JDK-8265956 : JVM crashes when matching LShiftVB Node
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 16,17
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: generic
  • CPU: generic
  • Submitted: 2021-04-26
  • Updated: 2021-05-18
  • Resolved: 2021-05-11
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 17
17 b22Fixed
Related Reports
Relates :  
Description
reproduce:

run the attachment by `--add-modules=jdk.incubator.vector TestVectorShuffleIotaShort` on x86 or aarch64

Then we get crash like this:

o573  LShiftVB  === _ o571 o572  [[o634 o577  24  25 ]]  #vectord[8]:{byte}

--N: o573  LShiftVB  === _ o571 o572  [[o634 o577  24  25 ]]  #vectord[8]:{byte}

   --N: o571  VectorLoadConst  === _ o22  [[o573 ]]  #vectord[8]:{byte}
   VECD  100  loadcon8B

      --N: o22  ConI  === o0  [[o571 o423 o399 o407 ]]  #int:0
      IMMI  0  IMMI
      IMMI0  0  IMMI0
      IMMIEXT  0  IMMIEXT
      IMMI_LE_4  0  IMMI_LE_4
      IMMISCALE  0  IMMISCALE
      IMMI26  0  IMMI26
      IMMI19  0  IMMI19
      IMMIU12  0  IMMIU12
      IMMIOFFSET  0  IMMIOFFSET
      IMMIOFFSET1  0  IMMIOFFSET1
      IMMIOFFSET2  0  IMMIOFFSET2
      IMMIOFFSET4  0  IMMIOFFSET4
      IMMIOFFSET8  0  IMMIOFFSET8
      IMMIOFFSET16  0  IMMIOFFSET16
      IMMI8  0  IMMI8
      IMMI8_SHIFT8  0  IMMI8_SHIFT8
      IMMIADDSUB  0  IMMIADDSUB
      IREGI  100  loadConI
      IREGINOSP  100  loadConI
      IREGI_R0  100  loadConI
      IREGI_R2  100  loadConI
      IREGI_R3  100  loadConI
      IREGI_R4  100  loadConI
      VMEMA_IMMIOFFSET4  0  VMEMA_IMMIOFFSET4
      IREGIORL2I  100  IREGI

   --N: o572  ConI  === o0  [[o573 o576 ]]  #int:1
   IMMI  0  IMMI
   IMMI_1  0  IMMI_1
   IMMIEXT  0  IMMIEXT
   IMMI_LE_4  0  IMMI_LE_4
   IMMI_BITMASK  0  IMMI_BITMASK
   IMMISCALE  0  IMMISCALE
   IMMI26  0  IMMI26
   IMMI19  0  IMMI19
   IMMIU12  0  IMMIU12
   IMMIOFFSET  0  IMMIOFFSET
   IMMIOFFSET1  0  IMMIOFFSET1
   IMMIOFFSET2  0  IMMIOFFSET2
   IMMIOFFSET4  0  IMMIOFFSET4
   IMMIOFFSET8  0  IMMIOFFSET8
   IMMIOFFSET16  0  IMMIOFFSET16
   IMMI8  0  IMMI8
   IMMI8_SHIFT8  0  IMMI8_SHIFT8
   IMMIADDSUB  0  IMMIADDSUB
   IMMILOG  0  IMMILOG
   IREGI  100  loadConI
   IREGINOSP  100  loadConI
   IREGI_R0  100  loadConI
   IREGI_R2  100  loadConI
   IREGI_R3  100  loadConI
   IREGI_R4  100  loadConI
   IREGIORL2I  100  IREGI

# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc:  SuppressErrorAt=/matcher.cpp:1685
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/home/wanghuang/repo/jdk/src/hotspot/share/opto/matcher.cpp:1685), pid=70646, tid=70702
#  assert(false) failed: bad AD file
#
# JRE version: OpenJDK Runtime Environment (17.0) (slowdebug build 17-internal+0-adhoc.wanghuang.jdk)
# Java VM: OpenJDK 64-Bit Server VM (slowdebug 17-internal+0-adhoc.wanghuang.jdk, mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-aarch64)
# Problematic frame:
# V  [libjvm.so+0xee1a58][thread 70647 also had an error]
  Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x5a4
#
# Core dump will be written. Default location: /home/wanghuang/repo/jdk/core.%e.70646.%t
#
# An error report file with more information is saved as:
# /home/wanghuang/repo/jdk/hs_err_pid70646.log
#
# Compiler replay data is saved as:
# /home/wanghuang/repo/jdk/replay_pid70646.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)

The main reason is that we miss this rule
match(Set dst (LShiftVB src  shift));

We can fix this by :
* adding the rule `match(Set dst (LShiftVB src  imm));` 
(maybe  under 
`match(Set dst (LShiftVB src (LShiftCntV imm)));` if we have ) 
* or we should add a `LShiftCntVNode` here:

    Node* cnt = gvn().makecon(TypeInt::make(log2i_exact(step_val->get_con())));
    res = gvn().transform(VectorNode::make(Op_LShiftVB, res, cnt, vt));
    
and add rule `LShiftCntV imm` on all archs
Comments
Changeset: 10a049e1 Author: Wang Huang <whuang@openjdk.org> Committer: Jie Fu <jiefu@openjdk.org> Date: 2021-05-11 03:20:15 +0000 URL: https://git.openjdk.java.net/jdk/commit/10a049e1714bfe64f895177f4de7a31ad65f407a
11-05-2021