Bug ID: JDK-8312741 C2: LoopLimitNode is not eliminated

JDK-8312741 : C2: LoopLimitNode is not eliminated

Type: Bug
Component: hotspot
Sub-Component: compiler
Affected Version: 11.0.14-oracle,11.0.20

Priority: P3
Status: Resolved
Resolution: Fixed
OS: generic
CPU: generic

Submitted: 2023-07-18
Updated: 2024-07-29
Resolved: 2024-07-29

Versions (Unresolved/Resolved/Fixed)

The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.

JDK 11
11.0.26-oracle masterFixed

Related Reports

Relates :	JDK-8268261 - C2: assert(n != __null) failed: Bad immediate dominator info.
Relates :	JDK-8260370 - C2: LoopLimit node is not eliminated
Relates :	JDK-8075105 - soft match failure with LoopLimitNode

Description

ADDITIONAL SYSTEM INFORMATION :
# JRE version: OpenJDK Runtime Environment (11.0.20) (fastdebug build 11.0.20-internal+0-adhoc.jdk11u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 11.0.20-internal+0-adhoc.jdk11u, compiled mode, tiered, compressed oops, g1 gc, linux-amd64)

A DESCRIPTION OF THE PROBLEM :
I ran a modified regression test (compiler.codegen.TestBooleanVect) on JDK11.0.20 and I noticed that it crashes with the -Xcomp option.


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/home/repository/jdk11u/src/hotspot/share/opto/matcher.cpp:1591), pid=45504, tid=50587
#  assert(false) failed: bad AD file
#
# JRE version: OpenJDK Runtime Environment (11.0.20) (fastdebug build 11.0.20-internal+0-adhoc.jdk11u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 11.0.20-internal+0-adhoc.jdk11u, compiled mode, tiered, compressed oops, g1 gc, linux-amd64)
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#


STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
java -Xcomp compiler.codegen.TestBooleanVect

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
Testing Boolean vectors
Warmup
Verification
Time
test_ci: 1
test_vi: 7
test_cp: 22456
test_2ci: 2
test_2vi: 34
test_ci_neg: 19841
test_vi_neg: 43
test_cp_neg: 10673
test_2ci_neg: 31
test_2vi_neg: 14105
test_ci_oppos: 172
test_vi_oppos: 13061
test_cp_oppos: 88
test_2ci_oppos: 17779
test_2vi_oppos: 76
test_ci_off: 14470
test_vi_off: 75
test_cp_off: 13817
test_2ci_off: 71
test_2vi_off: 17033
test_ci_inv: 78
test_vi_inv: 15433
test_cp_inv: 63
test_2ci_inv: 15263
test_2vi_inv: 42
test_ci_scl: 18218
test_vi_scl: 70
test_cp_scl: 14833
test_2ci_scl: 110
test_2vi_scl: 13228
test_cp_alndst: 54
test_cp_alnsrc: 14292
test_2ci_aln: 59
test_2vi_aln: 14506
test_cp_unalndst: 59
test_cp_unalnsrc: 16872
test_2ci_unaln: 71
test_2vi_unaln: 12447
PASSE
ACTUAL -
Testing Boolean vectors
Warmup
Default case invoked for: 
   opcode  = 182, "LoopLimit"
o25466  LoopLimit       === _ o41910 o3279  [[o24686 o23912  1102 ]] 

--N: o25466     LoopLimit       === _ o41910 o3279  [[o24686 o23912  1102 ]] 

   --N: o41910  Binary  === _ o401 o23805  [[o25466 ]] 
   _Binary_rRegI_rRegI  100  _Binary_rRegI_rRegI
   _Binary_rax_RegI_rRegI  100  _Binary_rax_RegI_rRegI

      --N: o401 ConI    === o0  [[o405 o20023 o866 o40512 o2415 o163 o3215 o32405 o27850 o431 o1449 o20022 o744 o19813 o26621 o3359 o1414 o21208 o21203 o21214 o435 o4137 o27396 o2815 o23912 o27853 o3316 o373 o26082 o181 o482 o28947 o24032 o20051 o1590 o440 o4519 o4603 o4845 o464 o3278 o460 o23190 o20052 o41771 o361 o5509 o499 o418 o2276 o27400 o5515 o32234 o4541 o426 o453 o513 o449 o21036 o21041 o19995 o21708 o5521 o21165 o4558 o41913 o21166 o23171 o23940 o23115 o23021 o23193 o23685 o23688 o23691 o26866 o40737 o23783 o41706 o23937 o23809 o24212 o23815 o37370 o23860 o21217 o24211 o24782 o24634 o37991 o24460 o24462 o24465 o40731 o41753 o25607 o41704 o41910 o24968 o24586 o24589 o24967 o26743 o27397 o41723 o40707 o37190 o25573 o24686 o26048 o35291 o32509 o27409 o26796 o24557 o27863 o32356 o41747 o27849 ]]  #int:1
      IMMI  10  IMMI
      IMMI1  0  IMMI1
      IMMI2  0  IMMI2
      IMMI8  5  IMMI8
      IMMU8  5  IMMU8
      IMMI16  10  IMMI16
      IMMU31  0  IMMU31
      RREGI  100  loadConI
      RAX_REGI  100  loadConI
      RBX_REGI  100  loadConI
      RCX_REGI  100  loadConI
      RDX_REGI  100  loadConI
      RDI_REGI  100  loadConI
      NO_RCX_REGI  100  loadConI
      NO_RAX_RDX_REGI  100  loadConI
      VECS  105  vshiftcntimm
      LEGVECS  205  MoveVecS2Leg
      STACKSLOTI  200  storeSSI

      --N: o23805       CMoveI  === _ o41908 o41909  [[o23195 o41704 o41910 o23934 o40739 o40732  71  959 ]]  #int
      RREGI  0  RREGI
      RAX_REGI  0  RAX_REGI
      RBX_REGI  0  RBX_REGI
      RCX_REGI  0  RCX_REGI
      RDX_REGI  0  RDX_REGI
      RDI_REGI  0  RDI_REGI
      NO_RCX_REGI  0  NO_RCX_REGI
      NO_RAX_RDX_REGI  0  NO_RAX_RDX_REGI
      STACKSLOTI  100  storeSSI

   --N: o3279   ConI    === o0  [[o40275 o377 o31898 o25941 o22819 o26153 o4848 o23935 o2363 o4827 o25466 o23196 ]]  #int:2
   IMMI  10  IMMI
   IMMI2  0  IMMI2
   IMMI8  5  IMMI8
   IMMU8  5  IMMU8
   IMMI16  10  IMMI16
   IMMU31  0  IMMU31
   RREGI  100  loadConI
   RAX_REGI  100  loadConI
   RBX_REGI  100  loadConI
   RCX_REGI  100  loadConI
   RDX_REGI  100  loadConI
   RDI_REGI  100  loadConI
   NO_RCX_REGI  100  loadConI
   NO_RAX_RDX_REGI  100  loadConI
   VECS  105  vshiftcntimm
   LEGVECS  205  MoveVecS2Leg
   STACKSLOTI  200  storeSSI

# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc:  SuppressErrorAt=/matcher.cpp:1591
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/home/repository/jdk11u/src/hotspot/share/opto/matcher.cpp:1591), pid=52197, tid=55198
#  assert(false) failed: bad AD file
#
# JRE version: OpenJDK Runtime Environment (11.0.20) (fastdebug build 11.0.20-internal+0-adhoc.jdk11u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 11.0.20-internal+0-adhoc.jdk11u, compiled mode, tiered, compressed oops, g1 gc, linux-amd64)
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# An error report file with more information is saved as:
# /home/repository/bugs/TestBooleanVect_07_18_11_50_56/hs_err_pid45504.log
#
# Compiler replay data is saved as:
# /home/repository//bugs/TestBooleanVect_07_18_11_50_56/replay_pid45504.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#
Current thread is 55198
Dumping core ...

---------- BEGIN SOURCE ----------
The source code, as well as the hs_err log can be downloaded from 
https://drive.google.com/file/d/15XAc7YcXe8aCupRUjFnTvEXe2oGQ7etd/view?usp=sharing
---------- END SOURCE ----------

FREQUENCY : always

Comments

It is this JDK-8268261 which caused the regression in 11.0.14 b01, I reverted the change in 11u-cpu tip and there are no crashes observed. This issue is specific to jdk11u-cpu. Need to check wny it is not the case in the mainline.
26-07-2023
Thanks Tobias, for the detailed analysis. I was watching this issue since it was in JI. Will do further triaging. Thanks,
25-07-2023
ILW = Assert/crash during C2 compilation, reproducible with generated test (probably an edge case), disable compilation of affected method = HLM = P3
25-07-2023
I can reproduce this since 11.0.14+1 but not with > JDK 11 and I couldn't find any changes in that build that would explain it. I suspect that it was only triggered by a change but it might still be worth narrowing it down. I attached a simplified version of the test (run with -Xbatch -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,TestBooleanVect::* -XX:-TieredCompilation TestBooleanVect). The problem is very similar to JDK-8260370 in that a LoopLimitNode is not removed by LoopLimitNode::Ideal, i.e. this code is not executed: https://github.com/openjdk/jdk/blob/d0761c19d1ddafbcb5ea97334335462e716de250/src/hotspot/share/opto/loopnode.cpp#L2376 But that issue should not affect JDK 11u. [~vlivanov], any ideas? This might also be to JDK-8255000. Leaving this to sustaining for further investigation.
25-07-2023
Issue is reproduced. Crash is observed. OS: Windows 10 JDK 11.0.20 debug : fail Output: Testing Boolean vectors Warmup Default case invoked for: opcode = 181, "LoopLimit" o15729 LoopLimit === _ o28591 o3280 [[o15730 o15453 1255 ]] --N: o15729 LoopLimit === _ o28591 o3280 [[o15730 o15453 1255 ]] --N: o28591 Binary === _ o401 o14077 [[o15729 ]] _Binary_rRegI_rRegI 100 _Binary_rRegI_rRegI _Binary_rax_RegI_rRegI 100 _Binary_rax_RegI_rRegI ....... ILW = assertion failure in debug build (no failure observed in release build); reported once ; disable compilation of affected method = MLM = P4 Moving it to dev team for further analysis
25-07-2023