8159244: Partially initialized string object created by C2's string concat optimization may escape

Summary: Emit release barrier after String creation to prevent partially initialized object from escaping.
Reviewed-by: kvn

src/share/vm/opto/stringopts.cpp

 /*
- * Copyright (c) 2009, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2009, 2016, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -1640,6 +1640,17 @@ void PhaseStringOpts::replace_string_concat(StringConcat* sc) {
       kit.store_String_length(kit.control(), result, length);
     }
     kit.store_String_value(kit.control(), result, char_array);
+
+    // Do not let stores that initialize this object be reordered with
+    // a subsequent store that would make this object accessible by
+    // other threads.
+    // Record what AllocateNode this StoreStore protects so that
+    // escape analysis can go from the MemBarStoreStoreNode to the
+    // AllocateNode and eliminate the MemBarStoreStoreNode if possible
+    // based on the escape status of the AllocateNode.
+    AllocateNode* alloc = AllocateNode::Ideal_allocation(result, _gvn);
+    assert(alloc != NULL, "should be newly allocated");
+    kit.insert_mem_bar(Op_MemBarStoreStore, alloc->proj_out(AllocateNode::RawAddress));
   } else {
     result = C->top();
   }

test/compiler/stringopts/TestStringObjectInitialization.java

+/*
+ * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+
+import java.util.Arrays;
+
+/*
+ * @test
+ * @bug 8159244
+ * @summary Verifies that no partially initialized String object escapes from
+ *          C2's String concat optimization in a highly concurrent setting.
+ *          This test triggers the bug in about 1 out of 10 runs.
+ * @compile -XDstringConcat=inline TestStringObjectInitialization.java
+ * @run main/othervm/timeout=300 -XX:+IgnoreUnrecognizedVMOptions -XX:-UseCompressedOops -XX:-CompactStrings
+ *                               -XX:-UseG1GC -XX:+UseParallelGC TestStringObjectInitialization
+ */
+public class TestStringObjectInitialization {
+
+    String myString;
+
+    public static void main(String[] args) throws Exception {
+        TestStringObjectInitialization t = new TestStringObjectInitialization();
+        // Create some threads that concurrently update 'myString'
+        for (int i = 0; i < 100; ++i) {
+            (new Thread(new Runner(t))).start();
+        }
+        Thread last = new Thread(new Runner(t));
+        last.start();
+        last.join();
+    }
+
+    private void add(String message) {
+        // String escapes to other threads here
+        myString += message;
+    }
+
+    public void run(String s, String[] sArray) {
+        // Trigger C2's string concatenation optimization
+        add(s + Arrays.toString(sArray) + " const ");
+    }
+}
+
+class Runner implements Runnable {
+    private TestStringObjectInitialization test;
+
+    public Runner(TestStringObjectInitialization t) {
+        test = t;
+    }
+
+    public void run(){
+        String[] array = {"a", "b", "c"};
+        for (int i = 0; i < 10000; ++i) {
+            test.run("a", array);
+        }
+    }
+}
+