JDK-8323101 : C2: assert(n->in(0) == nullptr) failed: divisions with zero check should already have bailed out earlier in split-if
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 11.0.20,17.0.8,21,22,23
  • Priority: P2
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2024-01-07
  • Updated: 2024-02-16
  • Resolved: 2024-01-15
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 21 JDK 22 JDK 23
21.0.3Fixed 22Fixed 23 b06Fixed
Related Reports
Relates :  
JDK-8299259 - C2: Div/Mod nodes without zero check could be split through iv phi of loop resulting in SIGFPE
Relates :  
JDK-8323652 - C2: PhaseIdeal::build_loop_late_post_work() does not treat DivL/ModL as unpinned
Relates :  
JDK-8267532 - C2: Profile and prune untaken exception handlers
Description
The following test failed an assert in the JDK22 CI:

applications/javafuzzer/BigTest.java

Here's a snippet from the log file:

#section:driver
----------messages:(7/309)----------
command: driver applications.javafuzzer.JavaFuzzerRunner -NT 300
reason: User specified action: run driver/timeout=100000 applications.javafuzzer.JavaFuzzerRunner -NT 300 
started: Sat Jan 06 05:08:15 GMT 2024
Mode: agentvm
Agent id: 2
finished: Sat Jan 06 17:38:56 GMT 2024
elapsed time (seconds): 45040.799
----------configuration:(16/2546)----------

<snip>

----------System.out:(52/4717)----------
For random generator using seed: 1049105939623813467
To re-run test with same seed value please add "-Djdk.test.lib.random.seed=1049105939623813467" to command line.
Using JRuby dist path: /System/Volumes/Data/mesos/work_dir/jib-master/install/org/jruby/jruby-dist/9.2.12.0/jruby-dist-9.2.12.0-bin.zip/jruby-9.2.12.0
[DBG] Created generator string: '/System/Volumes/Data/mesos/work_dir/jib-master/install/jdk-22+31-2291/macosx-x64-debug.jdk/jdk-22/fastdebug/bin/java --module-path /System/Volumes/Data/mesos/work_dir/jib-master/install/org/jruby/jruby-dist/9.2.12.0/jruby-dist-9.2.12.0-bin.zip/jruby-9.2.12.0/lib/jruby.jar --add-opens java.base/sun.nio.ch=org.jruby.dist --add-opens java.base/java.io=org.jruby.dist -Djruby.home=/System/Volumes/Data/mesos/work_dir/jib-master/install/org/jruby/jruby-dist/9.2.12.0/jruby-dist-9.2.12.0-bin.zip/jruby-9.2.12.0 -Djruby.lib=/System/Volumes/Data/mesos/work_dir/jib-master/install/org/jruby/jruby-dist/9.2.12.0/jruby-dist-9.2.12.0-bin.zip/jruby-9.2.12.0/lib org.jruby.Main -W0 -I /System/Volumes/Data/mesos/work_dir/jib-master/install/com/oracle/jpg/bigapps/javafuzzer/javafuzzer/3.2/javafuzzer-3.2.zip/rb /System/Volumes/Data/mesos/work_dir/jib-master/install/com/oracle/jpg/bigapps/javafuzzer/javafuzzer/3.2/javafuzzer-3.2.zip/rb/Fuzzer.rb -f /System/Volumes/Data/mesos/work_dir/jib-master/install/com/oracle/jpg/bigapps/javafuzzer/javafuzzer/3.2/javafuzzer-3.2.zip/rb/config.yml'
Starting JavaFuzzer: '/bin/bash /System/Volumes/Data/mesos/work_dir/jib-master/install/com/oracle/jpg/bigapps/javafuzzer/javafuzzer/3.2/javafuzzer-3.2.zip/mrt.sh -R /System/Volumes/Data/mesos/work_dir/slaves/b8be9c31-0e0c-4781-900b-aa9694854b6a-S4433/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/412296fe-3046-437b-8f7d-6891751cdcf2/runs/82c4a490-87b5-4a68-a182-4e75a4fbb68e/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_javafuzzer_BigTest_java/scratch/0 -NT 300 -NP 12 -A -conf config.yml'
[2024-01-06T05:08:21.844331Z] Gathering output for process 19138
[2024-01-06T17:38:56.003037Z] Waiting for completion for process 19138
[2024-01-06T17:38:56.003358Z] Waiting for completion finished for process 19138
Output and diagnostic info for process 19138 was saved into 'pid-19138-output.log'

Summary of the JavaFuzzer run:
------------------------------
Host:     jpg-mac-x64-029.us.oracle.com
Tests:    12 x 300
Args:     -conf config.yml

Started  at: Sat Jan  6 05:08:22 GMT 2024


r1- 300: 180 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 120 Reference Java failures
r5- 300: 184 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 116 Reference Java failures
r8- 300: 173 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 127 Reference Java failures
r4- 300: 167 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 133 Reference Java failures
r10- 300: 171 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 129 Reference Java failures
r11- 300: 173 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 127 Reference Java failures
r9- 300: 163 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 137 Reference Java failures
r7- 300: 182 passed, 1 crashes, 0 fails, 0 hangs, 0 incorrect tests, 117 Reference Java failures
r6- 300: 184 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 116 Reference Java failures
r12- 300: 167 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 133 Reference Java failures
r2- 300: 171 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 129 Reference Java failures
r3- 300: 159 passed, 0 crashes, 0 fails, 0 hangs, 0 incorrect tests, 141 Reference Java failures

Finished at: Sat Jan  6 17:38:55 GMT 2024


#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/System/Volumes/Data/mesos/work_dir/slaves/0db9c48f-6638-40d0-9a4b-bd9cc7533eb8-S29383/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/83d8cb3b-40f7-4b64-8c21-159e6ef386d9/runs/ad6c5410-4399-4119-8438-85fa3145168b/workspace/open/src/hotspot/share/opto/loopopts.cpp:290), pid=62552, tid=39939
#  assert(n->in(0) == nullptr) failed: divisions with zero check should already have bailed out earlier in split-if
#
# JRE version: Java(TM) SE Runtime Environment (22.0+31) (fastdebug build 22-ea+31-2291)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 22-ea+31-2291, mixed mode, sharing, compressed oops, compressed class ptrs, g1 gc, bsd-amd64)
# No core dump will be written. Core dumps have been disabled. To enable core dumping, try "ulimit -c unlimited" before starting Java again
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------


----------System.err:(15/908)----------
java.lang.RuntimeException: assertEquals: expected 1 to equal 2
	at jdk.test.lib.Asserts.fail(Asserts.java:634)
	at jdk.test.lib.Asserts.assertEquals(Asserts.java:205)
	at jdk.test.lib.Asserts.assertEquals(Asserts.java:189)
	at applications.javafuzzer.JavaFuzzerRunner.reportResults(JavaFuzzerRunner.java:264)
	at applications.javafuzzer.JavaFuzzerRunner.runWithConfigurations(JavaFuzzerRunner.java:285)
	at applications.javafuzzer.JavaFuzzerRunner.main(JavaFuzzerRunner.java:307)
	at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:103)
	at java.base/java.lang.reflect.Method.invoke(Method.java:580)
	at com.sun.javatest.regtest.agent.MainActionHelper$AgentVMRunnable.run(MainActionHelper.java:333)
	at java.base/java.lang.Thread.run(Thread.java:1570)

JavaTest Message: Test threw exception: java.lang.RuntimeException
JavaTest Message: shutting down test

result: Failed. Execution failed: `main' threw exception: java.lang.RuntimeException: assertEquals: expected 1 to equal 2


Here's the crashing thread's stack:

---------------  T H R E A D  ---------------

Current thread (0x00007fdc9a023010):  JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=39939, stack(0x0000700002a4e000,0x0000700002b4e000) (1024K)]


Current CompileTask:
C2:217    1 % !b        Test::mainTest @ 122 (538 bytes)

Stack: [0x0000700002a4e000,0x0000700002b4e000],  sp=0x0000700002b49d30,  free space=1007k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.dylib+0x1232154]  VMError::report_and_die(int, char const*, char const*, __va_list_tag*, Thread*, unsigned char*, void*, void*, char const*, int, unsigned long)+0x5a4  (loopopts.cpp:290)
V  [libjvm.dylib+0x1232928]  VMError::report_and_die(Thread*, void*, char const*, int, char const*, char const*, __va_list_tag*)+0x38
V  [libjvm.dylib+0x651a04]  report_vm_error(char const*, int, char const*, char const*, ...)+0xb4
V  [libjvm.dylib+0xd5ce8f]  PhaseIdealLoop::cannot_split_division(Node const*, Node const*) const+0x11f
V  [libjvm.dylib+0xd5c285]  PhaseIdealLoop::split_thru_phi(Node*, Node*, int)+0xa5
V  [libjvm.dylib+0xd61d96]  PhaseIdealLoop::split_if_with_blocks_pre(Node*)+0x316
V  [libjvm.dylib+0xd652cc]  PhaseIdealLoop::split_if_with_blocks(VectorSet&, Node_Stack&)+0x1dc
V  [libjvm.dylib+0xd520e2]  PhaseIdealLoop::build_and_optimize()+0xa82
V  [libjvm.dylib+0x5b7648]  PhaseIdealLoop::optimize(PhaseIterGVN&, LoopOptsMode)+0x58
V  [libjvm.dylib+0x5b0b02]  Compile::Optimize()+0x712
V  [libjvm.dylib+0x5aeef2]  Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x15d2
V  [libjvm.dylib+0x473768]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x1b8
V  [libjvm.dylib+0x5cdb3f]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0xaaf
V  [libjvm.dylib+0x5ccc87]  CompileBroker::compiler_thread_loop()+0x357
V  [libjvm.dylib+0x9ae085]  JavaThread::thread_main_inner()+0x1a5
V  [libjvm.dylib+0x117baec]  Thread::call_run()+0xbc
V  [libjvm.dylib+0xefa652]  thread_native_entry(Thread*)+0x122
C  [libsystem_pthread.dylib+0x64e1]  _pthread_start+0x7d
C  [libsystem_pthread.dylib+0x1f6b]  thread_start+0xf
Comments
[jdk21u-fix-request] Approval Request from Aleksey Shipilëv Clean backport to fix a C2 corner case. Applies cleanly. New tests fail without the patch, and pass with it.
30-01-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk21u-dev/pull/179 Date: 2024-01-16 10:26:56 +0000
16-01-2024
I am seeing the same failure on current jdk21u-dev with new tests. From this, I am concluding we need to backport the fix everywhere JDK-8299259 went, so that we handle the div-with-ctrl-dependency part correctly.
16-01-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk22/pull/76 Date: 2024-01-15 12:34:56 +0000
15-01-2024
Changeset: 7e0a4ed6 Author: Christian Hagedorn <chagedorn@openjdk.org> Date: 2024-01-15 12:16:10 +0000 URL: https://git.openjdk.org/jdk/commit/7e0a4ed6292586772c23292dbdd67ed1db5c12f7
15-01-2024
A pull request was submitted for review. URL: https://git.openjdk.org/jdk/pull/17394 Date: 2024-01-12 10:52:55 +0000
12-01-2024
ILW = Assert during C2 compilation (potential regression in JDK 22), reproducible with Fuzzer generated test, -XX:-SplitIfBlocks or disable compilation of affected method = HMM = P2
08-01-2024
Reproducible with JDK 22 and 23 (but not with JDK 21): java -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,Test*::* -XX:-TieredCompilation -Xbatch -XX:+UnlockExperimentalVMOptions -XX:PerMethodTrapLimit=0 Test.java Seems to be triggered by JDK-8267532 in JDK 22 b26.
08-01-2024
Assert comes from JDK-8299259, [~chagedorn].
08-01-2024