JDK-8266615 : C2 incorrectly folds subtype checks involving an interface array
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 8u281,11,16,17
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2021-05-05
  • Updated: 2021-08-09
  • Resolved: 2021-05-18
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 17
11.0.13-oracleFixed 17 b23Fixed
Description
ADDITIONAL SYSTEM INFORMATION :
JDK: 11.0.11

A DESCRIPTION OF THE PROBLEM :
JDK: 11.0.11
Minimum Reproducible Code: https://github.com/chhsiao90/jdk-8257594-bug

When running the main function of PropertyInfoSetResolver, java.lang.ClassCastException was thrown while several iterations.

Bug is only reproducible on 11.0.11 and 16.0.1.
It looks like it's JIT optimization issue, might be introduced by https://bugs.openjdk.java.net/browse/JDK-8257594

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Clones the git repository from github: https://github.com/chhsiao90/jdk-8257594-bug
Run the main function of PropertyInfoSetResolver

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Run without error
ACTUAL -
java.lang.ClassCastException after several iteration

---------- BEGIN SOURCE ----------
https://github.com/chhsiao90/jdk-8257594-bug
---------- END SOURCE ----------

CUSTOMER SUBMITTED WORKAROUND :
Downgrade JDK to 11.0.10

FREQUENCY : always
Comments
Regression test compiler/types/TestInterfaceArraySubtypeCheck.java passed in JDK17 ATR
09-08-2021
11u Fix Request Backporting this patch fixes a C2 bug that causes incorrect execution. Patch applies cleanly to 11u. New test fails without the patch, and passes with it. tier1 tests pass with the patch.
01-06-2021
Changeset: ce88b334 Author: Tobias Hartmann <thartmann@openjdk.org> Date: 2021-05-18 12:21:24 +0000 URL: https://git.openjdk.java.net/jdk/commit/ce88b334884b6cc76bd938a8a8e6a9b28a777cb8
18-05-2021
Updated ILW = Incorrect result of subtype check (cast/instanceof), edge case but easy to reproduce, no workaround but disable C2 compilation of affected method = HMM = P2
17-05-2021
This is not related to JDK-8257594 (although the problem triggers more often afterwards) and also not a regression in JDK 11.0.11. Attached Test.java triggers the problem even in JDK 8u.
12-05-2021
For me it looks like this is not a regression, the problem exist for a while, and it only discovered with the below recent change https://github.com/openjdk/jdk/blob/master/src/hotspot/share/opto/graphKit.cpp#L3321 if (!objtp->maybe_null()) { builtin_throw(Deoptimization::Reason_class_check, makecon(TypeKlassPtr::make(objtp->klass()))); return top(); } And inside builtin_throw we have https://github.com/openjdk/jdk/blob/master/src/hotspot/share/opto/graphKit.cpp#L593 case Deoptimization::Reason_class_check: if (java_bc() == Bytecodes::_aastore) { ex_obj = env()->ArrayStoreException_instance(); } else { ex_obj = env()->ClassCastException_instance(); <=== here }
11-05-2021
WIth the newly provided testcase, I could see ClassCastException. > Exception in thread "main" java.lang.ClassCastException
11-05-2021
Additional details from submitter == We hit ClassCastException without stack trace and with NULL message (ie preallocated exception) after upgrading OpenJDK from v 11.0.10 to 11.0.11. The defect is not reproducible while using -XX:-OmitStackTraceInFastThrow option so seems it is related to the compiler optimization. The defect is not reproducible using direct single source java file execution (without javac compilation). The defect is not reproducible while using step-by-step debugging. Reducing production logic to a minimized reproducible code results that the defect sometimes is not reproduced: frequency of reproducing is about 4 from 5 attempts for an attached code. Please find attached minimized reproducible code (that differs from specified in JDK-8266615). Steps to reproduce: 1. Install OpenJDK 11.0.11 2. Create any directory and go to it. 3. Download attached JDK11011Defect.java class to the directory created above. 4. Download to the same directory the following jar libs: https://repo1.maven.org/maven2/org/modelmapper/modelmapper/2.3.0/modelmapper-2.3.0.jar https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.11.4/protobuf-java-3.11.4.jar 5. Compile code: javac -classpath .\* JDK11011Defect.java 6. Execute code: java -classpath .\*;.\ JDK11011Defect
10-05-2021
Verified this is regression in jdk11.0.11 and jdk16 b28. Most likely due to JDK-8257594 /tank/fmatte/JAVA/jdk16/jdk-16-ea+28/fastdebug/bin/java PropertyInfoSetResolver.java . . 27 27 Exception in thread "main" java.lang.NullPointerException: Cannot invoke "PropertyInfoResolver.propertyInfoFor(java.lang.Class, java.lang.reflect.Member, String)" because "<parameter2>" is null at PropertyInfoSetResolver.resolveProperties(PropertyInfoSetResolver.java:13) at PropertyInfoSetResolver.main(PropertyInfoSetResolver.java:21)
06-05-2021