JDK-8233529 : loopTransform.cpp:2984: Error: assert(p_f->Opcode() == Op_IfFalse) failed
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 11,12,13,14
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2019-11-04
  • Updated: 2022-06-27
  • Resolved: 2019-11-12
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11 JDK 13 JDK 14
11.0.7-oracleFixed 13.0.3Fixed 14 b23Fixed
Related Reports
Relates :  
Description
Attached test crashes with:

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (open/src/hotspot/share/opto/loopTransform.cpp:2984), pid=25022, tid=25034
#  Error: assert(p_f->Opcode() == Op_IfFalse) failed
#
# JRE version: Java(TM) SE Runtime Environment (14.0+21) (fastdebug build 14-ea+21-927)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 14-ea+21-927, compiled mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x11f21fc]  IdealLoopTree::remove_main_post_loops(CountedLoopNode*, PhaseIdealLoop*)+0x37c
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e %P %I %h" (or dumping to /tmp/fuzzer.tmp.zPS5O09UCc/core.25022)
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------

Command Line: -Xmx1G -Xcomp -Xbatch -XX:CompileOnly=Test Test

Host: Intel Core Processor (Broadwell), 12 cores, 28G, Oracle Linux Server release 7.5
Time: Fri Nov  1 11:46:11 2019 UTC elapsed time: 33 seconds (0d 0h 0m 33s)

---------------  T H R E A D  ---------------

Current thread (0x00007f5280340000):  JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=25034, stack(0x00007f5255cfd000,0x00007f5255dfe000)]


Current CompileTask:
C2:  33368   78 %  b  4       Test::mainTest @ 131 (568 bytes)

Stack: [0x00007f5255cfd000,0x00007f5255dfe000],  sp=0x00007f5255df8190,  free space=1004k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x11f21fc]  IdealLoopTree::remove_main_post_loops(CountedLoopNode*, PhaseIdealLoop*)+0x37c
V  [libjvm.so+0x11f28aa]  IdealLoopTree::do_remove_empty_loop(PhaseIdealLoop*) [clone .part.161]+0x64a
V  [libjvm.so+0x11f2d62]  IdealLoopTree::iteration_split_impl(PhaseIdealLoop*, Node_List&)+0x52
V  [libjvm.so+0x11f4631]  IdealLoopTree::iteration_split(PhaseIdealLoop*, Node_List&)+0x111
V  [libjvm.so+0x11f4546]  IdealLoopTree::iteration_split(PhaseIdealLoop*, Node_List&)+0x26
V  [libjvm.so+0x1218f57]  PhaseIdealLoop::build_and_optimize(LoopOptsMode)+0xc97
V  [libjvm.so+0x9d9dda]  PhaseIdealLoop::optimize(PhaseIterGVN&, LoopOptsMode)+0x2ea
V  [libjvm.so+0x9d706c]  Compile::Optimize()+0xadc
V  [libjvm.so+0x9d8634]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0x1094
V  [libjvm.so+0x81ed30]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x110
V  [libjvm.so+0x9e4ebc]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x2cc
V  [libjvm.so+0x9e5e68]  CompileBroker::compiler_thread_loop()+0x468
V  [libjvm.so+0x170e3e6]  JavaThread::thread_main_inner()+0x226
V  [libjvm.so+0x1713af6]  Thread::call_run()+0xf6
V  [libjvm.so+0x1434b5e]  thread_native_entry(Thread*)+0x10e

Register to memory mapping:

RAX=0x00007f52881f6000 points into unknown readable memory: 58 00 00 00 00 00 00 00
RBX=0x00007f523c5d05b0 points into unknown readable memory: 90 49 4b 87 52 7f 00 00
RCX=0x00007f528711ee59: <offset 0x0000000001a32e59> in /scratch/lmesnik/jenkins/workspace/JavaFuzzer/jdk-14/fastdebug/lib/server/libjvm.so at 0x00007f52856ec000
RDX=0x00007f52870ad9c8: <offset 0x00000000019c19c8> in /scratch/lmesnik/jenkins/workspace/JavaFuzzer/jdk-14/fastdebug/lib/server/libjvm.so at 0x00007f52856ec000
RSP=0x00007f5255df8190 is pointing into the stack for thread: 0x00007f5280340000
RBP=0x00007f5255df81d0 is pointing into the stack for thread: 0x00007f5280340000
RSI=0x0000000000000ba8 is an unknown value
RDI=0x00007f52870ac8c0: <offset 0x00000000019c08c0> in /scratch/lmesnik/jenkins/workspace/JavaFuzzer/jdk-14/fastdebug/lib/server/libjvm.so at 0x00007f52856ec000
R8 =0x00007f523c059310 points into unknown readable memory: a0 9f 4b 87 52 7f 00 00
R9 =0x00007f5255df8170 is pointing into the stack for thread: 0x00007f5280340000
R10=0x00007f523c5d4f10 points into unknown readable memory: 70 f2 4b 87 52 7f 00 00
R11=0x0000000000000003 is an unknown value
R12=0x00007f523c5d05b8 points into unknown readable memory: 08 06 5d 3c 52 7f 00 00
R13=0x00007f523c5d05cc points into unknown readable memory: 03 00 00 00
R14=0x00007f523c5d0a58 points into unknown readable memory: f0 81 4b 87 52 7f 00 00
R15=0x00007f523c57a668 points into unknown readable memory: f0 81 4b 87 52 7f 00 00


Registers:
RAX=0x00007f52881f6000, RBX=0x00007f523c5d05b0, RCX=0x00007f528711ee59, RDX=0x00007f52870ad9c8
RSP=0x00007f5255df8190, RBP=0x00007f5255df81d0, RSI=0x0000000000000ba8, RDI=0x00007f52870ac8c0
R8 =0x00007f523c059310, R9 =0x00007f5255df8170, R10=0x00007f523c5d4f10, R11=0x0000000000000003
R12=0x00007f523c5d05b8, R13=0x00007f523c5d05cc, R14=0x00007f523c5d0a58, R15=0x00007f523c57a668
RIP=0x00007f52868de1fc, EFLAGS=0x0000000000010202, CSGSFS=0x0000000000000033, ERR=0x0000000000000006
  TRAPNO=0x000000000000000e
Comments
Fix request (13u): The patch applies cleanly. The test fails without the fix and passes with the fix.
25-03-2020

Fix Request (11u) This patch fixes the loop optimization, and keeps codebases in sync (I see 11.0.7-oracle). The patch applies cleanly to 11u, passes tier1, tier2 tests. New regression test fails without the patch, passes with it. Risk is medium, as it affects loop optimizations, albeit in a simple manner.
13-01-2020

URL: https://hg.openjdk.java.net/jdk/jdk/rev/ff1887930406 User: thartmann Date: 2019-11-12 09:16:39 +0000
12-11-2019

We have two loops (see TestRemoveMainPostLoops.java): Loop A with an inner loop followed by Loop B. (1) OSR compilation is triggered in loop B. (2) Pre-/main-/post loops are created for loop B. (3) Main and post loops of B are found empty and are removed. (4) Inner loop A is fully unrolled and removed. (5) Only main and post loops are created for A (no pre loop -> "PeelMainPost") and main is unrolled. (6) Pre loop of A is found empty, attempt to remove main and post loop then incorrectly selects main loop from A. The loop layout looks like this: Loop: N0/N0 has_sfpt Loop: N383/N718 limit_check sfpts={ 160 } Loop: N512/N517 counted [int,int),+1 (4 iters) pre has_sfpt <- belongs to A Loop: N760/N338 counted [1,100),+2 (102 iters) main has_sfpt <- belongs to B Loop: N713/N716 counted [int,101),+1 (4 iters) post has_sfpt <- belongs to B Please note that the order of the two loops is not like in the Java code because it's an OSR compilation that starts execution in the second loop. I've strengthened the asserts in locate_pre_from_main() and added a check for is_main_no_pre_loop() in the caller: http://cr.openjdk.java.net/~thartmann/8233529/webrev.00/ The code has been introduced by JDK-8085832 [1].
08-11-2019

(gdb) print p_f->dump(2) 1243 Conv2B === _ 815 [[ 817 ]] !jvms: 0x0000000800095040::invokeStatic @ bci:10 0x00000008000a5040::invoke @ bci:73 0x00000008000a5840::linkToTargetMethod @ bci:7 Test::mainTest @ bci:389 1242 IfTrue === 816 [[ 817 ]] #1 !jvms: Unsafe::allocateUninitializedArray @ bci:51 StringConcatHelper::newArray @ bci:19 0x0000000800095040::invokeStatic @ bci:10 0x00000008000a5040::invoke @ bci:73 0x00000008000a5840::linkToTargetMethod @ bci:7 Test::mainTest @ bci:389 817 If === 1242 1243 [[ 415 1251 ]] P=0,999999, C=-1,000000 !jvms: Test::mainTest @ bci:213 1251 IfTrue === 817 [[ 2984 ]] #1 !jvms: 0x0000000800095040::invokeStatic @ bci:10 0x00000008000a5040::invoke @ bci:73 0x00000008000a5840::linkToTargetMethod @ bci:7 Test::mainTest @ bci:389 $3 = void
06-11-2019

Reproduces with JDK 11 but not with earlier versions.
06-11-2019

Testcase, hs_err and replay are in attachment.
04-11-2019