JDK-8252188 : Crash in OrINode::Ideal(PhaseGVN*, bool)+0x8b9
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 16
  • Priority: P1
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2020-08-22
  • Updated: 2024-11-22
  • Resolved: 2020-09-19
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 16
16 b17Fixed
Related Reports
Relates :  
Relates :  
Description
Regression encountered in JDK 16 b11. JDK 16 b10 tests fine.

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (node.hpp:1070), pid=11977, tid=12077
#  guarantee(t != NULL) failed: must be con
#
# JRE version: Java(TM) SE Runtime Environment (16.0+11) (build 16-ea+11-421)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (16-ea+11-421, mixed mode, sharing, tiered, compressed oops, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x320ae9]  OrINode::Ideal(PhaseGVN*, bool)+0x8b9
#


---------------  T H R E A D  ---------------

Current thread (0x00007f9904013970):  JavaThread "C2 CompilerThread2" daemon [_thread_in_native, id=12077, stack(0x00007f993e2e4000,0x00007f993e3e5000)]


Current CompileTask:
C2:  21390 15315 %     4       oracle.security.crypto.core.SHA::k @ 54 (509 bytes)

Stack: [0x00007f993e2e4000,0x00007f993e3e5000],  sp=0x00007f993e3dff50,  free space=1007k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x320ae9]  OrINode::Ideal(PhaseGVN*, bool)+0x8b9
V  [libjvm.so+0xb92682]  PhaseIterGVN::transform_old(Node*)+0x92
V  [libjvm.so+0xb8f869]  PhaseIterGVN::optimize()+0x109
V  [libjvm.so+0xa048a4]  PhaseIdealLoop::build_and_optimize(LoopOptsMode)+0xbc4
V  [libjvm.so+0x51f65f]  PhaseIdealLoop::optimize(PhaseIterGVN&, LoopOptsMode)+0x18f
V  [libjvm.so+0x51dccf]  Compile::Optimize()+0x12bf
V  [libjvm.so+0x51eda0]  Compile::Compile(ciEnv*, ciMethod*, int, bool, bool, bool, bool, DirectiveSet*)+0xc10
V  [libjvm.so+0x46d8d1]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x111
V  [libjvm.so+0x5277a8]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0xd18
V  [libjvm.so+0x528278]  CompileBroker::compiler_thread_loop()+0x4e8
V  [libjvm.so+0xcef6fb]  JavaThread::thread_main_inner()+0x11b
V  [libjvm.so+0xcf45fd]  Thread::call_run()+0xfd
V  [libjvm.so+0xb499a7]  thread_native_entry(Thread*)+0xe7

Register to memory mapping:

RAX=0x00007f9971b52000 points into unknown readable memory: 0x0000000000000058 | 58 00 00 00 00 00 00 00
RBX=0x00007f9904495aa0 points into unknown readable memory: 0x00007f9970e5b430 | 30 b4 e5 70 99 7f 00 00
RCX=0x00007f9970b806ee: <offset 0x0000000000ded6ee> in /download1/jdk-16/lib/server/libjvm.so at 0x00007f996fd93000
RDX=0x00007f9970b806fa: <offset 0x0000000000ded6fa> in /download1/jdk-16/lib/server/libjvm.so at 0x00007f996fd93000
RSP=0x00007f993e3dff50 is pointing into the stack for thread: 0x00007f9904013970
RBP=0x00007f993e3dff90 is pointing into the stack for thread: 0x00007f9904013970
RSI=0x000000000000042e is an unknown value
RDI=0x00007f9970bb38d8: <offset 0x0000000000e208d8> in /download1/jdk-16/lib/server/libjvm.so at 0x00007f996fd93000
R8 =0x0 is NULL
R9 =0x0 is NULL
R10=0x00007f98c4468d10 points into unknown readable memory: 0x00007f9970e5bb60 | 60 bb e5 70 99 7f 00 00
R11=0x0000000070e79600 is an unknown value
R12=0x00007f98c446b7f8 points into unknown readable memory: 0x00007f9970e55a40 | 40 5a e5 70 99 7f 00 00
R13=0x00007f98e8090028 points into unknown readable memory: 0x00007f9970e55658 | 58 56 e5 70 99 7f 00 00
R14=0x00007f993e3e0f90 is pointing into the stack for thread: 0x00007f9904013970
R15=0x0000000000000001 is an unknown value

---------------  S Y S T E M  ---------------

OS:
Oracle Linux Server release 7.6
uname: Linux 4.14.35-1902.3.2.el7uek.x86_64 #2 SMP Tue Jul 30 03:59:02 GMT 2019 x86_64
OS uptime: 368 days 3:38 hours
libc: glibc 2.17 NPTL 2.17 
rlimit (soft/hard): STACK 8192k/infinity , CORE 524288k/524288k , NPROC 65536/449796 , NOFILE 16384/16384 , AS infinity/infinity , CPU infinity/infinity , DATA infinity/infinity , FSIZE infinity/infinity , MEMLOCK 64k/64k
load average: 3.75 2.06 1.61

/proc/meminfo:
MemTotal:       115225884 kB
MemFree:        14645544 kB
MemAvailable:   107906472 kB
Buffers:         8544088 kB
Cached:         76907600 kB
SwapCached:        16384 kB
Active:         76314416 kB
Inactive:       13858800 kB
Active(anon):    3441396 kB
Inactive(anon):  1412184 kB
Active(file):   72873020 kB
Inactive(file): 12446616 kB
Unevictable:        8796 kB
Mlocked:            8796 kB
SwapTotal:       8388604 kB
SwapFree:        4872400 kB
Dirty:              1944 kB
Writeback:             0 kB
AnonPages:       4713288 kB
Mapped:           263448 kB
Shmem:            125404 kB
Slab:           10140924 kB
SReclaimable:    9058680 kB
SUnreclaim:      1082244 kB
KernelStack:       15520 kB
PageTables:        30880 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:    66001544 kB
Committed_AS:   11618440 kB
VmallocTotal:   34359738367 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB
HardwareCorrupted:     0 kB
AnonHugePages:   2408448 kB
ShmemHugePages:        0 kB
ShmemPmdMapped:        0 kB
CmaTotal:              0 kB
CmaFree:               0 kB
HugePages_Total:       0
HugePages_Free:        0
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 kB
DirectMap4k:     2418596 kB
DirectMap2M:    110823424 kB
DirectMap1G:     6291456 kB

/sys/kernel/mm/transparent_hugepage/enabled: [always] madvise never
/sys/kernel/mm/transparent_hugepage/defrag (defrag/compaction efforts parameter): always defer defer+madvise [madvise] never

Process Memory:
Virtual Size: 5991800K (peak: 5992316K)
Resident Set Size: 1053744K (peak: 1053744K) (anon: 895856K, file: 157888K, shmem: 0K)
Swapped out: 0K
C-Heap outstanding allocations: 186951K

/proc/sys/kernel/threads-max (system-wide limit on the number of threads): 899592
/proc/sys/vm/max_map_count (maximum number of memory map areas a process may have): 65530
/proc/sys/kernel/pid_max (system-wide limit on number of process identifiers): 32768

container (cgroup) information:
container_type: cgroupv1
cpu_cpuset_cpus: 0-31
cpu_memory_nodes: 0
active_processor_count: 32
cpu_quota: no quota
cpu_period: 100000
cpu_shares: no shares
memory_limit_in_bytes: unlimited
memory_and_swap_limit_in_bytes: unlimited
memory_soft_limit_in_bytes: unlimited
memory_usage_in_bytes: 99413532672
memory_max_usage_in_bytes: 114354327552

KVM virtualization detected
Steal ticks since vm start: 18
Steal ticks percentage since vm start:  0.000

CPU: total 32 (initial active 32) (16 cores per cpu, 2 threads per core) family 6 model 63 stepping 2 microcode 0x1, cmov, cx8, fxsr, mmx, sse, sse2, sse3, ssse3, sse4.1, sse4.2, popcnt, vzeroupper, avx, avx2, aes, clmul, erms, lzcnt, ht, tsc, bmi1, bmi2, fma, clflush
CPU Model and flags from /proc/cpuinfo:
model name	: Intel(R) Xeon(R) CPU E5-2699 v3 @ 2.30GHz
flags		: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ss ht syscall nx pdpe1gb rdtscp lm constant_tsc arch_perfmon rep_good nopl xtopology cpuid tsc_known_freq pni pclmulqdq vmx ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm abm cpuid_fault invpcid_single pti ssbd ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid xsaveopt arat umip md_clear

Online cpus: 0-31
Offline cpus: 
BIOS frequency limitation: <Not Available>
Frequency switch latency (ns): <Not Available>
Available cpu frequencies: <Not Available>
Current governor: <Not Available>
Core performance/turbo boost: <Not Available>

Memory: 4k page, physical 115225884k(14645544k free), swap 8388604k(4872400k free)

vm_info: Java HotSpot(TM) 64-Bit Server VM (16-ea+11-421) for linux-amd64 JRE (16-ea+11-421), built on Aug 12 2020 15:52:02 by "mach5one" with gcc 9.2.0

Comments
Verified. The test crashes with jdk16b11 but not with latest jdk16b31.
13-01-2021

Verified it is fixed in JDK16b17.
01-10-2020

Changeset: 1438ce09 Author: Vladimir Kozlov <kvn@openjdk.org> Date: 2020-09-19 16:06:35 +0000 URL: https://git.openjdk.java.net/jdk/commit/1438ce09
19-09-2020

Update based on RFR comments: http://cr.openjdk.java.net/~kvn/8252188/webrev.01/ I will have an other update to add more testing.
05-09-2020

Note, the issue happened not during parsing but much later during loop optimization: PartialPeel Loop: N1932/N371 limit_check profile_predicated predicated sfpts={ 371 } OrI(LShiftI, URShiftI): 75 ConI === 0 [[ 76 89 102 1030 178 211 1291 1270 1063 1303 298 2071 2215 1075 838 1051 1507 571 583 595 793 1315 814 826 2129 2075 2109 2104 2100 2133 2080 2039 2043 2138 2048 2214 ]] #int:1 346 URShiftI === _ 1 1 [[ 347 ]] 298 LShiftI === _ 1 75 [[ 347 ]] 347 OrI === _ 298 346 [[ 2283 ]] I think we are in process of removing dead subgraph and it so happened that we process OrI node before it is killed.
03-09-2020

http://cr.openjdk.java.net/~kvn/8252188/webrev.00/
03-09-2020

Can you fix this or revert the bug? This is a blocking issue.
01-09-2020

Sure
29-08-2020

Jatin, please, take care of the bug. It would be very helpful to come up with a regression test for it.
27-08-2020

Or get constant checks and values like next: https://hg.openjdk.java.net/jdk/jdk/file/ebe6d3b79edf/src/hotspot/share/opto/mulnode.cpp#l443
26-08-2020

is_Con() check does not guarantee that Node is Integer constant because TOP node is also ConNode: http://hg.openjdk.java.net/jdk/jdk/file/469c06ca8637/src/hotspot/share/opto/compile.cpp#l899 Code added JDK-8248830 should replace is_Con() with Opcode() == Op_ConI or Op_ConL (for Long type code). And I surprise that non of our tests catch this obvious issue.
26-08-2020

Download osdt_core-19.7.0.0.jar from https://repo1.maven.org/maven2/com/oracle/database/security/osdt_core/19.7.0.0/ Download the attachment replay_pid11977.log Using the debug version of the JDK java -cp ./osdt_core-19.7.0.0.jar -XX:+ReplayCompiles -XX:+ReplayIgnoreInitErrors -XX:ReplayDataFile=replay_pid11977.log
26-08-2020

Hi [~coffeys] [~fmatte], Request help to attach or link to a reproducible test case for this issue. Thanks.
25-08-2020

Yes, it is more likely. Crash happened in "Node *OrINode::Ideal(PhaseGVN *phase, bool can_reshape)" either in left/right shift operation which calls get_int().
22-08-2020

one observation: JDK-8248830 introduced code seen on the stack here.
22-08-2020