Note
Bug 8382937: [lworld] System.arraycopy can copy null into a null-restricted array
Fixed to detect null copying to null-restricted arrays in FlatArrayKlass::copy_array
Overview#
In Valhalla, there are two concepts of arrays: those that can handle null and those that cannot. However, when converting a flat array to a reference array using System.arraycopy, there was an issue where checks for writing null into non-null arrays were missing.
The problem occurred in the method FlatArrayKlass::copy_array. When elements are written to the destination during copying, it called obj_at_put but did not include a CHECK (which is a macro) to propagate any exception conditions back to the caller.
As a result, runtime checks for null-restricted arrays were not functioning as expected1.
oop o = sh->obj_at(src_pos + i, CHECK);
-dh->obj_at_put(dst_pos + i, o);
+dh->obj_at_put(dst_pos + i, o, CHECK);
The fix itself is just one line of code, but since it involves the invariant conditions for null-restricted arrays, a unit test ArrayCopyStoreNull.java was added to confirm that attempting to copy null into a null-restricted array using System.arraycopy throws a NullPointerException.
PR Created on 2026/06/24#
In the PR, I explained that in the path where flat arrays are copied to reference arrays, obj_at_put was called without passing a CHECK. This method extracts elements one by one from the source array and writes them into the destination array.
The added test ArrayCopyStoreNull.java first confirms that non-null values can be copied into null-restricted arrays. Then it attempts to copy null, which is placed in a nullable array, into a null-restricted array. If a NullPointerException is thrown here, the test passes1.
nullableArray[1] = null;
try {
System.arraycopy(nullableArray, 1, nullRestrictedArray, 1, 1);
} catch (NullPointerException expected) {
return;
}
Review on 2026/06/24-26#
Mr. Frederic Parain2 reviewed the fix and tests. His internal testing did not detect any issues, and he approved the PR.
Integrated on 2026/06/26#
After approval, /integrate was performed, and Mr. Parain sponsored it with /sponsor. The changes were ultimately integrated into the Valhalla lworld branch as commit 2752ad8[^4].
Footnotes#
-
8382937: [lworld] System.arraycopy can copy null into a null-restricted array by PeyaPeyaPeyang · Pull Request #2577 · …Fix null checking when copying from flat arrays to reference arrays. Previously, FlatArrayKlass::copy_array called obj_at_put without CHECK. As aresult, the runtime check for null…GitHub
↩ ↩2
-
https://openjdk.org/census#fparainopenjdk.org↩