From 3d3d4641d523925058a038edf2a3304bbeca6b7c Mon Sep 17 00:00:00 2001
From: roland <unknown>
Date: Mon, 18 Jun 2012 09:52:31 +0200
Subject: [PATCH] 7174363: Arrays.copyOfRange leads to VM crash with -Xcomp
 -server if executed by testing framework Summary:
 Arrays.copyOfRange(original, from, to) with from > original.length tries to
 do a copy with a negative length. Reviewed-by: kvn, twisti

---
 src/share/vm/opto/library_call.cpp     | 10 ++++--
 test/compiler/7174363/Test7174363.java | 49 ++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 3 deletions(-)
 create mode 100644 test/compiler/7174363/Test7174363.java

diff --git a/src/share/vm/opto/library_call.cpp b/src/share/vm/opto/library_call.cpp
index f9d740efd..785f5a0ae 100644
--- a/src/share/vm/opto/library_call.cpp
+++ b/src/share/vm/opto/library_call.cpp
@@ -3592,8 +3592,10 @@ bool LibraryCallKit::inline_array_copyOf(bool is_copyOfRange) {
     }
 
     // Bail out if length is negative.
-    // ...Not needed, since the new_array will throw the right exception.
-    //generate_negative_guard(length, bailout, &length);
+    // Without this the new_array would throw
+    // NegativeArraySizeException but IllegalArgumentException is what
+    // should be thrown
+    generate_negative_guard(length, bailout, &length);
 
     if (bailout->req() > 1) {
       PreserveJVMState pjvms(this);
@@ -3617,7 +3619,9 @@ bool LibraryCallKit::inline_array_copyOf(bool is_copyOfRange) {
       // Extreme case:  Arrays.copyOf((Integer[])x, 10, String[].class).
       // This will fail a store-check if x contains any non-nulls.
       bool disjoint_bases = true;
-      bool length_never_negative = true;
+      // if start > orig_length then the length of the copy may be
+      // negative.
+      bool length_never_negative = !is_copyOfRange;
       generate_arraycopy(TypeAryPtr::OOPS, T_OBJECT,
                          original, start, newcopy, intcon(0), moved,
                          disjoint_bases, length_never_negative);
diff --git a/test/compiler/7174363/Test7174363.java b/test/compiler/7174363/Test7174363.java
new file mode 100644
index 000000000..50f784da1
--- /dev/null
+++ b/test/compiler/7174363/Test7174363.java
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ *
+ */
+
+/**
+ * @test
+ * @bug 7174363
+ * @summary crash with Arrays.copyOfRange(original, from, to) when from > original.length
+ *
+ * @run main/othervm -XX:-BackgroundCompilation Test7174363
+ */
+
+import java.util.*;
+
+public class Test7174363 {
+
+  static Object[] m(Object[] original, int from, int to) {
+    return Arrays.copyOfRange(original, from, to, Object[].class);
+  }
+
+  static public void main(String[] args) {
+    Object[] orig = new Object[10];
+    for (int i = 0; i < 20000; i++) {
+      try {
+        m(orig, 15, 20);
+      } catch(ArrayIndexOutOfBoundsException excp) {}
+    }
+  }
+}
-- 
GitLab