JDK-8289043 : C2: Vector constant materialization attempt
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 11.0.15,12,13,14,15
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: linux_ubuntu
  • CPU: x86_64
  • Submitted: 2022-06-21
  • Updated: 2022-10-17
  • Resolved: 2022-08-04
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 11
11.0.18-oracle b01Fixed
Related Reports
Relates :  
Description
ADDITIONAL SYSTEM INFORMATION :
Arch: x86_64
OS: Ubuntu 20.04.4 LTS
HotSpot
- openjdk version "11.0.17-internal" 2022-10-18
- OpenJDK Runtime Environment (fastdebug build 11.0.17-internal+0-adhoc.congli.my-jdk11u)
- OpenJDK 64-Bit Server VM (fastdebug build 11.0.17-internal+0-adhoc.congli.my-jdk11u, mixed mode)
javac: javac 11.0.17-internal

A DESCRIPTION OF THE PROBLEM :
The problem was found in the repo https://github.com/openjdk/jdk11u-dev (commit f915a327), OpenJDK 11.0.17 (internal). 

**Note** 
1. The given test may take **~1min** to make HotSpot crash. So please be patient.
2. Sorry, we cannot reduce the test further otherwise it cannot be reproduced.

The following is part of the log:
```
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/zdata/congli/my-jdk11u/src/hotspot/share/opto/matcher.cpp:1591), pid=3346525, tid=3346783
#  assert(false) failed: bad AD file
#
# JRE version: OpenJDK Runtime Environment (11.0.17) (fastdebug build 11.0.17-internal+0-adhoc.congli.my-jdk11u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 11.0.17-internal+0-adhoc.congli.my-jdk11u, mixed mode, tiered, compressed oops, g1 gc, linux-amd64)
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------

Command Line: -Xmx1G -Xbatch Test

Host: amdsuplus3.inf.ethz.ch, AMD Ryzen Threadripper 3990X 64-Core Processor, 128 cores, 251G, Ubuntu 20.04.4 LTS
Time: Tue Jun 21 18:15:28 2022 CEST elapsed time: 1.182462 seconds (0d 0h 0m 1s)

---------------  T H R E A D  ---------------

Current thread (0x00007fddd86ed800):  JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=3346783, stack(0x00007fdda4513000,0x00007fdda4614000)]


Current CompileTask:
C2:   1182  122   !b  4       Test::lMeth (198 bytes)

Stack: [0x00007fdda4513000,0x00007fdda4614000],  sp=0x00007fdda460ea70,  free space=1006k
Native frames: (J=compiled Java code, A=aot compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x1a756ca]  VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x1ca
V  [libjvm.so+0x1a76835]  VMError::report_and_die(Thread*, void*, char const*, int, char const*, char const*, __va_list_tag*)+0x35
V  [libjvm.so+0xc3626a]  report_vm_error(char const*, int, char const*, char const*, ...)+0x10a
V  [libjvm.so+0x1518490]  Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x5c0
V  [libjvm.so+0x15184fa]  Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x62a
V  [libjvm.so+0x15184fa]  Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x62a
V  [libjvm.so+0x1518f1b]  Matcher::match_tree(Node const*)+0x1bb
V  [libjvm.so+0x151db92]  Matcher::xform(Node*, int)+0xd42
V  [libjvm.so+0x15222d8]  Matcher::match()+0xbf8
V  [libjvm.so+0xb46065]  Compile::Code_Gen()+0xb5
V  [libjvm.so+0xb4c1ae]  Compile::Compile(ciEnv*, C2Compiler*, ciMethod*, int, bool, bool, bool, bool, DirectiveSet*)+0x1bbe
V  [libjvm.so+0x91bfc4]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, DirectiveSet*)+0x334
V  [libjvm.so+0xb5d210]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x540
V  [libjvm.so+0xb5e8b8]  CompileBroker::compiler_thread_loop()+0x678
V  [libjvm.so+0x19ab8d2]  JavaThread::thread_main_inner()+0x252
V  [libjvm.so+0x19a42ab]  Thread::call_run()+0x7b
V  [libjvm.so+0x169a5b6]  thread_native_entry(Thread*)+0x106
```

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
1. javac Test.java
2. java -Xmx1G -Xbatch Test

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
No crashes
ACTUAL -
Crashed

---------- BEGIN SOURCE ----------
class Test {
  int N;
  int iFld;

  static long lMeth(int i, double d1, int i1) {
    int i21;
    float f2 = 54.993F;
    for (i21 = 5; i21 < 125; ++i21) {
      int i28 = 4;
      f2 += 65008;
      java.io.PrintStream ax$7 = System.out;
      java.io.PrintStream ax$8 = System.err;
      java.io.PrintStream ax$9 =
          new java.io.PrintStream(
              new java.io.OutputStream() {
                public void write(int b) {}
              });
      System.setOut(ax$9);
      for (int ax$5 = -3790; ax$5 < 3069; ax$5 += 1) {
        int ax$3 = i28;
        try {
          int[] ax$1 = {10, 20, 45, 38, 88};
          int[] ax$0 = new int[20];
          for (int ax$2 = 0; ax$2 < ax$0.length && ax$2 < ax$1.length; ax$2++)
            i28 += ax$0[ax$2] + ax$1[ax$2];
        } finally {
          i28 = ax$3;
        }
      }
      System.setOut(ax$7);
      System.setErr(ax$8);
    }
    long meth_res = Float.floatToIntBits(f2);
    return meth_res;
  }

  void mainTest(String[] strArr1) {
    double d = 2.2304;
    N <<= lMeth(iFld, d, iFld);
  }

  public static void main(String[] strArr) {
    Test _instance = new Test();
    for (int i; ; ) _instance.mainTest(strArr);
  }
}
---------- END SOURCE ----------

FREQUENCY : always



Comments
Fix Request (11u): Should get fixed for parity with 11.0.18-oracle. Fix is small, tested and reviewed (see PR).
14-10-2022

A pull request was submitted for review. URL: https://git.openjdk.org/jdk11u-dev/pull/1445 Date: 2022-10-11 21:42:00 +0000
14-10-2022

The problem arises in MemNode::can_see_stored_value() when trying to materialize zero constant for a vector type. Since vector memory nodes report T_VOID as their MemNode::memory_type(), it results in TOP constant being returned for phase->zerocon(memory_type()).
02-08-2022

The bug is fixed in 16 by JDK-8223347.
02-08-2022

[~vlivanov], could you please have a look?
22-07-2022

The problematic graph looks like this: o970 ConL === o0 [[o748 o1674 o1625 o1114 o3945 ]] #long:20 o89 CheckCastPP === o207 o4172 [[o3496 o3945 o3508 o184 o184 o3508 o183 o185 o3445 o3945 o4163 o3433 o3445 298 ]] #int[int:5]:NotNull:exact * o347 Initialize === o4126 o1 o549 o1 o1 o1 o4127 [[o209 o172 292 ]] o3551 If === o3547 o3550 o3549 [[o3527 o3552 269 ]] P=0,999999, C=-1,000000 o3945 AddP === _ o89 o89 o970 [[o4093 ]] o172 Proj === o347 [[o62 o62 o4093 o98 o3432 o3434 o384 o377 o426 o3495 o379 o496 o3497 o382 o382 o98 o99 o377 o588 o379 261 ]] #2 Memory: @rawptr:BotPTR, idx=Raw; o3552 IfTrue === o3551 [[o3535 o4093 268 ]] #1 o4093 LoadVector === o3552 o172 o3945 [[o4094 ]] @int[int:5]:NotNull:exact+any *, idx=10; mismatched #vectorx[4]:{int} o4094 AddVI === _ o1 o4093 [[o4095 ]] #vectorx[4]:{int} The AddVI has a top input. It's LoadVector input is replaced during IGVN because its type is TOP: 3945 AddP === _ 89 89 970 [[ 4093 ]] !orig=[3727],[606] !jvms: Writer::<init> @ bci:18 BufferedWriter::<init> @ bci:2 BufferedWriter::<init> @ bci:5 PrintStream::<init> @ bci:41 PrintStream::<init> @ bci:11 PrintStream::<init> @ bci:3 Test::test @ bci:262 3943 AddP === _ 90 90 970 [[ 4092 ]] !orig=[3729],[585] !jvms: Writer::<init> @ bci:18 BufferedWriter::<init> @ bci:2 BufferedWriter::<init> @ bci:5 PrintStream::<init> @ bci:41 PrintStream::<init> @ bci:11 PrintStream::<init> @ bci:3 Test::test @ bci:262 172 Proj === 347 [[ 62 62 4093 4092 3432 3434 384 377 426 3495 379 496 3497 382 382 98 99 377 588 379 98 ]] #2 Memory: @rawptr:BotPTR, idx=Raw; !orig=[4835],[4842] !jvms: Test::test @ bci:32 3552 IfTrue === 3551 [[ 4092 4093 3535 ]] #1 !orig=[3608] !jvms: OutputStreamWriter::<init> @ bci:14 PrintStream::<init> @ bci:26 PrintStream::<init> @ bci:11 PrintStream::<init> @ bci:3 Test::test @ bci:262 4093 LoadVector === 3552 172 3945 [[ 4094 ]] @int[int:5]:NotNull:exact+any *, idx=10; mismatched #vectorx[4]:{int} !orig=[3944],[3726],[405] !jvms: Writer::<init> @ bci:18 BufferedWriter::<init> @ bci:2 BufferedWriter::<init> @ bci:5 PrintStream::<init> @ bci:41 PrintStream::<init> @ bci:11 PrintStream::<init> @ bci:3 Test::test @ bci:262 4092 LoadVector === 3552 172 3943 [[ 4094 ]] @int[int:20]:NotNull:exact+any *, idx=10; mismatched #top !orig=[3942],[3728],[380],3768 !jvms: BufferedWriter::<init> @ bci:21 BufferedWriter::<init> @ bci:5 PrintStream::<init> @ bci:41 PrintStream::<init> @ bci:11 PrintStream::<init> @ bci:3 Test::test @ bci:262 4094 AddVI === _ 4092 4093 [[ 4095 ]] #vectorx[4]:{int} !orig=[3941],[3725],[204] !jvms: Writer::<init> @ bci:18 BufferedWriter::<init> @ bci:2 BufferedWriter::<init> @ bci:5 PrintStream::<init> @ bci:41 PrintStream::<init> @ bci:11 PrintStream::<init> @ bci:3 Test::test @ bci:262
22-07-2022

ILW = Assert/crash during C2 compilation, with generated test, disable compilation of affected method = HLM = P3
22-07-2022

I attached a simplified test (Test-1.java) that reproduces the issue up to JDK-8223347 in JDK 16 b21.
22-07-2022

I can reproduce this with the attached test up to JDK 13.02.
21-07-2022

Additional Information from submitter: ====================================== The test we've provided for this issue thread is reduced by us. If you cannot reproduce the problem, please download the original unreduced test (i.e., Test.java and FuzzerUtils.java) from the following link: <attached> Note: 1. we are running using openjdk 11.0.17-internal built on commit f915a327, instead of either 11.0.15 (debug) or 11.0.15 (release) 2. the link also contains a hs_err_pidxxxxxx.log and replay_pidxxxxxx.log, which are generated by running the original unreduced test instead of the reduced one Hope these can help you to diagnose the problem
24-06-2022

Not able to reproduce this issue on either GA build or fastdebug builds. OS: Windows 10 JDK 8u333: Pass JDK 11.0.15.1: Pass JDK 17.0.3: Pass JDK 18.0.1.1: Pass Moving it to JDK for further analysis.
23-06-2022