On Mon, 18 May 2026 08:37:16 GMT, Tobias Hartmann <[email protected]> wrote:
> @rwestrel (thanks!) noticed that flat array loads are control dependent on > the flat-array layout checks, but they are not pinned strongly enough > relative to the range check. New `TestFlatArrayLoadPinning.java` demonstrates > this: With `-XX:+StressGCM`, C2 can schedule one of the field loads from the > flat array to before the range check. When the array index is out of bounds, > compiled code performs an out-of-bounds memory load from the flat array > payload and crashes with a `SIGSEGV` instead of throwing the expected > `ArrayIndexOutOfBoundsException`. > > The fix is to use `C2_UNKNOWN_CONTROL_LOAD` for these loads. > > Thanks, > Tobias > > --------- > - [x] I confirm that I make this contribution in accordance with the [OpenJDK > Interim AI Policy](https://openjdk.org/legal/ai). src/hotspot/share/opto/inlinetypenode.cpp line 1460: > 1458: PhaseGVN& gvn = kit->gvn(); > 1459: // The flat field loads are dependent on both the array layout checks > as well as the range check. > 1460: DecoratorSet decorators = IN_HEAP | IS_ARRAY | MO_UNORDERED | > C2_CONTROL_DEPENDENT_LOAD | C2_UNKNOWN_CONTROL_LOAD; Do we need both `C2_CONTROL_DEPENDENT_LOAD` and `C2_UNKNOWN_CONTROL_LOAD here? Also, if the value is known null free and non atomic at compile time (the runtime checks control fold and the loads are control dependent on the range check), wouldn't we want to not pin the load? ------------- PR Review Comment: https://git.openjdk.org/valhalla/pull/2445#discussion_r3257576818
