Skip to content

8369946: Bytecode rewriting causes Java heap corruption on PPC #27867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 2 commits into from
Closed

8369946: Bytecode rewriting causes Java heap corruption on PPC #27867

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
138df66
8369946: Bytecode rewriting causes Java heap corruption on PPC
TheRealMDoerr Oct 17, 2025
773b82f
Improve comment.
TheRealMDoerr Oct 21, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions src/hotspot/cpu/ppc/interp_masm_ppc.hpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,8 +133,13 @@ class InterpreterMacroAssembler: public MacroAssembler {
void get_cache_index_at_bcp(Register Rdst, int bcp_offset, size_t index_size);

void load_resolved_indy_entry(Register cache, Register index);
void load_field_entry(Register cache, Register index, int bcp_offset = 1);
void load_method_entry(Register cache, Register index, int bcp_offset = 1);
void load_field_or_method_entry(bool is_method, Register cache, Register index, int bcp_offset, bool for_fast_bytecode);
void load_field_entry(Register cache, Register index, int bcp_offset = 1, bool for_fast_bytecode = false) {
load_field_or_method_entry(false, cache, index, bcp_offset, for_fast_bytecode);
}
void load_method_entry(Register cache, Register index, int bcp_offset = 1, bool for_fast_bytecode = false) {
load_field_or_method_entry(true, cache, index, bcp_offset, for_fast_bytecode);
}

void get_u4(Register Rdst, Register Rsrc, int offset, signedOrNot is_signed);

Expand Down
34 changes: 17 additions & 17 deletions src/hotspot/cpu/ppc/interp_masm_ppc_64.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -468,33 +468,33 @@ void InterpreterMacroAssembler::load_resolved_indy_entry(Register cache, Registe
add(cache, cache, index);
}

void InterpreterMacroAssembler::load_field_entry(Register cache, Register index, int bcp_offset) {
void InterpreterMacroAssembler::load_field_or_method_entry(bool is_method, Register cache, Register index, int bcp_offset, bool for_fast_bytecode) {
const int entry_size = is_method ? sizeof(ResolvedMethodEntry) : sizeof(ResolvedFieldEntry),
base_offset = is_method ? Array<ResolvedMethodEntry>::base_offset_in_bytes() : Array<ResolvedFieldEntry>::base_offset_in_bytes(),
entries_offset = is_method ? in_bytes(ConstantPoolCache::method_entries_offset()) : in_bytes(ConstantPoolCache::field_entries_offset());

// Get index out of bytecode pointer
get_cache_index_at_bcp(index, bcp_offset, sizeof(u2));
// Take shortcut if the size is a power of 2
if (is_power_of_2(sizeof(ResolvedFieldEntry))) {
if (is_power_of_2(entry_size)) {
// Scale index by power of 2
sldi(index, index, log2i_exact(sizeof(ResolvedFieldEntry)));
sldi(index, index, log2i_exact(entry_size));
} else {
// Scale the index to be the entry index * sizeof(ResolvedFieldEntry)
mulli(index, index, sizeof(ResolvedFieldEntry));
mulli(index, index, entry_size);
}
// Get address of field entries array
ld_ptr(cache, in_bytes(ConstantPoolCache::field_entries_offset()), R27_constPoolCache);
addi(cache, cache, Array<ResolvedFieldEntry>::base_offset_in_bytes());
ld_ptr(cache, entries_offset, R27_constPoolCache);
addi(cache, cache, base_offset);
add(cache, cache, index);
}

void InterpreterMacroAssembler::load_method_entry(Register cache, Register index, int bcp_offset) {
// Get index out of bytecode pointer
get_cache_index_at_bcp(index, bcp_offset, sizeof(u2));
// Scale the index to be the entry index * sizeof(ResolvedMethodEntry)
mulli(index, index, sizeof(ResolvedMethodEntry));

// Get address of field entries array
ld_ptr(cache, ConstantPoolCache::method_entries_offset(), R27_constPoolCache);
addi(cache, cache, Array<ResolvedMethodEntry>::base_offset_in_bytes());
add(cache, cache, index); // method_entries + base_offset + scaled index
if (for_fast_bytecode) {
// Prevent speculative loading from ResolvedFieldEntry/ResolvedMethodEntry as it can miss the info written by another thread.
// TemplateTable::patch_bytecode uses release-store.
// We reached here via control dependency (Bytecode dispatch has used the rewritten Bytecode).
// So, we can use control-isync based ordering.
isync();
}
}

// Load object from cpool->resolved_references(index).
Expand Down
13 changes: 8 additions & 5 deletions src/hotspot/cpu/ppc/templateTable_ppc_64.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -148,7 +148,9 @@ void TemplateTable::patch_bytecode(Bytecodes::Code new_bc, Register Rnew_bc, Reg
__ bind(L_fast_patch);
}

// Patch bytecode.
// Patch bytecode with release store to coordinate with ResolvedFieldEntry
// and ResolvedMethodEntry loads in fast bytecode codelets.
__ release();
__ stb(Rnew_bc, 0, R14_bcp);

__ bind(L_patch_done);
Expand Down Expand Up @@ -312,6 +314,7 @@ void TemplateTable::fast_aldc(LdcType type) {
// We are resolved if the resolved reference cache entry contains a
// non-null object (CallSite, etc.)
__ get_cache_index_at_bcp(R31, 1, index_size); // Load index.
// Only rewritten during link time. So, no need for memory barriers for accessing resolved info.
__ load_resolved_reference_at_index(R17_tos, R31, R11_scratch1, R12_scratch2, &is_null);

// Convert null sentinel to null
Expand Down Expand Up @@ -3114,7 +3117,7 @@ void TemplateTable::fast_storefield(TosState state) {
const ConditionRegister CR_is_vol = CR2; // Non-volatile condition register (survives runtime call in do_oop_store).

// Constant pool already resolved => Load flags and offset of field.
__ load_field_entry(Rcache, Rscratch);
__ load_field_entry(Rcache, Rscratch, 1, /* for_fast_bytecode */ true);
jvmti_post_field_mod(Rcache, Rscratch, false /* not static */);
load_resolved_field_entry(noreg, Rcache, noreg, Roffset, Rflags, false); // Uses R11, R12

Expand Down Expand Up @@ -3195,7 +3198,7 @@ void TemplateTable::fast_accessfield(TosState state) {
// R12_scratch2 used by load_field_cp_cache_entry

// Constant pool already resolved. Get the field offset.
__ load_field_entry(Rcache, Rscratch);
__ load_field_entry(Rcache, Rscratch, 1, /* for_fast_bytecode */ true);
load_resolved_field_entry(noreg, Rcache, noreg, Roffset, Rflags, false); // Uses R11, R12

// JVMTI support
Expand Down Expand Up @@ -3334,7 +3337,7 @@ void TemplateTable::fast_xaccess(TosState state) {
__ ld(Rclass_or_obj, 0, R18_locals);

// Constant pool already resolved. Get the field offset.
__ load_field_entry(Rcache, Rscratch, 2);
__ load_field_entry(Rcache, Rscratch, 2, /* for_fast_bytecode */ true);
load_resolved_field_entry(noreg, Rcache, noreg, Roffset, Rflags, false); // Uses R11, R12

// JVMTI support not needed, since we switch back to single bytecode as soon as debugger attaches.
Expand Down Expand Up @@ -3495,7 +3498,7 @@ void TemplateTable::fast_invokevfinal(int byte_no) {

assert(byte_no == f2_byte, "use this argument");
Register Rcache = R31;
__ load_method_entry(Rcache, R11_scratch1);
__ load_method_entry(Rcache, R11_scratch1, 1, /* for_fast_bytecode */ true);
invokevfinal_helper(Rcache, R11_scratch1, R12_scratch2, R22_tmp2, R23_tmp3);
}

Expand Down