JDK-8176506 : C2: loop unswitching and unsafe accesses cause crash
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 8,9,10
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2017-03-10
  • Updated: 2020-01-14
  • Resolved: 2017-06-06
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 10
10 b21Fixed
Related Reports
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Relates :  
Description
    static A test_helper(Object o) {
        // this includes a check for null with both branches taken
        return (A)o;
    }


    // Loop is unswitched because of the test null for null from the
    // checkcast above, unsafe access is copied in each branch, the
    // compiler sees a memory access to a null object
    static int test1(Object o, long offset) {
        int f = 0;
        for (int i = 0; i < 100; i++) {
            A a = test_helper(o);
            f = UNSAFE.getInt(a, offset);
        }
        return f;
    }

Results in:

#  Internal Error (/home/roland/hs/hotspot/src/share/vm/opto/compile.cpp:1720), pid=24319, tid=24364
#  assert(flat != TypePtr::BOTTOM) failed: cannot alias-analyze an untyped ptr: adr_type = NULL+12

Comments
This is reproduces in jdk8u. Reproducer, for example: http://hg.openjdk.java.net/jdk/jdk/file/6e287efa5fa3/test/hotspot/jtreg/gc/shenandoah/compiler/TestMaybeNullUnsafeAccess.java This causes the crash when run with -XX:+UseCountedLoopSafepoints (with any GC, not just Shenandoah)
23-10-2019

Testing of http://cr.openjdk.java.net/~roland/8176506/webrev.04/ shows only one new failure (during VM startup) which is not related to this changes.
02-06-2017

From the discussion on the mailing list, it seems that finding a comprehensive fix for this issue will require more work and discussions. Also, this problem has not appeared in our testing so far. I'll add the "jdk9-defer-yes" label to the bug and set the fix version to 10. Igor [~iignatyev], please take corrective action if you disagree. Thank you!
15-03-2017

Thank you, Roland!
15-03-2017

I'm fine with postponing to 10 if it's fine on your side.
14-03-2017

Hi Roland [~roland], would you be OK with deferring this bug to 10 already now, or would you rather prefer that we keep it around for now and defer it later (if for some reason the fix is not yet ready in the time frame we have left). Thank you! Best regards, Zoltan
14-03-2017

ILW = Assert in C2's alias analysis, easy to reproduce, disable alias analysis or loop unswitching = MHM = P3
10-03-2017