EVALUATION
The bug is in the following code produced by
InterpreterGenerator::generate_fixed_frame():
0xffffffff38c0b914: add %o2, 0x8, %o2
0xffffffff38c0b918: cmp %o2, %o1
0xffffffff38c0b91c: bleu,a,pt %icc,0xffffffff38c0b914
0xffffffff38c0b920: stx %g0, [%o2] <<<< SEGV here
0xffffffff38c0b924: mov 0x1, %g3
This code zeroes out the local variables when creating an interpreter frame.
However the branch instruction is incorrect on 64-bit SPARC. It should
test the %xcc condition codes instead of the %icc condition codes. This
bug will cause problems in the very rare situation when the region being
zeroed crosses a 4 Gb boundary.
The fix is to change this instruction to use the %xcc condition codes on
64-bit sparc. I will check for other cases of this type of error in
the other generated code.
###@###.### 2003-09-18
My analasis above of when this bug will cause a problem is not quite
correct. A problem occurs when the region being zeroed is at the end of,
or crosses a 4 Gb boundary. If the LSW of the address of end of the
memory region is 0xfffffff8, the loop does not properly terminate and
zeroes memory far beyond the the intended region (this is the cause of
the SEGV.) If the region crosses a 4 Gb boundary, the loop will not
execute at all.
###@###.### 2003-09-22
|
Java