JDK-8351008 : C2 crash: assert(bol->Opcode() == Op_Bool) failed: Unexpected node
  • Type: Bug
  • Component: hotspot
  • Sub-Component: compiler
  • Affected Version: 25
  • Priority: P2
  • Status: Closed
  • Resolution: Duplicate
  • CPU: x86_64,aarch64
  • Submitted: 2025-03-02
  • Updated: 2025-03-07
  • Resolved: 2025-03-07
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 25
25Resolved
Related Reports
Causes :  
JDK-8323582 - C2 SuperWord AlignVector: misaligned vector memory access with unaligned native memory
Duplicate :  
JDK-8350756 - C2 SuperWord Multiversioning: remove useless slow loop when the fast loop disappears
Relates :  
JDK-8351392 - C2 crash: failed: Expected Bool, but got OpaqueMultiversioning
Description
Reproduces with attached Test.java and 
"java -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,*Test*::* -XX:-TieredCompilation -Xcomp -XX:PerMethodTrapLimit=0 Test.java"

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  Internal Error (/opt/mach5/mesos/work_dir/slaves/03ecc23a-edd5-4bb5-a333-4ff8ea07fd7c-S717/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/e54e3118-c337-42cd-9cb3-3adabc8d8136/runs/fa08aad9-3748-4d75-8573-8480b07beb93/workspace/open/src/hotspot/share/opto/loopopts.cpp:794), pid=3514564, tid=3514595
#  assert(bol->Opcode() == Op_Bool) failed: Unexpected node
#
# JRE version: Java(TM) SE Runtime Environment (25.0+12) (fastdebug build 25-ea+12-LTS-1321)
# Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 25-ea+12-LTS-1321, mixed mode, sharing, compressed oops, compressed class ptrs, g1 gc, linux-aarch64)
# Problematic frame:
# V  [libjvm.so+0x116e160]  PhaseIdealLoop::conditional_move(Node*)+0xd80
#
# Core dump will be written. Default location: Core dumps may be processed with "/opt/core.sh %p" (or dumping to /tmp/fuzzer.tmp.3JDo0h0ZW5/core.3514564)
#
# If you would like to submit a bug report, please visit:
#   https://bugreport.java.com/bugreport/crash.jsp
#

---------------  S U M M A R Y ------------

Command Line: -XX:+UnlockDiagnosticVMOptions -XX:RepeatCompilation=50 -Xmx1G -XX:+IgnoreUnrecognizedVMOptions -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,*Test*::* -XX:-TieredCompilation -Xbatch -XX:+UnlockDiagnosticVMOptions -XX:+StressLCM -XX:+StressGCM -XX:+StressIGVN -XX:+StressCCP -XX:+StressMacroExpansion -XX:+UnlockExperimentalVMOptions -XX:PerMethodSpecTrapLimit=0 -XX:PerMethodTrapLimit=0 -XX:MaxRAMPercentage=6.25 -Dtest.boot.jdk=/opt/mach5/mesos/work_dir/jib-master/install/jdk/23/37/bundles/linux-aarch64/jdk-23_linux-aarch64_bin.tar.gz/jdk-23 -Djava.io.tmpdir=/opt/mach5/mesos/work_dir/slaves/e32bbe1d-e945-4ded-9d0a-e114d727b0db-S4439/frameworks/1735e8a2-a1db-478c-8104-60c8b0af87dd-0196/executors/f04d0b70-9a57-4137-a5b9-77431e550833/runs/efeafda1-0e6e-4af0-a88a-5017c2facc6c/testoutput/test-support/jtreg_closed_test_hotspot_jtreg_applications_javafuzzer_LongRunningTests_java/tmp Test

Host: AArch64, 8 cores, 30G, Oracle Linux Server release 9.4
Time: Sun Mar  2 00:10:30 2025 UTC elapsed time: 1.014406 seconds (0d 0h 0m 1s)

---------------  T H R E A D  ---------------

Current thread (0x0000ffff98257db0):  JavaThread "C2 CompilerThread0" daemon [_thread_in_native, id=3514595, stack(0x0000ffff7cf1f000,0x0000ffff7d11d000) (2040K)]


Current CompileTask:
C2:1014    4    b        Test::vMeth2 (232 bytes)

Stack: [0x0000ffff7cf1f000,0x0000ffff7d11d000],  sp=0x0000ffff7d117560,  free space=2017k
Native frames: (J=compiled Java code, j=interpreted, Vv=VM code, C=native code)
V  [libjvm.so+0x116e160]  PhaseIdealLoop::conditional_move(Node*)+0xd80  (loopopts.cpp:794)
V  [libjvm.so+0x116ec68]  PhaseIdealLoop::split_if_with_blocks_pre(Node*)+0x274  (loopopts.cpp:1128)
V  [libjvm.so+0x11739cc]  PhaseIdealLoop::split_if_with_blocks(VectorSet&, Node_Stack&)+0x1fc  (loopopts.cpp:1981)
V  [libjvm.so+0x1165518]  PhaseIdealLoop::build_and_optimize()+0xf48  (loopnode.cpp:4904)
V  [libjvm.so+0x8f4a78]  PhaseIdealLoop::optimize(PhaseIterGVN&, LoopOptsMode)+0x2e8  (loopnode.hpp:1154)
V  [libjvm.so+0x8edfc8]  Compile::optimize_loops(PhaseIterGVN&, LoopOptsMode)+0x58  (compile.cpp:2173)
V  [libjvm.so+0x8eeaf8]  Compile::Optimize()+0x874  (compile.cpp:2418)
V  [libjvm.so+0x8f1ee8]  Compile::Compile(ciEnv*, ciMethod*, int, Options, DirectiveSet*)+0x14b8  (compile.cpp:848)
V  [libjvm.so+0x747a00]  C2Compiler::compile_method(ciEnv*, ciMethod*, int, bool, DirectiveSet*)+0x17c  (c2compiler.cpp:141)
V  [libjvm.so+0x8fec3c]  CompileBroker::invoke_compiler_on_method(CompileTask*)+0x8cc  (compileBroker.cpp:2338)
V  [libjvm.so+0x8ff7fc]  CompileBroker::compiler_thread_loop()+0x58c  (compileBroker.cpp:1975)
V  [libjvm.so+0xd7b9e4]  JavaThread::thread_main_inner()+0xe4  (javaThread.cpp:776)
V  [libjvm.so+0x1627b30]  Thread::call_run()+0xac  (thread.cpp:231)
V  [libjvm.so+0x135a0a4]  thread_native_entry(Thread*)+0x130  (os_linux.cpp:877)
C  [libc.so.6+0x806d8]  start_thread+0x2d8
Comments
[~dholmes] trying it again.
07-03-2025
[~epeter] an issue can only be marked as "Fixed" if there was a changeset committed using that issue's bug id. If this has been fixed by something else then this issue should be closed as a duplicate.
07-03-2025
The reported regression test is fixed now in mainline, and the regression test is integrated as part of JDK-8350756.
06-03-2025
Update: It looks like JDK-8350756 can indeed fix this issue, at least the reported reproducers pass with that patch now. I'm hoping to open the PR for it tomorrow.
03-03-2025
[~thartmann] Thanks for the reduced test! In the logs below, we can clearly see that the inner loop is Multiversion-ed, then the two copies of the inner loop disappear, and we are only left with the multiverion diamond inside the outer loop. That multiversion diamond without the loops lets PhaseIdealLoop::conditional_move run into the assertion. java -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,*Test*::* -XX:-TieredCompilation -Xcomp -XX:PerMethodTrapLimit=0 -XX:+TraceLoopOpts -XX:CompileCommand=TraceAutoVectorization,*::*,ALL TestSimple.java Counted Loop: N138/N114 counted [0,1000),+1 (-1 iters) sfpts={ 106 } Counted Loop: N149/N143 counted [82,9),-1 (-1 iters) Loop: N0/N0 has_sfpt Loop: N138/N114 counted [0,1000),+1 (-1 iters) sfpts={ 106 } Loop: N148/N147 Loop: N149/N143 counted [82,9),-1 (-1 iters) has_sfpt strip_mined Multiversion Loop: N149/N143 counted [82,9),-1 (2147483648 iters) has_sfpt strip_mined PreMainPost Loop: N149/N143 counted [82,9),-1 (2147483648 iters) multiversion_fast has_sfpt strip_mined Unroll 2 Loop: N149/N143 counted [int,9),-1 (2147483648 iters) main multiversion_fast has_sfpt strip_mined Loop: N0/N0 has_sfpt Loop: N138/N114 counted [0,1000),+1 (-1 iters) sfpts={ 106 } Loop: N174/N175 sfpts={ 177 } Loop: N167/N172 counted [82,9),-1 (2147483648 iters) rc multiversion_delayed_slow has_sfpt strip_mined Loop: N231/N236 counted [82,int),-1 (4 iters) pre rc multiversion_fast Loop: N0/N0 has_sfpt Loop: N138/N114 counted [0,1000),+1 (-1 iters) sfpts={ 106 } Loop: N174/N175 sfpts={ 177 } Loop: N167/N172 counted [82,9),-1 (2147483648 iters) rc multiversion_delayed_slow has_sfpt strip_mined Loop: N231/N236 counted [82,int),-1 (4 iters) pre rc multiversion_fast Loop: N0/N0 has_sfpt Loop: N138/N114 counted [0,1000),+1 (-1 iters) rc sfpts={ 106 } # # A fatal error has been detected by the Java Runtime Environment: # # Internal Error (/oracle-work/jdk-fork7/open/src/hotspot/share/opto/loopopts.cpp:794), pid=2925852, tid=2925866 # assert(bol->Opcode() == Op_Bool) failed: Unexpected node # # JRE version: Java(TM) SE Runtime Environment (25.0) (fastdebug build 25-internal-LTS-2025-03-03-0714382.emanuel...) # Java VM: Java HotSpot(TM) 64-Bit Server VM (fastdebug 25-internal-LTS-2025-03-03-0714382.emanuel..., compiled mode, compressed oops, compressed class ptrs, g1 gc, linux-amd64) # Problematic frame: # V [libjvm.so+0x1360d72] PhaseIdealLoop::conditional_move(Node*)+0x10a2 # # Core dump will be written. Default location: Core dumps may be processed with "/usr/share/apport/apport -p%p -s%s -c%c -d%d -P%P -u%u -g%g -- %E" (or dumping to /oracle-work/jdk-fork7/build/linux-x64-debug/jdk/bin/core.2925852) # # An error report file with more information is saved as: # /oracle-work/jdk-fork7/build/linux-x64-debug/jdk/bin/hs_err_pid2925852.log # # Compiler replay data is saved as: # /oracle-work/jdk-fork7/build/linux-x64-debug/jdk/bin/replay_pid2925852.log # # If you would like to submit a bug report, please visit: # https://bugreport.java.com/bugreport/crash.jsp # Aborted (core dumped)
03-03-2025
Reduced version of the test attached. java -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,*TestSimple*::* -XX:-TieredCompilation -Xcomp -XX:PerMethodTrapLimit=0 TestSimple.java
03-03-2025
It looks like the loops on the fast and slow path disappear, need to investigate why exactly. Then we get a diamond with the OpaqueMultiversioning, and we try to cmove it in the next loop-opts phase. I think that JDK-8350756 could help here: if we mark the OpaqueMultiversioning as useless and remove it, then we should not land in PhaseIdealLoop::conditional_move with a OpaqueMultiversioning that is still useful.
03-03-2025
I had a quick look, we fail here, we get a "OpaqueMultiversioning" instead of "Bool": Node* bol = iff->in(1); assert(!bol->is_OpaqueInitializedAssertionPredicate(), "Initialized Assertion Predicates cannot form a diamond with Halt"); if (bol->is_OpaqueTemplateAssertionPredicate()) { // Ignore Template Assertion Predicates with OpaqueTemplateAssertionPredicate nodes. return nullptr; } assert(bol->Opcode() == Op_Bool, "Unexpected node"); int cmp_op = bol->in(1)->Opcode(); if (cmp_op == Op_SubTypeCheck) { // SubTypeCheck expansion expects an IfNode return nullptr; } It seems that there are already other "predicate" related cases here that made issues in the past. Maybe we just have to add another exception. And we should probably add some product check for the assert and bail out of the optimization as well. I need to look a bit closer at why the diamond shape exists here with the "OpaqueMultiversioning" as the "iff" condition.
03-03-2025
Reproduces easily with: "java -XX:CompileCommand=quiet -XX:CompileCommand=compileonly,*Test*::* -XX:-TieredCompilation -Xcomp -XX:PerMethodTrapLimit=0 Test.java" It's a regression from JDK-8323582. Workaround: "-XX:ConditionalMoveLimit=0" ILW = Assert during C2 compilation due to unexpected node, easy to reproduce with fuzzer generated Test at tier6 and tier8, -XX:ConditionalMoveLimit=0 = HMM = P2
03-03-2025