JDK-8237524 : AArch64: String.compareTo() may return incorrect result
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 11,12,13,14,15
  • Priority: P4
  • Status: Resolved
  • Resolution: Fixed
  • OS: linux
  • CPU: aarch64
  • Submitted: 2020-01-20
  • Updated: 2020-11-19
  • Resolved: 2020-01-29
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 15
11.0.10Fixed 15 b08Fixed
Related Reports
Relates :  
Relates :  
Relates :  
Description
AArch64 String.compareTo() may return incorrect result in some corner
cases. This issue can be reproduced in below program by constructing two
strings from the same byte array but with different encoding options.

import java.lang.reflect.Constructor;

public class Test {
  public static void main(String[] args) throws Exception {
    Constructor<String> c = String.class.getDeclaredConstructor(byte[].class, byte.class);
    c.setAccessible(true);

    byte[] bytes = new byte[] {
      'Y', 'm', '_', 'l', 'V', 'n', 'W', 'S', 'w', 'm', 'W', 'S'
    };

    String s1 = c.newInstance(bytes, (byte) 0);
    String s2 = c.newInstance(bytes, (byte) 1);
    System.out.println(s1.compareTo(s2));
  }
}

// $ java -Xint Test
// -27904
// $ java -Xcomp -XX:-TieredCompilation Test
// 6

Comments
Fix Request (11u) This fixes a corner case in AArch64 intrinsic. Patch applies cleanly to 11u. New patch fails without the patch, passes with it. Patched 11u passes tier1.
23-09-2020

I think you can, in principle, end up having two Strings with the same backing array, but two different coders. For example, de-duplication code (not in its current form, though?) may decide to share the arrays regardless of coder.
23-09-2020

URL: https://hg.openjdk.java.net/jdk/jdk/rev/b53fdc9fd058 User: adinn Date: 2020-01-29 10:16:29 +0000
29-01-2020

change JBS type to enhancement as the incorrect result can only happen if strings are constructed with non-public constructors
21-01-2020

ok to be fixed in 15. patch review thread: http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2020-January/036790.html
21-01-2020

Adding Fix-Version as 15 for now. Please modify if wrong. Thanks.
21-01-2020