Merge

Reviewed-by: kcr

make/conf/version-numbers.conf

@@ -28,12 +28,12 @@
 
 DEFAULT_VERSION_FEATURE=22
 DEFAULT_VERSION_INTERIM=0
-DEFAULT_VERSION_UPDATE=1
+DEFAULT_VERSION_UPDATE=2
 DEFAULT_VERSION_PATCH=0
 DEFAULT_VERSION_EXTRA1=0
 DEFAULT_VERSION_EXTRA2=0
 DEFAULT_VERSION_EXTRA3=0
-DEFAULT_VERSION_DATE=2024-04-16
+DEFAULT_VERSION_DATE=2024-07-16
 DEFAULT_VERSION_CLASSFILE_MAJOR=66  # "`$EXPR $DEFAULT_VERSION_FEATURE + 44`"
 DEFAULT_VERSION_CLASSFILE_MINOR=0
 DEFAULT_VERSION_DOCS_API_SINCE=11

src/hotspot/share/c1/c1_RangeCheckElimination.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012, 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2012, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -483,14 +483,14 @@ void RangeCheckEliminator::in_block_motion(BlockBegin *block, AccessIndexedList
 
           if (c) {
             jint value = c->type()->as_IntConstant()->value();
-            if (value != min_jint) {
-              if (ao->op() == Bytecodes::_isub) {
-                value = -value;
-              }
+            if (ao->op() == Bytecodes::_iadd) {
               base = java_add(base, value);
-              last_integer = base;
-              last_instruction = other;
+            } else {
+              assert(ao->op() == Bytecodes::_isub, "unexpected bytecode");
+              base = java_subtract(base, value);
             }
+            last_integer = base;
+            last_instruction = other;
             index = other;
           } else {
             break;

src/hotspot/share/classfile/symbolTable.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -339,8 +339,23 @@ Symbol* SymbolTable::lookup_common(const char* name,
   return sym;
 }
 
+// Symbols should represent entities from the constant pool that are
+// limited to <64K in length, but usage errors creep in allowing Symbols
+// to be used for arbitrary strings. For debug builds we will assert if
+// a string is too long, whereas product builds will truncate it.
+static int check_length(const char* name, int len) {
+  assert(len <= Symbol::max_length(),
+         "String length %d exceeds the maximum Symbol length of %d", len, Symbol::max_length());
+  if (len > Symbol::max_length()) {
+    warning("A string \"%.80s ... %.80s\" exceeds the maximum Symbol "
+            "length of %d and has been truncated", name, (name + len - 80), Symbol::max_length());
+    len = Symbol::max_length();
+  }
+  return len;
+}
+
 Symbol* SymbolTable::new_symbol(const char* name, int len) {
-  assert(len <= Symbol::max_length(), "sanity");
+  len = check_length(name, len);
   unsigned int hash = hash_symbol(name, len, _alt_hash);
   Symbol* sym = lookup_common(name, len, hash);
   if (sym == nullptr) {
@@ -473,6 +488,7 @@ void SymbolTable::new_symbols(ClassLoaderData* loader_data, const constantPoolHa
   for (int i = 0; i < names_count; i++) {
     const char *name = names[i];
     int len = lengths[i];
+    assert(len <= Symbol::max_length(), "must be - these come from the constant pool");
     unsigned int hash = hashValues[i];
     assert(lookup_shared(name, len, hash) == nullptr, "must have checked already");
     Symbol* sym = do_add_if_needed(name, len, hash, is_permanent);
@@ -482,6 +498,7 @@ void SymbolTable::new_symbols(ClassLoaderData* loader_data, const constantPoolHa
 }
 
 Symbol* SymbolTable::do_add_if_needed(const char* name, int len, uintx hash, bool is_permanent) {
+  assert(len <= Symbol::max_length(), "caller should have ensured this");
   SymbolTableLookup lookup(name, len, hash);
   SymbolTableGet stg;
   bool clean_hint = false;
@@ -530,7 +547,7 @@ Symbol* SymbolTable::do_add_if_needed(const char* name, int len, uintx hash, boo
 
 Symbol* SymbolTable::new_permanent_symbol(const char* name) {
   unsigned int hash = 0;
-  int len = (int)strlen(name);
+  int len = check_length(name, (int)strlen(name));
   Symbol* sym = SymbolTable::lookup_only(name, len, hash);
   if (sym == nullptr) {
     sym = do_add_if_needed(name, len, hash, /* is_permanent */ true);

src/hotspot/share/oops/symbol.cpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -53,6 +53,7 @@ uint32_t Symbol::pack_hash_and_refcount(short hash, int refcount) {
 }
 
 Symbol::Symbol(const u1* name, int length, int refcount) {
+  assert(length <= max_length(), "SymbolTable should have caught this!");
   _hash_and_refcount =  pack_hash_and_refcount((short)os::random(), refcount);
   _length = (u2)length;
   // _body[0..1] are allocated in the header just by coincidence in the current

src/hotspot/share/oops/symbol.hpp

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1997, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -130,6 +130,7 @@ class Symbol : public MetaspaceObj {
     return (int)heap_word_size(byte_size(length));
   }
 
+  // Constructor is private for use only by SymbolTable.
   Symbol(const u1* name, int length, int refcount);
 
   static short extract_hash(uint32_t value)   { return (short)(value >> 16); }

src/hotspot/share/opto/ifnode.cpp

@@ -733,6 +733,7 @@ bool IfNode::cmpi_folds(PhaseIterGVN* igvn, bool fold_ne) {
 bool IfNode::is_ctrl_folds(Node* ctrl, PhaseIterGVN* igvn) {
   return ctrl != nullptr &&
     ctrl->is_Proj() &&
+    ctrl->outcnt() == 1 && // No side-effects
     ctrl->in(0) != nullptr &&
     ctrl->in(0)->Opcode() == Op_If &&
     ctrl->in(0)->outcnt() == 2 &&
@@ -1308,7 +1309,7 @@ Node* IfNode::fold_compares(PhaseIterGVN* igvn) {
 
   if (cmpi_folds(igvn)) {
     Node* ctrl = in(0);
-    if (is_ctrl_folds(ctrl, igvn) && ctrl->outcnt() == 1) {
+    if (is_ctrl_folds(ctrl, igvn)) {
       // A integer comparison immediately dominated by another integer
       // comparison
       ProjNode* success = nullptr;

src/hotspot/share/opto/superword.cpp

@@ -3692,20 +3692,39 @@ void SuperWord::align_initial_loop_index(MemNode* align_to_ref) {
   _igvn.register_new_node_with_optimizer(N);
   _phase->set_ctrl(N, pre_ctrl);
 
+  // The computation of the new pre-loop limit could overflow or underflow the int range. This is problematic in
+  // combination with Range Check Elimination (RCE), which determines a "safe" range where a RangeCheck will always
+  // succeed. RCE adjusts the pre-loop limit such that we only enter the main-loop once we have reached the "safe"
+  // range, and adjusts the main-loop limit so that we exit the main-loop before we leave the "safe" range. After RCE,
+  // the range of the main-loop can only be safely narrowed, and should never be widened. Hence, the pre-loop limit
+  // can only be increased (for stride > 0), but an add overflow might decrease it, or decreased (for stride < 0), but
+  // a sub underflow might increase it. To prevent that, we perform the Sub / Add and Max / Min with long operations.
+  lim0       = new ConvI2LNode(lim0);
+  N          = new ConvI2LNode(N);
+  orig_limit = new ConvI2LNode(orig_limit);
+  _igvn.register_new_node_with_optimizer(lim0);
+  _igvn.register_new_node_with_optimizer(N);
+  _igvn.register_new_node_with_optimizer(orig_limit);
+
   //   substitute back into (1), so that new limit
   //     lim = lim0 + N
   Node* lim;
   if (stride < 0) {
-    lim = new SubINode(lim0, N);
+    lim = new SubLNode(lim0, N);
   } else {
-    lim = new AddINode(lim0, N);
+    lim = new AddLNode(lim0, N);
   }
   _igvn.register_new_node_with_optimizer(lim);
   _phase->set_ctrl(lim, pre_ctrl);
   Node* constrained =
-    (stride > 0) ? (Node*) new MinINode(lim, orig_limit)
-                 : (Node*) new MaxINode(lim, orig_limit);
+    (stride > 0) ? (Node*) new MinLNode(_phase->C, lim, orig_limit)
+                 : (Node*) new MaxLNode(_phase->C, lim, orig_limit);
   _igvn.register_new_node_with_optimizer(constrained);
+
+  // We know that the result is in the int range, there is never truncation
+  constrained = new ConvL2INode(constrained);
+  _igvn.register_new_node_with_optimizer(constrained);
+
   _phase->set_ctrl(constrained, pre_ctrl);
   _igvn.replace_input_of(pre_opaq, 1, constrained);
 }

src/hotspot/share/utilities/exceptions.cpp

@@ -44,6 +44,9 @@
 #include "utilities/events.hpp"
 #include "utilities/exceptions.hpp"
 
+// Limit exception message components to 64K (the same max as Symbols)
+#define MAX_LEN 65535
+
 // Implementation of ThreadShadow
 void check_ThreadShadow() {
   const ByteSize offset1 = byte_offset_of(ThreadShadow, _pending_exception);
@@ -116,10 +119,11 @@ bool Exceptions::special_exception(JavaThread* thread, const char* file, int lin
     const char* exc_value = h_exception.not_null() ? h_exception->print_value_string() :
                       h_name != nullptr ? h_name->as_C_string() :
                       "null";
-    log_info(exceptions)("Thread cannot call Java so instead of throwing exception <%s%s%s> (" PTR_FORMAT ") \n"
+    log_info(exceptions)("Thread cannot call Java so instead of throwing exception <%.*s%s%.*s> (" PTR_FORMAT ") \n"
                         "at [%s, line %d]\nfor thread " PTR_FORMAT ",\n"
                         "throwing pre-allocated exception: %s",
-                        exc_value, message ? ": " : "", message ? message : "",
+                        MAX_LEN, exc_value, message ? ": " : "",
+                        MAX_LEN, message ? message : "",
                         p2i(h_exception()), file, line, p2i(thread),
                         Universe::vm_exception()->print_value_string());
     // We do not care what kind of exception we get for a thread which
@@ -145,10 +149,11 @@ void Exceptions::_throw(JavaThread* thread, const char* file, int line, Handle h
 
   // tracing (do this up front - so it works during boot strapping)
   // Note, the print_value_string() argument is not called unless logging is enabled!
-  log_info(exceptions)("Exception <%s%s%s> (" PTR_FORMAT ") \n"
+  log_info(exceptions)("Exception <%.*s%s%.*s> (" PTR_FORMAT ") \n"
                        "thrown [%s, line %d]\nfor thread " PTR_FORMAT,
-                       h_exception->print_value_string(),
-                       message ? ": " : "", message ? message : "",
+                       MAX_LEN, h_exception->print_value_string(),
+                       message ? ": " : "",
+                       MAX_LEN, message ? message : "",
                        p2i(h_exception()), file, line, p2i(thread));
 
   // for AbortVMOnException flag
@@ -566,13 +571,13 @@ void Exceptions::log_exception(Handle exception, const char* message) {
   ResourceMark rm;
   const char* detail_message = java_lang_Throwable::message_as_utf8(exception());
   if (detail_message != nullptr) {
-    log_info(exceptions)("Exception <%s: %s>\n thrown in %s",
-                         exception->print_value_string(),
-                         detail_message,
-                         message);
+    log_info(exceptions)("Exception <%.*s: %.*s>\n thrown in %.*s",
+                         MAX_LEN, exception->print_value_string(),
+                         MAX_LEN, detail_message,
+                         MAX_LEN, message);
   } else {
-    log_info(exceptions)("Exception <%s>\n thrown in %s",
-                         exception->print_value_string(),
-                         message);
+    log_info(exceptions)("Exception <%.*s>\n thrown in %.*s",
+                         MAX_LEN, exception->print_value_string(),
+                         MAX_LEN, message);
   }
 }

src/hotspot/share/utilities/utf8.cpp

@@ -24,6 +24,7 @@
 
 #include "precompiled.hpp"
 #include "memory/allocation.hpp"
+#include "utilities/checkedCast.hpp"
 #include "utilities/debug.hpp"
 #include "utilities/globalDefinitions.hpp"
 #include "utilities/utf8.hpp"
@@ -431,12 +432,16 @@ int UNICODE::utf8_size(jbyte c) {
 
 template<typename T>
 int UNICODE::utf8_length(const T* base, int length) {
-  int result = 0;
+  size_t result = 0;
   for (int index = 0; index < length; index++) {
     T c = base[index];
-    result += utf8_size(c);
+    int sz = utf8_size(c);
+    if (result + sz > INT_MAX-1) {
+      break;
+    }
+    result += sz;
   }
-  return result;
+  return checked_cast<int>(result);
 }
 
 template<typename T>

src/java.desktop/share/classes/sun/java2d/SunGraphics2D.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1996, 2022, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1996, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -2150,27 +2150,33 @@ private void doCopyArea(int x, int y, int w, int h, int dx, int dy) {
         }
 
         Blit ob = lastCAblit;
-        if (dy == 0 && dx > 0 && dx < w) {
-            while (w > 0) {
-                int partW = Math.min(w, dx);
-                w -= partW;
-                int sx = x + w;
-                ob.Blit(theData, theData, comp, clip,
-                        sx, y, sx+dx, y+dy, partW, h);
+        try {
+            if (dy == 0 && dx > 0 && dx < w) {
+                while (w > 0) {
+                    int partW = Math.min(w, dx);
+                    w -= partW;
+                    int sx = Math.addExact(x, w);
+                    ob.Blit(theData, theData, comp, clip,
+                            sx, y, sx+dx, y+dy, partW, h);
+                }
+                return;
             }
-            return;
-        }
-        if (dy > 0 && dy < h && dx > -w && dx < w) {
-            while (h > 0) {
-                int partH = Math.min(h, dy);
-                h -= partH;
-                int sy = y + h;
-                ob.Blit(theData, theData, comp, clip,
-                        x, sy, x+dx, sy+dy, w, partH);
+            if (dy > 0 && dy < h && dx > -w && dx < w) {
+                while (h > 0) {
+                    int partH = Math.min(h, dy);
+                    h -= partH;
+                    int sy = Math.addExact(y, h);
+                    ob.Blit(theData, theData, comp, clip,
+                            x, sy, Math.addExact(x, dx), sy+dy, w, partH);
+                }
+                return;
             }
+            ob.Blit(theData, theData, comp, clip, x, y,
+                Math.addExact(x, dx), Math.addExact(y, dy), w, h);
+        } catch (ArithmeticException ex) {
+            // We are hitting integer overflow in Math.addExact()
             return;
         }
-            ob.Blit(theData, theData, comp, clip, x, y, x+dx, y+dy, w, h);
     }
 
     /*

src/java.desktop/share/classes/sun/java2d/pipe/DrawImage.java

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2001, 2020, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2001, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -369,6 +369,13 @@ protected void renderImageXform(SunGraphics2D sg, Image img,
         final AffineTransform itx;
         try {
             itx = tx.createInverse();
+            double[] mat = new double[6];
+            itx.getMatrix(mat);
+            for (double d : mat) {
+                if (!Double.isFinite(d)) {
+                    return;
+                }
+            }
         } catch (final NoninvertibleTransformException ignored) {
             // Non-invertible transform means no output
             return;

src/java.desktop/share/native/libawt/java2d/SurfaceData.h

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 1999, 2024, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -32,6 +32,7 @@
 #define _Included_SurfaceData
 
 #include <jni.h>
+#include <limits.h>
 
 #ifdef __cplusplus
 extern "C" {
@@ -53,6 +54,14 @@ typedef struct {
 
 #define SD_RASINFO_PRIVATE_SIZE         64
 
+#define UNSAFE_TO_ADD(a, b) \
+    (((a >= 0) && (b >= 0) && (a > (INT_MAX - b))) || \
+     ((a < 0) && (b < 0) && (a < (INT_MIN - b)))) \
+
+#define UNSAFE_TO_SUB(a, b) \
+    (((b >= 0) && (a < 0) && (a < (INT_MIN + b))) || \
+     ((b < 0) && (a >= 0) && (-b > (INT_MAX - a)))) \
+
 /*
  * The SurfaceDataRasInfo structure is used to pass in and return various
  * pieces of information about the destination drawable.  In particular: