Skip to content

8354323: Safeguard SwitchBootstraps.typeSwitch when used outside the compiler #25090

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+33 −6
Open

8354323: Safeguard SwitchBootstraps.typeSwitch when used outside the compiler #25090

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 16 additions & 6 deletions src/java.base/share/classes/java/lang/runtime/SwitchBootstraps.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -546,7 +546,11 @@ private static Consumer<CodeBuilder> generateTypeSwitchSkeleton(Class<?> selecto
Object caseLabel = caseLabels[idx];
cb.labelBinding(caseTargets[idx]);
if (caseLabel instanceof Class<?> classLabel) {
if (unconditionalExactnessCheck(selectorType, classLabel)) {
if (isNotValidPair(selectorType, caseLabel)){
cb.goto_(next);
continue;
}
else if (unconditionalExactnessCheck(selectorType, classLabel)) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we merge this into isNotValidPair(...) || unconditionalExactnessCheck(...) then do nothing? The next label is already in theory immediately bound to the instruction after goto.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The empty body means that we unconditionally return the index case 0 -> /*no if is generated*/ return 0;.

I confirmed that by merging, the following test would not pass. It returns erroneously 0, instead of 1.

testPrimitiveType((byte) 1, byte.class,0, 1, boolean.class, byte.class);

//nothing - unconditionally use this case
} else if (classLabel.isPrimitive()) {
if (!selectorType.isPrimitive() && !Wrapper.isWrapperNumericOrBooleanType(selectorType)) {
Expand Down Expand Up @@ -717,6 +721,11 @@ private static Consumer<CodeBuilder> generateTypeSwitchSkeleton(Class<?> selecto
};
}

private static boolean isNotValidPair(Class<?> selectorType, Object caseLabel) {
return (selectorType == boolean.class && caseLabel != boolean.class && caseLabel != Boolean.class) ||
(selectorType != boolean.class && selectorType.isPrimitive() && (caseLabel == boolean.class || caseLabel == Boolean.class));
}

/*
* Construct the method handle that represents the method int typeSwitch(Object, int, BiPredicate, List)
*/
Expand Down Expand Up @@ -769,11 +778,12 @@ private static boolean unconditionalExactnessCheck(Class<?> selectorType, Class<
return true;
}
else if (selectorType.equals(targetType) ||
((selectorType.equals(byte.class) && !targetType.equals(char.class)) ||
(selectorType.equals(short.class) && (selectorWrapper.isStrictSubRangeOf(targetWrapper))) ||
(selectorType.equals(char.class) && (selectorWrapper.isStrictSubRangeOf(targetWrapper))) ||
(selectorType.equals(int.class) && (targetType.equals(double.class) || targetType.equals(long.class))) ||
(selectorType.equals(float.class) && (selectorWrapper.isStrictSubRangeOf(targetWrapper))))) return true;
(targetType.isPrimitive() && selectorType.isPrimitive() &&
((selectorType.equals(byte.class) && !targetType.equals(char.class)) ||
(selectorType.equals(short.class) && (selectorWrapper.isStrictSubRangeOf(targetWrapper))) ||
(selectorType.equals(char.class) && (selectorWrapper.isStrictSubRangeOf(targetWrapper))) ||
(selectorType.equals(int.class) && (targetType.equals(double.class) || targetType.equals(long.class))) ||
(selectorType.equals(float.class) && (selectorWrapper.isStrictSubRangeOf(targetWrapper)))))) return true;
return false;
}

Expand Down
17 changes: 17 additions & 0 deletions test/jdk/java/lang/runtime/SwitchBootstrapsTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,12 @@ private void testType(Object target, int start, int result, Object... labels) th
assertEquals(-1, (int) indy.invoke(null, start));
}

private void testPrimitiveType(Object target, Class<?> targetType, int start, int result, Object... labels) throws Throwable {
MethodType switchType = MethodType.methodType(int.class, targetType, int.class);
MethodHandle indy = ((CallSite) BSM_TYPE_SWITCH.invoke(MethodHandles.lookup(), "", switchType, labels)).dynamicInvoker();
assertEquals((int) indy.invoke(target, start), result);
}

private void testEnum(Enum<?> target, int start, int result, Object... labels) throws Throwable {
testEnum(target.getClass(), target, start, result, labels);
}
Expand Down Expand Up @@ -132,6 +138,17 @@ public boolean equals(Object obj) {
}, 0, 1, 1L);
}

public void testPrimitiveTypes() throws Throwable {
testPrimitiveType((short) 1, short.class, 0, 1, String.class);
testPrimitiveType((byte) 1, byte.class,0, 1, String.class, byte.class);
testPrimitiveType(true, boolean.class,0, 1, false, boolean.class);
testPrimitiveType(1, int.class,0, 1, String.class);
testPrimitiveType(1, int.class,0, 1, true);
testPrimitiveType(true, boolean.class,0, 1, false);
testPrimitiveType((byte) 1, byte.class,0, 1, boolean.class, byte.class);
testPrimitiveType((byte) 1, byte.class,0, 1, Boolean.class, byte.class);
}

public void testEnums() throws Throwable {
testEnum(E1.A, 0, 2, "B", "C", "A", E1.class);
testEnum(E1.B, 0, 0, "B", "C", "A", E1.class);
Expand Down