Repository navigation
[JVM] Handle array component mirrors and reflective allocation safely - #552
Merged
Merged
Conversation
CaelmBleidd
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reflective array allocation could abort when Class.getComponentType read uninitialized JDK mirror fields, or when an input Class carried symbolic synthetic metadata. Resolve component classes from the engine's known type representatives, returning null for non-array classes. When a representative is unavailable, decline the approximation and let the existing execution path handle the call instead of casting symbolic metadata to a concrete reference.
Apply the same metadata contract to Array.newInstance and check its null component argument before reading memory, producing the modeled NullPointerException.
Validation: 11 focused tests pass with the pinned JacoDB. They cover primitive/reference/nested arrays, non-array/primitive/void/interface classes, reflective allocation/copying, raw symbolic Class inputs, and the null-component exception. The symbolic-metadata and null-component regressions fail before their respective fixes. Symbolic Class-input tests check machine execution without concrete Class reconstruction.
On the unchanged real ArrayUtils bytecode and full class denominator, the final ON diagnostic reaches 4279/5175 class-owned IR points with 2851 normal symbolic terminations and stops by timeout without an engine failure. getComponentType and Array.newInstance approximations execute 180 and 194 times. The configured budget is 10s and the machine loop takes 10.012s; the outer analysis timer is 12.950s and also includes machine construction and surrounding work. Native replay was disabled, so these are symbolic reachability/results, not native coverage or concrete correctness claims.