Bug ID: JDK-8234616 assert(0 <= i && i < _len) failed: illegal index in PhaseMacroExpand::expand_macro

JDK-8234616 : assert(0 <= i && i < _len) failed: illegal index in PhaseMacroExpand::expand_macro_nodes()

Type: Bug
Component: hotspot
Sub-Component: compiler
Affected Version: 14

Priority: P3
Status: Resolved
Resolution: Fixed

Submitted: 2019-11-22
Updated: 2020-10-16
Resolved: 2019-12-04

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 14
14 b26Fixed

Related Reports

Relates :

JDK-8227384 - C2 compilation fails with "graph should be schedulable" when running with -XX:-EliminateLocks

Description

lucene test suite crashes with 
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (open/src/hotspot/share/utilities/growableArray.hpp:237), pid=28723, tid=28766
#  assert(0 <= i && i < _len) failed: illegal index
#
# JRE version: Java(TM) SE Runtime Environment (14.0+24) (fastdebug build 14-ea+24-1107)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 14-ea+24-1107, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x11ac5a7]  PhaseMacroExpand::expand_macro_nodes()+0x567
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/libexec/abrt-hook-ccpp %s %c %p %u %g %t e %P %I %h" (or dumping to /shared/jenkins/workspace/LuceneSolr/lucene/build/core/test/J2/core.28723)
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------

Command Line: -ea -esa --illegal-access=deny -Dtests.prefix=tests -Dtests.seed=DD4EC6BCDF73989B -Xmx512M -Dtests.iters= -Dtests.verbose=false -Dtests.infostream=false -Dtests.codec=random -Dtests.postingsformat=random -Dtests.docvaluesformat=random -Dtests.locale=random -Dtests.timezone=random -Dtests.directory=random -Dtests.linedocsfile=europarl.lines.txt.gz -Dtests.luceneMatchVersion=9.0.0 -Dtests.cleanthreads=perMethod -Djava.util.logging.config.file=/shared/jenkins/workspace/LuceneSolr/lucene/tools/junit4/logging.properties -Dtests.nightly=false -Dtests.weekly=false -Dtests.monster=false -Dtests.slow=true -Dtests.asserts=true -Dtests.multiplier=1 -DtempDir=./temp -Djava.io.tmpdir=./temp -Dcommon.dir=/shared/jenkins/workspace/LuceneSolr/lucene -Dclover.db.dir=/shared/jenkins/workspace/LuceneSolr/lucene/build/clover/db -Djava.security.policy=/shared/jenkins/workspace/LuceneSolr/lucene/tools/junit4/tests.policy -Dtests.LUCENE_VERSION=9.0.0 -Djetty.testMode=1 -Djetty.insecurerandom=1 -Dsolr.directoryFactory=org.apache.solr.core.MockDirectoryFactory -Djava.awt.headless=true -Djdk.map.althashing.threshold=0 -Dtests.src.home=/shared/jenkins/workspace/LuceneSolr -Djava.security.egd=file:/dev/./urandom -Djunit4.childvm.cwd=/shared/jenkins/workspace/LuceneSolr/lucene/build/core/test/J2 -Djunit4.tempDir=/shared/jenkins/workspace/LuceneSolr/lucene/build/core/test/temp -Djunit4.childvm.id=2 -Djunit4.childvm.count=4 -Dfile.encoding=ISO-8859-1 -Djava.security.manager=org.apache.lucene.util.TestSecurityManager -Dtests.filterstacks=true -Dtests.leaveTemporary=false com.carrotsearch.ant.tasks.junit4.slave.SlaveMainSafe -eventsfile /shared/jenkins/workspace/LuceneSolr/lucene/build/core/test/temp/junit4-J2-20191121_172746_6737922592080310229544.events @/shared/jenkins/workspace/LuceneSolr/lucene/build/core/test/temp/junit4-J2-20191121_172746_67315435337447244214033.suites -stdin

Host: Intel(R) Xeon(R) Platinum 8167M CPU @ 2.00GHz, 8 cores, 58G, Oracle Linux Server release 7.7
Time: Thu Nov 21 17:34:13 2019 PST elapsed time: 385 seconds (0d 0h 6m 25s)

---------------  T H R E A D  ---------------

Current thread (0x00007fab4034e000):  JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=28766, stack(0x00007fab28812000,0x00007fab28913000)]


Current CompileTask:
C2: 385690 21419   !   4       org.apache.lucene.index.IndexWriter::updateDocument (130 bytes)

Stack: [0x00007fab28812000,0x00007fab28913000],  sp=0x00007fab2890e570,  free space=1009k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x11ac5a7]  PhaseMacroExpand::expand_macro_nodes()+0x567
V  [libjvm.so+0x99a3fe]  Compile::Optimize()+0xdbe
V  [libjvm.so+0x99b6d4]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, DirectiveSet*)+0x1094
V  [libjvm.so+0x813c20]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x110
V  [libjvm.so+0x9a7f2c]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x2cc
V  [libjvm.so+0x9a8f18]  CompileBroker::compiler_thread_loop()+0x4a8
V  [libjvm.so+0x1670af6]  JavaThread::thread_main_inner()+0x226
V  [libjvm.so+0x16761d6]  Thread::call_run()+0xf6
V  [libjvm.so+0x13a841e]  thread_native_entry(Thread*)+0x10e

Register to memory mapping:

RAX=0x00007fab4a90b000 points into unknown readable memory: 58 00 00 00 00 00 00 00
RBX=0x0000000000000019 is an unknown value
RCX=0x00007fab4983300e: <offset 0x000000000198d00e> in /shared/jenkins/jdk/jdk-14/fastdebug/lib/server/libjvm.so at 0x00007fab47ea6000
RDX=0x00007fab496dc160: <offset 0x0000000001836160> in /shared/jenkins/jdk/jdk-14/fastdebug/lib/server/libjvm.so at 0x00007fab47ea6000
RSP=0x00007fab2890e570 is pointing into the stack for thread: 0x00007fab4034e000
RBP=0x00007fab2890e5c0 is pointing into the stack for thread: 0x00007fab4034e000
RSI=0x00000000000000ed is an unknown value
RDI=0x00007fab496d8788: <offset 0x0000000001832788> in /shared/jenkins/jdk/jdk-14/fastdebug/lib/server/libjvm.so at 0x00007fab47ea6000
R8 =0x00007faaf3966b60 points into unknown readable memory: d0 78 62 f7 aa 7f 00 00
R9 =0x0000000000000001 is an unknown value
R10=0x00000000000000ff is an unknown value
R11=0x00000000000000ff is an unknown value
R12=0x0000000000000019 is an unknown value
R13=0x00007fab2890e730 is pointing into the stack for thread: 0x00007fab4034e000
R14=0x0000000000000019 is an unknown value
R15=0x00007faa623a3030 points into unknown readable memory: e8 41 b9 49 ab 7f 00 00


Registers:
RAX=0x00007fab4a90b000, RBX=0x0000000000000019, RCX=0x00007fab4983300e, RDX=0x00007fab496dc160
RSP=0x00007fab2890e570, RBP=0x00007fab2890e5c0, RSI=0x00000000000000ed, RDI=0x00007fab496d8788
R8 =0x00007faaf3966b60, R9 =0x0000000000000001, R10=0x00000000000000ff, R11=0x00000000000000ff
R12=0x0000000000000019, R13=0x00007fab2890e730, R14=0x0000000000000019, R15=0x00007faa623a3030
RIP=0x00007fab490525a7, EFLAGS=0x0000000000010246, CSGSFS=0x002b000000000033, ERR=0x0000000000000006
  TRAPNO=0x000000000000000e

Top of Stack: (sp=0x00007fab2890e570)
0x00007fab2890e570:   00007fab2890e5c0 00007fab492c58b7
0x00007fab2890e580:   00007fab2890f100 00007faa99a6d15c
0x00007fab2890e590:   00007fab2890f350 00007fab28910cd0
0x00007fab2890e5a0:   00007fab2890e7a0 00007fab4005a140 

Instructions: (pc=0x00007fab490525a7)
0x00007fab490524a7:   8b 40 10 4c 8b 18 41 0f b7 43 30 83 e0 1f 66 83
0x00007fab490524b7:   f8 15 74 34 49 8b 01 48 8d 0d e1 56 7d 00 4c 89
0x00007fab490524c7:   5d c0 48 8d 15 1d fc 7d 00 be 38 03 00 00 48 8d
0x00007fab490524d7:   3d b4 4d 68 00 c6 00 58 31 c0 e8 1a 81 84 ff e8
0x00007fab490524e7:   15 3a 1f 00 4c 8b 5d c0 41 83 7b 20 02 0f 84 4d
0x00007fab490524f7:   04 00 00 48 8d 05 57 1e b9 00 48 8d 0d 91 4d 7d
0x00007fab49052507:   00 48 8d 15 e1 90 76 00 be 05 0a 00 00 48 8d 3d
0x00007fab49052517:   05 7e 76 00 48 8b 00 c6 00 58 31 c0 e8 d8 80 84
0x00007fab49052527:   ff e8 d3 39 1f 00 ba 01 00 00 00 49 8d 76 1c 49
0x00007fab49052537:   8d 7e 08 e8 a1 1b ff ff 41 80 7d 60 00 48 89 c2
0x00007fab49052547:   0f 84 22 04 00 00 48 89 55 c0 4d 8b 7d 18 e9 09
0x00007fab49052557:   fd ff ff 66 0f 1f 44 00 00 80 7d c0 00 74 08 85
0x00007fab49052567:   db 0f 8f 37 fb ff ff 41 89 dc 41 83 ec 01 0f 88
0x00007fab49052577:   33 05 00 00 4d 63 f4 41 39 dc 7c 33 48 8d 05 ce
0x00007fab49052587:   1d b9 00 48 8d 0d 7d 0a 7e 00 48 8d 15 c8 9b 68
0x00007fab49052597:   00 be ed 00 00 00 48 8d 3d e4 61 68 00 48 8b 00
0x00007fab490525a7:   c6 00 58 31 c0 e8 4f 80 84 ff e8 4a 39 1f 00 49
0x00007fab490525b7:   8b 47 30 4a 8b 1c f0 f6 43 32 08 0f 84 e8 03 00
0x00007fab490525c7:   00 49 8b 7d 18 48 89 de e8 4c 18 41 ff 48 8d 0d
0x00007fab490525d7:   fd 8f c8 00 48 3b 01 74 43 4c 8d 43 1c 4c 8d 7b
0x00007fab490525e7:   08 31 d2 4c 89 c6 4c 89 ff 4c 89 45 c8 e8 e7 1a
0x00007fab490525f7:   ff ff 48 85 c0 0f 84 3b 01 00 00 4c 8b 45 c8 31
0x00007fab49052607:   d2 4c 89 ff 4c 89 c6 e8 cd 1a ff ff 48 89 c7 e8
0x00007fab49052617:   f5 29 45 ff 84 c0 0f 84 1a 01 00 00 49 8b 7d 10
0x00007fab49052627:   48 89 de e8 b1 06 00 00 49 8b 45 10 4c 8b b8 98
0x00007fab49052637:   01 00 00 41 8b 5f 18 e9 3b ff ff ff 0f 1f 44 00
0x00007fab49052647:   00 48 8d 05 09 1d b9 00 41 b8 01 00 00 00 48 8d
0x00007fab49052657:   0d 1f 55 7d 00 48 8d 15 2b 55 7d 00 be 73 01 00
0x00007fab49052667:   00 48 8d 3d 21 4c 68 00 48 8b 00 c6 00 58 45 8b
0x00007fab49052677:   4e 1c 31 c0 e8 80 7f 84 ff e8 7b 38 1f 00 e9 cd
0x00007fab49052687:   fb ff ff 66 0f 1f 44 00 00 41 0f b7 46 30 66 25
0x00007fab49052697:   ff 03 66 3d 60 02 74 33 48 8d 05 b2 1c b9 00 48 


Stack slot to memory mapping:
stack at sp + 0 slots: 0x00007fab2890e5c0 is pointing into the stack for thread: 0x00007fab4034e000
stack at sp + 1 slots: 0x00007fab492c58b7: <offset 0x000000000141f8b7> in /shared/jenkins/jdk/jdk-14/fastdebug/lib/server/libjvm.so at 0x00007fab47ea6000
stack at sp + 2 slots: 0x00007fab2890f100 is pointing into the stack for thread: 0x00007fab4034e000
stack at sp + 3 slots: 0x00007faa99a6d15c points into unknown readable memory: 70 00 00 00
stack at sp + 4 slots: 0x00007fab2890f350 is pointing into the stack for thread: 0x00007fab4034e000
stack at sp + 5 slots: 0x00007fab28910cd0 is pointing into the stack for thread: 0x00007fab4034e000
stack at sp + 6 slots: 0x00007fab2890e7a0 is pointing into the stack for thread: 0x00007fab4034e000
stack at sp + 7 slots: 0x00007fab4005a140 points into unknown readable memory: 50 26 bc 49 ab 7f 00 00

Comments

URL: https://hg.openjdk.java.net/jdk/jdk/rev/a1802614d6fe User: thartmann Date: 2019-12-04 06:07:59 +0000
04-12-2019
We assert in PhaseMacroExpand::expand_macro_nodes() when accessing the macro_node array because 'macro_idx' is out of the upper bound: https://hg.openjdk.java.net/jdk/jdk/file/43c4fb8ba96b/src/hotspot/share/opto/macro.cpp#l2591 The problem is that in the previous iteration, we hit the following code path which removes an unreachable macro node but does not decrement 'macro_idx': https://hg.openjdk.java.net/jdk/jdk/file/43c4fb8ba96b/src/hotspot/share/opto/macro.cpp#l2594 The problem was introduced in JDK 14 by the fix for JDK-8227384: https://hg.openjdk.java.net/jdk/jdk/rev/43c4fb8ba96b#l3.25 I've changed the loop to a for loop to make sure the index is always decremented and also strengthened the asserts. I was not able to create a regression test but the issue reproduces intermittently with Lucene. http://cr.openjdk.java.net/~thartmann/8234616/webrev.00/
03-12-2019
I can reproduce this with latest jdk/jdk.
03-12-2019
Reproduced reported crash, intermittently with fastdebug build 14-ea+24-1107, with lucene test. Could not yet get the crash with product build or any other versions yet (Also could not yet get any reduced test case or reproduce with replay) $ sudo git clone https://github.com/apache/lucene-solr $ cd lucene-solr/ $ ant ivy-bootstrap $ ant compile $ ant test initial ILW = assert failure with debug build; rare, intermittent, at present only with lucene test; possibly disable compilation of affected method = MMM = P3
26-11-2019
Hi, this seems new. We have not seen that in our Jenkins builds, but I haven't updated to last recent build. In b14 no such problem (if this helps to figure out when it appears first). I will now update our "Policeman Jenkins" server to the latest build. In whoich Lucene module did this happen? Lucene-Core?
22-11-2019
Failure is reproducible.
22-11-2019
The master repo of lucene-solr https://github.com/apache/lucene-solr was tested with JDK 14 b24. ant ivy-bootstrap ant compile ant test commands were used The last commits in lucene (if needed) Changes LUCENE-9056: Fewer conditionals in #advance. (#1021) (detail / githubweb) SOLR-13946: Fix SpellCheckCollatorTest.testEstimatedHitCounts (detail / githubweb) LUCENE-9054: Fix reproduceJenkinsFailures.py to not overwrite junit XML (detail / githubweb)
22-11-2019
In addition, Lucene does not run fastdebug builds, so we may only see crushes. b24 is now installed, waiting for results. bq. In whoich Lucene module did this happen? Lucene-Core? It's in core, it's part of debug output.
22-11-2019