JDK-8202952 : C2: Unexpected dead nodes after matching
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 8u171,10,11,12
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2018-05-11
  • Updated: 2024-09-20
  • Resolved: 2019-01-23
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 13 Other
11.0.5Fixed 13 b05Fixed openjdk8u392Fixed
Related Reports
Duplicate :  
JDK-8221604 - C2 crash Node_Backward_Iterator::next()
Relates :  
JDK-8339303 - SIGSEGV in Node_Backward_Iterator::next() during PhaseCFG::schedule_late
Description
While running following example C2 crashes 
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007fa6648787a3, pid=13689, tid=13701
#
# JRE version: Java(TM) SE Runtime Environment (11.0+7) (fastdebug build 11-ea+7)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 11-ea+7, compiled mode, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0xd9e7a3]  Node_Backward_Iterator::next()+0x173
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e %P %I %h" (or dumping to /tmp/fuzzer.tmp.XWph5hV3Hg/core.13689)
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------

Command Line: -Xmx1G -Xcomp -Xbatch -XX:-TieredCompilation -XX:CompileOnly= Test

Host: slc16ijb, Intel Core Processor (Haswell, no TSX), 4 cores, 14G, Oracle Linux Server release 7.4
Time: Mon Apr  9 19:19:08 2018 PDT elapsed time: 7 seconds (0d 0h 0m 7s)

---------------  T H R E A D  ---------------

Current thread (0x00007fa65c269800):  JavaThread "C2 CompilerThread1" daemon [_thread_in_native, id=13701, stack(0x00007fa63edb1000,0x00007fa63eeb2000)]


Current CompileTask:
C2:   7551 1365    b        Test::vMeth (232 bytes)

Stack: [0x00007fa63edb1000,0x00007fa63eeb2000],  sp=0x00007fa63eeace50,  free space=1007k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0xd9e7a3]  Node_Backward_Iterator::next()+0x173
V  [libjvm.so+0xda3544]  PhaseCFG::schedule_late(VectorSet&, Node_Stack&)+0xd4
V  [libjvm.so+0xda54cd]  PhaseCFG::global_code_motion()+0x12dd
V  [libjvm.so+0xda6cf1]  PhaseCFG::do_global_code_motion()+0x51
V  [libjvm.so+0xa8bb02]  Compile::Code_Gen()+0x292
V  [libjvm.so+0xa8f5aa]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0x130a
V  [libjvm.so+0x8b27d2]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x2e2
V  [libjvm.so+0xa99d48]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x3b8
V  [libjvm.so+0xa9a9d1]  CompileBroker::compiler_thread_loop()+0x281
V  [libjvm.so+0x17635f2]  JavaThread::thread_main_inner()+0x242
V  [libjvm.so+0x17637f4]  JavaThread::run()+0x144
V  [libjvm.so+0x1495212]  thread_native_entry(Thread*)+0x112
Comments
Fix Request (8u) I would like to backport this patch to fix crash during C2 compilation. This patch doesn't apply cleanly due to context differences, and I selected fuzzer tests from Fei Yang because the tests in the original commit cannot be reproduced on JDK8u. New test fails without product change and passes with it, performed hotspot jtreg test on linux x86-64 platforms with -Xcomp options.
27-03-2023
A pull request was submitted for review. URL: https://git.openjdk.org/jdk8u-dev/pull/291 Date: 2023-03-24 07:57:45 +0000
24-03-2023
I believe 8u variant would go something like this (tested with selected fuzzer tests): http://cr.openjdk.java.net/~shade/8202952/webrev.8u.01/
20-08-2019
Fix Request (11u) This failure readily reproduces with C2 fuzzing in 11u-dev. Patch applies to 11u cleanly, new test fails without product change and passes with it. tier1 passes after the fix. Fuzzing testcases pass in 11u after the patch.
19-08-2019
Another simple test that can also triggers the bug : public class Test { public static int s = 0; public static final int N = 400; public static int a[] = new int[N]; public static void test() { int x = -57785; for (int i = 0; i < N; i++) { a[(x >>> 1) % N] &= (--x); for (int j = 4; j > 1; j -= 3) { switch ((j % 9) + 119) { case 122: s += i; break; case 123: s += i; break; default: } } } } public static void main(String[] args) { for (int i = 0; i < 16000; i++) { test(); } System.out.println("s = " + s); } } $java Test # # A fatal error has been detected by the Java Runtime Environment: # # SIGSEGV (0xb) at pc=0x00007f07bee29552, pid=30779, tid=30790 # # JRE version: OpenJDK Runtime Environment (12.0) (fastdebug build 12-internal+0-adhoc.yangfei.jdk-jdk12) # Java VM: OpenJDK 64-Bit Server VM (fastdebug 12-internal+0-adhoc.yangfei.jdk-jdk12, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64) # Problematic frame: # V [libjvm.so+0xdb9552] Node_Backward_Iterator::next()+0x172 # # Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport %p %s %c %P" (or dumping to /home/yangfei/test/GCM2/core.30779) # # An error report file with more information is saved as: # /home/yangfei/test/GCM2/hs_err_pid30779.log # # Compiler replay data is saved as: # /home/yangfei/test/GCM2/replay_pid30779.log # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp # Current thread is 30790 Dumping core ... Aborted (core dumped)
24-01-2019
URL: http://hg.openjdk.java.net/jdk/jdk/rev/80b55cf3a804 User: vlivanov Date: 2019-01-23 02:16:05 +0000
23-01-2019
ILW = Crash during C2 compilation, with javafuzzer test, disable compilation of method = HMM = P2
11-05-2018
I can not reproduce this on my machine. [~lmesnik], is there a replay compilation file available?
11-05-2018
There are hs_err for 11,10,8 and testcase attached.
11-05-2018