Bug ID: JDK-8177095 Range check dependent CastII/ConvI2L is prematurely eliminated

JDK-8177095 : Range check dependent CastII/ConvI2L is prematurely eliminated

Type: Bug
Component: hotspot
Sub-Component: compiler
Affected Version: 6u141,7u131,8u121,9

Priority: P1
Status: Closed
Resolution: Fixed
OS: generic
CPU: generic

Submitted: 2017-03-17
Updated: 2020-02-26
Resolved: 2017-03-27

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 10	JDK 7	JDK 8	JDK 9	Other
10Fixed	7u241Fixed	8u152Fixed	9 b163Fixed	openjdk7uFixed

Related Reports

Relates :	JDK-6675699 - need comprehensive fix for unconstrained ConvI2L with narrowed type
Relates :	JDK-8154831 - CastII/ConvI2L for a range check is prematurely eliminated

Description

This problem can manifest as one of the following (depending on the exact code shape and build type):

#  SIGSEGV (0xb) at pc=0x00007f7a7b737d6e, pid=44537, tid=44643

Stack: [0x00007f78a99e2000,0x00007f78a9ae3000],  sp=0x00007f78a9adde00,  free space=1007k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0xa1bd6e]  PhaseIdealLoop::build_loop_late_post(Node*)+0x13e
V  [libjvm.so+0xa1c133]  PhaseIdealLoop::build_loop_late(VectorSet&, Node_List&, Node_Stack&)+0x133
V  [libjvm.so+0xa1e9b2]  PhaseIdealLoop::build_and_optimize(bool, bool)+0x7c2
V  [libjvm.so+0x60546f]  Compile::Optimize()+0x46f
V  [libjvm.so+0x607227]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0x1087
V  [libjvm.so+0x531fc2]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x1d2
V  [libjvm.so+0x60f2bc]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x41c
V  [libjvm.so+0x610143]  CompileBroker::compiler_thread_loop()+0x273
V  [libjvm.so+0xce62e8]  JavaThread::thread_main_inner()+0xd8
V  [libjvm.so+0xce6618]  JavaThread::run()+0x2e8
V  [libjvm.so+0xb647c2]  thread_native_entry(Thread*)+0xf2


#  SIGSEGV (0xb) at pc=0x00007f62e4ca0cd8, pid=10145, tid=0x00007f62cee51700

Stack: [0x00007f62ced51000,0x00007f62cee52000],  sp=0x00007f62cee4d460,  free space=1009k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x40bcd8]  PhaseChaitin::gather_lrg_masks(bool)+0x208
V  [libjvm.so+0x40ef3a]  PhaseChaitin::Register_Allocate()+0x71a
V  [libjvm.so+0x4a3810]  Compile::Code_Gen()+0x260
V  [libjvm.so+0x4a6091]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool)+0x14b1
V  [libjvm.so+0x3f2a75]  C2Compiler::compile_method(ciEnv*, ciMethod*, int)+0x1f5
V  [libjvm.so+0x4b05da]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0xc9a
V  [libjvm.so+0x4b1586]  CompileBroker::compiler_thread_loop()+0x5d6
V  [libjvm.so+0xa761a3]  JavaThread::thread_main_inner()+0x103
V  [libjvm.so+0xa762ec]  JavaThread::run()+0x11c
V  [libjvm.so+0x926ed8]  java_start(Thread*)+0x108
C  [libpthread.so.0+0x7e9a]  start_thread+0xda


#  Internal Error (/scratch/HUDSON/workspace/9-2-build-linux-amd64-phase2/jdk9/6205/hotspot/src/share/vm/opto/loopnode.cpp:3565), pid=44718, tid=44826
#  assert(false) failed: Bad graph detected in build_loop_late

Stack: [0x00007fac00a74000,0x00007fac00b75000],  sp=0x00007fac00b6f310,  free space=1004k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x16c9aa2]  VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x162
V  [libjvm.so+0x16ca82f]  VMError::report_and_die(Thread*, char const*, int, char const*, char const*, __va_list_tag*)+0x2f
V  [libjvm.so+0xaa1e4d]  report_vm_error(char const*, int, char const*, char const*, ...)+0xdd
V  [libjvm.so+0x1178515]  PhaseIdealLoop::build_loop_late_post(Node*)+0x285
V  [libjvm.so+0x1178a7b]  PhaseIdealLoop::build_loop_late(VectorSet&, Node_List&, Node_Stack&)+0x10b
V  [libjvm.so+0x117d344]  PhaseIdealLoop::build_and_optimize(bool, bool)+0x904
V  [libjvm.so+0xa10afd]  Compile::Optimize()+0x50d
V  [libjvm.so+0xa12a1e]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0x124e
V  [libjvm.so+0x844162]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x2e2
V  [libjvm.so+0xa1dcb6]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x3d6
V  [libjvm.so+0xa1e951]  CompileBroker::compiler_thread_loop()+0x2b1
V  [libjvm.so+0x162e31e]  JavaThread::thread_main_inner()+0x22e
V  [libjvm.so+0x162e5ae]  JavaThread::run()+0x1ce
V  [libjvm.so+0x137ee82]  thread_native_entry(Thread*)+0x112


#  Internal Error (/scratch/HUDSON/workspace/9-2-build-linux-amd64-phase2/jdk9/6205/hotspot/src/share/vm/opto/chaitin.cpp:264), pid=44984, tid=45090
#  Error: assert(src) failed

Stack: [0x00007f81182bc000,0x00007f81183bd000],  sp=0x00007f81183b7d60,  free space=1007k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x16c9aa2]  VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x162
V  [libjvm.so+0x16ca82f]  VMError::report_and_die(Thread*, char const*, int, char const*, char const*, __va_list_tag*)+0x2f
V  [libjvm.so+0xaa1e4d]  report_vm_error(char const*, int, char const*, char const*, ...)+0xdd
V  [libjvm.so+0x8896de]  PhaseChaitin::Union(Node const*, Node const*)+0x48e
V  [libjvm.so+0x9a21b2]  PhaseCoalesce::combine_these_two(Node*, Node*)+0x4b2
V  [libjvm.so+0x9a266c]  PhaseAggressiveCoalesce::coalesce(Block*)+0x1dc
V  [libjvm.so+0x9a29d2]  PhaseCoalesce::coalesce_driver()+0x42
V  [libjvm.so+0x894ae4]  PhaseChaitin::Register_Allocate()+0x2b4
V  [libjvm.so+0xa0dfe9]  Compile::Code_Gen()+0x3a9
V  [libjvm.so+0xa12ada]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0x130a
V  [libjvm.so+0x844162]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x2e2
V  [libjvm.so+0xa1dcb6]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x3d6
V  [libjvm.so+0xa1e951]  CompileBroker::compiler_thread_loop()+0x2b1
V  [libjvm.so+0x162e31e]  JavaThread::thread_main_inner()+0x22e
V  [libjvm.so+0x162e5ae]  JavaThread::run()+0x1ce
V  [libjvm.so+0x137ee82]  thread_native_entry(Thread*)+0x112

Comments

Fix verified by regression test.
07-08-2017
Thanks, Vladimir!
27-03-2017
Fix approved.
24-03-2017
A similar problem was fixed by JDK-8154831.
22-03-2017
A CastII (or a ConvI2L before JDK-6675699) with a narrow type that represents the index of an array access is eliminated because the input range does not intersect. This happens because the node is pushed upwards through an AddI. However, the control path to the array access is not eliminated leaving the graph in a corrupted state. I'll update the title and description of the bug. I attempted to fix this with JDK-6675699 but missed these cases. Prototype fix: http://cr.openjdk.java.net/~thartmann/8177095/webrev.00/
22-03-2017
ILW = Crash or assert in C2 (loop opts or register allocator), easy to reproduce, disable compilation = HHM = P1
22-03-2017
Attached Test.java reproduces the problem with latest JDK 6, 7, 8 and 9. The problem was not introduced in JDK 8u 112.
22-03-2017
Fix Request: It's important to fix this because the bug can cause crashes during compilation with no feasible workaround. The issue can be reproduced with 8 lines of Java code. The fix is low risk because it only disables optimizations. Review thread: http://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2017-March/025891.html
22-03-2017
I'm able to reproduce this with the latest 8u build and replay compilation. With a debug build, I hit an assert in the register allocator: # Internal Error (/oracle/jdk8u-dev/hotspot/src/share/vm/opto/chaitin.cpp:257), pid=7663, tid=0x00007f38a1058700 # assert(src) failed: V [libjvm.so+0x11d22b0] VMError::report_and_die()+0x160 V [libjvm.so+0x7b6ddb] report_vm_error(char const, int, char const, char const)+0x7b V [libjvm.so+0x5ee85f] PhaseChaitin::Union(Node const, Node const)+0x39f V [libjvm.so+0x6c5c8f] PhaseCoalesce::combine_these_two(Node, Node)+0x3bf V [libjvm.so+0x6c5f65] PhaseAggressiveCoalesce::coalesce(Block)+0x1f5 V [libjvm.so+0x6c61d2] PhaseCoalesce::coalesce_driver()+0x42 V [libjvm.so+0x5f83c5] PhaseChaitin::Register_Allocate()+0x275 Looks like the live range index of src node is 0. Investigating.
20-03-2017
Steps to reproduce 1. cd pastry-2.1 2. ant compile 3. ant jar 4. java -cp pastry.jar rice.pastry.testing.RoutingTableTest 3
20-03-2017
Issue is reproducible in 8u112, 8u121 and 8u131. == # A fatal error has been detected by the Java Runtime Environment: # # SIGSEGV (0xb) at pc=0x00007f62e4ca0cd8, pid=10145, tid=0x00007f62cee51700 # # JRE version: Java(TM) SE Runtime Environment (8.0_131-b04) (build 1.8.0_131-ea-b04) # Java VM: Java HotSpot(TM) 64-Bit Server VM (25.131-b04 mixed mode linux-amd64 compressed oops) # Problematic frame: # V [libjvm.so+0x40bcd8] PhaseChaitin::gather_lrg_masks(bool)+0x208 # # Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp Below is the result == 8u111 - Pass 8u112 - Fail 8u131 b04 - Fail 9 ea b160 - Not able to verify on 9 as the test case has dependency with "sun.reflect.ReflectionFactory.GetReflectionFactoryAction()" which has been removed in 9. Getting compilation error.
20-03-2017
Issue is reproducible in 8u112, 8u121 and 8u131. == # A fatal error has been detected by the Java Runtime Environment: # # SIGSEGV (0xb) at pc=0x00007f62e4ca0cd8, pid=10145, tid=0x00007f62cee51700 # # JRE version: Java(TM) SE Runtime Environment (8.0_131-b04) (build 1.8.0_131-ea-b04) # Java VM: Java HotSpot(TM) 64-Bit Server VM (25.131-b04 mixed mode linux-amd64 compressed oops) # Problematic frame: # V [libjvm.so+0x40bcd8] PhaseChaitin::gather_lrg_masks(bool)+0x208 # # Failed to write core dump. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp Below is the result == 8u111 - Pass 8u112 - Fail 8u131 b04 - Fail 9 ea b160 - Not able to verify on 9 as the test case has dependency with "sun.reflect.ReflectionFactory.GetReflectionFactoryAction()" which has been removed in 9. Getting compilation error.
20-03-2017