JDK-8218966 : AArch64: String.compareTo() can read memory after string
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 11,12,13
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: linux
  • CPU: aarch64
  • Submitted: 2019-02-14
  • Updated: 2020-11-19
  • Resolved: 2019-05-22
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 13
11.0.11-oracleFixed 13 b22Fixed
Related Reports
Relates :  
JDK-8202326 - AARCH64: optimize string compare intrinsic
Relates :  
JDK-8218748 - AARCH64: String::compareTo intrinsic documentation and maintenance improvement
Description
There is a bug in stub code of AArch64 String.compareTo() intrinsics. It can be reproduced by below Java code and VM options.

public class Test {
  public static void main(String[] args) {
    String str1 = "/home/pengfei/backup/Android/projects/ActionBarSherlock/tree/master/actionbarsherlock/res/";
    String str2 = "/home/pengfei/backup/Android/projects/ActionBarSherlock/tree/master/actionbarsherlock/res/\u6d4b\u8bd5.png";
    System.out.println(str1.compareTo(str2));
  }
}

// $ java -Xint Test
// -6
// $ java -Xcomp -XX:-TieredCompilation -XX:-Inline Test
// -27979
Comments
Fix Request(11u): String.compareTo() is important part of API. It must be correct for all cases. Risk: Small. Only AARCH64 is affected. Original fix is pushed several month ago into jdk_jdk and no problems found so far. Testing: tier1 hotspot jtreg tests + jck Review thread: https://mail.openjdk.java.net/pipermail/jdk-updates-dev/2019-August/001727.html
22-08-2019
A proposed fix from dpochepk http://cr.openjdk.java.net/~dpochepk/8218966/webrev/
07-03-2019
The reason is not updated string counter in case string is not large enough for prefetch loop to be used. Then tail of this string is checked via 16-character loop. Then Intrinsic still return negative result, because of zeroed bytes after 1st string, but returned negative value is different from negative value returned via interpreter version and also memory after string is read.
14-02-2019
A revamp of this intrinsic is pre-reviewed with Pengfei, who agreed to participate in a testing effort. Thanks Pengfei!
14-02-2019