JDK-8271600 : C2: CheckCastPP which should closely follow Allocate is sunk of a loop
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 17,18
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2021-08-02
  • Updated: 2021-09-28
  • Resolved: 2021-08-23
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 18
18 b12Fixed
Related Reports
Relates :  
JDK-8252372 - Check if cloning is required to move loads out of loops in PhaseIdealLoop::split_if_with_blocks_post()
Description
Test on x86 with option "-XX:UseAVX=2 -Djdk.incubator.vector.test.loop-iterations=400":

config AbstractVectorConversionTest.getRunTime(org.testng.internal.TestResult@5560f6dd): success
test Vector256ConversionTests.castShape(Species[short, 16, S_256_BIT], Species[byte, 64, S_512_BIT], short(i)): success
castShape took 814 ms
config AbstractVectorConversionTest.getRunTime(org.testng.internal.TestResult@198fb10e): success
 2039  Phi  ===  1424  18810  18778  [[ 18818  19022  19060 ]]  #rawptr:BotPTR !jvms: ByteVector::blendTemplate @ bci:26 (line 1886) Byte256Vector::blend @ bci:11 (line 370) Byte256Vector::blend @ bci:3 (line 41) ByteVector::sliceTemplate @ bci:75 (line 1978) Byte256Vector::slice @ bci:3 (line 378) Byte256Vector::slice @ bci:3 (line 41) AbstractVector::convertShapeTemplate @ bci:266 (line 373) Short256Vector::convertShape @ bci:4 (line 248) AbstractVector::castShape @ bci:31 (line 287) AbstractVectorConversionTest::conversion_kernel @ bci:374 (line 449)
 1389  CallStaticJavaDirect  ===  10659  0  2076  29  0  2089  16867  631  16865  642  644  16656  0  16657  16658  0  0  646  16659  16660  0  436  16869  655  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  0  18670  0  0  0  2090  2091  0  0  0  0  0  0  0  1395  1394  1393  1392  26873  2090  1391  18865  18864  [[ 1390  1388  2092  2096  2104  13454 ]] Static wrapper for: _new_instance_Java # rawptr:NotNull ( java/lang/Object:NotNull * ) C=0.000100 ByteVector::rearrangeTemplate @ bci:24 (line 2093) reexecute Byte256Vector::rearrange @ bci:7 (line 412) Byte256Vector::rearrange @ bci:2 (line 41) ByteVector::sliceTemplate @ bci:64 (line 1978) Byte256Vector::slice @ bci:3 (line 378) Byte256Vector::slice @ bci:3 (line 41) AbstractVector::convertShapeTemplate @ bci:266 (line 373) Short256Vector::convertShape @ bci:4 (line 248) AbstractVector::castShape @ bci:31 (line 287) AbstractVectorConversionTest::conversion_kernel @ bci:374 (line 449) !jvms: ByteVector::blendTemplate @ bci:26 (line 1886) Byte256Vector::blend @ bci:11 (line 370) Byte256Vector::blend @ bci:3 (line 41) ByteVector::sliceTemplate @ bci:75 (line 1978) Byte256Vector::slice @ bci:3 (line 378) Byte256Vector::slice @ bci:3 (line 41) AbstractVector::convertShapeTemplate @ bci:266 (line 373) Short256Vector::convertShape @ bci:4 (line 248) AbstractVector::castShape @ bci:31 (line 287) AbstractVectorConversionTest::conversion_kernel @ bci:374 (line 449)
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc:  SuppressErrorAt=/buildOopMap.cpp:360
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/tmp/ci-scripts/jdk_src/src/hotspot/share/opto/buildOopMap.cpp:360), pid=12841, tid=12904
#  assert(false) failed: there should be a oop in OopMap instead of a live raw oop at safepoint
#
# JRE version: OpenJDK Runtime Environment (18.0) (fastdebug build 18-internal+0-git-7cc1eb3e5)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 18-internal+0-git-7cc1eb3e5, mixed mode, sharing, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x63bcf6]  OopFlow::build_oop_map(Node*, int, PhaseRegAlloc*, int*)+0xa06
#
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /tmp/work/scratch/hs_err_pid12841.log
#
# Compiler replay data is saved as:
# /tmp/work/scratch/replay_pid12841.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#
STDERR:
WARNING: Using incubator modules: jdk.incubator.vector
rerun:
cd /tmp/work/scratch && \
HOME=/home/ent-admin \
LANG=en_US.UTF-8 \
LC_ALL=en_US.UTF-8 \
PATH=/bin:/usr/bin:/usr/sbin \
CLASSPATH=/tmp/work/classes/jdk/incubator/vector/Vector256ConversionTests.d:/home/ent-admin/ci-scripts/jdk_src/test/jdk/jdk/incubator/vector:/mnt/share/openjdk/packages/jtreg/jtreg/lib/testng.jar:/mnt/share/openjdk/packages/jtreg/jtreg/lib/jcommander.jar:/mnt/share/openjdk/packages/jtreg/jtreg/lib/guice.jar:/mnt/share/openjdk/packages/jtreg/jtreg/lib/javatest.jar:/mnt/share/openjdk/packages/jtreg/jtreg/lib/jtreg.jar \
    /mnt/share/homes/njian/jdk/daily-build/x86_64-fastdebug/jdk-master/bin/java \
        -Dtest.vm.opts='-ea -esa -Djdk.incubator.vector.test.loop-iterations=400 -Xmx768m -server' \
        -Dtest.tool.vm.opts='-J-ea -J-esa -J-Djdk.incubator.vector.test.loop-iterations=400 -J-Xmx768m -J-server' \
        -Dtest.compiler.opts= \
        -Dtest.java.opts= \
        -Dtest.jdk=/mnt/share/homes/njian/jdk/daily-build/x86_64-fastdebug/jdk-master \
        -Dcompile.jdk=/mnt/share/homes/njian/jdk/daily-build/x86_64-fastdebug/jdk-master \
        -Dtest.timeout.factor=8.0 \
        -Dtest.root=/home/ent-admin/ci-scripts/jdk_src/test/jdk \
        -Dtest.name=jdk/incubator/vector/Vector256ConversionTests.java \
        -Dtest.file=/home/ent-admin/ci-scripts/jdk_src/test/jdk/jdk/incubator/vector/Vector256ConversionTests.java \
        -Dtest.src=/home/ent-admin/ci-scripts/jdk_src/test/jdk/jdk/incubator/vector \
        -Dtest.src.path=/home/ent-admin/ci-scripts/jdk_src/test/jdk/jdk/incubator/vector \
        -Dtest.classes=/tmp/work/classes/jdk/incubator/vector/Vector256ConversionTests.d \
        -Dtest.class.path=/tmp/work/classes/jdk/incubator/vector/Vector256ConversionTests.d \
        -Dtest.class.path.prefix=/tmp/work/classes/jdk/incubator/vector/Vector256ConversionTests.d:/home/ent-admin/ci-scripts/jdk_src/test/jdk/jdk/incubator/vector \
        -Dtest.modules='jdk.incubator.vector java.base/jdk.internal.vm.annotation' \
        --add-modules jdk.incubator.vector,java.base \
        --add-exports java.base/jdk.internal.vm.annotation=ALL-UNNAMED \
        -ea \
        -esa \
        -Djdk.incubator.vector.test.loop-iterations=400 \
        -Xmx768m \
        -server \
        -XX:-TieredCompilation \
        --add-opens jdk.incubator.vector/jdk.incubator.vector=ALL-UNNAMED \
        com.sun.javatest.regtest.agent.MainWrapper /tmp/work/jdk/incubator/vector/Vector256ConversionTests.d/testng.0.jta jdk/incubator/vector/Vector256ConversionTests.java false Vector256ConversionTests

TEST RESULT: Failed. Unexpected exit from test [exit code: 134]

My system info: Intel(R) Xeon(R) Silver 4116 CPU @ 2.10GHz.
Comments
Fix request (17u): The bug leads to an assert in C2 (regression in JDK 17). The fix is low risk (bail out) and has been tested in the JDK 18 for a while and with tier1-3 in JDK 17u. The patch applies cleanly.
28-09-2021
Changeset: 2ff4c01d Author: Vladimir Ivanov <vlivanov@openjdk.org> Date: 2021-08-23 20:23:41 +0000 URL: https://git.openjdk.java.net/jdk/commit/2ff4c01d42f1afcc53abd48e074356fb4a700754
23-08-2021
I don't think we a have a bug for this problem, yet. So, this looks like a newly found regression for JDK-8252372.
19-08-2021
The following patch fixes the crash: diff --git a/src/hotspot/share/opto/loopopts.cpp b/src/hotspot/share/opto/loopopts.cpp index d86a5db0718..7dc7283fafc 100644 --- a/src/hotspot/share/opto/loopopts.cpp +++ b/src/hotspot/share/opto/loopopts.cpp @@ -1441,7 +1441,8 @@ void PhaseIdealLoop::try_sink_out_of_loop(Node* n) { !n->is_Proj() && !n->is_MergeMem() && !n->is_CMove() && - n->Opcode() != Op_Opaque4) { + n->Opcode() != Op_Opaque4 && + !(n->is_CheckCastPP() && n->in(1)->bottom_type()->isa_rawptr())) { Node *n_ctrl = get_ctrl(n); IdealLoopTree *n_loop = get_loop(n_ctrl); if (n_loop != _ltree_root && n->outcnt() > 1) {
18-08-2021
It looks like a regression from JDK-8252372. A CheckCastPP node which immediately follows an Allocation node is successfully sunk out of a loop and it extends the live range of the corresponding raw oop (produced by Allocate node), so it crosses a safepoint. [~thartmann] [~chagedorn] does it duplicate any existing bug?
18-08-2021
Right, -Djdk.incubator.vector.test.loop-iterations=500 seems to do the trick. I can reproduce it as well now. Thanks!
16-08-2021
I can easily reproduce (single run) this on another x86 system, with: (-Djdk.incubator.vector.test.loop-iterations=500) $ jtreg -othervm -a -ea -esa -va -ignore:quiet -vmoptions:"-Djdk.incubator.vector.test.loop-iterations=500" -timeoutFactor:32 -J-Xmx8g -testjdk:/mnt/share/homes/ninjia02/jdk/daily-build/x86_64-fastdebug/jdk-master -server -r:/tmp/report -w:/tmp/work /tmp/jdk_src/test/jdk/jdk/incubator/vector/Vector256ConversionTests.java $ lscpu Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Byte Order: Little Endian CPU(s): 44 On-line CPU(s) list: 0-43 Thread(s) per core: 2 Core(s) per socket: 22 Socket(s): 1 NUMA node(s): 1 Vendor ID: GenuineIntel CPU family: 6 Model: 85 Model name: Intel(R) Xeon(R) Gold 6152 CPU @ 2.10GHz Stepping: 4 CPU MHz: 2100.151 BogoMIPS: 4200.00 Virtualization: VT-x L1d cache: 32K L1i cache: 32K L2 cache: 1024K L3 cache: 30976K NUMA node0 CPU(s): 0-43 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush dts acpi mmx fxsr sse sse2 ss ht tm pbe syscall nx pdpe1gb rdtscp lm constant_tsc art arch_perfmon pebs bts rep_good nopl xtopology nonstop_tsc cpuid aperfmperf pni pclmulqdq dtes64 monitor ds_cpl vmx smx est tm2 ssse3 sdbg fma cx16 xtpr pdcm pcid dca sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand lahf_lm abm 3dnowprefetch cpuid_fault epb cat_l3 cdp_l3 invpcid_single pti intel_ppin ssbd mba ibrs ibpb stibp tpr_shadow vnmi flexpriority ept vpid fsgsbase tsc_adjust bmi1 hle avx2 smep bmi2 erms invpcid rtm cqm mpx rdt_a avx512f avx512dq rdseed adx smap clflushopt clwb intel_pt avx512cd avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves cqm_llc cqm_occup_llc cqm_mbm_total cqm_mbm_local dtherm arat pln pts pku ospke md_clear flush_l1d $ java -XX:+PrintFlagsFinal -version | grep UseAVX intx UseAVX = 2 {ARCH product} {default}
16-08-2021
I was not able to reproduce this with > 1000 runs on a AVX-512 capable machine.
13-08-2021
ILW = Assert during C2 compilation (regression), single Vector API (incubator) test with command-line flag, no workaround but disable compilation of affected method = HLM = P3
02-08-2021