatically rebased without conflicts.

openjdk · 2023-01-23T06:12:21Z

@TobiHartmann Pushed as commit 45e4e00.

💡 You may see a message that your pull request was closed with unmerged commits. This can be safely ignored.

TobiHartmann added 3 commits January 20, 2023 12:24

8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constan…

62b970d

…t NULL src argument

Removed whitespace

4f48a09

Enabled fix

fa80e23

openjdk bot added the rfr label Jan 20, 2023

openjdk bot added the hotspot-compiler label Jan 20, 2023

rwestrel approved these changes Jan 20, 2023

View reviewed changes

openjdk bot added the ready label Jan 20, 2023

TobiHartmann added 2 commits January 20, 2023 13:07

Fixed wrong refactoring

0dbd75d

Fixed wrong Value call

219b34a

chhagedorn approved these changes Jan 20, 2023

View reviewed changes

vnkozlov approved these changes Jan 20, 2023

View reviewed changes

openjdk bot added the integrated label Jan 23, 2023

openjdk bot closed this Jan 23, 2023

openjdk bot removed ready rfr labels Jan 23, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument #12112

8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument #12112

TobiHartmann commented Jan 20, 2023 •

edited by openjdk bot

Loading

bridgekeeper bot commented Jan 20, 2023

openjdk bot commented Jan 20, 2023

rwestrel left a comment

openjdk bot commented Jan 20, 2023 •

edited

Loading

TobiHartmann commented Jan 20, 2023

TobiHartmann commented Jan 20, 2023

mlbridge bot commented Jan 20, 2023

chhagedorn left a comment

chhagedorn Jan 20, 2023

TobiHartmann commented Jan 20, 2023

vnkozlov left a comment

TobiHartmann commented Jan 23, 2023

TobiHartmann commented Jan 23, 2023

openjdk bot commented Jan 23, 2023

openjdk bot commented Jan 23, 2023

	public static String copyValueOf(char[] data, int offset, int count) {
	return new String(data, offset, count);

	public String(char[] value, int offset, int count) {
	this(value, offset, count, rangeCheck(value, offset, count));

	String(char[] value, int off, int len, Void sig) {
	if (len == 0) {
	this.value = "".value;
	this.coder = "".coder;
	return;
	}
	if (COMPACT_STRINGS) {
	byte[] val = StringUTF16.compress(value, off, len);

8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument #12112

8300079: SIGSEGV in LibraryCallKit::inline_string_copy due to constant NULL src argument #12112

Conversation

TobiHartmann commented Jan 20, 2023 • edited by openjdk bot Loading

Progress

Issue

Reviewers

Reviewing

bridgekeeper bot commented Jan 20, 2023

openjdk bot commented Jan 20, 2023

rwestrel left a comment

Choose a reason for hiding this comment

openjdk bot commented Jan 20, 2023 • edited Loading

TobiHartmann commented Jan 20, 2023

TobiHartmann commented Jan 20, 2023

mlbridge bot commented Jan 20, 2023

Webrevs

chhagedorn left a comment

Choose a reason for hiding this comment

chhagedorn Jan 20, 2023

Choose a reason for hiding this comment

TobiHartmann commented Jan 20, 2023

vnkozlov left a comment

Choose a reason for hiding this comment

TobiHartmann commented Jan 23, 2023

TobiHartmann commented Jan 23, 2023

openjdk bot commented Jan 23, 2023

openjdk bot commented Jan 23, 2023

TobiHartmann commented Jan 20, 2023 •

edited by openjdk bot

Loading

openjdk bot commented Jan 20, 2023 •

edited

Loading