IJ57242: THE JIT FAILS TO PROTECT A PRIVATIZED LOAD FROM CAUSING AN ARRAY OVERRUN

APAR status

• Closed as program error.

Error description

• Error Message: A SIGSEGV/GPF is received while executing in JIT
  compiled code.
  .
  Stack Trace: N/A
  .
  The issue is caused by an attempt to read from an array using an
  index that might go beyond the end of the array as part of a
  loop privatization optimization. The result of the load will go
  unused in cases where the index is larger than the array length
  so no negative execution characteristics are possible, but in
  rare cases when the array exists near the end of the java heap,
  it's possible for a SIGSEGV to occur.
  In the example of this problem we have seen, the issue occurred
  in java/util/regex/Pattern$Branch.match() while processing a
  large Latin1 compressed (1 byte per character) String. The
  inlining of the uncompressed UTF16 path caused a load where the
  index was multiplied by 2 to account for a 2-byte per character
  String. This resulted in a unguarded load past the end of the
  java heap causing a SIGSEGV.
  

Local fix

• This Java command line parameter will avoid the problem by
  preventing the JIT from performing the inlining operation that
  allows the issue to occur.
  -Xjit:disableUnsafe
  The option may have a substantial performance impact. The impact
  can be limited by having the option only apply to a single
  method that is known to suffer from this issue.
  -Xjit:{<method_signature>}(disableUnsafe)
  Where <method_signature> is replaced with the method name as
  seen in the Javacore file as the failing method.
  At the time of writing, we have only seen this issue cause
  problems for the Loop Versioner optimization. Therefore, using
  the following JIT option will likely avoid the issue while
  causing a lower performance impact.
  -Xjit:disableLoopVersioner
  or
  -Xjit:{<method_signature>}(disableLoopVersioner)
  

Problem summary

• When inlining some specific methods with array load operations,
  the load operation can be incorrectly flagged allowing the loop
  optimizer to skip some array length checks when privatizing the
  load.
  

Problem conclusion

• The JIT was modified to properly flag array load instructions
  .
  This APAR will be fixed in the following Releases:
  .
  IBM Semeru Runtimes
     21              21.0.5.0
     17              17.0.13.0
     11              11.0.25.0
  IBM SDK, Java Technology Edition
     8    SR8 FP35  (8.0.8.35)
  .
  Downloads and supplementary documentation can be found at the
  following locations:
  - For non z/OS operating systems:
    - IBM Semeru Runtimes, Version 11 and later
      https://www.ibm.com/semeru-runtimes/downloads/
    - IBM SDK, Java Technology Edition, Version 8
      https://www.ibm.com/support/pages/java-sdk-downloads/
  - For the z/OS operating system:
    - Java SDK Products on z/OS
      https://www.ibm.com/support/pages/java-sdk-products-zos
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  JIT

• Fixed component ID

  620700124

Applicable component levels