JDK-8217359 : C2 compiler triggers SIGSEGV after transformation in ConvI2LNode::Ideal
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 8u192,9,11,11.0.1,12,13
  • Priority: P1
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2019-01-18
  • Updated: 2022-10-14
  • Resolved: 2019-01-23
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 12 JDK 13 JDK 8 Other
11.0.5Fixed 12 b29Fixed 13Fixed 8u361Fixed openjdk8u232Fixed
Related Reports
Duplicate :  
Description
Reduced test case:

public class Test {

public static int iFld=18932;
public static long vMeth_check_sum = 0;
public static long instanceCount=36887L;

public static void vMeth() {
short s=-25632;
float f=0.512F, f1=2.556F;
int i6=32547, i7=9, i8=-9, i9=36, i10=-223;

for (i6 = 4; i6 < 182; i6++) {
i8 = 1;
while (++i8 < 17) {
f1 = 1;
do

{ i7 += (182 + (f1 * f1)); }

while (++f1 < 1);

Test.iFld += (i8 | Test.iFld);
}
}

for (i9 = 9; i9 < 100; ++i9)

{ i10 -= i6; i10 >>= s; i7 += (((i9 * i10) + i6) - Test.instanceCount); }

vMeth_check_sum += i6 + i7 + i8;
}

public static void main(String[] strArr) {
for (int i = 0; i < 16000; i++)

{ vMeth(); }

}
}

 

Command line: java -XX:-TieredCompilation -XX:CompileCommand=compileonly,Test.vMeth -XX:+UseSerialGC -XX:CICompilerCount=1 Test

Error message:

CompileCommand: compileonly Test.vMeth

To suppress the following error report, specify this argument
after -XX: or in .hotspotrc: SuppressErrorAt=/phaseX.hpp:215
#
A fatal error has been detected by the Java Runtime Environment:
#
Internal Error (/home/yangfei/jdk-jdk/src/hotspot/share/opto/phaseX.hpp:215), pid=31053, tid=31066
assert(n != __null) failed: must not be null
#
JRE version: OpenJDK Runtime Environment (13.0) (slowdebug build 13-internal+0-adhoc.yangfei.jdk-jdk)
Java VM: OpenJDK 64-Bit Server VM (slowdebug 13-internal+0-adhoc.yangfei.jdk-jdk, mixed mode, sharing, compressed oops, serial gc, linux-amd64)
Problematic frame:
V [libjvm.so+0x556f13] PhaseTransform::type(Node const*) const+0x7d
#
Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %P" (or dumping to /home/yangfei/test/C2/core.31053)
#
An error report file with more information is saved as:
/home/yangfei/test/C2/hs_err_pid31053.log
#
Compiler replay data is saved as:
/home/yangfei/test/C2/replay_pid31053.log
#
If you would like to submit a bug report, please visit:
http://bugreport.java.com/bugreport/crash.jsp
#
Current thread is 31066
Dumping core ...
Aborted (core dumped)
 

Crash log:

25 --------------- T H R E A D ---------------
26
27 Current thread (0x00007f8c68120000): JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=31066, stack(0x00007f8c580a4000,0x00007f8c581a5000)]
28
29
30 Current CompileTask:
31 C2: 1697 1 Test::vMeth (164 bytes)
32
33 Stack: [0x00007f8c580a4000,0x00007f8c581a5000], sp=0x00007f8c581a0260, free space=1008k
34 Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
35 V [libjvm.so+0x556f13] PhaseTransform::type(Node const*) const+0x7d
36 V [libjvm.so+0x552463] AddNode::Ideal(PhaseGVN*, bool)+0x42b
37 V [libjvm.so+0x554331] AddLNode::Ideal(PhaseGVN*, bool)+0xa7d
38 V [libjvm.so+0x10c71a1] PhaseGVN::apply_ideal(Node*, bool)+0x6b
39 V [libjvm.so+0x10c8f16] PhaseIterGVN::transform_old(Node*)+0x3b6
40 V [libjvm.so+0x10c89df] PhaseIterGVN::optimize()+0x12f
41 V [libjvm.so+0xecb7bf] PhaseMacroExpand::expand_macro_nodes()+0xb73
42 V [libjvm.so+0x85de9b] Compile::Optimize()+0xdef
43 V [libjvm.so+0x8564c8] Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0x11e6
44 V [libjvm.so+0x71812f] C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x14b
45 V [libjvm.so+0x8738f8] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x790
46 V [libjvm.so+0x87260e] CompileBroker::compiler_thread_loop()+0x3ea
47 V [libjvm.so+0x13299be] compiler_thread_entry(JavaThread*, Thread*)+0x83
48 V [libjvm.so+0x1324698] JavaThread::thread_main_inner()+0x17c
49 V [libjvm.so+0x132451a] JavaThread::run()+0x150
50 V [libjvm.so+0x1320686] Thread::call_run()+0x1c6
51 V [libjvm.so+0x1053536] thread_native_entry(Thread*)+0x1f6

 

Simple proposed fix:

diff -r d633be26e59b src/hotspot/share/opto/convertnode.cpp
— a/src/hotspot/share/opto/convertnode.cpp Mon Jan 14 20:56:15 2019 -0500
+++ b/src/hotspot/share/opto/convertnode.cpp Tue Jan 15 13:18:07 2019 +0800
@@ -393,7 +393,11 @@
assert(rxlo == (int)rxlo && rxhi == (int)rxhi, "x should not overflow");
assert(rylo == (int)rylo && ryhi == (int)ryhi, "y should not overflow");
Node* cx = phase->C->constrained_convI2L(phase, x, TypeInt::make(rxlo, rxhi, widen), NULL);
+ Node *hook = new Node(1);
+ hook->init_req(0, cx); // Add a use to cx to prevent him from dying
Node* cy = phase->C->constrained_convI2L(phase, y, TypeInt::make(rylo, ryhi, widen), NULL);
+ hook->del_req(0); // Just yank bogus edge
+ hook->destruct();
switch (op) {
case Op_AddI: return new AddLNode(cx, cy);
case Op_SubI: return new SubLNode(cx, cy);
Comments
Fix request (8u) This fixes JVM crash. Patch applies cleanly-ish, after usual path adjustment and finding+patching the right piece of code in connode.cpp instead of convertnode.cpp. New testcase fails without fix, and passes with it. Build passes tier1 and tier2 tests. Review for jdk8u-backport: https://mail.openjdk.java.net/pipermail/jdk8u-dev/2019-August/010086.html
21-08-2019

Fix Request (11u) This fixes the JVM crash on clear reproducer. The patch applies cleanly to 11u. New testcase fails without product fix, and passes with it. Additionally, patched build passes tier1 and tier2 tests.
19-06-2019

New regression test passes in mach5
12-02-2019

URL: http://hg.openjdk.java.net/jdk/jdk12/rev/44f41693631f User: fyang Date: 2019-01-23 17:07:27 +0000
23-01-2019

Fix request approved. The change is small and safe.
22-01-2019

Fix Request For JDK12 and unreleased 13, the HotSpot JVM will always crash when executing the simple test with the default settings. Refer to this for how the bug triggers: https://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2019-January/032251.html It's possible that this bug may trigger for normal use cases, should be fixed for JDK12. Webrev: http://cr.openjdk.java.net/~fyang/8217359/webrev.01/ JTreg tested with both x86_64 fastdebug build and x86_64 release build (built from the http://hg.openjdk.java.net/jdk/jdk repo). Also committed to the submit repo and passed oracle internal tests (http://hg.openjdk.java.net/jdk/submit/rev/7345adfbc913). This fix is low-risk and has been reviewed by thartmann. (https://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2019-January/032333.html)
22-01-2019

https://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2019-January/032251.html
18-01-2019

ILW = JVM crash / not recent regression; Always reproducible with reported test / not yet reported with any existing tests; disable compilation of affected method! = HHM = P1
18-01-2019