# HG changeset patch
# User johnc
# Date 1275957964 25200
# Node ID d53d91cb378c13ab90610da3a90778d50785934d
# Parent  193a468093fa03c2a5293ebfd180480b43a2f249
6953058: G1: A bigapp crashes with SIGSEGV in compiled code
Summary: In C2's G1 post write barrier, the loads of the buffer and index fields from the DirtyCardQueue structure may be moved across a safepoint. Use the current value of "control" in the C2 IR to limit how far these loads can move.
Reviewed-by: never, iveresov, kvn

diff -r 193a468093fa -r d53d91cb378c src/share/vm/opto/graphKit.cpp
--- a/src/share/vm/opto/graphKit.cpp	Wed May 26 00:30:39 2010 -0700
+++ b/src/share/vm/opto/graphKit.cpp	Mon Jun 07 17:46:04 2010 -0700
@@ -3492,7 +3492,6 @@
 
   Node* tls = __ thread(); // ThreadLocalStorage
 
-  Node* no_ctrl = NULL;
   Node* no_base = __ top();
   float likely  = PROB_LIKELY(0.999);
   float unlikely  = PROB_UNLIKELY(0.999);
@@ -3516,10 +3515,10 @@
   Node* index_adr =  __ AddP(no_base, tls, __ ConX(index_offset));
 
   // Now some values
-
-  Node* index  = __ load(no_ctrl, index_adr, TypeInt::INT, T_INT, Compile::AliasIdxRaw);
-  Node* buffer = __ load(no_ctrl, buffer_adr, TypeRawPtr::NOTNULL, T_ADDRESS, Compile::AliasIdxRaw);
-
+  // Use ctrl to avoid hoisting these values past a safepoint, which could
+  // potentially reset these fields in the JavaThread.
+  Node* index  = __ load(__ ctrl(), index_adr, TypeInt::INT, T_INT, Compile::AliasIdxRaw);
+  Node* buffer = __ load(__ ctrl(), buffer_adr, TypeRawPtr::NOTNULL, T_ADDRESS, Compile::AliasIdxRaw);
 
   // Convert the store obj pointer to an int prior to doing math on it
   // Must use ctrl to prevent "integerized oop" existing across safepoint