RFR(XS) 8057758: Tests run TypeProfileLevel=222 crash with guarantee(0) failed: must find derived/base pair

[Vladimir Kozlov]

Thank you, Igor

Vladimir

On 9/9/14 3:06 PM, Igor Veresov wrote:
> Looks good.
>
> igor
>
> On Sep 9, 2014, at 11:50 AM, Vladimir Kozlov <vladimir.kozlov at oracle.com> wrote:
>
>> http://cr.openjdk.java.net/~kvn/8057758/webrev/
>> https://bugs.openjdk.java.net/browse/JDK-8057758
>>
>> The problem evaluation and fix were done by Roland:
>>
>> "Crash goes away when run with -XX:-UseMultiplyToLenIntrinsic.
>> After intrinsification of MultiplyToLen, type speculation registers the fact that profiling reported non null objects being returned. It adds a CheckCastPP node for that. The MultiplyToLen sets its return type to TypeAryPtr::INTS. The CheckCastPP that is created by type speculation casts the non speculative type to TypeAryPtr::INTS which has an offset of Type::OffsetBot. Even after the speculative part of the CheckCastPP is removed, the CheckCastPP is not optimized out and the buildOopMap code wrongly assumes the result of the CheckCastPP to be a derived pointer."
>>
>> Use TypeAryPtr::INT type with offset 0.
>>
>> Thanks,
>> Vladimir
>