The problem is that ConvI2L nodes with a narrow type are not dependent on the corresponding range check that proves that the input value is always in the range. As a result, the ConvI2L node may flow above the range check during loop optimizations and end up with an input that is not in its type range (for example, in a peeled iteration of a loop). The node is then replaced by TOP causing the data path to be eliminated. However, because there is no control dependency to the corresponding range check, the path from the peeled iteration that uses the result of the ConvI2L may not be eliminated. We finally crash because we are using a value that is not available (for example, from the old loop body). For details, see TestLoopPeeling.java.

This problem may show up for array accesses but also for other places where we emit a ConvI2L node (for example, array allocation). We solved several instances of this problem in the past with "workaround-fixes" (JDK-6659207, JDK-4781451, JDK-4799512, JDK-6663854) but should implement a robust fix that makes ConvI2L nodes dependent on the range check.

The crash may look similar to this:

Bad graph detected in build_loop_late
n:  181	AddP	=== _  163  182  124  [[ 183 ]]  !jvms: TestLoopPeeling::testArrayAccess @ bci:43
early(n):  200	Loop	===  200  230  192  [[ 200  69  68  84 ]] inner  !orig=[65] !jvms: TestLoopPeeling::testArrayAccess @ bci:8
n->in(1):  163	CastPP	===  156  93  [[ 182  164  164  173  182  181 ]]  #int[int:>=0]:NotNull:exact * !jvms: TestLoopPeeling::testArrayAccess @ bci:43
early(n->in(1)):  156	IfTrue	===  155  [[ 168  163 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
n->in(1)->in(1):  93	DecodeN	=== _  92  [[ 108  95  163 ]]  #int[int:>=0]:exact * !jvms: TestLoopPeeling::testArrayAccess @ bci:20
early(n->in(1)->in(1)):  3	Start	===  3  0  [[ 3  5  6  7  8  9  10  11  12 ]]  #{0:control, 1:abIO, 2:memory, 3:rawptr:BotPTR, 4:return_address, 5:TestLoopPeeling:NotNull *, 6:int, 7:int}
n->in(2):  182	AddP	=== _  163  163  128  [[ 181 ]]  !jvms: TestLoopPeeling::testArrayAccess @ bci:43
early(n->in(2)):  200	Loop	===  200  230  192  [[ 200  69  68  84 ]] inner  !orig=[65] !jvms: TestLoopPeeling::testArrayAccess @ bci:8
n->in(2)->in(1):  163	CastPP	===  156  93  [[ 182  164  164  173  182  181 ]]  #int[int:>=0]:NotNull:exact * !jvms: TestLoopPeeling::testArrayAccess @ bci:43
early(n->in(2)->in(1)):  156	IfTrue	===  155  [[ 168  163 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
n->in(2)->in(2):  163	CastPP	===  156  93  [[ 182  164  164  173  182  181 ]]  #int[int:>=0]:NotNull:exact * !jvms: TestLoopPeeling::testArrayAccess @ bci:43
early(n->in(2)->in(2)):  156	IfTrue	===  155  [[ 168  163 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
n->in(2)->in(3):  128	LShiftL	=== _  126  127  [[ 130  182 ]]  !orig=254 !jvms: TestLoopPeeling::testArrayAccess @ bci:24
early(n->in(2)->in(3)):  200	Loop	===  200  230  192  [[ 200  69  68  84 ]] inner  !orig=[65] !jvms: TestLoopPeeling::testArrayAccess @ bci:8
n->in(3):  124	ConL	===  0  [[ 181  129 ]]  #long:16
early(n->in(3)):  0	Root	===  0  50  63  107  123  162  177  198  [[ 0  1  3  23  24  38  45  58  72  81  90  94  102  118  124  127 ]] 

LCA(n):  169	IfTrue	===  168  [[ 15  183 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
n->out(0):  183	StoreI	===  169  7  181  38  [[ 184 ]]  @int[int:>=0]:exact+any *, idx=6;  Memory: @int[int:>=0]:NotNull:exact+any *, idx=6; !jvms: TestLoopPeeling::testArrayAccess @ bci:43
later(n->out(0)):  169	IfTrue	===  168  [[ 15  183 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
n->out(0)->out(0):  184	Phi	===  15  7  7  183  7  [[ 18 ]]  #memory  Memory: @int[int:>=0]:exact+any *, idx=6; !orig=[17]
later(n->out(0)->out(0)):  15	Region	===  15  251  136  169  32  [[ 15  184  198 ]] 

idom[0]  169	IfTrue	===  168  [[ 15  183 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
idom[1]  168	RangeCheck	===  156  167  [[ 169  172 ]] P=0.999999, C=-1.000000 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
idom[2]  156	IfTrue	===  155  [[ 168  163 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
idom[3]  155	If	===  248  96  [[ 156  157 ]] P=0.999999, C=-1.000000 !jvms: TestLoopPeeling::testArrayAccess @ bci:43
idom[4]  248	Region	===  248  247  144  [[ 248  155  259 ]] 
idom[5]  226	If	===  233  206  [[ 227  247 ]] P=0.900000, C=-1.000000 !orig=142 !jvms: TestLoopPeeling::testArrayAccess @ bci:34
idom[6]  233	IfTrue	===  232  [[ 226 ]] #1 !orig=[76] !jvms: TestLoopPeeling::testArrayAccess @ bci:11
idom[7]  232	If	===  64  74  [[ 233  251 ]] P=0.900000, C=-1.000000 !orig=[75] !jvms: TestLoopPeeling::testArrayAccess @ bci:11
idom[8]  64	IfTrue	===  54  [[ 232 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:8
idom[9]  54	If	===  51  53  [[ 55  64 ]] P=0.999999, C=-1.000000 !jvms: TestLoopPeeling::testArrayAccess @ bci:8
idom[10]  51	IfTrue	===  41  [[ 54 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:8
idom[11]  41	If	===  28  40  [[ 42  51 ]] P=0.999999, C=-1.000000 !jvms: TestLoopPeeling::testArrayAccess @ bci:8
idom[12]  28	IfTrue	===  27  [[ 41 ]] #1 !jvms: TestLoopPeeling::testArrayAccess @ bci:5
idom[13]  27	If	===  5  26  [[ 28  29 ]] P=0.500000, C=-1.000000 !jvms: TestLoopPeeling::testArrayAccess @ bci:5
idom[14]  5	Parm	===  3  [[ 27 ]] Control !jvms: TestLoopPeeling::testArrayAccess @ bci:-1

# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc:  SuppressErrorAt=/loopnode.cpp:3545
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/oracle/8144212/hotspot/src/share/vm/opto/loopnode.cpp:3545), pid=14004, tid=14024
#  assert(false) failed: Bad graph detected in build_loop_late
#
# JRE version: Java(TM) SE Runtime Environment (9.0) (build 1.9.0-internal-fastdebug-tohartma_2015_11_30_14_45-b00)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (1.9.0-internal-fastdebug-tohartma_2015_11_30_14_45-b00, compiled mode, tiered, compressed oops, g1 gc, linux-amd64)
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %P" (or dumping to /oracle/6675699/hotspot/JTwork/scratch/core.14004)
#
# An error report file with more information is saved as:
# /oracle/6675699/hotspot/JTwork/scratch/hs_err_pid14004.log
#
# Compiler replay data is saved as:
# /oracle/6675699/hotspot/JTwork/scratch/replay_pid14004.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007f6472efe274, pid=14916, tid=140068918191872
#
# JRE version: Java(TM) SE Runtime Environment (8.0_11-b12) (build 1.8.0_11-b12)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (25.11-b03 compiled mode linux-amd64 compressed oops)
# Problematic frame:
# V  [libjvm.so+0x7a1274]  PhaseIdealLoop::build_loop_late_post(Node*)+0x144
#
# Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /oracle/6675699/hotspot/JTwork/scratch/hs_err_pid14916.log
#
# Compiler replay data is saved as:
# /oracle/6675699/hotspot/JTwork/scratch/replay_pid14916.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.sun.com/bugreport/crash.jsp
#