# HG changeset patch
# User roland
# Date 1340005951 -7200
# Node ID eeb819cf36e5162d747abe6794d760d27d87ee22
# Parent  8c92982cbbc48af3b01bc07cc1ee3e9b3ffb6517
7174363: Arrays.copyOfRange leads to VM crash with -Xcomp -server if executed by testing framework
Summary: Arrays.copyOfRange(original, from, to) with from > original.length tries to do a copy with a negative length.
Reviewed-by: kvn, twisti

diff -r 8c92982cbbc4 -r eeb819cf36e5 src/share/vm/opto/library_call.cpp
--- a/src/share/vm/opto/library_call.cpp	Fri Jun 15 01:25:19 2012 -0700
+++ b/src/share/vm/opto/library_call.cpp	Mon Jun 18 09:52:31 2012 +0200
@@ -3592,8 +3592,10 @@
     }
 
     // Bail out if length is negative.
-    // ...Not needed, since the new_array will throw the right exception.
-    //generate_negative_guard(length, bailout, &length);
+    // Without this the new_array would throw
+    // NegativeArraySizeException but IllegalArgumentException is what
+    // should be thrown
+    generate_negative_guard(length, bailout, &length);
 
     if (bailout->req() > 1) {
       PreserveJVMState pjvms(this);
@@ -3617,7 +3619,9 @@
       // Extreme case:  Arrays.copyOf((Integer[])x, 10, String[].class).
       // This will fail a store-check if x contains any non-nulls.
       bool disjoint_bases = true;
-      bool length_never_negative = true;
+      // if start > orig_length then the length of the copy may be
+      // negative.
+      bool length_never_negative = !is_copyOfRange;
       generate_arraycopy(TypeAryPtr::OOPS, T_OBJECT,
                          original, start, newcopy, intcon(0), moved,
                          disjoint_bases, length_never_negative);
diff -r 8c92982cbbc4 -r eeb819cf36e5 test/compiler/7174363/Test7174363.java
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/test/compiler/7174363/Test7174363.java	Mon Jun 18 09:52:31 2012 +0200
@@ -0,0 +1,49 @@
+/*
+ * Copyright (c) 2012, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ *
+ */
+
+/**
+ * @test
+ * @bug 7174363
+ * @summary crash with Arrays.copyOfRange(original, from, to) when from > original.length
+ *
+ * @run main/othervm -XX:-BackgroundCompilation Test7174363
+ */
+
+import java.util.*;
+
+public class Test7174363 {
+
+  static Object[] m(Object[] original, int from, int to) {
+    return Arrays.copyOfRange(original, from, to, Object[].class);
+  }
+
+  static public void main(String[] args) {
+    Object[] orig = new Object[10];
+    for (int i = 0; i < 20000; i++) {
+      try {
+        m(orig, 15, 20);
+      } catch(ArrayIndexOutOfBoundsException excp) {}
+    }
+  }
+}