6646019: array subscript expressions become top() with -d64

Summary: stop compilation after negative array allocation
Reviewed-by: never, jrose

src/share/vm/opto/parse2.cpp

@@ -105,10 +105,19 @@ Node* Parse::array_addressing(BasicType type, int vals, const Type* *result2) {
   if (GenerateRangeChecks && need_range_check) {
     // Range is constant in array-oop, so we can use the original state of mem
     Node* len = load_array_length(ary);
-    // Test length vs index (standard trick using unsigned compare)
-    Node* chk = _gvn.transform( new (C, 3) CmpUNode(idx, len) );
-    BoolTest::mask btest = BoolTest::lt;
-    Node* tst = _gvn.transform( new (C, 2) BoolNode(chk, btest) );
+    Node* tst;
+    if (sizetype->_hi <= 0) {
+      // If the greatest array bound is negative, we can conclude that we're
+      // compiling unreachable code, but the unsigned compare trick used below
+      // only works with non-negative lengths.  Instead, hack "tst" to be zero so
+      // the uncommon_trap path will always be taken.
+      tst = _gvn.intcon(0);
+    } else {
+      // Test length vs index (standard trick using unsigned compare)
+      Node* chk = _gvn.transform( new (C, 3) CmpUNode(idx, len) );
+      BoolTest::mask btest = BoolTest::lt;
+      tst = _gvn.transform( new (C, 2) BoolNode(chk, btest) );
+    }
     // Branch to failure if out of bounds
     { BuildCutout unless(this, tst, PROB_MAX);
       if (C->allow_range_check_smearing()) {

test/compiler/6646019/Test.java

+/*
+ * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
+ * SUN PROPRIETARY/CONFIDENTIAL. Use is subject to license terms.
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ *
+ */
+
+/*
+ * @test
+ * @bug 6646019
+ * @summary array subscript expressions become top() with -d64
+ * @run main/othervm -Xcomp -XX:CompileOnly=Test.test Test
+*/
+
+
+public class Test  {
+  final static int i = 2076285318;
+  long l = 2;
+  short s;
+
+  public static void main(String[] args) {
+    Test t = new Test();
+    try { t.test(); }
+    catch (Throwable e) {
+      if (t.l != 5) {
+        System.out.println("Fails: " + t.l + " != 5");
+      }
+    }
+  }
+
+  private void test() {
+    l = 5;
+    l = (new short[(byte)-2])[(byte)(l = i)];
+  }
+}