8345250: [lworld] C2: Array loads and stores on inexact flat arrays cause crashes

src/hotspot/share/ci/ciArrayKlass.cpp

@@ -105,23 +105,25 @@ bool ciArrayKlass::is_leaf_type() {
 ciArrayKlass* ciArrayKlass::make(ciType* element_type, bool null_free) {
   if (element_type->is_primitive_type()) {
     return ciTypeArrayKlass::make(element_type->basic_type());
-  } else {
-    ciKlass* klass = element_type->as_klass();
-    if (null_free && klass->is_loaded()) {
-      GUARDED_VM_ENTRY(
-        EXCEPTION_CONTEXT;
-        Klass* ak = InlineKlass::cast(klass->get_Klass())->value_array_klass(THREAD);
-        if (HAS_PENDING_EXCEPTION) {
-          CLEAR_PENDING_EXCEPTION;
-        } else if (ak->is_flatArray_klass()) {
-          return CURRENT_THREAD_ENV->get_flat_array_klass(ak);
-        } else if (ak->is_objArray_klass()) {
-          return CURRENT_THREAD_ENV->get_obj_array_klass(ak);
-        }
-      )
-    }
-    return ciObjArrayKlass::make(klass);
   }
+
+  ciKlass* klass = element_type->as_klass();
+  assert(!null_free || !klass->is_loaded() || klass->is_inlinetype() || klass->is_abstract() ||
+         klass->is_java_lang_Object(), "only value classes are null free");
+  if (null_free && klass->is_loaded() && klass->is_inlinetype()) {
+    GUARDED_VM_ENTRY(
+      EXCEPTION_CONTEXT;
+      Klass* ak = InlineKlass::cast(klass->get_Klass())->value_array_klass(THREAD);
+      if (HAS_PENDING_EXCEPTION) {
+        CLEAR_PENDING_EXCEPTION;
+      } else if (ak->is_flatArray_klass()) {
+        return CURRENT_THREAD_ENV->get_flat_array_klass(ak);
+      } else if (ak->is_objArray_klass()) {
+        return CURRENT_THREAD_ENV->get_obj_array_klass(ak);
+      }
+    )
+  }
+  return ciObjArrayKlass::make(klass);
 }
 
 int ciArrayKlass::array_header_in_bytes() {

src/hotspot/share/opto/graphKit.cpp

@@ -1835,7 +1835,18 @@ void GraphKit::access_clone(Node* src, Node* dst, Node* size, bool is_array) {
 Node* GraphKit::array_element_address(Node* ary, Node* idx, BasicType elembt,
                                       const TypeInt* sizetype, Node* ctrl) {
   const TypeAryPtr* arytype = _gvn.type(ary)->is_aryptr();
-  uint shift = arytype->is_flat() ? arytype->flat_log_elem_size() : exact_log2(type2aelembytes(elembt));
+  assert(!arytype->is_flat() || elembt == T_OBJECT, "element type of flat arrays are T_OBJECT");
+  uint shift;
+  if (arytype->is_flat() && arytype->klass_is_exact()) {
+    // We can only determine the flat array layout statically if the klass is exact. Otherwise, we could have different
+    // value classes at runtime with a potentially different layout. The caller needs to fall back to call
+    // load/store_unknown_inline_Type() at runtime. We could return a sentinel node for the non-exact case but that
+    // might mess with other GVN transformations in between. Thus, we just continue in the else branch normally, even
+    // though we don't need the address node in this case and throw it away again.
+    shift = arytype->flat_log_elem_size();
+  } else {
+    shift = exact_log2(type2aelembytes(elembt));
+  }
   uint header = arrayOopDesc::base_offset_in_bytes(elembt);
 
   // short-circuit a common case (saves lots of confusing waste motion)
@@ -3493,7 +3504,7 @@ Node* GraphKit::gen_checkcast(Node *obj, Node* superklass, Node* *failure_contro
   const TypeKlassPtr* improved_klass_ptr_type = klass_ptr_type->try_improve();
   const TypeOopPtr* toop = improved_klass_ptr_type->cast_to_exactness(false)->as_instance_type();
   bool safe_for_replace = (failure_control == nullptr);
-  assert(!null_free || toop->is_inlinetypeptr(), "must be an inline type pointer");
+  assert(!null_free || toop->can_be_inline_type(), "must be an inline type pointer");
 
   // Fast cutout:  Check the case that the cast is vacuously true.
   // This detects the common cases where the test will short-circuit

src/hotspot/share/opto/parse.hpp

@@ -494,8 +494,10 @@ class Parse : public GraphKit {
   Node* array_store_check(Node*& adr, const Type*& elemtype);
   // Helper function to generate array load
   void array_load(BasicType etype);
+  Node* load_from_unknown_flat_array(Node* array, Node* array_index, const TypeOopPtr* element_ptr);
   // Helper function to generate array store
   void array_store(BasicType etype);
+  void store_to_unknown_flat_array(Node* array, Node* idx, Node* non_null_stored_value);
   // Helper function to compute array addressing
   Node* array_addressing(BasicType type, int vals, const Type*& elemtype);
   bool needs_range_check(const TypeInt* size_type, const Node* index) const;