infernap12/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2026-02-02 22:48:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

6892265: System.arraycopy unable to reference elements beyond Integer.MAX_VALUE bytes

Browse Source 
Use size_t type cast to widen int values in typeArrayKlass::copy_array().

Reviewed-by: never, jcoomes
This commit is contained in:
Vladimir Kozlov 2009-12-03 14:20:22 -08:00
parent b25112408f
commit d19aa4e217
2 changed files with 71 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
hotspot/src/share/vm/oops/typeArrayKlass.cpp
View File

@ -123,16 +123,16 @@ void typeArrayKlass::copy_array(arrayOop s, int src_pos, arrayOop d, int dst_pos
|| (((unsigned int) length + (unsigned int) dst_pos) > (unsigned int) d->length()) ) {
THROW(vmSymbols::java_lang_ArrayIndexOutOfBoundsException());
}
// Check zero copy
if (length == 0)
return;
// This is an attempt to make the copy_array fast.
// NB: memmove takes care of overlapping memory segments.
// Potential problem: memmove is not guaranteed to be word atomic
// Revisit in Merlin
int l2es = log2_element_size();
int ihs = array_header_in_bytes() / wordSize;
char* src = (char*) ((oop*)s + ihs) + (src_pos << l2es);
char* dst = (char*) ((oop*)d + ihs) + (dst_pos << l2es);
memmove(dst, src, length << l2es);
char* src = (char*) ((oop*)s + ihs) + ((size_t)src_pos << l2es);
char* dst = (char*) ((oop*)d + ihs) + ((size_t)dst_pos << l2es);
Copy::conjoint_memory_atomic(src, dst, (size_t)length << l2es);
}

65
hotspot/test/compiler/6892265/Test.java Normal file
View File

@ -0,0 +1,65 @@
/*
* Copyright 2009 Sun Microsystems, Inc. All Rights Reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
* CA 95054 USA or visit www.sun.com if you need additional information or
* have any questions.
*
*/
/**
* @test
* @bug 6892265
* @summary System.arraycopy unable to reference elements beyond Integer.MAX_VALUE bytes
*
* @run main/othervm Test
*/
public class Test {
static final int NCOPY = 1;
static final int OVERFLOW = 1;
static int[] src2 = new int[NCOPY];
static int[] dst2;
static void test() {
int N;
int SIZE;
N = Integer.MAX_VALUE/4 + OVERFLOW;
System.arraycopy(src2, 0, dst2, N, NCOPY);
System.arraycopy(dst2, N, src2, 0, NCOPY);
}
public static void main(String[] args) {
try {
dst2 = new int[NCOPY + Integer.MAX_VALUE/4 + OVERFLOW];
} catch (OutOfMemoryError e) {
System.exit(95); // Not enough memory
}
System.out.println("warmup");
for (int i=0; i <11000; i++) {
test();
}
System.out.println("start");
for (int i=0; i <1000; i++) {
test();
}
System.out.println("finish");
}
}