FULL PRODUCT VERSION :
java version "1.6.0_15"
Java(TM) SE Runtime Environment (build 1.6.0_15-b03-219)
Java HotSpot(TM) 64-Bit Server VM (build 14.1-b02-90, mixed mode)


FULL OS VERSION :
This bug occurs on all platforms.

A DESCRIPTION OF THE PROBLEM :
By inspection of source code of the client compiler, I have discovered that it does not recognize the default branch of a lookupswitch or tableswitch bytecode to be a safepoint (if the default target is backwards). Typically this type of bytecode does not occur in javac-generated class files.



STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Inspect the HotSpot Client Compiler source code file:

src/share/vm/c1/c1_GraphBuilder.cpp @ 1251 and 1286:

    // add default successor
    sux->at_put(i, block_at(bci() + switch_->default_offset()));
    ValueStack* state_before = has_bb ? state() : NULL;
    append(new TableSwitch(ipop(), sux, switch_->low_key(), state_before, has_bb));



EXPECTED VERSUS ACTUAL BEHAVIOR :
A tableswitch or lookupswitch bytecode in which the default successor is a backward branch should be marked as a safepoint. The actual result is that such an instruction is not marked as a safepoint; this could lead to a long-running (or even non-terminating) loop in the compiled code without a safepoint.
ERROR MESSAGES/STACK TRACES THAT OCCUR :
Could result in VM crash.

REPRODUCIBILITY :
This bug can be reproduced always.

---------- BEGIN SOURCE ----------
Javac will not generate bytecode that demonstrates the bug. Jasm or similar must be used to construct such a test case.


---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
The c1_GraphBuilder.cpp code should include the line

   has_bb |= switch_->default_offset() < 0;

For both lookupswitch and tableswitch at the above mentioned lines.