Bug ID: JDK-8307131 C2: assert(false) failed: malformed control flow

JDK-8307131 : C2: assert(false) failed: malformed control flow

Type: Bug
Component: hotspot
Sub-Component: compiler
Affected Version: 17,20,21

Priority: P4
Status: Resolved
Resolution: Fixed
OS: linux,windows
CPU: x86_64,aarch64

Submitted: 2023-04-28
Updated: 2023-07-10
Resolved: 2023-05-09

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 21
21 b22Fixed

Related Reports

Relates :	JDK-8288981 - C2: Fix issues with skeleton predicates
Relates :	JDK-8303951 - Add asserts before record_method_not_compilable where possible
Relates :	JDK-8282045 - When loop strip mining fails, safepoints are removed from loop anyway
Relates :	JDK-8303466 - C2: failed: malformed control flow. Limit type made precise with MaxL/MinL

Description

The following test failed in the JDK21 CI:

applications/javafuzzer/MediumTest.java

Here's a snippet from the log file:

Summary of the JavaFuzzer run:
------------------------------
Host:     win2019-x64-473874
Tests:    12 x 50
Args:     -conf config.yml

Started  at: Fri Apr 28 18:06:03 GMT 2023


r11- 50: 35 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 15 Reference Java failures
r3- 50: 33 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 17 Reference Java failures
r10- 50: 31 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 19 Reference Java failures
r8- 50: 33 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 17 Reference Java failures
r7- 50: 32 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 18 Reference Java failures
r4- 50: 31 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 19 Reference Java failures
r2- 50: 32 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 18 Reference Java failures
r5- 50: 31 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 19 Reference Java failures
r12- 50: 30 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 20 Reference Java failures
r6- 50: 33 passed, 1 crashes, 0 fails, 0 hangs, 0 incorrect tests, 16 Reference Java failures
r1- 50: 27 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 23 Reference Java failures
r9- 50: 29 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 21 Reference Java failures

Finished at: Fri Apr 28 19:23:07 GMT 2023


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (c:\\sb\\prod\\1682641347\\workspace\\open\\src\\hotspot\\share\\opto\\compile.cpp:4003), pid=29116, tid=32968
#  assert(false) failed: malformed control flow
#
# JRE version: Java(TM) SE Runtime Environment (21.0+21) (fastdebug build 21-ea+21-LTS-1697)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 21-ea+21-LTS-1697, compiled mode, sharing, compressed oops, compressed class ptrs, g1 gc, windows-amd64)
# Core dump will be written. Default location: C:\\sb\\prod\\1682704971\\testoutput\\test-support\\jtreg_closed_test_hotspot_jtreg_applications_javafuzzer_MediumTest_java\\tmp\\fuzzer.tmp.Z6VkTvrXkp\\hs_err_pid29116.mdmp
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------


----------System.err:(51/4108)*----------
java.nio.charset.MalformedInputException: Input length = 1
	at java.base/java.nio.charset.CoderResult.throwException(CoderResult.java:279)
	at java.base/sun.nio.cs.StreamDecoder.implRead(StreamDecoder.java:384)
	at java.base/sun.nio.cs.StreamDecoder.lockedRead(StreamDecoder.java:215)
	at java.base/sun.nio.cs.StreamDecoder.read(StreamDecoder.java:169)
	at java.base/java.io.InputStreamReader.read(InputStreamReader.java:189)
	at java.base/java.io.BufferedReader.fill(BufferedReader.java:161)
	at java.base/java.io.BufferedReader.implReadLine(BufferedReader.java:371)
	at java.base/java.io.BufferedReader.readLine(BufferedReader.java:348)
	at java.base/java.io.BufferedReader.readLine(BufferedReader.java:437)
	at java.base/java.nio.file.Files.readAllLines(Files.java:3394)
	at java.base/java.nio.file.Files.readAllLines(Files.java:3432)
	at applications.javafuzzer.JavaFuzzerRunner.lambda$main$2(JavaFuzzerRunner.java:233)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:184)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
	at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1924)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
	at applications.javafuzzer.JavaFuzzerRunner.main(JavaFuzzerRunner.java:231)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:578)
	at com.sun.javatest.regtest.agent.MainActionHelper$AgentVMRunnable.run(MainActionHelper.java:333)
	at java.base/java.lang.Thread.run(Thread.java:1592)
java.lang.RuntimeException: Failed to access C:\\sb\\prod\\1682704971\\testoutput\\test-support\\jtreg_closed_test_hotspot_jtreg_applications_javafuzzer_MediumTest_java\\scratch\\0\\crashes\\r6-36\\hs_err_pid29116.mdmp
	at applications.javafuzzer.JavaFuzzerRunner.lambda$main$2(JavaFuzzerRunner.java:237)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:184)
	at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
	at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
	at java.base/java.util.Iterator.forEachRemaining(Iterator.java:133)
	at java.base/java.util.Spliterators$IteratorSpliterator.forEachRemaining(Spliterators.java:1924)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
	at applications.javafuzzer.JavaFuzzerRunner.main(JavaFuzzerRunner.java:231)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:578)
	at com.sun.javatest.regtest.agent.MainActionHelper$AgentVMRunnable.run(MainActionHelper.java:333)
	at java.base/java.lang.Thread.run(Thread.java:1592)

JavaTest Message: Test threw exception: java.lang.RuntimeException
JavaTest Message: shutting down test

result: Failed. Execution failed: `main' threw exception: java.lang.RuntimeException: Failed to access C:\sb\prod\1682704971\testoutput\test-support\jtreg_closed_test_hotspot_jtreg_applications_javafuzzer_MediumTest_java\scratch\0\crashes\r6-36\hs_err_pid29116.mdmp


Here's the crashing thread's stack trace:

---------------  T H R E A D  ---------------

Current thread (0x0000027b70c39d90):  JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=32968, stack(0x000000e466300000,0x000000e466400000)]


Current CompileTask:
C2:    417    8 % !b        Test::bMeth @ 33 (286 bytes)

Stack: [0x000000e466300000,0x000000e466400000]
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [jvm.dll+0xbd62a1]  os::win32::platform_print_native_stack+0xf1  (os_windows_x86.cpp:236)
V  [jvm.dll+0xe4e5f9]  VMError::report+0x1019  (vmError.cpp:815)
V  [jvm.dll+0xe50255]  VMError::report_and_die+0x645  (vmError.cpp:1588)
V  [jvm.dll+0xe50964]  VMError::report_and_die+0x64  (vmError.cpp:1353)
V  [jvm.dll+0x5316fb]  report_vm_error+0x5b  (debug.cpp:191)
V  [jvm.dll+0x4cb686]  Compile::final_graph_reshaping+0xce6  (compile.cpp:4003)
V  [jvm.dll+0x4c6128]  Compile::Optimize+0x1308  (compile.cpp:2450)
V  [jvm.dll+0x4c2da8]  Compile::Compile+0x1458  (compile.cpp:841)
V  [jvm.dll+0x3e18ca]  C2Compiler::compile_method+0x11a  (c2compiler.cpp:121)
V  [jvm.dll+0x4de1c1]  CompileBroker::invoke_compiler_on_method+0x881  (compileBroker.cpp:2268)
V  [jvm.dll+0x4db796]  CompileBroker::compiler_thread_loop+0x396  (compileBroker.cpp:1945)
V  [jvm.dll+0x7aaa54]  JavaThread::thread_main_inner+0x224  (javaThread.cpp:718)
V  [jvm.dll+0xdc666b]  Thread::call_run+0x1cb  (thread.cpp:220)
V  [jvm.dll+0xbd4bd0]  os::win32::thread_native_entry+0xa0  (os_windows.cpp:551)
C  [ucrtbase.dll+0x2268a]
C  [KERNEL32.DLL+0x17974]
C  [ntdll.dll+0x5a0b1]

Comments

The fix for this bug is integrated in jdk-21+22-1858.
09-05-2023
Changeset: d2b3eef0 Author: Roland Westrelin <roland@openjdk.org> Date: 2023-05-09 09:54:22 +0000 URL: https://git.openjdk.org/jdk/commit/d2b3eef0f2d48446613955cabe69cb4236042878
09-05-2023
[~roland] Thanks Roland for the investigation of Reduced2.java! Then I guess it will be fixed with JDK-8288981. I'll make sure that this test passes.
05-05-2023
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/13826 Date: 2023-05-05 08:48:06 +0000
05-05-2023
[~chagedorn] Reduced2.java is not the same issue. I think it's an issue with predicates. Predication happens first then some unrolling then peeling then pre/main/post loops are created again and then some control flow in the new pre loop dies because of a range check CastII. I suppose this would be caught if assertion predicates were cloned after the peeled iteration. I couldn't verify it though. Maybe you can?
05-05-2023
I've just traced Reduced2.java back to JDK-8292088. But that just removed Opaque2 nodes earlier, so it must have revealed an already existing issue. If Reduced2.java appears to be a different issue than Reduced.java, please file a new bug, thanks!
04-05-2023
To reproduce: $ java -Xcomp -XX:CompileOnly=Reduced -XX:-TieredCompilation Reduced.java I've noticed that with JDK 20+15, we have a bailout due to an infinite loop with Reduced.java (JDK 20+16 fails with malformed control flow). But that only happens since JDK-8282045. [~roland] Might be worth checking if there is something we could do to avoid this infinite loop bailout as well. Another case which starts to bailout with malformed control flow with JDK 20+16 (but no bailout with JDK 20+15): $ java -Xcomp -XX:CompileOnly=Reduced2 Reduced2.java
04-05-2023
The "malformed control flow" (introduced in JDK-8303951) has so far triggered 3 bugs: JDK-8303466, JDK-8306997, JDK-8288981.
02-05-2023
ILW = Same as JDK-8306997 = P4
02-05-2023