JDK-8229450 : C2 compilation fails with assert(found_sfpt) failed: no node in loop that's not input to safepoint
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 11,12,13,14
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2019-08-13
  • Updated: 2022-06-27
  • Resolved: 2019-09-04
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 13 JDK 14
11.0.6-oracleFixed 13.0.3Fixed 14 b13Fixed
Related Reports
Relates :  
JDK-8229483 - Sinking load out of loop may trigger: assert(found_sfpt) failed: no node in loop that's not input to safepoint
Relates :  
JDK-8186027 - C2: loop strip mining
Relates :  
JDK-8252869 - crash in PhaseIdealLoop::build_loop_late_post when creating pdf from xml using pdfbox 2.0.21 & fop-1.1 (OpenJDK 11.0+28)
Description
(gdb) !./bin/java --version
openjdk 11 2018-09-25
OpenJDK Runtime Environment (slowdebug build 11+28)
OpenJDK 64-Bit Server VM (slowdebug build 11+28, mixed mode)

#0  0x00007ffff741e760 in raise () from /lib64/libc.so.6
#1  0x00007ffff741fd41 in abort () from /lib64/libc.so.6
#2  0x00007ffff63f60d5 in os::abort (dump_core=true, siginfo=0x0, context=0x0) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/os/linux/os_linux.cpp:1411
#3  0x00007ffff6668b39 in VMError::report_and_die (id=-536870912, message=0x7ffff6b324fe "assert(found_sfpt) failed", detail_fmt=0x7ffff6b324d0 "no node in loop that's not input to safepoint", detail_args=0x7fffd0aa1310, thread=0x7ffff01cd000, pc=0x0, siginfo=0x0, context=0x0,
    filename=0x7ffff6b31bd8 "/local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp", lineno=950, size=0) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/utilities/vmError.cpp:1541
#4  0x00007ffff6667ee3 in VMError::report_and_die (thread=0x7ffff01cd000, context=0x0, filename=0x7ffff6b31bd8 "/local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp", lineno=950, message=0x7ffff6b324fe "assert(found_sfpt) failed",
    detail_fmt=0x7ffff6b324d0 "no node in loop that's not input to safepoint", detail_args=0x7fffd0aa1310) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/utilities/vmError.cpp:1266
#5  0x00007ffff5cd6c3f in report_vm_error (file=0x7ffff6b31bd8 "/local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp", line=950, error_msg=0x7ffff6b324fe "assert(found_sfpt) failed", detail_fmt=0x7ffff6b324d0 "no node in loop that's not input to safepoint")
    at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/utilities/debug.cpp:231
#6  0x00007ffff6253945 in LoopNode::verify_strip_mined (this=0x7fffb010f720, expect_skeleton=-1) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp:950
#7  0x00007ffff6254fce in CountedLoopNode::skip_strip_mined (this=0x7fffb010f720, expect_skeleton=-1) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp:1197
#8  0x00007ffff625aa83 in IdealLoopTree::dump_head (this=0x7fffb01256a0) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp:2403
#9  0x00007ffff625b128 in IdealLoopTree::dump (this=0x7fffb01256a0) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp:2470
#10 0x00007ffff625b145 in IdealLoopTree::dump (this=0x7fffb0125770) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp:2471
#11 0x00007ffff625b145 in IdealLoopTree::dump (this=0x7fffb0123f90) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp:2471
#12 0x00007ffff625ca05 in PhaseIdealLoop::build_and_optimize (this=0x7fffd0aa34b0, do_split_ifs=false, skip_loop_opts=false, last_round=false) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.cpp:2861
#13 0x00007ffff5c464b4 in PhaseIdealLoop::PhaseIdealLoop (this=0x7fffd0aa34b0, igvn=..., do_split_ifs=false, skip_loop_opts=false, last_round=false) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/loopnode.hpp:945
#14 0x00007ffff5c39967 in Compile::Optimize (this=0x7fffd0aa5a60) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/compile.cpp:2291
#15 0x00007ffff5c32bb6 in Compile::Compile (this=0x7fffd0aa5a60, ci_env=0x7fffd0aa6730, compiler=0x7ffff01cc5f0, target=0x7fffb00561f0, osr_bci=-1, subsume_loads=true, do_escape_analysis=true, eliminate_boxing=true, directive=0x7ffff0108660)
    at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/compile.cpp:868
#16 0x00007ffff5aef1f3 in C2Compiler::compile_method (this=0x7ffff01cc5f0, env=0x7fffd0aa6730, target=0x7fffb00561f0, entry_bci=-1, directive=0x7ffff0108660) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/opto/c2compiler.cpp:109
#17 0x00007ffff5c4f21d in CompileBroker::invoke_compiler_on_method (task=0x7ffff02fc590) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/compiler/compileBroker.cpp:2108
#18 0x00007ffff5c4e158 in CompileBroker::compiler_thread_loop () at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/compiler/compileBroker.cpp:1808
#19 0x00007ffff65ea664 in compiler_thread_entry (thread=0x7ffff01cd000, __the_thread__=0x7ffff01cd000) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/runtime/thread.cpp:3273
#20 0x00007ffff65e5467 in JavaThread::thread_main_inner (this=0x7ffff01cd000) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/runtime/thread.cpp:1752
#21 0x00007ffff65e52d9 in JavaThread::run (this=0x7ffff01cd000) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/share/runtime/thread.cpp:1732
#22 0x00007ffff63f4815 in thread_native_entry (thread=0x7ffff01cd000) at /local/home/xxinliu/ws-openjdk11/src/OpenJDK11Src/src/src/hotspot/os/linux/os_linux.cpp:698
#23 0x00007ffff79ab54b in start_thread () from /lib64/libpthread.so.0
#24 0x00007ffff74df2ff in clone () from /lib64/libc.so.6

(gdb) !./bin/java --version
openjdk 11 2018-09-25
OpenJDK Runtime Environment (slowdebug build 11+28)
OpenJDK 64-Bit Server VM (slowdebug build 11+28, mixed mode)

reproducer: 
./bin/java -cp /ion-java-1.5.0.jar  -XX:+ReplayCompiles -XX:ReplayDataFile=/replay_simplied.log  -XX:+ReplayIgnoreInitErrors -XX:+TraceLoopOpts
Comments
Fix request (13u) Patch applies cleanly, test does pass.
23-03-2020
Checked compiler/loopstripmining/LoadDependsOnIfIdenticalToLoopExit.java passes in jdk14 atr and latest CI.
30-01-2020
Fix Request 11u. Minimal risk, has a test case. Applies cleanly net of line numbers.
04-09-2019
discussion and code review: https://mail.openjdk.java.net/pipermail/hotspot-compiler-dev/2019-September/034933.html
04-09-2019
URL: https://hg.openjdk.java.net/jdk/jdk/rev/cf8164854fda User: roland Date: 2019-09-04 14:49:35 +0000
04-09-2019
$cat compile2.cmd compileonly TestMe::has_binary_cookie dontinline TestMe::unread $javac ./TestMe.java $./bin/java -XX:+PrintCompilation -cp . -XX:-TieredCompilation -Xbatch -XX:+UnlockDiagnosticVMOptions -XX:CompileCommandFile=compile2.cmd -XX:+PrintInlining -XX:-OptimizePtrCompare -XX:-OptoPeephole -XX:-SuperWordLoopUnrollAnalysis -XX:+UseLoopPredicate -XX:-PartialPeelAtUnsignedTests -XX:-LoopUnswitching -XX:-UseSuperWord -XX:-SubsumeLoads -XX:-OptimizeStringConcat -XX:-RangeCheckElimination -XX:-DoEscapeAnalysis -XX:PrintIdealGraphLevel=2 -XX:PrintIdealGraphFile=reprod2.xml -XX:+TraceLoopOpts TestMe
29-08-2019
I don't think so. I took a look at JDK-8229483, it's not reproduced using jdk11. In my case, it's shared boolean expression instead of anti-dependency.
27-08-2019
Isn't this a duplicate of JDK-8229483?
27-08-2019
https://cr.openjdk.java.net/~xliu/8229450/02/webrev/
27-08-2019
Please see the attachment JDK-8229450.png Node '520 IF' shares the same node '364 Bool' with '677 CountedLoopEnd'. Because 677 dominates 520, SplitIfBlocks writes 0 or 1 to its in(1) of 520. It also 'Move control-dependent data Nodes on the live path up to the dominating control'. see PhaseIdealLoop::dominated_by. Dominating control node '678 IfFalse' happens to be the control dependent of '683 SafePoint' of a inner loop. LoopNode::verify_strip_mined will fail if SplitIfBlocks changes the outs of it.
24-08-2019
replay_simplied_v2.log is 1/3 than original replay file. To trigger this bug, it must include read & isIonBinary & cookieMachines. 5366 29 b 4 software.amazon.ion.impl._Private_IonReaderFactory::has_binary_cookie (71 bytes) @ 16 software.amazon.ion.impl.UnifiedInputStreamX::read (105 bytes) force inline by ciReplay @ 56 software.amazon.ion.impl.UnifiedInputStreamX::unread (150 bytes) disallowed by ciReplay @ 65 software.amazon.ion.util.IonStreamUtils::isIonBinary (10 bytes) force inline by ciReplay @ 6 software.amazon.ion.util.IonStreamUtils::cookieMatches (45 bytes) force inline by ciReplay Even thought my java test includes in the same way, it still can't hit this problem. In my understanding, some ProfileData in replay file play important role for the shape of IR.
22-08-2019
the broken function is like this, which BINARY_VERSION_MARKER_SIZE is compiler-time constant 4. private static final boolean has_binary_cookie(UnifiedInputStreamX uis) throws IOException { byte[] bytes = new byte[BINARY_VERSION_MARKER_SIZE]; // try to read the first 4 bytes and unread them (we want // the data stream undisturbed by our peeking ahead) int len; for (len = 0; len < BINARY_VERSION_MARKER_SIZE; len++) { int c = uis.read(); if (c == UnifiedInputStreamX.EOF) { break; } bytes[len] = (byte)c; } for (int ii=len; ii>0; ) { ii--; uis.unread(bytes[ii] & 0xff); } boolean is_cookie = isIonBinary(bytes, 0, len); return is_cookie; }
13-08-2019
yes. it shows up in jdk11 because it has strip mining and LoopStripMiningIter== 1000 because of G1. it also crashes in release build. here is the original hs_err logs. --------------- T H R E A D --------------- Current thread (0x00007f8b7cc30800): JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=1190, stack(0x00007f8b471ee000,0x00007f8b472ef000)] Current CompileTask: C2: 95297 16586 4 software.amazon.ion.impl._Private_IonReaderFactory::has_binary_cookie (71 bytes) Stack: [0x00007f8b471ee000,0x00007f8b472ef000], sp=0x00007f8b472e9c90, free space=1007k Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code) V [libjvm.so+0xaa6181] PhaseIdealLoop::build_loop_late_post(Node*)+0x171 V [libjvm.so+0xaa659b] PhaseIdealLoop::build_loop_late(VectorSet&, Node_List&, Node_Stack&)+0x16b V [libjvm.so+0xaa9200] PhaseIdealLoop::build_and_optimize(bool, bool, bool)+0x720 V [libjvm.so+0x635ebb] Compile::Optimize()+0x65b V [libjvm.so+0x637382] Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0xbf2 V [libjvm.so+0x54cf1c] C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0xbc V [libjvm.so+0x64150d] CompileBroker::invoke_compiler_on_method(CompileTask*)+0x49d V [libjvm.so+0x642ca8] CompileBroker::compiler_thread_loop()+0x598 V [libjvm.so+0xdb4443] JavaThread::thread_main_inner()+0x103 V [libjvm.so+0xdb4715] JavaThread::run()+0x2a5 V [libjvm.so+0xdb042a] Thread::call_run()+0x14a V [libjvm.so+0xc00e9e] thread_native_entry(Thread*)+0xee siginfo: si_signo: 11 (SIGSEGV), si_code: 1 (SEGV_MAPERR), si_addr: 0x0000000000000008
13-08-2019
ILW = Assert during C2 compilation related to loop strip mining, easy to reproduce with regression test but never showed up before, disable loop strip mining (-XX:LoopStripMiningIter=0) = HML = P2
13-08-2019
JDK1894.before is the loop before SplitIfBlocks. JDK1894.after is the loop after SplitIfBlocks. node 959 has been changed by PhaseIdealLoop::dominated_by.
13-08-2019
I use today's nightly build of JDK. It crashed for the same reason. if I append -XX:-SplitIfBlocks, it can pass. #./bin/java --version openjdk 14-internal 2020-03-17 OpenJDK Runtime Environment (fastdebug build 14-internal+0-adhoc..src) OpenJDK 64-Bit Server VM (fastdebug build 14-internal+0-adhoc..src, mixed mode, sharing) # ./bin/java -cp /ion-java-1.5.0.jar -XX:+ReplayCompiles -XX:ReplayDataFile=/replay_simplied.log -XX:+ReplayIgnoreInitErrors -XX:+TraceLoopOpts -XX:-SplitIfBlocks Counted Loop: N999/N372 counted [0,4),+1 (-1 iters) Counted Loop: N1012/N1006 counted [int,0),-1 (-1 iters) Loop: N0/N0 has_sfpt Loop: N998/N997 limit_check Loop: N999/N372 limit_check counted [0,4),+1 (-1 iters) has_sfpt strip_mined Loop: N1011/N1010 limit_check Loop: N1012/N1006 limit_check counted [int,0),-1 (-1 iters) has_sfpt strip_mined Loop: N0/N0 has_sfpt Loop: N998/N997 limit_check sfpts={ 1000 } Loop: N999/N372 limit_check counted [0,4),+1 (-1 iters) has_sfpt strip_mined Loop: N1011/N1010 limit_check sfpts={ 1013 } Loop: N1012/N1006 limit_check counted [int,0),-1 (-1 iters) has_sfpt strip_mined Loop: N0/N0 has_sfpt Loop: N998/N997 limit_check sfpts={ 1000 } Loop: N999/N372 # To suppress the following error report, specify this argument # after -XX: or in .hotspotrc: SuppressErrorAt=/loopnode.cpp:992 # # A fatal error has been detected by the Java Runtime Environment: # # Internal Error (/src/src/hotspot/share/opto/loopnode.cpp:992), pid=4576, tid=4587 # assert(found_sfpt) failed: no node in loop that's not input to safepoint # # JRE version: OpenJDK Runtime Environment (14.0) (fastdebug build 14-internal+0-adhoc..src) # Java VM: OpenJDK 64-Bit Server VM (fastdebug 14-internal+0-adhoc..src, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64) # Problematic frame: # V [libjvm.so+0x11ec138] LoopNode::verify_strip_mined(int) const+0x5f8 # # No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again # # An error report file with more information is saved as: # /jdk/hs_err_pid4576.log # # If you would like to submit a bug report, please visit: # http://bugreport.java.com/bugreport/crash.jsp # Current thread is 4587 Dumping core ... Aborted
13-08-2019