JDK-8317299 : safepoint scalarization doesn't keep track of the depth of the JVM state
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 17,21,22,23
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • OS: linux_ubuntu
  • CPU: x86_64
  • Submitted: 2023-09-21
  • Updated: 2024-06-14
  • Resolved: 2024-02-06
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 21 JDK 22 JDK 23
21.0.5-oracleFixed 22Resolved 23 b09Fixed
Related Reports
Relates :  
JDK-8324605 - [lworld] Enable scalarization before inlining is finished
Relates :  
JDK-8276998 - [REDO] Optimization of Box nodes in uncommon_trap
Relates :  
JDK-8325313 - Header format error in TestIntrinsicBailOut after JDK-8317299
Description
ADDITIONAL SYSTEM INFORMATION :
# JRE version: OpenJDK Runtime Environment (17.0.9) (fastdebug build 17.0.9-internal+0-adhoc.jdk17u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 17.0.9-internal+0-adhoc.jdk17u, compiled mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)


A DESCRIPTION OF THE PROBLEM :
I ran a testcase using JDK17.0.9, and I found the JVM crashed under the option -Xcomp  -XX:-InlineUnsafeOps 

# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/data/jdk17u/src/hotspot/share/opto/output.cpp:803), pid=2064999, tid=2065012
#  assert(local) failed: use _top instead of null
#
# JRE version: OpenJDK Runtime Environment (17.0.9) (fastdebug build 17.0.9-internal+0-adhoc.jdk17u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 17.0.9-internal+0-adhoc.jdk17u, compiled mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x28a206c]  PhaseOutput::FillLocArray(int, MachSafePointNode*, Node*, GrowableArray<ScopeValue*>*, GrowableArray<ScopeValue*>*)+0x48c
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /data/bugs/TestIntrinsicBailOut_09_21_17_52_10/core.2064999)
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
java -Xcomp  -XX:-InlineUnsafeOps   compiler.vectorapi.TestIntrinsicBailOut

ACTUAL -
# To suppress the following error report, specify this argument
# after -XX: or in .hotspotrc:  SuppressErrorAt=/output.cpp:803
#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/data/jdk17u/src/hotspot/share/opto/output.cpp:803), pid=2064999, tid=2065012
#  assert(local) failed: use _top instead of null
#
# JRE version: OpenJDK Runtime Environment (17.0.9) (fastdebug build 17.0.9-internal+0-adhoc.jdk17u)
# Java VM: OpenJDK 64-Bit Server VM (fastdebug 17.0.9-internal+0-adhoc.jdk17u, compiled mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x28a206c]  PhaseOutput::FillLocArray(int, MachSafePointNode*, Node*, GrowableArray<ScopeValue*>*, GrowableArray<ScopeValue*>*)+0x48c
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /data/bugs/TestIntrinsicBailOut_09_21_17_52_10/core.2064999)
#
# An error report file with more information is saved as:
# /data/bugs/TestIntrinsicBailOut_09_21_17_52_10/hs_err_pid2064999.log
#
# Compiler replay data is saved as:
# /data/bugs/TestIntrinsicBailOut_09_21_17_52_10/replay_pid2064999.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp

---------- BEGIN SOURCE ----------

---------- END SOURCE ----------
Comments
[jdk21u-fix-request] Approval Request from Martin Should get backported for parity with 21.0.5-oracle. The backport has been reviewed and tier 1-4 have passed.
14-06-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk21u-dev/pull/716 Date: 2024-06-13 15:04:52 +0000
13-06-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk22u/pull/74 Date: 2024-02-28 06:50:47 +0000
28-02-2024
Fix Request (JDK 22u) Fixes a crash during C2 compilation or potential incorrect execution. The fix is medium risk. Tested with tier1,tier2,tier3,hs-comp-stress,hs-precheckin-comp. Applies cleanly.
28-02-2024
Changeset: 6d911f68 Author: Damon Fenacci <dfenacci@openjdk.org> Date: 2024-02-06 07:53:03 +0000 URL: https://git.openjdk.org/jdk/commit/6d911f68a3244c40a62ab2570dfec68b8d0ed5d8
06-02-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/17500 Date: 2024-01-19 16:31:25 +0000
24-01-2024
Deferral Request: Fix is not ready in time for JDK 22 and will most likely be complex. This is not a regression in JDK 22.
15-01-2024
ILW = Assert during C2 compilation, single test with diagnostic flag -XX:-InlineUnsafeOps, disable compilation of affected method = HLM = P3
29-09-2023
I can reproduce this with JDK 17.0.9 and with slightly adjusted TestIntrinsicBailOut2 also with JDK 22: java --add-modules jdk.incubator.vector -Xcomp -XX:-TieredCompilation -XX:-InlineUnsafeOps -XX:CompileCommand=compileonly,TestIntrinsicBailOut2::test -XX:CompileCommand=quiet --enable-preview --source 22 TestIntrinsicBailOut2.java
29-09-2023
Issue is not reproduced. Crash is not observed on JDK 17 OS: Ubuntu 20.04 JDK 17.0.8: Pass ILW = Crash, not reproducible , no known workaround yet = MLM = P4 Attaching submitter's crash log hs_err_pid2055037.log file. Moving it to dev team for further analysis
29-09-2023