Skip to content

8369506: Bytecode rewriting causes Java heap corruption on AArch64 #27748

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 5 commits into from
Closed

8369506: Bytecode rewriting causes Java heap corruption on AArch64 #27748

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
5b5087e
JDK-8369506: Bytecode rewriting causes Java heap corruption on AArch64
jcking Oct 10, 2025
dd68d39
Update src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
jcking Oct 15, 2025
2f1b5e0
Remove trailing whitespace added by Github
jcking Oct 15, 2025
3575e7b
Suggestions from shipilev
jcking Oct 15, 2025
95d4831
Merge branch 'openjdk:master' into aarch64-rewrite-bytecodes
jcking Oct 15, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions src/hotspot/cpu/aarch64/interp_masm_aarch64.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1704,3 +1704,15 @@ void InterpreterMacroAssembler::load_method_entry(Register cache, Register index
add(cache, cache, Array<ResolvedMethodEntry>::base_offset_in_bytes());
lea(cache, Address(cache, index));
}

#ifdef ASSERT
void InterpreterMacroAssembler::verify_field_offset(Register reg) {
// Verify the field offset falls after the header and Klass pointer. This is a cheap check which
// is able to detect a regression of JDK-8369506.
Label valid;
subs(zr, reg, oopDesc::base_offset_in_bytes());
br(Assembler::GE, valid);
stop("bad field offset");
bind(valid);
}
#endif
2 changes: 2 additions & 0 deletions src/hotspot/cpu/aarch64/interp_masm_aarch64.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,6 +319,8 @@ class InterpreterMacroAssembler: public MacroAssembler {
void load_resolved_indy_entry(Register cache, Register index);
void load_field_entry(Register cache, Register index, int bcp_offset = 1);
void load_method_entry(Register cache, Register index, int bcp_offset = 1);

void verify_field_offset(Register reg) NOT_DEBUG_RETURN;
};

#endif // CPU_AARCH64_INTERP_MASM_AARCH64_HPP
13 changes: 11 additions & 2 deletions src/hotspot/cpu/aarch64/templateTable_aarch64.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -168,6 +168,7 @@ void TemplateTable::patch_bytecode(Bytecodes::Code bc, Register bc_reg,
Register temp_reg, bool load_bc_into_bc_reg/*=true*/,
int byte_no)
{
assert_different_registers(bc_reg, temp_reg);
if (!RewriteBytecodes) return;
Label L_patch_done;

Expand Down Expand Up @@ -232,8 +233,11 @@ void TemplateTable::patch_bytecode(Bytecodes::Code bc, Register bc_reg,
__ bind(L_okay);
#endif

// patch bytecode
__ strb(bc_reg, at_bcp(0));
// Patch the bytecode using STLR, this is required so that the last STLR used in
// ResolvedFieldEntry::fill_in is obsevable before the patched bytecode. If it is not,
// TemplateTable::fast_* will observe an unresolved ResolvedFieldEntry and corrupt the Java heap.
__ lea(temp_reg, at_bcp(0));
__ stlrb(bc_reg, temp_reg);
__ bind(L_patch_done);
}

Expand Down Expand Up @@ -3079,6 +3083,7 @@ void TemplateTable::fast_storefield(TosState state)

// R1: field offset, R2: field holder, R5: flags
load_resolved_field_entry(r2, r2, noreg, r1, r5);
__ verify_field_offset(r1);

{
Label notVolatile;
Expand Down Expand Up @@ -3168,6 +3173,8 @@ void TemplateTable::fast_accessfield(TosState state)
__ load_field_entry(r2, r1);

__ load_sized_value(r1, Address(r2, in_bytes(ResolvedFieldEntry::field_offset_offset())), sizeof(int), true /*is_signed*/);
__ verify_field_offset(r1);

__ load_unsigned_byte(r3, Address(r2, in_bytes(ResolvedFieldEntry::flags_offset())));

// r0: object
Expand Down Expand Up @@ -3234,7 +3241,9 @@ void TemplateTable::fast_xaccess(TosState state)
__ ldr(r0, aaddress(0));
// access constant pool cache
__ load_field_entry(r2, r3, 2);

__ load_sized_value(r1, Address(r2, in_bytes(ResolvedFieldEntry::field_offset_offset())), sizeof(int), true /*is_signed*/);
__ verify_field_offset(r1);

// 8179954: We need to make sure that the code generated for
// volatile accesses forms a sequentially-consistent set of
Expand Down