JDK-8219335 : "failed: unexpected type" assert failure in ConnectionGraph::split_unique_types() with unsafe accesses
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 10,11,12,13
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2019-02-19
  • Updated: 2019-09-26
  • Resolved: 2019-02-21
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 12 JDK 13
11.0.4Fixed 12.0.2Fixed 13 b10Fixed
Related Reports
Duplicate :  
Relates :  
Description
#  Internal Error (/home/roland/hs/src/hotspot/share/opto/escape.cpp:3118), pid=17688, tid=17701
#  assert(tn_type == TypePtr::NULL_PTR || tn_t != __null && !tinst->klass()->is_subtype_of(tn_t->klass())) failed: unexpected type
#
# JRE version: OpenJDK Runtime Environment (13.0) (fastdebug build 13-internal+0-adhoc.roland.hs)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 13-internal+0-adhoc.roland.hs, compiled mode, sharing, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0xb8ee95]  ConnectionGraph::split_unique_types(GrowableArray<Node*>&, GrowableArray<ArrayCopyNode*>&)+0x405

Test case:

import java.lang.reflect.Field;
import jdk.internal.misc.Unsafe;

public class MaybeOffHeapUnsafeAccessToNewObject {
    public volatile int f_int = -1;


    public static Unsafe unsafe = Unsafe.getUnsafe();
    public static final long f_int_off;

    static {
        Field f_int_field = null;
        try {
            f_int_field = MaybeOffHeapUnsafeAccessToNewObject.class.getField("f_int");
        } catch (Exception e) {
            System.out.println("reflection failed " + e);
            e.printStackTrace();
        }
        f_int_off = unsafe.objectFieldOffset(f_int_field);
    }

    static public void main(String[] args) {
	MaybeOffHeapUnsafeAccessToNewObject o = new MaybeOffHeapUnsafeAccessToNewObject();
	test1();
    }

    static Object test1_helper1(Object t) {
	return t;
    }

    static long test1_helper2(long off) {
	return off;
    }

    static int test1() {
        MaybeOffHeapUnsafeAccessToNewObject t = new MaybeOffHeapUnsafeAccessToNewObject();
	Object o = test1_helper1(t);
	long off = test1_helper2(f_int_off);
        return unsafe.getInt(o, off);
    }

}

ran with:

-XX:-UseOnStackReplacement -XX:-BackgroundCompilation -XX:-TieredCompilation -Xcomp -XX:CompileOnly=MaybeOffHeapUnsafeAccessToNewObject::test1 -XX:+IgnoreUnrecognizedVMOptions -XX:+AlwaysIncrementalInline MaybeOffHeapUnsafeAccessToNewObject
Comments
Fix Request (11u, 12u) This backport fixes the corner case in escape analysis and unsafe access to new object. The risk is low, as it rejects scalar replacement for maybe off-heap unsafe accesses. Patch applies cleanly to 11u and 12u. New test fails without the EA patch, and passes with it. tier1 passes in both 11u and 12u after the patch.
22-03-2019

ILW = Assert in EA due to unexpected raw memory, rare case with incremental inlining and unsafe access, disable EA or compilation of affected method = HLM = P3
20-02-2019

JDK-8176506 was fixed in 10 so likely applies to all releases since 10
19-02-2019