--- a/.hgtags	Thu May 28 20:52:47 2015 -0700
+++ b/.hgtags	Wed Jun 03 20:27:36 2015 -0700
@@ -666,3 +666,5 @@
 ab2353694ea7fd4907c5c88b8334f8feaafca8c7 jdk8u60-b16
 5efc25c367164b6856554b0d625f3c422fdf9558 hs25.60-b17
 c26d09f1065cd26bd8b926efc5d3938b71e09eb5 jdk8u60-b17
+624f4cc05e7e95dd2103f343c54d7bdea6a81919 hs25.60-b18
+3fa5c654c143fe309e5ddda92adc5fb132365bcf jdk8u60-b18

--- a/make/hotspot_version	Thu May 28 20:52:47 2015 -0700
+++ b/make/hotspot_version	Wed Jun 03 20:27:36 2015 -0700
@@ -35,7 +35,7 @@
 
 HS_MAJOR_VER=25
 HS_MINOR_VER=60
-HS_BUILD_NUMBER=17
+HS_BUILD_NUMBER=18
 
 JDK_MAJOR_VER=1
 JDK_MINOR_VER=8

--- a/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp	Thu May 28 20:52:47 2015 -0700
+++ b/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp	Wed Jun 03 20:27:36 2015 -0700
@@ -75,7 +75,7 @@
     assert((uintptr_t)end % mapping_granularity_in_bytes == 0,
       err_msg("end mapping area address must be a multiple of mapping granularity %zd, is " PTR_FORMAT,
         mapping_granularity_in_bytes, p2i(end)));
-    size_t num_target_elems = (end - bottom) / (mapping_granularity_in_bytes / HeapWordSize);
+    size_t num_target_elems = pointer_delta(end, bottom, mapping_granularity_in_bytes);
     idx_t bias = (uintptr_t)bottom / mapping_granularity_in_bytes;
     address base = create_new_base_array(num_target_elems, target_elem_size_in_bytes);
     initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes, log2_intptr(mapping_granularity_in_bytes));

--- a/src/share/vm/opto/phaseX.cpp	Thu May 28 20:52:47 2015 -0700
+++ b/src/share/vm/opto/phaseX.cpp	Wed Jun 03 20:27:36 2015 -0700
@@ -1521,11 +1521,12 @@
       set_type(n, t);
       for (DUIterator_Fast imax, i = n->fast_outs(imax); i < imax; i++) {
         Node* m = n->fast_out(i);   // Get user
-        if( m->is_Region() ) {  // New path to Region?  Must recheck Phis too
+        if (m->is_Region()) {  // New path to Region?  Must recheck Phis too
           for (DUIterator_Fast i2max, i2 = m->fast_outs(i2max); i2 < i2max; i2++) {
             Node* p = m->fast_out(i2); // Propagate changes to uses
-            if( p->bottom_type() != type(p) ) // If not already bottomed out
+            if (p->bottom_type() != type(p)) { // If not already bottomed out
               worklist.push(p); // Propagate change to user
+            }
           }
         }
         // If we changed the receiver type to a call, we need to revisit
@@ -1535,12 +1536,31 @@
         if (m->is_Call()) {
           for (DUIterator_Fast i2max, i2 = m->fast_outs(i2max); i2 < i2max; i2++) {
             Node* p = m->fast_out(i2);  // Propagate changes to uses
-            if (p->is_Proj() && p->as_Proj()->_con == TypeFunc::Control && p->outcnt() == 1)
+            if (p->is_Proj() && p->as_Proj()->_con == TypeFunc::Control && p->outcnt() == 1) {
               worklist.push(p->unique_out());
+            }
           }
         }
-        if( m->bottom_type() != type(m) ) // If not already bottomed out
+        if (m->bottom_type() != type(m)) { // If not already bottomed out
           worklist.push(m);     // Propagate change to user
+        }
+
+        // CmpU nodes can get their type information from two nodes up in the
+        // graph (instead of from the nodes immediately above). Make sure they
+        // are added to the worklist if nodes they depend on are updated, since
+        // they could be missed and get wrong types otherwise.
+        uint m_op = m->Opcode();
+        if (m_op == Op_AddI || m_op == Op_SubI) {
+          for (DUIterator_Fast i2max, i2 = m->fast_outs(i2max); i2 < i2max; i2++) {
+            Node* p = m->fast_out(i2); // Propagate changes to uses
+            if (p->Opcode() == Op_CmpU) {
+              // Got a CmpU which might need the new type information from node n.
+              if(p->bottom_type() != type(p)) { // If not already bottomed out
+                worklist.push(p); // Propagate change to user
+              }
+            }
+          }
+        }
       }
     }
   }

--- a/src/share/vm/prims/jniCheck.cpp	Thu May 28 20:52:47 2015 -0700
+++ b/src/share/vm/prims/jniCheck.cpp	Wed Jun 03 20:27:36 2015 -0700
@@ -185,6 +185,9 @@
  * throw an ArrayIndexOutOfBoundsException or ArrayStoreException.
  *
  * In all other cases, a non-error return value guarantees that no exceptions have been thrown.
+ *
+ * Programmers often defend against ArrayIndexOutOfBoundsException, so warning
+ * for these functions would be pedantic.
  */
 static inline void
 check_pending_exception(JavaThread* thr) {
@@ -201,6 +204,16 @@
   }
 }
 
+/**
+ * Add to the planned number of handles. I.e. plus current live & warning threshold
+ */
+static inline void
+add_planned_handle_capacity(JNIHandleBlock* handles, size_t capacity) {
+  handles->set_planned_capacity(capacity +
+                                handles->get_number_of_live_handles() +
+                                CHECK_JNI_LOCAL_REF_CAP_WARN_THRESHOLD);
+}
+
 
 static inline void
 functionEnterCritical(JavaThread* thr)
@@ -243,7 +256,7 @@
       thr->print_stack();
     )
     // Complain just the once, reset to current + warn threshold
-    handles->set_planned_capacity(live_handles + CHECK_JNI_LOCAL_REF_CAP_WARN_THRESHOLD);
+    add_planned_handle_capacity(handles, 0);
   }
 }
 
@@ -720,7 +733,7 @@
       NativeReportJNIFatalError(thr, "negative capacity");
     jint result = UNCHECKED()->PushLocalFrame(env, capacity);
     if (result == JNI_OK) {
-      thr->active_handles()->set_planned_capacity(capacity + CHECK_JNI_LOCAL_REF_CAP_WARN_THRESHOLD);
+      add_planned_handle_capacity(thr->active_handles(), capacity);
     }
     functionExit(thr);
     return result;
@@ -824,7 +837,7 @@
     }
     jint result = UNCHECKED()->EnsureLocalCapacity(env, capacity);
     if (result == JNI_OK) {
-      thr->active_handles()->set_planned_capacity(capacity + CHECK_JNI_LOCAL_REF_CAP_WARN_THRESHOLD);
+      add_planned_handle_capacity(thr->active_handles(), capacity);
     }
     functionExit(thr);
     return result;
@@ -1628,7 +1641,6 @@
       check_is_obj_array(thr, array);
     )
     jobject result = UNCHECKED()->GetObjectArrayElement(env,array,index);
-    thr->set_pending_jni_exception_check("GetObjectArrayElement");
     functionExit(thr);
     return result;
 JNI_END
@@ -1643,7 +1655,6 @@
       check_is_obj_array(thr, array);
     )
     UNCHECKED()->SetObjectArrayElement(env,array,index,val);
-    thr->set_pending_jni_exception_check("SetObjectArrayElement");
     functionExit(thr);
 JNI_END
 
@@ -1733,7 +1744,6 @@
       check_primitive_array_type(thr, array, ElementTag); \
     ) \
     UNCHECKED()->Get##Result##ArrayRegion(env,array,start,len,buf); \
-    thr->set_pending_jni_exception_check("Get"#Result"ArrayRegion"); \
     functionExit(thr); \
 JNI_END
 
@@ -1758,7 +1768,6 @@
       check_primitive_array_type(thr, array, ElementTag); \
     ) \
     UNCHECKED()->Set##Result##ArrayRegion(env,array,start,len,buf); \
-    thr->set_pending_jni_exception_check("Set"#Result"ArrayRegion"); \
     functionExit(thr); \
 JNI_END
 
@@ -1835,7 +1844,6 @@
       checkString(thr, str);
     )
     UNCHECKED()->GetStringRegion(env, str, start, len, buf);
-    thr->set_pending_jni_exception_check("GetStringRegion");
     functionExit(thr);
 JNI_END
 
@@ -1850,7 +1858,6 @@
       checkString(thr, str);
     )
     UNCHECKED()->GetStringUTFRegion(env, str, start, len, buf);
-    thr->set_pending_jni_exception_check("GetStringUTFRegion");
     functionExit(thr);
 JNI_END
 

--- a/test/TEST.groups	Thu May 28 20:52:47 2015 -0700
+++ b/test/TEST.groups	Wed Jun 03 20:27:36 2015 -0700
@@ -149,6 +149,8 @@
 # Tests that require compact3 API's
 #
 needs_compact3 = \
+  compiler/jsr292/RedefineMethodUsedByMultipleMethodHandles.java \
+  compiler/rangechecks/TestRangeCheckSmearing.java \
   compiler/whitebox/DeoptimizeMethodTest.java \
   compiler/whitebox/SetForceInlineMethodTest.java \
   compiler/whitebox/SetDontInlineMethodTest.java \
@@ -159,6 +161,7 @@
   compiler/whitebox/IsMethodCompilableTest.java \
   gc/6581734/Test6581734.java \
   gc/7072527/TestFullGCCount.java \
+  gc/TestGCLogRotationViaJcmd.java \
   gc/g1/TestHumongousAllocInitialMark.java \
   gc/g1/TestHumongousShrinkHeap.java \
   gc/arguments/TestG1HeapRegionSize.java \
@@ -177,6 +180,7 @@
   serviceability/threads/TestFalseDeadLock.java \
   serviceability/jvmti/GetObjectSizeOverflow.java \
   serviceability/jvmti/TestRedefineWithUnresolvedClass.java \
+  serviceability/sa/jmap-hashcode/Test8028623.java \
   compiler/tiered/NonTieredLevelsTest.java \
   compiler/tiered/TieredLevelsTest.java \
   compiler/intrinsics/bmi/verifycode

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/test/compiler/types/TestTypePropagationToCmpU.java	Wed Jun 03 20:27:36 2015 -0700
@@ -0,0 +1,59 @@
+/*
+ * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test
+ * @bug 8080156 8060036
+ * @summary Test correctness of type propagation to CmpUNodes.
+ * @run main TestTypePropagationToCmpU
+ */
+public class TestTypePropagationToCmpU {
+    public static void main(String[] args) {
+        try {
+            // Trigger compilation
+            for (int i = 0; i < 100_000; ++i) {
+                test();
+            }
+        } catch (NullPointerException e) {
+            // Test should never throw a NullPointerException
+            throw new RuntimeException("Test failed");
+        }
+    }
+
+    static int global = 42;
+
+    public static void test() {
+        int a = Integer.MIN_VALUE;
+        int b = global;
+        char[] buf = { 0 };
+        for (int i = 0; i <= b; ++i) {
+            a = i - b;
+        }
+        // C2 adds a range check and an uncommon trap here to ensure that the array index
+        // is in bounds. If type information is not propagated correctly to the corresponding
+        // CmpUNode, this trap may be always taken. Because C2 also removes the unnecessary
+        // allocation of 'buf', a NullPointerException is thrown in this case.
+        char c = buf[(a * 11) / 2 - a]; // a is 0 here if global >= 0
+        buf[0] = 0;
+    }
+}

--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/test/gc/g1/Test2GbHeap.java	Wed Jun 03 20:27:36 2015 -0700
@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2014, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+ * or visit www.oracle.com if you need additional information or have any
+ * questions.
+ */
+
+/*
+ * @test Test2GbHeap
+ * @bug 8031686
+ * @summary Regression test to ensure we can start G1 with 2gb heap.
+ * @key gc
+ * @key regression
+ * @library /testlibrary
+ */
+
+import java.util.ArrayList;
+
+import com.oracle.java.testlibrary.OutputAnalyzer;
+import com.oracle.java.testlibrary.ProcessTools;
+
+public class Test2GbHeap {
+  public static void main(String[] args) throws Exception {
+    ArrayList<String> testArguments = new ArrayList<String>();
+
+    testArguments.add("-XX:+UseG1GC");
+    testArguments.add("-Xmx2g");
+    testArguments.add("-version");
+
+    ProcessBuilder pb = ProcessTools.createJavaProcessBuilder(testArguments.toArray(new String[0]));
+
+    OutputAnalyzer output = new OutputAnalyzer(pb.start());
+
+    // Avoid failing test for setups not supported.
+    if (output.getOutput().contains("Could not reserve enough space for 2097152KB object heap")) {
+      // Will fail on machines with too little memory (and Windows 32-bit VM), ignore such failures.
+      output.shouldHaveExitValue(1);
+    } else if (output.getOutput().contains("G1 GC is disabled in this release")) {
+      // G1 is not supported on embedded, ignore such failures.
+      output.shouldHaveExitValue(1);
+    } else {
+      // Normally everything should be fine.
+      output.shouldHaveExitValue(0);
+    }
+  }
+}