1 files changed, 8 insertions, 4 deletions
diff --git a/runtime/mirror/array-inl.h b/runtime/mirror/array-inl.h
index 2bdf8277cd..8f81ae5c1a 100644
--- a/runtime/mirror/array-inl.h
+++ b/runtime/mirror/array-inl.h
@@ -36,11 +36,15 @@ inline uint32_t Array::ClassSize(PointerSize pointer_size) {
   return Class::ComputeClassSize(true, vtable_entries, 0, 0, 0, 0, 0, pointer_size);
 }
 
-template<VerifyObjectFlags kVerifyFlags, ReadBarrierOption kReadBarrierOption>
+template <VerifyObjectFlags kVerifyFlags, ReadBarrierOption kReadBarrierOption, bool kIsObjArray>
 inline size_t Array::SizeOf() {
-  size_t component_size_shift =
-      GetClass<kVerifyFlags, kReadBarrierOption>()
-      ->template GetComponentSizeShift<kReadBarrierOption>();
+  // When we are certain that this is a object array, then don't fetch shift
+  // from component_type_ as that doesn't work well with userfaultfd GC as the
+  // component-type class may be allocated at a higher address than the array.
+  size_t component_size_shift = kIsObjArray ?
+                                    Primitive::ComponentSizeShift(Primitive::kPrimNot) :
+                                    GetClass<kVerifyFlags, kReadBarrierOption>()
+                                        ->template GetComponentSizeShift<kReadBarrierOption>();
   // Don't need to check this since we already check this in GetClass.
   int32_t component_count =
       GetLength<static_cast<VerifyObjectFlags>(kVerifyFlags & ~kVerifyThis)>();