Bug ID: JDK-6646019 array subscript expressions become top() with -d64

JDK-6646019 : array subscript expressions become top() with -d64

Type: Bug
Component: hotspot
Sub-Component: compiler
Affected Version: 6u10,7

Priority: P3
Status: Closed
Resolution: Fixed
OS: linux,solaris
CPU: generic

Submitted: 2007-12-29
Updated: 2012-02-01
Resolved: 2011-03-08

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 6	JDK 7	Other
6u14Fixed	7Fixed	hs13Fixed

Related Reports

Duplicate :	JDK-6663926 - Erroneous execution results when C2 -Xcomp is used
Duplicate :	JDK-6646015 - Assertion (_base == Int,"Not an Int") in -Xcomp mode
Duplicate :	JDK-6646021 - assert(n != top() \|\| ..., "live value must not be garbage") in -Xcomp mode
Duplicate :	JDK-6646017 - assert(_base >= AnyPtr && _base <= KlassPtr,"Not a pointer") in -Xcomp mode
Duplicate :	JDK-6646018 - assert(_exits.control()->is_top() \|\| ...) in -Xcomp mode
Duplicate :	JDK-6646016 - assert(_base == KlassPtr,"Not a klass pointer") in -Xcomp mode
Relates :	JDK-6589186 - 20070719212032.jrose.6337834 putback produces amd64 jvmg error: Bad immediate dominator info

Description

This assertion is observed at least on linux-i586/amd64 with both latest jdk6 (1.6.0_10-ea-b09) and jdk7 (1.7.0-ea-b24):
	#  Internal Error (/BUILD_AREA/jdk7/hotspot/src/share/vm/opto/matcher.cpp:1337), pid=16791, tid=1081244000
	#  Error: assert(false,"bad AD file")

It occurs only in -Xcomp mode.

Testcase and hs_err file are attached.
Also fails on sparc with -d64.

Comments

EVALUATION Bug was introduced by fix for 6589186.

14-01-2008

EVALUATION For performance reasons, in 64 bit mode, C2 tries to narrow the type of an array subscript expression to 32 bits. If at compile time, the subscript, or the array length is deduced to be negative, the compiler recognizes the impossibility of the value and the narrowing operation uses a top() node to represent the expression. At runtime, the array subscript operation is not reached because an exception will be thrown first. However, the top() node plays havoc with the C2 type system and should be avoided if the conditions that generate it are recognized. The sample program has code to allocate an array with a negative length. Other tests show failures with negative array subscripts.

09-01-2008