Status fields:
| creation_ts: | 2008-12-26 13:17 |
|---|---|
| component: | vm |
| version: | unspecified |
| rep_platform: | All |
| op_sys: | All |
| bug_status: | RESOLVED |
| resolution: | FIXED |
| reporter: | michi@complang.tuwien.ac.at |
When accessing an array of boxed elements (ex. java.lang.Integer[]) via reflection, the
VM segfaults. The problem is that our array access functions (ie. array_element_set)
unbox the boxed primitive ignoring the actual type of the destination array. This leads
to the primitive value being written into the object-array. The following is a snippet
of the SEGV log:
LOG: [0x00002aaaab2346d0] We received a SIGSEGV and tried to handle it, but we were
LOG: [0x00002aaaab2346d0] unable to find a Java method at:
LOG: [0x00002aaaab2346d0]
LOG: [0x00002aaaab2346d0] PC=0x00002aaaab308311
LOG: [0x00002aaaab2346d0]
LOG: [0x00002aaaab2346d0] Dumping the current stacktrace:
at java.lang.reflect.Array.set(Ljava/lang/Object;ILjava/lang/Object;)V(Native
Method)
at PR119.test()V(PR119.java:37)
[...]
I have already written a regression test and will commit it in a second. I have only
tested this with OpenJDK so far, but I suspect GNU Classpath is not being affected. This
is a critical bug because it can be exploited easily.
This is the fix: http://mips.complang.tuwien.ac.at/hg/cacao/rev/c9d8153b15bc