commit 7cf9af2ce0bb72c5bd2ff7c5bd82df5c05877355
author Mingyao Yang <mingyao@google.com> Tue Feb 06 15:02:42 2018 -0800
committer Mingyao Yang <mingyao@google.com> Wed Feb 07 10:33:41 2018 -0800
tree 7cd74d68e4a43e1e82bcf3ca49017db5a0a39fa6
parent 8bcecf915545581bf23b5348cd94d3f5ec6eb669

Do not eliminate array allocation if it may throw NegativeArraySizeException

Bug: 70023972
Test: run-test on host. 530-checker-lse.
Change-Id: I00e2d69f82b3dda21559ffcba827e0a52d900ff1

compiler/optimizing/load_store_elimination.cc

diff --git a/compiler/optimizing/load_store_elimination.cc b/compiler/optimizing/load_store_elimination.cc
index 8b4eae1..237ecd3 100644
--- a/compiler/optimizing/load_store_elimination.cc
+++ b/compiler/optimizing/load_store_elimination.cc
@@ -882,6 +882,7 @@
     }
     if (ref_info->IsSingletonAndRemovable() && !new_instance->NeedsChecks()) {
       DCHECK(!new_instance->IsFinalizable());
+      // new_instance can potentially be eliminated.
       singleton_new_instances_.push_back(new_instance);
     }
     ScopedArenaVector<HInstruction*>& heap_values =
@@ -904,7 +905,13 @@
       return;
     }
     if (ref_info->IsSingletonAndRemovable()) {
-      singleton_new_instances_.push_back(new_array);
+      if (new_array->GetLength()->IsIntConstant() &&
+          new_array->GetLength()->AsIntConstant()->GetValue() >= 0) {
+        // new_array can potentially be eliminated.
+        singleton_new_instances_.push_back(new_array);
+      } else {
+        // new_array may throw NegativeArraySizeException. Keep it.
+      }
     }
     ScopedArenaVector<HInstruction*>& heap_values =
         heap_values_for_[new_array->GetBlock()->GetBlockId()];

test/530-checker-lse/expected.txt

diff --git a/test/530-checker-lse/expected.txt b/test/530-checker-lse/expected.txt
index ddae16a..fb67e22 100644
--- a/test/530-checker-lse/expected.txt
+++ b/test/530-checker-lse/expected.txt
@@ -1 +1,2 @@
 java.lang.ArrayIndexOutOfBoundsException: length=3; index=3
+Got NegativeArraySizeException.

test/530-checker-lse/src/Main.java

diff --git a/test/530-checker-lse/src/Main.java b/test/530-checker-lse/src/Main.java
index 98838c5..ebde3bf 100644
--- a/test/530-checker-lse/src/Main.java
+++ b/test/530-checker-lse/src/Main.java
@@ -1052,6 +1052,23 @@
     return array[1] + array[i];
   }
 
+  /// CHECK-START: int Main.testAllocationEliminationOfArray5(int) load_store_elimination (before)
+  /// CHECK: NewArray
+  /// CHECK: ArraySet
+  /// CHECK: ArrayGet
+
+  /// CHECK-START: int Main.testAllocationEliminationOfArray5(int) load_store_elimination (after)
+  /// CHECK: NewArray
+  /// CHECK-NOT: ArraySet
+  /// CHECK-NOT: ArrayGet
+  private static int testAllocationEliminationOfArray5(int i) {
+    // Cannot eliminate array allocation due to unknown i that may
+    // cause NegativeArraySizeException.
+    int[] array = new int[i];
+    array[1] = 12;
+    return array[1];
+  }
+
   /// CHECK-START: int Main.testExitMerge(boolean) load_store_elimination (before)
   /// CHECK: NewInstance
   /// CHECK: InstanceFieldSet
@@ -1205,6 +1222,12 @@
     assertIntEquals(testAllocationEliminationOfArray2(), 11);
     assertIntEquals(testAllocationEliminationOfArray3(2), 4);
     assertIntEquals(testAllocationEliminationOfArray4(2), 6);
+    assertIntEquals(testAllocationEliminationOfArray5(2), 12);
+    try {
+      testAllocationEliminationOfArray5(-2);
+    } catch (NegativeArraySizeException e) {
+      System.out.println("Got NegativeArraySizeException.");
+    }
 
     assertIntEquals(testStoreStore().i, 41);
     assertIntEquals(testStoreStore().j, 43);