I just discovered this bug by manual code inspection, and found a reproducer.

It seems to be a regression of JDK-8248830, that is when RotateRightV was added to SuperWord.

The problem is that we directly get the input node, rather than the vector_opd, which fails if that input is not a vector already, but for example a PopulateIndex pattern that is only vectorized when calling vector_opd.

[~jbhateja] did this:

      } else if (VectorNode::is_scalar_rotate(n)) {
        Node* in1 = low_adr->in(1);
        Node* in2 = p->at(0)->in(2);

And by now it looks like this:

      } else if (VectorNode::is_scalar_rotate(n)) {
        Node* in1 = first->in(1);
        Node* in2 = first->in(2);

But at least in1 should be using vector_opd, like most other ops:

        Node* in1 = vector_opd(p, 1);

When the input is a PopulateIndex pattern, then "first->in(1)" gives us the iv-phi, which is a scalar. vector_opd would produce a PopulateIndex vector.

In the ad-file, we get an error, because we do not expect a scalar as the first operand of the RotateRightV, but a vector.

Reproduces on JDK23, JDK22, JDK21, maybe older.

/oracle-work/jdk-fork4/build/linux-x64-debug/jdk/bin/java -XX:CompileCommand=compileonly,TestRotate::* -Xbatch TestRotate.java

/oracle-work/jdk-21.0.3/fastdebug/bin/java -XX:CompileCommand=compileonly,TestRotate::* -Xbatch -XX:+UseSuperWord TestRotate.java

Disabling -XX:-UseSuperWord avoids the crash.

Strangely, product seems to run just fine.
But I'm not sure I'd trust the result... though it seems to be correct in the reproducer.

----------------------

sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
sum: -1220673536
o895  RotateRightV  === _ o977 o137  [[ o896 ]]  #vectorz[16]:{int}

--N: o895  RotateRightV  === _ o977 o137  [[ o896 ]]  #vectorz[16]:{int}

   --N: o977  AddI  === _ o1176 o1198  [[ o895 ]] 
   RREGI  110  addI_rReg_imm
   RAX_REGI  110  addI_rReg_imm
   RBX_REGI  110  addI_rReg_imm
   RCX_REGI  110  addI_rReg_imm
   RDX_REGI  110  addI_rReg_imm
   RDI_REGI  110  addI_rReg_imm
   NO_RAX_RDX_REGI  110  addI_rReg_imm
   NO_RBP_R13_REGI  110  addI_rReg_imm
   STACKSLOTI  210  storeSSI
   _AddI_rRegI_rRegI  100  _AddI_rRegI_rRegI

      --N: o1176  Phi  === o1172 o1247 o242  [[ o1159 o1160 o1161 o1162 o1163 o1164 o242 o1058 o1057 o977 ]]  #int #tripcount
      RREGI  0  RREGI
      RAX_REGI  0  RAX_REGI
      RBX_REGI  0  RBX_REGI
      RCX_REGI  0  RCX_REGI
      RDX_REGI  0  RDX_REGI
      RDI_REGI  0  RDI_REGI
      NO_RAX_RDX_REGI  0  NO_RAX_RDX_REGI
      NO_RBP_R13_REGI  0  NO_RBP_R13_REGI
      STACKSLOTI  100  storeSSI

      --N: o1198  ConI  === o0  [[ o977 ]]  #int:112
      IMMI  10  IMMI
      IMMU7  5  IMMU7
      IMMI8  5  IMMI8
      IMMU8  5  IMMU8
      IMMI16  10  IMMI16
      IMMU31  0  IMMU31
      RREGI  100  loadConI
      RAX_REGI  100  loadConI
      RBX_REGI  100  loadConI
      RCX_REGI  100  loadConI
      RDX_REGI  100  loadConI
      RDI_REGI  100  loadConI
      NO_RAX_RDX_REGI  100  loadConI
      NO_RBP_R13_REGI  100  loadConI
      STACKSLOTI  200  storeSSI

   --N: o137  ConI  === o0  [[ o895 o262 o302 o906 o976 o1055 o1056 o1156 o1157 o1158 o1159 ]]  #int:18
   IMMI  10  IMMI
   IMMU7  5  IMMU7
   IMMI8  5  IMMI8
   IMMU8  5  IMMU8
   IMMI16  10  IMMI16
   IMMU31  0  IMMU31
   RREGI  100  loadConI
   RAX_REGI  100  loadConI
   RBX_REGI  100  loadConI
   RCX_REGI  100  loadConI
   RDX_REGI  100  loadConI
   RDI_REGI  100  loadConI
   NO_RAX_RDX_REGI  100  loadConI
   NO_RBP_R13_REGI  100  loadConI
   STACKSLOTI  200  storeSSI

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/oracle-work/jdk-fork4/open/src/hotspot/share/opto/matcher.cpp:1727), pid=2026916, tid=2026930
#  assert(false) failed: bad AD file
#
# JRE version: Java(TM) SE Runtime Environment (23.0) (fastdebug build 23-internal-2024-05-22-1054280.emanuel...)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 23-internal-2024-05-22-1054280.emanuel..., mixed mode, tiered, compressed oops, compressed class ptrs, g1 gc, linux-amd64)
# Problematic frame:
# V  [libjvm.so+0x134c5da]  Matcher::Label_Root(Node const*, State*, Node*, Node*&)+0x87a
#
# Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /oracle-work/jdk-fork2/build/linux-x64-debug/jdk/bin/core.2026916)
#
# An error report file with more information is saved as:
# /oracle-work/jdk-fork2/build/linux-x64-debug/jdk/bin/hs_err_pid2026916.log
#
# Compiler replay data is saved as:
# /oracle-work/jdk-fork2/build/linux-x64-debug/jdk/bin/replay_pid2026916.log
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#
Aborted (core dumped)